Merge pull request #1567 from kernelkit/kernel-upgrade-c7cf8e8a-c974-4873-a74d-00042e95b98b

Upgrade to kernel 6.18.39
Upgrade Linux kernel to 6.18.39
2026-07-23 09:23:02 +02:00 · 2026-07-18 20:16:26 +02:00 · 2026-07-18 15:42:43 +00:00 · 2026-07-16 13:09:16 +02:00 · 2026-07-16 10:53:11 +02:00 · 2026-07-06 09:37:21 +02:00
1003 changed files with 3387 additions and 314187 deletions
@@ -78,7 +78,7 @@ jobs:

      - name: Configure ${{ matrix.defconfig }}_defconfig
        run: |
-          make ${{ matrix.defconfig }}_defconfig
+          make ${{ matrix.defconfig }}_defconfig apply-mirror

      - name: Build ${{ matrix.defconfig }}_defconfig
        run: |
@@ -173,7 +173,7 @@ jobs:
          export BUILD_DIR=$PWD/build
          export BR2_EXTERNAL_INFIX_PATH=$PWD
          export RELEASE=""
-          export INFIX_ID="infix"
+          export IX_ID="infix"

          for target in $TARGETS; do
            export BINARIES_DIR=$PWD/output_${target}/images
@@ -54,7 +54,7 @@ jobs:
        run: |
          target=${{ matrix.target }}_defconfig
          echo "Building $target ..."
-          make $target
+          make $target apply-mirror
          make

      - name: Generate SBOM from Build
@@ -70,6 +70,25 @@ jobs:
        run: |
          make test-spec

+      # rootfs.squashfs is still present here; it is stripped from the
+      # tarball below.  mkimage pulls the rpi64 bootloader from the
+      # latest-boot release and uses the freshly built host genimage.
+      - name: Build Raspberry Pi image
+        if: matrix.target == 'aarch64'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          ./utils/mkimage.sh -d -r output raspberrypi-rpi64
+          mkdir -p rpi-image
+          mv output/images/*-rpi64-sdcard.img rpi-image/
+          xz -T0 rpi-image/*-rpi64-sdcard.img
+
+      - uses: actions/upload-artifact@v7
+        if: matrix.target == 'aarch64'
+        with:
+          name: artifact-rpi64-image
+          path: rpi-image/*.img.xz
+
      - name: Prepare Artifacts
        run: |
          cd output/
@@ -98,3 +117,8 @@ jobs:
        with:
          name: artifact-disk-image-${{ matrix.target }}
          path: output/images/*.qcow2
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: artifact-pkg-${{ matrix.target }}
+          path: output/images/*.pkg
@@ -129,7 +129,7 @@ jobs:

      - name: Configure ${{ env.TARGET }}
        run: |
-          make ${{ env.TARGET }}_defconfig
+          make ${{ env.TARGET }}_defconfig apply-mirror

      - name: Cleanup stale containers and ports
        run: |
@@ -95,7 +95,7 @@ jobs:
          makeLatest: ${{ steps.rel.outputs.latest }}
          discussionCategory: ${{ steps.rel.outputs.cat }}
          bodyFile: release.md
-          artifacts: "*.tar.gz,*.qcow2"
+          artifacts: "*.tar.gz,*.qcow2,*.pkg,*.img.xz"

      - name: Summary
        run: |
@@ -2,7 +2,7 @@ source "$BR2_EXTERNAL_INFIX_PATH/board/Config.in"

 menu "Branding"

-config INFIX_VENDOR
+config IX_VENDOR
 	string "Vendor name"
 	default "KernelKit"
 	help
@@ -15,7 +15,7 @@ config INFIX_VENDOR

 	  Used for VENDOR_NAME in /etc/os-release and GNS3 appliance files.

-config INFIX_VENDOR_HOME
+config IX_VENDOR_HOME
 	string "Vendor URL"
 	help
 	  The homepage of the OS vendor.  The value should be in RFC3986
@@ -24,14 +24,14 @@ config INFIX_VENDOR_HOME

 	  Optional, used for VENDOR_HOME in /etc/os-release

-config INFIX_NAME
+config IX_NAME
 	string "Operating system name"
 	default "Infix"
 	help
 	  Mandatory.  Used for identifying the OS as NAME in /etc/os-release
 	  and product_name in GNS3 appliance files.

-config INFIX_ID
+config IX_ID
 	string "Operating system identifier"
 	default "infix"
 	help
@@ -43,9 +43,9 @@ config INFIX_ID
 	  Mandatory.  Used for identifying the OS as ID in /etc/os-release and
 	  in the generated image name: ID-ARCH-VERSION.img

-config INFIX_IMAGE_ID
+config IX_IMAGE_ID
 	string "Operating system image name"
-	default "${INFIX_ID}-${BR2_ARCH}"
+	default "${IX_ID}-${BR2_ARCH}"
 	help
 	  A lower-case string (no spaces or other characters outside of 0–9,
 	  a–z, ".", "_" and "-"), for naming critical image files, directories
@@ -54,18 +54,18 @@ config INFIX_IMAGE_ID
 	  Mandatory.  When INFIX_RELEASE is set, this string is appended to
 	  the IMAGE_ID with a '-' separator.

-config INFIX_COMPATIBLE
+config IX_COMPATIBLE
 	string "Operating system compatible string"
-	default "${INFIX_IMAGE_ID}"
+	default "${IX_IMAGE_ID}"
 	help
 	  A lower-case string (no spaces or other characters outside of 0–9,
 	  a–z, ".", "_" and "-"), used for image identification at upgrade.
 	  E.g., the RAUC [system] compatible string.

-	  Mandatory.  Defaults to $INFIX_IMAGE_ID, which in turn is composed
-	  of $INFIX_ID-$BR2_ARCH.
+	  Mandatory.  Defaults to $IX_IMAGE_ID, which in turn is composed
+	  of $IX_ID-$BR2_ARCH.

-config INFIX_TAGLINE
+config IX_TAGLINE
 	string "Operating system tagline"
 	default "Infix OS — Immutable.Friendly.Secure"
 	help
@@ -74,25 +74,25 @@ config INFIX_TAGLINE

 	  This is also show at boot when the system init process starts.

-config INFIX_DESC
+config IX_DESC
 	string "Operating system description"
 	help
 	  Optional.  Used for long description texts about the OS.  E.g.,
 	  the GNS3 appliance file description field.  Saved in the file
-	  /etc/os-release as INFIX_DESC.
+	  /etc/os-release as IX_DESC.

-config INFIX_HOME
+config IX_HOME
 	string "Operating system URL"
 	help
 	  Used for identifying the OS, e.g. as HOME_URL in /etc/os-release

-config INFIX_DOC
+config IX_DOC
 	string "Operating system docs"
 	help
 	  Optional.  Main documentation URL, will be shown in /etc/os-release
 	  as DOCUMENTATION_URL.

-config INFIX_SUPPORT
+config IX_SUPPORT
 	string "Operating system support"
 	help
 	  Main support page for the operating system, if there is any.  This
@@ -102,22 +102,23 @@ config INFIX_SUPPORT
 	  Optional.  Shown, e.g., as SUPPORT_URL in /etc/os-release or
 	  maintainer_email in .gns3a.

-config INFIX_OEM_PATH
+config IX_OEM_PATH
 	string "Path to OEM br2-external"
 	help
 	  A br2-external using Infix will likely want to version the branded
 	  OS using their own GIT tags.  Set this variable to point to the base
 	  directory (absolute path) and the Infix post-build.sh will call `git
-	  describe -C $INFIX_OEM_PATH`.
+	  describe -C $IX_OEM_PATH`.

-	  Note: for release builds the global variable INFIX_RELEASE overrides
-	  the version information derived from `git describe`.  However, the
-	  GIT version is always saved as the BUILD_ID in /etc/os-releases.
+	  Note: the OS version (VERSION, VERSION_ID, BUILD_ID in
+	  /etc/os-release) is always derived from `git describe`.  The global
+	  variable INFIX_RELEASE does not change it; it only labels the release
+	  channel (IMAGE_VERSION) and names the published artifacts.

 endmenu

 # For /etc/os-release, uses CondtionArchitechture= from systemd.unit(5)
-config INFIX_ARCH
+config IX_ARCH
 	string
 	default "arm"     if BR2_arm
 	default "arm64"   if BR2_aarch64
@@ -22,7 +22,7 @@ image var.ext4 {
        }
 }

-image #INFIX_ID##VERSION#-vero-w-#TARGET#.img {
+image #IX_ID##VERSION#-vero-w-#TARGET#.img {
        hdimage {
                partition-table-type = "gpt"
                gpt-no-backup = true
@@ -24,7 +24,7 @@ image var.ext4 {
        }
 }

-image #INFIX_ID##VERSION#-bpi-r3-#TARGET#.img {
+image #IX_ID##VERSION#-bpi-r3-#TARGET#.img {
        hdimage {
                partition-table-type = "gpt"

@@ -24,7 +24,7 @@ image var.ext4 {
        }
 }

-image #INFIX_ID##VERSION#-bpi-r4-#TARGET#.img {
+image #IX_ID##VERSION#-bpi-r4-#TARGET#.img {
        hdimage {
                partition-table-type = "gpt"
                gpt-no-backup = true
@@ -24,7 +24,7 @@ image var.ext4 {
        }
 }

-image #INFIX_ID##VERSION#-bpi-r64-#TARGET#.img {
+image #IX_ID##VERSION#-bpi-r64-#TARGET#.img {
        hdimage {
                partition-table-type = "hybrid"
                # MT7622 TF-A partition driver detects GPT by checking MBR[0]
@@ -26,7 +26,7 @@ image var.ext4 {
 	}
 }

-image #INFIX_ID##VERSION#-nanopi-r2s-sdcard.img {
+image #IX_ID##VERSION#-nanopi-r2s-sdcard.img {
 	hdimage {
 		partition-table-type = "gpt"
 	}
@@ -24,7 +24,7 @@ image var.ext4 {
        }
 }

-image #INFIX_ID##VERSION#-espressobin-#TARGET#.img {
+image #IX_ID##VERSION#-espressobin-#TARGET#.img {
        hdimage {
                partition-table-type = "gpt"
        }
@@ -36,7 +36,7 @@ image var.ext4 {
 	}
 }

-image #INFIX_ID##VERSION#-rpi64-sdcard.img {
+image #IX_ID##VERSION#-rpi64-sdcard.img {
 	hdimage {
 		partition-table-type = "hybrid"
 	}
@@ -39,7 +39,7 @@ image var.ext4 {
 	}
 }

-image #INFIX_ID##VERSION#-sama7g54-ek-#TARGET#.img {
+image #IX_ID##VERSION#-sama7g54-ek-#TARGET#.img {
 	hdimage {
 		partition-table-type = "hybrid"
 	}
@@ -36,7 +36,7 @@ image var.ext4 {
 	}
 }

-image #INFIX_ID##VERSION#-rpi2-sdcard.img {
+image #IX_ID##VERSION#-rpi2-sdcard.img {
 	hdimage {
 		partition-table-type = "hybrid"
 	}
@@ -11,7 +11,7 @@ source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-readme/Config.in"

 endmenu

-config QEMU_SCRIPTS
+config IX_QEMU_SCRIPTS
 	bool "QEMU scripts"
 	default y
 	help
@@ -19,20 +19,20 @@ config QEMU_SCRIPTS
 	  directory, which can be used to launch virtual Infix
 	  instances.

-menuconfig TRUSTED_KEYS
+menuconfig IX_TRUSTED_KEYS
 	bool "Trusted keys for image"
 	help
 	 Keys that will be accepted for this image

-config TRUSTED_KEYS_DEVELOPMENT
+config IX_TRUSTED_KEYS_DEVELOPMENT
 	bool "Development key"
-	depends on TRUSTED_KEYS
+	depends on IX_TRUSTED_KEYS

-config TRUSTED_KEYS_DEVELOPMENT_PATH
+config IX_TRUSTED_KEYS_DEVELOPMENT_PATH
 	string
-	depends on TRUSTED_KEYS_DEVELOPMENT
+	depends on IX_TRUSTED_KEYS_DEVELOPMENT
 	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"

-config TRUSTED_KEYS_EXTRA_PATH
+config IX_TRUSTED_KEYS_EXTRA_PATH
 	string "Path to extra keys to include in image"
-	depends on TRUSTED_KEYS
+	depends on IX_TRUSTED_KEYS
@@ -1,14 +1,14 @@
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/image/image.mk
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/qemu/qemu.mk

-ifeq ($(TRUSTED_KEYS),y)
+ifeq ($(IX_TRUSTED_KEYS),y)
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk

-TRUSTED_KEYS=$(TRUSTED_KEYS_DEVELOPMENT_PATH) $(TRUSTED_KEYS_EXTRA_PATH)
+IX_TRUSTED_KEYS=$(IX_TRUSTED_KEYS_DEVELOPMENT_PATH) $(IX_TRUSTED_KEYS_EXTRA_PATH)
 define RAUC_POST_BUILD_INSTALL_CERT
 	@$(call IXMSG,"Installing signing cert for RAUC")
 	mkdir -p $(TARGET_DIR)/etc/rauc/keys
-	$(foreach crt,$(shell ls $(TRUSTED_KEYS)), \
+	$(foreach crt,$(shell ls $(IX_TRUSTED_KEYS)), \
 		cp $(crt) $(TARGET_DIR)/etc/rauc/keys/$(shell openssl x509 -hash -noout <$(crt)).0;)

 endef
@@ -1,4 +1,4 @@
-config IMAGE_EXT4_RAUC
+config IX_IMAGE_EXT4_RAUC
 	bool "RAUC upgrade bundle (ext4)"
 	depends on BR2_TARGET_ROOTFS_EXT2
 	select BR2_PACKAGE_HOST_RAUC
@@ -7,17 +7,17 @@ config IMAGE_EXT4_RAUC
 	  image.  Intended for development boards whose bootloader does
 	  not support squashfs.

-config IMAGE_EXT4_RAUC_KEY
+config IX_IMAGE_EXT4_RAUC_KEY
 	string "signing key"
-	depends on IMAGE_EXT4_RAUC
+	depends on IX_IMAGE_EXT4_RAUC
 	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
 	help
 	  Path to the private key, in PKCS#8 format, used to sign
 	  the RAUC bundle; or a PKCS#11 URI.

-config IMAGE_EXT4_RAUC_CERT
+config IX_IMAGE_EXT4_RAUC_CERT
 	string "signing certificate"
-	depends on IMAGE_EXT4_RAUC
+	depends on IX_IMAGE_EXT4_RAUC
 	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
 	help
 	  Path to the X509 certificate which will be associated with
@@ -1,6 +1,6 @@
-config IMAGE_ITB_AUX
+config IX_IMAGE_ITB_AUX
 	bool "aux partition"
-	depends on IMAGE_ITB_ROOTFS
+	depends on IX_IMAGE_ITB_ROOTFS
 	select BR2_PACKAGE_HOST_UBOOT_TOOLS
 	select BR2_PACKAGE_HOST_GENIMAGE
 	help
@@ -1,4 +1,4 @@
-menuconfig IMAGE_ITB_DL_RELEASE
+menuconfig IX_IMAGE_ITB_DL_RELEASE
 	bool "Download existing release"
 	depends on !BR2_TARGET_ROOTFS_SQUASHFS
 	help
@@ -7,9 +7,9 @@ menuconfig IMAGE_ITB_DL_RELEASE
 	  Infix image, to create a full disk image that can be
 	  provisioned to an SD-card or eMMC.

-config IMAGE_ITB_DL_RELEASE_URL
+config IX_IMAGE_ITB_DL_RELEASE_URL
 	string "URL"
-	depends on IMAGE_ITB_DL_RELEASE
+	depends on IX_IMAGE_ITB_DL_RELEASE
 	default "https://github.com/kernelkit/infix/releases/download/latest/infix-${BR2_ARCH}.tar.gz"
 	help
 	  URL to release tarball.
@@ -1,23 +1,23 @@
-menuconfig IMAGE_ITB_GNS3A
+menuconfig IX_IMAGE_ITB_GNS3A
 	bool "GNS3 Appliance (ITB)"
 	depends on BR2_x86_64
-	select IMAGE_ITB_QCOW
+	select IX_IMAGE_ITB_QCOW
 	help
 	  Create a GNS3 appliance description that, together with the
 	  disk image, can be imported into GNS3.

-config IMAGE_ITB_GNS3A_RAM
+config IX_IMAGE_ITB_GNS3A_RAM
 	int "Reserved RAM (MiB)"
-	depends on IMAGE_ITB_GNS3A
+	depends on IX_IMAGE_ITB_GNS3A
 	default "192"
 	help
 	  Amount of host RAM reserved for an appliance instance.

 	  Minimum supported size is 192M.

-config IMAGE_ITB_GNS3A_IFNUM
+config IX_IMAGE_ITB_GNS3A_IFNUM
 	int "Number of interfaces"
-	depends on IMAGE_ITB_GNS3A
+	depends on IX_IMAGE_ITB_GNS3A
 	default "1"
 	help
 	  Number of Ethernet interfaces to create for an appliance instance.
@@ -1,6 +1,6 @@
-menuconfig IMAGE_ITB_QCOW
+menuconfig IX_IMAGE_ITB_QCOW
 	bool "QEMU disk image (ITB)"
-	depends on (IMAGE_ITB_ROOTFS && IMAGE_ITB_AUX) || IMAGE_ITB_DL_RELEASE
+	depends on (IX_IMAGE_ITB_ROOTFS && IX_IMAGE_ITB_AUX) || IX_IMAGE_ITB_DL_RELEASE
 	select BR2_PACKAGE_HOST_GENIMAGE
 	help
 	  Compose a full disk image with redundant Linux OS partitions,
@@ -11,9 +11,9 @@ menuconfig IMAGE_ITB_QCOW
 	  - Creating a GNS3 appliance
 	  - Developing/debugging issues in the boot process in QEMU

-menuconfig IMAGE_ITB_QCOW_SIZE
+menuconfig IX_IMAGE_ITB_QCOW_SIZE
 	string "Image size"
-	depends on IMAGE_ITB_QCOW
+	depends on IX_IMAGE_ITB_QCOW
 	default "512M"
 	help
 	  Create a disk image of this size.  A K/M/G suffix may be used
@@ -26,22 +26,22 @@ menuconfig IMAGE_ITB_QCOW_SIZE

 choice
 	prompt "Bootloader"
-	depends on IMAGE_ITB_QCOW
-	default IMAGE_ITB_QCOW_BOOT_EFI if BR2_x86_64
-	default IMAGE_ITB_QCOW_BOOT_NONE
+	depends on IX_IMAGE_ITB_QCOW
+	default IX_IMAGE_ITB_QCOW_BOOT_EFI if BR2_x86_64
+	default IX_IMAGE_ITB_QCOW_BOOT_NONE

-config IMAGE_ITB_QCOW_BOOT_NONE
+config IX_IMAGE_ITB_QCOW_BOOT_NONE
 	bool "None"
 	help
 	  Do not create any bootloader partition in the disk image.

-config IMAGE_ITB_QCOW_BOOT_EFI
+config IX_IMAGE_ITB_QCOW_BOOT_EFI
 	bool "EFI"
 	help
 	  Create a boot partition from a directory containing an EFI
 	  boot application, e.g. GRUB.

-config IMAGE_ITB_QCOW_BOOT_BIN
+config IX_IMAGE_ITB_QCOW_BOOT_BIN
 	bool "Binary"
 	help
 	  Create a boot partition from a raw image containing the boot
@@ -49,18 +49,18 @@ config IMAGE_ITB_QCOW_BOOT_BIN

 endchoice

-config IMAGE_ITB_QCOW_BOOT_DATA
+config IX_IMAGE_ITB_QCOW_BOOT_DATA
 	string "Bootloader data"
-	depends on IMAGE_ITB_QCOW
-	depends on IMAGE_ITB_QCOW_BOOT_EFI || IMAGE_ITB_QCOW_BOOT_BIN
+	depends on IX_IMAGE_ITB_QCOW
+	depends on IX_IMAGE_ITB_QCOW_BOOT_EFI || IX_IMAGE_ITB_QCOW_BOOT_BIN
 	default "${BINARIES_DIR}/efi-part/EFI" if BR2_x86_64
 	help
 	  Path to the directory or file holding the bootloader data.

-config IMAGE_ITB_QCOW_BOOT_OFFSET
+config IX_IMAGE_ITB_QCOW_BOOT_OFFSET
 	hex "Bootloader offset"
-	depends on IMAGE_ITB_QCOW
-	depends on IMAGE_ITB_QCOW_BOOT_EFI || IMAGE_ITB_QCOW_BOOT_BIN
+	depends on IX_IMAGE_ITB_QCOW
+	depends on IX_IMAGE_ITB_QCOW_BOOT_EFI || IX_IMAGE_ITB_QCOW_BOOT_BIN
 	default 0x8000
 	help
 	  Offset at which the bootloader partition is placed. Remember
@@ -6,8 +6,8 @@

 # We can source the rootfs+aux from a local build, or from a
 # downloaded release; so adjust our dependencies accordingly.
-IMAGE_ITB_QCOW_SRC-$(IMAGE_ITB_ROOTFS)     := image-itb-rootfs image-itb-aux
-IMAGE_ITB_QCOW_SRC-$(IMAGE_ITB_DL_RELEASE) := image-itb-dl-release
+IMAGE_ITB_QCOW_SRC-$(IX_IMAGE_ITB_ROOTFS)     := image-itb-rootfs image-itb-aux
+IMAGE_ITB_QCOW_SRC-$(IX_IMAGE_ITB_DL_RELEASE) := image-itb-dl-release

 IMAGE_ITB_QCOW_DEPENDENCIES := host-genimage $(IMAGE_ITB_QCOW_SRC-y)
 IMAGE_ITB_QCOW_CONFIG_VARS := BOOT_DATA BOOT_OFFSET SIZE
@@ -1,23 +1,23 @@
-menuconfig IMAGE_ITB_RAUC
+menuconfig IX_IMAGE_ITB_RAUC
 	bool "RAUC upgrade bundle (ITB)"
-	select IMAGE_ITB_ROOTFS
+	select IX_IMAGE_ITB_ROOTFS
 	select BR2_PACKAGE_HOST_RAUC
 	help
 	  Create RAUC upgrade bundle, for targets using ITB images,
 	  that can be used to upgrade a running system to this version
 	  of Infix.

-config IMAGE_ITB_RAUC_KEY
+config IX_IMAGE_ITB_RAUC_KEY
 	string "signing key"
-	depends on IMAGE_ITB_RAUC
+	depends on IX_IMAGE_ITB_RAUC
 	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
 	help
 	  Path to the private key, in PKCS#8 format, used to sign
 	  the RAUC bundle; or a PKCS#11 URI.

-config IMAGE_ITB_RAUC_CERT
+config IX_IMAGE_ITB_RAUC_CERT
 	string "signing certificate"
-	depends on IMAGE_ITB_RAUC
+	depends on IX_IMAGE_ITB_RAUC
 	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
 	help
 	  Path to the X509 certificate which will be associated with
@@ -1,4 +1,4 @@
-menuconfig IMAGE_ITB_ROOTFS
+menuconfig IX_IMAGE_ITB_ROOTFS
 	bool "rootfs.itb+.itbh"
 	select BR2_TARGET_ROOTFS_SQUASHFS
 	select BR2_PACKAGE_HOST_UBOOT_TOOLS
@@ -7,9 +7,9 @@ menuconfig IMAGE_ITB_ROOTFS
 	  and extract detached header (.itbh) for U-Boot based
 	  targets.

-config IMAGE_ITB_ROOTFS_KEY
+config IX_IMAGE_ITB_ROOTFS_KEY
 	string "signing key"
-	depends on IMAGE_ITB_ROOTFS
+	depends on IX_IMAGE_ITB_ROOTFS
 	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
 	help
 	  Path to the private RSA key, in PKCS#8 format, used to sign
@@ -1,4 +1,4 @@
-config IMAGE_README
+config IX_IMAGE_README
 	bool "Install README.md in images"
 	help
 	  Install a README.md with useful information about getting
@@ -13,6 +13,6 @@ $(BINARIES_DIR)/README.md: $(IMAGE_README_DIR)/README.md
 	@mkdir -p $(BINARIES_DIR)
 	@cp $< $@

-ifeq ($(IMAGE_README),y)
+ifeq ($(IX_IMAGE_README),y)
 TARGETS_ROOTFS += image-readme
 endif
@@ -12,15 +12,17 @@ $(1): $$($(2)_DEPENDENCIES)
 	BINARIES_DIR=$$(BINARIES_DIR) \
 	BR2_EXTERNAL_INFIX_PATH=$$(BR2_EXTERNAL_INFIX_PATH) \
 	ARTIFACT=$$(INFIX_ARTIFACT) \
-	COMPATIBLE=$$(INFIX_COMPATIBLE) \
+	COMPATIBLE=$$(IX_COMPATIBLE) \
 	VERSION=$$(INFIX_VERSION) \
-	$$(foreach var,$$($(2)_CONFIG_VARS),$$(var)=$$($(2)_$$(var)) ) \
+	$$(foreach var,$$($(2)_CONFIG_VARS),$$(var)=$$($(3)_$$(var)) ) \
 	$$($(2)_DIR)/generate.sh $$($(2)_OPTS)

-ifeq ($$($(2)),y)
+ifeq ($$($(3)),y)
 TARGETS_ROOTFS += $(1)
 endif

 endef

-ix-image = $(call inner-ix-image,$(pkgname),$(call UPPERCASE,$(pkgname)))
+# $(2) is the package-local make-var prefix (UPPERCASE pkgname); $(3) is
+# the IX_ prefixed Kconfig symbol name, see issue #1305.
+ix-image = $(call inner-ix-image,$(pkgname),$(call UPPERCASE,$(pkgname)),IX_$(call UPPERCASE,$(pkgname)))
@@ -16,7 +16,7 @@ die()
 #      DISK_IMAGE_SIZE="512"
 #      etc.
 #
-# Nested variables, like INFIX_COMPATIBLE="${INFIX_IMAGE_ID}"
+# Nested variables, like IX_COMPATIBLE="${IX_IMAGE_ID}"
 # are handled by sourcing the file in a subshell.
 #
 # shellcheck disable=SC1090
@@ -37,7 +37,7 @@ EOF
 }

 if [ -f "$TARGET_DIR/etc/rauc/system.conf" ]; then
-    sed -i "s/compatible=.*/compatible=$INFIX_COMPATIBLE/" "$TARGET_DIR/etc/rauc/system.conf"
+    sed -i "s/compatible=.*/compatible=$IX_COMPATIBLE/" "$TARGET_DIR/etc/rauc/system.conf"
 fi

 if [ -n "${ID_LIKE}" ]; then
@@ -53,40 +53,40 @@ cp "$TARGET_DIR/etc/hostname" "$TARGET_DIR/etc/hostname.d/10-default"
 ixmsg "Creating /etc/os-release"
 rm -f "$TARGET_DIR/etc/os-release"
 {
-    echo "NAME=\"$INFIX_NAME\""
-    echo "ID=$INFIX_ID"
-    echo "PRETTY_NAME=\"$INFIX_TAGLINE $INFIX_VERSION\""
+    echo "NAME=\"$IX_NAME\""
+    echo "ID=$IX_ID"
+    echo "PRETTY_NAME=\"$IX_TAGLINE $INFIX_VERSION\""
    echo "ID_LIKE=\"${ID}\""
    echo "DEFAULT_HOSTNAME=$BR2_TARGET_GENERIC_HOSTNAME"
    echo "VERSION=\"${INFIX_VERSION}\""
    echo "VERSION_ID=${INFIX_VERSION}"
    echo "BUILD_ID=\"${INFIX_BUILD_ID}\""
-    if [ -n "$INFIX_IMAGE_ID" ]; then
-	echo "IMAGE_ID=\"$INFIX_IMAGE_ID\""
+    if [ -n "$IX_IMAGE_ID" ]; then
+	echo "IMAGE_ID=\"$IX_IMAGE_ID\""
    fi
    if [ -n "$INFIX_RELEASE" ]; then
 	echo "IMAGE_VERSION=\"$INFIX_RELEASE\""
    fi
-    echo "ARCHITECTURE=\"${INFIX_ARCH}\""
-    echo "HOME_URL=$INFIX_HOME"
-    if [ -n "$INFIX_VENDOR" ]; then
-	echo "VENDOR_NAME=\"$INFIX_VENDOR\""
+    echo "ARCHITECTURE=\"${IX_ARCH}\""
+    echo "HOME_URL=$IX_HOME"
+    if [ -n "$IX_VENDOR" ]; then
+	echo "VENDOR_NAME=\"$IX_VENDOR\""
    fi
-    if [ -n "$INFIX_VENDOR_HOME" ]; then
-	echo "VENDOR_HOME=\"$INFIX_VENDOR_HOME\""
+    if [ -n "$IX_VENDOR_HOME" ]; then
+	echo "VENDOR_HOME=\"$IX_VENDOR_HOME\""
    fi
-    if [ -n "$INFIX_DOC" ]; then
-	echo "DOCUMENTATION_URL=\"$INFIX_DOC\""
+    if [ -n "$IX_DOC" ]; then
+	echo "DOCUMENTATION_URL=\"$IX_DOC\""
    fi
-    if [ -n "$INFIX_SUPPORT" ]; then
-	echo "SUPPORT_URL=\"$INFIX_SUPPORT\""
+    if [ -n "$IX_SUPPORT" ]; then
+	echo "SUPPORT_URL=\"$IX_SUPPORT\""
    fi
-    if [ -n "$INFIX_DESC" ]; then
-	echo "INFIX_DESC=\"$INFIX_DESC\""
+    if [ -n "$IX_DESC" ]; then
+	echo "INFIX_DESC=\"$IX_DESC\""
    fi
 } > "$TARGET_DIR/etc/os-release"

-echo "$INFIX_TAGLINE $INFIX_VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"
+echo "$IX_TAGLINE $INFIX_VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"
 ixmsg "Creating /etc/version: $(cat "$TARGET_DIR/etc/version")"

 # In case of ambguities, this is what the image was built from
@@ -1,85 +1,85 @@
 mainmenu "QEMU Virtualization"

-config QEMU_ARCH_IS_32
+config IX_QEMU_ARCH_IS_32
 	bool

-config QEMU_ARCH_IS_64
+config IX_QEMU_ARCH_IS_64
 	bool

 choice
 	prompt "Target Architecture"
 	default @ARCH@

-config QEMU_riscv64
-	bool "risv64"
-	select QEMU_ARCH_IS_64
+config IX_QEMU_riscv64
+	bool "riscv64"
+	select IX_QEMU_ARCH_IS_64

-config QEMU_x86_64
+config IX_QEMU_x86_64
 	bool "x86_64"
-	select QEMU_ARCH_IS_64
+	select IX_QEMU_ARCH_IS_64

-config QEMU_arm
+config IX_QEMU_arm
 	bool "AArch32 (little endian)"
-	select QEMU_ARCH_IS_32
+	select IX_QEMU_ARCH_IS_32

-config QEMU_aarch64
+config IX_QEMU_aarch64
 	bool "AArch64 (little endian)"
-	select QEMU_ARCH_IS_64
+	select IX_QEMU_ARCH_IS_64

 endchoice

 choice
 	prompt "Loader"
-	default QEMU_LOADER_KERNEL
+	default IX_QEMU_LOADER_KERNEL

-config QEMU_LOADER_KERNEL
+config IX_QEMU_LOADER_KERNEL
 	bool "Kernel"

-config QEMU_LOADER_UBOOT
+config IX_QEMU_LOADER_UBOOT
 	bool "U-Boot"
-	depends on QEMU_aarch64
+	depends on IX_QEMU_aarch64

-config QEMU_LOADER_OVMF
+config IX_QEMU_LOADER_OVMF
 	bool "OVMF (UEFI)"
-	depends on QEMU_x86_64
+	depends on IX_QEMU_x86_64

 endchoice

 choice
     prompt "Rootfs type"
-     default QEMU_ROOTFS_INITRD
+     default IX_QEMU_ROOTFS_INITRD

-config QEMU_ROOTFS_MMC
+config IX_QEMU_ROOTFS_MMC
     bool "MMC"
-     depends on QEMU_aarch64
+     depends on IX_QEMU_aarch64

-config QEMU_ROOTFS_INITRD
+config IX_QEMU_ROOTFS_INITRD
     bool "Initrd"
-     depends on QEMU_LOADER_KERNEL
+     depends on IX_QEMU_LOADER_KERNEL

-config QEMU_ROOTFS_VSCSI
+config IX_QEMU_ROOTFS_VSCSI
     bool "Virtio SCSI"

 endchoice

 choice
     prompt "Console"
-     default QEMU_CONSOLE_SERIAL if QEMU_arm
-     default QEMU_CONSOLE_VIRTIO
+     default IX_QEMU_CONSOLE_SERIAL if IX_QEMU_arm
+     default IX_QEMU_CONSOLE_VIRTIO

-config QEMU_CONSOLE_VIRTIO
+config IX_QEMU_CONSOLE_VIRTIO
     bool "Virtio (hvc0)"

-config QEMU_CONSOLE_SERIAL
+config IX_QEMU_CONSOLE_SERIAL
     bool "Serial (ttyS0/ttyAMA0)"
-     depends on !QEMU_LOADER_OVMF
+     depends on !IX_QEMU_LOADER_OVMF
 endchoice

-config QEMU_MACHINE
+config IX_QEMU_MACHINE
 	string "Select emulated machine"
-	default "qemu-system-arm     -M virt,accel=kvm:tcg -cpu max" if QEMU_arm
-	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu cortex-a53" if QEMU_aarch64
-	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if QEMU_x86_64
+	default "qemu-system-arm     -M virt,accel=kvm:tcg -cpu max" if IX_QEMU_arm
+	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu cortex-a53" if IX_QEMU_aarch64
+	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if IX_QEMU_x86_64
 	help
 	  You should not have to change this setting, although you may
 	  want to tweak it, or change the acceleration.
@@ -88,7 +88,7 @@ config QEMU_MACHINE
 	  the defconfig you started with.  Currently Infix supports
 	  arm (AArch32), aarch64 (ARM64), and x86_64 (AMD64).

-config QEMU_MACHINE_RAM
+config IX_QEMU_MACHINE_RAM
 	string "RAM size (k/M/G)"
 	default "448M"
 	help
@@ -96,62 +96,62 @@ config QEMU_MACHINE_RAM
 	  if you get kernel panic with: "System is deadlocked on memory",
 	  try increasing this one.

-config QEMU_KERNEL
+config IX_QEMU_KERNEL
 	string
-	depends on QEMU_LOADER_KERNEL
-	default "../zImage"  if QEMU_arm
-	default "../Image"   if QEMU_aarch64
-	default "../bzImage" if QEMU_x86_64
+	depends on IX_QEMU_LOADER_KERNEL
+	default "../zImage"  if IX_QEMU_arm
+	default "../Image"   if IX_QEMU_aarch64
+	default "../bzImage" if IX_QEMU_x86_64

-config QEMU_BIOS
+config IX_QEMU_BIOS
 	string
-	depends on !QEMU_LOADER_KERNEL
-	default "../u-boot.bin" if QEMU_LOADER_UBOOT
-	default "../OVMF.fd"    if QEMU_LOADER_OVMF
+	depends on !IX_QEMU_LOADER_KERNEL
+	default "../u-boot.bin" if IX_QEMU_LOADER_UBOOT
+	default "../OVMF.fd"    if IX_QEMU_LOADER_OVMF

-config QEMU_ROOTFS
+config IX_QEMU_ROOTFS
 	string
-	default "@DISK_IMG@" if !QEMU_ROOTFS_INITRD
-	default "../rootfs.squashfs" if QEMU_ROOTFS_INITRD
+	default "@DISK_IMG@" if !IX_QEMU_ROOTFS_INITRD
+	default "../rootfs.squashfs" if IX_QEMU_ROOTFS_INITRD

-config QEMU_DTB_EXTEND
+config IX_QEMU_DTB_EXTEND
 	bool
-	depends on QEMU_LOADER_UBOOT
-	default y if QEMU_aarch64
+	depends on IX_QEMU_LOADER_UBOOT
+	default y if IX_QEMU_aarch64

-if QEMU_ROOTFS_INITRD
+if IX_QEMU_ROOTFS_INITRD

-config QEMU_RW
+config IX_QEMU_RW
 	string "Writable /cfg layer"
-	depends on QEMU_ROOTFS_INITRD
+	depends on IX_QEMU_ROOTFS_INITRD
 	default "cfg.ext4"

-config QEMU_RW_VAR_OPT
+config IX_QEMU_RW_VAR_OPT
 	bool "Separate writable /var"

-if QEMU_RW_VAR_OPT
-config QEMU_RW_VAR_SIZE
+if IX_QEMU_RW_VAR_OPT
+config IX_QEMU_RW_VAR_SIZE
 	string "Size of /var"
 	default "256M"
-config QEMU_RW_VAR
+config IX_QEMU_RW_VAR
 	string "Writable /var layer"
 	default "var.ext4"
 endif

 endif

-config QEMU_VPD
+config IX_QEMU_VPD
 	bool "Emulate a Vital Product Data (VPD) Memory"

-config QEMU_HOST
+config IX_QEMU_HOST
 	string "Export host filesystem path"
 	default "/tmp"

-config QEMU_APPEND
+config IX_QEMU_APPEND
 	string "Extra kernel options"
-	depends on !QEMU_ROOTFS_MMC
+	depends on !IX_QEMU_ROOTFS_MMC

-config QEMU_EXTRA
+config IX_QEMU_EXTRA
 	string "Extra QEMU options"


@@ -159,72 +159,72 @@ comment "RTC"

 choice
 	prompt "Mode"
-	default QEMU_RTC_UTC
+	default IX_QEMU_RTC_UTC

-config QEMU_RTC_UTC
+config IX_QEMU_RTC_UTC
 	bool "UTC"

-config QEMU_RTC_LOCAL
+config IX_QEMU_RTC_LOCAL
 	bool "Local time"

-config QEMU_RTC_RANDOM
+config IX_QEMU_RTC_RANDOM
 	bool "Random"

 endchoice

 choice
 	prompt "Clock"
-	default QEMU_CLOCK_HOST
+	default IX_QEMU_CLOCK_HOST

-config QEMU_CLOCK_HOST
+config IX_QEMU_CLOCK_HOST
 	bool "Host clock"

-config QEMU_CLOCK_RT
+config IX_QEMU_CLOCK_RT
 	bool "Independent (monotonic)"

-config QEMU_CLOCK_VM
+config IX_QEMU_CLOCK_VM
 	bool "Virtual"

 endchoice

-config QEMU_RTC
+config IX_QEMU_RTC
 	string
-	default "utc"       if QEMU_RTC_UTC
-	default "localtime" if QEMU_RTC_LOCAL
-	default "random"    if QEMU_RTC_RANDOM
+	default "utc"       if IX_QEMU_RTC_UTC
+	default "localtime" if IX_QEMU_RTC_LOCAL
+	default "random"    if IX_QEMU_RTC_RANDOM

-config QEMU_CLOCK
+config IX_QEMU_CLOCK
 	string
-	default "host"      if QEMU_CLOCK_HOST
-	default "rt"        if QEMU_CLOCK_RT
-	default "vm"        if QEMU_CLOCK_VM
+	default "host"      if IX_QEMU_CLOCK_HOST
+	default "rt"        if IX_QEMU_CLOCK_RT
+	default "vm"        if IX_QEMU_CLOCK_VM

 comment "Networking"

 choice
     prompt "Network Mode"
-     default QEMU_NET_USER
+     default IX_QEMU_NET_USER

-config QEMU_NET_NONE
+config IX_QEMU_NET_NONE
     bool "None"

-config QEMU_NET_BRIDGE
+config IX_QEMU_NET_BRIDGE
     bool "Bridged"

-config QEMU_NET_USER
+config IX_QEMU_NET_USER
     bool "User"

-config QEMU_NET_TAP
+config IX_QEMU_NET_TAP
     bool "TAP"

-config QEMU_NET_ROCKER
+config IX_QEMU_NET_ROCKER
     bool "Rocker"

 endchoice

-config QEMU_NET_MODEL
+config IX_QEMU_NET_MODEL
 	string "Interface model"
-	default "virtio-net-device" if QEMU_arm
+	default "virtio-net-device" if IX_QEMU_arm
 	default "virtio-net-pci"
 	help
 	  The default, virtio-net-pci, NIC works for most use-cases, but
@@ -233,23 +233,23 @@ config QEMU_NET_MODEL

 	  Note: ARM 32-bit uses virtio-net-device (MMIO) by default.

-config QEMU_NET_BRIDGE_DEV
+config IX_QEMU_NET_BRIDGE_DEV
 	string "Bridge device"
-	depends on QEMU_NET_BRIDGE
+	depends on IX_QEMU_NET_BRIDGE
 	default "virbr0"

-config QEMU_NET_USER_OPTS
+config IX_QEMU_NET_USER_OPTS
 	string "User mode options"
-	depends on QEMU_NET_USER
+	depends on IX_QEMU_NET_USER
 	help
 	  Extra -nic user,<OPTIONS>

-config QEMU_NET_TAP_N
+config IX_QEMU_NET_TAP_N
 	int "Number of TAPs"
-	depends on QEMU_NET_TAP
+	depends on IX_QEMU_NET_TAP
 	default 1

-config QEMU_NET_PORTS
+config IX_QEMU_NET_PORTS
 	int "Number of Rocker switch ports"
-	depends on QEMU_NET_ROCKER
+	depends on IX_QEMU_NET_ROCKER
 	default 10
@@ -10,7 +10,7 @@ qemu-kconfig = \
 	BR2_CONFIG="$(BINARIES_DIR)/qemu/.config" \
 	$(BUILD_DIR)/buildroot-config/$(1) $(2) "$(BINARIES_DIR)/qemu/Config.in"

-ifeq ($(QEMU_SCRIPTS),y)
+ifeq ($(IX_QEMU_SCRIPTS),y)

 .PHONY: run
 run:
@@ -33,7 +33,7 @@ $(BINARIES_DIR)/qemu/run.sh: $(QEMU_SCRIPTS_DIR)/run.sh
 $(BINARIES_DIR)/qemu/Config.in: $(QEMU_SCRIPTS_DIR)/Config.in.in
 	@mkdir -p $(dir $@)
 	@sed \
-		-e "s:@ARCH@:QEMU_$(BR2_ARCH):" \
+		-e "s:@ARCH@:IX_QEMU_$(BR2_ARCH):" \
 		-e "s:@DISK_IMG@:../$(INFIX_ARTIFACT).qcow2:" \
 	< $< >$@

@@ -40,7 +40,7 @@ usage()
    echo "  ARGS1  Args before the '--' separator are for kernel space"
    echo "  --     Separator"
    echo "  ARGS2  Args after the '--' separator are for the init process"
-    echo "         Also, qemu.cfg has QEMU_APPEND which can affect this."
+    echo "         Also, qemu.cfg has IX_QEMU_APPEND which can affect this."
    echo
    echo "Example:"
    echo "  $prognm -- finit.debug"
@@ -62,45 +62,45 @@ load_qemucfg()
    # shellcheck disable=SC1090
    .  "./.config"

-    [ "$CONFIG_QEMU_MACHINE" ] || die "Missing QEMU_MACHINE"
-    [ "$CONFIG_QEMU_ROOTFS"  ] || die "Missing QEMU_ROOTFS"
+    [ "$CONFIG_IX_QEMU_MACHINE" ] || die "Missing IX_QEMU_MACHINE"
+    [ "$CONFIG_IX_QEMU_ROOTFS"  ] || die "Missing IX_QEMU_ROOTFS"

-    [ -n "$CONFIG_QEMU_KERNEL" ] && [ -n "$CONFIG_QEMU_BIOS" ] \
-	&& die "QEMU_KERNEL conflicts with QEMU_BIOS"
+    [ -n "$CONFIG_IX_QEMU_KERNEL" ] && [ -n "$CONFIG_IX_QEMU_BIOS" ] \
+	&& die "IX_QEMU_KERNEL conflicts with IX_QEMU_BIOS"

-    [ -z "$CONFIG_QEMU_KERNEL" ] && [ -z "$CONFIG_QEMU_BIOS" ] \
-	&& die "QEMU_KERNEL or QEMU_BIOS must be set"
+    [ -z "$CONFIG_IX_QEMU_KERNEL" ] && [ -z "$CONFIG_IX_QEMU_BIOS" ] \
+	&& die "IX_QEMU_KERNEL or IX_QEMU_BIOS must be set"
 }

 loader_args()
 {
-    if [ "$CONFIG_QEMU_BIOS" ]; then
-	echo -n "-bios $CONFIG_QEMU_BIOS "
-    elif [ "$CONFIG_QEMU_KERNEL" ]; then
-	echo -n "-kernel $CONFIG_QEMU_KERNEL "
+    if [ "$CONFIG_IX_QEMU_BIOS" ]; then
+	echo -n "-bios $CONFIG_IX_QEMU_BIOS "
+    elif [ "$CONFIG_IX_QEMU_KERNEL" ]; then
+	echo -n "-kernel $CONFIG_IX_QEMU_KERNEL "
    fi
 }

 append_args()
 {
    # ARM 32-bit doesn't support virtio console properly, always use serial
-    if [ "$CONFIG_QEMU_arm" ]; then
+    if [ "$CONFIG_IX_QEMU_arm" ]; then
 	echo -n "console=ttyAMA0 "
-    elif [ "$CONFIG_QEMU_CONSOLE_VIRTIO" ]; then
+    elif [ "$CONFIG_IX_QEMU_CONSOLE_VIRTIO" ]; then
 	echo -n "console=hvc0 "
-    elif [ "$CONFIG_QEMU_x86_64" ]; then
+    elif [ "$CONFIG_IX_QEMU_x86_64" ]; then
 	echo -n "console=ttyS0 "
-    elif [ "$CONFIG_QEMU_aarch64" ]; then
+    elif [ "$CONFIG_IX_QEMU_aarch64" ]; then
 	echo -n "console=ttyAMA0 "
    else
 	die "Unknown console"
    fi

-    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
+    if [ "$CONFIG_IX_QEMU_ROOTFS_INITRD" = "y" ]; then
 	# Size of initrd, rounded up to nearest kb
-	size=$((($(stat -c %s "$CONFIG_QEMU_ROOTFS") + 1023) >> 10))
+	size=$((($(stat -c %s "$CONFIG_IX_QEMU_ROOTFS") + 1023) >> 10))
 	echo -n "root=/dev/ram0 ramdisk_size=${size} "
-    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
+    elif [ "$CONFIG_IX_QEMU_ROOTFS_VSCSI" = "y" ]; then
 	echo -n "root=PARTLABEL=primary "
    fi

@@ -110,20 +110,20 @@ append_args()
 	echo -n "debug "
    fi

-    echo -n "${QEMU_APPEND} ${QEMU_EXTRA_APPEND} "
+    echo -n "${IX_QEMU_APPEND} ${QEMU_EXTRA_APPEND} "
 }

 rootfs_args()
 {
-    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
-	echo -n "-initrd $CONFIG_QEMU_ROOTFS "
-    elif [ "$CONFIG_QEMU_ROOTFS_MMC" = "y" ]; then
+    if [ "$CONFIG_IX_QEMU_ROOTFS_INITRD" = "y" ]; then
+	echo -n "-initrd $CONFIG_IX_QEMU_ROOTFS "
+    elif [ "$CONFIG_IX_QEMU_ROOTFS_MMC" = "y" ]; then
 	echo -n "-device sdhci-pci "
 	echo -n "-device sd-card,drive=mmc "
-	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
-    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
+	echo -n "-drive id=mmc,file=$CONFIG_IX_QEMU_ROOTFS,if=none,format=raw "
+    elif [ "$CONFIG_IX_QEMU_ROOTFS_VSCSI" = "y" ]; then
 	# ARM 32-bit virt machine uses MMIO virtio devices, not PCI
-	if [ "$CONFIG_QEMU_arm" ]; then
+	if [ "$CONFIG_IX_QEMU_arm" ]; then
 	    echo -n "-drive file=qemu.qcow2,if=none,format=qcow2,id=rootfs "
 	    echo -n "-device virtio-blk-device,drive=rootfs "
 	else
@@ -140,9 +140,9 @@ serial_args()
    echo -n "-chardev stdio,id=console0,mux=on "
    echo -n "-mon chardev=console0 "

-    if [ "$CONFIG_QEMU_CONSOLE_VIRTIO" ]; then
+    if [ "$CONFIG_IX_QEMU_CONSOLE_VIRTIO" ]; then
 	echo -n "-device virtconsole,nr=0,name=console,chardev=console0 "
-    elif [ "$CONFIG_QEMU_CONSOLE_SERIAL" ]; then
+    elif [ "$CONFIG_IX_QEMU_CONSOLE_SERIAL" ]; then
 	echo -n "-serial chardev:console0 "
    else
 	die "Unknown console"
@@ -175,7 +175,7 @@ usb_args()

 rw_args()
 {
-    [ "$CONFIG_QEMU_RW" ] ||  return
+    [ "$CONFIG_IX_QEMU_RW" ] ||  return

    command -v mkfs.ext4 >/dev/null || die "$prognm: cannot find mkfs.ext4"

@@ -184,45 +184,45 @@ rw_args()
 	mkfs.ext4 -L aux "aux.ext4" >/dev/null 2>&1
    fi

-    if ! [ -f "$CONFIG_QEMU_RW" ]; then
-	dd if=/dev/zero of="$CONFIG_QEMU_RW" bs=16M count=1 >/dev/null 2>&1
-	mkfs.ext4 -L cfg "$CONFIG_QEMU_RW" >/dev/null 2>&1
+    if ! [ -f "$CONFIG_IX_QEMU_RW" ]; then
+	dd if=/dev/zero of="$CONFIG_IX_QEMU_RW" bs=16M count=1 >/dev/null 2>&1
+	mkfs.ext4 -L cfg "$CONFIG_IX_QEMU_RW" >/dev/null 2>&1
    fi

    # ARM 32-bit virt machine uses MMIO virtio devices, not PCI
-    if [ "$CONFIG_QEMU_arm" ]; then
+    if [ "$CONFIG_IX_QEMU_arm" ]; then
 	echo -n "-drive file=aux.ext4,if=none,format=raw,id=aux "
 	echo -n "-device virtio-blk-device,drive=aux "
-	echo -n "-drive file=$CONFIG_QEMU_RW,if=none,format=raw,id=cfg "
+	echo -n "-drive file=$CONFIG_IX_QEMU_RW,if=none,format=raw,id=cfg "
 	echo -n "-device virtio-blk-device,drive=cfg "

-	if [ "$CONFIG_QEMU_RW_VAR_OPT" ]; then
-	    if ! [ -f "$CONFIG_QEMU_RW_VAR" ]; then
-		dd if=/dev/zero of="$CONFIG_QEMU_RW_VAR" bs=$CONFIG_QEMU_RW_VAR_SIZE count=1 >/dev/null 2>&1
-		mkfs.ext4 -L var "$CONFIG_QEMU_RW_VAR" >/dev/null 2>&1
+	if [ "$CONFIG_IX_QEMU_RW_VAR_OPT" ]; then
+	    if ! [ -f "$CONFIG_IX_QEMU_RW_VAR" ]; then
+		dd if=/dev/zero of="$CONFIG_IX_QEMU_RW_VAR" bs=$CONFIG_IX_QEMU_RW_VAR_SIZE count=1 >/dev/null 2>&1
+		mkfs.ext4 -L var "$CONFIG_IX_QEMU_RW_VAR" >/dev/null 2>&1
 	    fi
-	    echo -n "-drive file=$CONFIG_QEMU_RW_VAR,if=none,format=raw,id=var "
+	    echo -n "-drive file=$CONFIG_IX_QEMU_RW_VAR,if=none,format=raw,id=var "
 	    echo -n "-device virtio-blk-device,drive=var "
 	fi
    else
 	echo -n "-drive file=aux.ext4,if=virtio,format=raw,bus=0,unit=3 "
-	echo -n "-drive file=$CONFIG_QEMU_RW,if=virtio,format=raw,bus=0,unit=1 "
+	echo -n "-drive file=$CONFIG_IX_QEMU_RW,if=virtio,format=raw,bus=0,unit=1 "

-	if [ "$CONFIG_QEMU_RW_VAR_OPT" ]; then
-	    if ! [ -f "$CONFIG_QEMU_RW_VAR" ]; then
-		dd if=/dev/zero of="$CONFIG_QEMU_RW_VAR" bs=$CONFIG_QEMU_RW_VAR_SIZE count=1 >/dev/null 2>&1
-		mkfs.ext4 -L var "$CONFIG_QEMU_RW_VAR" >/dev/null 2>&1
+	if [ "$CONFIG_IX_QEMU_RW_VAR_OPT" ]; then
+	    if ! [ -f "$CONFIG_IX_QEMU_RW_VAR" ]; then
+		dd if=/dev/zero of="$CONFIG_IX_QEMU_RW_VAR" bs=$CONFIG_IX_QEMU_RW_VAR_SIZE count=1 >/dev/null 2>&1
+		mkfs.ext4 -L var "$CONFIG_IX_QEMU_RW_VAR" >/dev/null 2>&1
 	    fi
-	    echo -n "-drive file=$CONFIG_QEMU_RW_VAR,if=virtio,format=raw,bus=0,unit=2 "
+	    echo -n "-drive file=$CONFIG_IX_QEMU_RW_VAR,if=virtio,format=raw,bus=0,unit=2 "
 	fi
    fi
 }

 host_args()
 {
-    [ "$CONFIG_QEMU_HOST" ] || return
+    [ "$CONFIG_IX_QEMU_HOST" ] || return

-    echo -n "-virtfs local,path=$CONFIG_QEMU_HOST,security_model=none,writeout=immediate,mount_tag=hostfs "
+    echo -n "-virtfs local,path=$CONFIG_IX_QEMU_HOST,security_model=none,writeout=immediate,mount_tag=hostfs "
 }

 net_dev_args()
@@ -230,7 +230,7 @@ net_dev_args()
    name="e$1"
    mac=$(printf "02:00:00:00:00:%02x" "$1")

-    echo -n "-device $CONFIG_QEMU_NET_MODEL,netdev=$name,mac=$mac "
+    echo -n "-device $CONFIG_IX_QEMU_NET_MODEL,netdev=$name,mac=$mac "
    echo "$name	$mac" >>"$mactab"
 }

@@ -252,29 +252,29 @@ net_args()
    :> "$mactab"
    echo -n "-fw_cfg name=opt/mactab,file=$mactab "

-    if [ "$CONFIG_QEMU_NET_BRIDGE" = "y" ]; then
-	echo -n "-netdev bridge,id=e1,br=$CONFIG_QEMU_NET_BRIDGE_DEV "
+    if [ "$CONFIG_IX_QEMU_NET_BRIDGE" = "y" ]; then
+	echo -n "-netdev bridge,id=e1,br=$CONFIG_IX_QEMU_NET_BRIDGE_DEV "
 	net_dev_args 1
-    elif [ "$CONFIG_QEMU_NET_TAP" = "y" ]; then
-	for i in $(seq 1 "$CONFIG_QEMU_NET_TAP_N"); do
+    elif [ "$CONFIG_IX_QEMU_NET_TAP" = "y" ]; then
+	for i in $(seq 1 "$CONFIG_IX_QEMU_NET_TAP_N"); do
 	    echo -n "-netdev tap,id=e$i,ifname=qtap$i "
 	    net_dev_args "$i"
 	done
-    elif [ "$CONFIG_QEMU_NET_ROCKER" = "y" ]; then
+    elif [ "$CONFIG_IX_QEMU_NET_ROCKER" = "y" ]; then
 	sw=sw0			# Only single switch support atm.
 	echo -n "-device '{\"driver\":\"rocker\", \"name\":\"${sw}\", "
 	echo -n "\"fp_start_macaddr\":\"02:00:00:00:00:01\", "
 	echo -n "\"ports\":["
-	for i in $(seq 1 "$CONFIG_QEMU_NET_PORTS"); do
+	for i in $(seq 1 "$CONFIG_IX_QEMU_NET_PORTS"); do
 	    [ "$i" -gt 1 ] && echo -n ", "
 	    echo -n "\"${sw}p${i}\""
 	done
 	echo -n "]}' "
-	for i in $(seq 1 "$CONFIG_QEMU_NET_PORTS"); do
+	for i in $(seq 1 "$CONFIG_IX_QEMU_NET_PORTS"); do
 	    rocker_port_args 0 "$i"
 	done
-    elif [ "$CONFIG_QEMU_NET_USER" = "y" ]; then
-	[ "$CONFIG_QEMU_NET_USER_OPTS" ] && useropts=",$CONFIG_QEMU_NET_USER_OPTS"
+    elif [ "$CONFIG_IX_QEMU_NET_USER" = "y" ]; then
+	[ "$CONFIG_IX_QEMU_NET_USER_OPTS" ] && useropts=",$CONFIG_IX_QEMU_NET_USER_OPTS"
 	echo -n "-netdev user,id=e1${useropts} "
 	net_dev_args 1
    else
@@ -285,7 +285,7 @@ net_args()
 # Vital Product data
 vpd_args()
 {
-    [ "$CONFIG_QEMU_VPD" = "y" ] || return
+    [ "$CONFIG_IX_QEMU_VPD" = "y" ] || return

    vpd_file="${qdir}/vpd"

@@ -324,8 +324,8 @@ random_date()

 rtc_args()
 {
-    rtc="${CONFIG_QEMU_RTC:-utc}"
-    clock="${CONFIG_QEMU_CLOCK:-host}"
+    rtc="${CONFIG_IX_QEMU_RTC:-utc}"
+    clock="${CONFIG_IX_QEMU_CLOCK:-host}"
    if [ "$rtc" = "random" ]; then
 	rtc=$(random_date)
    fi
@@ -358,28 +358,28 @@ extract_squashfs()
 run_qemu()
 {
    # Auto-extract rootfs.squashfs from rootfs.itb if needed for initrd mode
-    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ] && [ ! -f "$CONFIG_QEMU_ROOTFS" ]; then
-	itb="${CONFIG_QEMU_ROOTFS%.squashfs}.itb"
+    if [ "$CONFIG_IX_QEMU_ROOTFS_INITRD" = "y" ] && [ ! -f "$CONFIG_IX_QEMU_ROOTFS" ]; then
+	itb="${CONFIG_IX_QEMU_ROOTFS%.squashfs}.itb"
 	if [ -f "$itb" ]; then
-	    extract_squashfs "$itb" "$CONFIG_QEMU_ROOTFS"
+	    extract_squashfs "$itb" "$CONFIG_IX_QEMU_ROOTFS"
 	else
-	    die "Missing $CONFIG_QEMU_ROOTFS and cannot find $itb to extract it from"
+	    die "Missing $CONFIG_IX_QEMU_ROOTFS and cannot find $itb to extract it from"
 	fi
    fi

-    if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
+    if [ "$CONFIG_IX_QEMU_ROOTFS_VSCSI" = "y" ]; then
 	if ! qemu-img check "qemu.qcow2"; then
 	    rm -f "qemu.qcow2"
 	fi
 	if [ ! -f "qemu.qcow2" ]; then
 	    echo "Creating qcow2 disk image for Qemu ..."
-	    qemu-img create -f qcow2 -o backing_file="$CONFIG_QEMU_ROOTFS" \
+	    qemu-img create -f qcow2 -o backing_file="$CONFIG_IX_QEMU_ROOTFS" \
 		     -F qcow2 "qemu.qcow2" > /dev/null
 	fi
    fi

    read -r qemu <<EOF
-	$CONFIG_QEMU_MACHINE -nodefaults -m $CONFIG_QEMU_MACHINE_RAM \
+	$CONFIG_IX_QEMU_MACHINE -nodefaults -m $CONFIG_IX_QEMU_MACHINE_RAM \
 	  $(loader_args) \
 	  $(rootfs_args) \
 	  $(serial_args) \
@@ -391,14 +391,14 @@ run_qemu()
 	  $(rtc_args) \
 	  $(vpd_args) \
 	  $(gdb_args) \
-	  $CONFIG_QEMU_EXTRA
+	  $CONFIG_IX_QEMU_EXTRA
 EOF
    # Save resulting command to a script, because I cannot for the life
    # of me figure out how to embed the JSON snippet for Rocker and run
    # it here without issues, spent way too much time on it -- Joachim
    run=$(mktemp -t run.qemu.XXX)
    echo "#!/bin/sh" > "$run"
-    if [ "$CONFIG_QEMU_KERNEL" ]; then
+    if [ "$CONFIG_IX_QEMU_KERNEL" ]; then
 	echo "$qemu -append \"$(append_args)\" $*" >> "$run"
    else
 	echo "$qemu $*" >> "$run"
@@ -419,9 +419,9 @@ EOF

 dtb_args()
 {
-    [ "$CONFIG_QEMU_LOADER_UBOOT" ] || return
+    [ "$CONFIG_IX_QEMU_LOADER_UBOOT" ] || return

-    if [ "$CONFIG_QEMU_DTB_EXTEND" ]; then
+    if [ "$CONFIG_IX_QEMU_DTB_EXTEND" ]; then
 	# On the current architecture, QEMU will generate an internal
 	# DT based on the system configuration.

@@ -445,12 +445,12 @@ dtb_args()

 generate_dot()
 {
-    [ "$CONFIG_QEMU_NET_TAP" = "y" ] || return
+    [ "$CONFIG_IX_QEMU_NET_TAP" = "y" ] || return

    hostports="<qtap1> qtap1"
    targetports="<e1> e1"
    edges="host:qtap1 -- target:e1 [kind=mgmt];"
-    for tap in $(seq 2 $((CONFIG_QEMU_NET_TAP_N - 1))); do
+    for tap in $(seq 2 $((CONFIG_IX_QEMU_NET_TAP_N - 1))); do
 	hostports="$hostports | <qtap$tap> qtap$tap "
 	targetports="$targetports | <e$tap> e$tap "
 	edges="$edges host:qtap$tap -- target:e$tap;"
@@ -485,7 +485,7 @@ EOF

 menuconfig()
 {
-    grep -q QEMU_MACHINE Config.in || die "$prognm: must be run from the $$O/images/qemu directory"
+    grep -q IX_QEMU_MACHINE Config.in || die "$prognm: must be run from the $$O/images/qemu directory"
    command -v kconfig-mconf >/dev/null || die "$prognm: cannot find kconfig-mconf for menuconfig"
    exec kconfig-mconf Config.in
 }
@@ -24,6 +24,10 @@ net.ipv4.conf.all.arp_ignore=1
 net.ipv4.ip_forward=1
 net.ipv4.ip_forward_update_priority=0

+# Allow binding to non-local addresses, e.g. floating VIPs not yet
+# configured on an interface, see issue #1022
+net.ipv4.ip_nonlocal_bind=1
+
 net.ipv4.conf.all.forwarding=0
 net.ipv4.conf.default.forwarding=0

@@ -7,6 +7,10 @@ net.ipv6.conf.all.ignore_routes_with_linkdown=1
 net.ipv6.conf.all.forwarding=0
 net.ipv6.conf.default.forwarding=0

+# Allow binding to non-local addresses, e.g. floating VIPs not yet
+# configured on an interface, see issue #1022
+net.ipv6.ip_nonlocal_bind=1
+
 # Accept router advertisements even when forwarding is enabled
 net.ipv6.conf.all.accept_ra=2
 net.ipv6.conf.default.accept_ra=2
@@ -25,7 +25,7 @@ define UBOOT_PRE_BUILD_INSTALL_KEY
 	$(HOST_DIR)/bin/dtc -a 1024 <(echo '/dts-v1/; / { signature {}; };') \
 		>$(@D)/infix-key.dtb
 	$(foreach key, \
-		$(call qstrip,$(TRUSTED_KEYS_DEVELOPMENT_PATH)) $(call qstrip,$(TRUSTED_KEYS_EXTRA_PATH)),\
+		$(call qstrip,$(IX_TRUSTED_KEYS_DEVELOPMENT_PATH)) $(call qstrip,$(IX_TRUSTED_KEYS_EXTRA_PATH)),\
 		$(call uboot-add-pubkey,$(key),$(@D)/infix-key.dtb))
 	$(HOST_DIR)/bin/dtc -I dtb -O dts \
 		<$(@D)/infix-key.dtb \
@@ -46,3 +46,12 @@ define UBOOT_PRE_BUILD_INSTALL_ENV
 		$(@D)/arch/$(UBOOT_ARCH)/dts/
 endef
 UBOOT_PRE_BUILD_HOOKS += UBOOT_PRE_BUILD_INSTALL_ENV
+
+# Stamp non-release builds so they cannot be mistaken for a release,
+# U-Boot's setlocalversion picks up .scmversion, see issue #919.
+define UBOOT_PRE_BUILD_DEVEL_VERSION
+	echo "-DEVEL" >$(@D)/.scmversion
+endef
+ifeq ($(INFIX_RELEASE),)
+UBOOT_PRE_BUILD_HOOKS += UBOOT_PRE_BUILD_DEVEL_VERSION
+endif
@@ -244,7 +244,6 @@ CONFIG_FW_CFG_SYSFS_CMDLINE=y
 CONFIG_BLK_DEV_NULL_BLK=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_RAM=y
-CONFIG_BLK_DEV_NBD=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_BLK_DEV_SR=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.36"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.39"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -143,11 +143,11 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
-INFIX_VENDOR_HOME="https://www.kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://www.kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+IX_VENDOR_HOME="https://www.kernelkit.org"
+IX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+IX_HOME="https://github.com/kernelkit/infix/"
+IX_DOC="https://www.kernelkit.org/infix/"
+IX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
@@ -162,7 +162,6 @@ BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_YANGERD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -192,9 +191,9 @@ BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_PCIUTILS=y
-IMAGE_ITB_AUX=y
-IMAGE_ITB_QCOW=y
-IMAGE_ITB_RAUC=y
-IMAGE_README=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_IMAGE_ITB_AUX=y
+IX_IMAGE_ITB_QCOW=y
+IX_IMAGE_ITB_RAUC=y
+IX_IMAGE_README=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.36"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.39"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -121,17 +121,16 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
-INFIX_VENDOR_HOME="https://www.kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://www.kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+IX_VENDOR_HOME="https://www.kernelkit.org"
+IX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+IX_HOME="https://github.com/kernelkit/infix/"
+IX_DOC="https://www.kernelkit.org/infix/"
+IX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_YANGERD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -152,9 +151,9 @@ BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-IMAGE_ITB_AUX=y
-IMAGE_ITB_QCOW=y
-IMAGE_ITB_RAUC=y
-IMAGE_README=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_IMAGE_ITB_AUX=y
+IX_IMAGE_ITB_QCOW=y
+IX_IMAGE_ITB_RAUC=y
+IX_IMAGE_README=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -25,5 +25,5 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.36"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.39"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -129,6 +129,7 @@ BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
+BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_KMOD_XZ=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
@@ -136,11 +137,11 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_MICROCHIP_SAMA7G54_EK=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
-INFIX_VENDOR_HOME="https://www.kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://www.kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+IX_VENDOR_HOME="https://www.kernelkit.org"
+IX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+IX_HOME="https://github.com/kernelkit/infix/"
+IX_DOC="https://www.kernelkit.org/infix/"
+IX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
 BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
@@ -149,7 +150,6 @@ BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_YANGERD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -174,9 +174,9 @@ BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-IMAGE_ITB_AUX=y
-IMAGE_ITB_QCOW=y
-IMAGE_ITB_RAUC=y
-IMAGE_README=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_IMAGE_ITB_AUX=y
+IX_IMAGE_ITB_QCOW=y
+IX_IMAGE_ITB_RAUC=y
+IX_IMAGE_README=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -28,7 +28,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.36"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.39"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -119,17 +119,16 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_MICROCHIP_SAMA7G54_EK=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
-INFIX_VENDOR_HOME="https://www.kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://www.kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+IX_VENDOR_HOME="https://www.kernelkit.org"
+IX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+IX_HOME="https://github.com/kernelkit/infix/"
+IX_DOC="https://www.kernelkit.org/infix/"
+IX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_YANGERD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -150,9 +149,9 @@ BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-IMAGE_ITB_AUX=y
-IMAGE_ITB_QCOW=y
-IMAGE_ITB_RAUC=y
-IMAGE_README=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_IMAGE_ITB_AUX=y
+IX_IMAGE_ITB_QCOW=y
+IX_IMAGE_ITB_RAUC=y
+IX_IMAGE_README=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -40,5 +40,5 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -38,5 +38,5 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -38,5 +38,5 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -38,5 +38,5 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -38,5 +38,5 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -38,5 +38,5 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -38,5 +38,5 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -45,5 +45,5 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_BOOTLOADER_SPLASHSCREEN=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -164,14 +164,15 @@ BR2_TARGET_UBOOT_SPL=y
 BR2_TARGET_UBOOT_SPL_NAME="spl/u-boot-spl.bin.normal.out"
 BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/visionfive2/uboot/visionfive2-env.dtsi"
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
+BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-INFIX_VENDOR_HOME="https://www.kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://www.kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+IX_VENDOR_HOME="https://www.kernelkit.org"
+IX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+IX_HOME="https://github.com/kernelkit/infix/"
+IX_DOC="https://www.kernelkit.org/infix/"
+IX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
@@ -181,7 +182,6 @@ BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_YANGERD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -211,9 +211,9 @@ BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_PCIUTILS=y
-IMAGE_ITB_AUX=y
-IMAGE_ITB_QCOW=y
-IMAGE_ITB_RAUC=y
-IMAGE_README=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_IMAGE_ITB_AUX=y
+IX_IMAGE_ITB_QCOW=y
+IX_IMAGE_ITB_RAUC=y
+IX_IMAGE_README=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -40,5 +40,5 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_BOOTLOADER_SPLASHSCREEN=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -34,5 +34,5 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -34,5 +34,5 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -1,4 +1,4 @@
 BR2_TARGET_ROOTFS_EXT2=y
 BR2_TARGET_ROOTFS_EXT2_4=y
 BR2_TARGET_ROOTFS_EXT2_SIZE="512M"
-IMAGE_EXT4_RAUC=y
+IX_IMAGE_EXT4_RAUC=y
@@ -0,0 +1,5 @@
+# Prefer internal download mirror over official upstream sites.  If
+# the mirror is unreachable, e.g., off-site without VPN, Buildroot
+# falls back to the upstream URL and then sources.buildroot.net
+# Set up a local mirror and add IP to /etc/hosts to override
+BR2_PRIMARY_SITE="http://mirror.internal/pub"
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.36"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.39"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -110,7 +110,6 @@ BR2_PACKAGE_RAUC=y
 BR2_PACKAGE_RAUC_DBUS=y
 BR2_PACKAGE_RAUC_GPT=y
 BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_RAUC_STREAMING=y
 BR2_PACKAGE_RAUC_JSON=y
 BR2_PACKAGE_SYSKLOGD=y
 BR2_PACKAGE_SYSKLOGD_LOGGER=y
@@ -140,11 +139,11 @@ BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-INFIX_VENDOR_HOME="https://www.kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://www.kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+IX_VENDOR_HOME="https://www.kernelkit.org"
+IX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+IX_HOME="https://github.com/kernelkit/infix/"
+IX_DOC="https://www.kernelkit.org/infix/"
+IX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
 BR2_PACKAGE_FEATURE_WIFI=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
@@ -157,7 +156,6 @@ BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_YANGERD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -187,9 +185,9 @@ BR2_PACKAGE_WEBUI=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_PCIUTILS=y
-IMAGE_ITB_AUX=y
-IMAGE_ITB_QCOW=y
-IMAGE_ITB_RAUC=y
-IMAGE_README=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_IMAGE_ITB_AUX=y
+IX_IMAGE_ITB_QCOW=y
+IX_IMAGE_ITB_RAUC=y
+IX_IMAGE_README=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -26,7 +26,7 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.36"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.39"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -118,17 +118,16 @@ BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
-INFIX_VENDOR_HOME="https://www.kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://www.kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+IX_VENDOR_HOME="https://www.kernelkit.org"
+IX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+IX_HOME="https://github.com/kernelkit/infix/"
+IX_DOC="https://www.kernelkit.org/infix/"
+IX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_YANGERD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -149,9 +148,9 @@ BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-IMAGE_ITB_AUX=y
-IMAGE_ITB_QCOW=y
-IMAGE_ITB_RAUC=y
-IMAGE_README=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
+IX_IMAGE_ITB_AUX=y
+IX_IMAGE_ITB_QCOW=y
+IX_IMAGE_ITB_RAUC=y
+IX_IMAGE_README=y
+IX_TRUSTED_KEYS=y
+IX_TRUSTED_KEYS_DEVELOPMENT=y
@@ -3,12 +3,45 @@ Change Log

 All notable changes to the project are documented in this file.

-[v26.06.0][UNRELEASED]
+[v26.08.0][UNRELEASED]
 -------------------------

 ### Changes

- Upgrade Linux kernel to 6.18.36 (LTS)
+- Upgrade Linux kernel to 6.18.39 (LTS)
+- Upgrade Buildroot to 2025.02.15 (LTS)
+- Add support for firewall address-set (ipset): named sets of IP addresses and
+  networks, usable as zone sources for per-IP access control, issue #1189
+- Build RPi64 SD card images in release builds
+- Include .pkg files in release builds
+
+### Fixes
+
+- Fix annoying "cannot deselect all services" or reset to YANG default in the
+  web interface's firewall configuration page
+
+[v26.06.0][] - 2026-07-01
+-------------------------
+
+> [!NOTE]
+> Noteworthy changes and additions in this release:
+>
+> **🌐 Web Interface:** Infix gets its first-ever web interface!  Browse live
+> status and a full operational tree, handle common tasks from curated
+> configuration pages, and drop into a YANG tree editor for everything else.
+> A maintenance section covers firmware upgrade, backup & restore, and more.
+>
+> **📶 Wi-Fi Roaming & Mesh:** Access points sharing an SSID can hand clients
+> off seamlessly with 802.11k/v/r, form a cable-free 802.11s mesh backhaul,
+> and steer dual-band clients onto the faster 5/6 GHz band.
+>
+> **🗓️ System Scheduling:** Reusable time schedules based on ietf-schedule
+> (RFC 9922) let features like scheduled reboot and software update checks
+> run on a recurring, cron-style calendar.
+
+### Changes
+
+- Upgrade Linux kernel to 6.18.37 (LTS)
 - Upgrade Buildroot to 2025.02.15 (LTS)
 - Add basic web interface: static status pages and a tree view of operational
  status.  Curated configuration pages for some common tasks and a YANG tree
@@ -27,6 +60,13 @@ All notable changes to the project are documented in this file.
  iCalendar recurrence grouping pruned to cron-expressible rules.  Schedules
  are reusable time-specs; features (`scheduled-reboot`,
  `software/check-update`) trigger off them via a schedule reference
+- Configuring multiple BSS (more than one SSID) on a single Wi-Fi radio now
+  requires an explicitly configured MAC address per BSS
+- New operational `advertised-pmd-types` leaf-list on each Ethernet interface,
+  exposing the link modes currently advertised, to compare against the
+  `supported-pmd-types` introduced in v26.05.0
+- Release assets no longer ship separate `.sha256` checksum files; the
+  download page now publishes a SHA-256 checksum for each asset directly

 ### Fixes

@@ -39,6 +79,14 @@ All notable changes to the project are documented in this file.
  default `admin` user no permission to read or write the file from shell
 - Fix admin url shown for HTTP/HTTPS links in <https://network.local> browser,
  used pre-conflict resolution hostname.local, instead of hostname-2.local
+- Fix unreadable per-port temperature sensor names in `show hardware` on
+  Marvell based switches: each sensor is now named after the front-panel port
+  it serves (e.g. `e1`, `e2`) instead of a raw device-tree path.  `show
+  system` also reports a representative SoC temperature on CN913x platforms
+- Fix missing `contact` and `location` settings in operational status; the
+  values were configurable but never returned on RESTCONF/NETCONF reads
+- Fix spurious YANG validation warnings, for NTP and WireGuard configuration,
+  emitted on every NETCONF session and schema load

 [wifi]: https://www.kernelkit.org/infix/latest/wifi/

@@ -2174,7 +2222,8 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.05.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v26.06.0...HEAD
+[v26.08.0]:   https://github.com/kernelkit/infix/compare/v26.06.0...v26.08.0
 [v26.06.0]:   https://github.com/kernelkit/infix/compare/v26.05.0...v26.06.0
 [v26.05.0]:   https://github.com/kernelkit/infix/compare/v26.04.0...v26.05.0
 [v26.04.0]:   https://github.com/kernelkit/infix/compare/v26.03.0...v26.04.0
@@ -28,7 +28,7 @@ Verify the result after a build by inspecting:

 > [!IMPORTANT]
 > To get a proper GIT revision (hash) from your OS spin, remember to set
-> in menuconfig `INFIX_OEM_PATH`.  When unset, the Infix `post-build.sh`
+> in menuconfig `IX_OEM_PATH`.  When unset, the Infix `post-build.sh`
 > script defaults to the Infix base path.  The revision is stored in the
 > file `/etc/os-release` as `BUILD_ID`, also in the file `/etc/version`.
 > See below for more info.
@@ -427,7 +427,7 @@ Used for `BUILD_ID` in `/etc/os-release`.
 **Default:** `$(git describe --always --dirty --tags)`, from the _top
 directory_. By default, the top directory refers to the root of the
 Infix source tree, but this can be changed by setting the branding
-variable `INFIX_OEM_PATH`, e.g. in a `defconfig` file or via `make
+variable `IX_OEM_PATH`, e.g. in a `defconfig` file or via `make
 menuconfig`, to the path of an enclosing br2-external.

 #### `INFIX_RELEASE`
@@ -190,6 +190,9 @@ To apply a single snippet to the current output directory:
    make apply-ext4         # build an ext4 rootfs (needed for boards
                            # whose bootloader lacks squashfs support,
                            # e.g. Marvell ESPRESSObin)
+    make apply-mirror       # prefer an internal download mirror
+                            # (BR2_PRIMARY_SITE) over upstream sites,
+                            # see utils/mirror-sync.sh for populating it

 The `apply-*` targets require an existing `.config` (i.e. you must have
 already run a `make <board>_defconfig`).  The snippet is merged using
@@ -223,6 +223,96 @@ The firewall includes over 100 pre-defined services, such as:
 > See the YANG model for the full list, or tap the ++question++ key
 > when setting up an allowed host service in a zone `set service`

+## Address Sets
+
+Address sets are named collections of IP addresses and networks that can be
+used as zone *sources*, alongside the `network` setting.  Traffic from a
+member of the set is classified into that zone regardless of which interface
+it arrives on.  Since source matching takes precedence over interface
+matching, an address set in a trusted zone can selectively lift devices out
+of a restrictive interface zone.
+
+This enables per-IP access control: block everything by default and grant
+individual end devices access at runtime.
+
+> [!IMPORTANT]
+> Assigning an address set to a zone only decides which zone the source IP
+> belongs to.  It does **not** by itself grant access to the device.  Access
+> to HOST services is still controlled by the zone's `action` and `service`
+> settings.  A common pattern is to keep the interface or default zone
+> restrictive (`reject`/`drop`) and attach the address set to a separate
+> trusted zone with `action accept`, as shown below.
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>edit firewall address-set allowed</b>
+admin@example:/config/firewall/…/allowed/> <b>set description "End devices granted access"</b>
+admin@example:/config/firewall/…/allowed/> <b>set entry 192.168.1.40</b>
+admin@example:/config/firewall/…/allowed/> <b>end</b>
+admin@example:/config/firewall/> <b>edit zone trusted</b>
+admin@example:/config/firewall/…/trusted/> <b>set action accept</b>
+admin@example:/config/firewall/…/trusted/> <b>set address-set allowed</b>
+admin@example:/config/firewall/…/trusted/> <b>leave</b>
+</code></pre>
+
+### Static and Dynamic Entries
+
+Entries come in two kinds:
+
+- **Static** entries are set in the configuration, like `192.168.1.40`
+  above, and are restored at boot
+- **Dynamic** entries are added and removed at runtime using the `add`,
+  `remove`, and `flush` actions.  They take effect immediately and survive
+  firewall configuration changes, but are *not* saved to the configuration,
+  so a reboot starts from a clean slate
+
+From admin-exec context in the CLI:
+
+<pre class="cli"><code>admin@example:/> <b>firewall address-set allowed add 192.168.1.42</b>
+admin@example:/> <b>show firewall address-set allowed</b>
+name                : allowed
+family              : ipv4
+timeout             : none
+
+ENTRY            TYPE     EXPIRES
+192.168.1.40     static
+192.168.1.42     dynamic
+admin@example:/> <b>firewall address-set allowed remove 192.168.1.42</b>
+</code></pre>
+
+The same actions are available over NETCONF and RESTCONF, e.g., allowing a
+device from a network management system:
+
+```json
+~$ curl -kX POST -u admin:admin -H "Content-Type: application/yang-data+json" \
+        -d '{"infix-firewall:input": {"entry": "192.168.1.42"}}'              \
+        https://example.local/restconf/data/infix-firewall:firewall/address-set=allowed/add
+```
+
+Static entries can only be removed by changing the configuration, the
+`remove` action manages dynamic entries only.  The `flush` action removes
+all dynamic entries at once, leaving static entries in place.
+
+### Expiring Entries
+
+An address set can be created with a `timeout`, giving every dynamic entry a
+limited lifetime.  Such sets are dynamic-only: static entries cannot be
+configured, and entries cannot be removed manually, they expire on their
+own.  This suits time-limited access grants and automated ban lists.
+
+<pre class="cli"><code>admin@example:/config/firewall/> <b>edit address-set banned</b>
+admin@example:/config/firewall/…/banned/> <b>set timeout 3600</b>
+admin@example:/config/firewall/…/banned/> <b>leave</b>
+admin@example:/> <b>firewall address-set banned add 203.0.113.99</b>
+</code></pre>
+
+The remaining lifetime of each entry is shown in the `EXPIRES` column of
+<kbd>show firewall address-set</kbd>.
+
+> [!NOTE]
+> Entries in timeout sets do not survive firewall configuration changes,
+> the set is flushed when the firewall configuration is rebuilt.  Regular
+> (non-timeout) sets keep their dynamic entries over configuration changes.
+
 ## Examples

 ### End Device Protection
@@ -1,13 +1,15 @@
 IXMSG = printf "\e[37;44m>>>   $(call qstrip,$(1))\e[0m\n"

-oem-dir := $(call qstrip,$(INFIX_OEM_PATH))
+oem-dir := $(call qstrip,$(IX_OEM_PATH))
 INFIX_TOPDIR = $(if $(oem-dir),$(oem-dir),$(BR2_EXTERNAL_INFIX_PATH))

 # Unless the user specifies an explicit build id, source it from git.
-# The build id also becomes the image version, unless an official
-# release is being built.
-export INFIX_BUILD_ID ?= $(shell git -C $(INFIX_TOPDIR) describe --dirty --always --tags)
-export INFIX_VERSION = $(if $(INFIX_RELEASE),$(INFIX_RELEASE),$(INFIX_BUILD_ID))
-export INFIX_ARTIFACT = $(call qstrip,$(INFIX_IMAGE_ID)$(if $(INFIX_RELEASE),-$(INFIX_RELEASE)))
+# Exclude the moving 'latest*' tags so the version always resolves to a
+# real release tag, see issue #1524.  The build id is also the version
+# shown to users; INFIX_RELEASE only labels the release channel and names
+# artifacts (see INFIX_ARTIFACT below).
+export INFIX_BUILD_ID ?= $(shell git -C $(INFIX_TOPDIR) describe --dirty --always --tags --exclude 'latest*')
+export INFIX_VERSION = $(INFIX_BUILD_ID)
+export INFIX_ARTIFACT = $(call qstrip,$(IX_IMAGE_ID)$(if $(INFIX_RELEASE),-$(INFIX_RELEASE)))

 INFIX_CFLAGS:=-Wall -Werror -Wextra -Wno-unused-parameter -Wformat=2 -Wformat-overflow=2 -Winit-self -Wstrict-overflow=4 -Wno-format-truncation -Wno-format-nonliteral
@@ -13,7 +13,6 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/curios-httpd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/curios-nftables/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/gencert/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/statd/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/yangerd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/factory/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/faux/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/finit/Config.in"
@@ -0,0 +1 @@
+sha256  49c4d5edbd3ee0a0f6b15ef097b79539530a574ceed8a4dffec1d02455933029  LICENSE
@@ -0,0 +1 @@
+sha256  8cdb4def6e91fde66ed0880a6e6ecc364aa96012e53b3cfb990b53b9dab976d4  LICENSE
@@ -1,7 +0,0 @@
-config BR2_PACKAGE_YANGERD
-	bool "yangerd"
-	depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
-	help
-	  Operational data daemon for YANG/NETCONF/RESTCONF.
-	  Replaces Python yanger scripts with a persistent Go daemon
-	  serving operational data over a Unix socket IPC protocol.
@@ -1,3 +0,0 @@
-service <> name:yangerd log:prio:daemon.notice,tag:yangerd \
-	env:-/etc/default/yangerd \
-	[2345]  yangerd -- Operational data daemon
@@ -1,35 +0,0 @@
-################################################################################
-#
-# yangerd
-#
-################################################################################
-
-YANGERD_VERSION = 1.0.0
-YANGERD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/yangerd
-YANGERD_SITE_METHOD = local
-YANGERD_GOMOD = github.com/kernelkit/infix/src/yangerd
-YANGERD_LICENSE = BSD-2-Clause
-YANGERD_LICENSE_FILES = LICENSE
-YANGERD_REDISTRIBUTE = NO
-
-YANGERD_BUILD_TARGETS = cmd/yangerd cmd/yangerctl
-YANGERD_INSTALL_BINS = yangerd yangerctl
-
-define YANGERD_INSTALL_EXTRA
-	$(INSTALL) -D -m 0644 $(YANGERD_PKGDIR)/yangerd.conf \
-		$(FINIT_D)/available/yangerd.conf
-	ln -sf ../available/yangerd.conf $(FINIT_D)/enabled/yangerd.conf
-	$(INSTALL) -d $(TARGET_DIR)/etc/default
-	echo '# yangerd build-time feature flags (generated by yangerd.mk)' \
-		> $(TARGET_DIR)/etc/default/yangerd
-	echo 'YANGERD_ENABLE_WIFI=$(if $(BR2_PACKAGE_IW),true,false)' \
-		>> $(TARGET_DIR)/etc/default/yangerd
-	echo 'YANGERD_ENABLE_CONTAINERS=$(if $(BR2_PACKAGE_PODMAN),true,false)' \
-		>> $(TARGET_DIR)/etc/default/yangerd
-	echo 'YANGERD_ENABLE_GPS=$(if $(BR2_PACKAGE_GPSD),true,false)' \
-		>> $(TARGET_DIR)/etc/default/yangerd
-	echo 'YANGERD_LOG_LEVEL=deug' >> $(TARGET_DIR)/etc/default/yangerd
-endef
-YANGERD_POST_INSTALL_TARGET_HOOKS += YANGERD_INSTALL_EXTRA
-
-$(eval $(golang-package))
@@ -1,4 +1,4 @@
-From a3165eb664d65da173e91e8b159b8daf9a1285c7 Mon Sep 17 00:00:00 2001
+From 38ef4ac1fa9bd9b0436311c6f8962646222c54f9 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
 Subject: [PATCH 01/50] net: phy: marvell10g: Support firmware loading on
@@ -1,4 +1,4 @@
-From 0ee3021b04ec64d96b90d9246f37d3d7a1f8f187 Mon Sep 17 00:00:00 2001
+From 48bb808a5c8d7d0d7c49e4453f4809a9fdeefddc Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
 Subject: [PATCH 02/50] net: phy: marvell10g: Fix power-up when strapped to
@@ -1,4 +1,4 @@
-From 7e5a199bca36c5d8b1fd3875bbb8343c86db73ea Mon Sep 17 00:00:00 2001
+From da0565da3839ac4f85b9743a4a207fbbe6d9c719 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
 Subject: [PATCH 03/50] net: phy: marvell10g: Add LED support for 88X3310
@@ -1,4 +1,4 @@
-From 62a1468f5c6fdaba5074fa7555e3b7888762e4e7 Mon Sep 17 00:00:00 2001
+From 7f3d654b9af1b449555f0076f56db9a8c48f7314 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
 Subject: [PATCH 04/50] net: phy: marvell10g: Support LEDs tied to a single
@@ -1,4 +1,4 @@
-From 38519daa6941dc275e3efaaba699b6441f1c19e2 Mon Sep 17 00:00:00 2001
+From ae3d8558243c10a3fa34534765cdc5a4ece535b1 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
 Subject: [PATCH 05/50] net: phy: Do not resume PHY when attaching
@@ -1,4 +1,4 @@
-From e11c3a1cf1979f558a1a1c06ed68a99b89273aea Mon Sep 17 00:00:00 2001
+From 08f6224ebcba517410b4dc2b98f7b50db842dc30 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
 Subject: [PATCH 06/50] net: bridge: avoid classifying unknown multicast as
@@ -1,4 +1,4 @@
-From 9186aa368a4b580090d14ee1d9218ac33bc0aa5f Mon Sep 17 00:00:00 2001
+From 9044f8f0599e025644d13c0b031826f5765bbc34 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 06:44:41 +0100
 Subject: [PATCH 07/50] net: bridge: Ignore router ports when forwarding L2
@@ -1,4 +1,4 @@
-From 9641f50de1c780b0e45be9095ab28cbbc4c70011 Mon Sep 17 00:00:00 2001
+From 2ddcdd2cb31dd46e552fea1adf3e89d9925412ee Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 4 Apr 2024 16:36:30 +0200
 Subject: [PATCH 08/50] net: bridge: drop delay for applying strict multicast
@@ -1,4 +1,4 @@
-From d14c3ad03563ac803180c18e6917eb506bea7079 Mon Sep 17 00:00:00 2001
+From 9e9322c41e94e95c3dd4841334933a6c8ef11fd1 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 May 2024 14:51:54 +0200
 Subject: [PATCH 09/50] net: bridge: Differentiate MDB additions from
@@ -1,4 +1,4 @@
-From 4d2335aac65d03c004d27cd27f077362588851e2 Mon Sep 17 00:00:00 2001
+From 1d26447cb586481eee5c4564b68f49c6731b2c83 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 24 Nov 2023 23:29:55 +0100
 Subject: [PATCH 10/50] nvmem: layouts: onie-tlv: Let device probe even when
@@ -1,4 +1,4 @@
-From 1f727779b31e9dec09b669d07655371c45fbc64b Mon Sep 17 00:00:00 2001
+From 4620363bad6472dbe2b8de2093f0a70df812df58 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 11 Aug 2024 11:27:35 +0200
 Subject: [PATCH 11/50] net: usb: r8152: add r8153b support for link/activity
@@ -1,4 +1,4 @@
-From 8053206624b54fb84715342e7b921e0939d594a7 Mon Sep 17 00:00:00 2001
+From 8f3422542356b5cb77f6c2a73431ca06e86b302f Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 10 Aug 2025 18:52:54 +0200
 Subject: [PATCH 12/50] arm64: dts: mediatek: mt7986a: rename BPi R3 ports to
@@ -1,4 +1,4 @@
-From 5b4047d082c93431f77819b894e29a13acebd787 Mon Sep 17 00:00:00 2001
+From dc104487c9361afb69344f4b28d67191b3a86ba6 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Wed, 20 Aug 2025 21:38:24 +0200
 Subject: [PATCH 13/50] drm/panel-simple: Add a timing for the Raspberry Pi 7"
@@ -1,4 +1,4 @@
-From 3efdf41a3464704c4ffb99ea94266dc900f7b556 Mon Sep 17 00:00:00 2001
+From debb5dd84c54cb3d2fd81266a16e40b4e46dc5a7 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Thu, 21 Aug 2025 11:20:23 +0200
 Subject: [PATCH 14/50] input:touchscreen:edt-ft5x06: Add polled mode
@@ -1,4 +1,4 @@
-From ce445d44a5e6ae84214986cbccef985a240e831d Mon Sep 17 00:00:00 2001
+From c27a3dffd31067521fd10a9bc89e9deda4d5361f Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
 Subject: [PATCH 15/50] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for
@@ -1,4 +1,4 @@
-From 57aa43c667a99e08c11a6141f80c068021585829 Mon Sep 17 00:00:00 2001
+From dcaafda96688a910419945920eb73487a3569c97 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
 Subject: [PATCH 16/50] net: dsa: mv88e6xxx: Improve indirect register access
@@ -1,4 +1,4 @@
-From 70c247b71e2f2ede0cae581b0558bd09cd85275e Mon Sep 17 00:00:00 2001
+From b23b36d1963b8a8b61adc26a1971c78623987285 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
 Subject: [PATCH 17/50] net: dsa: mv88e6xxx: Honor ports being managed via
@@ -1,4 +1,4 @@
-From b9b9cc025114c8bb8546012d575cbb9759ce6975 Mon Sep 17 00:00:00 2001
+From 04823fe9ff9c611478db9eb97281da93f4cb49d0 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
 Subject: [PATCH 18/50] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
@@ -1,4 +1,4 @@
-From 071b831a6ba7c5de2cc05738b595cea10e2eb068 Mon Sep 17 00:00:00 2001
+From 19d957f79007833d47c3c3a646d848c9a879cb8d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
 Subject: [PATCH 19/50] net: dsa: tag_dsa: Use tag priority as initial
@@ -1,4 +1,4 @@
-From 625493833fcdc4268a46ce4b2c59eefb1a0a0be0 Mon Sep 17 00:00:00 2001
+From b596ef44536a882d1522d4ad058e26d887d0212d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
 Subject: [PATCH 20/50] net: dsa: Support MDB memberships whose L2 addresses
@@ -1,4 +1,4 @@
-From c59543ced113c4a66ccf07cbfac5dc7dd6cb253e Mon Sep 17 00:00:00 2001
+From 4df7c3a09d6596888cb4b968a04b8b24b2ffed67 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
 Subject: [PATCH 21/50] net: dsa: Support EtherType based priority overrides
@@ -1,4 +1,4 @@
-From fb04b75bc53f6b1b27f91f4ed21013b293e8577c Mon Sep 17 00:00:00 2001
+From bb62c8b847b04e674188e90cb1ce28b780aa70f0 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 22 Mar 2024 16:15:43 +0100
 Subject: [PATCH 22/50] net: dsa: mv88e6xxx: Support EtherType based priority
@@ -1,4 +1,4 @@
-From 32e460b9fbc7b25817c05b9ec2c01f4827f7cca7 Mon Sep 17 00:00:00 2001
+From 0bd5832d6a8dfe3ff5e8eae10060b8189052bea4 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 11:04:22 +0200
 Subject: [PATCH 23/50] net: dsa: mv88e6xxx: Add mqprio qdisc support
@@ -1,4 +1,4 @@
-From 30f92e6d97e8d6d8fe36e872e627b28fcf24fdac Mon Sep 17 00:00:00 2001
+From 2f1b4e2c1ac07b59a68205d17f69ac236b1272b7 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 29 May 2024 13:20:41 +0200
 Subject: [PATCH 24/50] net: dsa: mv88e6xxx: Use VLAN prio over IP when both
@@ -1,4 +1,4 @@
-From a9055d21d1237a5449d5f410d3a0c3d8953a1965 Mon Sep 17 00:00:00 2001
+From 3ded57ad8a13d5bb817295c537f9660cc7987326 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 26 Nov 2024 19:45:59 +0100
 Subject: [PATCH 25/50] [FIX] net: dsa: mv88e6xxx: Trap locally terminated
@@ -1,4 +1,4 @@
-From 7fb7bc76b39078049d7965bef1bc976f9e1142c5 Mon Sep 17 00:00:00 2001
+From 1667410f54c1647cc3b9a00d4fe9ed61a3936f0b Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 16 Jan 2025 12:35:12 +0100
 Subject: [PATCH 26/50] net: dsa: mv88e6xxx: collapse disabled state into
@@ -1,4 +1,4 @@
-From 2a8ff34ccf08f85f985ebea74b6eb47a64e2f247 Mon Sep 17 00:00:00 2001
+From 211f53f2cc60dadda623ffd258fafb9dd6034519 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 12 Feb 2025 22:03:14 +0100
 Subject: [PATCH 27/50] net: dsa: mv88e6xxx: Only activate LAG offloading when
@@ -1,4 +1,4 @@
-From 348c281450bf30875877045d628f8a56ef7896a1 Mon Sep 17 00:00:00 2001
+From d42f3887e25aa770c0dd7d722f0410a926a943ae Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Wed, 14 Jan 2026 18:22:41 +0100
 Subject: [PATCH 28/50] net: dsa: mv88e6xxx: Add LED support for 6393X
@@ -1,4 +1,4 @@
-From 653db5307cd9d69d6b14e163f02226c83e26bd05 Mon Sep 17 00:00:00 2001
+From 8cd6f1604dc816fab887eee9f297bf0df4befbd1 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Thu, 15 Jan 2026 22:47:37 +0100
 Subject: [PATCH 29/50] wifi: brcmfmac: support deletion and recreation of
@@ -1,4 +1,4 @@
-From 6445e629e19b9380dc96c9e5bfd15bbf706e1311 Mon Sep 17 00:00:00 2001
+From 290cb9ee43a75cc2c8994850e48ee6eee9603d3f Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Mon, 19 Jan 2026 13:06:53 +0100
 Subject: [PATCH 30/50] wifi: brcmfmac: check connection state before querying
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Joachim WibergandGitHub	8d57337fcf	Merge pull request #1567 from kernelkit/kernel-upgrade-c7cf8e8a-c974-4873-a74d-00042e95b98b Upgrade to kernel 6.18.39	2026-07-18 20:16:26 +02:00
ael-bot	b29bbc56f9	Upgrade Linux kernel to 6.18.39	2026-07-18 15:42:43 +00:00
Joachim WibergandGitHub	05e34a5441	Merge pull request #1566 from kernelkit/bump-buildroot	2026-07-16 13:09:16 +02:00
Mattias Walström	ec52472949	Bump buildroot to 2025.02.16 2025.02.16, released July 15, 2026 Important / security related fixes: apache: CVE-2026-29167, CVE-2026-29170, CVE-2026-34355, CVE-2026-34356, CVE-2026-42535, CVE-2026-42536, CVE-2026-43951, CVE-2026-44119, CVE-2026-44185, CVE-2026-44186, CVE-2026-44631, CVE-2026-48913, CVE-2026-49975 asterisk: GHSA-3g56-cgrh-95p5, GHSA-3rhj-hhw7-m6fw, GHSA-4pgv-j3mr-3rcp, GHSA-589g-qgf8-m6mx, GHSA-746q-794h-cc7f, GHSA-8jhw-m2hg-vp3h, GHSA-8jw3-ccr9-xrmf, GHSA-g8q2-p36q-94f6, GHSA-h5hv-jmgj-92q2, GHSA-j2mm-57pq-jh94, GHSA-mxgm-8c6f-5p8f, GHSA-ph27-3m5q-mj5m, GHSA-q9fr-m7g8-6ph5, GHSA-qf8j-jp7h-c5hx, GHSA-r6c2-hwc2-j4mp, GHSA-vfhr-r9x9-c687, GHSA-vrfp-mg3q-3959, GHSA-wcvv-g26m-wx5c, GHSA-x348-j6c9-77f3, GHSA-xgj6-2gc5-5x9c avahi: CVE-2026-34933 bind: (no CVE assigned), CVE-2026-3593 cpp-httplib: CVE-2026-45352, CVE-2026-45372, CVE-2026-46527 cups-filters: CVE-2025-64503 expat: CVE-2026-50219, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403, CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407, CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411, CVE-2026-56412 ghostscript: (no CVE assigned) glibc: CVE-2026-5450, CVE-2026-5928 icu: CVE-2025-5222 imagemagick: CVE-2026-48724, CVE-2026-48733, CVE-2026-48734, CVE-2026-48994, CVE-2026-49218, CVE-2026-49219, CVE-2026-53460, CVE-2026-53461, CVE-2026-53462, CVE-2026-53463, CVE-2026-53464, CVE-2026-53465 jq: CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, CVE-2026-39979, CVE-2026-40164, CVE-2026-40612, CVE-2026-41256, CVE-2026-41257, CVE-2026-43894, CVE-2026-43896, CVE-2026-44777, CVE-2026-49839, CVE-2026-54679 libarchive: (no CVE assigned) libcurl: CVE-2026-10536, CVE-2026-11352, CVE-2026-11564, CVE-2026-11586, CVE-2026-11856, CVE-2026-12064, CVE-2026-8286, CVE-2026-8458, CVE-2026-8924, CVE-2026-8925, CVE-2026-8926, CVE-2026-8927, CVE-2026-8932, CVE-2026-9079, CVE-2026-9080, CVE-2026-9545, CVE-2026-9546, CVE-2026-9547 libevent: (no CVE assigned) libglib2: CVE-2025-14087 libgsasl: CVE-2026-48829 libinput: CVE-2026-50292 libopenssl: CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-7383, CVE-2026-9076 libssh2: CVE-2026-55199, CVE-2026-55200 mariadb: CVE-2026-48163, CVE-2026-48165, CVE-2026-49261 mesa3d: CVE-2026-40393 mongoose: (no CVE assigned yet) nginx: CVE-2026-42055, CVE-2026-48142 openjpeg: CVE-2026-6192 openvpn: CVE-2026-11771, CVE-2026-12932, CVE-2026-12996, CVE-2026-13117, CVE-2026-13122, CVE-2026-13698 php: CVE-2026-12184, CVE-2026-14355 python-django: CVE-2026-35192, CVE-2026-35193, CVE-2026-48587, CVE-2026-5766, CVE-2026-6873, CVE-2026-6907, CVE-2026-7666, CVE-2026-8404 python3: CVE-2026-11940, CVE-2026-9669 redis: CVE-2026-23479, CVE-2026-23631, CVE-2026-25243 squid: CVE-2026-33515, CVE-2026-33526, CVE-2026-47729, CVE-2026-50012 sudo: CVE-2026-35535 swupdate: CVE-2026-28525 tiff: CVE-2026-36849 tor: TROVE-2026-025, TROVE-2026-026. util-linux: CVE-2025-14104, CVE-2026-27456, CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 webkitgtk: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901, CVE-2026-28902, CVE-2026-28903, CVE-2026-28904, CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658, CVE-2026-43660 wolfssl: CVE-2026-10097, CVE-2026-10098, CVE-2026-10512, CVE-2026-10592, CVE-2026-11310, CVE-2026-11703, CVE-2026-11999, CVE-2026-12340, CVE-2026-55958, CVE-2026-55960, CVE-2026-55961, CVE-2026-55962, CVE-2026-55964, CVE-2026-55967, CVE-2026-6091, CVE-2026-6092, CVE-2026-6094, CVE-2026-6291, CVE-2026-6325, CVE-2026-6329, CVE-2026-6330, CVE-2026-6331, CVE-2026-6412, CVE-2026-6450, CVE-2026-6678, CVE-2026-6681, CVE-2026-6731, CVE-2026-7511, CVE-2026-7531, CVE-2026-7532, CVE-2026-8720 Toolchain: - gcc: bump 14.x series to 14.4.0 - glibc, localedef: security bump to version 2.41-143-gfc7a48bc9 Infrastructure updates/fixes: - support/testing Improve TestPythonPy3NetworkmanagerGoi - generate-cyclonedx: fixup scp-style git sites - support/testing: Fix test_gnupg2 - support/testing: various internal refactorings Updated / fixed packages: apache, asterisk, avahi, bind, bind, cpp-httplib, cpp-httplib, cups-filters, expat, gcc:, ghostscript, glibc, hwdata, icu, imagemagick, jq, kodi-screensaver-rsxs, libarchive, libcurl, libepoxy, libevent, libglib2, libglib2, libglib2-bootstrap, libgsasl, libgsasl, libinput, libopenssl, libssh2, libssh2, linux, mariadb, mdnsd, mesa3d, mongoose, mpd, nginx, ntp, openjpeg, openrc, openvpn, php, python-django, python3, python3, qt5, redis, rsync, ruby, shadow, shim, squid, squid, squid, squid, strongswan, sudo, swupdate, tiff, tor, util-linux, util-linux, util-linux, util-linux, util-linux, util-linux, webkitgtk, wolfssl	2026-07-16 10:53:11 +02:00
Joachim WibergandGitHub	05fe5b5d46	Merge pull request #1563 from kernelkit/misc Firewall address-set support	2026-07-06 09:37:21 +02:00
Joachim Wiberg	17a1b80b83	Namespace Infix Kconfig options under IX_ Infix defines its own Kconfig options with unprefixed names (IMAGE_, QEMU_, TRUSTED_KEYS*) and an INFIX_ prefix. Unprefixed names risk clashing with Buildroot and with other br2-externals/spins that source our tree. Rename all 86 options to a common IX_ prefix, collapsing the existing INFIX_ ones, e.g. INFIX_IMAGE_ID becomes IX_IMAGE_ID. The os-release INFIX_DESC field is a runtime interface, not a Kconfig option, and is kept; the qemu Config.in generator's @ARCH@ symbol is updated to match. Closes #1305 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-07-06 05:28:11 +02:00
Joachim Wiberg	461c092346	.github: publish .pkg bundle and Raspberry Pi image on release Releases exposed the RAUC upgrade bundle only inside the per-arch tarball, and shipped no ready-to-flash Raspberry Pi image; users had to unpack the tarball or assemble an image from a separate bootloader. Upload output/images/*.pkg as its own artifact, and build an rpi64 SD card image in the aarch64 release leg before rootfs.squashfs is stripped from the tarball, combining it with the rpi64 bootloader from the latest-boot release. Publish both as release assets; the tarball still carries the .pkg too. Closes #1084 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-07-06 05:28:10 +02:00
Joachim Wiberg	b2a7c0aac5	board: enable ip_nonlocal_bind for IPv4 and IPv6 Services could not bind to addresses not yet present on an interface, e.g. floating VIPs managed by a routing daemon, since nonlocal bind was left at the kernel default of disabled. Enable net.ipv4.ip_nonlocal_bind and net.ipv6.ip_nonlocal_bind among the router defaults in /etc/sysctl.d. Closes #1022 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-07-06 05:28:09 +02:00
Joachim Wiberg	e3a0426154	board: mark developer U-Boot builds with -DEVEL Developer builds report the bare upstream U-Boot version, e.g. 2025.01, and are easily mistaken for release builds. Nothing stamps a local version on non-release builds to tell them apart. Write a .scmversion of -DEVEL from a pre-build hook when INFIX_RELEASE is unset, so developer builds report 2025.01-DEVEL. Release builds are left untouched. Closes #919 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-07-06 05:28:09 +02:00
Joachim Wiberg	2a51fc41d7	.github: enable mirror.internal for builders Closes #985 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-07-06 05:28:08 +02:00
Joachim Wiberg	b0de6fc89c	configs: switch arm and riscv64 to pre-built go toolchain Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-07-06 05:28:08 +02:00
Joachim Wiberg	52ba6d2ecc	utils: mirroring script for download artifacts Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-07-06 05:23:53 +02:00
Mattias WalströmandGitHub	ef9cfafdd9	Merge pull request #1564 from kernelkit/kernel-upgrade-a4683739-6d7e-4d01-a5c8-bebf8cf6fabc Upgrade to kernel 6.18.38	2026-07-05 11:05:38 +02:00
ael-bot	dc0519043e	Upgrade Linux kernel to 6.18.38	2026-07-05 06:53:18 +00:00
Joachim Wiberg	4c6aa115a3	webui: fix more wrappers decoding keyed GETs as bare nodes Three more RESTCONF wrappers assume the response to a keyed GET is the bare node, when the server nests it under the full parent path: the container resource-usage stats always read zero, the WireGuard listen port never populated, and resetting advertised link modes silently re-enabled auto-negotiation on links where it was forced off. Same class of bug as the firewall zone reset fix: the decode matches nothing and the zero value is used as if valid. Model the full nesting in all three wrappers, reusing the existing container list wrapper. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-07-04 09:32:02 +02:00
Joachim Wiberg	7291b812a6	webui: fix firewall zone service resets Resetting a zone's services (or interfaces) wiped the entire zone: action, interfaces, address-sets, everything but the name. The keyed zone GET decodes into a wrapper expecting the node bare, but the server nests it under the full parent path: {"infix-firewall:firewall": {"zone": [ ... ]}} The decode silently matched nothing, so the reset handler rebuilt the zone from an empty struct and PUT only the zone name. The same mismatch also broke network preservation when saving a zone. Clear leaf-lists by deleting each instance instead of rebuilding the zone with PUT, so a reset cannot touch anything else. Fix the wrapper shape, document the nesting convention on the RESTCONF client Get, and log a warning when a non-empty response decodes to a zero-valued wrapper. When saving zones, omit empty leaf-lists and a defaulted action. Refresh the firewall page after resets and update the handler tests to mock the real response shape. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-07-04 09:32:01 +02:00
Joachim Wiberg	56ea7faa7c	Add firewall address-set (ipset) support Add firewall address-sets: named sets of IP addresses and networks, usable as zone sources for per-IP access control, issue #1189. Static entries are part of the configuration; dynamic entries are managed at runtime with new add/remove/flush actions, from the CLI or over NETCONF/RESTCONF. Dynamic entries survive firewall configuration changes but are not saved to the configuration. Sets with a timeout expire their entries automatically. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-07-03 08:59:37 +02:00
Joachim Wiberg	ca1d40cf7a	package/webui: add missing license hash Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-07-01 10:34:12 +02:00
Joachim Wiberg	5b370745fd	package/netbrowse: add missing license hash Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-07-01 10:33:59 +02:00
Tobias WaldekranzandGitHub	2a766d7886	Merge pull request #1545 from kernelkit/factory-config-test test: add generic boot-from-factory-config test	2026-07-01 10:14:13 +02:00
Mattias WalströmandGitHub	1bb9f778ff	Merge pull request #1559 from kernelkit/releng Final release touches	2026-07-01 08:53:31 +02:00
Joachim Wiberg	d2abdf0f64	Final ChangeLog update for v26.06 [skip ci] Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-07-01 08:27:16 +02:00
Joachim Wiberg	5df26b217a	utils: link to GNS3 blog instead of GNS3 marketplace Friendlier for first-time users, and drives traffic to the blog, hopefully. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-07-01 08:26:15 +02:00
Joachim WibergandGitHub	b3ae276a14	Merge pull request #1558 from kernelkit/releng Update ChangeLog for v26.06 release	2026-07-01 08:05:23 +02:00
Joachim Wiberg	5bbb83a3e6	Update ChangeLog for v26.06 release [skip ci] Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-06-30 22:59:50 +02:00
Richard Alpe	e233dbc6da	test: reboot at end of factory config test to restore Reboot at end of factory config test to restore test config. Signed-off-by: Richard Alpe <richard@bit42.se>	2026-06-30 17:19:07 +02:00
Mattias WalströmandGitHub	d83c708cd1	Merge pull request #1553 from kernelkit/wifi-fixes2 Some important wifi fixes	2026-06-30 13:31:01 +02:00
Richard Alpe	d333c66f9c	test: add generic boot-from-factory-config test Verify that the device's factory-default configuration boots cleanly and that the device remains usable afterwards -- i.e. it does not fall back to the fail-secure failure-config. The test exercises the device's own first-boot bootstrap path: it clears the startup-config and reboots with the test-mode startup override set, so confd initialises running from the factory-config (its first-boot path). That mirrors a factory-fresh / factory-reset device and avoids applying a full config swap over the live management session -- confd cannot replace the whole running datastore from within an RPC without timing out, and a factory config may reconfigure the very transport we are connected over. The test is image-generic, using whatever factory-config the running image was built with, so it covers both the stock Infix factory config and any spin factory config. A single-node (1x1) topology is used on purpose: a factory config is not written with a lab full of peers in mind, so booting it across a multi-node topology could trigger broadcast storms or similar. NETCONF only, as it is the one management transport present in every factory config. Signed-off-by: Richard Alpe <richard@bit42.se>	2026-06-30 10:32:43 +02:00
Mattias Walström	1b11bae8eb	test: static_multicast_filters: Fix indendation	2026-06-30 09:18:52 +02:00
Mattias Walström	2744e6ee85	test: Whitespace	2026-06-30 09:18:52 +02:00
Mattias Walström	9b41139066	test: netns: refactor must_receive Parameter was called `timeout` but it was used as a duration, how long it should fetch packets to match on.	2026-06-30 09:18:52 +02:00
Mattias Walström	d0d95f4098	confd: wifi: Fix issue with reconfigure modes on a wifi radio The previous mode was not teardowned correctly	2026-06-30 09:18:52 +02:00
Mattias Walström	84dfaf7c03	buildroot: Add missing MBO feature in hostapd	2026-06-30 09:18:52 +02:00
Tobias WaldekranzandGitHub	afcc40589a	Merge pull request #1556 from kernelkit/misc Minor fixes	2026-06-30 09:06:25 +02:00
Joachim Wiberg	208f7c9f08	confd: simplify gen-hostname, defer MAC expansion to confd gen-hostname baked the last three MAC octets straight into the generated hostname, so the actual MAC ended up stored in the configuration. Copy that config to another device and its hostname no longer matched the hardware. Emit the %h and %m format specifiers and let confd expand them when the config is applied, so the MAC is resolved per device and never written to a saved config. This also drops the /run/system.json lookup. Closes #1554 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-06-29 19:35:04 +02:00
Joachim Wiberg	f8c68a38af	version: derive OS version from git describe, not the release label On weekly builds INFIX_RELEASE is "latest", and it fed straight into INFIX_VERSION, so the keyword showed up as VERSION, VERSION_ID and PRETTY_NAME in /etc/os-release, in /etc/version (show version), in the ietf-system os-version operational leaf, and in the mDNS advertisement. None of those pinned down the source revision; only BUILD_ID did. Tie INFIX_VERSION to INFIX_BUILD_ID (git describe). INFIX_RELEASE now only labels the release channel (IMAGE_VERSION) and names the published artifacts. Also exclude the moving 'latest*' tags from git describe, so the build id can never resolve to "latest" should that tag land on, or nearest to, the built commit. Fixes #1524 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-06-29 18:36:17 +02:00
Mattias WalströmandGitHub	8994879e26	Merge pull request #1551 from kernelkit/kernel-upgrade-953677c4-aa53-4a5e-a399-5b0a5e1482a7 Upgrade to kernel 6.18.37	2026-06-29 14:41:30 +02:00
Joachim WibergandGitHub	b5a0ea0b1b	Merge pull request #1552 from kernelkit/releng Update ChangeLog for v26.06.0 release [skip ci]	2026-06-28 18:07:05 +02:00
Joachim Wiberg	435406af68	Update ChangeLog for v26.06.0 release Add relevant fixes and features that was missed in PRs. [skip ci] Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-06-28 06:44:20 +02:00
ael-bot	79107d2548	Upgrade Linux kernel to 6.18.37	2026-06-27 13:24:01 +00:00
Mattias WalströmandGitHub	7a9cece84f	Merge pull request #1550 from kernelkit/refactor-misc-operational	2026-06-27 12:58:26 +02:00
Mattias Walström	b8ba1a1042	test: spec: Allow to generate test specification without logical topology	2026-06-27 10:57:22 +02:00
Mattias Walström	60676e21be	test: operational_all: Harden to catch more - Test so the value in operational actually is correct - Move test to last in suite to see that there are no stray data in operational (yangerd)	2026-06-27 10:57:22 +02:00
Joachim WibergandGitHub	763750b6ed	Merge pull request #1549 from kernelkit/coverity-findings	2026-06-27 09:45:11 +02:00
Joachim Wiberg	23c5f16a4f	confd: guard NULL forced PMD in fixed-speed ethtool config In netdag_gen_ethtool_autoneg() the unmapped and "exactly one entry" checks already guarantee a forced PMD link mode is selected, but Coverity cannot see the correlation and flags the later deref. Fold !forced into the entry-count guard to make the invariant explicit. Fixes Coverity CID 561388. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-06-27 07:26:04 +02:00
Joachim Wiberg	5d3fce35c8	confd: guard NULL band/ssid/class in WiFi config generation lydx_get_cattr() yields NULL for an absent leaf or a failed radio component lookup; that NULL was passed straight to strcmp() on several WiFi paths (wifi_chan_to_freq, the wifi_gen_mesh width branches, wifi_find_higher_band_twin, dep_radio_components), risking a crash. Guard each value before use. Fixes Coverity CID 561387, 561389, 561390, 561391, 561392. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-06-27 07:25:59 +02:00
				`@@ -0,0 +1 @@`
				`sha256 49c4d5edbd3ee0a0f6b15ef097b79539530a574ceed8a4dffec1d02455933029 LICENSE`
				`@@ -0,0 +1 @@`
				`sha256 8cdb4def6e91fde66ed0880a6e6ecc364aa96012e53b3cfb990b53b9dab976d4 LICENSE`