summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* vrunner: use QMP quit before SIGTERM in daemon_stop escalationBruce Ashfield2026-06-121-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | When the SHUTDOWN-via-virtio-serial poll window expires and the QEMU process is still alive, send a QMP quit before SIGTERMing. Functionally near-equivalent to SIGTERM at the process level (both converge on qemu_system_killed() and a block-layer flush) but goes through QEMU's monitor interface, which is the same mechanism hv_idle_shutdown() already uses for idle-timeout shutdowns. Unifying the two escalation paths makes the code easier to reason about — one channel for "ask QEMU to exit cleanly," one fallback for "the monitor isn't responding." QMP quit is NOT a replacement for the virtio-serial ===SHUTDOWN=== command: it stops QEMU without giving the guest a chance to run its own graceful_shutdown() (which is what cleanly unmounts the state disk). It's only an improvement over SIGTERM as the *fallback* when the guest hasn't responded to the SHUTDOWN command within the poll window. The full architectural fix — QMP system_powerdown driving an ACPI handler in the guest that calls graceful_shutdown() — needs guest-side acpid wiring and is tracked separately. SIGTERM and SIGKILL remain as further fallbacks for cases where QMP itself is unresponsive (e.g. older configs without a QMP socket, or QEMU hung in a state where the monitor stops servicing commands). Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* vrunner: poll for clean VM exit before SIGTERM in daemon_stopBruce Ashfield2026-06-121-3/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The daemon_stop() flow sent ===SHUTDOWN=== over virtio-serial and then slept exactly 2 seconds before unconditionally SIGTERMing QEMU. The guest's graceful_shutdown(), which is what the SHUTDOWN command ultimately triggers, does: sync umount /var/lib/containers/storage (ext4 journal commit) sync blockdev --flushbufs (per disk) sync sleep 2 reboot -f Under load this routinely takes 5-30 seconds — the ext4 journal commit on the state disk after a vimport that just wrote tens of MB of layer blobs is the slow step. A fixed 2-second wait followed by SIGTERM kills the guest mid-umount and leaves the state disk's journal half-committed: layer files have correct inode metadata but partially-unwritten data extents. The next memres session remounts that disk and reads the apparently-OK files. Tar-split reassembly during podman save / podman push then hits the unwritten extents and produces: Error: reading blob sha256:<hash>: EOF Error: reading blob sha256:<hash>: file integrity checksum failed for "<file>" Reported via yocto-patches as a workaround in run-push-containers (`<runtime> image rm --all` before push) on the autobuilder. The "first push works, subsequent fail" pattern in that report comes from the first push hitting a clean session and subsequent pushes inheriting the corrupted state disk from the prior SIGTERM-truncated shutdown. Replace the fixed sleep with a poll loop that watches for the QEMU process to exit, up to 60 seconds (120 * 0.5s). 60s is generous enough to cover heavy ext4 journal commits; short enough that a truly hung guest doesn't block the caller indefinitely. The existing SIGTERM and SIGKILL escalation paths remain as fallbacks for the genuinely-stuck case. Reproducer: vimport an OCI image as testimg:latest, save it, memres restart, re-vimport, save again. Without this fix the second save fails 100% of the time on the same blob digest with EOF or CRC error. With this fix six consecutive vimport+save cycles across three restart rounds complete cleanly. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* tests: add containerd and CRI-O recipe and runtime testsBruce Ashfield2026-06-121-0/+358
| | | | | | | | | | | | | | | | | | | | | | | 35 tests across three tiers: Tier 1 (static): containerd recipe checks (virtual/containerd provider, systemd service, CNI networking, ctr/shim install), profile config, packagegroup, nerdctl and cri-tools recipe existence, CRI-O recipe checks (seccomp requirement, systemd service, CNI/conmon/runtime deps). Tier 2 (build): containerd, nerdctl, and container-image-host with containerd profile build verification. Tier 3 (boot): containerd service status, ctr/nerdctl availability and version, namespace listing, runtime availability, CNI plugins, nerdctl pull/run/images cycle with busybox. The boot tests build container-image-host with CONTAINER_PROFILE=containerd automatically. CRI-O boot tests are not included — CRI-O requires a kubelet to drive it, so runtime testing is covered by k3s tests when k3s is configured to use CRI-O as its CRI. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* tests: add libvirt recipe and runtime testsBruce Ashfield2026-06-121-0/+468
| | | | | | | | | | | | | | | | | | | | | | | 46 tests across three tiers: Tier 1 (static, no build): Recipe structure, PACKAGECONFIG options, hook_support.py python3 compatibility (text mode, raw string regex, syntax validation), service files, patch files, kvm-image-minimal recipe checks. Tier 2 (build): libvirt and kvm-image-minimal build verification. Tier 3 (boot): libvirtd service status, virtlockd socket, virsh connectivity via monolithic daemon socket, capabilities, nodeinfo, domain listing, default network, hook script installation and permissions, qemu user and libvirt group existence. The boot tests use the explicit monolithic daemon socket path (qemu+unix:///system?socket=/var/run/libvirt/libvirt-sock) because libvirt v12 defaults to modular daemons (virtqemud) but the kvm-image-minimal recipe runs the monolithic libvirtd. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* libvirt: enable nftables by defaultBruce Ashfield2026-06-121-1/+1
| | | | | | | | | | | | | | The iptables kernel modules (MASQUERADE, etc.) are increasingly unavailable — the broader container ecosystem has moved to nftables (netavark dropped iptables entirely, incus prefers nft). Without nftables enabled, libvirtd's default network fails to start with "Extension MASQUERADE revision 0 not supported, missing kernel module". Add nftables to the default PACKAGECONFIG. This switches the firewall backend priority to nftables,iptables (prefer nft, fall back to iptables) and changes RDEPENDS from iptables to nftables + iproute2-tc. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* libvirt: disable secrets encryption for embedded environmentsBruce Ashfield2026-06-121-0/+10
| | | | | | | | | | | | | | | Libvirt v12 added encrypted secrets storage using systemd-creds. The build-time virt-secret-init-encryption.service generates an encrypted credential via 'systemd-creds encrypt' tied to the build host's TPM or machine key. At runtime in a QEMU VM (or any different machine), the credential cannot be decrypted, causing libvirtd to fail with "Invalid encryption key for the secret" and refuse to start. Set encrypt_data = 0 in secret.conf and remove the stale build-time encrypted key file. Embedded and QEMU-based environments do not have persistent machine credentials needed for this feature. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* tests: remove redundant DISTRO_FEATURES appends from build fixturesBruce Ashfield2026-06-123-3/+2
| | | | | | | | | | | | | | | | | The -R conf files used by test build fixtures appended DISTRO_FEATURES values that are already provided by meta-virt-host.conf (virtualization, vcontainer, systemd). BitBake tracks append operations in task hashes, so a duplicate append changes the hash and invalidates sstate for every recipe that depends on DISTRO_FEATURES — causing full rebuilds even when the image was just built. Only append features genuinely needed by the test profile and not already present in the base config: - k3s: append only "k3s" (virtualization already in base) - xen: append only "xen vxn" (virtualization systemd vcontainer in base) - incus: no append needed (CONTAINER_PROFILE alone is sufficient) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* linux-yocto: add CONFIG_SCHED_CORE for LXC 7.0Bruce Ashfield2026-06-122-0/+5
| | | | | | | | | | | | | LXC 7.0.0 requires core scheduling support (CONFIG_SCHED_CORE) and aborts container startup with "The kernel does not support core scheduling" when it is missing. This is a new hard requirement — previous LXC versions treated it as optional. Add lxc-extra.cfg fragment unconditionally (alongside the existing lxc.scc from the kernel cache) since any build with the virtualization DISTRO_FEATURE may use LXC containers via incus or directly. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* incus: change service type from notify to simpleBruce Ashfield2026-06-121-3/+4
| | | | | | | | | | | | | Incusd does not call sd_notify(READY=1) — the Go source has no systemd notification support in the main daemon (only in incus-agent, the guest-side component). With Type=notify, systemd waits indefinitely for the ready notification and the service stays in 'activating' state even though incusd is fully operational. This was not caught before the v7 uprev because the previous build was cached via sstate or the service was tested manually. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* incus: switch from iptables to nftablesBruce Ashfield2026-06-121-1/+1
| | | | | | | | | | Incus detects nftables at runtime and prefers it for firewall management. Without the nft binary, incusd logs "nft missing" and falls back to a degraded mode that can leave the service stuck in activating state. The broader ecosystem has moved to nftables — netavark already dropped iptables support entirely. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* k3s: fix pause image reference for containerd v2Bruce Ashfield2026-06-123-5/+15
| | | | | | | | | | | | | | | | | | K3s's default pause image reference "rancher/mirrored-pause:3.6" is a short name that containerd v1 auto-expanded to the fully qualified "docker.io/rancher/mirrored-pause:3.6". The k3s v1.36 uprev moved to containerd v2, which uses a new CRI plugin (io.containerd.cri.v1) with a pinned_images config instead of the old sandbox_image. Containerd v2 no longer auto-expands short names when looking up pinned images, causing every pod sandbox creation to fail with "image not found" even though the image is present in the containerd image store under its fully qualified name. Pass --pause-image docker.io/rancher/mirrored-pause:3.6 in both the server and agent systemd service files to use the fully qualified reference that containerd v2 can resolve. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* tests: make k3s, incus, and xen tests self-containedBruce Ashfield2026-06-123-49/+159
| | | | | | | | | | | | | | | | | | | These boot tests previously required manual local.conf changes to set CONTAINER_PROFILE, DISTRO_FEATURES, and other variables before the image could be built and tested. This meant complete test coverage required editing local.conf between runs. Add build fixtures that use bitbake -R with a temporary conf file to inject the required variables automatically: - k3s: builds container-image-host with CONTAINER_PROFILE=k3s-host - incus: builds container-image-host with CONTAINER_PROFILE=incus - xen: builds xen-image-minimal with xen/vxn DISTRO_FEATURES Each test module now builds its own image before booting, using the same run_bitbake + extra_vars pattern established in test_container_cross_install.py. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* tests: fix image ID parsing and 9p assertion patternsBruce Ashfield2026-06-122-22/+25
| | | | | | | | | | | | | | test_vdkr_registry.py: Docker's images output changed from separate REPOSITORY TAG IMAGE_ID columns to combined IMAGE ID DISK_USAGE columns. The parser grabbed the disk usage (8.45MB) as the image ID. Handle both old and new formats. test_container_registry_script.py: The secure registry tests checked for literal 'virtfs' and 'cashare' strings in vrunner.sh, but the 9p share setup was refactored to use hv_build_9p_opts(). Update assertions to match the current abstraction. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* tests: parametrize boot tests over container profiles for full coverageBruce Ashfield2026-06-122-209/+227
| | | | | | | | | | | | | | | | | | | | | | | | | | The boot tests (TestBundledContainersBoot, TestCustomServiceFileBoot) previously depended on whatever CONTAINER_PROFILE was in local.conf, skipping docker checks when podman was configured and vice versa. Getting complete coverage required manually editing local.conf and running the tests twice. Add --container-profiles pytest option (default: docker,podman) and a profiled_session fixture that builds container-image-host with each profile via a temporary bitbake -R conf file, boots it, and runs all checks. Both docker and podman get a full build-boot-verify cycle in a single test run with no local.conf changes. Also fix: - run_bitbake() gains extra_vars parameter for bitbake -R overrides - Strip OSC 3008 shell integration escape sequences from run_command output (BusyBox shell emits these, corrupting file paths used in subsequent commands) - Use known file paths for service file content checks instead of extracting paths from ls output (avoids escape sequence corruption) - Add test_bundle_class_unpack_enabled to catch do_unpack[noexec] regression Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* container-bundle: fix do_unpack for custom service filesBruce Ashfield2026-06-121-3/+3
| | | | | | | | | | | | | | | | | CONTAINER_SERVICE_FILE varflags reference files from SRC_URI via ${UNPACKDIR}, but do_unpack[noexec] = "1" prevented SRC_URI file:// entries from being unpacked. The custom service files never reached UNPACKDIR, the install loop silently skipped them, and bundles ended up with empty services/ directories. The noexec was added when the class had no source files of its own, but CONTAINER_SERVICE_FILE introduced a legitimate need for SRC_URI unpacking. Also fix S to use UNPACKDIR instead of WORKDIR, which OE-core's do_unpack QA check now requires. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* tests: fix container-cross-install bitbake invocation and busybox compatBruce Ashfield2026-06-122-20/+34
| | | | | | | | | | | | | | | | | | | | | | | | Three issues in test_container_cross_install.py: - run_bitbake() called bitbake directly, requiring the OE build environment to be pre-sourced. test_multilayer_oci.py wraps bitbake in 'bash -c source oe-init-build-env && bitbake' which is self- contained. Adopt the same pattern so tests work from any shell. - test_vdkr_initramfs_create and test_vpdmn_initramfs_create built the initramfs recipes in the main config, but these recipes require the vruntime multiconfig distro. Use mc:vruntime-x86-64: prefix. - test_systemd_services_directory_exists used 'head -5' which BusyBox does not support (requires 'head -n 5'). The container-image-host image uses BusyBox when built without coreutils. Also fix conftest.py VdkrRunner and VpdmnRunner ensure_memres() to default no_registry=True, so pulled images use short names (alpine:latest) rather than registry-prefixed names from the baked-in VDKR_DEFAULT_REGISTRY config. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* netavark: add nftables as runtime dependencyBruce Ashfield2026-06-122-0/+4
| | | | | | | | | | | | | | Netavark dropped iptables support and now uses nft directly for all firewall rules (masquerade, DNAT, connection tracking). Without nftables installed, netavark fails at runtime with "unable to execute nft: No such file or directory", preventing any podman container from starting with network access. Add nftables to netavark's RDEPENDS since it is an unconditional runtime requirement, and to packagegroup-netavark for independent packagegroup usage. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* container-host-config: update registries.conf to v2 formatBruce Ashfield2026-06-121-23/+8
| | | | | | | | | | Podman 6.0 rejects the v1 registries.conf format entirely, failing with "registries.conf must be in v2 format but is in v1" at runtime. The old format used [registries.search] with registries = [...] syntax which was deprecated for years. Docker is unaffected — it does not read registries.conf. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* vpdmn: switch to nftables and add kernel config for netavarkBruce Ashfield2026-06-043-1/+22
| | | | | | | | | | | | | | | | | | | | Netavark dropped iptables support entirely and now uses nft directly for firewall rules (masquerade, DNAT, connection tracking). The vpdmn rootfs had iptables installed but the vruntime kernel had CONFIG_NF_TABLES disabled, causing netavark to fail at runtime with "Protocol not supported" when trying to initialize the nftables Netlink socket. Replace iptables with nftables in vpdmn-rootfs-image IMAGE_INSTALL and add container-net.cfg kernel config fragment enabling NF_TABLES, NFT_MASQ, NFT_NAT, NFT_CT, NFT_FIB and related options required by netavark's nftables firewall driver. The fragment is gated on the vcontainer DISTRO_FEATURE so it only applies to vruntime/vcontainer kernels, not arbitrary builds that happen to include meta-virtualization. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* netavark: update to v2.0.0-dev-tipBruce Ashfield2026-06-042-128/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping netavark to version v1.17.0-165-ga1f48948, which comprises the following commits: 196ff50c fix(deps): update rust crate clap to ~4.6.1 8e7bd639 Cirrus: Remove all setup 7ef20deb packit: Add testing-farm jobs 4e65e01e tmt: Initial enablement 28a9af01 rpm: Add tests subpackage f57e23e0 gitignore: Include generated rpm dirs a105a5d9 Tests: Use environment variables for binary paths 13235bdc fix(deps): update tonic monorepo to 0.14.6 8c066cf0 test: run firewalld with debug logging 0b60e14d fix(deps): update rust crate mozim to 0.3.2 34bce643 fix(deps): update rust crate tokio to 1.52.3 48f26952 bats: remove fd 3 work around 6d59b0d0 bump msrv to 1.88 27a27e82 Packit: Only create dist-git PRs for rawhide f75ebcbb Improve error messages 5fb96334 Remove OWNERS file 230dd6eb routes: Add route_type field for blackhole/unreachable/prohibit routes 06187459 fix(deps): update rust crate tokio to 1.52.1 3f3c588d bridge: default to strict isolation mode 65fe5b5c macvlan: use a default metric of 99 e798da91 fix(deps): update rust crate netlink-packet-route to 0.30.0 ab5e1843 fix(deps): update rust crate tokio to 1.52.0 457369fa Ensure create plugins don't change name, id, or driver 98e8a4c2 Add within-network subnet overlap and duplicate validation f81e2332 chore(deps): update rust crate rand to v0.9.3 [security] c45d1e7f Fix: Add more descriptive netavark error messages(s) 61112f39 Add IPv6 auto-detection in network create 825a2014 Add more create tests. b2f28218 fix(deps): update rust crate tokio to 1.51.1 41ae8821 fix(deps): update rust crate tokio to 1.51.0 0378fa78 fix(deps): update rust crate clap to ~4.6.0 abe3842a fix(deps): update rust crate env_logger to 0.11.10 d9b5a3bd fix(deps): update rust crate regex to 1.12.3 ec9414e9 fix(deps): update rust crate chrono to 0.4.44 4b643515 Re-use parse functions for drivers 7525cba1 Introduce netavark create command fa9a2a30 Break out exec plugin logic 3710f631 Split `install` into sub-targets 80bb1b80 chore(deps): update rust crate once_cell to 1.21.4 59a81031 chore(deps): update dependency containers/automation_images to v20260310 f725857c chore(deps): update rust crate tempfile to 3.27.0 9dadaa43 fix(deps): update rust crate tokio to 1.50.0 a7bb3355 fix(deps): update rust crate ipnet to 2.12.0 497df7eb fix(deps): update rust crate clap to ~4.5.60 358d63a8 [skip-ci] Update GitHub Artifact Actions 39c9a938 chore(deps): update rust crate tempfile to 3.26.0 a3863bb0 remove netlink zero buffer workaround da79ffe6 chore(deps): update rust crate chrono to 0.4.44 b5b9ffd1 fix(deps): update rust crate netlink-packet-route to 0.29.0 402e401b fix(deps): update tonic monorepo to 0.14.5 a85e4938 Support multiple static IPs per subnet b49f7b99 fix(deps): update rust-futures monorepo to 0.3.32 90bbbc12 fix(deps): update tonic monorepo to 0.14.4 c7797087 migrate to oidc faca63ea fix(deps): update rust crate env_logger to 0.11.9 7860f16a chore(deps): update rust crate tempfile to 3.25.0 d082033f fix(deps): update rust crate hyper-util to 0.1.20 e2d40bd4 fix(deps): update tonic monorepo to 0.14.3 3c42c174 fix(deps): update rust crate netlink-sys to 0.8.8 c552dc4b netlink_route: remove NLM_F_ACK from dump requests e76248e2 netlink: validate buffer length fd3d2ad1 netlink: zero out buffer before sending 8b3db5e1 netlink: socket read logic 00ae6483 bridge: read mtu from vrf table if set 0e114222 only consult main routing table for default interface f0bce8d8 chore(deps): update rust crate chrono to 0.4.43 becf497f fix(deps): update rust crate tower to 0.5.3 b070c572 fix(deps): update rust crate zbus to 5.13.1 a8b25232 fix(deps): update rust crate prost to 0.14.3 5eeca3ff fix(deps): update rust crate zbus to 5.13.0 0b0c5c13 fix(deps): update rust crate netlink-packet-route to 0.28.0 aaf2eb54 chore(deps): update rust crate tempfile to 3.24.0 c08db05c fix(deps): update rust crate tokio-stream to 0.1.18 26854297 fix(deps): update rust crate tokio to 1.49.0 d1acb61b fix(deps): update rust crate serde_json to 1.0.146 1b53849b [skip-ci] Update GitHub Artifact Actions c8c07fd7 chore(deps): update dependency containers/automation_images to v20251211 f2c5265a mozim: do not use netlink feature d8901d00 bump mozim to v0.3.1 49ee09b2 make network setup order deterministic eaa44031 fix(deps): update rust crate hyper-util to 0.1.19 d42622bc fix(deps): update rust crate log to 0.4.29 658740ee fix(deps): update rust crate clap to ~4.5.53 6c2066a3 [skip-ci] Update actions/checkout action to v6 02ae64f6 New images 2025-11-20 2355b144 Minor documentation and style fixes 7054ba66 Add test cases that existed for iptables but not for nftables 0fa48211 Remove iptables support 37446a17 fix(deps): update rust crate hyper-util to 0.1.18 1df91984 bump to v2.0.0-dev bd90b616 add outbound_addr4 & outbound_addr6 to bridge driver Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* podman: switch from CNI to netavark as sole network backendBruce Ashfield2026-06-043-15/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | Podman's vendored containers/common library removed CNI support entirely in commit 8d1f636e40 (March 2026). The NetworkBackend() function now unconditionally rejects any backend other than netavark, making network_backend = "cni" in containers.conf a runtime error. The vpdmn rootfs originally used CNI because netavark's dependency chain (nmap -> libpcap -> bluez5 -> cairo) was too heavy for the vruntime BBMASK environment. That dependency chain no longer exists — netavark v1.16.0+ uses a built-in Rust connection tester and has no heavyweight runtime dependencies. Recipe changes: - Clear BUILDTAGS_EXTRA default (was CNI build tag, now a no-op) - Set VIRTUAL-RUNTIME_container_networking and _container_dns with strong assignments so podman always RDEPENDS on netavark and aardvark-dns regardless of distro config - Remove ${sysconfdir}/cni from FILES vpdmn rootfs changes: - Replace cni with netavark + aardvark-dns in IMAGE_INSTALL - Update containers.conf network_backend from cni to netavark Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* slirp4netns: update to v1.3.4-tipBruce Ashfield2026-06-031-2/+2
| | | | | | | | Bumping slirp4netns to version v1.3.4-2-g13fd3e7, which comprises the following commits: 4f4bcaf v1.3.4+dev Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* passt: update to 2026_05_26-tipBruce Ashfield2026-06-031-2/+2
| | | | | | | | | Bumping passt to version 2026_05_26.038c51e-2-g4b28237, which comprises the following commits: 4b28237 tcp: Don't leak sockets on error paths 98e3c01 tcp, tcp_splice: Make helper for setting SO_LINGER socket option Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* openvswitch: update to v3.7.1-tipBruce Ashfield2026-06-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Bumping ovs to version v3.7.1-18-g04b05b31a, which comprises the following commits: 04b05b31a ofproto-dpif: Fix bundle floodable flag when disabling STP/RSTP. ea4ac2dd5 ovsdb-cs: Fix resource leak in ovsdb_cs_parse_schema(). e2a95595a configure: Allow disabling POSIX async I/O and disable in FreeBSD CI. 8dbcfcc4c cirrus: Remove Cirrus CI for running FreeBSD test builds. 73057faec github: Migrate FreeBSD CI from Cirrus CI to GitHub Actions. 47446a693 ofproto-dpif: Remove unused rule->recirc_id. 502e13a8b ofproto-dpif: Rename recirc_free_ofproto to better match the code. 9b63c2ead ofproto-dpif: Avoid race between recirc id free and the leak check. bc4498ced docs: Remove a few remaining references to the OOT module. b7d221174 vswitch.xml: Remove the claim that OVS processes are single-threaded. 1f28a59dc vswitch.xml: Remove the claim that L3 GRE is not supported. 04ad744ff dpif-netdev: Fix mega flow ufid collisions for different wild cards. 332081017 ofproto-dpif-xlate: Classify ct_clear as non-reversible for clone(). 45443e077 docs: Fix OpenFlow port range. 1a77b18d0 github: Re-enable system tests for DPDK and AF_XDP. b53965f1a netdev-dpdk: Fix memory leak when configuring rx-steering. 1c9b2cefd stream-ssl: Disable TLS session tickets. 78aa10ca3 Prepare for 3.7.2. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* cni: bump plugins to v1.9.1-tip and flannel to v1.9.1-flannel1-tipBruce Ashfield2026-06-034-48/+91
| | | | | | | | | | | | | | | | | | | | | | | The cni recipe pins three upstream components. Per-component state: - containernetworking/cni (SRCREV_cni): unchanged at 7c270076 = v1.3.0-27-g7c27007, already at master HEAD. - containernetworking/plugins (SRCREV_plugins): 6d8f05b8 -> d653d38d (v1.9.1-3 -> v1.9.1-10). - flannel-io/cni-plugin (SRCREV_flannel_plugin): 09e4c7f9 -> e4902565 (v1.9.0-flannel1-12 -> v1.9.1-flannel1-6 — crosses to the v1.9.1 flannel line). PV stays at 1.3.0+git since the canonical "cni" component didn't move. Regenerated go-mod sidecars via `bitbake cni -c discover_and_generate` for the new go.sum that the plugins + flannel SRCREV bumps imply. Added `include go-mod-licenses.inc` for first-time per-dependency license tracking on this recipe. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* yq: update to v4.53.2-tipBruce Ashfield2026-06-035-13/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping yq to version v4.53.2-25-g8f3291d3, which comprises the following commits: 8f3291d3 fix: decode properties array bracket paths (#2693) 2861815f fix(json): preserve floats with trailing zero when encoding YAML to JSON (#2701) fcb79822 feat(toml): fix JSON to TOML root scope and null handling (#2689) e9acb9b7 Bump golang.org/x/mod from 0.35.0 to 0.36.0 (#2709) 83b282c4 Bump golang.org/x/net from 0.53.0 to 0.54.0 (#2707) 54fa4324 Bump golang from 1.26.2 to 1.26.3 (#2706) ee6c30da fix: reset TOML decoder finished flag on Init to fix multi-doc evaluation (#2704) 722c9aa1 Fix nested inline YAML merge explode (#2699) 702dd160 Bump github.com/pelletier/go-toml/v2 from 2.3.0 to 2.3.1 (#2695) d1dff466 fix: preserve TOML inline table array scope (#2694) cb979355 fix: TOML encoder uses inline tables for YAML FlowStyle mappings, inconsistent with explicit JSON parsing (#2687) cfe2eee7 Preserve empty TOML arrays in tables (#2686) 1a433d10 Bump actions/upload-artifact from 4.6.1 to 7.0.1 (#2663) 1c0d8b9d Bump actions/checkout from 4.2.2 to 6.0.2 (#2668) 0110a3ce Bump golang.org/x/net from 0.52.0 to 0.53.0 (#2669) 54482d44 Bump golang from `2a2b4b5` to `5f3787b` (#2664) 33f3351c Bump ossf/scorecard-action from 2.4.1 to 2.4.3 (#2665) 6cb656ce Bump alpine from `2510918` to `5b10f43` (#2667) ecc43d7c fix: reset TOML decoder between files when evaluating all at once (#2685) 1deec5e4 Fix repeatString overflow test on 32-bit platforms (#2680) ff45fad1 Bump github.com/zclconf/go-cty from 1.18.0 to 1.18.1 (#2682) 6679d3c0 Bump github/codeql-action from 3 to 4 (#2671) 54a7fc8f Bump softprops/action-gh-release from 2.6.2 to 3.0.0 (#2672) 0d3ab079 Bump golang.org/x/text from 0.35.0 to 0.36.0 (#2670) d93987a9 release notes Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* python3-webob: update to 1.8.10Bruce Ashfield2026-06-031-1/+1
| | | | | | | | Bump 1.8.9 -> 1.8.10 (latest on PyPI). New sdist sha256sum: 1c963a11f307bc3f624fbab9dde737701eae255f32981b7a5486a88db1767c2b Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* python3-newrelic: update to 13.1.0Bruce Ashfield2026-06-032-20/+40
| | | | | | | | Bump 10.9.0 -> 13.1.0 (latest on PyPI). New sdist sha256sum: 1492f0fe510cdc0c1347f597baca2a3ddd7e0662895a800e19fe524396f7bf05 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* python3-dotenv: update to 1.2.2Bruce Ashfield2026-06-032-366/+2
| | | | | | | | Bump 1.1.0 -> 1.2.2 (latest on PyPI). New sdist sha256sum: 2c371a91fbd7ba082c2c1dc1f8bf89ca22564a087c2c287cd9b662adde799cf3 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* python3-bugsnag: update to 4.9.0Bruce Ashfield2026-06-031-1/+1
| | | | | | | | Bump 4.7.1 -> 4.9.0 (latest on PyPI). New sdist sha256sum: c22e2d1f0148282a0898e4c81a0ed39c65ee566e20bdc43cec04b978eb272b2b Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* python3-botocore: update to 1.43.21Bruce Ashfield2026-06-031-1/+1
| | | | | | | | Bump 1.37.35 -> 1.43.21 (latest on PyPI). New sdist sha256sum: 17604607efe28894e947401379e569cc8f0fe2d69337ece98bd0c82d1bcfaf92 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* python3-boto3: update to 1.43.21Bruce Ashfield2026-06-031-1/+1
| | | | | | | | Bump 1.37.35 -> 1.43.21 (latest on PyPI). New sdist sha256sum: 6dfeb70bf4f9a3514b91c7199f475f71f939199d62f9c63cd555b033fb283f89 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* gunicorn: update to 26.0.0Bruce Ashfield2026-06-031-3/+3
| | | | | | | | Bump 23.0.0 -> 26.0.0 (latest on PyPI). New sdist sha256sum: ca9346f85e3a4aeeb64d491045c16b9a35647abd37ea15efe53080eb8b090baf Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* python3-udica: update to v0.2.9Bruce Ashfield2026-06-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping udica to version v0.2.9, which comprises the following commits: 0ffdba2 udica-0.2.9 08d2da4 Add --tcp-connect option a3eb3de Clean up after adding LDX support 6698e0b Add LXD support 1c91fe0 Clean up after adding custom rule support 1c0814b feat: Add support for custom CIL templates 71c8bdf Fix issues reported by latest "black" f0faa84 github: Run tests also on CentOS stream 10 45b5841 Update actions/checkout action to v6 83544e9 chore(deps): update dependency containers/automation_images to v20260310 54fa8f5 chore(deps): update dependency containers/automation_images to v20250422 925e78d chore(deps): update dependency containers/automation_images to v20250324 0472a15 github: disable testing on centos8 7fa8143 chore(deps): update dependency containers/automation_images to v20250131 edd373f [skip-ci] Update actions/checkout action to v4 afcb14f cirrus: Install fuse-overlayfs 5ed2702 chore(deps): update dependency containers/automation_images to v20240529 2604f49 confined: Allow watching mount_var_run_t 131d228 confined: allow asynchronous I/O operations f411c14 confined: make "-l" non optional d444e67 Add tests covering confined user policy generation 3cda61f Add option to generate custom policy for a confined user fa7fe1b Update dependency containers/automation_images to v20231208 b19842e udica-0.2.8 5428c0b CI: Drop release from test name 16b952d Update dependency containers/automation_images to v20231004 0e25295 Update dependency containers/automation_images to v20230614 313ece3 Update dependency containers/automation_images to v20230426 61e4adf [skip-ci] Update actions/checkout action to v3 6a7382b Fix generating policy for Crio mounts 558f7f5 Update dependency containers/automation_images to v20230405 3e33f1a Add renovate configuration c2a33cb Cirrus: Update CI VM Images 5d6feb3 Fix several lint findings 07ff36f Show diff when checking formatting e4383f9 Cirrus: Update CI VM images to F37 34c0f13 Rename --device-access to --devices 0d3e319 Add unit test for --device-access a2f0e45 Syntax changes after running black a72b8ff Add ---device--access option bd32eaf Cirrus: Update CI VM images Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* go-dirhash-native: update golang.org/x/mod to v0.36.0-tipBruce Ashfield2026-06-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping the pinned golang.org/x/mod commit from v0.27.0 to v0.36.0-2-g087f651 (19 non-merge commits past the previously-pinned tag). The recipe's PV stays at "1.0" since it is a wrapper for the dirhash helper, not a version of x/mod itself. Comprising: 087f651 modfile: use slices.Backward 343ee60 x/mod: allow for aggressively conslidating requires 643da9b go.mod: update golang.org/x dependencies ccc3cdf zip: include 'but content has correct sum' note in TestVCS ab30318 zip: update zip hashes for new flate compression 03901d3 go.mod: update golang.org/x dependencies 1ac721d go.mod: update golang.org/x dependencies fb1fac8 all: upgrade go directive to at least 1.25.0 [generated] 27761a2 go.mod: update golang.org/x dependencies 4c04067 go.mod: update golang.org/x dependencies d271cf3 go.mod: update golang.org/x dependencies 269c237 sumdb/note: delete chop 3f03020 x/mod: apply go fix and go vet 7416265 go.mod: update golang.org/x dependencies 5517a71 all: fix some comments b6cdd1a modfile: use reflect.TypeFor instead of reflect.TypeOf bba3e06 go.mod: update golang.org/x dependencies 1759e96 go.mod: update golang.org/x dependencies f060e16 all: upgrade go directive to at least 1.24.0 [generated] Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* oci-runtime-tools: update to v0.9.0-tipBruce Ashfield2026-06-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping runtime-tools to version v0.9.0-147-g8a4db57, which comprises the following commits: 6372393 Add support for `riscv64` arch ce94ed3 ci: update golangci-lint for compatibility with go1.26 b58544f Makefile: add EXTRA_LDFLAGS 3c27840 cgroups: treat 'max' pids.max as -1 LinuxPids.Limit in GetPidsData(). 5f84332 cgroups,generate,validat{e,ion}: fix golangci-lint deprecation warnings. b521900 go.{mod,sum}: bump runtime-spec to v1.3.0. 79a3f0f ci: use "oldstable" and "stable" Go versions 4da4e5e ci: bump actions etc. to latest versions 1216466 golangci-lint: switch to v2 2734868 generate: fix a comment 80497fb validation: fix ST1017: don't use Yoda conditions 827638e validation/linux_cgroups_relative_cpus: fix staticcheck warning 9e87868 Add annotations to ignore some staticcheck warnings b00213a Fix staticcheck QF1003 warnings 5bae0b9 generate/seccomp: remove double package import 59d9b89 cmd/runtimetest: use strings.ReplaceAll bd70e01 Modernize the code b01335e Remove obsoleted +build tags 6072004 Add time namespace / TimeOffsets check and helper c2dadba Switch to github.com/moby/sys/capability 4c69808 ci: bump Go and github actions e1c9375 cmd/oci-runtime-tool: fix govet warning a3a57a9 cmd/runtimetest: use github.com/moby/sys/mountinfo 27bf223 go.mod: github.com/opencontainers/runtime-spec v1.1.0 28f43fa go.mod: golang.org/x/sys v0.1.0 c6b8fa3 gof(ump)t code b2e2dab Update GitHub actions base runner image b1f58fe Add Go 1.19 and Go 1.20 support cd79116 Update GitHub actions packages to resolve warnings 0f9ac2c Remove io/ioutil package references. 0524bb2 Revert "Change /dev to be mounted by default with /noexec" 2e043c6 validate/capabilities: fix incorrect package name. 4167830 Add CODEOWNERS, rm .pullapprove.yml 24aab90 generate, validate: isolate gojson* dependencies. e972318 generate: add support for domainname c3bea2c seccomp: Separate conditions for personality syscall into single rule 6666f24 Add devfs and fdescfs as default mounts for FreeBSD 91a7b1d Add generator support for FreeBSD 62ac333 Switch to `github.com/blang/semver/v4` 8d08049 generate/seccomp: Allow Landlock syscalls a65a3b6 Use new golangci-lint 932a8c1 generate: NewFromSpec() remove deprecated comment 7fdb100 seccomp: add CloneNewCgroup to check sysCloneFlagsIndex d58bc16 validate/CheckRoot: fix panic on empty spec 83399e7 validate/CheckRoot: fix error text 8927281 Add syscall "statx" in seccomp to fix Operation not permitted a202491 spec generator support setting unified 30cecc1 validation/linux_rootfs_propagation: fix 10d2584 runtimetest: validateRootfsPropagation: fixes 8b26e24 validate: rm Clean() arguments 3fb1264 validation: fix Cleanup 14cd51e Makefile: replace TAP with TAPTOOL adcb290 Fix hanging on runc create. 5ce2cac cmd/runtimetest: fix NewPid deprecation warning 8e1a3b5 deps: bump github.com/syndtr/gocapability to latest 543268b deps: github.com/hashicorp/go-multierror to v1.1.1 4b164a1 deps: bump github.com/opencontainers/selinux to v1.9.1 ee9c051 deps: bump github.com/mrunalp/fileutils to v0.5.0 01a6f47 deps: bump sirupsen/logrus to v1.8.1 abcb94d deps: switch to google/uuid 2253869 validation/.gitignore: fix 953e752 MAINTAINERS: add @kolyshkin 221e5ea deps: bump github.com/xeipuuv/gojsonschema to v1.2.0 67884fc validate: prepare for new xeipuuv/gojsonschema 09d837b Change /dev to be mounted by default with /noexec 10c865d ci: re-add commit subject length validation a22a894 ci: add golangci-lint run a7cecde Add*Hook: do not return errors c0037c9 runtimetest: silence errlint on unix.Unmount 9505f16 Explicitly ignore errors from YAML fec9c3c validation: fix Clean 0ab61ae validation: fix/rename ReadStandardStreams 6f4b5ba validate: fix staticcheck linter warning 6a9ad7c runtimtest: fix validatePosixMounts 44e9496 Fix "addr cannot be nil" staticcheck linter warnings d38bd63 Fix deprecation warnings from staticcheck linter 1826c32 Fix gosimple linter warnings e36f98f Fix deadcode linter warnings 112c88c Makefile: use fancy git commit ids 16dfbbd Makefile: add/use BUILD_FLAGS 5432bc4 ci: replace travis with gha ci fab664e Makefile: rm gofmt and golint, simplify gotest 98b2d35 Run make .gofmt 0e5956d Switch from Godeps to go modules 71a5e7c generate: add --linux-intelRdt-closid option 4f51ef9 validation: read pid in PostCreate 6502e57 Fix build of hugetlb tests on 32-bit platforms 10f8f55 generate: fix type for Umask 8f1e958 Remove spurious WARNING message 43243fe Add missing interface to set init processes Umask 120c67a AddDevice(): better diagnostic when creating dup 2affd45 Add missing clone rule for s390x. be9f6f1 Update hugetlb tests to be more portable 5a98426 Fix cgroup hugetlb size prefix for kB cd1349b Improve performance of AddProcessEnv 73e9a99 update Mashimiao email in MAINTAINERS Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* grpc-go: update to v1.81.1Bruce Ashfield2026-06-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping grpc-go to version v1.81.1, which comprises the following commits: caf0772c Change version from 1.81.1-dev to 1.81.1 (#9122) 6ccbeebf Cherry-pick #9111 into v1.81.x (#9121) b33c29e4 Cherry-pick #9081 into v1.81.x (#9102) c45fae6d Change version to 1.81.1-dev (#9063) cb182283 Change version to 1.81.0 (#9062) 96748f97 Cherry-pick #9105 to 1.81.x (#9106) 91832222 Cherry pick #9055, #9032 to v1.81.x (#9095) 5cba6da4 Revert "deps: update dependencies for all modules (#9065)" (#9067) af8a9364 deps: update dependencies for all modules (#9065) cdc60dfa transport: optimize heap allocations in ready reader and update syscall connection handling (#9035) 208d053e xds/resolver: pass complete XDSConfig in RPC context for HTTP filters (gRFC A83) (#9046) 50fe1cc7 test: Fix flaky test `TestServerStreaming_ClientCallRecvMsgTwice` in `end2end_test.go`. (#9058) d574bad1 build(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 (#9050) b8bf4d04 build(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 in /interop/xds (#9051) 19d23bf9 build(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 in /examples (#9052) 74b3acd1 xds: remove TODO to replace Endpoint with resolver.Endpoint struct (#9049) 1c132b9b tests: avoid relying on socket reads/writes for synchronization (#9033) 280b81bd build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#9042) ce2bdef9 transport: fixes non-linux environment failures (#9048) 71849e8c xds: change clusterimpl to add SNI to handshake info (#9016) 5fdb6d08 mem: add `Buffer.Slice()` (#8977) aa4d2818 xds/internal/client: Add async gauge metrics for Connected and Resources (A78) (#8807) a21508ee transport: move readyreader to its own package (#9037) 99312fed stats: Use service import for gRPC code (#9034) 21438020 xds: LRS custom metrics changes (a85) (#9005) 2b8b708f interop: regenerate proto (#9028) c754bf92 transport: Fix handling of closed connections in ReadyReader (#9031) c33aa45e alts: Release read buffer when blocked on socket read (#8964) 34da8d03 transport: Add values to the grpc.disconnect_error label for grpc.subchannel.disconnections metric (A94) (#8973) 2de5b1c0 grpclb: replace testServer with StubServer in grpclb_test.go (#8979) 0fe467a5 binarylog: replace testServer with StubServer in binarylog_end2end_test.go (#8978) 8de729c0 xds: fix typo in `xdsresource.Metadata` (#9026) b71c2620 grpc/stats: Add support for custom labels in per call metrics (A108) (#9008) f1d1ce56 xds/rbac: add additional handling for addresses with ports (#8990) c20fba0f xds: Exported `buildXDSClientConfig` to use in external packages and update `xds_fake_transport.go`. (#9014) 6477252c test: Fix flaky test `TestServerStreaming_ClientCallSendMsgTwice` in `end2end_test.go`. (#9004) 2eade05a Fix flaky test `TestAggregatedClusterSuccess_SwitchBetweenLeafAndAggregate` in aggregate_cluster_test.go. (#9009) 89af32f6 xds: Add SNI related field in handshake info (#8965) 45a3304f stats: replace testServer with StubServer in stats_test.go (#8980) 52bf4d9e build(deps): bump google.golang.org/grpc from 1.70.0 to 1.79.3 in /cmd/protoc-gen-go-grpc (#8988) 4b786ffb xds: replace net with netip in `xds/xdsclient` and `xds/server` (#8909) ccc8d7bd priority: implement changes to child policy caching specified in A115 (#8997) 99d6291e test/xds: wait for server to enter SERVING mode before sending the first RPC (#9003) 12e91ddb xds: add support for HTTP filter state retention, as specified in A83 (#8924) 58bbf8ab grpc: enforce strict path checking for incoming requests on the server (#8985) d0d7cab7 github: set testing CI names to be stable (#8982) 36e13de7 grpclb: replace net.IP with netip.Addr (#8918) 7f783427 xdsclient: fix panic on empty resource in ADS response (#8970) e5563c65 change directory name `fakeTransport` to `faketransport`. (#8976) 7daee260 grpc: introduce ErrRetriesExhausted to wrap retry failures (#8894) f967422a transport: make the client send a RST_STREAM when it receives an END_STREAM from the server (#8832) 99f36d4a xds/testutils: add fakeTransport for testing. (#8890) 98573cbe rls: update rls cache metrics to use async gauge framework (#8808) fd539615 xds: leaf clusters provide the handshake info instead of top level cluster (#8956) ad2d82e3 xdsresource: add SNI related fields in security config of CDS update for A101 (#8941) d0ea4f35 cds: use a grpcsync.Event instead of a channel to communicate resource names being requested (#8960) 0e2c0ea1 deps: update dependencies for all modules (#8969) 81c7924e xds/clusterresolver: improve configbuilder tests by removing globals (#8939) 71a4abb6 xds: regenrate expired SPIFFE certs (#8963) 1acfea83 grpc: Enable shared write buffers by default (#8957) 8360b4c4 xds/resolver: make service config human readable in the log (#8958) 223662f0 cds: increase defaultTestTimeout to 10s for e2e tests (#8959) b9f79673 xds/resolver: remove unnecessary error check in test (#8955) 549306ae Update gRPC-Go's dependency versions on master (#8953) 5c4e754a Change version to 1.81.0-dev (#8950) 7e2686f9 cdsbalancer: Update comment about usage of BalancerAttributes (#8951) b6597b3d xds/clusterimpl: use xdsConfig for updates and remove redundant fields from LB config (#8945) 1d4fa8a7 xds: change cdsbalancer to use update from dependency manager (#8907) 8f47d364 attributes: Replace internal map with linked list (#8933) 22e1ee80 xds: add panic recovery in xdsclient resource unmarshalling. (#8895) 7136e99e credentials/alts: Pool write buffers (#8919) 46a31de5 security/advancedtls: fix macOS compatibility in CRL script (#8932) 38eb2de1 protoc-gen-go-grpc: remove use_generic_streams_experimental flag (defaults to true) (#8936) 7bc57850 xds: fix copy-paste bug in WeightExpirationPeriod config (#8915) d2eab687 balancer/rls: fix goroutine leak in control_channel_test (#8898) c9d52ee6 xds/xdsclient: add EDS sum of endpoint weights does not exceed MaxUint32 (#8899) 4a83bf96 ringhash: enable behaviors of A76 by default (#8922) ace972de orca: fix goroutine leak in fakeORCAService.StreamCoreMetrics (#8911) 19e41284 xds: decouple A76 and A86 EDS metadata parsing (#8875) b6f89f74 mem: Move buffer pool implementations to internal (#8910) c1a9239e xds/rbac: replace legacy net to netip (#8908) 3be7e2d0 mem: Add faster tiered buffer pool (#8775) 13e24552 correctly check nil stream (#8905) 944f0585 client: process RPC stats/tracing only when a handler is configured (#8874) 2c113abf advancedtls: re-generate test certs and increase expiry (#8900) 779b7922 xds: refactor server-side HTTP filter processing (#8878) e08fc36d resolver: Add resolver.EndpointMap.All() to iterate over keys and values (#8867) d7b3f936 cdsbalancer: Increase timeout for test (#8889) 78601448 mem: ensure `Reader` buffers are reused on early return (#8886) 0f69b6eb credentials: add end-to-end tests for JWT call credentials behavior (#8818) 9d8ede99 xds: split service and message codegen import (#8881) 12fc393c xdsdepmgr: add functionality for cluster subscription (#8792) 55bfbbb2 xds/clusterresolver: implement gRFC A61 changes for LOGICAL_DNS clusters (#8733) 830c9098 cmd/protoc-gen-go-grpc: bump -version to 1.6.1 for release (#8879) b7b1cce6 examples: Poll for expected server logs in test (#8871) 2abe1f0d github: Add config for Gemini code assist (#8873) 46350a74 channelz: Regenerate proto (#8872) 49e224f8 xds/googlec2p: Revert PR 8829 that removed `SetFallbackBootstrapConfig` (#8869) 61d569d3 *: Implementation of weighted random shuffling (A113) (#8864) 7985bb44 rls: Fix flaky test TestPickerUpdateOnDataCacheSizeDecrease (#8856) 3e475d7c xdsclient: add test for custom xDS resource subscription (#8834) 0dc1bcd1 client/picker: log loop to V(2) (#8863) 69b542a5 credentials/tls: verify overwritten authority against only leaf certificate (#8831) e6ca4177 xds/googlec2p: remove legacy `SetFallbackBootstrapConfig` and fix tests. (#8829) 6601041b documentation: improve proxy documentation (#8840) 65b3eeb0 transport: warn when header list size exceeds 8KB (#8845) 19ace67b outlierdetection: move ParseConfig test to a test-only package (#8833) c05cfb36 balancer/rls: Use log *f functions with format args (#8859) a8d11ced balancer: introduce env flag for case-sensitive registry (#8837) c7ec4d9a test: use testpb alias in stream_test.go for proto messages. (#8854) 1c79a7c8 transport: fix potential race in `TestKeepaliveClientClosesWithActiveStreams`. (#8827) 72789830 xds: fix typo in log message (#8843) c2d81b71 deps: update dependencies for all modules (#8853) 3fb101d6 hierarchy: Use public API for testing (#8846) de165147 Change version to 1.80.0-dev (#8852) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lopper: update to v1.4.2-tipBruce Ashfield2026-06-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping lopper to version v1.4.2-23-g0c3cfa9, which comprises the following commits: 0c3cfa9 lopper: assists: zephyr: Drop bootph-all property from generated domain DTS fdc4cea tests: regression coverage for domain-to-domain /axi node survival ee83fa1 tests: regression coverage for child_nodes deserialization in overlays 86fa315 tree: coerce comment prop values in resolve() to handle libfdt variants 3263e49 lopper: narrow is_overlay_file() to true /plugin/; overlays 180c06d overlay: store fixup refs as (label, rel_path) tuples, not abs_paths f484b0d overlay: defer phandle resolution to build time via _resolve_overlay_fixups cbbc26e lopper:assists:baremetal_xparameters_xlnx: Refactor DDRMC5 property extraction to use target node instead of axi_noc2 nodes 3dbcf83 base: phandle_safe_name: replace all invalid label characters 79b7c0e lopper:assist:baremetal_validate_comp_xlnx: Fix srec_spi_bootloader build failure on Spartan US+ OSPI-enabled design fe54df3 assists: xlnx_overlay_pl_dt: Move amba_pl to amba rename after overlay tree construction f3e0808 Add per-hart interrupts for RISCV b7c6fd6 overlay: fix child_nodes deserialization in multi-pass lopper invocations b2a5280 Revert "lopper:assists:baremetallinker_xlnx: Fix default DDR selection for Microblaze RISC-V to prefer BRAM" ae0f2da gen_domain_dts: Add riscv,timer node generation 59b00b5 lopper:assists:baremetallinker_xlnx: Fix default DDR selection for Microblaze RISC-V to prefer BRAM 612ebb1 lopper:assists:baremetal_xparameters_xlnx: Add DDRMC5_I2C_MASTER and DDRMC5_DEBUG_ELF defines 49a6270 baremetalconfig_xlnx: fix clocks single-cell offset; optional prop first int 0f0b55b baremetal: Add lpddrmc to valid memory IP list 375bcee lopper: assists: zephyr: Fix UFS clock-name and clocks assignment 008897f lopper: assists: xlnx_overlay_pl_dt: exclude address-map property from overlay 9fc81f9 lops/%.yaml.lop: register OpenAMP domain-to-domain phandle properties a046513 domain_access: fix step 2c to scan full subnode depth and mark parent chain Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* yocto-cfg-fragments: update to v6.18-tipBruce Ashfield2026-06-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping yocto-kernel-cache to latest, which comprises the following commits: 6d012fbc amd-versal-gen2: add scc and cfg files for amd-versal-gen2 platform 68930558 amd-versal: add scc and cfg files for amd-versal platforms a966c892 amd-zynq: add scc and cfg files for amd-zynq platforms 479a0d49 amd-zynqmp: add scc and cfg files for amd-zynqmp platform 595f3493 edac: move apei configs to separate feature 9e749529 nxp-ls1028: add scc and cfg files for nxp-ls1028 platform 3fe9b5c1 kver: bumping to v6.18.33 fbc4b736 microchip-pic64gx: remove the unneeded flash_fs configures 13ebff50 nxp-imx9: Enable SND_SOC_DMIC and IMX_FLEXIO for nxp-imx9 a5384458 bsp/intel-{x86,common}: drop CONFIG_HIGHMEM64G ead8bb52 qat: fix CONFIG_CRYPTO_CTS mismatch warnings 2d12860e kver: bumping to v6.18.32 6f2f1a2d kver: bumping to v6.18.31 9c909f87 bsp/microchip-pic64gx: add kernel cache support for PIC64GX SoC 4ad2f82e genericarm64.cfg: enable CONFIG_INTERCONNECT_QCOM_QCS615 5c13eec0 genericarm64-pinctrl.cfg: enable CONFIG_PINCTRL_QCS615 c9906354 kver: bumping to v6.18.28 127f83ad kver: bumping to v6.18.26 177495c1 kver: bumping to v6.18.25 f94e250f kver: bumping to v6.18.24 dcbc01fb kver: bumping to v6.18.23 cdcc0ceb nxp-imx9: add arm64 BSP for the NXP i.MX9 SoC family 450672a4 bcm-2xxx-rpi: Enable RTC for rpi d8f130c8 kver: bumping to v6.18.22 8af6e86e kver: bumping to v6.18.21 97232138 bsp/intel-x86: add support for Broadcom NetXtreme-C/E Ethernet Cards 8d07a6ad bsp/intel-x86: add support for Broadcom MPI3 Storage Controller 41925d8d kver: bumping to v6.18.20 8987a1d4 nvidia-orin: enable configs for reading data from eeprom 465cb5bc genericarm64/serial: change SERIAL_IMX_CONSOLE to =y 899d5e6d kver: bumping to v6.18.19 5981f920 nvidia-orin: add scc and cfg files for NVIDIA Orin platform 1ee48237 kver: bumping to v6.18.18 bc293057 bcm-2xxx-rpi: Fix configuration audit warnings (LEDS, BACKLIGHT) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* xvisor: update to v0.3.2-tipBruce Ashfield2026-06-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping xvisor to version v0.3.2-57-g1de3ff44, which comprises the following commits: 1de3ff44 [RISC-V] Fix RVV vlenb probe in cpu_vcpu_rvv_init 8713a802 [RISC-V] Disable MMU before page table cleanup 50facff9 [RISC-V] Fix RVV state and dynamically initialize vector registers 5ec72e10 [RISC-V] Fix RVV context save/restore stride and RV32 compatibility 0558c348 TESTS: compile with -fno-pic and -Wl,--no-pie acea4920 [RISC-V] Replace .word encodings with H-extension mnemonics b4f4753e RISC-V: delegate illegal instruction exception by default defbff33 RISC-V: introduce RVV_ENABLED macro fa393fe8 RISC-V: make dumpreg command sensitive to VLEN 8a12f4dd RISC-V: add support for RVV f9035e95 Fix: Track vcpu after scheduler switch to process correct IRQs e6cf23ef CORE: vmm_main: Check aliases node if stdout-path value is not a path 22a8fe9b TESTS: Use '-std=gnu11' to fix build with GCC 15 9682e7b5 Makefile: Use '-std=gnu11' to fix build with GCC 15 355c79a0 irq-riscv-aclint: fix overlapping irqdomains 37ff69f4 irq-riscv-imsic: fix imsic without handlers 10a76a80 virtio_host_blk: make device ready before using its virtqueues 09328306 RISC-V: Pass -1 in hart_mask_base instead of hart_mask in rfence SBI. 4ac97ff8 RISC-V: Configure Smstateen extension for Guest 57abfd81 RISC-V: Add Smstateen related CSR defines ef0f5b31 RISC-V: Parse Smstateen extension from ISA string 0d3c1047 CORE: vmm_platform: Fix platform_get_msi_domain() implementation 2e0ed848 RISC-V: Implement SBI nested acceleration extension 2f1d7696 RISC-V: Extend nested virtualization for shared memory based HFENCE ad0de2db RISC-V: Extend nested virtualization for shared memory based CSR access 34059f13 RISC-V: Add defines for the SBI nested acceleration extension fb46e69f RISC-V: Remove redundant timer event from struct riscv_priv_nested a8c5e49d RISC-V: Increase the SWTLB size used for nested virtualization 50e27aee RISC-V: Use bitfields in struct arch_pgflags 37b51025 RISC-V: Count the guest page faults redirected to the Guest 6777a28c x86: Fix linker warning seen with binutils 2.39 a99eda34 [DRIVERS] virtio: fix virtio test bit 9b5f55ed DRIVERS: xlnx-uartlite: Add support for Xilinx AXI UART Lite c21af932 fix: correct argument for opensbi dbcn console read ecall 4b27a93d Makefile: Improve dependency files inclusion logic f9e95d05 RISC-V: Add sbss section in linker script abc9b330 COMMANDS: vserial: Yield the CPU time in cmd_vserial_bind() 5403f96d RISC-V: Implement SBI debug console extension for Guest afd3ba37 RISC-V: Fix how guest vserial instance is located b8abc095 RISC-V: Use SBI debug console for defterm whenever available 0dfef2af RISC-V: Add SBI_SPEC_MK_VERSION() helper macro fc818343 RISC-V: Add defines for SBI debug console extension 9f685732 RISC-V: Change the SBI specification version to v2.0 for guest d16db436 RISC-V: Allow disabling SBI extensions based on Guest DT 7ee4bfde RISC-V: Add option probe() callback for VCPU SBI extensions 8763c9ed RISC-V: Rename cpu_vcpu_fp_init() to cpu_vcpu_fp_reset() 08199bd5 RISC-V: Improve timer init and deinit function 9cd344d0 DOCS: Update qemu-system-riscv[64|32] usage in README files abb381cb Makefile: fix grep warning 0c8bbfe3 Makefile: fix grep warning a969f502 RISC-V: Force no-pie code generation and static link f5742761 X86: fix some basic error 3f715f58 RISC-V: Align _start_hang symbol to 4 bytes a705b847 TOOLS: memimg.py: explicitly use the python3 interpreter 888c94e7 TOOLS: d2c.py: explicitly use the python3 interpreter 1329959e TESTS: common: Fix busybox rootfs configuration for virt32 2968af2f DOCS: Update commit tag in v0.3.2 release notes Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* xen-tools: update to RELEASE-4.21.1 -tipBruce Ashfield2026-06-021-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping xen-tools to version RELEASE-4.21.1-39-g16e9e6245c, which comprises the following commits: 16e9e6245c tools/libxl: Fix libxl_nocpuid.c build with json-c ed13b64882 CI/ECLAIR: avoid intercepting intermediate linking steps 3db23dfdc6 symbols: explicitly specify source file name for symtab 7372acade2 memory: overlapping XENMAPSPACE_gmfn_range requests fd2ccd79ab x86/time: make do_settime() uses more accurate 3dccad5220 xsm/flask: Fix undefined behaviour in avc_dump_av() 1ae7e08217 EFI: adjust cfg file buffer freeing 9358a206cb xvmalloc: adjust XVFREE() ordering a8e85414e6 x86/svm: Always sync guest CR2 on VMExit 13ca96cdc9 x86/boot: Disable interrupts when establishing SSP 00496ab150 x86/cpuidle: split the max_cstate variable 032d39ff0e x86/cpu: identify uninitialized CPU data using BAD_APICID 8af05b4917 x86/amd: Mitigate AMD-SN-7052 0d8b25d1fc gnttab: split gnttab_map_frame() 43e32ae4f9 tools/xenstored: make conn_delete_all_transactions() idempotent f732e91aa8 tools/oxenstored: Reset quota when resetting permissions 17a7843054 x86/mkelf32: Actually pad load segment to 2 MiB boundary 54db249531 xen/cpu: round cpu_khz calculations 27748a7343 x86/time: use native TSC scaling factors when TSC is not scaled 2d1a11a50d x86/HPET: channel handling in hpet_broadcast_resume() 76b359a878 x86/APIC: handle overflow in TMICT calculation 9c79644d35 x86/time: do not kill calibration timer on suspend 6b8be120c8 xen/uart: set a default baudrate if non specified neither found b2352be941 xen/x86: Check supported features even for PVH dom0 8f3dcdcf9f video/vesa: harden font height parsing afb919ff6a ns16550: harden positional parsing f35f0ac0c8 ns16550: harden name/value pair parsing c9ba169b93 llc-coloring: improve checking while parsing feb99494bf EFI: avoid OOB config file reads e2981e073f x86/fpu: Initialise FTW in xstate_alloc_save_area() 761aba980a xen/uart: be more careful with changes to the PCI command register a011ca9e08 xen/uart: uniformly set ->ps_bdf_enable for all PCI serial devices 8482a1ce08 libacpi: Pass missing --dm_version to mk_dsdt b3c4a20a15 xen/uart: report an error if the device type is not supported aaa03d41be arinc653: remove idle period in default schedule 646bcc17ce arinc653: avoid array overrun d174a86aaf arinc653: overwrite entire .dom_handle[] for Dom0 slots fa82d4f5cc update Xen version to 4.21.2-pre 90b20547b7 x86/amd: Mitigate AMD-SN-7053 / FP-DSS Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* xen: update to RELEASE-4.21.1 -tipBruce Ashfield2026-06-022-111/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping xen to version RELEASE-4.21.1-39-g16e9e6245c, which comprises the following commits: 16e9e6245c tools/libxl: Fix libxl_nocpuid.c build with json-c ed13b64882 CI/ECLAIR: avoid intercepting intermediate linking steps 3db23dfdc6 symbols: explicitly specify source file name for symtab 7372acade2 memory: overlapping XENMAPSPACE_gmfn_range requests fd2ccd79ab x86/time: make do_settime() uses more accurate 3dccad5220 xsm/flask: Fix undefined behaviour in avc_dump_av() 1ae7e08217 EFI: adjust cfg file buffer freeing 9358a206cb xvmalloc: adjust XVFREE() ordering a8e85414e6 x86/svm: Always sync guest CR2 on VMExit 13ca96cdc9 x86/boot: Disable interrupts when establishing SSP 00496ab150 x86/cpuidle: split the max_cstate variable 032d39ff0e x86/cpu: identify uninitialized CPU data using BAD_APICID 8af05b4917 x86/amd: Mitigate AMD-SN-7052 0d8b25d1fc gnttab: split gnttab_map_frame() 43e32ae4f9 tools/xenstored: make conn_delete_all_transactions() idempotent f732e91aa8 tools/oxenstored: Reset quota when resetting permissions 17a7843054 x86/mkelf32: Actually pad load segment to 2 MiB boundary 54db249531 xen/cpu: round cpu_khz calculations 27748a7343 x86/time: use native TSC scaling factors when TSC is not scaled 2d1a11a50d x86/HPET: channel handling in hpet_broadcast_resume() 76b359a878 x86/APIC: handle overflow in TMICT calculation 9c79644d35 x86/time: do not kill calibration timer on suspend 6b8be120c8 xen/uart: set a default baudrate if non specified neither found b2352be941 xen/x86: Check supported features even for PVH dom0 8f3dcdcf9f video/vesa: harden font height parsing afb919ff6a ns16550: harden positional parsing f35f0ac0c8 ns16550: harden name/value pair parsing c9ba169b93 llc-coloring: improve checking while parsing feb99494bf EFI: avoid OOB config file reads e2981e073f x86/fpu: Initialise FTW in xstate_alloc_save_area() 761aba980a xen/uart: be more careful with changes to the PCI command register a011ca9e08 xen/uart: uniformly set ->ps_bdf_enable for all PCI serial devices 8482a1ce08 libacpi: Pass missing --dm_version to mk_dsdt b3c4a20a15 xen/uart: report an error if the device type is not supported aaa03d41be arinc653: remove idle period in default schedule 646bcc17ce arinc653: avoid array overrun d174a86aaf arinc653: overwrite entire .dom_handle[] for Dom0 slots fa82d4f5cc update Xen version to 4.21.2-pre 90b20547b7 x86/amd: Mitigate AMD-SN-7053 / FP-DSS Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* virt-manager: update to v5.1.0-tipBruce Ashfield2026-06-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping virt-manager to version v5.1.0-94-g213b015b2, which comprises the following commits: 213b015b2 Translated using Weblate (Estonian) a4c03a822 Translated using Weblate (Serbian) da38bc58b Translated using Weblate (Persian) 0d2b47f14 Translated using Weblate (Chinese (Simplified Han script)) e17091b6d ci: bump codecov/codecov-action from 5 to 6 2450354f3 man: virt-install: add inst prefix to kickstart installer arguments 3fc7a2fa8 Translated using Weblate (Chinese (Traditional) (zh_TW)) c9f9f165d Translated using Weblate (Chinese (Simplified) (zh_CN)) 947a5a2aa Translated using Weblate (French) b4e57abb5 Update translation files a2052e959 Added translation using Weblate (Chinese (Simplified Han script)) ef9f5cc90 Translated using Weblate (Estonian) fad29e937 serialcon: add 'nmdm' console support b2b32ccc7 tests: properly skip win11 aarch64 test on old osinfo 19f18e9f5 cli: add --boot firmware.enrolled-keys=,firmware.secure-boot= e5c731787 domain: os: add set_firmware_feature helper 08ec19204 man: virt-install: remove some obscure --boot scearios 3eebb61b7 man: virt-install: change `--boot secure-boot=` docs 09ecf1cfd ci: Install `acl` to get more code coverage 48c9076d5 ci: add `workflow_dispatch` to more workflows 91f506f06 testdriver: add more complete zfs XML 2c87e485e uitests: createvm: add Customize->Add Hardware->TPM case 20d375a04 details: Fix TPM label from `Customize` wizard 23d6f9088 tests: cli: fix aarch64-win11 with latest osinfo-db d306fb6b2 uitests: Add coverage exclusions 198778dfb uitests: cover NVME disks and controller 98921c4dc uitests: cover USB startup policy 9681c3d43 ui: add USB startup policy mnemonics b3daef7ef testmock: add --test-options=disable-name-validation ba532d3ed uitests: relax alert lookup naming eba62e983 uitests: fix snapshot name validation test 5d7c66378 man: secure-boot: don't mention entrolled-keys 23dd48ae9 cli: add --boot secure-boot option 9ab2918fa virtinst: add support for iommufd d13271422 virtinst: fix locale when running in flatpak 90e425b59 ui: Show NVMe Controller details 08b547366 virtManager: Add NVMe disk type 97505a9fe virtinst: implement NVMe disk target generation 605b3d807 virtinst: Add NVMe Controller 6f1adcc92 virtinst: Add serial controller option to cli 206e79d50 tests: use Node.path when available 711275b92 tests: handle "collection_path" and "path" for pytest_ignore_collect() a5a540369 tests: port pytest_ignore_collect() to pathlib 10014e150 addhardware: Add usb as a recommended sound device 606633249 Translated using Weblate (Swedish) 04ab5617a Translated using Weblate (Indonesian) 7fd958770 Translated using Weblate (Estonian) 9a9267470 Translated using Weblate (Turkish) 2af8e00c8 Translated using Weblate (Romanian) ff0e401ee Translated using Weblate (Chinese (Simplified) (zh_CN)) fe5e1ea17 Translated using Weblate (Portuguese (Brazil)) a91f48faa Translated using Weblate (Portuguese) 0fbc02c6e Translated using Weblate (English (United Kingdom)) 0881c9c64 Translated using Weblate (Italian) 4afe2b71e Translated using Weblate (Turkish) 74d5b0f9e Translated using Weblate (Chinese (Simplified) (zh_CN)) cc2bb397e Translated using Weblate (Chinese (Simplified) (zh_CN)) 39791b73c Translated using Weblate (Kabyle) e9bf0bc12 Translated using Weblate (Chinese (Simplified) (zh_CN)) 984d20203 Translated using Weblate (Finnish) d150bab3f Translated using Weblate (German) 43f4c7859 Translated using Weblate (Polish) 7c2bebaee Translated using Weblate (Russian) f5b56cdec Translated using Weblate (Korean) 904f95291 Translated using Weblate (Swedish) bc9e5dc15 Translated using Weblate (Spanish) 015fb0b7f Translated using Weblate (Georgian) 3a66f48e2 Translated using Weblate (Ukrainian) a5553cb91 Translated using Weblate (Romanian) 87298b9c9 Translated using Weblate (Czech) 35ad9057f virtinst: Fix XDG_DATA_HOME handling 488389ced ci: Add gobject-introspection dep e1613dba5 ci: Fix test-against-libvirt-git a2baaf789 installer: add support to use device boot order 3985b0746 virtinst: remove legacy attribute from set_boot_order/get_boot_order 3a25792d9 virtinst: guest: introduce can_use_device_boot_order 25670b2ee virtinst: rework get_boot_order 161fb1baa maint: use constants instead of strings for boot devices e438a7724 ci: bump actions/checkout from 5 to 6 411f019f8 virtinst: add support for pcihole64 53df7b496 virtinst: add support for acpi-generic-initiator d57e2e738 virtinst: interface: add support for backend.hostname and backend.fqdn 57e6f96f9 virtManager: wrapped details hw-panel with GtkScrolledWindow f9a01fbf9 metainfo: Add developer tag 9e9252982 Rename AppStream metadata to rDNS format f907ede75 Calling loader.close() before pixbuf assignment to avoid NoneType pixbuf 6fe47feca Fix typo in virt-clone documentation 766bf2ecd xmlapi: add xmletree.py backend d0372e82c xmllibxml2: lazily import libxml2 ff9fa95e5 xmlbase: fix parentnode None check d4988b02e xmlapi: split out xmlbase.py and xmllibxml2.py ea71cf9a8 virtinst: cloudinit: include empty meta-data file ecd280d59 addhardware: network: adjust supported network devices for bhyve a2c00ee84 ci: bump actions/setup-python from 5 to 6 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* virtiofsd: update to v1.13.3Bruce Ashfield2026-06-022-4/+4
| | | | | | | | | | | | | Single patch-level bump on the 1.13.x line. New crate sha256sum from the crates.io API: 162e60c45fbfeaf1d3f8407d788d4b5a0a718f49f469ccd3c7140480716d7677 virtiofsd-crates.inc regenerated via `bitbake virtiofsd -c update_crates`; only 4 lines of diff in the pinned crate list, consistent with a patch release. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* vhost-device-vsock: update to v0.3.0Bruce Ashfield2026-06-022-244/+200
| | | | | | | | | | | | | | | | | | Bump 0.1.0 -> 0.3.0 (the two newer crate publications: 0.2.0 then 0.3.0). The other four vhost-device-* recipes (gpio, i2c, rng, scsi) stay at 0.1.0 since that remains the only version published on crates.io for each of them. New crate sha256sum (from the crates.io API): 52ce95d81af89ad693d067c650e42df0f217addfbc96cc4820f7c62eb4a28b13 vhost-device-vsock-crates.inc regenerated via `bitbake vhost-device-vsock -c update_crates`; the new Cargo.lock pulled in a substantial refresh of the transitive dependency graph (200 insertions, 244 deletions in the pinned list). Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* upx: update to v5.1.1-tipBruce Ashfield2026-06-021-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping upx to version v5.1.1-64-g93abc161, which comprises the following commits: 93abc161 CI updates f1671f80 CI updates 86f16465 CP/M-86: size header data group to buffer size 07570d35 Add support for CP/M-86 CMD 3d5101c6 PE: stub should not clear tlsindex for .dll cd56a4a5 CI updates 70ae43e9 pefile: align imagesize after removing .reloc section b7472198 CI updates eab70229 pefile: align imagesize after removing .reloc section f52b206f CI updates d7bd3d9a JNI_OnLoad only if CMD_COMPRESS 2dd6e381 CI updates ceb8a395 CI updates 2f9be3bd CI updates 8fa669f2 CI updates 5ef29bb4 CI updates 06334a4d CI updates b1a6b710 CI updates 2d302628 CI updates 8cee4522 riscv64: preserve e_flags to prevent CantUnpack d6f2f877 CI updates fab1117a CI updates 965cb22e CI updates 15ed0285 CI updates 136bf9a2 CI updates 77c942d0 CI updates ac5336f2 CI updates 7e1fab76 CI updates 21874327 CI updates fa5877ff CI updates f9138c1b CI updates 0aea9492 CI updates f0a89504 pefile: really remove .reloc section if no relocs 7850dfe3 CI updates 9e06ba7a CI updates ab05f314 pefile: really remove .reloc section if no relocs c0cfe9f9 pefile: diagnose bad Import e0abaa5e CI updates ffc0e622 CI updates 924283a1 CI updates df8b76f0 Catch more fuzz when unpacking ELF symbol table 7fe3b646 CI updates 0e875f54 CI updates ee8facd3 CI updates 0cd70a32 CI updates 37b33373 CI updates aeb1caf8 CI updates 9e3dcdc9 CI updates db5de3d0 CI updates 7f2d1e5c CI updates 7e78bbdf CI updates 50f3a42c CI updates dcfbf325 CI updates 64dab898 CI updates 3821b557 CI updates 20f608ce CI updates 30fee81f pefile de-compress: fix bug when no relocs 2a6fdf7c submodules: update for new versions f6a210ec CI updates 6cc54699 test-clibs: submodules 6a6b6fb5 pack ELF64: fix PLT section name for SHT_RELA in pack3 5e394635 unpack Elf: check relocation of DT_INIT_ARRAY bfd92757 unpack ELF: check xct_off or yct_off 36babe77 all: post-release version bump Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* rootlesskit: update to v3.0.1-tipBruce Ashfield2026-06-028-34/+265
| | | | | | | | Bumping rootlesskit to version v3.0.1-2-g321e732, which comprises the following commits: a892af9 v3.0.1+dev Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* nagios-nsca: update to v2.10.3Bruce Ashfield2026-06-021-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | Bump 2.9.2 -> 2.10.3 (one minor + 3 patch releases on the 2.10.x line). Source location changed: upstream development moved off SourceForge to GitHub, and prdownloads.sourceforge.net returns 404 for anything past nsca-2.9.2. SRC_URI repointed at the GitHub release artifact. New tarball checksums from the upstream GitHub release: md5sum = 25048d91910a45213c0f0ea5a8da11c9 sha256sum = 0b36d5c10936f98d278b66c682af95b8e227c5942ad725c4a1949945296f6877 LIC_FILES_CHKSUM md5 of src/nsca.c lines 1-16 updated from dd7a195cc7d8a3ebcfabd65360d0cab4 to c94838c8194765df77dbf93c7e10b5a2 — the license header text changed across the version gap, but the licence itself remains GPL-2.0-only. S = "${WORKDIR}/..." updated to "${UNPACKDIR}/..." — the same poky WORKDIR -> UNPACKDIR transition that hit nagios-nrpe; this recipe predates the change and was caught the moment we tried to rebuild from scratch. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* nagios-nrpe: update to v4.1.3Bruce Ashfield2026-06-023-43/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bump 4.0.2 -> 4.1.3 (3 patch releases on the 4.1.x line). New tarball checksums from the upstream GitHub release asset: md5sum = 92c61b315fd7c51d3cb52b848a9a5821 sha256sum = 5a86dfde6b9732681abcd6ea618984f69781c294b8862a45dfc18afaca99a27a sha1sum = b8842c6f6d555deb5ec0359fd49dfcc7952085d6 sha384sum = 81c83ae3713d0baeef5636d7adae47c27c14eeae757e3962c579ac1486856998bc17a6e1a87aff9b290817fbb474ee09 sha512sum = dc81e2104b7604e6c67a0dc73a3e6449f7e089390a807be7281492b5ab61e13347ed264292e0642798cee4bafc5978d423184e81bbe753343aaa68daea091f7e LIC_FILES_CHKSUM md5 of src/nrpe.c lines 1-35 unchanged at 0dadd78599abbc737af81432702e9161, so the existing pin still applies. A number of recipe-level fixes were needed to get this building under modern OE-core. The build chain across the 15-month gap from 4.0.2 surfaced each one in turn: - S = "${WORKDIR}/${SRCNAME}-${PV}" updated to "${UNPACKDIR}/...". OE-core moved unpacked sources out of WORKDIR and into UNPACKDIR a while back; this recipe predates that transition and was caught by the do_unpack QA check now that we rebuild from scratch. - Drop file://0001-Should-fix-235-nasty_metachars-was-not-being- returne.patch. The CVE-2020-6581 fix (add `return copy;` to process_metachars()) is now present in upstream src/nrpe.c at line 622, so the patch fails to apply and is no longer needed. - Add file://0001-nrpe-ssl.h-guard-ssl_verify_callback_common- declarat.patch. v4.1.3 introduced an `int ssl_verify_callback_common(int, X509_STORE_CTX *, int)` prototype in include/nrpe-ssl.h *outside* the existing #ifdef HAVE_SSL block. The header is included unconditionally by check_nrpe.c and nrpe.c, so any --disable-ssl build hits `unknown type name 'X509_STORE_CTX'`. The patch wraps the prototype in the matching HAVE_SSL guard; the other openssl- typed externs in the same file were already correctly guarded. - PACKAGECONFIG default flipped from "cmdargs bashcomp" to "cmdargs bashcomp ssl". v4.1.3 references `use_ssl` from check_nrpe.c and nrpe.c outside HAVE_SSL guards, but the variable is only defined in src/nrpe-ssl.c — which configure adds to $(SSL_OBJS) only when --enable-ssl is passed. Disabling SSL therefore produces undefined-reference link errors. Enabling by default sidesteps the regression; the new 0001-nrpe-ssl.h-* patch keeps --disable-ssl at least compilable if a downstream user opts out. - EXTRA_OECONF_SSL emptied. The previous value passed --with-ssl-inc=${STAGING_DIR_HOST}${includedir} and --with-ssl-lib=${STAGING_DIR_HOST}${libdir} to configure. When either of those is set, configure disables pkg-config probing and falls back to a hardcoded library search that appends `-L$SSL_LIB_DIR -Wl,-rpath,$SSL_LIB_DIR` to LDFLAGS (visible in configure around line 7695). With our sysroot path that lands as a recipe-sysroot RPATH baked into the installed nrpe and check_nrpe binaries — tripping do_package_qa [rpaths] and [buildpaths]. An empty EXTRA_OECONF_SSL leaves PACKAGECONFIG[ssl] adding nothing to OECONF; pkg-config (driven by the openssl DEPENDS) then finds the library cleanly via the standard --libs flow, which does not bake an rpath into the link. - inherit pkgconfig added. Without it pkgconfig-native is not in the build environment, x86_64-poky-linux-pkg-config is not on PATH, and the EXTRA_OECONF_SSL-empty path above falls through to "found in /usr/include/openssl" (host paths, not sysroot) with a final "compiling and linking against SSL works... no". Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* nagios-plugins: update to v2.5Bruce Ashfield2026-06-021-2/+2
| | | | | | | | | | | | | | | | | | Bumping nagios-plugins to version release-2.5, which comprises the following commits: 8852bf48 Prep for release 2.5 a4c38359 Update NEWS for release date 431f2db3 Update NEWS for contribution and version 0946dd61 check_http: fix segfault when SSL connection fails (#782) 7b98e023 Update NEWS for contribution d41d1185 check_dns: fix reverse mapping (#707) e0994b24 Update NEWS and THANKS.in for Andreas Hasenkopf's contribution 5e455523 Update NEWS and THANKS.in for Paul B. Henson's contribution 90117305 Fixes #685 check_by_ssh should return UNKNOWN, not CRITICAL, on timeout af0f7070 check_icmp: Handle `::` IPv6 address correctly 7c744201 Update THANKS.in for Edgar Fuß Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-24 23:50:02 +0000