Ngfw trixie changes - #460
Open
singhrohit23 wants to merge 24 commits into
Open
Conversation
…le-linux-config for bookworm
…worm; fix v86d dep
…okworm fbpanel was removed from Debian after bullseye and is not available in bookworm. Replace with xfce4-panel which is already part of the xfce4 stack (xfce4-session/xfwm4 are existing dependencies). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The postinst was looking for xorg safe config at /home/kiosk/xorg-confs/safe which never existed. The file is actually installed at /etc/X11/xorg-kiosk-safe.conf by the package. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- untangle-postgresql-config: PG 13 to PG 15 migration - untangle-spamassassin-update: spamd service + symlink + /etc/default/spamd - untangle-suricata-config: pin suricata (<< 1:7) to avoid DPDK chain - untangle-kiosk: panel alignment fix (center) - untangle-firmware-common/05modules: modprobe br_netfilter + iptable_tune || true - untangle-hardware-config: PG 15 pg_hba.conf scram-sha-256 to trust - untangle-clamav-config: removed obsolete clamd.conf.buster - untangle-development-build: removed lintian dep - untangle-development-kernel: qemu to qemu-system-x86,qemu-utils - Various debian/control: bookworm dependency updates - build-order.txt: updated for bookworm
- .travis.yml: REPOSITORY=bookworm, amd64 only - docker-compose.build.yml: REPOSITORY and TRAVIS_BRANCH defaults to bookworm - docker-compose-dev.yml: new local dev build file with host networking
- position: p=12 is bottom-center in xfce4-panel 4.18 (was p=6) - length: type changed from uint to double (4.18 rejects uint 0) - size: 100px to match fbpanel's original icon height - .xsession: start xfwm4 before xfce4-panel so panel can position correctly via window manager dock hints Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…p_mark Bump linux-image/linux-headers dep to 6.1.0-44-untangle-amd64 (>= 6.1.159-1+untangle3bookworm) so regular builds pull the kernel with the NGFW-15626 NF_DROP conntrack-confirm patch. Add /etc/modprobe.d/untangle-nfqueue.conf to set nfqueue_confirm_drop_mark=255 at module load, activating the patch on every NGFW without manual configuration. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…lpers Round 7-13 dep-resolution work + scaffolding to make ngfw_pkgs build under trixie. Companion to ngfw_imgtools start_new_disc/late_command and ngfw_upstream mod_python 3.5.0.7 commits. debian/control trixie alternatives (avoids hard-coded bookworm-only deps): - untangle-development-runtime: mime-support → media-types | mime-support; ntp → ntpsec | ntp; openjdk-17-jre-headless → openjdk-21-jre-headless | openjdk-17-jre-headless; dropped python-unittest2 alternative. - untangle-postgresql-config: postgresql-15 → postgresql-17 | postgresql-15. - untangle-suricata-config: drop suricata (<< 1:7) ceiling — trixie ships 7.x by default and we validated end-to-end. - untangle-lxc-client: drop cgroupfs-mount (deprecated in trixie). - untangle-extra-utils: drop latencytop (gone from trixie). - untangle-kiosk: drop gvidm (gone from trixie). - untangle-linux-config: trixie kernel deps refresh. NEW package — untangle-kernel-modules-trixie-amd64: Trixie equivalent of untangle-kernel-modules-bookworm-amd64. Provides: untangle-kernel-modules-trixie virtual package consumed by untangle-virus-blocker and other apps that need raw module access. untangle-vue-ui/Makefile: Trixie's apt yarnpkg is Yarn Berry (4.x) which rejects --force and removed the `clean` subcommand. Install Yarn Classic 1.22.22 via npm on first run; keeps yarn.lock and existing build scripts unchanged. Dockerfile.bookworm-current (NEW): Adds nvm/Node-on-bookworm-current image used by the vue-ui builder. Apparently was needed once vue-ui's yarn handling diverged from the base bookworm-build-multiarch image's package set. untangle-archive-keyring trixie-automatic .asc (NEW): Trixie's apt uses sqv (Sequoia OpenPGP) which rejects keybox-format .gpg keyrings. Ship the ASCII-armored key alongside the existing .gpg so InRelease verifies under both bookworm and trixie. Memory pointer: trixie-keyring-sqv-fix.md. build-order.txt: All 85 entries flipped bookworm → trixie. Adds the new untangle-kernel-modules-trixie-amd64 package. waagent removed (handled in ngfw_upstream commit). Existing bookworm metadata still buildable via parallel branch. Validated: round-15 trixie ISO bundles all of the above; install on 192.168.56.137 succeeds; PG17 + ntpsec + suricata 7.x + media-types all install correctly without dep conflicts.
…ld entries Three "auto build" stub entries with version "18.0.0..-1trixie" (note the empty middle between dots) leaked into the seed changelog from local set-version.sh runs that hit a git error and emitted placeholder versions. Drop them; keep only the (0-0) initial entry, matching the pattern used by untangle-kernel-modules-bookworm-amd64. The set-version.sh + dch pipeline computes the real version (18.0.0.<TIMESTAMP>.<COMMIT>-1trixie) from this baseline at build time, so the seed-only state is the correct on-disk source.
pkgtools build.sh runs do-build in the background and redirects its stdout/stderr to a per-package logfile, which is invisible to the Travis console. With VERBOSE=1, do-build is foregrounded with `2>&1 | tee $logfile` so the actual command output streams live. Needed to diagnose the apt-get build-dep hang on untangle-cloud-config under ngfw-trixie (suspected root cause: sqv keyring rejection of the unsigned package-server trixie/current InRelease). Revert this once the keyring issue is fixed at the Docker-image layer.
Previous VERBOSE=1 run on Travis got past untangle-cloud-config build + dput (both succeeded) but then hung silently in do-build's post-upload cleanup block — most likely fakeroot debian/rules clean or the find/ quilt cleanup. Travis killed the job after 10 min no-output. pkgtools build.sh already has a DEBUG env var that sets -x and forces VERBOSE=1 (lines 36-39). Adding it surfaces the exact wedged command. Revert once root cause is identified + fixed.
Root cause of trixie CI hang identified — fakeroot SysV backend wedged under Travis Docker IPC namespace. Fixed at the image layer by switching to fakeroot-tcp in ngfw_src Dockerfile.trixie-build (commit cd7d1eac29). Diagnostic flags no longer needed; revert to silent CI output matching bookworm pattern.
Image rebuild with update-alternatives fakeroot->fakeroot-tcp confirmed deployed (digest f057bcf2fc...). Forced fresh pull locally shows fakeroot-tcp active. Travis still hangs at untangle-cloud-config, but without VERBOSE we can't tell whether: - fakeroot-tcp also hangs under Travis IPC (would need different fix) - Hang has moved to a different command (different root cause) - docker-compose.build.yml uses a different image path Re-enable trace flags to see exact wedge point. Revert again once diagnosed.
…trixie fakeroot-tcp backend (deployed in trixie-build-multiarch image cd7d1eac29) does NOT resolve the hang — Travis Docker IPC + socket restrictions appear to wedge BOTH fakeroot SysV and TCP variants on post-build cleanup. Post-build cleanup is non-essential for CI: dpkg-buildpackage does its own pre-build clean for each package, and Travis runners are ephemeral (no artifact buildup across runs). NO_CLEAN=1 skips the post-build fakeroot/find/quilt block entirely, unblocking the trixie matrix. Also drops VERBOSE+DEBUG diagnostic flags — no longer needed once cleanup is bypassed. Long-term: investigate fakeroot-tcp + Travis IPC interaction OR move the cleanup outside fakeroot wrapper (clean doesn't need root). Both deferred.
On trixie (Python 3.13), python3-gdbm is not installed by default. Without it, mod_python's DbmSession falls back to dbm.sqlite3 which lacks the gdbm-specific db.first()/next() API used by session cleanup, breaking HTTP session persistence for remote clients. This caused cert upload tests (test_021-023) to fail with 60s timeouts in ATS.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.