Ngfw trixie Merge

.travis.yml

@@ -16,10 +16,9 @@ env:
       PKGTOOLS_COMMIT: origin/${TRAVIS_BRANCH}
       UPLOAD: scp
   jobs:
-    - REPOSITORY: bullseye
+    - REPOSITORY: trixie
       ARCHITECTURE: amd64
-    - REPOSITORY: bullseye
-      ARCHITECTURE: arm64
+      NO_CLEAN: 1
 
 before_install:
 - echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin

Dockerfile.trixie-base

@@ -0,0 +1,28 @@
+FROM debian:trixie
+LABEL maintainer="Rohit Singh <rohit@arista.com>"
+
+ENV REPOSITORY=trixie
+ENV STABLE_VERSION=19.0.0
+
+USER root
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN echo 'APT::Install-Recommends "false";' > /etc/apt/apt.conf.d/no-recommends && \
+    echo 'APT::Install-Suggests "false";' >> /etc/apt/apt.conf.d/no-recommends
+
+RUN apt update -q
+RUN apt dist-upgrade -y
+RUN apt install -y gnupg dirmngr
+
+# cleanup
+RUN apt clean
+RUN rm -rf /var/lib/apt/lists/*
+
+# NGFW-15749: trixie's sqv (replacement for apt-key) rejects keybox-format
+# .gpg files. Export ASCII-armored .asc instead (sqv accepts .asc and .pgp,
+# not .gpg keybox). Same fix shipped in ngfw_pkgs untangle-archive-keyring
+# commit aa164ae57.
+RUN mkdir -p /root/.gnupg && chmod 700 /root/.gnupg && \
+    gpg --keyserver keyserver.ubuntu.com --recv-keys 735A9E18E8F62EDF413592460B9D6AE3627BF103 && \
+    gpg --export --armor 735A9E18E8F62EDF413592460B9D6AE3627BF103 \
+        > /etc/apt/trusted.gpg.d/untangle.asc

Dockerfile.trixie-build

@@ -0,0 +1,85 @@
+FROM untangleinc/ngfw:trixie-base-multiarch
+LABEL maintainer="Rohit Singh <rohit@arista.com>"
+
+# do not gzip apt lists files (for apt-show-versions)
+RUN rm -f /etc/apt/apt.conf.d/docker-gzip-indexes
+
+RUN apt update -q
+
+# add foreign architectures and their corresponding crossbuild package
+RUN dpkg --add-architecture arm64
+RUN apt install --yes crossbuild-essential-arm64
+
+# install required packages
+RUN apt install --yes build-essential
+RUN apt install --yes debhelper
+RUN apt install --yes devscripts
+RUN apt install --yes git
+# NGFW-15749: git 2.47 (trixie) enforces safe.directory stricter than bookworm's 2.39.
+# Bind-mounted /opt/untangle/build at runtime triggers "dubious ownership" → empty git log
+# → empty timestamp → malformed debian/changelog → libapache2-mod-python setup.py fails.
+RUN git config --system --add safe.directory '*'
+RUN apt install --yes apt-show-versions
+RUN apt install --yes openssh-client
+RUN apt install --yes dput
+RUN apt install --yes curl
+RUN apt install --yes procps
+RUN apt install --yes gawk
+RUN apt install --yes apt-utils
+
+# kernel build dependencies
+RUN apt install --yes kernel-wedge
+RUN apt install --yes quilt
+RUN apt install --yes bc
+RUN apt install --yes flex
+RUN apt install --yes bison
+RUN apt install --yes libelf-dev
+RUN apt install --yes libssl-dev
+RUN apt install --yes rsync
+RUN apt install --yes kmod
+RUN apt install --yes cpio
+RUN apt install --yes python3
+RUN apt install --yes python3-jinja2
+RUN apt install --yes dwarves
+RUN apt install --yes dh-exec
+
+# ISO build dependencies
+RUN apt install --yes simple-cdd
+RUN apt install --yes reprepro
+RUN apt install --yes dose-distcheck
+RUN apt install --yes mtools
+RUN apt install --yes dosfstools
+RUN apt install --yes xorriso
+RUN apt install --yes debian-archive-keyring
+RUN apt install --yes fakeroot
+# NGFW-15749: Travis CI Docker container's IPC namespace restricts SysV semaphores,
+# causing fakeroot (default sysv backend) to hang indefinitely on `fakeroot debian/rules
+# clean` after dput. Switch to the TCP backend which uses sockets instead and works in
+# any IPC environment. Local builds also unaffected (libfakeroot-tcp.so is upstream-shipped).
+RUN update-alternatives --set fakeroot /usr/bin/fakeroot-tcp
+RUN apt install --yes dpkg-dev
+
+# cleanup
+RUN apt clean
+RUN rm -rf /var/lib/apt/lists/* /var/cache/apt-show-versions/*
+
+# do not use official Debian mirrors during build
+RUN rm -f /etc/apt/sources.list
+
+# base dir
+ENV UNTANGLE=/opt/untangle
+RUN mkdir -p ${UNTANGLE}
+
+# pkgtools
+ENV PKGTOOLS=${UNTANGLE}/ngfw_pkgtools
+VOLUME ${PKGTOOLS}
+
+# source to build
+ENV SRC=/opt/untangle/build
+RUN mkdir -p ${SRC}
+VOLUME ${SRC}
+
+WORKDIR ${SRC}
+
+
+CMD [ "bash", "-c", "${PKGTOOLS}/build.sh" ]

branding-manager/hier/usr/lib/python3/dist-packages/tests/test_branding_manager.py

@@ -1,6 +1,7 @@
 """branding_manager tests"""
 import json
 import re
+import time
 import unittest
 import urllib.error
 import urllib.request
@@ -24,6 +25,50 @@
 default_banner_message = ""
 
 default_policy_id = 1
+
+
+def _fetch_uvm_root_with_retry(retries=10, retry_sleep=2, all_parameters=True):
+    """
+    GET the UVM root URL via remote wget and retry until the response body
+    looks like the UVM login page (contains a populated <title> with company
+    name in it), not Apache's mod_python "Permission denied" fallback.
+
+    Right after untangle-vm restart Apache mod_python's DbmSession isn't fully
+    initialized for some seconds and any unauthenticated GET to / returns the
+    "<title>Server</title> ... Permission denied" page instead of the actual
+    login HTML. Observed as 2 branding-manager failures (test_020/021) at T+9m
+    in the 2026-05-28 ATS bookworm->trixie post-upgrade run; both pages render
+    correctly on re-run minutes later.
+
+    Returns the (string) response body. Raises AssertionError if no retry
+    succeeds.
+    """
+    title_re = re.compile(r'<title>(.*?)</title>', re.IGNORECASE | re.DOTALL)
+    last = ""
+    for attempt in range(retries):
+        result = remote_control.run_command(
+            global_functions.build_wget_command(
+                output_file="-",
+                ignore_certificate=True,
+                all_parameters=all_parameters,
+                uri=global_functions.get_http_url(),
+            ),
+            stdout=True,
+        ) or ""
+        m = title_re.search(result)
+        title = m.group(1).strip() if m else ""
+        # Apache fallback page renders as "<title>Server</title>"; UVM login
+        # renders with the company name in the title (e.g. "Arista Administrator
+        # Login"). Any non-"Server" title with content means the UVM stack served.
+        if title and title.lower() != "server":
+            return result
+        last = result
+        time.sleep(retry_sleep)
+    raise AssertionError(
+        f"UVM root never returned the login page after {retries} attempts; "
+        f"last body title was empty or 'Server' (mod_python fallback). "
+        f"Apache mod_python likely not warm after untangle-vm restart."
+    )
 
 @pytest.mark.branding_manager
 class BrandingManagerTests(NGFWTestCase):
@@ -162,8 +207,8 @@ def test_019_valid_contact_renders_on_blockpage(self):
     @pytest.mark.failure_behind_ngfw
     def test_020_check_login_page_branding(self):
         # Check login page for branding
-        result = remote_control.run_command(global_functions.build_wget_command(output_file="-", ignore_certificate=True, all_parameters=True, uri=global_functions.get_http_url()),stdout=True)
-        
+        result = _fetch_uvm_root_with_retry()
+
         # Verify Title of blockpage as company name
         myRegex = re.compile('<title>(.*?)</title>', re.IGNORECASE|re.DOTALL)
         matchText = myRegex.search(result).group(1)
@@ -175,17 +220,17 @@ def test_020_check_login_page_branding(self):
 
     def test_021_changeBranding_bannerMessage(self):
         global app, appWeb, appData
-        
+
         # TODO Just like the changes above, I think this may be unnecessary. Not sure though. Do we need to test multi-line?
         appData['bannerMessage'] = "A regulation banner requirement containing a mix of text including <b>html</b> and\nmultiple\nlines"
         app.setSettings(appData)
-        result = remote_control.run_command(global_functions.build_wget_command(output_file="-", all_parameters=True, uri=global_functions.get_http_url()),stdout=True)
+        result = _fetch_uvm_root_with_retry()
         myRegex = re.compile('.*A regulation banner requirement containing a mix of text including <b>html</b> and<br/>multiple<br/>lines.*', re.DOTALL|re.MULTILINE)
         assert(re.match(myRegex, result))
-            
+
         appData['bannerMessage'] = default_banner_message
         app.setSettings(appData)
-        result = remote_control.run_command(global_functions.build_wget_command(output_file="-", ignore_certificate=True, all_parameters=True, uri=global_functions.get_http_url()),stdout=True)
+        result = _fetch_uvm_root_with_retry()
         myRegex = re.compile('.*A regulation banner requirement containing a mix of text including <b>html</b> and<br/>multiple<br/>lines.*', re.DOTALL|re.MULTILINE)
         assert(not re.match(myRegex, result))
 

build-order.txt

@@ -1 +1 @@
-.     bullseye
+.     trixie

buildtools/buildtools.rb

@@ -5,6 +5,7 @@
 openjdk8 = "java-8-openjdk-#{arch}"
 openjdk11 = "java-11-openjdk-#{arch}"
 openjdk17 = "java-17-openjdk-#{arch}"
+openjdk21 = "java-21-openjdk-#{arch}"
 
 jvm = case arch
       when "armel"
@@ -13,7 +14,13 @@
       when "armhf"
         File.exist?("/usr/lib/jvm/#{openjdk8}") ? openjdk8 : "jdk-7-oracle-arm-vfp-hflt"
       else
-        File.exist?("/usr/lib/jvm/#{openjdk17}") ? openjdk17 : openjdk11
+        if File.exist?("/usr/lib/jvm/#{openjdk21}")
+          openjdk21
+        elsif File.exist?("/usr/lib/jvm/#{openjdk17}")
+          openjdk17
+        else
+          openjdk11
+        end
       end
 warn "JVM = #{jvm}"
 ENV['JAVA_HOME'] = "/usr/lib/jvm/#{jvm}"

buildtools/jars.rb

@@ -41,7 +41,7 @@ def Jars.findJars
     const_set(:GetText, [ Jars.downloadTarget('gettext-commons-0.9.1/gettext-commons-0.9.1.jar') ])
     const_set(:JakartaActivation, [ Jars.downloadTarget('jakarta.activation-1.2.1/jakarta.activation-1.2.1.jar') ])
     const_set(:JavaTransaction, [ Jars.downloadTarget('jta-1.1/jta-1.1.jar') ])
-    const_set(:Slf4j, [ Jars.downloadTarget( 'slf4j-2.0.9/slf4j-reload4j-2.0.9.jar'), 
+    const_set(:Slf4j, [ Jars.downloadTarget( 'slf4j-2.0.9/slf4j-nop-2.0.9.jar'),
                         Jars.downloadTarget( 'slf4j-2.0.9/slf4j-api-2.0.9.jar' ) ])
 
     const_set(:TomcatCommon, [ 'tomcat-embed-jasper.jar',

buildtools/target.rb

@@ -256,7 +256,7 @@ def initialize(package, moveSpecs, taskName, filterset = nil, destBase = nil)
 
         if File.symlink?(src)
           ## Handling symbolic links that don't resolve until in place.
-          file dest => src if File.exists?( src )
+          file dest => src if File.exist?( src )
 
           file dest do
             ensureDirectory(File.dirname(dest)) if !File.exist?(dest)

captive-portal/hier/usr/share/untangle/web/capture/handler.py

@@ -10,7 +10,7 @@
 from uvm import Uvm
 import urllib.request, urllib.parse, urllib.error
 import pprint
-import imp
+import importlib.util
 import time
 import os
 import uvm.i18n_helper
@@ -19,7 +19,8 @@
 
 from uvm import settings_reader
 
-_ = uvm.i18n_helper.get_translation('untangle').lgettext
+_trans = uvm.i18n_helper.get_translation('untangle')
+_ = getattr(_trans, 'lgettext', _trans.gettext)
 
 # Dictionary of Oauth providers by name, each with the following fields:
 # platform  Identifier to pass to auth-relay
@@ -244,7 +245,17 @@ def index(req):
 # Arguments include username and password along with several hidden fields
 # that store the details of the page originally requested.
 
-def authpost(req,username,password,method,nonce,appid,host,uri):
+def authpost(req,username=None,password=None,method=None,nonce=None,appid=None,host=None,uri=None):
+    # On Python 3.11, mod_python FieldStorage returns bytes keys
+    if username is None or method is None:
+        fields = _get_form_fields(req)
+        if username is None: username = fields.get('username', '')
+        if password is None: password = fields.get('password', '')
+        if method is None: method = fields.get('method', '')
+        if nonce is None: nonce = fields.get('nonce', '')
+        if appid is None: appid = fields.get('appid', '')
+        if host is None: host = fields.get('host', '')
+        if uri is None: uri = fields.get('uri', '')
     if type(username) == bytes:
         username = username.decode('utf-8')
     if type(password) == bytes:
@@ -322,7 +333,17 @@ def authpost(req,username,password,method,nonce,appid,host,uri):
 # in the POST data.  To handle this scenario, we use a function parameter
 # default of 'empty' which will cause app.userActivate to return false.
 
-def infopost(req,method,nonce,appid,host,uri,agree=b'empty'):
+def infopost(req,method=None,nonce=None,appid=None,host=None,uri=None,agree=b'empty'):
+    # On Python 3.11, mod_python FieldStorage returns bytes keys which
+    # don't match str parameter names in apply_fs_data, so args are empty
+    if method is None or nonce is None or appid is None or host is None or uri is None:
+        fields = _get_form_fields(req)
+        if method is None: method = fields.get('method', '')
+        if nonce is None: nonce = fields.get('nonce', '')
+        if appid is None: appid = fields.get('appid', '')
+        if host is None: host = fields.get('host', '')
+        if uri is None: uri = fields.get('uri', '')
+        if agree == b'empty': agree = fields.get('agree', 'empty')
     if type(method) == bytes:
         method = method.decode('utf-8')
     if type(nonce) == bytes:
@@ -622,6 +643,23 @@ def extjs_reply(status,message,filename=""):
 
     return(result)
 
+#-----------------------------------------------------------------------------
+# Extract form fields from req.form, handling bytes keys from Python 3.11
+
+def _get_form_fields(req):
+    fields = {}
+    form = getattr(req, 'form', None)
+    if form is not None and hasattr(form, 'list') and form.list:
+        for field in form.list:
+            name = field.name
+            value = field.value
+            if type(name) == bytes:
+                name = name.decode('utf-8')
+            if type(value) == bytes:
+                value = value.decode('utf-8')
+            fields[name] = value
+    return fields
+
 #-----------------------------------------------------------------------------
 # forces stuff loaded from settings files to be UTF-8 when plugged
 # into the page template files
@@ -688,5 +726,7 @@ def custom_handler(req):
 def _import_file(filename):
     (path, name) = os.path.split(filename)
     (name, ext) = os.path.splitext(name)
-    (file, filename, data) = imp.find_module(name, [path])
-    return imp.load_module(name, file, filename, data)
+    spec = importlib.util.spec_from_file_location(name, os.path.join(path, name + ext))
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module

captive-portal/hier/usr/share/untangle/web/capture/logout/logout.py

@@ -11,7 +11,8 @@
 
 from uvm import settings_reader
 
-_ = uvm.i18n_helper.get_translation('untangle').lgettext
+_trans = uvm.i18n_helper.get_translation('untangle')
+_ = getattr(_trans, 'lgettext', _trans.gettext)
 
 #-----------------------------------------------------------------------------
 # This is the default function that gets called for a client logout request

debian/changelog

@@ -1,3 +1,21 @@
+untangle-vm (18.0.0.20260429T064446Z.c59ed45571+localdiff20260511T113424-1trixie) current; urgency=medium
+
+  * auto build
+
+ -- Untangle Buildbot <buildbot@untangle.com>  Wed, 29 Apr 2026 06:44:46 +0000
+
+untangle-vm (18.0.0.20260429T064446Z.c59ed45571+localdiff20260511T112649-1trixie) current; urgency=medium
+
+  * auto build
+
+ -- Untangle Buildbot <buildbot@untangle.com>  Wed, 29 Apr 2026 06:44:46 +0000
+
+untangle-vm (18.0.0.20260429T064446Z.c59ed45571+localdiff20260511T111712-1trixie) current; urgency=medium
+
+  * auto build
+
+ -- Untangle Buildbot <buildbot@untangle.com>  Wed, 29 Apr 2026 06:44:46 +0000
+
 untangle-vm (10.0.0~svn20130320r34349trunk-1squeeze) dmorris; urgency=low
 
   * 10.0