Benjamin Somers
f06aecbaa8
shared/uefi: Add some OVMF dumping primitives
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-22 20:27:52 -04:00
Benjamin Somers
f4a5c0658a
shared/uefi: Add various variable dissectors
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-22 20:27:27 -04:00
Benjamin Somers
578fbaa5f1
shared/uefi: Add OVMF parsing primitives
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-22 20:27:26 -04:00
Benjamin Somers
5d70034573
shared/api: Add InstanceNVRAMVariable struct
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-22 20:27:25 -04:00
Stéphane Graber
f3007efb9e
incus: Don't persist INCUS_REMOTE as the default remote
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-17 17:03:58 -04:00
Stéphane Graber
637a1b2bea
shared/tls: Use first successful connection in RFC3493Dialer
...
Closes #3643
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-16 00:24:40 -04:00
Stéphane Graber
8b165bff4e
shared/api: Add InstancePortForwardPost
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-12 12:06:47 -04:00
Marcos Guillermo
4f88c2a16e
shared/api: add Network field to NetworkAllocations
...
Signed-off-by: Marcos Guillermo <marcos.cosson@ccc.ufcg.edu.br>
2026-07-09 21:59:21 -04:00
Stéphane Graber
de3d67d43a
incusd/device: Use IsAPIName for device name validation
...
Incus 7.1 added an extra check for device names through IsAPIName.
The other device name validation was less strict and can therefore be
removed and IsAPIName used everywhere.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-04 23:10:40 -04:00
Stéphane Graber
ee81502afe
incusd: Limit websocket control message size
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-04 23:10:23 -04:00
Stéphane Graber
9c6002e864
incusd: Use constant-time comparison for secrets
...
Compare cluster join tokens, certificate add tokens, image secrets and
operation secrets in constant time to avoid timing side-channels.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-04 23:10:05 -04:00
Stéphane Graber
708f897921
Merge pull request #3568 from stgraber/main
...
Tests / System (dir, stable, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / Client (oldstable, macos-latest) (push) Waiting to run
Tests / Client (oldstable, ubuntu-latest) (push) Waiting to run
Tests / Client (oldstable, windows-latest) (push) Waiting to run
Tests / Client (stable, macos-latest) (push) Waiting to run
Tests / Client (stable, ubuntu-latest) (push) Waiting to run
Tests / Client (stable, windows-latest) (push) Waiting to run
Tests / Documentation (push) Waiting to run
incusd/devices: Allow /32 and /128 for OCI addresses
2026-06-30 11:59:53 -04:00
Stéphane Graber
6eb95b4dae
incusd/devices: Allow /32 and /128 for OCI addresses
...
It's a valid configuration to set ipv4.address to a /32 or ipv6.address
to a /128 as LXC will make the gateway as an on-link gateway.
This is particularly useful when dealing with public addresses.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-30 10:13:01 -04:00
Stéphane Graber
31de4be43c
shared/logger: Add WarnOnErrorExcept helper
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-30 09:34:46 -04:00
Serge Hallyn
09b784b312
Merge pull request #3542 from stgraber/security
...
Security fixes
2026-06-25 19:25:13 -05:00
Stéphane Graber
46d6ef2321
incusd/images: Validate fingerprint on direct download
...
This addresses CVE-2026-48769
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-25 18:19:49 -04:00
Stéphane Graber
873a032a46
shared/validate: Reject compression algorithm arguments
...
This addresses CVE-2026-48755
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-25 18:19:48 -04:00
Marc Schiffbauer
4873408d00
shared/validate: Add SELinux validation functions
...
Signed-off-by: Marc Schiffbauer <mschiff@gentoo.org>
2026-06-25 18:17:19 -04:00
Stéphane Graber
35ad321a39
Merge pull request #3529 from masnax/osinfo
...
Add version specific QEMU args according to `image.os` and `image.release`
2026-06-25 14:48:25 -04:00
Max Asnaashari
08ff94784e
shared/osinfo: Add osinfo package
...
Signed-off-by: Max Asnaashari <max.asna@futurfusion.io>
2026-06-25 10:21:48 -07:00
Stéphane Graber
f843eaf2ae
shared/cliconfig: Use platform-specific config directory
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-25 11:28:05 -04:00
Tycho Andersen
ef0b2e00ce
Merge pull request #3496 from stgraber/main
...
Add core.https_allowed_websocket_origin
2026-06-14 10:57:30 -06:00
Stéphane Graber
267891c544
shared/ws: Validate websocket origin against trusted origins
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-13 23:43:35 -04:00
augustodsgv
f2dab164b6
incus/keepalive: Fix comment typo
...
Signed-off-by: augustodsgv <augustodsgv@gmail.com>
2026-06-13 23:02:35 -04:00
Stéphane Graber
6728a1eafc
global: Update for go-yaml/v4 rc5
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-10 22:26:22 -04:00
Stéphane Graber
f830526711
shared/cliconfig: Remove duplicate file closing
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-10 11:25:56 -04:00
Stéphane Graber
191206b420
shared/util: Log deferred errors with WarnOnError
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-06 19:15:14 -04:00
Stéphane Graber
b002734cb6
shared/simplestreams: Log deferred errors with WarnOnError
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-06 19:15:13 -04:00
Stéphane Graber
3675d12eba
shared/subprocess: Log deferred errors with WarnOnError
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-06 19:15:12 -04:00
Stéphane Graber
e00a8f5745
shared/archive: Log deferred errors with WarnOnError
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-06 19:15:11 -04:00
Stéphane Graber
6e887997ff
shared/cliconfig: Log deferred errors with WarnOnError
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-06 19:15:10 -04:00
Stéphane Graber
583b48422a
shared/idmap: Log deferred errors with WarnOnError
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-06 19:15:09 -04:00
Stéphane Graber
16b4399772
shared/resources/usbid: Log deferred errors with WarnOnError
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-06 19:15:08 -04:00
Stéphane Graber
3fbc20137a
shared/resources: Log deferred errors with WarnOnError
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-06 19:15:07 -04:00
Stéphane Graber
1bc4d3feb8
shared/logger: Add WarnOnError helper
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-06 19:14:33 -04:00
Stéphane Graber
3732e84290
shared/api: Add Server.Filtered()
...
This returns a filtered version of the struct where sensitive keys are
replaced with SENSITIVE and where some other noisy keys are removed or
summarized.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-06 00:34:07 -04:00
Stéphane Graber
dc4f57c57d
global: Clean latest gofumpt
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-05 01:56:18 -04:00
Stéphane Graber
ba407ebf09
shared/api: Remove legacy logic
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-06-04 14:23:12 -04:00
Stéphane Graber
d59a96e45c
shared/tls: Detect Lego version/behavior based on help
...
The previous attempt at detecting Lego v5 wasn't successful as various
distribution and packages appear to be messing with reporting of the
version string...
Most notably the Debian lego package reports the version as "dev".
Some others report it based on git tag ("v4" prefix) while others report
the actual version ("4.x").
This is enough of a mess that we should instead just scan the help message.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-05-31 10:10:08 -04:00
Stéphane Graber
ea9eeba6b7
shared/tls: Add support for Lego v5
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-05-31 08:37:19 -04:00
Stéphane Graber
094db782bf
shared/validate: Add CPU topology parsing helper
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-05-28 12:58:29 -04:00
Benjamin Somers
ae5b55a706
shared/api/url: Add URL fragment setter
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-05-28 10:07:02 +00:00
Benjamin Somers
eb79979573
incus: Keep track of last working remote
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-05-27 19:35:26 +00:00
Benjamin Somers
19ce43ffd4
incus/remote: Add support for multiple URLs
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-05-27 19:31:13 +00:00
Stéphane Graber
0be992c3de
Merge pull request #3404 from stgraber/rebuild
...
Implement storage volume rebuild
2026-05-27 14:54:01 -04:00
Stéphane Graber
75bcc0159a
shared/api: Drop no-op omitempty on nested struct fields
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-05-27 03:37:58 -04:00
Stéphane Graber
b7a3c767f8
global: Use strings.Cut instead of strings.Split/SplitN
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-05-27 03:37:55 -04:00
Stéphane Graber
a172b4ef43
shared/api: Add StorageVolumeRebuildPost
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-05-26 18:35:05 -04:00
Stéphane Graber
1d64af1e40
shared/simplestreams: Add combined_type
...
That key is used to indicate the type of a combined image as we can't
rely on the ftype of the root disk to detect it.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-05-24 22:54:03 -04:00
Stéphane Graber
5b6b50b707
shared/archive: Improved ENOSPC detection
...
Closes #3303
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-05-22 11:12:52 -04:00
