- CI moves to .gitea/workflows/ci.yml and calls the shared driver workflow
of NAPALM/driver-standard; .github/ is gone.
- napalm-device-types >=4.21.1 from PyPI (the README no longer installs
it from git), py.typed, SPDX license string, setuptools>=77, version
floors on the dev extra, Issues and Changelog links on git.netork.io.
- mypy strict for the package; napalm_bsd.base, napalm_bsd.freebsd and
napalm_bsd.openbsd are exempt for now (28 errors, mostly getters typed
as plain dicts rather than the device-types TypedDicts), recorded in the
quality baseline with three complex parsers. parse.py is strict after a
one-line annotation.
- Coverage floor 94 % (measured 94.63 %).
- nosec for the staging path on the device (B108); it is a mktemp
template on the remote host, not a local temp file.
- The wildcard listen addresses parsed from sockstat/netstat are named
constants with a nosec (B104): reported data, never a bind. The output
is unchanged.
- ruff found nothing left after the mechanical pass.
Mechanical: ruff format, and ruff check --fix with the rule set every NAPALM
driver uses (E, F, I, UP, B at line length 100, Python 3.10). What ruff
cannot fix comes in the next commit.
The driver accepted any SSH host key. It now verifies through
napalm-device-types' HostKeyCheck (>= 4.19.0): with a known key in
optional_args["ssh_host_keys"] any other key is refused before login, and
every key seen is reported to optional_args["ssh_host_key_observer"].
Without either argument it connects as before (first use).
fix_snmp wrote an application's snmpd.conf (community public, Managed
by netOrk, netork@localhost) and judged itself by a local snmpget.
The drivers implement napalm-device-types 4.13's SnmpAgentMixin steps
instead: net-snmp installed, snmpd.conf with one rocommunity line per
allowed source (staged without privilege, installed by root), snmpd
enabled and restarted. pf and ipfw rules stay the operator's. A
community or text that would break the file is refused. The caller
verifies with its own SNMP client.
Also get_management_peer() from SSH_CONNECTION, ensure_package from
the base package, and get_snmp_config no longer assumes "public".
BREAKING CHANGE: run_device_action is removed. Requires
napalm-device-types 4.13.
Part of #12 (the OpenBSD new_version text is still open).
run_command prepended the sudo password to the caller's stdin. A sudo
that does not prompt left it for the command, and fix_snmp's
'cat > snmpd.conf' wrote it as the configuration's first line before
making the file world-readable.
run_command now refuses stdin to a privileged command while a sudo
password is set. fix_snmp stages the configuration in a mktemp file
without privilege, and root installs it next to the target and renames
it over, so nothing root runs follows a symlink.
Closes#8
first_boot_pending() is true while /firstboot exists on FreeBSD. A FreeBSD
cloud image upgrades its base system on its first boot, starts sshd only
after that and restarts right away, and /etc/rc removes /firstboot just
before that restart. netOrk waits for this before it sets up a new VM
(NetOrk/netork#795).
OpenBSD has no such marker to ask yet, so it returns False there.
netOrk reads an empty update list as "no updates" and closes every patch
clock on the host. A refused sudo, a failing pkg, syspatch or freebsd-update,
or a pkg database pkg cannot read used to come back as that empty list. Each
of these now raises. Only pkg's "is not installed" still means no packages.
BsdDriver takes on napalm-device-types' HostStatusMixin. On FreeBSD it
reports a host whose installed kernel differs from the running one as
needing a reboot (device-types 4.1). OpenBSD stays unknown.
Closes#4
Christian Manivong