1 Release 1 Tag

RSS Feed

• v0.15.0 3aa1955382

  Compare

  napalm-linux 0.15.0 Stable

  christianmanivong released this 2026-10-24 14:59:36 +00:00 | 3 commits to main since this release

  The first release on PyPI. It collects everything since 0.4.0, which was the last version recorded here.

  Changed

  • The driver follows the NAPALM driver standard
    (https://git.netork.io/NAPALM/driver-standard): CI on Gitea runs ruff, mypy, the
    tests on Python 3.10–3.13 and at the lowest declared versions, bandit, pip-audit and
    a build check, and a release tag publishes to PyPI. The package now ships py.typed
    and a LICENSE file. Python 3.9 is no longer supported; napalm-device-types never
    ran on it.
  • Exceptions the driver deliberately ignores (the PTY width at login, closing a dead
    session, unreadable route lines, the snmpd.conf community and port) are now logged
    at debug level.

  Added

  • apt's proxy through napalm-device-types' AptProxyMixin (NetOrk/netork#1397). get_package_proxy() is what apt-config dump says, not 00proxy alone: a proxy in 90curtin-aptproxy or /etc/apt/apt.conf wins over it, and was missed. New: get_package_proxy_report() (every line that sets it, per-host overrides, the https sources) and check_package_proxy(url, expect) (a fetch with apt-helper, past any proxy). configure_package_proxy(url) now also comments out other proxy lines, reads the result back and fetches one InRelease through the proxy; it fails when apt still fetches elsewhere. Reads run on the exec channel. Requires napalm-device-types 4.22.0; version 0.14.0.
  • get_host_firewall() (napalm-device-types' HostFirewallMixin, NetOrk/netork#1344): the host's own netfilter rules — nft -j list ruleset, with the tables iptables manages taken from iptables-save — as chains and rules in one shape. Read-only, as root, on an exec channel (the nft JSON is one long line). Requires napalm-device-types 4.21.0; version 0.13.0.
  • get_service_packages() (napalm-device-types' ServicePackagesMixin, NetOrk/netork#1236): which installed packages each systemd service is made of — the one shipping its unit file and the one shipping its ExecStart binary. Read-only, on an exec channel under sh, without sudo. Requires napalm-device-types 4.20.0; version 0.12.0.

  Security

  • The SSH host key is verified (NetOrk/netork#1167). open() hands netmiko the key the caller expects for the port in optional_args["ssh_host_keys"] (as a known_hosts file that exists only while it connects, with ssh_strict), so any other key is refused before the login (SshHostKeyMismatch); without one netmiko accepts the first key. Every key seen goes to optional_args["ssh_host_key_observer"]. OpenMediaVault and QNAP get this through LinuxDriver.open(). Requires napalm-device-types 4.19.0; version 0.11.0.

  Changed

  • Breaking: get_device_warnings is gone, and with it the apt_proxy_url argument.
    The driver reports facts and the application names warnings (napalm-device-types 4.14):
    get_package_proxy() says which proxy apt fetches through; pending updates were always
    in get_available_updates(). Requires napalm-device-types 4.14.0; version 0.9.0.

  Changed

  • Breaking: run_device_action is gone, with fix_snmp, fix_apt_proxy,
    fix_docker_permissions and the unused apt_update_upgrade. The driver implements
    napalm-device-types 4.13's fix templates instead, and the caller supplies every value:
    configure_snmp_agent(settings) (one rocommunity line per allowed source, udp/161
    opened in ufw or iptables for those sources only, each step judged by its exit
    status), configure_package_proxy(url), grant_container_engine_access(user) and
    ensure_package(name). No community, contact, location or address of an application
    is built in any more. Requires napalm-device-types 4.13.0 or later; version 0.8.0.
  • The sudo hint names no application's settings.

  Fixed

  • The type annotations resolve: Dict, List and Optional were used without an
    import (#29).

  Added

  • get_system_identity() (napalm-device-types 4.9 SystemIdentityMixin): the host's
    SMBIOS system UUID, product serial and board serial, read as root on an exec channel,
    vendor placeholders empty. netOrk matches a server to its BMC on these. Requires
    napalm-device-types 4.9.0 or later; version 0.7.0.

  Changed

  • Requires napalm-device-types 4.7.1 or later; version 0.6.0.
  • Breaking: get_users() is now get_os_users(), following napalm-device-types
    4.7, which renamed OSDriver.get_users because NAPALM's own get_users has
    another shape. The return value is unchanged (a list of UserDict).
    get_users() is NAPALM's again and raises NotImplementedError.

  Fixed

  • Listing updates on yum hosts (RHEL 7, CentOS 7) no longer fails with
    napalm-device-types 4.7: its parse_dnf_security needs the __DNF_RC=<status>
    line DNF_SECURITY_COMMAND prints, and the yum security query had none, so it
    raised ValueError. The yum query now prints that marker the same way
    ({ ...; echo __DNF_RC=$?; } | cat). A yum or dnf security query that failed,
    or whose output was cut short before the marker, still leaves security unknown
    (None) instead of reporting no advisories.

  Security

  • run_command(privileged=True, stdin=...) raises ValueError while a sudo
    password is set. sudo -S reads the password from stdin, and a sudo that does
    not prompt (NOPASSWD, a cached timestamp) left it for the command, which read
    it as the first line of the data: netOrk wrote it into a file that way
    (NetOrk/netork#1029). Stage the data without privilege and have root install
    that file. Without a sudo password (sudo -n) or for a root login, stdin
    still goes to the command.
  • The sudo password is no longer typed into the interactive shell
    (NetOrk/netork#1039). Every privileged command ran there as
    echo '<password>' | sudo -S -p "" <command>: bash kept it in its history,
    so each poll wrote the password into the login user's ~/.bash_history, and
    while the command ran it was in the process list for every local user.
    Privileged commands (_sudo, _sudo_status, and _run_privileged with a
    sudo password) now run on an exec channel like run_command(privileged=True):
    the password reaches sudo -S on stdin, there is no PTY to echo it, and the
    whole command runs as root in one sh -c (before, only the part up to the
    first ;, && or | did, so mv … && chown root:root … failed its chown).
    The interactive session also switches its history off before its first
    command ( unset HISTFILE; set +o history). History files written before
    this version may still hold the sudo password: remove those lines from the
    login user's ~/.bash_history on your hosts and consider changing the
    password. _sudo_status takes the exit status from the channel; it is None
    only when the channel closed without one.
  • The snmpd and apt proxy fixes no longer stage their files at a fixed path in
    /tmp (/tmp/netork_snmpd.conf, /tmp/netork_00proxy) and then mv,
    chown and chmod them as root. Another local user could create that path
    first as a symlink, for example to /etc/shadow, and root's chown/chmod
    followed it. The content now goes to a fresh mktemp file under umask 077,
    written without privilege, and root installs it as a new file owned by root
    (mode 644) next to the target and renames it into place
    (_install_file_as_root). Nothing runs as root when staging failed.
  • get_vpn_tunnels() without a sudo password no longer writes wg show all dump
    (which includes the interfaces' private keys) to the predictable
    /tmp/.netork_wg_<hash>; the dump comes straight from the exec channel.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)