kernelkit · troglobit · Jan 12, 2026 · Jan 9, 2026 · Jan 13, 2026 · Jan 12, 2026
diff --git a/board/common/rootfs/etc/profile.d/convenience.sh b/board/common/rootfs/etc/profile.d/convenience.sh
@@ -4,14 +4,14 @@ alias ll='ls -alF'
 alias ls='ls --color=auto'
 
 export LANG=C.UTF-8
-export EDITOR=/usr/bin/edit
-export VISUAL=/usr/bin/edit
+export EDITOR=/usr/bin/editor
+export VISUAL=/usr/bin/editor
 export LESS="-P %f (press h for help or q to quit)"
 export LESSOPEN="|/usr/bin/lesspipe.sh %s"
 alias vim='vi'
 alias view='vi -R'
 alias emacs='mg'
-alias sensible-editor=edit
+alias sensible-editor=editor
 alias sensible-pager=pager
 alias hd="hexdump -C"
 

diff --git a/board/common/rootfs/usr/bin/cfg b/board/common/rootfs/usr/bin/cfg
diff --git a/board/common/rootfs/usr/bin/edit b/board/common/rootfs/usr/bin/edit
diff --git a/board/common/rootfs/usr/bin/show-legacy b/board/common/rootfs/usr/bin/show-legacy
@@ -91,7 +91,7 @@ EOF
 
 is_dhcp_running()
 {
-    sysrepocfg -X -f json -m infix-dhcp-server | jq -r '
+    copy operational -x /infix-dhcp-server:dhcp-server | jq -r '
         ."infix-dhcp-server:dhcp-server".enabled as $global |
         if ."infix-dhcp-server:dhcp-server".subnet? then
                 (."infix-dhcp-server:dhcp-server".subnet[] |
@@ -110,15 +110,15 @@ dhcp()
 
     case $1 in
 	detail)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
+	    copy operational -x /infix-dhcp-server:dhcp-server | \
 		jq -C .
 	    ;;
 	stat*)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
+	    copy operational -x /infix-dhcp-server:dhcp-server | \
 		/usr/libexec/statd/cli-pretty "show-dhcp-server" -s
 	    ;;
 	*)
-	    sysrepocfg -f json -X -d operational -m infix-dhcp-server | \
+	    copy operational -x /infix-dhcp-server:dhcp-server | \
 		/usr/libexec/statd/cli-pretty "show-dhcp-server"
 	    ;;
     esac
@@ -182,13 +182,13 @@ ifaces()
     else
 	if [ $# -gt 0 ]; then
 	    for iface in $*; do
-		sysrepocfg -f json -X -d operational -x \
+		copy operational -x \
 			   "/ietf-interfaces:interfaces/interface[name='$iface']" | \
 		    /usr/libexec/statd/cli-pretty "show-interfaces" -n "$iface"
 	    done
 	    return
 	fi
-        sysrepocfg -f json -X -d operational -m ietf-interfaces | \
+        copy operational -x /ietf-interfaces:interfaces | \
           /usr/libexec/statd/cli-pretty "show-interfaces"
     fi
 }
@@ -227,7 +227,7 @@ rstp()
 
 stp()
 {
-    sysrepocfg -f json -X -d operational -m ietf-interfaces | \
+    copy operational -x /ietf-interfaces:interfaces | \
         /usr/libexec/statd/cli-pretty "show-bridge-stp"
 }
 
@@ -248,7 +248,7 @@ routes()
     else
 	arg="-i ipv4"
     fi
-    sysrepocfg -f json -X -d operational -x "/ietf-routing:routing/ribs" | \
+    copy operational -x /ietf-routing:routing/ribs | \
 	/usr/libexec/statd/cli-pretty "show-routing-table" $arg
 }
 

diff --git a/buildroot b/buildroot
diff --git a/configs/aarch32_defconfig b/configs/aarch32_defconfig
@@ -60,7 +60,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
@@ -141,7 +141,6 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 IMAGE_ITB_AUX=y

diff --git a/configs/aarch32_minimal_defconfig b/configs/aarch32_minimal_defconfig
@@ -60,7 +60,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
@@ -141,7 +141,6 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 IMAGE_ITB_AUX=y

diff --git a/configs/aarch64_defconfig b/configs/aarch64_defconfig
@@ -64,7 +64,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
 BR2_PACKAGE_ONIGURUMA=y
@@ -179,7 +179,6 @@ BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y

diff --git a/configs/aarch64_minimal_defconfig b/configs/aarch64_minimal_defconfig
@@ -34,7 +34,7 @@ BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defc
 BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
@@ -131,7 +131,6 @@ BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y

diff --git a/configs/riscv64_defconfig b/configs/riscv64_defconfig
@@ -76,7 +76,7 @@ BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
 BR2_PACKAGE_ONIGURUMA=y
@@ -203,7 +203,6 @@ BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y

diff --git a/configs/x86_64_defconfig b/configs/x86_64_defconfig
@@ -60,7 +60,7 @@ BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
 BR2_PACKAGE_ONIGURUMA=y
@@ -176,7 +176,6 @@ BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y

diff --git a/configs/x86_64_minimal_defconfig b/configs/x86_64_minimal_defconfig
@@ -35,7 +35,7 @@ BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defc
 BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -143,7 +143,6 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 IMAGE_ITB_AUX=y

diff --git a/doc/ChangeLog.md b/doc/ChangeLog.md
@@ -6,29 +6,25 @@ All notable changes to the project are documented in this file.
 [v26.01.0][UNRELEASED]
 -------------------------
 
-> [!WARNING]
-> **BREAKING CHANGES:** This release includes breaking changes to WiFi configuration:
+> [!IMPORTANT]
+> This release includes **breaking changes** to WiFi configuration that will
+> result in existing configuration being disabled:
 >
 > - WiFi station/client configuration has been restructured. The `wifi` container
 >   now requires a `radio` reference, and station configuration has moved under a
->   `wifi/station` container. Existing WiFi configurations must be manually updated.
-> - WiFi radios are now configured via `ietf-hardware` instead of the interfaces module.
-
-> [!NOTE]
-> Noteworthy changes and additions in this release:
->
-> - WiFi Access Point (AP) mode support with multi-SSID capability
-> - RIPv2 routing support
-> - WireGuard support
+>   `wifi/station` container. Existing WiFi configurations must be manually updated
+> - WiFi radios are now configured via `ietf-hardware` instead of the interfaces module
 
 ### Changes
 
+Noteworthy changes and additions in this release are marked below in bold text.
+
 - Upgrade Linux kernel to 6.12.65 (LTS)
 - Upgrade libyang to 4.2.2
 - Upgrade sysrepo to 4.2.10
 - Upgrade netopeer2 (NETCONF) to 2.7.0
-- Add RIPv2 routing support, issue #582
-- Add NTP server support, issue #904
+- Add **RIPv2 routing support**, issue #582
+- Add **NTP server support**, issue #904
 - Migrate DHCPv6 client to odhcp6c for improved Router Advertisement
   integration.  Adds support for hybrid RA+DHCPv6 deployments where SLAAC
   assigns addresses and DHCPv6 provides DNS (common ISP scenario)
@@ -45,21 +41,35 @@ All notable changes to the project are documented in this file.
   policy, keeping snapshots from every 5 minutes (recent) to yearly (historical)
 - Add support data collection script, useful when troubleshooting issues on
   deployed systems. Gathers system information, logs, and more.  Issue #1287
-- Add WiFi Access Point (AP) mode with multi-SSID support and WPA2/WPA3 security.
-  **BREAKING:** WiFi architecture refactored with radios configured via
-  `ietf-hardware` and interfaces requiring `radio` reference. Station config
-  moved to `wifi/station` container. Existing Wi-Fi interfaces will be
-  removed during upgrade (for the rest of the configuration to apply)
-  and you need to reconfigure them again. See [wifi.md](wifi.md) for details
-- Add support for WireGuard VPN tunnels.
+- Add **WiFi Access Point (AP) mode with multi-SSID support and WPA2/WPA3**
+  security.  **BREAKING:** WiFi architecture refactored with radios configured
+  via `ietf-hardware` and interfaces requiring `radio` reference. Station
+  config moved to `wifi/station` container.  Existing Wi-Fi interfaces will be
+  removed during upgrade (for the rest of the configuration to apply) and you
+  need to reconfigure them again.  See the [WiFi][] documentation for details
+- Add support for **WireGuard VPN tunnels**.
+- New default NACM privilege levels (user levels) in `factory-config`:
+  `operator` (network & container manager) and `guest` (read-only).  For
+  details, see the updated system configuration documentation, as well as a
+  new dedicated NACM configuration guide
+- New `show nacm` admin-exec command to inspect access control rules
+- CLI now uses `copy` and `rpc` tools instead of deprecated `sysrepocfg`.  The
+  latter now also require the use of `sudo` for `admin` level users
+- Enhanced `copy` command with XPath filtering support
 
 ### Fixes
 
+- Fix #1082: Wi-Fi interfaces always scanned, introduce a `scan-mode` to the
+  Wi-Fi concept in Infix
 - Fix #1314: Raspberry Pi 4B with 1 or 8 GiB RAM does not boot.  This was due
   newer EEPROM firmware in newer boards require a newer rpi-firmware package
-- Fix #1082: Wi-Fi interfaces always scanned, introduce a  `scan-mode`
-  to the Wi-Fi concept in Infix.
+- Fix #1345: firewall not updating when interfaces become bridge/lag ports
+- Fix #1346: firewall complains in syslog, no `/etc/firewalld/firewalld.conf`
+- Fix default password hash in `do password encrypt` command.  New hash is the
+  same as the more commonly used `change password` command, *yescrypt*
+- Prevent MOTD from showing on non-shell user login attempts
 
+[wifi]: https://kernelkit.org/infix/latest/wifi/
 
 [v25.11.0][] - 2025-12-02
 -------------------------