Repository navigation
[code sync] Merge code from sonic-net/sonic-buildimage:master to master - #3503
Open
mssonicbld wants to merge 98 commits into
Open
mssonicbld wants to merge 98 commits into
mssonicbld wants to merge 98 commits into
Conversation
mssonicbld
commented
Oct 31, 2026
mssonicbld
commented
Collaborator
[master] Upgrade SONiC package Versions
…cally (#30373) #### Why I did it platform/vpp ``` * 9ac6e93 - (HEAD -> master, origin/master, origin/HEAD) Merge pull request Azure#327 from lolyu/sonic-ext-l2-trap-learn (42 minutes ago) [Longxiang Lyu] |\ | CODE_OF_CONDUCT.md LICENSE README.md SECURITY.md SUPPORT.md azure-pipelines failure_prs.log renovate scripts skip_prs.log 341a927 - Merge branch 'master' into sonic-ext-l2-trap-learn (26 hours ago) [Longxiang Lyu] | |\ | |/ |/| * | 03f9177 - vpp: load nat_plugin.so (nat44-ed) for SAI NAT (Azure#305) (26 hours ago) [Ryan] | CODE_OF_CONDUCT.md LICENSE README.md SECURITY.md SUPPORT.md azure-pipelines failure_prs.log renovate scripts skip_prs.log 6a38235 - [vpp][sonic_ext] Bump VPP_VERSION to 2606-0.17 and list l2-trap-learn in the feature test (26 hours ago) [Longxiang Lyu] | CODE_OF_CONDUCT.md LICENSE README.md SECURITY.md SUPPORT.md azure-pipelines failure_prs.log renovate scripts skip_prs.log dadb8ca - Merge branch 'master' into sonic-ext-l2-trap-learn (26 hours ago) [Longxiang Lyu] | |\ | |/ |/| * | 8feae71 - [sonic-ext] Test feature toggles set in startup.conf (Azure#323) (35 hours ago) [AkeelAli] * | 28fa5ba - vpp: route unmapped hosts untranslated with nat44-ed static NAT (Azure#315) (2 days ago) [Ryan] | CODE_OF_CONDUCT.md LICENSE README.md SECURITY.md SUPPORT.md azure-pipelines failure_prs.log renovate scripts skip_prs.log 2033604 - [vpp][sonic_ext] Count trap-learn frames atomically (2 days ago) [Longxiang Lyu] | CODE_OF_CONDUCT.md LICENSE README.md SECURITY.md SUPPORT.md azure-pipelines failure_prs.log renovate scripts skip_prs.log 49b1b19 - [vpp][sonic_ext] Learn the source MAC of trapped L2 frames (2 days ago) [Longxiang Lyu] |/ * 09f4c26 - Merge pull request Azure#314 from aaronber0614/fix/vxlan-decap-any-ut (3 days ago) [aaronber0614] |\ | CODE_OF_CONDUCT.md LICENSE README.md SECURITY.md SUPPORT.md azure-pipelines failure_prs.log renovate scripts skip_prs.log b7bc003 - Merge branch 'master' into fix/vxlan-decap-any-ut (3 days ago) [aaronber0614] | |\ | |/ |/| * | dd0fa7c - [vpp] Add sonic_ext packet-trim admission shim (SAI DROP_AND_TRIM datapath) (Azure#269) (3 days ago) [aaronber0614] / * 814ce5d - Merge branch 'master' into fix/vxlan-decap-any-ut (8 days ago) [yue-fred-gao] * 612392e - Merge branch 'master' into fix/vxlan-decap-any-ut (9 days ago) [yue-fred-gao] * 0bb5837 - [vpp][vxlan] Verify decap-any VNI isolation (10 days ago) [Aaron Bernardino] * 900cdce - [vpp][vxlan] Add source-independent decap unit tests (10 days ago) [Aaron Bernardino] ``` #### How I did it #### How to verify it #### Description for the changelog
[master] Upgrade docker-ptf package versions
… automatically (#30458) #### Why I did it src/sonic-platform-common ``` * 608be69 - (HEAD -> master, origin/master, origin/HEAD) [platform-api] A cross-language platform API, declared once in a .pyi (Azure#768) (19 minutes ago) [ganglv] ``` #### How I did it #### How to verify it #### Description for the changelog
…tically (#30459) #### Why I did it src/sonic-sairedis ``` * 58614f5f - (HEAD -> master, origin/master, origin/HEAD) Retry PHY collection when lane count increases (Azure#2090) (23 hours ago) [Mark Xiao] ``` #### How I did it #### How to verify it #### Description for the changelog
Enable CoPP policer stats polling by default and add COPP_STATS to YANG
[docker-hft]: Move countersyncd from swss into a dedicated hft container
Signed-off-by: Fraser Gordon <fraserg@arista.com>
What: Adds two docker-sonic-mgmt dependency patches for IPv6 targets and double-valued Subscribe updates in the pinned pygnmi 0.8.15 package. Why: The published PyPI artifact lacks upstream fixes, causing bare-IPv6 connection failures and lost double_val telemetry values; related to #29630 and upstream pygnmi#179. How: Separates bracketed IPv6 gRPC targets from bare socket/TLS hosts, accepts already-bracketed addresses, preserves Unix socket paths, and parses double_val using field presence so zero is retained. Applies both patches through the existing Dockerfile mechanism with batch, forward and zero-fuzz checks, without changing the version pin. Testing: All 32 reported checks passed, including required Azure.sonic-buildimage, EasyCLA and Semgrep. Reported published-head validation passed 22 real local RPC scenarios and native bare-IPv6 mTLS Get on SONiC 20260510.11; controlled PTF-side Subscribe tests retained 0.0, -17.25 and 1.23456789012345 while reproducing the original defects as controls. Native-DUT double telemetry, UDS+mTLS and full-image validation remain unqualified; the HTTP CONNECT proxy correction and its test results apply only to an unpublished follow-up. Signed-off-by: donghaolicd <leedonhom@gmail.com>
Why I did it The Bookworm PTF Debian package lock still specifies the older +b6 revision for its Brotli packages. Update those pins to the requested +deb12u1 revision. Work item tracking Microsoft ADO (number only): N/A How I did it Changed the libbrotli1 and python3-brotli version pins from 1.0.9-2+b6 to 1.0.9-2+deb12u1 in the Bookworm PTF package lock.
* [sonic-yang-models] Add generic SAI_PROFILE CONFIG_DB table Add a new, vendor-agnostic SAI_PROFILE CONFIG_DB table that allows arbitrary SAI init-config key/value pairs (rendered into /etc/sai.d/sai.profile and consumed by syncd/the vendor SAI implementation) to be supplied as CONFIG_DB data instead of being hardcoded per hwsku. --------- Signed-off-by: bingwang <bingwang@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
mssonicbld
requested review from
Qi Luo (qiluo-msft) and
xumia
as code owners
October 31, 2026 03:04
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Collaborator
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
…lly (#30405) #### Why I did it src/sonic-swss ``` * 2f7bbdd0 - (HEAD -> master, origin/master, origin/HEAD) [copp]: Align VS tests with LLDP and UDLD queue3 mapping (#5076) (9 hours ago) [prabhataravind] * 6d7cc9af - [portsorch]: Do not let an optional DF attribute fail object creation (#4841) (3 days ago) [Tamer Ahmed] * 35ccc4bd - [macsecmgrd] clear stale APPL_DB MACsec state before a new MKA session (#4994) (3 days ago) [senthil-nexthop] ``` #### How I did it #### How to verify it #### Description for the changelog
…omatically (#30427) #### Why I did it src/sonic-mgmt-common ``` * 9199e14 - (HEAD -> master, origin/master, origin/HEAD) Update module github.com/redis/go-redis/v9 to v9.6.3 [SECURITY] (Azure#265) (4 hours ago) [renovate[bot]] * 19c6323 - [ci] switch to sonic-ubuntu-1c agent pool (Azure#272) (2 days ago) [yijingyan2] ``` #### How I did it #### How to verify it #### Description for the changelog
…automatically (#30457) #### Why I did it src/sonic-mgmt-framework ``` * 5aecf1b - (HEAD -> master, origin/master, origin/HEAD) [ci] switch to agent pool sonicso1ES-amd64 to address no space left issue (Azure#175) (27 hours ago) [yijingyan2] ``` #### How I did it #### How to verify it #### Description for the changelog
…utomatically (#30468) #### Why I did it src/sonic-host-services ``` * 8fd500a - (HEAD -> master, origin/master, origin/HEAD) Remove unused ImageService download and install D-Bus methods (Azure#482) (6 hours ago) [Brad House - Nexthop] ``` #### How I did it #### How to verify it #### Description for the changelog
…D automatically (#30469) #### Why I did it src/sonic-platform-daemons ``` * e57911e - (HEAD -> master, origin/master, origin/HEAD) [ycabled][active-standby] Ignore transceiver updates for initialized MUX simulator. (Azure#882) (56 minutes ago) [harjotsinghpawra] ``` #### How I did it #### How to verify it #### Description for the changelog
…atically (#30407) #### Why I did it src/sonic-utilities ``` * 69d3a50b - (HEAD -> master, origin/master, origin/HEAD) Add Arista-7060X6-32PE SKU to gcu_field_operation_validators.conf.json (#4994) (31 hours ago) [Justin Wong] * 82606ac5 - Speed up show ip route on large multi-ASIC RIBs (#4771) (2 days ago) [saksarav-nokia] * df814712 - uboot bootloader get_installed_images fix for Issue-4968 (#4972) (3 days ago) [Senthilnathan Veerappan] * f113917d - Add common cpoutil command (#4864) (3 days ago) [Arthur_Micas] * fa11264d - [portstat]: Count ingress buffer drops in Overruns Received (#4995) (3 days ago) [Ariz Zubair (Microsoft)] * db6796ef - 7060CX device state migration via upgrade (#4834) (3 days ago) [Justin Wong] ``` #### How I did it #### How to verify it #### Description for the changelog
…tically (#30470) #### Why I did it src/sonic-sairedis ``` * 53a883ca - (HEAD -> master, origin/master, origin/HEAD) [syncd] Read the switch MAC defaults on a VOQ switch too (Azure#2110) (5 hours ago) [Brad House - Nexthop] * aeb0c72b - [syncd] Match next hops with equal attributes by their next hop groups (Azure#2102) (5 hours ago) [Brad House - Nexthop] ``` #### How I did it #### How to verify it #### Description for the changelog
mssonicbld
force-pushed
the
sonicbld/master-merge
branch
from
November 1, 2026 03:04
5f39057 to
3de2998
Compare
Collaborator
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
…e (#29266)
Add a MACsec codec module (ptf_macsec) and PTF dataplane transform
hooks so PTF tests can send and receive MACsec-protected frames
natively on testbeds where MACsec is always on. SA parameters are
read from /root/macsec_info.pickle when present.
The codec is opt-in: it activates only when the marker file
/root/macsec_native_codec exists, so a PTF image carrying it behaves
exactly as before for test frameworks that still handle MACsec in
their own test-side code. Without the marker or the pickle the hooks
are inert.
The codec rewrites the outer source MAC to the peer's MAC before
encrypting (opt-out via a marker file) to match Broadcom's SCI
derivation from {outer_src_MAC, port_id}.
Signed-off-by: Devesh Pathak <250206677+devesh-nexthop@users.noreply.github.com>
…utomatically (#30478) #### Why I did it src/sonic-host-services ``` * 37783d9 - (HEAD -> master, origin/master, origin/HEAD) switch_platform_init: use native local database connectors (Azure#472) (5 hours ago) [Ashutosh Agrawal] ``` #### How I did it #### How to verify it #### Description for the changelog
* [cli][dhcp_server] Phase 2: match and binding table CLI Add the operator-facing commands for the two new tables introduced by the Phase 1 data model: * config dhcp_server ipv4 match add|update|del - manage named match conditions. Deletion is refused while a binding still references the match; update re-validates every affected VLAN before committing. * config dhcp_server ipv4 binding add|update|del - manage bindings. --match takes a comma separated list (AND logic) and exactly one of an IP list or --range must be supplied. update replaces the match list and/or switches the pool source between ips and ranges. * show dhcp_server ipv4 match|binding. Validation mirrors the config generator: a circuit_id must resolve to exactly one port or PortChannel that is a member of the VLAN - a port alias, an aliasless port name, or a PortChannel name, which is the set of values dhcp_relay can actually stamp into Option 82 sub-option 1 - pools must fall inside a VLAN subnet, and two bindings on one VLAN may not have the same number of conditions while still being able to match the same client. Names are additionally checked against the separators Config DB reserves. A match name may contain neither '|', the key separator, nor ',', the leaf-list separator used to join a binding's matches into a single 'matches@' string - a name carrying either cannot be read back as the reference that was written. A binding name excludes only '|', since it is a key component but never a leaf-list member. Match values stay unrestricted, being neither. Both checks are applied wherever the value can first become wrong, not only where it is first written. A circuit_id is resolved when the match itself is created or updated, so a match naming a port that does not exist is refused immediately rather than surviving until some later binding happens to reference it. Likewise, `range update` re-validates every binding that consumes the range against the proposed endpoints, because a range can be moved out of its VLAN long after the binding that uses it was accepted. That matters more than it looks: dhcp_cfggen aborts generation of the entire Kea configuration when a pool falls outside its VLAN subnet, so an unchecked range update takes DHCP down for every interface on the box, not just the one that was edited. Range revalidation deliberately covers binding consumers only. DHCP_SERVER_IPV4_PORT entries may also reference a range and are validated nowhere today; guarding them would change behaviour that predates this series and belongs in its own change. The MATCH mode itself is deliberately not selectable yet: `--mode` still accepts only PORT. Both tables are inert until an interface runs in MATCH mode, so this commit adds no behaviour change on its own. Enabling the mode is done in the commit that also teaches dhcpservd to compile these tables, so that no release exposes a mode the runtime cannot serve. Refs: sonic-net/SONiC#2535 Signed-off-by: Nishant Sharma <nshntsharma86@gmail.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * [dhcp]: Align match and binding CLI key validation with YANG Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Nishant Sharma <nshntsharma86@gmail.com> * [dhcp_server]: Address config and show CLI review comments Signed-off-by: Nishant Sharma <nshntsharma86@gmail.com> * [dhcp_server]: Add interface-scoped lease clearing Signed-off-by: Nishant Sharma <nshntsharma86@gmail.com> * Addressing review comments by copilot ai Signed-off-by: Nishant Sharma <nshntsharma86@gmail.com> --------- Signed-off-by: Nishant Sharma <nshntsharma86@gmail.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…D automatically (#30530) #### Why I did it src/sonic-platform-daemons ``` * 312cfc1 - (HEAD -> master, origin/master, origin/HEAD) [pcied] Honour PCIE_DETACH_INFO on platforms that are not smartswitches (Azure#899) (28 hours ago) [gordon-nexthop] * 8a7fc06 - Add Major system leak support - sonicBMC (Azure#896) (3 days ago) [judyjoseph] ``` #### How I did it #### How to verify it #### Description for the changelog
…certificates.sh (#30363) What: Updates the B27 certificate script to install separate server certificate, key and CA files on the BMC host for Redfish credential staging. Why: Direct container copies no longer persist under the current staging mechanism, and forcing TLSStrict blocks resources that should remain accessible without client certificates. How: Installs credentials under /etc/sonic/credentials/redfish with the server key mode set to 0600. Adds optional --push-config to set REDFISH|certs and restart an enabled Redfish service without saving unrelated configuration, validates explicit or certificate-derived client CNs, and removes generation of combined PEM/TLSStrict files and temporary signing artifacts. Testing: All 18 reported checks passed, including required Azure.sonic-buildimage, EasyCLA and Semgrep. The author reports B27 validation on 202608.Nexthop.269636-81d6686e6 covering installation with and without --push-config, live trusted-CN changes and certificate rotation under an existing CA. Reviewer isolated controls confirmed supported CNs round-trip and invalid values cause no SSH/SCP/DB activity; no hardware action was performed for that review. Signed-off-by: Shreyansh Jain <shreyansh@nexthop.ai>
mssonicbld
force-pushed
the
sonicbld/master-merge
branch
from
November 8, 2026 03:03
59408fd to
3646e73
Compare
Collaborator
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
…437) minigraph.py writes CONSOLE_SWITCH|console_mgmt for every device, "yes" for MgmtTsToR and "no" for everything else. load_minigraph applies init_cfg.json first and the minigraph on top of it, so a BMC deployed from a minigraph always ends up with the console feature disabled, overriding the default its platform declares in init_cfg.json. Leave CONSOLE_SWITCH out for NetworkBmc, so the platform default applies. Platforms that declare nothing still come up with the YANG default (disabled). Signed-off-by: Yakiv Huryk <yhuryk@nvidia.com>
[master] Upgrade SONiC package Versions
…matically (#30601) #### Why I did it src/sonic-py-swsssdk ``` * c8f1efe - (HEAD -> master, origin/master, origin/HEAD) [ci] switch to sonic-ubuntu-1c agent pool (Azure#165) (3 hours ago) [yijingyan2] ``` #### How I did it #### How to verify it #### Description for the changelog
mssonicbld
force-pushed
the
sonicbld/master-merge
branch
from
November 9, 2026 03:04
3646e73 to
255f2d6
Compare
Collaborator
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
[master] Upgrade docker-ptf package versions
Signed-off-by: Ashutosh Agrawal <ashu@cisco.com>
…UNNEL_LIST (#29569) What: Adds the optional boolean install_on_kernel field to the sonic-vnet YANG model, with documentation, sample configuration and validation fixtures. Why: Configurations containing this field otherwise fail YANG validation, disrupting GCU and config-reload flows for tunnel routes requesting kernel installation. How: Adds the leaf without a default and introduces module revision 2026-09-15. Extends the complete-route fixture with true, adds positive false and negative non-boolean cases, and retains coverage for configurations omitting the field; route-programming implementation is outside this schema change. Testing: All required checks passed, including Azure.sonic-buildimage, EasyCLA and Semgrep, with 33 successful checks and two neutral checks overall. Validation fixtures cover true, false, invalid and omitted values. The PR supplies model-test and package-build commands but no separate execution results or tested image version. Signed-off-by: Mia Tao <miatao@microsoft.com>
…ly (#30599) #### Why I did it src/dhcprelay ``` * b6dbf6c - (HEAD -> master, origin/master, origin/HEAD) [ci] switch to sonic-ubuntu-1c agent pool (Azure#166) (27 hours ago) [yijingyan2] ``` #### How I did it #### How to verify it #### Description for the changelog
…omatically (#30593) #### Why I did it src/sonic-swss-common ``` * 1c90cc4 - (HEAD -> master, origin/master, origin/HEAD) use 1ES agent to provide more disk space (Azure#1143) (3 hours ago) [yijingyan2] * ce32ac8 - [ci]: Use shared downstream CI templates (Azure#1263) (27 hours ago) [Lawrence Lee] * 5dadfe9 - redis: add opt-in DBConnector authentication (Azure#1270) (32 hours ago) [Ashutosh Agrawal] ``` #### How I did it #### How to verify it #### Description for the changelog
Why I did it Fixes #30357 do_config_migration copies only the files in copy_list from the previous image's configuration backup. otel_config.yml is not in that list, so after an image upgrade (cold or warm reboot into the new image) the otel collector starts with the new image's default configuration, which sends everything to the nop exporter. HFT and countersyncd recover and keep exporting, but the collector silently drops all data and the user's backend stops receiving counters. Work item tracking Microsoft ADO (number only): How I did it Added otel_config.yml to copy_list in do_config_migration. If the previous image has no such file, copy_config_files_and_directories only logs that it is missing and the new image's default is kept.
mssonicbld
force-pushed
the
sonicbld/master-merge
branch
from
November 10, 2026 03:04
255f2d6 to
9e8cc12
Compare
Collaborator
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
…utomatically (#30600) #### Why I did it src/sonic-host-services ``` * 539295c - (HEAD -> master, origin/master, origin/HEAD) [console-monitor] don't report the PTY bridge as failed on a normal stop (Azure#478) (3 days ago) [Yakiv Huryk] ``` #### How I did it #### How to verify it #### Description for the changelog
…cally (#30674) #### Why I did it platform/vpp ``` * 87e0c74 - (HEAD -> master, origin/master, origin/HEAD) vpp: Add unit tests for everflow features (Azure#333) (14 hours ago) [Taran D] ``` #### How I did it #### How to verify it #### Description for the changelog
What: Moves CONSOLE_SWITCH out of FEATURE into a top-level table in the Arista Goldfinch platform init_cfg.json. Why: The nesting introduced by #30386 prevented the default CONSOLE_SWITCH|console_mgmt entry from being populated, leaving switch-host console access unavailable until manually enabled. How: Corrects the JSON structure while retaining console_mgmt.enabled as "yes" and leaving the other feature defaults unchanged. Testing: All 33 reported checks passed, including required Azure.sonic-buildimage, EasyCLA and Semgrep. The author reports consutil connect 0 working after the fix on 202608. The original issue was reproduced on a Goldfinch DUT with a November 5, 2026 msft-202608 Arista nightly; no separate post-fix image version or master hardware results are supplied. Signed-off-by: nori meher <nori.meher@arista.com>
* [CodeQL] Restrict Centec SFP cache permissions Create the shared SFP cache directory with mode 0755 and correct existing world-writable directories before writing EEPROM cache files. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Lun Yue <17232861+lunyue-ms@users.noreply.github.com> * [CodeQL] Justify Centec cache directory mode Semgrep treats 0755 as an insecure file mode, but directories require execute bits for traversal and this mode keeps write access restricted to the owner. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Lun Yue <17232861+lunyue-ms@users.noreply.github.com> * [device/centec]: Reject symlinked SFP cache directories Open the cache with O_DIRECTORY and O_NOFOLLOW, then set permissions on the verified directory descriptor and always close it. Keep the directory-mode Semgrep suppression in both platform copies. Add Linux regression coverage for creation, legacy permissions, invalid paths, symlink substitution, and descriptor cleanup on failure. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Lun Yue <17232861+lunyue-ms@users.noreply.github.com> * [device/centec]: Remove standalone SFP cache regression tests Keep the PR focused on the two platform plugin fixes as requested. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Lun Yue <17232861+lunyue-ms@users.noreply.github.com> * [device/centec]: Replace EEPROM cache entries atomically Write EEPROM data to a securely created temporary file in the cache directory, close it, and atomically replace the old entry instead of following pre-existing symlinks or modifying hard-linked files. Publish cache files with mode 0644 and clean up temporary files on failure. Remove dangling cache symlinks for absent transceivers as well. Keep both E582 platform copies in sync. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Lun Yue <17232861+lunyue-ms@users.noreply.github.com> * [device/centec]: Preserve Python 2 cache initialization support Replace the Python-3-only exist_ok option with an EEXIST-compatible mkdir pattern; O_DIRECTORY and O_NOFOLLOW still validate the existing path before fchmod. Use POSIX rename for same-directory atomic cache publication on both Python versions, and report OSError as well as IOError through the existing initialization error handler. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Lun Yue <17232861+lunyue-ms@users.noreply.github.com> --------- Signed-off-by: Lun Yue <17232861+lunyue-ms@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…alidate-then-install (#30461) What: Hardens Redfish credential staging by restricting private-key file permissions, validating certificate/key pairs and fingerprinting the copied credentials before publication. Why: The combined server PEM could be world-readable, invalid staged credentials could permit bmcweb's self-signed fallback, and source rotation between validation, copying and stamping could install unchecked bytes or skip a needed update. How: Creates the temporary server PEM under umask 077, checks certificate validity dates, key consistency and matching public keys, and validates copied PEM/CA files before renaming them into place. Computes the applied stamp from those copied bytes and updates readiness diagnostics; PEM, CA and hash-link publication remain separate operations rather than one atomic transaction. Testing: All 32 reported checks passed, including required Azure.sonic-buildimage, EasyCLA and Semgrep. Reviewer validation used shell syntax checks and 33 isolated actual-source controls with cryptographic, filesystem and service effects mocked. Native certificate provisioning, DUT qualification and target-branch testing are not established; automated regression and partial-install/concurrency coverage remain follow-ups. Signed-off-by: Shreyansh Jain <shreyansh@nexthop.ai>
What: Upgrades the Broadcom XGS SAI package from 15.2.1.0.0.0.47.1 to 15.2.1.0.0.0.50.1. Why: Incorporates upstream scheduler-weight, TH2 SR4 interface-type and link-layer retry configuration fixes; tracked by ADO 40388973. How: Updates LIBSAIBCM_XGS_VERSION in platform/broadcom/sai-xgs.mk while retaining SAI_15.2.1_GA. The release description reports synchronization through upstream 50.0, an unchanged SDK and preservation of the Microsoft AN/LT behavior. Testing: All 18 reported checks passed, including required Azure.sonic-buildimage, EasyCLA and Semgrep. The author reports full 12-script TH2 qualification on SONiC.master-30440.1261942-86bf12f85: T0 had 253 passed and 942 conditionally skipped; T1 had 430 passed and 765 conditionally skipped, with zero final failures/errors and no waivers. One T1 everflow module passed on retry; same-bed ordered controls passed on both candidate and baseline images. Package provenance and symbol checks passed; hardware coverage was XGS TH2 only, with no Condor3 qualification. Signed-off-by: Aaron Bernardino <aaronber@microsoft.com>
mssonicbld
force-pushed
the
sonicbld/master-merge
branch
from
November 11, 2026 03:03
9e8cc12 to
bb4bb2a
Compare
Collaborator
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.