v16.2.0

os configure, config generate: Add '--secureBoot' option to opt-in secure boot

.github/actions/publish/action.yml

@@ -0,0 +1,133 @@
+---
+name: package and draft GitHub release
+# https://github.com/product-os/flowzone/tree/master/.github/actions
+inputs:
+  json:
+    description: "JSON stringified object containing all the inputs from the calling workflow"
+    required: true
+  secrets:
+    description: "JSON stringified object containing all the secrets from the calling workflow"
+    required: true
+  variables:
+    description: "JSON stringified object containing all the variables from the calling workflow"
+    required: true
+
+  # --- custom environment
+  XCODE_APP_LOADER_EMAIL:
+    type: string
+    default: "accounts+apple@balena.io"
+  NODE_VERSION:
+    type: string
+    default: '16.x'
+  VERBOSE:
+    type: string
+    default: "true"
+
+runs:
+  # https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
+  using: "composite"
+  steps:
+    - name: Download custom source artifact
+      uses: actions/download-artifact@v3
+      with:
+        name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}-${{ runner.arch }}
+        path: ${{ runner.temp }}
+
+    - name: Extract custom source artifact
+      shell: pwsh
+      working-directory: .
+      run: tar -xf ${{ runner.temp }}/custom.tgz
+
+    - name: Setup Node.js
+      uses: actions/setup-node@v3
+      with:
+        node-version: ${{ inputs.NODE_VERSION }}
+        cache: npm
+
+    - name: Install additional tools
+      if: runner.os == 'Windows'
+      shell: bash
+      run: |
+        choco install yq
+
+    - name: Install additional tools
+      if: runner.os == 'macOS'
+      shell: bash
+      run: |
+        brew install coreutils
+
+    # https://www.electron.build/code-signing.html
+    # https://github.com/Apple-Actions/import-codesign-certs
+    - name: Import Apple code signing certificate
+      if: runner.os == 'macOS'
+      uses: apple-actions/import-codesign-certs@v1
+      with:
+        p12-file-base64: ${{ fromJSON(inputs.secrets).APPLE_SIGNING }}
+        p12-password: ${{ fromJSON(inputs.secrets).APPLE_SIGNING_PASSWORD }}
+
+    - name: Import Windows code signing certificate
+      if: runner.os == 'Windows'
+      shell: powershell
+      run: |
+        Set-Content -Path ${{ runner.temp }}/certificate.base64 -Value $env:WINDOWS_CERTIFICATE
+        certutil -decode ${{ runner.temp }}/certificate.base64 ${{ runner.temp }}/certificate.pfx
+        Remove-Item -path ${{ runner.temp }} -include certificate.base64
+
+        Import-PfxCertificate `
+          -FilePath ${{ runner.temp }}/certificate.pfx `
+          -CertStoreLocation Cert:\CurrentUser\My `
+          -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -Force -AsPlainText)
+
+      env:
+        WINDOWS_CERTIFICATE: ${{ fromJSON(inputs.secrets).WINDOWS_SIGNING }}
+        WINDOWS_CERTIFICATE_PASSWORD: ${{ fromJSON(inputs.secrets).WINDOWS_SIGNING_PASSWORD }}
+
+    # https://github.com/product-os/scripts/tree/master/shared
+    # https://github.com/product-os/balena-concourse/blob/master/pipelines/github-events/template.yml
+    - name: Package release
+      shell: bash
+      run: |
+        set -ea
+
+        [[ '${{ inputs.VERBOSE }}' =~ on|On|Yes|yes|true|True ]] && set -x
+
+        runner_os="$(echo "${RUNNER_OS}" | tr '[:upper:]' '[:lower:]')"
+        runner_arch="$(echo "${RUNNER_ARCH}" | tr '[:upper:]' '[:lower:]')"
+
+        if [[ $runner_os =~ darwin|macos|osx ]]; then
+            CSC_KEY_PASSWORD=${{ fromJSON(inputs.secrets).APPLE_SIGNING_PASSWORD }}
+            CSC_KEYCHAIN=signing_temp
+            CSC_LINK=${{ fromJSON(inputs.secrets).APPLE_SIGNING }}
+
+        elif [[ $runner_os =~ windows|win ]]; then
+            CSC_KEY_PASSWORD=${{ fromJSON(inputs.secrets).WINDOWS_SIGNING_PASSWORD }}
+            CSC_LINK='${{ runner.temp }}\certificate.pfx'
+
+            # patches/all/oclif.patch
+            MSYSSHELLPATH="$(which bash)"
+            MSYSTEM=MSYS
+
+            # (signtool.exe) https://github.com/actions/runner-images/blob/main/images/win/Windows2019-Readme.md#installed-windows-sdks
+            PATH="/c/Program Files (x86)/Windows Kits/10/bin/${runner_arch}:${PATH}"
+        fi
+
+        npm run package
+
+        find dist -type f -maxdepth 1
+
+      env:
+        # https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/#improvements-for-public-repository-forks
+        # https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks#about-workflow-runs-from-public-forks
+        CSC_FOR_PULL_REQUEST: true
+        # https://sectigo.com/resource-library/time-stamping-server
+        TIMESTAMP_SERVER: http://timestamp.sectigo.com
+        # Apple notarization (automation/build-bin.ts)
+        XCODE_APP_LOADER_EMAIL: ${{ inputs.XCODE_APP_LOADER_EMAIL }}
+        XCODE_APP_LOADER_PASSWORD: ${{ fromJSON(inputs.secrets).XCODE_APP_LOADER_PASSWORD }}
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v3
+      with:
+        name: gh-release-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}
+        path: dist
+        retention-days: 1

.github/actions/test/action.yml

@@ -0,0 +1,59 @@
+---
+name: test release
+# https://github.com/product-os/flowzone/tree/master/.github/actions
+inputs:
+  json:
+    description: "JSON stringified object containing all the inputs from the calling workflow"
+    required: true
+  secrets:
+    description: "JSON stringified object containing all the secrets from the calling workflow"
+    required: true
+  variables:
+    description: "JSON stringified object containing all the variables from the calling workflow"
+    required: true
+
+  # --- custom environment
+  NODE_VERSION:
+    type: string
+    default: '16.x'
+  VERBOSE:
+    type: string
+    default: "true"
+
+runs:
+  # https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
+  using: "composite"
+  steps:
+    # https://github.com/actions/setup-node#caching-global-packages-data
+    - name: Setup Node.js
+      uses: actions/setup-node@v3
+      with:
+        node-version: ${{ inputs.NODE_VERSION }}
+        cache: npm
+
+    - name: Test release
+      shell: bash
+      run: |
+        set -ea
+
+        [[ '${{ inputs.VERBOSE }}' =~ on|On|Yes|yes|true|True ]] && set -x
+
+        if [[ -e package-lock.json ]] || [[ -e npm-shrinkwrap.json ]]; then
+            npm ci
+        else
+            npm i
+        fi
+
+        npm run build
+        npm run test
+
+    - name: Compress custom source
+      shell: pwsh
+      run: tar -acf ${{ runner.temp }}/custom.tgz .
+
+    - name: Upload custom artifact
+      uses: actions/upload-artifact@v3
+      with:
+        name: custom-${{ github.event.pull_request.head.sha || github.event.head_commit.id }}-${{ runner.os }}-${{ runner.arch }}
+        path: ${{ runner.temp }}/custom.tgz
+        retention-days: 1

.github/workflows/flowzone.yml

@@ -0,0 +1,29 @@
+name: Flowzone
+
+on:
+  pull_request:
+    types: [opened, synchronize, closed]
+    branches: [main, master]
+  pull_request_target:
+    types: [opened, synchronize, closed]
+    branches: [main, master]
+
+jobs:
+  flowzone:
+    name: Flowzone
+    uses: product-os/flowzone/.github/workflows/flowzone.yml@v4.7.1
+    # prevent duplicate workflow executions for pull_request and pull_request_target
+    if: |
+      (
+        github.event.pull_request.head.repo.full_name == github.repository &&
+        github.event_name == 'pull_request'
+      ) || (
+        github.event.pull_request.head.repo.full_name != github.repository &&
+        github.event_name == 'pull_request_target'
+      )
+    secrets: inherit
+    with:
+      custom_runs_on: '[["self-hosted","Linux","distro:focal","X64"],["self-hosted","Linux","distro:focal","ARM64"],["macos-12"],["windows-2019"]]'
+      repo_config: true
+      repo_description: "The official balena CLI tool."
+      github_prerelease: true

.resinci.yml

@@ -1,20 +0,0 @@
----
-npm:
-  platforms:
-    - name: linux
-      os: ubuntu
-      architecture: x86_64
-      node_versions:
-        - "12"
-        - "14"
-    ##
-    ## Temporarily skip Alpine tests until the following issues are resolved:
-    ##   * https://github.com/concourse/concourse/issues/7905
-    ##   * https://github.com/product-os/balena-concourse/issues/631
-    ##
-    # - name: linux
-    #   os: alpine
-    #   architecture: x86_64
-    #   node_versions:
-    #     - "12"
-    #     - "14"

CHANGELOG.md

@@ -4,6 +4,896 @@ All notable changes to this project will be documented in this file
 automatically by Versionist. DO NOT EDIT THIS FILE MANUALLY!
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## 16.2.0 - 2023-05-19
+
+* secureboot: Retrieve the OS release & contract in one request [Thodoris Greasidis]
+* os configure, config generate: Add '--secureBoot' option to opt-in secure boot [Alex Gonzalez]
+
+<details>
+<summary> package.json: Update balena-sdk to 16.44.2 [Alex Gonzalez] </summary>
+
+> ### balena-sdk-16.44.2 - 2023-05-16
+> 
+> * Update flowzone's macos runner to v12 [Thodoris Greasidis]
+> * Add device type yocto properties to typings [Otávio Jacobi]
+> * Optimize getDeviceUrl request in one query [Otávio Jacobi]
+> 
+> ### balena-sdk-16.44.1 - 2023-05-09
+> 
+> * Fix device.getAllByOrganization parameter docs [Otávio Jacobi]
+> 
+> ### balena-sdk-16.44.0 - 2023-04-27
+> 
+> * Add device.getAllByOrganization() [Thodoris Greasidis]
+> * Deprecate Device's is_managed_by__device & manages__device properties [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.43.0 - 2023-04-19
+> 
+> * Add test case DeviceHistory expandable resources [fisehara]
+> * Make DeviceHistory referenced resources expandable [fisehara]
+> 
+> ### balena-sdk-16.42.0 - 2023-04-18
+> 
+> * Add support for pine queries on Concept Type properties [Thodoris Greasidis]
+> * Properly type Actor properties on resources [fisehara]
+> 
+> ### balena-sdk-16.41.0 - 2023-04-07
+> 
+> * Release model: Add support for getting/patching releases by `application` & `rawVersion` pairs [myarmolinsky]
+> 
+
+</details>
+
+* flowzone: update custom runs to use macos-12 [Alex Gonzalez]
+
+## 16.1.0 - 2023-05-16
+
+* build linux/arm packages [balenaCI]
+
+## 16.0.0 - 2023-05-16
+
+* support: Change the printed support expiry date in ISO 8601 UTC format [Thodoris Greasidis]
+* logs: Change the timestamp format to ISO 8601 UTC [Thodoris Greasidis]
+* Pin flowzone to v4.7.1 [Felipe Lalanne]
+* Update etcher-sdk to v8.5.3 [Felipe Lalanne]
+* Update vercel/pkg to v5.8.1 [Felipe Lalanne]
+* Update to Node 16 [Felipe Lalanne]
+
+## 15.2.3 - 2023-05-03
+
+* Use valid release uuid for local releases [Felipe Lalanne]
+
+## 15.2.2 - 2023-04-28
+
+* Remove nvmrc [Felipe Lalanne]
+
+## 15.2.1 - 2023-04-28
+
+* Fix tslib going out of sync causing HUP to fail [Thodoris Greasidis]
+
+## 15.2.0 - 2023-04-05
+
+
+<details>
+<summary> Add support for device restarts in open-balena [Thodoris Greasidis] </summary>
+
+> ### balena-sdk-16.40.0 - 2023-04-05
+> 
+> * device.reboot: Fix the typings requiring a second argument [Thodoris Greasidis]
+> * device.restartApplication: Use the supervisor endpoint to issue restarts [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.39.1 - 2023-04-04
+> 
+> * patch: Split instruction strings on linebreak [Vipul Gupta (@vipulgupta2048)]
+> 
+> ### balena-sdk-16.39.0 - Invalid date
+> 
+> * Add `device history` model [fisehara]
+> 
+> ### balena-sdk-16.38.2 - 2023-03-28
+> 
+> * Fix credit-bundle jsdocs [Josh Bowling]
+> 
+> ### balena-sdk-16.38.1 - 2023-03-27
+> 
+> * Deprecate the device-type.json's instructions field [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.38.0 - 2023-03-21
+> 
+> * Add aliases for the DT contrast slugs used in getInstructions [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.37.0 - 2023-03-21
+> 
+> * device-type/getInstructions: Overload to accept the device type contract [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.36.6 - 2023-03-20
+> 
+> * Update TypeScript to 5.0.2 [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.36.5 - 2023-03-16
+> 
+> * patch: Improve jetsonFlash provisioning partial [Vipul Gupta (@vipulgupta2048)]
+> 
+> ### balena-sdk-16.36.4 - 2023-03-15
+> 
+> * Avoid running write operation tests in parallel to support retries [Thodoris Greasidis]
+> * Retry failing tests twice [Thodoris Greasidis]
+> * Fix tests per removal of `microservices-starter` application type [myarmolinsky]
+> 
+> ### balena-sdk-16.36.3 - 2023-02-28
+> 
+> * models/device-type: Add test for Radxa Zero instructions [Alexandru Costache]
+> * lib/models: Add radxaFlash protocol for Radxa boards [Alexandru Costache]
+> 
+> ### balena-sdk-16.36.2 - 2023-02-24
+> 
+> * tests: Stop using flowzone internal env vars to for skipping npm test [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.36.1 - 2023-02-20
+> 
+> * Add plan validity date fields [Josh Bowling]
+> 
+> ### balena-sdk-16.36.0 - 2023-02-16
+> 
+> * Add contract partial based instruction generation [Micah Halter]
+> 
+> ### balena-sdk-16.35.0 - 2023-02-10
+> 
+> * Add `CreditBundle` model [myarmolinsky]
+> 
+> ### balena-sdk-16.34.0 - 2023-02-09
+> 
+> * Add configVarInvalidRegex to Config Var typing [Felipe Lalanne]
+> 
+> ### balena-sdk-16.33.0 - 2023-02-09
+> 
+> * CurrentServiceWithCommit: Add release `raw_version` to type [myarmolinsky]
+> 
+> ### balena-sdk-16.32.3 - 2023-02-07
+> 
+> * Optimize the device.get method [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.32.2 - 2023-02-02
+> 
+> * Improve pine typings for public resources without id fields [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.32.1 - 2023-01-16
+> 
+> * Drop no longer used .travis.yml & .hound.yml [Thodoris Greasidis]
+> * Rerun prettier [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.32.0 - 2023-01-05
+> 
+> * typings: Add the device.is_frozen field [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.31.2 - 2022-12-20
+> 
+> * application.create: Deprecate the `parent` option [Thodoris Greasidis]
+> * Deprecate the device.getAllByParentDevice() method [Thodoris Greasidis]
+> * Simplify the device.move() checks [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.31.1 - 2022-12-17
+> 
+> * Replace appveyor with flowzone [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.31.0 - 2022-12-16
+> 
+> * Add `updateAccountInfo` method to billing model for updating billing account info [myarmolinsky]
+> 
+> ### balena-sdk-16.30.2 - 2022-12-13
+> 
+> * Flowzone: Allow external contributions [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.30.1 - 2022-12-07
+> 
+> * patch: bump catch-uncommitted from 1.6.2 to 2.0.0 [dependabot[bot]]
+> 
+> ### balena-sdk-16.30.0 - 2022-11-24
+> 
+> * Add utils and export mergePineOptions `balena.utils.mergePineOptions()` [JSReds]
+> 
+> ### balena-sdk-16.29.3 - 2022-11-24
+> 
+> * device.getWithServiceDetails: Stop auto-expanding the gateway_downloads [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.29.2 - 2022-11-16
+> 
+> * Update TypeScript to 4.9.3 [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.29.1 - 2022-11-12
+> 
+> * Fix release end_timestamp type [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.29.0 - 2022-11-12
+> 
+> 
+> <details>
+> <summary> Support filtered $count operations inside $filter & $orderby [Thodoris Greasidis] </summary>
+> 
+>> #### pinejs-client-js-6.12.0 - 2022-11-10
+>> 
+>> * Deprecate the 'a/count' notation in $orderby [Thodoris Greasidis]
+>> * Deprecate the $count: { $op: number } notation [Thodoris Greasidis]
+>> * Add support for `$filter: { $op: [{ $count: {} }, number] }` notation [Thodoris Greasidis]
+>> 
+>> #### pinejs-client-js-6.11.0 - 2022-11-09
+>> 
+>> * Deprecate non-$filter props inside `$expand: { a: { $count: {...}}}` [Thodoris Greasidis]
+>> * Add support for `$orderby: { a: { $count: ... }, $dir: 'asc' }` notation [Thodoris Greasidis]
+>> 
+>> #### pinejs-client-js-6.10.7 - 2022-11-07
+>> 
+>> * Refactor the deprecation message definitions [Thodoris Greasidis]
+>> 
+>> #### pinejs-client-js-6.10.6 - 2022-11-01
+>> 
+>> * tests: Support `.only` & `.skip` in the higher level test functions [Thodoris Greasidis]
+>> 
+>> #### pinejs-client-js-6.10.5 - 2022-10-14
+>> 
+>> * Flowzone: Use inherited secrets [Pagan Gazzard]
+>> 
+>> #### pinejs-client-js-6.10.4 - 2022-09-26
+>> 
+>> * Specify node 10 as the minimum supported node engine in the package.json [Thodoris Greasidis]
+>> * Replace balenaCI with flowzone [Thodoris Greasidis]
+>> 
+>> #### pinejs-client-js-6.10.3 - 2022-09-15
+>> 
+>> * Fix $count typings to only allow $filter under it [Thodoris Greasidis]
+>> 
+>> #### pinejs-client-js-6.10.2 - 2022-04-08
+>> 
+>> * Update dependencies [Pagan Gazzard]
+>> * Remove circleci [Pagan Gazzard]
+>> 
+>> #### pinejs-client-js-6.10.1 - 2022-02-08
+>> 
+>> * Do not await the _request() result to allow enhanced promises downstream [Thodoris Greasidis]
+>> 
+>> #### pinejs-client-js-6.10.0 - 2022-01-24
+>> 
+>> * Add optional retry logic to client [Paul Jonathan Zoulin]
+>> 
+> 
+> </details>
+> 
+> 
+> ### balena-sdk-16.28.4 - 2022-11-04
+> 
+> * Use deep imports for date-fns to improve tree-shaking [Thodoris Greasidis]
+> * Enable esModuleInterop build option [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.28.3 - 2022-11-03
+> 
+> * Update balena-errors to v4.7.3 [JSReds]
+> 
+
+</details>
+
+## 15.1.3 - 2023-04-05
+
+
+<details>
+<summary> devices supported: Fix showing types without a valid & finalized release [Thodoris Greasidis] </summary>
+
+> ### balena-sdk-16.28.2 - 2022-10-27
+> 
+> * Update tests to run on node 18 [Thodoris Greasidis]
+> * deviceType.getAllSupported: Require a valid & final release to exist [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.28.1 - 2022-10-14
+> 
+> * flowzone: Run the node tests using the latest LTS version [Thodoris Greasidis]
+> 
+
+</details>
+
+## 15.1.2 - 2023-03-27
+
+* Improve type checking by using the satisfies operator [Thodoris Greasidis]
+
+## 15.1.1 - 2023-03-17
+
+* Update TypeScript to 5.0.2 [Thodoris Greasidis]
+
+## 15.1.0 - 2023-03-14
+
+
+<details>
+<summary> Update balena-compose to v2.2.1 [Kyle Harding] </summary>
+
+> ### balena-compose-2.2.1 - 2023-03-14
+> 
+> * Ignore references to build stages when evaluating manifests [Kyle Harding]
+> 
+> ### balena-compose-2.2.0 - 2023-03-13
+> 
+> * OCI Image Index should allow platform opts [Kyle Harding]
+> 
+> ### balena-compose-2.1.4 - 2023-03-13
+> 
+> * Write to debug log when using platform option [Kyle Harding]
+> 
+> ### balena-compose-2.1.3 - 2023-03-01
+> 
+> * Fixup tests to use recent debian:bullseye-slim images [Kyle Harding]
+> 
+> ### balena-compose-2.1.2 - 2022-10-17
+> 
+> * test/multibuild: Use 127.0.0.1 for the extra_hosts test [Ken Bannister]
+> * Output error text to aid test debugging [Ken Bannister]
+> * Replace balenaCI & circleCI with flowzone [Thodoris Greasidis]
+> * Pin dockerode to v3.3.3 to avoid regression [Ken Bannister]
+> * Prettify fixup [Ken Bannister]
+> * Fix underspecified generics in release/models [Ken Bannister]
+> 
+
+</details>
+
+## 15.0.6 - 2023-03-13
+
+* Devices: explicitly fetches only used fields [Otávio Jacobi]
+
+## 15.0.5 - 2023-03-10
+
+* Fix application isLegacy check for rename and deploy [JSReds]
+
+## 15.0.4 - 2023-02-21
+
+* patch: Clarify update rate of update notifier info [Heath Raftery]
+
+## 15.0.3 - 2023-01-18
+
+* Use https for the npm deprecation check, avoiding a redirect [Pagan Gazzard]
+
+## 15.0.2 - 2023-01-14
+
+* Fix push --nolive doc typo [Josh Bowling]
+
+## 15.0.1 - 2023-01-10
+
+* Process livepush build logs inline [Felipe Lalanne]
+
+## 15.0.0 - 2023-01-02
+
+* preload: Drops ability to preload Intel Edison (EOL 2017) Upgrade balena-preload from 12.2.0 to 13.0.0 [JOASSART Edwin]
+
+## 14.5.18 - 2022-12-29
+
+* Update flowzone tests to use npm ci [Thodoris Greasidis]
+
+## 14.5.17 - 2022-12-28
+
+* Stop using the deprecated balena-sync module [Thodoris Greasidis]
+
+## 14.5.16 - 2022-12-28
+
+* Update the npm-shrinkwrap.json dependencies to match the package.json [Thodoris Greasidis]
+
+## 14.5.15 - 2022-12-12
+
+* patch: update balena-preload to 12.2.0 [Edwin Joassart]
+
+## 14.5.14 - 2022-12-11
+
+* Bump multicast-dns to rebased commit (again) [pipex]
+
+## 14.5.13 - 2022-12-08
+
+* Build on macos-11 for library compatibility reasons [Page-]
+* Build on ubuntu-20.04 for library compatibility reasons [Page-]
+
+## 14.5.12 - 2022-11-21
+
+* Move GH publishing to FZ core [ab77]
+
+## 14.5.11 - 2022-11-17
+
+* Adding .nvmrc so we can use nvm use instead of hunting for version [zoobot]
+
+## 14.5.10 - 2022-11-11
+
+* Fix surfacing incompatible device type errors as not recognized [Thodoris Greasidis]
+
+## 14.5.9 - 2022-11-11
+
+* Prevent git from existing with 141 [ab77]
+
+## 14.5.8 - 2022-11-10
+
+* Replace missing input [ab77]
+
+## 14.5.7 - 2022-11-10
+
+* Just ignore errors during publish [ab77]
+
+## 14.5.6 - 2022-11-10
+
+* Ignore PIPE signal [ab77]
+
+## 14.5.5 - 2022-11-10
+
+* Don't pipefail [ab77]
+
+## 14.5.4 - 2022-11-10
+
+* Error when the device type and image parameters do not match [Thodoris Greasidis]
+
+## 14.5.3 - 2022-11-10
+
+* Switch to Flowzone [ab77]
+
+## 14.5.2 - 2022-10-21
+
+* Stop waiting for the analytics response [Thodoris Greasidis]
+
+## 14.5.1 - 2022-10-20
+
+* Bump parse-link-header from 1.0.1 to 2.0.0 [dependabot[bot]]
+
+## 14.5.0 - 2022-10-18
+
+* keeps events loggiging with default message [Otávio Jacobi]
+* uses amplitude data events format [Otávio Jacobi]
+* changes analytics endpoint to analytics-backend [Otávio Jacobi]
+
+## 14.4.4 - 2022-10-18
+
+* Update simple-git to 3.14.1 [Thodoris Greasidis]
+
+## 14.4.3 - 2022-10-17
+
+* config generate: Fix the incompatible arch errors showing as not found [Thodoris Greasidis]
+
+## 14.4.2 - 2022-10-17
+
+* Stop relying on device-type.json for resolving the device type aliases [Thodoris Greasidis]
+* Stop relying on device-type.json for resolving the cpu architecture [Thodoris Greasidis]
+
+## 14.4.1 - 2022-10-12
+
+* balena os initialize: Clarify that the process includes flashing [Heath Raftery]
+
+## 14.4.0 - 2022-10-12
+
+* device register: Add support for the `--deviceType` option [Thodoris Greasidis]
+
+<details>
+<summary> Update balena-sdk to 16.28.0 [Thodoris Greasidis] </summary>
+
+> ### balena-sdk-16.28.0 - 2022-10-12
+> 
+> * device.register: Allow providing a device type for the registered device [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.27.0 - 2022-10-07
+> 
+> * Add support for batch operations for more device modifying methods [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.26.7 - 2022-10-07
+> 
+> * Fix request batching chunking when there is no grouping navigation prop [Thodoris Greasidis]
+> * request-batching: Increase the batch size to 200 items [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.26.6 - 2022-10-06
+> 
+> * Fix request batching not chunking the items of the operation [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.26.5 - 2022-09-26
+> 
+> * Delete redundant .resinci.yml [Pagan Gazzard]
+> 
+> ### balena-sdk-16.26.4 - 2022-09-23
+> 
+> * Remove moment in favor of date-fns [Matthew Yarmolinsky]
+> 
+> ### balena-sdk-16.26.3 - 2022-09-21
+> 
+> * Skip running tests in flowzone till we can inject env vars [Thodoris Greasidis]
+> * Switch from balenaCI to flowzone [Pagan Gazzard]
+> 
+> ### balena-sdk-16.26.2 - 2022-09-06
+> 
+> 
+> <details>
+> <summary> Update balena-register-device to 8.0.0 [Thodoris Greasidis] </summary>
+> 
+>> #### balena-register-device-8.0.0 - 2022-09-06
+>> 
+>> * Remove the travis & appveyor configurations [Thodoris Greasidis]
+>> * tsconfig: Enable strict type checking [Thodoris Greasidis]
+>> * Update devDependencies [Thodoris Greasidis]
+>> * Update the uuid package to v9 [Thodoris Greasidis]
+>> * Prevent creating a package-lock.json [Thodoris Greasidis]
+>> * Drop support for node 10 in favor of 14 & 16 [Thodoris Greasidis]
+>> 
+>> #### balena-register-device-7.2.0 - 2021-04-29
+>> 
+>> * Support `supervisorVersion`/`osVersion`/`osVariant`/`macAddress` fields [Pagan Gazzard]
+>> 
+>> #### balena-register-device-7.1.1 - 2021-04-29
+>> 
+>> * Update dependencies [Pagan Gazzard]
+>> 
+> </details>
+> 
+> 
+> ### balena-sdk-16.26.1 - 2022-08-29
+> 
+> * Update TypeScript to v4.8 [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.26.0 - 2022-08-26
+> 
+> * Pin TypeScript to 4.7 until upstream dependencies are updated [Thodoris Greasidis]
+> * types: Add the InvitationTokenDecodedPayload type [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.25.1 - 2022-08-05
+> 
+> * Deprecate the public_key from the user JWT [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.25.0 - 2022-08-04
+> 
+> * application.remove: Support batch deletions by providing multiple IDs [Thodoris Greasidis]
+> * Refactor the request batching implementation to be generic [Thodoris Greasidis]
+> * Change pine options merging to extend the default `$select`ed properties [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.24.2 - 2022-08-02
+> 
+> * Refactor the internal mergePineOptions utility [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.24.1 - 2022-07-21
+> 
+> * Update Husky to v7 [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.24.0 - 2022-07-08
+> 
+> * types: Add missing Application to Service relation [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.23.0 - 2022-07-07
+> 
+> * Add expiry-date for generation of user and device keys [Nitish Agarwal]
+> 
+</details>
+
+## 14.3.1 - 2022-09-06
+
+* Add unified OS versions in the examples of the device & os commands [Thodoris Greasidis]
+
+## 14.3.0 - 2022-08-17
+
+* release: Add `validate` command for validating releases [Matthew Yarmolinsky]
+* release: Add `invalidate` command for invalidating releases [Matthew Yarmolinsky]
+
+## 14.2.0 - 2022-08-16
+
+* fleet: Add `track-latest` command for tracking the latest release [Matthew Yarmolinsky]
+* fleet: Add `pin` command for pinning fleets to a specific release [Matthew Yarmolinsky]
+
+## 14.1.0 - 2022-08-03
+
+* Add device track command for pinning a device to the latest release or a specific release [Matthew Yarmolinsky]
+
+## 14.0.0 - 2022-08-01
+
+* Drop undocumented support for numeric ids in balena device commands [Matthew Yarmolinsky]
+* Drop support for the deprecated `balena device public-url <enable|disable|status> <uuid>` and related format [Matthew Yarmolinsky]
+* Drop support for numeric fleet id parameters from all commands [Matthew Yarmolinsky]
+* fleet: Add `--filter`, `--no-header`, `--no-truncate`, and `--sort` options [Matthew Yarmolinsky]
+* fleet: Add `--fields` and `--json` options [Matthew Yarmolinsky]
+* fleet: Use the oclif output formatter [Matthew Yarmolinsky]
+* config: Drop optional and ignored `--type` flag [Matthew Yarmolinsky]
+* Drop deprecated `--logs` flag [Matthew Yarmolinsky]
+* Drop support for open-balena-api < v0.131.0 [Matthew Yarmolinsky]
+
+## 13.10.1 - 2022-08-01
+
+* Fix balena deploy missing dependency error [Thodoris Greasidis]
+
+## 13.10.0 - 2022-07-20
+
+* Add `--view` flag to `device` command for opening a device's dashboard page [Matthew Yarmolinsky]
+
+## 13.9.0 - 2022-07-19
+
+* Switch to balena-compose [Akis Kesoglou]
+
+## 13.8.0 - 2022-07-18
+
+* Add `--note` option for `push` and `deploy` [Matthew Yarmolinsky]
+
+## 13.7.1 - 2022-07-13
+
+* os download: Fix resolving to draft releases [Thodoris Greasidis]
+
+## 13.7.0 - 2022-07-07
+
+* Add `--view` flag to `fleet` command for opening a fleet's dashboard page [Matthew Yarmolinsky]
+
+## 13.6.1 - 2022-06-09
+
+
+<details>
+<summary> Update balena-sdk to use the native OS release phase & variant fields [Thodoris Greasidis] </summary>
+
+> ### balena-sdk-16.22.0 - 2022-06-06
+> 
+> * os: Start using the release.phase field in the available versions [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.21.1 - 2022-06-02
+> 
+> * Add provisioning key expiry date to generateDeviceProvisioningKey [Nitish Agarwal]
+> 
+> ### balena-sdk-16.21.0 - 2022-06-01
+> 
+> * os: Refactor the computation of OS releases [Thodoris Greasidis]
+> * os: Use the model's release variant when the native fields are used [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.20.6 - 2022-06-01
+> 
+> * Deprecate the needsPasswordReset field of the JWTUser [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.20.5 - 2022-05-25
+> 
+> * Update TypeScript to v4.7 [Thodoris Greasidis]
+> 
+</details>
+
+## 13.6.0 - 2022-06-06
+
+* Update QEMU to v7.0.0 [Kyle Harding]
+
+## 13.5.3 - 2022-05-31
+
+* Drop the needsPasswordReset property from the tests [Thodoris Greasidis]
+
+## 13.5.2 - 2022-05-31
+
+* Deduplicate npm-shrinkwrap.json [Thodoris Greasidis]
+
+## 13.5.1 - 2022-05-26
+
+* preload: Fix issue where balenaOS v2.98.3+ required an Internet connection to start apps [pipex]
+
+## 13.5.0 - 2022-05-24
+
+
+<details>
+<summary> Update balena-sdk to 16.20.4 [Nitish Agarwal] </summary>
+
+> ### balena-sdk-16.20.4 - 2022-05-09
+> 
+> * bump @types/node from 10.17.60 to 12.20.500 [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.20.3 - 2022-05-06
+> 
+> * patch: bump browserify from 14.5.0 to 17.0.0 [dependabot[bot]]
+> 
+> ### balena-sdk-16.20.2 - 2022-05-05
+> 
+> * patch: bump tmp from 0.0.31 to 0.2.1 [dependabot[bot]]
+> 
+> ### balena-sdk-16.20.1 - 2022-05-05
+> 
+> * Drop the non-populated apiUrl & actionsUrl properties from Config type [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.20.0 - 2022-05-04
+> 
+> * models.apiKey: Update apiKeyInfo with expiryDate option [Nitish Agarwal]
+> * os.getConfig: Add typings for the provisioningKeyExpiryDate option [Balena CI]
+> 
+> ### balena-sdk-16.19.14 - 2022-05-04
+> 
+> * config.getAll: Mark the deviceTypes property as optional [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.19.13 - 2022-05-03
+> 
+> * patch: bump mocha from 3.5.3 to 10.0.0 [dependabot[bot]]
+> 
+> ### balena-sdk-16.19.12 - 2022-05-03
+> 
+> * config.getAll: Deprecate the pubnub property and mark as optional [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.19.11 - 2022-05-03
+> 
+> * patch: bump mockttp from 0.9.1 to 2.7.0 [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.19.10 - 2022-04-27
+> 
+> * Reduce the prod typing dependencies [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.19.9 - 2022-04-26
+> 
+> * patch: Remove documentation.md from the NPM package [Vipul Gupta]
+> 
+> ### balena-sdk-16.19.8 - 2022-04-20
+> 
+> * patch: Remove additional quotes [Vipul Gupta (@vipulgupta2048)]
+> 
+> ### balena-sdk-16.19.7 - 2022-04-12
+> 
+> * tests: Update to work with latest major of superagent [Thodoris Greasidis]
+> * patch: bump superagent from 3.8.3 to 7.1.2 [dependabot[bot]]
+> 
+> ### balena-sdk-16.19.6 - 2022-04-11
+> 
+> * patch: bump dotenv from 4.0.0 to 16.0.0 [dependabot[bot]]
+> 
+> ### balena-sdk-16.19.5 - 2022-04-09
+> 
+> * Bump karma to v6 [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.19.4 - 2022-04-09
+> 
+> * Add dependabot configuration [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.19.3 - 2022-04-06
+> 
+> * tests: Update v5 model endpoint prefix references [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.19.2 - 2022-04-06
+> 
+> 
+> <details>
+> <summary> Fix extracting a meaningful error message instead of "[object Object]" [Thodoris Greasidis] </summary>
+> 
+>> #### balena-request-11.5.5 - 2022-04-06
+>> 
+>> * Fix extracting the response error from object response bodies [Thodoris Greasidis]
+>> 
+>> #### balena-request-11.5.4 - 2022-04-06
+>> 
+>> * Drop explicit karma-chrome-launcher devDependency [Thodoris Greasidis]
+>> 
+> </details>
+> 
+> 
+> ### balena-sdk-16.19.1 - 2022-04-05
+> 
+> * Update balena-request dependency to v11.5.3 [Matthew Yarmolinsky]
+> 
+> ### balena-sdk-16.19.0 - 2022-03-16
+> 
+> * Add release.setKnownIssueList function for setting a release's known issue list [Matthew Yarmolinsky]
+> 
+> ### balena-sdk-16.18.0 - 2022-03-14
+> 
+> * minor: Add trying SDK in the browser [Vipul Gupta (@vipulgupta2048)]
+> 
+> ### balena-sdk-16.17.0 - 2022-03-11
+> 
+> * device.getWithServiceDetails: Add the release id in the service info [Matthew Yarmolinsky]
+> 
+> ### balena-sdk-16.16.1 - 2022-03-08
+> 
+> * Replace internal use of deprecated OsVersion.rawVersion with raw_version [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.16.0 - 2022-03-03
+> 
+> * Add support for named imports from .mjs files [Thodoris Greasidis]
+> * Update npx command to fix ts-compatibility tests [Thodoris Greasidis]
+> * Regenerate Documentation [Thodoris Greasidis]
+> * Update typescript to 4.6.2 [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.15.1 - 2022-02-24
+> 
+> * Remove unnecessary vpn address filtering when fetching local addresses [Pagan Gazzard]
+> 
+> ### balena-sdk-16.15.0 - 2022-02-16
+> 
+> * Add applicationClass parameter to application create function for setting is_of__class property [Matthew Yarmolinsky]
+> 
+> ### balena-sdk-16.14.0 - 2022-02-15
+> 
+> * Add name and description field to generateDeviceKey for device. [Nitish Agarwal]
+> 
+> ### balena-sdk-16.13.4 - 2022-01-27
+> 
+> * typings: Fix conditional $or/$and/$not $filters [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.13.3 - 2022-01-27
+> 
+> * Deprecate the supportsBlink field of the DeviceTypeJson.DeviceType type [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.13.2 - 2022-01-25
+> 
+> * Deprecate the logoUrl field of the DeviceTypeJson.DeviceType type [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.13.1 - 2022-01-21
+> 
+> * Replace internal use of release.contains__image with release_image [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.13.0 - 2022-01-21
+> 
+> * models: Deprecate the release.contains__image in favor of the term form [Thodoris Greasidis]
+> * models: Add the release_image term form property in the Release typings [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.12.1 - 2022-01-17
+> 
+> * config.getConfigVarSchema: Send the token only when using a device type [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.12.0 - 2022-01-10
+> 
+> * Replace DeviceTypeJson usage for alias resolution with model queries [Thodoris Greasidis]
+> * models/device-type: Support aliases as argument of the get() method [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.11.3 - 2022-01-09
+> 
+> * Fix jsdoc example for balena.errors [Ken Bannister]
+> 
+> ### balena-sdk-16.11.2 - Invalid date
+> 
+> * tests: Convert auth spec to async await [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.11.1 - Invalid date
+> 
+> * Fix buggy tests causing flakiness on node 16 [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.11.0 - Invalid date
+> 
+> * Alias device.getManifestBySlug as config.getDeviceTypeManifestBySlug [Thodoris Greasidis]
+> * Deprecate device.getManifestByApplication [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.10.0 - Invalid date
+> 
+> * application.get: Add support for retrieving applications by uuid [Thodoris Greasidis]
+> * package.json: Rename the lint-fix npm script to lint:fix [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.9.4 - 2021-12-29
+> 
+> * os: Avoid mutating the args in getAvailableOsVersions & getAllOsVersion [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.9.3 - 2021-12-28
+> 
+> * os: Replace semver normalization with balena-semver [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.9.2 - 2021-12-28
+> 
+> * Stop relying on the balena-pine module [Thodoris Greasidis]
+> 
+> ### balena-sdk-16.9.1 - 2021-12-28
+> 
+> * Enable nested changelogs for balena-hup-action-utils [Thodoris Greasidis]
+> 
+</details>
+
+* Add provisioning key expiry date option to config generate options [Balena CI]
+
+## 13.4.3 - 2022-05-19
+
+
+<details>
+<summary> Update docker-progress to 5.1.3 [Pagan Gazzard] </summary>
+
+> ### docker-progress-5.1.3 - 2022-05-11
+> 
+> * Reject on the stream closing if it has not already ended successfully [Pagan Gazzard]
+> 
+> ### docker-progress-5.1.2 - 2022-05-10
+> 
+> * Update dependencies [Pagan Gazzard]
+> 
+> ### docker-progress-5.1.1 - 2022-05-10
+> 
+> * Avoid breaking changes to PushPullOptions required properties [Kyle Harding]
+> 
+> ### docker-progress-5.1.0 - 2022-03-10
+> 
+> * Add support for building images with progress [Felipe Lalanne]
+> 
+</details>
+
+## 13.4.2 - 2022-05-10
+
+
+<details>
+<summary> preload: Fix detection of supervisor version for balenaOS v2.93.0 [Kyle Harding] </summary>
+
+> ### balena-preload-12.0.1 - 2022-05-10
+> 
+> * Update supervisor image regex to include tagged images [Kyle Harding]
+> 
+</details>
+
 ## 13.4.1 - 2022-04-11
 
 * leave: Update log message to advise that device still needs deleting [Taro Murao]

INSTALL-ADVANCED.md

@@ -78,8 +78,8 @@ If you are a Node.js developer, you may wish to install the balena CLI via [npm]
 The npm installation involves building native (platform-specific) binary modules, which require
 some development tools to be installed first, as follows.
 
-> **The balena CLI currently requires Node.js version 12 (min 12.8.0).**  
-> **Versions 13 and later are not yet fully supported.**
+> **The balena CLI currently requires Node.js version 16.**  
+> **Versions 17 and later are not yet fully supported.**
 
 ### Install development tools
 
@@ -89,7 +89,7 @@ some development tools to be installed first, as follows.
 $ sudo apt-get update && sudo apt-get -y install curl python3 git make g++
 $ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
 $ . ~/.bashrc
-$ nvm install 12
+$ nvm install 16
 ```
 
 The `curl` command line above uses
@@ -106,15 +106,15 @@ recommended.
 ```sh
 $ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
 $ . ~/.bashrc
-$ nvm install 12
+$ nvm install 16
 ```
 
 #### **Windows** (not WSL)
 
 Install:
 
-* Node.js v12 from the [Nodejs.org releases page](https://nodejs.org/en/download/releases/).
   * If you'd like the ability to switch between Node.js versions, install
+- Node.js v16 from the [Nodejs.org releases page](https://nodejs.org/en/download/releases/).
     [nvm-windows](https://github.com/coreybutler/nvm-windows#node-version-manager-nvm-for-windows)
     instead.
 * The [MSYS2 shell](https://www.msys2.org/), which provides `git`, `make`, `g++` and more:

automation/build-bin.ts

@@ -45,8 +45,6 @@ const execFileAsync = promisify(execFile);
 export const packageJSON = loadPackageJson();
 export const version = 'v' + packageJSON.version;
 const arch = process.arch;
-const MSYS2_BASH =
-	process.env.MSYSSHELLPATH || 'C:\\msys64\\usr\\bin\\bash.exe';
 
 function dPath(...paths: string[]) {
 	return path.join(ROOT, 'dist', ...paths);
@@ -89,7 +87,7 @@ async function diffPkgOutput(pkgOut: string) {
 		'tests',
 		'test-data',
 		'pkg',
-		`expected-warnings-${process.platform}.txt`,
+		`expected-warnings-${process.platform}-${arch}.txt`,
 	);
 	const absSavedPath = path.join(ROOT, relSavedPath);
 	const ignoreStartsWith = [
@@ -182,9 +180,18 @@ async function execPkg(...args: any[]) {
  * to be directly executed from inside another binary executable.)
  */
 async function buildPkg() {
+	// https://github.com/vercel/pkg#targets
+	let targets = `linux-${arch}`;
+	// TBC: not possible to build for macOS or Windows arm64 on x64 nodes
+	if (process.platform === 'darwin') {
+		targets = `macos-x64`;
+	}
+	if (process.platform === 'win32') {
+		targets = `win-x64`;
+	}
 	const args = [
-		'--target',
-		'host',
+		'--targets',
+		targets,
 		'--output',
 		'build-bin/balena',
 		'package.json',
@@ -425,20 +432,28 @@ async function renameInstallerFiles() {
 
 /**
  * If the CSC_LINK and CSC_KEY_PASSWORD env vars are set, digitally sign the
- * executable installer by running the balena-io/scripts/shared/sign-exe.sh
- * script (which must be in the PATH) using a MSYS2 bash shell.
+ * executable installer using Microsoft SignTool.exe (Sign Tool)
+ * https://learn.microsoft.com/en-us/dotnet/framework/tools/signtool-exe
  */
 async function signWindowsInstaller() {
 	if (process.env.CSC_LINK && process.env.CSC_KEY_PASSWORD) {
 		const exeName = renamedOclifInstallers[process.platform];
 		console.log(`Signing installer "${exeName}"`);
-		await execFileAsync(MSYS2_BASH, [
-			'sign-exe.sh',
+		// trust ...
+		await execFileAsync('signtool.exe', [
+			'sign',
+			'-t',
+			process.env.TIMESTAMP_SERVER || 'http://timestamp.comodoca.com',
 			'-f',
-			exeName,
+			process.env.CSC_LINK,
+			'-p',
+			process.env.CSC_KEY_PASSWORD,
 			'-d',
 			`balena-cli ${version}`,
+			exeName,
 		]);
+		// ... but verify
+		await execFileAsync('signtool.exe', ['verify', '-pa', '-v', exeName]);
 	} else {
 		console.log(
 			'Skipping installer signing step because CSC_* env vars are not set',
@@ -450,14 +465,21 @@ async function signWindowsInstaller() {
  * Wait for Apple Installer Notarization to continue
  */
 async function notarizeMacInstaller(): Promise<void> {
-	const appleId = 'accounts+apple@balena.io';
-	const { notarize } = await import('electron-notarize');
-	await notarize({
-		appBundleId: 'io.balena.etcher',
-		appPath: renamedOclifInstallers.darwin,
-		appleId,
-		appleIdPassword: '@keychain:CLI_PASSWORD',
-	});
+	const appleId =
+		process.env.XCODE_APP_LOADER_EMAIL || 'accounts+apple@balena.io';
+	const appBundleId = packageJSON.oclif.macos.identifier || 'io.balena.cli';
+	const appleIdPassword = process.env.XCODE_APP_LOADER_PASSWORD;
+
+	if (appleIdPassword) {
+		const { notarize } = await import('electron-notarize');
+		// https://github.com/electron/notarize/blob/main/README.md
+		await notarize({
+			appBundleId,
+			appPath: renamedOclifInstallers.darwin,
+			appleId,
+			appleIdPassword,
+		});
+	}
 }
 
 /**

automation/check-doc.ts

@@ -15,11 +15,12 @@
  * limitations under the License.
  */
 
-const stripIndent = require('common-tags/lib/stripIndent');
-const _ = require('lodash');
-const { promises: fs } = require('fs');
-const path = require('path');
-const simplegit = require('simple-git/promise');
+// tslint:disable-next-line:import-blacklist
+import { stripIndent } from 'common-tags';
+import * as _ from 'lodash';
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import { simpleGit } from 'simple-git';
 
 const ROOT = path.normalize(path.join(__dirname, '..'));
 
@@ -31,7 +32,7 @@ const ROOT = path.normalize(path.join(__dirname, '..'));
  * using `touch`.
  */
 async function checkBuildTimestamps() {
-	const git = simplegit(ROOT);
+	const git = simpleGit(ROOT);
 	const docFile = path.join(ROOT, 'docs', 'balena-cli.md');
 	const [docStat, gitStatus] = await Promise.all([
 		fs.stat(docFile),
@@ -81,4 +82,5 @@ async function run() {
 	}
 }
 
+// tslint:disable-next-line:no-floating-promises
 run();

completion/_balena

@@ -12,15 +12,15 @@ _balena() {
   # Sub-completions
   api_key_cmds=( generate )
   config_cmds=( generate inject read reconfigure write )
-  device_cmds=( deactivate identify init local-mode move os-update public-url purge reboot register rename restart rm shutdown )
+  device_cmds=( deactivate identify init local-mode move os-update pin public-url purge reboot register rename restart rm shutdown track-fleet )
   devices_cmds=( supported )
   env_cmds=( add rename rm )
-  fleet_cmds=( create purge rename restart rm )
+  fleet_cmds=( create pin purge rename restart rm track-latest )
   internal_cmds=( osinit )
   key_cmds=( add rm )
   local_cmds=( configure flash )
   os_cmds=( build-config configure download initialize versions )
-  release_cmds=( finalize )
+  release_cmds=( finalize invalidate validate )
   tag_cmds=( rm set )
 
 

completion/balena-completion.bash

@@ -11,15 +11,15 @@ _balena_complete()
   # Sub-completions
   api_key_cmds="generate"
   config_cmds="generate inject read reconfigure write"
-  device_cmds="deactivate identify init local-mode move os-update public-url purge reboot register rename restart rm shutdown"
+  device_cmds="deactivate identify init local-mode move os-update pin public-url purge reboot register rename restart rm shutdown track-fleet"
   devices_cmds="supported"
   env_cmds="add rename rm"
-  fleet_cmds="create purge rename restart rm"
+  fleet_cmds="create pin purge rename restart rm track-latest"
   internal_cmds="osinit"
   key_cmds="add rm"
   local_cmds="configure flash"
   os_cmds="build-config configure download initialize versions"
-  release_cmds="finalize"
+  release_cmds="finalize invalidate validate"
   tag_cmds="rm set"
 
 

docs/balena-cli.md

@@ -333,11 +333,35 @@ Examples:
 
 ### Options
 
+#### --fields FIELDS
+
+only show provided fields (comma-separated)
+
+#### -j, --json
+
+output in json format
+
+#### --filter FILTER
+
+filter results by substring matching of a given field, eg: --filter field=foo
+
+#### --no-header
+
+hide table header from output
+
+#### --no-truncate
+
+do not truncate output to fit screen
+
+#### --sort SORT
+
+field to sort by (prepend '-' for descending order)
+
 ## fleet <fleet>
 
 Display detailed information about a single fleet.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -345,23 +369,34 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
 	$ balena fleet MyFleet
 	$ balena fleet myorg/myfleet
+	$ balena fleet myorg/myfleet --view
 
 ### Arguments
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ### Options
 
+#### --view
+
+open fleet dashboard page
+
+#### --fields FIELDS
+
+only show provided fields (comma-separated)
+
+#### -j, --json
+
+output in json format
+
 ## fleet create <name>
 
 Create a new balena fleet.
@@ -408,7 +443,7 @@ fleet device type (Check available types with `balena devices supported`)
 Purge data from all devices belonging to a fleet.
 This will clear the fleet's '/data' directory.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -416,9 +451,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -429,7 +462,7 @@ Examples:
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ### Options
 
@@ -440,7 +473,7 @@ Rename a fleet.
 Note, if the `newName` parameter is omitted, it will be
 prompted for interactively.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -448,9 +481,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -462,7 +493,7 @@ Examples:
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### NEWNAME
 
@@ -474,7 +505,7 @@ the new name for the fleet
 
 Restart all devices belonging to a fleet.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -482,9 +513,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -495,7 +524,7 @@ Examples:
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ### Options
 
@@ -505,7 +534,7 @@ Permanently remove a fleet.
 
 The --yes option may be used to avoid interactive confirmation.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -513,9 +542,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -527,7 +554,7 @@ Examples:
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ### Options
 
@@ -618,7 +645,7 @@ List all of your devices.
 
 Devices can be filtered by fleet with the `--fleet` option.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -626,9 +653,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 The --json option is recommended when scripting the output of this command,
 because field names are less likely to change in JSON format and because it
@@ -646,7 +671,7 @@ Examples:
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -j, --json
 
@@ -680,6 +705,7 @@ Show information about a single device.
 Examples:
 
 	$ balena device 7cf02a6
+	$ balena device 7cf02a6 --view
 
 ### Arguments
 
@@ -689,6 +715,10 @@ the device uuid
 
 ### Options
 
+#### --view
+
+open device dashboard page
+
 ## device deactivate <uuid>
 
 Deactivate a device.
@@ -753,7 +783,7 @@ If the '--fleet' or '--drive' options are omitted, interactive menus will be
 presented with values to choose from. If the '--os-version' option is omitted,
 the latest released OS version for the fleet's default device type will be used.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -761,9 +791,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Image configuration questions will be asked interactively unless a pre-configured
 'config.json' file is provided with the '--config' option.  The file can be
@@ -773,13 +801,14 @@ Examples:
 
 	$ balena device init
 	$ balena device init -f myorg/myfleet
+	$ balena device init --fleet myFleet --os-version 2.101.7 --drive /dev/disk5 --config config.json --yes
 	$ balena device init --fleet myFleet --os-version 2.83.21+rev1.prod --drive /dev/disk5 --config config.json --yes
 
 ### Options
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -y, --yes
 
@@ -811,6 +840,10 @@ path to the config JSON file, see `balena os build-config`
 
 custom key name assigned to generated provisioning api key
 
+#### --provisioning-key-expiry-date PROVISIONING-KEY-EXPIRY-DATE
+
+expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)
+
 ## device local-mode <uuid>
 
 Output current local mode status, or enable/disable local mode
@@ -849,7 +882,7 @@ Move one or more devices to another fleet.
 
 If --fleet is omitted, the fleet will be prompted for interactively.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -857,9 +890,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -878,7 +909,7 @@ comma-separated list (no blank spaces) of device UUIDs to be moved
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ## device os-update <uuid>
 
@@ -892,6 +923,7 @@ Requires balenaCloud; will not work with openBalena or standalone balenaOS.
 Examples:
 
 	$ balena device os-update 23c73a1
+	$ balena device os-update 23c73a1 --version 2.101.7
 	$ balena device os-update 23c73a1 --version 2.31.0+rev1.prod
 
 ### Arguments
@@ -916,9 +948,6 @@ This command will output the current public URL for the
 specified device.  It can also enable or disable the URL,
 or output the enabled status, using the respective options.
 
-The old command style 'balena device public-url enable <uuid>'
-is deprecated, but still supported.
-
 Examples:
 
 	$ balena device public-url 23c73a1
@@ -932,10 +961,6 @@ Examples:
 
 the uuid of the device to manage
 
-#### LEGACYUUID
-
-
-
 ### Options
 
 #### --enable
@@ -997,7 +1022,7 @@ Register a new device with a balena fleet.
 
 If --uuid is not provided, a new UUID will be automatically assigned.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1005,21 +1030,20 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
 	$ balena device register MyFleet
 	$ balena device register MyFleet --uuid <uuid>
 	$ balena device register myorg/myfleet --uuid <uuid>
+	$ balena device register myorg/myfleet --uuid <uuid> --deviceType <deviceTypeSlug>
 
 ### Arguments
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 ### Options
 
@@ -1027,6 +1051,10 @@ fleet name, slug (preferred), or numeric ID (deprecated)
 
 custom uuid
 
+#### --deviceType DEVICETYPE
+
+device type slug (run 'balena devices supported' for possible values)
+
 ## device rename &#60;uuid&#62; [newName]
 
 Rename a device.
@@ -1233,7 +1261,7 @@ name may be null in JSON output (or 'N/A' in tabular output) if the fleet that
 the device belonged to is no longer accessible by the current user (for example,
 in case the current user was removed from the fleet by the fleet's owner).
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1241,9 +1269,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -1261,7 +1287,7 @@ Examples:
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -c, --config
 
@@ -1371,7 +1397,7 @@ therefore the --service option cannot be used when the variable name starts
 with a reserved prefix. When defining custom fleet variables, please avoid
 these reserved prefixes.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1379,9 +1405,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -1409,7 +1433,7 @@ variable value; if omitted, use value from this process' environment
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -d, --device DEVICE
 
@@ -1492,7 +1516,7 @@ select a service variable (may be used together with the --device option)
 
 List all tags and their values for the specified fleet, device or release.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1500,9 +1524,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -1516,7 +1538,7 @@ Examples:
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -d, --device DEVICE
 
@@ -1530,7 +1552,7 @@ release id
 
 Remove a tag from a fleet, device or release.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1538,9 +1560,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -1560,7 +1580,7 @@ the key string of the tag
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -d, --device DEVICE
 
@@ -1578,7 +1598,7 @@ You can optionally provide a value to be associated with the created
 tag, as an extra argument after the tag key. If a value isn't
 provided, a tag with an empty value is created.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -1586,9 +1606,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -1615,7 +1633,7 @@ the optional value associated with the tag
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -d, --device DEVICE
 
@@ -1900,7 +1918,7 @@ Examples:
 
 #### FLEETORDEVICE
 
-fleet name/slug/id, device uuid, or address of local device
+fleet name/slug, device uuid, or address of local device
 
 #### SERVICE
 
@@ -1968,7 +1986,7 @@ Examples:
 
 #### DEVICEORFLEET
 
-device UUID or fleet name/slug/ID
+device UUID or fleet name/slug
 
 ### Options
 
@@ -2054,9 +2072,11 @@ Development images can be selected by appending `.dev` to the version.
 Examples:
 
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img
+	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.101.7
+	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2022.7.0
+	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version ^2.90.0
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.60.1+rev1
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.60.1+rev1.dev
-	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version ^2.60.0
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2021.10.2.prod
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version latest
 	$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version default
@@ -2140,6 +2160,9 @@ confuse the balenaOS "development mode" with a device's "local mode", the latter
 being a supervisor feature that allows the "balena push" command to push a user's
 application directly to a device in the local network.
 
+The '--secureBoot' option is used to configure a balenaOS installer image to opt-in
+secure boot and disk encryption.
+
 The --system-connection (-c) option is used to inject NetworkManager connection
 profiles for additional network interfaces, such as cellular/GSM or additional
 WiFi or ethernet connections. This option may be passed multiple times in case there
@@ -2147,7 +2170,7 @@ are multiple files to inject. See connection profile examples and reference at:
 https://www.balena.io/docs/reference/OS/network/2.x/
 https://developer.gnome.org/NetworkManager/stable/ref-settings.html
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -2155,9 +2178,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Note: This command is currently not supported on Windows natively. Windows users
 are advised to install the Windows Subsystem for Linux (WSL) with Ubuntu, and use
@@ -2186,7 +2207,7 @@ ask advanced configuration questions (when in interactive mode)
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### --config CONFIG
 
@@ -2212,6 +2233,10 @@ WiFi SSID (network name) (non-interactive configuration)
 
 Configure balenaOS to operate in development mode
 
+#### --secureBoot
+
+Configure balenaOS installer to opt-in secure boot and disk encryption
+
 #### -d, --device DEVICE
 
 device UUID
@@ -2236,10 +2261,16 @@ paths to local files to place into the 'system-connections' directory
 
 custom key name assigned to generated provisioning api key
 
+#### --provisioning-key-expiry-date PROVISIONING-KEY-EXPIRY-DATE
+
+expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)
+
 ## os initialize &#60;image&#62;
 
 Initialize an os image for a device with a previously
-		configured operating system image.
+		configured operating system image and flash the
+		an external storage drive or the device's storage
+		medium depending on the device type.
 		
 
 Note: Initializing the device may ask for administrative permissions
@@ -2290,13 +2321,16 @@ confuse the balenaOS "development mode" with a device's "local mode", the latter
 being a supervisor feature that allows the "balena push" command to push a user's
 application directly to a device in the local network.
 
+The '--secureBoot' option is used to configure a balenaOS installer image to opt-in
+secure boot and disk encryption.
+
 To configure an image for a fleet of mixed device types, use the --fleet option
 alongside the --deviceType option to specify the target device type.
 
 To avoid interactive questions, specify a command line option for each question that
 would otherwise be asked.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -2304,9 +2338,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -2315,6 +2347,7 @@ Examples:
 	$ balena config generate --device 7cf02a6 --version 2.12.7 --deviceApiKey <existingDeviceKey>
 	$ balena config generate --device 7cf02a6 --version 2.12.7 --output config.json
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --dev
+	$ balena config generate --fleet myorg/fleet --version 2.12.7 --secureBoot
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --deviceType fincm3
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --output config.json
 	$ balena config generate --fleet myorg/fleet --version 2.12.7 --network wifi --wifiSsid mySsid --wifiKey abcdefgh --appUpdatePollInterval 15
@@ -2327,12 +2360,16 @@ a balenaOS version
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### --dev
 
 Configure balenaOS to operate in development mode
 
+#### --secureBoot
+
+Configure balenaOS installer to opt-in secure boot and disk encryption
+
 #### -d, --device DEVICE
 
 device UUID
@@ -2373,6 +2410,10 @@ supervisor cloud polling interval in minutes (e.g. for device variables)
 
 custom key name assigned to generated provisioning api key
 
+#### --provisioning-key-expiry-date PROVISIONING-KEY-EXPIRY-DATE
+
+expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)
+
 ## config inject &#60;file&#62;
 
 Inject a 'config.json' file to a balenaOS image file or attached SD card or
@@ -2394,10 +2435,6 @@ the path to the config.json file to inject
 
 ### Options
 
-#### -t, --type TYPE
-
-ignored - no longer required
-
 #### -d, --drive DRIVE
 
 path to OS image file (e.g. balena.img) or block device (e.g. /dev/disk2)
@@ -2418,10 +2455,6 @@ Examples:
 
 ### Options
 
-#### -t, --type TYPE
-
-ignored - no longer required
-
 #### -d, --drive DRIVE
 
 path to OS image file (e.g. balena.img) or block device (e.g. /dev/disk2)
@@ -2449,10 +2482,6 @@ Examples:
 
 ### Options
 
-#### -t, --type TYPE
-
-ignored - no longer required
-
 #### -d, --drive DRIVE
 
 path to OS image file (e.g. balena.img) or block device (e.g. /dev/disk2)
@@ -2491,10 +2520,6 @@ the value of the config parameter to write
 
 ### Options
 
-#### -t, --type TYPE
-
-ignored - no longer required
-
 #### -d, --drive DRIVE
 
 path to OS image file (e.g. balena.img) or block device (e.g. /dev/disk2)
@@ -2515,7 +2540,7 @@ Check also the Preloading and Preregistering section of the balena CLI's advance
 masterclass document:
 https://www.balena.io/docs/learn/more/masterclasses/advanced-cli/#5-preloading-and-preregistering
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -2523,9 +2548,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Note that the this command requires Docker to be installed, as further detailed
 in the balena CLI's installation instructions:
@@ -2551,7 +2574,7 @@ the image file path
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -c, --commit COMMIT
 
@@ -2715,6 +2738,7 @@ Examples:
 	$ balena push myFleet
 	$ balena push myFleet --source <source directory>
 	$ balena push myFleet -s <source directory>
+	$ balena push myFleet --source <source directory> --note "this is the note for this release"
 	$ balena push myFleet --release-tag key1 "" key2 "value2 with spaces"
 	$ balena push myorg/myfleet
 	
@@ -2779,7 +2803,7 @@ used (usually $HOME/.balena/secrets.yml|.json)
 
 Don't run a live session on this push. The filesystem will not be monitored,
 and changes will not be synchronized to any running containers. Note that both
-this flag and --detached and required to cause the process to end once the
+this flag and --detached are required to cause the process to end once the
 initial build has completed.
 
 #### -d, --detached
@@ -2831,6 +2855,10 @@ by the 'track latest' release policy but can be used through release pinning.
 Draft releases can be marked as final through the API. Releases are created
 as final by default unless this option is given.
 
+#### --note NOTE
+
+The notes for this release
+
 # Settings
 
 ## settings
@@ -3010,7 +3038,7 @@ the type of device this build is for
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -e, --emulated
 
@@ -3020,14 +3048,6 @@ Use QEMU for ARM architecture emulation during the image build
 
 Alternative Dockerfile name/path, relative to the source folder
 
-#### --dockercompose DOCKERCOMPOSE
-
-Alternative docker-compose.yml name in the source root folder
-
-#### --logs
-
-No-op and deprecated since balena CLI v12.0.0. Build logs are now shown by default.
-
 #### --nologs
 
 Hide the image build log output (produce less verbose output)
@@ -3200,6 +3220,7 @@ Examples:
 
 	$ balena deploy myFleet
 	$ balena deploy myorg/myfleet --build --source myBuildDir/
+	$ balena deploy myorg/myfleet --build --source myBuildDir/ --note "this is the note for this release"
 	$ balena deploy myorg/myfleet myRepo/myImage
 	$ balena deploy myFleet myRepo/myImage --release-tag key1 "" key2 "value2 with spaces"
 
@@ -3207,7 +3228,7 @@ Examples:
 
 #### FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### IMAGE
 
@@ -3240,6 +3261,10 @@ by the 'track latest' release policy but can be used through release pinning.
 Draft releases can be marked as final through the API. Releases are created
 as final by default unless this option is given.
 
+#### --note NOTE
+
+The notes for this release
+
 #### -e, --emulated
 
 Use QEMU for ARM architecture emulation during the image build
@@ -3248,14 +3273,6 @@ Use QEMU for ARM architecture emulation during the image build
 
 Alternative Dockerfile name/path, relative to the source folder
 
-#### --dockercompose DOCKERCOMPOSE
-
-Alternative docker-compose.yml name in the source root folder
-
-#### --logs
-
-No-op and deprecated since balena CLI v12.0.0. Build logs are now shown by default.
-
 #### --nologs
 
 Hide the image build log output (produce less verbose output)
@@ -3349,7 +3366,7 @@ scan the local network for balenaOS devices and prompt you to select one
 from an interactive picker. This may require administrator/root privileges.
 Likewise, if the fleet option is not provided then a picker will be shown.
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -3357,9 +3374,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 
@@ -3380,7 +3395,7 @@ the IP or hostname of device
 
 #### -f, --fleet FLEET
 
-fleet name, slug (preferred), or numeric ID (deprecated)
+fleet name or slug (preferred)
 
 #### -i, --pollInterval POLLINTERVAL
 
@@ -3436,7 +3451,7 @@ or hours, e.g. '12h', '2d'.
 Both --device and --fleet flags accept multiple values, specified as
 a comma-separated list (with no spaces).
 
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the `balena fleets` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -3444,9 +3459,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.
+environments).
 
 Examples:
 

lib/commands/config/generate.ts

@@ -19,13 +19,18 @@ import { flags } from '@oclif/command';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, getCliForm, stripIndent } from '../../utils/lazy';
-import { applicationIdInfo, devModeInfo } from '../../utils/messages';
+import {
+	applicationIdInfo,
+	devModeInfo,
+	secureBootInfo,
+} from '../../utils/messages';
 import type { PineDeferred } from 'balena-sdk';
 
 interface FlagsDef {
 	version: string; // OS version
 	fleet?: string;
 	dev?: boolean; // balenaOS development variant
+	secureBoot?: boolean;
 	device?: string;
 	deviceApiKey?: string;
 	deviceType?: string;
@@ -37,6 +42,7 @@ interface FlagsDef {
 	wifiKey?: string;
 	appUpdatePollInterval?: string;
 	'provisioning-key-name'?: string;
+	'provisioning-key-expiry-date'?: string;
 	help: void;
 }
 
@@ -50,6 +56,8 @@ export default class ConfigGenerateCmd extends Command {
 
 		${devModeInfo.split('\n').join('\n\t\t')}
 
+		${secureBootInfo.split('\n').join('\n\t\t')}
+
 		To configure an image for a fleet of mixed device types, use the --fleet option
 		alongside the --deviceType option to specify the target device type.
 
@@ -65,6 +73,7 @@ export default class ConfigGenerateCmd extends Command {
 		'$ balena config generate --device 7cf02a6 --version 2.12.7 --deviceApiKey <existingDeviceKey>',
 		'$ balena config generate --device 7cf02a6 --version 2.12.7 --output config.json',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --dev',
+		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --secureBoot',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --deviceType fincm3',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --output config.json',
 		'$ balena config generate --fleet myorg/fleet --version 2.12.7 --network wifi --wifiSsid mySsid --wifiKey abcdefgh --appUpdatePollInterval 15',
@@ -79,9 +88,14 @@ export default class ConfigGenerateCmd extends Command {
 		}),
 		fleet: { ...cf.fleet, exclusive: ['device'] },
 		dev: cf.dev,
+		secureBoot: cf.secureBoot,
 		device: {
 			...cf.device,
-			exclusive: ['fleet', 'provisioning-key-name'],
+			exclusive: [
+				'fleet',
+				'provisioning-key-name',
+				'provisioning-key-expiry-date',
+			],
 		},
 		deviceApiKey: flags.string({
 			description:
@@ -120,6 +134,11 @@ export default class ConfigGenerateCmd extends Command {
 			description: 'custom key name assigned to generated provisioning api key',
 			exclusive: ['device'],
 		}),
+		'provisioning-key-expiry-date': flags.string({
+			description:
+				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
+			exclusive: ['device'],
+		}),
 		help: cf.help,
 	};
 
@@ -140,11 +159,9 @@ export default class ConfigGenerateCmd extends Command {
 			| (DeviceWithDeviceType & { belongs_to__application: PineDeferred })
 			| null = null;
 		if (options.device != null) {
-			const { tryAsInteger } = await import('../../utils/validation');
-			const rawDevice = await balena.models.device.get(
-				tryAsInteger(options.device),
-				{ $expand: { is_of__device_type: { $select: 'slug' } } },
-			);
+			const rawDevice = await balena.models.device.get(options.device, {
+				$expand: { is_of__device_type: { $select: 'slug' } },
+			});
 			if (!rawDevice.belongs_to__application) {
 				const { ExpectedError } = await import('../../errors');
 				throw new ExpectedError(stripIndent`
@@ -167,26 +184,35 @@ export default class ConfigGenerateCmd extends Command {
 
 		const deviceType = options.deviceType || resourceDeviceType;
 
-		const deviceManifest = await balena.models.device.getManifestBySlug(
-			deviceType,
-		);
-
 		// Check compatibility if application and deviceType provided
 		if (options.fleet && options.deviceType) {
-			const appDeviceManifest = await balena.models.device.getManifestBySlug(
-				resourceDeviceType,
-			);
-
 			const helpers = await import('../../utils/helpers');
 			if (
-				!helpers.areDeviceTypesCompatible(appDeviceManifest, deviceManifest)
+				!(await helpers.areDeviceTypesCompatible(
+					resourceDeviceType,
+					deviceType,
+				))
 			) {
-				throw new balena.errors.BalenaInvalidDeviceType(
+				const { ExpectedError } = await import('../../errors');
+				throw new ExpectedError(
 					`Device type ${options.deviceType} is incompatible with fleet ${options.fleet}`,
 				);
 			}
 		}
 
+		const deviceManifest = await balena.models.device.getManifestBySlug(
+			deviceType,
+		);
+
+		const { validateSecureBootOptionAndWarn } = await import(
+			'../../utils/config'
+		);
+		await validateSecureBootOptionAndWarn(
+			options.secureBoot,
+			deviceType,
+			options.version,
+		);
+
 		// Prompt for values
 		// Pass params as an override: if there is any param with exactly the same name as a
 		// required option, that value is used (and the corresponding question is not asked)
@@ -195,7 +221,9 @@ export default class ConfigGenerateCmd extends Command {
 		});
 		answers.version = options.version;
 		answers.developmentMode = options.dev;
+		answers.secureBoot = options.secureBoot;
 		answers.provisioningKeyName = options['provisioning-key-name'];
+		answers.provisioningKeyExpiryDate = options['provisioning-key-expiry-date'];
 
 		// Generate config
 		const { generateDeviceConfig, generateApplicationConfig } = await import(

lib/commands/config/inject.ts

@@ -57,7 +57,6 @@ export default class ConfigInjectCmd extends Command {
 	public static usage = 'config inject <file>';
 
 	public static flags: flags.Input<FlagsDef> = {
-		...cf.deviceTypeIgnored,
 		drive: cf.driveOrImg,
 		help: cf.help,
 	};

lib/commands/config/read.ts

@@ -47,7 +47,6 @@ export default class ConfigReadCmd extends Command {
 	public static usage = 'config read';
 
 	public static flags: flags.Input<FlagsDef> = {
-		...cf.deviceTypeIgnored,
 		drive: cf.driveOrImg,
 		help: cf.help,
 		json: cf.json,

lib/commands/config/reconfigure.ts

@@ -50,7 +50,6 @@ export default class ConfigReconfigureCmd extends Command {
 	public static usage = 'config reconfigure';
 
 	public static flags: flags.Input<FlagsDef> = {
-		...cf.deviceTypeIgnored,
 		drive: cf.driveOrImg,
 		advanced: flags.boolean({
 			description: 'show advanced commands',

lib/commands/config/write.ts

@@ -64,7 +64,6 @@ export default class ConfigWriteCmd extends Command {
 	public static usage = 'config write <key> <value>';
 
 	public static flags: flags.Input<FlagsDef> = {
-		...cf.deviceTypeIgnored,
 		drive: cf.driveOrImg,
 		help: cf.help,
 	};

lib/commands/deploy.ts

@@ -16,7 +16,7 @@
  */
 
 import { flags } from '@oclif/command';
-import type { ImageDescriptor } from 'resin-compose-parse';
+import type { ImageDescriptor } from '@balena/compose/dist/parse';
 
 import Command from '../command';
 import { ExpectedError } from '../errors';
@@ -60,6 +60,7 @@ interface FlagsDef extends ComposeCliFlags, DockerCliFlags {
 	nologupload: boolean;
 	'release-tag'?: string[];
 	draft: boolean;
+	note?: string;
 	help: void;
 }
 
@@ -101,6 +102,7 @@ ${dockerignoreHelp}
 	public static examples = [
 		'$ balena deploy myFleet',
 		'$ balena deploy myorg/myfleet --build --source myBuildDir/',
+		'$ balena deploy myorg/myfleet --build --source myBuildDir/ --note "this is the note for this release"',
 		'$ balena deploy myorg/myfleet myRepo/myImage',
 		'$ balena deploy myFleet myRepo/myImage --release-tag key1 "" key2 "value2 with spaces"',
 	];
@@ -114,7 +116,7 @@ ${dockerignoreHelp}
 	];
 
 	public static usage = 'deploy <fleet> [image]';
-	// TODO:  docker-compose naming
+
 	public static flags: flags.Input<FlagsDef> = {
 		source: flags.string({
 			description:
@@ -145,6 +147,7 @@ ${dockerignoreHelp}
 				as final by default unless this option is given.`,
 			default: false,
 		}),
+		note: flags.string({ description: 'The notes for this release' }),
 		...composeCliFlags,
 		...dockerCliFlags,
 		// NOTE: Not supporting -h for help, because of clash with -h in DockerCliFlags
@@ -231,6 +234,9 @@ ${dockerignoreHelp}
 			releaseTagKeys,
 			releaseTagValues,
 		);
+		if (options.note) {
+			await sdk.models.release.note(release.id, options.note);
+		}
 	}
 
 	async deployProject(
@@ -334,7 +340,7 @@ ${dockerignoreHelp}
 			);
 
 			let release: Release | ComposeReleaseInfo['release'];
-			if (appType?.is_legacy) {
+			if (appType.slug === 'legacy-v1' || appType.slug === 'legacy-v2') {
 				const { deployLegacy } = require('../utils/deploy-legacy');
 
 				const msg = getChalk().yellow(

lib/commands/device/identify.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 import { ExpectedError } from '../../errors';
 
 interface FlagsDef {
@@ -43,7 +42,6 @@ export default class DeviceIdentifyCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to identify',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];

lib/commands/device/index.ts

@@ -21,7 +21,6 @@ import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { expandForAppName } from '../../utils/helpers';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 import type { Application, Release } from 'balena-sdk';
 
@@ -44,6 +43,7 @@ interface ExtendedDevice extends DeviceWithDeviceType {
 
 interface FlagsDef {
 	help: void;
+	view: boolean;
 }
 
 interface ArgsDef {
@@ -56,13 +56,15 @@ export default class DeviceCmd extends Command {
 
 		Show information about a single device.
 		`;
-	public static examples = ['$ balena device 7cf02a6'];
+	public static examples = [
+		'$ balena device 7cf02a6',
+		'$ balena device 7cf02a6 --view',
+	];
 
 	public static args: Array<IArg<any>> = [
 		{
 			name: 'uuid',
 			description: 'the device uuid',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];
@@ -71,13 +73,19 @@ export default class DeviceCmd extends Command {
 
 	public static flags: flags.Input<FlagsDef> = {
 		help: cf.help,
+		view: flags.boolean({
+			default: false,
+			description: 'open device dashboard page',
+		}),
 	};
 
 	public static authenticated = true;
 	public static primary = true;
 
 	public async run() {
-		const { args: params } = this.parse<FlagsDef, ArgsDef>(DeviceCmd);
+		const { args: params, flags: options } = this.parse<FlagsDef, ArgsDef>(
+			DeviceCmd,
+		);
 
 		const balena = getBalenaSdk();
 
@@ -108,6 +116,14 @@ export default class DeviceCmd extends Command {
 			],
 			...expandForAppName,
 		})) as ExtendedDevice;
+
+		if (options.view) {
+			const open = await import('open');
+			const dashboardUrl = balena.models.device.getDashboardUrl(device.uuid);
+			await open(dashboardUrl, { wait: false });
+			return;
+		}
+
 		device.status = device.overall_status;
 
 		device.dashboard_url = balena.models.device.getDashboardUrl(device.uuid);

lib/commands/device/init.ts

@@ -31,6 +31,7 @@ interface FlagsDef {
 	config?: string;
 	help: void;
 	'provisioning-key-name'?: string;
+	'provisioning-key-expiry-date'?: string;
 }
 
 export default class DeviceInitCmd extends Command {
@@ -69,6 +70,7 @@ export default class DeviceInitCmd extends Command {
 	public static examples = [
 		'$ balena device init',
 		'$ balena device init -f myorg/myfleet',
+		'$ balena device init --fleet myFleet --os-version 2.101.7 --drive /dev/disk5 --config config.json --yes',
 		'$ balena device init --fleet myFleet --os-version 2.83.21+rev1.prod --drive /dev/disk5 --config config.json --yes',
 	];
 
@@ -97,6 +99,10 @@ export default class DeviceInitCmd extends Command {
 		'provisioning-key-name': flags.string({
 			description: 'custom key name assigned to generated provisioning api key',
 		}),
+		'provisioning-key-expiry-date': flags.string({
+			description:
+				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
+		}),
 		help: cf.help,
 	};
 
@@ -123,7 +129,7 @@ export default class DeviceInitCmd extends Command {
 			options.fleet ||
 				(
 					await (await import('../../utils/patterns')).selectApplication()
-				).id,
+				).slug,
 			{
 				$expand: {
 					is_for__device_type: {
@@ -185,6 +191,14 @@ export default class DeviceInitCmd extends Command {
 				options['provisioning-key-name'],
 			);
 		}
+
+		if (options['provisioning-key-expiry-date']) {
+			configureCommand.push(
+				'--provisioning-key-expiry-date',
+				options['provisioning-key-expiry-date'],
+			);
+		}
+
 		await runCommand(configureCommand);
 	}
 

lib/commands/device/local-mode.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 interface FlagsDef {
 	enable: boolean;
@@ -52,7 +51,6 @@ export default class DeviceLocalModeCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to manage',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];

lib/commands/device/move.ts

@@ -21,6 +21,7 @@ import type {
 	BalenaSDK,
 	Device,
 	DeviceType,
+	PineOptions,
 	PineTypedResult,
 } from 'balena-sdk';
 import Command from '../../command';
@@ -88,17 +89,14 @@ export default class DeviceMoveCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		const { tryAsInteger } = await import('../../utils/validation');
 		const { expandForAppNameAndCpuArch } = await import('../../utils/helpers');
 
-		// Parse ids string into array of correct types
-		const deviceIds: Array<string | number> = params.uuid
-			.split(',')
-			.map((id) => tryAsInteger(id));
+		// Split uuids string into array of uuids
+		const deviceUuids = params.uuid.split(',');
 
 		// Get devices
 		const devices = await Promise.all(
-			deviceIds.map(
+			deviceUuids.map(
 				(uuid) =>
 					balena.models.device.get(
 						uuid,
@@ -115,7 +113,7 @@ export default class DeviceMoveCmd extends Command {
 				: 'N/a';
 		}
 
-		// Disambiguate application (if is a number, it could either be an ID or a numerical name)
+		// Disambiguate application
 		const { getApplication } = await import('../../utils/sdk');
 
 		// Get destination application
@@ -124,7 +122,7 @@ export default class DeviceMoveCmd extends Command {
 			: await this.interactivelySelectApplication(balena, devices);
 
 		// Move each device
-		for (const uuid of deviceIds) {
+		for (const uuid of deviceUuids) {
 			try {
 				await balena.models.device.move(uuid, application.id);
 				console.info(`Device ${uuid} was moved to fleet ${application.slug}`);
@@ -156,7 +154,7 @@ export default class DeviceMoveCmd extends Command {
 					$select: 'slug',
 				},
 			},
-		} as const;
+		} satisfies PineOptions<DeviceType>;
 		const deviceTypes = (await balena.models.deviceType.getAllSupported(
 			deviceTypeOptions,
 		)) as Array<PineTypedResult<DeviceType, typeof deviceTypeOptions>>;

lib/commands/device/os-update.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 import type { Device } from 'balena-sdk';
 import { ExpectedError } from '../../errors';
 
@@ -47,6 +46,7 @@ export default class DeviceOsUpdateCmd extends Command {
 		`;
 	public static examples = [
 		'$ balena device os-update 23c73a1',
+		'$ balena device os-update 23c73a1 --version 2.101.7',
 		'$ balena device os-update 23c73a1 --version 2.31.0+rev1.prod',
 	];
 
@@ -54,7 +54,6 @@ export default class DeviceOsUpdateCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to update',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];

lib/commands/device/pin.ts

@@ -0,0 +1,103 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { getExpandedProp } from '../../utils/pine';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	uuid: string;
+	releaseToPinTo?: string;
+}
+
+export default class DevicePinCmd extends Command {
+	public static description = stripIndent`
+		Pin a device to a release.
+
+		Pin a device to a release.
+
+		Note, if the commit is omitted, the currently pinned release will be printed, with instructions for how to see a list of releases
+		`;
+	public static examples = [
+		'$ balena device pin 7cf02a6',
+		'$ balena device pin 7cf02a6 91165e5',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'uuid',
+			description: 'the uuid of the device to pin to a release',
+			required: true,
+		},
+		{
+			name: 'releaseToPinTo',
+			description: 'the commit of the release for the device to get pinned to',
+		},
+	];
+
+	public static usage = 'device pin <uuid> [releaseToPinTo]';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(DevicePinCmd);
+
+		const balena = getBalenaSdk();
+
+		const device = await balena.models.device.get(params.uuid, {
+			$expand: {
+				should_be_running__release: {
+					$select: 'commit',
+				},
+				belongs_to__application: {
+					$select: 'slug',
+				},
+			},
+		});
+
+		const pinnedRelease = getExpandedProp(
+			device.should_be_running__release,
+			'commit',
+		);
+		const appSlug = getExpandedProp(device.belongs_to__application, 'slug');
+
+		const releaseToPinTo = params.releaseToPinTo;
+
+		if (!releaseToPinTo) {
+			console.log(
+				`${
+					pinnedRelease
+						? `This device is currently pinned to ${pinnedRelease}.`
+						: 'This device is not currently pinned to any release.'
+				} \n\nTo see a list of all releases this device can be pinned to, run \`balena releases ${appSlug}\`.`,
+			);
+		} else {
+			await balena.models.device.pinToRelease(params.uuid, releaseToPinTo);
+		}
+	}
+}

lib/commands/device/public-url.ts

@@ -21,7 +21,6 @@ import Command from '../../command';
 import { ExpectedError } from '../../errors';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 interface FlagsDef {
 	enable: boolean;
@@ -32,8 +31,6 @@ interface FlagsDef {
 
 interface ArgsDef {
 	uuid: string;
-	// Optional hidden arg to support old command format
-	legacyUuid?: string;
 }
 
 export default class DevicePublicUrlCmd extends Command {
@@ -43,9 +40,6 @@ export default class DevicePublicUrlCmd extends Command {
 		This command will output the current public URL for the
 		specified device.  It can also enable or disable the URL,
 		or output the enabled status, using the respective options.
-
-		The old command style 'balena device public-url enable <uuid>'
-		is deprecated, but still supported.
 	`;
 
 	public static examples = [
@@ -59,15 +53,8 @@ export default class DevicePublicUrlCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to manage',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
-		{
-			// Optional hidden arg to support old command format
-			name: 'legacyUuid',
-			parse: (dev) => tryAsInteger(dev),
-			hidden: true,
-		},
 	];
 
 	public static usage = 'device public-url <uuid>';
@@ -95,25 +82,6 @@ export default class DevicePublicUrlCmd extends Command {
 			DevicePublicUrlCmd,
 		);
 
-		// Legacy command format support.
-		// Previously this command used the following format
-		// (changed due to oclif technicalities):
-		//   `balena device public-url enable|disable|status <uuid>`
-		if (params.legacyUuid) {
-			const action = params.uuid;
-			if (!['enable', 'disable', 'status'].includes(action)) {
-				throw new ExpectedError(
-					`Unexpected arguments: ${params.uuid} ${params.legacyUuid}`,
-				);
-			}
-
-			options.enable = action === 'enable';
-			options.disable = action === 'disable';
-			options.status = action === 'status';
-			params.uuid = params.legacyUuid;
-			delete params.legacyUuid;
-		}
-
 		const balena = getBalenaSdk();
 
 		if (options.enable) {

lib/commands/device/purge.ts

@@ -63,17 +63,14 @@ export default class DevicePurgeCmd extends Command {
 	public async run() {
 		const { args: params } = this.parse<FlagsDef, ArgsDef>(DevicePurgeCmd);
 
-		const { tryAsInteger } = await import('../../utils/validation');
 		const balena = getBalenaSdk();
 		const ux = getCliUx();
 
-		const deviceIds = params.uuid.split(',').map((id) => {
-			return tryAsInteger(id);
-		});
+		const deviceUuids = params.uuid.split(',');
 
-		for (const deviceId of deviceIds) {
-			ux.action.start(`Purging data from device ${deviceId}`);
-			await balena.models.device.purge(deviceId);
+		for (const uuid of deviceUuids) {
+			ux.action.start(`Purging data from device ${uuid}`);
+			await balena.models.device.purge(uuid);
 			ux.action.stop();
 		}
 	}

lib/commands/device/reboot.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 interface FlagsDef {
 	force: boolean;
@@ -43,7 +42,6 @@ export default class DeviceRebootCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to reboot',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];

lib/commands/device/register.ts

@@ -25,6 +25,7 @@ import { applicationIdInfo } from '../../utils/messages';
 
 interface FlagsDef {
 	uuid?: string;
+	deviceType?: string;
 	help: void;
 }
 
@@ -47,6 +48,7 @@ export default class DeviceRegisterCmd extends Command {
 		'$ balena device register MyFleet',
 		'$ balena device register MyFleet --uuid <uuid>',
 		'$ balena device register myorg/myfleet --uuid <uuid>',
+		'$ balena device register myorg/myfleet --uuid <uuid> --deviceType <deviceTypeSlug>',
 	];
 
 	public static args: Array<IArg<any>> = [ca.fleetRequired];
@@ -58,6 +60,10 @@ export default class DeviceRegisterCmd extends Command {
 			description: 'custom uuid',
 			char: 'u',
 		}),
+		deviceType: flags.string({
+			description:
+				"device type slug (run 'balena devices supported' for possible values)",
+		}),
 		help: cf.help,
 	};
 
@@ -77,7 +83,11 @@ export default class DeviceRegisterCmd extends Command {
 
 		console.info(`Registering to ${application.slug}: ${uuid}`);
 
-		const result = await balena.models.device.register(application.id, uuid);
+		const result = await balena.models.device.register(
+			application.id,
+			uuid,
+			options.deviceType,
+		);
 
 		return result && result.uuid;
 	}

lib/commands/device/rename.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 interface FlagsDef {
 	help: void;
@@ -48,7 +47,6 @@ export default class DeviceRenameCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to rename',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 		{

lib/commands/device/restart.ts

@@ -82,24 +82,21 @@ export default class DeviceRestartCmd extends Command {
 			DeviceRestartCmd,
 		);
 
-		const { tryAsInteger } = await import('../../utils/validation');
 		const balena = getBalenaSdk();
 		const ux = getCliUx();
 
-		const deviceIds = params.uuid.split(',').map((id) => {
-			return tryAsInteger(id);
-		});
+		const deviceUuids = params.uuid.split(',');
 		const serviceNames = options.service?.split(',');
 
-		// Iterate sequentially through deviceIds.
+		// Iterate sequentially through deviceUuids.
 		// We may later want to add a batching feature,
 		// so that n devices are processed in parallel
-		for (const deviceId of deviceIds) {
-			ux.action.start(`Restarting services on device ${deviceId}`);
+		for (const uuid of deviceUuids) {
+			ux.action.start(`Restarting services on device ${uuid}`);
 			if (serviceNames) {
-				await this.restartServices(balena, deviceId, serviceNames);
+				await this.restartServices(balena, uuid, serviceNames);
 			} else {
-				await this.restartAllServices(balena, deviceId);
+				await this.restartAllServices(balena, uuid);
 			}
 			ux.action.stop();
 		}
@@ -107,7 +104,7 @@ export default class DeviceRestartCmd extends Command {
 
 	async restartServices(
 		balena: BalenaSDK,
-		deviceId: number | string,
+		deviceUuid: string,
 		serviceNames: string[],
 	) {
 		const { ExpectedError, instanceOf } = await import('../../errors');
@@ -116,7 +113,7 @@ export default class DeviceRestartCmd extends Command {
 		// Get device
 		let device: DeviceWithServiceDetails<CurrentServiceWithCommit>;
 		try {
-			device = await balena.models.device.getWithServiceDetails(deviceId, {
+			device = await balena.models.device.getWithServiceDetails(deviceUuid, {
 				$expand: {
 					is_running__release: { $select: 'commit' },
 				},
@@ -124,7 +121,7 @@ export default class DeviceRestartCmd extends Command {
 		} catch (e) {
 			const { BalenaDeviceNotFound } = await import('balena-errors');
 			if (instanceOf(e, BalenaDeviceNotFound)) {
-				throw new ExpectedError(`Device ${deviceId} not found.`);
+				throw new ExpectedError(`Device ${deviceUuid} not found.`);
 			} else {
 				throw e;
 			}
@@ -136,7 +133,7 @@ export default class DeviceRestartCmd extends Command {
 		serviceNames.forEach((service) => {
 			if (!device.current_services[service]) {
 				throw new ExpectedError(
-					`Service ${service} not found on device ${deviceId}.`,
+					`Service ${service} not found on device ${deviceUuid}.`,
 				);
 			}
 		});
@@ -155,7 +152,7 @@ export default class DeviceRestartCmd extends Command {
 			if (serviceContainer) {
 				restartPromises.push(
 					balena.models.device.restartService(
-						deviceId,
+						deviceUuid,
 						serviceContainer.image_id,
 					),
 				);
@@ -166,32 +163,32 @@ export default class DeviceRestartCmd extends Command {
 			await Promise.all(restartPromises);
 		} catch (e) {
 			if (e.message.toLowerCase().includes('no online device')) {
-				throw new ExpectedError(`Device ${deviceId} is not online.`);
+				throw new ExpectedError(`Device ${deviceUuid} is not online.`);
 			} else {
 				throw e;
 			}
 		}
 	}
 
-	async restartAllServices(balena: BalenaSDK, deviceId: number | string) {
+	async restartAllServices(balena: BalenaSDK, deviceUuid: string) {
 		// Note: device.restartApplication throws `BalenaDeviceNotFound: Device not found` if device not online.
 		// Need to use device.get first to distinguish between non-existant and offline devices.
 		// Remove this workaround when SDK issue resolved: https://github.com/balena-io/balena-sdk/issues/649
 		const { instanceOf, ExpectedError } = await import('../../errors');
 		try {
-			const device = await balena.models.device.get(deviceId);
+			const device = await balena.models.device.get(deviceUuid);
 			if (!device.is_online) {
-				throw new ExpectedError(`Device ${deviceId} is not online.`);
+				throw new ExpectedError(`Device ${deviceUuid} is not online.`);
 			}
 		} catch (e) {
 			const { BalenaDeviceNotFound } = await import('balena-errors');
 			if (instanceOf(e, BalenaDeviceNotFound)) {
-				throw new ExpectedError(`Device ${deviceId} not found.`);
+				throw new ExpectedError(`Device ${deviceUuid} not found.`);
 			} else {
 				throw e;
 			}
 		}
 
-		await balena.models.device.restartApplication(deviceId);
+		await balena.models.device.restartApplication(deviceUuid);
 	}
 }

lib/commands/device/rm.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 
 interface FlagsDef {
 	yes: boolean;
@@ -84,7 +83,7 @@ export default class DeviceRmCmd extends Command {
 		// Remove
 		for (const uuid of uuids) {
 			try {
-				await balena.models.device.remove(tryAsInteger(uuid));
+				await balena.models.device.remove(uuid);
 			} catch (err) {
 				console.info(`${err.message}, uuid: ${uuid}`);
 				process.exitCode = 1;

lib/commands/device/shutdown.ts

@@ -20,7 +20,6 @@ import type { IArg } from '@oclif/parser/lib/args';
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent } from '../../utils/lazy';
-import { tryAsInteger } from '../../utils/validation';
 import { ExpectedError } from '../../errors';
 
 interface FlagsDef {
@@ -44,7 +43,6 @@ export default class DeviceShutdownCmd extends Command {
 		{
 			name: 'uuid',
 			description: 'the uuid of the device to shutdown',
-			parse: (dev) => tryAsInteger(dev),
 			required: true,
 		},
 	];

lib/commands/device/track-fleet.ts

@@ -0,0 +1,63 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	uuid: string;
+}
+
+export default class DeviceTrackFleetCmd extends Command {
+	public static description = stripIndent`
+		Make a device track the fleet's pinned release.
+
+		Make a device track the fleet's pinned release.
+		`;
+	public static examples = ['$ balena device track-fleet 7cf02a6'];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'uuid',
+			description: "the uuid of the device to make track the fleet's release",
+			required: true,
+		},
+	];
+
+	public static usage = 'device track-fleet <uuid>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(DeviceTrackFleetCmd);
+
+		const balena = getBalenaSdk();
+
+		await balena.models.device.trackApplicationRelease(params.uuid);
+	}
+}

lib/commands/devices/index.ts

@@ -22,7 +22,7 @@ import { expandForAppName } from '../../utils/helpers';
 import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo, jsonInfo } from '../../utils/messages';
 
-import type { Application } from 'balena-sdk';
+import type { Application, Device, PineOptions } from 'balena-sdk';
 
 interface ExtendedDevice extends DeviceWithDeviceType {
 	dashboard_url?: string;
@@ -36,6 +36,18 @@ interface FlagsDef {
 	json: boolean;
 }
 
+const devicesSelectFields = {
+	$select: [
+		'id',
+		'uuid',
+		'device_name',
+		'status',
+		'is_online',
+		'supervisor_version',
+		'os_version',
+	],
+} satisfies PineOptions<Device>;
+
 export default class DevicesCmd extends Command {
 	public static description = stripIndent`
 		List all devices.
@@ -70,6 +82,7 @@ export default class DevicesCmd extends Command {
 		const { flags: options } = this.parse<FlagsDef, {}>(DevicesCmd);
 
 		const balena = getBalenaSdk();
+		const devicesOptions = { ...devicesSelectFields, ...expandForAppName };
 
 		let devices;
 
@@ -78,11 +91,11 @@ export default class DevicesCmd extends Command {
 			const application = await getApplication(balena, options.fleet);
 			devices = (await balena.models.device.getAllByApplication(
 				application.id,
-				expandForAppName,
+				devicesOptions,
 			)) as ExtendedDevice[];
 		} else {
 			devices = (await balena.models.device.getAll(
-				expandForAppName,
+				devicesOptions,
 			)) as ExtendedDevice[];
 		}
 

lib/commands/devices/supported.ts

@@ -15,6 +15,7 @@
  * limitations under the License.
  */
 import { flags } from '@oclif/command';
+import type * as BalenaSdk from 'balena-sdk';
 import * as _ from 'lodash';
 import Command from '../../command';
 
@@ -59,36 +60,38 @@ export default class DevicesSupportedCmd extends Command {
 
 	public async run() {
 		const { flags: options } = this.parse<FlagsDef, {}>(DevicesSupportedCmd);
-		const [dts, configDTs] = await Promise.all([
-			getBalenaSdk().models.deviceType.getAllSupported({
-				$expand: { is_of__cpu_architecture: { $select: 'slug' } },
-				$select: ['slug', 'name'],
-			}),
-			getBalenaSdk().models.config.getDeviceTypes(),
-		]);
-		const dtsBySlug = _.keyBy(dts, (dt) => dt.slug);
-		const configDTsBySlug = _.keyBy(configDTs, (dt) => dt.slug);
+		const pineOptions = {
+			$select: ['slug', 'name'],
+			$expand: {
+				is_of__cpu_architecture: { $select: 'slug' },
+				device_type_alias: {
+					$select: 'is_referenced_by__alias',
+					$orderby: { is_referenced_by__alias: 'asc' },
+				},
+			},
+		} satisfies BalenaSdk.PineOptions<BalenaSdk.DeviceType>;
+		const dts = (await getBalenaSdk().models.deviceType.getAllSupported(
+			pineOptions,
+		)) as Array<
+			BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>
+		>;
 		interface DT {
 			slug: string;
 			aliases: string[];
 			arch: string;
 			name: string;
 		}
-		let deviceTypes: DT[] = [];
-		for (const slug of Object.keys(dtsBySlug)) {
-			const configDT: Partial<typeof configDTs[0]> =
-				configDTsBySlug[slug] || {};
-			const aliases = (configDT.aliases || []).filter(
-				(alias) => alias !== slug,
-			);
-			const dt: Partial<typeof dts[0]> = dtsBySlug[slug] || {};
-			deviceTypes.push({
-				slug,
+		let deviceTypes = dts.map((dt): DT => {
+			const aliases = dt.device_type_alias
+				.map((dta) => dta.is_referenced_by__alias)
+				.filter((alias) => alias !== dt.slug);
+			return {
+				slug: dt.slug,
 				aliases: options.json ? aliases : [aliases.join(', ')],
-				arch: (dt.is_of__cpu_architecture as any)?.[0]?.slug || 'n/a',
+				arch: dt.is_of__cpu_architecture[0]?.slug || 'n/a',
 				name: dt.name || 'N/A',
-			});
-		}
+			};
+		});
 		const fields = ['slug', 'aliases', 'arch', 'name'];
 		deviceTypes = _.sortBy(deviceTypes, fields);
 		if (options.json) {

lib/commands/fleet/index.ts

@@ -15,19 +15,20 @@
  * limitations under the License.
  */
 
-import type { flags } from '@oclif/command';
+import type { flags as flagsType } from '@oclif/command';
+import { flags } from '@oclif/command';
 import type { Release } from 'balena-sdk';
 
 import Command from '../../command';
 import * as cf from '../../utils/common-flags';
 import * as ca from '../../utils/common-args';
-import { getBalenaSdk, getVisuals, stripIndent } from '../../utils/lazy';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
 import { applicationIdInfo } from '../../utils/messages';
-import { isV14 } from '../../utils/version';
 import type { DataOutputOptions } from '../../framework';
 
 interface FlagsDef extends DataOutputOptions {
 	help: void;
+	view: boolean;
 }
 
 interface ArgsDef {
@@ -45,15 +46,20 @@ export default class FleetCmd extends Command {
 	public static examples = [
 		'$ balena fleet MyFleet',
 		'$ balena fleet myorg/myfleet',
+		'$ balena fleet myorg/myfleet --view',
 	];
 
 	public static args = [ca.fleetRequired];
 
 	public static usage = 'fleet <fleet>';
 
-	public static flags: flags.Input<FlagsDef> = {
+	public static flags: flagsType.Input<FlagsDef> = {
 		help: cf.help,
-		...(isV14() ? cf.dataOutputFlags : {}),
+		view: flags.boolean({
+			default: false,
+			description: 'open fleet dashboard page',
+		}),
+		...cf.dataOutputFlags,
 	};
 
 	public static authenticated = true;
@@ -66,7 +72,9 @@ export default class FleetCmd extends Command {
 
 		const { getApplication } = await import('../../utils/sdk');
 
-		const application = (await getApplication(getBalenaSdk(), params.fleet, {
+		const balena = getBalenaSdk();
+
+		const application = (await getApplication(balena, params.fleet, {
 			$expand: {
 				is_for__device_type: { $select: 'slug' },
 				should_be_running__release: { $select: 'commit' },
@@ -78,26 +86,22 @@ export default class FleetCmd extends Command {
 			commit?: string;
 		};
 
+		if (options.view) {
+			const open = await import('open');
+			const dashboardUrl = balena.models.application.getDashboardUrl(
+				application.id,
+			);
+			await open(dashboardUrl, { wait: false });
+			return;
+		}
+
 		application.device_type = application.is_for__device_type[0].slug;
 		application.commit = application.should_be_running__release[0]?.commit;
 
-		if (isV14()) {
-			await this.outputData(
-				application,
-				['app_name', 'id', 'device_type', 'slug', 'commit'],
-				options,
-			);
-		} else {
-			// Emulate table.vertical title output, but avoid uppercasing and inserting spaces
-			console.log(`== ${application.slug}`);
-			console.log(
-				getVisuals().table.vertical(application, [
-					'id',
-					'device_type',
-					'slug',
-					'commit',
-				]),
-			);
-		}
+		await this.outputData(
+			application,
+			['app_name', 'id', 'device_type', 'slug', 'commit'],
+			options,
+		);
 	}
 }

lib/commands/fleet/pin.ts

@@ -0,0 +1,100 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { getExpandedProp } from '../../utils/pine';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	slug: string;
+	releaseToPinTo?: string;
+}
+
+export default class FleetPinCmd extends Command {
+	public static description = stripIndent`
+		Pin a fleet to a release.
+
+		Pin a fleet to a release.
+
+		Note, if the commit is omitted, the currently pinned release will be printed, with instructions for how to see a list of releases
+		`;
+	public static examples = [
+		'$ balena fleet pin myfleet',
+		'$ balena fleet pin myorg/myfleet 91165e5',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'slug',
+			description: 'the slug of the fleet to pin to a release',
+			required: true,
+		},
+		{
+			name: 'releaseToPinTo',
+			description: 'the commit of the release for the fleet to get pinned to',
+		},
+	];
+
+	public static usage = 'fleet pin <slug> [releaseToPinTo]';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(FleetPinCmd);
+
+		const balena = getBalenaSdk();
+
+		const fleet = await balena.models.application.get(params.slug, {
+			$expand: {
+				should_be_running__release: {
+					$select: 'commit',
+				},
+			},
+		});
+
+		const pinnedRelease = getExpandedProp(
+			fleet.should_be_running__release,
+			'commit',
+		);
+
+		const releaseToPinTo = params.releaseToPinTo;
+		const slug = params.slug;
+
+		if (!releaseToPinTo) {
+			console.log(
+				`${
+					pinnedRelease
+						? `This fleet is currently pinned to ${pinnedRelease}.`
+						: 'This fleet is not currently pinned to any release.'
+				} \n\nTo see a list of all releases this fleet can be pinned to, run \`balena releases ${slug}\`.`,
+			);
+		} else {
+			await balena.models.application.pinToRelease(slug, releaseToPinTo);
+		}
+	}
+}

lib/commands/fleet/rename.ts

@@ -80,7 +80,7 @@ export default class FleetRenameCmd extends Command {
 		const application = await getApplication(balena, params.fleet, {
 			$expand: {
 				application_type: {
-					$select: ['is_legacy'],
+					$select: ['slug'],
 				},
 			},
 		});
@@ -92,7 +92,7 @@ export default class FleetRenameCmd extends Command {
 
 		// Check app supports renaming
 		const appType = (application.application_type as ApplicationType[])?.[0];
-		if (appType.is_legacy) {
+		if (appType.slug === 'legacy-v1' || appType.slug === 'legacy-v2') {
 			throw new ExpectedError(
 				`Fleet ${params.fleet} is of 'legacy' type, and cannot be renamed.`,
 			);

lib/commands/fleet/restart.ts

@@ -62,9 +62,9 @@ export default class FleetRestartCmd extends Command {
 
 		const balena = getBalenaSdk();
 
-		// Disambiguate application (if is a number, it could either be an ID or a numerical name)
+		// Disambiguate application
 		const application = await getApplication(balena, params.fleet);
 
-		await balena.models.application.restart(application.id);
+		await balena.models.application.restart(application.slug);
 	}
 }

lib/commands/fleet/rm.ts

@@ -79,6 +79,6 @@ export default class FleetRmCmd extends Command {
 		const application = await getApplication(balena, params.fleet);
 
 		// Remove
-		await balena.models.application.remove(application.id);
+		await balena.models.application.remove(application.slug);
 	}
 }

lib/commands/fleet/track-latest.ts

@@ -0,0 +1,66 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import type { IArg } from '@oclif/parser/lib/args';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	slug: string;
+}
+
+export default class FleetTrackLatestCmd extends Command {
+	public static description = stripIndent`
+		Make this fleet track the latest release.
+
+		Make this fleet track the latest release.
+		`;
+	public static examples = [
+		'$ balena fleet track-latest myorg/myfleet',
+		'$ balena fleet track-latest myfleet',
+	];
+
+	public static args: Array<IArg<any>> = [
+		{
+			name: 'slug',
+			description: 'the slug of the fleet to make track the latest release',
+			required: true,
+		},
+	];
+
+	public static usage = 'fleet track-latest <slug>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(FleetTrackLatestCmd);
+
+		const balena = getBalenaSdk();
+
+		await balena.models.application.trackLatestRelease(params.slug);
+	}
+}

lib/commands/fleets.ts

@@ -19,8 +19,7 @@ import { flags } from '@oclif/command';
 
 import Command from '../command';
 import * as cf from '../utils/common-flags';
-import { getBalenaSdk, getVisuals, stripIndent } from '../utils/lazy';
-import { isV14 } from '../utils/version';
+import { getBalenaSdk, stripIndent } from '../utils/lazy';
 import type { DataSetOutputOptions } from '../framework';
 
 interface ExtendedApplication extends ApplicationWithDeviceType {
@@ -49,7 +48,7 @@ export default class FleetsCmd extends Command {
 	public static usage = 'fleets';
 
 	public static flags: flags.Input<FlagsDef> = {
-		...(isV14() ? cf.dataSetOutputFlags : {}),
+		...cf.dataSetOutputFlags,
 		help: cf.help,
 	};
 
@@ -79,30 +78,17 @@ export default class FleetsCmd extends Command {
 			application.device_type = application.is_for__device_type[0].slug;
 		});
 
-		if (isV14()) {
-			await this.outputData(
-				applications,
-				[
-					'id',
-					'app_name',
-					'slug',
-					'device_type',
-					'device_count',
-					'online_devices',
-				],
-				options,
-			);
-		} else {
-			console.log(
-				getVisuals().table.horizontal(applications, [
-					'id',
-					'app_name => NAME',
-					'slug',
-					'device_type',
-					'online_devices',
-					'device_count',
-				]),
-			);
-		}
+		await this.outputData(
+			applications,
+			[
+				'id',
+				'app_name',
+				'slug',
+				'device_type',
+				'device_count',
+				'online_devices',
+			],
+			options,
+		);
 	}
 }

lib/commands/os/configure.ts

@@ -23,7 +23,11 @@ import Command from '../../command';
 import { ExpectedError } from '../../errors';
 import * as cf from '../../utils/common-flags';
 import { getBalenaSdk, stripIndent, getCliForm } from '../../utils/lazy';
-import { applicationIdInfo, devModeInfo } from '../../utils/messages';
+import {
+	applicationIdInfo,
+	devModeInfo,
+	secureBootInfo,
+} from '../../utils/messages';
 
 const CONNECTIONS_FOLDER = '/system-connections';
 
@@ -36,6 +40,7 @@ interface FlagsDef {
 	'config-wifi-key'?: string;
 	'config-wifi-ssid'?: string;
 	dev?: boolean; // balenaOS development variant
+	secureBoot?: boolean;
 	device?: string; // device UUID
 	'device-type'?: string;
 	help?: void;
@@ -43,6 +48,7 @@ interface FlagsDef {
 	'system-connection': string[];
 	'initial-device-name'?: string;
 	'provisioning-key-name'?: string;
+	'provisioning-key-expiry-date'?: string;
 }
 
 interface ArgsDef {
@@ -52,12 +58,14 @@ interface ArgsDef {
 interface Answers {
 	appUpdatePollInterval: number; // in minutes
 	developmentMode?: boolean; // balenaOS development variant
+	secureBoot?: boolean;
 	deviceType: string; // e.g. "raspberrypi3"
 	network: 'ethernet' | 'wifi';
 	version: string; // e.g. "2.32.0+rev1"
 	wifiSsid?: string;
 	wifiKey?: string;
 	provisioningKeyName?: string;
+	provisioningKeyExpiryDate?: string;
 }
 
 export default class OsConfigureCmd extends Command {
@@ -78,6 +86,8 @@ export default class OsConfigureCmd extends Command {
 
 		${devModeInfo.split('\n').join('\n\t\t')}
 
+		${secureBootInfo.split('\n').join('\n\t\t')}
+
 		The --system-connection (-c) option is used to inject NetworkManager connection
 		profiles for additional network interfaces, such as cellular/GSM or additional
 		WiFi or ethernet connections. This option may be passed multiple times in case there
@@ -121,7 +131,7 @@ export default class OsConfigureCmd extends Command {
 		config: flags.string({
 			description:
 				'path to a pre-generated config.json file to be injected in the OS image',
-			exclusive: ['provisioning-key-name'],
+			exclusive: ['provisioning-key-name', 'provisioning-key-expiry-date'],
 		}),
 		'config-app-update-poll-interval': flags.integer({
 			description:
@@ -138,7 +148,15 @@ export default class OsConfigureCmd extends Command {
 			description: 'WiFi SSID (network name) (non-interactive configuration)',
 		}),
 		dev: cf.dev,
-		device: { ...cf.device, exclusive: ['fleet', 'provisioning-key-name'] },
+		secureBoot: cf.secureBoot,
+		device: {
+			...cf.device,
+			exclusive: [
+				'fleet',
+				'provisioning-key-name',
+				'provisioning-key-expiry-date',
+			],
+		},
 		'device-type': flags.string({
 			description:
 				'device type slug (e.g. "raspberrypi3") to override the fleet device type',
@@ -161,6 +179,11 @@ export default class OsConfigureCmd extends Command {
 			description: 'custom key name assigned to generated provisioning api key',
 			exclusive: ['config', 'device'],
 		}),
+		'provisioning-key-expiry-date': flags.string({
+			description:
+				'expiry date assigned to generated provisioning api key (format: YYYY-MM-DD)',
+			exclusive: ['config', 'device'],
+		}),
 		help: cf.help,
 	};
 
@@ -201,7 +224,7 @@ export default class OsConfigureCmd extends Command {
 					is_for__device_type: { $select: 'slug' },
 				},
 			})) as ApplicationWithDeviceType;
-			await checkDeviceTypeCompatibility(balena, options, app);
+			await checkDeviceTypeCompatibility(options, app);
 			deviceTypeSlug =
 				options['device-type'] || app.is_for__device_type[0].slug;
 		}
@@ -224,6 +247,15 @@ export default class OsConfigureCmd extends Command {
 		const { validateDevOptionAndWarn } = await import('../../utils/config');
 		await validateDevOptionAndWarn(options.dev, osVersion);
 
+		const { validateSecureBootOptionAndWarn } = await import(
+			'../../utils/config'
+		);
+		await validateSecureBootOptionAndWarn(
+			options.secureBoot,
+			deviceTypeSlug,
+			osVersion,
+		);
+
 		const answers: Answers = await askQuestionsForDeviceType(
 			deviceTypeManifest,
 			options,
@@ -234,7 +266,9 @@ export default class OsConfigureCmd extends Command {
 		}
 		answers.version = osVersion;
 		answers.developmentMode = options.dev;
+		answers.secureBoot = options.secureBoot;
 		answers.provisioningKeyName = options['provisioning-key-name'];
+		answers.provisioningKeyExpiryDate = options['provisioning-key-expiry-date'];
 
 		if (_.isEmpty(configJson)) {
 			if (device) {
@@ -346,17 +380,17 @@ async function getOsVersionFromImage(
  * @param app Balena SDK Application model object
  */
 async function checkDeviceTypeCompatibility(
-	sdk: BalenaSdk.BalenaSDK,
 	options: FlagsDef,
 	app: ApplicationWithDeviceType,
 ) {
 	if (options['device-type']) {
-		const [appDeviceType, optionDeviceType] = await Promise.all([
-			sdk.models.device.getManifestBySlug(app.is_for__device_type[0].slug),
-			sdk.models.device.getManifestBySlug(options['device-type']),
-		]);
 		const helpers = await import('../../utils/helpers');
-		if (!helpers.areDeviceTypesCompatible(appDeviceType, optionDeviceType)) {
+		if (
+			!(await helpers.areDeviceTypesCompatible(
+				app.is_for__device_type[0].slug,
+				options['device-type'],
+			))
+		) {
 			throw new ExpectedError(
 				`Device type ${options['device-type']} is incompatible with fleet ${options.fleet}`,
 			);

lib/commands/os/download.ts

@@ -53,9 +53,11 @@ export default class OsDownloadCmd extends Command {
 `;
 	public static examples = [
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img',
+		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.101.7',
+		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2022.7.0',
+		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version ^2.90.0',
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.60.1+rev1',
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2.60.1+rev1.dev',
-		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version ^2.60.0',
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version 2021.10.2.prod',
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version latest',
 		'$ balena os download raspberrypi3 -o ../foo/bar/raspberry-pi.img --version default',

lib/commands/os/initialize.ts

@@ -42,7 +42,9 @@ export default class OsInitializeCmd extends Command {
 		Initialize an os image for a device.
 
 		Initialize an os image for a device with a previously
-		configured operating system image.
+		configured operating system image and flash the
+		an external storage drive or the device's storage
+		medium depending on the device type.
 		${INIT_WARNING_MESSAGE}
 	`;
 

lib/commands/preload.ts

@@ -187,7 +187,7 @@ Can be repeated to add multiple certificates.\
 			: undefined;
 
 		const progressBars: {
-			[key: string]: ReturnType<typeof getVisuals>['Progress'];
+			[key: string]: InstanceType<ReturnType<typeof getVisuals>['Progress']>;
 		} = {};
 
 		const progressHandler = function (event: {
@@ -201,7 +201,7 @@ Can be repeated to add multiple certificates.\
 		};
 
 		const spinners: {
-			[key: string]: ReturnType<typeof getVisuals>['Spinner'];
+			[key: string]: InstanceType<ReturnType<typeof getVisuals>['Spinner']>;
 		} = {};
 
 		const spinnerHandler = function (event: { name: string; action: string }) {
@@ -288,7 +288,7 @@ Can be repeated to add multiple certificates.\
 				preloader.on('error', reject);
 				resolve(
 					this.prepareAndPreload(preloader, balena, {
-						appId: fleetSlug,
+						slug: fleetSlug,
 						commit,
 						pinDevice,
 					}),
@@ -491,10 +491,10 @@ Would you like to disable automatic updates for this fleet now?\
 		});
 	}
 
-	async getAppWithReleases(balenaSdk: BalenaSDK, appId: string) {
+	async getAppWithReleases(balenaSdk: BalenaSDK, slug: string) {
 		const { getApplication } = await import('../utils/sdk');
 
-		return (await getApplication(balenaSdk, appId, {
+		return (await getApplication(balenaSdk, slug, {
 			$expand: this.applicationExpandOptions,
 		})) as Application & { should_be_running__release: [Release?] };
 	}
@@ -503,15 +503,15 @@ Would you like to disable automatic updates for this fleet now?\
 		preloader: Preloader,
 		balenaSdk: BalenaSDK,
 		options: {
-			appId?: string;
+			slug?: string;
 			commit?: string;
 			pinDevice: boolean;
 		},
 	) {
 		await preloader.prepare();
 
-		const application = options.appId
-			? await this.getAppWithReleases(balenaSdk, options.appId)
+		const application = options.slug
+			? await this.getAppWithReleases(balenaSdk, options.slug)
 			: await this.selectApplication(preloader.config.deviceType);
 
 		let commit: string; // commit hash or the strings 'latest' or 'current'
@@ -523,7 +523,7 @@ Would you like to disable automatic updates for this fleet now?\
 			if (this.isCurrentCommit(options.commit)) {
 				if (!appCommit) {
 					throw new Error(
-						`Unexpected empty commit hash for fleet ID "${application.id}"`,
+						`Unexpected empty commit hash for fleet slug "${application.slug}"`,
 					);
 				}
 				// handle `--commit current` (and its `--commit latest` synonym)

lib/commands/push.ts

@@ -22,7 +22,7 @@ import { getBalenaSdk, stripIndent } from '../utils/lazy';
 import { dockerignoreHelp, registrySecretsHelp } from '../utils/messages';
 import type { BalenaSDK } from 'balena-sdk';
 import { ExpectedError, instanceOf } from '../errors';
-import { RegistrySecrets } from 'resin-multibuild';
+import { RegistrySecrets } from '@balena/compose/dist/multibuild';
 import { lowercaseIfSlug } from '../utils/normalization';
 import {
 	applyReleaseTagKeysAndValues,
@@ -55,6 +55,7 @@ interface FlagsDef {
 	'multi-dockerignore': boolean;
 	'release-tag'?: string[];
 	draft: boolean;
+	note?: string;
 	help: void;
 }
 
@@ -97,6 +98,7 @@ export default class PushCmd extends Command {
 		'$ balena push myFleet',
 		'$ balena push myFleet --source <source directory>',
 		'$ balena push myFleet -s <source directory>',
+		'$ balena push myFleet --source <source directory> --note "this is the note for this release"',
 		'$ balena push myFleet --release-tag key1 "" key2 "value2 with spaces"',
 		'$ balena push myorg/myfleet',
 		'',
@@ -138,7 +140,6 @@ export default class PushCmd extends Command {
 			char: 'e',
 			default: false,
 		}),
-		// TODO:  docker-compose naming
 		dockerfile: flags.string({
 			description:
 				'Alternative Dockerfile name/path, relative to the source folder',
@@ -177,7 +178,7 @@ export default class PushCmd extends Command {
 			description: stripIndent`
 				Don't run a live session on this push. The filesystem will not be monitored,
 				and changes will not be synchronized to any running containers. Note that both
-				this flag and --detached and required to cause the process to end once the
+				this flag and --detached are required to cause the process to end once the
 				initial build has completed.`,
 			default: false,
 		}),
@@ -242,6 +243,7 @@ export default class PushCmd extends Command {
 				as final by default unless this option is given.`,
 			default: false,
 		}),
+		note: flags.string({ description: 'The notes for this release' }),
 		help: cf.help,
 	};
 
@@ -355,6 +357,9 @@ export default class PushCmd extends Command {
 				releaseTagKeys,
 				releaseTagValues,
 			);
+			if (options.note) {
+				await sdk.models.release.note(releaseId, options.note);
+			}
 		} else if (releaseTagKeys.length > 0) {
 			throw new Error(stripIndent`
 				A release ID could not be parsed out of the builder's output.

lib/commands/release/invalidate.ts

@@ -0,0 +1,83 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	commitOrId: string | number;
+}
+
+export default class ReleaseInvalidateCmd extends Command {
+	public static description = stripIndent`
+		Invalidate a release.
+
+		Invalidate a release.
+
+		Invalid releases are not automatically deployed to devices tracking the latest
+		release. For an invalid release to be deployed to a device, the device should be
+		explicity pinned to that release.
+`;
+	public static examples = [
+		'$ balena release invalidate a777f7345fe3d655c1c981aa642e5555',
+		'$ balena release invalidate 1234567',
+	];
+
+	public static usage = 'release invalidate <commitOrId>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static args = [
+		{
+			name: 'commitOrId',
+			description: 'the commit or ID of the release to invalidate',
+			required: true,
+			parse: (commitOrId: string) => tryAsInteger(commitOrId),
+		},
+	];
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(
+			ReleaseInvalidateCmd,
+		);
+
+		const balena = getBalenaSdk();
+
+		const release = await balena.models.release.get(params.commitOrId, {
+			$select: ['id', 'is_invalidated'],
+		});
+
+		if (release.is_invalidated) {
+			console.log(`Release ${params.commitOrId} is already invalidated!`);
+			return;
+		}
+
+		await balena.models.release.setIsInvalidated(release.id, true);
+		console.log(`Release ${params.commitOrId} invalidated`);
+	}
+}

lib/commands/release/validate.ts

@@ -0,0 +1,80 @@
+/**
+ * @license
+ * Copyright 2016-2020 Balena Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { flags } from '@oclif/command';
+import Command from '../../command';
+import * as cf from '../../utils/common-flags';
+import { getBalenaSdk, stripIndent } from '../../utils/lazy';
+import { tryAsInteger } from '../../utils/validation';
+
+interface FlagsDef {
+	help: void;
+}
+
+interface ArgsDef {
+	commitOrId: string | number;
+}
+
+export default class ReleaseValidateCmd extends Command {
+	public static description = stripIndent`
+		Validate a release.
+
+		Validate a release.
+
+		Valid releases are automatically deployed to devices tracking the latest
+		release if they are finalized.
+`;
+	public static examples = [
+		'$ balena release validate a777f7345fe3d655c1c981aa642e5555',
+		'$ balena release validate 1234567',
+	];
+
+	public static usage = 'release validate <commitOrId>';
+
+	public static flags: flags.Input<FlagsDef> = {
+		help: cf.help,
+	};
+
+	public static args = [
+		{
+			name: 'commitOrId',
+			description: 'the commit or ID of the release to validate',
+			required: true,
+			parse: (commitOrId: string) => tryAsInteger(commitOrId),
+		},
+	];
+
+	public static authenticated = true;
+
+	public async run() {
+		const { args: params } = this.parse<FlagsDef, ArgsDef>(ReleaseValidateCmd);
+
+		const balena = getBalenaSdk();
+
+		const release = await balena.models.release.get(params.commitOrId, {
+			$select: ['id', 'is_invalidated'],
+		});
+
+		if (!release.is_invalidated) {
+			console.log(`Release ${params.commitOrId} is already validated!`);
+			return;
+		}
+
+		await balena.models.release.setIsInvalidated(release.id, false);
+		console.log(`Release ${params.commitOrId} validated`);
+	}
+}

lib/commands/scan.ts

@@ -16,7 +16,6 @@
  */
 
 import { flags } from '@oclif/command';
-import type { LocalBalenaOsDevice } from 'balena-sync';
 import Command from '../command';
 import * as cf from '../utils/common-flags';
 import { getCliUx, stripIndent } from '../utils/lazy';
@@ -72,7 +71,7 @@ export default class ScanCmd extends Command {
 
 	public async run() {
 		const _ = await import('lodash');
-		const { discover } = await import('balena-sync');
+		const { discoverLocalBalenaOsDevices } = await import('../utils/discover');
 		const prettyjson = await import('prettyjson');
 		const dockerUtils = await import('../utils/docker');
 
@@ -88,8 +87,7 @@ export default class ScanCmd extends Command {
 		const ux = getCliUx();
 		ux.action.start('Scanning for local balenaOS devices');
 
-		const localDevices: LocalBalenaOsDevice[] =
-			await discover.discoverLocalBalenaOsDevices(discoverTimeout);
+		const localDevices = await discoverLocalBalenaOsDevices(discoverTimeout);
 		const engineReachableDevices: boolean[] = await Promise.all(
 			localDevices.map(async ({ address }: { address: string }) => {
 				const docker = await dockerUtils.createClient({
@@ -106,7 +104,7 @@ export default class ScanCmd extends Command {
 			}),
 		);
 
-		const developmentDevices: LocalBalenaOsDevice[] = localDevices.filter(
+		const developmentDevices = localDevices.filter(
 			(_localDevice, index) => engineReachableDevices[index],
 		);
 
@@ -116,18 +114,15 @@ export default class ScanCmd extends Command {
 			_.isEqual,
 		);
 
-		const productionDevicesInfo = _.map(
-			productionDevices,
-			(device: LocalBalenaOsDevice) => {
-				return {
-					host: device.host,
-					address: device.address,
-					osVariant: 'production',
-					dockerInfo: undefined,
-					dockerVersion: undefined,
-				};
-			},
-		);
+		const productionDevicesInfo = productionDevices.map((device) => {
+			return {
+				host: device.host,
+				address: device.address,
+				osVariant: 'production',
+				dockerInfo: undefined,
+				dockerVersion: undefined,
+			};
+		});
 
 		// Query devices for info
 		const devicesInfo = await Promise.all(

lib/commands/ssh.ts

@@ -76,8 +76,7 @@ export default class SshCmd extends Command {
 	public static args = [
 		{
 			name: 'fleetOrDevice',
-			description:
-				'fleet name/slug/id, device uuid, or address of local device',
+			description: 'fleet name/slug, device uuid, or address of local device',
 			required: true,
 		},
 		{

lib/commands/support.ts

@@ -149,7 +149,7 @@ export default class SupportCmd extends Command {
 			console.log(
 				`Access has been granted for ${duration}, expiring ${new Date(
 					expiryTs,
-				).toLocaleString()}`,
+				).toISOString()}`,
 			);
 		}
 	}

lib/commands/tag/rm.ts

@@ -90,8 +90,6 @@ export default class TagRmCmd extends Command {
 			throw new ExpectedError(TagRmCmd.missingResourceMessage);
 		}
 
-		const { tryAsInteger } = await import('../../utils/validation');
-
 		if (options.fleet) {
 			const { getFleetSlug } = await import('../../utils/sdk');
 			return balena.models.application.tags.remove(
@@ -100,10 +98,7 @@ export default class TagRmCmd extends Command {
 			);
 		}
 		if (options.device) {
-			return balena.models.device.tags.remove(
-				tryAsInteger(options.device),
-				params.tagKey,
-			);
+			return balena.models.device.tags.remove(options.device, params.tagKey);
 		}
 		if (options.release) {
 			const { disambiguateReleaseParam } = await import(

lib/commands/tag/set.ts

@@ -105,8 +105,6 @@ export default class TagSetCmd extends Command {
 
 		params.value ??= '';
 
-		const { tryAsInteger } = await import('../../utils/validation');
-
 		if (options.fleet) {
 			const { getFleetSlug } = await import('../../utils/sdk');
 			return balena.models.application.tags.set(
@@ -117,7 +115,7 @@ export default class TagSetCmd extends Command {
 		}
 		if (options.device) {
 			return balena.models.device.tags.set(
-				tryAsInteger(options.device),
+				options.device,
 				params.tagKey,
 				params.value,
 			);

lib/commands/tags.ts

@@ -76,8 +76,6 @@ export default class TagsCmd extends Command {
 			throw new ExpectedError(this.missingResourceMessage);
 		}
 
-		const { tryAsInteger } = await import('../utils/validation');
-
 		let tags;
 
 		if (options.fleet) {
@@ -87,9 +85,7 @@ export default class TagsCmd extends Command {
 			);
 		}
 		if (options.device) {
-			tags = await balena.models.device.tags.getAllByDevice(
-				tryAsInteger(options.device),
-			);
+			tags = await balena.models.device.tags.getAllByDevice(options.device);
 		}
 		if (options.release) {
 			const { disambiguateReleaseParam } = await import(

lib/commands/tunnel.ts

@@ -82,7 +82,7 @@ export default class TunnelCmd extends Command {
 	public static args = [
 		{
 			name: 'deviceOrFleet',
-			description: 'device UUID or fleet name/slug/ID',
+			description: 'device UUID or fleet name/slug',
 			required: true,
 			parse: lowercaseIfSlug,
 		},
@@ -153,19 +153,19 @@ export default class TunnelCmd extends Command {
 						try {
 							await handler(client);
 							logConnection(
-								client.remoteAddress || '',
-								client.remotePort || 0,
-								client.localAddress,
-								client.localPort,
+								client.remoteAddress ?? '',
+								client.remotePort ?? 0,
+								client.localAddress ?? '',
+								client.localPort ?? 0,
 								uuid,
 								remotePort,
 							);
 						} catch (err) {
 							logConnection(
-								client.remoteAddress || '',
-								client.remotePort || 0,
-								client.localAddress,
-								client.localPort,
+								client.remoteAddress ?? '',
+								client.remotePort ?? 0,
+								client.localAddress ?? '',
+								client.localPort ?? 0,
 								uuid,
 								remotePort,
 								err,

lib/deprecation.ts

@@ -86,7 +86,7 @@ export class DeprecationChecker {
 	 * @param version Semver without 'v' prefix, e.g. '12.0.0.'
 	 */
 	protected getNpmUrl(version: string) {
-		return `http://registry.npmjs.org/balena-cli/${version}`;
+		return `https://registry.npmjs.org/balena-cli/${version}`;
 	}
 
 	/**

lib/errors.ts

@@ -177,7 +177,16 @@ const messages: {
 		Looks like the session token has expired.
 		Try logging in again with the "balena login" command.`,
 
-	BalenaInvalidDeviceType: (error: Error & { deviceTypeSlug?: string }) => {
+	BalenaInvalidDeviceType: (
+		error: Error & { deviceTypeSlug?: string; type?: string },
+	) => {
+		// TODO: The SDK should be throwing a different Error for this case.
+		if (
+			typeof error.type === 'string' &&
+			error.type.startsWith('Incompatible ')
+		) {
+			return error.type;
+		}
 		const slug = error.deviceTypeSlug ? `"${error.deviceTypeSlug}"` : 'slug';
 		return stripIndent`
 			Device type ${slug} not recognized. Perhaps misspelled?

lib/events.ts

@@ -24,7 +24,7 @@ import { stripIndent } from './utils/lazy';
  * @param commandSignature A string like, for example:
  *      "push <fleetOrDevice>"
  * That's literally so: "fleetOrDevice" is NOT replaced with the actual
- * fleet ID or device ID. The purpose is to find out the most / least
+ * fleet slug or device uuid. The purpose is to find out the most / least
  * used command verbs, so we can focus our development effort where it is most
  * beneficial to end users.
  *
@@ -73,38 +73,52 @@ export async function trackCommand(commandSignature: string) {
 	}
 }
 
+const TIMEOUT = 4000;
+
 /**
  * Make the event tracking HTTPS request to balenaCloud's '/mixpanel' endpoint.
  */
 async function sendEvent(balenaUrl: string, event: string, username?: string) {
 	const { default: got } = await import('got');
 	const trackData = {
-		event,
-		properties: {
-			arch: process.arch,
-			balenaUrl, // e.g. 'balena-cloud.com' or 'balena-staging.com'
-			distinct_id: username,
-			mp_lib: 'node',
-			node: process.version,
-			platform: process.platform,
-			token: 'balena-main',
-			version: packageJSON.version,
-		},
-	};
-	const url = `https://api.${balenaUrl}/mixpanel/track`;
-	const searchParams = {
-		ip: 0,
-		verbose: 0,
-		data: Buffer.from(JSON.stringify(trackData)).toString('base64'),
+		api_key: 'balena-main',
+		events: [
+			{
+				event_type: event,
+				user_id: username,
+				version_name: packageJSON.version,
+				event_properties: {
+					balenaUrl, // e.g. 'balena-cloud.com' or 'balena-staging.com'
+					arch: process.arch,
+					platform: process.platform,
+					node: process.version,
+				},
+			},
+		],
 	};
+	const url = `https://data.${balenaUrl}/amplitude/2/httpapi`;
+
 	try {
-		await got(url, { searchParams, retry: 0, timeout: 4000 });
+		await got.post(url, {
+			json: trackData,
+			retry: 0,
+			timeout: {
+				// Starts when the request is initiated.
+				request: TIMEOUT,
+				// Starts when request has been flushed.
+				// Exits the request as soon as it's sent.
+				response: 0,
+			},
+		});
 	} catch (e) {
 		if (process.env.DEBUG) {
 			console.error(`[debug] Event tracking error: ${e.message || e}`);
 		}
 
-		if (e instanceof got.TimeoutError) {
+		if (
+			e instanceof got.TimeoutError &&
+			TIMEOUT < (e.timings.phases.total ?? 0)
+		) {
 			console.error(stripIndent`
 				Timeout submitting analytics event to balenaCloud/openBalena.
 				If you are using the balena CLI in an air-gapped environment with a filtered

lib/help.ts

@@ -91,7 +91,7 @@ export default class BalenaHelp extends Help {
 			.map((pc) => {
 				return commands.find((c) => c.id === pc.replace(' ', ':'));
 			})
-			.filter((c): c is typeof commands[0] => !!c);
+			.filter((c): c is (typeof commands)[0] => !!c);
 
 		let usageLength = 0;
 		for (const cmd of primaryCommands) {

lib/utils/cloud.ts

@@ -107,16 +107,6 @@ export const getDeviceAndMaybeAppFromUUID = _.memoize(
 	(_sdk, deviceUUID) => deviceUUID,
 );
 
-/** Given a device type alias like 'nuc', return the actual slug like 'intel-nuc'. */
-export const unaliasDeviceType = _.memoize(async function (
-	sdk: SDK.BalenaSDK,
-	deviceType: string,
-): Promise<string> {
-	return (
-		(await sdk.models.device.getManifestBySlug(deviceType)).slug || deviceType
-	);
-});
-
 /**
  * Download balenaOS image for the specified `deviceType`.
  * `OSVersion` may be one of:
@@ -255,8 +245,8 @@ export async function getOsVersions(
 	);
 	// if slug is an alias, fetch the real slug
 	if (!versions.length) {
-		// unaliasDeviceType() produces a nice error msg if slug is invalid
-		slug = await unaliasDeviceType(sdk, slug);
+		// unalias device type slug
+		slug = (await sdk.models.deviceType.get(slug, { $select: 'slug' })).slug;
 		if (slug !== deviceType) {
 			versions = await sdk.models.os.getAvailableOsVersions(slug);
 		}

lib/utils/common-args.ts

@@ -18,7 +18,7 @@ import { lowercaseIfSlug } from './normalization';
 
 export const fleetRequired = {
 	name: 'fleet',
-	description: 'fleet name, slug (preferred), or numeric ID (deprecated)',
+	description: 'fleet name or slug (preferred)',
 	required: true,
 	parse: lowercaseIfSlug,
 };

lib/utils/common-flags.ts

@@ -19,13 +19,12 @@ import { flags } from '@oclif/command';
 import { stripIndent } from './lazy';
 import { lowercaseIfSlug } from './normalization';
 
-import { isV14 } from './version';
 import type { IBooleanFlag } from '@oclif/parser/lib/flags';
 import type { DataOutputOptions, DataSetOutputOptions } from '../framework';
 
 export const fleet = flags.string({
 	char: 'f',
-	description: 'fleet name, slug (preferred), or numeric ID (deprecated)',
+	description: 'fleet name or slug (preferred)',
 	parse: lowercaseIfSlug,
 });
 
@@ -75,6 +74,12 @@ export const dev: IBooleanFlag<boolean> = flags.boolean({
 	default: false,
 });
 
+export const secureBoot: IBooleanFlag<boolean> = flags.boolean({
+	description:
+		'Configure balenaOS installer to opt-in secure boot and disk encryption',
+	default: false,
+});
+
 export const drive = flags.string({
 	char: 'd',
 	description: stripIndent`
@@ -97,19 +102,6 @@ export const deviceType = flags.string({
 	required: true,
 });
 
-export const deviceTypeIgnored = {
-	...(isV14()
-		? {}
-		: {
-				type: flags.string({
-					description: 'ignored - no longer required',
-					char: 't',
-					required: false,
-					hidden: true,
-				}),
-		  }),
-};
-
 export const json: IBooleanFlag<boolean> = flags.boolean({
 	char: 'j',
 	description: 'produce JSON output instead of tabular output',

lib/utils/compose-types.d.ts

@@ -15,8 +15,11 @@
  * limitations under the License.
  */
 
-import type { ImageModel, ReleaseModel } from 'balena-release/build/models';
-import type { Composition, ImageDescriptor } from 'resin-compose-parse';
+import type {
+	ImageModel,
+	ReleaseModel,
+} from '@balena/compose/dist/release/models';
+import type { Composition, ImageDescriptor } from '@balena/compose/dist/parse';
 import type { Pack } from 'tar-stream';
 
 interface Image {
@@ -39,7 +42,7 @@ export interface BuiltImage {
 
 export interface TaggedImage {
 	localImage: import('dockerode').Image;
-	serviceImage: import('balena-release/build/models').ImageModel;
+	serviceImage: import('@balena/compose/dist/release/models').ImageModel;
 	serviceName: string;
 	logs: string;
 	props: BuiltImage.props;
@@ -61,8 +64,6 @@ export interface ComposeOpts {
 export interface ComposeCliFlags {
 	emulated: boolean;
 	dockerfile?: string;
-	dockercompose?: string;
-	logs: boolean;
 	nologs: boolean;
 	'multi-dockerignore': boolean;
 	'noparent-check': boolean;
@@ -79,7 +80,9 @@ export interface ComposeProject {
 }
 
 export interface Release {
-	client: ReturnType<typeof import('balena-release').createClient>;
+	client: ReturnType<
+		typeof import('@balena/compose/dist/release').createClient
+	>;
 	release: Pick<
 		ReleaseModel,
 		| 'id'

lib/utils/compose.ts

@@ -19,7 +19,7 @@ import type { Renderer } from './compose_ts';
 import type * as SDK from 'balena-sdk';
 import type Dockerode = require('dockerode');
 import * as path from 'path';
-import type { Composition, ImageDescriptor } from 'resin-compose-parse';
+import type { Composition, ImageDescriptor } from '@balena/compose/dist/parse';
 import type {
 	BuiltImage,
 	ComposeOpts,
@@ -64,7 +64,7 @@ export function createProject(
 ): ComposeProject {
 	const yml = require('js-yaml') as typeof import('js-yaml');
 	const compose =
-		require('resin-compose-parse') as typeof import('resin-compose-parse');
+		require('@balena/compose/dist/parse') as typeof import('@balena/compose/dist/parse');
 
 	// both methods below may throw.
 	const rawComposition = yml.load(composeStr);
@@ -107,7 +107,7 @@ export const createRelease = async function (
 	const _ = require('lodash') as typeof import('lodash');
 	const crypto = require('crypto') as typeof import('crypto');
 	const releaseMod =
-		require('balena-release') as typeof import('balena-release');
+		require('@balena/compose/dist/release') as typeof import('@balena/compose/dist/release');
 
 	const client = releaseMod.createClient({ apiEndpoint, auth });
 
@@ -214,7 +214,7 @@ export const getPreviousRepos = (
 					image: [SDK.Image];
 				}>;
 				const { getRegistryAndName } =
-					require('resin-multibuild') as typeof import('resin-multibuild');
+					require('@balena/compose/dist/multibuild') as typeof import('@balena/compose/dist/multibuild');
 				return Promise.all(
 					images.map(function (d) {
 						const imageName = d.image[0].is_stored_at__image_location || '';

lib/utils/compose_ts.ts

@@ -16,7 +16,7 @@
  */
 import { flags } from '@oclif/command';
 import { BalenaSDK } from 'balena-sdk';
-import type { TransposeOptions } from 'docker-qemu-transpose';
+import type { TransposeOptions } from '@balena/compose/dist/emulate';
 import type * as Dockerode from 'dockerode';
 import { promises as fs } from 'fs';
 import jsyaml = require('js-yaml');
@@ -26,8 +26,8 @@ import type {
 	BuildConfig,
 	Composition,
 	ImageDescriptor,
-} from 'resin-compose-parse';
-import type * as MultiBuild from 'resin-multibuild';
+} from '@balena/compose/dist/parse';
+import type * as MultiBuild from '@balena/compose/dist/multibuild';
 import * as semver from 'semver';
 import type { Duplex, Readable } from 'stream';
 import type { Pack } from 'tar-stream';
@@ -118,7 +118,7 @@ export async function loadProject(
 	image?: string,
 	imageTag?: string,
 ): Promise<ComposeProject> {
-	const compose = await import('resin-compose-parse');
+	const compose = await import('@balena/compose/dist/parse');
 	const { createProject } = await import('./compose');
 	let composeName: string;
 	let composeStr: string;
@@ -262,7 +262,7 @@ export async function buildProject(
 	opts: BuildProjectOpts,
 ): Promise<BuiltImage[]> {
 	await checkBuildSecretsRequirements(opts.docker, opts.projectPath);
-	const compose = await import('resin-compose-parse');
+	const compose = await import('@balena/compose/dist/parse');
 	const imageDescriptors = compose.parse(opts.composition);
 	const renderer = await startRenderer({ imageDescriptors, ...opts });
 	let buildSummaryByService: Dictionary<string> | undefined;
@@ -333,7 +333,7 @@ async function $buildProject(
 	logger.logDebug('Prepared tasks; building...');
 
 	const { BALENA_ENGINE_TMP_PATH } = await import('../config');
-	const builder = await import('resin-multibuild');
+	const builder = await import('@balena/compose/dist/multibuild');
 
 	const builtImages = await builder.performBuilds(
 		tasks,
@@ -481,8 +481,9 @@ async function qemuTransposeBuildStream({
 		throw new Error(`No buildStream for task '${task.tag}'`);
 	}
 
-	const transpose = await import('docker-qemu-transpose');
-	const { toPosixPath } = (await import('resin-multibuild')).PathUtils;
+	const transpose = await import('@balena/compose/dist/emulate');
+	const { toPosixPath } = (await import('@balena/compose/dist/multibuild'))
+		.PathUtils;
 
 	const transposeOptions: TransposeOptions = {
 		hostQemuPath: toPosixPath(binPath),
@@ -508,9 +509,9 @@ async function setTaskProgressHooks({
 	inlineLogs?: boolean;
 	renderer: Renderer;
 	task: BuildTaskPlus;
-	transposeOptions?: import('docker-qemu-transpose').TransposeOptions;
+	transposeOptions?: import('@balena/compose/dist/emulate').TransposeOptions;
 }) {
-	const transpose = await import('docker-qemu-transpose');
+	const transpose = await import('@balena/compose/dist/emulate');
 	// Get the service-specific log stream
 	const logStream = renderer.streams[task.serviceName];
 	task.logBuffer = [];
@@ -724,16 +725,16 @@ export async function getServiceDirsFromComposition(
  *
  * The `image` argument may therefore refer to either a `build` or `image` property
  * of a service in a docker-compose.yml file, which is a bit confusing but it matches
- * the `ImageDescriptor.image` property as defined by `resin-compose-parse`.
+ * the `ImageDescriptor.image` property as defined by `@balena/compose/parse`.
  *
- * Note that `resin-compose-parse` "normalizes" the docker-compose.yml file such
+ * Note that `@balena/compose/parse` "normalizes" the docker-compose.yml file such
  * that, if `services.service.build` is a string, it is converted to a BuildConfig
  * object with the string value assigned to `services.service.build.context`:
- * https://github.com/balena-io-modules/resin-compose-parse/blob/v2.1.3/src/compose.ts#L166-L167
+ * https://github.com/balena-io-modules/balena-compose/blob/v0.1.0/lib/parse/compose.ts#L166-L167
  * This is why this implementation works when `services.service.build` is defined
  * as a string in the docker-compose.yml file.
  *
- * @param image The `ImageDescriptor.image` attribute parsed with `resin-compose-parse`
+ * @param image The `ImageDescriptor.image` attribute parsed with `@balena/compose/parse`
  */
 export function isBuildConfig(
 	image: string | BuildConfig,
@@ -759,7 +760,8 @@ export async function tarDirectory(
 	}: TarDirectoryOptions,
 ): Promise<import('stream').Readable> {
 	const { filterFilesWithDockerignore } = await import('./ignore');
-	const { toPosixPath } = (await import('resin-multibuild')).PathUtils;
+	const { toPosixPath } = (await import('@balena/compose/dist/multibuild'))
+		.PathUtils;
 
 	let readFile: (file: string) => Promise<Buffer>;
 	if (process.platform === 'win32') {
@@ -941,7 +943,7 @@ async function parseRegistrySecrets(
 			throw new ExpectedError('Filename must end with .json, .yml or .yaml');
 		}
 		const raw = (await fs.readFile(secretsFilename)).toString();
-		const multiBuild = await import('resin-multibuild');
+		const multiBuild = await import('@balena/compose/dist/multibuild');
 		const registrySecrets =
 			new multiBuild.RegistrySecretValidator().validateRegistrySecrets(
 				isYaml ? require('js-yaml').load(raw) : JSON.parse(raw),
@@ -970,7 +972,7 @@ export async function makeBuildTasks(
 	releaseHash: string = 'unavailable',
 	preprocessHook?: (dockerfile: string) => string,
 ): Promise<MultiBuild.BuildTask[]> {
-	const multiBuild = await import('resin-multibuild');
+	const multiBuild = await import('@balena/compose/dist/multibuild');
 	const buildTasks = await multiBuild.splitBuildStream(composition, tarStream);
 
 	logger.logDebug('Found build tasks:');
@@ -1016,7 +1018,7 @@ async function performResolution(
 	releaseHash: string,
 	preprocessHook?: (dockerfile: string) => string,
 ): Promise<MultiBuild.BuildTask[]> {
-	const multiBuild = await import('resin-multibuild');
+	const multiBuild = await import('@balena/compose/dist/multibuild');
 	const resolveListeners: MultiBuild.ResolveListeners = {};
 	const resolvePromise = new Promise<never>((_resolve, reject) => {
 		resolveListeners.error = [reject];
@@ -1081,7 +1083,7 @@ async function validateSpecifiedDockerfile(
 	dockerfilePath: string,
 ): Promise<string> {
 	const { contains, toNativePath, toPosixPath } = (
-		await import('resin-multibuild')
+		await import('@balena/compose/dist/multibuild')
 	).PathUtils;
 
 	const nativeProjectPath = path.normalize(projectPath);
@@ -1241,7 +1243,7 @@ async function pushAndUpdateServiceImages(
 	token: string,
 	images: TaggedImage[],
 	afterEach: (
-		serviceImage: import('balena-release/build/models').ImageModel,
+		serviceImage: import('@balena/compose/dist/release/models').ImageModel,
 		props: object,
 	) => void,
 ) {
@@ -1326,12 +1328,14 @@ async function pushAndUpdateServiceImages(
 async function pushServiceImages(
 	docker: Dockerode,
 	logger: Logger,
-	pineClient: ReturnType<typeof import('balena-release').createClient>,
+	pineClient: ReturnType<
+		typeof import('@balena/compose/dist/release').createClient
+	>,
 	taggedImages: TaggedImage[],
 	token: string,
 	skipLogUpload: boolean,
 ): Promise<void> {
-	const releaseMod = await import('balena-release');
+	const releaseMod = await import('@balena/compose/dist/release');
 	logger.logInfo('Pushing images to registry...');
 	await pushAndUpdateServiceImages(
 		docker,
@@ -1361,8 +1365,8 @@ export async function deployProject(
 	skipLogUpload: boolean,
 	projectPath: string,
 	isDraft: boolean,
-): Promise<import('balena-release/build/models').ReleaseModel> {
-	const releaseMod = await import('balena-release');
+): Promise<import('@balena/compose/dist/release/models').ReleaseModel> {
+	const releaseMod = await import('@balena/compose/dist/release');
 	const { createRelease, tagServiceImages } = await import('./compose');
 	const tty = (await import('./tty'))(process.stdout);
 
@@ -1639,7 +1643,6 @@ function truncateString(str: string, len: number): string {
 	return str.slice(0, str.lastIndexOf('\n'));
 }
 
-// TODO:  docker-compose naming
 export const composeCliFlags: flags.Input<ComposeCliFlags> = {
 	emulated: flags.boolean({
 		description:
@@ -1650,14 +1653,6 @@ export const composeCliFlags: flags.Input<ComposeCliFlags> = {
 		description:
 			'Alternative Dockerfile name/path, relative to the source folder',
 	}),
-	dockercompose: flags.string({
-		description:
-			'Alternative docker-compose.yml name in the source root folder',
-	}),
-	logs: flags.boolean({
-		description:
-			'No-op and deprecated since balena CLI v12.0.0. Build logs are now shown by default.',
-	}),
 	nologs: flags.boolean({
 		description:
 			'Hide the image build log output (produce less verbose output)',

lib/utils/config.ts

@@ -52,6 +52,10 @@ export interface ImgConfig {
 	os?: {
 		sshKeys?: string[];
 	};
+
+	installer?: {
+		secureboot?: boolean;
+	};
 }
 
 export async function generateApplicationConfig(
@@ -63,6 +67,7 @@ export async function generateApplicationConfig(
 		os?: {
 			sshKeys?: string[];
 		};
+		secureBoot?: boolean;
 	},
 ): Promise<ImgConfig> {
 	options = {
@@ -84,6 +89,12 @@ export async function generateApplicationConfig(
 			: options.os.sshKeys;
 	}
 
+	// configure installer secure boot opt-in if specified
+	if (options.secureBoot) {
+		config.installer ??= {};
+		config.installer.secureboot = options.secureBoot;
+	}
+
 	return config;
 }
 
@@ -165,3 +176,62 @@ export async function validateDevOptionAndWarn(
 		and exposes network ports such as 2375 that allows unencrypted access to balenaEngine.
 		Therefore, development mode should only be used in private, trusted local networks.`);
 }
+
+/**
+ * Chech whether the `--secureBoot` option of commands related to OS configuration
+ * such as `os configure` and `config generate` is compatible with a given
+ * OS release, and print a warning regarding the consequences of using that
+ * option.
+ */
+export async function validateSecureBootOptionAndWarn(
+	secureBoot?: boolean,
+	slug?: string,
+	version?: string,
+	logger?: import('./logger'),
+) {
+	if (!secureBoot) {
+		return;
+	}
+	const { ExpectedError } = await import('../errors');
+	if (!version) {
+		throw new ExpectedError(`Error: No version provided`);
+	}
+	if (!slug) {
+		throw new ExpectedError(`Error: No device type provided`);
+	}
+	const sdk = getBalenaSdk();
+	const releasePineOpts = {
+		$select: 'contract',
+		$filter: { raw_version: `${version.replace(/^v/, '')}` },
+	} satisfies BalenaSdk.PineOptions<BalenaSdk.Release>;
+	// TODO: Remove the added type casting when the SDK returns the fully typed result
+	const [osRelease] = (await sdk.models.os.getAllOsVersions(
+		slug,
+		releasePineOpts,
+	)) as Array<
+		BalenaSdk.OsVersion &
+			BalenaSdk.PineTypedResult<BalenaSdk.Release, typeof releasePineOpts>
+	>;
+	if (!osRelease) {
+		throw new ExpectedError(`Error: No ${version} release for ${slug}`);
+	}
+
+	const contract = osRelease.contract ? JSON.parse(osRelease.contract) : null;
+	if (
+		contract?.provides.some((entry: Dictionary<string>) => {
+			return entry.type === 'sw.feature' && entry.slug === 'secureboot';
+		})
+	) {
+		if (!logger) {
+			const Logger = await import('./logger');
+			logger = Logger.getLogger();
+		}
+		logger.logInfo(stripIndent`
+			The '--secureBoot' option is being used to configure a balenaOS installer image
+			into secure boot and full disk encryption.`);
+	} else {
+		throw new ExpectedError(
+			`Error: The '--secureBoot' option is not supported for ${slug} in ${version}`,
+		);
+	}
+}

lib/utils/device/deploy.ts

@@ -18,13 +18,13 @@
 import * as semver from 'balena-semver';
 import * as Docker from 'dockerode';
 import * as _ from 'lodash';
-import { Composition } from 'resin-compose-parse';
+import { Composition } from '@balena/compose/dist/parse';
 import {
 	BuildTask,
 	getAuthConfigObj,
 	LocalImage,
 	RegistrySecrets,
-} from 'resin-multibuild';
+} from '@balena/compose/dist/multibuild';
 import type { Readable } from 'stream';
 
 import { BALENA_ENGINE_TMP_PATH } from '../../config';
@@ -44,7 +44,7 @@ import { displayBuildLog } from './logs';
 import { stripIndent } from '../lazy';
 
 const LOCAL_APPNAME = 'localapp';
-const LOCAL_RELEASEHASH = 'localrelease';
+const LOCAL_RELEASEHASH = '10ca12e1ea5e';
 const LOCAL_PROJECT_NAME = 'local_image';
 
 // Define the logger here so the debug output
@@ -209,9 +209,9 @@ export async function deployToDevice(opts: DeviceDeployOptions): Promise<void> {
 	globalLogger.logDebug('Fetching device information...');
 	const deviceInfo = await api.getDeviceInformation();
 
-	let buildLogs: Dictionary<string> | undefined;
+	let imageIds: Dictionary<string[]> | undefined;
 	if (!opts.nolive) {
-		buildLogs = {};
+		imageIds = {};
 	}
 
 	const { awaitInterruptibleTask } = await import('../helpers');
@@ -223,7 +223,7 @@ export async function deployToDevice(opts: DeviceDeployOptions): Promise<void> {
 		deviceInfo,
 		globalLogger,
 		opts,
-		buildLogs,
+		imageIds,
 	);
 
 	globalLogger.outputDeferredMessages();
@@ -265,7 +265,7 @@ export async function deployToDevice(opts: DeviceDeployOptions): Promise<void> {
 			docker,
 			logger: globalLogger,
 			composition: project.composition,
-			buildLogs: buildLogs!,
+			imageIds: imageIds!,
 			deployOpts: opts,
 		});
 		promises.push(livepush.init());
@@ -312,6 +312,14 @@ function connectToDocker(host: string, port: number): Docker {
 	});
 }
 
+function extractDockerArrowMessage(outputLine: string): string | undefined {
+	const arrowTest = /^.*\s*-+>\s*(.+)/i;
+	const match = arrowTest.exec(outputLine);
+	if (match != null) {
+		return match[1];
+	}
+}
+
 async function performBuilds(
 	composition: Composition,
 	tarStream: Readable,
@@ -319,9 +327,9 @@ async function performBuilds(
 	deviceInfo: DeviceInfo,
 	logger: Logger,
 	opts: DeviceDeployOptions,
-	buildLogs?: Dictionary<string>,
+	imageIds?: Dictionary<string[]>,
 ): Promise<BuildTask[]> {
-	const multibuild = await import('resin-multibuild');
+	const multibuild = await import('@balena/compose/dist/multibuild');
 
 	const buildTasks = await makeBuildTasks(
 		composition,
@@ -345,14 +353,29 @@ async function performBuilds(
 	// If we're passed a build logs object make sure to set it
 	// up properly
 	let logHandlers: ((serviceName: string, line: string) => void) | undefined;
-	if (buildLogs != null) {
+
+	const lastArrowMessage: Dictionary<string> = {};
+
+	if (imageIds != null) {
 		for (const task of buildTasks) {
 			if (!task.external) {
-				buildLogs[task.serviceName] = '';
+				imageIds[task.serviceName] = [];
 			}
 		}
 		logHandlers = (serviceName: string, line: string) => {
-			buildLogs[serviceName] += `${line}\n`;
+			// If this was a from line, take the last found
+			// image id and save it
+			if (
+				/step \d+(?:\/\d+)?\s*:\s*FROM/i.test(line) &&
+				lastArrowMessage[serviceName] != null
+			) {
+				imageIds[serviceName].push(lastArrowMessage[serviceName]);
+			} else {
+				const msg = extractDockerArrowMessage(line);
+				if (msg != null) {
+					lastArrowMessage[serviceName] = msg;
+				}
+			}
 		};
 	}
 
@@ -370,7 +393,7 @@ async function performBuilds(
 	const imagesToRemove: string[] = [];
 
 	// Now tag any external images with the correct name that they should be,
-	// as this won't be done by resin-multibuild
+	// as this won't be done by @balena/compose/multibuild
 	await Promise.all(
 		localImages.map(async (localImage) => {
 			if (localImage.external) {
@@ -413,12 +436,26 @@ export async function rebuildSingleTask(
 	// the logs, so any calller who wants to keep track of
 	// this should provide the following callback
 	containerIdCb?: (id: string) => void,
-): Promise<string> {
-	const multibuild = await import('resin-multibuild');
+): Promise<string[]> {
+	const multibuild = await import('@balena/compose/dist/multibuild');
 	// First we run the build task, to get the new image id
-	let buildLogs = '';
+	const stageIds = [] as string[];
+	let lastArrowMessage: string | undefined;
+
 	const logHandler = (_s: string, line: string) => {
-		buildLogs += `${line}\n`;
+		// If this was a FROM line, take the last found
+		// image id and save it as a stage id
+		if (
+			/step \d+(?:\/\d+)?\s*:\s*FROM/i.test(line) &&
+			lastArrowMessage != null
+		) {
+			stageIds.push(lastArrowMessage);
+		} else {
+			const msg = extractDockerArrowMessage(line);
+			if (msg != null) {
+				lastArrowMessage = msg;
+			}
+		}
 
 		if (containerIdCb != null) {
 			const match = line.match(/^\s*--->\s*Running\s*in\s*([a-f0-9]*)\s*$/i);
@@ -477,7 +514,7 @@ export async function rebuildSingleTask(
 		]);
 	}
 
-	return buildLogs;
+	return stageIds;
 }
 
 function assignOutputHandlers(
@@ -533,10 +570,17 @@ async function assignDockerBuildOpts(
 	await Promise.all(
 		buildTasks.map(async (task: BuildTask) => {
 			task.dockerOpts = {
-				cachefrom: images,
-				labels: {
-					'io.resin.local.image': '1',
-					'io.resin.local.service': task.serviceName,
+				...(task.dockerOpts || {}),
+				...{
+					cachefrom: images,
+					labels: {
+						'io.resin.local.image': '1',
+						'io.resin.local.service': task.serviceName,
+					},
+					t: getImageNameFromTask(task),
+					nocache: opts.nocache,
+					forcerm: true,
+					pull: opts.pull,
 				},
 				t: getImageNameFromTask(task),
 				nocache: opts.nocache,

lib/utils/device/live.ts

@@ -21,8 +21,8 @@ import * as fs from 'fs';
 import Livepush, { ContainerNotRunningError } from 'livepush';
 import * as _ from 'lodash';
 import * as path from 'path';
-import type { Composition } from 'resin-compose-parse';
-import type { BuildTask } from 'resin-multibuild';
+import type { Composition } from '@balena/compose/dist/parse';
+import type { BuildTask } from '@balena/compose/dist/multibuild';
 
 import { instanceOf } from '../../errors';
 import Logger = require('../logger');
@@ -52,7 +52,6 @@ interface MonitoredContainer {
 	containerId: string;
 }
 
-type BuildLogs = Dictionary<string>;
 type StageImageIDs = Dictionary<string[]>;
 
 export interface LivepushOpts {
@@ -62,7 +61,7 @@ export interface LivepushOpts {
 	docker: Dockerode;
 	api: DeviceAPI;
 	logger: Logger;
-	buildLogs: BuildLogs;
+	imageIds: StageImageIDs;
 	deployOpts: DeviceDeployOptions;
 }
 
@@ -97,7 +96,7 @@ export class LivepushManager {
 		this.api = opts.api;
 		this.logger = opts.logger;
 		this.deployOpts = opts.deployOpts;
-		this.imageIds = LivepushManager.getMultistageImageIDs(opts.buildLogs);
+		this.imageIds = opts.imageIds;
 	}
 
 	public async init(): Promise<void> {
@@ -250,7 +249,7 @@ export class LivepushManager {
 			cwd: serviceContext,
 			followSymlinks: true,
 			ignoreInitial: true,
-			ignored: (filePath: string, stats: fs.Stats | undefined) => {
+			ignored: (filePath: string, stats?: fs.Stats) => {
 				if (!stats) {
 					try {
 						// sync because chokidar defines a sync interface
@@ -297,33 +296,6 @@ export class LivepushManager {
 		return new Dockerfile(content).generateLiveDockerfile();
 	}
 
-	private static getMultistageImageIDs(buildLogs: BuildLogs): StageImageIDs {
-		const stageIds: StageImageIDs = {};
-		_.each(buildLogs, (log, serviceName) => {
-			stageIds[serviceName] = [];
-
-			const lines = log.split(/\r?\n/);
-			let lastArrowMessage: string | undefined;
-			for (const line of lines) {
-				// If this was a from line, take the last found
-				// image id and save it
-				if (
-					/step \d+(?:\/\d+)?\s*:\s*FROM/i.test(line) &&
-					lastArrowMessage != null
-				) {
-					stageIds[serviceName].push(lastArrowMessage);
-				} else {
-					const msg = LivepushManager.extractDockerArrowMessage(line);
-					if (msg != null) {
-						lastArrowMessage = msg;
-					}
-				}
-			}
-		});
-
-		return stageIds;
-	}
-
 	private async awaitDeviceStateSettle(): Promise<void> {
 		// Cache the state to avoid unnecessary calls
 		this.lastDeviceStatus = await this.api.getStatus();
@@ -405,9 +377,9 @@ export class LivepushManager {
 				);
 			}
 
-			let buildLog: string;
+			let stageImages: string[];
 			try {
-				buildLog = await rebuildSingleTask(
+				stageImages = await rebuildSingleTask(
 					serviceName,
 					this.docker,
 					this.logger,
@@ -466,17 +438,13 @@ export class LivepushManager {
 				);
 			}
 
-			const buildLogs: Dictionary<string> = {};
-			buildLogs[serviceName] = buildLog;
-			const stageImages = LivepushManager.getMultistageImageIDs(buildLogs);
-
 			const dockerfile = new Dockerfile(buildTask.dockerfile!);
 
 			instance.livepush = await Livepush.init({
 				dockerfile,
 				context: buildTask.context!,
 				containerId: container.containerId,
-				stageImages: stageImages[serviceName],
+				stageImages,
 				docker: this.docker,
 			});
 			this.assignLivepushOutputHandlers(serviceName, instance.livepush);
@@ -536,16 +504,6 @@ export class LivepushManager {
 		});
 	}
 
-	private static extractDockerArrowMessage(
-		outputLine: string,
-	): string | undefined {
-		const arrowTest = /^.*\s*-+>\s*(.+)/i;
-		const match = arrowTest.exec(outputLine);
-		if (match != null) {
-			return match[1];
-		}
-	}
-
 	private getDockerfilePathFromTask(task: BuildTask): string[] {
 		switch (task.projectType) {
 			case 'Standard Dockerfile':

lib/utils/device/logs.ts

@@ -155,12 +155,8 @@ export function displayLogObject<T extends Log>(
 	system: boolean,
 	filterServices?: string[],
 ): void {
-	let toPrint: string;
-	if (obj.timestamp != null) {
-		toPrint = `[${new Date(obj.timestamp).toLocaleString()}]`;
-	} else {
-		toPrint = `[${new Date().toLocaleString()}]`;
-	}
+	const d = obj.timestamp != null ? new Date(obj.timestamp) : new Date();
+	let toPrint = `[${d.toISOString()}]`;
 
 	if (obj.serviceName != null) {
 		if (filterServices) {

lib/utils/discover.ts

@@ -0,0 +1,40 @@
+import { enumerateServices, findServices } from 'resin-discoverable-services';
+
+interface LocalBalenaOsDevice {
+	address: string;
+	host: string;
+	osVariant?: string;
+	port: number;
+}
+
+// Although we only check for 'balena-ssh', we know, implicitly, that balenaOS
+// devices come with 'rsync' installed that can be used over SSH.
+const avahiBalenaSshTag = 'resin-ssh';
+
+export async function discoverLocalBalenaOsDevices(
+	timeout = 4000,
+): Promise<LocalBalenaOsDevice[]> {
+	const availableServices = await enumerateServices();
+	const serviceDefinitions = Array.from(availableServices)
+		.filter((s) => Array.from(s.tags).includes(avahiBalenaSshTag))
+		.map((s) => s.service);
+
+	if (serviceDefinitions.length === 0) {
+		throw new Error(
+			`Could not find any available '${avahiBalenaSshTag}' services`,
+		);
+	}
+
+	const services = await findServices(serviceDefinitions, timeout);
+	return services.map(function (service) {
+		// User referer address to get device IP. This will work fine assuming that
+		// a device only advertises own services.
+		const {
+			referer: { address },
+			host,
+			port,
+		} = service;
+
+		return { address, host, port };
+	});
+}

lib/utils/docker.ts

@@ -105,7 +105,7 @@ export interface BuildOpts {
 	cachefrom?: string[];
 	nocache?: boolean;
 	pull?: boolean;
-	registryconfig?: import('resin-multibuild').RegistrySecrets;
+	registryconfig?: import('@balena/compose/dist/multibuild').RegistrySecrets;
 	squash?: boolean;
 	t?: string; // only the tag portion of the image name, e.g. 'abc' in 'myimg:abc'
 }
@@ -132,7 +132,7 @@ export function generateBuildOpts(options: {
 	'cache-from'?: string;
 	nocache: boolean;
 	pull?: boolean;
-	'registry-secrets'?: import('resin-multibuild').RegistrySecrets;
+	'registry-secrets'?: import('@balena/compose/dist/multibuild').RegistrySecrets;
 	squash: boolean;
 	tag?: string;
 }): BuildOpts {

lib/utils/helpers.ts

@@ -107,21 +107,50 @@ export async function getManifest(
 	deviceType: string,
 ): Promise<BalenaSdk.DeviceTypeJson.DeviceType> {
 	const init = await import('balena-device-init');
+	const sdk = getBalenaSdk();
 	const manifest = await init.getImageManifest(image);
-	if (manifest != null) {
-		return manifest;
+	if (
+		manifest != null &&
+		manifest.slug !== deviceType &&
+		manifest.slug !== (await sdk.models.deviceType.get(deviceType)).slug
+	) {
+		const { ExpectedError } = await import('../errors');
+		throw new ExpectedError(
+			`The device type of the provided OS image ${manifest.slug}, does not match the expected device type ${deviceType}`,
+		);
 	}
-	return getBalenaSdk().models.device.getManifestBySlug(deviceType);
+	return manifest ?? (await sdk.models.device.getManifestBySlug(deviceType));
 }
 
-export const areDeviceTypesCompatible = (
-	appDeviceType: BalenaSdk.DeviceTypeJson.DeviceType,
-	osDeviceType: BalenaSdk.DeviceTypeJson.DeviceType,
-) =>
-	getBalenaSdk().models.os.isArchitectureCompatibleWith(
-		osDeviceType.arch,
-		appDeviceType.arch,
-	) && !!appDeviceType.isDependent === !!osDeviceType.isDependent;
+export const areDeviceTypesCompatible = async (
+	appDeviceTypeSlug: string,
+	osDeviceTypeSlug: string,
+) => {
+	if (appDeviceTypeSlug === osDeviceTypeSlug) {
+		return true;
+	}
+	const sdk = getBalenaSdk();
+	const pineOptions = {
+		$select: 'is_of__cpu_architecture',
+		$expand: {
+			is_of__cpu_architecture: {
+				$select: 'slug',
+			},
+		},
+	} satisfies BalenaSdk.PineOptions<BalenaSdk.DeviceType>;
+	const [appDeviceType, osDeviceType] = await Promise.all(
+		[appDeviceTypeSlug, osDeviceTypeSlug].map(
+			(dtSlug) =>
+				sdk.models.deviceType.get(dtSlug, pineOptions) as Promise<
+					BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>
+				>,
+		),
+	);
+	return sdk.models.os.isArchitectureCompatibleWith(
+		osDeviceType.is_of__cpu_architecture[0].slug,
+		appDeviceType.is_of__cpu_architecture[0].slug,
+	);
+};
 
 export async function osProgressHandler(step: InitializeEmitter) {
 	step.on('stdout', process.stdout.write.bind(process.stdout));
@@ -155,7 +184,7 @@ export async function getAppWithArch(
 	const options: BalenaSdk.PineOptions<BalenaSdk.Application> = {
 		$expand: {
 			application_type: {
-				$select: ['name', 'slug', 'supports_multicontainer', 'is_legacy'],
+				$select: ['name', 'slug', 'supports_multicontainer'],
 			},
 			is_for__device_type: {
 				$select: 'slug',
@@ -410,11 +439,11 @@ export function getProxyConfig(): ProxyConfig | undefined {
 
 export const expandForAppName = {
 	$expand: {
-		belongs_to__application: { $select: ['app_name', 'slug'] as any },
+		belongs_to__application: { $select: ['app_name', 'slug'] },
 		is_of__device_type: { $select: 'slug' },
 		is_running__release: { $select: 'commit' },
 	},
-} as const;
+} satisfies BalenaSdk.PineOptions<BalenaSdk.Device>;
 
 export const expandForAppNameAndCpuArch = {
 	$expand: {
@@ -428,7 +457,7 @@ export const expandForAppNameAndCpuArch = {
 			},
 		},
 	},
-} as const;
+} satisfies BalenaSdk.PineOptions<BalenaSdk.Device>;
 
 /**
  * Use the `readline` library on Windows to install SIGINT handlers.

lib/utils/ignore.ts

@@ -92,7 +92,6 @@ async function readDockerIgnoreFile(projectDir: string): Promise<string> {
 	return dockerIgnoreStr;
 }
 
-// TODO:  docker-compose naming
 /**
  * Create an instance of '@balena/dockerignore', initialized with the contents
  * of a .dockerignore file (if any) found at the given directory argument, plus

lib/utils/messages.ts

@@ -86,7 +86,6 @@ If the --registry-secrets option is not specified, and a secrets.yml or
 secrets.json file exists in the balena directory (usually $HOME/.balena),
 this file will be used instead.`;
 
-// TODO:  docker-compose naming
 export const dockerignoreHelp =
 	'DOCKERIGNORE AND GITIGNORE FILES  \n' +
 	`By default, the balena CLI will use a single ".dockerignore" file (if any) at
@@ -138,7 +137,7 @@ adding exception patterns to the applicable .dockerignore file(s), for example
 - https://www.npmjs.com/package/@balena/dockerignore`;
 
 export const applicationIdInfo = `\
-Fleets may be specified by fleet name, slug, or numeric ID. Fleet slugs are
+Fleets may be specified by fleet name or slug. Fleet slugs are
 the recommended option, as they are unique and unambiguous. Slugs can be
 listed with the \`balena fleets\` command. Note that slugs may change if the
 fleet is renamed. Fleet names are not unique and may result in  "Fleet is
@@ -146,9 +145,7 @@ ambiguous" errors at any time (even if it "used to work in the past"), for
 example if the name clashes with a newly created public fleet, or with fleets
 from other balena accounts that you may be invited to join under any role.
 For this reason, fleet names are especially discouraged in scripts (e.g. CI
-environments). Numeric fleet IDs are deprecated because they consist of an
-implementation detail of the balena backend. We intend to remove support for
-numeric IDs at some point in the future.`;
+environments).`;
 
 export const applicationNameNote = `\
 Fleets may be specified by fleet name or slug. Slugs are recommended because
@@ -172,6 +169,10 @@ confuse the balenaOS "development mode" with a device's "local mode", the latter
 being a supervisor feature that allows the "balena push" command to push a user's
 application directly to a device in the local network.`;
 
+export const secureBootInfo = `\
+The '--secureBoot' option is used to configure a balenaOS installer image to opt-in
+secure boot and disk encryption.`;
+
 export const jsonInfo = `\
 The --json option is recommended when scripting the output of this command,
 because field names are less likely to change in JSON format and because it

lib/utils/patterns.ts

@@ -280,71 +280,64 @@ export function inferOrSelectDevice(preferredUuid: string) {
 }
 
 /*
- * Given applicationOrDevice, which may be
- *  - an application name
- *  - an application slug
- *  - an application id (integer)
+ * Given fleetOrDevice, which may be
+ *  - a fleet name
+ *  - a fleet slug
  *  - a device uuid
  * Either:
  *  - in case of device uuid, return uuid of device after verifying that it exists and is online.
- *  - in case of application, return uuid of device user selects from list of online devices.
- *
- * 	TODO: Modify this when app IDs dropped.
+ *  - in case of fleet, return uuid of device user selects from list of online devices.
  */
 export async function getOnlineTargetDeviceUuid(
 	sdk: BalenaSDK,
-	applicationOrDevice: string,
+	fleetOrDevice: string,
 ) {
 	const logger = (await import('../utils/logger')).getLogger();
 
 	// If looks like UUID, probably device
-	if (validation.validateUuid(applicationOrDevice)) {
+	if (validation.validateUuid(fleetOrDevice)) {
 		let device: Device;
 		try {
 			logger.logDebug(
-				`Trying to fetch device by UUID ${applicationOrDevice} (${typeof applicationOrDevice})`,
+				`Trying to fetch device by UUID ${fleetOrDevice} (${typeof fleetOrDevice})`,
 			);
-			device = await sdk.models.device.get(applicationOrDevice, {
+			device = await sdk.models.device.get(fleetOrDevice, {
 				$select: ['uuid', 'is_online'],
 			});
 
 			if (!device.is_online) {
-				throw new ExpectedError(
-					`Device with UUID ${applicationOrDevice} is offline`,
-				);
+				throw new ExpectedError(`Device with UUID ${fleetOrDevice} is offline`);
 			}
 
 			return device.uuid;
 		} catch (err) {
 			const { BalenaDeviceNotFound } = await import('balena-errors');
 			if (instanceOf(err, BalenaDeviceNotFound)) {
-				logger.logDebug(`Device with UUID ${applicationOrDevice} not found`);
-				// Now try app
+				logger.logDebug(`Device with UUID ${fleetOrDevice} not found`);
+				// Now try application
 			} else {
 				throw err;
 			}
 		}
 	}
 
-	// Not a device UUID, try app
-	let app: Application;
+	// Not a device UUID, try application
+	let application: Application;
 	try {
-		logger.logDebug(`Fetching fleet ${applicationOrDevice}`);
+		logger.logDebug(`Fetching fleet ${fleetOrDevice}`);
 		const { getApplication } = await import('./sdk');
-		app = await getApplication(sdk, applicationOrDevice);
+		application = await getApplication(sdk, fleetOrDevice);
 	} catch (err) {
 		const { BalenaApplicationNotFound } = await import('balena-errors');
 		if (instanceOf(err, BalenaApplicationNotFound)) {
-			throw new ExpectedError(
-				`Fleet or Device not found: ${applicationOrDevice}`,
-			);
+			throw new ExpectedError(`Fleet or Device not found: ${fleetOrDevice}`);
 		} else {
 			throw err;
 		}
 	}
 
 	// App found, load its devices
-	const devices = await sdk.models.device.getAllByApplication(app.id, {
+	const devices = await sdk.models.device.getAllByApplication(application.id, {
 		$select: ['device_name', 'uuid'],
 		$filter: { is_online: true },
 	});
@@ -352,13 +345,13 @@ export async function getOnlineTargetDeviceUuid(
 	// Throw if no devices online
 	if (_.isEmpty(devices)) {
 		throw new ExpectedError(
-			`Fleet ${app.slug} found, but has no devices online.`,
+			`Fleet ${application.slug} found, but has no devices online.`,
 		);
 	}
 
-	// Ask user to select from online devices for application
+	// Ask user to select from online devices for fleet
 	return getCliForm().ask({
-		message: `Select a device on fleet ${app.slug}`,
+		message: `Select a device on fleet ${application.slug}`,
 		type: 'list',
 		default: devices[0].uuid,
 		choices: _.map(devices, (device) => ({

lib/utils/promote.ts

@@ -163,12 +163,61 @@ async function getOsVersion(deviceIp: string): Promise<string> {
 	return match[1];
 }
 
+const dockerPort = 2375;
+const dockerTimeout = 2000;
+
+async function selectLocalBalenaOsDevice(timeout = 4000): Promise<string> {
+	const { discoverLocalBalenaOsDevices } = await import('../utils/discover');
+	const { SpinnerPromise } = getVisuals();
+	const devices = await new SpinnerPromise({
+		promise: discoverLocalBalenaOsDevices(timeout),
+		startMessage: 'Discovering local balenaOS devices..',
+		stopMessage: 'Reporting discovered devices',
+	});
+
+	const responsiveDevices: typeof devices = [];
+	const Docker = await import('docker-toolbelt');
+	await Promise.all(
+		devices.map(async function (device) {
+			const address = device?.address;
+			if (!address) {
+				return;
+			}
+
+			try {
+				const docker = new Docker({
+					host: address,
+					port: dockerPort,
+					timeout: dockerTimeout,
+				});
+				await docker.ping();
+				responsiveDevices.push(device);
+			} catch {
+				return;
+			}
+		}),
+	);
+
+	if (!responsiveDevices.length) {
+		throw new Error('Could not find any local balenaOS devices');
+	}
+
+	return getCliForm().ask({
+		message: 'select a device',
+		type: 'list',
+		default: devices[0].address,
+		choices: responsiveDevices.map((device) => ({
+			name: `${device.host || 'untitled'} (${device.address})`,
+			value: device.address,
+		})),
+	});
+}
+
 async function selectLocalDevice(): Promise<string> {
-	const { forms } = await import('balena-sync');
-	let hostnameOrIp;
 	try {
-		hostnameOrIp = await forms.selectLocalBalenaOsDevice();
+		const hostnameOrIp = await selectLocalBalenaOsDevice();
 		console.error(`==> Selected device: ${hostnameOrIp}`);
+		return hostnameOrIp;
 	} catch (e) {
 		if (e.message.toLowerCase().includes('could not find any')) {
 			throw new ExpectedError(e);
@@ -176,8 +225,6 @@ async function selectLocalDevice(): Promise<string> {
 			throw e;
 		}
 	}
-
-	return hostnameOrIp;
 }
 
 async function selectAppFromList(
@@ -198,31 +245,37 @@ async function selectAppFromList(
 
 async function getOrSelectApplication(
 	sdk: BalenaSdk.BalenaSDK,
-	deviceType: string,
+	deviceTypeSlug: string,
 	appName?: string,
 ): Promise<ApplicationWithDeviceType> {
-	const _ = await import('lodash');
+	const pineOptions = {
+		$select: 'slug',
+		$expand: {
+			is_of__cpu_architecture: {
+				$select: 'slug',
+			},
+		},
+	} satisfies BalenaSdk.PineOptions<BalenaSdk.DeviceType>;
+	const [deviceType, allDeviceTypes] = await Promise.all([
+		sdk.models.deviceType.get(deviceTypeSlug, pineOptions) as Promise<
+			BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>
+		>,
+		sdk.models.deviceType.getAllSupported(pineOptions) as Promise<
+			Array<BalenaSdk.PineTypedResult<BalenaSdk.DeviceType, typeof pineOptions>>
+		>,
+	]);
 
-	const allDeviceTypes = await sdk.models.config.getDeviceTypes();
-	const deviceTypeManifest = _.find(allDeviceTypes, { slug: deviceType });
-	if (!deviceTypeManifest) {
-		throw new ExpectedError(`"${deviceType}" is not a valid device type`);
-	}
-	const compatibleDeviceTypes = _(allDeviceTypes)
-		.filter(
-			(dt) =>
-				sdk.models.os.isArchitectureCompatibleWith(
-					deviceTypeManifest.arch,
-					dt.arch,
-				) &&
-				!!dt.isDependent === !!deviceTypeManifest.isDependent &&
-				dt.state !== 'DISCONTINUED',
+	const compatibleDeviceTypes = allDeviceTypes
+		.filter((dt) =>
+			sdk.models.os.isArchitectureCompatibleWith(
+				deviceType.is_of__cpu_architecture[0].slug,
+				dt.is_of__cpu_architecture[0].slug,
+			),
 		)
-		.map((type) => type.slug)
-		.value();
+		.map((type) => type.slug);
 
 	if (!appName) {
-		return createOrSelectApp(sdk, compatibleDeviceTypes, deviceType);
+		return createOrSelectApp(sdk, compatibleDeviceTypes, deviceTypeSlug);
 	}
 
 	const options: BalenaSdk.PineOptions<BalenaSdk.Application> = {
@@ -257,13 +310,13 @@ async function getOrSelectApplication(
 			undefined,
 			true,
 		);
-		return await createApplication(sdk, deviceType, name);
+		return await createApplication(sdk, deviceTypeSlug, name);
 	}
 
 	// We've found at least one fleet with the given name.
 	// Filter out fleets for non-matching device types and see what we're left with.
 	const validApplications = applications.filter((app) =>
-		_.includes(compatibleDeviceTypes, app.is_for__device_type[0].slug),
+		compatibleDeviceTypes.includes(app.is_for__device_type[0].slug),
 	);
 
 	if (validApplications.length === 0) {
@@ -334,13 +387,7 @@ async function createApplication(
 				try {
 					await sdk.models.application.getDirectlyAccessible(appName, {
 						$filter: {
-							$or: [
-								{ slug: { $startswith: `${username!.toLowerCase()}/` } },
-								// TODO: do we still need the following filter? Is it for
-								// old openBalena instances where slugs were equal to the
-								// app name and did not contain the slash character?
-								{ $not: { slug: { $contains: '/' } } },
-							],
+							slug: { $startswith: `${username!.toLowerCase()}/` },
 						},
 					});
 					// TODO: This is the only example in the codebase where `printErrorMessage()`

lib/utils/qemu.ts

@@ -21,7 +21,7 @@ import { ExpectedError } from '../errors';
 import { getBalenaSdk, stripIndent } from './lazy';
 import Logger = require('./logger');
 
-export const QEMU_VERSION = 'v6.0.0+balena1';
+export const QEMU_VERSION = 'v7.0.0+balena1';
 export const QEMU_BIN_NAME = 'qemu-execve';
 
 export function qemuPathInContext(context: string) {

lib/utils/remote-build.ts

@@ -17,7 +17,7 @@ import type { BalenaSDK } from 'balena-sdk';
 import * as JSONStream from 'JSONStream';
 import * as readline from 'readline';
 import * as request from 'request';
-import { RegistrySecrets } from 'resin-multibuild';
+import { RegistrySecrets } from '@balena/compose/dist/multibuild';
 import type * as Stream from 'stream';
 import streamToPromise = require('stream-to-promise');
 import type { Pack } from 'tar-stream';

lib/utils/sdk.ts

@@ -24,54 +24,32 @@ import type {
 
 /**
  * Get a fleet object, disambiguating the fleet identifier which may be a
- * a fleet slug, name or numeric database ID (as a string).
+ * a fleet slug or name.
  * TODO: add support for fleet UUIDs.
  */
 export async function getApplication(
 	sdk: BalenaSDK,
-	nameOrSlugOrId: string | number,
+	nameOrSlug: string,
 	options?: PineOptions<Application>,
 ): Promise<Application> {
-	const { looksLikeFleetSlug, looksLikeInteger } = await import('./validation');
-	if (
-		typeof nameOrSlugOrId === 'string' &&
-		looksLikeFleetSlug(nameOrSlugOrId)
-	) {
-		return await sdk.models.application.getDirectlyAccessible(
-			nameOrSlugOrId,
+	const { looksLikeFleetSlug } = await import('./validation');
+	if (!looksLikeFleetSlug(nameOrSlug)) {
+		// Not a slug: must be an app name.
+		// TODO: revisit this logic when we add support for fleet UUIDs.
+		return await sdk.models.application.getAppByName(
+			nameOrSlug,
 			options,
+			'directly_accessible',
 		);
 	}
-	if (typeof nameOrSlugOrId === 'number' || looksLikeInteger(nameOrSlugOrId)) {
-		try {
-			// Test for existence of app with this numerical ID
-			return await sdk.models.application.getDirectlyAccessible(
-				Number(nameOrSlugOrId),
-				options,
-			);
-		} catch (e) {
-			if (typeof nameOrSlugOrId === 'number') {
-				throw e;
-			}
-			const { instanceOf } = await import('../errors');
-			const { BalenaApplicationNotFound } = await import('balena-errors');
-			if (!instanceOf(e, BalenaApplicationNotFound)) {
-				throw e;
-			}
-			// App with this numerical ID not found, but there may be an app with this numerical name.
-		}
-	}
-	// Not a slug and not a numeric database ID: must be an app name.
-	// TODO: revisit this logic when we add support for fleet UUIDs.
-	return await sdk.models.application.getAppByName(
-		nameOrSlugOrId,
+	return await sdk.models.application.getDirectlyAccessible(
+		nameOrSlug,
 		options,
-		'directly_accessible',
 	);
 }
 
 /**
- * Given a fleet name, slug or numeric database ID, return its slug.
+ * Given a fleet name or slug, return its slug.
  * This function conditionally makes an async SDK/API call to retrieve the
  * application object, which can be wasteful if the application object is
  * required before or after the call to this function. If this is the case,
@@ -79,16 +57,15 @@ export async function getApplication(
  */
 export async function getFleetSlug(
 	sdk: BalenaSDK,
-	nameOrSlugOrId: string | number,
+	nameOrSlug: string,
 ): Promise<string> {
 	const { looksLikeFleetSlug } = await import('./validation');
-	if (
-		typeof nameOrSlugOrId === 'string' &&
-		looksLikeFleetSlug(nameOrSlugOrId)
-	) {
-		return nameOrSlugOrId.toLowerCase();
+	if (!looksLikeFleetSlug(nameOrSlug)) {
+		// Not a slug: must be an app name.
+		// TODO: revisit this logic when we add support for fleet UUIDs.
+		return (await getApplication(sdk, nameOrSlug)).slug;
 	}
-	return (await getApplication(sdk, nameOrSlugOrId)).slug;
+	return nameOrSlug.toLowerCase();
 }
 
 /**

lib/utils/ssh.ts

@@ -151,23 +151,23 @@ export async function runRemoteCommand({
 	let exitCode: number | undefined;
 	let exitSignal: NodeJS.Signals | undefined;
 	try {
-		[exitCode, exitSignal] = await new Promise<[number, NodeJS.Signals]>(
-			(resolve, reject) => {
-				const ps = spawn(program, args, { stdio })
-					.on('error', reject)
-					.on('close', (code, signal) => resolve([code, signal]));
+		[exitCode, exitSignal] = await new Promise((resolve, reject) => {
+			const ps = spawn(program, args, { stdio })
+				.on('error', reject)
+				.on('close', (code, signal) =>
+					resolve([code ?? undefined, signal ?? undefined]),
+				);
 
-				if (ps.stdin && stdin && typeof stdin !== 'string') {
-					stdin.pipe(ps.stdin);
-				}
-				if (ps.stdout && stdout && typeof stdout !== 'string') {
-					ps.stdout.pipe(stdout);
-				}
-				if (ps.stderr && stderr && typeof stderr !== 'string') {
-					ps.stderr.pipe(stderr);
-				}
-			},
-		);
+			if (ps.stdin && stdin && typeof stdin !== 'string') {
+				stdin.pipe(ps.stdin);
+			}
+			if (ps.stdout && stdout && typeof stdout !== 'string') {
+				ps.stdout.pipe(stdout);
+			}
+			if (ps.stderr && stderr && typeof stderr !== 'string') {
+				ps.stderr.pipe(stderr);
+			}
+		});
 	} catch (error) {
 		const msg = [
 			`ssh failed with exit code=${exitCode} signal=${exitSignal}:`,

lib/utils/update.ts

@@ -19,8 +19,10 @@ import * as UpdateNotifier from 'update-notifier';
 
 import packageJSON = require('../../package.json');
 
-// Check for an update once a day. 1 day granularity should be
-// enough, rather than every run.
+// Check for an update at most once a day. 1 day granularity should be
+// enough, rather than every run. Note because we show the information
+// from the *last* time we ran, if the cli has not been run for a while
+// the update info can be out of date.
 const balenaUpdateInterval = 1000 * 60 * 60 * 24 * 1;
 
 let notifier: UpdateNotifier.UpdateNotifier;

lib/utils/version.ts

@@ -21,13 +21,3 @@ import { version } from '../../package.json';
 export function isVersionGTE(v: string): boolean {
 	return semver.gte(process.env.BALENA_CLI_VERSION_OVERRIDE || version, v);
 }
-
-let v14: boolean;
-
-/** Feature switch for the next major version of the CLI */
-export function isV14(): boolean {
-	if (v14 === undefined) {
-		v14 = isVersionGTE('14.0.0');
-	}
-	return v14;
-}

package.json

@@ -1,6 +1,6 @@
 {
   "name": "balena-cli",
-  "version": "13.4.1",
+  "version": "16.2.0",
   "description": "The official balena Command Line Interface",
   "main": "./build/app.js",
   "homepage": "https://github.com/balena-io/balena-cli",
@@ -27,9 +27,8 @@
     "scripts": [
       "build/**/*.js",
       "node_modules/balena-sdk/es2018/index.js",
-      "node_modules/balena-sync/build/**/*.js",
       "node_modules/pinejs-client-request/node_modules/pinejs-client-core/es2018/index.js",
-      "node_modules/resin-compose-parse/build/schemas/*.json"
+      "node_modules/@balena/compose/dist/parse/schemas/*.json"
     ],
     "assets": [
       "build/auth/pages/*.ejs",
@@ -90,12 +89,11 @@
   "author": "Balena Inc. (https://balena.io/)",
   "license": "Apache-2.0",
   "engines": {
-    "node": ">=12.8.0 <13.0.0",
-    "npm": "<7.0.0"
+    "node": ">=16 <18"
   },
   "husky": {
     "hooks": {
-      "pre-commit": "node automation/check-npm-version.js && node automation/check-doc.js"
+      "pre-commit": "node automation/check-npm-version.js && ts-node automation/check-doc.ts"
     }
   },
   "oclif": {
@@ -115,7 +113,7 @@
     ]
   },
   "devDependencies": {
-    "@balena/lint": "^6.2.0",
+    "@balena/lint": "^6.2.2",
     "@oclif/config": "^1.18.2",
     "@oclif/parser": "^3.8.6",
     "@octokit/plugin-throttling": "^3.5.1",
@@ -127,13 +125,14 @@
     "@types/chai-as-promised": "^7.1.4",
     "@types/cli-truncate": "^2.0.0",
     "@types/common-tags": "^1.8.1",
-    "@types/dockerode": "^3.3.8",
+    "@types/dockerode": "^3.3.9",
     "@types/ejs": "^3.1.0",
     "@types/express": "^4.17.13",
     "@types/fs-extra": "^9.0.13",
     "@types/global-agent": "^2.1.1",
     "@types/global-tunnel-ng": "^2.1.1",
     "@types/http-proxy": "^1.17.8",
+    "@types/inquirer": "^7.3.3",
     "@types/intercept-stdout": "^0.1.0",
     "@types/is-root": "^2.1.2",
     "@types/js-yaml": "^4.0.5",
@@ -147,7 +146,7 @@
     "@types/ndjson": "^2.0.1",
     "@types/net-keepalive": "^0.4.1",
     "@types/nock": "^11.1.0",
-    "@types/node": "^12.20.42",
+    "@types/node": "^16.18.25",
     "@types/node-cleanup": "^2.1.2",
     "@types/parse-link-header": "^1.0.1",
     "@types/prettyjson": "^0.0.30",
@@ -184,16 +183,17 @@
     "mocha": "^8.4.0",
     "mock-require": "^3.0.3",
     "nock": "^13.2.1",
-    "parse-link-header": "^1.0.1",
-    "pkg": "^5.5.1",
+    "parse-link-header": "^2.0.0",
+    "pkg": "^5.8.1",
     "publish-release": "^1.6.1",
     "rewire": "^5.0.0",
-    "simple-git": "^2.48.0",
+    "simple-git": "^3.14.1",
     "sinon": "^11.1.2",
     "ts-node": "^10.4.0",
-    "typescript": "^4.5.4"
+    "typescript": "^5.0.2"
   },
   "dependencies": {
+    "@balena/compose": "^2.2.1",
     "@balena/dockerignore": "^1.0.2",
     "@balena/es-version": "^1.0.1",
     "@oclif/command": "^1.8.16",
@@ -201,19 +201,16 @@
     "@sentry/node": "^6.16.1",
     "@types/fast-levenshtein": "0.0.1",
     "@types/update-notifier": "^4.1.1",
-    "JSONStream": "^1.0.3",
     "balena-config-json": "^4.2.0",
     "balena-device-init": "^6.0.0",
-    "balena-errors": "^4.7.1",
+    "balena-errors": "^4.7.3",
     "balena-image-fs": "^7.0.6",
-    "balena-image-manager": "^7.1.1",
-    "balena-preload": "^12.0.0",
-    "balena-release": "^3.2.0",
-    "balena-sdk": "^16.9.0",
+    "balena-image-manager": "^8.0.0",
+    "balena-preload": "^13.0.0",
+    "balena-sdk": "^16.44.2",
     "balena-semver": "^2.3.0",
     "balena-settings-client": "^4.0.7",
     "balena-settings-storage": "^7.0.0",
-    "balena-sync": "^11.0.2",
     "bluebird": "^3.7.2",
     "body-parser": "^1.19.1",
     "chalk": "^3.0.0",
@@ -225,11 +222,11 @@
     "common-tags": "^1.7.2",
     "denymount": "^2.3.0",
     "docker-modem": "3.0.0",
-    "docker-progress": "^5.0.1",
-    "docker-qemu-transpose": "^1.1.1",
+    "docker-progress": "^5.1.3",
+    "docker-toolbelt": "^3.3.10",
     "dockerode": "^3.3.1",
     "ejs": "^3.1.6",
-    "etcher-sdk": "^6.2.1",
+    "etcher-sdk": "^8.5.3",
     "event-stream": "3.3.4",
     "express": "^4.17.2",
     "fast-boot2": "^1.1.0",
@@ -245,6 +242,7 @@
     "is-elevated": "^3.0.0",
     "is-root": "^2.1.0",
     "js-yaml": "^4.1.0",
+    "JSONStream": "^1.0.3",
     "klaw": "^3.0.0",
     "livepush": "^3.5.1",
     "lodash": "^4.17.21",
@@ -263,10 +261,9 @@
     "reconfix": "^1.0.0-v0-1-0-fork-46760acff4d165f5238bfac5e464256ef1944476",
     "request": "^2.88.2",
     "resin-cli-form": "^2.0.2",
-    "resin-cli-visuals": "^1.8.0",
-    "resin-compose-parse": "^2.1.3",
+    "resin-cli-visuals": "^1.8.2",
+    "resin-discoverable-services": "^2.0.4",
     "resin-doodles": "^0.2.0",
-    "resin-multibuild": "^4.12.2",
     "resin-stream-logger": "^0.1.2",
     "rimraf": "^3.0.2",
     "semver": "^7.3.5",
@@ -288,6 +285,6 @@
     "windosu": "^0.3.0"
   },
   "versionist": {
-    "publishedAt": "2022-04-11T16:10:47.566Z"
+    "publishedAt": "2023-05-19T18:11:55.798Z"
   }
 }

patches/all/@oclif+parser+3.8.10.patch

@@ -1,24 +1,24 @@
 diff --git a/node_modules/@oclif/parser/lib/errors.js b/node_modules/@oclif/parser/lib/errors.js
-index 0c93a81..95d06be 100644
+index 39936e3..23e3925 100644
 --- a/node_modules/@oclif/parser/lib/errors.js
 +++ b/node_modules/@oclif/parser/lib/errors.js
-@@ -13,7 +13,8 @@ const m = deps_1.default()
+@@ -14,7 +14,8 @@ const m = deps_1.default()
      .add('list', () => require('./list'));
  class CLIParseError extends errors_1.CLIError {
      constructor(options) {
 -        options.message += '\nSee more help with --help';
-+        const help = options.command ? `\`${options.command} --help\`` : '--help';
-+        options.message += `\nSee more help with ${help}`;
++    		const help = options.command ? `\`${options.command} --help\`` : '--help';
++    		options.message += `\nSee more help with ${help}`;
          super(options.message);
          this.parse = options.parse;
      }
-@@ -34,22 +35,24 @@ class InvalidArgsSpecError extends CLIParseError {
+@@ -35,22 +36,24 @@ class InvalidArgsSpecError extends CLIParseError {
  exports.InvalidArgsSpecError = InvalidArgsSpecError;
  class RequiredArgsError extends CLIParseError {
      constructor({ args, parse }) {
 -        let message = `Missing ${args.length} required arg${args.length === 1 ? '' : 's'}`;
-+        const command = 'balena ' + parse.input.context.id.replace(/:/g, ' ');
-+        let message = `Missing ${args.length} required argument${args.length === 1 ? '' : 's'}`;
++    		const command = 'balena ' + parse.input.context.id.replace(/:/g, ' ');
++    		let message = `Missing ${args.length} required argument${args.length === 1 ? '' : 's'}`;
          const namedArgs = args.filter(a => a.name);
          if (namedArgs.length > 0) {
              const list = m.list.renderList(namedArgs.map(a => [a.name, a.description]));
@@ -32,7 +32,7 @@ index 0c93a81..95d06be 100644
  exports.RequiredArgsError = RequiredArgsError;
  class RequiredFlagError extends CLIParseError {
      constructor({ flag, parse }) {
-+        const command = 'balena ' + parse.input.context.id.replace(/:/g, ' ');
++    		const command = 'balena ' + parse.input.context.id.replace(/:/g, ' ');
          const usage = m.list.renderList(m.help.flagUsages([flag], { displayRequired: false }));
          const message = `Missing required flag:\n${usage}`;
 -        super({ parse, message });
@@ -41,15 +41,15 @@ index 0c93a81..95d06be 100644
      }
  }
 diff --git a/node_modules/@oclif/parser/lib/list.js b/node_modules/@oclif/parser/lib/list.js
-index 3907cc0..b689ca1 100644
+index 9d020b7..6ea9eb9 100644
 --- a/node_modules/@oclif/parser/lib/list.js
 +++ b/node_modules/@oclif/parser/lib/list.js
-@@ -21,7 +21,7 @@ function renderList(items) {
+@@ -22,7 +22,7 @@ function renderList(items) {
          }
          left = left.padEnd(maxLength);
          right = linewrap(maxLength + 2, right);
 -        return `${left}  ${right}`;
-+        return `${left} : ${right}`;
++  			return `${left} : ${right}`;
      });
      return lines.join('\n');
  }

patches/all/open+7.4.2.patch

@@ -1,15 +1,16 @@
 diff --git a/node_modules/open/index.js b/node_modules/open/index.js
-index 3bf5373..e042b64 100644
+index 13147d0..ff161dd 100644
 --- a/node_modules/open/index.js
 +++ b/node_modules/open/index.js
-@@ -11,7 +11,9 @@ const pAccess = promisify(fs.access);
- const pExecFile = promisify(childProcess.execFile);
+@@ -10,7 +10,10 @@ const pAccess = promisify(fs.access);
+ const pReadFile = promisify(fs.readFile);
  
  // Path to included `xdg-open`.
 -const localXdgOpenPath = path.join(__dirname, 'xdg-open');
 +const localXdgOpenPath = process.pkg
 +	? path.join(path.dirname(process.execPath), 'xdg-open')
 +	: path.join(__dirname, 'xdg-open');
++
  
- // Convert a path from WSL format to Windows format:
- // `/mnt/c/Program Files/Example/MyApp.exe` → `C:\Program Files\Example\MyApp.exe`
+ /**
+ Get the mount point for fixed drives in WSL.

patches/unix/node-gyp-build+4.6.0.patch

@@ -1,8 +1,8 @@
-diff --git a/node_modules/node-gyp-build/index.js b/node_modules/node-gyp-build/index.js
-index b5096ed..7cd451a 100644
---- a/node_modules/node-gyp-build/index.js
-+++ b/node_modules/node-gyp-build/index.js
-@@ -29,6 +29,9 @@ load.path = function (dir) {
+diff --git a/node_modules/node-gyp-build/node-gyp-build.js b/node_modules/node-gyp-build/node-gyp-build.js
+index 61b398e..3cc3be8 100644
+--- a/node_modules/node-gyp-build/node-gyp-build.js
++++ b/node_modules/node-gyp-build/node-gyp-build.js
+@@ -30,6 +30,9 @@ load.resolve = load.path = function (dir) {
      if (process.env[name + '_PREBUILD']) dir = process.env[name + '_PREBUILD']
    } catch (err) {}
  

repo.yml

@@ -10,11 +10,9 @@ upstream:
     url: 'https://github.com/balena-io-modules/balena-image-manager'
   - repo: 'balena-preload'
     url: 'https://github.com/balena-io-modules/balena-preload'
-  - repo: 'balena-sync'
-    url: 'https://github.com/balena-io-modules/balena-sync'
   - repo: 'etcher-sdk'
     url: 'https://github.com/balena-io-modules/etcher-sdk/'
-  - repo: 'resin-compose-parse'
-    url: 'https://github.com/balena-io-modules/resin-compose-parse'
+  - repo: 'balena-compose'
+    url: 'https://github.com/balena-io-modules/balena-compose'
   - repo: 'docker-progress'
     url: 'https://github.com/balena-io-modules/docker-progress'

tests/auth/tokens.ts

@@ -6,7 +6,6 @@ const johnDoe = {
 	gitlab_id: 1325,
 	social_service_account: null,
 	hasPasswordSet: true,
-	needsPasswordReset: false,
 	public_key: false,
 	features: [],
 	id: 1344,
@@ -21,7 +20,6 @@ const janeDoe = {
 	social_service_account: null,
 	has_disabled_newsletter: true,
 	hasPasswordSet: true,
-	needsPasswordReset: false,
 	public_key: false,
 	features: [],
 	intercomUserHash:

tests/commands/deploy.spec.ts

@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 
-import type { Request as ReleaseRequest } from 'balena-release';
+import type { Request as ReleaseRequest } from '@balena/compose/dist/release';
 import { expect } from 'chai';
 import { promises as fs } from 'fs';
 import * as _ from 'lodash';
@@ -291,7 +291,7 @@ describe('balena deploy', function () {
 			statusCode: 500,
 			inspectRequest: (_uri, requestBody) => {
 				const imageBody = requestBody as Partial<
-					import('balena-release/build/models').ImageModel
+					import('@balena/compose/dist/release/models').ImageModel
 				>;
 				expect(imageBody.status).to.equal('success');
 			},
@@ -300,7 +300,7 @@ describe('balena deploy', function () {
 		api.expectPatchRelease({
 			inspectRequest: (_uri, requestBody) => {
 				const releaseBody = requestBody as Partial<
-					import('balena-release/build/models').ReleaseModel
+					import('@balena/compose/dist/release/models').ReleaseModel
 				>;
 				expect(releaseBody.status).to.equal('failed');
 			},

tests/commands/device/devices.spec.ts

@@ -38,7 +38,7 @@ describe('balena devices', function () {
 	it('should list devices from own and collaborator apps', async () => {
 		api.scope
 			.get(
-				'/v6/device?$orderby=device_name%20asc&$expand=belongs_to__application($select=app_name,slug),is_of__device_type($select=slug),is_running__release($select=commit)',
+				'/v6/device?$orderby=device_name%20asc&$select=id,uuid,device_name,status,is_online,supervisor_version,os_version&$expand=belongs_to__application($select=app_name,slug),is_of__device_type($select=slug),is_running__release($select=commit)',
 			)
 			.replyWithFile(200, path.join(apiResponsePath, 'devices.json'), {
 				'Content-Type': 'application/json',

tests/commands/device/supported.spec.ts

@@ -44,7 +44,6 @@ describe('balena devices supported', function () {
 
 	it('should list currently supported devices, with correct filtering', async () => {
 		api.expectGetDeviceTypes();
-		api.expectGetConfigDeviceTypes();
 
 		const { out, err } = await runCommand('devices supported');
 
@@ -54,7 +53,7 @@ describe('balena devices supported', function () {
 		expect(lines).to.have.lengthOf.at.least(2);
 		expect(lines).to.contain('intel-nuc nuc amd64 Intel NUC');
 		expect(lines).to.contain(
-			'odroid-xu4 odroid-ux3, odroid-u3+ armv7hf ODROID-XU4',
+			'odroid-xu4 odroid-u3+, odroid-ux3 armv7hf ODROID-XU4',
 		);
 		expect(err).to.eql([]);
 	});

tests/commands/env/envs.spec.ts

@@ -138,6 +138,7 @@ describe('balena envs', function () {
 	});
 
 	it('should successfully list env variables for a test device', async () => {
+		api.expectGetDevice({ shortUUID, fullUUID });
 		api.expectGetDevice({ fullUUID });
 		api.expectGetDeviceEnvVars();
 		api.expectGetApplication();
@@ -145,20 +146,19 @@ describe('balena envs', function () {
 		api.expectGetAppServiceVars();
 		api.expectGetDeviceServiceVars();
 
-		const uuid = shortUUID;
-		const result = await runCommand(`envs -d ${uuid}`);
+		const result = await runCommand(`envs -d ${shortUUID}`);
 		let { out } = result;
 		let expected =
 			stripIndent`
 			ID     NAME  VALUE       FLEET    DEVICE  SERVICE
 			120110 svar1 svar1-value org/test *       service1
 			120111 svar2 svar2-value org/test *       service2
-			120120 svar3 svar3-value org/test ${uuid} service1
-			120121 svar4 svar4-value org/test ${uuid} service2
+			120120 svar3 svar3-value org/test ${shortUUID} service1
+			120121 svar4 svar4-value org/test ${shortUUID} service2
 			120101 var1  var1-val    org/test *       *
 			120102 var2  22          org/test *       *
-			120203 var3  var3-val    org/test ${uuid} *
-			120204 var4  44          org/test ${uuid} *
+			120203 var3  var3-val    org/test ${shortUUID} *
+			120204 var4  44          org/test ${shortUUID} *
 			` + '\n';
 
 		out = out.map((l) => l.replace(/ +/g, ' '));
@@ -168,6 +168,7 @@ describe('balena envs', function () {
 	});
 
 	it('should successfully list env variables for a test device (JSON output)', async () => {
+		api.expectGetDevice({ shortUUID, fullUUID });
 		api.expectGetDevice({ fullUUID });
 		api.expectGetDeviceEnvVars();
 		api.expectGetApplication();
@@ -192,6 +193,7 @@ describe('balena envs', function () {
 	});
 
 	it('should successfully list config variables for a test device', async () => {
+		api.expectGetDevice({ shortUUID, fullUUID });
 		api.expectGetDevice({ fullUUID });
 		api.expectGetDeviceConfigVars();
 		api.expectGetApplication();
@@ -216,24 +218,24 @@ describe('balena envs', function () {
 		const serviceName = 'service2';
 		api.expectGetService({ serviceName });
 		api.expectGetApplication();
+		api.expectGetDevice({ shortUUID, fullUUID });
 		api.expectGetDevice({ fullUUID });
 		api.expectGetDeviceServiceVars();
 		api.expectGetAppEnvVars();
 		api.expectGetAppServiceVars();
 		api.expectGetDeviceEnvVars();
 
-		const uuid = shortUUID;
-		const result = await runCommand(`envs -d ${uuid} -s ${serviceName}`);
+		const result = await runCommand(`envs -d ${shortUUID} -s ${serviceName}`);
 		let { out } = result;
 		let expected =
 			stripIndent`
 			ID     NAME  VALUE       FLEET    DEVICE  SERVICE
 			120111 svar2 svar2-value org/test *       service2
-			120121 svar4 svar4-value org/test ${uuid} service2
+			120121 svar4 svar4-value org/test ${shortUUID} service2
 			120101 var1  var1-val    org/test *       *
 			120102 var2  22          org/test *       *
-			120203 var3  var3-val    org/test ${uuid} *
-			120204 var4  44          org/test ${uuid} *
+			120203 var3  var3-val    org/test ${shortUUID} *
+			120204 var4  44          org/test ${shortUUID} *
 		` + '\n';
 
 		out = out.map((l) => l.replace(/ +/g, ' '));
@@ -243,20 +245,20 @@ describe('balena envs', function () {
 	});
 
 	it('should successfully list env and service variables for a test device (unknown fleet)', async () => {
+		api.expectGetDevice({ shortUUID, fullUUID, inaccessibleApp: true });
 		api.expectGetDevice({ fullUUID, inaccessibleApp: true });
 		api.expectGetDeviceEnvVars();
 		api.expectGetDeviceServiceVars();
 
-		const uuid = shortUUID;
-		const result = await runCommand(`envs -d ${uuid}`);
+		const result = await runCommand(`envs -d ${shortUUID}`);
 		let { out } = result;
 		let expected =
 			stripIndent`
 			ID     NAME  VALUE       FLEET DEVICE  SERVICE
-			120120 svar3 svar3-value N/A   ${uuid} service1
-			120121 svar4 svar4-value N/A   ${uuid} service2
-			120203 var3  var3-val    N/A   ${uuid} *
-			120204 var4  44          N/A   ${uuid} *
+			120120 svar3 svar3-value N/A   ${shortUUID} service1
+			120121 svar4 svar4-value N/A   ${shortUUID} service2
+			120203 var3  var3-val    N/A   ${shortUUID} *
+			120204 var4  44          N/A   ${shortUUID} *
 		` + '\n';
 
 		out = out.map((l) => l.replace(/ +/g, ' '));
@@ -271,22 +273,22 @@ describe('balena envs', function () {
 		api.expectGetApplication();
 		api.expectGetAppEnvVars();
 		api.expectGetAppServiceVars();
+		api.expectGetDevice({ shortUUID, fullUUID });
 		api.expectGetDevice({ fullUUID });
 		api.expectGetDeviceEnvVars();
 		api.expectGetDeviceServiceVars();
 
-		const uuid = shortUUID;
-		const result = await runCommand(`envs -d ${uuid} -s ${serviceName}`);
+		const result = await runCommand(`envs -d ${shortUUID} -s ${serviceName}`);
 		let { out } = result;
 		let expected =
 			stripIndent`
 			ID     NAME  VALUE       FLEET    DEVICE  SERVICE
 			120110 svar1 svar1-value org/test *       ${serviceName}
-			120120 svar3 svar3-value org/test ${uuid} ${serviceName}
+			120120 svar3 svar3-value org/test ${shortUUID} ${serviceName}
 			120101 var1  var1-val    org/test *       *
 			120102 var2  22          org/test *       *
-			120203 var3  var3-val    org/test ${uuid} *
-			120204 var4  44          org/test ${uuid} *
+			120203 var3  var3-val    org/test ${shortUUID} *
+			120204 var4  44          org/test ${shortUUID} *
 		` + '\n';
 
 		out = out.map((l) => l.replace(/ +/g, ' '));
@@ -301,6 +303,7 @@ describe('balena envs', function () {
 		api.expectGetApplication();
 		api.expectGetAppEnvVars();
 		api.expectGetAppServiceVars();
+		api.expectGetDevice({ shortUUID, fullUUID });
 		api.expectGetDevice({ fullUUID });
 		api.expectGetDeviceEnvVars();
 		api.expectGetDeviceServiceVars();

tests/commands/os/configure.spec.ts

@@ -59,6 +59,7 @@ if (process.platform !== 'win32') {
 				'--config-network ethernet',
 				'--initial-device-name testDeviceName',
 				'--provisioning-key-name testKey',
+				'--provisioning-key-expiry-date 2050-12-12',
 			];
 
 			const { err } = await runCommand(command.join(' '));

tests/commands/ssh.spec.ts

@@ -178,7 +178,7 @@ async function startMockSshServer(): Promise<[Server, number]> {
 	});
 
 	return await new Promise<[Server, number]>((resolve, reject) => {
-		// TODO: remove 'as any' below. According to @types/node v12.20.42, the
+		// TODO: remove 'as any' below. According to @types/node v16.18.25, the
 		// callback type is `() => void`, but our code assumes `(err: Error) => void`
 		const listener = (server.listen as any)(0, '127.0.0.1', (err: Error) => {
 			// this callback is called for the 'listening' event

tests/docker-build.ts

@@ -19,7 +19,7 @@ import { expect } from 'chai';
 import * as _ from 'lodash';
 import { promises as fs } from 'fs';
 import * as path from 'path';
-import { PathUtils } from 'resin-multibuild';
+import { PathUtils } from '@balena/compose/dist/multibuild';
 import rewire = require('rewire');
 import * as sinon from 'sinon';
 import { Readable } from 'stream';

tests/nock/balena-api-mock.ts

@@ -212,13 +212,20 @@ export class BalenaAPIMock extends NockMock {
 
 	public expectGetDevice(opts: {
 		fullUUID: string;
+		shortUUID?: string;
 		inaccessibleApp?: boolean;
 		isOnline?: boolean;
 		optional?: boolean;
 		persist?: boolean;
 	}) {
 		const id = 7654321;
-		this.optGet(/^\/v\d+\/device($|\?)/, opts).reply(200, {
+		const providedUuid = opts.shortUUID ?? opts.fullUUID;
+		this.optGet(
+			providedUuid.length !== 32
+				? /^\/v\d+\/device($|\?)/
+				: /^\/v\d+\/device\(uuid=%27[0-9a-f]{32}%27\)/,
+			opts,
+		).reply(200, {
 			d: [
 				{
 					id,

tests/nock/proxy-server.ts

@@ -113,7 +113,7 @@ async function createProxyServer(): Promise<[number, number]> {
 	let proxyPort = 0; // TCP port number, 0 means automatic allocation
 
 	await new Promise<void>((resolve, reject) => {
-		// TODO: remove 'as any' below. According to @types/node v12.20.42, the
+		// TODO: remove 'as any' below. According to @types/node v16.18.25, the
 		// callback type is `() => void`, but our code assumes `(err: Error) => void`
 		const listener = (server.listen as any)(0, '127.0.0.1', (err: Error) => {
 			if (err) {
@@ -197,7 +197,7 @@ async function createInterceptorServer(): Promise<number> {
 	let interceptorPort = 0;
 
 	await new Promise<void>((resolve, reject) => {
-		// TODO: remove 'as any' below. According to @types/node v12.20.42, the
+		// TODO: remove 'as any' below. According to @types/node v16.18.25, the
 		// callback type is `() => void`, but our code assumes `(err: Error) => void`
 		const listener = (server.listen as any)(0, '127.0.0.1', (err: Error) => {
 			if (err) {