v4.1.342

Update balena/open-balena-api Docker tag to v34.4.4

.github/actionlint.yaml

@@ -0,0 +1,8 @@
+self-hosted-runner:
+  # Labels of self-hosted runner in array of strings.
+  labels:
+  - "distro:jammy"
+# Configuration variables in array of strings defined in your repository or
+# organization. `null` means disabling configuration variables check.
+# Empty array means no configuration variable is allowed.
+config-variables: null

.github/renovate.json

@@ -0,0 +1,27 @@
+{
+  "extends": ["github>balena-io/renovate-config"],
+  "ignorePaths": [
+    "**/node_modules/**",
+    "**/bower_components/**",
+    "**/vendor/**",
+    "**/examples/**",
+    "**/__tests__/**",
+    "**/test/**",
+    "**/tests/suites/**",
+    "**/__fixtures__/**",
+    "**/Dockerfile.template"
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": [
+        ".*"
+      ],
+      "matchStrings": [
+        ".*amiFilter=(?<packageName>.*?)\n(.*currentImageName=(?<currentDigest>.*?)\n)?(.*\n)?.*?(?<depName>[a-zA-Z0-9-_:]*)[ ]*?[:|=][ ]*?[\"|']?(?<currentValue>ami-[a-z0-9]{17})[\"|']?.*"
+      ],
+      "datasourceTemplate": "aws-machine-image",
+      "versioningTemplate": "aws-machine-image"
+    }
+  ]
+}

.github/workflows/flowzone.yml

@@ -8,6 +8,11 @@ on:
     types: [opened, synchronize, closed]
     branches: [main, master]
 
+permissions:
+  contents: read
+  id-token: "write"  # AWS GitHub OIDC required: write
+  packages: read
+
 jobs:
   flowzone:
     name: Flowzone
@@ -25,15 +30,6 @@ jobs:
     with:
       jobs_timeout_minutes: 60
       cloudflare_website: open-balena
-      custom_runs_on: |
-        [
-          [
-            "self-hosted",
-            "Linux",
-            "X64"
-          ]
-        ]
-
       balena_slugs: |
         balena/open-balena
 

.github/workflows/renovate.json

@@ -0,0 +1,15 @@
+{
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": [
+        ".*"
+      ],
+      "matchStrings": [
+        ".*amiFilter=(?<packageName>.*?)\n(.*currentImageName=(?<currentDigest>.*?)\n)?(.*\n)?.*?(?<depName>[a-zA-Z0-9-_:]*)[ ]*?[:|=][ ]*?[\"|']?(?<currentValue>ami-[a-z0-9]{17})[\"|']?.*"
+      ],
+      "datasourceTemplate": "aws-machine-image",
+      "versioningTemplate": "aws-machine-image"
+    }
+  ]
+}

.github/workflows/tests.yml

@@ -51,8 +51,8 @@ jobs:
             launch_template_version: ${{ vars.AWS_EC2_LT_VERSION || '6' }}
             # https://docs.renovatebot.com/modules/datasource/aws-machine-image/
             # amiFilter=[{"Name":"owner-id","Values":["099720109477"]},{"Name":"name","Values":["ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"]},{"region":"us-east-1"}]
-            # currentImageName=unknown
-            ami: ami-04b70fa74e45c3917
+            # currentImageName=ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-20241206
+            ami: ami-00f3c44a2de45a590
             subdomain:  ${{ vars.DNS_SUBDOMAIN || 'auto' }}
             dns_tld: ${{ vars.DNS_TLD || 'balena-devices.com' }}
 
@@ -73,13 +73,15 @@ jobs:
       name: ${{ matrix.target }}
 
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+    - uses: actions/checkout@85e6279cec87321a52edac9c87bce653a07cf6c2
+      with:
+        persist-credentials: false
 
     # https://github.com/unfor19/install-aws-cli-action
     - name: Setup awscli
       uses: unfor19/install-aws-cli-action@e8b481e524a99f37fbd39fdc1dcb3341ab091367 # v1
 
-    - uses: aws-actions/configure-aws-credentials@61a110527dcc9ccef6c109117050c80a00bec898
+    - uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722
       with:
         aws-region: ${{ vars.AWS_REGION || 'us-east-1' }}
         role-session-name: github-${{ github.job }}-${{ github.run_id }}-${{ github.run_attempt }}
@@ -90,15 +92,19 @@ jobs:
     - name: install session-manager-plugin
       if: matrix.target == 'compose-private-pki'
       run: |
+        # shellcheck disable=SC2153
         runner_arch="$(echo "${RUNNER_ARCH}" | tr '[:upper:]' '[:lower:]' | sed 's/x64/64bit/g')"
 
-        session-manager-plugin || (curl -sSfo session-manager-plugin.deb https://s3.amazonaws.com/session-manager-downloads/plugin/latest/ubuntu_${runner_arch}/session-manager-plugin.deb \
+        session-manager-plugin || (curl -sSfo session-manager-plugin.deb "https://s3.amazonaws.com/session-manager-downloads/plugin/latest/ubuntu_${runner_arch}/session-manager-plugin.deb" \
           && sudo dpkg -i session-manager-plugin.deb \
           && rm -f session-manager-plugin.deb)
 
     # https://github.com/balena-io-examples/setup-balena-action
     - name: Setup balena CLI
       uses: balena-io-examples/setup-balena-action@main
+      with:
+        # renovate: datasource=github-releases depName=balena-io/balena-cli
+        cli-version: v18.2.17
 
     # https://github.com/pdcastro/ssh-uuid#why
     # https://github.com/pdcastro/ssh-uuid#linux-debian-ubuntu-others
@@ -144,7 +150,7 @@ jobs:
         set ${verbose}
 
         key_name="${{ matrix.target }}-${GITHUB_RUN_ID}-${GITHUB_RUN_NUMBER}-${GITHUB_RUN_ATTEMPT}"
-        echo "key_name=${key_name}" >> $GITHUB_OUTPUT
+        echo "key_name=${key_name}" >>"${GITHUB_OUTPUT}"
 
         set +x
         private_key_material="$(aws ec2 create-key-pair \
@@ -160,14 +166,13 @@ jobs:
         done <<< "${private_key_material}"
 
         ssh_private_key="$(cat << EOF
-        $(echo "${private_key_material}")
+        ${private_key_material}
         EOF
         )"
-        echo "ssh_private_key<<EOF" >> $GITHUB_OUTPUT
+        echo "ssh_private_key<<EOF" >>"${GITHUB_OUTPUT}"
         set ${verbose}
 
-        echo "${ssh_private_key}" >> $GITHUB_OUTPUT
-        echo "EOF" >> $GITHUB_OUTPUT
+        { echo "${ssh_private_key}"; echo "EOF"; } >>"${GITHUB_OUTPUT}"
 
         echo "ssh_public_key=${public_key}" >> "${GITHUB_OUTPUT}"
 
@@ -201,6 +206,7 @@ jobs:
         # the actual version deployed depends on the AWS EC2/AMI, defined in AWS_EC2_LAUNCH_TEMPLATE
         os_version="$(balena os versions ${{ vars.DEVICE_TYPE || 'generic-amd64' }} | head -n 1)"
 
+        # shellcheck disable=SC2046
         balena config generate \
           --version "${os_version}" \
           --device "${balena_device_uuid}" \
@@ -217,7 +223,7 @@ jobs:
           GITHUB_SHA GITHUB_WORKFLOW RUNNER_ARCH RUNNER_NAME RUNNER_OS)
 
         for github_var in "${github_vars[@]}"; do
-            balena tag set ${github_var} "${!github_var}" --device "${balena_device_uuid}"
+            balena tag set "${github_var}" "${!github_var}" --device "${balena_device_uuid}"
         done
 
         echo "balena_device_uuid=${balena_device_uuid}" >> "${GITHUB_OUTPUT}"
@@ -391,6 +397,7 @@ jobs:
 
         source src/balena-tests/functions
 
+        # shellcheck disable=SC2046,SC2043
         for subnet_id in ${{ env.AWS_VPC_SUBNET_IDS }}; do
             # spot, on-demand
             for market_type in ${{ vars.MARKET_TYPES || 'spot' }}; do
@@ -439,6 +446,12 @@ jobs:
 
         source src/balena-tests/functions
 
+        function cleanup() {
+            aws ec2 describe-instances --instance-ids ${{ steps.balena-sut.outputs.instance_id }} \
+              | jq -r .Reservations[].Instances[].StateReason
+        }
+        trap 'cleanup' EXIT
+
         with_backoff balena login --token '${{ secrets.BALENA_API_KEY }}'
 
         if ! [[ -e "${HOME}/.ssh/id_rsa" ]]; then
@@ -450,7 +463,7 @@ jobs:
 
         match=''
         for key in $(balena keys | grep -v ID | awk '{print $1}'); do
-            fp=$(balena key ${key} | tail -n 1 | ssh-keygen -E md5 -lf /dev/stdin | awk '{print $2}')
+            fp=$(balena key "${key}" | tail -n 1 | ssh-keygen -E md5 -lf /dev/stdin | awk '{print $2}')
             if [[ $fp =~ $(ssh-keygen -E md5 -lf "${HOME}/.ssh/id_rsa" | awk '{print $2}') ]]; then
                 match="${key}"
                 break
@@ -470,8 +483,8 @@ jobs:
             echo "::warning::Still working..."
             sleep "$(( (RANDOM % 5) + 5 ))s"
 
-            aws ec2 wait instance-running --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || break
-            aws ec2 wait instance-status-ok --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || break
+            aws ec2 wait instance-running --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || exit 1
+            aws ec2 wait instance-status-ok --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || exit 1
         done
 
         echo "key_id=${GITHUB_SHA}" >> "${GITHUB_OUTPUT}"
@@ -486,6 +499,12 @@ jobs:
 
         source src/balena-tests/functions
 
+        function cleanup() {
+            aws ec2 describe-instances --instance-ids ${{ steps.balena-sut.outputs.instance_id }} \
+              | jq -r .Reservations[].Instances[].StateReason
+        }
+        trap 'cleanup' EXIT
+
         with_backoff balena login --token '${{ secrets.BALENA_API_KEY }}'
 
         balena whoami && ssh-add -l
@@ -499,8 +518,8 @@ jobs:
 
             sleep "$(( ( RANDOM % ${{ env.RETRY }} ) + ${{ env.RETRY }} ))s"
 
-            aws ec2 wait instance-running --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || break
-            aws ec2 wait instance-status-ok --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || break
+            aws ec2 wait instance-running --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || exit 1
+            aws ec2 wait instance-status-ok --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || exit 1
         done
 
         # wait for services to start running
@@ -512,8 +531,8 @@ jobs:
             echo "::warning::Still working..."
             sleep "$(( (RANDOM % 30) + 30 ))s"
 
-            aws ec2 wait instance-running --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || break
-            aws ec2 wait instance-status-ok --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || break
+            aws ec2 wait instance-running --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || exit 1
+            aws ec2 wait instance-status-ok --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || exit 1
         done
 
         # wait for Docker healthchecks
@@ -526,8 +545,8 @@ jobs:
             echo "::warning::Still working..."
             sleep "$(( (RANDOM % 30) + 30 ))s"
 
-            aws ec2 wait instance-running --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || break
-            aws ec2 wait instance-status-ok --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || break
+            aws ec2 wait instance-running --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || exit 1
+            aws ec2 wait instance-status-ok --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || exit 1
         done
 
     # (TBC) https://www.balena.io/docs/reference/supervisor/docker-compose/
@@ -544,6 +563,12 @@ jobs:
 
         source src/balena-tests/functions
 
+        function cleanup() {
+            aws ec2 describe-instances --instance-ids ${{ steps.balena-sut.outputs.instance_id }} \
+              | jq -r .Reservations[].Instances[].StateReason
+        }
+        trap 'cleanup' EXIT
+
         with_backoff balena login --token '${{ secrets.BALENA_API_KEY }}'
 
         balena whoami && ssh-add -l
@@ -566,8 +591,8 @@ jobs:
             echo "::warning::Still working..."
             sleep "$(( (RANDOM % 30) + 30 ))s"
 
-            aws ec2 wait instance-running --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || break
-            aws ec2 wait instance-status-ok --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || break
+            aws ec2 wait instance-running --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || exit 1
+            aws ec2 wait instance-status-ok --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || exit 1
         done
 
     - name: SUT&DUT (balena)
@@ -612,8 +637,8 @@ jobs:
             echo "::warning::Still working..."
             sleep "$(( ( RANDOM % ${{ env.RETRY }} ) + ${{ env.RETRY }} ))s"
 
-            aws ec2 wait instance-running --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || break
-            aws ec2 wait instance-status-ok --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || break
+            aws ec2 wait instance-running --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || exit 1
+            aws ec2 wait instance-status-ok --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || exit 1
         done
 
         # .. once the service exits with status == exited, it is assumed to be finished
@@ -629,8 +654,8 @@ jobs:
 
             sleep "$(( ( RANDOM % ${{ env.RETRY }} ) + ${{ env.RETRY }} ))s"
 
-            aws ec2 wait instance-running --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || break
-            aws ec2 wait instance-status-ok --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || break
+            aws ec2 wait instance-running --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || exit 1
+            aws ec2 wait instance-status-ok --instance-ids ${{ steps.balena-sut.outputs.instance_id }} || exit 1
         done
 
         # .. check its exit code
@@ -775,6 +800,14 @@ jobs:
                 && rm -f "\${tmphosts}" \
                 && getent hosts api.${{ matrix.subdomain }}.${{ matrix.dns_tld }} | grep 127.0.1.1
 
+              sshd -T
+              service ssh restart
+
+          # https://forums.docker.com/t/docker-compose-through-ssh-failing-and-referring-to-docker-example-com/115165/18
+          - path: /etc/ssh/sshd_config.d/00-cloud-init
+            content: |
+              MaxStartups 100:0:100
+
         # cloud-init runs as root
         # (e.g.) https://cloudinit.readthedocs.io/en/latest/reference/merging.html#example-cloud-config
         runcmd:
@@ -783,6 +816,7 @@ jobs:
 
         cloud-init schema -c user-data.yml
 
+        # shellcheck disable=SC2046,SC2043
         for subnet_id in ${{ env.AWS_VPC_SUBNET_IDS }}; do
             # spot, on-demand
             for market_type in ${{ vars.MARKET_TYPES || 'spot' }}; do
@@ -792,7 +826,7 @@ jobs:
                       $([[ -n '${{ matrix.ami }}' ]] && echo '--image-id ${{ matrix.ami }}') \
                       --launch-template 'LaunchTemplateId=${{ env.AWS_EC2_LAUNCH_TEMPLATE }},Version=${{ matrix.launch_template_version }}' \
                       --instance-type "${instance_type}" \
-                      $([[ $market_type =~ spot ]] && echo '--instance-market-options MarketType=spot') \
+                      $([[ "$market_type" =~ spot ]] && echo '--instance-market-options MarketType=spot') \
                       --security-group-ids '${{ env.AWS_VPC_SECURITY_GROUP_IDS }}' \
                       --subnet-id "${subnet_id}" \
                       --key-name '${{ steps.generate-key-pair.outputs.key_name }}' \
@@ -810,11 +844,15 @@ jobs:
         [[ -z $response ]] && exit 1
 
         instance_id="$(echo "${response}" | jq -r '.Instances[].InstanceId')"
-        echo "instance_id=${instance_id}" >> $GITHUB_OUTPUT
+        echo "instance_id=${instance_id}" >>"${GITHUB_OUTPUT}"
 
         aws ec2 wait instance-running --instance-ids "${instance_id}"
         with_backoff aws ec2 wait instance-status-ok --instance-ids "${instance_id}"
 
+        private_ip="$(aws ec2 describe-instances --instance-id "${instance_id}" \
+          | jq -r .Reservations[].Instances[].PrivateIpAddress)"
+        echo "private_ip=${private_ip}" >>"${GITHUB_OUTPUT}"
+
       env:
         ATTEMPTS: 2
         AWS_DEFAULT_REGION: ${{ vars.AWS_REGION || 'us-east-1' }}
@@ -852,10 +890,20 @@ jobs:
         trap 'log_output' EXIT
 
         # https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.html
+        mkdir -p "${HOME}/.ssh/controlmasters"
         cat << EOF > "${HOME}/.ssh/config"
+        host *
+            StrictHostKeyChecking no
+            UserKnownHostsFile /dev/null
+
         host i-*
             StrictHostKeyChecking no
             UserKnownHostsFile /dev/null
+            TCPKeepAlive yes
+            ServerAliveInterval 5
+            ControlPath "${HOME}/.ssh/controlmasters/%r@%h:%p"
+            ControlMaster auto
+            ControlPersist 5m
             ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'"
         EOF
 
@@ -888,7 +936,7 @@ jobs:
         echo "${result}" | jq -re
         cid="$(echo "${result}" | jq -r .Command.CommandId)"
         iid="$(echo "${result}" | jq -r .Command.InstanceIds[0])"
-        ([[ -n "$cid" ]] && [[ -n "$iid" ]]) || false
+        { [[ -n "$cid" ]] && [[ -n "$iid" ]]; } || false
 
         # https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#grouping-log-lines
         CYAN='\033[0;36m'; NC='\033[0m'; echo -e "::group::${CYAN}open-balena-tests${NC}"
@@ -912,26 +960,26 @@ jobs:
             with_backoff docker compose ls
             sleep $(((RANDOM%5) + 5))s
 
-            aws ec2 wait instance-running --instance-ids ${{ steps.ubuntu-sut.outputs.instance_id }} || break
-            aws ec2 wait instance-status-ok --instance-ids ${{ steps.ubuntu-sut.outputs.instance_id }} || break
+            aws ec2 wait instance-running --instance-ids ${{ steps.ubuntu-sut.outputs.instance_id }} || exit 1
+            aws ec2 wait instance-status-ok --instance-ids ${{ steps.ubuntu-sut.outputs.instance_id }} || exit 1
         done
         echo '::info::composition started'
 
         touch .env
         for service in sut dut; do
-        until [[ "$(docker compose ps --services "${service}" --status running)" =~ "${service}" ]]; do
+        until [[ "$(docker compose ps --services "${service}" --status running)" =~ ${service} ]]; do
             echo "::info::waiting for ${service}..."
             with_backoff docker compose ps
             sleep $(((RANDOM%5) + 5))s
 
-            aws ec2 wait instance-running --instance-ids ${{ steps.ubuntu-sut.outputs.instance_id }} || break
-            aws ec2 wait instance-status-ok --instance-ids ${{ steps.ubuntu-sut.outputs.instance_id }} || break
+            aws ec2 wait instance-running --instance-ids ${{ steps.ubuntu-sut.outputs.instance_id }} || exit 1
+            aws ec2 wait instance-status-ok --instance-ids ${{ steps.ubuntu-sut.outputs.instance_id }} || exit 1
         done
         echo "::info::${service} started"
         done
 
         echo '::info::settling down...'
-        sleep $(((RANDOM%30) + 15))s
+        sleep $(((RANDOM%15) + 15))s
 
         while [[ "$(aws ssm list-command-invocations --command-id "${cid}" \
           | jq -re '.CommandInvocations[].Status')" =~ InProgress ]]; do
@@ -940,8 +988,8 @@ jobs:
             echo '::info::still running...'
             sleep $(((RANDOM%1) + 1))s
 
-            aws ec2 wait instance-running --instance-ids ${{ steps.ubuntu-sut.outputs.instance_id }} || break
-            aws ec2 wait instance-status-ok --instance-ids ${{ steps.ubuntu-sut.outputs.instance_id }} || break
+            aws ec2 wait instance-running --instance-ids ${{ steps.ubuntu-sut.outputs.instance_id }} || exit 1
+            aws ec2 wait instance-status-ok --instance-ids ${{ steps.ubuntu-sut.outputs.instance_id }} || exit 1
         done
 
         aws ssm wait command-executed --command-id "${cid}" --instance-id "${iid}"
@@ -974,6 +1022,16 @@ jobs:
         with_backoff balena keys | grep ${{ steps.provision-ssh-key.outputs.key_id }} \
           | awk '{print $1}' | xargs --no-run-if-empty balena key rm --yes
 
+    - name: remove AWS/EC2 key-pair
+      if: always() && matrix.target == 'compose-private-pki'
+      continue-on-error: true
+      run: |
+        set -ue
+
+        [[ '${{ vars.VERBOSE }}' =~ on|On|Yes|yes|true|True ]] && set -x
+
+        aws ec2 delete-key-pair --key-name ${{ steps.generate-key-pair.outputs.key_name }}
+
     - name: delete balenaOS test device
       if: always() && matrix.target == 'balena-public-pki'
       continue-on-error: true
@@ -993,7 +1051,7 @@ jobs:
 
     # always destroy test EC2 instances even if the workflow is cancelled
     - name: destroy AWS test device(s)
-      if: always()
+      if: always() && matrix.target == 'balena-public-pki'
       run: |
         set -ue
 
@@ -1006,33 +1064,55 @@ jobs:
               --instance-ids ${{ steps.balena-sut.outputs.instance_id }}
         fi
 
+      env:
+        AWS_DEFAULT_REGION: ${{ vars.AWS_REGION || 'us-east-1' }}
+
+    # always destroy test EC2 instances even if the workflow is cancelled
+    - name: destroy AWS test device(s)
+      if: always() && matrix.target == 'compose-private-pki'
+      run: |
+        set -ue
+
+        [[ '${{ vars.VERBOSE }}' =~ on|On|Yes|yes|true|True ]] && set -x
+
+        source src/balena-tests/functions
+
         if [[ -n '${{ steps.ubuntu-sut.outputs.instance_id }}' ]]; then
             with_backoff aws ec2 terminate-instances \
               --instance-ids ${{ steps.ubuntu-sut.outputs.instance_id }}
         fi
 
-        with_backoff aws ec2 describe-instances --filters Name=tag:GITHUB_SHA,Values=${GITHUB_SHA}-tests \
-          | jq -r .Reservations[].Instances[].InstanceId \
-          | xargs --no-run-if-empty aws ec2 terminate-instances --instance-ids
+      env:
+        AWS_DEFAULT_REGION: ${{ vars.AWS_REGION || 'us-east-1' }}
+
+    # always destroy stale test EC2 instances
+    - name: destroy stale AWS test device(s)
+      if: always()
+      run: |
+        set -ue
+
+        [[ '${{ vars.VERBOSE }}' =~ on|On|Yes|yes|true|True ]] && set -x
+
+        source src/balena-tests/functions
 
         stale_instances=$(mktemp)
         aws ec2 describe-instances --filters \
           Name=tag:Name,Values=open-balena-tests \
           Name=instance-state-name,Values=running \
-          | jq -re '.Reservations[].Instances[].InstanceId + " " + .Reservations[].Instances[].LaunchTime' > ${stale_instances} || true
+          | jq -re '.Reservations[].Instances[].InstanceId + " " + .Reservations[].Instances[].LaunchTime' > "${stale_instances}" || true
 
         if test -s "${stale_instances}"; then
             while IFS= read -r line; do
-                instance_id=$(echo ${line} | awk '{print $1}')
-                launch_time=$(echo ${line} | awk '{print $2}')
-                now=$(date +%s)
-                then=$(date --date ${launch_time} +%s)
-                days_since_launch=$(( (now - then) / 86400 ))
-                if [[ -n $days_since_launch ]] && [[ $days_since_launch -ge 1 ]]; then
-                    with_backoff aws ec2 terminate-instances --instance-ids ${instance_id}
+                instance_id="$(echo "${line}" | awk '{print $1}')"
+                launch_time="$(echo "${line}" | awk '{print $2}')"
+                now="$(date +%s)"
+                then="$(date --date "${launch_time}" +%s)"
+                days_since_launch="$(( (now - then) / 86400 ))"
+                if [[ -n "$days_since_launch" ]] && [[ $days_since_launch -ge 1 ]]; then
+                    with_backoff aws ec2 terminate-instances --instance-ids "${instance_id}"
                 fi
-            done <${stale_instances}
-            rm -f ${stale_instances}
+            done <"${stale_instances}"
+            rm -f "${stale_instances}"
         fi
 
       env:
@@ -1056,11 +1136,11 @@ jobs:
               "https://api.cloudflare.com/client/v4/zones?name=${{ matrix.dns_tld }}" \
               -H 'Authorization: Bearer ${{ secrets.CLOUDFLARE_API_TOKEN }}' | jq -r '.result[].id')"
 
-            for record in "$(curl --silent --retry ${{ env.RETRY }} \
+            for record in $(curl --silent --retry ${{ env.RETRY }} \
               "https://api.cloudflare.com/client/v4/zones/${zone_id}/dns_records" \
               -H 'Authorization: Bearer ${{ secrets.CLOUDFLARE_API_TOKEN }}' \
               | jq -r --arg match "${match}" '.result[] | select(((.type=="TXT") and (.name | contains($match))))' \
-              | base64)"; do
+              | base64); do
 
                 json="$(echo "${record}" | base64 -d | jq -r)"
                 id="$(echo "${json}" | jq -r .id)"

.pre-commit-config.yaml

@@ -0,0 +1,17 @@
+# See https://pre-commit.com for more information
+# See https://pre-commit.com/hooks.html for more hooks
+exclude: ^(.versionbot/|CHANGELOG.md|VERSION|README.md)
+repos:
+-   repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+    -   id: trailing-whitespace
+    -   id: end-of-file-fixer
+    -   id: check-yaml
+        args: [--allow-multiple-documents]
+    -   id: check-added-large-files
+
+-   repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.10.0.1
+    hooks:
+    -   id: shellcheck

Makefile

@@ -145,7 +145,7 @@ auto-pki: config # Start all services using LetsEncrypt and ACME
 	@docker compose up -d
 	@$(MAKE) waitlog SERVICE=cert-manager LOG_STRING="/certs/export/chain.pem Certificate will not expire in [0-9] days"
 	@$(MAKE) waitlog SERVICE=cert-manager LOG_STRING="subject=CN = ${DNS_TLD}"
-	@$(MAKE) waitlog SERVICE=cert-manager LOG_STRING="issuer=C = US, O = Let's Encrypt, CN = R3"
+	@$(MAKE) waitlog SERVICE=cert-manager LOG_STRING="issuer=C = US, O = Let's Encrypt, CN = .*"
 	@$(MAKE) wait SERVICE=haproxy
 	@$(MAKE) showenv
 	@$(MAKE) showpass

README.md

@@ -16,6 +16,23 @@ images to your devices.
 
 To learn more about openBalena, visit [balena.io/open][open-balena-website].
 
+- [Features](#features)
+- [Getting Started](#getting-started)
+- [Compatibility](#compatibility)
+- [Documentation](#documentation)
+- [Getting Help](#getting-help)
+- [Contributing](#contributing)
+- [Roadmap](#roadmap)
+- [Differences between openBalena and balenaCloud](#differences-between-openbalena-and-balenacloud)
+- [License](#license)
+- [FAQ](#faq)
+  - [How do you ensure continuity of openBalena? Are there security patches on openBalena?](#how-do-you-ensure-continuity-of-openbalena-are-there-security-patches-on-openbalena)
+  - [How do you ensure the "Join" command actually works between openBalena and](#how-do-you-ensure-the-join-command-actually-works-between-openbalena-and)
+  - [Is it "production ready"?](#is-it-production-ready)
+  - [Can a new device type be added to openBalena?](#can-a-new-device-type-be-added-to-openbalena)
+  - [Are there open-source UI dashboards from the community for openBalena?](#are-there-open-source-ui-dashboards-from-the-community-for-openbalena)
+
+
 
 ## Features
 
@@ -159,7 +176,7 @@ While we actually have some rather large fleets using openBalena, we consider it
 perpetually in "beta". This means potentially introducing breaking changes between
 releases.
 
-### Can new device type be added to openBalena?
+### Can a new device type be added to openBalena?
 openBalena imports the following public [device-types] "out of the box". You can specify
 your own contracts repository by overriding `CONTRACTS_PUBLIC_REPO_NAME`,
 `CONTRACTS_PUBLIC_REPO_OWNER` and `IMAGE_STORAGE_BUCKET` environment variables on the API

VERSION

@@ -1 +1 @@
-4.1.6
+4.1.342

balena.yml

@@ -23,4 +23,4 @@ data:
     - generic-amd64
     - genericx86-64-ext
     - intel-nuc
-version: 4.1.6
+version: 4.1.342

docker-compose.yml

@@ -26,7 +26,7 @@ x-default-environment: &default-environment
   DB_PASSWORD: docker
   DB_USER: docker
   LOG_LEVEL: DEBUG
-  PRODUCTION_MODE: 'false'
+  PRODUCTION_MODE: 'true'
 
 x-default-healthcheck-trait: &with-default-healthcheck
   healthcheck:
@@ -79,7 +79,7 @@ services:
       *with-default-privileges,
       *with-default-volumes,
     ]
-    image: balena/open-balena-api:v25.1.7
+    image: balena/open-balena-api:34.4.4
     depends_on:
       - db
       - redis
@@ -119,7 +119,7 @@ services:
       *with-default-healthcheck,
       *with-default-privileges,
     ]
-    image: balena/open-balena-registry:v2.39.58
+    image: balena/open-balena-registry:2.41.23
     volumes:
       - certs-data:/certs
       - resin-data:/balena
@@ -146,7 +146,7 @@ services:
       *with-network-privileges,
       *with-default-privileges,
     ]
-    image: balena/open-balena-vpn:v11.30.22
+    image: balena/open-balena-vpn:v11.30.83
     depends_on:
       - api
     environment:
@@ -156,6 +156,8 @@ services:
       VPN_PORT: 443
       # ensure correct service instance IP is registered with the API
       VPN_SERVICE_REGISTER_INTERFACE: eth0
+    devices:
+      - /dev/net/tun
 
   # https://github.com/balena-io/open-balena-db
   db:
@@ -175,7 +177,7 @@ services:
       *with-default-healthcheck,
       *with-default-privileges,
     ]
-    image: balena/open-balena-s3:v2.28.45
+    image: balena/open-balena-s3:2.28.67
     volumes:
       - s3-data:/export
       - certs-data:/certs
@@ -189,7 +191,7 @@ services:
   redis:
     <<: *base-service
     # https://redis.io/blog/what-redis-license-change-means-for-our-managed-service-providers/
-    image: redis:7.2-alpine
+    image: redis:7.4-alpine
     volumes:
       - redis-data:/data
     healthcheck:
@@ -259,7 +261,7 @@ services:
   # https://github.com/cloudflare/cfssl/blob/master/doc/api/intro.txt
   balena-ca:
     <<: *base-service
-    image: balena/ca-private:v0.0.14
+    image: balena/ca-private:0.0.15
     volumes:
       - pki-data:/pki
       - certs-data:/certs

src/balena-tests/Dockerfile

@@ -1,7 +1,7 @@
 FROM ubuntu:24.04
 
 # renovate: datasource=github-releases depName=balena-io/balena-cli
-ARG BALENA_CLI_VERSION=v18.2.10
+ARG BALENA_CLI_VERSION=v20.2.3
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
 	bash \

src/balena-tests/balena.sh

@@ -1,23 +1,24 @@
 #!/usr/bin/env bash
 
-# shellcheck disable=SC2154,SC2034,SC1090
-set -ae
+# shellcheck disable=SC2034,SC1090
+set -aeu
 
-curl_opts="--retry 3 --fail"
+read -ra curl_opts <<<'--retry 3 --fail'
 if [[ $VERBOSE =~ on|On|Yes|yes|true|True ]]; then
     set -x
-    curl_opts="${curl_opts} --verbose"
+    curl_opts+=('--verbose')
 else
-    curl_opts="${curl_opts} --silent"
+    curl_opts+=('--silent')
 fi
 
+# shellcheck disable=SC1091
 source /usr/sbin/functions
 
 function remove_test_assets() {
     rm -rf /balena/config.json \
       "${GUEST_IMAGE}" \
       "${GUEST_IMAGE%.*}.ready" \
-      "${tmpbuild}" \
+      "${tmpbuild:-}" \
       /tmp/*.img
 }
 
@@ -39,18 +40,20 @@ function shutdown_dut() {
     local balena_device_uuid
     balena_device_uuid="$(cat </balena/config.json | jq -r .uuid)"
 
-    if [[ -n $balena_device_uuid ]]; then
+    if [[ -n "${balena_device_uuid:-}" ]]; then
         with_backoff balena device "${balena_device_uuid}"
-        with_backoff balena device shutdown -f "${balena_device_uuid}"
+        if ! with_backoff balena device shutdown -f "${balena_device_uuid}"; then
+            echo 'DUT failed to shutdown properly'
+        fi
     fi
 }
 
 function set_update_lock {
-    if [[ -n "$BALENA_SUPERVISOR_ADDRESS" ]] && [[ -n "$BALENA_SUPERVISOR_API_KEY" ]]; then
-        while [[ $(curl ${curl_opts} "${BALENA_SUPERVISOR_ADDRESS}/v1/device?apikey=${BALENA_SUPERVISOR_API_KEY}" \
+    if [[ -n "${BALENA_SUPERVISOR_ADDRESS:-}" ]] && [[ -n "${BALENA_SUPERVISOR_API_KEY:-}" ]]; then
+        while [[ $(curl "${curl_opts[@]}" "${BALENA_SUPERVISOR_ADDRESS}/v1/device?apikey=${BALENA_SUPERVISOR_API_KEY}" \
           -H "Content-Type: application/json" | jq -r '.update_pending') == 'true' ]]; do
 
-            curl ${curl_opts} "${BALENA_SUPERVISOR_ADDRESS}/v1/device?apikey=${BALENA_SUPERVISOR_API_KEY}" \
+            curl "${curl_opts[@]}" "${BALENA_SUPERVISOR_ADDRESS}/v1/device?apikey=${BALENA_SUPERVISOR_API_KEY}" \
               -H "Content-Type: application/json" | jq -r
 
             sleep "$(( (RANDOM % 3) + 3 ))s"
@@ -87,7 +90,8 @@ function update_ca_certificates() {
 }
 
 function wait_for_api() {
-    while ! curl ${curl_opts} "https://api.${DNS_TLD}/ping"; do
+    while ! curl "${curl_opts[@]}" "https://api.${DNS_TLD}/ping"; do
+        echo 'waiting for API...'
         sleep "$(( (RANDOM % 5) + 5 ))s"
     done
 }
@@ -96,6 +100,7 @@ function open_balena_login() {
     while ! balena login --credentials \
       --email "${SUPERUSER_EMAIL}" \
       --password "${SUPERUSER_PASSWORD}"; do
+        echo 'waiting for auth...'
         sleep "$(( (RANDOM % 5) + 5 ))s"
     done
 }
@@ -104,6 +109,7 @@ function create_fleet() {
     if ! balena fleet "${TEST_FLEET}"; then
         # wait for API to load DT contracts
         while ! balena fleet create "${TEST_FLEET}" --type "${DEVICE_TYPE}"; do
+            echo 'waiting for device types...'
             sleep "$(( (RANDOM % 5) + 5 ))s"
         done
 
@@ -158,7 +164,7 @@ function check_device_status() {
         balena_device_uuid="$(cat </balena/config.json | jq -r .uuid)"
 
         if [[ -n $balena_device_uuid ]]; then
-            is_online="$(balena devices --json --fleet "${TEST_FLEET}" \
+            is_online="$(balena device list --json --fleet "${TEST_FLEET}" \
               | jq -r --arg uuid "${balena_device_uuid}" '.[] | select(.uuid==$uuid).is_online == true')"
 
             if [[ $is_online =~ true ]]; then
@@ -175,9 +181,10 @@ function wait_for_device() {
 }
 
 function registry_auth() {
-    if [[ -n $REGISTRY_USER ]] && [[ -n $REGISTRY_PASS ]]; then
+    if [[ -n "${REGISTRY_USER:-}" ]] && [[ -n "${REGISTRY_PASS:-}" ]]; then
         with_backoff docker login -u "${REGISTRY_USER}" -p "${REGISTRY_PASS}"
 
+        # shellcheck disable=SC2016
         printf '{"https://index.docker.io/v1/": {"username":"%s", "password":"$s"}}' \
           "${REGISTRY_USER}" "${REGISTRY_PASS}" | jq -r > ~/.balena/secrets.json
     fi
@@ -201,31 +208,29 @@ function deploy_release() {
 }
 
 function get_releases() {
-      with_backoff balena releases --json "${TEST_FLEET}"
+      with_backoff balena release list --json "${TEST_FLEET}"
 }
 
 function get_release_commit() {
-      echo "$(get_releases)" | jq -re \
-        'select((.[].status=="success")
-        and (.[].is_invalidated==false)
-        and (.[].is_final==true)
-        and (.[].release_type=="final"))[0].commit'
+      get_releases | jq -re \
+        '[.[] | select((.status=="success")
+        and (.is_invalidated==false)
+        and (.is_final==true))][0].commit'
 }
 
 function get_release_id() {
-      echo "$(get_releases)" | jq -re \
-        'select((.[].status=="success")
-        and (.[].is_invalidated==false)
-        and (.[].is_final==true)
-        and (.[].release_type=="final"))[0].id'
+      get_releases | jq -re \
+        '[.[] | select((.status=="success")
+        and (.is_invalidated==false)
+        and (.is_final==true))][0].id'
 }
 
 function supervisor_update_target_state() {
     local balena_device_uuid
     balena_device_uuid="$(cat </balena/config.json | jq -r .uuid)"
 
-    if [[ -n $balena_device_uuid ]]; then
-        while ! curl ${curl_opts} "https://api.${DNS_TLD}/supervisor/v1/update" \
+    if [[ -n "${balena_device_uuid:-}" ]]; then
+        while ! curl "${curl_opts[@]}" "https://api.${DNS_TLD}/supervisor/v1/update" \
           --header "Content-Type: application/json" \
           --header "Authorization: Bearer $(cat <~/.balena/token)" \
           --data "{\"uuid\": \"${balena_device_uuid}\", \"data\": {\"force\": true}}"; do
@@ -241,9 +246,9 @@ function check_running_release() {
 
     local should_be_running_release
     should_be_running_release="$(get_release_commit)"
-    [[ -z $should_be_running_release ]] && false
+    [[ -z "$should_be_running_release" ]] && false
 
-    if [[ -n $balena_device_uuid ]]; then
+    if [[ -n "${balena_device_uuid:-}" ]]; then
         while ! [[ $(balena device "${balena_device_uuid}" | grep -E ^COMMIT | awk '{print $2}') =~ ${should_be_running_release} ]]; do
             running_release_id="$(balena device "${balena_device_uuid}" | grep -E ^COMMIT | awk '{print $2}')"
             printf 'please wait, device %s should be running %s, but is still running %s...\n' \
@@ -258,7 +263,7 @@ function check_running_release() {
 
 function get_os_version() {
     local BALENARC_BALENA_URL
-    BALENARC_BALENA_URL="$(echo "${BALENA_API_URL}" | sed 's#https://api\.##g')"
+    BALENARC_BALENA_URL="${BALENA_API_URL//https:\/\/api\./}"
 
     local os_version
     os_version=${OS_VERSION:-$(with_backoff balena os versions "${DEVICE_TYPE}" | head -n 1)}
@@ -266,27 +271,27 @@ function get_os_version() {
 }
 
 function upload_release_asset() {
-    if [[ "$RELEASE_ASSETS_TEST" =~ true ]]; then
+    if [[ "${RELEASE_ASSETS_T:-}" =~ true ]]; then
         local release_id
         release_id=${1:-1}
         release_asset="$(find / -type f -name '*.png' | head -n 1)"
 
-        curl ${curl_opts} "https://api.${DNS_TLD}/resin/release_asset" \
+        curl "${curl_opts[@]}" "https://api.${DNS_TLD}/resin/release_asset" \
           --header "Authorization: Bearer $(cat <~/.balena/token)" \
           --form "asset=@${release_asset}" \
           --form "release=${release_id}" \
-          --form "asset_key=$((RANDOM))-$(basename ${release_asset})" \
+          --form "asset_key=$((RANDOM))-$(basename "${release_asset}")" \
           | jq -re .asset.href \
-          | xargs curl ${curl_opts} -o "/tmp/$((RANDOM))-$(basename ${release_asset})"
+          | xargs curl "${curl_opts[@]}" -o "/tmp/$((RANDOM))-$(basename "${release_asset}")"
     fi
 }
 
 # --- main
-if [[ "$PRODUCTION_MODE" =~ true ]]; then
+if [[ "${PRODUCTION_MODE:-}" =~ true ]]; then
     exit
 fi
 
-if [[ -n "${BALENA_DEVICE_UUID}" ]]; then
+if [[ -n "${BALENA_DEVICE_UUID:-}" ]]; then
     # prepend the device UUID if running on balenaOS
     TLD="${BALENA_DEVICE_UUID}.${DNS_TLD}"
 else
@@ -303,7 +308,19 @@ GUEST_IMAGE=${GUEST_IMAGE:-/balena/balena.img}
 OS_VERSION="$(get_os_version)"
 TEST_FLEET=${TEST_FLEET:-test-fleet}
 
-[[ -f "$CONF" ]] && source "${CONF}"
+# wait here until global config is ready
+until [[ -s "$CONF" ]]; do
+    echo 'waiting for config...'
+    sleep "$(( (RANDOM % 5) + 5 ))s"
+done
+source "${CONF}"
+
+# wait her until we have valid login credentials
+until [[ -n "${SUPERUSER_EMAIL:-}" ]] && [[ -n "${SUPERUSER_PASSWORD:-}" ]]; do
+    echo 'waiting for credentials...'
+    sleep "$(( (RANDOM % 5) + 5 ))s"
+    source "${CONF}"
+done
 
 update_ca_certificates  # ensure self-signed root CA certificate(s) trust
 

src/cert-manager/Dockerfile

@@ -1,4 +1,4 @@
 # https://github.com/balena-io/cert-manager
-FROM balena/cert-manager:v0.2.2
+FROM balena/cert-manager:0.2.3
 
 COPY *.json /opt/

src/test-device/Dockerfile

@@ -1,6 +1,6 @@
 # https://hub.docker.com/r/qemux/qemu-docker
 # https://github.com/qemus/qemu-docker
-FROM qemux/qemu-docker:5.16
+FROM qemux/qemu-docker:6.14
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
 	minicom \