pull-reqeust created: https://github.com/vyos/vyos-1x/pull/4430

Response Policy Zone (RPZ)
It would be very very useful feature in VYOS
RPZ allows admins to easily block access to websites via DNS lookup. The lookup is done before the main communication which is based on IP addresses ( which can be blocked by IP Address Blocklists ). Usually the URLs of malicious websites do change much less often, compared to the IPs of them.

your assumption is correct, but:

In T7159#219749, @dmbaturin wrote:

@MPStudyly Well, it's open-source, so anyone can remove the banner by editing the script. The intention of the banner is simply to explain that rolling release and stream builds offer no stability guarantees.

In VMware vSphere, in multiple devices these log messages are seen after upgrading to 1.4.1 version:

The 2.6.12-1+deb12u1 is the latest package available from the Debian bookworm https://packages.debian.org/bookworm/haproxy
If you need the newest HAproxy version, you should build this by building scripts https://github.com/vyos/vyos-build/tree/current/scripts/package-build
Or waiting until bookworm updates the major package version.

Note that if the version of HAProxy used in Vyos is upgraded to version 2.8 or later (as proposed in T7142), then HTTP/2 is enabled by default and this task can be closed as "overcome by events".

HAProxy documentation for this:

I was looking into backporting it myself lately, at a glance your approach seems correct. I'll look deeper into it.

Just gonna bump this again. Would be great to see support for this as it would be super helpful for complex architecture-based netboot configurations.

The current fix is necessary, but it's not complete.

The above linked PR is ready for review by a maintainer. I've tried to cherry-pick only the most relevant commits from the upstream. The build was tested in the vyos-build container (as modified in https://vyos.dev/T7300) after each commit and the overall authentication flow was tested once as described in the PR.

@MPStudyly Well, it's open-source, so anyone can remove the banner by editing the script. The intention of the banner is simply to explain that rolling release and stream builds offer no stability guarantees.

Regarding the failure of the PR integration tests, this may have been a result of a typo, now corrected in rolling here:
https://github.com/vyos/vyos-1x/pull/4425
or an inconsistent github action (I will check that).

https://github.com/vyos/vyos-build/pull/939

SUMMARY:
working versions:

7.5.1-20240509-02-gc9dd2977e
8.0.1

Not working:

8.1
8.2.2
8.3-2 
9+
10+

also failed in PR

https://github.com/vyos/vyos-1x/pull/4424

Using relative url in .gitmodules will get forked repos difficult to build if not modify .gitmodules manually.

I looked through some Debian and Ubuntu ISOs and didn't notice dropbear installed in the live image. It's likely we are mostly susceptible to this because the live image is used as a loopback mount during normal installation. Many other Debian-based systems would be debootstrapped onto the host.