This release makes the agent only load AppArmor profiles whose name
matches the profile file name. Profiles are enumerated with
`apparmor_parser --names` before load/unload, and any profile which is
not the file's base name or a child profile/hat of it is rejected. This
prevents an add-on supplied apparmor.txt from redefining unrelated
profiles such as docker-default or hassio-supervisor.
Full changelog:
* https://github.com/home-assistant/os-agent/releases/tag/1.14.0
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Borrow shrinking used in home-assistant/operating-system-full-images for
reducing the data partition size to only fit its contents. Currently the
data partition is intentionally overprovisioned to comfortably fit all
docker images in the hassio build. This results in unnecessarily large
image which takes longer to flash, as all the zeroes at the end of the
filesystem need to be written to the SD card.
For OVA and aarch64 VM formats, the image is resized before creating the
VM images - this also makes all generic-aarch64 images sized to 32GB,
unlike 6GB which inherently needed resizing before use. Some juggling
extra juggling is needed in the aarch64 post-image step, as we want to
preserve the raw image (e.g. for generic aarch64 boards) but it's
desirable to keep it minimal as well, as it's meant to be flashed to
real hardware storage.
* Harmonize systemd unit and helper-script prefixes to haos (#4725)
Rename the hassos-prefixed systemd units and their ExecStart helper
binaries to a consistent haos- prefix, and update all in-repo
references. Normalize the affected unit Description= strings as well.
Units renamed in this commit are not referred externally (except for
syslog identifiers used in Supervisor Host logs), so no other changes
should be needed.
* Rename hassos-config to haos-config with alias
Rename the hassos-config.service unit and its binary to the haos-
prefix. This unit is restarted by Supervisor in os/manager.py, so add
Alias= to avoid the need to try both variants there.
* Rename hassos-cli binary to haos-cli
* Change HassOS to HAOS in unit descriptions and comments
* Rename hassos->haos in Buildroot makefiles, scripts and configs
* Rename bootargs_hassos to bootargs_haos in U-Boot scripts
* Rename external Buildroot tree HASSOS to HAOS
Set external.desc name to HAOS and rename all BR2_EXTERNAL_HASSOS_PATH
references to BR2_EXTERNAL_HAOS_PATH accordingly.
* Rename hassos.conf service drop-ins to haos.conf
* Rename hassos.config kernel fragment to haos.config
* Rename hassos-blobs repo in package/bluetooth-rtl8723
The repo was renamed somewhere in the past and it now relies on an
internal GitHub redirect. Change the URL to match the new repo name.
On CM4, rpi-eeprom-update only prints warning if the env variable
enabling self-update isn't set. In that case, also print bootloader info
so we can propagate it further.
Also, add patch making findBootFS faster, avoiding scan of all block
devices.
Refs #4631
Previously we needed to call rpi-eeprom-update -b to learn if flashrom
must be used (which returned an error in that case) and there was no
info if flashrom update is available. Extend the output of the default
printVersions output to show this information as well, as it's rather
inexpensive to check it and it makes it easier to offer relevant update
entities based on that.
Part of #4631
* Update Linux to 6.18 for x86 targets
Update ova and generic_86_64 to Linux 6.18.22. Rebase the IPv6
reachability probe patch (which still applies on 6.12 with offsets) and
update config fragments.
The rtl8812au-aircrack-ng stays disabled as it no longer builds and is
deprecated by upstream rtw88 which supports those cards.
The fragemnts stay mostly the same with this diff:
--- ../v6.12.y/docker.config 2025-03-18 15:05:42.161955925 +0100
+++ docker.config 2026-04-16 15:01:30.346942217 +0200
@@ -45,3 +44,0 @@
-CONFIG_IP6_NF_FILTER=y
-CONFIG_IP6_NF_MANGLE=y
-CONFIG_IP6_NF_NAT=y
@@ -48,0 +46,3 @@
+CONFIG_NETFILTER_XT_NAT=y
+CONFIG_NETFILTER_XT_TARGET_REDIRECT=y
+CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
@@ -56,4 +55,0 @@
-CONFIG_IP_NF_FILTER=y
-CONFIG_IP_NF_NAT=y
-CONFIG_IP_NF_TARGET_MASQUERADE=y
-CONFIG_IP_NF_TARGET_REDIRECT=y
--- ../v6.12.y/hassos.config 2026-01-16 13:49:13.879830313 +0100
+++ hassos.config 2026-04-16 15:08:29.248341382 +0200
@@ -30,2 +29,0 @@
-CONFIG_ZSWAP_ZPOOL_DEFAULT_ZSMALLOC=y
-CONFIG_ZSMALLOC=y
The IP_NF/IP6_NF depend on IP_NF_IPTABLES_LEGACY which is now by default
disabled. Since we use iptables-nft, those should not be needed, but
missing NETFILTER_XT options have been enabled to replace some of them.
ZSMALLOC is now enabled by default with ZSWAP and the ZSWAP option was
removed in related change in 2ccd9fecd9163f168761d4398564c81554f636ef.
CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO is a direct replacement of
CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE as suggested in linux commit
44d46b76c3a4b514a0cc9dab147ed430e5c1d699
> mm: add build-time option for hotplug memory default online type
> ...
> Existing users of CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=y should use
> CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO.
* Fix build of the gasket driver with Linux 6.18
Backport patch from an unmerged PR to fix build with 6.18.
* Update package/rtl88x2bu to fix 6.18 build
Update the OOT driver to the latest version to fix build.
* Update Buildroot's package/rtl8821cu to fix build
* buildroot c4b580fde8...bc2fe6e38c (4):
> package/rtl8821cu: bump to version 2025-12-14
> package/rtl8821cu: fix build failure with Linux 6.17
> package/rtl8821cu: fix build failure with Linux 6.16
> package/rtl8821cu: bump to version 2025-05-08
* Replace rtl8812au-aircrack-ng by upstream kernel drivers
The drivers also need firmware - for 8812/8821 the firmware files are
already present, for 8814 the firmare needs linux-firmware update to
20250410 or newer which will install it using the wildcard pattern.
Afer builder changes, ARM images are now correctly published with their
platform, and when skopeo is used to inspect/pull the image on x86 without any
other flags, it fails with:
Error parsing manifest for image: Error choosing image instance: no image found in image index for architecture amd64, variant "", OS linux
Pass the correct arch in skopeo operations to fix that.
* Bumped to latest version
* Changed to HTTPS download source
* Updated build dependencies (mirroring package/qemu)
* Added path to host Python (same as package/qemu)
* Removed meson flag (no longer needed)
* Added --disable-linux-io-uring (new in v10)
* Replaced old --disable-user by per-OS flags
* Removed duplicated flags
* Sorted flags alphabetically for easier maintenance
Fixes#4336
Update the patch adjusting findBootFS for HAOS. Make sure that the hardware
survey is performed before that so we know if we can/should use flashrom on
Pi 5 with NVMe.
Fixes#4574
The retry when fetching containers from the registry didn't work because the
script was executed with `set -e`. Capture the error code also for non-zero
exit status.
Also use while loop instead of recursion and back off exponentially - start
with 5s and multiply by 3 (i.e. 5s, 15s, 45s - waiting in total up to 1 minute
for the registry to recover).
This change adds termios2 compatibility to the ioctl interface of generic_raw_uart making it compatible to glibc 2.42+ environments which prefer termios2 rather than the old/obsolete termios ioctls. This is a similar change to what was introduced to eq3_char_loop in #4471. However, this change in generic_raw_uart is required so that /dev/raw-uart will be termios2 compatible for applications within the OpenCCU Add-on directly opening it in case a non-dualcopro RF module like HmIP-RFUSB-TK is using it directly. (This refs https://github.com/OpenCCU/OpenCCU/issues/3498)
This PR updates the eq3_char_loop package to contain the latest
eq3_char_loop v1.3 sources with termios2 compatibility which is required
for glibc 2.42+ environments (latest OpenCCU) so that the HMIPServer
within OpenCCU is able to startup correctly.
Since home-assistant/version#305 the AppArmor profiles were split to
per-channel files. This was never reflected in hassio package build though.
Currently this doesn't cause any trouble and the profile is replaced later by
the Supervisor but make sure we're always using the correct one from the
beginning.
Extract some of the parts of the "image import" to the script creating the data
partition to separate concerns. The Docker data directory is now passed as a
daemon option, instead of only mounting the data partition's folder to the
default directory, to be closer to the deployment setup. Also trap the exit and
error signals to remove the build container and unmount the data partition, as
failed or cancelled build have been leaking the containers/mounts when building
interactively (attached to the build container shell).
Importing docker-archive format leads to some layers missing in the content
storage which results in some image metadata missing. This appears to be the
same regression as moby/moby#49473. Importing OCI archives when bootstrapping
the data partition seems to work this bug around.
Fixes#4385
* Remove configs and board files of deprecated architectures
* Remove support for ODROID-XU4 boot files
* Remove ASUS Tinker support from rpi-rf-mod
* Remove RPi armv7 config fragment
Prefer the containerd snapshotter by using it by default for new installs and
when no Docker data is present (e.g. after datadisk wipe). The snapshotter is
enabled by a dockerd flag which is set when a flag file is present in the data
partition. This flag file can be used also to opt-in for this snapshotter on
legacy installs (high level API through OS Agent and Supervisor TBD), to
migrate to the containerd snapshotter this file can be simply created manually.
Testing shown no major problems when migrating, the old overlay2 folder can be
(and should be - to avoid situations where the data disk might run out of
space) deleted before the docker.service is started in the docker-prepare
script.
Note that there's no offline migration path, OS needs to be connected to the
internet to re-download the images when migrating. This could be theoretically
possible through docker image save/load functions but guarding for enough of
space and other edge cases would be probably too complex to justify it.
Refs #4252
Refs #4253 - easier opt-in method is still needed
Closes#4254 - migration is handled seamlessly by Docker
Use the version used in the docker-engine package to ensure it stays in sync.
Although we haven't seen any issues related to the fact it was sometimes
mismatching, reduce the burden of needing it to be synced manually.
RaspberryMatic was renamed to OpenCCU in
https://github.com/OpenCCU/OpenCCU/pull/3162. This caused change of the name of
the directory in the source tarball, causing build failure when the archive
wasn't cached.
* Fix rpi-eeprom-update when device boots from NVMe
The boot partition detection doesn't work correctly if the device boots from
NVMe. Also the mounting step is unnecessary in HAOS as we can assume the boot
partition to be always mounted.
Fix the issues by modifying the bootfs detection logic to always use /mnt/boot.
However, still fail in case when flashrom can't be used (usually on CM4). On
CM5, or on Pi 5 booted from NVMe, update process works without further changes
because the firmware can be flashed directly from the running system using
flashrom.
Fixes#4157
* Fix typo in patch commit message
Unbind the Bluetooth driver for Broadcom HCI module before the bluetooth
service starts if running on board without WiFi module. This is a replacement
for #2948 but using a more targeted approach for removing the particular driver
and better detection of no-WiFi (thus no-Bluetooth) models.
This still means the driver will be probed and couple of lines printed when it
fails to set baudrate and reset the module, yet this should be benign, at least
the all-zero MAC device no longers appears in Bluetooth stack.
Backport patch for traces appearing since v4.21.0 bump, introduced in #4095.
This change is not available in any newer tagged release of the driver and the
commit message upstream is messed up, hence the reworded patch.
This reverts commit eab18076ad.
This change was added in #2948 as a workaround for all-zero adapter appearing
in the HA frontend (#2944). With changes implemented in [1], this is no longer
needed, the only minor issue is that the ghost adapter still appears in
hciconfig (and other utilities') output as reported in [2]. However, this
should be less problematic than the Bluetooth being unavailable if WiFi is
disabled through disable-wifi DT overlay, so let's start with removing the
workaround.
Fixes#2975
[1] https://github.com/Bluetooth-Devices/bluetooth-adapters/pull/105
[2] https://github.com/raspberrypi/linux/issues/5756
Bump Hailo stuff to the latest version. While this is a breaking change for
add-ons depending on the driver, the most commonly used one (i.e. Frigate)
didn't bump to v4.20.1 on their stable channel either, so it shouldn't have
significant impact. We agreed with @blakeblackshear that once HAOS bumps the
Hailo driver in HAOS 16, Frigate will follow.
* package/vcgencmd: add tool for RPi VideoCore commands
This tool is used by rpi-eeprom-update and is fairly lightweight binary without
dependencies. Use it as-is from raspberry/utils repo.
* package/rpi-eeprom: change package to install EEPROM userspace scripts
* configs: enable rpi-eeprom for rpi4, rpi4-64, rpi5-64 and yellow
On Pi5 and Yellow also enable flashrom so the firmware can be installed
directly without recovery being involved. On Yellow/CM4 this can't be done
without config.txt changes though (SPI and pinmuxing needs to be enabled) but
the image is shared there and users may eventually use the tools if they want,
so install BCM2711 on Yellow too. The "officially recommended" method is
rpiboot though, which is also documented in Yellow docs.
Update generic_raw_uart package to the latest sources available coming with
direct kernel 6.12.x compatibility dropping the intermediate patches
accordingly. In addition, the eq3_char_loop patchset was updated to reflect the
same changes performed.
Update to latest version of the driver and matching firmware. The most common
application for it - Frigate - currently has 4.19.0 in stable but 4.20.0 is
staged in dev. As it's easier to select OS version than a version of the
add-on, it makes sense to stay ahead in HAOS. This also means Frigate needs to
be updated to the matching version (as staying on an arbitrary older patch
revision doesn't make much sense either).
Update Docker to latest version and containerd to latest version from the 1.7
line. Runc updated to v1.2.5 with rebased patchset from the outstanding PR.
* buildroot 257ddc70ce...b4df362187 (4):
> package/runc: bump version to v1.2.5
> package/docker-cli: bump version to v28.0.1
> package/docker-engine: bump version to v28.0.1
> package/containerd: bump version to v1.7.25
* Linux: Update kernel to 6.12.6
* Linux 6.12
* https://github.com/home-assistant/operating-system/pull/3767#discussion_r1899169881
* https://github.com/home-assistant/operating-system/pull/3767#discussion_r1899170543
* Add patch descriptions, kernel ver conditionals
Signed-off-by: Nick Venenga <nick@venenga.com>
* Remove extra zram compression algos
* Undo fragment files config change
...for platforms that didn't receive kernel updates
* Sort Dockerfile apt packages
* Add Upstream refs to patches
* Re-enable TC
* Restore v6.6.y kernel fragments
* Update buildroot to rebased branch
* Apply 6.12 migration only to generic-x86-64
* package/eq3_char_loop: port patch from RaspberryMatic by @jens-maus
* package/generic_raw_uart: port patch from RaspberryMatic by @jens-maus
* Restore buildroot-external/board/pc/patches/linux
It's used in ova and generic-aarch64 defconfigs. Keep the path removed from
generic-x86-64 defconfig.
* Split linux patches to be version-specific
The IPv6 reachability patch needs different context on 6.6.y and 6.12.y -
introduce version-specific linux directories. To avoid the need for extra
directory for version used in RPi, copy those patches to its patches directory.
* Replace removed Intel Skylake audio driver with Intel AVS
The Skylake driver was removed and should be now replaced either by Intel HD
Audio or Intel AVS. Remove the old options and enable AVS.
SND_SOC_INTEL_SKYLAKE=m not found (defined in /build/buildroot-external/board/pc/generic-x86-64/kernel.config:63)
SND_SOC_INTEL_SKL=m not found (defined in /build/buildroot-external/board/pc/generic-x86-64/kernel.config:64)
SND_SOC_INTEL_APL=m not found (defined in /build/buildroot-external/board/pc/generic-x86-64/kernel.config:65)
SND_SOC_INTEL_KBL=m not found (defined in /build/buildroot-external/board/pc/generic-x86-64/kernel.config:66)
SND_SOC_INTEL_GLK=m not found (defined in /build/buildroot-external/board/pc/generic-x86-64/kernel.config:67)
SND_SOC_INTEL_CNL=m not found (defined in /build/buildroot-external/board/pc/generic-x86-64/kernel.config:68)
SND_SOC_INTEL_CFL=m not found (defined in /build/buildroot-external/board/pc/generic-x86-64/kernel.config:69)
SND_SOC_INTEL_CML_H=m not found (defined in /build/buildroot-external/board/pc/generic-x86-64/kernel.config:70)
SND_SOC_INTEL_CML_LP=m not found (defined in /build/buildroot-external/board/pc/generic-x86-64/kernel.config:71)
SND_SOC_INTEL_SKYLAKE_FAMILY=m not found (defined in /build/buildroot-external/board/pc/generic-x86-64/kernel.config:72)
SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC=y not found (defined in /build/buildroot-external/board/pc/generic-x86-64/kernel.config:73)
SND_SOC_INTEL_SKYLAKE_COMMON=m not found (defined in /build/buildroot-external/board/pc/generic-x86-64/kernel.config:74)
-> https://github.com/torvalds/linux/commit/a882f4d750ee0ec7e264c015019d0d642e136ff6
SND_SOC_INTEL_SST=m requested, actual = n (defined in /build/buildroot-external/board/pc/generic-x86-64/kernel.config:58)
-> https://github.com/torvalds/linux/commit/970d299b0a0a29b7fa1a36a05f561cd932ee4149
* Remove I2C_COMPAT option
I2C_COMPAT=y not found (defined in /build/buildroot-external/board/pc/generic-x86-64/kernel.config:163)
-> https://github.com/torvalds/linux/commit/7e722083fcc3e148838fc3dc2486c498908c4677
* Correctly disable module compression after Kconfig change
The Kconfig structure was changed, there's now a top-level bool:
https://github.com/torvalds/linux/commit/c7ff693fa2094ba0a9d0a20feb4ab1658eff9c33
---------
Signed-off-by: Nick Venenga <nick@venenga.com>
Co-authored-by: Jan Čermák <sairon@sairon.cz>
Instead of using in-tree module on RPi 5, build it as a module from the
original sources. This will give us better control over the version used and
will also allow us for easier way to add the module to other platforms.
This also makes 017d172 unnecessary anymore.
Add Hailo-8 firmware binary for Rasperry Pi AI accelerators. The version needs
to be determined from the Git history of the kernel sources, as the driver
source code is included in the RPi downstream kernel and the version string
can't be found in the code directly.
Fixes#3663
* Add Makefile variable for Supervisor channel
Allow to set the release channel pre-installed Home Assistant components
like Supervisor and add-on are fetched from. This channel is then also
used at runtime.
* Use choice instead of string variable
* Fix channel in Supervisor updater.json config
* Add newlines
Stefan AgnerandClaude Fable 5.1
Jan Čermák
Jens Maus
Nick VenengaandJan Čermák