Carrier Router exp90.3 -- source distribution Release date: 2026-09-17 ISO: carrier-router-2026.09.17-exp90.3-generic-amd64.iso ISO SHA256: 99b5a93e95c99fd4a43319112689ee3d7610c6a7b08e4ae3f8232f55918f1c4b Publication status: exp90.3 ISO and corresponding source archives. Changes: see RELEASE-NOTES.txt for included fixes and known limitations. The unchanged upstream/Debian sources and notices are shared with exp66 at /downloads/exp66/. Their historical README publication status does not describe this release. Use this README and release-manifest.json for exp90.3. All covered Carrier modifications and build scripts are supplied in the new exp90.3 bundle. No Git database, history, operational configuration or keys are distributed. Known firmware issue remains unchanged: upstream WHENCE marks acenic/tg1.bin and acenic/tg2.bin Licence: Unknown. Publication is not a clearance of those redistribution permissions. See the supplied upstream notices. This is a collection of separately licensed works, not a blanket relicensing. Each source package retains its original copyright, license and exception notices. GNU GPL/LGPL and other source-disclosure requirements apply to their respective works. Carrier modifications to covered works are supplied under those works' applicable terms. These modifications were made through 2026-09-17. The release is experimental and is provided without warranty, as detailed in the respective licenses. Upstream projects do not endorse this distribution. Delivery layout --------------- carrier-modified-sources-exp90.3.tar.gz: complete working-source snapshots of the covered locally modified packages and necessary image-build scripts. carrier-third-party-sources-exp66.tar: upstream source snapshots, kernel and out-of-tree drivers, plus copyleft OCaml dependencies embedded in the CLI. carrier-debian-sources-exp66.tar: original Debian .dsc, upstream source and Debian patch archives, matched by source package/version to installed binaries. carrier-license-notices-exp66.tar.gz: package notices and license texts. release-manifest.json: all 840 installed binary versions, source locations, archive members and checksums. SHA256SUMS covers the downloadable release files. No private repository, repository history, deployment credentials or customer configurations are included. Original upstream authors' credits are preserved. Unmodified upstream test fixture keys, where present, are public test data, not deployed SSH, VPN or signing keys. Do not use fixture keys operationally. Independent permissively licensed custom code is not disclosed solely because it shares this ISO: in particular, the Carrier VPP and carrier-bmon modifications are not included in these source archives. Their required notices are included. Source package correspondence ----------------------------- carrier-vyos-1x-exp90.3: binary family 999.0.90-14649-gb3bedd8ec-dirty, including libvyosconfig0. Sources contain the BGP route-map composition, boot recovery, FRR memory control, VPP command/control integration, SSH/login and carrier-cli path changes. These are modifications to the GPL/LGPL covered configuration work, not withheld as separate proprietary features. carrier-vyatta-cfg-exp90.3: 0.102.0+vyos2+current6+carrier4, discard overlay lifecycle fix. carrier-bash-5.3.15-carrier2: GNU Bash5.3 + official001-015 + Carrier CLI port; binary package name vyatta-bash, version5.3.15-1+carrier2, executable carrier-cli. carrier-bash-completion-exp90.3: binary1:2.16.0-7+vyos1. IMPORTANT: compatibility source is2.8, not upstream2.16. Its Debian package version sorts above2.16. carrier-frr-10.7.1: FRR10.7.1-0 with its included Debian patch series. carrier-image-build-exp90.3: image assembly hooks, configuration and build recipes. It also supplies the actual release kernel .config and OCaml package metadata. Published source archives are snapshots, not Git repositories. Building covered components --------------------------- Use an isolated Debian13/Trixie amd64 build environment. Do not run build recipes as root on an operational router. Install the Build-Depends in each debian/control; the image-builder docker/Dockerfile describes its toolchain. The original build container is vyos/vyos-build:trixie-experimental. Tags and online package repositories may change; the release manifest pins source versions but this distribution does not claim bit-for-bit reproducibility of the entire ISO or continued availability of that mutable container tag. 1. Carrier Bash: extract its snapshot, cd into it, run ./prepare-source, then dpkg-buildpackage -uc -us -b. prepare-source verifies all sixteen pinned GNU input hashes and applies the maintained port patch. No old vbash alias is created. The operating-system Bash package is a separate Debian component. 2. vyatta-cfg: autoreconf -i, then dpkg-buildpackage -uc -us -b. Install the matching new carrier2 shell dependency first. 3. vyos-1x: use OCaml4.14.2 and the package versions in release-exp90.3/opam-metadata. Source snapshots for vyos1x-config and vyconf are supplied at the exact commits referenced by libvyosconfig/Makefile. All build dependencies and interface definitions remain in the source. A fresh local git init/add/ commit can satisfy tools that expect a checkout; no original history is required. To preserve the published binary version, export MAKEFLAGS='COMMIT_COUNT=14649 COMMIT_ID=gb3bedd8ec DIRTY_FLAG=-dirty' before dpkg-buildpackage -uc -us -b. Build libvyosconfig from the supplied source rather than accidentally reusing an unrelated preinstalled library. 4. FRR: install debian/control dependencies, then dpkg-buildpackage -uc -us -b -Ppkg.frr.rtrlib,pkg.frr.lua. Use the included Debian patch series. Do not replace this snapshot with the latest FRR branch. 5. bash-completion: dpkg-buildpackage -uc -us -b in its supplied source tree. 6. Debian packages: extract a source set with dpkg-source -x package.dsc, install its Build-Depends and use dpkg-buildpackage -uc -us -b. Upstream and .debian.tar files must be beside the .dsc. Some .dsc files reference multiple upstream archives; all referenced files are included and checksum-verified. Third-party recipes and the kernel --------------------------------- The image-build snapshot includes scripts/package-build for the corresponding components. Archives from the upstream rolling tarball service contain the packaging and/or patches applied when they were generated. Inspect their debian/changelog and do NOT blindly reapply a patch already in the source. For strongSwan the source is6.0.7; the binary packaging suffix is-1+vyos0. Its patch files are provided with the build scripts; update the changelog to 6.0.7-1+vyos0 before a Debian build of that prepared source. The linux-kernel-6.18.48 archive is the upstream supplier's prepared source, including the applied router patchset. Use release-exp90.3/config-6.18.48-vyos as .config. The release uses module signature enforcement. Signing private keys are not included. A rebuild must generate its own signing key/certificate, use its own trusted_keys.pem (or intentionally configure its trust policy), rebuild the kernel and all external modules together, and sign those modules with that key. Changing only an external module will not satisfy the shipped kernel's signature enforcement. No Carrier online activation is required to boot a rebuilt image; firmware Secure Boot trust remains the device owner's configuration. The matching driver commits are named in the source archives, not the newer driver revisions a mutable upstream recipe may now select. Intel driver recipes derive versions from git describe; when building a tar snapshot, supply the pinned binary version from release-manifest.json rather than substituting a moving origin/main checkout. The build and install flags, patches, kernel-vars and module-signing procedure are in the supplied scripts. WireGuard tools includes its pinned1.0.20260223 upstream archive and build.sh. The image requires live-boot and live-boot-initramfs-tools version 1:20151213.vyos1. Their source is upstream/live-boot_20151213.vyos1.tar.xz in the shared third-party archive. Build the supplied Debian packaging and place both resulting .debs in packages/; the moving rolling archive may no longer offer them. carrier-live-boot.pref.chroot rejects other versions and check-boot-payload --require-carrier-boot checks the finished SquashFS. Do not remove these guards just to allow a different boot stack to resolve. To assemble an image, put rebuilt packages in the image builder's packages/ directory, together with the remaining separately licensed binary packages, then run build-vyos-image for generic/amd64 with the exp90.3 version. Necessary assembly source is included, but undisclosed independent permissive components must be reused as binaries or replaced independently. A locally created Git repository may be used for build metadata; the private development repository is not required. Public installation uses the normal add system image command or booting the ISO and running install image; back up settings and retain a known-working image before changing the boot default. Verification and availability ----------------------------- Source files were matched to the accepted exp90.3 ISO package inventory. Debian source files were verified against their source-index SHA256 entries. The locally modified snapshots omit repository databases and build outputs, not the source needed to modify covered behavior. Artifact hashes and source URLs are in release-manifest.json. Downloads do not require an account or payment. Keep these source downloads available with the corresponding binary release; do not replace versioned files in place with a later source revision. The copyleft carl9170 firmware1.9.6 source is included, extracted from the same linux-firmware20260410 source distribution. Other bundled firmware has separate vendor redistribution terms; see linux-firmware notices and WHENCE. Network driver source licensing does not automatically license a separate firmware blob. exp90.3 exact-source delta: carrier-updated-sources-exp80.tar.gz contains the updated Debian/upstream sources listed in release-manifest.json. Unchanged versions reuse the listed exp66 archives. OpenVPN 2.7.7-1+vyos1 uses the supplied Debian 2.7.7-1 source plus package.toml (remove systemd-dev build dependency and append +vyos1 to changelog). Modified covered sources include changes without internal Git databases/history. Component licenses remain applicable. Historical firmware redistribution caveats remain unchanged. The unchanged updated-source archive is reused from /downloads/exp80/. The new PPP ownership plugin is built from src/ppp/carrier-session.c with ppp-dev 2.5.2 headers; the package pins the matching ppp runtime ABI. exp90.3 OpenVPN source delta: carrier-updated-sources-exp82.tar.gz contains the complete Debian 2.7.7-1 .dsc/orig/debian source set, verified against the .dsc SHA-256 checksums, and the matching VyOS package recipe. Rebuild with dpkg-source -x, remove systemd-dev from debian/control as the recipe specifies, and append +vyos1 to the changelog version before dpkg-buildpackage. The exp80 shared updated-source archive remains available for unchanged packages; its old OpenVPN 2.7.5 source does not correspond to exp90.3. exp90.3 adds carrier-iftop-exp90.3.tar.gz with complete modified iftop sources, original source and Debian packaging archives, license notices, native VPP plugin source, build.py and stream tests. See SOURCE-BUILD.txt. Matching interface headers and notices are supplied separately in carrier-vpp-monitor-headers-exp90.3.tar.gz; this is not the full VPP source. The unchanged OpenVPN 2.7.7 source delta is served from downloads/exp82/. Internal Git databases/history and private deployment data are not included. carrier-updated-sources-exp90.3.tar.gz contains the matching unmodified Debian bind9 1:9.20.29-1~deb13u1 source, packaging and upstream signature. Checksums were verified against the authenticated APT source index used for this ISO.