oxidized 0.29.1 → 0.37.0

data/docs/Model-Notes/IvantiConnectSecure.md

@@ -0,0 +1,59 @@
+### Ivanti Connect Secure (ICS)
+
+#### Overview
+
+This model provides support for Ivanti Connect Secure (ICS) appliances using REST API ([official documentation](https://help.ivanti.com/ps/help/en_US/ICS/22.x/22.7R2/22.xICSAG.pdf)).
+ICS stores its configuration as a binary ZIP archive (with `system.cfg` and `user.cfg` files) which is retrieved using the `/api/v1/system/binary-configuration` endpoint.
+
+The model performs an initial authentication against `/api/v1/realm_auth` using Basic Auth (`username`/`password`) and retrieves a temporary `api_key`.
+This key is then used for all further API requests during the Oxidized collection cycle.
+
+The model is designed to work with standard ICS deployments without requiring command-line access to the device.
+
+#### How Configuration Is Retrieved
+
+1. Oxidized authenticates using:
+
+```bash
+POST /api/v1/realm_auth
+```
+
+with:
+- Basic Auth: `username` + `password`
+- JSON body `{"realm": "<realm>"}`
+
+
+2. ICS returns a temporary:
+
+```json
+{ "api_key": "<token>" }
+```
+
+
+3. The configuration is fetched from:
+
+```bash
+GET /api/v1/system/binary-configuration
+```
+
+with:
+- `api_key` as `username`
+- `''` as `password`
+
+ICS responds with a BASE64-encoded ZIP archive containing the device configuration.
+The model stores this BASE64 value as a single uninterrupted line.
+
+
+#### Required Node Configuration
+
+In source (CSV, HTTP, SQL, etc.), simply define:
+
+```yaml
+model: ivanti
+username: <your username>
+password: <your password>
+vars:
+  realm: <your realm>   # Optional, default = "Users"
+```
+
+The model will automatically handle authentication and obtain the API key as stated above.

data/docs/Model-Notes/OS6.md

@@ -0,0 +1,10 @@
+# OS6 Configuration
+
+The commands Oxidized executes are:
+
+1. terminal length 0
+2. show version
+3. show interfaces transceiver properties
+4. show running-config
+
+Back to [Model-Notes](README.md)

data/docs/Model-Notes/README.md

@@ -2,25 +2,6 @@
 
 This directory contains implementation notes and caveats to assist you in your oxidized deployment.
 
-Use the table below for more information on the Vendor/Model caveats.
-
-Vendor          | Model           |Updated
-----------------|-----------------|----------------
-3COM|[Comware](Comware.md)|15 Feb 2018
-AireOS|[AireOS](AireOS.md)|29 Nov 2017
-Arbor Networks|[ArbOS](ArbOS.md)|27 Feb 2018
-Arista|[EOS](EOS.md)|05 Feb 2018
-Cumulus|[Cumulus](Cumulus.md)|11 Jun 2018
-Huawei|[VRP](VRP-Huawei.md)|17 Nov 2017
-Huawei|[SmartAX series](SmartAX-Huawei.md)|21 Jan 2019
-Cisco IOS|[IOS](IOS.md)|29 Mar 2019
-Juniper|[MX/QFX/EX/SRX/J Series](JunOS.md)|18 Jan 2018
-Netgear|[Netgear](Netgear.md)|11 Apr 2018
-Nokia|[Nokia ISAM](Nokia.md)|22 Aug 2018
-Dell/EMC|[Dell EMC Networking OS10](OS10.md)|07 Dec 2021
-Viptela|[Viptela](Viptela.md)|1 Jul 2018
-Zyxel|[XGS4600 Series](XGS4600-Zyxel.md)|1 Feb 2018
-Linux|[LinuxGeneric](LinuxGeneric.md)|10 Jun 2019
-Lenovo|[Lenovo Network OS](LenovoNOS.md)|5 Apr 2022
+The model notes are linked from the [list of supported OS types](/docs/Supported-OS-Types.md).
 
 If you discover additional caveats or problems please make sure to consult the [GitHub issues for oxidized](https://github.com/ytti/oxidized/issues) known issues.

data/docs/Model-Notes/RouterOS.md

@@ -0,0 +1,28 @@
+# Mikrotik RouterOS Configuration
+
+RouterOS 7.12 and later support ED25519 keys. 
+
+Create a key pair, save the public key (``id_ed25519.pub``) and save it on flash. Create a user
+and attach the public key.
+
+```text
+[admin@mikrotik] > /user add name=oxidized group=read disabled=no
+[admin@mikrotik] > /user ssh-keys import public-key-file=id_ed25519.pub user=oxidized
+```
+
+Oxidized can now retrieve your configuration!
+
+## Save significant changes only
+
+You can [store the configuration only on significant changes](/docs/Configuration.md#store-configuration-only-on-significant-changes)
+by setting the [variable](/docs/Configuration.md#options-credentials-vars-etc-precedence)
+`output_store_mode` to `on_significant`. On RouterOS, this prevents Oxidized from saving a
+new configuration version when only the system history has changed without any actual
+configuration change.
+
+```yaml
+vars:
+  output_store_mode: on_significant
+```
+
+Back to [Model-Notes](README.md)

data/docs/Model-Notes/SikluMHTG.md

@@ -0,0 +1,7 @@
+# Siklu Multihaul Terragraph Radio Line
+
+The Siklu Multihaul TG radios use a different command set than the other Siklu radios.
+
+To use this model, your source must designate the model as siklumhtg instead of siklu. It also requires that the MH-TG radio be running at least version 2.1.2.
+
+Back to [Model-Notes](README.md)

data/docs/Model-Notes/TrueNAS.md

@@ -0,0 +1,23 @@
+# TrueNAS
+
+This should support both older TrueNAS CORE (FreeBSD-based) and newer
+TrueNAS SCALE (Linux-based) devices.
+
+## Authentication
+
+Ensure that the user configured for oxidized to login to your device has the
+permissions to read the configuration database. On older CORE instances, this
+would just work without sudo. On newer devices, the `/data/freenas-v1.db` file
+can only be read by the root user.
+
+On SCALE devices with Apps support, it's also necessary to add some privileges
+to read the container configurations for any apps you have installed, which can
+be found under `/mnt/.ix-apps`.
+
+You can make sure that the user that oxidized uses to login (`oxidized` in this
+example) can dump the configuration using `sudo` by adding something like this
+to your `/etc/sudoers` file:
+
+```
+oxidized ALL=(ALL) NOPASSWD: /usr/bin/find /mnt/.ix-apps/app_configs *, /usr/bin/sqlite3 -readonly file\:/data/freenas-v1.db *
+```

data/docs/Model-Notes/XGS4600-Zyxel.md

@@ -5,6 +5,11 @@
 FTP access is only possible as admin, other users can login but cannot pull the files.
 For the XGS4600 series the config file is _config_ and not _config-0_
 
+To enable FTP backup, uncomment the following line in _oxidized/lib/oxidized/model/zynos.rb_
+```text
+  # cmd 'config-0'
+```
+
 The following line in _oxidized/lib/oxidized/model/zynos.rb_ will need changing
 
 ```text

data/docs/ModelUnitTests.md

@@ -0,0 +1,219 @@
+# Model Unit Tests
+Oxidized includes automated unit tests for its models, which require very little
+effort to use. There are three different default unit tests for models:
+- [Device Simulation](ModelUnitTests.md#device-simulation)
+- [Device Prompt](ModelUnitTests.md#device-prompt)
+- [Secrets](ModelUnitTests.md#secrets)
+- [Significant Changes](ModelUnitTests.md#significant-changes)
+
+You only need to provide test files under [/spec/model/data](/spec/model/data),
+and the tests will be run automatically with `rake test`. See
+[CONTRIBUTING.md](/CONTRIBUTING.md) for explanations on how to set up a
+development environment. In the following examples, we use
+[Bundler](https://bundler.io/) and prefix all commands with `bundle exec`.
+
+In addition, you can write [custom unit tests](ModelUnitTests.md#custom-tests)
+for your model
+
+## Device Simulation
+### YAML Simulation File
+You need a [YAML simulation file](/docs/DeviceSimulation.md) for your device.
+See the link for instructions on how to produce it.
+
+The YAML simulation files are stored under
+[/spec/model/data/](/spec/model/data/), with the naming convention
+`<model>#<description>#simulation.yaml`, where `<model>` is the lowercase name
+of the Oxidized model and `<description>` is the name of the test case.
+`<description>` is generally formatted as `<hardware>_<software>` or
+`<hardware>_<software>_<information>`.
+
+Using a correct name for the file is important to ensure it is included in
+automatic model unit tests.
+
+### Expected Output
+You need a second file that contains the expected output, which has the same
+name as the YAML simulation file but ends with `#output.txt` instead of
+`#simulation.yaml`.
+
+You can automatically produce an output file based on the current model for all
+YAML simulation files missing an `#output.txt`:
+```shell
+bundle exec ruby spec/model/atoms_generate.rb
+```
+
+In the following example,
+`spec/model/data/aoscx#R8N85A-C6000-48G-CL4_PL.10.08.1010#output.txt` (the
+second file in the list) was missing:
+
+```shell
+oxidized$ bundle exec ruby spec/model/atoms_generate.rb
+Run options: --seed 57811
+
+# Running:
+
+Generating output file for aoscx#R0X25A-6410_FL.10.10.1100#simulation... SKIP, output already exists
+Generating output file for aoscx#R8N85A-C6000-48G-CL4_PL.10.08.1010#simulation... OK
+Generating output file for arubainstant#IAP515_8.10.0.6_VWLC#simulation... SKIP, output already exists
+Generating output file for asa#5512_9.12-4-67_single-context#simulation... SKIP, output already exists
+Generating output file for garderos#R7709_003_006_068#simulation... SKIP, output already exists
+Generating output file for ios#C8200L_16.12.1#simulation... FAIL, no simulation file
+Generating output file for ios#C9200L-24P-4G_17.09.04a#simulation... SKIP, output already exists
+Generating output file for ios#C9800-L-F-K9_17.06.05#simulation... SKIP, output already exists
+Generating output file for ios#asr920_16.8.1b#simulation... SKIP, output already exists
+Generating output file for junos#srx300_22.4#simulation... SKIP, output already exists
+Generating output file for opnsense#nano_23.7#simulation... SKIP, output already exists
+Generating output file for pfsense#CE_2.7.2#simulation... SKIP, output already exists
+Generating output file for routeros#CHR_7.10.1#simulation... SKIP, output already exists
+Generating output file for routeros#CHR_7.16#simulation... SKIP, output already exists
+Generating output file for routeros#L009UiGS_7.15.2#simulation... SKIP, output already exists
+.
+
+Finished in 0.904792s, 1.1052 runs/s, 0.0000 assertions/s.
+
+1 runs, 0 assertions, 0 failures, 0 errors, 0 skips
+Coverage report generated for RSpec to /home/xxx/oxidized/coverage/coverage.xml. 651 / 1122 LOC (58.02%) covered
+Coverage report generated for RSpec to /home/xxx/oxidized/coverage.
+Line Coverage: 58.02% (651 / 1122)
+```
+
+### Running the Tests
+You can modify the `#output.txt` file to match your expectations and modify the
+model accordingly. Run `bundle exec rake` to run the tests.
+
+Here is an example when the output of the VTP command is missing in the expected
+output:
+
+```
+oxidized$ bundle exec rake test
+/usr/bin/ruby3.1 -I"lib:spec" /home/xxx/oxidized/vendor/bundle/ruby/3.1.0/gems/rake-13.2.1/lib/rake/rake_test_loader.rb "spec/cli_spec.rb" "spec/config_spec.rb" "spec/hook/githubrepo_spec.rb" "spec/input/ssh_spec.rb" "spec/manager_spec.rb" "spec/model/apc_aos_spec.rb" "spec/model/model_atoms_spec.rb" "spec/model/model_helper_spec.rb" "spec/node_spec.rb" "spec/nodes_spec.rb" "spec/output/file_spec.rb" "spec/output/git_spec.rb" "spec/refinements_spec.rb" "spec/source/csv_spec.rb" "spec/source/http_spec.rb" "spec/source/jsonfile_spec.rb" "spec/source/sql_spec.rb"
+Run options: --seed 31447
+
+# Running:
+
+...............................................................SS..................F.............................SS..
+
+Finished in 7.963602s, 14.6918 runs/s, 48.7217 assertions/s.
+
+  1) Failure:
+ATOMS tests#test_0006_ios#C9200L-24P-4G_17.09.04a#output has expected output [spec/model/model_atoms_spec.rb:12]:
+--- expected
++++ actual
+@@ -9,6 +9,21 @@
+ ! CPU: ARM64
+ ! Memory: nvram 2048K
+ !
++! VTP: VTP Version capable             : 1 to 3
++! VTP: VTP version running             : 1
++! VTP: VTP Domain Name                 : Oxidized
++! VTP: VTP Pruning Mode                : Disabled (Operationally Disabled)
++! VTP: VTP Traps Generation            : Disabled
++! VTP: Device ID                       : 40f0.7800.0000
++! VTP: Feature VLAN:
++! VTP: --------------
++! VTP: VTP Operating Mode                : Transparent
++! VTP: Maximum VLANs supported locally   : 1005
++! VTP: Number of existing VLANs          : 10
++! VTP: Configuration Revision            : 0
++! VTP: MD5 digest                        : 0x35 0x00 0x00 0x00 0x00 0x00 0x7F 0xB4
++! VTP:                                     0x07 0x00 0x00 0x00 0x00 0x00 0x09 0x6D
++!
+ ! NAME: \"c92xxL Stack\", DESCR: \"c92xxL Stack\"
+ ! PID: C9200L-24P-4G     , VID: V01  , SN: JAE24FFFFFF
+ !
+
+
+117 runs, 388 assertions, 1 failures, 0 errors, 4 skips
+
+You have skipped tests. Run with --verbose for details.
+Coverage report generated for RSpec to /home/xxx/oxidized/coverage/coverage.xml. 2167 / 3131 LOC (69.21%) covered
+Coverage report generated for RSpec to /home/xxx/oxidized/coverage.
+Line Coverage: 69.21% (2167 / 3131)
+rake aborted!
+Command failed with status (1): [ruby -I"lib:spec" /home/xxx/oxidized/vendor/bundle/ruby/3.1.0/gems/rake-13.2.1/lib/rake/rake_test_loader.rb "spec/cli_spec.rb" "spec/config_spec.rb" "spec/hook/githubrepo_spec.rb" "spec/input/ssh_spec.rb" "spec/manager_spec.rb" "spec/model/apc_aos_spec.rb" "spec/model/model_atoms_spec.rb" "spec/model/model_helper_spec.rb" "spec/node_spec.rb" "spec/nodes_spec.rb" "spec/output/file_spec.rb" "spec/output/git_spec.rb" "spec/refinements_spec.rb" "spec/source/csv_spec.rb" "spec/source/http_spec.rb" "spec/source/jsonfile_spec.rb" "spec/source/sql_spec.rb" ]
+/home/xxx/oxidized/vendor/bundle/ruby/3.1.0/gems/rake-13.2.1/exe/rake:27:in `<top (required)>'
+Tasks: TOP => test
+(See full trace by running task with --trace)
+```
+
+If you want to be sure that your model has been tested, run
+`bundle exec rake test TESTOPTS="--verbose"` and search for your models unter
+`ATOMS tests`
+
+### Running only one test
+If you want to run only one test while debuging your model, you can select it
+with the option `--name=/regexp/`:
+```
+bundle exec rake test TESTOPTS="--verbose --name=/ios#C9800.*output/"
+```
+
+You can also set `Oxidized.asetus.cfg.debug = true` in
+`spec/model/model_helper.rb` to activate debug logs.
+
+## Device Prompt
+You can specify device prompts to test in a YAML file named
+`spec/model/data/<model>#generic#prompt.yaml`.
+
+The YAML file has three sections containing a list of prompts to test:
+- pass: these prompts will pass the prompt regexp.
+- pass_with_expect: these prompts will pass the prompt regexp after having been
+  cleaned by the expect commands.
+- fail: these prompts will fail the prompt regexp.
+
+Here is an example:
+```yaml
+pass:
+  - "LAB-R1234_Garderos# "
+pass_with_expect:
+  - "\e[4m\rLAB-R1234_Garderos#\e[m "
+fail:
+  - "\e[4m\rLAB-R1234_Garderos#\e[m "
+  - "#LAB#"
+```
+
+## Secrets
+You can test if the model effectively removes secrets from your YAML simulation
+file with a YAML file named like the YAML simulation, but with the suffix
+`#secret.yaml`.
+
+The YAML file has two sections containing a list of strings to test:
+- fail: the test will fail if the output contains these strings.
+- pass: the test will pass only if the output contains these strings.
+
+```yaml
+fail:
+  - 'AAAAAAAAAABBBBBBBBBBCCCCCCCCCC'
+pass:
+  - 'snmp-server host 10.10.42.12 version 2c <secret removed> inform'
+  - 'hash-mgmt-user oxidized password hash <secret removed>'
+  - 'hash-mgmt-user rocks password hash <secret removed> usertype read-only'
+```
+
+## Significant Changes
+You can test if the model correctly detects significant changes from a YAML
+simulation file (`#simulation.yaml`) when run with variable
+`output_store_mode` set to `on_significant`.
+
+The output is checked against a file with the same 
+prefix as the yaml simulation file, but with the suffix
+`#significant_changes.yaml`.
+
+The `#significant_changes.yaml` file contains two sections with a list of
+strings or regular expressions to test:
+- pass: the test passes only if the output contains these strings (significant changes).
+- fail: the test fails if the output contain these strings (non-significant changes).
+
+```yaml
+pass:
+ - "! Processor ID: FCL2XXXXXXX"
+fail:
+ - "! Last configuration change at 13:57:08 CET Wed Mar 13 2024"
+ - "! NVRAM config last updated at 15:26:39 CET Wed Mar 13 2024 by oxidized"
+```
+
+## Custom tests
+When you write custom tests for your models, please do not use the filenames
+mentioned above, as it will interfere with the standard tests. If you need to
+store a custom simulation file, use `model#description#custom_simulation.yaml`.
+
+The [cumulus test](/spec/model/cumulus_spec.rb) is an example of a custom
+test.

data/docs/Outputs.md

@@ -10,9 +10,48 @@ output:
     directory: /var/lib/oxidized/configs
 ```
 
+### Groups
+If you use groups, the nodes will be stored in directories named after the
+groups. The directories are stored one level above the directory for configurations
+without groups.
+
+Example:
+```
+/var/lib/oxidized/
++ configs/     # Configurations of groupless nodes
++ group1/      # Configurations of nodes in group1
++ group2/      # Configurations of nodes in group2
+```
+
+### Clean obsolete nodes
+The `file` output can automatically remove the configuration of nodes no
+longer present in the [source](Sources.md).
+
+> :warning: **Warning:** this might be a dangerous operation: oxidized
+> will remove **any** file not matching the hostname of the nodes configured
+> in the source.
+
+When using groups, it will remove any files not matching the hostnames of the
+nodes from the groups directories (which are on the same level as the default
+directory). As a safety measure, oxidized will only clean configuration out of
+active groups. If the group `example` isn't used anymore, oxidized won't clean
+the configurations out of the directory `../example/`.
+
+Configuration:
+
+```yaml
+output:
+  default: file
+  clean_obsolete_nodes: true
+  file:
+    directory: "~/.config/oxidized/configs/default"
+```
+
+
 ## Output: Git
 
-This uses the rugged/libgit2 interface. So you should remember that normal Git hooks will not be executed.
+This uses the rugged/libgit2 interface. So you should remember that normal Git
+hooks will not be executed.
 
 For a single repository containing all devices:
 
@@ -63,6 +102,50 @@ output:
 
 ```
 
+### Git performance issues with large device counts
+When you use git to store your configurations, the size of your repository will
+grow over time. This growth may lead to performance issues. If you encounter
+such issues, you should perform a Git garbage collection on your repository.
+
+Follow these steps to do so:
+
+1. Stop oxidized (no one should access the git repository while running garbage
+   collection)
+2. Make a backup of your oxidized data, especially the Git repository
+3. Change directory your oxidized git repository (as configured in oxidized
+   configuration file)
+4. Execute the command `git gc` to run the garbage collection
+5. Restart oxidized - you're done!
+
+
+### Clean obsolete nodes
+The `git` output can automatically remove the configuration of nodes no
+longer present in the [source](Sources.md).
+
+> :warning: **Limitations**
+> - this currently only works with `single_repo: true`
+> - it will ignore configurations saved as [output types](#output-types) in
+>   a separate repository.
+> - oxidized will refuse to remove old configurations
+>   when saving  [output types](#output-types) in a subdirectory of the git
+>   repository (`type_as_directory: true`), or it would remove the output
+>   type directories
+
+Oxidized will remove **any** file within the git repository not matching the
+group and hostname of the nodes configured in the source and will then commit
+the change into git.
+
+Configuration:
+
+```yaml
+output:
+  default: git
+  clean_obsolete_nodes: true
+  git:
+    single_repo: true
+    repo: "~/.config/oxidized/devices.git"
+```
+
 ## Output: Git-Crypt
 
 This uses the gem git and system git-crypt interfaces. Have a look at [GIT-Crypt](https://www.agwa.name/projects/git-crypt/) documentation to know how to install it.
@@ -128,9 +211,9 @@ output:
 
 Please note that user list is only updated once at creation.
 
-## Output: Http
+## Output: HTTP
 
-The HTTP output will POST a config to the specified HTTP URL. Basic username/password authentication is supported.
+The HTTP output will POST a config as JSON to the specified HTTP URL. It supports HTTP Basic Authentication, custom headers, and SSL/TLS verification control.
 
 Example HTTP output configuration:
 
@@ -138,11 +221,25 @@ Example HTTP output configuration:
 output:
   default: http
   http:
-    user: admin
-    password: changeit
     url: "http://192.168.162.50:8080/db/coll"
+    user: admin             # Optional - for HTTP basic auth
+    password: changeit      # Optional - for HTTP basic auth
+    ssl_verify: false       # Optional - verify SSL certs (default: false)
+    headers:                # Optional - custom HTTP headers
+      X-Custom-Header: "value"
+      X-API-Key: "secret"
 ```
 
+### Configuration Options
+
+| Option       | Required | Description                                             |
+|--------------|----------|---------------------------------------------------------|
+| `url`        | Yes      | Full HTTP/HTTPS URL to POST the config to               |
+| `user`       | No       | Username for HTTP Basic Authentication                  |
+| `password`   | No       | Password for HTTP Basic Authentication                  |
+| `ssl_verify` | No       | When `true`, verify SSL certificates (default: `false`) |
+| `headers`    | No       | Hash of custom HTTP headers to include in the request   |
+
 ## Output types
 
 If you prefer to have different outputs in different files and/or directories, you can easily do this by modifying the corresponding model. To change the behaviour for IOS, you would edit `lib/oxidized/model/ios.rb` (run `gem contents oxidized` to find out the full file path).

data/docs/Release.md

@@ -0,0 +1,102 @@
+# How to release a new version of Oxidized?
+This document is targeted at oxidized maintainers. It describes the release process.
+
+## Version numbering
+Oxidized versions are numbered like major.minor.patch
+- currently, the major version is 0.
+- minor is incremented when releasing new features.
+- patch is incremented when releasing fixes only.
+
+## Create a release branch
+Name the release branch `release/0.xx.yy`
+
+## Review changes
+Run `git diff 0.30.0` (where `0.30.0` is to be changed to the last release) and review
+all the changes that have been done. Have a specific look at changes you don't understand.
+
+For a graphical compare, use `git difftool -d 0.30.0`.
+
+Commit fixes to the release branch
+
+## Update the gem dependencies to the latest versions
+```
+bundle outdated
+bundle update
+bundle outdated
+```
+
+## Update rubocup .rubocop_todo.yml
+Run `bundle exec rubocop --auto-gen-config`,
+and make sure `bundle exec rake` passes after it.
+
+If you change some code => Restart the release process at the beginning ;-)
+
+## Make sure the file permissions are correct
+Run `bundle exec rake chmod`
+
+## Test !
+Test the git code and the container against as much device types and
+environments as you can.
+
+## Bump the version
+Update CHANGELOG.md:
+- review it
+- add release notes
+- set the new version (replace `[Unreleased]` with `[0.xx.yy – 202Y-MM-DD]`)
+
+Change the version in `lib/oxidized/version.rb`
+
+Upload the branch to github, make a Pull Request for it.
+
+## Make sure you pass all GitHub CI
+They test different ruby versions an run security checks on the code (codeql).
+
+## Prepare the release in your working repository
+1. Merge the Pull Request into master with the commit message
+   `chore(release): release version 0.3x.y`
+2. `git pull` on master
+3. Tag the commit with `git tag -a 0.xx.yy -m "Release 0.xx.yy"` or `rake tag`
+4. Build the gem with ‘rake build’
+5. Run `git diff` to check if there have been more changes (there shouldn't)
+6. Install an test the gem locally
+```shell
+gem install --user-install pkg/oxidized-0.xx.yy.gem
+~/.local/share/gem/ruby/3.3.0/bin/oxidized
+```
+
+## Release in github
+Push the tag to github:
+```
+git push origin 0.xx.yy
+```
+
+Make a release from the tag in github.
+- Name the release `0.xx.yy`
+- Generate release notes
+- Remove `## What's changed`
+- Take the release notes from CHANGELOG.md
+- List new contributors (generated automatically)
+- Keep the Full Changelog (generated automatically)
+- Preview
+- Publish
+
+Close the corresponding milestone in github.
+
+## Release in rubygems
+Push the gem with ‘rake push’
+
+## Release in docker.io
+The OCI-Containter is automatically build and pushed to docker.io by github
+
+## Update CHANGELOG.md for next release
+Add
+```
+## [Unreleased]
+
+### Added
+
+### Changed
+
+### Fixed
+
+```