The web interface checks the image again, and flashes from the SD card

Since BMC-UI 3.25.0 the web interface skipped the image CRC check on every module flash, and flashing from a file on the SD card failed with a 411. Both are fixed: the check runs unless you tick "Skip CRC", and the card file is read by the daemon itself.

Firmware v2.43.0, 15 October 2026 — the first image to carry bmcd 2.39.0, BMC-UI 4.1.0. Every item below is the repository's own changelog entry, taken apart; the whole entry is a click away under each one.

New

bmcd: sdcard=1&file=<path> flashes a node (or upgrades the firmware) from a

file on the card, confined to the card; an absolute path, a .. or symlink leaving the card, a missing file, a directory and an unmounted card are refused with a 400 that says which

A node can be flashed from an image on the SD card, by the path the card

listing gives bmcd 2.39.0

opt=set&type=flash&node=<0..3>&sdcard=1&file=<path> takes file as the path relative to the card that GET /sdcard/files returns, and it is confined to the card the way the listing is: an absolute path, a .. that leaves the card, a symlink that points out of it, a missing file, a directory and an unmounted card are each refused with a 400 and a message saying which.

The whole entry

It cannot be combined with local or a URL. Until now the listing offered paths that nothing could take back. local is unchanged (an absolute path, not confined, as tpi flash --local uses it); it is now documented as such, next to sdcard, in the OpenAPI document, which also describes the flash parameters for the first time. The firmware upgrade shares the same code and accepts sdcard too. A file on the card cannot be named under os_upgrade/, which an upgrade empties before it stages. sha256 is now checked for sdcard and local flashes, as it is for uploads and URLs; before, it was accepted and ignored. local=0 no longer counts as local, and a card file named httpd.img is no longer taken for a URL.

Unit tests for the flash request (npm test), and an SD card listing with a

long filename in the demo BMC-UI 4.1.0

Fixed

• Flashing a node from an image on the SD card works from the web interface. It never did since BMC-UI 3.25.0: choosing an image on the card and pressing flash was refused with 411 "Invalid length query parameter".

  The whole entry

  The interface now asks the daemon to read the file from the card, and the progress bar shows a real percentage. Reported by a user on Discord.

• The web interface skipped the image CRC check on every node flash since BMC-UI 3.25.0. It sent skip_crc=false, and the daemon read the key's presence rather than its value. The check now runs unless "Skip CRC" is ticked (BMC-UI 4.1.0 sends skip_crc only then; bmcd 2.39.0 reads the value).

• A sha256 given for an image on the BMC or the SD card is now verified. It was accepted and ignored; only uploads and URLs were checked.

• The SD-card picker's "Choose" button stays visible,. On desktop and phone; a long filename no longer pushes it out of the dialog.

• A failed flash says why in words. Instead of showing the daemon's raw JSON.

• skip_crc=false skipped the CRC check. The flag was read by whether the key was present, not by its value, so skip_crc=false and skip_crc=0 turned verification off. bmcd 2.39.0

  The whole entry

  The web interface has sent skip_crc=false on every flash since BMC-UI 3.25.0, so every node flash started from the web interface skipped the check. Now skip_crc skips only when it is present with an empty value or 1, true, yes, on (any case), which keeps tpi's key-only skip_crc working; 0, false, no, off and an absent key verify; any other value is refused with 400 "Invalid skip_crc value". Reported by a user on Discord.

• "Skip CRC" left unticked still skipped the check, on every node flash, since v3.25.0. The interface sent skip_crc=false when the box was empty, and the daemon only asks whether the word skip_crc is present, not what it says, so verification was switched off whether you ticked the box or not. BMC-UI 4.1.0

  The whole entry

  The interface now sends skip_crc=1 only when the box is ticked, and the check runs otherwise. This needs bmcd 2.39.0 (firmware with it) to take full effect; on an older daemon the flash behaves as before.

• Flashing a node from the SD card works. Choosing an image on the card and pressing flash was refused with "Invalid length query parameter", because the interface asked the daemon to fetch the card path as though it were an upload. BMC-UI 4.1.0

  The whole entry

  It never worked since the picker arrived in v3.25.0. The interface now asks the daemon to read the file from the card itself, and the progress bar shows a real percentage when the daemon reports the image's size (bmcd 2.39.0). Reported by a user on Discord.

• The "Choose" button in the SD card picker is always visible. A long filename widened the table until the button was pushed out of the dialog. Long paths now wrap, and the size, state and button columns keep their width. BMC-UI 4.1.0

• A failed flash now says why in words. The daemon's answer was shown as raw JSON ({"response":[{"result":"..."}]}); the message inside it is shown instead. BMC-UI 4.1.0

---

Every release of the firmware · the roadmap · follow by feed