Update

vendor/tailscale.com/Makefile

@@ -10,10 +10,10 @@ vet: ## Run go vet
 
 tidy: ## Run go mod tidy and update nix flake hashes
 	./tool/go mod tidy
-	./update-flake.sh
+	./tool/go run ./tool/updateflakes
 
 lint: ## Run golangci-lint
-	./tool/go run github.com/golangci/golangci-lint/cmd/golangci-lint run
+	./tool/go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint run
 
 updatedeps: ## Update depaware deps
 	# depaware (via x/tools/go/packages) shells back to "go", so make sure the "go"
@@ -137,15 +137,66 @@ publishdevproxy: check-image-repo ## Build and publish k8s-proxy image to locati
 sshintegrationtest: ## Run the SSH integration tests in various Docker containers
 	@GOOS=linux GOARCH=amd64 CGO_ENABLED=0 ./tool/go test -tags integrationtest -c ./ssh/tailssh -o ssh/tailssh/testcontainers/tailssh.test && \
 	GOOS=linux GOARCH=amd64 CGO_ENABLED=0 ./tool/go build -o ssh/tailssh/testcontainers/tailscaled ./cmd/tailscaled && \
-	echo "Testing on ubuntu:focal" && docker build --build-arg="BASE=ubuntu:focal" -t ssh-ubuntu-focal ssh/tailssh/testcontainers && \
-	echo "Testing on ubuntu:jammy" && docker build --build-arg="BASE=ubuntu:jammy" -t ssh-ubuntu-jammy ssh/tailssh/testcontainers && \
-	echo "Testing on ubuntu:noble" && docker build --build-arg="BASE=ubuntu:noble" -t ssh-ubuntu-noble ssh/tailssh/testcontainers && \
-	echo "Testing on alpine:latest" && docker build --build-arg="BASE=alpine:latest" -t ssh-alpine-latest ssh/tailssh/testcontainers
+	echo "Testing on ubuntu:focal, ubuntu:jammy, ubuntu:noble, alpine:latest (in parallel)" && \
+	docker build --build-arg="BASE=ubuntu:focal" -t ssh-ubuntu-focal ssh/tailssh/testcontainers & \
+	docker build --build-arg="BASE=ubuntu:jammy" -t ssh-ubuntu-jammy ssh/tailssh/testcontainers & \
+	docker build --build-arg="BASE=ubuntu:noble" -t ssh-ubuntu-noble ssh/tailssh/testcontainers & \
+	docker build --build-arg="BASE=alpine:latest" -t ssh-alpine-latest ssh/tailssh/testcontainers & \
+	wait
 
 .PHONY: generate
 generate: ## Generate code
 	./tool/go generate ./...
 
+.PHONY: tsapp-build-and-flash-pi
+tsapp-build-and-flash-pi: ## Build a tsapp-pi.arm64 GAF from HEAD and flash a local SD card (macOS auto-detects the disk; pass DISK=/dev/sdX on Linux)
+	cd gokrazy && ../tool/go run build.go --gaf --app=tsapp-pi.arm64
+	./tool/go run --exec=sudo ./cmd/tailscale configure flash-appliance \
+		--variant=pi-arm64 \
+		--gaf=gokrazy/tsapp-pi.arm64.gaf \
+		$(if $(DISK),--disk=$(DISK)) \
+		$(if $(wildcard $(HOME)/.ssh/id_ed25519.pub),--add-ssh-authorized-keys=$(HOME)/.ssh/id_ed25519.pub)
+
+.PHONY: tsapp-qemu-pi
+tsapp-qemu-pi: ## Build tsapp-pi.arm64 and boot it under qemu-system-aarch64 with a framebuffer GUI window and working network (requires mtools, dtc, qemu-efi-aarch64)
+	cd gokrazy && ../tool/go run build.go --build --app=tsapp-pi.arm64
+	# Extract the kernel from the FAT boot partition for direct -kernel boot.
+	rm -f gokrazy/tsapp-pi.arm64.vmlinuz
+	mcopy -i gokrazy/tsapp-pi.arm64.img@@4194304 ::vmlinuz gokrazy/tsapp-pi.arm64.vmlinuz
+	# Use the "virt" machine (not raspi3b) because it provides working
+	# PCI e1000 networking and, with UEFI firmware, an EFI framebuffer
+	# via the ramfb device. The raspi3b machine's USB NIC emulation is
+	# too broken for DHCP and its SoC watchdog reboots the guest.
+	#
+	# Find the UEFI firmware. Common paths:
+	#   Debian/Ubuntu: /usr/share/qemu-efi-aarch64/QEMU_EFI.fd
+	#   Homebrew:      /opt/homebrew/share/qemu/edk2-aarch64-code.fd
+	#   Fedora:        /usr/share/edk2/aarch64/QEMU_EFI.fd
+	QEMU_EFI=$$(for f in \
+		/usr/share/qemu-efi-aarch64/QEMU_EFI.fd \
+		/opt/homebrew/share/qemu/edk2-aarch64-code.fd \
+		/usr/share/edk2/aarch64/QEMU_EFI.fd \
+		$$(dirname $$(which qemu-system-aarch64))/../share/qemu/edk2-aarch64-code.fd; do \
+		[ -f "$$f" ] && echo "$$f" && break; \
+	done) && \
+	[ -n "$$QEMU_EFI" ] || { echo "error: cannot find QEMU EFI firmware (install qemu-efi-aarch64)"; exit 1; } && \
+	qemu-system-aarch64 \
+		-M virt -cpu cortex-a53 -m 1G \
+		-bios "$$QEMU_EFI" \
+		-device ramfb \
+		-device e1000,netdev=net0 -netdev user,id=net0 \
+		-kernel gokrazy/tsapp-pi.arm64.vmlinuz \
+		-append "console=ttyAMA0,115200 nowatchdog gokrazy.log_to_serial=1 root=PARTUUID=60c24cc1-f3f9-427a-8199-dd02023b0001/PARTNROFF=1 ro init=/gokrazy/init rootwait" \
+		-drive file=gokrazy/tsapp-pi.arm64.img,format=raw,if=none,id=disk0 \
+		-device virtio-blk-device,drive=disk0 \
+		-serial mon:stdio
+
+.PHONY: tsapp-push-pi
+tsapp-push-pi: ## Build a tsapp-pi.arm64 GAF from HEAD and push it to a running Pi over the network (pass PI=<ip>)
+	@[ -n "$(PI)" ] || { echo "usage: make tsapp-push-pi PI=<ip-address>"; exit 1; }
+	cd gokrazy && ../tool/go run build.go --gaf --app=tsapp-pi.arm64
+	./tool/go run ./gokrazy/gafpush --gaf=gokrazy/tsapp-pi.arm64.gaf --pi=$(PI)
+
 .PHONY: pin-github-actions
 pin-github-actions:
 	./tool/go tool github.com/stacklok/frizbee actions .github/workflows