Badfish has received substantial updates and fixes in the 1.6/1.7 release, including its own Redfish emulator for developing/testing against a mock iDRAC without bare metal. iDRAC10 support, configurable REST timeouts, multi-vendor detection and a lot more are within, come have a look!
What’s New in 1.6.0
Badfish 1.6.0 was a smaller release focused on configuration and compatibility:
- Configurable request timeout: every Redfish REST call now honors
--timeout(in seconds) instead of a fixed 120 second default, useful for slow or heavily loaded BMCs. - Multi-vendor detection: vendor detection now covers Dell, Supermicro and HPE, so vendor-specific flags are only offered where the target platform supports them.
- CLI and documentation cleanup: help text now distinguishes vendor-specific vs generic options, plus Black formatting and CI updates.
Badfish runs on Arch btw
Badfish is now available on Arch Linux and derivative distributions through the AUR:
yay -S badfish
1.7.0: Built-in Redfish Emulator
The headline feature of 1.7.0 is Badfish’s own Redfish emulator, a mock iDRAC server you can run anywhere:
badfish --redfish-emulator --port 8443
It runs as a persistent HTTPS server until interrupted. The design uses static JSON resource templates served by a small aiohttp app with an in-memory fake driver that holds mutable system state, inspired by the sushy-tools emulator but written independently for Badfish.
What it covers
- Session/token authentication and an AccountService with role-based RBAC (ReadOnly/Operator/Administrator, JSON-backed user store, last-enabled-Administrator guard)
- Power and reset, one-shot boot and boot order
- BIOS registry and attributes, jobs queue, virtual media, firmware inventory
- Processor/memory/network inventory, Dell OS deployment service, SCP targets, Dell NIC attribute registry
- Realistic job and task lifecycle: jobs report running first, then complete; unknown tasks return 404 like real iDRAC
Why it’s valuable
Badfish talks to real BMCs, which makes feature development, CI and debugging expensive without hardware. The emulator gives you the same Redfish surface in a container or laptop so:
- New Badfish code paths are tested against a live server in CI, not mocked unit tests
- Developers can reproduce edge cases (RBAC demotions, virtual media mounts, SCP exports) deterministically
- Anyone can try Badfish with no hardware, no credentials and no risk
The emulator generates its own self-signed TLS certificate at runtime under $XDG_CACHE_HOME/badfish/emulator (overridable with BADFISH_EMULATOR_CERTS), so no private key ever ships in the repo, wheel or RPM. Default credentials are quads/quads, overridable with BADFISH_EMULATOR_USER and BADFISH_EMULATOR_PASSWORD.
Other 1.7.0 Improvements
- Multiple BIOS attributes in one call: repeatable
--attribute-value attribute=valuestages several changes and applies them in a single operation with one reboot; no-op PATCHes are skipped entirely. - Explicit host location:
--rack,--ulocand--bladearguments for rack/U-location/blade overrides. - iDRAC10 support: Dell 17G hosts (R670, iDRAC10) now work with virtual media and OS deployment, which previously failed on the removed legacy Dell OEM namespace.
- Hardening: boot-to failures propagate to exit status, export paths join correctly, duplicate attribute names (including case-insensitive ones) are rejected, structured
--check-bootJSON, and defensive parsing throughout. - Packaging: container images now build from the checked-out code (no more stale master-based dev images), an AUR package is published, rpmlint gates RPM hygiene in CI, and the README documents the full current feature set.
SSL Inspection and Credentials
Badfish verifies TLS certificates by default against your BMC. For development and testing against hosts with self-signed certificates, including the bundled Redfish emulator, use --insecure to skip verification; do not use it with production BMCs. The README documents this under Skip TLS certificate verification.
For credentials, environment variables are preferred over -u/-p so secrets never land in shell history or process listings:
export BADFISH_USERNAME="my_username" export BADFISH_PASSWORD="my_password" badfish -H mgmt-host01.example.com --power-state
Try It
Install Badfish and start the emulator:
dnf copr enable quadsdev/badfish -y dnf install badfish -y badfish --redfish-emulator --port 8443
Then point Badfish at it as you would any BMC, using --insecure for the emulator’s self-signed cert. Full documentation lives in the Badfish README.
Try the Container
The same emulator runs in the container image:
podman pull quay.io/quads/badfish podman run -it --rm -p 8443:8443 quay.io/quads/badfish --redfish-emulator --port 8443
Point a Badfish client at it (default emulator credentials are quads/quads):
export BADFISH_USERNAME=quads export BADFISH_PASSWORD=quads badfish -H localhost --insecure --power-state
QUADS Project 