.editorconfig

@@ -0,0 +1,11 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[Jenkinsfile]
+indent_style = space
+indent_size = 4

.vscode/settings.json

@@ -1,7 +0,0 @@
-{
-    "files.associations": {
-        "**/configs/*_defconfig": "properties",
-        "**/etc/fstab": "text",
-        "**/etc/pam.d/*": "raw"
-    }
-}

Makefile

@@ -1,31 +1,17 @@
-BUILDROOT_SRC ?= ~/src/buildroot
-
-.PHONY: all
-all: initramfs rootfs
+SHELL ?= /bin/sh
 
 .PHONY: rootfs
-rootfs: _build/rootfs/.config
-	$(MAKE) -C _build/rootfs -j $(shell nproc)
+rootfs:
+	$(SHELL) mkrootfs.sh _build/rootfs
 
 .PHONY: initramfs
-initramfs: _build/initramfs/.config
-	$(MAKE) -C _build/initramfs -j $(shell nproc)
+initramfs: _build/rootfs/boot/initramfs.img
+
+_build/rootfs/boot/initramfs.img: \
+		_build/rootfs/bin/dracut \
+		mkinitramfs.sh
+	$(SHELL) mkinitramfs.sh _build/rootfs
 
 .PHONY: publish
 publish:
-	rsync -rtliO \
-		--delete \
-		_build/rootfs/images/rpi-firmware/ \
-		_build/rootfs/images/Image \
-		_build/rootfs/images/*.dtb \
-		_build/initramfs/images/rootfs.cpio.lz4 \
-		pxe0.pyrocufflink.blue:/var/lib/tftpboot/basementhud/
-	rsync -P --no-W \
-		_build/rootfs/images/rootfs.squashfs \
-		pxe0.pyrocufflink.blue:/var/lib/nbd/basementhud.squashfs
-
-_build/rootfs/.config:
-	$(MAKE) -C $(BUILDROOT_SRC) O=${PWD}/_build/rootfs BR2_EXTERNAL=${PWD} basementhud_defconfig
-
-_build/initramfs/.config:
-	$(MAKE) -C $(BUILDROOT_SRC) O=${PWD}/_build/initramfs BR2_EXTERNAL=${PWD} basementhud_initramfs_defconfig
+	$(SHELL) publish.sh _build/rootfs

README.md

@@ -1,32 +1,32 @@
-# Network-Booted Heads-Up Display System
+# Basement Hud Network-Booted OS
 
-## Required Build Host Configuration
+Customized Fedora-based operating system distributed as an immutable
+root filesystem image.
+
+## Building
+
+Must run on a Fedora host or privileged container.
+
+Build the root filesystem image:
 
 ```sh
-sudo dnf install -y \
-	ncurses-devel \
-	perl-ExtUtils-MakeMaker \
-	perl-FindBin \
-	perl-Thread-Queue \
-	--
+make rootfs
 ```
 
+This will create an `_build/rootfs` directory containing the root filesystem
+hierarchy.  The `_build/rootfs/boot` directory contains the necessary files to
+boot the system:
+
+* `efi`: This directory contains the Raspberry Pi firmware files
+* `initramfs.img`: Early userspace image
+* `vmlinuz`: Kernel image
+* `basementhud.squashfs`: Root filesystem image
+
+The Raspberry Pi firmware, initramfs image, and kernel image files must be
+served by a TFTP, while the rootfs image is served by NBD.
+
+Build the initramfs image:
+
 ```sh
-git clone git://git.buildroot.net/buildroot ~/src/buildroot
-```
-
-## Build
-
-### Build the Initramfs
-
-```sh
-make -C ~/src/buildroot O=${PWD}/_build/initramfs BR2_EXTERNAL=${PWD} basementhud_initramfs_defconfig
-make -C _build/initramfs -j $(nproc)
-```
-
-### Build the Rootfs
-
-```sh
-make -C ~/src/buildroot O=${PWD}/_build/rootfs BR2_EXTERNAL=${PWD} basementhud_defconfig
-make -C _build/rootfs -j $(nproc)
+make initramfs
 ```

ci/Dockerfile

@@ -1,4 +1,4 @@
-FROM registry.fedoraproject.org/fedora:30
+FROM registry.fedoraproject.org/fedora:35
 
 ARG UID
 ARG GID
@@ -7,19 +7,13 @@ RUN groupadd -g ${GID} jenkins \
     && useradd -u ${UID} -g ${GID} -m -d /var/lib/jenkins -l jenkins
 
 RUN dnf install -y \
-    bc \
-    bzip2 \
-    cpio \
-    diffutils \
-    g++ \
-    gcc \
+    findutils \
     make \
-    ncurses-devel \
     openssh-clients \
-    patch \
-    perl-ExtUtils-MakeMaker \
-    perl-Thread-Queue \
+    python3-pip \
     rsync \
-    wget \
-    which \
+    squashfs-tools \
+    tar \
+    unzip \
+    util-linux \
     && dnf clean all

ci/Jenkinsfile

@@ -1,14 +1,8 @@
 pipeline {
     agent {
-        dockerfile {
-            dir 'ci'
-            args '''
-            -v /etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts
-            '''
-            additionalBuildArgs '''\
-            --build-arg UID=$(id -u) \
-            --build-arg GID=$(id -g) \
-            '''
+        kubernetes {
+            yamlFile 'ci/podTemplate.yaml'
+            defaultContainer 'build'
         }
     }
 
@@ -17,66 +11,29 @@ pipeline {
         disableConcurrentBuilds()
     }
 
-    triggers {
-        pollSCM ''
-    }
-
-    parameters {
-        booleanParam \
-            name: 'Clean',
-            description: 'Clean the workspace and perform a full rebuild'
-    }
-
-    environment {
-        BUILDROOT_SRC = "${env.WORKSPACE}/buildroot"
-    }
-
     stages {
-        stage('Prepare') {
-            steps {
-                script {
-                    if (params.Clean) {
-                        sh 'rm -rf _build'
-                    }
-                }
-                checkout poll: false, scm: [
-                    $class: 'GitSCM',
-                    branches: [[name: '2022.02.x']],
-                    doGenerateSubmoduleConfigurations: false,
-                    userRemoteConfigs: [[url: 'git://git.buildroot.net/buildroot']],
-                    extensions: [
-                        [
-                            $class: 'RelativeTargetDirectory',
-                            relativeTargetDir: 'buildroot',
-                        ],
-                    ],
-                ]
-            }
-        }
-
         stage('Build') {
-            parallel {
-                stage('Build Initramfs') {
-                    steps {
-                        sh 'make initramfs'
-                    }
-                }
-
-                stage('Build Rootfs') {
-                    steps {
-                        sh 'make rootfs'
-                    }
-                }
+            steps {
+                copyArtifacts \
+                    filter: 'aarch64/mqttdpms',
+                    projectName: '../mqttdpms/master',
+                    selector: lastSuccessful()
+                sh 'install aarch64/mqttdpms overlay/usr/local/bin/'
+                sh 'make rootfs initramfs'
             }
         }
 
         stage('Publish') {
             when {
-                branch 'master'
+                not {
+                    changeRequest()
+                }
             }
             steps {
-                sshagent(['jenkins-pxe']) {
-                    sh 'make publish'
+                container('publish') {
+                    sshagent(['jenkins-pxe']) {
+                        sh 'make publish'
+                    }
                 }
             }
         }

ci/podTemplate.yaml

@@ -0,0 +1,31 @@
+spec:
+  nodeSelector:
+    kubernetes.io/arch: arm64
+  terminationGracePeriodSeconds: 0
+  containers:
+  - name: build
+    image: git.pyrocufflink.net/containerimages/build/basementhud
+    command:
+    - sleep
+    - infinity
+    securityContext:
+      readOnlyRootFilesystem: true
+      privileged: true
+    volumeMounts:
+    - name: tmp
+      mountPath: /tmp
+  - name: publish
+    image: git.pyrocufflink.net/containerimages/build/basementhud
+    command:
+    - sleep
+    - infinity
+    securityContext:
+      readOnlyRootFilesystem: true
+      runAsUser: 1000
+    volumeMounts:
+    - name: tmp
+      mountPath: /tmp
+  volumes:
+  - name: tmp
+    emptyDir:
+      medium: Memory

cmdline.txt

@@ -1 +1 @@
-audit=0 panic=5 console=ttyAMA0 root=nbd:pxe0.pyrocufflink.blue:basementhud sshkeys.root=http://rosalina.pyrocufflink.blue/~dustin/id_ed25519.pub
+rd.retry=3 rd.timeout=5 panic=5 audit=0 root=nbd:pxe0.pyrocufflink.blue:basementhud console=ttyAMA0

config.txt

@@ -1,23 +1,60 @@
-# See http://buildroot.org/manual.html#rootfs-custom
-# and http://elinux.org/RPiconfig for a description of config.txt syntax
+# Raspberry Pi 4
+[pi4]
+kernel=vmlinuz
+dtoverlay=upstream-pi4
 
-start_file=start4.elf
-fixup_file=fixup4.dat
-
-kernel=Image
+# Default Fedora configs for all Raspberry Pi Revisions
+[all]
+# Put the RPi into 64 bit mode
+arm_64bit=1
 
 # To use an external initramfs file
-initramfs rootfs.cpio.lz4
+initramfs initramfs.img
+
+# Enable UART
+# Only enable UART if you're going to use it as it has speed implications
+# Serial console is ttyS0 on RPi3 and ttyAMA0 on all other variants
+# u-boot will auto detect serial and pass corrent options to kernel if enabled
+# Speed details: https://www.raspberrypi.org/forums/viewtopic.php?f=28&t=141195
+
+# Terrible hack to work around U-Boot issues on most devices
+#enable_uart=1
+
+# Early boot delay in the hope monitors are initialised enough to provide EDID
+bootcode_delay=1
+
+# We need this to be 32Mb to support VCHI services and drivers which use them
+# but this isn't used by mainline VC4 driver so reduce to lowest supported value
+# You need to set this to at least 80 for using the camera
+gpu_mem=32
+
+# Use eXtended firmware by default
+start_x=1
+
+# Stop the RPi turning on HDMI monitors on reboot
+hdmi_ignore_cec_init=1
 
-# Disable overscan assuming the display supports displaying the full resolution
-# If the text shown on the screen disappears off the edge, comment this out
 disable_overscan=1
 
-dtoverlay=vc4-kms-v3d-pi4
-dtoverlay=imx219
-#dtoverlay=ov5647
+# New option to allow the firmware to load upstream dtb
+# Will allow things like camera, touchscreen etc to work OOTB
+upstream_kernel=1
+
+# HAT and DT overlays. Documentation at Raspberry Pi here:
+# https://www.raspberrypi.org/documentation/configuration/device-tree.md
+# Each dtoverlay line is an individual HAT/overlay, multiple lines allowed
+# dtoverlay=rpi-sense
+
+# Other options you can adjust for all Raspberry Pi Revisions
+# https://www.raspberrypi.org/documentation/configuration/config-txt/README.md
+# All options documented at http://elinux.org/RPiconfig
+# for more options see http://elinux.org/RPi_config.txt
+
+# To use this on Fedora you need to use firmware provided device tree, not kernel
+# For this functionality follow the following guide:
+# https://fedoraproject.org/w/index.php?title=Architectures/ARM/Raspberry_Pi/HATs
 
 dtoverlay=disable-bt
 
-# enable 64bits support
-arm_64bit=1
+# Enable the i2c RTC on the CM4 I/O board
+dtoverlay=i2c-rtc,pcf85063a,i2c_csi_dsi

configs/basementhud_defconfig

@@ -1,69 +0,0 @@
-BR2_aarch64=y
-BR2_cortex_a72=y
-BR2_ARM_FPU_VFPV4=y
-BR2_TOOLCHAIN_BUILDROOT_GLIBC=y
-BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_10=y
-BR2_TOOLCHAIN_BUILDROOT_CXX=y
-BR2_TARGET_GENERIC_HOSTNAME="localhost"
-BR2_INIT_SYSTEMD=y
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
-BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
-BR2_ROOTFS_USERS_TABLES="$(BR2_EXTERNAL_basementhud_PATH)/rootfs/users"
-BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_basementhud_PATH)/rootfs/overlay"
-BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_basementhud_PATH)/rootfs/post-build.sh"
-BR2_ROOTFS_POST_FAKEROOT_SCRIPT="$(BR2_EXTERNAL_basementhud_PATH)/rootfs/post-fakeroot.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_basementhud_PATH)/rootfs/post-image.sh"
-BR2_LINUX_KERNEL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="$(call github,raspberrypi,linux,0b54dbda3cca2beb51e236a25738784e90853b64)/linux-0b54dbda3cca2beb51e236a25738784e90853b64.tar.gz"
-BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_basementhud_PATH)/rootfs/linux.config"
-BR2_LINUX_KERNEL_DTS_SUPPORT=y
-BR2_LINUX_KERNEL_INTREE_DTS_NAME="broadcom/bcm2711-rpi-4-b"
-BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
-# BR2_PACKAGE_BUSYBOX is not set
-BR2_PACKAGE_SED=y
-BR2_PACKAGE_BTRFS_PROGS=y
-BR2_PACKAGE_E2FSPROGS=y
-BR2_PACKAGE_MESA3D=y
-BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_V3D=y
-BR2_PACKAGE_MESA3D_OPENGL_GLX=y
-BR2_PACKAGE_XORG7=y
-BR2_PACKAGE_XSERVER_XORG_SERVER=y
-BR2_PACKAGE_XAPP_XINIT=y
-BR2_PACKAGE_XAPP_XSET=y
-BR2_PACKAGE_MATCHBOX=y
-BR2_PACKAGE_RPI_FIRMWARE=y
-BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4=y
-BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="$(BR2_EXTERNAL_basementhud_PATH)/config.txt"
-BR2_PACKAGE_PYTHON3=y
-BR2_PACKAGE_PYTHON_PIP=y
-BR2_PACKAGE_PYTHON_PYDANTIC=y
-BR2_PACKAGE_PYTHON_PYYAML=y
-BR2_PACKAGE_CA_CERTIFICATES=y
-BR2_PACKAGE_LIBCURL=y
-BR2_PACKAGE_LIBCURL_CURL=y
-# BR2_PACKAGE_LIBCURL_EXTRA_PROTOCOLS_FEATURES is not set
-BR2_PACKAGE_CHRONY=y
-BR2_PACKAGE_DHCPCD=y
-# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_IPROUTE2=y
-BR2_PACKAGE_NBD=y
-BR2_PACKAGE_OPENSSH=y
-BR2_PACKAGE_COREUTILS=y
-BR2_PACKAGE_COREUTILS_INDIVIDUAL_BINARIES=y
-BR2_PACKAGE_PROCPS_NG=y
-BR2_PACKAGE_PSMISC=y
-BR2_PACKAGE_RSYSLOG=y
-# BR2_PACKAGE_SYSTEMD_PSTORE is not set
-# BR2_PACKAGE_SYSTEMD_HOSTNAMED is not set
-# BR2_PACKAGE_SYSTEMD_HWDB is not set
-# BR2_PACKAGE_SYSTEMD_NETWORKD is not set
-# BR2_PACKAGE_SYSTEMD_RESOLVED is not set
-# BR2_PACKAGE_SYSTEMD_TIMEDATED is not set
-# BR2_PACKAGE_SYSTEMD_TIMESYNCD is not set
-BR2_PACKAGE_UTIL_LINUX_LOGIN=y
-BR2_PACKAGE_LESS=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
-BR2_TARGET_ROOTFS_SQUASHFS4_LZ4=y
-# BR2_TARGET_ROOTFS_TAR is not set

configs/basementhud_initramfs_defconfig

@@ -1,18 +0,0 @@
-BR2_aarch64=y
-BR2_cortex_a72=y
-BR2_ARM_FPU_VFPV4=y
-BR2_TOOLCHAIN_BUILDROOT_MUSL=y
-BR2_KERNEL_HEADERS_5_10=y
-BR2_TOOLCHAIN_BUILDROOT_CXX=y
-BR2_INIT_NONE=y
-# BR2_TARGET_GENERIC_GETTY is not set
-# BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
-BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_basementhud_PATH)/initramfs/overlay"
-BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_basementhud_PATH)/initramfs/busybox.config"
-# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_NBD=y
-BR2_TARGET_ROOTFS_CPIO=y
-BR2_TARGET_ROOTFS_CPIO_LZ4=y
-# BR2_TARGET_ROOTFS_TAR is not set
-BR2_PACKAGE_HOST_KMOD=y
-BR2_PACKAGE_HOST_UTIL_LINUX=y

external.desc

@@ -1,2 +0,0 @@
-name: basementhud
-desc: Basement HUD System

initramfs/overlay/sbin/init

@@ -1,40 +0,0 @@
-#!/bin/sh -e
-
-export PATH=/usr/sbin:/usr/bin:/sbin:/bin
-
-mkdir -p /proc /run /sys
-mount -t sysfs sysfs /sys
-mount -t proc proc /proc
-mount -t tmpfs tmpfs /run
-
-# shellcheck disable=SC2046
-set -- $(cat /proc/cmdline)
-while [ $# -ge 1 ]; do
-    case "$1" in
-    root=nbd:*)
-        arg=${1#*:}
-        name=${arg#*:}
-        host=${arg%:*}
-        ;;
-    esac
-    shift
-done
-
-for path in /sys/class/net/*; do
-    [ -e "${path}" ] || continue
-    ip link set "${path##*/}" up
-done
-sleep 5
-udhcpc -q
-
-@bd-client -N "${name}" -R -p "${host}" /dev/nbd0
-mkdir -p /sysroot
-mount -o ro -t squashfs /dev/nbd0 /sysroot || nbd-client -c /dev/nbd0
-
-cd /sysroot
-mount --move /proc /sysroot/proc
-mount --move /sys /sysroot/sys
-mount --move /dev /sysroot/dev
-mount --move /run /sysroot/run
-
-exec switch_root /sysroot /lib/systemd/systemd

initramfs/overlay/usr/sbin/@bd-client

@@ -1 +0,0 @@
-nbd-client

initramfs/overlay/usr/share/udhcpc/default.script

@@ -1,39 +0,0 @@
-#!/bin/sh
-
-
-case "$1" in
-deconfig|nak)
-    ;;
-renew|bound)
-    if [ -n "${ip}" ]; then
-        # shellcheck disable=SC2154  # interface is is an environment variable
-        ip addr add "${ip}"/"${mask:-32}" dev "${interface}"
-    fi
-    if [ -n "${staticroutes}" ]; then
-        # shellcheck disable=SC2086  # we WANT word splitting here!
-        set -- ${staticroutes}
-        ip route add "$1" via "$2" dev "${interface}"
-    elif [ -n "${router}" ]; then
-        for gw in ${router}; do
-            ip route add default via "${gw}" dev "${interface}"
-        done
-    fi
-    : > /etc/resolv.conf
-    if [ -n "${search}" ]; then
-        printf 'search %s\n' "${search}" >> /etc/resolv.conf
-    elif [ -n "${domain}" ]; then
-        printf 'search %s\n' "${domain}" >> /etc/resolv.conf
-    fi
-    if [ -n "${dns}" ]; then
-        for ns in ${dns}; do
-            printf 'nameserver %s\n' "${ns}" >> /etc/resolv.conf
-        done
-    fi
-    if [ -n "${ntpsrv}" ] && [ -x /usr/sbin/ntpd ]; then
-        for ts in ${ntpsrv}; do
-            /usr/sbin/ntpd -n -q -p "${ts}" || continue
-            break
-        done
-    fi
-    ;;
-esac

mkinitramfs.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+
+set -eu
+
+destdir="$(readlink -e "$1")"
+
+kver=$(rpm --root "${destdir}" -q --qf '%{VERSION}-%{RELEASE}.%{ARCH}' kernel)
+printf 'Building initramfs image for kernel %s\n' "${kver}"
+
+cd "${destdir}"
+mkdir -p boot dev proc sys tmp
+mountpoint -q dev || mount -o bind /dev dev
+mountpoint -q proc || mount -t proc proc proc
+mountpoint -q sys || mount -t sysfs sysfs sys
+mountpoint -q tmp || mount -t tmpfs tmpfs tmp
+
+echo 'Copying kernel image to /boot/ ...' >&2
+cp -a "${destdir}"/lib/modules/"${kver}"/vmlinuz \
+    "${destdir}"/boot/
+echo 'Building initramfs image ...' 2>&1
+chroot "${destdir}" dracut \
+    --no-hostonly \
+    --modules 'nbd udev-rules dracut-systemd shutdown' \
+    --drivers 'genet nbd squashfs' \
+    --force-drivers 'bcm2835_wdt i2c_bcm2835 i2c_mux_pinctrl rtc_pcf85063' \
+    --force \
+    /boot/initramfs.img \
+    "${kver}"
+echo 'Fixing boot file pemissions ...' 2>&1
+find "${destdir}"/boot \
+    -type d -exec chmod a+rx {} + \
+    -or \
+    -type f -exec chmod a+r {} +
+
+umount tmp sys proc dev

mkrootfs.sh

@@ -0,0 +1,86 @@
+#!/bin/sh
+
+set -e
+
+srcdir="$(dirname "$0")"
+destdir="$(mkdir -p "$1" && readlink -e "$1")"
+dest=basementhud.squashfs
+releasever=37
+
+mkdir -p "${destdir}"
+
+dnf --installroot "${destdir}" install -y \
+    --releasever ${releasever} \
+    fedora-release
+
+cp /etc/dnf/dnf.conf "${destdir}/etc/dnf/"
+echo install_weak_deps=False >> "${destdir}"/etc/dnf/dnf.conf
+
+dnf --installroot "${destdir}" install -y \
+    bcm2711-firmware \
+    curl \
+    dhcp-client \
+    dracut-network \
+    firefox \
+    hostname \
+    kmod \
+    mesa-dri-drivers \
+    nbd \
+    openbox \
+    openssh-server \
+    openssl1.1 \
+    rsyslog \
+    systemd \
+    xinit \
+    xorg-x11-server-Xorg \
+    xrandr \
+    xset \
+    zram-generator \
+    zram-generator-defaults \
+    --
+
+dnf --installroot "${destdir}" install -y \
+    --setopt tsflags=noscripts \
+    kernel \
+    --
+kver=$(rpm --root "${destdir}" -q --qf '%{VERSION}-%{RELEASE}.%{ARCH}' kernel)
+if [ ! -f "${destdir}"/lib/modules/"${kver}"/modules.dep ]; then
+    chroot "${destdir}" depmod -a "${kver}"
+fi
+
+cp -p \
+    "${srcdir}"/cmdline.txt \
+    "${srcdir}"/config.txt \
+    "${destdir}"/boot/efi
+
+tar --owner root:0 --group root:0 -C "${srcdir}/overlay" -c . \
+    | tar -C "${destdir}" -x
+chown -R 1000:1000 "${destdir}"/home/user
+if ! grep -q ^user: "${destdir}"/etc/group; then
+    chroot "${destdir}" groupadd -g 1000 user
+fi
+if ! grep -q ^user: "${destdir}"/etc/passwd; then
+    chroot "${destdir}" useradd -u 1000 -g 1000 user
+fi
+if ! grep -qE '^video:.*:.+:.*,?user' "${destdir}"/etc/group; then
+    chroot "${destdir}" gpasswd -a user video
+fi
+chroot "${destdir}" systemctl enable \
+    dhclient@eth0 \
+    systemd-time-wait-sync \
+    systemd-timesyncd \
+    xinit@user
+chroot "${destdir}" systemctl disable \
+    systemd-homed \
+    systemd-userdbd
+ln -sf /run/resolv.conf "${destdir}"/etc/resolv.conf
+grep -lR pam_sss "${destdir}"/etc/pam.d \
+    | xargs sed -i /pam_sss/d
+
+umask 0022
+mksquashfs "${destdir}" "${destdir}/boot/${dest}" \
+    -comp lz4 \
+    -noappend \
+    -ef "${srcdir}"/squashfs-exclude.txt \
+    -no-exports \
+    -wildcards

overlay/etc/dhcp/dhclient-enter-hooks

@@ -0,0 +1,7 @@
+# Avoid handling the EXPIRE event, which would ordinarily result in the
+# IP address being removed from the interface.  `dhclient` fires the
+# EXPIRE event every time it renews the lease, even if the lease has not
+# actually expired.
+if [ "${reason}" = EXPIRE ]; then
+    exit 0
+fi

overlay/etc/dhcp/dhclient.conf

@@ -0,0 +1,10 @@
+option classless-static-routes code 121 = array of unsigned integer 8;
+
+send dhcp-client-identifier = hardware;
+
+request subnet-mask, broadcast-address, time-offset, routers,
+        domain-name, domain-name-servers, domain-search, host-name,
+        root-path, interface-mtu, classless-static-routes,
+        netbios-name-servers, netbios-scope, ntp-servers,
+        dhcp6.domain-search, dhcp6.fqdn,
+        dhcp6.name-servers, dhcp6.sntp-servers;

overlay/etc/fstab

@@ -0,0 +1,6 @@
+tmpfs /var/lib/rsyslog tmpfs defaults 0 0
+tmpfs /var/log tmpfs defaults 0 0
+tmpfs /var/lib/systemd tmpfs defaults 0 0
+/dev/mmcblk0 /run/storage ext4 ro,noexec,nosuid,nodev,x-systemd.makefs 0 2
+overlay /etc/ssh overlay ro,lowerdir=/etc/ssh:/run/storage/ssh,noexec,nodev,nosuid,x-systemd.requires-mounts-for=/run/storage 0 0
+/dev/nbd1 swap swap noauto,x-systemd.makefs 0 0

overlay/etc/nbdtab

@@ -0,0 +1 @@
+nbd1 pxe0.pyrocufflink.blue basementhud-swap

overlay/etc/rsyslog.conf

@@ -0,0 +1,9 @@
+global(workDirectory="/var/lib/rsyslog")
+module(load="imjournal"
+       StateFile="imjournal.state")
+action(
+    type="omfwd"
+    Target="172.30.0.17"
+    Port="514"
+    template="RSYSLOG_SyslogProtocol23Format"
+)

overlay/etc/systemd/system/dev-nbd1.device.wants/nbd@nbd1.service

@@ -0,0 +1 @@
+/usr/lib/systemd/system/nbd@.service

overlay/etc/systemd/system/dev-nbd1.swap.d/no-default-dependencies.conf

@@ -0,0 +1,5 @@
+[Unit]
+# All swap units have a default `Before=swap.target` dependency.  This
+# does not work for swap devices using NBD, because `swap.target` is
+# reached before the network is up.
+DefaultDependencies=no

overlay/etc/systemd/system/dhclient@.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=DHCPv4 client for %I
+Before=network-online.target
+Before=network.target
+
+[Service]
+Type=forking
+RuntimeDirectory=dhclient
+ExecStart=/usr/sbin/dhclient -4 -1 -lf /run/dhclient/%I.lease -pf /run/dhclient/%I.pid
+PIDFile=/run/dhclient/%I.pid
+
+[Install]
+WantedBy=multi-user.target

overlay/etc/systemd/system/emergency.service.d/sulogin-force.conf

@@ -0,0 +1,2 @@
+[Service]
+Environment=SYSTEMD_SULOGIN_FORCE=1

overlay/etc/systemd/system/init-localstorage.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Initialize Local Storage
+DefaultDependencies=no
+After=local-fs-pre.target
+After=run-storage.mount
+Before=etc-ssh.mount
+Before=local-fs.target
+Conflicts=shutdown.target
+ConditionPathExists=!/run/storage/ssh
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/libexec/init-localstorage.sh
+
+[Install]
+WantedBy=run-storage.mount

overlay/etc/systemd/system/multi-user.target.wants/dev-nbd1.swap

@@ -0,0 +1 @@
+../dev-nbd1.swap

overlay/etc/systemd/system/run-storage.mount.wants/init-localstorage.service

@@ -0,0 +1 @@
+../init-localstorage.service

overlay/etc/systemd/system/xinit@.service

@@ -2,19 +2,21 @@
 Description=Start X.org for user %I
 Wants=network-online.target
 After=network-online.target
-Wants=time-sync.target
-After=time-sync.target
+Wants=time-set.target
+After=time-set.target
+After=getty@tty1.service
+Conflicts=getty@tty1.service
 
 [Service]
 Type=simple
 User=%I
 WorkingDirectory=~
 PAMName=xinit
-TTYPath=/dev/tty7
+TTYPath=/dev/tty1
 StandardInput=tty
 StandardOutput=journal
 StandardError=journal
-ExecStart=/usr/bin/startx
+ExecStart=/usr/bin/startx -- -nocursor
 Restart=always
 
 [Install]

overlay/etc/systemd/user/firefox-marionette.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Firefox marionette reverse proxy
+Requires=firefox-marionette.socket
+Requires=firefox.service
+
+[Service]
+ExecStart=/usr/lib/systemd/systemd-socket-proxyd \
+    --connections-max=1 \
+    --exit-idle-time=10s \
+    127.0.0.1:2828

overlay/etc/systemd/user/firefox-marionette.socket

@@ -0,0 +1,5 @@
+[Unit]
+Description=Firefox Marionette socket
+
+[Socket]
+ListenStream=[::]:2829

overlay/etc/systemd/user/firefox.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Firefox web browser
+Wants=firefox-marionette.socket
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/firefox -marionette
+Restart=always
+StandardInput=null
+StandardOutput=journal

overlay/etc/systemd/user/mqttdpms.service

@@ -0,0 +1,9 @@
+[Unit]
+Description=MQTT DPMS Control
+
+[Service]
+ExecStart=/usr/local/bin/mqttdpms
+Environment=RUST_LOG=info
+Restart=always
+StandardInput=null
+StandardOutput=journal

overlay/etc/tmpfiles.d/resolvconf.conf

@@ -0,0 +1 @@
+f /run/resolv.conf 0644 root root - -

overlay/home/user/.config/mqttdpms/config.toml

@@ -0,0 +1 @@
+/run/storage/mqttdpms.toml

overlay/home/user/.config/openbox/autostart

@@ -0,0 +1,10 @@
+#!/bin/sh
+
+BASE_URL=https://hudctrl.pyrocufflink.blue/api
+xrandr --listactivemonitors \
+    | curl "${BASE_URL}"/display/monitors \
+        -H 'Content-Type: text/plain' \
+        --upload-file -
+
+curl "${BASE_URL}"/display/up \
+    -d port=2829

overlay/home/user/.xinitrc

@@ -0,0 +1,12 @@
+#!/bin/sh
+
+xset s off
+xset -dpms
+
+TZ="$(curl https://ipapi.co/timezone)"
+export TZ
+
+systemctl --user import-environment DISPLAY TZ
+systemctl --user start firefox-marionette.socket firefox mqttdpms
+
+exec openbox-session

overlay/root/.ssh/authorized_keys

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJsL5fSylmiJmBtW0DH/viAAmtU2E/2M17GPvysiyRs+ dustin@rosalina

overlay/usr/lib/dracut/modules.d/90kernel-network-modules/module-setup.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/bash
+
+check() {
+    return 255
+}
+
+depends() {
+    return 0
+}
+
+installkernel() {
+    return 0
+}
+
+install() {
+    return 0
+}

overlay/usr/local/bin/basementhud

@@ -0,0 +1,10 @@
+#!/bin/sh
+
+python3 -m ensurepip
+python3 -m pip install -U pip
+python3 -m pip install \
+    --user \
+    --find-links https://files.pyrocufflink.blue/wheels/voonex \
+    --upgrade \
+    voonex
+exec python3 -m voonex

overlay/usr/local/libexec/home-overlay.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+if mountpoint -q "${HOME}"; then
+    exit 0
+fi
+
+upperdir="${XDG_RUNTIME_DIR}"/home/rw
+workdir="${XDG_RUNTIME_DIR}"/home/.work
+
+mkdir -p "${upperdir}"
+mkdir -p "${workdir}"
+
+mount overlay \
+    -t overlay \
+    -o lowerdir="${HOME}",upperdir="${upperdir}",workdir="${workdir}" \
+    "${HOME}"
+chown "${PAM_USER}": "${HOME}"

overlay/usr/local/libexec/init-localstorage.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+
+die() {
+    remount_ro
+    echo "ERROR: $1" >&2
+    exit 1
+}
+
+gen_ssh_keys() {
+    unset kf x
+    mkdir -p /run/storage/ssh || die 'Could not create /run/storage/ssh'
+    for x in rsa ecdsa ed25519; do
+        kf=/run/storage/ssh/ssh_host_${x}_key
+        if [ ! -f ${kf} ]; then
+            ssh-keygen -t ${x} -f ${kf} -N '' -C '' \
+                || die "Failed to generate ${x} SSH host key"
+        fi
+    done
+}
+
+remount_ro() {
+    if [ -w /run/storage ]; then
+        mount -oremount,ro /run/storage
+    fi
+}
+
+remount_rw() {
+    if [ ! -w /run/storage ]; then
+        mount -o remount,rw /run/storage \
+            || die 'Could not remount /run/storage read-write'
+    fi
+}
+
+mountpoint -q /run/storage || die '/run/storage is not mounted'
+
+if [ ! -d /run/storage/ssh ]; then
+    remount_rw
+    gen_ssh_keys
+fi
+
+remount_ro

prepare.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -e
+shopt -s nullglob
+
+dnf install -y \
+    make \
+    rsync \
+    squashfs-tools \
+    tar \
+    unzip \
+    util-linux \
+    --

publish.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+
+set -eu
+
+destdir="$(readlink -e "$1")"
+bootdir="${destdir}/boot"
+
+rsync -rtliO --chmod=a=rwX \
+    "${bootdir}"/efi/ \
+    "${bootdir}"/initramfs.img \
+    "${bootdir}"/vmlinuz \
+    pxe0.pyrocufflink.blue:/var/lib/tftpboot/basementhud/
+rsync -ti --chmod=a=rwX \
+    "${bootdir}"/basementhud.squashfs \
+    pxe0.pyrocufflink.blue:/var/lib/nbd/basementhud.squashfs

rootfs/overlay/etc/chrony.conf

@@ -1,2 +0,0 @@
-sourcedir /run/chrony-dhcp
-makestep 0.1 10

rootfs/overlay/etc/dhcpcd.conf

@@ -1,55 +0,0 @@
-# A sample configuration for dhcpcd.
-# See dhcpcd.conf(5) for details.
-
-# Allow users of this group to interact with dhcpcd via the control socket.
-#controlgroup wheel
-
-# Inform the DHCP server of our hostname for DDNS.
-#hostname
-
-# Use the hardware address of the interface for the Client ID.
-clientid
-# or
-# Use the same DUID + IAID as set in DHCPv6 for DHCPv4 ClientID as per RFC4361.
-# Some non-RFC compliant DHCP servers do not reply with this set.
-# In this case, comment out duid and enable clientid above.
-#duid
-
-# Persist interface configuration when dhcpcd exits.
-persistent
-
-# vendorclassid is set to blank to avoid sending the default of
-# dhcpcd-<version>:<os>:<machine>:<platform>
-vendorclassid
-
-# A list of options to request from the DHCP server.
-option domain_name_servers, domain_name, domain_search
-option classless_static_routes
-# Respect the network MTU. This is applied to DHCP routes.
-option interface_mtu
-
-# Request a hostname from the network
-option host_name
-
-# Most distributions have NTP support.
-option ntp_servers
-
-# Rapid commit support.
-# Safe to enable by default because it requires the equivalent option set
-# on the server to actually work.
-option rapid_commit
-
-option log_servers
-
-# A ServerID is required by RFC2131.
-require dhcp_server_identifier
-
-# Generate SLAAC address using the Hardware Address of the interface
-#slaac hwaddr
-# OR generate Stable Private IPv6 Addresses based from the DUID
-slaac private
-
-denyinterfaces dummy* veth* docker*
-
-env NTP_CONF=/run/chrony-dhcp/dhcpcd.sources
-env ntp_restart_cmd=/usr/bin/chronyc reload sources

rootfs/overlay/etc/fstab

@@ -1,4 +0,0 @@
-tmpfs /var tmpfs mode=0755,noexec,nosuid,nodev 0 0
-tmpfs /root tmpfs size=1M,mode=550 0 0
-/dev/mmcblk0 /run/storage ext4 ro,noexec,nosuid,nodev 0 2
-overlay /etc/ssh overlay ro,lowerdir=/etc/ssh:/run/storage/ssh,noexec,nodev,nosuid,x-systemd.requires-mounts-for=/run/storage 0 0

rootfs/overlay/etc/rsyslog.conf

@@ -1,6 +0,0 @@
-global(workDirectory="/var/lib/rsyslog")
-module(load="imjournal"
-       StateFile="imjournal.state")
-
-include(file="/etc/rsyslog.d/*.conf" mode="optional")
-include(file="/run/rsyslog.d/*.conf" mode="optional")

rootfs/overlay/home/user/.xinitrc

@@ -1,7 +0,0 @@
-#!/bin/sh
-
-xset s off
-xset -dpms
-systemctl --user import-environment DISPLAY
-systemctl --user start gui.target
-exec matchbox-window-manager -use_titlebar no

rootfs/overlay/usr/lib/dhcpcd/dhcpcd-hooks/60-syslog

@@ -1,31 +0,0 @@
-#!/bin/sh
-
-gen_action() {
-    echo   'action('
-    echo   '    type="omfwd"'
-    printf '    Target="%s"\n' "${1}"
-    echo   '    Port="514"'
-    echo   '    template="RSYSLOG_SyslogProtocol23Format"'
-    echo   ')'
-}
-
-changed=false
-if [ -n "${interface}" ] && [ -d /run/rsyslog.d ]; then
-    if [ -n "${new_log_servers}" ]; then
-        if [ "${new_log_servers}" != "${old_log_servers}" ]; then
-            echo '# Generated by dhcpcd' \
-                > /run/rsyslog.d/dhcpcd."${interface}".conf
-            for s in ${new_log_servers}; do
-                gen_action "${s}" >> /run/rsyslog.d/dhcpcd."${interface}".conf
-            done
-        fi
-        changed=true
-    elif [ -n "${old_log_servers}" ]; then
-        rm -f /run/rsyslog.d/dhcpcd."${interface}".conf
-        changed=true
-    fi
-fi
-
-if ${changed}; then
-    systemctl try-restart rsyslog
-fi

rootfs/overlay/usr/lib/systemd/system-generators/fetch-sshkeys-generator

@@ -1,25 +0,0 @@
-#!/bin/sh
-
-enable_unit() {
-    mkdir -p "${normaldir}"/multi-user.target.wants
-    ln -s /lib/systemd/system/"$1" "${normaldir}"/multi-user.target.wants/
-}
-
-normaldir="$1"
-# shellcheck disable=SC2034
-earlydir="$2"
-# shellcheck disable=SC2034
-latedir="$3"
-
-# shellcheck disable=SC2046
-set -- $(cat /proc/cmdline)
-while [ $# -ge 1 ]; do
-    case "$1" in
-    sshkeys.*=*)
-        arg=${1#*.}
-        user=${arg%=*}
-        enable_unit fetch-sshkeys@"${user}".service
-        ;;
-    esac
-    shift
-done

rootfs/overlay/usr/lib/systemd/system-preset/70-basementhud.preset

@@ -1,10 +0,0 @@
-disable cups-lpd.socket
-disable cups.service
-disable cups.socket
-disable cups.path
-
-disable systemd-networkd.service
-disable systemd-resolved.service
-disable systemd-timesyncd.service
-
-xinit@user.service

rootfs/overlay/usr/lib/systemd/system/chrony-wait.service

@@ -1,47 +0,0 @@
-[Unit]
-Description=Wait for chrony to synchronize system clock
-Documentation=man:chronyc(1)
-After=chrony.service
-Requires=chrony.service
-Before=time-sync.target
-Wants=time-sync.target
-
-[Service]
-Type=oneshot
-# Wait for chronyd to update the clock and the remaining
-# correction to be less than 0.1 seconds
-ExecStart=/usr/bin/chronyc -h 127.0.0.1,::1 waitsync 0 0.1 0.0 1
-# Wait for at most 3 minutes
-TimeoutStartSec=180
-RemainAfterExit=yes
-StandardOutput=null
-
-CapabilityBoundingSet=
-DevicePolicy=closed
-DynamicUser=yes
-IPAddressAllow=localhost
-IPAddressDeny=any
-LockPersonality=yes
-MemoryDenyWriteExecute=yes
-PrivateDevices=yes
-PrivateUsers=yes
-ProcSubset=pid
-ProtectClock=yes
-ProtectControlGroups=yes
-ProtectHome=yes
-ProtectHostname=yes
-ProtectKernelLogs=yes
-ProtectKernelModules=yes
-ProtectKernelTunables=yes
-ProtectProc=invisible
-ProtectSystem=strict
-RestrictAddressFamilies=AF_INET AF_INET6
-RestrictNamespaces=yes
-RestrictRealtime=yes
-SystemCallArchitectures=native
-SystemCallFilter=@system-service
-SystemCallFilter=~@privileged @resources
-UMask=0777
-
-[Install]
-WantedBy=multi-user.target

rootfs/overlay/usr/lib/systemd/system/copy-var.service

@@ -1,9 +0,0 @@
-[Unit]
-Description=Copy /var contents to writable storage
-DefaultDependencies=no
-After=var.mount
-Before=local-fs.target
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/copy-var.sh

rootfs/overlay/usr/lib/systemd/system/dhcpcd.service.d/before-network-online.conf

@@ -1,2 +0,0 @@
-[Unit]
-Before=network-online.target

rootfs/overlay/usr/lib/systemd/system/dhcpcd.service.d/pidfile.conf

@@ -1,2 +0,0 @@
-[Service]
-PIDFile=/run/dhcpcd/pid

rootfs/overlay/usr/lib/systemd/system/fetch-sshkeys@.service

@@ -1,10 +0,0 @@
-[Unit]
-Description=Fetch SSH authorized_keys for %I
-Wants=network-online.target
-After=network-online.target
-After=remote-fs.target
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/fetch-sshkeys.sh
-User=%I

rootfs/overlay/usr/lib/systemd/system/local-fs.target.requires/copy-var.service

@@ -1 +0,0 @@
-../copy-var.service

rootfs/overlay/usr/lib/systemd/system/nbdtab-generator.service

@@ -1,13 +0,0 @@
-[Unit]
-Description=Generate nbdtab
-DefaultDependencies=no
-Before=sysinit.target
-After=local-fs.target
-ConditionPathExists=/etc/nbdtab
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/nbdtab-generator.sh
-
-[Install]
-WantedBy=sysinit.target

rootfs/overlay/usr/lib/systemd/system/rsyslog.service.d/after-network-online.conf

@@ -1,2 +0,0 @@
-[Unit]
-After=network-online.target

rootfs/overlay/usr/lib/systemd/user/gui.target

@@ -1,5 +0,0 @@
-[Unit]
-Description=Graphical User Interface
-After=default.target
-Wants=default.target
-AllowIsolate=yes

rootfs/overlay/usr/lib/tmpfiles.d/chrony.conf

@@ -1 +0,0 @@
-d /run/chrony-dhcp 0755 root root

rootfs/overlay/usr/lib/tmpfiles.d/rsyslog.conf

@@ -1 +0,0 @@
-d /run/rsyslog.d 0755 root root -

rootfs/overlay/usr/libexec/copy-var.sh

@@ -1,23 +0,0 @@
-#!/bin/sh
-
-set -e
-
-cleanup() {
-    if [ -n "${tmpdir}" ] && [ -d "${tmpdir}" ] && [ / != "${tmpdir}" ]; then
-        if mountpoint -q "${tmpdir}"; then
-            umount "${tmpdir}"
-        fi
-        rm -rf "${tmpdir}"
-    fi
-    unset tmpdir
-}
-
-tmpdir=$(TMPDIR=/run mktemp -d)
-trap cleanup INT QUIT TERM EXIT
-
-mount -o bind / "${tmpdir}"
-cp -a "${tmpdir}"/var/. /var/
-
-if [ -x "$(command -v selinuxenabled)" ] && selinuxenabled; then
-    restorecon -RF /var
-fi

rootfs/overlay/usr/libexec/fetch-sshkeys.sh

@@ -1,29 +0,0 @@
-#!/bin/sh -e
-
-umask 0077
-mkdir -p ~/.ssh
-: > ~/.ssh/authorized_keys
-
-fetch_keys() {
-    curl -fsSL "${1}" >> ~/.ssh/authorized_keys
-}
-
-# shellcheck disable=SC2046
-set -- $(cat /proc/cmdline)
-while [ $# -ge 1 ]; do
-    case "$1" in
-    sshkeys.*=*)
-        arg=${1#*.}
-        user=${arg%=*}
-        url=${arg#*=}
-        if [ "${user}" = "${USER}" ]; then
-            fetch_keys "${url}"
-        fi
-        ;;
-    esac
-    shift
-done
-
-if [ -x "$(command -v selinuxenabled)" ] && selinuxenabled; then
-    restorecon -RF ~/.ssh
-fi

rootfs/overlay/usr/libexec/nbdtab-generator.sh

@@ -1,29 +0,0 @@
-#!/bin/sh
-
-[ -f /etc/nbdtab ] || exit 0
-
-# shellcheck disable=SC2046
-set -- $(cat /proc/cmdline)
-while [ $# -ge 1 ]; do
-    case "$1" in
-    root=nbd:*)
-        arg=${1#*:}
-        host=${arg%:*}
-        ;;
-    esac
-    shift
-done
-
-[ -n "${host}" ] || exit 0
-
-serial=$(sed -nr '/Serial/s/.*([0-9a-f]{8})/\1/p' /proc/cpuinfo)
-if [ $? -ne 0 ]; then
-    serial=UNKNOWN-SERIAL
-fi
-sed \
-    -e s/@NBDHOST@/"${host}"/ \
-    -e s/@SERIAL@/"${serial}"/ \
-    /etc/nbdtab \
-    > /run/nbdtab
-
-mount -o bind /run/nbdtab /etc/nbdtab

rootfs/post-build.sh

@@ -1,6 +0,0 @@
-#!/bin/sh
-
-cp -puv "${BUILD_DIR}"/nbd-*/systemd/nbd@.service \
-    "${TARGET_DIR}"/usr/lib/systemd/system/
-
-touch "${TARGET_DIR}"/usr/lib/clock-epoch

rootfs/post-fakeroot.sh

@@ -1,3 +0,0 @@
-#!/bin/sh
-
-rm -rfv "${TARGET_DIR}"/var/log/journal

rootfs/post-image.sh

@@ -1,5 +0,0 @@
-#!/bin/sh
-
-# shellcheck disable=SC2154
-cp -v "${BR2_EXTERNAL_basementhud_PATH}"/cmdline.txt \
-	"${BINARIES_DIR}"/rpi-firmware/cmdline.txt

rootfs/users

@@ -1 +0,0 @@
-user 1000 user 1000 * /home/user /bin/sh -

squashfs-exclude.txt

@@ -0,0 +1,70 @@
+boot/*
+dev/*
+etc/dnf*
+etc/pki/CA
+etc/pki/rpm-gpg
+etc/pki/tls/certs/Makefile
+etc/yum*
+proc/*
+run/*
+sys/*
+tmp/*
+usr/bin/as
+usr/bin/c++filt
+usr/bin/dwp
+usr/bin/elfedit
+usr/bin/gmake
+usr/bin/gprof
+usr/bin/ld
+usr/bin/ld.*
+usr/bin/make
+usr/bin/makedb
+usr/bin/objcopy
+usr/bin/objdump
+usr/bin/perl*
+usr/bin/pip*
+usr/bin/ranlib
+usr/bin/rpm*
+usr/bin/size
+usr/bin/strings
+usr/games
+usr/lib/dracut
+usr/lib/games
+usr/lib/modules/*/.vmlinuz*.hmac
+usr/lib/modules/*/System.map*
+usr/lib/modules/*/config*
+usr/lib/modules/*/dtb
+usr/lib/modules/*/initramfs*
+usr/lib/modules/*/symvers*
+usr/lib/modules/*/vmlinuz*
+usr/lib/pkgconfig
+usr/lib64/games
+usr/lib64/pkgconfig
+usr/share/GeoIP
+usr/share/applications
+usr/share/bash-completions/completions/pip*
+usr/share/doc
+usr/share/games
+usr/share/info
+usr/share/locale/*/*/bfd.mo
+usr/share/locale/*/*/gas.mo
+usr/share/locale/*/*/gold.mo
+usr/share/locale/*/*/gprof.mo
+usr/share/locale/*/*/ld.mo
+usr/share/locale/*/*/make.mo
+usr/share/man
+usr/share/pkgconfig
+usr/src
+var/cache/dnf
+var/cache/yum
+var/games
+var/lib/Makefile
+var/lib/dnf
+var/lib/games
+var/lib/rpm
+var/lib/yum
+var/local
+var/log/yum.log
+var/nis
+var/opt
+var/yp