.editorconfig

@@ -1,11 +0,0 @@
-root = true
-
-[*]
-charset = utf-8
-end_of_line = lf
-insert_final_newline = true
-trim_trailing_whitespace = true
-
-[Jenkinsfile]
-indent_style = space
-indent_size = 4

.vscode/settings.json

@@ -0,0 +1,7 @@
+{
+    "files.associations": {
+        "**/configs/*_defconfig": "properties",
+        "**/etc/fstab": "text",
+        "**/etc/pam.d/*": "raw"
+    }
+}

Makefile

@@ -1,17 +1,31 @@
-SHELL ?= /bin/sh
+BUILDROOT_SRC ?= ~/src/buildroot
+
+.PHONY: all
+all: initramfs rootfs
 
 .PHONY: rootfs
-rootfs:
-	$(SHELL) mkrootfs.sh _build/rootfs
+rootfs: _build/rootfs/.config
+	$(MAKE) -C _build/rootfs -j $(shell nproc)
 
 .PHONY: initramfs
-initramfs: _build/rootfs/boot/initramfs.img
-
-_build/rootfs/boot/initramfs.img: \
-		_build/rootfs/bin/dracut \
-		mkinitramfs.sh
-	$(SHELL) mkinitramfs.sh _build/rootfs
+initramfs: _build/initramfs/.config
+	$(MAKE) -C _build/initramfs -j $(shell nproc)
 
 .PHONY: publish
 publish:
-	$(SHELL) publish.sh _build/rootfs
+	rsync -rtliO \
+		--delete \
+		_build/rootfs/images/rpi-firmware/ \
+		_build/rootfs/images/Image \
+		_build/rootfs/images/*.dtb \
+		_build/initramfs/images/rootfs.cpio.lz4 \
+		pxe0.pyrocufflink.blue:/var/lib/tftpboot/basementhud/
+	rsync -P --no-W \
+		_build/rootfs/images/rootfs.squashfs \
+		pxe0.pyrocufflink.blue:/var/lib/nbd/basementhud.squashfs
+
+_build/rootfs/.config:
+	$(MAKE) -C $(BUILDROOT_SRC) O=${PWD}/_build/rootfs BR2_EXTERNAL=${PWD} basementhud_defconfig
+
+_build/initramfs/.config:
+	$(MAKE) -C $(BUILDROOT_SRC) O=${PWD}/_build/initramfs BR2_EXTERNAL=${PWD} basementhud_initramfs_defconfig

README.md

@@ -1,32 +1,32 @@
-# Basement Hud Network-Booted OS
+# Network-Booted Heads-Up Display System
 
-Customized Fedora-based operating system distributed as an immutable
-root filesystem image.
-
-## Building
-
-Must run on a Fedora host or privileged container.
-
-Build the root filesystem image:
+## Required Build Host Configuration
 
 ```sh
-make rootfs
+sudo dnf install -y \
+	ncurses-devel \
+	perl-ExtUtils-MakeMaker \
+	perl-FindBin \
+	perl-Thread-Queue \
+	--
 ```
 
-This will create an `_build/rootfs` directory containing the root filesystem
-hierarchy.  The `_build/rootfs/boot` directory contains the necessary files to
-boot the system:
-
-* `efi`: This directory contains the Raspberry Pi firmware files
-* `initramfs.img`: Early userspace image
-* `vmlinuz`: Kernel image
-* `basementhud.squashfs`: Root filesystem image
-
-The Raspberry Pi firmware, initramfs image, and kernel image files must be
-served by a TFTP, while the rootfs image is served by NBD.
-
-Build the initramfs image:
-
 ```sh
-make initramfs
+git clone git://git.buildroot.net/buildroot ~/src/buildroot
+```
+
+## Build
+
+### Build the Initramfs
+
+```sh
+make -C ~/src/buildroot O=${PWD}/_build/initramfs BR2_EXTERNAL=${PWD} basementhud_initramfs_defconfig
+make -C _build/initramfs -j $(nproc)
+```
+
+### Build the Rootfs
+
+```sh
+make -C ~/src/buildroot O=${PWD}/_build/rootfs BR2_EXTERNAL=${PWD} basementhud_defconfig
+make -C _build/rootfs -j $(nproc)
 ```

ci/Dockerfile

@@ -1,4 +1,4 @@
-FROM registry.fedoraproject.org/fedora:35
+FROM registry.fedoraproject.org/fedora:30
 
 ARG UID
 ARG GID
@@ -7,13 +7,19 @@ RUN groupadd -g ${GID} jenkins \
     && useradd -u ${UID} -g ${GID} -m -d /var/lib/jenkins -l jenkins
 
 RUN dnf install -y \
-    findutils \
+    bc \
+    bzip2 \
+    cpio \
+    diffutils \
+    g++ \
+    gcc \
     make \
+    ncurses-devel \
     openssh-clients \
-    python3-pip \
+    patch \
+    perl-ExtUtils-MakeMaker \
+    perl-Thread-Queue \
     rsync \
-    squashfs-tools \
-    tar \
-    unzip \
-    util-linux \
+    wget \
+    which \
     && dnf clean all

ci/Jenkinsfile

@@ -1,8 +1,14 @@
 pipeline {
     agent {
-        kubernetes {
-            yamlFile 'ci/podTemplate.yaml'
-            defaultContainer 'build'
+        dockerfile {
+            dir 'ci'
+            args '''
+            -v /etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts
+            '''
+            additionalBuildArgs '''\
+            --build-arg UID=$(id -u) \
+            --build-arg GID=$(id -g) \
+            '''
         }
     }
 
@@ -11,31 +17,68 @@ pipeline {
         disableConcurrentBuilds()
     }
 
+    triggers {
+        pollSCM ''
+    }
+
+    parameters {
+        booleanParam \
+            name: 'Clean',
+            description: 'Clean the workspace and perform a full rebuild'
+    }
+
+    environment {
+        BUILDROOT_SRC = "${env.WORKSPACE}/buildroot"
+    }
+
     stages {
-        stage('Build') {
+        stage('Prepare') {
             steps {
-                copyArtifacts \
-                    filter: 'aarch64/mqttdpms',
-                    projectName: '../mqttdpms/master',
-                    selector: lastSuccessful()
-                sh 'install aarch64/mqttdpms overlay/usr/local/bin/'
-                sh 'make rootfs initramfs'
+                script {
+                    if (params.Clean) {
+                        sh 'rm -rf _build'
+                    }
+                }
+                checkout poll: false, scm: [
+                    $class: 'GitSCM',
+                    branches: [[name: '2022.02.x']],
+                    doGenerateSubmoduleConfigurations: false,
+                    userRemoteConfigs: [[url: 'git://git.buildroot.net/buildroot']],
+                    extensions: [
+                        [
+                            $class: 'RelativeTargetDirectory',
+                            relativeTargetDir: 'buildroot',
+                        ],
+                    ],
+                ]
+            }
+        }
+
+        stage('Build') {
+            parallel {
+                stage('Build Initramfs') {
+                    steps {
+                        sh 'make initramfs'
+                    }
+                }
+
+                stage('Build Rootfs') {
+                    steps {
+                        sh 'make rootfs'
+                    }
+                }
             }
         }
 
         stage('Publish') {
             when {
-                not {
-                    changeRequest()
-                }
+                branch 'master'
             }
             steps {
-                container('publish') {
                 sshagent(['jenkins-pxe']) {
                     sh 'make publish'
                 }
             }
         }
     }
-    }
 }

ci/podTemplate.yaml

@@ -1,31 +0,0 @@
-spec:
-  nodeSelector:
-    kubernetes.io/arch: arm64
-  terminationGracePeriodSeconds: 0
-  containers:
-  - name: build
-    image: git.pyrocufflink.net/containerimages/build/basementhud
-    command:
-    - sleep
-    - infinity
-    securityContext:
-      readOnlyRootFilesystem: true
-      privileged: true
-    volumeMounts:
-    - name: tmp
-      mountPath: /tmp
-  - name: publish
-    image: git.pyrocufflink.net/containerimages/build/basementhud
-    command:
-    - sleep
-    - infinity
-    securityContext:
-      readOnlyRootFilesystem: true
-      runAsUser: 1000
-    volumeMounts:
-    - name: tmp
-      mountPath: /tmp
-  volumes:
-  - name: tmp
-    emptyDir:
-      medium: Memory

cmdline.txt

@@ -1 +1 @@
-rd.retry=3 rd.timeout=5 panic=5 audit=0 root=nbd:pxe0.pyrocufflink.blue:basementhud console=ttyAMA0
+audit=0 panic=5 console=ttyAMA0 root=nbd:pxe0.pyrocufflink.blue:basementhud sshkeys.root=http://rosalina.pyrocufflink.blue/~dustin/id_ed25519.pub

config.txt

@@ -1,60 +1,23 @@
-# Raspberry Pi 4
-[pi4]
-kernel=vmlinuz
-dtoverlay=upstream-pi4
+# See http://buildroot.org/manual.html#rootfs-custom
+# and http://elinux.org/RPiconfig for a description of config.txt syntax
 
-# Default Fedora configs for all Raspberry Pi Revisions
-[all]
-# Put the RPi into 64 bit mode
-arm_64bit=1
+start_file=start4.elf
+fixup_file=fixup4.dat
+
+kernel=Image
 
 # To use an external initramfs file
-initramfs initramfs.img
-
-# Enable UART
-# Only enable UART if you're going to use it as it has speed implications
-# Serial console is ttyS0 on RPi3 and ttyAMA0 on all other variants
-# u-boot will auto detect serial and pass corrent options to kernel if enabled
-# Speed details: https://www.raspberrypi.org/forums/viewtopic.php?f=28&t=141195
-
-# Terrible hack to work around U-Boot issues on most devices
-#enable_uart=1
-
-# Early boot delay in the hope monitors are initialised enough to provide EDID
-bootcode_delay=1
-
-# We need this to be 32Mb to support VCHI services and drivers which use them
-# but this isn't used by mainline VC4 driver so reduce to lowest supported value
-# You need to set this to at least 80 for using the camera
-gpu_mem=32
-
-# Use eXtended firmware by default
-start_x=1
-
-# Stop the RPi turning on HDMI monitors on reboot
-hdmi_ignore_cec_init=1
+initramfs rootfs.cpio.lz4
 
+# Disable overscan assuming the display supports displaying the full resolution
+# If the text shown on the screen disappears off the edge, comment this out
 disable_overscan=1
 
-# New option to allow the firmware to load upstream dtb
-# Will allow things like camera, touchscreen etc to work OOTB
-upstream_kernel=1
-
-# HAT and DT overlays. Documentation at Raspberry Pi here:
-# https://www.raspberrypi.org/documentation/configuration/device-tree.md
-# Each dtoverlay line is an individual HAT/overlay, multiple lines allowed
-# dtoverlay=rpi-sense
-
-# Other options you can adjust for all Raspberry Pi Revisions
-# https://www.raspberrypi.org/documentation/configuration/config-txt/README.md
-# All options documented at http://elinux.org/RPiconfig
-# for more options see http://elinux.org/RPi_config.txt
-
-# To use this on Fedora you need to use firmware provided device tree, not kernel
-# For this functionality follow the following guide:
-# https://fedoraproject.org/w/index.php?title=Architectures/ARM/Raspberry_Pi/HATs
+dtoverlay=vc4-kms-v3d-pi4
+dtoverlay=imx219
+#dtoverlay=ov5647
 
 dtoverlay=disable-bt
 
-# Enable the i2c RTC on the CM4 I/O board
-dtoverlay=i2c-rtc,pcf85063a,i2c_csi_dsi
+# enable 64bits support
+arm_64bit=1

configs/basementhud_defconfig

@@ -0,0 +1,69 @@
+BR2_aarch64=y
+BR2_cortex_a72=y
+BR2_ARM_FPU_VFPV4=y
+BR2_TOOLCHAIN_BUILDROOT_GLIBC=y
+BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_10=y
+BR2_TOOLCHAIN_BUILDROOT_CXX=y
+BR2_TARGET_GENERIC_HOSTNAME="localhost"
+BR2_INIT_SYSTEMD=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
+BR2_ROOTFS_USERS_TABLES="$(BR2_EXTERNAL_basementhud_PATH)/rootfs/users"
+BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_basementhud_PATH)/rootfs/overlay"
+BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_basementhud_PATH)/rootfs/post-build.sh"
+BR2_ROOTFS_POST_FAKEROOT_SCRIPT="$(BR2_EXTERNAL_basementhud_PATH)/rootfs/post-fakeroot.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_basementhud_PATH)/rootfs/post-image.sh"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="$(call github,raspberrypi,linux,0b54dbda3cca2beb51e236a25738784e90853b64)/linux-0b54dbda3cca2beb51e236a25738784e90853b64.tar.gz"
+BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_basementhud_PATH)/rootfs/linux.config"
+BR2_LINUX_KERNEL_DTS_SUPPORT=y
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="broadcom/bcm2711-rpi-4-b"
+BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
+# BR2_PACKAGE_BUSYBOX is not set
+BR2_PACKAGE_SED=y
+BR2_PACKAGE_BTRFS_PROGS=y
+BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_MESA3D=y
+BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_V3D=y
+BR2_PACKAGE_MESA3D_OPENGL_GLX=y
+BR2_PACKAGE_XORG7=y
+BR2_PACKAGE_XSERVER_XORG_SERVER=y
+BR2_PACKAGE_XAPP_XINIT=y
+BR2_PACKAGE_XAPP_XSET=y
+BR2_PACKAGE_MATCHBOX=y
+BR2_PACKAGE_RPI_FIRMWARE=y
+BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4=y
+BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="$(BR2_EXTERNAL_basementhud_PATH)/config.txt"
+BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_PYTHON_PIP=y
+BR2_PACKAGE_PYTHON_PYDANTIC=y
+BR2_PACKAGE_PYTHON_PYYAML=y
+BR2_PACKAGE_CA_CERTIFICATES=y
+BR2_PACKAGE_LIBCURL=y
+BR2_PACKAGE_LIBCURL_CURL=y
+# BR2_PACKAGE_LIBCURL_EXTRA_PROTOCOLS_FEATURES is not set
+BR2_PACKAGE_CHRONY=y
+BR2_PACKAGE_DHCPCD=y
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_IPROUTE2=y
+BR2_PACKAGE_NBD=y
+BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_COREUTILS=y
+BR2_PACKAGE_COREUTILS_INDIVIDUAL_BINARIES=y
+BR2_PACKAGE_PROCPS_NG=y
+BR2_PACKAGE_PSMISC=y
+BR2_PACKAGE_RSYSLOG=y
+# BR2_PACKAGE_SYSTEMD_PSTORE is not set
+# BR2_PACKAGE_SYSTEMD_HOSTNAMED is not set
+# BR2_PACKAGE_SYSTEMD_HWDB is not set
+# BR2_PACKAGE_SYSTEMD_NETWORKD is not set
+# BR2_PACKAGE_SYSTEMD_RESOLVED is not set
+# BR2_PACKAGE_SYSTEMD_TIMEDATED is not set
+# BR2_PACKAGE_SYSTEMD_TIMESYNCD is not set
+BR2_PACKAGE_UTIL_LINUX_LOGIN=y
+BR2_PACKAGE_LESS=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
+BR2_TARGET_ROOTFS_SQUASHFS4_LZ4=y
+# BR2_TARGET_ROOTFS_TAR is not set

configs/basementhud_initramfs_defconfig

@@ -0,0 +1,18 @@
+BR2_aarch64=y
+BR2_cortex_a72=y
+BR2_ARM_FPU_VFPV4=y
+BR2_TOOLCHAIN_BUILDROOT_MUSL=y
+BR2_KERNEL_HEADERS_5_10=y
+BR2_TOOLCHAIN_BUILDROOT_CXX=y
+BR2_INIT_NONE=y
+# BR2_TARGET_GENERIC_GETTY is not set
+# BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_basementhud_PATH)/initramfs/overlay"
+BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_basementhud_PATH)/initramfs/busybox.config"
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_NBD=y
+BR2_TARGET_ROOTFS_CPIO=y
+BR2_TARGET_ROOTFS_CPIO_LZ4=y
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_PACKAGE_HOST_KMOD=y
+BR2_PACKAGE_HOST_UTIL_LINUX=y

external.desc

@@ -0,0 +1,2 @@
+name: basementhud
+desc: Basement HUD System

initramfs/overlay/sbin/init

@@ -0,0 +1,40 @@
+#!/bin/sh -e
+
+export PATH=/usr/sbin:/usr/bin:/sbin:/bin
+
+mkdir -p /proc /run /sys
+mount -t sysfs sysfs /sys
+mount -t proc proc /proc
+mount -t tmpfs tmpfs /run
+
+# shellcheck disable=SC2046
+set -- $(cat /proc/cmdline)
+while [ $# -ge 1 ]; do
+    case "$1" in
+    root=nbd:*)
+        arg=${1#*:}
+        name=${arg#*:}
+        host=${arg%:*}
+        ;;
+    esac
+    shift
+done
+
+for path in /sys/class/net/*; do
+    [ -e "${path}" ] || continue
+    ip link set "${path##*/}" up
+done
+sleep 5
+udhcpc -q
+
+@bd-client -N "${name}" -R -p "${host}" /dev/nbd0
+mkdir -p /sysroot
+mount -o ro -t squashfs /dev/nbd0 /sysroot || nbd-client -c /dev/nbd0
+
+cd /sysroot
+mount --move /proc /sysroot/proc
+mount --move /sys /sysroot/sys
+mount --move /dev /sysroot/dev
+mount --move /run /sysroot/run
+
+exec switch_root /sysroot /lib/systemd/systemd

initramfs/overlay/usr/sbin/@bd-client

@@ -0,0 +1 @@
+nbd-client

initramfs/overlay/usr/share/udhcpc/default.script

@@ -0,0 +1,39 @@
+#!/bin/sh
+
+
+case "$1" in
+deconfig|nak)
+    ;;
+renew|bound)
+    if [ -n "${ip}" ]; then
+        # shellcheck disable=SC2154  # interface is is an environment variable
+        ip addr add "${ip}"/"${mask:-32}" dev "${interface}"
+    fi
+    if [ -n "${staticroutes}" ]; then
+        # shellcheck disable=SC2086  # we WANT word splitting here!
+        set -- ${staticroutes}
+        ip route add "$1" via "$2" dev "${interface}"
+    elif [ -n "${router}" ]; then
+        for gw in ${router}; do
+            ip route add default via "${gw}" dev "${interface}"
+        done
+    fi
+    : > /etc/resolv.conf
+    if [ -n "${search}" ]; then
+        printf 'search %s\n' "${search}" >> /etc/resolv.conf
+    elif [ -n "${domain}" ]; then
+        printf 'search %s\n' "${domain}" >> /etc/resolv.conf
+    fi
+    if [ -n "${dns}" ]; then
+        for ns in ${dns}; do
+            printf 'nameserver %s\n' "${ns}" >> /etc/resolv.conf
+        done
+    fi
+    if [ -n "${ntpsrv}" ] && [ -x /usr/sbin/ntpd ]; then
+        for ts in ${ntpsrv}; do
+            /usr/sbin/ntpd -n -q -p "${ts}" || continue
+            break
+        done
+    fi
+    ;;
+esac

mkinitramfs.sh

@@ -1,35 +0,0 @@
-#!/bin/sh
-
-set -eu
-
-destdir="$(readlink -e "$1")"
-
-kver=$(rpm --root "${destdir}" -q --qf '%{VERSION}-%{RELEASE}.%{ARCH}' kernel)
-printf 'Building initramfs image for kernel %s\n' "${kver}"
-
-cd "${destdir}"
-mkdir -p boot dev proc sys tmp
-mountpoint -q dev || mount -o bind /dev dev
-mountpoint -q proc || mount -t proc proc proc
-mountpoint -q sys || mount -t sysfs sysfs sys
-mountpoint -q tmp || mount -t tmpfs tmpfs tmp
-
-echo 'Copying kernel image to /boot/ ...' >&2
-cp -a "${destdir}"/lib/modules/"${kver}"/vmlinuz \
-    "${destdir}"/boot/
-echo 'Building initramfs image ...' 2>&1
-chroot "${destdir}" dracut \
-    --no-hostonly \
-    --modules 'nbd udev-rules dracut-systemd shutdown' \
-    --drivers 'genet nbd squashfs' \
-    --force-drivers 'bcm2835_wdt i2c_bcm2835 i2c_mux_pinctrl rtc_pcf85063' \
-    --force \
-    /boot/initramfs.img \
-    "${kver}"
-echo 'Fixing boot file pemissions ...' 2>&1
-find "${destdir}"/boot \
-    -type d -exec chmod a+rx {} + \
-    -or \
-    -type f -exec chmod a+r {} +
-
-umount tmp sys proc dev

mkrootfs.sh

@@ -1,86 +0,0 @@
-#!/bin/sh
-
-set -e
-
-srcdir="$(dirname "$0")"
-destdir="$(mkdir -p "$1" && readlink -e "$1")"
-dest=basementhud.squashfs
-releasever=37
-
-mkdir -p "${destdir}"
-
-dnf --installroot "${destdir}" install -y \
-    --releasever ${releasever} \
-    fedora-release
-
-cp /etc/dnf/dnf.conf "${destdir}/etc/dnf/"
-echo install_weak_deps=False >> "${destdir}"/etc/dnf/dnf.conf
-
-dnf --installroot "${destdir}" install -y \
-    bcm2711-firmware \
-    curl \
-    dhcp-client \
-    dracut-network \
-    firefox \
-    hostname \
-    kmod \
-    mesa-dri-drivers \
-    nbd \
-    openbox \
-    openssh-server \
-    openssl1.1 \
-    rsyslog \
-    systemd \
-    xinit \
-    xorg-x11-server-Xorg \
-    xrandr \
-    xset \
-    zram-generator \
-    zram-generator-defaults \
-    --
-
-dnf --installroot "${destdir}" install -y \
-    --setopt tsflags=noscripts \
-    kernel \
-    --
-kver=$(rpm --root "${destdir}" -q --qf '%{VERSION}-%{RELEASE}.%{ARCH}' kernel)
-if [ ! -f "${destdir}"/lib/modules/"${kver}"/modules.dep ]; then
-    chroot "${destdir}" depmod -a "${kver}"
-fi
-
-cp -p \
-    "${srcdir}"/cmdline.txt \
-    "${srcdir}"/config.txt \
-    "${destdir}"/boot/efi
-
-tar --owner root:0 --group root:0 -C "${srcdir}/overlay" -c . \
-    | tar -C "${destdir}" -x
-chown -R 1000:1000 "${destdir}"/home/user
-if ! grep -q ^user: "${destdir}"/etc/group; then
-    chroot "${destdir}" groupadd -g 1000 user
-fi
-if ! grep -q ^user: "${destdir}"/etc/passwd; then
-    chroot "${destdir}" useradd -u 1000 -g 1000 user
-fi
-if ! grep -qE '^video:.*:.+:.*,?user' "${destdir}"/etc/group; then
-    chroot "${destdir}" gpasswd -a user video
-fi
-chroot "${destdir}" systemctl enable \
-    dhclient@eth0 \
-    systemd-time-wait-sync \
-    systemd-timesyncd \
-    xinit@user
-chroot "${destdir}" systemctl disable \
-    systemd-homed \
-    systemd-userdbd
-ln -sf /run/resolv.conf "${destdir}"/etc/resolv.conf
-grep -lR pam_sss "${destdir}"/etc/pam.d \
-    | xargs sed -i /pam_sss/d
-
-umask 0022
-mksquashfs "${destdir}" "${destdir}/boot/${dest}" \
-    -comp lz4 \
-    -noappend \
-    -ef "${srcdir}"/squashfs-exclude.txt \
-    -no-exports \
-    -wildcards

overlay/etc/dhcp/dhclient-enter-hooks

@@ -1,7 +0,0 @@
-# Avoid handling the EXPIRE event, which would ordinarily result in the
-# IP address being removed from the interface.  `dhclient` fires the
-# EXPIRE event every time it renews the lease, even if the lease has not
-# actually expired.
-if [ "${reason}" = EXPIRE ]; then
-    exit 0
-fi

overlay/etc/dhcp/dhclient.conf

@@ -1,10 +0,0 @@
-option classless-static-routes code 121 = array of unsigned integer 8;
-
-send dhcp-client-identifier = hardware;
-
-request subnet-mask, broadcast-address, time-offset, routers,
-        domain-name, domain-name-servers, domain-search, host-name,
-        root-path, interface-mtu, classless-static-routes,
-        netbios-name-servers, netbios-scope, ntp-servers,
-        dhcp6.domain-search, dhcp6.fqdn,
-        dhcp6.name-servers, dhcp6.sntp-servers;

overlay/etc/fstab

@@ -1,6 +0,0 @@
-tmpfs /var/lib/rsyslog tmpfs defaults 0 0
-tmpfs /var/log tmpfs defaults 0 0
-tmpfs /var/lib/systemd tmpfs defaults 0 0
-/dev/mmcblk0 /run/storage ext4 ro,noexec,nosuid,nodev,x-systemd.makefs 0 2
-overlay /etc/ssh overlay ro,lowerdir=/etc/ssh:/run/storage/ssh,noexec,nodev,nosuid,x-systemd.requires-mounts-for=/run/storage 0 0
-/dev/nbd1 swap swap noauto,x-systemd.makefs 0 0

overlay/etc/nbdtab

@@ -1 +0,0 @@
-nbd1 pxe0.pyrocufflink.blue basementhud-swap

overlay/etc/rsyslog.conf

@@ -1,9 +0,0 @@
-global(workDirectory="/var/lib/rsyslog")
-module(load="imjournal"
-       StateFile="imjournal.state")
-action(
-    type="omfwd"
-    Target="172.30.0.17"
-    Port="514"
-    template="RSYSLOG_SyslogProtocol23Format"
-)

overlay/etc/systemd/system/dev-nbd1.device.wants/nbd@nbd1.service

@@ -1 +0,0 @@
-/usr/lib/systemd/system/nbd@.service

overlay/etc/systemd/system/dev-nbd1.swap.d/no-default-dependencies.conf

@@ -1,5 +0,0 @@
-[Unit]
-# All swap units have a default `Before=swap.target` dependency.  This
-# does not work for swap devices using NBD, because `swap.target` is
-# reached before the network is up.
-DefaultDependencies=no

overlay/etc/systemd/system/dhclient@.service

@@ -1,13 +0,0 @@
-[Unit]
-Description=DHCPv4 client for %I
-Before=network-online.target
-Before=network.target
-
-[Service]
-Type=forking
-RuntimeDirectory=dhclient
-ExecStart=/usr/sbin/dhclient -4 -1 -lf /run/dhclient/%I.lease -pf /run/dhclient/%I.pid
-PIDFile=/run/dhclient/%I.pid
-
-[Install]
-WantedBy=multi-user.target

overlay/etc/systemd/system/emergency.service.d/sulogin-force.conf

@@ -1,2 +0,0 @@
-[Service]
-Environment=SYSTEMD_SULOGIN_FORCE=1

overlay/etc/systemd/system/init-localstorage.service

@@ -1,16 +0,0 @@
-[Unit]
-Description=Initialize Local Storage
-DefaultDependencies=no
-After=local-fs-pre.target
-After=run-storage.mount
-Before=etc-ssh.mount
-Before=local-fs.target
-Conflicts=shutdown.target
-ConditionPathExists=!/run/storage/ssh
-
-[Service]
-Type=oneshot
-ExecStart=/usr/local/libexec/init-localstorage.sh
-
-[Install]
-WantedBy=run-storage.mount

overlay/etc/systemd/system/multi-user.target.wants/dev-nbd1.swap

@@ -1 +0,0 @@
-../dev-nbd1.swap

overlay/etc/systemd/system/run-storage.mount.wants/init-localstorage.service

@@ -1 +0,0 @@
-../init-localstorage.service

overlay/etc/systemd/user/firefox-marionette.service

@@ -1,10 +0,0 @@
-[Unit]
-Description=Firefox marionette reverse proxy
-Requires=firefox-marionette.socket
-Requires=firefox.service
-
-[Service]
-ExecStart=/usr/lib/systemd/systemd-socket-proxyd \
-    --connections-max=1 \
-    --exit-idle-time=10s \
-    127.0.0.1:2828

overlay/etc/systemd/user/firefox-marionette.socket

@@ -1,5 +0,0 @@
-[Unit]
-Description=Firefox Marionette socket
-
-[Socket]
-ListenStream=[::]:2829

overlay/etc/systemd/user/firefox.service

@@ -1,10 +0,0 @@
-[Unit]
-Description=Firefox web browser
-Wants=firefox-marionette.socket
-
-[Service]
-Type=simple
-ExecStart=/usr/bin/firefox -marionette
-Restart=always
-StandardInput=null
-StandardOutput=journal

overlay/etc/systemd/user/mqttdpms.service

@@ -1,9 +0,0 @@
-[Unit]
-Description=MQTT DPMS Control
-
-[Service]
-ExecStart=/usr/local/bin/mqttdpms
-Environment=RUST_LOG=info
-Restart=always
-StandardInput=null
-StandardOutput=journal

overlay/etc/tmpfiles.d/resolvconf.conf

@@ -1 +0,0 @@
-f /run/resolv.conf 0644 root root - -

overlay/home/user/.config/mqttdpms/config.toml

@@ -1 +0,0 @@
-/run/storage/mqttdpms.toml

overlay/home/user/.config/openbox/autostart

@@ -1,10 +0,0 @@
-#!/bin/sh
-
-BASE_URL=https://hudctrl.pyrocufflink.blue/api
-xrandr --listactivemonitors \
-    | curl "${BASE_URL}"/display/monitors \
-        -H 'Content-Type: text/plain' \
-        --upload-file -
-
-curl "${BASE_URL}"/display/up \
-    -d port=2829

overlay/home/user/.xinitrc

@@ -1,12 +0,0 @@
-#!/bin/sh
-
-xset s off
-xset -dpms
-
-TZ="$(curl https://ipapi.co/timezone)"
-export TZ
-
-systemctl --user import-environment DISPLAY TZ
-systemctl --user start firefox-marionette.socket firefox mqttdpms
-
-exec openbox-session

overlay/root/.ssh/authorized_keys

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJsL5fSylmiJmBtW0DH/viAAmtU2E/2M17GPvysiyRs+ dustin@rosalina

overlay/usr/lib/dracut/modules.d/90kernel-network-modules/module-setup.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/bash
-
-check() {
-    return 255
-}
-
-depends() {
-    return 0
-}
-
-installkernel() {
-    return 0
-}
-
-install() {
-    return 0
-}

overlay/usr/local/bin/basementhud

@@ -1,10 +0,0 @@
-#!/bin/sh
-
-python3 -m ensurepip
-python3 -m pip install -U pip
-python3 -m pip install \
-    --user \
-    --find-links https://files.pyrocufflink.blue/wheels/voonex \
-    --upgrade \
-    voonex
-exec python3 -m voonex

overlay/usr/local/libexec/home-overlay.sh

@@ -1,17 +0,0 @@
-#!/bin/sh
-
-if mountpoint -q "${HOME}"; then
-    exit 0
-fi
-
-upperdir="${XDG_RUNTIME_DIR}"/home/rw
-workdir="${XDG_RUNTIME_DIR}"/home/.work
-
-mkdir -p "${upperdir}"
-mkdir -p "${workdir}"
-
-mount overlay \
-    -t overlay \
-    -o lowerdir="${HOME}",upperdir="${upperdir}",workdir="${workdir}" \
-    "${HOME}"
-chown "${PAM_USER}": "${HOME}"

overlay/usr/local/libexec/init-localstorage.sh

@@ -1,41 +0,0 @@
-#!/bin/sh
-
-die() {
-    remount_ro
-    echo "ERROR: $1" >&2
-    exit 1
-}
-
-gen_ssh_keys() {
-    unset kf x
-    mkdir -p /run/storage/ssh || die 'Could not create /run/storage/ssh'
-    for x in rsa ecdsa ed25519; do
-        kf=/run/storage/ssh/ssh_host_${x}_key
-        if [ ! -f ${kf} ]; then
-            ssh-keygen -t ${x} -f ${kf} -N '' -C '' \
-                || die "Failed to generate ${x} SSH host key"
-        fi
-    done
-}
-
-remount_ro() {
-    if [ -w /run/storage ]; then
-        mount -oremount,ro /run/storage
-    fi
-}
-
-remount_rw() {
-    if [ ! -w /run/storage ]; then
-        mount -o remount,rw /run/storage \
-            || die 'Could not remount /run/storage read-write'
-    fi
-}
-
-mountpoint -q /run/storage || die '/run/storage is not mounted'
-
-if [ ! -d /run/storage/ssh ]; then
-    remount_rw
-    gen_ssh_keys
-fi
-
-remount_ro

prepare.sh

@@ -1,13 +0,0 @@
-#!/bin/bash
-
-set -e
-shopt -s nullglob
-
-dnf install -y \
-    make \
-    rsync \
-    squashfs-tools \
-    tar \
-    unzip \
-    util-linux \
-    --

publish.sh

@@ -1,15 +0,0 @@
-#!/bin/sh
-
-set -eu
-
-destdir="$(readlink -e "$1")"
-bootdir="${destdir}/boot"
-
-rsync -rtliO --chmod=a=rwX \
-    "${bootdir}"/efi/ \
-    "${bootdir}"/initramfs.img \
-    "${bootdir}"/vmlinuz \
-    pxe0.pyrocufflink.blue:/var/lib/tftpboot/basementhud/
-rsync -ti --chmod=a=rwX \
-    "${bootdir}"/basementhud.squashfs \
-    pxe0.pyrocufflink.blue:/var/lib/nbd/basementhud.squashfs

rootfs/overlay/etc/chrony.conf

@@ -0,0 +1,2 @@
+sourcedir /run/chrony-dhcp
+makestep 0.1 10

rootfs/overlay/etc/dhcpcd.conf

@@ -0,0 +1,55 @@
+# A sample configuration for dhcpcd.
+# See dhcpcd.conf(5) for details.
+
+# Allow users of this group to interact with dhcpcd via the control socket.
+#controlgroup wheel
+
+# Inform the DHCP server of our hostname for DDNS.
+#hostname
+
+# Use the hardware address of the interface for the Client ID.
+clientid
+# or
+# Use the same DUID + IAID as set in DHCPv6 for DHCPv4 ClientID as per RFC4361.
+# Some non-RFC compliant DHCP servers do not reply with this set.
+# In this case, comment out duid and enable clientid above.
+#duid
+
+# Persist interface configuration when dhcpcd exits.
+persistent
+
+# vendorclassid is set to blank to avoid sending the default of
+# dhcpcd-<version>:<os>:<machine>:<platform>
+vendorclassid
+
+# A list of options to request from the DHCP server.
+option domain_name_servers, domain_name, domain_search
+option classless_static_routes
+# Respect the network MTU. This is applied to DHCP routes.
+option interface_mtu
+
+# Request a hostname from the network
+option host_name
+
+# Most distributions have NTP support.
+option ntp_servers
+
+# Rapid commit support.
+# Safe to enable by default because it requires the equivalent option set
+# on the server to actually work.
+option rapid_commit
+
+option log_servers
+
+# A ServerID is required by RFC2131.
+require dhcp_server_identifier
+
+# Generate SLAAC address using the Hardware Address of the interface
+#slaac hwaddr
+# OR generate Stable Private IPv6 Addresses based from the DUID
+slaac private
+
+denyinterfaces dummy* veth* docker*
+
+env NTP_CONF=/run/chrony-dhcp/dhcpcd.sources
+env ntp_restart_cmd=/usr/bin/chronyc reload sources

rootfs/overlay/etc/fstab

@@ -0,0 +1,4 @@
+tmpfs /var tmpfs mode=0755,noexec,nosuid,nodev 0 0
+tmpfs /root tmpfs size=1M,mode=550 0 0
+/dev/mmcblk0 /run/storage ext4 ro,noexec,nosuid,nodev 0 2
+overlay /etc/ssh overlay ro,lowerdir=/etc/ssh:/run/storage/ssh,noexec,nodev,nosuid,x-systemd.requires-mounts-for=/run/storage 0 0

rootfs/overlay/etc/rsyslog.conf

@@ -0,0 +1,6 @@
+global(workDirectory="/var/lib/rsyslog")
+module(load="imjournal"
+       StateFile="imjournal.state")
+
+include(file="/etc/rsyslog.d/*.conf" mode="optional")
+include(file="/run/rsyslog.d/*.conf" mode="optional")

rootfs/overlay/home/user/.xinitrc

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+xset s off
+xset -dpms
+systemctl --user import-environment DISPLAY
+systemctl --user start gui.target
+exec matchbox-window-manager -use_titlebar no

rootfs/overlay/usr/lib/dhcpcd/dhcpcd-hooks/60-syslog

@@ -0,0 +1,31 @@
+#!/bin/sh
+
+gen_action() {
+    echo   'action('
+    echo   '    type="omfwd"'
+    printf '    Target="%s"\n' "${1}"
+    echo   '    Port="514"'
+    echo   '    template="RSYSLOG_SyslogProtocol23Format"'
+    echo   ')'
+}
+
+changed=false
+if [ -n "${interface}" ] && [ -d /run/rsyslog.d ]; then
+    if [ -n "${new_log_servers}" ]; then
+        if [ "${new_log_servers}" != "${old_log_servers}" ]; then
+            echo '# Generated by dhcpcd' \
+                > /run/rsyslog.d/dhcpcd."${interface}".conf
+            for s in ${new_log_servers}; do
+                gen_action "${s}" >> /run/rsyslog.d/dhcpcd."${interface}".conf
+            done
+        fi
+        changed=true
+    elif [ -n "${old_log_servers}" ]; then
+        rm -f /run/rsyslog.d/dhcpcd."${interface}".conf
+        changed=true
+    fi
+fi
+
+if ${changed}; then
+    systemctl try-restart rsyslog
+fi

rootfs/overlay/usr/lib/systemd/system-generators/fetch-sshkeys-generator

@@ -0,0 +1,25 @@
+#!/bin/sh
+
+enable_unit() {
+    mkdir -p "${normaldir}"/multi-user.target.wants
+    ln -s /lib/systemd/system/"$1" "${normaldir}"/multi-user.target.wants/
+}
+
+normaldir="$1"
+# shellcheck disable=SC2034
+earlydir="$2"
+# shellcheck disable=SC2034
+latedir="$3"
+
+# shellcheck disable=SC2046
+set -- $(cat /proc/cmdline)
+while [ $# -ge 1 ]; do
+    case "$1" in
+    sshkeys.*=*)
+        arg=${1#*.}
+        user=${arg%=*}
+        enable_unit fetch-sshkeys@"${user}".service
+        ;;
+    esac
+    shift
+done

rootfs/overlay/usr/lib/systemd/system-preset/70-basementhud.preset

@@ -0,0 +1,10 @@
+disable cups-lpd.socket
+disable cups.service
+disable cups.socket
+disable cups.path
+
+disable systemd-networkd.service
+disable systemd-resolved.service
+disable systemd-timesyncd.service
+
+xinit@user.service

rootfs/overlay/usr/lib/systemd/system/chrony-wait.service

@@ -0,0 +1,47 @@
+[Unit]
+Description=Wait for chrony to synchronize system clock
+Documentation=man:chronyc(1)
+After=chrony.service
+Requires=chrony.service
+Before=time-sync.target
+Wants=time-sync.target
+
+[Service]
+Type=oneshot
+# Wait for chronyd to update the clock and the remaining
+# correction to be less than 0.1 seconds
+ExecStart=/usr/bin/chronyc -h 127.0.0.1,::1 waitsync 0 0.1 0.0 1
+# Wait for at most 3 minutes
+TimeoutStartSec=180
+RemainAfterExit=yes
+StandardOutput=null
+
+CapabilityBoundingSet=
+DevicePolicy=closed
+DynamicUser=yes
+IPAddressAllow=localhost
+IPAddressDeny=any
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+PrivateDevices=yes
+PrivateUsers=yes
+ProcSubset=pid
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProtectSystem=strict
+RestrictAddressFamilies=AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources
+UMask=0777
+
+[Install]
+WantedBy=multi-user.target

rootfs/overlay/usr/lib/systemd/system/copy-var.service

@@ -0,0 +1,9 @@
+[Unit]
+Description=Copy /var contents to writable storage
+DefaultDependencies=no
+After=var.mount
+Before=local-fs.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/copy-var.sh

rootfs/overlay/usr/lib/systemd/system/dhcpcd.service.d/before-network-online.conf

@@ -0,0 +1,2 @@
+[Unit]
+Before=network-online.target

rootfs/overlay/usr/lib/systemd/system/dhcpcd.service.d/pidfile.conf

@@ -0,0 +1,2 @@
+[Service]
+PIDFile=/run/dhcpcd/pid

rootfs/overlay/usr/lib/systemd/system/fetch-sshkeys@.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Fetch SSH authorized_keys for %I
+Wants=network-online.target
+After=network-online.target
+After=remote-fs.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/fetch-sshkeys.sh
+User=%I

rootfs/overlay/usr/lib/systemd/system/local-fs.target.requires/copy-var.service

@@ -0,0 +1 @@
+../copy-var.service

rootfs/overlay/usr/lib/systemd/system/nbdtab-generator.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Generate nbdtab
+DefaultDependencies=no
+Before=sysinit.target
+After=local-fs.target
+ConditionPathExists=/etc/nbdtab
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/nbdtab-generator.sh
+
+[Install]
+WantedBy=sysinit.target

rootfs/overlay/usr/lib/systemd/system/rsyslog.service.d/after-network-online.conf

@@ -0,0 +1,2 @@
+[Unit]
+After=network-online.target

rootfs/overlay/usr/lib/systemd/system/xinit@.service

@@ -2,21 +2,19 @@
 Description=Start X.org for user %I
 Wants=network-online.target
 After=network-online.target
-Wants=time-set.target
-After=time-set.target
-After=getty@tty1.service
-Conflicts=getty@tty1.service
+Wants=time-sync.target
+After=time-sync.target
 
 [Service]
 Type=simple
 User=%I
 WorkingDirectory=~
 PAMName=xinit
-TTYPath=/dev/tty1
+TTYPath=/dev/tty7
 StandardInput=tty
 StandardOutput=journal
 StandardError=journal
-ExecStart=/usr/bin/startx -- -nocursor
+ExecStart=/usr/bin/startx
 Restart=always
 
 [Install]

rootfs/overlay/usr/lib/systemd/user/gui.target

@@ -0,0 +1,5 @@
+[Unit]
+Description=Graphical User Interface
+After=default.target
+Wants=default.target
+AllowIsolate=yes

rootfs/overlay/usr/lib/tmpfiles.d/chrony.conf

@@ -0,0 +1 @@
+d /run/chrony-dhcp 0755 root root

rootfs/overlay/usr/lib/tmpfiles.d/rsyslog.conf

@@ -0,0 +1 @@
+d /run/rsyslog.d 0755 root root -

rootfs/overlay/usr/libexec/copy-var.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+set -e
+
+cleanup() {
+    if [ -n "${tmpdir}" ] && [ -d "${tmpdir}" ] && [ / != "${tmpdir}" ]; then
+        if mountpoint -q "${tmpdir}"; then
+            umount "${tmpdir}"
+        fi
+        rm -rf "${tmpdir}"
+    fi
+    unset tmpdir
+}
+
+tmpdir=$(TMPDIR=/run mktemp -d)
+trap cleanup INT QUIT TERM EXIT
+
+mount -o bind / "${tmpdir}"
+cp -a "${tmpdir}"/var/. /var/
+
+if [ -x "$(command -v selinuxenabled)" ] && selinuxenabled; then
+    restorecon -RF /var
+fi

rootfs/overlay/usr/libexec/fetch-sshkeys.sh

@@ -0,0 +1,29 @@
+#!/bin/sh -e
+
+umask 0077
+mkdir -p ~/.ssh
+: > ~/.ssh/authorized_keys
+
+fetch_keys() {
+    curl -fsSL "${1}" >> ~/.ssh/authorized_keys
+}
+
+# shellcheck disable=SC2046
+set -- $(cat /proc/cmdline)
+while [ $# -ge 1 ]; do
+    case "$1" in
+    sshkeys.*=*)
+        arg=${1#*.}
+        user=${arg%=*}
+        url=${arg#*=}
+        if [ "${user}" = "${USER}" ]; then
+            fetch_keys "${url}"
+        fi
+        ;;
+    esac
+    shift
+done
+
+if [ -x "$(command -v selinuxenabled)" ] && selinuxenabled; then
+    restorecon -RF ~/.ssh
+fi

rootfs/overlay/usr/libexec/nbdtab-generator.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+
+[ -f /etc/nbdtab ] || exit 0
+
+# shellcheck disable=SC2046
+set -- $(cat /proc/cmdline)
+while [ $# -ge 1 ]; do
+    case "$1" in
+    root=nbd:*)
+        arg=${1#*:}
+        host=${arg%:*}
+        ;;
+    esac
+    shift
+done
+
+[ -n "${host}" ] || exit 0
+
+serial=$(sed -nr '/Serial/s/.*([0-9a-f]{8})/\1/p' /proc/cpuinfo)
+if [ $? -ne 0 ]; then
+    serial=UNKNOWN-SERIAL
+fi
+sed \
+    -e s/@NBDHOST@/"${host}"/ \
+    -e s/@SERIAL@/"${serial}"/ \
+    /etc/nbdtab \
+    > /run/nbdtab
+
+mount -o bind /run/nbdtab /etc/nbdtab

rootfs/post-build.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+cp -puv "${BUILD_DIR}"/nbd-*/systemd/nbd@.service \
+    "${TARGET_DIR}"/usr/lib/systemd/system/
+
+touch "${TARGET_DIR}"/usr/lib/clock-epoch

rootfs/post-fakeroot.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+rm -rfv "${TARGET_DIR}"/var/log/journal

rootfs/post-image.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+# shellcheck disable=SC2154
+cp -v "${BR2_EXTERNAL_basementhud_PATH}"/cmdline.txt \
+	"${BINARIES_DIR}"/rpi-firmware/cmdline.txt

rootfs/users

@@ -0,0 +1 @@
+user 1000 user 1000 * /home/user /bin/sh -

squashfs-exclude.txt

@@ -1,70 +0,0 @@
-boot/*
-dev/*
-etc/dnf*
-etc/pki/CA
-etc/pki/rpm-gpg
-etc/pki/tls/certs/Makefile
-etc/yum*
-proc/*
-run/*
-sys/*
-tmp/*
-usr/bin/as
-usr/bin/c++filt
-usr/bin/dwp
-usr/bin/elfedit
-usr/bin/gmake
-usr/bin/gprof
-usr/bin/ld
-usr/bin/ld.*
-usr/bin/make
-usr/bin/makedb
-usr/bin/objcopy
-usr/bin/objdump
-usr/bin/perl*
-usr/bin/pip*
-usr/bin/ranlib
-usr/bin/rpm*
-usr/bin/size
-usr/bin/strings
-usr/games
-usr/lib/dracut
-usr/lib/games
-usr/lib/modules/*/.vmlinuz*.hmac
-usr/lib/modules/*/System.map*
-usr/lib/modules/*/config*
-usr/lib/modules/*/dtb
-usr/lib/modules/*/initramfs*
-usr/lib/modules/*/symvers*
-usr/lib/modules/*/vmlinuz*
-usr/lib/pkgconfig
-usr/lib64/games
-usr/lib64/pkgconfig
-usr/share/GeoIP
-usr/share/applications
-usr/share/bash-completions/completions/pip*
-usr/share/doc
-usr/share/games
-usr/share/info
-usr/share/locale/*/*/bfd.mo
-usr/share/locale/*/*/gas.mo
-usr/share/locale/*/*/gold.mo
-usr/share/locale/*/*/gprof.mo
-usr/share/locale/*/*/ld.mo
-usr/share/locale/*/*/make.mo
-usr/share/man
-usr/share/pkgconfig
-usr/src
-var/cache/dnf
-var/cache/yum
-var/games
-var/lib/Makefile
-var/lib/dnf
-var/lib/games
-var/lib/rpm
-var/lib/yum
-var/local
-var/log/yum.log
-var/nis
-var/opt
-var/yp