fixing package list

.gitignore

@@ -1,6 +1,7 @@
 # We don't want local build settings in case someone's using
 # the git dir as a place to store their build.ini
 /build.ini
+/build.ini.*
 /dist.build.ini
 *.bak
 
@@ -8,7 +9,11 @@
 /overlay
 !/overlay/x86_64
 !/overlay/i686
-!/overlay/etc/
+!/overlay/etc
+extra/templates/overlay
+!extra/templates/overlay/x86_64
+!extra/templates/overlay/i686
+!extra/templates/overlay/etc
 # The default doesn't store these in the git working dir,
 # but better safe than sorry.
 /root.x86_64

bdisk/bGPG.py

@@ -12,8 +12,15 @@ def genGPG(conf):
     dlpath = build['dlpath']
     bdisk = conf['bdisk']
     gpghome = conf['gpg']['mygpghome']
-    distkey = build['gpgkey']
+    distkeys = []
-    gpgkeyserver = build['gpgkeyserver']
+    gpgkeyserver = []
+    for a in conf['build']['arch']:
+        keysrv = conf['src'][a]['gpgkeyserver']
+        distkey = conf['src'][a]['gpgkey']
+        if keysrv and (keysrv not in gpgkeyserver):
+            gpgkeyserver.append(keysrv)
+        if distkey and(distkey not in distkeys):
+            distkeys.append(distkey)
     templates_dir = '{0}/extra/templates'.format(build['basedir'])
     mykey = False
     pkeys = []
@@ -28,28 +35,30 @@ def genGPG(conf):
         if gpghome == '':
             # We'll generate a key if we can't find one here.
             gpghome = build['dlpath'] + '/.gnupg'
+    killStaleAgent(conf)
     os.environ['GNUPGHOME'] = gpghome
     gpg = gpgme.Context()
     # do we need to add a keyserver?
-    if gpgkeyserver != '':
+    if len(gpgkeyserver) != 0:
         dirmgr = '{0}/dirmngr.conf'.format(gpghome)
-        if os.path.isfile(dirmgr):
+        for s in gpgkeyserver:
-            with open(dirmgr, 'r+') as f:
+            if os.path.isfile(dirmgr):
-                findme = any(gpgkeyserver in line for line in f)
+                with open(dirmgr, 'r+') as f:
-                if not findme:
+                    findme = any(s in line for line in f)
-                    f.seek(0, os.SEEK_END)
+                    if not findme:
-                    f.write("\n# Added by {0}.\nkeyserver {1}\n".format(
+                        f.seek(0, os.SEEK_END)
-                                                        bdisk['pname'],
+                        f.write("\n# Added by {0}.\nkeyserver {1}\n".format(
-                                                        gpgkeyserver))
+                                                            bdisk['pname'],
+                                                            s))
     if mykey:
         try:
-            privkey = gpg.get_key(mykey, True)
+            pkeys.append(gpg.get_key(mykey, True))
         except:
             exit('{0}: ERROR: You specified using {1} but we have no secret key for that ID!'.format(
                                                         datetime.datetime.now(),
                                                         mykey))
     else:
-        for key in gpg.keylist(None,True):
+        for key in gpg.keylist(None, True):
             if key.can_sign:
                 pkeys.append(key)
                 break
@@ -62,46 +71,43 @@ def genGPG(conf):
             privkey = gpg.get_key(gpg.genkey(tpl_out).fpr, True)
             pkeys.append(privkey)
             # do we need to add a keyserver? this is for the freshly-generated GNUPGHOME
-            if build['gpgkeyserver'] != '':
+            if len(gpgkeyserver) != 0:
                 dirmgr = '{0}/dirmngr.conf'.format(gpghome)
-                with open(dirmgr, 'r+') as f:
+                for s in gpgkeyserver:
-                    findme = any(gpgkeyserver in line for line in f)
+                    with open(dirmgr, 'r+') as f:
-                    if not findme:
+                        findme = any(s in line for line in f)
-                        f.seek(0, os.SEEK_END)
+                        if not findme:
-                        f.write("\n# Added by {0}.\nkeyserver {1}\n".format(
+                            f.seek(0, os.SEEK_END)
-                                                            bdisk['pname'],
+                            f.write("\n# Added by {0}.\nkeyserver {1}\n".format(
-                                                            build['gpgkeyserver']))
+                                                                bdisk['pname'],
+                                                                s))
     gpg.signers = pkeys
     # Now we try to find and add the key for the base image.
     gpg.keylist_mode = gpgme.KEYLIST_MODE_EXTERN  # remote (keyserver)
-    if distkey: # testing
+    if len(distkeys) > 0: # testing
-    #try:
+        for k in distkeys:
-        key = gpg.get_key(distkey)
+            key = gpg.get_key(k)
-    #except:
+            importkey = key.subkeys[0].fpr
-    #    exit('{0}: ERROR: We cannot find key ID {1}!'.format(
+            gpg.keylist_mode = gpgme.KEYLIST_MODE_LOCAL # local keyring (default)
-    #                                datetime.datetime.now(),
+            DEVNULL = open(os.devnull, 'w')
-    #                                distkey))
+            print('{0}: [GPG] Importing {1} and signing it for verification purposes...'.format(
-    importkey = key.subkeys[0].fpr
+                                            datetime.datetime.now(),
-    gpg.keylist_mode = gpgme.KEYLIST_MODE_LOCAL # local keyring (default)
+                                            distkey))
-    DEVNULL = open(os.devnull, 'w')
+            cmd = ['/usr/bin/gpg',
-    print('{0}: [GPG] Importing {1} and signing it for verification purposes...'.format(
+                    '--recv-keys',
-                                    datetime.datetime.now(),
+                    '--batch',
-                                    distkey))
+                    '--yes',
-    cmd = ['/usr/bin/gpg',
+                    '0x{0}'.format(importkey)]
-            '--recv-keys',
+            subprocess.call(cmd, stdout = DEVNULL, stderr = subprocess.STDOUT)
-            '--batch',
+            sigkeys = []
-            '--yes',
+            for i in gpg.get_key(importkey).subkeys:
-            '0x{0}'.format(importkey)]
+                sigkeys.append(i.fpr)
-    subprocess.call(cmd, stdout = DEVNULL, stderr = subprocess.STDOUT)
+            cmd = ['/usr/bin/gpg',
-    sigkeys = []
+                    '--batch',
-    for k in gpg.get_key(importkey).subkeys:
+                    '--yes',
-        sigkeys.append(k.fpr)
+                    '--lsign-key',
-    cmd = ['/usr/bin/gpg',
+                    '0x{0}'.format(importkey)]
-            '--batch',
+            subprocess.call(cmd, stdout = DEVNULL, stderr = subprocess.STDOUT)
-            '--yes',
-            '--lsign-key',
-            '0x{0}'.format(importkey)]
-    subprocess.call(cmd, stdout = DEVNULL, stderr = subprocess.STDOUT)
     # We need to expose this key to the chroots, too, so we need to export it.
     with open('{0}/gpgkey.pub'.format(dlpath), 'wb') as f:
         gpg.export(pkeys[0].subkeys[0].keyid, f)
@@ -111,13 +117,13 @@ def killStaleAgent(conf):
     # Kill off any stale GPG agents running.
     # Probably not even needed, but good to have.
     chrootdir = conf['build']['chrootdir']
-    dlpath = conf['build']['dlpath']
+    gpgpath = conf['gpg']['mygpghome']
     procs = psutil.process_iter()
     plst = []
     for p in procs:
         if (p.name() in ('gpg-agent', 'dirmngr') and p.uids()[0] == os.getuid()):
             pd = psutil.Process(p.pid).as_dict()
-            for d in (chrootdir, dlpath):
+            for d in (chrootdir, gpgpath):
                 if pd['cwd'].startswith('{0}'.format(d)):
                     plst.append(p.pid)
     if len(plst) >= 1:
@@ -125,7 +131,7 @@ def killStaleAgent(conf):
             psutil.Process(p).terminate()
 
 def signIMG(path, conf):
-    if conf['build']['gpg']:
+    if conf['build']['sign']:
         # Do we want to kill off any stale gpg-agents? (So we spawn a new one)
         # Requires further testing.
         #killStaleAgent()

bdisk/bchroot.py

@@ -138,11 +138,12 @@ def chrootTrim(build):
                                                         humanize.naturalsize(
                                                             os.path.getsize(tarball)),
                                                         dbdir))
-        for d in ('etc/pacman.d/gnupg', 'var/empty/.gnupg'):
+        #for d in ('etc/pacman.d/gnupg', 'var/empty/.gnupg'):  # actually, we should probably keep these.
-            if os.path.isdir('{0}/root.{1}/{2}'.format(chrootdir, a, d)):
+        # they don't take much space, and it's a PITA to pacman-key --init && pacman-key --populate again on boot.
-                shutil.rmtree('{0}/root.{1}/{2}'.format(chrootdir, a, d))
+        #    if os.path.isdir('{0}/root.{1}/{2}'.format(chrootdir, a, d)):
+        #        shutil.rmtree('{0}/root.{1}/{2}'.format(chrootdir, a, d))
         # TODO: move the self-cleanup in pre-build.sh to here.
-        delme = ['/root/.gnupg',
+        delme = [#'/root/.gnupg',  # see above
                 '/root/.bash_history',
                 #'/var/log/chroot_install.log',  # disable for now. maybe always disable if debug is enabled? TODO.
                 '/.git',

bdisk/bdisk.py

@@ -1,4 +1,6 @@
 #!/bin/env python3
+
+import argparse
 import host
 import prep
 import bchroot
@@ -8,14 +10,17 @@ import bSSL
 import ipxe
 import bsync
 import bGPG
+import os
 
-# we need to:
+
-# we also need to figure out how to implement "mentos" (old bdisk) like functionality, letting us reuse an existing chroot install if possible to save time for future builds.
+def bdisk(args):
-#   if not, though, it's no big deal.
+    # we also need to figure out how to implement "mentos" (old bdisk) like functionality, letting us reuse an
-# still on the todo: iPXE
+    # existing chroot install if possible to save time for future builds.
-if __name__ == '__main__':
+    # if not, though, it's no big deal.
+    if os.getuid() != 0:
+        exit('{0}: ERROR: BDisk *must* be run as the root user or with sudo!'.format(datetime.datetime.now()))
     print('{0}: Starting.'.format(datetime.datetime.now()))
-    conf = host.parseConfig(host.getConfig())[1]
+    conf = host.parseConfig(host.getConfig(conf_file = args['buildini']))[1]
     prep.dirChk(conf)
     conf['gpgobj'] = bGPG.genGPG(conf)
     prep.buildChroot(conf, keep = False)
@@ -47,3 +52,20 @@ if __name__ == '__main__':
     bsync.git(conf)
     bsync.rsync(conf)
     print('{0}: Finish.'.format(datetime.datetime.now()))
+
+def parseArgs():
+    args = argparse.ArgumentParser(description = 'BDisk - a tool for building live/rescue media.',
+                                   epilog = 'brent s. || 2017 || https://bdisk.square-r00t.net')
+    args.add_argument('buildini',
+                      metavar = '/path/to/build.ini',
+                      default = '/etc/bdisk/build.ini',
+                      nargs = '?',
+                      help = 'The full/absolute path to the build.ini to use for this run. The default is /etc/bdisk/build.ini, but see https://bdisk.square-r00t.net/#the_code_build_ini_code_file.')
+    return(args)
+
+def main():
+    args = vars(parseArgs().parse_args())
+    bdisk(args)
+
+if __name__ == '__main__':
+    main()

bdisk/bsync.py

@@ -32,12 +32,12 @@ def http(conf):
                                                     datetime.datetime.now(),
                                                     httpdir))
         for a in arch:
-            for i in ('md5', 'sfs', 'sha256'):
+            for i in ('md5', 'sfs', 'sha256', 'sha512'):
                 httpfiles['{0}/{1}/airootfs.{2}'.format(bdisk['name'], a, i)] = '{0}/{1}/airootfs.{2}'.format(bdisk['name'], a, i)
         httpfiles['VERSION_INFO.txt'] = 'VERSION_INFO.txt'
         if 'x86_64' in arch:
             httpfiles['boot/{0}.64.kern'.format(bdisk['uxname'])] = '{0}.64.kern'.format(bdisk['uxname'])
-            httpfiles['boot/{0}.64.img'.format(bdisk['uxname'])] = '{0}.32.img'.format(bdisk['uxname'])
+            httpfiles['boot/{0}.64.img'.format(bdisk['uxname'])] = '{0}.64.img'.format(bdisk['uxname'])
         if 'i686' in arch:
             httpfiles['boot/{0}.32.kern'.format(bdisk['uxname'])] = '{0}.32.kern'.format(bdisk['uxname'])
             httpfiles['boot/{0}.32.img'.format(bdisk['uxname'])] = '{0}.32.img'.format(bdisk['uxname'])
@@ -48,7 +48,8 @@ def http(conf):
             fulldest = '{0}/{1}'.format(httpdir, destpath)
             parentdir = os.path.split(fulldest)[0]
             os.makedirs(parentdir, exist_ok = True)
-            shutil.copy2('{0}/{1}'.format(prepdir, k), '{0}/{1}'.format(httpdir, httpfiles[k]))
+            if os.path.lexists('{0}/{1}'.format(prepdir, k)):
+                shutil.copy2('{0}/{1}'.format(prepdir, k), '{0}/{1}'.format(httpdir, httpfiles[k]))
         for root, dirs, files in os.walk(httpdir):
             for d in dirs:
                 os.chown(os.path.join(root, d), uid, gid)
@@ -80,7 +81,7 @@ def tftp(conf):
                                                 datetime.datetime.now(),
                                                 tftpdir))
         for a in arch:
-            for i in ('md5', 'sfs', 'sha256'):
+            for i in ('md5', 'sfs', 'sha256', 'sha512'):
                 tftpfiles['{0}/{1}/airootfs.{2}'.format(bdisk['name'], a, i)] = '{0}/{1}/airootfs.{2}'.format(bdisk['name'], a, i)
         tftpfiles['VERSION_INFO.txt'] = 'VERSION_INFO.txt'
         if 'x86_64' in arch:

bdisk/build.py

@@ -21,6 +21,7 @@ def genImg(conf):
     basedir = build['basedir']
     prepdir = build['prepdir']
     hashes = {}
+    hashes['sha512'] = {}
     hashes['sha256'] = {}
     hashes['md5'] = {}
     squashfses = []
@@ -52,9 +53,10 @@ def genImg(conf):
                                             humanize.naturalsize(
                                                 os.path.getsize(squashimg))))
         # Generate the checksum files
-        print("{0}: [BUILD] Generating SHA256, MD5 checksums ({1})...".format(
+        print("{0}: [BUILD] Generating SHA512 SHA256, MD5 checksums ({1})...".format(
-                                                datetime.datetime.now(),
+                                                                datetime.datetime.now(),
                                                 squashimg))
+        hashes['sha512'][a] = hashlib.sha512()
         hashes['sha256'][a] = hashlib.sha256()
         hashes['md5'][a] = hashlib.md5()
         with open(squashimg, 'rb') as f:
@@ -63,8 +65,11 @@ def genImg(conf):
                 if not stream:
                     break
                 # NOTE: these items are hashlib objects, NOT strings!
+                hashes['sha512'][a].update(stream)
                 hashes['sha256'][a].update(stream)
                 hashes['md5'][a].update(stream)
+        with open(airoot + 'airootfs.sha512', 'w+') as f:
+            f.write("{0}  airootfs.sfs\n".format(hashes['sha512'][a].hexdigest()))
         with open(airoot + 'airootfs.sha256', 'w+') as f:
             f.write("{0}  airootfs.sfs\n".format(hashes['sha256'][a].hexdigest()))
         with open(airoot + 'airootfs.md5', 'w+') as f:
@@ -329,7 +334,7 @@ def genISO(conf):
     tpl_loader = jinja2.FileSystemLoader(templates_dir)
     env = jinja2.Environment(loader = tpl_loader)
     tpl = env.get_template(isolinux_cfg)
-    tpl_out = tpl.render(build = build, bdisk = bdisk)
+    tpl_out = tpl.render(build = build, bdisk = bdisk, bitness = bitness)
     with open(sysl_tmp + '/isolinux.cfg', "w+") as f:
         f.write(tpl_out)
     # And we need to build the ISO!

bdisk/host.py

@@ -24,10 +24,13 @@ def getHostname():
     hostname = platform.node()
     return(hostname)
 
-def getConfig(conf_file='/etc/bdisk/build.ini'):
+def getConfig(conf_file = '/etc/bdisk/build.ini'):
     conf = False
     # define some defailt conf paths in case we're installed by
     # a package manager. in order of the paths we should search.
+    currentdir = os.path.dirname(os.path.realpath(__file__))
+    currentdir_user = os.path.abspath('{0}/../build.ini'.format(currentdir))
+    currentdir_def = os.path.abspath('{0}/../extra/dist.build.ini'.format(currentdir))
     default_conf_paths = ['/etc/bdisk/build.ini',
                         '/usr/share/bdisk/build.ini',
                         '/usr/share/bdisk/extra/build.ini',
@@ -36,7 +39,8 @@ def getConfig(conf_file='/etc/bdisk/build.ini'):
                         '/usr/local/share/docs/bdisk/build.ini',
                         '/opt/dev/bdisk/build.ini',
                         '/opt/dev/bdisk/extra/build.ini',
-                        '/opt/dev/bdisk/extra/dist.build.ini']
+                        '/opt/dev/bdisk/extra/dist.build.ini',
+                        currentdir_user]
         # if we weren't given one/using the default...
     if conf_file == '/etc/bdisk/build.ini':
         if not os.path.isfile(conf_file):
@@ -44,9 +48,11 @@ def getConfig(conf_file='/etc/bdisk/build.ini'):
                 if os.path.isfile(p):
                     conf = p
                     break
+        else:
+            conf = conf_file
     else:
         conf = conf_file
-    defconf = '{0}/../extra/dist.build.ini'.format(os.path.dirname(os.path.realpath(__file__)))
+    defconf = os.path.abspath('{0}/../extra/dist.build.ini'.format(os.path.dirname(os.path.realpath(__file__))))
     if not conf:
         # okay, so let's check for distributed/"blank" ini's
         # since we can't seem to find one.
@@ -68,9 +74,9 @@ def parseConfig(confs):
     config_dict = {s:dict(config.items(s)) for s in config.sections()}
     # Convert the booleans to pythonic booleans in the dict...
     config_dict['bdisk']['user'] = config['bdisk'].getboolean('user')
-    config_dict['build']['gpg'] = config['build'].getboolean('gpg')
     config_dict['build']['i_am_a_racecar'] = config['build'].getboolean('i_am_a_racecar')
     config_dict['build']['ipxe'] = config['build'].getboolean('ipxe')
+    config_dict['build']['sign'] = config['build'].getboolean('sign')
     config_dict['build']['multiarch'] = (config_dict['build']['multiarch']).lower()
     config_dict['ipxe']['iso'] = config['ipxe'].getboolean('iso')
     config_dict['ipxe']['usb'] = config['ipxe'].getboolean('usb')
@@ -91,12 +97,17 @@ def parseConfig(confs):
     # commits on top of a new tagged release). e.g. for build Y:
     # v#.##-Y or v#.##rX-Y
     if config_dict['bdisk']['ver'] == '':
-        repo = git.Repo(config_dict['build']['basedir'])
+        try:
-        refs = repo.git.describe(repo.head.commit).split('-')
+            repo = git.Repo(config_dict['build']['basedir'])
-        if len(refs) >= 2:
+            refs = repo.git.describe(repo.head.commit).split('-')
-            config_dict['bdisk']['ver'] = refs[0] + 'r' + refs[1]
+            if len(refs) >= 2:
-        else:
+                config_dict['bdisk']['ver'] = refs[0] + 'r' + refs[1]
-            config_dict['bdisk']['ver'] = refs[0]
+            else:
+                config_dict['bdisk']['ver'] = refs[0]
+        except:
+            exit(('{0}: ERROR: {1} is NOT a valid git repository, and you did not specify bdisk:ver in your build.ini! ' +
+                  'Did you perhaps install from a package manager? Please refer to the documentation.').format(datetime.datetime.now(),
+                                                                                                               config_dict['build']['basedir']))
     # And the build number.
     # TODO: support tracking builds per version. i.e. in buildnum:
     # v2.51r13:0
@@ -126,16 +137,20 @@ def parseConfig(confs):
                                         config_dict['build']['multiarch']))
     ## VALIDATORS ##
     # Validate bootstrap mirror
-    if (validators.domain(config_dict['build']['mirror']) or validators.ipv4(
+    config_dict['src'] = {}
-                                config_dict['build']['mirror']) or validatords.ipv6(
+    for a in config_dict['build']['arch']:
-                                config_dict['build']['mirror'])):
+        config_dict['src'][a] = config_dict['source_' + a]
-        try:
+        if (validators.domain(config_dict['src'][a]['mirror']) or validators.ipv4(
-            getaddrinfo(config_dict['build']['mirror'], None)
+                                    config_dict['src'][a]['mirror']) or validatords.ipv6(
-        except:
+                                    config_dict['src'][a]['mirror'])):
-            exit(('{0}: ERROR: {1} does not resolve and cannot be used as a ' + 
+            try:
-                'mirror for the bootstrap tarballs. Check your configuration.').format(
+                getaddrinfo(config_dict['src'][a]['mirror'], None)
-                                        datetime.datetime.now(),
+            except:
-                                        config_dict['build']['host']))
+                exit(('{0}: ERROR: {1} does not resolve and cannot be used as a ' + 
+                    'mirror for the bootstrap tarballs. Check your configuration.').format(
+                                            datetime.datetime.now(),
+                                            config_dict['src'][a]['host']))
+        config_dict['src'][a]['gpg'] = config['source_' + a].getboolean('gpg')
     # Are we rsyncing? If so, validate the rsync host.
     # Works for IP address too. It does NOT check to see if we can
     # actually *rsync* to it; that'll come later.

bdisk/ipxe.py

@@ -21,7 +21,8 @@ def buildIPXE(conf):
     srcdir = build['srcdir']
     embedscript = build['dlpath'] + '/EMBED'
     ipxe_src = srcdir + '/ipxe'
-    ipxe_git_uri = 'git://git.ipxe.org/ipxe.git'
+    #ipxe_git_uri = 'git://git.ipxe.org/ipxe.git'
+    ipxe_git_uri = 'http://git.ipxe.org/ipxe.git'
     print('{0}: [IPXE] Prep/fetch sources...'.format(
                                         datetime.datetime.now()))
     # Get the source

bdisk/prep.py

@@ -25,27 +25,34 @@ def dirChk(conf):
 def downloadTarball(conf):
     build = conf['build']
     dlpath = build['dlpath']
+    src = conf['src']
     arch = build['arch']
-    #mirror = 'http://mirrors.kernel.org/archlinux'
-    mirror = build['mirrorproto'] + '://' + build['mirror']
-    rlsdir = mirror + build['mirrorpath']
-    sha_in = urlopen(mirror + build['mirrorchksum'])
-    # returns path/filename e.g. /some/path/to/file.tar.gz
-    # we use .gnupg since we'll need it later.
-    os.makedirs(dlpath + '/.gnupg', exist_ok = True)
     tarball_path = {}
-    for x in arch:
-        tarball_path[x] = dlpath + '/.latest.' + x + '.tar'
-    sha1sums = sha_in.read()
-    sha_in.close()
-    sha_raw = sha1sums.decode("utf-8")
-    sha_list = list(filter(None, sha_raw.split('\n')))
-    sha_dict = {x.split()[1]: x.split()[0] for x in sha_list}
-    # all that lousy work just to get a sha1 sum. okay. so.
     for a in arch:
+        locsrc = conf['source_' + a]
+        mirror = locsrc['mirrorproto'] + '://' + locsrc['mirror']
+        rlsdir = mirror + locsrc['mirrorpath']
+        if locsrc['mirrorchksum'] != '':
+            if locsrc['chksumtype'] == '':
+                exit("{0}: source_{1}:chksumtype is unset!".format(datetime.datetime.now(), a))
+            hash_type = locsrc['chksumtype']
+            hash_in = urlopen(mirror + locsrc['mirrorchksum'])
+            hashsums = hash_in.read()
+            hash_in.close()
+            hash_raw = hashsums.decode("utf-8")
+            hash_list = list(filter(None, hash_raw.split('\n')))
+            hash_dict = {x.split()[1]: x.split()[0] for x in hash_list}
+        # returns path/filename e.g. /some/path/to/file.tar.gz
+        # we use .gnupg since we'll need it later.
+        os.makedirs(dlpath + '/.gnupg', exist_ok = True)
+        tarball_path[a] = dlpath + '/.latest.' + a + '.tar'
         pattern = re.compile('^.*' + a + '\.tar(\.(gz|bz2|xz))?$')
-        tarball = [filename.group(0) for l in list(sha_dict.keys()) for filename in [pattern.search(l)] if filename][0]
+        if locsrc['mirrorfile'] != '':
-        sha1 = sha_dict[tarball]
+            tarball = locsrc['mirrorfile']
+        else:
+            tarball = [filename.group(0) for l in list(hash_dict.keys()) for filename in [pattern.search(l)] if filename][0]
+        if locsrc['mirrorchksum'] != '':
+            hashsum = hash_dict[tarball]
         if os.path.isfile(tarball_path[a]):
             pass
         else:
@@ -53,7 +60,6 @@ def downloadTarball(conf):
             print("{0}: [PREP] Fetching tarball ({1} architecture)...".format(
                                                             datetime.datetime.now(),
                                                             a))
-            #dl_file = urllib.URLopener()
             tarball_dl = urlopen(rlsdir + tarball)
             with open(tarball_path[a], 'wb') as f:
                 f.write(tarball_dl.read())
@@ -63,20 +69,32 @@ def downloadTarball(conf):
                                                     tarball_path[a],
                                                     humanize.naturalsize(
                                                         os.path.getsize(tarball_path[a]))))
-        print("{0}: [PREP] Checking hash checksum {1} against {2}...".format(
+        if locsrc['mirrorchksum'] != '':
-                                                    datetime.datetime.now(),
+            print("{0}: [PREP] Checking hash checksum {1} against {2}...".format(
-                                                    sha1,
+                                                        datetime.datetime.now(),
-                                                    tarball_path[a]))
+                                                        hashsum,
-        tarball_hash = hashlib.sha1(open(tarball_path[a], 'rb').read()).hexdigest()
+                                                        tarball_path[a]))
-        if tarball_hash != sha1:
+            # Calculate the checksum according to type specified.
-            exit(("{0}: {1} either did not download correctly\n\t\t\t    or a wrong (probably old) version exists on the filesystem.\n\t\t\t    " +
+            tarball_hash = False
-                                "Please delete it and try again.").format(datetime.datetime.now(), tarball))
+            for i in hashlib.algorithms_available:
-        elif build['mirrorgpgsig'] != '':
+                if hash_type == i:
-            # okay, so the sha1 matches. let's verify the signature.
+                    hashfunc = getattr(hashlib, i)
-            if build['mirrorgpgsig'] == '.sig':
+                    tarball_hash = hashfunc(open(tarball_path[a], 'rb').read()).hexdigest()
+                    break
+            if not tarball_hash:
+                exit("{0}: source_{1}:chksumtype '{2}' is not supported on this machine!".format(
+                                                            datetime.datetime.now(),
+                                                            a,
+                                                            hash_type))
+            if tarball_hash != hashsum:
+                exit(("{0}: {1} either did not download correctly\n\t\t\t    or a wrong (probably old) version exists on the filesystem.\n\t\t\t    " +
+                                    "Please delete it and try again.").format(datetime.datetime.now(), tarball))
+        if locsrc['mirrorgpgsig'] != '':
+            # let's verify the signature.
+            if locsrc['mirrorgpgsig'] == '.sig':
                 gpgsig_remote = rlsdir + tarball + '.sig'
             else:
-                gpgsig_remote = build['mirrorgpgsig']
+                gpgsig_remote = locsrc['mirrorgpgsig']
             sig_dl = urlopen(gpgsig_remote)
             sig = tarball_path[a] + '.sig'
             with open(sig, 'wb+') as f:

docs/TODO

@@ -1,5 +1,13 @@
-## Missing v2.x functionality ##
+-investigate weird signing issue- if you specify a key to sign with, it appears that the squashed images (at least in the http dir) doesn't have a sig/asc. do they need to copy it over? or is it not even signing them?
+-switch from python-pygpgme to python-gpgme for better performance. also clean up bGPG in general; reference KANT.
+-more pythonic! classes (because inits help), use list or tuple constant for checksums, try vars-ing the configparser stuff (and move defaults to in-code?),
+   change path combinations to use os.path.join etc.
+-modularity: https://stackoverflow.com/a/8719100
+
+-mtree-like functionality; if mtree spec is found, apply that to files in overlay (or chroot even); otherwise copy from overlay and don't touch chroot 
+
 -i_am_a_racecar optimizations
+- different distro guests (debian, etc.)- https://stackoverflow.com/questions/2349991/python-how-to-import-other-python-files/20749411#20749411
 -incorporate this into the manual?
 -TFTP configs generated for pxelinux
 -fix the branding, etc. on ipxe. :(
@@ -9,25 +17,27 @@
 -- https://code.google.com/p/byte-unixbench/
 -- https://github.com/akopytov/sysbench
 -- (http://blog.due.io/2014/linode-digitalocean-and-vultr-comparison/ etc.)
--implement pyalpm to decreate dependency on chroot pacman-ing?
+-There *has* to be a better way of handling package installation in the chroots.
+--implement pyalpm to decreate dependency on chroot pacman-ing?
 --or even maybe https://wiki.archlinux.org/index.php/offline_installation_of_packages in pure python!
 -set up automatic exporting to PDF of the user manual server-side. https://pypi.python.org/pypi/unoconv/0.6
--There *has* to be a better way of handling package installation in the chroots.
 -maybe remove lxde, firefox, chrome and replace with enlightenment/midori?
 -custom repo? https://brainwreckedtech.wordpress.com/2013/01/27/making-your-own-arch-linux-repository/
---https://wiki.archlinux.org/index.php/Building_32-bit_packages_on_a_64-bit_system
+--https://wiki.archlinux.org/index.php/Building_32-bit_packages_on_a_64-bit_system # NOTE: arch has dropped i686, now continued as archlinux32
 -implement better "additional" packages list. specify for path in build.ini- these should be more easily changed by end users. DON'T TOUCH iso.pkgs.lst since those are necessary for booting.
--shorewall/some other firewall?
+-automatic shorewall/some other firewall?
 -autodetection/configuration of network. DHCP is currently running by default, but does it need to support IPv6? if so, how would the user configure their network?
 -DISABLE NETWORKMANAGER AND "fi.w1.wpa_supplicant1"??? keeps spawning wpa_supplicant (and thusly killing networking proper)
 -for netboot, custom user agent (should be defined by build.ini)
 --iPXE's curl
 --initrd's curl
 -WISH: Better logging/debugging
+https://web.archive.org/web/20170726052946/http://www.lexev.org/en/2013/python-logging-every-day/
+
 -WISH: signing for secureboot releases (PreLoader and loader.efi handle this okay, but require manual intervention)
 -does loader.efi support splash backgrounds? can i implement that differently somehow?
 --yes, see e.g. https://www.reddit.com/r/archlinux/comments/3bwgf0/where_put_the_splasharchbmp_to_splash_screen_boot/
--strip out/remove unnecessary and orphan packages (e.g. gcc, make, automake, etc.)
+-strip out/remove unnecessary and orphan packages (e.g. gcc, make, automake, etc.) before building ISO
 -incorporate iPXE tweaks:
 --http://ipxe.org/crypto 
 --http://ipxe.org/cmd/imgtrust
@@ -39,6 +49,7 @@
 ---#imgverify initrd path/to/initrd.sig
 ---DONE, partially. need to incorporate codesign certs/keys. routines, conf variables
 -enable mirror= kernel commandline.
+-NOTE: Following should be implemented via AIF-NG (https://git.square-r00t.net/AIF-NG, work pending for fix to BDisk for i686/x86_64 split) 
 --if mirror_(NAME) is present, use that as repo name.
 --if it starts with /, treat as mirrorlist (Include); otherwise use Server = 
 --if it has mirror_SIG-X, set signature options e.g. _SIG-N would be "SigLevel = Never"
@@ -47,5 +58,3 @@
 -include WinMTR, build Mac OS X MTR for dist/tools on CD
 -include pre-compiled LibreCrypt for opening LUKS parts on Windows (https://github.com/t-d-k/LibreCrypt)
 --curl -s https://raw.githubusercontent.com/t-d-k/LibreCrypt/master/README.md | egrep 'InstallLibreCrypt_v[A-Za-z0-9\.]*.exe' | cut -f2 -d'"'
-
-

docs/manual/HEAD.adoc

@@ -1,6 +1,6 @@
 = BDisk User and Developer Manual
 Brent Saner <bts@square-r00t.net>
-v1.0, 2016-12
+v1.3, 2017-08-20
 :doctype: book
 :data-uri:
 :imagesdir: images

docs/manual/further/BUGS.adoc

@@ -2,17 +2,17 @@
 NOTE: It is possible to submit a bug or feature request without registering in my bugtracker. One of my pet peeves is needing to create an account/register on a bugtracker simply to report a bug! The following links only require an email address to file a bug (which is necessary in case I need any further clarification from you or to keep you updated on the status of the bug/feature request -- so please be sure to use a valid email address).
 
 === Bugs
-If you encounter any bugs in *BDisk*, you can file a bug report https://bugs.square-r00t.net/index.php?do=newtask&project=2&task_type=1[here^].
+If you encounter any bugs in *BDisk*, you can file a bug report https://bugs.square-r00t.net/index.php?do=newtask&project=2&task_type=1&product_category=5[here^].
 
-If you encounter any bugs (inaccurate information, typos, misformatting, etc.) in *this documentation*, you can file a bug report https://bugs.square-r00t.net/index.php?do=newtask&project=8&task_type=1[here^].
+If you encounter any bugs (inaccurate information, typos, misformatting, etc.) in *this documentation*, you can file a bug report https://bugs.square-r00t.net/index.php?do=newtask&project=2&task_type=1&product_category=26[here^].
 
 === Feature Requests
-If you have any features you'd like to see or you think would help *BDisk* become even more useful, please file a feature request https://bugs.square-r00t.net/index.php?do=newtask&project=2&task_type=2[here^].
+If you have any features you'd like to see or you think would help *BDisk* become even more useful, please file a feature request https://bugs.square-r00t.net/index.php?do=newtask&project=2&task_type=2&product_category=5[here^].
 
-If you have any suggestions on how to improve *this documentation* or feel it's missing information that could be useful, please file a feature request https://bugs.square-r00t.net/index.php?do=newtask&project=8&task_type=2[here^].
+If you have any suggestions on how to improve *this documentation* or feel it's missing information that could be useful, please file a feature request https://bugs.square-r00t.net/index.php?do=newtask&project=2&task_type=2&product_category=26[here^].
 
 === Patches
-I gladly welcome https://www.gnu.org/software/diffutils/manual/html_node/Unified-Format.html[patches^], but I deplore using GitHub (even though I https://github.com/johnnybubonic/BDisk[have a mirror there^]). For this reason, please follow the same https://www.kernel.org/doc/Documentation/SubmittingPatches[patch/pull request process] for the Linux kernel and email it to bts@square-r00t.net.
+I gladly welcome https://www.gnu.org/software/diffutils/manual/html_node/Unified-Format.html[patches^], but I deplore using GitHub (even though I https://github.com/johnnybubonic/BDisk[have a mirror there^]). For this reason, please follow the same https://www.kernel.org/doc/Documentation/process/submitting-patches.rst[patch/pull request process] for the Linux kernel and email it to bts@square-r00t.net.
 
 Alternatively, you may attach a patch to a <<bugs,bug report>>/<<feature_requests,feature request>>.
 

docs/manual/user/BUILDING.adoc

@@ -7,6 +7,8 @@ NOTE: Due to requiring various mounting and chrooting, BDisk must be run as the
 
 To initiate a build, simply run `<basedir>/bdisk/bdisk.py`. That's it! Everything should continue automatically.
 
+If you'd like to specify a path to a specific build configuration, you can use `<basedir>/bdisk/bdisk.py path/to/build.ini`. The default is _/etc/bdisk/build.ini_ (plus <<the_code_build_ini_code_,other locations>>).
+
 If you're using a packaged version you installed from your distro's package manager, you instead should run wherever it installs to. Most likely this is going to be `/usr/sbin/bdisk`. (On systemd build hosts that have done the https://www.freedesktop.org/wiki/Software/systemd/TheCaseForTheUsrMerge/[/usr merge^], you can use `/usr/sbin/bdisk` or `/sbin/bdisk`.)
 
 If you encounter any issues during the process, make sure you read the documentation -- if your issue still isn't addressed, please be sure to file a <<bug_reports_feature_requests,bug report>>!

docs/manual/user/BUILDINI.adoc

@@ -3,7 +3,7 @@ This file is where you can specify some of the very basics of BDisk building. It
 
 It's single-level, but divided into "sections". This is unfortunately a limitation of ConfigParser, but it should be easy enough to follow.
 
-Blank lines are ignored, as well as any lines beginning with `#` and `;`. There are some restrictions and recommendations for some values, so be sure to note them when they occur. Variables referencing other values in the `build.ini` are allowed in the format of `${value}` if it's in the same section; otherwise, `${section:value}` can be used.
+Blank lines are ignored, as well as any lines beginning with `#` and `;`. There are some restrictions and recommendations for some values, so be sure to note them when they occur. Variables referencing other values in the `build.ini` are allowed in the format of `${keyname}` if it's in the same section; otherwise, `${section:keyname}` can be used.
 
 If you want to use your own `build.ini` file (and you should!), the following paths are searched in order. The first one found will be used.
 
@@ -16,6 +16,7 @@ If you want to use your own `build.ini` file (and you should!), the following pa
 * `/opt/dev/bdisk/build.ini`
 * `/opt/dev/bdisk/extra/build.ini`
 * `/opt/dev/bdisk/extra/dist.build.ini`
+* `<bdisk.py directory>/../build.ini`
 
 We'll go into more detail for each section below.
 
@@ -24,7 +25,7 @@ We'll go into more detail for each section below.
  name = BDISK
  uxname = bdisk
  pname = BDisk
- ver =
+ ver = 
  dev = A Developer
  email = dev@domain.tld
  desc = A rescue/restore live environment.
@@ -34,17 +35,29 @@ We'll go into more detail for each section below.
  [user]
  username = ${bdisk:uxname}
  name = Default user
+ groups = ${bdisk:uxname},admin
  password = $$6$$t92Uvm1ETLocDb1D$$BvI0Sa6CSXxzIKBinIaJHb1gLJWheoXp7WzdideAJN46aChFu3hKg07QaIJNk4dfIJ2ry3tEfo3FRvstKWasg/
- [build]
+ [source_x86_64]
  mirror = mirror.us.leaseweb.net
  mirrorproto = https
  mirrorpath = /archlinux/iso/latest/
- mirrorfile =
+ mirrorfile = .sig
  mirrorchksum = ${mirrorpath}sha1sums.txt
+ chksumtype = sha1
  mirrorgpgsig =
  gpgkey = 7F2D434B9741E8AC
  gpgkeyserver =
- gpg = no
+ [source_i686]
+ mirror = mirror.us.leaseweb.net
+ mirrorproto = https
+ mirrorpath = /archlinux/iso/latest/
+ mirrorfile = 
+ mirrorchksum = ${mirrorpath}sha1sums.txt
+ chksumtype = sha1
+ mirrorgpgsig =
+ gpgkey =
+ gpgkeyserver =
+ [build]
  dlpath = /var/tmp/${bdisk:uxname}
  chrootdir = /var/tmp/chroots
  basedir = /opt/dev/bdisk
@@ -53,7 +66,8 @@ We'll go into more detail for each section below.
  prepdir = ${dlpath}/temp
  archboot = ${prepdir}/${bdisk:name}
  mountpt = /mnt/${bdisk:uxname}
- multiarch = yes
+ multiarch = x86_64
+ sign = yes
  ipxe = no
  i_am_a_racecar = no
  [gpg]
@@ -71,7 +85,7 @@ We'll go into more detail for each section below.
  [tftp]
  path = ${build:dlpath}/tftpboot
  user = root
- group = root
+ group = root 
  [ipxe]
  iso = no
  uri = https://domain.tld
@@ -81,9 +95,9 @@ We'll go into more detail for each section below.
  ssl_crt = ${ssldir}/main.crt
  ssl_key = ${ssldir}/main.key
  [rsync]
- host =
+ host = 
- user =
+ user = 
- path =
+ path = 
  iso = no
 
 === `[bdisk]`
@@ -114,7 +128,7 @@ This string is used for "pretty-printing" of the project name; it should be a mo
 . ASCII only
 
 ==== `ver`
-The version string. If this isn't specified, we'll try to guess based on the current git commit and tags in `<<code_basedir_code,build:basedir>>`.
+The version string. If this isn't specified, we'll try to guess based on the current git commit and tags in `<<code_basedir_code,build:basedir>>`. If `<<code_basedir_code,build:basedir>>` is *not* a git repository (i.e. you installed BDisk from a package manager), you MUST specify a version number.
 
 . No whitespace
 
@@ -179,20 +193,37 @@ What comment/description/real name should be used for the user? For more informa
 
 . ASCII only
 
+==== `groups`
+What groups this user should be added to, comma-separated. They will be created if they don't exist yet. Standard *nix group names rules apply:
+
+. ASCII only
+. 32 characters or less
+. Can only contain lower-case letters, numeric digits, underscores, or dashes (and can end with a dollar sign)
+. Must start with a (lower-case) letter or underscore
+. No whitespace
+
 ==== `password`
 The escaped, salted, hashed string to use for the non-root user.
 
 Please see <<passwords,the section on passwords>> for information on this value. In the <<example,example above>>, the string `$$6$$t92Uvm1ETLocDb1D$$BvI0Sa6CSXxzIKBinIaJHb1gLJWheoXp7WzdideAJN46aChFu3hKg07QaIJNk4dfIJ2ry3tEfo3FRvstKWasg/` is created from the password `test`. I cannot stress this enough, do not use a plaintext password here nor just use a regular `/etc/shadow` file/`crypt(3)` hash here. Read the section. I promise it's short.
 
-=== `[build]`
+=== `[source_<arch>]`
-This section controls some aspects about the host and things like filesystem paths, etc.
+This section controls where to fetch the "base" tarballs.
+
+NOTE: Previously, these settings were *not* architecture-specific, and included in the <<code_build_code,`build`>> section.
+
+It was necessary to create this section per architecture, because https://www.archlinux.org/news/phasing-out-i686-support/[Arch Linux has dropped i686 support^]. However, plenty of other distros also have removed support and other third-party projects have ported. (You can find the Arch Linux 32-bit/i686 port project http://archlinux32.org/[here^].)
+
+The directives here are only covered once, however, since both sections are identical- they just allow you to specify different mirrors. Note that the two settings are `[source_i686]` (for 32-bit) and `[source_x86_64]` (for 64-bit/multilib).
+
+Which section is used (or both) depends on what <<code_multiarch_code, architectures you have enabled>> for the build.
 
 ==== `mirror`
 A mirror that hosts the bootstrap tarball. It is *highly* recommended you use an Arch Linux https://wiki.archlinux.org/index.php/Install_from_existing_Linux#Method_A:_Using_the_bootstrap_image_.28recommended.29[bootstrap tarball^] as the build process is highly specialized to this (but <<bug_reports_feature_requests,patches/feature requests>> are welcome for other built distros). You can find a list of mirrors at the bottom of Arch's https://www.archlinux.org/download/[download page^].
 
 . No whitespace
 . Must be accessible remotely/via a WAN-recognized address
-. Must be a domain/FQDN only; no paths (those come later!)
+. Must be a domain/FQDN (or IP address) only; no paths (those come later!)
 
 ==== `mirrorproto`
 What protocol should we use for the <<code_mirror_code,`mirror`>>?
@@ -208,14 +239,42 @@ What is the path to the tarball directory on the <<code_mirror_code,`mirror`>>?
 . No whitespace
 
 ==== `mirrorfile`
-What is the filename for the tarball found in the path specified in <<code_mirrorpath_code,`mirrorpath`>> ? If left blank, we will use the sha1 <<code_mirrorchksum_code,checksum>> file to try to guess the most recent file.
+What is the filename for the tarball found in the path specified in <<code_mirrorpath_code,`mirrorpath`>> ? If left blank, we will use the hash <<code_mirrorchksum_code,checksum>> file to try to guess the most recent file.
 
 ==== `mirrorchksum`
-The path to a sha1 checksum file of the bootstrap tarball.
+*[optional]* +
+*default: (no hash checking done)* +
+*requires: <<code_chksumtype_code,`chksumtype`>>*
+
+The path to a checksum file of the bootstrap tarball.
 
 . No whitespace
 . Must be the full path
-. Don't include the mirror domain or protocol
+. Don't include the <<code_mirror_code,mirror domain>> or <<code_mirrorproto_code,protocol>>
+
+==== `chksumtype`
+The algorithm that <<code_mirrorchksum_code,`mirrorchksum`>>'s hashes are in.
+
+[options="header"]
+|======================
+7+^|Accepts one of:
+^m|blake2b
+^m|blake2s
+^m|md5
+^m|sha1
+^m|sha224
+^m|sha256
+^m|sha384
+^m|sha512
+^m|sha3_224
+^m|sha3_256
+^m|sha3_384
+^m|sha3_512
+^m|shake_128
+^m|shake_256
+|======================
+
+TIP: You may have support for additional hashing algorithms, but these are the ones gauranteed to be supported by Python's https://docs.python.org/3/library/hashlib.html[hashlib module^]. To get a full list of algorithms the computer you're building on supports, you can run `python3 -c 'import hashlib;print(hashlib.algorithms_available)'`. Most likely, however, <<code_mirrorchksum_code,`mirrorchksum`>> is going to be hashes of one of the above.
 
 ==== `mirrorgpgsig`
 *[optional]* +
@@ -225,7 +284,7 @@ The path to a sha1 checksum file of the bootstrap tarball.
 
 If the bootstrap tarball file has a GPG signature, we can use it for extra checking. If it's blank, GPG checking will be disabled.
 
-If you specify just `.sig` (or use the default and don't specify a <<code_mirrorfile_code,`mirrorfile`>>), BDisk will try to guess based on the file from the sha1 <<code_mirrorchksum_code,checksum>> file. Note that this must evaluate to a full URL. (e.g. `${mirrorproto}://${mirror}${mirrorpath}somefile.sig`)
+If you specify just `.sig` (or use the default and don't specify a <<code_mirrorfile_code,`mirrorfile`>>), BDisk will try to guess based on the file from the hash <<code_mirrorchksum_code,checksum>> file. Note that unless you're using the `.sig` "autodetection", this must evaluate to a full URL. (e.g. `${mirrorproto}://${mirror}${mirrorpath}somefile.sig`)
 
 ==== `gpgkey`
 *requires: <<optional,_gpg/gnupg_>>*
@@ -245,6 +304,18 @@ What is a valid keyserver we should use to fetch <<code_gpgkey_code,`gpgkey`>>?
 . The default (blank) is probably fine. If you don't specify a personal GPG config, then you'll most likely want to leave this blank.
 . If set, make sure it is a valid keyserver URI (e.g. `hkp://keys.gnupg.net`)
 
+[options="header"]
+|======================
+2+^|Accepts (case-insensitive) one of:
+^m|yes ^m|no
+^m|true ^m|false
+^m|1 ^m|0
+|======================
+
+=== `[build]`
+This section controls some aspects about the host and things like filesystem paths, etc.
+
+
 ==== `gpg`
 Should we sign our release files? See the <<code_gpg_code_2,`[gpg]`>> section.
 
@@ -454,7 +525,7 @@ What group the HTTP files should be owned as. This is most likely going to be ei
 . Group must exist on build system
 
 |======================
-^s|Can be one of: ^.^m|group name ^.^m|https://linux.die.net/man/5/group[UID]
+^s|Can be one of: ^.^m|groupname ^.^m|https://linux.die.net/man/5/group[GID]
 |======================
 
 === `[tftp]`
@@ -486,7 +557,7 @@ What group the TFTP files should be owned as. This is most likely going to be ei
 . Group must exist on build system
 
 |======================
-^s|Can be one of: ^.^m|group name ^.^m|https://linux.die.net/man/5/group[UID]
+^s|Can be one of: ^.^m|groupname ^.^m|https://linux.die.net/man/5/group[GID]
 |======================
 
 === `[ipxe]`

docs/manual/user/GETTING_STARTED.adoc

@@ -64,6 +64,8 @@ While not strictly necessary, these will greatly enhance your BDisk usage. I've
 
 NOTE: If you do not wish to install any of these or cannot install them, be sure to disable the relevant options in the `build.ini` file (we'll talk about that later). The default `extra/dist.build.ini` should be sane enough to not require any of these.
 
+* http://cdrtools.sourceforge.net/private/cdrecord.html[cdrtools^]
+** Needed for building iPXE.
 * http://gcc.gnu.org[gcc (multilib)^] (>=6.x)
 ** Needed for building iPXE.
 * http://gcc.gnu.org[gcc-libs (multilib)^] (>=6.x)

docs/manual/user/advanced/SSH.adoc

@@ -17,7 +17,7 @@ First, create a file: `<basedir>/overlay/etc/ssh/sshd_config` using the followin
  Subsystem	sftp	/usr/lib/ssh/sftp-server
  KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
  Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
- MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
+ MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
 
 We'll also want to implement a more secure `ssh_config` file to avoid possible leaks. The following is `<basedir>/overlay/etc/ssh/ssh_config`:
 
@@ -28,7 +28,7 @@ We'll also want to implement a more secure `ssh_config` file to avoid possible l
      PubkeyAuthentication yes
      HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa
      Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
-     MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
+     MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
 
 We'll want to create our own moduli. This can take a long time, but only needs to be done once -- it doesn't need to be done for every build. The following commands should be run in `<basedir>/overlay/etc/ssh/`:
 

docs/manual/user/fslayout/TEMPLATES.adoc

@@ -38,7 +38,7 @@ The `EFI/` directory is similar to <<efi, EFI/>> above also, but needs fewer con
 The `patches/` directory largely control branding of the mini ISO. They are in https://www.gnu.org/software/diffutils/manual/html_node/Unified-Format.html[unified diff^] (or "patch") format.
 
 ===== overlay/
-This directory contains *templated* overlays. These are intended to be templated by the user. See <<overlay, the overlay section>> for more information on how to use this. Remember to suffix your template files with the `.j2` extension.
+This directory contains *templated* overlays. These are intended to be templated by the user. See <<overlay_2, the overlay section>> for more information on how to use this. Remember to suffix your template files with the `.j2` extension.
 
 ===== pre-build.d/
 This directory contains *templated* overlays. These are intended to not be managed by the user, as they handle configuration necessary for building an ISO. See <<pre_build_d, the pre-build.d section>> for more information on this.

extra/dist.build.ini

@@ -26,17 +26,32 @@ user = yes
 [user]
 username = ${bdisk:uxname}
 name = Default user
+groups = ${bdisk:uxname},admin
 password =
 
-[build]
+[source_x86_64]
 mirror = mirror.us.leaseweb.net
 mirrorproto = https
 mirrorpath = /archlinux/iso/latest/
 mirrorfile = 
 mirrorchksum = ${mirrorpath}sha1sums.txt
+chksumtype = sha1
 mirrorgpgsig =
 gpgkey = 7F2D434B9741E8AC
 gpgkeyserver =
+
+[source_i686]
+mirror = mirror.us.leaseweb.net
+mirrorproto = https
+mirrorpath = /archlinux/iso/latest/
+mirrorfile = 
+mirrorchksum = ${mirrorpath}sha1sums.txt
+chksumtype = sha1
+mirrorgpgsig =
+gpgkey = 7F2D434B9741E8AC
+gpgkeyserver =
+
+[build]
 gpg = no
 dlpath = /var/tmp/${bdisk:uxname}
 chrootdir = /var/tmp/chroots
@@ -46,13 +61,15 @@ srcdir = ${dlpath}/src
 prepdir = ${dlpath}/temp
 archboot = ${prepdir}/${bdisk:name}
 mountpt = /mnt/${bdisk:uxname}
-multiarch = yes
+#multiarch = yes
-ipxe =
+multiarch = x86_64
+sign = yes
+ipxe = no
 i_am_a_racecar = yes
 
 [gpg]
 mygpgkey =
-mygpghome =
+mygpghome = ${build:dlpath}/.gnupg
 
 [sync]
 http = no

extra/modules/distro/TEMPLATE

@@ -0,0 +1,48 @@
+# The modules found in here are for distro-specific differences in the builds.
+# For instance, if you want to build a Debian-based BDisk, you'd specify pkg['install'] = ['apt-get', '-y', 'install', '%PKG%'],
+# name this file as "debian.py", and set bdisk:distro as 'debian'.
+# Note that the guest will need python installed. If distro is set as "NOCHECK", a distro check of the tarball won't be performed
+# (as the distro check requires python be installed first).
+
+# Special variables to be used in strings:
+# %PKG%	= the name of a package would be inserted here.
+
+# This template uses Debian as an example.
+
+# The name of the distro. Must match the output from platform.linux_distribution()[0].lower()
+# Regex is supported.
+distro = 'debian'
+
+# The path to python. Can be either python 2.x (2.6 or higher) or 3.x.
+pybin = '/usr/bin/python'
+
+guestenv = {}
+# The following environment variables will be set for the guest.
+guestenv['DEBIAN_FRONTEND'] = 'noninteractive'
+
+scripts = {}
+# This variable can be used to perform some additional system tweaks and such. This is run before package installation.
+# It must be formatted as a complete script- i.e. include a shebang etc.
+script['pre'] = """#!/bin/bash
+touch /root/BDISK
+"""
+
+# This variable can be used to perform some additional system tweaks and such. This is run after package installation.
+script['post'] = """#!/bin/bash
+rm -f /root/BDISK
+"""
+
+
+pkg = {}
+# The command, with arguments, in list format that should be run before we install software in the guest.
+# For instance, if your guest distro requires a local package listing cache (nearly all of them do) to be
+# updated first, this is where it would be run.
+pkg['pre'] = ['apt-get', '-y', 'update']
+
+# The command, with arguments, in a list format to install a package.
+# Note that the command must be constructed in a way that does not require user interaction.
+pkg['install'] = ['apt-get', '-y', 'install', '%PKG%']
+
+# The command, with arguments, in list format to use to check if a package is installed.
+# It should return 0 on exist status if it's installed. Any other exit status assumes the package is not installed.
+pkg['check'] = ['dpkg-query', '-f', '${binary:Package}\n', '-W', '%PKG']

extra/modules/distro/arch.py

@@ -0,0 +1,11 @@
+distro = 'arch'
+pybin = '/usr/bin/python'
+script['pre'] = """#!/bin/bash
+touch /root/BDISK
+"""
+script['post'] = """#!/bin/bash
+rm -f /root/BDISK
+"""
+pkg['pre'] = ['pacman', '-Syyy']
+pkg['install'] = ['apacman', '-S', '%PKG%']
+pkg['check'] = ['pacman', '-Q', '%PKG']

extra/modules/distro/centos.py

@@ -0,0 +1,11 @@
+distro = 'centos linux'
+pybin = '/usr/bin/python'
+script['pre'] = """#!/bin/bash
+touch /root/BDISK
+"""
+script['post'] = """#!/bin/bash
+rm -f /root/BDISK
+"""
+pkg['pre'] = ['yum', 'makecache']
+pkg['install'] = ['yum', '-y', 'install', '%PKG%']
+pkg['check'] = ['rpm', '-qi', '%PKG']

extra/modules/distro/debian.py

@@ -0,0 +1,12 @@
+distro = 'debian'
+pybin = '/usr/bin/python'
+guestenv['DEBIAN_FRONTEND'] = 'noninteractive'
+script['pre'] = """#!/bin/bash
+touch /root/BDISK
+"""
+script['post'] = """#!/bin/bash
+rm -f /root/BDISK
+"""
+pkg['pre'] = ['apt-get', '-q', '-y', 'update']
+pkg['install'] = ['apt-get', '-q', '-y', '-o Dpkg::Options::="--force-confdef"', '-o Dpkg::Options::="--force-confold"', 'install', '%PKG%']
+pkg['check'] = ['dpkg-query', '-f', "'${binary:Package}\n'", '-W', '%PKG']

extra/modules/distro/fedora.py

@@ -0,0 +1,11 @@
+distro = 'fedora'
+pybin = '/usr/bin/python3'
+script['pre'] = """#!/bin/bash
+touch /root/BDISK
+"""
+script['post'] = """#!/bin/bash
+rm -f /root/BDISK
+"""
+pkg['pre'] = ['yum', 'makecache']
+pkg['install'] = ['yum', '-y', 'install', '%PKG%']
+pkg['check'] = ['rpm', '-qi', '%PKG']

extra/modules/distro/rhel.py

@@ -0,0 +1,11 @@
+distro = 'red hat enterprise linux (server|desktop)'
+pybin = '/usr/bin/python'
+script['pre'] = """#!/bin/bash
+touch /root/BDISK
+"""
+script['post'] = """#!/bin/bash
+rm -f /root/BDISK
+"""
+pkg['pre'] = ['yum', 'makecache']
+pkg['install'] = ['yum', '-y', 'install', '%PKG%']
+pkg['check'] = ['rpm', '-qi', '%PKG']

extra/modules/distro/sles.py

@@ -0,0 +1,11 @@
+distro = 'suse linux enterprise server'
+pybin = '/usr/bin/python'
+script['pre'] = """#!/bin/bash
+touch /root/BDISK
+"""
+script['post'] = """#!/bin/bash
+rm -f /root/BDISK
+"""
+pkg['pre'] = ['zypper', 'refresh']
+pkg['install'] = ['zypper', 'install', '--no-confirm', '-l', '%PKG%']
+pkg['check'] = ['rpm', '-qi', '%PKG']

extra/modules/distro/ubuntu.py

@@ -0,0 +1,12 @@
+distro = 'ubuntu'
+pybin = '/usr/bin/python'
+guestenv['DEBIAN_FRONTEND'] = 'noninteractive'
+script['pre'] = """#!/bin/bash
+touch /root/BDISK
+"""
+script['post'] = """#!/bin/bash
+rm -f /root/BDISK
+"""
+pkg['pre'] = ['apt-get', '-q', '-y', 'update']
+pkg['install'] = ['apt-get', '-q', '-y', '-o Dpkg::Options::="--force-confdef"', '-o Dpkg::Options::="--force-confold"', 'install', '%PKG%']
+pkg['check'] = ['dpkg-query', '-f', "'${binary:Package}\n'", '-W', '%PKG']

extra/pkg.build.ini

@@ -26,17 +26,32 @@ user = yes
 [user]
 username = ${bdisk:uxname}
 name = Default user
+groups = ${bdisk:uxname},admin
 password =
 
-[build]
+[source_x86_64]
 mirror = mirror.us.leaseweb.net
 mirrorproto = https
 mirrorpath = /archlinux/iso/latest/
-mirrorfile =
+mirrorfile = 
 mirrorchksum = ${mirrorpath}sha1sums.txt
+chksumtype = sha1
 mirrorgpgsig =
 gpgkey = 7F2D434B9741E8AC
 gpgkeyserver =
+
+[source_i686]
+mirror = mirror.us.leaseweb.net
+mirrorproto = https
+mirrorpath = /archlinux/iso/latest/
+mirrorfile = 
+mirrorchksum = ${mirrorpath}sha1sums.txt
+chksumtype = sha1
+mirrorgpgsig =
+gpgkey = 7F2D434B9741E8AC
+gpgkeyserver =
+
+[build]
 gpg = no
 dlpath = /var/tmp/${bdisk:uxname}
 chrootdir = /var/tmp/chroots
@@ -46,13 +61,14 @@ srcdir = ${dlpath}/src
 prepdir = ${dlpath}/temp
 archboot = ${prepdir}/${bdisk:name}
 mountpt = /mnt/${bdisk:uxname}
-multiarch = yes
+#multiarch = yes
+multiarch = x86_64
 ipxe = no
 i_am_a_racecar = no
 
 [gpg]
 mygpgkey =
-mygpghome =
+mygpghome = ${build:dlpath}/.gnupg
 
 [sync]
 http = no

extra/pre-build.d/etc/hostname

@@ -1 +0,0 @@
-bdisk-live.loc.lan

extra/pre-build.d/etc/issue

@@ -1,90 +0,0 @@
-
-MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMW0dc,..      ..;cxKWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
-MMMMMMMMMMMMMMMMMMMMMMMMW0d:'.                    .,cx0WMMMMMMMMMMMMMMMMMMMMMMMM
-MMMMMMMMMMMMMMMMMMMMNx:.     .';cldxkkOOOOkkxdl:,..     .ckNMMMMMMMMMMMMMMMMMMMM
-MMMMMMMMMMMMMMMMMKl.    .;okKXXXXXXXXXXXXXXXXXXXXXX0xl;.    'oXMMMMMMMMMMMMMMMMM
-MMMMMMMMMMMMMMXl.   .:d0XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX0d;.   .dNMMMMMMMMMMMMMM
-MMMMMMMMMMMM0;   .cOXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXKk:    :KMMMMMMMMMMMM
-MMMMMMMMMMO'   'xKXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXKd.   ,KMMMMMMMMMM
-MMMMMMMMX,   ,OXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXx'   :NMMMMMMMM
-MMMMMMMd   .kXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXd.  .kMMMMMMM
-MMMMMN'   oKKxl:;,;:lkKXXXXXXXXXXXXXXXXXXXXXXXX0dl:;,;:ld0XXXXXXXXXXKc   ;WMMMMM
-MMMMK.  .O0;  ':ool:.  ;kXXXXXXXXXXXXXXXXXXX0l. .,coooc'  .c0XXXXXXXXXk.  .NMMMM
-MMMK.  'Kx  cNMMMMK.     ,0XXXXXXXXXXXXXXXKc  :0MMMMMMk.     cKXXXXXXXX0.  .NMMM
-MMN.  'Kd  kMMMMMM'       .OXXXXXXXXXXXXX0. 'XMMMMMMMN        'KXXXXXXXX0.  .WMM
-MW.  .K0  xMMMMMMMd        .KXXXXXXXXXXXK' ;WMMMMMMMMM:        'KXXXXXXXX0.  ;MM
-Mo   OXc .MMMMMMMMMXo:;ckN. dXXXXXXXXXXXd  NMMMMMMMMMMM0l::l0N  dXXXXXXXXXx   xM
-N   :XX, :MMMMMMMMMMMMMMMM; :XXXXXXXXXXX; ,MMMMMMMMMMMMMMMMMMM' :XXXXXXXXXX,  .M
-d   OXX; ,MMMMMMMMMMMMMMMM, :XXXXXXXXXXX: ,MMMMMMMMMMMMMMMMMMM' :XXXXXXXXXXx   O
-,  .XXXx  dxxxxxxxxxxxxxxd  xXXXXXXXXXXXx  dxxxxxxxxxxxxxxxxxd  xXXXXXXXXXXK.  c
-.  :XXXXc'''''''''''''''''':XXXXXXXXXXXXXc'''''''''''''''''''''cXXXXXXXXXXXX,  '
-   lXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:  .
-   lXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX;  .
-.  :XXXXXK0000000000000000000000000000000000000000000000000000KXXXXXXXXXXXXX,  '
-,  .XXXXXk                                                    .KXXXXXXXXXXXK.  c
-x   OXXXXXKKo  ..............................................  lXXXXXXXXXXXx   0
-W.  ;XXXXXXXO  ............................................... .XXXXXXXXXXX'  .M
-Md   kXXXXXXX,  ..............................................  KXXXXXXXXXd   OM
-MM,  .0XXXXXX0. ..............................................  KXXXXXXXXO   cMM
-MMN.  .KXXXXXXk  ............................................  ;XXXXXXXX0.  ,WMM
-MMMX.  .0XXXXXXk  .........................'''............... .0XXXXXXXO.  'WMMM
-MMMMX.  .kXXXXXXO.  .................,cdkO0KKK0Oxo:'........ .kXXXXXXXd   ,WMMMM
-MMMMMW;   cKXXXXXK;  .............'ckKKKKKKKKKKKKKK0x;....  '0XXXXXX0;   cWMMMMM
-MMMMMMMk.  .dXXXXXXx.  ..........:OKKKKKKKKKKKKKKKKKKKo.  .oXXXXXXKl   .0MMMMMMM
-MMMMMMMMNc   .xXXXXXKo.  .......lKKKKKKKKKKKKKKKKKK0o'  .dKXXXXXKd.   lWMMMMMMMM
-MMMMMMMMMMK;   .oKXXXXKd'   ...:KKKKKKKKKKKKKKK0xc'  .:kXXXXXX0l.   cXMMMMMMMMMM
-MMMMMMMMMMMMXc    ;xKXXXX0o,.  .;ldxkkOkkxol:'.  .,lOXXXXXXKd,   .lNMMMMMMMMMMMM
-MMMMMMMMMMMMMMWx,    ,lOXXXXX0xl:,.........';cok0XXXXXXKkl'    ;kWMMMMMMMMMMMMMM
-MMMMMMMMMMMMMMMMMNx,    .'cdOKXXXXXXXXXXXXXXXXXXXXKOd:'     ;kWMMMMMMMMMMMMMMMMM
-MMMMMMMMMMMMMMMMMMMMW0o,      .';:loddxxxxddol:,..     .,o0MMMMMMMMMMMMMMMMMMMMM
-MMMMMMMMMMMMMMMMMMMMMMMMMXko:'.                  .':oONMMMMMMMMMMMMMMMMMMMMMMMMM
-MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMW0dc;'......,:lx0WMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
-                                 ':ox0KXXK0koc'.                                
-                          .;ok000kxollcccclodxOKXKko;.                          
-                      ;d00dc'.                    .;lkXKd;.                     
-                  .o0Oc.     .,codkO0KKKKK0Okxdl;'.    .;dXKo'                  
-               .oKx,    .:d0XXXXXXXXXXXXXXXXXXXXXXXKkl,.   .c0Nd.               
-             ,0O;   .:xKXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXOl'   .oN0;             
-           ;Kx.   ;xKXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX0l.   :KX:           
-         ,Kx.  .lKXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXk,   ;XX,         
-        k0.  .oKXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXO,   oWO.       
-      ,No   :KXX0Okk0XXXXXXXXXXXXXXXXXXXXXXXXXXXK0Okk0KXXXXXXXXXXXk.  .KW;      
-     cN,  .kKl'  ...  'l0XXXXXXXXXXXXXXXXXXXXk:.  ...  .;dKXXXXXXXXK:   kMo     
-    oN.  '0d. c0WMMWo    ;0XXXXXXXXXXXXXXXKo. 'dKWMMMX,   .cKXXXXXXXXo   xMd    
-   lW.  'Kl .KMMMMM:       xXXXXXXXXXXXXX0' ,KMMMMMMM.      .OXXXXXXXXx   xMd   
-  ;M;  .Kd .NMMMMMMl        kXXXXXXXXXXXK. lMMMMMMMMM.       .OXXXXXXXXd   0M:  
-  Nx   0X. dMMMMMMMMk;..;dl 'XXXXXXXXXXXc 'MMMMMMMMMMWd,..:Oc ,XXXXXXXXX:  .WW. 
- dW.  lXK  KMMMMMMMMMMMMMMK  KXXXXXXXXXX. dMMMMMMMMMMMMMMMMM0  KXXXXXXXXK.  dMk 
- Wx   KXK  0MMMMMMMMMMMMMMK  KXXXXXXXXXX. xMMMMMMMMMMMMMMMMM0  KXXXXXXXXXc  .MM.
-:M;  ;XXX; ,xxxxxxxxxxxxxx: 'XXXXXXXXXXXc 'xxxxxxxxxxxxxxxxx; ,XXXXXXXXXXO   KMl
-xM.  oXXX0,,,,,,,,,,,,,,,,,,kXXXXXXXXXXXK;,,,,,,,,,,,,,,,,,,,,OXXXXXXXXXXX.  xMO
-0M   xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.  oMK
-0M   dXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.  oMK
-xM.  lXXXXXkdddddddddddddddddddddddddddddddddddddddddddddddddKXXXXXXXXXXXK   kMk
-:Mc  'XXXXXc'.                                               :XXXXXXXXXXXx   XMc
- W0   OXXXXXX0  ............................................  OXXXXXXXXXX;  ,MM.
- oM'  ,XXXXXXX, ............................................  oXXXXXXXXXO   0Mx 
-  NK   dXXXXXXO  ...........................................  lXXXXXXXXK.  ;MN. 
-  ,Md   kXXXXXXd  ..........................................  xXXXXXXXX;  .NM;  
-   cMl   kXXXXXXo  ......................................... .KXXXXXXK;  .XMl   
-    lMl   dXXXXXXd  ..................':lodxxdol:'......... .0XXXXXXK'  .XMo    
-     :Wx   :KXXXXXk. ..............,lkKKKKKKKKKKKKkc'....  .0XXXXXXk.  'NMc     
-      .XK.  .xXXXXXK:  ..........'oKKKKKKKKKKKKKKKKK0l..  lKXXXXX0;   oMN'      
-        dWo   .xXXXXXO;  .......,OKKKKKKKKKKKKKKKKKkc. .c0XXXXX0c   'KMx        
-         .0Nc   .oKXXXXO:.  ...'0KKKKKKKKKKKKKK0d:.  ,xKXXXXXO:   .OM0'         
-           ,0No.   ;xKXXXKx:.  .;ldxkOOkkxol;'.  'cxKXXXXX0l.   ,OMK;           
-             'kWk,    ,o0XXXXKko:,.........,:ldOKXXXXXKkc.   .lXMO,             
-               .cKNx;    .,cxOKXXXXXXXXXXXXXXXXXXKko:.    .lKMKl.               
-                  .cOWKd;.     ..,;cllooollc:;'.      'ckNM0c.                  
-                      'lONW0xl;..              .,:okXMNOo,                      
-                          .,cdOXWMWNXKK00KKXNMMWXOdc,.                          
-                                 .,cokO00Okdc,.
-
-
-
-
-bdisk
-\d \t
-\4
-\4{tun0}
-https://bdisk.square-r00t.net/

extra/pre-build.d/etc/locale.conf

@@ -1,14 +1,14 @@
 LANG=en_US.UTF-8
-LC_CTYPE="en_US.UTF-8"
+#LC_CTYPE="en_US.UTF-8"
-LC_NUMERIC="en_US.UTF-8"
+#LC_NUMERIC="en_US.UTF-8"
-LC_TIME="en_US.UTF-8"
+#LC_TIME="en_US.UTF-8"
-LC_COLLATE="en_US.UTF-8"
+#LC_COLLATE="en_US.UTF-8"
-LC_MONETARY="en_US.UTF-8"
+#LC_MONETARY="en_US.UTF-8"
-LC_MESSAGES="en_US.UTF-8"
+#LC_MESSAGES="en_US.UTF-8"
-LC_PAPER="en_US.UTF-8"
+#LC_PAPER="en_US.UTF-8"
-LC_NAME="en_US.UTF-8"
+#LC_NAME="en_US.UTF-8"
-LC_ADDRESS="en_US.UTF-8"
+#LC_ADDRESS="en_US.UTF-8"
-LC_TELEPHONE="en_US.UTF-8"
+#LC_TELEPHONE="en_US.UTF-8"
-LC_MEASUREMENT="en_US.UTF-8"
+#LC_MEASUREMENT="en_US.UTF-8"
-LC_IDENTIFICATION="en_US.UTF-8"
+#LC_IDENTIFICATION="en_US.UTF-8"
-LC_ALL=
+#LC_ALL=

extra/pre-build.d/etc/motd

@@ -1,40 +1 @@
-                                 ':ox0KXXK0koc'.
+((Generated by BDisk. https://bdisk.square-r00t.net/))
-                          .;ok000kxollcccclodxOKXKko;.
-                      ;d00dc'.                    .;lkXKd;.
-                  .o0Oc.     .,codkO0KKKKK0Okxdl;'.    .;dXKo'
-               .oKx,    .:d0XXXXXXXXXXXXXXXXXXXXXXXKkl,.   .c0Nd.
-             ,0O;   .:xKXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXOl'   .oN0;
-           ;Kx.   ;xKXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX0l.   :KX:
-         ,Kx.  .lKXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXk,   ;XX,
-        k0.  .oKXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXO,   oWO.
-      ,No   :KXX0Okk0XXXXXXXXXXXXXXXXXXXXXXXXXXXK0Okk0KXXXXXXXXXXXk.  .KW;
-     cN,  .kKl'  ...  'l0XXXXXXXXXXXXXXXXXXXXk:.  ...  .;dKXXXXXXXXK:   kMo
-    oN.  '0d. c0WMMWo    ;0XXXXXXXXXXXXXXXKo. 'dKWMMMX,   .cKXXXXXXXXo   xMd
-   lW.  'Kl .KMMMMM:       xXXXXXXXXXXXXX0' ,KMMMMMMM.      .OXXXXXXXXx   xMd
-  ;M;  .Kd .NMMMMMMl        kXXXXXXXXXXXK. lMMMMMMMMM.       .OXXXXXXXXd   0M:
-  Nx   0X. dMMMMMMMMk;..;dl 'XXXXXXXXXXXc 'MMMMMMMMMMWd,..:Oc ,XXXXXXXXX:  .WW.
- dW.  lXK  KMMMMMMMMMMMMMMK  KXXXXXXXXXX. dMMMMMMMMMMMMMMMMM0  KXXXXXXXXK.  dMk
- Wx   KXK  0MMMMMMMMMMMMMMK  KXXXXXXXXXX. xMMMMMMMMMMMMMMMMM0  KXXXXXXXXXc  .MM.
-:M;  ;XXX; ,xxxxxxxxxxxxxx: 'XXXXXXXXXXXc 'xxxxxxxxxxxxxxxxx; ,XXXXXXXXXXO   KMl
-xM.  oXXX0,,,,,,,,,,,,,,,,,,kXXXXXXXXXXXK;,,,,,,,,,,,,,,,,,,,,OXXXXXXXXXXX.  xMO
-0M   xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.  oMK
-0M   dXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.  oMK
-xM.  lXXXXXkdddddddddddddddddddddddddddddddddddddddddddddddddKXXXXXXXXXXXK   kMk
-:Mc  'XXXXXc'.                                               :XXXXXXXXXXXx   XMc
- W0   OXXXXXX0  ............................................  OXXXXXXXXXX;  ,MM.
- oM'  ,XXXXXXX, ............................................  oXXXXXXXXXO   0Mx
-  NK   dXXXXXXO  ...........................................  lXXXXXXXXK.  ;MN.
-  ,Md   kXXXXXXd  ..........................................  xXXXXXXXX;  .NM;
-   cMl   kXXXXXXo  ......................................... .KXXXXXXK;  .XMl
-    lMl   dXXXXXXd  ..................':lodxxdol:'......... .0XXXXXXK'  .XMo
-     :Wx   :KXXXXXk. ..............,lkKKKKKKKKKKKKkc'....  .0XXXXXXk.  'NMc
-      .XK.  .xXXXXXK:  ..........'oKKKKKKKKKKKKKKKKK0l..  lKXXXXX0;   oMN'
-        dWo   .xXXXXXO;  .......,OKKKKKKKKKKKKKKKKKkc. .c0XXXXX0c   'KMx
-         .0Nc   .oKXXXXO:.  ...'0KKKKKKKKKKKKKK0d:.  ,xKXXXXXO:   .OM0'
-           ,0No.   ;xKXXXKx:.  .;ldxkOOkkxol;'.  'cxKXXXXX0l.   ,OMK;
-             'kWk,    ,o0XXXXKko:,.........,:ldOKXXXXXKkc.   .lXMO,
-               .cKNx;    .,cxOKXXXXXXXXXXXXXXXXXXKko:.    .lKMKl.
-                  .cOWKd;.     ..,;cllooollc:;'.      'ckNM0c.
-                      'lONW0xl;..              .,:okXMNOo,
-                          .,cdOXWMWNXKK00KKXNMMWXOdc,.
-                                 .,cokO00Okdc,.

extra/pre-build.d/etc/systemd/scripts/livecd.fix.sh

@@ -1,5 +1,7 @@
 #/bin/sh -
 
+locale-gen
+
 #chmod 4755 /opt/google/chrome-beta/chrome-sandbox
 chmod 4755 /usr/bin/sudo
 
@@ -20,7 +22,7 @@ do
 done
 
 function fuck_you_gimme_net() {
-IFACE=$(ifconfig -a -s | egrep -E '^((en|wl)p?|em)' | awk '{print $1}' | tr '\n' ' ' | sed -e 's/\ $//g')
+IFACE=$(ip -o link | awk '{print $2}' | egrep -E '^((en|wl)p?|em)' | sed -e 's/:$//g' | head -n1)
 for i in ${IFACE};
 do
 
@@ -39,15 +41,15 @@ do
    DEV='wireless-open'
   fi
 
- ifconfig ${i} down
+ ip link set dev ${i} down
  cp -a /etc/netctl/examples/${DEV} /etc/netctl/${i}
  sed -i -re "s/^([[:space:]]*Interface[[:space:]]*=).*/\1${i}/g" /etc/netctl/${i}
  if [ "${DEV}" == "wireless-open" ];
  then
-  ifconfig ${i} up && \
+  ip link set dev ${i} up && \
   ESSID=$(iwlist ${i} scanning | egrep -A5 -B5 '^[[:space:]]*Encryption key:off' | egrep '^[[:space:]]*ESSID:' | sed -re 's/^[[:space:]]*ESSID:(.*)/\1/g')
   sed -i -re "s/^([[:space:]]*ESSID[[:space:]]*=).*/\1${ESSID}/g" /etc/netctl/${i}
-  ifconfig ${i} down
+  ip link set ${i} down
  fi
  netctl restart ${i} > /dev/null 2>&1
  #cat /etc/resolvconf.conf.failover > /etc/resolvconf.conf

extra/pre-build.d/root/packages.both

@@ -14,13 +14,15 @@ atop
 autopsy
 autossh
 backuppc
-#bacula ## TODO: grab all the bacula packages in here
+## TODO: grab all the bacula packages in here
+#bacula 
 beep
 bin86
 bind-tools
 binutils
 bluez-utils
-bonnie++ ## TODO: ugh. apacman has a new "regex mode"... that you can't disable. https://github.com/oshazard/apacman/issues/79
+## TODO: ugh. apacman has a new "regex mode"... that you can't disable. https://github.com/oshazard/apacman/issues/79
+#bonnie++ 
 boxbackup-client
 boxbackup-server
 bozocrack-git
@@ -55,13 +57,15 @@ dd_rescue
 dd_rhelp
 debianutils
 debootstrap
-#dialog #giving a weird dependency issue
+## giving a weird dependency issue
+#dialog 
 diffutils
 djohn
 dmidecode
 dnssec-anchors
 dnstracer
-#dnsutils #replaced by bind-tools, https://www.archlinux.org/packages/extra/x86_64/bind-tools/
+## replaced by bind-tools, https://www.archlinux.org/packages/extra/x86_64/bind-tools/
+#dnsutils 
 dos2unix
 dropbear
 dstat
@@ -145,14 +149,17 @@ keyutils
 kismet-allplugins
 lftp
 links
-#logkeys-git # requires a /dev/input, which apparently isn't included in the chroots
+## requires a /dev/input, which apparently isn't included in the chroots
+#logkeys-git 
 lm_sensors
 lrzsz
 lshw
-#lsiutil # giving intermittent errors when trying to fetch source
+## giving intermittent errors when trying to fetch source
+#lsiutil 
 lsof
 lsscsi
-#lxde # apacman currently doesn't like package groups, so...
+## apacman currently doesn't like package groups, so...
+#lxde 
 gpicview
 lxappearance
 lxappearance-obconf
@@ -173,21 +180,23 @@ pcmanfm
 lynx
 #lzip
 macchanger
-#magicrescue # no longer maintained, upstream down
+## no longer maintained, upstream down
+#magicrescue 
 mbr
 mbuffer
 mcelog
 mdadm
 mdcrack
-# superseded by storcli
+## superseded by storcli
 #megaraid-cli
 memtester
 mfoc
 minicom
-#mondo # mindi-busybox fails to build 09.23.2016
+## mindi-busybox fails to build 09.23.2016
+#mondo 
 mtd-utils
 mtr
-mtree
+mtree-git
 multipath-tools
 myrescue
 nbd
@@ -198,13 +207,14 @@ net-snmp
 netselect
 nettle
 networkmanager-pptp
-nginx-devel
+nginx-mainline
 ngrep
 nmap
 nmon
 ntfs-3g
 ntfsfixboot
-#nwipe #broken since they moved to github(?)
+## broken since they moved to github(?)
+#nwipe 
 nwipe-git
 obnam
 open-iscsi
@@ -273,13 +283,15 @@ smartmontools
 smbclient
 s-nail
 socat
-#star ## do people even USE tape backups anymore?
+## do people even USE tape backups anymore?
+#star 
 storcli
 strace
 stress
 sucrack
 symlinks
 sysstat
+systemd-sysvcompat
 tcpdump
 tcpslice
 tcptraceroute
@@ -316,7 +328,8 @@ vncrack
 vnstat
 vpnc
 weplab
-#whdd #currently depends on dialog, which is broke as shit
+## currently depends on dialog, which is broke as shit
+#whdd 
 whois
 wifite-mod-pixiewps-git
 wipe

extra/pre-build.d/root/packages.both.FULL

@@ -14,13 +14,15 @@ atop
 autopsy
 autossh
 backuppc
-#bacula ## TODO: grab all the bacula packages in here
+## TODO: grab all the bacula packages in here
+#bacula 
 beep
 bin86
 bind-tools
 binutils
 bluez-utils
-bonnie++ ## TODO: ugh. apacman has a new "regex mode"... that you can't disable. https://github.com/oshazard/apacman/issues/79
+## TODO: ugh. apacman has a new "regex mode"... that you can't disable. https://github.com/oshazard/apacman/issues/79
+#bonnie++ 
 boxbackup-client
 boxbackup-server
 bozocrack-git
@@ -55,13 +57,15 @@ dd_rescue
 dd_rhelp
 debianutils
 debootstrap
-#dialog #giving a weird dependency issue
+## giving a weird dependency issue
+#dialog 
 diffutils
 djohn
 dmidecode
 dnssec-anchors
 dnstracer
-#dnsutils #replaced by bind-tools, https://www.archlinux.org/packages/extra/x86_64/bind-tools/
+## replaced by bind-tools, https://www.archlinux.org/packages/extra/x86_64/bind-tools/
+#dnsutils 
 dos2unix
 dropbear
 dstat
@@ -145,14 +149,17 @@ keyutils
 kismet-allplugins
 lftp
 links
-#logkeys-git # requires a /dev/input, which apparently isn't included in the chroots
+## requires a /dev/input, which apparently isn't included in the chroots
+#logkeys-git 
 lm_sensors
 lrzsz
 lshw
-#lsiutil # giving intermittent errors when trying to fetch source
+## giving intermittent errors when trying to fetch source
+#lsiutil 
 lsof
 lsscsi
-#lxde # apacman currently doesn't like package groups, so...
+## apacman currently doesn't like package groups, so...
+#lxde 
 gpicview
 lxappearance
 lxappearance-obconf
@@ -173,21 +180,23 @@ pcmanfm
 lynx
 #lzip
 macchanger
-#magicrescue # no longer maintained, upstream down
+## no longer maintained, upstream down
+#magicrescue 
 mbr
 mbuffer
 mcelog
 mdadm
 mdcrack
-# superseded by storcli
+## superseded by storcli
 #megaraid-cli
 memtester
 mfoc
 minicom
-#mondo # mindi-busybox fails to build 09.23.2016
+## mindi-busybox fails to build 09.23.2016
+#mondo 
 mtd-utils
 mtr
-mtree
+mtree-git
 multipath-tools
 myrescue
 nbd
@@ -198,13 +207,14 @@ net-snmp
 netselect
 nettle
 networkmanager-pptp
-nginx-devel
+nginx-mainline
 ngrep
 nmap
 nmon
 ntfs-3g
 ntfsfixboot
-#nwipe #broken since they moved to github(?)
+## broken since they moved to github(?)
+#nwipe 
 nwipe-git
 obnam
 open-iscsi
@@ -273,13 +283,15 @@ smartmontools
 smbclient
 s-nail
 socat
-#star ## do people even USE tape backups anymore?
+## do people even USE tape backups anymore?
+#star 
 storcli
 strace
 stress
 sucrack
 symlinks
 sysstat
+systemd-sysvcompat
 tcpdump
 tcpslice
 tcptraceroute
@@ -316,7 +328,8 @@ vncrack
 vnstat
 vpnc
 weplab
-#whdd #currently depends on dialog, which is broke as shit
+## currently depends on dialog, which is broke as shit
+#whdd 
 whois
 wifite-mod-pixiewps-git
 wipe

extra/pre-build.d/root/packages.both.SMALL

@@ -1,4 +1,4 @@
 # Commented lines are supported (via a preceding # only).
 # Packages from the AUR can be specified.
 # We need to install all X drivers.
-mtree
+mtree-git

extra/pre-build.d/root/pre-build.sh

@@ -141,7 +141,12 @@ then
 fi
 # Add the regular user
 useradd -m -s /bin/bash -c "${USERCOMMENT}" ${REGUSR}
-usermod -aG users,games,video,audio ${REGUSR}
+usermod -aG users,games,video,audio ${REGUSR}  # TODO: remove this in lieu of $REGUSR_GRPS? these are all kind of required, though, for regular users anyways
+for g in $(echo ${REGUSR_GRPS} | sed 's/,[[:space:]]*/ /g');
+do
+	getent group ${g} > /dev/null 2>&1 || groupadd ${g}
+	usermod -aG ${g} ${REGUSR}
+done
 passwd -d ${REGUSR}
 # Add them to sudoers
 mkdir -p /etc/sudoers.d

extra/templates/VERSION_INFO.txt.j2

@@ -2,5 +2,5 @@ Version:        {{ bdisk['ver'] }}
 Build:          {{ build['buildnum'] }}
 Time:           {{ build['time'] }}
 Machine:        {{ hostname }} ({{ distro }})
-User:           {{ build['user'] }}{% if build['realuser'] is defined and build['realuser'] > 0 %} ({{ build['realuser'] }}){% endif %}
+User:           {{ build['user'] }}{% if build['realuser'] is defined and build['realuser']|length > 0 %} ({{ build['realuser'] }}){% endif %}
 

extra/templates/pre-build.d/etc/hostname.j2

@@ -0,0 +1 @@
+{{ bdisk['uxname']|lower }}.loc.lan

extra/templates/pre-build.d/root/VARS.txt.j2

@@ -4,6 +4,7 @@ export PNAME='{{ bdisk['name'] }}'
 export DISTPUB='{{ bdisk['dev'] }}'
 export DISTDESC='{{ bdisk['desc'] }}'
 export REGUSR='{{ user['username']|lower }}'
+export REGUSR_GRPS='{{ user['groups'] }}'
 export USERCOMMENT='{{ user['name'] }}'
 export REGUSR_PASS='{{ user['password'] }}'
 export ROOT_PASS='{{ bdisk['root_password'] }}'