chore: better compression for sysext images

lib/make-sysext.nix

@@ -46,6 +46,7 @@ runCommand name
 
   }
   ''
+    set -ex -o pipefail
     do_copy () {
       local prefix="$1"
       local drv="$2"
@@ -60,6 +61,25 @@ runCommand name
       destdir="$(dirname -- "$destfile")"
 
       mkdir -pv "$destdir"
+
+      # recursively copy if ending with /
+      if [[ "$destfile" =~ /$ ]]; then
+        basedir="$(dirname -- "$destfile")"
+        chmod -R 755 "$basedir"
+        # remove if exists
+        for f in $srcfile/*; do
+          basename="$(basename -- "$f")"
+          rm -f "$destfile/$basename"
+        done
+        cp -rPv "$srcfile" "$basedir"
+        chmod -R 755 "$basedir"
+        for f in $destfile/*; do
+          patchelf --set-interpreter /lib/ld-linux-x86-64.so.2 $f || true
+          patchelf --set-rpath /usr/lib $f || true
+        done
+        return
+      fi
+
       cp -Pv "$srcfile" "$destfile"
 
       chmod 755 "$destfile"
@@ -79,7 +99,7 @@ runCommand name
 
     pushd $out
     find tree -type d -exec chmod 0755 {} \;
-    mkfs.erofs --all-root $name.raw tree/
+    mkfs.erofs -zlz4hc,12 -C1048576 -Efragments,dedupe,ztailpacking --all-root $name.raw tree/
     veritysetup format --root-hash-file $name.roothash $name.raw $name.verity
     # TODO: pcks7 signature
     # openssl smime -sign -nocerts -noattr -binary -in ${name}.roothash \