Fix status badge

.envrc.recommended

@@ -1,3 +1 @@
-nix_direnv_manual_reload
 use flake
-dotenv_if_exists

.gitignore

@@ -1,11 +1,6 @@
 .env
-.envrc
 .direnv
 .task
-/result
-/target
-/out
-/initrd.gz
+result
 .*.swp
 .*.swo
-.nixos-test-history

.rgignore

@@ -1,3 +0,0 @@
-.direnv
-/result
-/target

.woodpecker/ci.yaml

@@ -6,6 +6,28 @@ when:
 
 steps:
   check:
-    image: docker.io/nixpkgs/nix-flakes:nixos-24.05
+    image: alpine
+    volumes:
+      - nix:/nix
     commands:
+      # install nix
+      - |
+        test -f /nix/installer || wget -O /nix/installer https://github.com/DeterminateSystems/nix-installer/releases/download/v0.18.0/nix-installer-x86_64-linux
+        chmod +x /nix/installer
+        rm -f /nix/receipt.json /nix/nix-installer
+        /nix/installer install linux --init=none --no-confirm
+        . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+
+      # configure nix
+      - |
+        mkdir -p /etc/nix
+        cat <<EOF > /etc/nix/nix.conf
+        sandbox = false
+        experimental-features = nix-command flakes
+        EOF
+
+      # build
+      - nix build .#patos_image
+
+      # check
       - nix flake check

LICENSE

@@ -1,373 +0,0 @@
-Mozilla Public License Version 2.0
-==================================
-
-1. Definitions
---------------
-
-1.1. "Contributor"
-    means each individual or legal entity that creates, contributes to
-    the creation of, or owns Covered Software.
-
-1.2. "Contributor Version"
-    means the combination of the Contributions of others (if any) used
-    by a Contributor and that particular Contributor's Contribution.
-
-1.3. "Contribution"
-    means Covered Software of a particular Contributor.
-
-1.4. "Covered Software"
-    means Source Code Form to which the initial Contributor has attached
-    the notice in Exhibit A, the Executable Form of such Source Code
-    Form, and Modifications of such Source Code Form, in each case
-    including portions thereof.
-
-1.5. "Incompatible With Secondary Licenses"
-    means
-
-    (a) that the initial Contributor has attached the notice described
-        in Exhibit B to the Covered Software; or
-
-    (b) that the Covered Software was made available under the terms of
-        version 1.1 or earlier of the License, but not also under the
-        terms of a Secondary License.
-
-1.6. "Executable Form"
-    means any form of the work other than Source Code Form.
-
-1.7. "Larger Work"
-    means a work that combines Covered Software with other material, in
-    a separate file or files, that is not Covered Software.
-
-1.8. "License"
-    means this document.
-
-1.9. "Licensable"
-    means having the right to grant, to the maximum extent possible,
-    whether at the time of the initial grant or subsequently, any and
-    all of the rights conveyed by this License.
-
-1.10. "Modifications"
-    means any of the following:
-
-    (a) any file in Source Code Form that results from an addition to,
-        deletion from, or modification of the contents of Covered
-        Software; or
-
-    (b) any new file in Source Code Form that contains any Covered
-        Software.
-
-1.11. "Patent Claims" of a Contributor
-    means any patent claim(s), including without limitation, method,
-    process, and apparatus claims, in any patent Licensable by such
-    Contributor that would be infringed, but for the grant of the
-    License, by the making, using, selling, offering for sale, having
-    made, import, or transfer of either its Contributions or its
-    Contributor Version.
-
-1.12. "Secondary License"
-    means either the GNU General Public License, Version 2.0, the GNU
-    Lesser General Public License, Version 2.1, the GNU Affero General
-    Public License, Version 3.0, or any later versions of those
-    licenses.
-
-1.13. "Source Code Form"
-    means the form of the work preferred for making modifications.
-
-1.14. "You" (or "Your")
-    means an individual or a legal entity exercising rights under this
-    License. For legal entities, "You" includes any entity that
-    controls, is controlled by, or is under common control with You. For
-    purposes of this definition, "control" means (a) the power, direct
-    or indirect, to cause the direction or management of such entity,
-    whether by contract or otherwise, or (b) ownership of more than
-    fifty percent (50%) of the outstanding shares or beneficial
-    ownership of such entity.
-
-2. License Grants and Conditions
---------------------------------
-
-2.1. Grants
-
-Each Contributor hereby grants You a world-wide, royalty-free,
-non-exclusive license:
-
-(a) under intellectual property rights (other than patent or trademark)
-    Licensable by such Contributor to use, reproduce, make available,
-    modify, display, perform, distribute, and otherwise exploit its
-    Contributions, either on an unmodified basis, with Modifications, or
-    as part of a Larger Work; and
-
-(b) under Patent Claims of such Contributor to make, use, sell, offer
-    for sale, have made, import, and otherwise transfer either its
-    Contributions or its Contributor Version.
-
-2.2. Effective Date
-
-The licenses granted in Section 2.1 with respect to any Contribution
-become effective for each Contribution on the date the Contributor first
-distributes such Contribution.
-
-2.3. Limitations on Grant Scope
-
-The licenses granted in this Section 2 are the only rights granted under
-this License. No additional rights or licenses will be implied from the
-distribution or licensing of Covered Software under this License.
-Notwithstanding Section 2.1(b) above, no patent license is granted by a
-Contributor:
-
-(a) for any code that a Contributor has removed from Covered Software;
-    or
-
-(b) for infringements caused by: (i) Your and any other third party's
-    modifications of Covered Software, or (ii) the combination of its
-    Contributions with other software (except as part of its Contributor
-    Version); or
-
-(c) under Patent Claims infringed by Covered Software in the absence of
-    its Contributions.
-
-This License does not grant any rights in the trademarks, service marks,
-or logos of any Contributor (except as may be necessary to comply with
-the notice requirements in Section 3.4).
-
-2.4. Subsequent Licenses
-
-No Contributor makes additional grants as a result of Your choice to
-distribute the Covered Software under a subsequent version of this
-License (see Section 10.2) or under the terms of a Secondary License (if
-permitted under the terms of Section 3.3).
-
-2.5. Representation
-
-Each Contributor represents that the Contributor believes its
-Contributions are its original creation(s) or it has sufficient rights
-to grant the rights to its Contributions conveyed by this License.
-
-2.6. Fair Use
-
-This License is not intended to limit any rights You have under
-applicable copyright doctrines of fair use, fair dealing, or other
-equivalents.
-
-2.7. Conditions
-
-Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
-in Section 2.1.
-
-3. Responsibilities
--------------------
-
-3.1. Distribution of Source Form
-
-All distribution of Covered Software in Source Code Form, including any
-Modifications that You create or to which You contribute, must be under
-the terms of this License. You must inform recipients that the Source
-Code Form of the Covered Software is governed by the terms of this
-License, and how they can obtain a copy of this License. You may not
-attempt to alter or restrict the recipients' rights in the Source Code
-Form.
-
-3.2. Distribution of Executable Form
-
-If You distribute Covered Software in Executable Form then:
-
-(a) such Covered Software must also be made available in Source Code
-    Form, as described in Section 3.1, and You must inform recipients of
-    the Executable Form how they can obtain a copy of such Source Code
-    Form by reasonable means in a timely manner, at a charge no more
-    than the cost of distribution to the recipient; and
-
-(b) You may distribute such Executable Form under the terms of this
-    License, or sublicense it under different terms, provided that the
-    license for the Executable Form does not attempt to limit or alter
-    the recipients' rights in the Source Code Form under this License.
-
-3.3. Distribution of a Larger Work
-
-You may create and distribute a Larger Work under terms of Your choice,
-provided that You also comply with the requirements of this License for
-the Covered Software. If the Larger Work is a combination of Covered
-Software with a work governed by one or more Secondary Licenses, and the
-Covered Software is not Incompatible With Secondary Licenses, this
-License permits You to additionally distribute such Covered Software
-under the terms of such Secondary License(s), so that the recipient of
-the Larger Work may, at their option, further distribute the Covered
-Software under the terms of either this License or such Secondary
-License(s).
-
-3.4. Notices
-
-You may not remove or alter the substance of any license notices
-(including copyright notices, patent notices, disclaimers of warranty,
-or limitations of liability) contained within the Source Code Form of
-the Covered Software, except that You may alter any license notices to
-the extent required to remedy known factual inaccuracies.
-
-3.5. Application of Additional Terms
-
-You may choose to offer, and to charge a fee for, warranty, support,
-indemnity or liability obligations to one or more recipients of Covered
-Software. However, You may do so only on Your own behalf, and not on
-behalf of any Contributor. You must make it absolutely clear that any
-such warranty, support, indemnity, or liability obligation is offered by
-You alone, and You hereby agree to indemnify every Contributor for any
-liability incurred by such Contributor as a result of warranty, support,
-indemnity or liability terms You offer. You may include additional
-disclaimers of warranty and limitations of liability specific to any
-jurisdiction.
-
-4. Inability to Comply Due to Statute or Regulation
----------------------------------------------------
-
-If it is impossible for You to comply with any of the terms of this
-License with respect to some or all of the Covered Software due to
-statute, judicial order, or regulation then You must: (a) comply with
-the terms of this License to the maximum extent possible; and (b)
-describe the limitations and the code they affect. Such description must
-be placed in a text file included with all distributions of the Covered
-Software under this License. Except to the extent prohibited by statute
-or regulation, such description must be sufficiently detailed for a
-recipient of ordinary skill to be able to understand it.
-
-5. Termination
---------------
-
-5.1. The rights granted under this License will terminate automatically
-if You fail to comply with any of its terms. However, if You become
-compliant, then the rights granted under this License from a particular
-Contributor are reinstated (a) provisionally, unless and until such
-Contributor explicitly and finally terminates Your grants, and (b) on an
-ongoing basis, if such Contributor fails to notify You of the
-non-compliance by some reasonable means prior to 60 days after You have
-come back into compliance. Moreover, Your grants from a particular
-Contributor are reinstated on an ongoing basis if such Contributor
-notifies You of the non-compliance by some reasonable means, this is the
-first time You have received notice of non-compliance with this License
-from such Contributor, and You become compliant prior to 30 days after
-Your receipt of the notice.
-
-5.2. If You initiate litigation against any entity by asserting a patent
-infringement claim (excluding declaratory judgment actions,
-counter-claims, and cross-claims) alleging that a Contributor Version
-directly or indirectly infringes any patent, then the rights granted to
-You by any and all Contributors for the Covered Software under Section
-2.1 of this License shall terminate.
-
-5.3. In the event of termination under Sections 5.1 or 5.2 above, all
-end user license agreements (excluding distributors and resellers) which
-have been validly granted by You or Your distributors under this License
-prior to termination shall survive termination.
-
-************************************************************************
-*                                                                      *
-*  6. Disclaimer of Warranty                                           *
-*  -------------------------                                           *
-*                                                                      *
-*  Covered Software is provided under this License on an "as is"       *
-*  basis, without warranty of any kind, either expressed, implied, or  *
-*  statutory, including, without limitation, warranties that the       *
-*  Covered Software is free of defects, merchantable, fit for a        *
-*  particular purpose or non-infringing. The entire risk as to the     *
-*  quality and performance of the Covered Software is with You.        *
-*  Should any Covered Software prove defective in any respect, You     *
-*  (not any Contributor) assume the cost of any necessary servicing,   *
-*  repair, or correction. This disclaimer of warranty constitutes an   *
-*  essential part of this License. No use of any Covered Software is   *
-*  authorized under this License except under this disclaimer.         *
-*                                                                      *
-************************************************************************
-
-************************************************************************
-*                                                                      *
-*  7. Limitation of Liability                                          *
-*  --------------------------                                          *
-*                                                                      *
-*  Under no circumstances and under no legal theory, whether tort      *
-*  (including negligence), contract, or otherwise, shall any           *
-*  Contributor, or anyone who distributes Covered Software as          *
-*  permitted above, be liable to You for any direct, indirect,         *
-*  special, incidental, or consequential damages of any character      *
-*  including, without limitation, damages for lost profits, loss of    *
-*  goodwill, work stoppage, computer failure or malfunction, or any    *
-*  and all other commercial damages or losses, even if such party      *
-*  shall have been informed of the possibility of such damages. This   *
-*  limitation of liability shall not apply to liability for death or   *
-*  personal injury resulting from such party's negligence to the       *
-*  extent applicable law prohibits such limitation. Some               *
-*  jurisdictions do not allow the exclusion or limitation of           *
-*  incidental or consequential damages, so this exclusion and          *
-*  limitation may not apply to You.                                    *
-*                                                                      *
-************************************************************************
-
-8. Litigation
--------------
-
-Any litigation relating to this License may be brought only in the
-courts of a jurisdiction where the defendant maintains its principal
-place of business and such litigation shall be governed by laws of that
-jurisdiction, without reference to its conflict-of-law provisions.
-Nothing in this Section shall prevent a party's ability to bring
-cross-claims or counter-claims.
-
-9. Miscellaneous
-----------------
-
-This License represents the complete agreement concerning the subject
-matter hereof. If any provision of this License is held to be
-unenforceable, such provision shall be reformed only to the extent
-necessary to make it enforceable. Any law or regulation which provides
-that the language of a contract shall be construed against the drafter
-shall not be used to construe this License against a Contributor.
-
-10. Versions of the License
----------------------------
-
-10.1. New Versions
-
-Mozilla Foundation is the license steward. Except as provided in Section
-10.3, no one other than the license steward has the right to modify or
-publish new versions of this License. Each version will be given a
-distinguishing version number.
-
-10.2. Effect of New Versions
-
-You may distribute the Covered Software under the terms of the version
-of the License under which You originally received the Covered Software,
-or under the terms of any subsequent version published by the license
-steward.
-
-10.3. Modified Versions
-
-If you create software not governed by this License, and you want to
-create a new license for such software, you may create and use a
-modified version of this License if you rename the license and remove
-any references to the name of the license steward (except to note that
-such modified license differs from this License).
-
-10.4. Distributing Source Code Form that is Incompatible With Secondary
-Licenses
-
-If You choose to distribute Source Code Form that is Incompatible With
-Secondary Licenses under the terms of this version of the License, the
-notice described in Exhibit B of this License must be attached.
-
-Exhibit A - Source Code Form License Notice
--------------------------------------------
-
-  This Source Code Form is subject to the terms of the Mozilla Public
-  License, v. 2.0. If a copy of the MPL was not distributed with this
-  file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-If it is not possible or desirable to put the notice in a particular
-file, then You may include the notice in a location (such as a LICENSE
-file in a relevant directory) where a recipient would be likely to look
-for such a notice.
-
-You may add additional accurate notices of copyright ownership.
-
-Exhibit B - "Incompatible With Secondary Licenses" Notice
----------------------------------------------------------
-
-  This Source Code Form is "Incompatible With Secondary Licenses", as
-  defined by the Mozilla Public License, v. 2.0.

README.adoc

@@ -1,60 +0,0 @@
-:showtitle:
-:toc: left
-:icons: font
-
-= PatOS - Patagia OS
-
-[link=https://ci.patagia.dev/repos/2,window=_blank]
-image::https://ci.patagia.dev/api/badges/2/status.svg[Build Status]
-
-PatOS is a minimal, immutable Linux distribution specialized for the Patagia Platform.
-
-== Features
-
-* Immutable read-only system
-* Trust chain verification using secure boot and dm-verity
-* Automatic updates and unattended rollbacks
-* Host/TPM bound data encryption by default
-
-== Roadmap and status
-
-[cols="3,1",options="header"]
-|===
-|Feature |Status
-
-| A/B root partitions with discoverable partitions
-| ✅
-
-| Verity protection of root partitions
-| ✅
-
-| Encrypted state partition with tpm2 host binding
-| ✅
-
-| Factory reset / clearing of state partition
-| ✅
-
-| Automatic updates
-| ⚠️
-
-| Installer
-| ❌
-
-| Machine registration and provisioning
-| ❌
-
-| Boot assessment w/automatic rollback
-| ❌
-
-|===
-
-== Community
-
-* Source code: https://patagia.dev/Patagia/patos
-
-
-== License
-
-Copyright (C) 2024 Patagia AB
-
-Unless otherwise noted, all components are licenced under the Mozilla Public License Version 2.0.

README.md

@@ -0,0 +1,5 @@
+# PatOS - Patagia OS
+
+[![status-badge](https://ci.patagia.dev/api/badges/2/status.svg)](https://ci.patagia.dev/repos/2)
+
+PatOS is a minimal, immutable Linux distribution specialized for the Patagia Platform.

dbus-broker/default.nix

@@ -1,165 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  pkgs,
-  ...
-}:
-
-let
-  meta = {
-    maintainers = with lib.maintainers; [ peterhoeg ];
-    platforms = lib.platforms.linux;
-  };
-
-  dep =
-    {
-      pname,
-      version,
-      hash,
-      rev ? "v${version}",
-      buildInputs ? [ ],
-    }:
-    stdenv.mkDerivation {
-      inherit pname version;
-      src = fetchFromGitHub {
-        owner = "c-util";
-        repo = pname;
-        inherit hash rev;
-      };
-      nativeBuildInputs = with pkgs; [
-        meson
-        ninja
-        pkg-config
-      ];
-      inherit buildInputs;
-      meta = meta // {
-        description = "The C-Util Project is a collection of utility libraries for the C11 language.";
-        homepage = "https://c-util.github.io/";
-        license = [
-          lib.licenses.asl20
-          lib.licenses.lgpl21Plus
-        ];
-      };
-    };
-
-  # These libraries are not used outside of dbus-broker.
-  #
-  # If that changes, we can always break them out, but they are essentially
-  # part of the dbus-broker project, just in separate repositories.
-  c-dvar = dep {
-    pname = "c-dvar";
-    version = "1.1.0";
-    hash = "sha256-p/C+BktclVseCtZJ1Q/YK03vP2ClnYRLB1Vmj2OQJD4=";
-    buildInputs = [
-      c-stdaux
-      c-utf8
-    ];
-  };
-  c-ini = dep {
-    pname = "c-ini";
-    version = "1.1.0";
-    hash = "sha256-wa7aNl20hkb/83c4AkQ/0YFDdmBs4XGW+WLUtBWIC98=";
-    buildInputs = [
-      c-list
-      c-rbtree
-      c-stdaux
-      c-utf8
-    ];
-  };
-  c-list = dep {
-    pname = "c-list";
-    version = "3.1.0";
-    hash = "sha256-fp3EAqcbFCLaT2EstLSzwP2X13pi2EFpFAullhoCtpw=";
-  };
-  c-rbtree = dep {
-    pname = "c-rbtree";
-    version = "3.2.0";
-    hash = "sha256-dTMeawhPLRtHvMXfXCrT5iCdoh7qS3v+raC6c+t+X38=";
-    buildInputs = [ c-stdaux ];
-  };
-  c-shquote = dep {
-    pname = "c-shquote";
-    version = "1.1.0";
-    hash = "sha256-z6hpQ/kpCYAngMNfxLkfsxaGtvP4yBMigX1lGpIIzMQ=";
-    buildInputs = [ c-stdaux ];
-  };
-  c-stdaux = dep {
-    pname = "c-stdaux";
-    version = "1.5.0";
-    hash = "sha256-MsnuEyVCmOIr/q6I1qyPsNXp48jxIEcXoYLHbOAZtW0=";
-  };
-  c-utf8 = dep {
-    pname = "c-utf8";
-    version = "1.1.0";
-    hash = "sha256-9vBYylbt1ypJwIAQJd/oiAueh+4VYcn/KzofQuhUea0=";
-    buildInputs = [ c-stdaux ];
-  };
-
-in
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "dbus-broker";
-  version = "36";
-
-  src = fetchFromGitHub {
-    owner = "bus1";
-    repo = "dbus-broker";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-5dAMKjybqrHG57vArbtWEPR/svSj2ION75JrjvnnpVM=";
-  };
-
-  nativeBuildInputs = with pkgs; [
-    docutils
-    meson
-    ninja
-    pkg-config
-  ];
-
-  buildInputs = [
-    c-dvar
-    c-ini
-    c-list
-    c-rbtree
-    c-shquote
-    c-stdaux
-    c-utf8
-    pkgs.dbus
-    pkgs.linuxHeaders
-    pkgs.systemd
-  ];
-
-  mesonFlags = [
-    # while we technically support 4.9 and 4.14, the NixOS module will throw an
-    # error when using a kernel that's too old
-    "--prefix=/"
-    "--bindir=/usr/bin"
-    "-D=linux-4-17=true"
-    "-D=system-console-users=gdm,sddm,lightdm"
-  ];
-
-  PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "/usr/lib/systemd/system";
-  PKG_CONFIG_SYSTEMD_SYSTEMDUSERUNITDIR = "/usr/lib/systemd/user";
-  PKG_CONFIG_SYSTEMD_CATALOGDIR = "/usr/lib/systemd/catalog";
-
-  preInstall = ''
-    export DESTDIR=${placeholder "out"}
-  '';
-
-  postInstall = ''
-    mkdir -p $out/usr/share
-    cp -Pr ${pkgs.dbus.out}/share/* $out/usr/share/
-    cp ${pkgs.dbus.out}/etc/systemd/system/dbus.socket $out/usr/lib/systemd/system/
-    find $out/usr/share/ -type d -exec chmod 755 {} \;
-    sed -i 's#/nix/store.*/share#/usr/share#' $out/usr/share/xml/dbus-1/catalog.xml
-    sed -i 's#/nix/store.*/libexec#/usr/bin#' $out/usr/share/dbus-1/system.conf
-  '';
-
-  doCheck = false;
-
-  meta = meta // {
-    description = "Linux D-Bus Message Broker";
-    homepage = "https://github.com/bus1/dbus-broker/wiki";
-    license = lib.licenses.asl20;
-  };
-})

flake.lock

@@ -1,15 +1,64 @@
 {
   "nodes": {
+    "advisory-db": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1727353582,
+        "narHash": "sha256-2csMEEOZhvowVKZNBHk1kMJqk72ZMrPj9LQYCzP6EKs=",
+        "owner": "rustsec",
+        "repo": "advisory-db",
+        "rev": "cb905e6e405834bdff1eb1e20c9b10edb5403889",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rustsec",
+        "repo": "advisory-db",
+        "type": "github"
+      }
+    },
+    "crane": {
+      "locked": {
+        "lastModified": 1727316705,
+        "narHash": "sha256-/mumx8AQ5xFuCJqxCIOFCHTVlxHkMT21idpbgbm/TIE=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "5b03654ce046b5167e7b0bccbd8244cb56c16f0e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "lastModified": 1726560853,
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1726560853,
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
         "type": "github"
       },
       "original": {
@@ -20,24 +69,71 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1739020877,
-        "narHash": "sha256-mIvECo/NNdJJ/bXjNqIh8yeoSjVLAuDuTUzAo7dzs8Y=",
-        "owner": "NixOS",
+        "lastModified": 1728888510,
+        "narHash": "sha256-nsNdSldaAyu6PE3YUA+YQLqUDJh+gRbBooMMekZJwvI=",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "a79cfe0ebd24952b580b1cf08cd906354996d547",
+        "rev": "a3c0b3b21515f74fd2665903d4ce6bc4dc81c77c",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "nixos",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
+    "patagia-agent": {
+      "inputs": {
+        "advisory-db": "advisory-db",
+        "crane": "crane",
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1728144622,
+        "narHash": "sha256-EWH6pJE0HfHdIaelizOWqArgXZ2KJo0tb4EUCnUYQrY=",
+        "ref": "main",
+        "rev": "853f7f81b60ca687685cec3c817b75abbab86077",
+        "revCount": 8,
+        "type": "git",
+        "url": "ssh://git@patagia.dev/patagia/patagia-agent"
+      },
+      "original": {
+        "ref": "main",
+        "type": "git",
+        "url": "ssh://git@patagia.dev/patagia/patagia-agent"
+      }
+    },
     "root": {
       "inputs": {
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "patagia-agent": "patagia-agent"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "patagia-agent",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1727490462,
+        "narHash": "sha256-OrrPiNBiikv9BR464XTT75FzOq7tKAvMbMi7YOKVIeg=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "11a13e50debafae4ae802f1d6b8585101516dd93",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     },
     "systems": {
@@ -54,6 +150,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -3,7 +3,9 @@
 
   inputs = {
     flake-utils.url = "github:numtide/flake-utils";
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    patagia-agent.url = "git+ssh://git@patagia.dev/patagia/patagia-agent?ref=main";
+    patagia-agent.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs =
@@ -11,59 +13,126 @@
       self,
       flake-utils,
       nixpkgs,
+      patagia-agent,
     }:
     flake-utils.lib.eachDefaultSystem (
       system:
       let
-        pkgs = import nixpkgs { inherit system; };
-        patosPkgs = self.packages.${system};
+
+        pkgs = import nixpkgs {
+          inherit system;
+          overlays = [
+            (import ./overlays)
+          ];
+        };
+
+        # Prepare an update package for the system.
+        mkUpdate =
+          nixos:
+          let
+            config = nixos.config;
+          in
+          pkgs.runCommand "update-${config.system.image.version}"
+            {
+              nativeBuildInputs = with pkgs; [
+                erofs-utils
+                zstd
+              ];
+            }
+            ''
+              mkdir -p $out
+              cp ${config.system.build.image}/${config.boot.uki.name}_${config.system.image.version}.store.raw $out/
+
+              zstd -9 ${config.system.build.uki}/${config.system.boot.loader.ukiFile} \
+                -o $out/${config.system.boot.loader.ukiFile}.zst
+
+              zstd -9 ${config.system.build.image}/${config.boot.uki.name}_${config.system.image.version}.store.raw \
+                -o $out/${config.boot.uki.name}_${config.system.image.version}.img.zst
+            '';
+
+        # Prepare a ready-to-boot disk image.
+        mkInstallImage =
+          nixos:
+          let
+            config = nixos.config;
+          in
+          pkgs.runCommand "update-${config.system.image.version}"
+            {
+              nativeBuildInputs = with pkgs; [
+                qemu
+                zstd
+              ];
+            }
+            ''
+              mkdir -p $out
+              cp ${config.system.build.image}/${config.boot.uki.name}_${config.system.image.version}.raw $out/
+              qemu-img convert -f raw -O qcow2 -C ${config.system.build.image}/${config.boot.uki.name}_${config.system.image.version}.raw $out/disk.qcow2
+
+              zstd -9 ${config.system.build.image}/${config.boot.uki.name}_${config.system.image.version}.store.raw \
+                -o $out/${config.boot.uki.name}_${config.system.image.version}.img.zst
+
+              zstd -9 ${config.system.build.uki}/${config.system.boot.loader.ukiFile} \
+                -o $out/${config.system.boot.loader.ukiFile}.zst
+            '';
       in
       {
-        packages = {
-          default = self.packages.${system}.image;
-          image = pkgs.writeShellScriptBin "image" ''
-            set -ex
-            echo "make UKI..."
-
-            mkdir -p patos/efi/boot
-            ${self.packages.${system}.systemd.out}/usr/bin/ukify build \
-            --linux ${self.packages.${system}.kernel.kernel}/bzImage \
-            --initrd ./initrd.gz \
-            --cmdline "console=ttyS0" \
-            -o patos/efi/boot/bootx64.efi
-          '';
-
-          kernel = pkgs.callPackage ./kernel { };
-          glibc = pkgs.callPackage ./glibc { };
-          systemd = pkgs.callPackage ./systemd { };
-          dbus-broker = pkgs.callPackage ./dbus-broker { };
-          rootfs = pkgs.callPackage ./rootfs { inherit patosPkgs; };
-
-          mkinitrd = pkgs.callPackage ./utils/mkinitrd.nix { inherit patosPkgs; };
-          qemu-uefi-tpm = pkgs.callPackage ./utils/qemu-uefi-tpm.nix { };
-        };
-
-        checks = {
-          simple-test = pkgs.runCommand "simple-test" { } ''
-            ${self.packages.${system}.default}/bin/my-program
-            touch $out
-          '';
-        };
-
-        formatter = pkgs.nixpkgs-fmt;
-
-        devShells.default = pkgs.mkShell {
-          buildInputs = with pkgs; [
+        devShell = pkgs.mkShell {
+          packages = with pkgs; [
             erofs-utils
             just
-            nixd
-            nixfmt-rfc-style
-            squashfs-tools-ng
-            self.packages.${system}.qemu-uefi-tpm
-            self.packages.${system}.mkinitrd
+            self.packages.${system}.qemu-efi
           ];
         };
 
+        packages = {
+          default = self.packages.${system}.patos_image;
+          patos_image = mkInstallImage self.nixosConfigurations.${system}.patos;
+          patos_update = mkUpdate self.nixosConfigurations.${system}.patos;
+
+          image = system.build;
+
+          # FIXME: only do for x86_64
+          # A helper script to run the disk images above.
+          qemu-efi = pkgs.writeShellApplication {
+            name = "qemu-efi";
+
+            runtimeInputs = [ pkgs.qemu_kvm ];
+
+            text = ''
+              qemu-system-x86_64 \
+                -smp 4 -m 2048 -machine q35,accel=kvm \
+                -bios ${pkgs.OVMF.fd}/FV/OVMF.fd \
+                -snapshot \
+                -display none \
+                -serial stdio "$@"
+            '';
+          };
+        };
+
+        nixosConfigurations = rec {
+          patos = nixpkgs.lib.nixosSystem {
+            specialArgs.pkgs = pkgs;
+            system = system;
+            modules = [
+              {
+                _module.args = {
+                  inherit patagia-agent;
+                };
+              }
+              ./modules/kernel
+              ./modules/filesystems.nix
+              ./modules/generic.nix
+              ./modules/minimize.nix
+              ./modules/network.nix
+              # ./modules/patagia-agent.nix
+              ./modules/partitions.nix
+              ./modules/system_overrides.nix
+              ./modules/sysupdate.nix
+              ./modules/utils.nix
+            ];
+          };
+        };
+
       }
     );
 }

glibc/default.nix

@@ -1,53 +0,0 @@
-{
-  pkgs,
-  stdenv,
-
-  ...
-}:
-let
-  version = pkgs.glibc.version;
-  src = pkgs.glibc.src;
-  pname = "glibcPatos";
-in
-stdenv.mkDerivation (finalAttrs: {
-  inherit version;
-  inherit src;
-  inherit pname;
-
-  enableParallelBuilding = true;
-  dontPatchShebangs = true;
-
-  configureFlags = [
-    "--prefix=/"
-    "--libdir=/lib"
-    "--bindir=/bin"
-    "--sysconfdir=/etc"
-  ];
-
-  preConfigure =
-    ''
-      export PWD_P=$(type -tP pwd)
-      for i in configure io/ftwtest-sh; do
-          sed -i "$i" -e "s^/bin/pwd^$PWD_P^g"
-      done
-
-      mkdir ../build
-      cd ../build
-
-      configureScript="`pwd`/../$sourceRoot/configure"
-    '';
-
-  nativeBuildInputs = with pkgs; [
-      bison
-      python3Minimal
-  ];
-
-  outputs = [
-    "out"
-  ];
-
-  preInstall = ''
-    export DESTDIR=${placeholder "out"}
-  '';
-
-})

justfile

@@ -13,15 +13,12 @@ build: build-image
 
 # Build PatOS image
 build-image:
-  nix build .#patos
+  nix build .#patos_image
 
-# Build PatOS image (developer mode)
-build-devel-image:
-  nix build .#devel
+# Build PatOS update image
+build-update:
+  nix build .#patos_update
 
 run: build-image
-  qemu-uefi-tpm ./result/*.img
-
-run-devel: build-devel-image
-  qemu-uefi-tpm ./result/*.img
-
+  qemu-efi -hda ./result/disk.qcow2
+  

kernel/default.nix

@@ -1,16 +0,0 @@
-{ pkgs, ... }:
-let
-  version = "6.13.2";
-in
-pkgs.linuxPackagesFor (
-  pkgs.linuxManualConfig {
-    version = "${version}-patos1";
-    modDirVersion = version;
-    src = pkgs.fetchurl {
-      url = "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${version}.tar.xz";
-      hash = "sha256-zfYpgZBru+lwGutzxPn8yAegmEbCiHMWY9YnF+0a5wU=";
-    };
-    configfile = ./generic.config;
-    allowImportFromDerivation = true;
-  }
-)

modules/filesystems.nix

@@ -0,0 +1,44 @@
+{ config, ... }: {
+
+  zramSwap = {
+    enable = true;
+    algorithm = "zstd";
+    memoryPercent = 20;
+  };
+
+  fileSystems = {
+    "/" = {
+      fsType = "tmpfs";
+      options = [
+        "size=20%"
+      ];
+    };
+
+    "/var" =
+      let
+        partConf = config.image.repart.partitions."var".repartConfig;
+      in
+      {
+        device = "/dev/disk/by-partuuid/${partConf.UUID}";
+        fsType = partConf.Format;
+      };
+
+    "/boot" =
+      let
+        partConf = config.image.repart.partitions."esp".repartConfig;
+      in
+      {
+        device = "/dev/disk/by-partuuid/${partConf.UUID}";
+        fsType = partConf.Format;
+      };
+
+    "/nix/store" =
+      let
+        partConf = config.image.repart.partitions."store".repartConfig;
+      in
+      {
+        device = "/dev/disk/by-partlabel/${partConf.Label}";
+        fsType = partConf.Format;
+      };
+  };
+}

modules/generic.nix

@@ -0,0 +1,65 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+{
+
+  boot = {
+    enableContainers = false;
+    initrd.systemd.enable = true;
+    initrd.compressor = "zstd";
+    kernelParams = [
+      "console=ttyS0"
+    ];
+    loader.efi.canTouchEfiVariables = true;
+    loader.grub.enable = false;
+    loader.systemd-boot.enable = true;
+    uki.name = "patos";
+  };
+
+  system.image.version = "0.0.1"; # FIXME: Use epoch version.
+
+  system.nixos = {
+    codeName = "Finn";
+    distroId = "patos";
+    distroName = "PatOS";
+    release = "2024-09";
+  };
+
+  system.switch.enable = false;
+
+  # Make the current system version visible in the prompt.
+  programs.bash.promptInit = ''
+    export PS1="\u@\h (version ${config.system.image.version}) \w $ "
+  '';
+
+  # Not compatible with system.etc.overlay.enable yet.
+  # users.mutableUsers = false;
+
+  services.getty.autologinUser = "root";
+
+  # Temporary files
+  boot.tmp.cleanOnBoot = true;
+  boot.tmp.useTmpfs = true;
+  systemd.services.nix-daemon = {
+    environment.TMPDIR = "/var/tmp";
+  };
+
+  services.journald.extraConfig = ''
+    SystemMaxUse=10M
+  '';
+
+  services.fstrim.enable = true;
+
+  # Debugging
+  environment.systemPackages = with pkgs; [
+    (runCommand "systemd-sysupdate" { } ''
+      mkdir -p $out/bin
+      ln -s ${config.systemd.package}/lib/systemd/systemd-sysupdate $out/bin
+    '')
+  ];
+
+  system.stateVersion = "24.11";
+}

modules/kernel/default.nix

@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  boot.kernelPackages =
+    let
+      version = "6.11.2";
+    in
+    pkgs.linuxPackagesFor (
+      pkgs.linuxManualConfig {
+        version = "${version}-patos1";
+        modDirVersion = version;
+        src = pkgs.fetchurl {
+          url = "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${version}.tar.xz";
+          sha256 = "ec9ef7a0b9cebb55940e1ef87a1f9e1004b10456a119dc386bb3e565b0d39c42";
+        };
+        configfile = ./generic.config;
+        allowImportFromDerivation = true;
+      }
+    );
+}

modules/kernel/generic.config

@@ -1397,6 +1397,14 @@ CONFIG_MMU=y
 CONFIG_MODPROBE_PATH="/sbin/modprobe"
 CONFIG_MODULE_COMPRESS_ZSTD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
+CONFIG_MODULE_SIG_ALL=y
+CONFIG_MODULE_SIG_FORCE=y
+CONFIG_MODULE_SIG_FORMAT=y
+CONFIG_MODULE_SIG_HASH="sha512"
+CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
+CONFIG_MODULE_SIG_KEY_TYPE_RSA=y
+CONFIG_MODULE_SIG_SHA512=y
+CONFIG_MODULE_SIG=y
 CONFIG_MODULE_SRCVERSION_ALL=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULES_TREE_LOOKUP=y

modules/minimize.nix

@@ -0,0 +1,18 @@
+{ modulesPath, ... }:
+{
+  imports = [
+    "${modulesPath}/profiles/minimal.nix"
+  ];
+
+  nix.enable = false;
+  system.disableInstallerTools = true;
+  system.etc.overlay.enable = true;
+  systemd.sysusers.enable = true;
+
+  programs.less.lessopen = null;
+  programs.command-not-found.enable = false;
+
+  environment.defaultPackages = [ ];
+
+  security.sudo.enable = false;
+}

modules/network.nix

@@ -0,0 +1,11 @@
+{ config, ... }: {
+  networking = {
+    useNetworkd = true;
+
+    # Easy debugging.
+    firewall.enable = false;
+  };
+
+  # Faster boot.
+  systemd.network.wait-online.enable = false;
+}

modules/partitions.nix

@@ -0,0 +1,103 @@
+{
+  config,
+  pkgs,
+  lib,
+  modulesPath,
+  ...
+}:
+{
+
+  imports = [
+    "${modulesPath}/image/repart.nix"
+  ];
+
+  image.repart =
+    let
+      efiArch = pkgs.stdenv.hostPlatform.efiArch;
+    in
+    {
+      name = config.boot.uki.name;
+      split = true;
+
+      mkfsOptions = {
+        erofs = [
+          # "-zzstd,6" # Zstd compression
+          # "-zlz4hc,12"
+          "-T0" # Fixed timestamp for all files
+          "-C262144" # 256 KiB cluster size
+          # "-C65536" # 64 KiB cluster size
+          # "-C1048576" # 1 MiB cluster size
+          "-Efragments,dedupe,ztailpacking" # Extra features
+        ];
+      };
+
+      partitions = {
+        "esp" = {
+          contents = {
+            "/EFI/BOOT/BOOT${lib.toUpper efiArch}.EFI".source = "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
+            "/EFI/Linux/${config.system.boot.loader.ukiFile}".source = "${config.system.build.uki}/${config.system.boot.loader.ukiFile}";
+
+            # systemd-boot configuration
+            "/loader/loader.conf".source = (
+              pkgs.writeText "$out" ''
+                timeout 0
+              ''
+              # FIXME: should not be 0 in prod
+            );
+          };
+          repartConfig = {
+            Type = "esp";
+            UUID = "c12a7328-f81f-11d2-ba4b-00a0c93ec93b"; # Well known
+            Format = "vfat";
+            SizeMinBytes = "256M";
+            SplitName = "-";
+          };
+        };
+        "store" = {
+          storePaths = [ config.system.build.toplevel ];
+          stripNixStorePrefix = true;
+          repartConfig = {
+            Type = "linux-generic";
+            Label = "${config.boot.uki.name}_${config.system.image.version}";
+            Format = "erofs";
+            Minimize = "best";
+            ReadOnly = "yes";
+            SizeMinBytes = "1G";
+            SizeMaxBytes = "1G";
+            SplitName = "store";
+          };
+        };
+
+        # Placeholder for the second installed Nix store.
+        "store-empty" = {
+          repartConfig = {
+            Type = "linux-generic";
+            Label = "_empty";
+            Minimize = "off";
+            SizeMinBytes = "1G";
+            SizeMaxBytes = "1G";
+            SplitName = "-";
+          };
+        };
+
+        # Persistent storage
+        "var" = {
+          repartConfig = {
+            Type = "var";
+            UUID = "4d21b016-b534-45c2-a9fb-5c16e091fd2d"; # Well known
+            Format = "xfs";
+            Label = "nixos-persistent";
+            Minimize = "off";
+
+            # Has to be large enough to hold update files.
+            SizeMinBytes = "2G";
+            SizeMaxBytes = "2G";
+            SplitName = "-";
+
+            # Wiping this gives us a clean state.
+            FactoryReset = "yes";
+          };
+        };
+      };
+    };
+}

modules/patagia-agent.nix

@@ -0,0 +1,39 @@
+{
+  pkgs,
+  utils,
+  ...
+}:
+
+{
+
+  system.activationScripts.patagia-agent = ''
+    mkdir -p /var/lib/extensions
+    mkdir -p /etc/systemd/extensions
+  '';
+
+  environment.etc."sysupdate.patagia-agent.d".source =
+    let
+      format = pkgs.formats.ini { listToValue = toString; };
+    in
+    utils.systemdUtils.lib.definitions "sysupdate.patagia-agent.d" format {
+      "10-image.conf" = {
+        Source = {
+          MatchPattern = "patagia-agent_@v.raw";
+          Path = "https://images.dl.patagia.dev/patagia-agent/";
+          Type = "url-file";
+        };
+
+        Target = {
+          InstancesMax = 2;
+          Path = "/var/lib/extensions";
+          CurrentSymlink = "/etc/systemd/extensions/patagia-agent.raw";
+          Type = "regular-file";
+          MatchPattern = "patagia-agent_@v.raw";
+        };
+
+        Transfer = {
+          Verify = "no"; # FIXME: verify
+        };
+      };
+    };
+}

modules/system_overrides.nix

@@ -0,0 +1,5 @@
+{ lib, options, ... }: {
+  # This fields is immutable by default, but can be overridden.
+  options.system.nixos.codeName = lib.mkOption { readOnly = false; };
+  options.system.nixos.release = lib.mkOption { readOnly = false; };
+}

modules/sysupdate.nix

@@ -0,0 +1,96 @@
+{ config, pkgs, ... }:
+let
+  gpgPubKeyStaging = ''
+    -----BEGIN PGP PUBLIC KEY BLOCK-----
+
+    mDMEZvb3mhYJKwYBBAHaRw8BAQdAvyH7AMLukMEF/1as7auAh757//LlO/kBG8pm
+    zhOlTj20LFBhdGFnaWEgU3RhZ2luZyA8bm9yZXBseStzdGFnaW5nQHBhdGFnaWEu
+    aW8+iJQEExYKADwWIQTjWE8tGxWc+3+vxyy1R4V5MjgMzAUCZvb3mgIbAwUJBaOa
+    gAQLCQgHBBUKCQgFFgIDAQACHgUCF4AACgkQtUeFeTI4DMwDWAEAlMAhSZh086Ux
+    OfLBR1QYgHtXmk6tObJurWkZq6cGICwA/2fBOtZcLfAPRWYPLHAtsqtFrO6CIyQG
+    H6n4Iv3D5ZsCuDgEZvb3mhIKKwYBBAGXVQEFAQEHQPKKcltfHlELIHf0AYcd0nOe
+    GaWcAnoW4o3zLZUVNnlpAwEIB4h+BBgWCgAmFiEE41hPLRsVnPt/r8cstUeFeTI4
+    DMwFAmb295oCGwwFCQWjmoAACgkQtUeFeTI4DMzuegEA62XIq4Ir+4DWdTql58bA
+    +0Vr89dMQsAxwVzGGzl8D8wBAMuPY6/2SwbA7KwWuz8L/cTPQVLBt+TSdYeuCBps
+    e5UE
+    =m2st
+    -----END PGP PUBLIC KEY BLOCK-----
+  '';
+  gpgKeyring = pkgs.runCommand "gpg-keyring" { buildInputs = [ pkgs.gnupg ]; } ''
+    mkdir -p $out
+    export GNUPGHOME=$out
+    gpg --no-default-keyring --keyring=$out/import-pubring.gpg --fingerprint
+    gpg --no-default-keyring --keyring=$out/import-pubring.gpg --import <<< '${gpgPubKeyStaging}'
+    rm $out/S.scdaemon $out/S.gpg-agent $out/S.gpg-agent.*
+  '';
+in
+{
+  environment.etc."systemd/import-pubring.gpg".source = "${gpgKeyring}/import-pubring.gpg";
+
+  systemd.additionalUpstreamSystemUnits = [
+    "systemd-sysext.service"
+  ];
+
+  systemd.services."systemd-sysext.service".enable = true;
+
+  systemd.sysupdate = {
+    enable = true;
+
+    transfers = {
+      "10-uki" = {
+        Source = {
+          MatchPattern = [
+            "${config.boot.uki.name}_@v.efi.xz"
+          ];
+
+          Path = "https://images.dl.patagia.dev/patos/";
+          Type = "url-file";
+        };
+        Target = {
+          InstancesMax = 2;
+          MatchPattern = [
+            "${config.boot.uki.name}_@v.efi"
+          ];
+
+          Mode = "0444";
+          Path = "/EFI/Linux";
+          PathRelativeTo = "boot";
+
+          Type = "regular-file";
+        };
+        Transfer = {
+          ProtectVersion = "%A";
+          Verify = "no";
+        };
+      };
+
+      "20-store" = {
+        Source = {
+          MatchPattern = [
+            "${config.boot.uki.name}_@v.img.xz"
+          ];
+          Path = "https://images.dl.patagia.dev/patos/";
+          Type = "url-file";
+        };
+
+        Target = {
+          InstancesMax = 2;
+
+          # This doesn't work, because / is a tmpfs and the heuristic is not that smart.
+          #
+          # Path = "auto";
+          Path = "/dev/sda";
+
+          MatchPattern = "${config.boot.uki.name}_@v";
+
+          Type = "partition";
+          ReadOnly = "yes";
+        };
+        Transfer = {
+          Verify = "no";
+        };
+      };
+
+    };
+  };
+}

modules/utils.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  script = pkgs.writeShellScriptBin "patos-upgrade.sh" ''
+    systemd-sysupdate --verify=no
+    systemd-sysupdate --verify=no update --reboot
+  '';
+in
+{
+  environment.systemPackages = [
+    # pkgs.ncdu
+    script
+  ];
+}

overlays/default.nix

@@ -0,0 +1,19 @@
+final: prev: {
+  # Build mkfs.erofs with zstd support
+  erofs-utils = prev.erofs-utils.overrideAttrs (old: {
+    buildInputs = old.buildInputs ++ [ prev.zstd ];
+    configureFlags = old.configureFlags ++ [
+      "--enable-multithreading"
+      "--enable-zstd"
+    ];
+  });
+
+  util-linux = prev.util-linux.override {
+    ncursesSupport = false;
+    nlsSupport = false;
+  };
+
+  dbus = prev.dbus.override {
+    x11Support = false;
+  };
+}

rootfs/default.nix

@@ -1,30 +0,0 @@
-{
-  pkgs,
-  stdenvNoCC,
-  patosPkgs,
-  ...
-}:
-let
-  version = "0.0.1";
-  pname = "patos-rootfs";
-in
-stdenvNoCC.mkDerivation (finalAttrs: {
-  inherit version;
-  inherit pname;
-
-  buildInputs = with pkgs; [
-    glibc
-    binutils
-  ];
-
-  glibcPatos = patosPkgs.glibc.out;
-  systemd = patosPkgs.systemd.out;
-  dbusBroker = patosPkgs.dbus-broker.out;
-  kernel = patosPkgs.kernel.kernel;
-  busybox = pkgs.busybox.out;
-  kmodLibs = pkgs.kmod.lib;
-  kmodBin = pkgs.kmod.out;
-  libbpf = pkgs.libbpf.out;
-
-  builder = ./mkrootfs.sh;
-})

rootfs/mkrootfs.sh

@@ -1,54 +0,0 @@
-set -ex -o pipefail
-
-mkdir -p $out
-mkdir -p $out/etc $out/dev $out/proc $out/sys $out/tmp $out/root
-ln -sf ../usr/bin $out/bin
-ln -sf ../usr/bin $out/sbin
-ln -sf ../usr/lib $out/lib
-ln -sf ../usr/lib $out/lib64
-ln -sf ../proc/self/mounts $out/etc/mtab
-
-### install systemd
-echo "Installing systemd"
-cp -Pr $systemd/* $out/
-find $out -type d -exec chmod 755 {} \;
-rm -rf $out/usr/include
-rm -rf $out/usr/sbin
-rm -f $out/usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service
-# remove vconsole setup
-rm -f $out/usr/lib/udev/rules.d/90-vconsole.rules
-
-### install PatOS glibc
-cp -P $glibcPatos/lib/*.so* $out/usr/lib/
-
-### install kernel modules
-cp -r $kernel/lib/modules $out/usr/lib/
-find $out/usr/lib/modules -type d -exec chmod 755 {} \;
-
-### install busybox
-cp $busybox/bin/busybox $out/usr/bin/
-$out/usr/bin/busybox --list | xargs -I {} ln -sf busybox $out/usr/bin/{}
-
-### install dbus broker
-cp -r $dbusBroker/* $out/
-
-### install lib kmod
-cp -P $kmodLibs/lib/* $out/usr/lib
-cp -P $kmodBin/bin/* $out/usr/bin
-
-### install libbpf
-cp -P $libbpf/lib/libbpf* $out/usr/lib
-
-### Find and install all shared libs
-find $out -type f -executable -exec ldd {} \; | awk '{print $3}' | grep -v systemd | grep -v glibc | sort -u | xargs cp -t $out/usr/lib
-find $out -type f -executable -exec chmod 755 {} \;
-
-# FIXME: ELF patching. Is there a better way?
-find $out -type f -executable -exec patchelf --set-rpath /lib:/usr/lib:/usr/lib/systemd {} \;
-find $out -type f -executable -exec patchelf --set-interpreter /lib/ld-linux-x86-64.so.2 {} \;
-patchelf --remove-rpath $out/usr/lib/ld-linux-x86-64.so.2
-
-# strip binaries
-find $out -type f -executable -exec strip {} \;
-find $out -type d -exec chmod 755 {} \;
-

systemd/0017-meson.build-do-not-create-systemdstatedir.patch

@@ -1,21 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: nikstur <nikstur@outlook.com>
-Date: Mon, 6 Nov 2023 22:51:38 +0100
-Subject: [PATCH] meson.build: do not create systemdstatedir
-
----
- meson.build | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/meson.build b/meson.build
-index bffda86845..cb5dcec0f9 100644
---- a/meson.build
-+++ b/meson.build
-@@ -2781,7 +2781,6 @@ install_data('LICENSE.GPL2',
- install_subdir('LICENSES',
-                install_dir : docdir)
- 
--install_emptydir(systemdstatedir)
- 
- #####################################################################
- 

systemd/default.nix

@@ -1,324 +0,0 @@
-{
-  fetchFromGitHub,
-  lib,
-  pkgs,
-  stdenv,
-  targetPackages,
-  ...
-}:
-let
-  version = "257.3";
-
-  # Use the command below to update `releaseTimestamp` on every (major) version
-  # change. More details in the commentary at mesonFlags.
-  # command:
-  #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
-  #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
-  releaseTimestamp = "1734643670";
-
-  pname = "systemd";
-in
-stdenv.mkDerivation (finalAttrs: {
-  inherit version;
-
-  pname = pname;
-
-  src = fetchFromGitHub {
-    owner = "systemd";
-    repo = "systemd";
-    rev = "v${version}";
-    hash = "sha256-GvRn55grHWR6M+tA86RMzqinuXNpPZzRB4ApuGN/ZvU=";
-  };
-
-  dontCheckForBrokenSymlinks = true;
-
-  patches = [
-    ./0017-meson.build-do-not-create-systemdstatedir.patch
-  ];
-
-  nativeBuildInputs = with pkgs; [
-    bash
-    pkg-config
-    makeBinaryWrapper
-    gperf
-    ninja
-    meson
-    glibcLocales
-    getent
-    m4
-    autoPatchelfHook
-
-    intltool
-    gettext
-
-    libxslt
-    docbook_xsl
-    docbook_xml_dtd_42
-    docbook_xml_dtd_45
-    bash
-    (buildPackages.python3Packages.python.withPackages (
-      ps: with ps; [
-        lxml
-        jinja2
-        ps.pyelftools
-      ]
-    ))
-
-    bpftools
-    buildPackages.llvmPackages.clang
-    buildPackages.llvmPackages.libllvm
-  ];
-
-  outputs = [
-    "out"
-    "dev"
-  ];
-
-  separateDebugInfo = true;
-
-  autoPatchelfFlags = [ "--keep-libc" ];
-
-  hardeningDisable = [
-    # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111523
-    "trivialautovarinit"
-    # breaks clang -target bpf; should be fixed to filter target?
-    "zerocallusedregs"
-    "shadowstack"
-  ];
-
-  buildInputs = with pkgs; [
-    libxcrypt
-    libcap
-    libuuid
-    linuxHeaders
-    bashInteractive # for patch shebangs
-    libgcrypt
-    libgpg-error
-    openssl
-    acl
-    libapparmor
-    audit
-    zlib
-    bzip2
-    lz4
-    xz
-    zstd
-    elfutils
-    kexec-tools
-    kmod
-    libidn2
-    libseccomp
-    libselinux
-    iptables
-    p11-kit
-    libfido2
-    pam
-    pcre2
-    libbpf
-    tpm2-tss
-    qrencode
-    libarchive
-    (lib.getDev curl)
-    (lib.getDev cryptsetup.dev)
-    (python3Packages.python.withPackages (ps: with ps; [ pefile ]))
-    (llvmPackages.compiler-rt.override {
-      doFakeLibgcc = true;
-    })
-  ];
-
-  mesonBuildType = "release";
-
-  doCheck = false; # fails a bunch of tests
-
-  preConfigure = ''
-    mesonFlagsArray+=(-Dntp-servers="0.europe.pool.ntp.org 1.europe.pool.ntp.org 2.europe.pool.ntp.org 3.europe.pool.ntp.org")
-    export LC_ALL="en_US.UTF-8";
-  '';
-
-  postPatch =
-    ''
-      substituteInPlace meson.build \
-        --replace "find_program('clang'" "find_program('${stdenv.cc.targetPrefix}clang'"
-    ''
-    + ''
-      substituteInPlace src/ukify/ukify.py \
-        --replace \
-        "'readelf'" \
-        "'${targetPackages.stdenv.cc.bintools.targetPrefix}readelf'" \
-        --replace \
-        "/usr/lib/systemd/boot/efi" \
-        "$out/usr/lib/systemd/boot/efi"
-    ''
-    # Finally, patch shebangs in scripts used at build time. This must not patch
-    # scripts that will end up in the output, to avoid build platform references
-    # when cross-compiling.
-    + ''
-      shopt -s extglob
-      patchShebangs tools test src/!(rpm|kernel-install|ukify) src/kernel-install/test-kernel-install.sh
-    '';
-
-  # trigger the test -n "$DESTDIR" || mutate in upstreams build system
-  preInstall = ''
-    export DESTDIR=${placeholder "out"}
-  '';
-
-  mesonFlags = [
-
-    "--prefix=/usr"
-    "--sysconfdir=/etc"
-    "--localstatedir=/var"
-    "--libdir=/usr/lib"
-    "--bindir=/usr/bin"
-    "--includedir=/usr/include"
-    "--localedir=/usr/share/locale"
-
-    # Options
-
-    # We bump this attribute on every (major) version change to ensure that we
-    # have known-good value for a timestamp that is in the (not so distant)
-    # past. This serves as a lower bound for valid system timestamps during
-    # startup. Systemd will reset the system timestamp if this date is +- 15
-    # years from the system time.
-    # See the systemd v250 release notes for further details:
-    #   https://github.com/systemd/systemd/blob/60e930fc3e6eb8a36fbc184773119eb8d2f30364/NEWS#L258-L266
-    (lib.mesonOption "time-epoch" releaseTimestamp)
-
-    (lib.mesonOption "version-tag" version)
-    (lib.mesonOption "mode" "release")
-    (lib.mesonOption "tty-gid" "3") # tty in NixOS has gid 3
-
-    (lib.mesonOption "kmod-path" "/usr/bin/kmod")
-    (lib.mesonOption "debug-shell" "/usr/bin/sh")
-    (lib.mesonOption "pamconfdir" "/etc/pam.d")
-    (lib.mesonOption "shellprofiledir" "/etc/profile.d")
-    (lib.mesonOption "dbuspolicydir" "/usr/share/dbus-1/system.d")
-    (lib.mesonOption "dbussessionservicedir" "/usr/share/dbus-1/services")
-    (lib.mesonOption "dbussystemservicedir" "/usr/share/dbus-1/system-services")
-    (lib.mesonOption "setfont-path" "/usr/bin/setfont")
-    (lib.mesonOption "loadkeys-path" "/usr/bin/loadkeys")
-    (lib.mesonOption "sulogin-path"  "/usr/bin/sulogin")
-    (lib.mesonOption "nologin-path" "/usr/bin/nologin")
-    (lib.mesonOption "mount-path" "/usr/bin/mount")
-    (lib.mesonOption "umount-path" "/usr/bin/umount")
-
-    # SBAT
-    (lib.mesonOption "sbat-distro" "patos")
-    (lib.mesonOption "sbat-distro-summary" "PatOS")
-    (lib.mesonOption "sbat-distro-url" "https://patagia.io/")
-    (lib.mesonOption "sbat-distro-pkgname" pname)
-    (lib.mesonOption "sbat-distro-version" version)
-
-    # Users
-    (lib.mesonOption "system-uid-max" "999")
-    (lib.mesonOption "system-gid-max" "999")
-
-    # SysVinit
-    (lib.mesonOption "sysvinit-path" "")
-    (lib.mesonOption "sysvrcnd-path" "")
-
-    # SSH
-    # Disabled for now until someone makes this work.
-    (lib.mesonOption "sshconfdir" "no")
-    (lib.mesonOption "sshdconfdir" "no")
-
-    # Features
-
-    # Tests
-    (lib.mesonBool "tests" false)
-    (lib.mesonEnable "glib" false)
-    (lib.mesonEnable "dbus" false)
-
-    # Compression
-    (lib.mesonEnable "bzip2" true)
-    (lib.mesonEnable "lz4" true)
-    (lib.mesonEnable "xz" true)
-    (lib.mesonEnable "zstd" true)
-    (lib.mesonEnable "zlib" true)
-
-    # NSS
-    (lib.mesonEnable "nss-resolve" true)
-    (lib.mesonBool "nss-myhostname" true)
-    (lib.mesonBool "nss-systemd" true)
-
-    # Cryptsetup
-    (lib.mesonEnable "libcryptsetup" true)
-    (lib.mesonEnable "libcryptsetup-plugins" true)
-    (lib.mesonEnable "p11kit" true)
-
-    # FIDO2
-    (lib.mesonEnable "libfido2" true)
-    (lib.mesonEnable "openssl" true)
-
-    # Password Quality
-    (lib.mesonEnable "pwquality" false)
-    (lib.mesonEnable "passwdqc" false)
-
-    # Remote
-    (lib.mesonEnable "remote" false)
-    (lib.mesonEnable "microhttpd" false)
-
-    (lib.mesonEnable "pam" false)
-    (lib.mesonEnable "acl" true)
-    (lib.mesonEnable "audit" true)
-    (lib.mesonEnable "apparmor" true)
-    (lib.mesonEnable "gcrypt" true)
-    (lib.mesonEnable "importd" true)
-    (lib.mesonEnable "homed" false)
-    (lib.mesonEnable "polkit" true)
-    (lib.mesonEnable "elfutils" true)
-    (lib.mesonEnable "libcurl" true)
-    (lib.mesonEnable "libidn" false)
-    (lib.mesonEnable "libidn2" true)
-    (lib.mesonEnable "libiptc" true)
-    (lib.mesonEnable "repart" true)
-    (lib.mesonEnable "sysupdate" true)
-    (lib.mesonEnable "sysupdated" true)
-    (lib.mesonEnable "seccomp" true)
-    (lib.mesonEnable "selinux" true)
-    (lib.mesonEnable "tpm2" true)
-    (lib.mesonEnable "pcre2" true)
-    (lib.mesonEnable "bpf-framework" true)
-    (lib.mesonEnable "bootloader" true)
-    (lib.mesonEnable "ukify" true)
-    (lib.mesonEnable "kmod" true)
-    (lib.mesonEnable "qrencode" true)
-    (lib.mesonEnable "vmspawn" false)
-    (lib.mesonEnable "libarchive" true)
-    (lib.mesonEnable "xenctrl" false)
-    (lib.mesonEnable "gnutls" false)
-    (lib.mesonEnable "xkbcommon" false)
-    (lib.mesonEnable "man" false)
-
-    (lib.mesonBool "analyze" true)
-    (lib.mesonBool "logind" true)
-    (lib.mesonBool "localed" false)
-    (lib.mesonBool "hostnamed" true)
-    (lib.mesonBool "machined" true)
-    (lib.mesonBool "networkd" true)
-    (lib.mesonBool "oomd" true)
-    (lib.mesonBool "portabled" true)
-    (lib.mesonBool "hwdb" true)
-    (lib.mesonBool "timedated" true)
-    (lib.mesonBool "timesyncd" true)
-    (lib.mesonBool "userdb" false)
-    (lib.mesonBool "coredump" true)
-    (lib.mesonBool "firstboot" true)
-    (lib.mesonBool "resolve" true)
-    (lib.mesonBool "sysusers" true)
-    (lib.mesonBool "efi" true)
-    (lib.mesonBool "utmp" true)
-    (lib.mesonBool "log-trace" true)
-
-    (lib.mesonBool "kernel-install" true)
-    (lib.mesonBool "quotacheck" false)
-    (lib.mesonBool "ldconfig" false)
-    (lib.mesonBool "install-sysconfdir" true)
-    (lib.mesonBool "create-log-dirs" true)
-    (lib.mesonBool "smack" true)
-    (lib.mesonBool "b_pie" true)
-
-    (lib.mesonOption "bashcompletiondir" "no")
-    (lib.mesonOption "zshcompletiondir" "no")
-  ];
-
-})

utils/mkinitrd.nix

@@ -1,125 +0,0 @@
-{
-  pkgs,
-  patosPkgs,
-  ...
-}:
-pkgs.writeShellApplication {
-  name = "mkinitrd";
-
-  runtimeInputs = with pkgs; [
-    cpio
-    gzip
-  ];
-
-  text = ''
-    echo "Building initram disk"
-    mkdir -p root
-    pushd root
-
-    ### copy rootfs
-    cp -prP ${patosPkgs.rootfs}/* .
-    find . -type d -exec chmod 755 {} \;
-
-    ### create directories
-    ln -sf ../usr/lib/systemd/systemd init
-
-    # set default target to basic
-    mkdir usr/lib/systemd/system/basic.target.wants
-    ln -sf basic.target usr/lib/systemd/system/default.target
-
-    # enable dbus broker
-    ln -sf ../dbus-broker.service usr/lib/systemd/system/basic.target.wants/dbus.service
-    ln -sf ../dbus.socket usr/lib/systemd/system/sockets.target.wants/dbus.socket
-
-    ### Create needed files
-    echo patos > ./etc/hostname
-    cat <<EOF > ./etc/os-release
-    NAME="PatOS"
-    PRETTY_NAME="PatOS Platform"
-    ID=patos
-    EOF
-
-    cat <<EOF > ./etc/passwd
-    root::0:0:root:/root:/bin/sh
-    bin:x:1:1:bin:/bin:/usr/bin/nologin
-    daemon:x:2:2:daemon:/:/usr/bin/nologin
-    mail:x:8:12:mail:/var/spool/mail:/usr/bin/nologin
-    ftp:x:14:11:ftp:/srv/ftp:/usr/bin/nologin
-    http:x:33:33:http:/srv/http:/usr/bin/nologin
-    uuidd:x:68:68:uuidd:/:/usr/bin/nologin
-    messagebus:x:81:81:messagebus:/:/usr/bin/nologin
-    nobody:x:99:99:nobody:/:/usr/bin/nologin
-    EOF
-    chmod 644 ./etc/passwd
-
-    cat <<EOF > ./etc/group
-    root:x:0:root
-    bin:x:1:root,bin,daemon
-    daemon:x:2:root,bin,daemon
-    sys:x:3:root,bin
-    adm:x:4:root,daemon
-    tty:x:5:
-    disk:x:6:root
-    lp:x:7:daemon
-    mem:x:8:
-    kmem:x:9:
-    wheel:x:10:root
-    ftp:x:11:
-    mail:x:12:
-    uucp:x:14:
-    log:x:19:root
-    utmp:x:20:
-    locate:x:21:
-    rfkill:x:24:
-    smmsp:x:25:
-    proc:x:26:
-    http:x:33:
-    games:x:50:
-    lock:x:54:
-    uuidd:x:68:
-    messagebus:x:81:
-    network:x:90:
-    video:x:91:
-    audio:x:92:
-    optical:x:93:
-    floppy:x:94:
-    storage:x:95:
-    scanner:x:96:
-    input:x:97:
-    power:x:98:
-    nobody:x:99:
-    EOF
-    chmod 644 ./etc/group
-
-    # FIXME: remove this later (just to get a shell in the initramfs)
-    cat <<EOF > usr/lib/systemd/system/demo.service
-    [Unit]
-    Description=Debug Shell (/bin/sulogin)
-    Conflicts=shutdown.target
-    Before=shutdown.target
-
-    [Service]
-    Environment=HOME=/root
-    WorkingDirectory=/root
-    ExecStart=/bin/sulogin
-    Type=idle
-    StandardInput=tty-force
-    StandardOutput=inherit
-    StandardError=inherit
-    KillMode=process
-    IgnoreSIGPIPE=no
-    SendSIGHUP=yes
-    Restart=always
-
-    [Install]
-    WantedBy=basic.target
-    EOF
-    ln -sf ../demo.service usr/lib/systemd/system/basic.target.wants/demo.service
-
-    # gen initrd
-    find . -print0 | cpio --null --owner=root:root -o --format=newc | gzip -9 > ../initrd.gz
-
-    popd
-    rm -rf root
-  '';
-}

utils/qemu-uefi-tpm.nix

@@ -1,50 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-pkgs.writeShellApplication {
-  name = "qemu-uefi-tpm";
-
-  runtimeInputs = with pkgs; [
-    qemu
-    swtpm
-  ];
-
-  text =
-    let
-      tpmOVMF = pkgs.OVMF.override { tpmSupport = true; };
-    in
-    ''
-      set -ex
-      state="/tmp/patos-qemu-$USER"
-      rm -rf "$state"
-      mkdir -m 700 "$state"
-      truncate -s 1G "$state/disk.raw"
-
-      swtpm socket -d --tpmstate dir="$state" \
-        --ctrl type=unixio,path="$state/swtpm-sock" \
-        --tpm2 \
-        --log level=20
-
-      qemu-system-x86_64 \
-        -enable-kvm \
-        -machine q35,accel=kvm \
-        -cpu host \
-        -smp 8 \
-        -m 4G \
-        -display none \
-        -nographic \
-        -chardev "stdio,id=char0,mux=on,logfile=$state/console.log,signal=off" \
-        -serial chardev:char0 \
-        -mon chardev=char0 \
-        -drive "if=pflash,format=raw,unit=0,readonly=on,file=${tpmOVMF.firmware}" \
-        -drive "if=pflash,format=raw,unit=1,readonly=on,file=${tpmOVMF.variables}" \
-        -chardev socket,id=chrtpm,path="$state/swtpm-sock" \
-        -tpmdev emulator,id=tpm0,chardev=chrtpm \
-        -device tpm-tis,tpmdev=tpm0 \
-        -netdev id=net00,type=user,hostfwd=tcp::2222-:22 \
-        -device virtio-net-pci,netdev=net00 \
-        -drive "file=fat:rw:patos/,format=raw" \
-        -drive "format=raw,file=$state/disk.raw"
-    '';
-}