[PATCH 00/20] Many image fixes and systemd integration

Demi Marie Obenour
2025-09-04T23:47:46Z

Patches 1 through 19 are all fixes or enhancements to the image build
process. There are other changes that need to be done around error
handling, but these are all useful regardless. See the individual
commit messages for details.

Notably, one of these patches standardizes file modes so that they are
not dependent on the permissions in the user's git repository (except
for whether the executable bit is set, which git stores). This is
because that depends on things like the user's umask, and thus should
have no effect on the image.

Patch 20 switches from s6-linux-init to systemd. This is not intended
for merging, at least not yet. However, it *is* meant to show the
beginning of how Spectrum could benefit from systemd's features.
Notably, this patch reduces the amount of code. This is despite all
Spectrum-specific services still being managed by s6 and additional
complexity in the Nix files being needed to work around nixpkgs not
using standard directories to find things like systemd unit files and
PAM modules. It's also worth noting that at least GNOME has a fairly
hard dependency on systemd, but I doubt COSMIC will as parts of it are
even used on Redox, which definitely does not run systemd!

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
Demi Marie Obenour (20):
scripts/make-erofs.sh: Ensure that / is world-readable
scripts/make-erofs.sh: Do not read one byte at a time
scripts/make-erofs.sh: Avoid unneeded calls to awk and chmod
scripts/make-erofs.sh: Validate all paths
scripts/make-erofs.sh: Avoid unneeded calls to dirname
scripts/make-erofs.sh: Avoid unneeded calls to mkdir
scripts/make-erofs.sh: Standardize file modes in images
Standardize directories and symlinks in images
Add os-release file
host/rootfs: Set -eu in build
Add /dev/fd and /dev/std*
host/rootfs: Do not read from /dev/tty1
host/rootfs: pass API socket as fd 3, not fd 0
host/rootfs: Disable unneeded BusyBox tools
host/rootfs: Use real less, not BusyBox less
host/rootfs: explicitly set PATH in network add script
Use /etc/s6-rc/compiled for compiled s6-rc directory
host/rootfs: virtiofsd: Do not use FD 0 as the socket
host/rootfs: Disable unneeded busybox stuff
host/rootfs: Switch to systemd

LICENSES/ISC.txt | 11 -
host/initramfs/etc/init | 7 +-
host/rootfs/Makefile | 186 +++++------
host/rootfs/bin | 1 -
host/rootfs/default.nix | 347 +++++++++++++++------
host/rootfs/etc/group | 1 -
host/rootfs/etc/init | 10 +-
host/rootfs/etc/machine-id | 0
host/rootfs/etc/mdev.conf | 7 -
host/rootfs/etc/mdev/listen | 11 -
host/rootfs/etc/mdev/net/add | 1 +
host/rootfs/etc/mdev/wait | 14 -
host/rootfs/etc/os-release | 12 +
host/rootfs/etc/os-release.license | 2 +
host/rootfs/etc/pam.d/login | 9 +
host/rootfs/etc/passwd | 1 -
host/rootfs/etc/s6-linux-init/env/WAYLAND_DISPLAY | 1 -
.../etc/s6-linux-init/env/WAYLAND_DISPLAY.license | 2 -
host/rootfs/etc/s6-linux-init/env/XDG_RUNTIME_DIR | 1 -
.../etc/s6-linux-init/env/XDG_RUNTIME_DIR.license | 2 -
.../etc/s6-linux-init/run-image/opengl-driver | 1 -
.../s6-linux-init/run-image/service/getty-tty1/run | 5 -
.../s6-linux-init/run-image/service/getty-tty2/run | 5 -
.../s6-linux-init/run-image/service/getty-tty3/run | 5 -
.../s6-linux-init/run-image/service/getty-tty4/run | 5 -
.../run-image/service/s6-svscan-log/run | 6 -
.../run-image/service/serial-getty-generator/run | 43 ---
.../run-image/service/serial-getty/template/run | 5 -
.../run-image/service/vmm/template/run | 1 -
.../notification-fd.license | 2 -
.../service/xdg-desktop-portal-spectrum-host/run | 5 -
.../template/notification-fd | 1 -
host/rootfs/etc/s6-linux-init/scripts/rc.init | 10 -
host/rootfs/etc/s6-rc/card0/type | 1 -
host/rootfs/etc/s6-rc/card0/type.license | 2 -
host/rootfs/etc/s6-rc/card0/up | 4 -
host/rootfs/etc/s6-rc/core/type | 1 -
host/rootfs/etc/s6-rc/core/type.license | 2 -
host/rootfs/etc/s6-rc/kvm/timeout-up | 1 -
host/rootfs/etc/s6-rc/kvm/timeout-up.license | 2 -
host/rootfs/etc/s6-rc/kvm/type | 1 -
host/rootfs/etc/s6-rc/kvm/type.license | 2 -
host/rootfs/etc/s6-rc/kvm/up | 4 -
host/rootfs/etc/s6-rc/mdevd-coldplug/dependencies | 4 -
host/rootfs/etc/s6-rc/mdevd-coldplug/type | 1 -
host/rootfs/etc/s6-rc/mdevd-coldplug/type.license | 2 -
host/rootfs/etc/s6-rc/mdevd-coldplug/up | 4 -
host/rootfs/etc/s6-rc/mdevd/notification-fd | 1 -
.../rootfs/etc/s6-rc/mdevd/notification-fd.license | 2 -
host/rootfs/etc/s6-rc/mdevd/run | 5 -
host/rootfs/etc/s6-rc/mdevd/type | 1 -
host/rootfs/etc/s6-rc/mdevd/type.license | 2 -
host/rootfs/etc/s6-rc/ok-all/contents | 3 +-
host/rootfs/etc/s6-rc/static-nodes/type | 1 -
host/rootfs/etc/s6-rc/static-nodes/type.license | 2 -
host/rootfs/etc/s6-rc/static-nodes/up | 26 --
host/rootfs/etc/s6-rc/sys-vmms/dependencies | 4 -
host/rootfs/etc/s6-rc/vm-env/contents | 5 -
host/rootfs/etc/s6-rc/vm-env/type | 1 -
host/rootfs/etc/s6-rc/vm-env/type.license | 2 -
host/rootfs/etc/s6-rc/vmm-env/contents | 6 -
host/rootfs/etc/s6-rc/vmm-env/type | 1 -
host/rootfs/etc/s6-rc/vmm-env/type.license | 2 -
host/rootfs/etc/s6-rc/weston/dependencies | 4 -
host/rootfs/etc/s6-rc/weston/run | 7 +-
host/rootfs/etc/security/namespace.conf | 0
.../etc/{s6-rc/core/up => sysctl.d/spectrum.conf} | 3 +-
.../systemd-veritysetup-generator | 1 +
.../etc/systemd/system.conf.d/zspectrum.conf | 25 ++
host/rootfs/etc/systemd/system/-.slice | 5 +
.../default.target.requires/s6-init-start.service | 1 +
.../s6-init-start.service | 1 +
.../s6-init-start.service | 1 +
.../etc/systemd/system/s6-init-start.service | 25 ++
.../system/serial-getty@.service.d/90_force.conf | 6 +
.../90_spectrum.conf | 4 +
.../system/user@.service.d/99_spectrum-uid.conf | 4 +
host/rootfs/etc/tmpfiles.d/99-spectrum.conf | 8 +
host/rootfs/etc/udev/rules.d/99-spectrum-kvm.rules | 8 +
host/rootfs/lib | 1 -
host/rootfs/sbin | 1 -
host/rootfs/shell.nix | 3 +-
host/rootfs/usr/bin/run-appimage | 2 +-
host/rootfs/usr/bin/run-vmm | 5 +-
host/rootfs/usr/bin/vm-start | 2 +-
host/rootfs/usr/lib/spectrum/s6-start | 5 +
.../share/spectrum}/service/dbus/notification-fd | 0
.../spectrum}/service/dbus/notification-fd.license | 0
.../share/spectrum}/service/dbus/run | 0
.../share/spectrum/service/dbus/template/log/run | 4 +
.../service/dbus/template/notification-fd | 0
.../service/dbus/template/notification-fd.license | 0
.../share/spectrum}/service/dbus/template/run | 2 +-
.../service/s6-svscan-log/notification-fd | 0
.../service/s6-svscan-log/notification-fd.license | 0
.../usr/share/spectrum/service/s6-svscan-log/run | 4 +
.../service/vhost-user-fs}/notification-fd | 0
.../service/vhost-user-fs}/notification-fd.license | 0
.../share/spectrum/service/vhost-user-fs}/run | 0
.../service/vhost-user-fs/template/log/run | 4 +
.../vhost-user-fs/template}/notification-fd | 0
.../vhost-user-fs/template/notification-fd.license | 0
.../spectrum}/service/vhost-user-fs/template/run | 5 +-
.../service/vhost-user-gpu}/notification-fd | 0
.../vhost-user-gpu}/notification-fd.license | 0
.../share/spectrum/service/vhost-user-gpu}/run | 0
.../service/vhost-user-gpu/template/data/check | 0
.../service/vhost-user-gpu/template/log/run | 4 +
.../vhost-user-gpu/template}/notification-fd | 0
.../template/notification-fd.license | 0
.../spectrum}/service/vhost-user-gpu/template/run | 0
.../spectrum}/service/vhost-user-gpu/template/type | 0
.../service/vhost-user-gpu/template/type.license | 0
host/rootfs/usr/share/spectrum/service/vmm/log/run | 4 +
.../share/spectrum/service/vmm}/notification-fd | 0
.../spectrum/service/vmm}/notification-fd.license | 0
.../share/spectrum/service/vmm}/run | 0
.../share/spectrum/service/vmm/template/log/run | 4 +
.../spectrum/service/vmm/template}/notification-fd | 0
.../service/vmm/template}/notification-fd.license | 0
.../usr/share/spectrum/service/vmm/template/run | 1 +
.../xdg-desktop-portal-spectrum-host/log/run | 4 +
.../notification-fd | 0
.../notification-fd.license | 0
.../service/xdg-desktop-portal-spectrum-host}/run | 0
.../template/log/run | 4 +
.../template}/notification-fd | 0
.../template/notification-fd.license | 0
.../xdg-desktop-portal-spectrum-host/template/run | 0
img/app/Makefile | 15 +-
img/app/bin | 1 -
img/app/default.nix | 101 +++---
img/app/etc/os-release | 12 +
img/app/etc/os-release.license | 2 +
img/app/etc/s6-linux-init/scripts/rc.init | 2 +-
img/app/sbin | 1 -
release/checks/integration/networking.c | 2 +-
release/checks/integration/portal.c | 2 +-
scripts/make-erofs.sh | 152 ++++++++-
vm/sys/net/Makefile | 15 +-
vm/sys/net/bin | 1 -
vm/sys/net/default.nix | 2 +
vm/sys/net/etc/os-release | 12 +
vm/sys/net/etc/os-release.license | 2 +
vm/sys/net/etc/s6-linux-init/scripts/rc.init | 7 +-
vm/sys/net/lib | 1 -
vm/sys/net/sbin | 1 -
vm/sys/net/var/run | 1 -
148 files changed, 754 insertions(+), 555 deletions(-)
---
base-commit: 0ac65013a1a29e91ea8476f39113e3598eb0e535
change-id: 20250815-systemd-2cdd0b578a86
--
Sincerely,
Demi Marie Obenour (she/her/hers)