The default _sshd.service_ unit runs `ssh-keygen -A` in `ExecStartPre`,
to ensure host keys exist before starting the SSH daemon.
Unfortunately, this tool does _not_ respect the `HostKey` settings in
`sshd_config`, and unconditionally tries to create the key files in
`/etc/ssh`. Since this directory is not writable, the command fails,
preventing the SSH daemon from starting.
Some packages, notably _systemd_, place their PAM modules in
`/usr/lib64/security` instead of `/usr/lib/security`. PAM only seems to
look in the latter location, though, so anything in the former needs to
be moved in order to be used.
Software written in C++ typically depends on `libstdc++.so.6` and
`libgcc_s.so.1`. These library dependencies are implicit, as Gentoo
expects GCC to be installed as part of the _@system_ set. Since that
set does not get installed in the target root, anything that depends on
those libraries will not function.
Rather than install _sys-devel/gcc_ in the target environment to get
those libraries, we can copy ones built by `crossdev` manually. This
way, we do not end up with a full C compiler and development toolchain
in the target environment, while still making the libraries available
for applications that need them.
Since installing _sys-libs/glibc_ in the crossdev root overwrites the
libraries built by crossdev, Portage records the latter as needing to be
protected. This results in _everything_ being pulled in to
@preserved-rebuild, which ultimately does nothing since the preserved
library is never replaced. To avoid this pointlessness, we need to
disable the _preserve-libs_ feature when reinstalling _glibc_.
We also disable _protect-owned_ to avoid spam from Portage when
initially overwriting the libraries and headers in the crossdev root.
`ldconfig` has started complaining that it needs a configuration file
when using the `-r` argument:
> /mnt/gentoo/usr/sbin/ldconfig: need absolute file name for
> configuration file when using -r
_crossdev_ sets `ACCEPT_KEYWORDS="${ARCH} ~${ARCH}" by default, even
when run with `--stable`. This can cause conflicts when the host system
does not accept ~arch, and may not be desirable anyway. Projects that
want to use ~arch can set it in their own `make.conf`.
The _u-boot_ package does not have any stable keywords, so we have to
explicitly accept it.
This will silence warnings from `mount` about `/etc/fstab` having
changed since the last time the `systemd-fstab-generator` was run. It's
not true, since it's immutable, but the warning comes up on Raspberry
Pis without an RTC.
For whatever reason, _systemd-networkd_ does not resepect the DNS domain
search list sent by the DHCP server by default. This means single-label
name lookups will fail in most cases.
We don't want to reinstall _baselayout_ when its USE flags change.
Indeed, USE flag changes are expected, because we first install it with
USE=build, but only temporarily. Once the initial symlinks for
merged-usr are in place, it can be reinstalled without that flag. We
don't need to keep reinstalling and toggling between states, so we
ignore USE flag changes for the first pass.
Projects can now include a `customize.sh` script. If present, this
script will be run after the root filesystem hierarchy has been created,
but before the image is captured. This allows projects to apply
additional customizations beyond adding or removing files.
The project configuration file can now contain an optional `rootflags`
variable. If specified, this variable will be used to set the GRUB
environment variable of the same name. The value will be appended to
the kernel command line.
The _app-alternatives/awk_ package installs a symlink to `busybox` for
for `awk`. Using this package instead of `busybox.symlinks` allows
it to satisfy other packages that depend on a generic `awk`
implementation.
Using the host's `ldconfig` doesn't work, as it only considers libraries
for the same machine type as itself. THus, we have to execute the
target's copy, which means running it via QEMU userspace emulation.
The `-o` argument to `xargs` tells it to reopen a TTY to pass to the
spawned process's standard input. If there is no controlling TTY, this
will fail. There's no reason to do this anyway, so let's avoid it.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
