systemd: sshd: Disable ssh-keygen

The default _sshd.service_ unit runs `ssh-keygen -A` in `ExecStartPre`,
to ensure host keys exist before starting the SSH daemon.
Unfortunately, this tool does _not_ respect the `HostKey` settings in
`sshd_config`, and unconditionally tries to create the key files in
`/etc/ssh`.  Since this directory is not writable, the command fails,
preventing the SSH daemon from starting.

Makefile

@@ -51,13 +51,16 @@ $(O)/.ready: \
 		install.packages \
 		$(CONFIGDIR)/install.packages \
 		$(wildcard $(CONFIGDIR)/installonly.packages) \
+		busybox.symlinks \
 		$(wildcard $(CONFIGDIR)/busybox.symlinks) \
 		$(O)/linux/arch/arm64/boot/Image.gz \
 		$(O)/semanage.mods \
 		$(shell find overlay -type f) \
 		$(shell find $(CONFIGDIR)/overlay -type f 2>/dev/null) \
+		$(wildcard $(CONFIGDIR)/customize.sh) \
 		$(O)/.built
 	./build-rootfs.sh "$(O)"
+	if [ -x "$(CONFIGDIR)"/customize.sh ]; then "$(CONFIGDIR)"/customize.sh "$(O)"; fi
 	touch $(O)/.ready
 
 $(O)/squashfs.exclude: \
@@ -90,7 +93,7 @@ kernel: $(O)/linux/arch/arm64/boot/Image.gz
 $(O)/efi-part/EFI/BOOT/BOOTAA64.efi: \
 		build-grub.sh \
 		grub.cfg \
-		$(O)/.prepared
+		$(O)/.built
 	./build-grub.sh "$(O)"
 
 grub: $(O)/efi-part/EFI/BOOT/BOOTAA64.efi

build-grub.sh

@@ -39,6 +39,8 @@ grub-mkimage \
 echo 'Generating GRUB configuration file ...'
 mkdir -p "${O}"/efi-part/EFI/gentoo
 cp -uv grub.cfg "${O}"/efi-part/EFI/gentoo
-grub-editenv "${O}"/efi-part/EFI/gentoo/grubenv set rootflags='ro'
+grub-editenv "${O}"/efi-part/EFI/gentoo/grubenv set \
-grub-editenv "${O}"/efi-part/EFI/gentoo/grubenv set default=0
+    rootflags="${rootflags-ro}" \
-grub-editenv "${O}"/efi-part/EFI/gentoo/grubenv set timeout=5
+    default=0 \
+    timeout=5 \
+    && :

build-rootfs.sh

@@ -16,13 +16,13 @@ USE=build \
 emerge \
     --root=/mnt/gentoo \
     --config-root="${O}"/portage \
-    -kvnjU \
+    -kvnj \
     sys-apps/baselayout
 
 cat \
     install.packages \
     "${CONFIGDIR}"/install.packages \
-    | xargs -ro \
+    | xargs -rt \
 ${target}-emerge \
     --root=/mnt/gentoo \
     --config-root="${O}"/portage \
@@ -30,7 +30,7 @@ ${target}-emerge \
     --rebuilt-binaries=y
 
 if [ -f "${CONFIGDIR}"/installonly.packages ]; then
-    < "${CONFIGDIR}"/installonly.packages xargs -ro \
+    < "${CONFIGDIR}"/installonly.packages xargs -rt \
     ${target}-emerge \
         --root=/mnt/gentoo \
         --config-root="${O}"/portage \
@@ -76,6 +76,24 @@ if [ -f /mnt/gentoo/etc/udev/hwdb.bin ]; then
     mv /mnt/gentoo/etc/udev/hwdb.bin /mnt/gentoo/usr/lib/udev/
 fi
 
+gccver=$(qlist -I -F '%{PV}' cross-${target}/gcc | sed 's/[^0-9].*//')
+for lib in \
+    libstdc++ \
+    libgcc_s \
+; do
+    cp /usr/lib/gcc/${target}/${gccver}/${lib}.so.* /mnt/gentoo/usr/lib64/
+done
+
+qemu-${target%%-*} \
+/mnt/gentoo/usr/sbin/ldconfig \
+    -r /mnt/gentoo \
+    -f /mnt/gentoo/etc/ld.so.conf
+
+if [ -d /mnt/gentoo/lib64/security ]; then
+    find /mnt/gentoo/lib64/security -name 'pam_*.so' \
+        -exec mv -t /mnt/gentoo/lib/security {} +
+fi
+
 rm -f /mnt/gentoo/lib/tmpfiles.d/provision.conf
 systemd-tmpfiles --root=/mnt/gentoo -E --exclude-prefix=/var --create
 

build.sh

@@ -16,6 +16,6 @@ cat \
     install.packages \
     "${CONFIGDIR}"/build.packages \
     "${CONFIGDIR}"/install.packages \
-    | xargs -rot \
+    | xargs -rt \
 ${target}-emerge -bkvnuUDj
 ${target}-emerge -bv @preserved-rebuild

busybox.symlinks

@@ -8,6 +8,7 @@ du
 echo
 env
 false
+find
 free
 fsync
 fuser

install-update.sh

@@ -20,7 +20,8 @@ set_default_boot() {
     _rc=0
     mkdir -p newroot || return
     mount -oro "$1" newroot || return
-    _kernel=$(find newroot/boot -name 'vmlinuz-*' -printf '%P\n' \
+    _kernel=$(find newroot/boot -name 'vmlinuz-*' \
+        | awk -F/ '{print $NF}' \
         | sort -V \
         | tail -n1
     )

install.packages

@@ -1,5 +1,8 @@
+app-alternatives/awk
 net-misc/openssh
 net-misc/wget
 sys-apps/busybox
+sys-apps/kbd
+sys-apps/gentoo-functions
 sys-apps/systemd
 sys-fs/btrfs-progs

overlay/etc/ssh/sshd_config.d/authorized-keys-command.conf

@@ -1,2 +0,0 @@
-AuthorizedKeysCommand /usr/libexec/ssh-authorized-keys %u %t
-AuthorizedKeysCommandUser nobody

overlay/etc/systemd/network/95-default.network

@@ -3,3 +3,9 @@ Type=ether
 
 [Network]
 DHCP=yes
+
+[DHCPv4]
+UseDomains=yes
+
+[DHCPv6]
+UseDomains=yes

overlay/usr/bin/system-update

@@ -119,6 +119,8 @@ trap cleanup INT TERM QUIT EXIT
 workdir=$(mktemp -d)
 cd "${workdir}"
 
+systemctl daemon-reload
+
 fetch_update "${source_url}" || die 'Failed to fetch update source'
 extract_update || die 'Failed to extact update source'
 ./install "${newroot}" || die 'Error installing system update'

overlay/usr/lib/firmware/brcm/brcmfmac43455-sdio.raspberrypi,4-compute-module-ha-yellow.bin.xz

@@ -1 +0,0 @@
-../cypress/cyfmac43455-sdio.bin.xz

overlay/usr/lib/firmware/brcm/brcmfmac43455-sdio.raspberrypi,4-compute-module-ha-yellow.txt.xz

@@ -1 +0,0 @@
-brcmfmac43455-sdio.raspberrypi,4-model-b.txt.xz

overlay/usr/lib/systemd/sshd.service.d/no-keygen.conf

@@ -0,0 +1,2 @@
+[Service]
+ExecStartPre=

overlay/usr/libexec/init-storage

@@ -23,7 +23,7 @@ copy_var() {
 
     echo 'Copying /var contents to data volume'
     mount -o subvol=var "${dev}" "${tmpdir}" || exit
-    cp -acuv /var/. "${tmpdir}" || exit
+    cp -auv /var/. "${tmpdir}" || exit
     umount "${tmpdir}"
 }
 
@@ -89,6 +89,9 @@ partition_number() {
 }
 
 relabel_all() {
+    if [ ! "$(command -v selinuxenabled)" ] || !selinuxenabled; then
+        return 0
+    fi
     selinuxtype=$(. /etc/selinux/config && echo ${SELINUXTYPE})
     find "${tmpdir}" | \
     setfiles \
@@ -129,7 +132,7 @@ setup_etc() {
     echo 'Initializing writable paths in /etc'
     mount -o subvol=etc "${dev}" "${tmpdir}" || exit
     if [ ! -f "${tmpdir}"/shadow ]; then
-        cp -ca /etc/shadow "${tmpdir}"/shadow || exit
+        cp -a /etc/shadow "${tmpdir}"/shadow || exit
     fi
     mount -o bind "${tmpdir}"/shadow /etc/shadow || exit
     if [ -f /etc/aimee-os/writable-etc ]; then
@@ -141,7 +144,7 @@ setup_etc() {
                         mkdir -p "${tmpdir}/${path%/*}"
                         ;;
                     esac
-                    cp -ca /etc/"${path}" "${tmpdir}/${path}"
+                    cp -a /etc/"${path}" "${tmpdir}/${path}"
                 elif [ "${type}" = d ]; then
                     mkdir -p "${tmpdir}/${path}"
                 elif [ "${type}" = f ]; then

overlay/usr/libexec/ssh-authorized-keys

@@ -1,4 +0,0 @@
-#!/bin/sh
-# vim: set sw=4 ts=4 sts=4 et :
-
-exec wget -q -O - https://sshkeys.pyrocufflink.blue/"$1"/"$2".pub

portage/package.accept_keywords/uboot

@@ -0,0 +1 @@
+sys-boot/u-boot ~arm64

portage/savedconfig/sys-apps/busybox

@@ -441,7 +441,7 @@ CONFIG_FEATURE_VI_UNDO_QUEUE_MAX=0
 #
 # Finding Utilities
 #
-# CONFIG_FIND is not set
+CONFIG_FIND=y
 # CONFIG_FEATURE_FIND_PRINT0 is not set
 # CONFIG_FEATURE_FIND_MTIME is not set
 # CONFIG_FEATURE_FIND_MMIN is not set

prepare.sh

@@ -37,14 +37,12 @@ if [ ! -f portage/make.conf/10-crossdev.conf ]; then
     sed -r \
         -e 's: ?-pam::' \
         -e '/PKGDIR=/d' \
+        -e '/ACCEPT_KEYWORDS/d' \
         /usr/${target}/etc/portage/make.conf \
         > "${O}"/portage/etc/portage/make.conf/10-crossdev.conf
 fi
 
-ln -snf /var/db/repos/gentoo/profiles/${profile} \
+FEATURES="${FEATURES} -preserve-libs -protect-owned" \
-    /usr/${target}/etc/portage/make.profile
-
-FEATURES="${FEATURES}" \
 PKGDIR="${PKGDIR}" \
 ${target}-emerge -bk1nvj sys-libs/glibc
 

squashfs.exclude

@@ -48,6 +48,7 @@ usr/share/portage
 usr/share/selinux/*/include
 usr/share/selinux/devel
 usr/share/zsh
+usr/src
 var/.updated
 var/cache/edb
 var/db/Makefile