Merge ee7f34b35a into 9bf154df78

.github/workflows/release.yml

@@ -1,50 +0,0 @@
-on:
-  release:
-    types: [ created ]
-
-name: Build & Deploy Image
-
-jobs:
-  build:
-    name: Build & Release Image
-    runs-on: ARM64
-    timeout-minutes: 2880
-    env:
-      working-directory: ./
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-      - name: Clean docker
-        id: clean_docker
-        working-directory: ${{ env.working-directory }}
-        run: |
-          docker system prune -af
-          docker system prune --volumes -f
-          docker image prune -af
-          docker container stop $(docker container ls -aq) || true
-          docker container rm $(docker container ls -aq) || true
-      - name: Build project
-        id: builder
-        working-directory: ${{ env.working-directory }}
-        run: |
-          bash build-docker.sh
-          echo ::set-output name=filename::$(ls deploy/*.img.xz | xargs -n 1 basename)
-      - name: Fix Permissions
-        id: fix_perm_filename
-        run: |
-          chmod a+rw ${{ env.working-directory }}/deploy/${{ steps.builder.outputs.filename }}
-          echo ${{ env.working-directory }}/deploy/${{ steps.builder.outputs.filename }}
-      - name: Upload Release Asset
-        id: upload-release-asset
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.LONG_TOKEN }}
-        with:
-          upload_url: ${{ github.event.release.upload_url }}
-          asset_path: ${{ env.working-directory }}/deploy/${{ steps.builder.outputs.filename }}
-          asset_name: ${{ steps.builder.outputs.filename }}
-          asset_content_type: application/x-tar
-      - name: Delete Image
-        id: delete_image
-        run: |
-          rm ${{ env.working-directory }}/deploy/${{ steps.builder.outputs.filename }}

.github/workflows/validate.yml

@@ -1,42 +0,0 @@
-on: ['pull_request']
-
-name: Build & Validate Image
-
-jobs:
-  build:
-    name: Build & Validate Image
-    runs-on: ARM64
-    timeout-minutes: 2880
-    env:
-      working-directory: ./
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-      - name: Clean docker
-        id: clean_docker
-        working-directory: ${{ env.working-directory }}
-        run: |
-          docker system prune -af
-          docker system prune --volumes -f
-          docker image prune -af
-          docker container stop $(docker container ls -aq) || true
-          docker container rm $(docker container ls -aq) || true
-      - name: Build project
-        id: builder
-        working-directory: ${{ env.working-directory }}
-        run: |
-          bash build-docker.sh
-          echo ::set-output name=filename::$(ls deploy/*.img.xz | xargs -n 1 basename)
-      - name: Fix Permissions
-        id: fix_perm_filename
-        run: |
-          chmod a+rw ${{ env.working-directory }}/deploy/${{ steps.builder.outputs.filename }}
-          echo ${{ env.working-directory }}/deploy/${{ steps.builder.outputs.filename }}
-      - uses: actions/upload-artifact@v1
-        with:
-          name: ${{ steps.builder.outputs.filename }}
-          path: ${{ env.working-directory }}/deploy/${{ steps.builder.outputs.filename }}
-      - name: Delete Image
-        id: delete_image
-        run: |
-          rm ${{ env.working-directory }}/deploy/${{ steps.builder.outputs.filename }}

Dockerfile

@@ -1,4 +1,4 @@
-ARG BASE_IMAGE=debian:buster
+ARG BASE_IMAGE=debian:bullseye
 FROM ${BASE_IMAGE}
 
 ENV DEBIAN_FRONTEND noninteractive
@@ -8,7 +8,7 @@ RUN apt-get -y update && \
         git vim parted \
         quilt coreutils qemu-user-static debootstrap zerofree zip dosfstools \
         libarchive-tools libcap2-bin rsync grep udev xz-utils curl xxd file kmod bc\
-        binfmt-support ca-certificates qemu-utils kpartx util-linux fdisk \
+        binfmt-support ca-certificates qemu-utils kpartx fdisk gpg pigz\
     && rm -rf /var/lib/apt/lists/*
 
 COPY . /pi-gen/

README.md

@@ -25,7 +25,6 @@ List of pre-installed software:
 - [hamlib](https://hamlib.github.io/)
 - [VaporTrail](https://github.com/inguardians/VaporTrail)
 - [Universal Radio Hacker](https://github.com/jopohl/urh)
-- [FoxTelem](https://github.com/ac2cz/FoxTelem)
 - [Quisk](http://james.ahlstrom.name/quisk/)
 - [0xCoto/VIRGO](https://github.com/0xCoto/VIRGO)
 - [0xCoto/CygnusRFI](https://github.com/0xCoto/CygnusRFI)
@@ -101,6 +100,17 @@ The remote desktop can be accessed using any VNC client. The credentials are the
 #### Running Programs
 Not all programs listed above will be listed on the desktop. Most of them require to be launched from the terminal. Please, refer to the documentation of the program that you would like to use for launch instructions. The `README.md` files can also be accessed offline inside the `/home/pi/PiSDR` directory.
 
+## Advanced
+
+You can also choose to compile PiSDR on your own. However, be aware that this process can take several hours, depending on your hardware. It's important to note that standard x86 machines, such as those with Intel and AMD CPUs, will typically take much longer. This is because they have to emulate an ARM64 processor to compile everything. In contrast, machines with native ARM64 processors, like Apple Silicon and Ampere, will be significantly faster as they don't require emulation.
+
+This project uses docker to compile the images.
+
+#### macOS (Colima)
+```bash
+$ colima start --cpu 8 --cpu-type cortex-a72 --memory 14 --arch aarch64
+```
+
 ## About the project
 PiSDR Project was created and maintained since 2019 by [Luigi F. Cruz](https://luigi.ltd).
 

build-docker.sh

@@ -1,13 +1,20 @@
-#!/bin/bash -eu
+#!/usr/bin/env bash
+# Note: Avoid usage of arrays as MacOS users have an older version of bash (v3.x) which does not supports arrays
+set -eu
 
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+DIR="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
 
 BUILD_OPTS="$*"
 
-DOCKER="docker"
+# Allow user to override docker command
+DOCKER=${DOCKER:-docker}
 
-if ! ${DOCKER} ps >/dev/null 2>&1; then
-	DOCKER="sudo docker"
+# Ensure that default docker command is not set up in rootless mode
+if \
+  ! ${DOCKER} ps    >/dev/null 2>&1 || \
+    ${DOCKER} info 2>/dev/null | grep -q rootless \
+; then
+	DOCKER="sudo ${DOCKER}"
 fi
 if ! ${DOCKER} ps >/dev/null; then
 	echo "error connecting to docker:"
@@ -48,7 +55,7 @@ fi
 CONTAINER_NAME=${CONTAINER_NAME:-pigen_work}
 CONTINUE=${CONTINUE:-0}
 PRESERVE_CONTAINER=${PRESERVE_CONTAINER:-0}
-PIGEN_DOCKER_OPTS=${PIGEN_DOCKER_OPTS:-""}  
+PIGEN_DOCKER_OPTS=${PIGEN_DOCKER_OPTS:-""}
 
 if [ -z "${IMG_NAME}" ]; then
 	echo "IMG_NAME not set in 'config'" 1>&2
@@ -75,42 +82,83 @@ fi
 # Modify original build-options to allow config file to be mounted in the docker container
 BUILD_OPTS="$(echo "${BUILD_OPTS:-}" | sed -E 's@\-c\s?([^ ]+)@-c /config@')"
 
-BASE_IMAGE=debian:buster
-${DOCKER} build --build-arg BASE_IMAGE=${BASE_IMAGE} -t pi-gen "${DIR}"
+${DOCKER} build --build-arg BASE_IMAGE=debian:bullseye -t pi-gen "${DIR}"
 
 if [ "${CONTAINER_EXISTS}" != "" ]; then
-	trap 'echo "got CTRL+C... please wait 5s" && ${DOCKER} stop -t 5 ${CONTAINER_NAME}_cont' SIGINT SIGTERM
-	time ${DOCKER} run --rm --privileged \
-		--cap-add=ALL \
-		-v /dev:/dev \
-		-v /lib/modules:/lib/modules \
-		${PIGEN_DOCKER_OPTS} \
-		--volume "${CONFIG_FILE}":/config:ro \
-		-e "GIT_HASH=${GIT_HASH}" \
-		--volumes-from="${CONTAINER_NAME}" --name "${CONTAINER_NAME}_cont" \
-		pi-gen \
-		bash -e -o pipefail -c "dpkg-reconfigure qemu-user-static &&
-	cd /pi-gen; ./build.sh ${BUILD_OPTS} &&
-	rsync -av work/*/build.log deploy/" &
-	wait "$!"
+  DOCKER_CMDLINE_NAME="${CONTAINER_NAME}_cont"
+  DOCKER_CMDLINE_PRE="--rm"
+  DOCKER_CMDLINE_POST="--volumes-from=\"${CONTAINER_NAME}\""
 else
-	trap 'echo "got CTRL+C... please wait 5s" && ${DOCKER} stop -t 5 ${CONTAINER_NAME}' SIGINT SIGTERM
-	time ${DOCKER} run --name "${CONTAINER_NAME}" --privileged \
-		--cap-add=ALL \
-		-v /dev:/dev \
-		-v /lib/modules:/lib/modules \
-		${PIGEN_DOCKER_OPTS} \
-		--volume "${CONFIG_FILE}":/config:ro \
-		-e "GIT_HASH=${GIT_HASH}" \
-		pi-gen \
-		bash -e -o pipefail -c "dpkg-reconfigure qemu-user-static &&
-	cd /pi-gen; ./build.sh ${BUILD_OPTS} &&
-	rsync -av work/*/build.log deploy/" &
-	wait "$!"
+  DOCKER_CMDLINE_NAME="${CONTAINER_NAME}"
+  DOCKER_CMDLINE_PRE=""
+  DOCKER_CMDLINE_POST=""
 fi
 
+# Check if binfmt_misc is required
+binfmt_misc_required=1
+case $(uname -m) in
+  aarch64)
+    binfmt_misc_required=0
+    ;;
+  arm*)
+    binfmt_misc_required=0
+    ;;
+esac
+
+# Check if qemu-aarch64-static and /proc/sys/fs/binfmt_misc are present
+if [[ "${binfmt_misc_required}" == "1" ]]; then
+  if ! qemu_arm=$(which qemu-aarch64-static) ; then
+    echo "qemu-aarch64-static not found (please install qemu-user-static)"
+    exit 1
+  fi
+  if [ ! -f /proc/sys/fs/binfmt_misc/register ]; then
+    echo "binfmt_misc required but not mounted, trying to mount it..."
+    if ! mount binfmt_misc -t binfmt_misc /proc/sys/fs/binfmt_misc ; then
+        echo "mounting binfmt_misc failed"
+        exit 1
+    fi
+    echo "binfmt_misc mounted"
+  fi
+  if ! grep -q "^interpreter ${qemu_arm}" /proc/sys/fs/binfmt_misc/qemu-aarch64* ; then
+    # Register qemu-aarch64 for binfmt_misc
+    reg="echo ':qemu-aarch64-rpi:M::"\
+"\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7\x00:"\
+"\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff:"\
+"${qemu_arm}:F' > /proc/sys/fs/binfmt_misc/register"
+    echo "Registering qemu-aarch64 for binfmt_misc..."
+    sudo bash -c "${reg}" 2>/dev/null || true
+  fi
+fi
+
+trap 'echo "got CTRL+C... please wait 5s" && ${DOCKER} stop -t 5 ${DOCKER_CMDLINE_NAME}' SIGINT SIGTERM
+time ${DOCKER} run \
+  $DOCKER_CMDLINE_PRE \
+  --name "${DOCKER_CMDLINE_NAME}" \
+  --privileged \
+  --cap-add=ALL \
+  -v /dev:/dev \
+  -v /lib/modules:/lib/modules \
+  ${PIGEN_DOCKER_OPTS} \
+  --volume "${CONFIG_FILE}":/config:ro \
+  -e "GIT_HASH=${GIT_HASH}" \
+  $DOCKER_CMDLINE_POST \
+  pi-gen \
+  bash -e -o pipefail -c "
+    dpkg-reconfigure qemu-user-static &&
+    # binfmt_misc is sometimes not mounted with debian bullseye image
+    (mount binfmt_misc -t binfmt_misc /proc/sys/fs/binfmt_misc || true) &&
+    cd /pi-gen; ./build.sh ${BUILD_OPTS} &&
+    rsync -av work/*/build.log deploy/
+  " &
+  wait "$!"
+
+# Ensure that deploy/ is always owned by calling user
 echo "copying results from deploy/"
-${DOCKER} cp "${CONTAINER_NAME}":/pi-gen/deploy .
+${DOCKER} cp "${CONTAINER_NAME}":/pi-gen/deploy - | tar -xf -
+
+echo "copying log from container ${CONTAINER_NAME} to depoy/"
+${DOCKER} logs --timestamps "${CONTAINER_NAME}" &>deploy/build-docker.log
+
 ls -lah deploy
 
 # cleanup

build.sh

@@ -14,20 +14,14 @@ $(cat "${i}-debconf")
 SELEOF
 EOF
 
-		log "End ${SUB_STAGE_DIR}/${i}-debconf"
+			log "End ${SUB_STAGE_DIR}/${i}-debconf"
 		fi
 		if [ -f "${i}-packages-nr" ]; then
 			log "Begin ${SUB_STAGE_DIR}/${i}-packages-nr"
 			PACKAGES="$(sed -f "${SCRIPT_DIR}/remove-comments.sed" < "${i}-packages-nr")"
 			if [ -n "$PACKAGES" ]; then
 				on_chroot << EOF
-n=0
-until [ "$n" -ge 5 ]
-do
-    apt-get --ignore-missing --fix-missing install --no-install-recommends -y $PACKAGES && break
-    n=$((n+1))
-    sleep 15
-done
+apt-get -o Acquire::Retries=3 install --no-install-recommends -y $PACKAGES
 EOF
 				if [ "${USE_QCOW2}" = "1" ]; then
 					on_chroot << EOF
@@ -42,13 +36,7 @@ EOF
 			PACKAGES="$(sed -f "${SCRIPT_DIR}/remove-comments.sed" < "${i}-packages")"
 			if [ -n "$PACKAGES" ]; then
 				on_chroot << EOF
-n=0
-until [ "$n" -ge 5 ]
-do
-    apt-get --ignore-missing --fix-missing install -y $PACKAGES && break
-    n=$((n+1))
-    sleep 15
-done
+apt-get -o Acquire::Retries=3 install -y $PACKAGES
 EOF
 				if [ "${USE_QCOW2}" = "1" ]; then
 					on_chroot << EOF
@@ -145,7 +133,7 @@ run_stage(){
 		done
 	fi
 
-	if [ "${USE_QCOW2}" = "1" ]; then 
+	if [ "${USE_QCOW2}" = "1" ]; then
 		unload_qimage
 	else
 		# make sure we are not umounting during export-image stage
@@ -167,6 +155,14 @@ if [ "$(id -u)" != "0" ]; then
 fi
 
 BASE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+if [[ $BASE_DIR = *" "* ]]; then
+	echo "There is a space in the base path of pi-gen"
+	echo "This is not a valid setup supported by debootstrap."
+	echo "Please remove the spaces, or move pi-gen directory to a base path without spaces" 1>&2
+	exit 1
+fi
+
 export BASE_DIR
 
 if [ -f config ]; then
@@ -207,21 +203,30 @@ fi
 export USE_QEMU="${USE_QEMU:-0}"
 export IMG_DATE="${IMG_DATE:-"$(date +%Y-%m-%d)"}"
 export IMG_FILENAME="${IMG_FILENAME:-"${IMG_DATE}-${IMG_NAME}"}"
-export ZIP_FILENAME="${ZIP_FILENAME:-"${IMG_DATE}-${IMG_NAME}"}"
+export ARCHIVE_FILENAME="${ARCHIVE_FILENAME:-"image_${IMG_DATE}-${IMG_NAME}"}"
 
 export SCRIPT_DIR="${BASE_DIR}/scripts"
-export WORK_DIR="${WORK_DIR:-"${BASE_DIR}/work/${IMG_DATE}-${IMG_NAME}"}"
+export WORK_DIR="${WORK_DIR:-"${BASE_DIR}/work/${IMG_NAME}"}"
 export DEPLOY_DIR=${DEPLOY_DIR:-"${BASE_DIR}/deploy"}
-export DEPLOY_ZIP="${DEPLOY_ZIP:-1}"
+
+# DEPLOY_ZIP was deprecated in favor of DEPLOY_COMPRESSION
+# This preserve the old behavior with DEPLOY_ZIP=0 where no archive was created
+if [ -z "${DEPLOY_COMPRESSION}" ] && [ "${DEPLOY_ZIP:-1}" = "0" ]; then
+	echo "DEPLOY_ZIP has been deprecated in favor of DEPLOY_COMPRESSION"
+	echo "Similar behavior to DEPLOY_ZIP=0 can be obtained with DEPLOY_COMPRESSION=none"
+	echo "Please update your config file"
+	DEPLOY_COMPRESSION=none
+fi
+export DEPLOY_COMPRESSION=${DEPLOY_COMPRESSION:-zip}
+export COMPRESSION_LEVEL=${COMPRESSION_LEVEL:-6}
 export LOG_FILE="${WORK_DIR}/build.log"
 
 export TARGET_HOSTNAME=${TARGET_HOSTNAME:-raspberrypi}
 
 export FIRST_USER_NAME=${FIRST_USER_NAME:-pi}
-export FIRST_USER_PASS=${FIRST_USER_PASS:-raspberry}
-export RELEASE=${RELEASE:-bullseye}
-export WPA_ESSID
-export WPA_PASSWORD
+export FIRST_USER_PASS
+export DISABLE_FIRST_BOOT_USER_RENAME=${DISABLE_FIRST_BOOT_USER_RENAME:-0}
+export RELEASE=${RELEASE:-bookworm} # Don't forget to update stage0/prerun.sh
 export WPA_COUNTRY
 export ENABLE_SSH="${ENABLE_SSH:-0}"
 export PUBKEY_ONLY_SSH="${PUBKEY_ONLY_SSH:-0}"
@@ -276,6 +281,10 @@ fi
 
 export NO_PRERUN_QCOW2="${NO_PRERUN_QCOW2:-1}"
 
+if [ "$SETFCAP" != "1" ]; then
+	export CAPSH_ARG="--drop=cap_setfcap"
+fi
+
 dependencies_check "${BASE_DIR}/depends"
 
 #check username is valid
@@ -284,6 +293,17 @@ if [[ ! "$FIRST_USER_NAME" =~ ^[a-z][-a-z0-9_]*$ ]]; then
 	exit 1
 fi
 
+if [[ "$DISABLE_FIRST_BOOT_USER_RENAME" == "1" ]] && [ -z "${FIRST_USER_PASS}" ]; then
+	echo "To disable user rename on first boot, FIRST_USER_PASS needs to be set"
+	echo "Not setting FIRST_USER_PASS makes your system vulnerable and open to cyberattacks"
+	exit 1
+fi
+
+if [[ "$DISABLE_FIRST_BOOT_USER_RENAME" == "1" ]]; then
+	echo "User rename on the first boot is disabled"
+	echo "Be advised of the security risks linked to shipping a device with default username/password set."
+fi
+
 if [[ -n "${APT_PROXY}" ]] && ! curl --silent "${APT_PROXY}" >/dev/null ; then
 	echo "Could not reach APT_PROXY server: ${APT_PROXY}"
 	exit 1
@@ -381,7 +401,7 @@ for EXPORT_DIR in ${EXPORT_DIRS}; do
 
 	else
 		run_stage
-	fi 
+	fi
 	if [ "${USE_QEMU}" != "1" ]; then
 		if [ -e "${EXPORT_DIR}/EXPORT_NOOBS" ]; then
 			# shellcheck source=/dev/null

config

@@ -2,3 +2,5 @@ IMG_NAME='PiSDR'
 ENABLE_SSH=1
 TARGET_HOSTNAME='pisdr'
 FIRST_USER_PASS='raspberry'
+DEPLOY_COMPRESSION='xz'
+COMPRESSION_LEVEL=9

depends

@@ -19,3 +19,5 @@ lsmod:kmod
 bc
 qemu-nbd:qemu-utils
 kpartx
+gpg
+pigz

export-image/01-user-rename/00-packages

@@ -0,0 +1 @@
+userconf-pi

export-image/01-user-rename/01-run.sh

@@ -0,0 +1,9 @@
+#!/bin/bash -e
+
+if [[ "${DISABLE_FIRST_BOOT_USER_RENAME}" == "0" ]]; then
+	on_chroot <<- EOF
+		SUDO_USER="${FIRST_USER_NAME}" rename-user -f -s
+	EOF
+else
+	rm -f "${ROOTFS_DIR}/etc/xdg/autostart/piwiz.desktop"
+fi

export-image/01-set-sources/01-run.sh → export-image/02-set-sources/01-run.sh

@@ -4,6 +4,6 @@ rm -f "${ROOTFS_DIR}/etc/apt/apt.conf.d/51cache"
 find "${ROOTFS_DIR}/var/lib/apt/lists/" -type f -delete
 on_chroot << EOF
 apt-get update
-apt-get -y dist-upgrade
+apt-get -y dist-upgrade --auto-remove --purge
 apt-get clean
 EOF

export-image/03-set-partuuid/00-run.sh → export-image/04-set-partuuid/00-run.sh

@@ -12,7 +12,6 @@ if [ "${NO_PRERUN_QCOW2}" = "0" ]; then
 	sed -i "s/BOOTDEV/PARTUUID=${BOOT_PARTUUID}/" "${ROOTFS_DIR}/etc/fstab"
 	sed -i "s/ROOTDEV/PARTUUID=${ROOT_PARTUUID}/" "${ROOTFS_DIR}/etc/fstab"
 
-	sed -i "s/ROOTDEV/PARTUUID=${ROOT_PARTUUID}/" "${ROOTFS_DIR}/boot/cmdline.txt"
-
+	sed -i "s/ROOTDEV/PARTUUID=${ROOT_PARTUUID}/" "${ROOTFS_DIR}/boot/firmware/cmdline.txt"
 fi
 

export-image/04-finalise/01-run.sh → export-image/05-finalise/01-run.sh

@@ -3,7 +3,10 @@
 IMG_FILE="${STAGE_WORK_DIR}/${IMG_FILENAME}${IMG_SUFFIX}.img"
 INFO_FILE="${STAGE_WORK_DIR}/${IMG_FILENAME}${IMG_SUFFIX}.info"
 
+sed -i 's/^update_initramfs=.*/update_initramfs=all/' "${ROOTFS_DIR}/etc/initramfs-tools/update-initramfs.conf"
+
 on_chroot << EOF
+update-initramfs -u
 if [ -x /etc/init.d/fake-hwclock ]; then
 	/etc/init.d/fake-hwclock stop
 fi
@@ -18,6 +21,12 @@ fi
 
 rm -f "${ROOTFS_DIR}/usr/bin/qemu-arm-static"
 
+if [ "${USE_QEMU}" != "1" ]; then
+	if [ -e "${ROOTFS_DIR}/etc/ld.so.preload.disabled" ]; then
+		mv "${ROOTFS_DIR}/etc/ld.so.preload.disabled" "${ROOTFS_DIR}/etc/ld.so.preload"
+	fi
+fi
+
 rm -f "${ROOTFS_DIR}/etc/network/interfaces.dpkg-old"
 
 rm -f "${ROOTFS_DIR}/etc/apt/sources.list~"
@@ -47,7 +56,7 @@ rm -f "${ROOTFS_DIR}/root/.vnc/private.key"
 rm -f "${ROOTFS_DIR}/etc/vnc/updateid"
 
 update_issue "$(basename "${EXPORT_DIR}")"
-install -m 644 "${ROOTFS_DIR}/etc/rpi-issue" "${ROOTFS_DIR}/boot/issue.txt"
+install -m 644 "${ROOTFS_DIR}/etc/rpi-issue" "${ROOTFS_DIR}/boot/firmware/issue.txt"
 
 cp "$ROOTFS_DIR/etc/rpi-issue" "$INFO_FILE"
 
@@ -72,9 +81,8 @@ cp "$ROOTFS_DIR/etc/rpi-issue" "$INFO_FILE"
 
 mkdir -p "${DEPLOY_DIR}"
 
-rm -f "${DEPLOY_DIR}/${ZIP_FILENAME}${IMG_SUFFIX}.zip"
+rm -f "${DEPLOY_DIR}/${ARCHIVE_FILENAME}${IMG_SUFFIX}.*"
 rm -f "${DEPLOY_DIR}/${IMG_FILENAME}${IMG_SUFFIX}.img"
-rm -f "${DEPLOY_DIR}/${ZIP_FILENAME}${IMG_SUFFIX}.img.xz"
 
 mv "$INFO_FILE" "$DEPLOY_DIR/"
 
@@ -90,11 +98,22 @@ else
 	make_bootable_image "${STAGE_WORK_DIR}/${IMG_FILENAME}${IMG_SUFFIX}.qcow2" "$IMG_FILE"
 fi
 
-if [ "${DEPLOY_ZIP}" == "1" ]; then
+case "${DEPLOY_COMPRESSION}" in
+zip)
 	pushd "${STAGE_WORK_DIR}" > /dev/null
-	xz -T16 -c "$(basename "${IMG_FILE}")" > "${DEPLOY_DIR}/${ZIP_FILENAME}${IMG_SUFFIX}.img.xz"
+	zip -"${COMPRESSION_LEVEL}" \
+	"${DEPLOY_DIR}/${ARCHIVE_FILENAME}${IMG_SUFFIX}.zip" "$(basename "${IMG_FILE}")"
 	popd > /dev/null
-	rm -f "${DEPLOY_DIR}/${IMG_FILENAME}${IMG_SUFFIX}.img"
-else
-	mv "$IMG_FILE" "$DEPLOY_DIR/"
-fi
+	;;
+gz)
+	pigz --force -"${COMPRESSION_LEVEL}" "$IMG_FILE" --stdout > \
+	"${DEPLOY_DIR}/${ARCHIVE_FILENAME}${IMG_SUFFIX}.img.gz"
+	;;
+xz)
+	xz --compress --force --threads 0 --memlimit-compress=50% -"${COMPRESSION_LEVEL}" \
+	--stdout "$IMG_FILE" > "${DEPLOY_DIR}/${ARCHIVE_FILENAME}${IMG_SUFFIX}.img.xz"
+	;;
+none | *)
+	cp "$IMG_FILE" "$DEPLOY_DIR/"
+;;
+esac

export-image/prerun.sh

@@ -10,8 +10,8 @@ if [ "${NO_PRERUN_QCOW2}" = "0" ]; then
 	rm -rf "${ROOTFS_DIR}"
 	mkdir -p "${ROOTFS_DIR}"
 
-	BOOT_SIZE="$((256 * 1024 * 1024))"
-	ROOT_SIZE=$(du --apparent-size -s "${EXPORT_ROOTFS_DIR}" --exclude var/cache/apt/archives --exclude boot --block-size=1 | cut -f 1)
+	BOOT_SIZE="$((512 * 1024 * 1024))"
+	ROOT_SIZE=$(du --apparent-size -s "${EXPORT_ROOTFS_DIR}" --exclude var/cache/apt/archives --exclude boot/firmware --block-size=1 | cut -f 1)
 
 	# All partition sizes and starts will be aligned to this size
 	ALIGN="$((4 * 1024 * 1024))"
@@ -33,55 +33,35 @@ if [ "${NO_PRERUN_QCOW2}" = "0" ]; then
 	parted --script "${IMG_FILE}" unit B mkpart primary fat32 "${BOOT_PART_START}" "$((BOOT_PART_START + BOOT_PART_SIZE - 1))"
 	parted --script "${IMG_FILE}" unit B mkpart primary ext4 "${ROOT_PART_START}" "$((ROOT_PART_START + ROOT_PART_SIZE - 1))"
 
-	PARTED_OUT=$(parted -sm "${IMG_FILE}" unit b print)
-	BOOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^1:' | cut -d':' -f 2 | tr -d B)
-	BOOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^1:' | cut -d':' -f 4 | tr -d B)
-
-	ROOT_OFFSET=$(echo "$PARTED_OUT" | grep -e '^2:' | cut -d':' -f 2 | tr -d B)
-	ROOT_LENGTH=$(echo "$PARTED_OUT" | grep -e '^2:' | cut -d':' -f 4 | tr -d B)
-
-	echo "Mounting BOOT_DEV..."
-	cnt=0
-	until BOOT_DEV=$(losetup --show -f -o "${BOOT_OFFSET}" --sizelimit "${BOOT_LENGTH}" "${IMG_FILE}"); do
-		if [ $cnt -lt 5 ]; then
-			cnt=$((cnt + 1))
-			echo "Error in losetup for BOOT_DEV.  Retrying..."
-			sleep 5
-		else
-			echo "ERROR: losetup for BOOT_DEV failed; exiting"
-			exit 1
-		fi
-	done
-
-	echo "Mounting ROOT_DEV..."
+	echo "Creating loop device..."
 	cnt=0
-	until ROOT_DEV=$(losetup --show -f -o "${ROOT_OFFSET}" --sizelimit "${ROOT_LENGTH}" "${IMG_FILE}"); do
+	until ensure_next_loopdev && LOOP_DEV="$(losetup --show --find --partscan "$IMG_FILE")"; do
 		if [ $cnt -lt 5 ]; then
 			cnt=$((cnt + 1))
-			echo "Error in losetup for ROOT_DEV.  Retrying..."
+			echo "Error in losetup.  Retrying..."
 			sleep 5
 		else
-			echo "ERROR: losetup for ROOT_DEV failed; exiting"
+			echo "ERROR: losetup failed; exiting"
 			exit 1
 		fi
 	done
 
-	echo "/boot: offset $BOOT_OFFSET, length $BOOT_LENGTH"
-	echo "/:     offset $ROOT_OFFSET, length $ROOT_LENGTH"
+	BOOT_DEV="${LOOP_DEV}p1"
+	ROOT_DEV="${LOOP_DEV}p2"
 
 	ROOT_FEATURES="^huge_file"
-	for FEATURE in metadata_csum 64bit; do
+	for FEATURE in 64bit; do
 	if grep -q "$FEATURE" /etc/mke2fs.conf; then
 		ROOT_FEATURES="^$FEATURE,$ROOT_FEATURES"
 	fi
 	done
-	mkdosfs -n boot -F 32 -v "$BOOT_DEV" > /dev/null
+	mkdosfs -n bootfs -F 32 -s 4 -v "$BOOT_DEV" > /dev/null
 	mkfs.ext4 -L rootfs -O "$ROOT_FEATURES" "$ROOT_DEV" > /dev/null
 
 	mount -v "$ROOT_DEV" "${ROOTFS_DIR}" -t ext4
-	mkdir -p "${ROOTFS_DIR}/boot"
-	mount -v "$BOOT_DEV" "${ROOTFS_DIR}/boot" -t vfat
+	mkdir -p "${ROOTFS_DIR}/boot/firmware"
+	mount -v "$BOOT_DEV" "${ROOTFS_DIR}/boot/firmware" -t vfat
 
-	rsync -aHAXx --exclude /var/cache/apt/archives --exclude /boot "${EXPORT_ROOTFS_DIR}/" "${ROOTFS_DIR}/"
-	rsync -rtx "${EXPORT_ROOTFS_DIR}/boot/" "${ROOTFS_DIR}/boot/"
+	rsync -aHAXx --exclude /var/cache/apt/archives --exclude /boot/firmware "${EXPORT_ROOTFS_DIR}/" "${ROOTFS_DIR}/"
+	rsync -rtx "${EXPORT_ROOTFS_DIR}/boot/firmware/" "${ROOTFS_DIR}/boot/firmware/"
 fi

scripts/common

@@ -7,21 +7,18 @@ bootstrap(){
 	local BOOTSTRAP_CMD=debootstrap
 	local BOOTSTRAP_ARGS=()
 
-	#export http_proxy=${APT_PROXY}
-
-	if [ "$(dpkg --print-architecture)" !=  "armhf" ] && [ "$(dpkg --print-architecture)" !=  "aarch64" ]; then
-		BOOTSTRAP_CMD=qemu-debootstrap
-	fi
+	export http_proxy=${APT_PROXY}
 
 	BOOTSTRAP_ARGS+=(--arch arm64)
 	BOOTSTRAP_ARGS+=(--include gnupg)
 	BOOTSTRAP_ARGS+=(--components "main,contrib,non-free")
 	#BOOTSTRAP_ARGS+=(--keyring "${STAGE_DIR}/files/raspberrypi.gpg")
 	BOOTSTRAP_ARGS+=(--exclude=info)
+	BOOTSTRAP_ARGS+=(--include=ca-certificates)
 	BOOTSTRAP_ARGS+=("$@")
 	printf -v BOOTSTRAP_STR '%q ' "${BOOTSTRAP_ARGS[@]}"
 
-	capsh --drop=cap_setfcap -- -c "'${BOOTSTRAP_CMD}' $BOOTSTRAP_STR" || true
+	capsh $CAPSH_ARG -- -c "'${BOOTSTRAP_CMD}' $BOOTSTRAP_STR" || true
 
 	if [ -d "$2/debootstrap" ] && ! rmdir "$2/debootstrap"; then
 		cp "$2/debootstrap/debootstrap.log" "${STAGE_WORK_DIR}"
@@ -61,19 +58,15 @@ export -f unmount
 unmount_image(){
 	sync
 	sleep 1
-	local LOOP_DEVICES
-	LOOP_DEVICES=$(losetup --list | grep "$(basename "${1}")" | cut -f1 -d' ')
-	for LOOP_DEV in ${LOOP_DEVICES}; do
-		if [ -n "${LOOP_DEV}" ]; then
-			local MOUNTED_DIR
-			MOUNTED_DIR=$(mount | grep "$(basename "${LOOP_DEV}")" | head -n 1 | cut -f 3 -d ' ')
-			if [ -n "${MOUNTED_DIR}" ] && [ "${MOUNTED_DIR}" != "/" ]; then
-				unmount "$(dirname "${MOUNTED_DIR}")"
+	LOOP_DEVICE=$(losetup --list | grep "$1" | cut -f1 -d' ')
+	if [ -n "$LOOP_DEVICE" ]; then
+		for part in "$LOOP_DEVICE"p*; do
+			if DIR=$(findmnt -n -o target -S "$part"); then
+				unmount "$DIR"
 			fi
-			sleep 1
-			losetup -d "${LOOP_DEV}"
-		fi
-	done
+		done
+		losetup -d "$LOOP_DEVICE"
+	fi
 }
 export -f unmount_image
 
@@ -94,7 +87,15 @@ on_chroot() {
 		mount --bind /sys "${ROOTFS_DIR}/sys"
 	fi
 
-	capsh --drop=cap_setfcap "--chroot=${ROOTFS_DIR}/" -- -e "$@"
+	if ! mount | grep -q "$(realpath "${ROOTFS_DIR}"/run)"; then
+		mount -t tmpfs  tmpfs "${ROOTFS_DIR}/run"
+	fi
+
+	if ! mount | grep -q "$(realpath "${ROOTFS_DIR}"/tmp)"; then
+		mount -t tmpfs  tmpfs "${ROOTFS_DIR}/tmp"
+	fi
+
+	capsh $CAPSH_ARG "--chroot=${ROOTFS_DIR}/" -- -e "$@"
 }
 export -f on_chroot
 
@@ -102,3 +103,11 @@ update_issue() {
 	echo -e "Raspberry Pi reference ${IMG_DATE}\nGenerated using ${PI_GEN}, ${PI_GEN_REPO}, ${GIT_HASH}, ${1}" > "${ROOTFS_DIR}/etc/rpi-issue"
 }
 export -f update_issue
+
+ensure_next_loopdev() {
+	local loopdev
+	loopdev="$(losetup -f)"
+	loopmaj="$(echo "$loopdev" | sed -E 's/.*[^0-9]*?([0-9]+)$/\1/')"
+	[[ -b "$loopdev" ]] || mknod "$loopdev" b 7 "$loopmaj"
+}
+export -f ensure_next_loopdev

scripts/qcow2_handling

@@ -109,8 +109,8 @@ load_qimage() {
 EOF
 				sync
 				kpartx -as $NBD_DEV
-				mkdosfs -n boot -F 32 -v $MAP_BOOT_DEV
-				mkfs.ext4 -L rootfs -O "^huge_file,^metadata_csum,^64bit" $MAP_ROOT_DEV
+				mkdosfs -n boot -F 32 -s 4 -v $MAP_BOOT_DEV
+				mkfs.ext4 -L rootfs -O "^huge_file,^64bit" $MAP_ROOT_DEV
 				sync
 			else
 				if [ ! -f "${WORK_DIR}/image-${PREV_STAGE}.qcow2" ]; then

stage0/00-configure-apt/00-run.sh

@@ -12,7 +12,8 @@ else
 	rm -f "${ROOTFS_DIR}/etc/apt/apt.conf.d/51cache"
 fi
 
-on_chroot apt-key add - < files/raspberrypi.gpg.key
+cat files/raspberrypi.gpg.key | gpg --dearmor > "${STAGE_WORK_DIR}/raspberrypi-archive-stable.gpg"
+install -m 644 "${STAGE_WORK_DIR}/raspberrypi-archive-stable.gpg" "${ROOTFS_DIR}/etc/apt/trusted.gpg.d/"
 on_chroot << EOF
 dpkg --add-architecture armhf
 apt-get update

stage0/00-configure-apt/01-packages

@@ -0,0 +1 @@
+raspberrypi-archive-keyring

stage0/00-configure-apt/files/raspi.list

@@ -1,3 +1,3 @@
-deb http://archive.raspberrypi.org/debian/ RELEASE main
+deb http://archive.raspberrypi.com/debian/ RELEASE main
 # Uncomment line below then 'apt-get update' to enable 'apt-get source'
-#deb-src http://archive.raspberrypi.org/debian/ RELEASE main
+#deb-src http://archive.raspberrypi.com/debian/ RELEASE main

stage0/00-configure-apt/files/sources.list

@@ -1,7 +1,7 @@
-deb http://deb.debian.org/debian RELEASE main contrib non-free
-deb http://security.debian.org/debian-security RELEASE-security main contrib non-free
-deb http://deb.debian.org/debian RELEASE-updates main contrib non-free
+deb http://deb.debian.org/debian RELEASE main contrib non-free non-free-firmware
+deb http://deb.debian.org/debian-security/ RELEASE-security main contrib non-free non-free-firmware
+deb http://deb.debian.org/debian RELEASE-updates main contrib non-free non-free-firmware
 # Uncomment deb-src lines below then 'apt-get update' to enable 'apt-get source'
-#deb-src http://deb.debian.org/debian RELEASE main contrib non-free
-#deb-src http://security.debian.org/debian-security RELEASE-security main contrib non-free
-#deb-src http://deb.debian.org/debian RELEASE-updates main contrib non-free
+#deb-src http://deb.debian.org/debian RELEASE main contrib non-free non-free-firmware
+#deb-src http://deb.debian.org/debian-security/ RELEASE-security main contrib non-free non-free-firmware
+#deb-src http://deb.debian.org/debian RELEASE-updates main contrib non-free non-free-firmware

stage0/02-firmware/01-packages

@@ -1,3 +1,6 @@
-raspberrypi-bootloader
-raspberrypi-kernel
-raspi-config
+initramfs-tools
+raspi-firmware
+linux-image-rpi-v8
+linux-image-rpi-2712
+linux-headers-rpi-v8
+linux-headers-rpi-2712

stage0/02-firmware/02-run.sh

@@ -0,0 +1,3 @@
+#!/bin/bash -e
+
+sed -i 's/^update_initramfs=.*/update_initramfs=no/' "${ROOTFS_DIR}/etc/initramfs-tools/update-initramfs.conf"

stage0/prerun.sh

@@ -1,5 +1,10 @@
 #!/bin/bash -e
 
+if [ "$RELEASE" != "bookworm" ]; then
+	echo "WARNING: RELEASE does not match the intended option for this branch."
+	echo "         Please check the relevant README.md section."
+fi
+
 if [ ! -d "${ROOTFS_DIR}" ] || [ "${USE_QCOW2}" = "1" ]; then
 	bootstrap ${RELEASE} "${ROOTFS_DIR}" http://deb.debian.org/debian/
 fi

stage1/00-boot-files/00-run.sh

@@ -1,4 +1,17 @@
 #!/bin/bash -e
 
-install -m 644 files/cmdline.txt "${ROOTFS_DIR}/boot/"
-install -m 644 files/config.txt "${ROOTFS_DIR}/boot/"
+mkdir -p "${ROOTFS_DIR}/boot/firmware"
+
+if ! [ -L "${ROOTFS_DIR}/boot/overlays" ]; then
+	ln -s firmware/overlays "${ROOTFS_DIR}/boot/overlays"
+fi
+
+install -m 644 files/cmdline.txt "${ROOTFS_DIR}/boot/firmware/"
+if ! [ -L "${ROOTFS_DIR}/boot/cmdline.txt" ]; then
+	ln -s firmware/cmdline.txt "${ROOTFS_DIR}/boot/cmdline.txt"
+fi
+
+install -m 644 files/config.txt "${ROOTFS_DIR}/boot/firmware/"
+if ! [ -L "${ROOTFS_DIR}/boot/config.txt" ]; then
+	ln -s firmware/config.txt "${ROOTFS_DIR}/boot/config.txt"
+fi

stage1/00-boot-files/files/config.txt

@@ -1,73 +1,44 @@
 # For more options and information see
-# http://rpf.io/configtxt
+# http://rptl.io/configtxt
 # Some settings may impact device functionality. See link above for details
 
-# uncomment if you get no picture on HDMI for a default "safe" mode
-#hdmi_safe=1
-
-# uncomment the following to adjust overscan. Use positive numbers if console
-# goes off screen, and negative if there is too much border
-#overscan_left=16
-#overscan_right=16
-#overscan_top=16
-#overscan_bottom=16
-
-# uncomment to force a console size. By default it will be display's size minus
-# overscan.
-#framebuffer_width=1920
-#framebuffer_height=1080
-
-# uncomment if hdmi display is not detected and composite is being output
-#hdmi_force_hotplug=1
-
-# uncomment to force a specific HDMI mode (this will force VGA)
-#hdmi_group=1
-#hdmi_mode=1
-
-# uncomment to force a HDMI mode rather than DVI. This can make audio work in
-# DMT (computer monitor) modes
-#hdmi_drive=2
-
-# uncomment to increase signal to HDMI, if you have interference, blanking, or
-# no display
-#config_hdmi_boost=4
-
-# uncomment for composite PAL
-#sdtv_mode=2
-
-#uncomment to overclock the arm. 700 MHz is the default.
-#arm_freq=800
-
 # Uncomment some or all of these to enable the optional hardware interfaces
 #dtparam=i2c_arm=on
 #dtparam=i2s=on
 #dtparam=spi=on
 
-# Uncomment this to enable infrared communication.
-#dtoverlay=gpio-ir,gpio_pin=17
-#dtoverlay=gpio-ir-tx,gpio_pin=18
-
-# Additional overlays and parameters are documented /boot/overlays/README
-
 # Enable audio (loads snd_bcm2835)
 dtparam=audio=on
 
+# Additional overlays and parameters are documented
+# /boot/firmware/overlays/README
+
 # Automatically load overlays for detected cameras
 camera_auto_detect=1
 
 # Automatically load overlays for detected DSI displays
 display_auto_detect=1
 
+# Automatically load initramfs files, if found
+auto_initramfs=1
+
 # Enable DRM VC4 V3D driver
 dtoverlay=vc4-kms-v3d
 max_framebuffers=2
 
+# Don't have the firmware create an initial video= setting in cmdline.txt.
+# Use the kernel's default instead.
+disable_fw_kms_setup=1
+
 # Run in 64-bit mode
 arm_64bit=1
 
 # Disable compensation for displays with overscan
 disable_overscan=1
 
+# Run as fast as firmware / board allows
+arm_boost=1
+
 [cm4]
 # Enable host mode on the 2711 built-in XHCI USB controller.
 # This line should be removed if the legacy DWC2 controller is required
@@ -76,8 +47,3 @@ otg_mode=1
 
 [all]
 
-[pi4]
-# Run as fast as firmware / board allows
-arm_boost=1
-
-[all]

stage1/01-sys-tweaks/00-packages

@@ -0,0 +1 @@
+raspi-config

stage1/01-sys-tweaks/00-run.sh

@@ -8,7 +8,10 @@ on_chroot << EOF
 if ! id -u ${FIRST_USER_NAME} >/dev/null 2>&1; then
 	adduser --disabled-password --gecos "" ${FIRST_USER_NAME}
 fi
-echo "${FIRST_USER_NAME}:${FIRST_USER_PASS}" | chpasswd
+
+if [ -n "${FIRST_USER_PASS}" ]; then
+	echo "${FIRST_USER_NAME}:${FIRST_USER_PASS}" | chpasswd
+fi
 echo "root:root" | chpasswd
 EOF
 

stage1/01-sys-tweaks/files/fstab

@@ -1,3 +1,3 @@
 proc            /proc           proc    defaults          0       0
-BOOTDEV  /boot           vfat    defaults          0       2
+BOOTDEV  /boot/firmware  vfat    defaults          0       2
 ROOTDEV  /               ext4    defaults,noatime  0       1

stage1/03-install-packages/00-packages

@@ -1 +1,2 @@
 libraspberrypi-bin libraspberrypi0
+systemd-timesyncd

stage2/00-copies-and-fills/01-packages

@@ -1 +0,0 @@
-raspi-copies-and-fills

stage2/00-copies-and-fills/02-run.sh

@@ -1,6 +0,0 @@
-#!/bin/bash -e
-
-if [ -f "${ROOTFS_DIR}/etc/ld.so.preload" ]; then
-   mv "${ROOTFS_DIR}/etc/ld.so.preload" "${ROOTFS_DIR}/etc/ld.so.preload.disabled"
-fi
-

stage2/01-sys-tweaks/00-packages

@@ -1,13 +1,17 @@
-ssh less fbset sudo psmisc strace ed ncdu crda
-console-setup keyboard-configuration debconf-utils parted unzip
+ssh less fbset sudo psmisc strace ed ncdu
+console-setup keyboard-configuration debconf-utils parted
 build-essential manpages-dev bash-completion gdb pkg-config
 python-is-python3
-python3-rpi.gpio v4l-utils
+v4l-utils
+python3-libgpiod
 python3-gpiozero
+pigpio python3-pigpio raspi-gpio python3-rpi.gpio
+python3-spidev
+python3-smbus2
 avahi-daemon
 lua5.1
 luajit
-hardlink ca-certificates curl
+ca-certificates curl
 fake-hwclock nfs-common usbutils
 libraspberrypi-dev libraspberrypi-doc libfreetype6-dev
 dosfstools
@@ -24,9 +28,12 @@ htop
 man-db
 policykit-1
 ssh-import-id
-rng-tools
 ethtool
 ntfs-3g
 pciutils
 rpi-eeprom
-raspinfo
+raspi-utils
+udisks2
+unzip zip p7zip-full
+file
+kms++-utils

stage2/01-sys-tweaks/00-patches/07-resize-init.diff

@@ -1,5 +1,5 @@
---- stage2.orig/rootfs/boot/cmdline.txt
-+++ stage2/rootfs/boot/cmdline.txt
+--- stage2.orig/rootfs/boot/firmware/cmdline.txt
++++ stage2/rootfs/boot/firmware/cmdline.txt
 @@ -1 +1 @@
 -console=serial0,115200 console=tty1 root=ROOTDEV rootfstype=ext4 fsck.repair=yes rootwait
-+console=serial0,115200 console=tty1 root=ROOTDEV rootfstype=ext4 fsck.repair=yes rootwait quiet init=/usr/lib/raspi-config/init_resize.sh
++console=serial0,115200 console=tty1 root=ROOTDEV rootfstype=ext4 fsck.repair=yes rootwait quiet init=/usr/lib/raspberrypi-sys-mods/firstboot

stage2/01-sys-tweaks/01-run.sh

@@ -24,8 +24,6 @@ s/^#?[[:blank:]]*PasswordAuthentication[[:blank:]]*yes[[:blank:]]*$/PasswordAuth
 fi
 
 on_chroot << EOF
-gcc -march=native -Q --help=target
-echo "++++++++++++++++++++++++++++++++++++"
 systemctl disable hwclock.sh
 systemctl disable nfs-common
 systemctl disable rpcbind
@@ -54,11 +52,15 @@ on_chroot <<EOF
 for GRP in input spi i2c gpio; do
 	groupadd -f -r "\$GRP"
 done
-for GRP in adm dialout cdrom audio users sudo video games plugdev input gpio spi i2c netdev; do
+for GRP in adm dialout cdrom audio users sudo video games plugdev input gpio spi i2c netdev render; do
   adduser $FIRST_USER_NAME \$GRP
 done
 EOF
 
+if [ -f "${ROOTFS_DIR}/etc/sudoers.d/010_pi-nopasswd" ]; then
+  sed -i "s/^pi /$FIRST_USER_NAME /" "${ROOTFS_DIR}/etc/sudoers.d/010_pi-nopasswd"
+fi
+
 on_chroot << EOF
 setupcon --force --save-only -v
 EOF

stage2/02-net-tweaks/00-packages

@@ -1,4 +1,4 @@
 wpasupplicant wireless-tools firmware-atheros firmware-brcm80211 firmware-libertas firmware-misc-nonfree firmware-realtek
 raspberrypi-net-mods
-dhcpcd5
+network-manager
 net-tools

stage2/02-net-tweaks/01-run.sh

@@ -3,27 +3,10 @@
 install -v -d					"${ROOTFS_DIR}/etc/wpa_supplicant"
 install -v -m 600 files/wpa_supplicant.conf	"${ROOTFS_DIR}/etc/wpa_supplicant/"
 
-on_chroot << EOF
-	SUDO_USER="${FIRST_USER_NAME}" raspi-config nonint do_boot_wait 0
-EOF
-
 if [ -v WPA_COUNTRY ]; then
-	echo "country=${WPA_COUNTRY}" >> "${ROOTFS_DIR}/etc/wpa_supplicant/wpa_supplicant.conf"
-fi
-
-if [ -v WPA_ESSID ] && [ -v WPA_PASSWORD ]; then
-on_chroot <<EOF
-set -o pipefail
-wpa_passphrase "${WPA_ESSID}" "${WPA_PASSWORD}" | tee -a "/etc/wpa_supplicant/wpa_supplicant.conf"
-EOF
-elif [ -v WPA_ESSID ]; then
-cat >> "${ROOTFS_DIR}/etc/wpa_supplicant/wpa_supplicant.conf" << EOL
-
-network={
-	ssid="${WPA_ESSID}"
-	key_mgmt=NONE
-}
-EOL
+	on_chroot <<- EOF
+		SUDO_USER="${FIRST_USER_NAME}" raspi-config nonint do_wifi_country "${WPA_COUNTRY}"
+	EOF
 fi
 
 # Disable wifi on 5GHz models if WPA_COUNTRY is not set
@@ -31,7 +14,9 @@ mkdir -p "${ROOTFS_DIR}/var/lib/systemd/rfkill/"
 if [ -n "$WPA_COUNTRY" ]; then
     echo 0 > "${ROOTFS_DIR}/var/lib/systemd/rfkill/platform-3f300000.mmcnr:wlan"
     echo 0 > "${ROOTFS_DIR}/var/lib/systemd/rfkill/platform-fe300000.mmcnr:wlan"
+    echo 0 > "${ROOTFS_DIR}/var/lib/systemd/rfkill/platform-1001100000.mmc:wlan"
 else
     echo 1 > "${ROOTFS_DIR}/var/lib/systemd/rfkill/platform-3f300000.mmcnr:wlan"
     echo 1 > "${ROOTFS_DIR}/var/lib/systemd/rfkill/platform-fe300000.mmcnr:wlan"
+    echo 1 > "${ROOTFS_DIR}/var/lib/systemd/rfkill/platform-1001100000.mmc:wlan"
 fi

stage3/00-install-packages/00-packages

@@ -1,5 +1,5 @@
 gstreamer1.0-x gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-plugins-bad gstreamer1.0-alsa gstreamer1.0-libav
-qpdfview gtk2-engines alsa-utils
+evince gtk2-engines alsa-utils
 desktop-base
 git
 policykit-1
@@ -12,4 +12,4 @@ fonts-liberation2
 obconf
 arandr
 libcamera-tools
-libcamera-apps
+libcamera-apps

stage3/00-install-packages/00-packages-nr

@@ -1,6 +1,8 @@
 xserver-xorg xinit
 mousepad
+eom
 lxde lxtask menu-xdg
 zenity xdg-utils
 gvfs-backends gvfs-fuse
-lightdm gnome-themes-standard gnome-icon-theme
+lightdm gnome-themes-extra-data gnome-icon-theme
+gnome-keyring

stage3/01-tweaks/00-run.sh

@@ -1,5 +0,0 @@
-#!/bin/bash -e
-
-on_chroot << EOF
-	SUDO_USER="${FIRST_USER_NAME}" raspi-config nonint do_boot_wait 1
-EOF

stage4/00-install-packages/00-packages

@@ -2,24 +2,18 @@ python3-pygame
 python3-tk thonny
 python3-pgzero
 python3-serial
-python3-picamera
 debian-reference-en dillo
 raspberrypi-net-mods raspberrypi-ui-mods
 python3-pip
 python3-numpy
-pypy
 alacarte rc-gui sense-hat
 tree
 libgl1-mesa-dri libgles1 libgles2-mesa xcompmgr
 geany
 piclone
-pigpio python3-pigpio raspi-gpio python3-rpi.gpio
-python3-spidev
 python3-twython
-python3-smbus
 python3-flask
 pprompt
 piwiz
 rp-prefapps
 ffmpeg
-vlc

stage4/00-install-packages/00-run.sh

@@ -0,0 +1,5 @@
+#!/bin/bash -e
+
+on_chroot << EOF
+	SUDO_USER="${FIRST_USER_NAME}" raspi-config nonint do_wayland W2
+EOF

stage4/00-install-packages/01-packages

@@ -1,22 +0,0 @@
-python3-automationhat
-python3-blinkt
-python3-cap1xxx
-python3-drumhat
-python3-envirophat
-python3-explorerhat
-python3-fourletterphat
-python3-microdotphat
-python3-mote
-python3-motephat
-python3-phatbeat
-python3-pianohat
-python3-piglow
-python3-rainbowhat
-python3-scrollphat
-python3-scrollphathd
-python3-sn3218
-python3-skywriter
-python3-touchphat
-python3-buttonshim
-python3-unicornhathd
-python3-pantilthat

stage4/00-install-packages/01-run.sh

@@ -0,0 +1,3 @@
+#!/bin/bash -e
+
+sed -i 's/^.*HandlePowerKey=.*$/HandlePowerKey=ignore/' "${ROOTFS_DIR}/etc/systemd/logind.conf"

stage4/05-pisdr-uhd/00-run.sh

@@ -5,7 +5,7 @@ mkdir -p 	"/home/${FIRST_USER_NAME}/PiSDR/Software"
 cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 
 if [ ! -d "uhd" ]; then
-    git clone --single-branch --branch UHD-3.15.LTS --depth 1 https://github.com/EttusResearch/uhd.git
+    git clone --single-branch --branch UHD-4.4 --depth 1 https://github.com/EttusResearch/uhd.git
 fi
 
 cd uhd/host

stage4/09-pisdr-limesdr/00-packages-nr

@@ -2,5 +2,5 @@ swig
 libsqlite3-dev
 libi2c-dev
 libusb-1.0-0-dev
-libwxgtk3.0-gtk3-dev
+libwxgtk3.2-dev
 freeglut3-dev

stage4/10-pisdr-plutosdr/00-packages-nr

@@ -5,4 +5,5 @@ libcdk5-dev
 libaio-dev
 libusb-1.0-0-dev
 libserialport-dev
-libavahi-client-dev
+libavahi-client-dev
+libzstd-dev

stage4/10-pisdr-plutosdr/00-run.sh

@@ -5,7 +5,7 @@ mkdir -p    "/home/${FIRST_USER_NAME}/PiSDR/Radios"
 cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Radios"
 
 if [ ! -d "libiio" ]; then
-    git clone --depth 1 https://github.com/analogdevicesinc/libiio
+    git clone --depth 1 --branch libiio-v0 https://github.com/analogdevicesinc/libiio
 fi
 
 cd libiio

stage4/10-pisdr-plutosdr/01-run.sh

@@ -5,7 +5,7 @@ mkdir -p    "/home/${FIRST_USER_NAME}/PiSDR/Radios"
 cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Radios"
 
 if [ ! -d "libad9361-iio" ]; then
-    git clone --depth 1 https://github.com/analogdevicesinc/libad9361-iio
+    git clone --depth 1 --branch v0.3 https://github.com/analogdevicesinc/libad9361-iio
 fi
 
 cd libad9361-iio

stage4/11-pisdr-rtlsdr/00-run.sh

@@ -5,10 +5,10 @@ mkdir -p    "/home/${FIRST_USER_NAME}/PiSDR/Radios"
 cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Radios"
 
 if [ ! -d "rtl-sdr" ]; then
-    git clone --depth 1 https://github.com/osmocom/rtl-sdr
+    git clone --depth 1 https://github.com/rtlsdrblog/rtl-sdr-blog.git
 fi
 
-cd rtl-sdr
+cd rtl-sdr-blog
 mkdir -p build
 cd build
 cmake -GNinja -DINSTALL_UDEV_RULES=ON -DDETACH_KERNEL_DRIVER=ON ..

stage4/12-pisdr-hackrf/00-run.sh

@@ -5,7 +5,7 @@ mkdir -p    "/home/${FIRST_USER_NAME}/PiSDR/Radios"
 cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Radios"
 
 if [ ! -d "hackrf" ]; then
-    git clone https://github.com/mossmann/hackrf.git
+    git clone --depth 1 https://github.com/mossmann/hackrf.git
 fi
 
 cd hackrf/host

stage4/13-pisdr-gnuradio/00-packages-nr

@@ -18,6 +18,7 @@ libqt5opengl5-dev
 libcodec2-dev
 libsndfile1-dev
 pybind11-dev
+libspdlog-dev
 gir1.2-gtk-3.0
 swig
 
@@ -35,4 +36,6 @@ python3-pip
 python3-gi-cairo
 python3-matplotlib
 python3-pygccxml
-python3-pyqtgraph
+python3-pyqtgraph
+python3-packaging
+python3-jsonschema

stage4/13-pisdr-gnuradio/00-run.sh

@@ -5,7 +5,7 @@ mkdir -p 	"/home/${FIRST_USER_NAME}/PiSDR/Software"
 cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 
 if [ ! -d "volk" ]; then
-	git clone --single-branch --branch v2.5.0 --depth 1 --recurse-submodules --shallow-submodules https://github.com/gnuradio/volk.git
+	git clone --single-branch --branch v3.0.0 --depth 1 --recurse-submodules --shallow-submodules https://github.com/gnuradio/volk.git
 fi
 
 cd volk

stage4/13-pisdr-gnuradio/01-run.sh

@@ -5,7 +5,7 @@ mkdir -p 	"/home/${FIRST_USER_NAME}/PiSDR/Software"
 cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 
 if [ ! -d "gnuradio" ]; then
-    git clone --single-branch --branch maint-3.9 --depth 1 --recurse-submodules --shallow-submodules https://github.com/gnuradio/gnuradio.git
+    git clone --single-branch --branch maint-3.10 --depth 1 --recurse-submodules --shallow-submodules https://github.com/gnuradio/gnuradio.git
 fi
 
 cd gnuradio

stage4/14-pisdr-gnuradio-mod/03-run.sh

@@ -5,7 +5,7 @@ mkdir -p    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 
 if [ ! -d "gr-sdrplay3" ]; then
-    git clone --single-branch --branch master --depth 1 https://github.com/fventuri/gr-sdrplay3.git
+    git clone --single-branch --branch main --depth 1 https://github.com/fventuri/gr-sdrplay3.git
 fi
 
 cd gr-sdrplay3

stage4/18-pisdr-sdrangel/00-packages-nr

@@ -41,3 +41,12 @@ libavcodec-dev
 libavformat-dev
 libopus-dev
 graphviz
+libqt5texttospeech5-dev
+zlib1g-dev
+libfaad-dev
+libqt5gamepad5-dev
+qtbase5-private-dev
+qtwebengine5-dev
+qml-module-qtquick-controls2
+libspeexdsp-dev
+libsamplerate0-dev

stage4/18-pisdr-sdrangel/00-run.sh

@@ -13,7 +13,7 @@ git reset --hard c0e92b92aca3d1d36c990b642b937c64d363c559
 mkdir -p build
 cd build
 cmake -GNinja ..
-ninja
+ninja install
 ldconfig
 cd ..
 rm -fr build

stage4/18-pisdr-sdrangel/03-run.sh

@@ -9,7 +9,7 @@ if [ ! -d "dsdcc" ]; then
 fi
 
 cd dsdcc
-git reset --hard "v1.9.0"
+git reset --hard "v1.9.3"
 mkdir -p build
 cd build
 cmake -GNinja -DUSE_MBELIB=ON  ..

stage4/18-pisdr-sdrangel/04-run.sh

@@ -5,11 +5,11 @@ mkdir -p    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 
 if [ ! -d "codec2" ]; then
-    git clone https://github.com/drowe67/codec2.git
+    git clone https://github.com/drowe67/codec2-dev.git codec2
 fi
 
 cd codec2
-git reset --hard 76a20416d715ee06f8b36a9953506876689a3bd2
+git reset --hard "v1.0.3"
 mkdir -p build
 cd build
 cmake -GNinja ..

stage4/18-pisdr-sdrangel/05-run.sh

@@ -5,13 +5,13 @@ mkdir -p    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 
 if [ ! -d "sdrangel" ]; then
-    git clone --depth 1 --branch v6.5.5 https://github.com/f4exb/sdrangel.git
+    git clone --depth 1 --branch v7.15.3 https://github.com/f4exb/sdrangel.git
 fi
 
 cd sdrangel
 mkdir -p build
 cd build
-cmake -GNinja ..
+cmake -DSOAPYSDR_DIR=/usr/local -GNinja ..
 ninja install
 ldconfig
 cd ..

stage4/24-pisdr-rpitx/00-packages-nr

@@ -10,7 +10,7 @@ liblqr-1-0
 libmagickcore-6.q16-6
 libmagickcore-6.q16-6-extra
 libmagickwand-6.q16-6
-libnetpbm10
+libnetpbm11
 libpng-dev
 libwmf0.2-7
 netpbm

stage4/26-pisdr-quisk/00-run.sh

@@ -1,5 +1,8 @@
 #!/bin/bash -e
 
+# currently not compiling with Bookworm
+exit
+
 on_chroot << EOF
 python3 -m pip install --upgrade quisk
 EOF

stage4/28-pisdr-airband/00-run.sh

@@ -5,7 +5,7 @@ mkdir -p    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 
 if [ ! -d "RTLSDR-Airband" ]; then
-    git clone --depth 1 https://github.com/szpajder/RTLSDR-Airband.git
+    git clone --branch unstable --depth 1 https://github.com/szpajder/RTLSDR-Airband.git
 fi
 
 cd RTLSDR-Airband

stage4/32-pisdr-cyberether/00-packages

@@ -0,0 +1,12 @@
+git 
+build-essential 
+cmake 
+pkg-config 
+ninja-build 
+meson
+mesa-vulkan-drivers 
+libvulkan-dev 
+spirv-cross 
+glslang-tools 
+libglfw3-dev
+libfftw3-dev

stage4/32-pisdr-cyberether/00-run.sh

@@ -0,0 +1,14 @@
+#!/bin/bash -e
+
+on_chroot << EOF
+mkdir -p    "/home/${FIRST_USER_NAME}/PiSDR/Software"
+cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Software"
+
+if [ ! -d "CyberEther" ]; then
+    git clone --branch development --depth 1 https://github.com/luigifcruz/CyberEther.git
+    cd CyberEther
+    meson -Dbuildtype=debugoptimized build
+    cd build
+    ninja
+fi
+EOF

stage4/32-pisdr-foxtelem/00-run.sh

@@ -1,13 +0,0 @@
-#!/bin/bash -e
-
-on_chroot << EOF
-mkdir -p    "/home/${FIRST_USER_NAME}/PiSDR/Software"
-cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Software"
-
-if [ ! -d "FoxTelem" ]; then
-    wget http://amsat.us/FoxTelem/linux/FoxTelem_1.11g2_linux.tar.gz
-    tar -xvzf FoxTelem_1.11g2_linux.tar.gz
-    mv FoxTelem_1.11g2_linux FoxTelem
-    rm FoxTelem_1.11g2_linux.tar.gz
-fi
-EOF

stage4/33-pisdr-sdrplusplus/00-run.sh

@@ -5,7 +5,7 @@ mkdir -p    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 
 if [ ! -d "SDRPlusPlus" ]; then
-    git clone --single-branch --branch 1.0.4 --depth 1 https://github.com/AlexandreRouma/SDRPlusPlus.git
+    git clone --single-branch --branch master --depth 1 https://github.com/AlexandreRouma/SDRPlusPlus.git
 fi
 
 cd SDRPlusPlus

stage4/35-pisdr-urh/00-run.sh

@@ -1,14 +1,17 @@
 #!/bin/bash -e
 
+# currently not compiling with latest AirSpy drivers
+exit
+
 on_chroot << EOF
 mkdir -p    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 
 if [ ! -d "urh" ]; then
-    git clone --depth 1 https://github.com/jopohl/urh.git
+    git clone --depth 1 --branch v2.9.4 https://github.com/jopohl/urh.git
 fi
 
 cd urh
-python3 -m pip install --upgrade cython
+python3 -m pip install cython==3.0.0
 python3 setup.py install
 EOF

stage4/41-pisdr-iiooscilloscope/00-run.sh

@@ -1,11 +1,14 @@
 #!/bin/bash -e
 
+# currently not compiling with latest Gtk
+exit
+
 on_chroot << EOF
 mkdir -p    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 cd 		    "/home/${FIRST_USER_NAME}/PiSDR/Software"
 
 if [ ! -d "iio-oscilloscope" ]; then
-    git clone --depth 1 https://github.com/analogdevicesinc/iio-oscilloscope.git
+    git clone --depth 1 --branch v0.16-master https://github.com/analogdevicesinc/iio-oscilloscope.git
 fi
 
 cd iio-oscilloscope