Slight restructure

.gitignore

@@ -1,2 +1,2 @@
-artifacts/
+build/artifacts/
 secrets/

build/build-image.sh

@@ -3,6 +3,14 @@
 set -euxo pipefail
 
 mkdir -p /artifacts/dist
-export EPREFIX="/artifacts/dist"
+export EPREFIX="/build/artifacts/dist"
 
-emerge --sync --quiet
+rm -f /var/db/repos/gentoo/metadata/timestamp.chk
+emerge --sync --quiet
+eselect profile list | grep hardened
+eselect profile set default/linux/amd64/23.0/musl/hardened/selinux
+
+mkdir -p /etc/portage/sets
+cp /build/packages.txt /etc/portage/sets/halogenos
+
+emerge @halogenos

build/packages.txt

@@ -0,0 +1 @@
+app-shells/bash

compose.yml

@@ -3,7 +3,6 @@ services:
     image: docker.io/gentoo/stage3
     command: /build/build-image.sh
     volumes:
-      - ./artifacts:/artifacts
       - ./build:/build
   sign:
     image: docker.io/vladgh/gpg
@@ -13,11 +12,11 @@ services:
      - signing_key_private
      - signing_key_public
     volumes:
-     - ./artifacts:/artifacts
+     - ./build/artifacts:/artifacts
   serve:
     image: docker.io/halverneus/static-file-server
     volumes:
-     - ./artifacts:/artifacts
+     - ./build/artifacts:/artifacts
 
 secrets:
   signing_key_password: