Further work on build script

.gitignore

@@ -1,2 +1,2 @@
-artifacts/
+build/artifacts/
 secrets/

build/build-image.sh

@@ -2,7 +2,47 @@
 
 set -euxo pipefail
 
-mkdir -p /artifacts/dist
+# Clean build dir and remake
-export EPREFIX="/artifacts/dist"
+rm -rf /build/artifacts/*
+mkdir -p /build/artifacts/dist
 
-emerge --sync --quiet
+# Gentoo setup
+mkdir -p /var/db/repos/gentoo
+rm -f /var/db/repos/gentoo/metadata/timestamp.x
+emerge-webrsync --quiet
+eselect profile set default/linux/amd64/23.0/musl/hardened/selinux
+
+# SquashFS tools needed for image generation
+emerge squashfstools
+
+# Copy in package list
+mkdir -p /etc/portage/sets
+cp /build/packages.txt /etc/portage/sets/halogenos
+
+# Set install location
+export ROOT="/build/artifacts/dist"
+
+# Emerge all packages
+emerge -j $(nproc) --quiet @halogenos
+
+# Fix directory locations
+mv /build/artifacts/dist/bin /build/artifacts/dist/usr/bin
+mv /build/artifacts/dist/lib /build/artifacts/dist/usr/lib
+mv /build/artifacts/dist/sbin /build/artifacts/dist/usr/sbin
+
+# Include any additional files
+
+# Make any additional config changes
+
+# Create images dir and img files
+mkdir -p /build/artifacts/images
+dd if=/dev/zero of=/build/images/usr.img bs=1 count=0 seek=2G
+dd if=/dev/zero of=/build/images/verity.img bs=1 count=0 seek=2000M 
+
+# Create squashfs
+mksquashfs /build/artifacts/dist /build/artifacts/usr.squashfs
+
+# Image squashfs filesystem onto usr img
+dd if=/build/artifacts/usr.squashfs of=/build/images/usr.img
+
+# Build verity

build/packages.txt

@@ -0,0 +1,3 @@
+app-shells/bash
+app-misc/hyfetch
+sys-libs/musl

compose.yml

@@ -1,9 +1,8 @@
 services:
   build:
-    image: docker.io/gentoo/stage3
+    image: docker.io/gentoo/stage3:musl-hardened
     command: /build/build-image.sh
     volumes:
-      - ./artifacts:/artifacts
       - ./build:/build
   sign:
     image: docker.io/vladgh/gpg
@@ -13,11 +12,11 @@ services:
      - signing_key_private
      - signing_key_public
     volumes:
-     - ./artifacts:/artifacts
+     - ./build/images:/images
   serve:
     image: docker.io/halverneus/static-file-server
     volumes:
-     - ./artifacts:/artifacts
+     - ./build/images:/images
 
 secrets:
   signing_key_password: