From bb5460427d2481f9d362eb744938a306c21e5107 Mon Sep 17 00:00:00 2001 From: Sam & Claude Date: Mon, 22 Jun 2026 20:24:25 +0200 Subject: [PATCH 1/4] docs: drop sudo from flash commands, append sync All decompress-and-write one-liners now share the same form: xz -dc ...img.xz | of=/dev/sdX bs=4M status=progress conv=fsync && sync - sudo removed (operator runs as root on USB stick) - && sync appended to all image-write commands - /dev/zero wipe commands unchanged - build.sh echo updated to match --- BUILD.md | 4 ++-- FLASHING.md | 12 ++++++------ README.md | 4 ++-- TESTING.md | 4 ++-- build.sh | 2 +- skills/iso-flash-verify/SKILL.md | 2 +- 6 files changed, 14 insertions(+), 14 deletions(-) diff --git a/BUILD.md b/BUILD.md index 40a1afc..2ba90dd 100644 --- a/BUILD.md +++ b/BUILD.md @@ -146,7 +146,7 @@ Published/downloaded artifacts are compressed as `.img.xz`. Stream the compressed image directly into `dd`: ```sh -xz -dc clawdie-quindecim-0.11.0.img.xz | sudo dd of=/dev/daX bs=1M status=progress conv=fsync +xz -dc clawdie-quindecim-0.11.0.img.xz | dd of=/dev/daX bs=1M status=progress conv=fsync && sync sync ``` @@ -163,7 +163,7 @@ curl -fL --retry 5 --retry-delay 5 -O \ For a build-local uncompressed image, plain `dd` is also fine: ```sh -sudo dd if=tmp/output/clawdie-quindecim-0.11.0.img of=/dev/daX bs=1M status=progress conv=fsync +dd if=tmp/output/clawdie-quindecim-0.11.0.img of=/dev/daX bs=1M status=progress conv=fsync && sync sync ``` diff --git a/FLASHING.md b/FLASHING.md index d986fe5..829f477 100644 --- a/FLASHING.md +++ b/FLASHING.md @@ -68,7 +68,7 @@ Flash by streaming xz into `dd`: ```sh set -o pipefail 2>/dev/null || true -xz -dc clawdie-quindecim-0.11.0.img.xz | sudo dd of=/dev/sdX bs=4M status=progress conv=fsync +xz -dc clawdie-quindecim-0.11.0.img.xz | dd of=/dev/sdX bs=4M status=progress conv=fsync && sync sync ``` @@ -116,7 +116,7 @@ sudo umount /dev/daXs* 2>/dev/null Flash by streaming xz into `dd`: ```sh -xz -dc clawdie-quindecim-0.11.0.img.xz | sudo dd of=/dev/daX bs=1M status=progress conv=fsync +xz -dc clawdie-quindecim-0.11.0.img.xz | dd of=/dev/daX bs=1M status=progress conv=fsync && sync sync ``` @@ -152,14 +152,14 @@ For a local build artifact that already exists as a raw image: ### Linux ```sh -sudo dd if=clawdie-quindecim-0.11.0.img of=/dev/sdX bs=4M status=progress conv=fsync +dd if=clawdie-quindecim-0.11.0.img of=/dev/sdX bs=4M status=progress conv=fsync && sync sync ``` ### FreeBSD ```sh -sudo dd if=clawdie-quindecim-0.11.0.img of=/dev/daX bs=1M status=progress conv=fsync +dd if=clawdie-quindecim-0.11.0.img of=/dev/daX bs=1M status=progress conv=fsync && sync sync ``` @@ -189,7 +189,7 @@ Then wipe only after confirming `/dev/sdX` is the USB stick: ```sh sudo sgdisk --zap-all /dev/sdX -sudo dd if=/dev/zero of=/dev/sdX bs=16M status=progress conv=fsync +dd if=/dev/zero of=/dev/sdX bs=16M status=progress conv=fsync sync ``` @@ -205,7 +205,7 @@ Then wipe only after confirming `/dev/daX` is the USB stick: ```sh sudo gpart destroy -F /dev/daX -sudo dd if=/dev/zero of=/dev/daX bs=16M status=progress conv=fsync +dd if=/dev/zero of=/dev/daX bs=16M status=progress conv=fsync sync ``` diff --git a/README.md b/README.md index 4317f93..038c38e 100644 --- a/README.md +++ b/README.md @@ -243,7 +243,7 @@ Linux: ```sh sha256sum -c clawdie-quindecim-0.11.0.img.xz.sha256 set -o pipefail 2>/dev/null || true -xz -dc clawdie-quindecim-0.11.0.img.xz | sudo dd of=/dev/sdX bs=4M status=progress conv=fsync +xz -dc clawdie-quindecim-0.11.0.img.xz | dd of=/dev/sdX bs=4M status=progress conv=fsync && sync sync ``` @@ -252,7 +252,7 @@ FreeBSD: ```sh HASH=$(awk '{print $1}' clawdie-quindecim-0.11.0.img.xz.sha256) sha256 -c "$HASH" clawdie-quindecim-0.11.0.img.xz -xz -dc clawdie-quindecim-0.11.0.img.xz | sudo dd of=/dev/daX bs=1M status=progress conv=fsync +xz -dc clawdie-quindecim-0.11.0.img.xz | dd of=/dev/daX bs=1M status=progress conv=fsync && sync sync ``` diff --git a/TESTING.md b/TESTING.md index 1a7ddbe..a9060fd 100644 --- a/TESTING.md +++ b/TESTING.md @@ -418,7 +418,7 @@ If you see stale labels such as `nomadbsd_zroot`, wipe the whole stick first: ```sh sudo umount /dev/sdX* 2>/dev/null || true sudo sgdisk --zap-all /dev/sdX -sudo dd if=/dev/zero of=/dev/sdX bs=16M status=progress conv=fsync +dd if=/dev/zero of=/dev/sdX bs=16M status=progress conv=fsync ``` ### Flash the image @@ -433,7 +433,7 @@ curl -fL --retry 5 --retry-delay 5 -O \ https://osa.smilepowered.org/downloads/iso/clawdie-quindecim-0.11.0.img.xz.sha256 sha256sum -c clawdie-quindecim-0.11.0.img.xz.sha256 set -o pipefail 2>/dev/null || true -xz -dc clawdie-quindecim-0.11.0.img.xz | sudo dd of=/dev/sdX bs=4M status=progress conv=fsync +xz -dc clawdie-quindecim-0.11.0.img.xz | dd of=/dev/sdX bs=4M status=progress conv=fsync && sync sync ``` diff --git a/build.sh b/build.sh index 3252e6b..26df799 100755 --- a/build.sh +++ b/build.sh @@ -2527,4 +2527,4 @@ echo " Image size : ${IMAGE_LOGICAL_SIZE}" echo " Allocated : ${IMAGE_ALLOCATED_SIZE} (sparse on build host)" echo "" echo " Write to USB:" -echo " dd if=${OUTPUT_IMAGE} of=/dev/daX bs=1M status=progress" +echo " dd if=${OUTPUT_IMAGE} of=/dev/daX bs=1M status=progress conv=fsync && sync" diff --git a/skills/iso-flash-verify/SKILL.md b/skills/iso-flash-verify/SKILL.md index 3a63c35..33deeb8 100644 --- a/skills/iso-flash-verify/SKILL.md +++ b/skills/iso-flash-verify/SKILL.md @@ -95,7 +95,7 @@ whole-disk path with the operator before writing. Example for Linux, replacing `/dev/sdX` with the confirmed whole disk: ```sh -xz -dc tmp/flash-downloads/.img.xz | sudo dd of=/dev/sdX bs=4M status=progress conv=fsync +xz -dc tmp/flash-downloads/.img.xz | dd of=/dev/sdX bs=4M status=progress conv=fsync && sync sync ``` From 3ef31687d953f0a105530ef2f0eaa5d3d036dc0b Mon Sep 17 00:00:00 2001 From: Sam & Claude Date: Tue, 23 Jun 2026 06:41:49 +0200 Subject: [PATCH 2/4] build: pre-stage uBlock Origin + disable default-browser check on live ISO MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Places uBlock Origin XPI in Firefox's distribution/extensions directory during ISO build. Also sets DontCheckDefaultBrowser via policies.json — Firefox is the only browser on the USB so the popup is pointless. Firefox auto-installs the extension on first launch with no internet required on the booted USB. --- build.sh | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/build.sh b/build.sh index 26df799..c9054e1 100755 --- a/build.sh +++ b/build.sh @@ -870,6 +870,58 @@ install_live_runtime_packages() { [ "$_mounted_devfs" -eq 1 ] && umount "${MOUNT_POINT}/dev" 2>/dev/null || true } +install_firefox_extensions() { + # Pre-stage uBlock Origin and Bitwarden, and apply enterprise policies + # (no default-browser check — Firefox is the only browser on the USB). + local _ff_dist="${MOUNT_POINT}/usr/local/lib/firefox/distribution" + local _ext_dir="${_ff_dist}/extensions" + local _policies="${_ff_dist}/policies.json" + + echo " Configuring Firefox..." + + mkdir -p "${_ext_dir}" || { + echo "ERROR: failed to create Firefox distribution directory" + exit 1 + } + + # Disable "make default browser" popup — Firefox is the only browser. + cat > "${_policies}" <<'POLICIES' +{ + "policies": { + "DontCheckDefaultBrowser": true + } +} +POLICIES + chmod 0644 "${_policies}" + + # Download a Firefox extension XPI if not already cached. + # Usage: _fetch_xpi