SepiaOS v2026.9.2

A complete SepiaOS card for Pi Zero 2 W, Pi 3, Pi 4, CM4, Pi 5 and
CM5: the boot partition, and a root filesystem of musl and busybox
with the kernel modules that match the shipped kernel — an LLVM
toolchain with GNU make beside it, so the card builds for itself, and
the e2fsprogs tools, so it can look after its own filesystems.

Branch	rel-2026.9.2
Commit	9aa7c321b6f710d173876f703bbffac8536a5173
Boot partition	v2026.8.0
Raspberry Pi firmware	1.20260521
Kernels	6.18.32-v8+ 6.18.32-v8-16k+
musl	1.2.6
LLVM	23.1.0 (v23.1.0 from Sepia-OS/llvm)
GNU make	4.4.1 (v4.4.1 from Sepia-OS/make)
e2fsprogs	1.47.4 (v1.47.4 from Sepia-OS/e2fsprogs)

Booted to a login prompt under QEMU as a Pi Zero 2 W, a Pi 3, a Pi 4
and a CM4 before publishing.

Building on the card

clang, clang++, lld and the LLVM binutils equivalents are in
/usr/bin, with libc++, libc++abi, libunwind, compiler-rt's builtins
and the GNUstep Objective-C runtime beside them. musl's headers and
its link-time objects are on the card too, which is what makes
clang hello.c work rather than only clang -c, and
/usr/bin/ld points at lld so the driver's default linker name
resolves. Clang defaults to compiler-rt, libc++ and libunwind through
a configuration file in /usr/lib/clang-config, so no flags are
needed.

GNU make 4.4.1 is at /usr/bin/make, from
Sepia-OS/make — the same cross-build against the same musl, so it
runs against the libc that is already on the card. That is the piece
that makes an ordinary Makefile work on the device rather than
only a single clang command line, and it is the last thing needed
to build a project here rather than compile a file. Its GPLv3 licence
text ships with it, at /usr/share/licenses/make/COPYING.

Filesystem tools

e2fsprogs 1.47.4 is on the card, from
Sepia-OS/e2fsprogs — the whole package rather than the single
resize2fs earlier images carried. mke2fs, e2fsck,
tune2fs, resize2fs, debugfs, dumpe2fs,
badblocks, blkid, fsck and e2image are in
/sbin, with filefrag, e2freefrag, e4defrag,
uuidd and the rest under /usr, the usual
mkfs.ext4/fsck.ext4/e2label names beside them, and
/etc/mke2fs.conf. Six of those names were busybox applets and
are now the real programs; busybox's own chattr and lsattr
in /bin still take precedence on PATH over the e2fsprogs
ones in /usr/bin. This is also what grows the root filesystem on
first boot. Its licences ship with it, at
/usr/share/licenses/e2fsprogs/.

Two honest caveats. First, nothing has run clang or make
on this card: QEMU's serial console is output-only, so what CI checks
is that every shipped binary is aarch64, asks for the musl loader, and
has its shared-library dependencies satisfied. That is a layout proof,
not a behavioural one. Second, every shared library these binaries name
is satisfied on this card, which CI asserts — but that is a statement
about the dynamic linker, not about the compiler working.

Logging in

Log in as root with the password sepiaos. It is good for
exactly one login: the first thing the shell does is make you choose
a new one.

First boot

The image is small on purpose. On its first boot it grows the root
filesystem to fill the card, adds a swap partition (1, 2 or 4 GiB
depending on the card's size) and reboots once - so the first boot
takes a little longer than the ones after it.

Flashing

Verify the download, then write it - on Linux:

sha256sum -c SHA256SUMS
xz -d sepiaos-v2026.9.2.img.xz
sudo dd if=sepiaos-v2026.9.2.img of=/dev/sdX bs=4M conv=fsync status=progress

On macOS the device is /dev/rdiskN and the block size is spelled
bs=4m; shasum -a 256 -c SHA256SUMS replaces sha256sum.

The sources this was built from are the archives below, and the
rel-2026.9.2 branch.