sledgehammer-stage-bits.yaml

---
Name: sledgehammer-stage-bits
Description: Stage Sledgehammer pieces needed for initial discovery and bootstrapping.
Templates:
  - Name: sledgehammer-start-up.sh
    Path: /sbin/sledgehammer-start-up.sh
    Contents: |
      #!/bin/bash
      export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
      export PS4='${BASH_SOURCE}@${LINENO}(${FUNCNAME[0]}): '
      set -x
      set -e
      shopt -s extglob
      get_param() {
          [[ $(cat /proc/cmdline) =~ $1 ]] && echo "${BASH_REMATCH[1]}"
      }
      # Some useful boot parameter matches
      ip_re='([0-9a-f.:]+/[0-9]+)'
      bootif_re='BOOTIF=([^ ]+)'
      provisioner_re='provisioner\.web=([^ ]+)'
      domain_re='DOMAINNAME=(.+)$'
      hostname_re='^HOSTNAME=(.+)$'
      host_re='rs\.uuid=([^ ]+)'
      dns_servers_re='^DNS=(.+)$'
      uuid_re='^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$'
      netname_re='"network":"([^ ]+)"'
      PROVISIONER_WEB="$(get_param "$provisioner_re")"
      # Test to see if we got everything we must have.
      # Die horribly otherwise.
      if ! [[ $PROVISIONER_WEB ]]; then
          echo "Do not know where to find the Provisioner."
          echo "This cannot happen"
          exit 1
      fi
      if [[ $(cat /proc/cmdline) =~ $bootif_re ]]; then
          if [[ "${BASH_REMATCH[1]}" == "discovery" ]] ; then
              MAC=$(cat /sys/class/net/eth0/address)
          else
              MAC="${BASH_REMATCH[1]//-/:}"
              MAC="${MAC#*:}"
          fi
      elif [[ -d /sys/firmware/efi ]]; then
          declare -A boot_entries
          bootent_re='^Boot([0-9]{4})'
          efimac_re='MAC\(([0-9a-f]+)'
          while read line; do
              k="${line%% *}"
              v="${line#* }"
              if [[ $k = BootCurrent:* ]]; then
                  current_bootent="${line##BootCurrent: }"
              elif [[ $k =~ $bootent_re ]]; then
                  boot_entries["${BASH_REMATCH[1]}"]="$v"
              fi
          done < <(efibootmgr -v)
          if [[ ${boot_entries["$current_bootent"]} =~ $efimac_re ]]; then
              MAC=''
              for o in 0 2 4 6 8 10; do
                  MAC+="${BASH_REMATCH[1]:$o:2}:"
              done
              MAC=${MAC%:}
          fi
      fi
      for nic in /sys/class/net/*; do
          [[ -f $nic/address && -f $nic/type && \
              $(cat "$nic/type") = 1 && \
              $(cat "$nic/address") = $MAC ]] || continue
          BOOTDEV="${nic##*/}"
          break
      done
      if [[ ! $BOOTDEV ]]; then
          echo "We don't know what the MAC address of our boot NIC was!"
          exit 1
      fi
      runningLink="$(networkctl |awk "/$BOOTDEV/ {print \$1}"|head -1)"
      leaseFile="/var/run/systemd/netif/leases/$runningLink"
      dhcp_param() {
          awk -F= "/^$1/ {print \$2}" < "$leaseFile"
      }
      HOSTNAME=""
      if [[ -e $leaseFile ]] ; then
          HOSTNAME="$(dhcp_param HOSTNAME)"
          DOMAIN="$(dhcp_param DOMAINNAME)"
          DNS_SERVERS="$(dhcp_param DNS)"
      fi
      [[ $DOMAIN ]] || DOMAIN="unspecified.domain.local"
      [[ $DNS_SERVERS ]] || DNS_SERVERS="8.8.8.8"
      # Make our hsotname include the domain.
      [[ $HOSTNAME && ${HOSTNAME%%.*} = $HOSTNAME ]] && HOSTNAME="${HOSTNAME}.${DOMAIN}"
      # If we do not have a hostname, try to look it up in the hosts file
      if [[ ! $HOSTNAME ]]; then
          lookup_1="$(getent hosts $dhcp_ip | awk '{print $2}')"
          lookup_2="$(getent hosts $dhcp_ip | awk '{print $2}')"
          if [[ $lookup_1 && $lookup_1 == $lookup_2 && $lookup_1 != localhost* ]]; then
              HOSTNAME="$lookup_1"
          fi
      fi
      while ! [[ -x /tmp/start-up.sh ]]; do
          curl -sgfL -o /tmp/start-up.sh "$PROVISIONER_WEB/machines/start-up.sh" || :
          if grep -q '/tmp/control.sh' /tmp/start-up.sh && \
              head -1 /tmp/start-up.sh | grep -q '^#!/bin/bash'; then
              chmod 755 /tmp/start-up.sh
              break
          fi
          sleep 1
      done
      export BOOTDEV PROVISIONER_WEB MAC DOMAIN DNS_SERVERS HOSTNAME
      . /tmp/start-up.sh
  - Name: sledgehammer-motd
    Path: /etc/motd
    Contents: |

          Digital Rebar       &&&
          Sledgehammer      &&&&&&&
                          &&&&&&&&&&&&&@
                        &&&&&&&&&&&&&&&&&@
                        &&&&&&&&&&&&&&&&&
                          &&&&&&&&&&&&&&&&&
                            &&&&&&&&&&&&&&&&&
                          &&& &&&&&&&&&&&&&&&
                        &&&&&&& &&&&&&&&&&&
                      &&&&&&&&&   &&&&&&&
                    &&&&&&&&&       &&&
                  &&&&&&&&&
                &&&&&&&&&
              &&&&&&&&&
            &&&&&&&&&
          &&&&&&&&&
          &&&&&&&             (c) RackN, Inc.

  - Name: sledgehammer-ssh-config
    Path: /etc/ssh/sshd_config
    Contents: |
      # Default sshd config for Sledgehammer in Rebar 2
      Protocol 2
      SyslogFacility AUTHPRIV
      PermitRootLogin without-password
      PasswordAuthentication no
      ChallengeResponseAuthentication no
      GSSAPIAuthentication no
      GSSAPICleanupCredentials yes
      UseDNS no
      UsePAM yes
      AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
      AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
      AcceptEnv LC_IDENTIFICATION LC_ALL
      Subsystem sftp /usr/libexec/openssh/sftp-server
  - Name: sledgehammer-service
    Path: /etc/systemd/system/sledgehammer.service
    Contents: |
      [Unit]
      Description=Sledgehammer startup script
      After=network-online.target
      Wants=network-online.target

      [Service]
      Type=oneshot
      RemainAfterExit=true
      ExecStart=/sbin/sledgehammer-start-up.sh

      [Install]
      WantedBy=multi-user.target
  - Name: sledgehammer-stage1-init
    Path: /IMAGE/initrd/init
    Contents: |
      #!/bin/ash

      fail() {
          printf '%s\n' "$@"
          echo "Dropping into shell for debugging"
          echo "Contact #community on rackn.slack.com channel for debugging"
          echo "Exiting the shell will reboot the system"
          /bin/ash -i
          reboot
      }

      export PATH=/bin
      export SIGNATURE="::SIGNATURE::"
      echo "Stage1 $SIGNATURE in Busybox"
      echo "You can download a copy of the Busybox source for this version at:"
      echo "http://rackn-sledgehammer.s3-website-us-west-2.amazonaws.com/busybox-1.29.3.tar.bz2"
      mount -t proc proc /proc
      mount -t sysfs sysfs /sys
      mount -t devtmpfs dev /dev
      mount -t tmpfs root /newinitramfs
      mkdir /dev/pts
      mount -t devpts devpts /dev/pts
      echo "Extracting drivers and other kernel modules"
      xz -d -c -f lib.cpio.xz |cpio -id
      test -d "lib/modules/$(uname -r)" || fail "Stage1 kernel modules do not match running kernel $(uname -r)" "We will fail to find network devices" "Make sure Sledgehammer $SIGNATURE was downloaded properly."
      rm lib.cpio.xz
      touch /dev/mdev.log /dev/mdev.seq
      echo "Loading drivers"
      echo '$MODALIAS=.* 0:0 660 @/bin/modprobe "$MODALIAS"' >/etc/mdev.conf
      echo /bin/mdev >/proc/sys/kernel/hotplug
      mdev -s
      # Load devices not loaded by mdev -s
      for i in /sys/class/net/*/uevent; do
          printf 'add' > "$i";
      done 2>/dev/null;
      unset i
      for i in /sys/bus/usb/devices/*; do
          case "${i##*/}" in
              [0-9]*-[0-9]*)
                  printf 'add' > "$i/uevent";;
          esac
      done; unset i
      # Load kernel modules, run twice.
      find /sys -name 'modalias' -type f -exec cat '{}' + | sort -u | xargs -n 1 modprobe  2>/dev/null
      find /sys -name 'modalias' -type f -exec cat '{}' + | sort -u | xargs -n 1 modprobe  2>/dev/null
      # If we loaded mlx4_core, also load mlx4_en
      if test -d /sys/module/mlx4_core; then
          modprobe mlx4_en
          mdev -s
      fi
      echo "Parsing kernel parameters required for booting"
      bootif=$(grep -o 'BOOTIF=[^ ]*' /proc/cmdline)
      nextone=$(grep -o 'provisioner.web=[^ ]*' /proc/cmdline)
      portdelay=$(grep -o 'provisioner.portdelay=[^ ]*' /proc/cmdline)
      postportdelay=$(grep -o 'provisioner.postportdelay=[^ ]*' /proc/cmdline)
      routedelay=$(grep -o 'provisioner.routedelay=[^ ]*' /proc/cmdline)
      wgetretrycount=$(grep -o 'provisioner.wgetretrycount=[^ ]*' /proc/cmdline)
      if [[ "$bootif" == "BOOTIF=discovery" ]] ; then
        bootif=$(cat /sys/class/net/eth0/address)
        bootif=${bootif//:/-}
        bootif="BOOTIF=01-$bootif"
      fi
      test -z "$bootif" && fail "Missing required parameter BOOTIF"
      test -z "$nextone" && fail "Missing required parameter provisioner.web"
      ip6=$(echo $nextone | grep -o '\[[0-9a-fA-F:]*\]')

      bootif=${bootif#*01-}
      bootif=${bootif//-/:}
      nextone=${nextone#*=}
      portdelay=${portdelay#*=}
      postportdelay=${postportdelay#*=}
      routedelay=${routedelay#*=}
      wgetretrycount=${wgetretrycount#*=}
      wgetretrycount=${wgetretrycount:-10}

      pxedev=""
      for dev in /sys/class/net/*; do
          test -f "$dev/address" || continue
          if test "$(cat "$dev/address")" = "$bootif"; then
              pxedev=${dev##*/}
              break
          fi
      done
      test -z "$pxedev" && fail "Failed to find network device we booted from"
      # if a port delay is sent - wait
      test -z "$portdelay" || sleep $portdelay
      echo "Configuring boot interface"
      ip link set "$pxedev" up
      # if a post port delay is sent - wait
      test -z "$postportdelay" || sleep $postportdelay
      if [[ "$ip6" == "" ]] ; then
          udhcpc -b -R -a -i "$pxedev"
      else
          test -z "$routedelay" || sleep $routedelay
          udhcpc6 -b -R -i "$pxedev"
      fi
      echo "Fetching second-stage initramfs"
      ARCH={{.Machine.Arch}}
      squashfs="$nextone/sledgehammer/$ARCH/$SIGNATURE/root.squashfs"
      if [ $ARCH == amd64 ]; then
          squashfs="$nextone/sledgehammer/$SIGNATURE/root.squashfs"
      fi
      if [ $ARCH == rpi4 ]; then
          squashfs="$nextone/sledgehammer/rpi4/rpi/root.squashfs"
      fi
      # Loop because it can take some time to come up.
      count=0
      while [[ $count != $wgetretrycount ]]; do
          (cd /newinitramfs; wget "$squashfs") && break
          sleep 1
          count=$(($count+1))
          if [[ $count == $wgetretrycount ]] ; then
              fail "Failed to download root.squashfs - exit to retry"
              count=0
          fi
      done
      echo "Switching to second-stage initramfs"
      modprobe loop
      modprobe squashfs
      mkdir /newinitramfs/.upper /newinitramfs/.work /newinitramfs/.lower
      mount -o ro -t squashfs "/newinitramfs/root.squashfs" /newinitramfs/.lower || \
          fail "Failed to mount root.squashfs as Stage2 initramfs"
      test -d "/newinitramfs/.lower/usr/lib/modules/$(uname -r)" || \
          fail "Stage2 kernel modules do not match running kernel!"
      # This is such a hack
      (cd "/newinitramfs/.lower/usr/lib/modules/$(uname -r)/kernel/fs/overlayfs"; insmod overlay.ko*) || \
          fail "Failed to load overlayfs kernel module"
      mount -t overlay -olowerdir=/newinitramfs/.lower,upperdir=/newinitramfs/.upper,workdir=/newinitramfs/.work newroot /newinitramfs || \
          fail "Failed to overlay a writeable filesystem over root.squashfs"

      # Remove /etc/machine-id
      rm -f /newinitramfs/etc/machine-id || :

      for fs in /dev /dev/pts /proc /sys; do
          mkdir -p "/newinitramfs$fs"
          mount --bind "$fs" "/newinitramfs$fs"
      done
      mkdir -p /newinitramfs/etc/systemd/network
      {
      echo '[Match]'
      printf 'MACAddress=%s\n\n' "$bootif"
      echo '[Network]'
      if [[ "$ip6" == "" ]] ; then
          echo 'DHCP=ipv4'
          echo
          echo '[DHCP]'
          echo 'ClientIdentifier=mac'
      else
          echo 'DHCP=ipv6'
          echo
          echo '[DHCP]'
          echo 'ClientIdentifier=mac'
      fi
      } > /newinitramfs/etc/systemd/network/20-bootif.network

      echo "$SIGNATURE" > /newinitramfs/etc/sledgehammer-id
      echo "SLEDGEHAMMER_VERSION=${SIGNATURE}" > /newinitramfs/etc/sledgehammer-release
      echo "SLEDGEHAMMER_DATE=\"::BUILD_DATE::\"" >> /newinitramfs/etc/sledgehammer-release
      echo "SLEDGEHAMMER_BUILDER_VERSION=::SBV::" >> /newinitramfs/etc/sledgehammer-release

      SLEDGE_ID=$(cat /newinitramfs/etc/sledgehammer-id)
      for file in "/newinitramfs/etc/issue" "/newinitramfs/etc/issue.net"; do
      echo "
      |              +--+   | Digital Rebar Sledgehammer
      |  +==========={  }   | ID $SLEDGE_ID
      |              +--+   | Kernel \r on an \m
      " > $file
      done

      echo "" >/proc/sys/kernel/hotplug
      if [[ "$ip6" == "" ]] ; then
          pkill udhcpc
      else
          pkill udhcpc6
      fi
      ip link set "$pxedev" down

      exec switch_root /newinitramfs /sbin/init
      fail "Failed to switch to stage2 initramfs" "This should never happen"
  - Name: sledgehammer-stage1-udhcpc-config
    Path: /IMAGE/initrd/usr/share/udhcpc/default.script
    Contents: |
      #!/bin/sh
      # udhcpc script edited by Tim Riker <Tim@Rikers.org>

      wait_for_ipv6_default_route() {
        attempts=10
        while [ $attempts != 0 ] && [ -z "$(ip -6 route list | grep default)" ] ; do
          sleep 1
          attempts=$(($attempts-1))
        done
        [ $attempts = 0 ] && echo "failed to get default ipv6 route"
      }

      RESOLV_CONF="/etc/resolv.conf"

      [ -n "$1" ] || { echo "Error: should be called from udhcpc"; exit 1; }

      NETMASK=""
      [ -n "$subnet" ] && NETMASK="netmask $subnet"
      BROADCAST=""
      [ -n "$broadcast" ] && BROADCAST="broadcast $broadcast"

      echo "Received ip=$ip"
      echo "Received ipv6=$ipv6"
      echo "Received ipv6prefix=$ipv6prefix"
      [ -n "$ip" ] || ip="$ipv6prefix"
      [ -n "$ip" ] || ip="$ipv6/128"

      case "$1" in
          deconfig)
              echo "Setting IP address 0.0.0.0 on $interface"
              ifconfig $interface 0.0.0.0
              ;;

          renew|bound)
              echo "Setting IP address $ip on $interface"
              ifconfig $interface $ip $NETMASK $BROADCAST
              if [ -n "$ipv6" ] ; then
                echo "waiting for default ipv6 route set"
                wait_for_ipv6_default_route
              fi

              if [ -n "$router" ] ; then
                  echo "Deleting routers"
                  while route del default gw 0.0.0.0 dev $interface ; do
                      :
                  done

                  metric=0
                  for i in $router ; do
                      echo "Adding router $i"
                      route add default gw $i dev $interface metric $metric
                      : $(( metric += 1 ))
                  done
              fi

              echo "Recreating $RESOLV_CONF"
              # If the file is a symlink somewhere (like /etc/resolv.conf
              # pointing to /run/resolv.conf), make sure things work.
              realconf=$(readlink -f "$RESOLV_CONF" 2>/dev/null || echo "$RESOLV_CONF")
              tmpfile="$realconf-$$"
              > "$tmpfile"
              [ -n "$domain" ] && echo "search $domain" >> "$tmpfile"
              for i in $dns ; do
                  echo " Adding DNS server $i"
                  echo "nameserver $i" >> "$tmpfile"
              done
              mv "$tmpfile" "$realconf"
              ;;
      esac

      exit 0
      EOF
  - Name: squashfs-excludes
    Path: /IMAGE/excludes
    Contents: |
      tmp/*
      IMAGE
      var/cache/yum/*
      usr/local/bin/*
      usr/share/doc
  - Name: install-sipcalc
    Contents: |
      #!/bin/bash
      # 'arch' is built for "x86_64", "aarch64, "armv7hl"
      # for ARM arch types - not tested yet
      # orig source location: https://koji.fedoraproject.org/koji/packageinfo?packageID=8762
      arch=$(uname -p)
      wget https://s3-us-west-2.amazonaws.com/rackn-sledgehammer/sipcalc-1.1.6-15.fc30.$arch.rpm -O /root/sipcalc.rpm
      yum install -y /root/sipcalc.rpm
      rm -rf /root/sipcalc.rpm
  - Name: update-systemd
    Contents: |
      #!/bin/bash
      # No updated systemd for things that are not x86_64
      [[ $(uname -m) = x86_64 ]] || exit 0
      wget https://copr.fedorainfracloud.org/coprs/jsynacek/systemd-backports-for-centos-7/repo/epel-7/jsynacek-systemd-backports-for-centos-7-epel-7.repo -O /etc/yum.repos.d/jsynacek-systemd-centos-7.repo
      yum remove -y systemd-networkd systemd-resolved
      yum update -y systemd
      rm /etc/yum.repos.d/jsynacek-systemd-centos-7.repo
      yum makecache -y
  - Name: update-parted
    Contents: |
      #!/bin/bash
      wget https://s3-us-west-2.amazonaws.com/rackn-sledgehammer/parted-3.2-35.el7.centos.x86_64.rpm -O /root/parted.rpm
      yum install -y /root/parted.rpm
      rm -rf /root/parted.rpm
  - Name: remove-unwanted-pkgs
    Contents: |
      #!/bin/bash
      chmod 755 /sbin/sledgehammer-start-up.sh
      echo "Removing unwanted packages"
      UNWANTED=(
          'alsa-firmware'
          'firewalld'
          'i*-firmware'
          mariadb-libs
          mozjs17
          plymouth
          selinux-policy-targeted)
      yum -y autoremove "${UNWANTED[@]}"
      echo "Removing unwanted locales"
      cd /usr/share/locale
      mv locale.alias en en_US ..
      rm -rf *
      mv ../locale.alias ../en ../en_US .
      cd /usr/lib/locale
      localedef --list-archive | \
          fgrep -v -e 'en_US' -e 'en_US.utf8' | \
          xargs localedef --delete-from-archive
      mv locale-archive locale-archive.tmpl
      build-locale-archive
      echo "Removing unwanted kernel modules"
      bk="$(cd /boot && echo config-*)"
      bk="${bk#config-}"
      cd /lib/modules/$bk/kernel
      rm -rf drivers/bluetooth \
          drivers/gpu \
          drivers/isdn \
          drivers/net/can \
          drivers/net/wireless \
          drivers/usb/atm \
          drivers/usb/image \
          net/6lowpan \
          net/bluetooth \
          net/wireless \
          sound
      cd /lib/
      depmod -a "$bk"
      echo "Removing unwanted firmware"
      # Take only the firmware our modules will need.
      while read -r mod; do
          while read -r fw; do
              [[ -f firmware/$fw ]] || continue
              mkdir -p "firmware.new/${fw%/*}"
              mv "firmware/$fw" "firmware.new/$fw"
          done < <(modinfo -F firmware "$mod")
      done < <(find modules -type f -name '*.ko*')
      rm -rf firmware
      mv firmware.new firmware
      cd /
      echo "Restoring Selinux file contexts"
      restorecon -r -F -i -p .
  - Name: fix-up-services
    Contents: |
      #!/bin/bash
      {{ template "setup.tmpl" .}}
      systemctl disable kdump.service
      systemctl disable crond.service
      systemctl disable auditd.service
      systemctl disable irqbalance.service
      systemctl disable remote-fs.target
      systemctl disable network.service
      systemctl disable systemd-readahead-collect.service
      systemctl disable systemd-readahead-replay.service
      cd /lib/systemd/system
      rm -f basic.target.wants/rhel-autorelabel-mark.service \
          basic.target.wants/rhel-autorelabel.service \
          basic.target.wants/selinux-policy-migrate-local-changes@minimum.service || :
      rm -f /etc/fstab || :
      touch /etc/fstab
      systemctl enable systemd-networkd.service
      systemctl enable systemd-resolved.service
      systemctl enable systemd-networkd-wait-online.service
      systemctl enable sledgehammer.service
      systemctl enable ntpd.service
  - Name: prepare-stage-1
    Contents: |
      #!/bin/bash
      {{ template "setup.tmpl" .}}
      ARCH={{.Machine.Arch}}
      bk="$(cd /boot && echo config-*)"
      bk="${bk#config-}"
      KERNEL="vmlinuz-${bk}"
      cd /IMAGE
      # Make module archive, trimming out things not needed to netboot.
      # We assume that no wireless connectifity is needed directly by Sledgehammer.
      [[ -d lib ]] && rm -rf lib
      mkdir -p lib/modules
      echo "Copying over required modules and firmware"
      cp -a "/lib/modules/$bk" lib/modules
      cd "lib/modules/$bk/kernel"
      rm -rf drivers/media \
          drivers/ata \
          drivers/bluetooth \
          drivers/cdrom \
          drivers/firewire \
          drivers/gpu \
          drivers/hid \
          drivers/hwmon \
          drivers/input/misc \
          drivers/isdn \
          drivers/md \
          drivers/mfd \
          drivers/mmc \
          drivers/mtd \
          drivers/net/can \
          drivers/net/wireless \
          drivers/nvme \
          drivers/parport \
          drivers/pcmcia \
          drivers/scsi \
          drivers/uio \
          drivers/usb/atm \
          drivers/usb/image \
          drivers/usb/misc \
          drivers/usb/serial \
          drivers/usb/storage \
          drivers/uwb \
          fs/btrfs \
          fs/ceph \
          fs/cifs \
          fs/cramfs \
          fs/dlm \
          fs/exofs \
          fs/ext4 \
          fs/fat \
          fs/fuse \
          fs/gfs2 \
          fs/isofs \
          fs/jbd2 \
          fs/nfs \
          fs/nfs_common \
          fs/nfsd \
          fs/udf \
          fs/xfs \
          net/6lowpan \
          net/bluetooth \
          net/bridge \
          net/can \
          net/ceph \
          net/openvswitch \
          net/wireless \
          sound
      cd /IMAGE
      depmod -b $PWD -a "$bk"
      # Take only the firmware our modules will need.
      while read -r mod; do
          while read -r fw; do
              [[ -f /lib/firmware/$fw ]] || continue
              mkdir -p "lib/firmware/${fw%/*}"
              cp "/lib/firmware/$fw" "lib/firmware/$fw"
          done < <(modinfo -F firmware "$mod")
      done < <(find lib/modules -type f -name '*.ko*')
      echo "Making module/firmware archive"
      find lib |sort |cpio -o -R 0:0 --format=newc |xz -T0 -c >initrd/lib.cpio.xz
      rm -rf lib
      echo "Staging kernel and busybox for stage1 initramfs"
      cp /boot/$KERNEL /IMAGE/vmlinuz0
      cd /IMAGE/initrd
      mkdir -p dev proc sys bin lib etc usr/share/udhcpc tmp newinitramfs
      curl -fgL -o bin/busybox http://rackn-sledgehammer.s3-website-us-west-2.amazonaws.com/busybox-1.29.3.${ARCH}
      (cd bin && chmod 755 busybox && ./busybox --install .)
      chmod 755 init usr/share/udhcpc/default.script
  - Name: make-stage-2
    Contents: |
      #!/bin/bash
      {{ template "setup.tmpl" .}}
      [[ -f /IMAGE/root.squashfs ]] && exit 0
      echo "Creating root.squashfs.  This may take upwards of 10 minutes"
      # Clean up resolv.conf now.
      rm -f /etc/resolv.conf || :
      mkdir -p /run/systemd/resolve
      touch /run/systemd/resolve/resolv.conf
      ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf
      # Remove /etc/machine-id
      rm -f /etc/machine-id || :
      # Make stage2 first
      mkdir -p /IMAGE/rootfs
      grep -q IMAGE/rootfs /proc/self/mounts || mount --bind -o ro / /IMAGE/rootfs
      cd /IMAGE
      {{if (eq .Machine.Arch "amd64")}}
      mksquashfs rootfs root.squashfs.working -comp xz -Xbcj x86 -no-exports -wildcards -ef excludes
      {{ else if (eq .Machine.Arch "arm64")}}
      mksquashfs rootfs root.squashfs.working -comp xz -Xbcj arm,armthumb -no-exports -wildcards -ef excludes
      {{ else }}
      mksquashfs rootfs root.squashfs.working -comp xz -no-exports -wildcards -ef excludes
      {{end}}
      mv root.squashfs.working root.squashfs
      umount /IMAGE/rootfs
  - Name: make-sledgehammer
    Contents: |
      #!/bin/bash
      {{ template "setup.tmpl" .}}
      echo "Generating unique signature for Sledgehammer"
      cd /IMAGE
      signature="$(sha1sum <root.squashfs |awk '{print $1}')"
      # make stage1.img
      cd initrd
      sed -i -e "s/::SIGNATURE::/$signature/" init
      sed -i -e "s/::BUILD_DATE::/$(date)/" init
      sed -i -e "s/::SBV::/$(RS_TOKEN= drpcli -U rocketskates -P r0cketsk8ts contents show sledgehammer-builder | jq .meta.Version -r)/" init
      find |sort |cpio -o -R 0:0 --format=newc |gzip -9 >../stage1.img
      cd ..
      # Tar it all up
      tarname=sledgehammer-$signature.{{.Machine.Arch}}.tar
      echo "Creating Sledgehammer $signature archive"
      sha1sum vmlinuz0 stage1.img root.squashfs >sha1sums
      mkdir $signature
      mv sha1sums vmlinuz0 stage1.img root.squashfs $signature
      tar cf $tarname $signature
      # Push back to dr-provision
      unset RS_TOKEN
      echo "Uploading Sledgehammer to dr-provision"
      drpcli -U rocketskates -P r0cketsk8ts isos upload $tarname as $tarname
      echo "$tarname uploaded to isos"