Shrink the ISOs: no GPU drivers in the live initrd, server without GPU and sound firmware

- build-iso.sh patches the container's mklive copy: dracut omits amdgpu,
  radeon, nouveau, i915 and xe (and so their firmware) from the live initrd,
  mksquashfs uses 1 MB blocks with the x86 BCJ filter. initrd 245 -> 89 MB.
- das-server 0.2.0 ships /etc/xbps.d/das-server.conf that ignores
  linux-firmware-nvidia, sof-firmware and alsa-firmware; the server ISO
  passes the same list to mklive -g.
- das-install-common 0.2.0: postinstall drops mklive-ignore.conf.

Desktop ISO 1.96 -> 1.72 GB, server ISO 1.57 -> 1.14 GB.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/container/build-iso.sh

@@ -6,6 +6,7 @@
 set -euo pipefail
 
 profile=${1:-desktop}
+ignore=""
 repo=/work/out/hostdir/binpkgs
 version=$(< /work/VERSION)
 
@@ -25,6 +26,9 @@ case $profile in
     # Both consoles: a screen and a serial line (IPMI, VPS consoles, QEMU -nographic).
     # mklive starts a login on ttyS0 when it sees console=ttyS0.
     cmdline="live.user=live loglevel=4 console=tty0 console=ttyS0,115200"
+    # das-server keeps these packages out of the installed system; the image
+    # is built before das-server is installed, so tell mklive as well
+    ignore=$(sed -n 's/^ignorepkg=//p' /work/srcpkgs/das-server/files/xbps-ignore.conf | xargs)
     ;;
   *)
     echo "build-iso: unknown profile '$profile' (desktop, server)" >&2
@@ -81,6 +85,22 @@ sed -i -e 's/echo void-live >/echo dasos >/' -e 's/voidlinux/live/g' "$adduser"
 # how to log in to the live system; its installer writes a neutral one).
 cp "$dir/branding/issue" /opt/void-mklive/data/issue
 
+# Size, also patched into this container's mklive copy:
+# - the live initrd only has to find and mount the image, the GPU drivers and
+#   their firmware (~150 MB) load from the root file system after switch_root;
+# - squashfs with 1 MB blocks and the x86 BCJ filter packs binaries tighter.
+mklive=/opt/void-mklive/mklive.sh
+for pattern in '--add-drivers "ahci"' '-comp "${SQUASHFS_COMPRESSION}"'; do
+  if ! grep -qF -- "$pattern" "$mklive"; then
+    echo "build-iso: '$pattern' not found in $mklive, mklive changed; update this script" >&2
+    exit 1
+  fi
+done
+sed -i \
+  -e 's/--add-drivers "ahci"/& --omit-drivers "amdgpu radeon nouveau i915 xe"/' \
+  -e 's/-comp "${SQUASHFS_COMPRESSION}"/& -b 1M -Xbcj x86/' \
+  "$mklive"
+
 rsvg-convert /work/live/branding/splash.svg --output "$work/splash.png"
 rm -f "$iso"
 
@@ -91,6 +111,7 @@ SPLASH_IMAGE=$work/splash.png ./mklive.sh \
   -c /var/cache/xbps \
   -p "$(read_list "$dir/packages.x86_64")" \
   -S "$(read_list "$dir/services")" \
+  ${ignore:+-g "$ignore"} \
   -I "$include" \
   -l "$locale" \
   -k us \

srcpkgs/das-install-common/files/postinstall

@@ -23,6 +23,9 @@ if ! grep -q '^[^#]*[[:space:]]/tmp[[:space:]]' /etc/fstab; then
 	echo "tmpfs /tmp tmpfs defaults,nosuid,nodev 0 0" >>/etc/fstab
 fi
 
+# mklive's list of packages left out of the image; das-server keeps its own
+rm -f /etc/xbps.d/mklive-ignore.conf
+
 # Guest tools only help inside their own hypervisor (VirtualBox's ones even
 # complain at every login elsewhere).
 machine=$(cat /sys/class/dmi/id/sys_vendor /sys/class/dmi/id/product_name 2>/dev/null || true)

srcpkgs/das-install-common/template

@@ -1,6 +1,6 @@
 # Template file for 'das-install-common'
 pkgname=das-install-common
-version=0.1.0
+version=0.2.0
 revision=1
 depends="das-snapshots dracut rsync"
 short_desc="Das OS installer steps shared by the desktop and server installers"

srcpkgs/das-server/files/xbps-ignore.conf

@@ -0,0 +1,5 @@
+# Firmware a server does not need, otherwise pulled in by linux-base:
+# NVIDIA GPUs and sound cards. Remove a line to get the package back.
+ignorepkg=linux-firmware-nvidia
+ignorepkg=sof-firmware
+ignorepkg=alsa-firmware

srcpkgs/das-server/template

@@ -1,6 +1,6 @@
 # Template file for 'das-server'
 pkgname=das-server
-version=0.1.0
+version=0.2.0
 revision=1
 depends="openssh chrony dhcpcd NetworkManager docker docker-compose nftables
  fail2ban socklog-void python3 curl lazydocker lazygit mc tmux htop
@@ -13,12 +13,14 @@ conf_files="
  /etc/nftables.conf
  /etc/fail2ban/jail.d/das.conf
  /etc/ssh/sshd_config.d/50-das.conf
- /etc/docker/daemon.json"
+ /etc/docker/daemon.json
+ /etc/xbps.d/das-server.conf"
 
 do_install() {
 	vinstall ${FILESDIR}/nftables.conf 644 etc
 	vinstall ${FILESDIR}/fail2ban-das.conf 644 etc/fail2ban/jail.d das.conf
 	vinstall ${FILESDIR}/sshd-das.conf 644 etc/ssh/sshd_config.d 50-das.conf
 	vinstall ${FILESDIR}/docker-daemon.json 644 etc/docker daemon.json
+	vinstall ${FILESDIR}/xbps-ignore.conf 644 etc/xbps.d das-server.conf
 	vlicense ${FILESDIR}/LICENSE
 }