Aram Hăvărneanu https://xw.is/index/ index /index/ xw.is These are my technical notes. Aram Hăvărneanu https://xw.is/toolchain-index/ toolchain-index /toolchain-index/ Toolchains Tips and tricks for building cross-toolchains. Aram Hăvărneanu 2019 11 28 2025 8 13 https://xw.is/debian-sysroot/ debian-sysroot /debian-sysroot/ Create Debian sysroots We'll create Debian sysroots suitable for a GCC cross compiler. Aram Hăvărneanu 2019 11 28 2025 8 13 Debootstrap machine Everything below runs on the debootstrap machine as root: sudo -i Aram Hăvărneanu 2019 11 28 2025 8 13 Prerequisites Debian or Ubuntu or any system that can run mmdebstrap(1) (modern alternative to debootstrap(8)), with a configured QEMU user emulator. Aram Hăvărneanu 2019 11 28 2025 8 13 Install debootstrap and associated tools apt install -y binfmt-support qemu-user-static mmdebstrap Aram Hăvărneanu 2019 11 28 2025 8 13 Run debootstrap We're going to create sysroots for riscv64 and s390x (see the list of supported Debian ports.). Add more packages to --include, if needed. archs="riscv64 s390x" for arch in ${archs}; do mmdebstrap --variant=buildd --include="zlib1g-dev libgmp-dev libmpfr-dev" --architectures=${arch} stable /tmp/sysroot-${arch}.tar.xz done Note that Debian images are multiarch, which means that libraries and header files are in a different location than the usual one. GCC must be made aware of this via --enable-multiarch when running the top-level configure script. Failure to set --enable-multiarch will result in a failed build. Additionally, GCC for the host should be configured just as the the GCC on the target (in the sysroot). For example, some platforms do not make use of multilib (even though GCC might support it), so in those cases multilib should be explicitly disabled on the build machine with --disable-multilib, because otherwise it might default to being enabled leading to build failure. Aram Hăvărneanu 2019 11 28 2025 8 13 Host machine The following runs on the host machine (the machine where you'll compile and run your cross compiler). It can be the same machine as the debootstrap machine. Aram Hăvărneanu 2019 11 28 2025 8 13 Create directories targets="riscv64-linux-gnu s390x-linux-gnu" for target in ${targets}; do mkdir -p $HOME/cross/${target}/sys-root done Note that when we created the sysroots we used the Debian architecture names (riscv64, s390x), but here we use the GCC target triple (riscv64-linux-gnu, s390x-linux-gnu). Aram Hăvărneanu 2019 11 28 2025 8 13 Copy sysroots Copy the sysroots from the debootstrap machine (here debian@194.182.186.188) to the host machine. targets="riscv64-linux-gnu s390x-linux-gnu" for target in ${targets}; do arch=$(echo ${target} | cut -d '-' -f 1) ssh debian@194.182.186.230 "cat /tmp/sysroot-${arch}.tar.xz" | tar -C ${HOME}/cross/${target}/sys-root -xJf - done Aram Hăvărneanu 2019 11 28 2025 8 13 Debootstrap machine (again) Aram Hăvărneanu 2019 11 28 2025 8 13 Cleanup Still as root: rm -rf /tmp/sysroot-*.tar.xz Aram Hăvărneanu 2025 8 12 https://xw.is/gdb-build/ gdb-build /gdb-build/ Build GDB and gdbserver(1) Aram Hăvărneanu 2025 8 12 Create source and build directories We use a suffix for the build directories so we can build for multiple targets at the same time. The name is arbitrary, we just choose the target name for convenience. mkdir -p ${HOME}/src mkdir -p ${HOME}/obj/gdb-16.3 mkdir -p ${HOME}/obj/gdb-16.3-riscv64-unknown-elf mkdir -p ${HOME}/obj/gdbserver-16.3-riscv64-linux-gnu Aram Hăvărneanu 2025 8 12 Download the source code curl https://sourceware.org/pub/gdb/releases/gdb-16.3.tar.xz | tar -C $HOME/src -xJf - Aram Hăvărneanu 2025 8 12 Build and install Aram Hăvărneanu 2025 8 12 GDB Make sure you have GMP 4.2+ and GNU MPFR 3.1.0+ installed. Set the path in --with-gmp and/or --with-mpfr, if needed. Aram Hăvărneanu 2025 8 12 Native debugging As we are building, running, and debugging binaries for the same architecture, we do not need to set host or target. Also note that we install it in a different prefix than the cross-debugging case below (${HOME} vs. ${HOME}/xgcc). cd ${HOME}/obj/gdb-16.3 ../../src/gdb-16.3/configure --prefix ${HOME} make -j12 && make install Aram Hăvărneanu 2025 8 12 Cross-debugging Set --target to your desired platform, here we use riscv64-unknown-elf representing bare-metal 64-bit RISC-V. It is fine for multiple cross toolchains to share the same --prefix and --bindir. cd ${HOME}/obj/gdb-16.3-riscv64-unknown-elf ../../src/gdb-16.3/configure --prefix ${HOME}/cross --with-system-zlib --target riscv64-unknown-elf --with-gmp=/opt/homebrew make -j12 && make install Aram Hăvărneanu 2025 8 12 gdbserver(1) gdbserver(1) is a program that runs on the same machine as the binaries you are debugging (the target machine above). You have two options, either compile gdbserver(1) natively on the target machine, or cross-compile it on the build machine and move it to the host machine (which for gdbserver(1) means the target machine). Of course if you can compile it natively you might as well compile GDB itself on the target machine and use that directly. Consult the GCC documentation if you are confused by this paragraph. Aram Hăvărneanu 2025 8 12 Native compilation gdbserver(1) is part of GDB, so just install GDB on the host as described above. Aram Hăvărneanu 2025 8 12 Cross compilation You need a GCC cross compiler targetting the host system (the one running gdbserver, here riscv64-linux-gnu). cd ${HOME}/obj/gdbserver-16.3-riscv64-linux-gnu ../../src/gdbserver-16.3/configure --prefix=/ --disable-gdb --disable-nls --host riscv64-linux-gnu LDFLAGS="-static" make -j12 all-gdbserver make DESTDIR=/tmp install-gdbserver We're building a statically-linked gdbserver so that it works on every system. For example, we might run gdbserver on a musl-based system, even though our Debian sysroot is based on GNU libc. The binary is available in /tmp/bin/gdbserver and can be moved to the host system. Aram Hăvărneanu 2019 11 10 2025 8 11 https://xw.is/gcc-sysroot-build/ gcc-sysroot-build /gcc-sysroot-build/ Build GCC targeting user space Aram Hăvărneanu 2019 11 10 2025 8 11 Create source and build directories We use a suffix for the build directories so we can build for multiple targets at the same time. The name is arbitrary, we just choose the target name for convenience. mkdir -p ${HOME}/src mkdir -p ${HOME}/obj/binutils-2.45-s390x-linux-gnu mkdir -p ${HOME}/obj/gcc-15.2.0-s390x-linux-gnu Aram Hăvărneanu 2019 11 10 2025 8 11 Download the source code curl https://sourceware.org/pub/binutils/releases/binutils-2.45.tar.xz | tar -C $HOME/src -xJf - curl https://sourceware.org/pub/gcc/releases/gcc-15.2.0/gcc-15.2.0.tar.xz | tar -C $HOME/src -xJf - Aram Hăvărneanu 2019 11 10 2025 8 11 Download GCC prerequisites cd ${HOME}/src/gcc-15.2.0 ./contrib/download_prerequisites Aram Hăvărneanu 2019 11 10 2025 8 11 Prepare the sysroot You will need header files and libraries for the target system (here s390x-linux-gnu). You can either obtain those files from an existing system, or you can prepare a sysroot on an unrelated system. We will assume the sysroot is installed in ${HOME}/cross/s390x-linux-gnu/sys-root, which is the default location for GCC sysroots. Aram Hăvărneanu 2019 11 10 2025 8 11 Build and install Aram Hăvărneanu 2019 11 10 2025 8 11 Binutils Build and install GNU Binutils. cd ${HOME}/obj/binutils-2.45-s390x-linux-gnu ../../src/binutils-2.45/configure --prefix ${HOME}/cross --with-system-zlib --target s390x-linux-gnu --enable-multiarch --disable-multilib --with-sysroot make -j12 && make install Aram Hăvărneanu 2019 11 10 2025 8 11 GCC Build and install GNU GCC. If we use multiarch sysroot (such as from Debian), we must pass --enable-multiarch otherwise GCC will not find the target headers and libraries. Additionally, if the sysroot doesn't make use of multilib, we must explicitly disable via --disable-multilib as otherwise GCC might default to enabling it. Failure to set --enable-multiarch --disable-multilib will result in a failed build. cd ${HOME}/obj/gcc-15.2.0-s390x-linux-gnu ../../src/gcc-15.2.0/configure --prefix ${HOME}/cross --with-system-zlib --target s390x-linux-gnu --enable-languages=c,c++ --enable-multiarch --disable-multilib --with-sysroot make -j12 && make install Note that don't pass a specific directory to --with-sysroot because we placed out sysroot in the default location where GCC expects it. Aram Hăvărneanu 2019 11 10 2025 8 11 https://xw.is/gcc-newlib-build/ gcc-newlib-build /gcc-newlib-build/ Build GCC with Newlib support Aram Hăvărneanu 2019 11 10 2025 8 11 Create source and build directories We use a suffix for the build directories so we can build for multiple targets at the same time. The name is arbitrary, we just choose the target name for convenience. mkdir -p ${HOME}/src mkdir -p ${HOME}/obj/binutils-2.45-riscv64-unknown-elf mkdir -p ${HOME}/obj/gcc-15.2.0-riscv64-unknown-elf mkdir -p ${HOME}/obj/gcc-15.2.0-riscv64-unknown-elf-newlib mkdir -p ${HOME}/obj/newlib-4.5.0.20241231-riscv64-unknown-elf Aram Hăvărneanu 2019 11 10 2025 8 11 Download the source code curl https://sourceware.org/pub/binutils/releases/binutils-2.45.tar.xz | tar -C $HOME/src -xJf - curl https://sourceware.org/pub/gcc/releases/gcc-15.2.0/gcc-15.2.0.tar.xz | tar -C $HOME/src -xJf - curl https://sourceware.org/pub/newlib/newlib-4.5.0.20241231.tar.gz | tar -C $HOME/src -xJf - Aram Hăvărneanu 2019 11 10 2025 8 11 Download GCC prerequisites cd ${HOME}/src/gcc-15.2.0 ./contrib/download_prerequisites Aram Hăvărneanu 2019 11 10 2025 8 11 Build and install Set --target to your desired platform, here we use riscv64-unknown-elf representing bare-metal 64-bit RISC-V. It is fine for multiple cross toolchains to share the same --prefix and --bindir. Aram Hăvărneanu 2019 11 10 2025 8 11 Binutils Build and install GNU Binutils. cd ${HOME}/obj/binutils-2.45-riscv64-unknown-elf ../../src/binutils-2.45/configure --prefix ${HOME}/cross --with-system-zlib --target riscv64-unknown-elf make -j12 && make install Aram Hăvărneanu 2019 11 10 2025 8 11 Bare-metal GCC Build and install GNU GCC. Note that we're only building the C compiler (--enable-languages=c). Additionally, --without-headers is crucial, at this point this is just a bare-metal compiler and we do not have the C standard library available. cd ${HOME}/obj/gcc-15.2.0-riscv64-unknown-elf ../../src/gcc-15.2.0/configure --prefix ${HOME}/cross --with-system-zlib --target riscv64-unknown-elf --disable-libssp --enable-languages=c --without-headers make -j12 && make install Aram Hăvărneanu 2019 11 10 2025 8 11 Newlib Using the bare-metal toolchain we just built, build Newlib. This will be our C standard library. Make sure the binaries from the toolchain built above are in PATH. You also need GNU Texinfo installed. Of course, only a subset of targets are supported by Newlib. cd ${HOME}/obj/newlib-4.5.0.20241231-riscv64-unknown-elf ../../src/newlib-4.5.0.20241231/configure --prefix ${HOME}/cross --with-system-zlib --target riscv64-unknown-elf make -j12 && make install Aram Hăvărneanu 2019 11 10 2025 8 11 Embedded GCC with Newlib support Build and install GNU GCC again, this time with Newlib support. cd ${HOME}/obj/gcc-15.2.0-riscv64-unknown-elf-newlib ../../src/gcc-15.2.0/configure --prefix ${HOME}/cross --with-system-zlib --target riscv64-unknown-elf --enable-languages=c --with-newlib make -j12 && make install Aram Hăvărneanu 2019 11 10 2025 8 11 https://xw.is/binutils-build/ binutils-build /binutils-build/ Build GNU Binutils Aram Hăvărneanu 2019 11 10 2025 8 11 Create source and build directories We use a suffix for the build directories so we can build for multiple targets at the same time. The name is arbitrary, we just choose the target name for convenience. mkdir -p ${HOME}/src mkdir -p ${HOME}/obj/binutils-2.45-riscv64-unknown-elf Aram Hăvărneanu 2019 11 10 2025 8 11 Download the source code curl https://sourceware.org/pub/binutils/releases/binutils-2.45.tar.xz | tar -C $HOME/src -xJf - Aram Hăvărneanu 2019 11 10 2025 8 11 Build and install Set --target to your desired platform, here we use riscv64-unknown-elf representing bare-metal 64-bit RISC-V. It is fine for multiple cross toolchains to share the same --prefix and --bindir. cd ${HOME}/obj/binutils-2.45-riscv64-unknown-elf ../../src/binutils-2.45/configure --prefix ${HOME}/cross --with-system-zlib --target riscv64-unknown-elf make -j12 && make install Aram Hăvărneanu 2019 11 10 2025 8 11 https://xw.is/gcc-build/ gcc-build /gcc-build/ Build bare-metal GCC Aram Hăvărneanu 2019 11 10 2025 8 11 Create source and build directories We use a suffix for the build directories so we can build for multiple targets at the same time. The name is arbitrary, we just choose the target name for convenience. mkdir -p ${HOME}/src mkdir -p ${HOME}/obj/binutils-2.45-riscv64-unknown-elf mkdir -p ${HOME}/obj/gcc-15.2.0-riscv64-unknown-elf Aram Hăvărneanu 2019 11 10 2025 8 11 Download the source code curl https://sourceware.org/pub/binutils/releases/binutils-2.45.tar.xz | tar -C $HOME/src -xJf - curl https://sourceware.org/pub/gcc/releases/gcc-15.2.0/gcc-15.2.0.tar.xz | tar -C $HOME/src -xJf - Aram Hăvărneanu 2019 11 10 2025 8 11 Download GCC prerequisites cd ${HOME}/src/gcc-15.2.0 ./contrib/download_prerequisites Aram Hăvărneanu 2019 11 10 2025 8 11 Build and install Set --target to your desired platform, here we use riscv64-unknown-elf representing bare-metal 64-bit RISC-V. It is fine for multiple cross toolchains to share the same --prefix and --bindir. Aram Hăvărneanu 2019 11 10 2025 8 11 Binutils Build and install GNU Binutils. cd ${HOME}/obj/binutils-2.45-riscv64-unknown-elf ../../src/binutils-2.45/configure --prefix ${HOME}/cross --with-system-zlib --target riscv64-unknown-elf make -j12 && make install Aram Hăvărneanu 2019 11 10 2025 8 11 GCC Build and install GNU GCC. Note that we're only building the C compiler (--enable-languages=c). Additionally, --without-headers is crucial—since this is a bare-metal compiler we do not have the C standard library available. cd ${HOME}/obj/gcc-15.2.0-riscv64-unknown-elf ../../src/gcc-15.2.0/configure --prefix ${HOME}/cross --with-system-zlib --target riscv64-unknown-elf --disable-libssp --enable-languages=c --without-headers make -j12 && make install Aram Hăvărneanu https://xw.is/os-index/ os-index /os-index/ Operating systems Tips and tricks for using various operating systems. Aram Hăvărneanu https://xw.is/freebsd-index/ freebsd-index /freebsd-index/ FreeBSD Tips and tricks for using FreeBSD. Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 https://xw.is/001J/ 001J /001J/ Upgrade FreeBSD 14.3 to 15.0 Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 Introduction Everything on this page needs to be done as root unless otherwise specified, so su(1) to root. su - Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 Upgrade the base system We will do the upgrade offline (in a new boot environment) so first create the BE using bectl(8) and mount it. bectl create 15.0-RELEASE bectl mount 15.0-RELEASE /mnt Then run freebsd-update(8): freebsd-update -b /mnt -d /mnt/var/db/freebsd-update -r 15.0-RELEASE upgrade freebsd-update -b /mnt -d /mnt/var/db/freebsd-update install freebsd-update -b /mnt -d /mnt/var/db/freebsd-update install freebsd-update -b /mnt -d /mnt/var/db/freebsd-update install Yes, you really need to run it that many times. Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 Upgrade the bootloader You need to update the bootloader, otherwise the system will stop booting eventually (but not immediately). I think this is only necessary after zpool upgrade, and zpool upgrade used to warn us about this, but apparently not anymore? (Maybe it's related to the switch to OpenZFS — unclear.) Presumably you can do this after booting into the new system, but before zpool upgrade. Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 BIOS First, determine your boot devices. z800:aram$ zpool status zroot pool: zroot state: ONLINE scan: scrub repaired 0B in 00:01:46 with 0 errors on Mon Feb 5 17:48:15 2018 config: NAME STATE READ WRITE CKSUM zroot ONLINE 0 0 0 mirror-0 ONLINE 0 0 0 gpt/zfs0 ONLINE 0 0 0 gpt/zfs1 ONLINE 0 0 0 errors: No known data errors Look for the GEOM devices in the geom(8) output. z800:aram$ geom -t ... da0 PART da0p3 da0p3 DEV da0p3 LABEL gpt/zfs0 gpt/zfs0 DEV zfs::vdev ZFS::VDEV ... da2 PART da2p3 da2p3 DEV da2p3 LABEL gpt/zfs1 gpt/zfs1 DEV zfs::vdev ZFS::VDEV ... In our case, we need to install the new bootloader on da0 and da2 using gpart(8). gpart bootcode -b /mnt/boot/pmbr -p /mnt/boot/gptzfsboot -i 1 da0 gpart bootcode -b /mnt/boot/pmbr -p /mnt/boot/gptzfsboot -i 1 da2 Of course, if you already booted into the new system, these become: gpart bootcode -b /boot/pmbr -p /boot/gptzfsboot -i 1 da0 gpart bootcode -b /boot/pmbr -p /boot/gptzfsboot -i 1 da2 Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 EFI TODO. Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 Upgrade the packages It is unclear why we need devfs, but we need it. mount -t devfs devfs /mnt/dev/ pkg -c /mnt update pkg -c /mnt upgrade umount /mnt/dev/ Aram Hăvărneanu 2021 4 15 2022 5 18 2025 8 27 2026 4 28 Activate the new boot environment Activate the new boot environment, then reboot. bectl umount 15.0-RELEASE bectl activate 15.0-RELEASE If it doesn't work, you can revert to another BE in the bootloader. Aram Hăvărneanu 2018 11 7 2025 8 28 https://xw.is/001K/ 001K /001K/ FreeBSD fiber channel target Aram Hăvărneanu 2018 11 7 2025 8 28 Prerequisites You need: A fiber channel card that supports target mode, e.g. QLogic QLE2462. FreeBSD with a kernel that supports your card, e.g isp(4). a ZFS zvol. Aram Hăvărneanu 2018 11 7 2025 8 28 Create a ZFS zvol This will create a sparse 850GB ZFS zvol. sudo zfs create -p -s -V 850g tank1/export/fc Aram Hăvărneanu 2018 11 7 2025 8 28 Enable ctld(8) sudo sysrc ctld_enable=YES Aram Hăvărneanu 2018 11 7 2025 8 28 Bring the device online Use ctladm(8) to bring the devices online. sudo ctladm port -o on isp0 sudo ctladm port -o on isp1 Aram Hăvărneanu 2018 11 7 2025 8 28 Check the WWN address You'll get output like: z800:aram$ sudo ctladm port -l Port Online Frontend Name pp vp 0 YES camsim camsim 0 0 naa.50000009e370df01 1 YES ioctl ioctl 0 0 2 YES tpc tpc 0 0 3 YES camtgt isp0 0 0 naa.2100001b321cd5b6 4 YES camtgt isp1 0 0 naa.2101001b323cd5b6 Aram Hăvărneanu 2018 11 7 2025 8 28 Configure ctl.conf(5) Use this config for ctl.conf(5): lun fibre-channel { backend block device-id "5000c5001d5ba30b" serial "MGKSERIAL0001" option vendor "MGK" option product "FC Disk" option naa "600A0B80002682A8000067D95897A544" option removable "on" path /dev/zvol/tank1/export/fc } target naa.100000062b1b88c8 { auth-group no-authentication port mpt0 port mpt1 lun 0 fibre-channel } Make sure the WWN matches. Next, start the ctld daemon. The device-id is from a real Seagate FC disk, and the naa is from a real array. I think both are required by macOS to make multipathing work. sudo service ctld start Query the status, to see if everything is working correctly: z800:aram$ sudo ctladm devlist -v LUN Backend Size (Blocks) BS Serial Number Device ID 0 block 1782579200 512 MYSERIAL 0 MYDEVID 0 lun_type=0 num_threads=14 file=/dev/zvol/tank1/export/fc ctld_name=naa.2100001b321cd5b6,lun,0 scsiname=naa.2100001b321cd5b6,lun,0 Aram Hăvărneanu 2018 11 7 2025 8 28 Initiator side If using macOS, the mac should just "see" the target, no configuration required. Aram Hăvărneanu 2018 6 7 2025 7 15 https://xw.is/001A/ 001A /001A/ FreeBSD Post Install Steps Aram Hăvărneanu 2018 6 7 2025 7 15 Introduction Everything on this page needs to be done as root unless otherwise specified, so su(1) to root. su - Aram Hăvărneanu 2018 6 7 2025 7 15 Set the hostname echo 'hostname="phoenix.xw.is"' >> /etc/rc.conf Aram Hăvărneanu 2018 6 7 2025 7 15 Update the software freebsd-update fetch freebsd-update install Aram Hăvărneanu 2018 6 7 2025 7 15 Install basic software pkg install -y bash sudo rsync tmux Aram Hăvărneanu 2018 6 7 2025 7 15 ZFS If you don't have ZFS root, for example in a pre-made cloud computing image, you might want to create a separate ZFS pool. echo 'zfs_enable="YES"' >>/etc/rc.conf service zfs start zpool create -m /tank tank xbd1 zfs set compression=on tank Aram Hăvărneanu 2018 6 7 2025 7 15 Create a user Create a user with a random password that can then do passwordless sudo(8): pw useradd -n aram -c 'Aram Hăvărneanu' -g staff -G wheel -m -s /usr/local/bin/bash -L staff -w random Enable passwordless sudo for the staff group: /usr/local/etc/sudoers.d/91-staff-no-password]]> Aram Hăvărneanu 2018 6 7 2025 7 15 SSH For ssh(1) access, first use su(1) to switch from root to the user:su - aramAnd then populate the ssh keys: mkdir -p $HOME/.ssh chmod 700 $HOME/.ssh cat <<EOF >>$HOME/.ssh/authorized_keys EOF chmod 644 $HOME/.ssh/authorized_keys sort -u -o $HOME/.ssh/authorized_keys $HOME/.ssh/authorized_keys Aram Hăvărneanu https://xw.is/openbsd-index/ openbsd-index /openbsd-index/ OpenBSD Tips and tricks for using OpenBSD. Aram Hăvărneanu 2019 1 2 2025 7 16 https://xw.is/001F/ 001F /001F/ OpenBSD Post Install Steps Aram Hăvărneanu 2019 1 2 2025 7 16 Introduction Everything on this page needs to be done as root unless otherwise specified, so su(1) to root. su - Aram Hăvărneanu 2019 1 2 2025 7 16 Vultr Vultr doesn't install ssh keys, if you want to permit direct SSH root login you need to populate .ssh/authorized_keys manually. mkdir -p $HOME/.ssh chmod 700 $HOME/.ssh cat <<EOF >>$HOME/.ssh/authorized_keys EOF chmod 644 $HOME/.ssh/authorized_keys sort -u -o $HOME/.ssh/authorized_keys $HOME/.ssh/authorized_keys Change the autogenerated password:usermod -p `jot -r -c 30 a z | rs -g0 0 30 | encrypt -b a` root Aram Hăvărneanu 2019 1 2 2025 7 16 Set the hostname echo 'freedom.mgk.ro' > /etc/myname Aram Hăvărneanu 2019 1 2 2025 7 16 Update the software echo 'https://cdn.openbsd.org/pub/OpenBSD' > /etc/installurl syspatch Aram Hăvărneanu 2019 1 2 2025 7 16 Install basic software pkg_add bash rsync Aram Hăvărneanu 2019 1 2 2025 7 16 Create a user Create a user with a random password that can then do passwordless doas(8): useradd -m -g staff -L staff -G wheel -c 'Aram Hăvărneanu' -s /bin/ksh -p `jot -r -c 30 a z | rs -g0 0 30 | encrypt -b a` aram Enable passwordless doas for the staff group: /etc/doas.conf permit nopass :staff permit nopass keepenv root EOF]]> Aram Hăvărneanu 2019 1 2 2025 7 16 SSH For ssh(1) access, first use su(1) to switch from root to the user:su - aramAnd then populate the ssh keys: mkdir -p $HOME/.ssh chmod 700 $HOME/.ssh cat <<EOF >>$HOME/.ssh/authorized_keys EOF chmod 644 $HOME/.ssh/authorized_keys sort -u -o $HOME/.ssh/authorized_keys $HOME/.ssh/authorized_keys After you've done this, you might want to disable root user login. Aram Hăvărneanu 2019 2 11 2019 2 22 https://xw.is/001G/ 001G /001G/ OpenBSD HE IPv6 tunnel Aram Hăvărneanu 2019 2 11 2019 2 22 Introduction We will create an IPv6 tunnel (provided by Hurricane Electric) suitable for subnetting (/48). Aram Hăvărneanu 2019 2 11 2019 2 22 Configuration In /etc/hostname.gif0: tunnel 207.246.122.61 209.51.161.14 !ifconfig gif0 inet6 alias 2001:470:1f06:95f::2 2001:470:1f06:95f::1 prefixlen 128 !route -n add -inet6 default 2001:470:1f06:95f::1 Enable it (as root): sh /etc/netstart gif0 Aram Hăvărneanu 2019 2 11 2019 2 22 Test Check that it works: Aram Hăvărneanu 2019 2 11 2019 2 22 Routing Assign IPs to the interface you wish to route to: freedom# cat /etc/hostname.enc0 inet 172.24.24.1 255.255.255.0 172.24.24.255 inet6 2001:470:8c78:a0::1 64 up Reconfigure it: sh /etc/netstart enc0 Enable IPv6 forwarding: freedom# cat /etc/sysctl.conf hw.smt=1 net.inet.ip.forwarding=1 net.inet6.ip6.forwarding=1 Same thing with sysctl (as root): sysctl net.inet6.ip6.forwarding=1 Aram Hăvărneanu 2019 2 22 https://xw.is/001H/ 001H /001H/ OpenSMTPD forward to Google Aram Hăvărneanu 2019 2 22 Introduction We'll use OpenSMTPD to forward to Google. Aram Hăvărneanu 2019 2 22 Prerequistes A Gmail or Google Workspace account. OpenSMTPD is already installed and running on OpenBSD. Aram Hăvărneanu 2019 2 22 How Enable access to what Google calls less secure apps. Then as root: echo "googlemail user@gmail.com:password" > /etc/mail/secrets You can use your Google Apps username instead of gmail, and googlemail is just a label that we will use later. In /etc/mail/smtpd.conf: table aliases file:/etc/mail/aliases table secrets db:/etc/mail/secrets.db listen on lo0 action "local" mbox alias <aliases> action "relay" relay host smtp+tls://googlemail@smtp.googlemail.com:587 auth <secrets> match for local action "local" match for any action "relay" Notice the googlemail label. After this, just restart smtpd: rcctl restart smtpd Aram Hăvărneanu 2019 2 22 Test echo "Does it work?" | mail -s "Mail test from OpenBSD" spam@mgk.ro Aram Hăvărneanu https://xw.is/linux-index/ linux-index /linux-index/ Linux Tips and tricks for using Linux. Aram Hăvărneanu 2025 9 10 https://xw.is/001M/ 001M /001M/ Red Hat Enterprise Linux Post Install Steps Aram Hăvărneanu 2025 9 10 Introduction Everything on this page needs to be done as root unless otherwise specified, so sudo(8) to root. sudo -i Aram Hăvărneanu 2025 9 10 Register your system. Generate a new activation key in the Red Hat Hybrid Cloud Console and register your system. rhc connect --activation-key <key> --organization 7877846 --disable-feature analytics --disable-feature remote-management Aram Hăvărneanu 2025 9 10 Update the software dnf -y upgrade-minimal reboot Aram Hăvărneanu 2025 9 10 Create a user Create a user with a locked password that can then do passwordless sudo(8): useradd -c 'Aram Hăvărneanu' -G wheel,users -m -s /bin/bash -U aram passwd -l aram Enable passwordless sudo for the wheel group: /etc/sudoers.d/91-wheel-no-password]]> Aram Hăvărneanu 2025 9 10 SSH For ssh(1) access, first use su(1) to switch from root to the user:su - aramAnd then populate the ssh keys: mkdir -p $HOME/.ssh chmod 700 $HOME/.ssh cat <<EOF >>$HOME/.ssh/authorized_keys EOF chmod 644 $HOME/.ssh/authorized_keys sort -u -o $HOME/.ssh/authorized_keys $HOME/.ssh/authorized_keys Aram Hăvărneanu 2025 9 10 Enable kpatch Install kpatch and enable it. dnf -y install kpatch kpatch-dnf dnf kpatch auto Aram Hăvărneanu 2025 9 10 Unregister your system When you retire your system, don't forget to unregister. rhc disconnect Aram Hăvărneanu 2019 11 28 2025 8 13 https://xw.is/debian-sysroot/ debian-sysroot /debian-sysroot/ Toolchains › Create Debian sysroots We'll create Debian sysroots suitable for a GCC cross compiler. Aram Hăvărneanu 2019 11 28 2025 8 13 Debootstrap machine Everything below runs on the debootstrap machine as root: sudo -i Aram Hăvărneanu 2019 11 28 2025 8 13 Prerequisites Debian or Ubuntu or any system that can run mmdebstrap(1) (modern alternative to debootstrap(8)), with a configured QEMU user emulator. Aram Hăvărneanu 2019 11 28 2025 8 13 Install debootstrap and associated tools apt install -y binfmt-support qemu-user-static mmdebstrap Aram Hăvărneanu 2019 11 28 2025 8 13 Run debootstrap We're going to create sysroots for riscv64 and s390x (see the list of supported Debian ports.). Add more packages to --include, if needed. archs="riscv64 s390x" for arch in ${archs}; do mmdebstrap --variant=buildd --include="zlib1g-dev libgmp-dev libmpfr-dev" --architectures=${arch} stable /tmp/sysroot-${arch}.tar.xz done Note that Debian images are multiarch, which means that libraries and header files are in a different location than the usual one. GCC must be made aware of this via --enable-multiarch when running the top-level configure script. Failure to set --enable-multiarch will result in a failed build. Additionally, GCC for the host should be configured just as the the GCC on the target (in the sysroot). For example, some platforms do not make use of multilib (even though GCC might support it), so in those cases multilib should be explicitly disabled on the build machine with --disable-multilib, because otherwise it might default to being enabled leading to build failure. Aram Hăvărneanu 2019 11 28 2025 8 13 Host machine The following runs on the host machine (the machine where you'll compile and run your cross compiler). It can be the same machine as the debootstrap machine. Aram Hăvărneanu 2019 11 28 2025 8 13 Create directories targets="riscv64-linux-gnu s390x-linux-gnu" for target in ${targets}; do mkdir -p $HOME/cross/${target}/sys-root done Note that when we created the sysroots we used the Debian architecture names (riscv64, s390x), but here we use the GCC target triple (riscv64-linux-gnu, s390x-linux-gnu). Aram Hăvărneanu 2019 11 28 2025 8 13 Copy sysroots Copy the sysroots from the debootstrap machine (here debian@194.182.186.188) to the host machine. targets="riscv64-linux-gnu s390x-linux-gnu" for target in ${targets}; do arch=$(echo ${target} | cut -d '-' -f 1) ssh debian@194.182.186.230 "cat /tmp/sysroot-${arch}.tar.xz" | tar -C ${HOME}/cross/${target}/sys-root -xJf - done Aram Hăvărneanu 2019 11 28 2025 8 13 Debootstrap machine (again) Aram Hăvărneanu 2019 11 28 2025 8 13 Cleanup Still as root: rm -rf /tmp/sysroot-*.tar.xz Aram Hăvărneanu 2019 8 9 2025 7 15 https://xw.is/001E/ 001E /001E/ Ubuntu Linux Post Install Steps Aram Hăvărneanu 2019 8 9 2025 7 15 Introduction Everything on this page needs to be done as root unless otherwise specified, so sudo(8) to root. sudo -i Aram Hăvărneanu 2019 8 9 2025 7 15 Set hostname hostnamectl set-hostname test0.mgk.ro reboot Aram Hăvărneanu 2019 8 9 2025 7 15 Scaleway If you're on a braindead platform like Scaleway, you might also need to disable this: systemctl disable scw-set-hostname Aram Hăvărneanu 2019 8 9 2025 7 15 Package management Aram Hăvărneanu 2019 8 9 2025 7 15 Do not install recommended and suggested packages Seriusly, who wants this? Disable it: cat <<EOT >/etc/apt/apt.conf.d/61norecommends APT::Install-Recommends "false"; APT::Install-Suggests "false"; EOT Aram Hăvărneanu 2019 8 9 2025 7 15 Update the software apt update && apt -y upgrade reboot Aram Hăvărneanu 2019 8 9 2025 7 15 User management Aram Hăvărneanu 2019 8 9 2025 7 15 Create a user (cloud computing) Create a user with a locked password that can then do passwordless sudo(8): useradd -c 'Aram Hăvărneanu' -G users -m -s /bin/bash -g staff aram passwd -l aram Enable passwordless sudo for the staff group: /etc/sudoers.d/91-staff-no-password]]> Aram Hăvărneanu 2019 8 9 2025 7 15 Fix the user created during installation (non-cloud) usermod -a -G staff aram passwd -l aram Enable passwordless sudo for the staff group: /etc/sudoers.d/91-staff-no-password]]> Aram Hăvărneanu 2019 8 9 2025 7 15 SSH For ssh(1) access, first use su(1) to switch from root to the user:su - aramAnd then populate the ssh keys: mkdir -p $HOME/.ssh chmod 700 $HOME/.ssh cat <<EOF >>$HOME/.ssh/authorized_keys EOF chmod 644 $HOME/.ssh/authorized_keys sort -u -o $HOME/.ssh/authorized_keys $HOME/.ssh/authorized_keys Aram Hăvărneanu 2019 8 9 2025 7 15 Install packages For home installations you might want to install avahi: apt install avahi-daemon For development systems you might want to install: apt install -y git build-essential clang clang-format clang-tidy Aram Hăvărneanu 2019 3 13 2025 7 15 https://xw.is/001D/ 001D /001D/ Install newer kernels in Debian stable Aram Hăvărneanu 2019 3 13 2025 7 15 Prerequisites Install Debian. Everything on this page needs to be done as root, so sudo(8) to root. sudo -i Aram Hăvărneanu 2019 3 13 2025 7 15 Enable backports cat <<EOT >>/etc/apt/sources.list deb http://deb.debian.org/debian/ stretch-backports main contrib non-free deb-src http://deb.debian.org/debian/ stretch-backports main contrib non-free EOT Aram Hăvărneanu 2019 3 13 2025 7 15 Upgrade some packages It's unclear why we need this or whether we need it at all: sudo apt-get -t stretch-backports upgrade Aram Hăvărneanu 2019 3 13 2025 7 15 Search for a new kernel apt search linux-image Aram Hăvărneanu 2019 3 13 2025 7 15 Install new kernel apt-get -t stretch-backports install linux-image-4.19.0-0.bpo.2-amd64 linux-headers-4.19.0-0.bpo.2-amd64 firmware-linux-free Aram Hăvărneanu 2019 3 13 2025 7 15 Reboot reboot After reboot, check for the new kernel: aram@debian:~$ uname -a Linux debian 4.19.0-0.bpo.2-amd64 1 SMP Debian 4.19.16-1~bpo9+1 (2019-02-07) x86_64 GNU/Linux aram@debian:~$ Aram Hăvărneanu 2018 8 31 2025 7 15 https://xw.is/001C/ 001C /001C/ Debian Linux Post Install Steps Aram Hăvărneanu 2018 8 31 2025 7 15 Introduction Everything on this page needs to be done as root unless otherwise specified, so sudo(8) to root. sudo -i Aram Hăvărneanu 2018 8 31 2025 7 15 Set hostname hostnamectl set-hostname sky.mgk.ro reboot Aram Hăvărneanu 2018 8 31 2025 7 15 Scaleway If you're on a braindead platform like Scaleway, you might also need to disable this: systemctl disable scw-set-hostname Aram Hăvărneanu 2018 8 31 2025 7 15 Package management Aram Hăvărneanu 2018 8 31 2025 7 15 Enable more repositories Debian doesn't enable the contrib and non-free repositories by default. Do it: cat <<EOT >/etc/apt/sources.list deb http://deb.debian.org/debian/ stretch main contrib non-free deb-src http://deb.debian.org/debian/ stretch main contrib non-free deb http://security.debian.org/debian-security stretch/updates main contrib non-free deb-src http://security.debian.org/debian-security stretch/updates main contrib non-free deb http://deb.debian.org/debian/ stretch-updates main contrib non-free deb-src http://deb.debian.org/debian/ stretch-updates main contrib non-free EOT Aram Hăvărneanu 2018 8 31 2025 7 15 Do not install recommended and suggested packages Seriusly, who wants this? Disable it: cat <<EOT >/etc/apt/apt.conf.d/50norecommends APT::Install-Recommends "false"; APT::Install-Suggests "false"; EOT Aram Hăvărneanu 2018 8 31 2025 7 15 Update the software apt update && apt -y upgrade reboot Aram Hăvărneanu 2018 8 31 2025 7 15 User management Aram Hăvărneanu 2018 8 31 2025 7 15 Create a user (cloud computing) Create a user with a locked password that can then do passwordless sudo(8): useradd -c 'Aram Hăvărneanu' -G users -m -s /bin/bash -g staff aram passwd -l aram Enable passwordless sudo for the staff group: /etc/sudoers.d/91-staff-no-password]]> Aram Hăvărneanu 2018 8 31 2025 7 15 Fix the user created during installation (non-cloud) usermod -a -G staff aram passwd -l aram Enable passwordless sudo for the staff group: /etc/sudoers.d/91-staff-no-password]]> Aram Hăvărneanu 2018 8 31 2025 7 15 SSH For ssh(1) access, first use su(1) to switch from root to the user:su - aramAnd then populate the ssh keys: mkdir -p $HOME/.ssh chmod 700 $HOME/.ssh cat <<EOF >>$HOME/.ssh/authorized_keys EOF chmod 644 $HOME/.ssh/authorized_keys sort -u -o $HOME/.ssh/authorized_keys $HOME/.ssh/authorized_keys Aram Hăvărneanu 2018 8 31 2025 7 15 Install packages For home installations you might want to install avahi: apt install avahi-daemon For development systems you might want to install: apt install rsync git build-essential linux-headers-amd64 gccgo gccgo-go golang-go clang clang-format clang-tidy And if you set up backports: apt -t stretch-backports install clang-6.0 golang-go apt autoremove Aram Hăvărneanu 2018 8 31 2025 7 15 Newer kernel If it's a testing or development system, perhaps you might want a newer kernel. Aram Hăvărneanu 2018 8 31 2025 7 15 https://xw.is/001B/ 001B /001B/ Fedora Linux Post Install Steps Aram Hăvărneanu 2018 8 31 2025 7 15 Introduction Everything on this page needs to be done as root unless otherwise specified, so sudo(8) to root. sudo -i Aram Hăvărneanu 2018 8 31 2025 7 15 Cloud Init If your install uses cloud-init (e.g. Amazon EC2) do the following: Aram Hăvărneanu 2018 8 31 2025 7 15 Set hostname echo 'preserve_hostname: yes' >/etc/cloud/cloud.cfg.d/55-preseve-hostname.cfg echo 'eden.mgk.ro' >/etc/hostname reboot Aram Hăvărneanu 2018 8 31 2025 7 15 Enable IPv6 cat <<EOF >/etc/cloud/cloud.cfg.d/56-custom-networking.cfg network: version: 1 config: - type: physical name: eth0 subnets: - type: dhcp - type: dhcp6 EOF reboot Aram Hăvărneanu 2018 8 31 2025 7 15 Scaleway If you're on a braindead platform like Scaleway, you might also need to disable this: systemctl disable scw-set-hostname Aram Hăvărneanu 2018 8 31 2025 7 15 Update the software dnf -y upgrade-minimal reboot Aram Hăvărneanu 2018 8 31 2025 7 15 Create a user Create a user with a locked password that can then do passwordless sudo(8): useradd -c 'Aram Hăvărneanu' -G wheel,users -m -s /bin/bash -U aram passwd -l aram Enable passwordless sudo for the wheel group: /etc/sudoers.d/91-wheel-no-password]]> Aram Hăvărneanu 2018 8 31 2025 7 15 SSH For ssh(1) access, first use su(1) to switch from root to the user:su - aramAnd then populate the ssh keys: mkdir -p $HOME/.ssh chmod 700 $HOME/.ssh cat <<EOF >>$HOME/.ssh/authorized_keys EOF chmod 644 $HOME/.ssh/authorized_keys sort -u -o $HOME/.ssh/authorized_keys $HOME/.ssh/authorized_keys Aram Hăvărneanu 2018 8 31 2025 7 15 Enable NTP service If not already enabled, enable NTP: systemctl enable --now ntpd.service Aram Hăvărneanu 2018 8 31 2025 7 15 Install packages For home installations you might want to install avahi: dnf install nss-mdns avahi systemctl enable --now avahi-daemon.service For development systems you might want to install: dnf -y groupinstall 'Development Tools' dnf -y install rsync clang clang-tools-extra gcc-go golang Aram Hăvărneanu 2019 3 20 https://xw.is/0017/ 0017 /0017/ Use local time for RTC on systemd-based Linux distributions This is not recommended, but if you need to use local time for whatever reason, you can do this: timedatectl set-local-rtc 1 Aram Hăvărneanu 2019 2 22 https://xw.is/0018/ 0018 /0018/ Upgrade Debian Linux to Testing See the Debian wiki for more information. Everything on this page must be ran as root. Switch to root with su -. Aram Hăvărneanu 2019 2 22 Upgrade to testing Run the following commands apt-get update && apt-get upgrade -y cat <<EOF >/etc/apt/sources.list deb https://deb.debian.org/debian testing main contrib non-free deb https://deb.debian.org/debian-security testing/updates main contrib non-free EOF apt-get update apt-get dist-upgrade -y apt autoremove -y Answer the questions. If you enable extra architectures (see below), you might want to limit the architectures of the main repositories to amd64 (assuming you use that). In this case do this instead: apt-get update && apt-get upgrade -y cat <<EOF >/etc/apt/sources.list deb [arch=amd64] https://deb.debian.org/debian testing main contrib non-free deb [arch=amd64] https://deb.debian.org/debian-security testing/updates main contrib non-free EOF apt-get update apt-get dist-upgrade -y apt autoremove -y Aram Hăvărneanu 2019 2 22 Make apt prefer testing by default If you are going to use multiple repos (e.g. debian-ports below), make testing the default like so: echo 'APT::Default-Release "testing";' >/etc/apt/apt.conf.d/91prefertesting Aram Hăvărneanu 2019 2 22 Add support for new (hardware) ports If you want to add support for new ports (e.g. RISC-V), do this: apt-get install -y debian-ports-archive-keyring cat <<EOF >>/etc/apt/sources.list deb https://deb.debian.org/debian-ports unstable main deb https://deb.debian.org/debian-ports unreleased main deb https://deb.debian.org/debian-ports experimental main EOF apt-get update Consider limiting the new ports to a specific architecture. Also consider limiting the main repositories to amd64 (if you use amd64). So do this instead: apt-get install -y debian-ports-archive-keyring cat <<EOF >>/etc/apt/sources.list deb [arch=riscv64] https://deb.debian.org/debian-ports unstable main deb [arch=riscv64] https://deb.debian.org/debian-ports unreleased main deb [arch=riscv64] https://deb.debian.org/debian-ports experimental main EOF apt-get update Aram Hăvărneanu 2019 2 22 https://xw.is/0019/ 0019 /0019/ Upgrade Debian Linux to Unstable See the Debian wiki for more information.Everything on this page must be ran as root. Switch to root with su -.Before upgrading to Debian Unstable, you must first upgrade to Debian Testing. Aram Hăvărneanu2019222https://xw.is/0018/0018/0018/Linux › Upgrade Debian Linux to TestingSee the Debian wiki for more information.Everything on this page must be ran as root. Switch to root with su -.Aram Hăvărneanu2019222Upgrade to testingRun the following commandsapt-get update && apt-get upgrade -y cat <<EOF >/etc/apt/sources.list deb https://deb.debian.org/debian testing main contrib non-free deb https://deb.debian.org/debian-security testing/updates main contrib non-free EOF apt-get update apt-get dist-upgrade -y apt autoremove -yAnswer the questions. If you enable extra architectures (see below), you might want to limit the architectures of the main repositories to amd64 (assuming you use that). In this case do this instead:apt-get update && apt-get upgrade -y cat <<EOF >/etc/apt/sources.list deb [arch=amd64] https://deb.debian.org/debian testing main contrib non-free deb [arch=amd64] https://deb.debian.org/debian-security testing/updates main contrib non-free EOF apt-get update apt-get dist-upgrade -y apt autoremove -yAram Hăvărneanu2019222Make apt prefer testing by defaultIf you are going to use multiple repos (e.g. debian-ports below), make testing the default like so:echo 'APT::Default-Release "testing";' >/etc/apt/apt.conf.d/91prefertestingAram Hăvărneanu2019222Add support for new (hardware) portsIf you want to add support for new ports (e.g. RISC-V), do this:apt-get install -y debian-ports-archive-keyring cat <<EOF >>/etc/apt/sources.list deb https://deb.debian.org/debian-ports unstable main deb https://deb.debian.org/debian-ports unreleased main deb https://deb.debian.org/debian-ports experimental main EOF apt-get updateConsider limiting the new ports to a specific architecture. Also consider limiting the main repositories to amd64 (if you use amd64). So do this instead:apt-get install -y debian-ports-archive-keyring cat <<EOF >>/etc/apt/sources.list deb [arch=riscv64] https://deb.debian.org/debian-ports unstable main deb [arch=riscv64] https://deb.debian.org/debian-ports unreleased main deb [arch=riscv64] https://deb.debian.org/debian-ports experimental main EOF apt-get update Aram Hăvărneanu2019222Upgrade to unstableRun the following commands:cat <<EOF >/etc/apt/sources.list deb http://deb.debian.org/debian unstable main deb http://deb.debian.org/debian-debug unstable-debug main deb http://deb.debian.org/debian-ports unstable main EOF apt-get update apt-get dist-upgrade -y apt autoremove -yThen answer the questions. Consider limiting the architecture to amd64 (if that's what you use):cat <<EOF >/etc/apt/sources.list deb [arch=amd64] http://deb.debian.org/debian unstable main deb [arch=amd64] http://deb.debian.org/debian-debug unstable-debug main deb [arch=amd64] http://deb.debian.org/debian-ports unstable main EOF apt-get update apt-get dist-upgrade -y apt autoremove -y Aram Hăvărneanu https://xw.is/solaris-index/ solaris-index /solaris-index/ Solaris Tips and tricks for using Solaris. Aram Hăvărneanu 2018 6 7 2025 7 8 https://xw.is/0008/ 0008 /0008/ Generate SPARC sysroot on amd64 Solaris 11 If you need libraries and headers for producing a Solaris/SPARC GCC cross compiler you can obtain them from a regular amd64 Solaris 11 installation. The following commands will install libraries suitable for Solaris gcc cross compiler in $PKG_IMAGE: TRIPLET=sparc64-sun-solaris2.11 export PKG_IMAGE=/export/$TRIPLET-sysroot zfs create rpool$PKG_IMAGE pkg image-create -F -p solaris=http://pkg.oracle.com/solaris/release $PKG_IMAGE pkg change-variant variant.arch=sparc pkg install --accept entire@latest solaris-minimal-server system/header gcc Aram Hăvărneanu 2018 6 7 2025 7 8 https://xw.is/0007/ 0007 /0007/ Re-add "Primary Administrator" in Solaris 11 Solaris used to ship with a Primary Administrator RBAC profile, but it was removed some time in Solaris 11. We can easily add it back to the profile description and to the execution profile databases. After this, we can run pfexec(1) without a password. Run the following as root: echo 'Primary Administrator:suser:cmd:::*:uid=0;gid=0' >> /etc/security/exec_attr echo 'Primary Administrator:::All administrative tasks:auths=solaris.*;solaris.grant;help=RtPriAdmin.html' >> /etc/security/prof_attr usermod -P "Primary Administrator" aram Aram Hăvărneanu 2019 2 22 https://xw.is/0013/ 0013 /0013/ Boot SPARC server behind NAT over the Internet from Solaris 11 VM also behind NAT Aram Hăvărneanu 2019 2 22 Network topology We have two sites, both connected to the Internet, Vienna, and Sibiu. We wish to network boot the SPARC server (located in Vienna), while we're working on the laptop in Sibiu. We have access to VMware Fusion, and we can install a Solaris network boot server in a virtual machine. =latex, font=\footnotesize ] \node [router] (r1) {Router \#1\\(NAT)}; \node [switch, above=1.2cm of r1] (sw1) {Switch}; \node [host, line width=1pt, left =2.4cm of sw1] (sparc) {SPARC\\server}; \node [host, right=2.4cm of sw1] (z800) {z800}; \node [cloudnode, below=1.2cm of r1] (internet) {Internet}; \node [router, below=1.2cm of internet] (r2) {Router \#2\\(NAT)}; \node [switch, below=1.2cm of r2] (sw2) {Switch}; \node [router, right=2cm of sw2] (r3) {Router \#3\\(VMware)}; \node [host, left =2.4cm of sw2] (laptop) {Laptop}; \node [host, line width=1pt, below=1.2cm of r3] (solaris) {Solaris\\VM}; \draw [thick] (sparc.west |- internet) -- ($(internet.west)+(-0.6cm,0)$); \draw [thick] ($(internet.east)+(0.6cm,0)$) -- ([xshift=0.5cm]z800.east |- internet); \node [anchor=south west,yshift=2pt] at (sparc.west |- internet) {Site \#1 (Vienna)}; \node [anchor=north west,yshift=-2pt] at (sparc.west |- internet) {Site \#2 (Sibiu)}; \draw (sparc.east) -- node[pos=.37,above] {192.168.0.60} (sw1.west); \draw (sw1.east) -- node[pos=.60,above] {192.168.0.100} (z800.west); \draw (sw1.south) -- node[pos=.85,left] {192.160.0.1/24}(r1.north); \draw (r1.south) -- node[pos=.15,left] {84.112.126.72} (internet.north); \draw (internet.south) -- node[pos=.85,left] {xx.xx.xx.xx} (r2.north); \draw (r2.south) -- node[pos=.20,left] {172.20/20} (sw2.north); \draw (sw2.east) -- node[pos=.58,above] {172.20.8.xx} (r3.west); \draw (sw2.west) -- node[pos=.65,above] {172.20.8.yy} (laptop.east); \draw (r3.south) -- node[pos=.20,right] {172.16.24/24} node[pos=.85,right] {172.16.24.128} (solaris.north); \end {tikzpicture} ]]> Aram Hăvărneanu 2019 2 22 Strategy The idea is that we have access through ssh to a machine in the same LAN as the server (z800 in the diagram above). We want to make the SPARC server think it's booting from this machine while we're in fact using ssh port forwarding to forward the inbound connection to that machine to our VM. Aram Hăvărneanu 2019 2 22 Instructions Install Solaris 11 (amd64) in VMware, on laptop. Then set-up a SPARC Automated Installer (AI) server: vm# pfexec installadm create-service -a sparc Make a client-specific AI config: cp /etc/netboot/{system,webboot}.conf /etc/netboot/cl.ie.nt.ip Edit /etc/netboot/client-ip/webboot.conf to reference client (e.g. behind NAT) IPs. Set-up remote port forwarding: laptop$ ssh -S none -NT -R 5555:172.16.24.128:5555 -L 8080:192.168.0.1:80 vienna.mgk.ro Set-up the SPARC machine to netboot using static IP: ok setenv network-boot-arguments host-ip=192.168.0.60,router-ip=192.168.0.1,subnet-mask=255.255.255.0,file=http://192.168.0.100:5555/cgi-bin/wanboot-cgi ok boot net Aram Hăvărneanu 2019 2 22 https://xw.is/0010/ 0010 /0010/ Solaris 11 zones virtual networking with NAT Aram Hăvărneanu 2019 2 22 Prepare the Solaris global zone Prepare the global zone; net2 is the interface connected to the Internet. dladm create-etherstub ether0 dladm create-vnic -l ether0 vnic0 ipadm create-ip vnic0 ipadm create-addr -T static -a 10.0.0.1/8 vnic0/v4 routeadm -u -e ipv4-forwarding ipadm set-ifprop -p forwarding=on -m ipv4 net2 ipadm set-ifprop -p forwarding=on -m ipv4 vnic0 echo "map net2 10.0.0.0/8 -> 0/32 portmap tcp/udp auto" > /etc/ipf/ipnat.conf echo "map net2 10.0.0.0/8 -> 0/32" >> /etc/ipf/ipnat.conf svcadm enable network/ipfilter Aram Hăvărneanu 2019 2 22 Prepare the non-global zones Prepare the zone; for-sysroot is the zone name. dladm create-vnic -l ether0 vnic1 zonecfg -z for-sysroot "create; set ip-type=exclusive; add net; set physical=vnic1; end; commit" zoneadm -z for-sysroot install zoneadm -z for-sysroot boot zlogin -C for-sysroot In sysconfig(1M) set up vnic1/v4 10.0.0.2/8 with 10.0.0.1 as default router. Aram Hăvărneanu 2019 2 22 Revert (optional) If you want to revert the previous steps, do the following. Aram Hăvărneanu 2019 2 22 Delete the non-global zone Delete the zone. zoneadm -z for-sysroot shutdown zoneadm -z for-sysroot uninstall -F zonecfg -z for-sysroot delete -F dladm delete-vnic vnic Aram Hăvărneanu 2019 2 22 Restore the global zone Restore the global zone to its original state. routeadm -u -d ipv4-forwarding ipadm delete-addr vnic0/v4 ipadm delete-ip vnic0 dladm delete-vnic vnic0 dladm delete-etherstub ether0 ipadm set-ifprop -p forwarding=off -m ipv4 net2 svcadm disable network/ipfilter rm /etc/ipf/ipnat.conf Aram Hăvărneanu 2018 6 7 https://xw.is/0011/ 0011 /0011/ Build GDB and gdbserver(1) for Solaris 11 SPARC Aram Hăvărneanu 2018 6 7 Build GDB on development machine On development (e.g. amd64) machine: cd $HOME curl http://ftp.gnu.org/gnu/gdb/gdb-7.11.1.tar.gz | tar xf - mkdir -p $HOME/gdb-build cd $HOME/gdb-build ../gdb-7.11.1/configure --prefix $HOME/xgcc --bindir $HOME/bin --target sparc64-sun-solaris2.11 make -j5 && make inst Aram Hăvărneanu 2018 6 7 Build GDB and gdbserver(1) on target machine On target (e.g. Solaris/SPARC) machine: cd $HOME/src curl http://ftp.gnu.org/gnu/gdb/gdb-7.11.1.tar.gz | gtar xzf - zfs create -p rpool/export/home/aram/builds/gdb zfs create -p rpool/export/home/aram/builds/gdbserver cd $HOME/builds/gdb CFLAGS='-m64' ../../src/gdb-7.11.1/configure --disable-tui --host sparc64-sun-solaris2.11 --build sparc64-sun-solaris2.11 --target sparc64-sun-solaris2.11 --prefix $HOME/tools --bindir $HOME/bin make -j80 && make install cd $HOME/builds/gdbserver ../../src/gdb-7.11.1/gdb/gdbserver/configure --host sparc64-sun-solaris2.11 --build sparc64-sun-solaris2.11 --target sparc64-sun-solaris2.11 --prefix $HOME/tools --bindir $HOME/bin make -j80 && make install Aram Hăvărneanu 2018 6 7 https://xw.is/0009/ 0009 /0009/ Create a new administrative user in Solaris Aram Hăvărneanu 2018 6 7 Ensure "Primary Administrator" profile exist Make sure Primary Administrator profile exists and the current user is assigned to it. Aram Hăvărneanu 2018 6 7 2025 7 8 https://xw.is/0007/ 0007 /0007/ Solaris › Re-add "Primary Administrator" in Solaris 11 Solaris used to ship with a Primary Administrator RBAC profile, but it was removed some time in Solaris 11. We can easily add it back to the profile description and to the execution profile databases. After this, we can run pfexec(1) without a password. Run the following as root: echo 'Primary Administrator:suser:cmd:::*:uid=0;gid=0' >> /etc/security/exec_attr echo 'Primary Administrator:::All administrative tasks:auths=solaris.*;solaris.grant;help=RtPriAdmin.html' >> /etc/security/prof_attr usermod -P "Primary Administrator" aram Aram Hăvărneanu 2018 6 7 Create the new user pfexec useradd -u 5008 -g staff -s /bin/bash -m -P 'Primary Administrator' -K 'defaultpriv=basic,dtrace_proc,dtrace_user' foo pfexec passwd -N foo Aram Hăvărneanu https://xw.is/macos-index/ macos-index /macos-index/ macOS Tips and tricks for using macOS. https://xw.is/macos-installer/ macos-installer /macos-installer/ Create a bootable installer for macOS Documentation https://support.apple.com/en-us/101578 You can use a USB flash drive or other secondary volume as a startup disk from which to install the Mac operating system. These steps are primarily for system administrators and other experienced users. Aram Hăvărneanu 2022 7 28 https://xw.is/0004/ 0004 /0004/ Use the Apple Keychain for ssh key passphrases On modern macOS systems, you can set up your system such that your encrypted ssh keys get automatically decrypted using the passphrase stored in the Apple Keychain (which gets unlocked at login). Aram Hăvărneanu 2022 7 28 Add your passphrase to the Keychain Create your keys as usual, then do this once for every key: ssh-add --apple-use-keychain ~/.ssh/id_ed25519 You must use the full path your key, a relative path will not work! Note that we're adding the key to the ssh agent here, but we will not be using the ssh agent. Rather, this operation has the side effect that the key will be saved in the keychain. Aram Hăvărneanu 2022 7 28 Configure ssh to use the Keychain Add this to your ~/.ssh/config: Host * IgnoreUnknown UseKeychain UseKeychain yes IgnoreUnknown is there so that UseKeychain (an Apple-specific extension) will work with non-Apple ssh implementations. Contrary to Internet misinformation you do not need to use ssh-agent(1), or enable any special Apple-specific options for the ssh agent. Of course you can do this per-host, or per-key, but then IgnoreUnknown should come early in your configuration, before any use of UseKeychain. Aram Hăvărneanu 2020 7 29 https://xw.is/0005/ 0005 /0005/ HiDPI XQuartz XQuartz doesn't support HiDPI in any reasonable way, but you can sort of make it work on a temporary basis using the following technique. Assuming you want to run a remote X application, and you want that application to use HiDPI: Install XQuartz, for example brew install xquartz. Enable full screen mode in XQuartz. It doesn't work in non-root window mode. Connect to remote server using remote X forwarding, like ssh -Snone -X z800.local. Disabling multiplexing is important because it doesn't work well with X forwarding. Run xterm, we need an X (non-native) terminal for later. In a native terminal (Terminal.app) run xrandr --output default --mode 5120x2880 --dpi 218. Unfortunately we can't make this permanent. After this, you will be in high resolution full screen X, with a very tiny xterm. Run whatever application from that xterm. You might need to force HiDPI mode for that application, but it should have all the pixels available. To get out of X, press ⌥ ⌘ A. Unfortunately this will turn off the X resolution hack set above. To get back into X at the correct resolution, run xrandr --output default --mode 5120x2880 --dpi 218 again in the native terminal. It's awful, but it works. Aram Hăvărneanu https://xw.is/git-index/ git-index /git-index/ Git Tips and tricks for using Git. Aram Hăvărneanu 2025 4 1 https://xw.is/0003/ 0003 /0003/ Sign Git commits with SSH keys Git can use ssh-keygen(1) to sign commits and tags. The problem is that if you want to avoid entering passphrases it requires a running ssh-agent(1). This is the case even if you configured ssh to automatically decrypt keys using the iCloud Keychain, as ssh-keygen(1) will not read ~/.ssh/config. We're going to make git(1) run a helper script that temporarily loads the required key into the ssh agent, setting a short timeout. Aram Hăvărneanu 2025 4 1 Create helper script Create this executable file and put it in your PATH, I'm using ~/bin/git-config-helper-gpg.ssh.defaultKeyCommand. #/bin/bash ssh-add -q -t 5 --apple-load-keychain ~/.ssh/id_ed25519 KEY=$(ssh-add -L | head -n 1) echo key::$KEY Aram Hăvărneanu 2025 4 1 Configure Git to use SSH for signing git config --global gpg.format ssh git config --global gpg.ssh.defaultKeyCommand ~/bin/git-config-helper-gpg.ssh.defaultKeyComma This configures git(1) to use SSH signing (as opposed to GPG) and instructs it to run our helper script when it needs to sign. Aram Hăvărneanu 2025 4 1 Configure Git to verify signatures Record a list of known email-signature pairs in .ssh/allowed_signers (file name and location is arbitrary): aram@mgk.ro ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMRc0UWKrFpCv/EOUo2jpEQt+C/pa0tc1rUWKgjbKTp7 aram@edengate.local Then configure git(1) to use this file for verification: git config --global gpg.ssh.allowedSignersFile ~/.ssh/allowed_signers Aram Hăvărneanu 2025 4 1 Sign every commit Optionally, you might want to automatically sign every commit and tag: git config --global commit.gpgsign true git config --global tag.gpgsign true Aram Hăvărneanu 2025 4 1 How to use Sign your commits using git commit -S (or enable autosigning). To check signatures use git log --show-signature. Aram Hăvărneanu 2025 4 1 GitHub GitHub needs to be aware of signing keys. The SSH key has to be specifically marked as a signing key in order for GitHub to show "verified" status. Aram Hăvărneanu 2021 9 20 https://xw.is/0001/ 0001 /0001/ Clone remote git repository using local cache Let's say you want a new clone of a Git distributed version control system repository, for example https://go.googlesource.com/go, but you already have it cloned elsewhere, say $HOME/go and you don't want to download all the objects from the internet, yet you don't want to clone the local repository either — you want the new clone to be connected to the remote repository. You can do this: git clone --reference-if-able $HOME/go --dissociate https://go.googlesource.com/go go.test This will work even if $HOME/go doesn't exist. Aram Hăvărneanu 2021 9 20 https://xw.is/0002/ 0002 /0002/ Clone specific git branch only Git clone supports --single-branch option to limit cloning to a single branch git clone --single-branch -b release-branch.go1.17 https://go.googlesource.com/go go.test This can be combined with --no-tags: git clone --single-branch -b release-branch.go1.17 --no-tags https://go.googlesource.com/go go.test Aram Hăvărneanu https://xw.is/ssh-index/ ssh-index /ssh-index/ OpenSSH Tips and tricks for using OpenSSH. Aram Hăvărneanu 2025 7 15 https://xw.is/ssh-keys/ ssh-keys /ssh-keys/ Public SSH Keys Aram Hăvărneanu 2025 7 15 SSH Keys Aram Hăvărneanu 2025 7 15 Authentication These are the public SSH keys that I use for authentication: Aram Hăvărneanu 2025 7 15 Signing These are the public SSH keys (in allowed_signers format) that I use for signing: aram@mgk.ro ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMRc0UWKrFpCv/EOUo2jpEQt+C/pa0tc1rUWKgjbKTp7 aram@edengate.local Aram Hăvărneanu 2025 7 15 Install Run the following commands to populate ~/.ssh/authorized_keys (see ssh(1)), creating it with necessary permissions if required: mkdir -p $HOME/.ssh chmod 700 $HOME/.ssh cat <<EOF >>$HOME/.ssh/authorized_keys EOF chmod 644 $HOME/.ssh/authorized_keys sort -u -o $HOME/.ssh/authorized_keys $HOME/.ssh/authorized_keys These commands are idempotent and will preserve existing keys. Aram Hăvărneanu 2025 7 15 Macros This page exports the and macros. To use them from other pages import this page with . Aram Hăvărneanu 2025 4 1 https://xw.is/0003/ 0003 /0003/ Git › Sign Git commits with SSH keys Git can use ssh-keygen(1) to sign commits and tags. The problem is that if you want to avoid entering passphrases it requires a running ssh-agent(1). This is the case even if you configured ssh to automatically decrypt keys using the iCloud Keychain, as ssh-keygen(1) will not read ~/.ssh/config. We're going to make git(1) run a helper script that temporarily loads the required key into the ssh agent, setting a short timeout. Aram Hăvărneanu 2025 4 1 Create helper script Create this executable file and put it in your PATH, I'm using ~/bin/git-config-helper-gpg.ssh.defaultKeyCommand. #/bin/bash ssh-add -q -t 5 --apple-load-keychain ~/.ssh/id_ed25519 KEY=$(ssh-add -L | head -n 1) echo key::$KEY Aram Hăvărneanu 2025 4 1 Configure Git to use SSH for signing git config --global gpg.format ssh git config --global gpg.ssh.defaultKeyCommand ~/bin/git-config-helper-gpg.ssh.defaultKeyComma This configures git(1) to use SSH signing (as opposed to GPG) and instructs it to run our helper script when it needs to sign. Aram Hăvărneanu 2025 4 1 Configure Git to verify signatures Record a list of known email-signature pairs in .ssh/allowed_signers (file name and location is arbitrary): aram@mgk.ro ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMRc0UWKrFpCv/EOUo2jpEQt+C/pa0tc1rUWKgjbKTp7 aram@edengate.local Then configure git(1) to use this file for verification: git config --global gpg.ssh.allowedSignersFile ~/.ssh/allowed_signers Aram Hăvărneanu 2025 4 1 Sign every commit Optionally, you might want to automatically sign every commit and tag: git config --global commit.gpgsign true git config --global tag.gpgsign true Aram Hăvărneanu 2025 4 1 How to use Sign your commits using git commit -S (or enable autosigning). To check signatures use git log --show-signature. Aram Hăvărneanu 2025 4 1 GitHub GitHub needs to be aware of signing keys. The SSH key has to be specifically marked as a signing key in order for GitHub to show "verified" status. Aram Hăvărneanu 2022 7 28 https://xw.is/0004/ 0004 /0004/ macOS › Use the Apple Keychain for ssh key passphrases On modern macOS systems, you can set up your system such that your encrypted ssh keys get automatically decrypted using the passphrase stored in the Apple Keychain (which gets unlocked at login). Aram Hăvărneanu 2022 7 28 Add your passphrase to the Keychain Create your keys as usual, then do this once for every key: ssh-add --apple-use-keychain ~/.ssh/id_ed25519 You must use the full path your key, a relative path will not work! Note that we're adding the key to the ssh agent here, but we will not be using the ssh agent. Rather, this operation has the side effect that the key will be saved in the keychain. Aram Hăvărneanu 2022 7 28 Configure ssh to use the Keychain Add this to your ~/.ssh/config: Host * IgnoreUnknown UseKeychain UseKeychain yes IgnoreUnknown is there so that UseKeychain (an Apple-specific extension) will work with non-Apple ssh implementations. Contrary to Internet misinformation you do not need to use ssh-agent(1), or enable any special Apple-specific options for the ssh agent. Of course you can do this per-host, or per-key, but then IgnoreUnknown should come early in your configuration, before any use of UseKeychain. Aram Hăvărneanu 2019 7 29 https://xw.is/0006/ 0006 /0006/ Connect to laptop (behind NAT) using intermediary server We'll use a combination of ssh remote and local port forwarding in order to expose the laptop's ssh port outside the NAT. The laptop must initiate the forwarding. Aram Hăvărneanu 2019 7 29 On the server Make sure you have an account that the laptop can connect to through ssh. Aram Hăvărneanu 2019 7 29 On the laptop This will initiate a connection to the server (from the laptop), and it will set-up a remote port forward such that dialing localhost:12345 on the server will forward to localhost:22 on the laptop. ssh -N -R 12345:localhost:22 harieta@freedom.mgk.ro Aram Hăvărneanu 2019 7 29 On the other client This will connect to the server, and then set-up a local port forward (from the other client to the server) such that dialing localhost:12345 on the client will connect to localhost:12345 on the server. Of course, localhost:12345 on the server just forwards to localhost:22 on the laptop. ssh -N -L 12345:localhost:12345 freedom.mgk.ro Then from another terminal (still on the other client) you can: ssh -p 12345 ubuntu@localhost And should reach localhost:22 on the laptop. Aram Hăvărneanu 2019 7 29 Alternatives Alternativelly, you can use Tailscale. Aram Hăvărneanu https://xw.is/misc-index/ misc-index /misc-index/ Miscellaneous Miscellaneous tips and tricks. Aram Hăvărneanu 2018 9 30 2022 9 15 2025 8 28 https://xw.is/001L/ 001L /001L/ LED lights Aram Hăvărneanu 2018 9 30 2022 9 15 2025 8 28 Introduction Most LED lights are pretty bad. Better LEDs can be found in video/cinema applications, or for museum exhibits. Photographers do not care much about LEDs as they do tend not to use continuous lights. Most household lamps use E26/E27 sockets, and the most common bulbs are A19, A21, and A23. Every lamp will take A19, many will take A21, but A23 is larger and requires thorough investigation whether it's supported by indoor lamps. Aram Hăvărneanu 2018 9 30 2022 9 15 2025 8 28 Power and energy LEDs are pretty energy efficient, but the power density is pretty low. If you need high power, incandescent or halogen is the only way to go. In general, this means you need more LED bulbs for household applications compared to incandescents, and it's very likely new fixtures supporting more bulbs are required. LEDs with more accurate color tend to have less power and be less energy efficient than other LEDs. Aram Hăvărneanu 2018 9 30 2022 9 15 2025 8 28 Light output How many lumens do you need? My incandescent lights have the following specs: Manufacturer Type Power Luminous Flux Philos Incandescent 300 W 4850 lm Powerlight Halogen 200 W 3980 lm Osram Halogen 150 W 2870 lm Philips Halogen 105 W 1980 lm Philips Incandescent 40 W 405 lm Aram Hăvărneanu 2018 9 30 2022 9 15 2025 8 28 Color temperature For general purpose household stuff you want something around 2700K. Very low power dim sidelighting can be lower (even 2000K). High power stuff can go as high as 3200K. Unless you have a special use case in mind, only look at 2700K and 3000K offerings. Aram Hăvărneanu 2018 9 30 2022 9 15 2025 8 28 Color rendering The the most common standard is CRI. Unfortunately, CRI is pretty useless, but consumer manufacturers frequently only specify CRI. You want something with CRI over 95. An important color not taken into account by CRI is R9. You want something with R9 over 90. A much better standard is TLCI. You want something with TLCI over 90. Another standard is TM-30. Aram Hăvărneanu 2018 9 30 2022 9 15 2025 8 28 TCLI results TLCI Results as supplied by Alan Roberts Television Lighting Consistency Index 2012 (results are from 2018) Indie Cinema Academy LED database Aram Hăvărneanu 2018 9 30 2022 9 15 2025 8 28 Notable manufacturers Aram Hăvărneanu 2018 9 30 2022 9 15 2025 8 28 Quality Waveform Lighting Yuji International Soraa Solux (Nobel prize winner who invented blue LEDs works here) Aram Hăvărneanu 2018 9 30 2022 9 15 2025 8 28 High power Cree Euri Green Creative Aram Hăvărneanu 2018 9 30 2022 9 15 2025 8 28 Notable products Aram Hăvărneanu 2018 9 30 2022 9 15 2025 8 28 800 lm class Manufacturer Product Color Temperature Luminous Flux CRI R9 TLCI Notes Waveform Lighting Ultra High 95 CRI E26 A19 10W LED Bulb for Home & Residential 2700/3000K 800 lm 95 91/95 FilmGrade series has 95 TLCI Yuji BC Series A60 High CRI Remote Phosphor LED 3000K 840 lm 97 95+ 97 recommended by gaffers Soraa Soraa VIVID A60 (E27) 2700K 800 lm 95 95 Ikea Ledare 11W LED1304G11 E27 2700K 600 lm 93 93 600 lm only Ikea Trådfri LED1623G12 2700K 1000 lm 89 smart bulb Solux ColorView 3000K 310–1490 lm 100 100 120V only Osram has some 95+ TLCI products in its professional spot line. It's unclear whether the A bulbs from the same professional line are just as good or not. Osram only claims 80+ CRI even for the good stuff, and the A products are rated the same. They might be much better than specified. Aram Hăvărneanu 2018 9 30 2022 9 15 2025 8 28 High power class Manufacturer Product Color Temperature Luminous Flux CRI R9 TLCI Notes EURI A Series LED EA21-4000cec-2 3000K 1600 lm 90 120V only Cree Cree 100 Watt Replacement 2700K/3000K 1600 lm 90+ Green Creative A21 18.5W HIGH CRI DIMMABLE 2700K 1600 lm 90 60 120V only Green Creative A23 LED 25W 277V E26 3000K 3200 lm 82 Aram Hăvărneanu 2018 9 30 2022 9 15 2025 8 28 Additional references Luminous Landscape Forum | Has anyone looked into the modern LED video lights as a print evaluation light? Ultimate LED Bulbs - Ultra High CRI - The Honorable Quest Aram Hăvărneanu 2018 6 7 2023 8 1 2025 7 23 https://xw.is/001I/ 001I /001I/ TLS Certificates Primer Aram Hăvărneanu 2018 6 7 2023 8 1 2025 7 23 Prerequisites You will need to generate a private key and a certificate signing request. DOMAIN=xw.is openssl req -new -newkey rsa:2048 -nodes -keyout $DOMAIN.key -out $DOMAIN.csr Send xw.is.csr to your certificate vendor and follow the instructions. Aram Hăvărneanu 2018 6 7 2023 8 1 2025 7 23 Prepare certificates for use Your certificate vendor will give you a bunch of files. You need to concatenate them in order to use them in your web server. Order is essential. For example, for DigiCert: cat xw_is.crt DigiCertCA.crt TrustedRoot.crt >xw.is.crt Aram Hăvărneanu 2018 6 7 2023 8 1 2025 7 23 Configure your web server Use xw.is.key and xw.is.crt in your web server. For example for nginx add this to your server block: worker_processes 1; events { worker_connections 1024; } http { server { listen 443; server_name xw.is; ssl on; ssl_certificate /tank/nginx/tls/xw.is.crt; ssl_certificate_key /tank/nginx/tls/xw.is.key; ssl_session_cache shared:SSL:1m; ssl_session_timeout 5m; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; location / { root /usr/local/www/nginx; index index.html index.htm; } } } Aram Hăvărneanu 2018 6 7 2023 8 1 2025 7 23 Alternatives Alternativelly, you might want to use Let's Encrypt. Aram Hăvărneanu 2018 9 30 2025 7 10 https://xw.is/0014/ 0014 /0014/ List of mobile network operators Aram Hăvărneanu 2018 9 30 2025 7 10 United States Aram Hăvărneanu 2018 9 30 2025 7 10 Networks Coverage map (very optimistic) provided by OpenSignal. In general Verizon has the best coverage, followed by AT&T, T-Mobile, with Sprint far behind. Where I need it, Verizon works best. Aram Hăvărneanu 2018 9 30 2025 7 10 List of MVNOs BestMVNO List of mobile virtual network operators in the United States Aram Hăvărneanu 2018 9 30 2025 7 10 Austria Aram Hăvărneanu 2018 9 30 2025 7 10 Networks OpenSignal also provides a coverage map. As a general idea A1 has the best coverage, especially in rural areas, followed by Drei (slightly worse), and T-Mobile Magenta (not too bad). Aram Hăvărneanu 2018 9 30 2025 7 10 List of MVNOs MVNO LIST AUSTRIA Liste der Mobilfunkanbieter in Österreich Also see the LTE-Forum. Aram Hăvărneanu 2019 2 22 https://xw.is/0016/ 0016 /0016/ Photo book print shops Aram Hăvărneanu 2019 2 22 Cheap Blurb, no soft-proofing, spotty quality control and inconsistent. Aram Hăvărneanu 2019 2 22 Quality Booksmart Studio, high end printer, both inkjet and digital press. Does NOT accept output-ready files. Pikto, from Canada, digital press printing and chromogenic printing. Does NOT accept output-ready files. White House Custom Colour, from California, digital press printing and chromogenic printing. Does NOT accept output-ready files. Digital Pro Lab, from Texas, have press profiles, but don't use press printing for albums. Does NOT accept output-ready files. Simply Color Lab, photo printing. Does NOT accept output-ready files. Aram Hăvărneanu 2019 2 22 Best quality Hemlock, they print LensWork. Aram Hăvărneanu 2019 2 22 Questionable AdoramaPix, unclear whether they do this right or not. Some FAQ entry claims they don't offer ICC profiles! They are using a chromogenic process for books, not digital press. ProDPI, they seem to know what they are doing, but I found their ICC profiles only for their chromogenic prints. Also, I heard a rumor that they were bought by WHCC. Paper Chase Press, they seem to know what they are doing, but they want a GRACoL2006_Coated1v2 color profile. Aram Hăvărneanu 2019 2 22 Not reviewed RIT, mentioned by Bill Atkinson. Aram Hăvărneanu 2018 6 7 https://xw.is/0015/ 0015 /0015/ Transcode mvk to mov with subtitles ffmpeg -i in.mkv -vcodec copy -acodec copy -scodec mov_text out.mov Aram Hăvărneanu https://xw.is/about/ about /about/ About This website is a “forest” created using the Forester tool, a system of evergreen hypertext notes. To navigate my forest, press Ctrl+K. Aram Hăvărneanu https://xw.is/copyright/ copyright /copyright/ Copyright and License Except where otherwise stated, content on this site is is available under the CC0 1.0 Universal license. Aram Hăvărneanu https://xw.is/disclaimer/ disclaimer /disclaimer/ Legal Disclaimer This site is provided as a public service by Aram Hăvărneanu. No guarantees, explicit or implicit, are made about the contents of this site. Use at your own risk. Aram Hăvărneanu 2025 7 8 https://xw.is/privacy/ privacy /privacy/ Privacy Policy Our web server does not ask anybody for any information, personal or otherwise. We don't use cookies, nor do we allow any third party to propagate cookies through our server. Aram Hăvărneanu https://xw.is/help/ help /help/ Help Overview of the Forester markup language Datalog-based query engine Creating new trees Forester for the Woodland Skeptic Source code for this website References Context Backlinks Related Contributions