Skip to content

Commit e071798

Browse files
mios-devclaude
mios-dev
and
claude
authored
fix(gitignore): replace symlink with real file, implement cascade whitelist
/.gitignore was a symlink (git opens .gitignore with O_NOFOLLOW, so it was silently unread — every system file in the / working tree leaked as untracked). Replaced with a real file. Rewrote the gitignore using a proper cascade whitelist: each FHS directory level (etc/*, usr/lib/*, etc.) is re-ignored after its parent is unignored, then only MiOS-named files are selectively allowed in mixed directories (sysusers.d, tmpfiles.d, systemd/system, etc.). Result: git status reduced from ~2000 entries to ~393 (all tracked MiOS files). Note: after editing /workspaces/MiOS/.gitignore, run: sudo cp /workspaces/MiOS/.gitignore /.gitignore Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent ffcedcf commit e071798

1 file changed

Lines changed: 288 additions & 84 deletions

File tree

‎.gitignore‎

Lines changed: 288 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -1,93 +1,297 @@
1-
# MiOS allow-list. Ignore everything, then unignore what MiOS owns.
1+
# MiOS Root Overlay - Whitelist .gitignore
2+
# This repository mirrors the system root (/) for a "Zero-Day" bootc build.
3+
# STRATEGY: Ignore everything by default, then surgically whitelist only MiOS-owned paths.
4+
# CASCADE RULE: To allow a nested path, every parent dir must be unignored first,
5+
# then the parent's contents must be re-ignored before the child is unignored.
6+
#
7+
# IMPORTANT: /.gitignore must be a real file (not a symlink) because git opens it
8+
# with O_NOFOLLOW. After editing this file run:
9+
# sudo cp /workspaces/MiOS/.gitignore /.gitignore
10+
11+
# ─────────────────────────────────────────────────────────────────────────────
12+
# 1. BLOCK EVERYTHING
13+
# ─────────────────────────────────────────────────────────────────────────────
214
/*
315
.*
416

5-
# Top-level system docs and metadata
6-
!README.md
7-
!VERSION
8-
!LICENSE
9-
!LICENSES.md
10-
!AGENTS.md
11-
!INDEX.md
12-
!SECURITY.md
13-
!SELF-BUILD.md
14-
!DEPLOY.md
15-
!SUMMARY.md
16-
!CONTRIBUTING.md
17-
18-
# Build infrastructure (Containerfile, Justfile, build orchestrators, helpers)
19-
!Containerfile
20-
!Justfile
21-
!build-mios.sh
22-
!install.sh
23-
!install.ps1
24-
!mios-build-local.ps1
25-
!preflight.ps1
26-
!push-to-github.ps1
27-
!image-versions.yml
28-
!renovate.json
29-
30-
# Repo hygiene
31-
!.editorconfig
32-
!.gitattributes
33-
!.gitignore
34-
!.github/
35-
!.devcontainer/
36-
!.github/**
37-
!.devcontainer/**
38-
!.devcontainer/
39-
40-
# Build orchestration trees (placeholder; populated as project grows)
41-
!automation/
42-
!automation/**
43-
!tools/
44-
!tools/**
45-
!specs/
46-
!specs/**
47-
!config/
48-
!config/**
49-
50-
# Day 0 AI Artifacts
51-
!ARCHITECTURE.md
52-
!ENGINEERING.md
53-
!llms.txt
54-
!llms-full.txt
55-
!system-prompt.md
56-
!.cursorrules
57-
!.clinerules
58-
!root-manifest.json
59-
!.github/ai-instructions.md
60-
!.devcontainer/
61-
62-
# FHS overlay -- the deployed system layer
63-
!usr/
64-
!usr/**
65-
!etc/
66-
!etc/**
67-
!home/
68-
!home/**
69-
!srv/
70-
!srv/**
71-
!v1/
72-
!v1/**
73-
!artifacts/
74-
!artifacts/**
75-
!agents/
76-
!agents/**
77-
agents/**/latest-context.json.gz
78-
79-
# Re-ignore noise inside whitelisted dirs
17+
# ─────────────────────────────────────────────────────────────────────────────
18+
# 2. REPOSITORY METADATA & TOP-LEVEL DOCS
19+
# ─────────────────────────────────────────────────────────────────────────────
20+
!/.gitignore
21+
!/.gitattributes
22+
!/.clinerules
23+
!/.cursorrules
24+
!/.editorconfig
25+
!/.github/
26+
!/.github/**
27+
!/AGENTS.md
28+
!/ARCHITECTURE.md
29+
!/CONTRIBUTING.md
30+
!/Containerfile
31+
!/DEPLOY.md
32+
!/ENGINEERING.md
33+
!/INDEX.md
34+
!/Justfile
35+
!/LICENSE
36+
!/LICENSES.md
37+
!/README.md
38+
!/SECURITY.md
39+
!/SELF-BUILD.md
40+
!/SUMMARY.md
41+
!/VERSION
42+
!/llms-full.txt
43+
!/llms.txt
44+
!/root-manifest.json
45+
!/image-versions.yml
46+
!/install.sh
47+
!/build-mios.sh
48+
!/mios-build-local.ps1
49+
!/preflight.ps1
50+
!/push-to-github.ps1
51+
!/renovate.json
52+
53+
# ─────────────────────────────────────────────────────────────────────────────
54+
# 3. MIOS BUILD & AUTOMATION INFRASTRUCTURE
55+
# ─────────────────────────────────────────────────────────────────────────────
56+
!/automation/
57+
!/automation/**
58+
!/tools/
59+
!/tools/**
60+
!/config/
61+
!/config/**
62+
!/agents/
63+
!/agents/**
64+
65+
# ─────────────────────────────────────────────────────────────────────────────
66+
# 4. /v1 — MiOS AI API surface
67+
# ─────────────────────────────────────────────────────────────────────────────
68+
!/v1/
69+
!/v1/**
70+
71+
# ─────────────────────────────────────────────────────────────────────────────
72+
# 5. /etc — only MiOS-managed config paths
73+
# ─────────────────────────────────────────────────────────────────────────────
74+
!/etc/
75+
etc/*
76+
!/etc/.keep
77+
!/etc/containers/
78+
etc/containers/*
79+
!/etc/containers/systemd/
80+
etc/containers/systemd/*
81+
!/etc/containers/systemd/mios*
82+
!/etc/fapolicyd/
83+
etc/fapolicyd/*
84+
!/etc/fapolicyd/fapolicyd.rules
85+
!/etc/mios/
86+
!/etc/mios/**
87+
88+
# ─────────────────────────────────────────────────────────────────────────────
89+
# 6. /home — placeholder only (no user data tracked)
90+
# ─────────────────────────────────────────────────────────────────────────────
91+
!/home/
92+
home/*
93+
!/home/.keep
94+
95+
# ─────────────────────────────────────────────────────────────────────────────
96+
# 7. /srv — MiOS service data
97+
# ─────────────────────────────────────────────────────────────────────────────
98+
!/srv/
99+
srv/*
100+
!/srv/.keep
101+
!/srv/ai/
102+
!/srv/ai/**
103+
104+
# ─────────────────────────────────────────────────────────────────────────────
105+
# 8. /root — MiOS shell skeleton for root user
106+
# ─────────────────────────────────────────────────────────────────────────────
107+
!/root/
108+
root/*
109+
!/root/.bashrc
110+
!/root/.zshrc
111+
!/root/.oh-my-zsh/
112+
!/root/.oh-my-zsh/**
113+
114+
# ─────────────────────────────────────────────────────────────────────────────
115+
# 9. /usr — full cascade whitelist
116+
# ─────────────────────────────────────────────────────────────────────────────
117+
!/usr/
118+
usr/*
119+
!/usr/bin/
120+
!/usr/lib/
121+
!/usr/libexec/
122+
!/usr/share/
123+
124+
# usr/bin — only the mios binary
125+
usr/bin/*
126+
!/usr/bin/mios
127+
128+
# usr/share — only mios/
129+
usr/share/*
130+
!/usr/share/mios/
131+
!/usr/share/mios/**
132+
133+
# usr/libexec — only mios/
134+
usr/libexec/*
135+
!/usr/libexec/mios/
136+
!/usr/libexec/mios/**
137+
138+
# usr/lib — cascade for each MiOS-owned subdirectory
139+
usr/lib/*
140+
141+
# Directories containing exclusively MiOS content — allow all via **
142+
!/usr/lib/NetworkManager/
143+
!/usr/lib/NetworkManager/**
144+
!/usr/lib/X11/
145+
!/usr/lib/X11/**
146+
!/usr/lib/bootc/
147+
!/usr/lib/bootc/**
148+
!/usr/lib/cloud/
149+
!/usr/lib/cloud/**
150+
!/usr/lib/cockpit/
151+
!/usr/lib/cockpit/**
152+
!/usr/lib/containers/
153+
!/usr/lib/containers/**
154+
!/usr/lib/crowdsec/
155+
!/usr/lib/crowdsec/**
156+
!/usr/lib/dnf/
157+
!/usr/lib/dnf/**
158+
!/usr/lib/dracut/
159+
!/usr/lib/dracut/**
160+
!/usr/lib/firewalld/
161+
!/usr/lib/firewalld/**
162+
!/usr/lib/greenboot/
163+
!/usr/lib/greenboot/**
164+
!/usr/lib/libvirt/
165+
!/usr/lib/libvirt/**
166+
!/usr/lib/locale.conf
167+
!/usr/lib/multipath.conf
168+
!/usr/lib/ostree/
169+
!/usr/lib/ostree/**
170+
!/usr/lib/rancher/
171+
!/usr/lib/rancher/**
172+
!/usr/lib/repart.d/
173+
!/usr/lib/repart.d/**
174+
!/usr/lib/ssh/
175+
!/usr/lib/ssh/**
176+
!/usr/lib/sssd/
177+
!/usr/lib/sssd/**
178+
!/usr/lib/sudoers.d/
179+
!/usr/lib/sudoers.d/**
180+
!/usr/lib/sysupdate.d/
181+
!/usr/lib/sysupdate.d/**
182+
!/usr/lib/usbguard/
183+
!/usr/lib/usbguard/**
184+
!/usr/lib/uupd/
185+
!/usr/lib/uupd/**
186+
!/usr/lib/waydroid/
187+
!/usr/lib/waydroid/**
188+
!/usr/lib/wsl-distribution.conf
189+
!/usr/lib/wsl.conf
190+
!/usr/lib/xrdp/
191+
!/usr/lib/xrdp/**
192+
193+
# Mixed directories (MiOS + OS files) — cascade with MiOS-specific patterns
194+
195+
# environment.d — MiOS named *mios*.conf only; blocks 99-environment.conf etc.
196+
!/usr/lib/environment.d/
197+
usr/lib/environment.d/*
198+
!/usr/lib/environment.d/*mios*
199+
200+
# modprobe.d — MiOS blacklist/nvidia/kvmfr/mios-* only; blocks dist-blacklist.conf, systemd.conf
201+
!/usr/lib/modprobe.d/
202+
usr/lib/modprobe.d/*
203+
!/usr/lib/modprobe.d/blacklist-*
204+
!/usr/lib/modprobe.d/kvmfr.conf
205+
!/usr/lib/modprobe.d/*mios*
206+
!/usr/lib/modprobe.d/nvidia*
207+
208+
# modules-load.d — MiOS *mios* only; blocks fuse-overlayfs.conf etc.
209+
!/usr/lib/modules-load.d/
210+
usr/lib/modules-load.d/*
211+
!/usr/lib/modules-load.d/*mios*
212+
213+
# pam.d — MiOS PAM files only; blocks systemd-run0, systemd-user etc.
214+
!/usr/lib/pam.d/
215+
usr/lib/pam.d/*
216+
!/usr/lib/pam.d/mios-*
217+
!/usr/lib/pam.d/password-auth
218+
!/usr/lib/pam.d/system-auth
219+
220+
# profile.d — all MiOS content
221+
!/usr/lib/profile.d/
222+
!/usr/lib/profile.d/**
223+
224+
# sysctl.d — MiOS *mios* only; blocks 10-default-yama-scope.conf, 50-*.conf etc.
225+
!/usr/lib/sysctl.d/
226+
usr/lib/sysctl.d/*
227+
!/usr/lib/sysctl.d/*mios*
228+
229+
# systemd — only MiOS-managed subdirs; blocks user/, user-generators/, timesyncd.conf etc.
230+
!/usr/lib/systemd/
231+
usr/lib/systemd/*
232+
!/usr/lib/systemd/journald.conf.d/
233+
!/usr/lib/systemd/journald.conf.d/**
234+
!/usr/lib/systemd/system/
235+
!/usr/lib/systemd/system-preset/
236+
!/usr/lib/systemd/zram-generator.conf.d/
237+
!/usr/lib/systemd/zram-generator.conf.d/**
238+
239+
# systemd/system-preset — *mios* only; blocks 90-default.preset, 90-systemd.preset etc.
240+
usr/lib/systemd/system-preset/*
241+
!/usr/lib/systemd/system-preset/*mios*
242+
243+
# systemd/system — MiOS units and drop-in dirs only; blocks sshd.service, NetworkManager.service etc.
244+
usr/lib/systemd/system/*
245+
!/usr/lib/systemd/system/mios-*.service
246+
!/usr/lib/systemd/system/mios-*.timer
247+
!/usr/lib/systemd/system/mios-*.target
248+
!/usr/lib/systemd/system/var-*.mount
249+
!/usr/lib/systemd/system/*.service.d/
250+
!/usr/lib/systemd/system/*.service.d/**
251+
# Exclude system-owned service.d dirs that MiOS doesn't manage
252+
usr/lib/systemd/system/systemd-udev-trigger.service.d/
253+
usr/lib/systemd/system/user@.service.d/
254+
usr/lib/systemd/system/user@0.service.d/
255+
256+
# sysusers.d — MiOS user/group definitions only; blocks basic.conf, dbus.conf etc.
257+
!/usr/lib/sysusers.d/
258+
usr/lib/sysusers.d/*
259+
!/usr/lib/sysusers.d/*mios*
260+
!/usr/lib/sysusers.d/20-podman-machine.conf
261+
262+
# tmpfiles.d — MiOS tmpfiles only; blocks podman.conf, sudo.conf, systemd-*.conf etc.
263+
!/usr/lib/tmpfiles.d/
264+
usr/lib/tmpfiles.d/*
265+
!/usr/lib/tmpfiles.d/*mios*
266+
267+
# udev — only MiOS rules; blocks system udev binaries and all other rules
268+
!/usr/lib/udev/
269+
usr/lib/udev/*
270+
!/usr/lib/udev/rules.d/
271+
usr/lib/udev/rules.d/*
272+
!/usr/lib/udev/rules.d/99-kvmfr.rules
273+
!/usr/lib/udev/rules.d/99-mios-gpu.rules
274+
275+
# ─────────────────────────────────────────────────────────────────────────────
276+
# 10. SAFETY OVERRIDES — sensitive, volatile, or OS-managed files
277+
# These exclusions always win regardless of section 9 allows above.
278+
# ─────────────────────────────────────────────────────────────────────────────
279+
etc/.pwd.lock
280+
etc/.updated
281+
etc/shadow*
282+
etc/gshadow*
283+
etc/passwd*
284+
etc/group*
285+
etc/subuid*
286+
etc/subgid*
287+
etc/adjtime
288+
etc/ld.so.cache
289+
usr/lib/containers/storage/
290+
usr/lib/node_modules/
80291
**/__pycache__/
81292
**/*.pyc
82293
**/.DS_Store
83294
**/Thumbs.db
84-
85-
# MiOS Runtime/Build Artifacts
295+
/artifacts/
86296
logs/
87297
*.log
88-
/artifacts/*.gz
89-
/artifacts/*.iso
90-
/artifacts/*.qcow2
91-
/artifacts/*.vhdx
92-
/artifacts/*.xz
93-
/artifacts/*.raw

0 commit comments

Comments
 (0)