Add verified rootless Gentoo image builder and package inputs

image/README.md

@@ -0,0 +1,38 @@
+HydraOS builds start from the pinned amd64 systemd stage3 and pinned Gentoo
+repository in `sources.json`. Run the builder as the normal user with Python 3,
+Podman and GnuPG available; temporary tool environments are sufficient. It
+refuses host root and work/cache paths outside the primary project checkout.
+
+```
+scripts/hydra-build fetch
+scripts/hydra-build prepare
+scripts/hydra-build packages --pretend
+scripts/hydra-build packages
+scripts/hydra-build status
+```
+
+`--work PATH`, `--cache PATH`, `--podman PATH` and `--gpg PATH` override defaults.
+Linked worktrees use the primary checkout's `build/` and `cache/`. The build
+lock prevents simultaneous writes in the same work directory. Interrupted
+package installation resumes through Portage; successful steps write
+`build/manifest.json`, signature evidence and the installed package/version/USE
+inventory in `build/artifacts/`. Downloaded inputs are reverified on every
+prepare; missing or changed files cannot be trusted from a checkpoint alone.
+
+The dedicated rootless Podman store is `build/podman`, separate from default
+Podman and Distrobox storage. The build container mounts inputs and repository
+read-only and retains its writable layer across failures. Host networking makes
+the existing local VPN/proxy available. `SYS_ADMIN` operates within the rootless
+user namespace; package sandbox features incompatible with it are disabled.
+No host disks or `/dev/kvm` are passed into the builder. Hydra never prunes
+containers/images or changes host services.
+
+Official Gentoo binpkgs require signatures. USE mismatches and selective testing
+keywords can cause source builds; concurrency is four compiler processes and
+one emerge job. Keep licenses and Portage's `/var/db/pkg`, world and repository
+for installed-system updates. Rolling binhost contents can change; resulting
+versions/USE are recorded without claiming bit-identical output. The pinned
+service-keyring hash may need deliberate review when Gentoo rotates keys.
+
+`rootfs` and `iso` are reserved assembly commands and currently return an
+explicit error until the live-image assembly implementation is integrated.

image/packages

@@ -0,0 +1,30 @@
+# Host, boot medium, and recovery tools. Keep Portage's installed database/world.
+app-emulation/qemu
+~sys-firmware/edk2-bin-202408
+>=gui-wm/labwc-0.20.0
+app-emulation/virt-viewer
+gui-apps/foot
+media-fonts/dejavu
+gui-libs/greetd
+net-misc/networkmanager
+net-dns/dnsmasq
+net-firewall/nftables
+media-video/pipewire
+media-video/wireplumber
+app-admin/sudo
+sys-kernel/gentoo-kernel-bin
+sys-kernel/linux-firmware
+sys-firmware/sof-firmware
+sys-firmware/intel-microcode
+sys-kernel/dracut
+sys-boot/grub
+sys-fs/squashfs-tools
+sys-fs/dosfstools
+sys-fs/e2fsprogs
+sys-block/parted
+sys-apps/util-linux
+sys-fs/mtools
+dev-libs/libisoburn
+dev-lang/python
+sec-keys/openpgp-keys-gentoo-release
+sec-keys/openpgp-keys-gentoo-auth

image/portage/binrepos.conf/gentoo.conf

@@ -0,0 +1,4 @@
+[gentoo]
+sync-uri = https://distfiles.gentoo.org/releases/amd64/binpackages/23.0/x86-64/
+priority = 10
+verify-signature = yes

image/portage/make.conf

@@ -0,0 +1,16 @@
+COMMON_FLAGS="-O2 -pipe -march=x86-64 -mtune=generic"
+CFLAGS="${COMMON_FLAGS}"
+CXXFLAGS="${COMMON_FLAGS}"
+FCFLAGS="${COMMON_FLAGS}"
+FFLAGS="${COMMON_FLAGS}"
+MAKEOPTS="-j4"
+EMERGE_DEFAULT_OPTS="--jobs=1 --getbinpkg --binpkg-respect-use=y --autounmask=n"
+FEATURES="getbinpkg binpkg-request-signature -usersandbox -sandbox -network-sandbox -ipc-sandbox -pid-sandbox"
+ACCEPT_LICENSE="@FREE @BINARY-REDISTRIBUTABLE linux-fw-redistributable no-source-code Intel-SDP"
+VIDEO_CARDS="intel"
+USE="X dbus wayland opengl alsa"
+QEMU_SOFTMMU_TARGETS="x86_64"
+QEMU_USER_TARGETS=""
+GRUB_PLATFORMS="efi-64"
+BINPKG_GPG_VERIFY_GPG_HOME="/etc/portage/gnupg"
+PORTAGE_NICENESS="10"

image/portage/package.accept_keywords/hydra

@@ -0,0 +1,2 @@
+>=gui-wm/labwc-0.20.0 ~amd64
+gui-libs/wlroots ~amd64

image/portage/package.use/hydra

@@ -0,0 +1,8 @@
+app-emulation/qemu spice usb usbredir virgl opengl wayland pipewire -gtk -sdl
+app-emulation/virt-viewer spice -libvirt
+net-misc/spice-gtk usbredir
+media-video/pipewire sound-server bluetooth dbus pipewire-alsa
+net-misc/networkmanager wifi
+sys-boot/grub mount
+media-libs/freetype harfbuzz
+sys-kernel/installkernel dracut

image/portage/repos.conf/gentoo.conf

@@ -0,0 +1,5 @@
+[gentoo]
+location = /var/db/repos/gentoo
+sync-type = git
+sync-uri = https://github.com/gentoo/gentoo.git
+auto-sync = no

image/sources.json

@@ -0,0 +1,17 @@
+{
+  "stage3": {
+    "url": "https://distfiles.gentoo.org/releases/amd64/autobuilds/20261011T170049Z/stage3-amd64-systemd-20261011T170049Z.tar.xz",
+    "sha256": "50634e8cb87384b94a6dbf78cd2707766c45a5a98f3823e7287d114ee998970b",
+    "signature_url": "https://distfiles.gentoo.org/releases/amd64/autobuilds/20261011T170049Z/stage3-amd64-systemd-20261011T170049Z.tar.xz.asc",
+    "fingerprint": "13EBBDBEDE7A12775DFDB1BABB572E0E2D182910"
+  },
+  "portage": {
+    "url": "https://github.com/gentoo/gentoo/archive/4696089e782c20b5f0c04952f6698d6a8cc1acb4.tar.gz",
+    "filename": "gentoo-4696089e782c20b5f0c04952f6698d6a8cc1acb4.tar.gz",
+    "sha256": "d24b2056f7ae26506193374b0d9f25c82d4bf547e0ee17279940169418bd3bca",
+    "commit": "4696089e782c20b5f0c04952f6698d6a8cc1acb4"
+  },
+  "keyring_url": "https://qa-reports.gentoo.org/output/service-keys.gpg",
+  "keyring_sha256": "9fe40114c956c4c4d593f6e961ac9a994b0772863f4e685608fbdd8d77e39748",
+  "binhost": "https://distfiles.gentoo.org/releases/amd64/binpackages/23.0/x86-64/"
+}