Building a card

Needs Docker. It builds for arm64: native on Apple silicon, much slower under emulation on Intel.

$ make image

That writes:

out/release/nullroute-0.1.0.img    the card
out/release/system.roothash        the dm-verity root hash
out/release/SHA256SUMS             checksums over both

Run both before you flash. The second matters most: a device that cannot tell those two boots apart has an integrity check for decoration.

$ make image-repro       # builds it twice, in separate containers, and compares
$ make image-boot-test   # boots it, then boots a copy with one byte changed