mkosi is a command-line tool for building customized, bootable OS images. It wraps distribution package managers (dnf, apt, pacman, zypper, apk) and deeply integrates with systemd components (systemd-nspawn, systemd-repart, systemd-boot, systemd-vmspawn, ukify) to produce disk images, containers, unified kernel images, initrds, and extension images. The tool supports multiple output formats (disk, tar, cpio, uki, esp, sysext, confext, portable, oci, directory, addon) and can generate images for a wide range of Linux distributions including Fedora, Debian, Ubuntu, Arch, CentOS, openSUSE, and more. The architecture is a modular Python application with a central build pipeline orchestrated in mkosi/__init__.py. Configuration is handled via layered INI-style files with conditional [Match]/[Assert] sections, allowing complex multi-image builds. A sandbox abstraction (sandbox.py) isolates tool execution using Linux namespaces, mounts, and seccomp filters. Distribution-specific installers are registered via a class registry pattern in mkosi/distribution/__init__.py. The tool also provides standalone subcommands: mkosi-initrd, mkosi-addon, mkosi-sandbox, each with its own entry point. Key features include incremental caching, SecureBoot signing, verity and TPM support, kernel-install integration, tools tree for reproducible builds, and a comprehensive manifest generation. The codebase is well-structured with clear separation between configuration, sandboxing, package management, and image creation. It has extensive tests (pytest with integration markers) and active CI.
The Firmware Modification Kit (FMK) is a CLI-based application toolkit designed for the extraction, analysis, and rebuilding of embedded Linux firmware images, primarily for routers and IoT devices. It functions as a monolithic suite of shell scripts, C/C++ binaries, and Python utilities that orchestrate a workflow: ingest a firmware binary, extract its filesystems (SquashFS, CramFS, YAFFS2), allow modification of contents or web UIs, and rebuild the image. The architecture relies heavily on bundled legacy versions of open-source tools, specifically Binwalk 2.1.1, multiple versions of SquashFS tools (2.0 through 4.2), and the 7-Zip/LZMA SDK. While functionally effective for its niche in embedded security and reverse engineering, the codebase exhibits significant technical debt due to massive code duplication across versioned forks of the same libraries and reliance on outdated dependencies (Python 2, legacy Windows API calls).