# OpenBSD 7.9 for Raspberry Pi 4B: flashable image

This is a fully installed, unofficial OpenBSD 7.9 arm64 image for the Raspberry
Pi 4 Model B. Flash it to an SD card, put your SSH public key on its small FAT
boot partition, and boot the Pi with wired Ethernet connected. No interactive
OpenBSD installation is required.

The first boot creates your administrator account and enables SSH after accepting
your key. There is **no default password**, no shared login key, and no direct
root SSH access. The administrator can become root with `doas` without a password.
Treat access to the corresponding private SSH key as administrator access to
the Pi.

## Release files and verification status

- `openbsd-7.9-rpi4b-generic.img.gz` — compressed raw disk image, 550,004,570
  bytes (about 525 MiB).
- `openbsd-7.9-rpi4b-generic-redistribution.tar.gz` — boot-component licenses,
  corresponding source archives, OpenBSD port patches, and build references.
- `SHA256` — SHA-256 checksum manifest for the release files.
- `README.md` — these instructions.
- `VALIDATION.json` — recorded image hashes, layout, completed checks, and limits.
- `openbsd-7.9-rpi4b-generic-firstboot.tar.gz` — first-boot helper, input parser,
  SSH configuration, integration notes, and parser tests.

**Prepared September 7, 2026. Offline checks and ARM64 QEMU tests passed.**
Disposable copies passed default and custom owner setup, SSH key login,
passwordless `doas`, rejection of unrelated keys and root SSH login, recovery
from missing and malformed input, and retry after partially completed account
setup. Reboots preserved access and host identity; changing the FAT input after
completed setup did not change the owner or installed keys. Independent copies
generated different machine keys. Installing a signed package and its
dependencies through `pkg_add` succeeded. The 34 parser tests also passed on
macOS and OpenBSD 7.9.

The release filesystems passed offline checks. A mounted-file identity audit
and a scan of the complete raw image for known source-owner markers passed.
The compressed archive was fully decompressed and its contents verified against
the pristine raw image's SHA-256. Test copies were separate from the unbooted
release image.

**This generic image has not yet booted on a physical Raspberry Pi.** The
original installed image previously booted on a Pi 4B, and its boot firmware
files remain unchanged here. QEMU uses virtual Ethernet and a virtual random
number device; these tests do not establish physical Ethernet, PoE, SD-card, or
hardware-entropy behavior for the generic image.

The generic build recreates the filesystems and copies the intended system files
into them, so deleted personal files are not carried over in free space. It
removes the source owner's account, SSH keys, host identity, and local history.
Fresh SSH host keys are generated when the new system boots. The original
archive is retained separately, unchanged, as a private rollback copy; it is not
part of this release.

## Card capacity and layout

The uncompressed image is **63,864,569,856 bytes**. The target SD card must hold
at least that many bytes. Cards sold as “64 GB” can differ in actual capacity;
check the byte count, rather than relying on the label. A larger card is fine.
You also need approximately 64 GB of free space on the computer to decompress
the image.

| Filesystem or partition | Approximate usable size |
| --- | ---: |
| `/` | 1.3 GiB |
| `/usr` | 28.4 GiB |
| `/home` | 27.4 GiB |
| Swap | 256 MiB |
| FAT firmware boot partition | 260 MiB |

Filesystem sizes are rounded `df -h` values; partition sizes are slightly
larger. `/usr` and `/home` are separate filesystems. **There is no automatic
expansion.** Space beyond the image's size remains unused on a larger card until
you deliberately grow the disk layout and filesystems.

## Verify and decompress

Download the image and its accompanying `SHA256` file into the same directory.
On macOS:

```sh
shasum -a 256 --ignore-missing -c SHA256
gzip -dc openbsd-7.9-rpi4b-generic.img.gz > openbsd-7.9-rpi4b-generic.img
```

On Linux:

```sh
sha256sum --ignore-missing -c SHA256
gzip -dc openbsd-7.9-rpi4b-generic.img.gz > openbsd-7.9-rpi4b-generic.img
```

Expect `openbsd-7.9-rpi4b-generic.img.gz: OK`. The manifest also covers the
companion files; `--ignore-missing` checks whichever release files you downloaded.
To verify the entire release directory, omit `--ignore-missing`.

Continue only if checksum verification and decompression succeed. The checksum
detects a damaged or mismatched download; it is not an OpenBSD release signature.

## Flash on macOS

Writing the image erases the selected device. Use `diskutil` to identify the SD
card and confirm its exact capacity. Replace `N` below with that card's whole-disk
number, such as the number shown in `/dev/disk4`.

```sh
diskutil list external physical
diskutil info /dev/diskN
diskutil unmountDisk /dev/diskN
sudo dd if=openbsd-7.9-rpi4b-generic.img of=/dev/rdiskN bs=4m
sync
diskutil eject /dev/diskN
```

Press Control-T during `dd` to display progress. After it finishes successfully,
reinsert the card so the FAT boot partition can mount. If macOS offers to
initialize an unreadable OpenBSD partition, dismiss that prompt. Do not
initialize the card.

## Flash on Linux

Use the device's size, model, and transport to identify the SD card. The example
uses `/dev/sdX`; a built-in reader may instead appear as `/dev/mmcblkN`. Replace
the placeholders with your actual device names.

```sh
lsblk -b -o NAME,SIZE,MODEL,TRAN,MOUNTPOINTS
sudo blockdev --getsize64 /dev/sdX
```

Unmount each mounted partition shown under the target card before writing it.
For example, `sudo umount /dev/sdX1` unmounts its first partition. Then write to
the **whole card**, not to a numbered partition:

```sh
sudo dd if=openbsd-7.9-rpi4b-generic.img of=/dev/sdX bs=4M status=progress conv=fsync
sync
```

Reinsert the card after the write succeeds. Mount its first, FAT partition to
add your configuration. For a card at `/dev/sdX`:

```sh
sudo mkdir -p /mnt/rpi-boot
sudo mount /dev/sdX1 /mnt/rpi-boot
```

For a card at `/dev/mmcblkN`, the first partition is `/dev/mmcblkNp1`.

## Add your SSH key before booting

In the **root directory of the FAT boot partition**, create a file named exactly
`authorized_keys`. Its contents must be your SSH **public** key, such as the
contents of `~/.ssh/id_ed25519.pub`. Never copy your private key to the card.

On macOS, substitute the mounted FAT volume's actual path:

```sh
cp ~/.ssh/id_ed25519.pub /Volumes/BOOT_VOLUME/authorized_keys
```

With the Linux mount above:

```sh
sudo cp ~/.ssh/id_ed25519.pub /mnt/rpi-boot/authorized_keys
```

If you do not have an SSH key yet, create one with `ssh-keygen` and keep the
private half on the computer you will use to connect. A passphrase can protect
that private key without giving the Pi a login password.

The file accepts up to 64 ordinary public-key lines. SSH certificates and
`authorized_keys` options are not accepted. Comments after a key are accepted
but are not copied into the installed account. Keep the filename exactly
`authorized_keys`, without a `.txt` suffix.

Optionally create a plain-text `setup.conf` file beside `authorized_keys`:

```ini
username=openbsd
hostname=openbsd-rpi4b
```

Those are the defaults when `setup.conf` is absent. The initial timezone is UTC.
Use a lowercase username of
1–31 characters, beginning with a letter and containing only letters, digits,
underscores, or hyphens. `root` is reserved. Use a lowercase hostname made of
valid DNS labels. For several Pis, choose a distinct hostname for each card.

Use plain `name=value` lines with no quotes, spaces around `=`, or inline
comments. The file is read as data and is never executed as a shell script.
Save it as plain ASCII text; Windows CRLF line endings are supported.

Raspberry Pi Imager can write the image as a custom OS image, but **its standard
OS customization settings do not configure this OpenBSD image**. Add the two
files manually as described above. On Windows, use the FAT partition if it is
visible after flashing; dismiss any offer to format the other partitions. If
your system does not expose the FAT partition, add the files from macOS or
Linux.

Safely unmount and eject the card after copying the files. On Linux, with the
mount shown above:

```sh
sync
sudo umount /mnt/rpi-boot
```

## Boot and connect

1. Insert the card into a Raspberry Pi 4 Model B.
2. Connect its Ethernet port to a network with a DHCP server and apply power.
3. Allow boot and setup to finish. Find the Pi's address in your DHCP server's
   lease table, initially under `openbsd-rpi4b`. A custom hostname takes effect
   during setup and may appear in DHCP after lease renewal or the next boot.
4. Connect with the private key matching the public key you supplied:

   ```sh
   ssh -i ~/.ssh/id_ed25519 openbsd@PI_ADDRESS
   ```

Substitute your configured username and the actual IP address. Ethernet uses
DHCP on OpenBSD's `bse0` interface. Wi-Fi credentials and `.local` discovery are
not configured. An SSH fingerprint prompt is expected for a newly provisioned
card; the console prints the host-key fingerprints for comparison.

Successful setup creates `/home/USERNAME`, installs the supplied keys, and
enables public-key-only SSH. Password authentication, keyboard-interactive
authentication, and direct root SSH login remain disabled. To open a root shell:

```sh
doas -s
```

There is no default user or root password to try if SSH fails. Without a valid
`authorized_keys` file, setup leaves SSH disabled while the system can still
obtain a DHCP lease. Power down, correct the files on the FAT partition, and
boot again. A serial console at **115200 baud, 8 data bits, no parity, 1 stop
bit** can show boot and setup messages; it does not supply a default login.

The setup helper mounts the FAT partition read-only. Input files remain on it
after success, and subsequent boots ignore them once setup is complete. Remove
them when convenient. Editing them later does not rename the installed user,
change the hostname, or update the user's installed SSH keys.

For another Pi, flash the pristine release image again and supply that owner's
key. A card that has already booted contains its generated host keys, configured
account, and any subsequent user data. Deleting the FAT input files does not
make a used card suitable for redistribution.

## Check the running system

After connecting, these commands verify the release, mounted filesystems,
Ethernet interface, SSH service, and administrator access:

```sh
uname -a
hostname
df -h
ifconfig bse0
doas rcctl check sshd
doas -n id -u
```

Expect OpenBSD 7.9 arm64, separate `/`, `/usr`, and `/home` filesystems, and an
active `bse0` interface with an address from your network. The last command
should print `0` without asking for a password.

OpenBSD uses `pkg_add` and `pkg_info` for packages. With working DNS and Internet
access, a dry run can check repository access without installing anything:

```sh
doas pkg_add -n jq
pkg_info
```

Apply operating-system patches with `doas syspatch`, and update installed
packages with `doas pkg_add -u`. Keeping a downloaded image patched remains the
operator's responsibility.

## Build provenance and licensing

This image is a third-party convenience build, **not an official OpenBSD
project image**. It starts from an installed OpenBSD 7.9 arm64 system with Pi
boot firmware and a layout previously exercised on the Raspberry Pi 4B. The
generic build and first-boot configuration sources are retained in this
project's `generic/` directory, along with its release validation records.
The first-boot source archive supplies the installed helper and its tests for
inspection without mounting the disk image. Official patches 001 through 014
are installed in this release.

OpenBSD and bundled firmware retain their respective licenses. The companion
`openbsd-7.9-rpi4b-generic-redistribution.tar.gz` supplies the Raspberry Pi
firmware notices, U-Boot licensing and source, the matching OpenBSD 7.9 port
recipes and patches, and the Raspberry Pi Linux source used for the device
trees. These license files are supplied as companion materials; they were not
present on the source image's FAT boot partition. Keep the companion archive
and this README available alongside the disk image when sharing the release.

Official documentation: [OpenBSD arm64](https://www.openbsd.org/arm64.html),
[OpenBSD FAQ](https://www.openbsd.org/faq/),
[package management](https://www.openbsd.org/faq/faq15.html), and
[`doas.conf`](https://man.openbsd.org/doas.conf).