/target
**/*.rs.bk
Cargo.lock.bak

# Generated by alloy_ui/build.rs from tokens.toml.
crates/alloy_ui/src/generated/tokens.rs

# Build/dist outputs
/dist/build/
/dist/*.iso
/dist/*.img
/dist/*.qcow2
/dist/*.tar.zst

# bootc-image-builder output (ISO/raw/qcow2 + manifest)
/output/
# ...and the rotated copy build-iso.sh/build-image.sh leave behind. Without
# this the rotation meant to protect the last good artifact instead commits
# a multi-gigabyte ISO, which is how a 2.3G blob reached this repo once.
/output.prev/

# The exported install source, kept across ISO builds so an unchanged image is
# not re-exported. Several GB of blobs that rebuild from the image itself.
/.iso-cache/

# Environment
.env
.env.*

# OS
.DS_Store
Thumbs.db

# Editor
.vscode/
.idea/
*.swp

# Local-only notes (per CLAUDE.md split: private docs live under _private/)
CLAUDE.md
todo.local.md

# Inspiration scrape — third-party images, not ours to redistribute
docs/inspo/

# Secrets and credentials. The baseline every repo under ~/Code carries, kept
# identical so no repo is the one that forgot. Suffix-matched rather than
# `*.env`, which would also catch committed environment files that hold no
# secrets (sweep systemd/sweep.env). `.env.example` is a tracked template and
# is negated back in.
!.env.example
*.pem
*.key
*.p8
*.p12
*.pfx
credentials.json

# vmtest scratch: qcow2 targets, firmware vars, vTPM state, screendumps.
/build/vmtest/state/

# layertest scratch: RPMs, the generated repo, the target disk, firmware vars.
/build/layertest/state/

# The packaged console and its repo metadata. Regenerated by build/rpm/build.sh
# from the crate, so committing it would store what rebuilds from source, and
# it is a 2 MB binary besides.
/build/rpm/out/

# Byte-compiled python from the vmtest and layertest helpers.
__pycache__/