I don't think GNU's IMP needs PA :-)

As for the other programs, try it and see. I'm sure I've had audacious & vlc working without PA, and QEMU.

Hmm, strange, I would have thought that users of a GNU/Linux distribution would be more supportive of the GPL.

So why do you think Linux dominates the server market then? FreeBSD's networking stack performs better but it's not as popular.

I think there was a kernel regression a while ago that haveged could work around but I'm pretty sure it's fixed by now.

Your entropy_avail looks fine, only worry once it gets bellow ~1000.

And anyway haveged only provides a pseudorandom output, get a hardware random number generator if you're serious about this stuff.

Is this with Xfce? Perhaps the desktop is overriding your configuration.

Looks that way, yes.

Fortunately the unit file is pretty simple:

empty@E485:~ $ systemctl cat wacom-inputattach@ --no-p                                 
# /usr/lib/systemd/system/wacom-inputattach@.service
[Unit]
Description=inputattach for Wacom ISDv4-compatible serial devices

[Service]
Type=simple
ExecStart=/usr/bin/isdv4-serial-inputattach /dev/%I
Restart=on-success
empty@E485:~ $

You could try the conversion script supplied by the sysvinit maintainers, which results in this init script:

### BEGIN INIT INFO
# Provides:       wacom-inputattach@${device}
# Required-Start: $remote_fs
# Required-Stop:  $remote_fs
# Default-Start:  2 3 4 5
# Default-Stop:   0 1 6
# Description:    inputattach for Wacom ISDv4-compatible serial devices
### END INIT INFO
DESC="wacom-inputattach@${device}"
DAEMON=/usr/bin/isdv4-serial-inputattach
DAEMON_ARGS="/dev/${device}"
PIDFILE=/run/wacom-inputattach@${device}-sysd2v.pid
START_ARGS="--background --make-pidfile"

Replace ${device} with the actual name assigned to the tablet under /dev

Save that file to /etc/init.d/wacom-inputattach@${device} (with ${device} replaced) and then use

# update-rc.d wacom-inputattach@${device} defaults

And again, ${device} needs to be substituted with the correct name.

I think the dnssec-trigger package will get things setup for you, just adjust the forward nameservers (I use Quad9, they should support DoT).

To make a "multiboot" USB simply copy the images to a partition on the USB stick then install both types of GRUB:

# mount /dev/sdXY /mnt
# mkdir -p /mnt/boot/efi
# mount /dev/sdXZ /mnt/boot/efi
# grub-install --target=i386-pc --boot-directory=/mnt/boot /dev/sdX
# grub-install --target=x86_64-efi --boot-directory=/mnt/boot --efi-directory=/mnt/boot/efi --removable

The stick will need both the main root partition (/dev/sdXY) and an EFI system partition (/dev/sdXZ) with a GUID partition table and a BIOS boot partition. For both UEFI and non-UEFI grub-install commands use the grub-pc-bin & grub-efi-amd64-bin packages. For multibitness UEFI systems there is also a grub-efi-ia32-bin package (--target=i386-efi).

Then write (/mnt)/boot/grub/grub.cfg with menu entries for each image, here is an example stanza for a Devuan ISO image:

menuentry 'Devuan (live)' {                                   
   isofile=usr/share/iso/devuan.iso
   search.fs_uuid $uuid_stick root
   loopback loop $root/$isofile                                             
   linux (loop)/live/vmlinuz boot=live config fromiso=$root/$isofile toram  
   initrd (loop)/live/initrd.img                                              
}

In this example the ISO image is stored on the root partition under /usr/share/iso/devuan.iso (because FHS) but you can put it wherever you want. Replace $uuid_stick with the actual UUID of the root partition.

Just by way of reassurance, Alpine Linux currently dominates the container market and that is fundamentally incompatible with systemd thanks to their musl libc base.

Isn't SUID X a bad idea?

I know Devuan doesn't need a wrapper for rootless X any more.

bsdgames ftw!