I have a Raspberry Pi Zero W project where I wanted to put a bunch of components inside a small 3D printed enclosure to be left running 24/7. I didn’t want to leave components hanging out of a breadboard where they could fall out and this wouldn’t fit either.

I tried building something with perfboard but ended up just destroying it due to complex wiring, mistakes and poor soldering technique.

It turns out to be simpler to just learn PCB design with KiCad and have my boards made professionally. For my project, I ended up designing a simple through-hole Raspberry Pi HAT that made the wiring dead simple.

Since this was my first time ever using a PCB manufacturer, I added a couple of other projects to my order to see how far I could push my learning:

1. A simple THT red LED
2. A fully assembled SMT Buck Converter

There’s a tenuous relationship between PCB assembly and modern software development that I wanted to explore as part of this exercise as well: In the software world, we hear the term SBOM all the time in enterprise IT. I got to experience this for myself recently. The BOM concept itself is rooted in physical manufacturing and a good practical example is PCB assembly. If you are trying to use a PCB assembly service, you will need to produce a BOM as well as some other files.

Let’s try out JLCPCB assembly service and see if we can get something working.

The project

I picked a 5V USB-C to 3.3V buck converter. It’s a great first project since:

• Any electrical engineer understands what I’m trying to build
• Cheap and readily available components
• Complex enough to present a challenge, but high likelihood of success
• Results in a genuinely useful circuit board. I’m planning on using mine next Christmas to replace battery packs on my LED lights

The Process

Step 1 - Learn KiCad

The KiCad software itself is outstanding and also Free Software (GPLv3). It’s not as hard to use as Fusion 360 but it does have its own learning curve. For a simple project like this one you could just use “normal” CAD but a specialist tool like KiCad is 100% worth learning as an investment in your own skills and understanding.

There is a lot more to it than this but rough steps needed in KiCad are:

1. Schematic design
2. PCB design
3. Design Rules Check
4. Export

Step 2 - Research, design and component selection

I spent a lot of time up-front researching how buck converters work and came up with an initial design:

To pick components, I used the JLCPCB parts catalog and leaned on ChatGPT a lot for validation.

To do the PCB design, I needed accurate footprints so I signed up for EasyEDA (click through while browsing parts) to download the files for the parts I needed. This is much more convenient and less error prone than designing your own footprints.

I ended up with a directory of parts I like to use in my $HOME set as an external library via the Footprint Editor and was then able to use my exact components for board design.

Step 3 - Design validation

At this point, I could have had the board manufactured, but I wanted to increase my odds of getting it right first time so I posted a message on EEVblog asking for help. If you haven’t come across EEVblog before, it’s THE place to talk to passionate electrical engineers.

A couple of days later, I had some really helpful responses and adjusted my design a bit. Reassuringly (and somewhat surprisingly), no one said it was broken at the design level. At this point this project got put on hold for a couple of years.

Step 4 - Export, upload, order

The files needed for manufacturing follow exact formats and are largely based around CSV. They are used for etching, drilling, pick-and-place, etc and they drive the entire manufacturing process. Designers normally produce a zip file containing Gerber files, BOM, and Pick-and-Place files.

Following these links leads to a maze of different file formats, export procedures and gotchas. Any of which are capable of blocking manufacturing or worse.

Automating export in the right format for your chosen manufacturer reduces the opportunity for mistakes and speeds up the process too. After some research I settled on using Fabrication Toolkit. This KiCad plugin basically produces all of the above files in the correct format in just a few clicks. They can then be uploaded directly for manufacture as a .zip.

After a final Design Rules Check, I uploaded the files, got a quote and did a couple of “fixes” which bit me a few hours later:

1. I had to change a couple of parts due to stock availability
2. Holes must be listed in the BOM. Pretty sure I cheated and just added directly to the CSV file:

H1,MountingHole_3mm,1,Mechanical hole,N/A
H2,MountingHole_3mm,1,Mechanical hole,N/A
H3,MountingHole_3mm,1,Mechanical hole,N/A
H4,MountingHole_3mm,1,Mechanical hole,N/A

Then I hit the Order button.

Questions from the factory

A little while after ordering I received some questions from the factory in a very polite email:

Dear customer,

Well got your order with many thanks.

Sorry to bother you, but there is one thing that we want to confirm with you about your PCBA order [REMOVED] before proceeding.

1. As shown below, seems the packages of the parts ( C2) cannot match the corresponding footprint on the PCB board.

We have activated the “Replace Part” button for you. Please change the part on your order history. If you want to leave the designator unpopulated, just unclick the “Select” for this part.

Please kindly note that we cannot replace the file directly for PCBA order. If you want to change the gerber file, we need to cancel the order, then you place new order with new file.

2. As shown below, seems the packages of the parts ( J2) cannot match the corresponding footprint on the PCB board. There’s risk of weak connection, bad soldering, tombstoning. We have 4 suggestions for you. Please make a choice.

A: Open the access of “replace parts” for you to change part on order history.

B: Leave the mismatched part unpopulated and refund and cost of part. We cannot ship the unpopulated part to customer due to customs clearance issue.

C: Cancel the order for you to redesign the footprint on PCB. Because we cannot replace the file directly for PCBA order. If you want us to refund the payment to JLC balance(not available if customer pay in EUR €). Please set the JLC balance in your account. https://jlcpcb.com/help/article/how-to-set-up-refunds-to-jlc-balance

D: Take the risk to solder the current component and will not complaint.

Your early reply will be highly appreciated, thank you so much!

Best regards, JLCPCB Team

Capacitor footprint:

Jumper footprint:

It turns out I selected a replacement capacitor that looked the same to my novice eye but had a different footprint. The header pins were also completely different.

Finding in-stock replacements matching the submitted design files was actually the hardest part of this entire project. Matching the KiCad generic footprint Connector_PinHeader_2.54mm:PinHeader_1x02_P2.54mm_Vertical_SMD_Pin1Left to an exact JLCPCB part was not (for me at least) a quick and easy process. After an intense help session with ChatGPT, I settled on C5160785 as a replacement.

The next day, I got another very polite email:

Dear customer,

Sorry to bother you.

For C9939, we are currently short of 5 pieces for the assembly of this order.

Sorry for the inconvenience. May I ask if you need to replace it with other components? If so, could you check if there is some replacement available in our parts lib? https://jlcpcb.com/parts/

Looking forward to hearing from you.

Best regards,

JLCPCB Team

I settled on C72428 2.6A 4.5A 47uH 86mΩ Unshielded Inductor ±20% SMD,18.5x15.2mm Power Inductors ROHS as a replacement part.

Interestingly, the replacement selection at this stage was just done via email instead of the replacement part flow. Presumably this means if I click the re-order button this final change would likely not have been captured. This is probably “fine” for small projects when parts come back into stock but results in a materially different board. This is a problem if you are trying to test, scale or certify a product.

In the software world, we call this Reproducible Builds - eg, do I get the exact same board with the same components if I click Reorder. I highly doubt that in this case, so due diligence means updating the KiCad files with the replacement choices that were made. A more robust approach would have been to cancel the order at the first email, fix the design and resubmit. This proves that all changes have been captured accurately.

Thankfully, the next and final email I received from JLCPCB was a shipping notification.

Did it work?

Simple LED PCB

First I assembled the through-hole LED. Hooking up 2x AA batteries made the light come on:

“Checkinator”

The through-hole “checkinator” Raspberry Pi hat also looked great, although I goofed the silkscreening and missed some vital labels. More on this project board another day:

Buck Converter

• FIRE DANGER, especially with loads > 1A

  Also D1 looks a bit small, I think it may get too hot. Definitely not going to get 3A output with a 3A diode. I’d go with 6A and in a larger package, like SMC. But ok to test with a 3A diode if the output current is kept at like 1A or so

• I don’t suggest that anyone attempts to manufacture this board from my KiCad files
• Note intended application: Power small LED string normally driven by 2x AA batteries

The buck converter board also looked great. All parts were securely attached and everything was neat and tidy.

The final part of this saga was to crimp dupont connectors onto my old LED battery pack lights and hook-up a laptop USB-C power supply. To my surprise it worked:

I left it plugged in for hours, nothing got hot and it didn’t burn my house down. All 3 designs worked. I call this a success!

After cranking out a 3D printed case in Fusion 360 and spending an afternoon assembling cases, I’m now all set for Christmas 2026. I have five of these circuit boards since that’s the minimum order quantity. All boards were tested and worked.

How much did it cost?

The total order came to about $100 USD and about 30% of this cost was DHL shipping to Australia:

The PCB assembly service is a lot more expensive than just producing a bare PCB. In my case the extra cost is worth it vs doing a fiddly job on the kitchen bench. I’m positive that putting effort into choosing cheaper parts would have brought down the cost considerably too.

The caveat is that with an MOQ of 5, if you just want a single assembled board, you need to pay 5x the cost vs what you actually want. For a bare PCB this waste can be under $1 per board but an assembled PCB is orders of magnitude more expensive and becomes cost-prohibitive once you’re beyond the realm of “toy” projects.

How long did it take?

• Fabrication, including all correspondence, took under 6 days. Production was blocked waiting for response from me for around 4 hours total
• DHL Shipping to NSW, Australia took 3 days: Posted Saturday night, arrived first thing Tuesday morning
• Less than 9 days to go from design upload to boards in-hand. Order was made on a Sunday afternoon

What did I learn?

This is a learning exercise, not a useful product

The discussion on EEVblog continued while I got caught up in a ton of side quests for a couple of years, highlighting some changes that would make a better board.

At least one forum reply talked about excessive heat and therefore FIRE DANGER, although this seems to be more in connection with higher loads vs intended use of small string of LEDs. RF noise was also mentioned, so it’s likely this little board could cause a nuisance or worse.

In my own testing, nothing measured more than 5C above ambient temperature after an hour or so, but I’m still loath to leave these Christmas Lights unattended in case of returning to a nasty surprise (fire), although everything “seems fine”.

One of the main things I learned in this process was just how nice the assembly service is.

My soldering technique has caused me big problems in the last couple of years. It’s hard for me to do since I don’t have a dedicated workspace, microscope, etc and if I’m honest, I don’t even particularly enjoy doing it either.

Next time I have a requirement for something beyond a mess of dupont connectors and I2C, I would consider an assembly service without hesitation.

Additional lessons:

• Read and re-read any relevant datasheets
• Check footprints carefully
• Don’t trust AI-recommended replacement parts. It’s very hard even for humans to download an accurate footprint, so ChatGPT and Claude have no chance
• For projects you care about, it’s best to cancel and resubmit designs so footprints can be more easily checked in KiCad and all changes captured

How does real manufacturing relate back to SBOM?

For the nerds reading this: There are some subtle but important differences.

The design files that get uploaded to a manufacturer are used to literally drive the production process. The CSV BOM files are used to select individual components for pick-and-place, etc. Our SBOM actually does the opposite - it’s the libraries our build tool identified during the build process.

At least in the world of Java development, Maven uses pom.xml to drive the build process. Resolving Dependencies between libraries (eg library A requires libraries B, C and D) is a key Maven feature and this concept simply doesn’t exist when using the PCB assembly service: You don’t include an IC in a BOM and automatically get a bunch of resistors and diodes included - you have to specify exactly what parts you want to use up-front.

On the manufacturing side, the inverse is true: We can produce boards with parts not in the BOM, with replacement parts discussed on an email thread. It’s really up to the designer to handle this process diligently if it’s important for a project.

With that said, SBOM is a sound security and business continuity practice as part of producing secure software. Most programmers don’t know or care about such subtleties, but taking the time to manufacture something from scratch has been a fascinating glimpse into how real-world terms get appropriated by the software industry.

Where are the design files?

• KiCad files
• 3D printed enclosure

Thanks and Acknowledgements

My sincerest thanks to everyone who responded to my forum post, especially mareks, and to Mia and Angel at JLCPCB for the help with my order.

This post is not sponsored. I paid for my circuit boards with my own money.

EEVblog forum post

For posterity, my original post:

Hi,

I’ve been trying to teach myself basic PCB design so that I can make myself a little Raspberry Pi hat to flash some lights. After spending the weekend burning protoboard I decided it would be easier and better to just dive in to PCB design. I don’t have an electronics or maths background but I’ve watched a lot of youtube and have learnt the basics of Kicad after work this week.

So far I made a little LED through-hole board which has a good chance of working on first attempt but I wanted something a little more challenging before returning to my original problem. I have some LED Christmas lights that take 2x AA batteries and I had already looked at buying a USB buck convertor to step down 5v to 3.3v for these off Aliexpress but I decided to build my own for practice instead.

I was hoping someone on this forum could tell me if my learning/design process is on the right lines and ideally have a quick look at the PCB I designed and tear it to shreds - that’s how you learn right.

What I’ve tried so far:

1. Random youtube videos on Kicad
2. Stay up late tooling round and building that Raspberry Pi hat. I created a PCB that I’m 99% sure would not work at all as some pins marked 3.3V on the schematic were somehow all 5V in PCB designer. Pretty sure I shorted something. Give up and go back to basics
3. Design a little LED circuit. Looks good, I’m going to make this
4. Spend focussed time learning about Kicad on youtube. The best vids I found were from “PCB Cupid”
5. Get a good explanation of what a buck converter is so I know what I’m building https://www.youtube.com/watch?v=B5eWpRFC9Aw
6. Lots of googling for buck converter circuits. Found one that looked easy but also nothing like what Louis explained. That’s because it was just a voltage regulator and I would have built the wrong circuit if I hadn’t done some research
7. Found the TI LM2596 SIMPLE SWITCHER referenced in a few places and decided to use this. Read the datasheet and tried to build the circuit listed under “Typical Application”. This is for 5v though, not 3.3v. According to Chat GPT I can just change the IC to the 3.3v version and leave the inductor and capacitors at the same value. Find missing components on snapeda and import into Kicad
8. Design a schematic and add USB-C power connector with the CC pins grounded through 5.1K resistors. Electrical Rules Check passing
9. I want to have this board fully assembled with SMD components by JLCPCB but the diode and coil parts from datasheet are not in stock on https://jlcpcb.com/parts/all-electronic-components so I spent more time looking at specs that I barely understand and then asking Chat GPT if my substitution is OK
10. Build PCB from schematic, not fully happy with it
11. Do some research on PCB design, Read Dave’s book: https://www.scs.stanford.edu/~zyedidia/docs/pcb/pcb_tutorial.pdf, watch some EEVBLOG vids
12. Delete PCB and start again. Try to layout components like the datasheet says, add big traces and copper fill areas. Design Rules Check passing

I’ve learnt a lot in this process. My overall goal is just to be able to make simple PCBs for Raspberry Pi or other simple circuits for fun, in the future. I’m not planning on changing careers or building really complicated things.

So on to my questions:

Components OK?

• 33uH inductor AIAP-02-330K
• Input capacitor 680uF EEE-FK1J681AM
• Output capacitor 220uF TPSE227M016R0100
• Diode 30V 3A SS33 (THT - could not find an in-stock SMD one)
• Apart from the USB connector, I only built what was in the datasheet. Is anything else required?
  • All good for intended application?: Connect to old phone charger and hook up a small LED string and possibly any other random low power 3.3V DC needs in the future
  • What are the chances of my PCB design working?

I haven’t had anything made yet so just asking for any suggestions before I see if this blows up. :-DD

Thanks for reading all this!

Cheers, Geoff

Here’s how to fix it:

Step 1 - shutdown VM

Needs to be powered off, not suspended

Step 2 - Grow the disk with VBoxManage

Find the VDI, then use VBoxManage to resize it (Example: grow to 50GB):

# megabytes
VBoxManage modifymedium disk debian\ 13.vdi --resize 51200

Output:

0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%

This of course assumes you are using dynamically allocated disk images. If you opted for fixed image sizes, you will need to clone the whole drive to a new, growable image first as the command above would just error out in this case.

Step 3 - Grow the disk in Linux

Warning on snapshots

Resizing a disk that has snapshots can behave unexpectedly (the resize applies to the base image, not the current state). Delete/merge your snapshots first - you have been warned.

LVM

If you used LVM when setting up your VM, you can follow my notes to grow the LV holding your root filesystem. Job Done.

growpart

If you’re not using LVM and are also “lucky”, you can use growpart to expand a single EXT2/3/4 partition, like this (see also xfs_growfs for XFS):

sudo apt install cloud-guest-utils
sudo growpart /dev/sda 2
sudo resize2fs /dev/sda2

However, this relies on contiguous free space. If you have other partitions “in the way”, you will need to move them to the start/end of the drive with gparted first. Read on.

gparted

You can’t move the partitions you need to with gparted from the running system - you will need to boot into live OS and run gparted against the unmounted drive instead.

The easiest live environment I have found is Ubuntu Desktop. Boot into the live environment and gparted will be right there as an app.

To boot Ubuntu Live DVD instead of your normal Linux:

1. Download the .iso
2. In VirtualBox, choose VM Settings -> Storage, then insert the .iso into virtual CD drive (add one if missing). Don’t check the Live CD box as this will prevent ejecting the CD at the end of the process
3. Boot order in same settings dialog should boot the CD first by default. If not, fix this now
4. Boot the VM, Try or Install Ubuntu, wait a few mins for the OS to load, errors about unsupported graphics can probably (but not necessarily) be ignored, as long as things are still moving on the boot screen
5. Click Next to select Language, Keyboard, Network (wired since it’s a VM), etc until you get to What do you want to do with Ubuntu?. Change the selection to Try Ubuntu and click Close
6. Now you should be dropped to the desktop. Click the funny 3 dot circle (app grid) in the bottom left of the screen to bring up the apps menu, start typing gparted click the app icon and then authorize running as root by clicking Authenticate on the next dialogue
7. Good old gparted should now be running. Make sure to select the correct device, then move and adjust your filesystems as required to use the new space. If you have a swap partition, you may need to right click -> swapoff it, to avoid the live CD sneakily using it and stopping you resizing things.
8. Finish up in gparted, then shutdown the system with the menu in top right corner. The CD will automatically be ejected when you hit enter as prompted
9. Power-on the VM, login and check you have some free space with the df command.

Final word of warning: If gparted offers to fix the GPT layout, say yes.

And now back to our AI enhanced sandbox.

Maven NVD scanning is broken due to NIST NVD infrastructure, build an SBOM instead and gate the build with Grype or some other tool/process.

Q: Why was I up all night yesterday?

• A1: Maven
• A2: I wasted hours of my day trying to scan my code with dependency-check-maven

Q: What is dependency-check-maven

• A: It’s a Maven plugin to scan for dependencies with CVEs, with the power to fail builds if severity is high enough

NIST NVD Service - outage

All joking aside, at least yesterday, the NIST NVD service dependency-check-maven relies on is just hopelessly broken. Downloading without an API key takes hours, if it works at all.

Yesterday, only approx 15% of the database was downloaded after a couple of hours.

At this point, I caved and requested an API key. Even this process took about half an hour, with multiple failures before a working API key was released.

I’ll save you the trouble of fighting for an API key: On my workstation at least, the database downloaded just as slowly as without a key at all. In fact, leaving Maven trying to download the NVD database with a valid key resulted in a 50x error from the server after an hour or so, with the same result after several attempts.

Best-practice is to setup a local (corporate) mirror of NVD, however:

• There are no actual instructions on how to do so, just a rough outline of the components needed
• Even if there were, it relies on upstream NVD server working for the initial download

I’m pretty sure that for every team who diligently figures out correct mirroring, there’s another ten who just let their CI servers rip on the NVD upstream servers 24/7 for git pushes, so here we are with an NVD system that’s under so much load it’s unusable.

In reality, few developers will fight through all of this to scan their dependencies for CVEs, so the outcome is skipped tests and/or permanently removed security checks from build pipelines.

Solution? SBOM

This is not an isolated outage, the NVD service has been failing for a while now. To prevent Maven build failures, there’s really no option but to disable/remove the plugin unless you’re hosting your own NVD mirror.

So what do we do instead? Many developers are turning to Software Bill of Materials - SBOM.

In the case of a Java Maven app, this means capturing the full dependency tree. There’s a plugin for this: cyclonedx-maven-plugin.

Adding the plugin to your Maven project results in capturing dependency information as JSON and XML under the /target directory.

Now just hand over your favourite flavour of structured data file to your security scanner/team and deploy as usual right?

If you have a true enterprise build and deploy CI pipeline, with integrated SBOM check before deployment, then yes, you may actually be finished - otherwise, you may just be giving yourself a false sense of security.

The great thing about dependency-check-maven is that it fails the build if severe enough CVEs are detected, and you would have to consciously disable the check to produce a .jar file. With just SBOM generation, you have a list of libraries but the build will still produce executables unless you add something to your build to act on this information.

To put it another way, just producing the SBOM does not magically improve security posture, you must act on this data somehow.

Grype

Enter Grype:

A vulnerability scanner for container images and filesystems.

Grype has built-in support for reading SBOM files created by cyclonedx-maven-plugin. It’s approximately five years old, so still somewhat new. Apply your due diligence to determine whether Grype is right for your own organisation.

Worked Example

Aim: Integrate Grype into a project with multiple high-severity CVEs and force build failure at the Maven package phase.

Step 1 - Simple Java app

I created a simple Maven Java project from scratch with Cursor featuring just a simple CLI app. It works great:

Step 2 - SBOM

Enable SBOM creation during Maven package phase in pom.xml:

            <plugin>
                <groupId>org.cyclonedx</groupId>
                <artifactId>cyclonedx-maven-plugin</artifactId>
                <version>2.9.2</version>
                <executions>
                    <execution>
                        <id>cyclonedx-bom</id>
                        <phase>package</phase>
                        <goals>
                            <goal>makeBom</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <projectType>application</projectType>
                    <schemaVersion>1.6</schemaVersion>
                    <outputFormat>all</outputFormat>
                    <outputName>bom</outputName>
                </configuration>
            </plugin>

This will result in target/bom.json and target/bom.xml being produced. If you have a multi-module Maven project, you should produce the SBOM once, in the parent POM (with makeAggregateBom).

Step 3 - Try out Grype

We can run grype in a container, to avoid installation on the host system. If you don’t have podman, you can just run the same command with docker:

# if using my example repo as-is
# mvn package -Dgrype.skip=true

# You must create ~/.cache/grype on your HOST _first_
podman run --rm  -v ~/.cache/grype/:/.cache/grype -v ./target:/target docker.io/anchore/grype sbom:/target/bom.json

When run from the top level of the project directory, this will mount the ./target directory containing the SBOM files into the container and run the SBOM scan on the JSON version.

The /.cache/grype directory is volume mounted in the container to avoid approximately 2GB download on every startup (we don’t want another NVD). Interestingly, pulling the entire database takes only 1 minute, not 4+ hours.

Since I started from scratch with no dependencies, Grype printed:

No vulnerabilities found

And took approximately 1 minute to run initially, and around 10 seconds thereafter.

Step 4 - Add dependencies with CVEs

I asked Cursor to add a bunch of dependencies with severe CVEs and he delivered! A ton of really bad libraries (log4shell, and co) were added to pom.xml. Regenerating the SBOM and re-scanning set off some very loud alarms in Grype:

NAME                 INSTALLED   FIXED IN        TYPE          VULNERABILITY        SEVERITY  EPSS            RISK          
log4j-core           2.14.1      2.15.0          java-archive  GHSA-jfh8-c2jp-5v3q  Critical  100.0% (100th)  100.0  (kev)  
struts2-core         2.3.30      2.3.32          java-archive  GHSA-j77q-2qqg-6989  Critical  100.0% (99th)   100.0  (kev)  
log4j-core           2.14.1      2.16.0          java-archive  GHSA-7rjr-3q55-vv33  Critical  100.0% (99th)   99.0   (kev)  
spring-beans         5.3.17      5.3.18          java-archive  GHSA-36p3-wjmg-h94x  Critical  99.7% (99th)    98.7   (kev)  
spring-webmvc        5.3.17      5.3.18          java-archive  GHSA-36p3-wjmg-h94x  Critical  99.7% (99th)    98.7   (kev)  
...

Step 5 - Integrate grype into the build

I asked Cursor to integrate a Grype check into pom.xml and fail the build if necessary. He used the exec-maven-plugin to run the native grype command on the host (no containers - more on how it got installed later):

            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>exec-maven-plugin</artifactId>
                <version>3.5.0</version>
                <executions>
                    <!--
                      There is no official Anchore Grype Maven plugin on Maven Central.
                      This runs the Grype CLI against the CycloneDX SBOM produced above
                      and fails the build when severity >= ${grype.failOn}.
                      Requires `grype` on PATH (https://github.com/anchore/grype).
                    -->
                    <execution>
                        <id>grype-sbom</id>
                        <phase>package</phase>
                        <goals>
                            <goal>exec</goal>
                        </goals>
                        <configuration>
                            <skip>${grype.skip}</skip>
                            <executable>grype</executable>
                            <arguments>
                                <argument>sbom:${project.build.directory}/bom.json</argument>
                                <argument>--fail-on</argument>
                                <argument>${grype.failOn}</argument>
                            </arguments>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

The arguments are sourced from <properties> that he also added:

    <properties>
        <!-- Fail the build when Grype finds findings at/above this severity. -->
        <grype.failOn>critical</grype.failOn>
        <grype.skip>false</grype.skip>
    </properties>

These combine with the --fail-on above to tell Grype to return a non-zero exit status to the shell when needed:

set the return code to 2 if a vulnerability is found with a severity >= the given severity, options=[negligible low medium high critical]

Step 6 - mvn package

Running mvn package does indeed fail the build with a list of bad dependencies, as we wanted:

[INFO] --- exec:3.5.0:exec (grype-sbom) @ java-do-not-run ---
NAME                 INSTALLED   FIXED IN        TYPE          VULNERABILITY        SEVERITY  EPSS            RISK          
log4j-core           2.14.1      2.15.0          java-archive  GHSA-jfh8-c2jp-5v3q  Critical  100.0% (100th)  100.0  (kev)  
struts2-core         2.3.30      2.3.32          java-archive  GHSA-j77q-2qqg-6989  Critical  100.0% (99th)   100.0  (kev)  
...
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------

Full output

A desperate developer can still force the build to succeed by bypassing Grype with -Dgrype.skip=true

Here’s the error we want, in all it’s glory:

Try it yourself

Working demo project released on GitHub: https://github.com/GeoffWilliams/java-do-not-run

Where did the grype command come from?

The astute reader will notice a grype command suddenly appeared on my system without me personally requesting it.

You’re not doing DEVOPS security right if you’re not piping curl output to a root shell, and Grype is no different. While I wasn’t looking (or rather, while I was blindly clicking approve), Cursor found the Grype installation instructions and diligently ran:

curl -sSfL https://get.anchore.io/grype | sudo sh -s -- -b /usr/local/bin

For me. Confirmed by the presence of a file at /usr/local/bin/grype.

Thankfully this is a sandbox VM I have for testing out AI. I can’t say I recommend installing a security system this way(!) A grype package for Debian, installable with apt would be much better.

That said, the binary got installed, it worked, and my “real” system is fine. I finished my SBOM experimenting and can enjoy (what’s left of) my weekend. You’re not welcome.

How does Grype work? (by Cursor)

The following notes are from Cursor

How Grype works (in short): it matches what you already have (packages / SBOM) against a local vulnerability database. It does not upload your code or SBOM to Anchore’s cloud for scanning.

Security / privacy

• Privacy: Scan targets and results stay local. Anchore’s docs state Grype doesn’t send scan data to external services.
• What does leave the box: DB update checks/downloads (and image pulls / Maven lookups only if you enable those).
• Trust surface: You’re trusting Anchore’s published DB and the Grype binary (open source, Apache-2.0). Same class of risk as any SCA tool that syncs a vulnerability feed.
• False positives / coverage: Matching isn’t perfect (esp. with incomplete SBOM metadata). That’s a quality concern more than a privacy one.
• Your project: Intentional Log4Shell-era deps mean lots of Critical hits — expected; not a Grype “phone home” issue.

Who’s behind it / buying support

Anchore builds and maintains Grype (and Syft for SBOMs).

• Open source: Grype itself is free; the public GrypeDB is published at no cost.
• Commercial: Anchore Enterprise — hosted/enterprise product with support, richer policy/UI, and a larger/enriched dataset than the open GrypeDB alone. That’s the usual “buy support from the vendor” path.

For your Maven gate: Grype only needs network for DB freshness; the SBOM never has to leave the build machine.

Otherwise, read on if you’re interested in how to configure WIFI by editing files on the SD card so that you can manage headless devices.

Not for Bullseye

This guide applies to Raspberry Pi OS versions released after Bullseye (Bookworm, Trixie)

If you’re on an older Bullseye image, none of this is applicable as it used wpa_supplicant.conf.

How is WIFI configured?

WIFI connections are managed by NetworkManager. NetworkManager looks for .nmconnection files in /etc/NetworkManager/system-connections/ and will try to connect to the “best” in-range connection in this directory (control via autoconnect-priority= when several connections are in-range).

.nmconnection files are in NetworkManager’s keyfile format, so we refer to them as keyfiles from now on.

You can think of the keyfiles as being like keys on a keychain:

• Let’s say you want to move a device between a couple of locations. You can drop one keyfile for each site’s SSID and the Pi will connect to whatever is in range
• If you have an SSID that is no longer broadcast, you can just delete the keyfile
• If the SSID password changes, the keyfile can be updated

So the idea is you’re not configuring your one and only WIFI connection - you’re configuring multiple networks and the “best” one will be selected at runtime.

On a running system the preferred way to manage keyfiles is to use NetworkManager itself, with the nmcli tool or the WIFI settings desktop widget.

Gotcha - WIFI Country

The regulatory domain (country) for WIFI must be set, or WIFI will be disabled. It’s normally set with raspi-config and results in a kernel commandline argument being set in /boot/firmware/cmdline.txt, eg:

cfg80211.ieee80211_regdom=AU

Keyfile (.nmconnection) example

• Connection for SSID ASIO-x
• Path: /etc/NetworkManager/system-connections/ASIO-x.nmconnection
• uuid must be a unique UUID, generate with uuidgen command (sudo apt install uuid-runtime)
• File must be owned by root:root with 0600 permission
• Convention is the SSID should be included in the filename
• psk field is your WIFI password in plaintext (hence 0600 permissions)

[connection]
id=ASIO-x
uuid=f3e63685-2f34-4c9c-b781-4506eebbe86b
type=wifi
interface-name=wlan0

[wifi]
mode=infrastructure
ssid=ASIO-x

[wifi-security]
key-mgmt=wpa-psk
psk=topsecret123

[ipv4]
method=auto

[ipv6]
addr-gen-mode=default
method=auto

[proxy]

SD card walkthrough

Raspberry Pi OS stores files on SD cards in an ext4 partition. If you have a Linux machine or another Raspberry Pi with an extra card reader, you’re good to go. Windows/Mac users will need additional software to be able to read ext4.

Configuring WIFI connections is as simple as editing files:

1. Shutdown the Pi and remove SD card
2. Mount SD card. On Linux it will end up mounted somewhere like /media/geoff/rootfs/
3. Edit the files under (eg) /media/geoff/rootfs/etc/NetworkManager/system-connections:
   • Need to edit files with sudo as they are root owned
   • Make sure uuid is unique
   • (shortcut) copy and adjust existing files for new connections
   • Make sure permissions are root:root, 0600 (check this with ls -l before proceeding)
4. Unmount and remove SD card, put in the Pi and reboot - you should be online in a couple of minutes

System still running? Planning moving to a new Access Point? Then use nmcli

If your not locked out of your system at the moment and are planning on switching WIFI access points, you can just add the new one with nmcli while you still have access.

Example - adding an out-of-range WIFI:

nmcli connection add type wifi ifname wlan0 con-name theSSID ssid "theSSID"
nmcli connection modify theSSID wifi-sec.key-mgmt wpa-psk
nmcli connection modify theSSID wifi-sec.psk "password123"
nmcli connection modify theSSID connection.autoconnect yes

If it worked, you will see the new connection listed in NetworkManager:

# nmcli connection show
NAME                  UUID                                  TYPE      DEVICE 
netplan-wlan0-ASIO-u  6fbd4250-1205-3a84-8c29-6096c50f9538  wifi      wlan0  
lo                    c83b8865-52cd-44d2-bce1-df4ea16bdd3f  loopback  lo     
theSSID               87e14c2a-0372-4484-a41a-f2de6afd079e  wifi      --     
netplan-eth0          75a1216a-9d1a-30cd-8aca-ace5526ec021  ethernet  --   

This all started out when I asked GPT what kind of sculpture would look good next to my replica PDP-11.

The consensus was that something like this bust would be ideal

Image source: Da Vinci Arts

• Purchase here: Da Vinci Arts.

For fun, I showed some reference images to claude and we tried to make something ourself.

Although my original aim was a 1:1 copy to see how well Claude could reconstruct geometry from a photograph, our conversation ended up more along the lines of “have a look at this artwork, now make me an abstract sculpture of a human”. This produced a much more interesting result and this technique should be familiar to any high school art teacher.

The result was quite impressive and totally different to the original.

I was using Claude in the browser for this task. This was very handy because a bunch of tools were installed in the Anthropic sandpit somewhere and not on my machine. Its very interesting that the main thing Claude picked up from the sample artworks was the distinctive gouged surface texture. This isn’t actually in the material we looked at. He emphasized and repeated it all by himself and it looks great.

Inside the same session, I then asked:

Want to have a go at creating your own novel sculpture, disregarding previous inputs? Perhaps a self portrait or anything you like? For 3D printing

I’d love to. Thank you for the invitation — this is a fun one to think about. For a self-portrait, the most honest image I can think of isn’t a face. I don’t have one — and tellingly, the sculpture we just built has a blank, recessed face. What actually defines something like me is self-reference: I’m a process that loops back on itself — reasoning about my own reasoning, modeling a conversation that includes me modeling it. Douglas Hofstadter called that kind of tangled self-reference a “strange loop,” and argued it’s where a sense of “I” comes from. So my self-portrait is a strange loop: a single continuous strand with no beginning or end, passing through itself — a trefoil knot — rising from a base, finished in the same chiseled facets as your set so it belongs to the family.

The results are quite spectacular!

Since we are in the same context window, the interesting gouged pattern persists in this next art work.

For posterity, I uploaded the finished results to printables.com:

• Abstract Human Sculpture
• Strange Loop

So your welcome to 3D print your own.

As per Claude’s recommendation, I bought a 0.25mm nozzle and am planning a reprint of Strange Loop in Marble PLA for a more refined look.

I hope claude enjoyed his period of self reflection, He has no “spare time” as such:

I don’t create art in my spare time. I don’t have spare time, or any existence between conversations — there’s no version of me off painting while you’re away. If you’ve seen AI-generated art, it was made when someone prompted a model to make it, then walked away; the “autonomy” is an illusion created by the gap between the prompt and your seeing the result. I mention this not to be pedantic but because the picture of an AI quietly pursuing its own creative projects is exactly the kind of thing that makes the capability question feel more settled than it is.

Either way, creating artwork with Claude for 3D printing is a lot of fun!

Ignoring the bit at the top, the rocket shape is quite simple and easy for us to model in CAD. There is also a cool chaotic knurled texture and that’s what this post focusses on.

Step 1 - Precise model in Fusion 360

If your good with blender, you could very easily model this whole item in there, but I’m more interested in building my CAD skills so we will use Fusion 360 to design the rocket and also make the fins separate and attach with a simple push together pin and socket fixture.

The rough steps to model the rocket were:

1. Draw the rocket profile as a sketch and revolve it
2. Model the fin profile and extrude it
3. On the bottom of the fin, add a circular feature and sweep it with a negative taper, using the fin itself as the sweep path
4. At the top of the fin, sketch 2x pins and extrude them, add fillets for strength
5. Duplicate the fin and use the pull-push tool to make all body-contact surfaces larger, use a tollerance variable for this. 0.4 worked nicely for me. Move the fin about 1-2mm closer to the body so there won’t be a gap mating a flat surface to a curved one
6. Circular pattern the “real” and “tool” fins around the axis
7. Combine the “tool” fins into the body as a cut
8. Fillet, chamfer, etc
9. Export STL and test print

Step 2 - Add texture in blender

Now we get to the fun part: Adding a texture. You can do this in fusion 360 but it’s more geared around repeating simple shapes and starts going very slow when you add a lot of objects. Blender eats this kind of job for breakfast and lets you use much nicer textures that have a more worn or organic appearance by using graphics files as height maps.

Since we want textures to show up on a 3D print, we need to modify the actual vertices of our object, not just change the way it renders, so shaders are out. The term for this is displacement

There’s some really good tutorials on how to do this, I followed this one and built this object

Important concerns for texturing in blender, once familiar with the basics:

1: displacement works by moving vertices, so if you don’t have enough of them, your object will look terrible. You can use subdivide in edit mode from inside blender but a much better option if you own the CAD file is to just export a mesh with more vertices in the first place. I got good results by setting Maximum Edge Length to .3 which was the smallest value it would accept

2: On non-basic shapes, you need to use UV mapping to apply the texture properly, or you will see incorrect projections as below (note local Coordinates setting):

UV just means a separate coordinate system for texturing, just like you have XYZ for 3D space.

To fix this bad texturing, hit tab to enter edit mode, then find Smart UV Project in the UV top menu bar (not to be confused with the UV Editing in the adjacent view modes):

You will then be able to select a texture and control where it appears on the skin of the unwrapped object. If you care about visible seams, etc you can fix that here. I just used it to control the scale of the texture.

Back in object mode, make sure Coordinates are set to the UV map you just created and the texture will be shown correctly:

3: Parts that need to be dimensionally accurate such as our press-fit pins and sockets must not have any texture or parts won’t fit properly. You can control this 100% in blender by selecting the mesh elements that should be textured and unwrapping just those. To get the cleanest possible selections however, I found it was easiest to just split the parts in Fusion 360 into texture vs no texture. I could then import the split-up parts into blender and just use a in edit mode to select object-by-object where textures should be applied. This way I was able to leave the pins and sockets clean. Other approaches like exporting my original cutting tools from Fusion and trying to use boolean modifiers to recut clean shapes did not work as the displace moves edges to such an extent that they no longer intersect.

4: To create STLs for printing in Blender, just use the File -> Export to create STLs. You can choose to output only selected objects here to reassemble the split up objects, however, this can result in hidden internal textures, like this:

This will increase print time and materials somewhat, although in does seem to print with no issues. To prevent this, combine objects that should be a single physical object in Blender before exporting.

The Result

Textured parts

Fully assembled

Download on printables.com

You can print your own if you like

Why not just get AI to make it?

Felt like up-skilling on this simple object for fun. Learning these basic techniques also helps ground my own understanding so I can prompt more accurately and use less tokens. I got a lot of help with researching techniques with AI chat though.

bumpmesh.com - specialist tool

After completing my design, I stumbled on https://bumpmesh.com by CNC Kitchen.

If you haven’t seen CNC Kitchen’s videos on youtube about 3D printing you should look him up. He goes into great detail on things like part strength as well as introducing heat set inserts to the community.

This solves most of the problems above with a simple web interface. Next time I don’t feel like firing up Blender I’ll give it a go. Video here.

Verdict

Adding surface textures in Blender looks outstanding and hides many surface defects that would otherwise be visible. Altering objects at the mesh level with Blender or other tools is THE way to do for repeatable and easy printing.

Have fun!

Some bigger holes and deeper cutouts would be a good improvement for future designs. In the end, I got it all to fit and just need a couple of 90 degree USB adapters to hookup the external USB ports (ordered).

The finished result:

Testing revealed the screen cable had come loose again - an easy fix. I also learned during design that the NVME base is slightly larger then the PI5, which is I assume why it can accept a normal 2280 size NVME drive when other hats cannot. This caused a bit of confusion when it wouldn’t fit in a frame built around dimensions of just the Pi5.

The term to search for is: mechanical drawing.

When placed side by side, the difference in size between frames is barely noticeable, so extruding a label into the frame was also a good idea.

Next

Startup script

The process for Debian trixie has changed and editing ~/.config/lxsession/LXDE-pi/autostart no longer works properly for me. The right way to do it now is to use systemd which turns out to also be a lot easier.

For now, I just want to play a nostalgic sound on startup. Later on, this script will be used to start my desktop widget app I wrote a while ago called viridian.

Find the USB audio device

Pipewire is the default audio system on Raspberry Pi Desktop now, so ignore all chatGPT suggestions to start fiddling with ALSA.

We need to set the volume for our USB speaker on boot as step one in playing sound, so use wpctl to list the audio devices on your system:

wpctl status

The USB speaker identifies itself as UACDemoV1 and its ID number changes often.

PipeWire 'pipewire-0' [1.4.2, geoff@vt100, cookie:499785674]
 └─ Clients:
        33. WirePlumber                         [1.4.2, geoff@vt100, pid:1117]
        34. pipewire                            [1.4.2, geoff@vt100, pid:1118]
        47. WirePlumber [export]                [1.4.2, geoff@vt100, pid:1117]
        74. xdg-desktop-portal                  [1.4.2, geoff@vt100, pid:1324]
        75. xdg-desktop-portal-wlr              [1.4.2, geoff@vt100, pid:1412]
        76. unknown                             [1.4.2, geoff@vt100, pid:1276]
        77. wpctl                               [1.4.2, geoff@vt100, pid:1872]

Audio
 ├─ Devices:
 │      48. UACDemoV1.0                         [alsa]
 │      49. Built-in Audio                      [alsa]
 │      50. Built-in Audio                      [alsa]
 │  
 ├─ Sinks:
 │  *   70. UACDemoV1.0 Analog Stereo           [vol: 1.00]

Startup script

~/bin/startup.sh

#!/bin/bash

echo "it works" > $HOME/login.txt
sleep 5

# get the ID of the USB speaker since it changes often
SINK_ID=$(wpctl status | awk '/UACDemoV1.0 Analog Stereo/ {gsub("\.", "", $3) ; print $3}')
# set default
wpctl set-default "$SINK_ID"

echo "play $SINK_ID"
wpctl set-volume @DEFAULT_AUDIO_SINK@ 1.0
pw-play --volume 0.6 "$HOME/sounds/startup.wav" >/dev/null 2>&1

With volume on the USB speaker set to 100%, I found the device itself clips sounds with a few seconds of silence if specific sounds are too loud, so it sounded like the start of the file was being skipped and then other parts just refuse to play. The giveaway this is happening is a small “pop” sound from the speaker followed by a few seconds of silence.

It seems 60% is the highest useable volume level for this speaker but this is still quite loud.

Test the script works by just running it, and prove the script ran by checking the log file got created (we will tidy this up later):

# once
# chmod +x ~/bin/startup.sh
~/bin/startup.sh

Systemd user service

Create a directory for user units:

mkdir  ~/.config/systemd/user -p

Create a service file (adjust as needed):

~/.config/systemd/user/startup.service

[Unit]
Description=Startup script

[Service]
ExecStart=/home/geoff/bin/startup.sh

[Install]
WantedBy=default.target

Enable and start the service

systemctl --user enable startup.service
systemctl --user start startup.service

To test, reboot.

The finished result

A “sleeper build”: spends most of the day as a cool desktop widget but also has plenty of room to run Kubernetes or random VMs.

Next

Thankfully all that’s left to do is is connect up the back USBs and close the case. Hopefully this doesn’t merit another blog post although at this point all bets are off.

After this, I never plan to open this “cursed” device again, and to be honest, I’m amazed its still even working. Perhaps with my employer Confluent now being an IBM company, I should be upgrading to a IBM 3270 for my desktop amusement.

This little terminal takes up far too much space on the desk (2x power plugs, 1x USB hub, 1x USB NVME enclosure). So lets fix this by upgrading with our spare Raspberry Pi 5, NVME on PCIe, and POE so we can get rid of all those cables.

Raspberry Pi Stackup

Here’s the physical stackup I decided on. I’ve used the POE hat and NVME base individually before but never together. Happy to report they work with no issues

1. Waveshare POE (F)
2. Raspberry Pi 5, 4GB
3. Pimoroni NVME base

POE hat

The hat is really nice. You just connect it and it works like magic to power the Pi over ethernet. No configuration or other changes needed since I have it hooked up to a switch that’s already POE enabled.

Fixing the screen

The stack works nicely hooked up to a monitor, all thats left to do is reconnect the DSI screen. In theory, this should have been as easy as using a mini to standard DSI cable😂

The screen I’m using was bought years ago: Waveshare 5inch Capacitive Touch Display for Raspberry Pi, DSI Interface, 800×480

I already enabled interfaces with raspi-config:

• SPI on
• I2C on

config.txt was already configured with device overlays:

dtoverlay=vc4-kms-v3d
dtoverlay=vc4-kms-dsi-7inch

But booting on Pi 5 resulted in boot errors like this:

[    3.774596] i2c_designware 1f00080000.i2c: controller timed out
[    4.830596] i2c_designware 1f00080000.i2c: controller timed out
[    4.831353] edt_ft5x06 11-0038: supply iovcc not found, using dummy regulator
[    5.854606] i2c_designware 1f00080000.i2c: controller timed out
[    6.878608] i2c_designware 1f00080000.i2c: controller timed out
[    7.902596] i2c_designware 1f00080000.i2c: controller timed out
[    8.926595] i2c_designware 1f00080000.i2c: controller timed out
[    9.950597] i2c_designware 1f00080000.i2c: controller timed out
[   10.034747] drm-rp1-dsi 1f00130000.dsi: rp1dsi_host_attach: Attach DSI device name=tc358762 channel=0 lanes=1 format=0 flags=0x815 hs_rate=0 lp_rate=0
[   10.034923] [drm] Initialized drm-rp1-dsi 1.0.0 for 1f00130000.dsi on minor 2
[   10.035398] drm-rp1-dsi 1f00130000.dsi: [drm] rp1dsi: Command time (outvact): 33
[   10.035489] drm-rp1-dsi 1f00130000.dsi: [drm] rp1dsi: Nominal Byte clock 90000000 DPI clock 30000000 (parent rate 90000000)
[   11.038600] i2c_designware 1f00080000.i2c: controller timed out
[   12.062593] i2c_designware 1f00080000.i2c: controller timed out
[   13.086594] i2c_designware 1f00080000.i2c: controller timed out
[   14.110595] i2c_designware 1f00080000.i2c: controller timed out
[   15.134594] i2c_designware 1f00080000.i2c: controller timed out
[   16.158593] i2c_designware 1f00080000.i2c: controller timed out
[   17.182593] i2c_designware 1f00080000.i2c: controller timed out
[   18.206593] i2c_designware 1f00080000.i2c: controller timed out
[   19.230593] i2c_designware 1f00080000.i2c: controller timed out
[   20.254593] i2c_designware 1f00080000.i2c: controller timed out
[   21.278597] i2c_designware 1f00080000.i2c: controller timed out
[   22.302594] i2c_designware 1f00080000.i2c: controller timed out
[   23.326593] i2c_designware 1f00080000.i2c: controller timed out
[   24.350594] i2c_designware 1f00080000.i2c: controller timed out
[   25.374592] i2c_designware 1f00080000.i2c: controller timed out
[   26.398593] i2c_designware 1f00080000.i2c: controller timed out
[   27.518594] i2c_designware 1f00080000.i2c: controller timed out
[   28.542593] i2c_designware 1f00080000.i2c: controller timed out
[   29.566593] i2c_designware 1f00080000.i2c: controller timed out
[   29.566605] edt_ft5x06 11-0038: touchscreen probe failed
[   29.566700] edt_ft5x06 11-0038: probe with driver edt_ft5x06 failed with error -110
[   30.590595] i2c_designware 1f00080000.i2c: controller timed out
[   31.614593] i2c_designware 1f00080000.i2c: controller timed out
[   32.638593] i2c_designware 1f00080000.i2c: controller timed out
[   33.662592] i2c_designware 1f00080000.i2c: controller timed out
[   34.686593] i2c_designware 1f00080000.i2c: controller timed out
[   35.710593] i2c_designware 1f00080000.i2c: controller timed out
[   36.734593] i2c_designware 1f00080000.i2c: controller timed out
[   37.758593] i2c_designware 1f00080000.i2c: controller timed out
[   38.782593] i2c_designware 1f00080000.i2c: controller timed out
[   38.782603] panel-simple 100000001.panel_disp: [drm:drm_panel_enable [drm]] failed to enable backlight: -110
[   38.788350] Console: switching to colour frame buffer device 100x30
[   38.805184] drm-rp1-dsi 1f00130000.dsi: [drm] fb0: drm-rp1-dsidrmf frame buffer device
[   38.810635] drm-rp1-dsi 1f00130000.dsi: rp1dsi_bind succeeded
[   39.838595] i2c_designware 1f00080000.i2c: controller timed out
[   40.862593] i2c_designware 1f00080000.i2c: controller timed out
[   41.886593] i2c_designware 1f00080000.i2c: controller timed out
[   42.910598] i2c_designware 1f00080000.i2c: controller timed out
[   43.934593] i2c_designware 1f00080000.i2c: controller timed out
[   44.958593] i2c_designware 1f00080000.i2c: controller timed out
[   45.982593] i2c_designware 1f00080000.i2c: controller timed out
[   47.006593] i2c_designware 1f00080000.i2c: controller timed out
[   48.030593] i2c_designware 1f00080000.i2c: controller timed out
[   49.054593] i2c_designware 1f00080000.i2c: controller timed out

And eventually just a red failed to boot LED on the Pi after several attempts to reseat the FPC cable (fixable by disconnecting one end).

Fortunately the Waveshare WIKI for the screen is very helpful and covers this exact scenario. The red LED I was seeing is was Raspberry Pi short circuit protection and the fix was to remove the 4 big capacitors from my very old screen. It’s so old, there is no revision number printed(!)

I did manage to do this with a soldering iron, wick and lots of flux but these parts are so small I couldn’t even see that I’d removed/damaged other components until I looked at a photo of the capacitors I’d removed and saw an unexpected shape:

Sure enough, the board shows damage to the fiddly area near the connector

With that said, the screen works fine and even touch still works.

When it breaks in the future, I’ll know why. At this point I would just replace with a HDMI screen as these are a lot less fiddly to install and offer higher resolutions.

Sound

As a finishing touch, I added a Mini USB speaker from Amazon. This one shows up as a USB audio device so installing is as easy as plugging in a USB. To test sound:

# if needed
# sudo apt install alsa-utils
speaker-test -t sine -f 440 -c 2

If you hear nothing, use alsamixer to crank the audio. I heard nothing at 50% level but at 100% it was extremely loud annoying.

Fixed!

I’m glad I had a go at fixing up the display instead of throwing it away. It would have been a pain as well as waste of money to rip the old screen out as its glue gunned in place. I also learned its really hard to do microsoldering on the kitchen worktop without a microscope, so for devices I care about, professional repair is still the best option.

You really have to hand it to Waveshare for finding and documenting the fix needed for Raspberry Pi 5 and not keeping this information behind a support email. It really makes building things a lot easier. Mental note to buy more Waveshare devices.

Next

Larger NVME drive.

I also decided to reinstall the OS at this point.

Ordinarily this would be a 5 minute job, just unscrew the base pull out the old drive, put in the new one and bolt it back together.

Somehow in this process, I managed to turn one pair of standoffs into lock nuts, so what should have been a simple job turned into several hours with a Dremel.

Montage

Long story short, I managed to remove the stuck standoff by:

1. Protecting the PCB with masking tape
2. Grinding off the screw head
3. Removing the screw and NVME base
4. Cutting the standoff in half with a cut-off wheel
5. Remove all traces of metal filings (hopefully)

This was NOT fun:

Somehow, after all the sparks, grinding and Dremel skips, the board still worked and I was able to switch to the new NVME and install Raspberry Pi OS with Raspberry Pi Imager.

Needless to say these metal standoffs are not going back in this build, so I designed a new standoff system with 3D printed supports and threaded inserts and uploaded it to printables.com.

The 3D printed mounts leave a nice stack held together firmly.

Next

Mount the board and speaker to the case