TODO: actually write tests lol

cmd/pkgserver: add noscript warning to test web UI
cmd/pkgserver: relocate JS tests
2026-04-09 11:46:25 +10:00 · 2026-04-09 11:46:25 +10:00 · 2026-04-09 11:46:25 +10:00 · 2026-04-09 11:46:25 +10:00 · 2026-04-09 11:46:25 +10:00 · 2026-04-09 11:46:25 +10:00
82 changed files with 14463 additions and 289 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,37 +1,22 @@
-# Binaries for programs and plugins
-*.exe
-*.exe~
-*.dll
-*.so
-*.dylib
-*.pkg
-/hakurei
-
-# Test binary, built with `go test -c`
+# produced by tools and text editors
+*.qcow2
 *.test
-
-# Output of the go coverage tool, specifically when used with LiteIDE
 *.out
-
-# Dependency directories (remove the comment below to include it)
-# vendor/
-
-# Go workspace file
-go.work
-go.work.sum
-
-# env file
-.env
 .idea
 .vscode

 # go generate
 /cmd/hakurei/LICENSE
+/cmd/pkgserver/.sass-cache
+/cmd/pkgserver/ui/static/*.js
+/cmd/pkgserver/ui/static/*.css*
+/cmd/pkgserver/ui/static/*.css.map
+/cmd/pkgserver/ui_test/*.js
+/cmd/pkgserver/ui_test/lib/*.js
+/cmd/pkgserver/ui_test/lib/*.css*
+/cmd/pkgserver/ui_test/lib/*.css.map
 /internal/pkg/testdata/testtool
 /internal/rosa/hakurei_current.tar.gz

-# release
-/dist/hakurei-*
-
-# interactive nixos vm
-nixos.qcow2
+# cmd/dist default destination
+/dist
--- a/all.sh
+++ b/all.sh
@@ -0,0 +1,6 @@
+#!/bin/sh -e
+
+TOOLCHAIN_VERSION="$(go version)"
+cd "$(dirname -- "$0")/"
+echo "# Building cmd/dist using ${TOOLCHAIN_VERSION}."
+go run -v --tags=dist ./cmd/dist
--- a/cmd/dist/comp/_hakurei
+++ b/cmd/dist/comp/_hakurei
--- a/cmd/dist/main.go
+++ b/cmd/dist/main.go
@@ -0,0 +1,237 @@
+//go:build dist
+
+package main
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"context"
+	"crypto/sha512"
+	_ "embed"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"io/fs"
+	"log"
+	"os"
+	"os/exec"
+	"os/signal"
+	"path/filepath"
+	"runtime"
+)
+
+// getenv looks up an environment variable, and returns fallback if it is unset.
+func getenv(key, fallback string) string {
+	if v, ok := os.LookupEnv(key); ok {
+		return v
+	}
+	return fallback
+}
+
+// mustRun runs a command with the current process's environment and panics
+// on error or non-zero exit code.
+func mustRun(ctx context.Context, name string, arg ...string) {
+	cmd := exec.CommandContext(ctx, name, arg...)
+	cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
+	if err := cmd.Run(); err != nil {
+		panic(err)
+	}
+}
+
+//go:embed comp/_hakurei
+var comp []byte
+
+func main() {
+	fmt.Println()
+	log.SetFlags(0)
+	log.SetPrefix("# ")
+
+	version := getenv("HAKUREI_VERSION", "untagged")
+	prefix := getenv("PREFIX", "/usr")
+	destdir := getenv("DESTDIR", "dist")
+
+	if err := os.MkdirAll(destdir, 0755); err != nil {
+		log.Fatal(err)
+	}
+	s, err := os.MkdirTemp(destdir, ".dist.*")
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer func() {
+		var code int
+
+		if err = os.RemoveAll(s); err != nil {
+			code = 1
+			log.Println(err)
+		}
+
+		if r := recover(); r != nil {
+			code = 1
+			log.Println(r)
+		}
+
+		os.Exit(code)
+	}()
+
+	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
+	defer cancel()
+
+	log.Println("Building hakurei.")
+	mustRun(ctx, "go", "generate", "./...")
+	mustRun(
+		ctx, "go", "build",
+		"-trimpath",
+		"-v", "-o", s,
+		"-ldflags=-s -w "+
+			"-buildid= -linkmode external -extldflags=-static "+
+			"-X hakurei.app/internal/info.buildVersion="+version+" "+
+			"-X hakurei.app/internal/info.hakureiPath="+prefix+"/bin/hakurei "+
+			"-X hakurei.app/internal/info.hsuPath="+prefix+"/bin/hsu "+
+			"-X main.hakureiPath="+prefix+"/bin/hakurei",
+		"./...",
+	)
+	fmt.Println()
+
+	log.Println("Testing Hakurei.")
+	mustRun(
+		ctx, "go", "test",
+		"-ldflags=-buildid= -linkmode external -extldflags=-static",
+		"./...",
+	)
+	fmt.Println()
+
+	log.Println("Creating distribution.")
+	const suffix = ".tar.gz"
+	distName := "hakurei-" + version + "-" + runtime.GOARCH
+	var f *os.File
+	if f, err = os.OpenFile(
+		filepath.Join(s, distName+suffix),
+		os.O_CREATE|os.O_EXCL|os.O_WRONLY,
+		0644,
+	); err != nil {
+		panic(err)
+	}
+	defer func() {
+		if f == nil {
+			return
+		}
+		if err = f.Close(); err != nil {
+			log.Println(err)
+		}
+	}()
+
+	h := sha512.New()
+	gw := gzip.NewWriter(io.MultiWriter(f, h))
+	tw := tar.NewWriter(gw)
+
+	mustWriteHeader := func(name string, size int64, mode os.FileMode) {
+		header := tar.Header{
+			Name:  filepath.Join(distName, name),
+			Size:  size,
+			Mode:  int64(mode),
+			Uname: "root",
+			Gname: "root",
+		}
+
+		if mode&os.ModeDir != 0 {
+			header.Typeflag = tar.TypeDir
+			fmt.Printf("%s %s\n", mode, name)
+		} else {
+			header.Typeflag = tar.TypeReg
+			fmt.Printf("%s %s (%d bytes)\n", mode, name, size)
+		}
+
+		if err = tw.WriteHeader(&header); err != nil {
+			panic(err)
+		}
+	}
+
+	mustWriteFile := func(name string, data []byte, mode os.FileMode) {
+		mustWriteHeader(name, int64(len(data)), mode)
+		if mode&os.ModeDir != 0 {
+			return
+		}
+		if _, err = tw.Write(data); err != nil {
+			panic(err)
+		}
+	}
+
+	mustWriteFromPath := func(dst, src string, mode os.FileMode) {
+		var r *os.File
+		if r, err = os.Open(src); err != nil {
+			panic(err)
+		}
+
+		var fi os.FileInfo
+		if fi, err = r.Stat(); err != nil {
+			_ = r.Close()
+			panic(err)
+		}
+
+		if mode == 0 {
+			mode = fi.Mode()
+		}
+
+		mustWriteHeader(dst, fi.Size(), mode)
+		if _, err = io.Copy(tw, r); err != nil {
+			_ = r.Close()
+			panic(err)
+		} else if err = r.Close(); err != nil {
+			panic(err)
+		}
+	}
+
+	mustWriteFile(".", nil, fs.ModeDir|0755)
+	mustWriteFile("comp/", nil, os.ModeDir|0755)
+	mustWriteFile("comp/_hakurei", comp, 0644)
+	mustWriteFile("install.sh", []byte(`#!/bin/sh -e
+cd "$(dirname -- "$0")" || exit 1
+
+install -vDm0755 "bin/hakurei" "${DESTDIR}`+prefix+`/bin/hakurei"
+install -vDm0755 "bin/sharefs" "${DESTDIR}`+prefix+`/bin/sharefs"
+
+install -vDm4511 "bin/hsu" "${DESTDIR}`+prefix+`/bin/hsu"
+if [ ! -f "${DESTDIR}/etc/hsurc" ]; then
+    install -vDm0400 "hsurc.default" "${DESTDIR}/etc/hsurc"
+fi
+
+install -vDm0644 "comp/_hakurei" "${DESTDIR}`+prefix+`/share/zsh/site-functions/_hakurei"
+`), 0755)
+
+	mustWriteFromPath("README.md", "README.md", 0)
+	mustWriteFile("hsurc.default", []byte("1000 0"), 0400)
+	mustWriteFromPath("bin/hsu", filepath.Join(s, "hsu"), 04511)
+	for _, name := range []string{
+		"hakurei",
+		"sharefs",
+	} {
+		mustWriteFromPath(
+			filepath.Join("bin", name),
+			filepath.Join(s, name),
+			0,
+		)
+	}
+
+	if err = tw.Close(); err != nil {
+		panic(err)
+	} else if err = gw.Close(); err != nil {
+		panic(err)
+	} else if err = f.Close(); err != nil {
+		panic(err)
+	}
+	f = nil
+
+	if err = os.WriteFile(
+		filepath.Join(destdir, distName+suffix+".sha512"),
+		append(hex.AppendEncode(nil, h.Sum(nil)), "  "+distName+suffix+"\n"...),
+		0644,
+	); err != nil {
+		panic(err)
+	}
+	if err = os.Rename(
+		filepath.Join(s, distName+suffix),
+		filepath.Join(destdir, distName+suffix),
+	); err != nil {
+		panic(err)
+	}
+}
--- a/cmd/mbf/main.go
+++ b/cmd/mbf/main.go
@@ -73,6 +73,8 @@ func main() {
 		flagCures int
 		flagBase  string
 		flagIdle  bool
+
+		flagHostAbstract bool
 	)
 	c := command.New(os.Stderr, log.Printf, "mbf", func([]string) (err error) {
 		msg.SwapVerbose(!flagQuiet)
@@ -91,7 +93,10 @@ func main() {

 		var flags int
 		if flagIdle {
-			flags &= pkg.CSchedIdle
+			flags |= pkg.CSchedIdle
+		}
+		if flagHostAbstract {
+			flags |= pkg.CHostAbstract
 		}
 		cache, err = pkg.Open(ctx, msg, flags, flagCures, base)

@@ -112,6 +117,13 @@ func main() {
 		&flagIdle,
 		"sched-idle", command.BoolFlag(false),
 		"Set SCHED_IDLE scheduling policy",
+	).Flag(
+		&flagHostAbstract,
+		"host-abstract", command.BoolFlag(
+			os.Getenv("MBF_HOST_ABSTRACT") != "",
+		),
+		"Do not restrict networked cure containers from connecting to host "+
+			"abstract UNIX sockets",
 	)

 	{
--- a/cmd/pkgserver/api.go
+++ b/cmd/pkgserver/api.go
@@ -0,0 +1,176 @@
+package main
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"net/url"
+	"path"
+	"strconv"
+	"sync"
+
+	"hakurei.app/internal/info"
+	"hakurei.app/internal/rosa"
+)
+
+// for lazy initialisation of serveInfo
+var (
+	infoPayload struct {
+		// Current package count.
+		Count int `json:"count"`
+		// Hakurei version, set at link time.
+		HakureiVersion string `json:"hakurei_version"`
+	}
+	infoPayloadOnce sync.Once
+)
+
+// handleInfo writes constant system information.
+func handleInfo(w http.ResponseWriter, _ *http.Request) {
+	infoPayloadOnce.Do(func() {
+		infoPayload.Count = int(rosa.PresetUnexportedStart)
+		infoPayload.HakureiVersion = info.Version()
+	})
+	// TODO(mae): cache entire response if no additional fields are planned
+	writeAPIPayload(w, infoPayload)
+}
+
+// newStatusHandler returns a [http.HandlerFunc] that offers status files for
+// viewing or download, if available.
+func (index *packageIndex) newStatusHandler(disposition bool) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		m, ok := index.names[path.Base(r.URL.Path)]
+		if !ok || !m.HasReport {
+			http.NotFound(w, r)
+			return
+		}
+
+		contentType := "text/plain; charset=utf-8"
+		if disposition {
+			contentType = "application/octet-stream"
+
+			// quoting like this is unsound, but okay, because metadata is hardcoded
+			contentDisposition := `attachment; filename="`
+			contentDisposition += m.Name + "-"
+			if m.Version != "" {
+				contentDisposition += m.Version + "-"
+			}
+			contentDisposition += m.ids + `.log"`
+			w.Header().Set("Content-Disposition", contentDisposition)
+		}
+		w.Header().Set("Content-Type", contentType)
+		w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+		if err := func() (err error) {
+			defer index.handleAccess(&err)()
+			_, err = w.Write(m.status)
+			return
+		}(); err != nil {
+			log.Println(err)
+			http.Error(
+				w, "cannot deliver status, contact maintainers",
+				http.StatusInternalServerError,
+			)
+		}
+	}
+}
+
+// handleGet writes a slice of metadata with specified order.
+func (index *packageIndex) handleGet(w http.ResponseWriter, r *http.Request) {
+	q := r.URL.Query()
+	limit, err := strconv.Atoi(q.Get("limit"))
+	if err != nil || limit > 100 || limit < 1 {
+		http.Error(
+			w, "limit must be an integer between 1 and 100",
+			http.StatusBadRequest,
+		)
+		return
+	}
+	i, err := strconv.Atoi(q.Get("index"))
+	if err != nil || i >= len(index.sorts[0]) || i < 0 {
+		http.Error(
+			w, "index must be an integer between 0 and "+
+				strconv.Itoa(int(rosa.PresetUnexportedStart-1)),
+			http.StatusBadRequest,
+		)
+		return
+	}
+	sort, err := strconv.Atoi(q.Get("sort"))
+	if err != nil || sort >= len(index.sorts) || sort < 0 {
+		http.Error(
+			w, "sort must be an integer between 0 and "+
+				strconv.Itoa(sortOrderEnd),
+			http.StatusBadRequest,
+		)
+		return
+	}
+	values := index.sorts[sort][i:min(i+limit, len(index.sorts[sort]))]
+	writeAPIPayload(w, &struct {
+		Values []*metadata `json:"values"`
+	}{values})
+}
+
+func (index *packageIndex) handleSearch(w http.ResponseWriter, r *http.Request) {
+	q := r.URL.Query()
+	limit, err := strconv.Atoi(q.Get("limit"))
+	if err != nil || limit > 100 || limit < 1 {
+		http.Error(
+			w, "limit must be an integer between 1 and 100",
+			http.StatusBadRequest,
+		)
+		return
+	}
+	i, err := strconv.Atoi(q.Get("index"))
+	if err != nil || i >= len(index.sorts[0]) || i < 0 {
+		http.Error(
+			w, "index must be an integer between 0 and "+
+				strconv.Itoa(int(rosa.PresetUnexportedStart-1)),
+			http.StatusBadRequest,
+		)
+		return
+	}
+	search, err := url.PathUnescape(q.Get("search"))
+	if len(search) > 100 || err != nil {
+		http.Error(
+			w, "search must be a string between 0 and 100 characters long",
+			http.StatusBadRequest,
+		)
+		return
+	}
+	desc := q.Get("desc") == "true"
+	n, res, err := index.performSearchQuery(limit, i, search, desc)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+	}
+	writeAPIPayload(w, &struct {
+		Count   int            `json:"count"`
+		Results []searchResult `json:"results"`
+	}{n, res})
+}
+
+// apiVersion is the name of the current API revision, as part of the pattern.
+const apiVersion = "v1"
+
+// registerAPI registers API handler functions.
+func (index *packageIndex) registerAPI(mux *http.ServeMux) {
+	mux.HandleFunc("GET /api/"+apiVersion+"/info", handleInfo)
+	mux.HandleFunc("GET /api/"+apiVersion+"/get", index.handleGet)
+	mux.HandleFunc("GET /api/"+apiVersion+"/search", index.handleSearch)
+	mux.HandleFunc("GET /api/"+apiVersion+"/status/", index.newStatusHandler(false))
+	mux.HandleFunc("GET /status/", index.newStatusHandler(true))
+}
+
+// writeAPIPayload sets headers common to API responses and encodes payload as
+// JSON for the response body.
+func writeAPIPayload(w http.ResponseWriter, payload any) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+	w.Header().Set("Pragma", "no-cache")
+	w.Header().Set("Expires", "0")
+
+	if err := json.NewEncoder(w).Encode(payload); err != nil {
+		log.Println(err)
+		http.Error(
+			w, "cannot encode payload, contact maintainers",
+			http.StatusInternalServerError,
+		)
+	}
+}
--- a/cmd/pkgserver/api_test.go
+++ b/cmd/pkgserver/api_test.go
@@ -0,0 +1,183 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"strconv"
+	"testing"
+
+	"hakurei.app/internal/info"
+	"hakurei.app/internal/rosa"
+)
+
+// prefix is prepended to every API path.
+const prefix = "/api/" + apiVersion + "/"
+
+func TestAPIInfo(t *testing.T) {
+	t.Parallel()
+
+	w := httptest.NewRecorder()
+	handleInfo(w, httptest.NewRequestWithContext(
+		t.Context(),
+		http.MethodGet,
+		prefix+"info",
+		nil,
+	))
+
+	resp := w.Result()
+	checkStatus(t, resp, http.StatusOK)
+	checkAPIHeader(t, w.Header())
+
+	checkPayload(t, resp, struct {
+		Count          int    `json:"count"`
+		HakureiVersion string `json:"hakurei_version"`
+	}{int(rosa.PresetUnexportedStart), info.Version()})
+}
+
+func TestAPIGet(t *testing.T) {
+	t.Parallel()
+	const target = prefix + "get"
+
+	index := newIndex(t)
+	newRequest := func(suffix string) *httptest.ResponseRecorder {
+		w := httptest.NewRecorder()
+		index.handleGet(w, httptest.NewRequestWithContext(
+			t.Context(),
+			http.MethodGet,
+			target+suffix,
+			nil,
+		))
+		return w
+	}
+
+	checkValidate := func(t *testing.T, suffix string, vmin, vmax int, wantErr string) {
+		t.Run("invalid", func(t *testing.T) {
+			t.Parallel()
+
+			w := newRequest("?" + suffix + "=invalid")
+			resp := w.Result()
+			checkError(t, resp, wantErr, http.StatusBadRequest)
+		})
+
+		t.Run("min", func(t *testing.T) {
+			t.Parallel()
+
+			w := newRequest("?" + suffix + "=" + strconv.Itoa(vmin-1))
+			resp := w.Result()
+			checkError(t, resp, wantErr, http.StatusBadRequest)
+
+			w = newRequest("?" + suffix + "=" + strconv.Itoa(vmin))
+			resp = w.Result()
+			checkStatus(t, resp, http.StatusOK)
+		})
+
+		t.Run("max", func(t *testing.T) {
+			t.Parallel()
+
+			w := newRequest("?" + suffix + "=" + strconv.Itoa(vmax+1))
+			resp := w.Result()
+			checkError(t, resp, wantErr, http.StatusBadRequest)
+
+			w = newRequest("?" + suffix + "=" + strconv.Itoa(vmax))
+			resp = w.Result()
+			checkStatus(t, resp, http.StatusOK)
+		})
+	}
+
+	t.Run("limit", func(t *testing.T) {
+		t.Parallel()
+		checkValidate(
+			t, "index=0&sort=0&limit", 1, 100,
+			"limit must be an integer between 1 and 100",
+		)
+	})
+
+	t.Run("index", func(t *testing.T) {
+		t.Parallel()
+		checkValidate(
+			t, "limit=1&sort=0&index", 0, int(rosa.PresetUnexportedStart-1),
+			"index must be an integer between 0 and "+strconv.Itoa(int(rosa.PresetUnexportedStart-1)),
+		)
+	})
+
+	t.Run("sort", func(t *testing.T) {
+		t.Parallel()
+		checkValidate(
+			t, "index=0&limit=1&sort", 0, int(sortOrderEnd),
+			"sort must be an integer between 0 and "+strconv.Itoa(int(sortOrderEnd)),
+		)
+	})
+
+	checkWithSuffix := func(name, suffix string, want []*metadata) {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			w := newRequest(suffix)
+			resp := w.Result()
+			checkStatus(t, resp, http.StatusOK)
+			checkAPIHeader(t, w.Header())
+			checkPayloadFunc(t, resp, func(got *struct {
+				Count  int         `json:"count"`
+				Values []*metadata `json:"values"`
+			}) bool {
+				return got.Count == len(want) &&
+					slices.EqualFunc(got.Values, want, func(a, b *metadata) bool {
+						return (a.Version == b.Version ||
+							a.Version == rosa.Unversioned ||
+							b.Version == rosa.Unversioned) &&
+							a.HasReport == b.HasReport &&
+							a.Name == b.Name &&
+							a.Description == b.Description &&
+							a.Website == b.Website
+					})
+			})
+
+		})
+	}
+
+	checkWithSuffix("declarationAscending", "?limit=2&index=0&sort=0", []*metadata{
+		{
+			Metadata: rosa.GetMetadata(0),
+			Version:  rosa.Std.Version(0),
+		},
+		{
+			Metadata: rosa.GetMetadata(1),
+			Version:  rosa.Std.Version(1),
+		},
+	})
+	checkWithSuffix("declarationAscending offset", "?limit=3&index=5&sort=0", []*metadata{
+		{
+			Metadata: rosa.GetMetadata(5),
+			Version:  rosa.Std.Version(5),
+		},
+		{
+			Metadata: rosa.GetMetadata(6),
+			Version:  rosa.Std.Version(6),
+		},
+		{
+			Metadata: rosa.GetMetadata(7),
+			Version:  rosa.Std.Version(7),
+		},
+	})
+	checkWithSuffix("declarationDescending", "?limit=3&index=0&sort=1", []*metadata{
+		{
+			Metadata: rosa.GetMetadata(rosa.PresetUnexportedStart - 1),
+			Version:  rosa.Std.Version(rosa.PresetUnexportedStart - 1),
+		},
+		{
+			Metadata: rosa.GetMetadata(rosa.PresetUnexportedStart - 2),
+			Version:  rosa.Std.Version(rosa.PresetUnexportedStart - 2),
+		},
+		{
+			Metadata: rosa.GetMetadata(rosa.PresetUnexportedStart - 3),
+			Version:  rosa.Std.Version(rosa.PresetUnexportedStart - 3),
+		},
+	})
+	checkWithSuffix("declarationDescending offset", "?limit=1&index=37&sort=1", []*metadata{
+		{
+			Metadata: rosa.GetMetadata(rosa.PresetUnexportedStart - 38),
+			Version:  rosa.Std.Version(rosa.PresetUnexportedStart - 38),
+		},
+	})
+}
--- a/cmd/pkgserver/index.go
+++ b/cmd/pkgserver/index.go
@@ -0,0 +1,105 @@
+package main
+
+import (
+	"cmp"
+	"errors"
+	"slices"
+	"strings"
+
+	"hakurei.app/internal/pkg"
+	"hakurei.app/internal/rosa"
+)
+
+const (
+	declarationAscending = iota
+	declarationDescending
+	nameAscending
+	nameDescending
+	sizeAscending
+	sizeDescending
+
+	sortOrderEnd = iota - 1
+)
+
+// packageIndex refers to metadata by name and various sort orders.
+type packageIndex struct {
+	sorts  [sortOrderEnd + 1][rosa.PresetUnexportedStart]*metadata
+	names  map[string]*metadata
+	search searchCache
+	// Taken from [rosa.Report] if available.
+	handleAccess func(*error) func()
+}
+
+// metadata holds [rosa.Metadata] extended with additional information.
+type metadata struct {
+	p rosa.PArtifact
+	*rosa.Metadata
+
+	// Populated via [rosa.Toolchain.Version], [rosa.Unversioned] is equivalent
+	// to the zero value. Otherwise, the zero value is invalid.
+	Version string `json:"version,omitempty"`
+	// Output data size, available if present in report.
+	Size int64 `json:"size,omitempty"`
+	// Whether the underlying [pkg.Artifact] is present in the report.
+	HasReport bool `json:"report"`
+
+	// Ident string encoded ahead of time.
+	ids string
+	// Backed by [rosa.Report], access must be prepared by HandleAccess.
+	status []byte
+}
+
+// populate deterministically populates packageIndex, optionally with a report.
+func (index *packageIndex) populate(cache *pkg.Cache, report *rosa.Report) (err error) {
+	if report != nil {
+		defer report.HandleAccess(&err)()
+		index.handleAccess = report.HandleAccess
+	}
+
+	var work [rosa.PresetUnexportedStart]*metadata
+	index.names = make(map[string]*metadata)
+	for p := range rosa.PresetUnexportedStart {
+		m := metadata{
+			p: p,
+
+			Metadata: rosa.GetMetadata(p),
+			Version:  rosa.Std.Version(p),
+		}
+		if m.Version == "" {
+			return errors.New("invalid version from " + m.Name)
+		}
+		if m.Version == rosa.Unversioned {
+			m.Version = ""
+		}
+
+		if cache != nil && report != nil {
+			id := cache.Ident(rosa.Std.Load(p))
+			m.ids = pkg.Encode(id.Value())
+			m.status, m.Size = report.ArtifactOf(id)
+			m.HasReport = m.Size >= 0
+		}
+
+		work[p] = &m
+		index.names[m.Name] = &m
+	}
+
+	index.sorts[declarationAscending] = work
+	index.sorts[declarationDescending] = work
+	slices.Reverse(index.sorts[declarationDescending][:])
+
+	index.sorts[nameAscending] = work
+	slices.SortFunc(index.sorts[nameAscending][:], func(a, b *metadata) int {
+		return strings.Compare(a.Name, b.Name)
+	})
+	index.sorts[nameDescending] = index.sorts[nameAscending]
+	slices.Reverse(index.sorts[nameDescending][:])
+
+	index.sorts[sizeAscending] = work
+	slices.SortFunc(index.sorts[sizeAscending][:], func(a, b *metadata) int {
+		return cmp.Compare(a.Size, b.Size)
+	})
+	index.sorts[sizeDescending] = index.sorts[sizeAscending]
+	slices.Reverse(index.sorts[sizeDescending][:])
+
+	return
+}
--- a/cmd/pkgserver/main.go
+++ b/cmd/pkgserver/main.go
@@ -0,0 +1,115 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"log"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"hakurei.app/command"
+	"hakurei.app/container/check"
+	"hakurei.app/internal/pkg"
+	"hakurei.app/internal/rosa"
+	"hakurei.app/message"
+)
+
+const shutdownTimeout = 15 * time.Second
+
+func main() {
+	log.SetFlags(0)
+	log.SetPrefix("pkgserver: ")
+
+	var (
+		flagBaseDir string
+		flagAddr    string
+	)
+
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP)
+	defer stop()
+	msg := message.New(log.Default())
+
+	c := command.New(os.Stderr, log.Printf, "pkgserver", func(args []string) error {
+		var (
+			cache  *pkg.Cache
+			report *rosa.Report
+		)
+		switch len(args) {
+		case 0:
+			break
+
+		case 1:
+			baseDir, err := check.NewAbs(flagBaseDir)
+			if err != nil {
+				return err
+			}
+
+			cache, err = pkg.Open(ctx, msg, 0, baseDir)
+			if err != nil {
+				return err
+			}
+			defer cache.Close()
+
+			report, err = rosa.OpenReport(args[0])
+			if err != nil {
+				return err
+			}
+
+		default:
+			return errors.New("pkgserver requires 1 argument")
+
+		}
+
+		var index packageIndex
+		index.search = make(searchCache)
+		if err := index.populate(cache, report); err != nil {
+			return err
+		}
+		ticker := time.NewTicker(1 * time.Minute)
+		go func() {
+			for {
+				select {
+				case <-ctx.Done():
+					ticker.Stop()
+					return
+				case <-ticker.C:
+					index.search.clean()
+				}
+			}
+		}()
+		var mux http.ServeMux
+		uiRoutes(&mux)
+		testUiRoutes(&mux)
+		index.registerAPI(&mux)
+		server := http.Server{
+			Addr:    flagAddr,
+			Handler: &mux,
+		}
+		go func() {
+			<-ctx.Done()
+			c, cancel := context.WithTimeout(context.Background(), shutdownTimeout)
+			defer cancel()
+			if err := server.Shutdown(c); err != nil {
+				log.Fatal(err)
+			}
+		}()
+		return server.ListenAndServe()
+	}).Flag(
+		&flagBaseDir,
+		"b", command.StringFlag(""),
+		"base directory for cache",
+	).Flag(
+		&flagAddr,
+		"addr", command.StringFlag(":8067"),
+		"TCP network address to listen on",
+	)
+	c.MustParse(os.Args[1:], func(err error) {
+		if errors.Is(err, http.ErrServerClosed) {
+			os.Exit(0)
+		}
+		log.Fatal(err)
+	})
+}
--- a/cmd/pkgserver/main_test.go
+++ b/cmd/pkgserver/main_test.go
@@ -0,0 +1,96 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"reflect"
+	"testing"
+)
+
+// newIndex returns the address of a newly populated packageIndex.
+func newIndex(t *testing.T) *packageIndex {
+	t.Helper()
+
+	var index packageIndex
+	if err := index.populate(nil, nil); err != nil {
+		t.Fatalf("populate: error = %v", err)
+	}
+	return &index
+}
+
+// checkStatus checks response status code.
+func checkStatus(t *testing.T, resp *http.Response, want int) {
+	t.Helper()
+
+	if resp.StatusCode != want {
+		t.Errorf(
+			"StatusCode: %s, want %s",
+			http.StatusText(resp.StatusCode),
+			http.StatusText(want),
+		)
+	}
+}
+
+// checkHeader checks the value of a header entry.
+func checkHeader(t *testing.T, h http.Header, key, want string) {
+	t.Helper()
+
+	if got := h.Get(key); got != want {
+		t.Errorf("%s: %q, want %q", key, got, want)
+	}
+}
+
+// checkAPIHeader checks common entries set for API endpoints.
+func checkAPIHeader(t *testing.T, h http.Header) {
+	t.Helper()
+
+	checkHeader(t, h, "Content-Type", "application/json; charset=utf-8")
+	checkHeader(t, h, "Cache-Control", "no-cache, no-store, must-revalidate")
+	checkHeader(t, h, "Pragma", "no-cache")
+	checkHeader(t, h, "Expires", "0")
+}
+
+// checkPayloadFunc checks the JSON response of an API endpoint by passing it to f.
+func checkPayloadFunc[T any](
+	t *testing.T,
+	resp *http.Response,
+	f func(got *T) bool,
+) {
+	t.Helper()
+
+	var got T
+	r := io.Reader(resp.Body)
+	if testing.Verbose() {
+		var buf bytes.Buffer
+		r = io.TeeReader(r, &buf)
+		defer func() { t.Helper(); t.Log(buf.String()) }()
+	}
+	if err := json.NewDecoder(r).Decode(&got); err != nil {
+		t.Fatalf("Decode: error = %v", err)
+	}
+
+	if !f(&got) {
+		t.Errorf("Body: %#v", got)
+	}
+}
+
+// checkPayload checks the JSON response of an API endpoint.
+func checkPayload[T any](t *testing.T, resp *http.Response, want T) {
+	t.Helper()
+
+	checkPayloadFunc(t, resp, func(got *T) bool {
+		return reflect.DeepEqual(got, &want)
+	})
+}
+
+func checkError(t *testing.T, resp *http.Response, error string, code int) {
+	t.Helper()
+
+	checkStatus(t, resp, code)
+	if got, _ := io.ReadAll(resp.Body); string(got) != fmt.Sprintln(error) {
+		t.Errorf("Body: %q, want %q", string(got), error)
+	}
+}
--- a/cmd/pkgserver/search.go
+++ b/cmd/pkgserver/search.go
@@ -0,0 +1,77 @@
+package main
+
+import (
+	"cmp"
+	"maps"
+	"regexp"
+	"slices"
+	"time"
+)
+
+type searchCache map[string]searchCacheEntry
+type searchResult struct {
+	NameIndices [][]int `json:"name_matches"`
+	DescIndices [][]int `json:"desc_matches,omitempty"`
+	Score       float64 `json:"score"`
+	*metadata
+}
+type searchCacheEntry struct {
+	query   string
+	results []searchResult
+	expiry  time.Time
+}
+
+func (index *packageIndex) performSearchQuery(limit int, i int, search string, desc bool) (int, []searchResult, error) {
+	entry, ok := index.search[search]
+	if ok {
+		return len(entry.results), entry.results[i:min(i+limit, len(entry.results))], nil
+	}
+
+	regex, err := regexp.Compile(search)
+	if err != nil {
+		return 0, make([]searchResult, 0), err
+	}
+	res := make([]searchResult, 0)
+	for p := range maps.Values(index.names) {
+		nameIndices := regex.FindAllIndex([]byte(p.Name), -1)
+		var descIndices [][]int = nil
+		if desc {
+			descIndices = regex.FindAllIndex([]byte(p.Description), -1)
+		}
+		if nameIndices == nil && descIndices == nil {
+			continue
+		}
+		score := float64(indexsum(nameIndices)) / (float64(len(nameIndices)) + 1)
+		if desc {
+			score += float64(indexsum(descIndices)) / (float64(len(descIndices)) + 1) / 10.0
+		}
+		res = append(res, searchResult{
+			NameIndices: nameIndices,
+			DescIndices: descIndices,
+			Score:       score,
+			metadata:    p,
+		})
+	}
+	slices.SortFunc(res[:], func(a, b searchResult) int { return -cmp.Compare(a.Score, b.Score) })
+	expiry := time.Now().Add(1 * time.Minute)
+	entry = searchCacheEntry{
+		query:   search,
+		results: res,
+		expiry:  expiry,
+	}
+	index.search[search] = entry
+
+	return len(res), res[i:min(i+limit, len(entry.results))], nil
+}
+func (s *searchCache) clean() {
+	maps.DeleteFunc(*s, func(_ string, v searchCacheEntry) bool {
+		return v.expiry.Before(time.Now())
+	})
+}
+func indexsum(in [][]int) int {
+	sum := 0
+	for i := 0; i < len(in); i++ {
+		sum += in[i][1] - in[i][0]
+	}
+	return sum
+}
--- a/cmd/pkgserver/test_ui.go
+++ b/cmd/pkgserver/test_ui.go
@@ -0,0 +1,97 @@
+//go:build frontend && frontend_test
+
+package main
+
+import (
+	"embed"
+	"net/http"
+	"path"
+	"strings"
+)
+
+//go:generate tsc -p ui_test
+//go:generate sass ui_test/lib/ui.scss ui_test/lib/ui.css
+//go:embed ui_test/*
+var test_content embed.FS
+
+func serveTestWebUI(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	w.Header().Set("X-XSS-Protection", "1")
+	w.Header().Set("X-Frame-Options", "DENY")
+
+	http.ServeFileFS(w, r, test_content, "ui_test/lib/ui.html")
+}
+
+func serveTestWebUIStaticContent(w http.ResponseWriter, r *http.Request) {
+	switch r.URL.Path {
+	case "/testui/style.css":
+		http.ServeFileFS(w, r, test_content, "ui_test/lib/ui.css")
+	case "/testui/skip-closed.svg":
+		http.ServeFileFS(w, r, test_content, "ui_test/lib/skip-closed.svg")
+	case "/testui/skip-open.svg":
+		http.ServeFileFS(w, r, test_content, "ui_test/lib/skip-open.svg")
+	case "/testui/success-closed.svg":
+		http.ServeFileFS(w, r, test_content, "ui_test/lib/success-closed.svg")
+	case "/testui/success-open.svg":
+		http.ServeFileFS(w, r, test_content, "ui_test/lib/success-open.svg")
+	case "/testui/failure-closed.svg":
+		http.ServeFileFS(w, r, test_content, "ui_test/lib/failure-closed.svg")
+	case "/testui/failure-open.svg":
+		http.ServeFileFS(w, r, test_content, "ui_test/lib/failure-open.svg")
+	default:
+		http.NotFound(w, r)
+	}
+}
+
+func serveTestLibrary(w http.ResponseWriter, r *http.Request) {
+	switch r.URL.Path {
+	case "/test/lib/test.js":
+		http.ServeFileFS(w, r, test_content, "ui_test/lib/test.js")
+	default:
+		http.NotFound(w, r)
+	}
+}
+
+func serveTests(w http.ResponseWriter, r *http.Request) {
+	if r.URL.Path == "/test/" {
+		http.Redirect(w, r, "/test.html", http.StatusMovedPermanently)
+		return
+	}
+	testPath := strings.TrimPrefix(r.URL.Path, "/test/")
+
+	if path.Ext(testPath) != ".js" {
+		http.Error(w, "403 forbidden", http.StatusForbidden)
+	}
+
+	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+	w.Header().Set("Pragma", "no-cache")
+	w.Header().Set("Expires", "0")
+
+	http.ServeFileFS(w, r, test_content, "ui_test/"+testPath)
+}
+
+func redirectUI(w http.ResponseWriter, r *http.Request) {
+	// The base path should not redirect to the root.
+	if r.URL.Path == "/ui/" {
+		http.NotFound(w, r)
+		return
+	}
+	if path.Ext(r.URL.Path) != ".js" {
+		http.Error(w, "403 forbidden", http.StatusForbidden)
+		return
+	}
+
+	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+	w.Header().Set("Pragma", "no-cache")
+	w.Header().Set("Expires", "0")
+
+	http.Redirect(w, r, strings.TrimPrefix(r.URL.Path, "/ui"), http.StatusFound)
+}
+
+func testUiRoutes(mux *http.ServeMux) {
+	mux.HandleFunc("GET /test.html", serveTestWebUI)
+	mux.HandleFunc("GET /testui/", serveTestWebUIStaticContent)
+	mux.HandleFunc("GET /test/lib", serveTestLibrary)
+	mux.HandleFunc("GET /test/", serveTests)
+	mux.HandleFunc("GET /ui/", redirectUI)
+}
--- a/cmd/pkgserver/test_ui_stub.go
+++ b/cmd/pkgserver/test_ui_stub.go
@@ -0,0 +1,7 @@
+//go:build !(frontend && frontend_test)
+
+package main
+
+import "net/http"
+
+func testUiRoutes(mux *http.ServeMux) {}
--- a/cmd/pkgserver/ui.go
+++ b/cmd/pkgserver/ui.go
@@ -0,0 +1,38 @@
+package main
+
+import "net/http"
+
+func serveWebUI(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+	w.Header().Set("Pragma", "no-cache")
+	w.Header().Set("Expires", "0")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	w.Header().Set("X-XSS-Protection", "1")
+	w.Header().Set("X-Frame-Options", "DENY")
+
+	http.ServeFileFS(w, r, content, "ui/index.html")
+}
+func serveStaticContent(w http.ResponseWriter, r *http.Request) {
+	switch r.URL.Path {
+	case "/static/style.css":
+		darkTheme := r.CookiesNamed("dark_theme")
+		if len(darkTheme) > 0 && darkTheme[0].Value == "true" {
+			http.ServeFileFS(w, r, content, "ui/static/dark.css")
+		} else {
+			http.ServeFileFS(w, r, content, "ui/static/light.css")
+		}
+	case "/favicon.ico":
+		http.ServeFileFS(w, r, content, "ui/static/favicon.ico")
+	case "/static/index.js":
+		http.ServeFileFS(w, r, content, "ui/static/index.js")
+	default:
+		http.NotFound(w, r)
+
+	}
+}
+
+func uiRoutes(mux *http.ServeMux) {
+	mux.HandleFunc("GET /{$}", serveWebUI)
+	mux.HandleFunc("GET /favicon.ico", serveStaticContent)
+	mux.HandleFunc("GET /static/", serveStaticContent)
+}
--- a/cmd/pkgserver/ui/index.html
+++ b/cmd/pkgserver/ui/index.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <link rel="stylesheet" href="static/style.css">
+    <title>Hakurei PkgServer</title>
+    <script src="static/index.js"></script>
+</head>
+<body>
+<h1>Hakurei PkgServer</h1>
+
+<table id="pkg-list">
+    <tr><td>Loading...</td></tr>
+</table>
+<p>Showing entries <span id="entry-counter"></span>.</p>
+<span class="bottom-nav"><a href="javascript:prevPage()">&laquo; Previous</a> <span id="page-number">1</span> <a href="javascript:nextPage()">Next &raquo;</a></span>
+<span><label for="count">Entries per page: </label><select name="count" id="count">
+    <option value="10">10</option>
+    <option value="20">20</option>
+    <option value="30">30</option>
+    <option value="50">50</option>
+</select></span>
+<span><label for="sort">Sort by: </label><select name="sort" id="sort">
+    <option value="0">Definition (ascending)</option>
+    <option value="1">Definition (descending)</option>
+    <option value="2">Name (ascending)</option>
+    <option value="3">Name (descending)</option>
+    <option value="4">Size (ascending)</option>
+    <option value="5">Size (descending)</option>
+</select></span>
+</body>
+<footer>
+    <p>&copy;<a href="https://hakurei.app/">Hakurei</a> (<span id="hakurei-version">unknown</span>). Licensed under the MIT license.</p>
+</footer>
+</html>
--- a/cmd/pkgserver/ui/static/_common.scss
+++ b/cmd/pkgserver/ui/static/_common.scss
--- a/cmd/pkgserver/ui/static/dark.scss
+++ b/cmd/pkgserver/ui/static/dark.scss
@@ -0,0 +1,6 @@
+@use 'common';
+
+html {
+  background-color: #2c2c2c;
+  color: ghostwhite;
+}
--- a/cmd/pkgserver/ui/static/favicon.ico
+++ b/cmd/pkgserver/ui/static/favicon.ico
--- a/cmd/pkgserver/ui/static/index.ts
+++ b/cmd/pkgserver/ui/static/index.ts
@@ -0,0 +1,161 @@
+function assertGetElementById(id: string): HTMLElement {
+    let elem = document.getElementById(id)
+    if(elem == null) throw new ReferenceError(`element with ID '${id}' missing from DOM`)
+    return elem
+}
+
+interface PackageIndexEntry {
+    name: string
+    size: number | null
+    description: string | null
+    website: string | null
+    version: string | null
+    report:  boolean
+}
+function toHTML(entry: PackageIndexEntry): HTMLTableRowElement {
+    let v = entry.version != null ? `<span>${escapeHtml(entry.version)}</span>` : ""
+    let s = entry.size != null ? `<p>Size: ${toByteSizeString(entry.size)} (${entry.size})</p>` : ""
+    let d = entry.description != null ? `<p>${escapeHtml(entry.description)}</p>` : ""
+    let w = entry.website != null ? `<a href="${encodeURI(entry.website)}">Website</a>` : ""
+    let r = entry.report ? `Log (<a href=\"${encodeURI('/api/v1/status/' + entry.name)}\">View</a> | <a href=\"${encodeURI('/status/' + entry.name)}\">Download</a>)` : ""
+    let row = <HTMLTableRowElement>(document.createElement('tr'))
+    row.innerHTML = `<td>
+            <h2>${escapeHtml(entry.name)} ${v}</h2>
+            ${d}
+            ${s}
+            ${w}
+            ${r}
+        </td>`
+    return row
+}
+
+function toByteSizeString(bytes: number): string {
+    if(bytes == null || bytes < 1024) return `${bytes}B`
+    if(bytes < Math.pow(1024, 2)) return `${(bytes/1024).toFixed(2)}kiB`
+    if(bytes < Math.pow(1024, 3)) return `${(bytes/Math.pow(1024, 2)).toFixed(2)}MiB`
+    if(bytes < Math.pow(1024, 4)) return `${(bytes/Math.pow(1024, 3)).toFixed(2)}GiB`
+    if(bytes < Math.pow(1024, 5)) return `${(bytes/Math.pow(1024, 4)).toFixed(2)}TiB`
+    return "not only is it big, it's large"
+}
+
+const API_VERSION = 1
+const ENDPOINT = `/api/v${API_VERSION}`
+interface InfoPayload {
+    count: number
+    hakurei_version: string
+}
+
+async function infoRequest(): Promise<InfoPayload> {
+    const res = await fetch(`${ENDPOINT}/info`)
+    const payload = await res.json()
+    return payload
+}
+interface GetPayload {
+    values: PackageIndexEntry[]
+}
+
+enum SortOrders {
+    DeclarationAscending,
+    DeclarationDescending,
+    NameAscending,
+    NameDescending
+}
+async function getRequest(limit: number, index: number, sort: SortOrders): Promise<GetPayload> {
+    const res = await fetch(`${ENDPOINT}/get?limit=${limit}&index=${index}&sort=${sort.valueOf()}`)
+    const payload = await res.json()
+    return payload
+}
+class State {
+    entriesPerPage: number = 10
+    entryIndex: number = 0
+    maxEntries: number = 0
+    sort: SortOrders = SortOrders.DeclarationAscending
+
+    getEntriesPerPage(): number {
+        return this.entriesPerPage
+    }
+    setEntriesPerPage(entriesPerPage: number) {
+        this.entriesPerPage = entriesPerPage
+        this.setEntryIndex(Math.floor(this.getEntryIndex() / entriesPerPage) * entriesPerPage)
+    }
+    getEntryIndex(): number {
+        return this.entryIndex
+    }
+    setEntryIndex(entryIndex: number) {
+        this.entryIndex = entryIndex
+        this.updatePage()
+        this.updateRange()
+        this.updateListings()
+    }
+    getMaxEntries(): number {
+        return this.maxEntries
+    }
+    setMaxEntries(max: number) {
+        this.maxEntries = max
+    }
+    getSortOrder(): SortOrders {
+        return this.sort
+    }
+    setSortOrder(sortOrder: SortOrders) {
+        this.sort = sortOrder
+        this.setEntryIndex(0)
+    }
+    updatePage() {
+        let page = Math.ceil(((this.getEntryIndex() + this.getEntriesPerPage()) - 1) / this.getEntriesPerPage())
+        assertGetElementById("page-number").innerText = String(page)
+    }
+    updateRange() {
+        let max = Math.min(this.getEntryIndex() + this.getEntriesPerPage(), this.getMaxEntries())
+        assertGetElementById("entry-counter").innerText = `${this.getEntryIndex() + 1}-${max} of ${this.getMaxEntries()}`
+    }
+    updateListings() {
+        getRequest(this.getEntriesPerPage(), this.getEntryIndex(), this.getSortOrder())
+            .then(res => {
+                let table = assertGetElementById("pkg-list")
+                table.innerHTML = ''
+                res.values.forEach((row) => {
+                    table.appendChild(toHTML(row))
+                })
+            })
+    }
+
+}
+
+let STATE: State
+
+function prevPage() {
+    let index = STATE.getEntryIndex()
+    STATE.setEntryIndex(Math.max(0, index - STATE.getEntriesPerPage()))
+}
+function nextPage() {
+    let index = STATE.getEntryIndex()
+    STATE.setEntryIndex(Math.min((Math.ceil(STATE.getMaxEntries() / STATE.getEntriesPerPage()) * STATE.getEntriesPerPage()) - STATE.getEntriesPerPage(), index + STATE.getEntriesPerPage()))
+}
+
+function escapeHtml(str: string): string {
+    if(str === undefined) return ""
+    return str
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&apos;')
+}
+
+document.addEventListener("DOMContentLoaded", () => {
+    STATE = new State()
+    infoRequest()
+        .then(res => {
+            STATE.setMaxEntries(res.count)
+            assertGetElementById("hakurei-version").innerText = res.hakurei_version
+            STATE.updateRange()
+            STATE.updateListings()
+        })
+
+    assertGetElementById("count").addEventListener("change", (event) => {
+        STATE.setEntriesPerPage(parseInt((event.target as HTMLSelectElement).value))
+    })
+    assertGetElementById("sort").addEventListener("change", (event) => {
+        STATE.setSortOrder(parseInt((event.target as HTMLSelectElement).value))
+    })
+})
--- a/cmd/pkgserver/ui/static/light.scss
+++ b/cmd/pkgserver/ui/static/light.scss
@@ -0,0 +1,6 @@
+@use 'common';
+
+html {
+  background-color: #d3d3d3;
+  color: black;
+}
--- a/cmd/pkgserver/ui/static/tsconfig.json
+++ b/cmd/pkgserver/ui/static/tsconfig.json
@@ -0,0 +1,6 @@
+{
+  "compilerOptions": {
+    "strict": true,
+    "target": "ES2024"
+  }
+}
--- a/cmd/pkgserver/ui_full.go
+++ b/cmd/pkgserver/ui_full.go
@@ -0,0 +1,9 @@
+//go:build frontend
+
+package main
+
+import "embed"
+
+//go:generate sh -c "sass ui/static/dark.scss ui/static/dark.css && sass ui/static/light.scss ui/static/light.css && tsc -p ui/static"
+//go:embed ui/*
+var content embed.FS
--- a/cmd/pkgserver/ui_stub.go
+++ b/cmd/pkgserver/ui_stub.go
@@ -0,0 +1,7 @@
+//go:build !frontend
+
+package main
+
+import "testing/fstest"
+
+var content fstest.MapFS
--- a/cmd/pkgserver/ui_test/all_tests.ts
+++ b/cmd/pkgserver/ui_test/all_tests.ts
@@ -0,0 +1,2 @@
+// Import all test files to execute their suite registrations.
+import "./test_tests.js";
--- a/cmd/pkgserver/ui_test/lib/cli.ts
+++ b/cmd/pkgserver/ui_test/lib/cli.ts
@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+
+// Many editors have terminal emulators built in, so running tests with NodeJS
+// provides faster iteration, especially for those acclimated to test-driven
+// development.
+
+import "../all_tests.js";
+import { StreamReporter, TESTS } from "./test.js";
+
+// TypeScript doesn't like process and Deno as their type definitions aren't
+// installed, but doesn't seem to complain if they're accessed through
+// globalThis.
+const process: any = (globalThis as any).process;
+const Deno: any = (globalThis as any).Deno;
+
+function getArgs(): string[] {
+    if (process) {
+        const [runtime, program, ...args] = process.argv;
+        return args;
+    }
+    if (Deno) return Deno.args;
+    return [];
+}
+
+function exit(code?: number): never {
+    if (Deno) Deno.exit(code);
+    if (process) process.exit(code);
+    throw `exited with code ${code ?? 0}`;
+}
+
+const args = getArgs();
+let verbose = false;
+if (args.length > 1) {
+    console.error("Too many arguments");
+    exit(1);
+}
+if (args.length === 1) {
+    if (args[0] === "-v" || args[0] === "--verbose" || args[0] === "-verbose") {
+        verbose = true;
+    } else if (args[0] !== "--") {
+        console.error(`Unknown argument '${args[0]}'`);
+        exit(1);
+    }
+}
+
+let reporter = new StreamReporter({ writeln: console.log }, verbose);
+TESTS.run(reporter);
+exit(reporter.succeeded() ? 0 : 1);
--- a/cmd/pkgserver/ui_test/lib/failure-closed.svg
+++ b/cmd/pkgserver/ui_test/lib/failure-closed.svg
@@ -0,0 +1,13 @@
+<?xml version="1.0"?>
+<!-- See failure-open.svg for an explanation of the view box dimensions. -->
+<svg xmlns="http://www.w3.org/2000/svg" width="20" viewBox="-20,-20 160 130">
+    <!-- This triangle should match success-closed.svg, fill and stroke color notwithstanding. -->
+    <polygon points="0,0 100,50 0,100" fill="red" stroke="red" stroke-width="15" stroke-linejoin="round"/>
+    <!--
+     ! y-coordinates go before x-coordinates here to highlight the difference
+     ! (or, lack thereof) between these numbers and the ones in failure-open.svg;
+     ! try a textual diff. Make sure to keep the numbers in sync!
+     -->
+    <line y1="30" x1="10" y2="70" x2="50" stroke="white" stroke-width="16"/>
+    <line y1="30" x1="50" y2="70" x2="10" stroke="white" stroke-width="16"/>
+</svg>
--- a/cmd/pkgserver/ui_test/lib/failure-open.svg
+++ b/cmd/pkgserver/ui_test/lib/failure-open.svg
@@ -0,0 +1,35 @@
+<?xml version="1.0"?>
+<!--
+ ! This view box is a bit weird: the strokes assume they're working in a view
+ ! box that spans from the (0,0) to (100,100), and indeed that is convenient
+ ! conceptualizing the strokes, but the stroke itself has a considerable width
+ ! that gets clipped by restrictive view box dimensions. Hence, the view is
+ ! shifted from (0,0)–(100,100) to (-20,-20)–(120,120), to make room for the
+ ! clipped stroke, while leaving behind an illusion of working in a view box
+ ! spanning from (0,0) to (100,100).
+ !
+ ! However, the resulting SVG is too close to the summary text, and CSS
+ ! properties to add padding do not seem to work with `content:` (likely because
+ ! they're anonymous replaced elements); thus, the width of the view is
+ ! increased considerably to provide padding in the SVG itself, while leaving
+ ! the strokes oblivious.
+ !
+ ! It gets worse: the summary text isn't vertically aligned with the icon! As
+ ! a flexbox cannot be used in a summary to align the marker with the text, the
+ ! simplest and most effective solution is to reduce the height of the view box
+ ! from 140 to 130, thereby removing some of the bottom padding present.
+ !
+ ! All six SVGs use the same view box (and indeed, they refer to this comment)
+ ! so that they all appear to be the same size and position relative to each
+ ! other on the DOM—indeed, the view box dimensions, alongside the width,
+ ! directly control their placement on the DOM.
+ !
+ ! TL;DR: CSS is janky, overflow is weird, and SVG is awesome!
+ -->
+<svg xmlns="http://www.w3.org/2000/svg" width="20" viewBox="-20,-20 160 130">
+    <!-- This triangle should match success-open.svg, fill and stroke color notwithstanding. -->
+    <polygon points="0,0 100,0 50,100" fill="red" stroke="red" stroke-width="15" stroke-linejoin="round"/>
+    <!-- See the comment in failure-closed.svg before modifying this. -->
+    <line x1="30" y1="10" x2="70" y2="50" stroke="white" stroke-width="16"/>
+    <line x1="30" y1="50" x2="70" y2="10" stroke="white" stroke-width="16"/>
+</svg>
--- a/cmd/pkgserver/ui_test/lib/go_test_entrypoint.ts
+++ b/cmd/pkgserver/ui_test/lib/go_test_entrypoint.ts
@@ -0,0 +1,3 @@
+import "../all_tests.js";
+import { GoTestReporter, TESTS } from "./test.js";
+TESTS.run(new GoTestReporter());
--- a/cmd/pkgserver/ui_test/lib/skip-closed.svg
+++ b/cmd/pkgserver/ui_test/lib/skip-closed.svg
@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+<!-- See failure-open.svg for an explanation of the view box dimensions. -->
+<svg xmlns="http://www.w3.org/2000/svg" width="20" viewBox="-20,-20 160 130">
+    <!-- This triangle should match success-closed.svg, fill and stroke color notwithstanding. -->
+    <polygon points="0,0 100,50 0,100" fill="blue" stroke="blue" stroke-width="15" stroke-linejoin="round"/>
+    <!--
+     ! This path is extremely similar to the one in skip-open.svg; before
+     ! making minor modifications, diff the two to understand how they should
+     ! remain in sync.
+     -->
+    <path
+        d="M 50,50
+           A 23,23 270,1,1 30,30
+           l -10,20
+           m 10,-20
+           l -20,-10"
+        fill="none"
+        stroke="white"
+        stroke-width="12"
+        stroke-linejoin="round"/>
+</svg>
--- a/cmd/pkgserver/ui_test/lib/skip-open.svg
+++ b/cmd/pkgserver/ui_test/lib/skip-open.svg
@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+<!-- See failure-open.svg for an explanation of the view box dimensions. -->
+<svg xmlns="http://www.w3.org/2000/svg" width="20" viewBox="-20,-20 160 130">
+    <!-- This triangle should match success-open.svg, fill and stroke color notwithstanding. -->
+    <polygon points="0,0 100,0 50,100" fill="blue" stroke="blue" stroke-width="15" stroke-linejoin="round"/>
+    <!--
+     ! This path is extremely similar to the one in skip-closed.svg; before
+     ! making minor modifications, diff the two to understand how they should
+     ! remain in sync.
+     -->
+    <path
+        d="M 50,50
+           A 23,23 270,1,1 70,30
+           l 10,-20
+           m -10,20
+           l -20,-10"
+        fill="none"
+        stroke="white"
+        stroke-width="12"
+        stroke-linejoin="round"/>
+</svg>
--- a/cmd/pkgserver/ui_test/lib/success-closed.svg
+++ b/cmd/pkgserver/ui_test/lib/success-closed.svg
@@ -0,0 +1,16 @@
+<?xml version="1.0"?>
+<!-- See failure-open.svg for an explanation of the view box dimensions. -->
+<svg xmlns="http://www.w3.org/2000/svg" width="20" viewBox="-20,-20 160 130">
+    <style>
+    .adaptive-stroke {
+        stroke: black;
+    }
+    @media (prefers-color-scheme: dark) {
+        .adaptive-stroke {
+            stroke: ghostwhite;
+        }
+    }
+    </style>
+    <!-- When updating this triangle, also update the other five SVGs. -->
+    <polygon points="0,0 100,50 0,100" fill="none" class="adaptive-stroke" stroke-width="15" stroke-linejoin="round"/>
+</svg>
--- a/cmd/pkgserver/ui_test/lib/success-open.svg
+++ b/cmd/pkgserver/ui_test/lib/success-open.svg
@@ -0,0 +1,16 @@
+<?xml version="1.0"?>
+<!-- See failure-open.svg for an explanation of the view box dimensions. -->
+<svg xmlns="http://www.w3.org/2000/svg" width="20" viewBox="-20,-20 160 130">
+    <style>
+    .adaptive-stroke {
+        stroke: black;
+    }
+    @media (prefers-color-scheme: dark) {
+        .adaptive-stroke {
+            stroke: ghostwhite;
+        }
+    }
+    </style>
+    <!-- When updating this triangle, also update the other five SVGs. -->
+    <polygon points="0,0 100,0 50,100" fill="none" class="adaptive-stroke" stroke-width="15" stroke-linejoin="round"/>
+</svg>
--- a/cmd/pkgserver/ui_test/lib/test.ts
+++ b/cmd/pkgserver/ui_test/lib/test.ts
@@ -0,0 +1,400 @@
+// =============================================================================
+// DSL
+
+type TestTree = TestGroup | Test;
+type TestGroup = { name: string, children: TestTree[] };
+type Test = { name: string, test: (t: TestController) => void };
+
+export class TestRegistrar {
+    #suites: TestGroup[];
+
+    constructor() {
+        this.#suites = [];
+    }
+
+    suite(name: string, children: TestTree[]) {
+        checkDuplicates(name, children)
+        this.#suites.push({ name, children });
+    }
+
+    run(reporter: Reporter) {
+        reporter.register(this.#suites);
+        for (const suite of this.#suites) {
+            for (const c of suite.children) runTests(reporter, [suite.name], c);
+        }
+        reporter.finalize();
+    }
+}
+
+export let TESTS = new TestRegistrar();
+
+// Register a suite in the global registrar.
+export function suite(name: string, children: TestTree[]) {
+    TESTS.suite(name, children);
+}
+
+export function context(name: string, children: TestTree[]): TestTree {
+    checkDuplicates(name, children);
+    return { name, children };
+}
+export const group = context;
+
+export function test(name: string, test: (t: TestController) => void): TestTree {
+    return { name, test };
+}
+
+function checkDuplicates(parent: string, names: { name: string }[]) {
+    let seen = new Set<string>();
+    for (const { name } of names) {
+        if (seen.has(name)) {
+            throw new RangeError(`duplicate name '${name}' in '${parent}'`);
+        }
+        seen.add(name);
+    }
+}
+
+export type TestState = "success" | "failure" | "skip";
+
+class AbortSentinel {}
+
+export class TestController {
+    #state: TestState;
+    logs: string[];
+
+    constructor() {
+        this.#state = "success";
+        this.logs = [];
+    }
+
+    getState(): TestState {
+        return this.#state;
+    }
+
+    fail() {
+        this.#state = "failure";
+    }
+
+    failed(): boolean {
+        return this.#state === "failure";
+    }
+
+    failNow(): never {
+        this.fail();
+        throw new AbortSentinel();
+    }
+
+    log(message: string) {
+        this.logs.push(message);
+    }
+
+    error(message: string) {
+        this.log(message);
+        this.fail();
+    }
+
+    fatal(message: string): never {
+        this.log(message);
+        this.failNow();
+    }
+
+    skip(message?: string): never {
+        if (message != null) this.log(message);
+        if (this.#state !== "failure") this.#state = "skip";
+        throw new AbortSentinel();
+    }
+
+    skipped(): boolean {
+        return this.#state === "skip";
+    }
+}
+
+// =============================================================================
+// Execution
+
+export interface TestResult {
+    state: TestState;
+    logs: string[];
+}
+
+function runTests(reporter: Reporter, parents: string[], node: TestTree) {
+    const path = [...parents, node.name];
+    if ("children" in node) {
+        for (const c of node.children) runTests(reporter, path, c);
+        return;
+    }
+    let controller = new TestController();
+    try {
+        node.test(controller);
+    } catch (e) {
+        if (!(e instanceof AbortSentinel)) {
+            controller.error(extractExceptionString(e));
+        }
+    }
+    reporter.update(path, { state: controller.getState(), logs: controller.logs });
+}
+
+function extractExceptionString(e: any): string {
+    // String() instead of .toString() as null and undefined don't have
+    // properties.
+    const s = String(e);
+    if (!(e instanceof Error && e.stack)) return s;
+    // v8 (Chromium, NodeJS) includes the error message, while Firefox and
+    // WebKit do not.
+    if (e.stack.startsWith(s)) return e.stack;
+    return `${s}\n${e.stack}`;
+}
+
+// =============================================================================
+// Reporting
+
+export interface Reporter {
+    register(suites: TestGroup[]): void
+    update(path: string[], result: TestResult): void;
+    finalize(): void;
+}
+
+export class NoOpReporter implements Reporter {
+    suites: TestGroup[];
+    results: ({ path: string[] } & TestResult)[];
+    finalized: boolean;
+
+    constructor() {
+        this.suites = [];
+        this.results = [];
+        this.finalized = false;
+    }
+
+    register(suites: TestGroup[]) {
+        this.suites = suites;
+    }
+
+    update(path: string[], result: TestResult) {
+        this.results.push({ path, ...result });
+    }
+
+    finalize() {
+        this.finalized = true;
+    }
+}
+
+export interface Stream {
+    writeln(s: string): void;
+}
+
+const SEP = " ❯ ";
+
+export class StreamReporter implements Reporter {
+    stream: Stream;
+    verbose: boolean;
+    #successes: ({ path: string[] } & TestResult)[];
+    #failures: ({ path: string[] } & TestResult)[];
+    #skips: ({ path: string[] } & TestResult)[];
+
+    constructor(stream: Stream, verbose: boolean = false) {
+        this.stream = stream;
+        this.verbose = verbose;
+        this.#successes = [];
+        this.#failures = [];
+        this.#skips = [];
+    }
+
+    succeeded(): boolean {
+        return this.#successes.length > 0 && this.#failures.length === 0;
+    }
+
+    register(suites: TestGroup[]) {}
+
+    update(path: string[], result: TestResult) {
+        if (path.length === 0) throw new RangeError("path is empty");
+        const pathStr = path.join(SEP);
+        switch (result.state) {
+        case "success":
+            this.#successes.push({ path, ...result });
+            if (this.verbose) this.stream.writeln(`✅️ ${pathStr}`);
+            break;
+        case "failure":
+            this.#failures.push({ path, ...result });
+            this.stream.writeln(`⚠️ ${pathStr}`);
+            break;
+        case "skip":
+            this.#skips.push({ path, ...result });
+            this.stream.writeln(`⏭️ ${pathStr}`);
+            break;
+        }
+    }
+
+    finalize() {
+        if (this.verbose) this.#displaySection("successes", this.#successes, true);
+        this.#displaySection("failures", this.#failures);
+        this.#displaySection("skips", this.#skips);
+        this.stream.writeln("");
+        this.stream.writeln(
+            `${this.#successes.length} succeeded, ${this.#failures.length} failed`
+            + (this.#skips.length ? `, ${this.#skips.length} skipped` : "")
+        );
+    }
+
+    #displaySection(name: string, data: ({ path: string[] } & TestResult)[], ignoreEmpty: boolean = false) {
+        if (!data.length) return;
+
+        // Transform [{ path: ["a", "b", "c"] }, { path: ["a", "b", "d"] }]
+        // into { "a ❯ b": ["c", "d"] }.
+        let pathMap = new Map<string, ({ name: string } & TestResult)[]>();
+        for (const t of data) {
+            if (t.path.length === 0) throw new RangeError("path is empty");
+            const key = t.path.slice(0, -1).join(SEP);
+            if (!pathMap.has(key)) pathMap.set(key, []);
+            pathMap.get(key)!.push({ name: t.path.at(-1)!, ...t });
+        }
+
+        this.stream.writeln("");
+        this.stream.writeln(name.toUpperCase());
+        this.stream.writeln("=".repeat(name.length));
+
+        for (let [path, tests] of pathMap) {
+            if (ignoreEmpty) tests = tests.filter((t) => t.logs.length);
+            if (tests.length === 0) continue;
+            if (tests.length === 1) {
+                this.#writeOutput(tests[0], path ? `${path}${SEP}` : "", false);
+            } else {
+                this.stream.writeln(path);
+                for (const t of tests) this.#writeOutput(t, "  - ", true);
+            }
+        }
+    }
+
+    #writeOutput(test: { name: string } & TestResult, prefix: string, nested: boolean) {
+        let output = "";
+        if (test.logs.length) {
+            // Individual logs might span multiple lines, so join them together
+            // then split it again.
+            const logStr = test.logs.join("\n");
+            const lines = logStr.split("\n");
+            if (lines.length <= 1) {
+                output = `: ${logStr}`;
+            } else {
+                const padding = nested ? "      " : "  ";
+                output = ":\n" + lines.map((line) => padding + line).join("\n");
+            }
+        }
+        this.stream.writeln(`${prefix}${test.name}${output}`);
+    }
+}
+
+function assertGetElementById(id: string): HTMLElement {
+    let elem = document.getElementById(id);
+    if (elem == null) throw new ReferenceError(`element with ID '${id}' missing from DOM`);
+    return elem;
+}
+
+export class DOMReporter implements Reporter {
+    register(suites: TestGroup[]) {}
+
+    update(path: string[], result: TestResult) {
+        if (path.length === 0) throw new RangeError("path is empty");
+        if (result.state === "skip") {
+            assertGetElementById("skip-counter-text").classList.remove("hidden");
+        }
+        const counter = assertGetElementById(`${result.state}-counter`);
+        counter.innerText = (Number(counter.innerText) + 1).toString();
+
+        let parent = assertGetElementById("root");
+        for (const node of path) {
+            let child: HTMLDetailsElement | null = null;
+            let summary: HTMLElement | null = null;
+            let d: Element;
+            outer: for (d of parent.children) {
+                if (!(d instanceof HTMLDetailsElement)) continue;
+                for (const s of d.children) {
+                    if (!(s instanceof HTMLElement)) continue;
+                    if (!(s.tagName === "SUMMARY" && s.innerText === node)) continue;
+                    child = d;
+                    summary = s;
+                    break outer;
+                }
+            }
+            if (!child) {
+                child = document.createElement("details");
+                child.className = "test-node";
+                child.ariaRoleDescription = "test";
+                summary = document.createElement("summary");
+                summary.appendChild(document.createTextNode(node));
+                summary.ariaRoleDescription = "test name";
+                child.appendChild(summary);
+                parent.appendChild(child);
+            }
+            if (!summary) throw new Error("unreachable as assigned above");
+
+            switch (result.state) {
+            case "failure":
+                child.open = true;
+                child.classList.add("failure");
+                child.classList.remove("skip");
+                child.classList.remove("success");
+                summary.setAttribute("aria-labelledby", "failure-description");
+                break;
+            case "skip":
+                if (child.classList.contains("failure")) break;
+                child.classList.add("skip");
+                child.classList.remove("success");
+                summary.setAttribute("aria-labelledby", "skip-description");
+                break;
+            case "success":
+                if (child.classList.contains("failure") || child.classList.contains("skip")) break;
+                child.classList.add("success");
+                summary.setAttribute("aria-labelledby", "success-description");
+                break;
+            }
+
+            parent = child;
+        }
+
+        const p = document.createElement("p");
+        p.classList.add("test-desc");
+        if (result.logs.length) {
+            const pre = document.createElement("pre");
+            pre.appendChild(document.createTextNode(result.logs.join("\n")));
+            p.appendChild(pre);
+        } else {
+            p.classList.add("italic");
+            p.appendChild(document.createTextNode("No output."));
+        }
+        parent.appendChild(p);
+    }
+
+    finalize() {}
+}
+
+interface GoNode {
+    name: string;
+    subtests: GoNode[] | null;
+}
+
+// Used to display results via `go test`, via some glue code from the Go side.
+export class GoTestReporter implements Reporter {
+    // Convert a test tree into the one expected by the Go code.
+    static serialize(node: TestTree): GoNode {
+        return {
+            name: node.name,
+            subtests: "children" in node ? node.children.map(GoTestReporter.serialize) : null,
+        };
+    }
+
+    register(suites: TestGroup[]) {
+        console.log(JSON.stringify(suites.map(GoTestReporter.serialize)));
+    }
+
+    update(path: string[], result: TestResult) {
+        let state: number;
+        switch (result.state) {
+            case "success": state = 0; break;
+            case "failure": state = 1; break;
+            case "skip": state = 2; break;
+        }
+        console.log(JSON.stringify({ path: path, state, logs: result.logs }));
+    }
+
+    finalize() {
+        console.log("null");
+    }
+}
--- a/cmd/pkgserver/ui_test/lib/ui.html
+++ b/cmd/pkgserver/ui_test/lib/ui.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <link rel="stylesheet" href="/testui/style.css">
+    <title>PkgServer Tests</title>
+</head>
+<body>
+<noscript>
+    I hate JavaScript as much as you, but this page runs tests written in
+    JavaScript to test the functionality of code written in JavaScript, so it
+    wouldn't make sense for it to work without JavaScript. <strong>Please turn
+    JavaScript on!</strong>
+</noscript>
+
+<h1>PkgServer Tests</h1>
+
+<main>
+<p id="counters">
+    <span id="success-counter">0</span> succeeded, <span id="failure-counter">0</span>
+    failed<span id="skip-counter-text" class="hidden">, <span id="skip-counter">0</span> skipped</span>.
+</p>
+
+<p hidden id="success-description">Successful test</p>
+<p hidden id="failure-description">Failed test</p>
+<p hidden id="skip-description">Partially or fully skipped test</p>
+
+<div id="root">
+</div>
+
+<script type="module">
+    import "/test/all_tests.js";
+    import { DOMReporter, TESTS } from "/test/lib/test.js";
+    TESTS.run(new DOMReporter());
+</script>
+</main>
+</body>
+</html>
--- a/cmd/pkgserver/ui_test/lib/ui.scss
+++ b/cmd/pkgserver/ui_test/lib/ui.scss
@@ -0,0 +1,87 @@
+:root {
+    --bg: #d3d3d3;
+    --fg: black;
+}
+
+@media (prefers-color-scheme: dark) {
+    :root {
+        --bg: #2c2c2c;
+        --fg: ghostwhite;
+    }
+}
+
+html {
+    background-color: var(--bg);
+    color: var(--fg);
+}
+
+h1, p, summary, noscript {
+    font-family: sans-serif;
+}
+
+noscript {
+    font-size: 16pt;
+}
+
+.root {
+    margin: 1rem 0;
+}
+
+details.test-node {
+    margin-left: 1rem;
+    padding: 0.2rem 0.5rem;
+    border-left: 2px dashed var(--fg);
+    > summary {
+        cursor: pointer;
+    }
+    &.success > summary::marker {
+        /*
+         * WebKit only supports color and font-size properties in ::marker [1],
+         * and its ::-webkit-details-marker only supports hiding the marker
+         * entirely [2], contrary to mdn's example [3]; thus, set a color as
+         * a fallback: while it may not be accessible for colorblind
+         * individuals, it's better than no indication of a test's state for
+         * anyone, as that there's no other way to include an indication in the
+         * marker on WebKit.
+         *
+         * [1]: https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Selectors/::marker#browser_compatibility
+         * [2]: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/summary#default_style
+         * [3]: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/summary#changing_the_summarys_icon
+         */
+        color: var(--fg);
+        content: url("/testui/success-closed.svg") / "success";
+    }
+    &.success[open] > summary::marker {
+        content: url("/testui/success-open.svg") / "success";
+    }
+    &.failure > summary::marker {
+        color: red;
+        content: url("/testui/failure-closed.svg") / "failure";
+    }
+    &.failure[open] > summary::marker {
+        content: url("/testui/failure-open.svg") / "failure";
+    }
+    &.skip > summary::marker {
+        color: blue;
+        content: url("/testui/skip-closed.svg") / "skip";
+    }
+    &.skip[open] > summary::marker {
+        content: url("/testui/skip-open.svg") / "skip";
+    }
+}
+
+p.test-desc {
+    margin: 0 0 0 1rem;
+    padding: 2px 0;
+    > pre {
+        margin: 0;
+    }
+}
+
+.hidden {
+    display: none;
+}
+
+.italic {
+    font-style: italic;
+}
--- a/cmd/pkgserver/ui_test/test_tests.ts
+++ b/cmd/pkgserver/ui_test/test_tests.ts
@@ -0,0 +1,85 @@
+import { NoOpReporter, TestRegistrar, context, group, suite, test } from "./lib/test.js";
+
+suite("dog", [
+    group("tail", [
+        test("wags when happy", (t) => {
+            if (0 / 0 !== Infinity / Infinity) {
+                t.fatal("undefined must not be defined");
+            }
+        }),
+        test("idle when down", (t) => {
+            t.log("test test");
+            t.error("dog whining noises go here");
+        }),
+    ]),
+    test("likes headpats", (t) => {
+        if (2 !== 2) {
+            t.error("IEEE 754 violated: 2 is NaN");
+        }
+    }),
+    context("near cat", [
+        test("is ecstatic", (t) => {
+            if (("b" + "a" + + "a" + "a").toLowerCase() === "banana") {
+                t.error("🍌🍌🍌");
+                t.error("🍌🍌🍌");
+                t.error("🍌🍌🍌");
+                t.failNow();
+            }
+        }),
+        test("playfully bites cats' tails", (t) => {
+            t.log("arf!");
+            throw new Error("nom");
+        }),
+    ]),
+]);
+
+suite("cat", [
+    test("likes headpats", (t) => {
+        t.log("meow");
+    }),
+    test("owns skipping rope", (t) => {
+        t.skip("this cat is stuck in your machine!");
+        t.log("never logged");
+    }),
+    test("tester tester", (t) => {
+        const r = new TestRegistrar();
+        r.suite("explod", [
+            test("with yarn", (t) => {
+                t.log("YAY");
+            }),
+        ]);
+        const reporter = new NoOpReporter();
+        r.run(reporter);
+        if (reporter.suites.length !== 1) {
+            t.fatal(`incorrect number of suites registered got=${reporter.suites.length} want=1`);
+        }
+        const suite = reporter.suites[0];
+        if (suite.name !== "explod") {
+            t.error(`suite name incorrect got='${suite.name}' want='explod'`);
+        }
+        if (suite.children.length !== 1) {
+            t.fatal(`incorrect number of suite children got=${suite.children.length} want=1`);
+        }
+        const test_ = suite.children[0];
+        if (test_.name !== "with yarn") {
+            t.error(`incorrect test name got='${test_.name}' want='with yarn'`);
+        }
+        if ("children" in test_) {
+            t.error(`expected leaf node, got group of ${test_.children.length} children`);
+        }
+        if (!reporter.finalized) t.error(`expected reporter to have been finalized`);
+        if (reporter.results.length !== 1) {
+            t.fatal(`incorrect result count got=${reporter.results.length} want=1`);
+        }
+        const result = reporter.results[0];
+        if (!(result.path.length === 2 &&
+              result.path[0] === "explod" &&
+              result.path[1] === "with yarn")) {
+            t.error(`incorrect result path got=${result.path} want=["explod", "with yarn"]`);
+        }
+        if (result.state !== "success") t.error(`expected test to succeed`);
+        if (!(result.logs.length === 1 && result.logs[0] === "YAY")) {
+            t.error(`incorrect result logs got=${result.logs} want=["YAY"]`);
+        }
+    }),
+]);
--- a/cmd/pkgserver/ui_test/tsconfig.json
+++ b/cmd/pkgserver/ui_test/tsconfig.json
@@ -0,0 +1,6 @@
+{
+  "compilerOptions": {
+    "strict": true,
+    "target": "ES2024"
+  }
+}
--- a/cmd/sharefs/fuse-operations.h
+++ b/cmd/sharefs/fuse-operations.h
@@ -7,8 +7,8 @@
 #endif

 #define SHAREFS_MEDIA_RW_ID (1 << 10) - 1 /* owning gid presented to userspace */
-#define SHAREFS_PERM_DIR 0700             /* permission bits for directories presented to userspace */
-#define SHAREFS_PERM_REG 0600             /* permission bits for regular files presented to userspace */
+#define SHAREFS_PERM_DIR 0770             /* permission bits for directories presented to userspace */
+#define SHAREFS_PERM_REG 0660             /* permission bits for regular files presented to userspace */
 #define SHAREFS_FORBIDDEN_FLAGS O_DIRECT  /* these open flags are cleared unconditionally */

 /* sharefs_private is populated by sharefs_init and contains process-wide context */
--- a/cmd/sharefs/fuse.go
+++ b/cmd/sharefs/fuse.go
@@ -19,7 +19,6 @@ import (
 	"encoding/gob"
 	"errors"
 	"fmt"
-	"io"
 	"log"
 	"os"
 	"os/exec"
@@ -470,13 +469,14 @@ func _main(s ...string) (exitCode int) {
 			os.NewFile(uintptr(C.fuse_session_fd(se)), "fuse"),
 		))

-		var setupWriter io.WriteCloser
-		if fd, w, err := container.Setup(&z.ExtraFiles); err != nil {
+		var setupPipe [2]*os.File
+		if r, w, err := os.Pipe(); err != nil {
 			log.Println(err)
 			return 5
 		} else {
-			z.Args = append(z.Args, "-osetup="+strconv.Itoa(fd))
-			setupWriter = w
+			z.Args = append(z.Args, "-osetup="+strconv.Itoa(3+len(z.ExtraFiles)))
+			z.ExtraFiles = append(z.ExtraFiles, r)
+			setupPipe[0], setupPipe[1] = r, w
 		}

 		if err := z.Start(); err != nil {
@@ -487,6 +487,9 @@ func _main(s ...string) (exitCode int) {
 			}
 			return 5
 		}
+		if err := setupPipe[0].Close(); err != nil {
+			log.Println(err)
+		}
 		if err := z.Serve(); err != nil {
 			if m, ok := message.GetMessage(err); ok {
 				log.Println(m)
@@ -496,10 +499,10 @@ func _main(s ...string) (exitCode int) {
 			return 5
 		}

-		if err := gob.NewEncoder(setupWriter).Encode(&setup); err != nil {
+		if err := gob.NewEncoder(setupPipe[1]).Encode(&setup); err != nil {
 			log.Println(err)
 			return 5
-		} else if err = setupWriter.Close(); err != nil {
+		} else if err = setupPipe[1].Close(); err != nil {
 			log.Println(err)
 		}

--- a/cmd/sharefs/test/raceattr.go
+++ b/cmd/sharefs/test/raceattr.go
@@ -0,0 +1,122 @@
+//go:build raceattr
+
+// The raceattr program reproduces vfs inode file attribute race.
+//
+// Even though libfuse high-level API presents the address of a struct stat
+// alongside struct fuse_context, file attributes are actually inherent to the
+// inode, instead of the specific call from userspace. The kernel implementation
+// in fs/fuse/xattr.c appears to make stale data in the inode (set by a previous
+// call) impossible or very unlikely to reach userspace via the stat family of
+// syscalls. However, when using default_permissions to have the VFS check
+// permissions, this race still happens, despite the resulting struct stat being
+// correct when overriding the check via capabilities otherwise.
+//
+// This program reproduces the failure, but because of its continuous nature, it
+// is provided independent of the vm integration test suite.
+package main
+
+import (
+	"context"
+	"flag"
+	"log"
+	"os"
+	"os/signal"
+	"runtime"
+	"sync"
+	"sync/atomic"
+	"syscall"
+)
+
+func newStatAs(
+	ctx context.Context, cancel context.CancelFunc,
+	n *atomic.Uint64, ok *atomic.Bool,
+	uid uint32, pathname string,
+	continuous bool,
+) func() {
+	return func() {
+		runtime.LockOSThread()
+		defer cancel()
+
+		if _, _, errno := syscall.Syscall(
+			syscall.SYS_SETUID, uintptr(uid),
+			0, 0,
+		); errno != 0 {
+			cancel()
+			log.Printf("cannot set uid to %d: %s", uid, errno)
+		}
+
+		var stat syscall.Stat_t
+		for {
+			if ctx.Err() != nil {
+				return
+			}
+
+			if err := syscall.Lstat(pathname, &stat); err != nil {
+				// SHAREFS_PERM_DIR not world executable, or
+				// SHAREFS_PERM_REG not world readable
+				if !continuous {
+					cancel()
+				}
+				ok.Store(true)
+				log.Printf("uid %d: %v", uid, err)
+			} else if stat.Uid != uid {
+				// appears to be unreachable
+				if !continuous {
+					cancel()
+				}
+				ok.Store(true)
+				log.Printf("got uid %d instead of %d", stat.Uid, uid)
+			}
+			n.Add(1)
+		}
+	}
+}
+
+func main() {
+	log.SetFlags(0)
+	log.SetPrefix("raceattr: ")
+
+	p := flag.String("target", "/sdcard/raceattr", "pathname of test file")
+	u0 := flag.Int("uid0", 1<<10-1, "first uid")
+	u1 := flag.Int("uid1", 1<<10-2, "second uid")
+	count := flag.Int("count", 1, "threads per uid")
+	continuous := flag.Bool("continuous", false, "keep running even after reproduce")
+	flag.Parse()
+
+	if os.Geteuid() != 0 {
+		log.Fatal("this program must run as root")
+	}
+
+	ctx, cancel := signal.NotifyContext(
+		context.Background(),
+		syscall.SIGINT,
+		syscall.SIGTERM,
+		syscall.SIGHUP,
+	)
+
+	if err := os.WriteFile(*p, nil, 0); err != nil {
+		log.Fatal(err)
+	}
+
+	var (
+		wg sync.WaitGroup
+
+		n  atomic.Uint64
+		ok atomic.Bool
+	)
+
+	if *count < 1 {
+		*count = 1
+	}
+	for range *count {
+		wg.Go(newStatAs(ctx, cancel, &n, &ok, uint32(*u0), *p, *continuous))
+		if *u1 >= 0 {
+			wg.Go(newStatAs(ctx, cancel, &n, &ok, uint32(*u1), *p, *continuous))
+		}
+	}
+
+	wg.Wait()
+	if !*continuous && ok.Load() {
+		log.Printf("reproduced after %d calls", n.Load())
+	}
+}
--- a/container/container.go
+++ b/container/container.go
@@ -28,9 +28,6 @@ const (
 	// CancelSignal is the signal expected by container init on context cancel.
 	// A custom [Container.Cancel] function must eventually deliver this signal.
 	CancelSignal = SIGUSR2
-
-	// Timeout for writing initParams to Container.setup.
-	initSetupTimeout = 5 * time.Second
 )

 type (
@@ -53,7 +50,7 @@ type (
 		ExtraFiles []*os.File

 		// Write end of a pipe connected to the init to deliver [Params].
-		setup *os.File
+		setup [2]*os.File
 		// Cancels the context passed to the underlying cmd.
 		cancel context.CancelFunc
 		// Closed after Wait returns. Keeps the spawning thread alive.
@@ -287,14 +284,16 @@ func (p *Container) Start() error {
 	}

 	// place setup pipe before user supplied extra files, this is later restored by init
-	if fd, f, err := Setup(&p.cmd.ExtraFiles); err != nil {
+	if r, w, err := os.Pipe(); err != nil {
 		return &StartError{
 			Fatal: true,
 			Step:  "set up params stream",
 			Err:   err,
 		}
 	} else {
-		p.setup = f
+		fd := 3 + len(p.cmd.ExtraFiles)
+		p.cmd.ExtraFiles = append(p.cmd.ExtraFiles, r)
+		p.setup[0], p.setup[1] = r, w
 		p.cmd.Env = []string{setupEnv + "=" + strconv.Itoa(fd)}
 	}
 	p.cmd.ExtraFiles = append(p.cmd.ExtraFiles, p.ExtraFiles...)
@@ -324,9 +323,9 @@ func (p *Container) Start() error {
 				}

 				if abi, err := LandlockGetABI(); err != nil {
-					if p.HostAbstract {
+					if p.HostAbstract || !p.HostNet {
 						// landlock can be skipped here as it restricts access
-						// to resources already covered by namespaces (pid)
+						// to resources already covered by namespaces (pid, net)
 						goto landlockOut
 					}
 					return &StartError{Step: "get landlock ABI", Err: err}
@@ -428,24 +427,33 @@ func (p *Container) Start() error {
 // Serve serves [Container.Params] to the container init.
 //
 // Serve must only be called once.
-func (p *Container) Serve() error {
-	if p.setup == nil {
+func (p *Container) Serve() (err error) {
+	if p.setup[0] == nil || p.setup[1] == nil {
 		panic("invalid serve")
 	}

-	setup := p.setup
-	p.setup = nil
-	if err := setup.SetDeadline(time.Now().Add(initSetupTimeout)); err != nil {
+	done := make(chan struct{})
+	defer func() {
+		if closeErr := p.setup[1].Close(); err == nil {
+			err = closeErr
+		}
+
+		if err != nil {
+			p.cancel()
+		}
+		close(done)
+		p.setup[0], p.setup[1] = nil, nil
+	}()
+	if err = p.setup[0].Close(); err != nil {
 		return &StartError{
 			Fatal:       true,
-			Step:        "set init pipe deadline",
+			Step:        "close read end of init pipe",
 			Err:         err,
 			Passthrough: true,
 		}
 	}

 	if p.Path == nil {
-		p.cancel()
 		return &StartError{
 			Step:   "invalid executable pathname",
 			Err:    EINVAL,
@@ -461,18 +469,27 @@ func (p *Container) Serve() error {
 		p.SeccompRules = make([]std.NativeRule, 0)
 	}

-	err := gob.NewEncoder(setup).Encode(&initParams{
+	t := time.Now().UTC()
+	go func(f *os.File) {
+		select {
+		case <-p.ctx.Done():
+			if cancelErr := f.SetWriteDeadline(t); cancelErr != nil {
+				p.msg.Verbose(err)
+			}
+
+		case <-done:
+			p.msg.Verbose("setup payload took", time.Since(t))
+			return
+		}
+	}(p.setup[1])
+
+	return gob.NewEncoder(p.setup[1]).Encode(&initParams{
 		p.Params,
 		Getuid(),
 		Getgid(),
 		len(p.ExtraFiles),
 		p.msg.IsVerbose(),
 	})
-	_ = setup.Close()
-	if err != nil {
-		p.cancel()
-	}
-	return err
 }

 // Wait blocks until the container init process to exit and releases any
--- a/container/container_test.go
+++ b/container/container_test.go
@@ -25,6 +25,8 @@ import (
 	"hakurei.app/ext"
 	"hakurei.app/fhs"
 	"hakurei.app/hst"
+	"hakurei.app/internal/info"
+	"hakurei.app/internal/params"
 	"hakurei.app/ldd"
 	"hakurei.app/message"
 	"hakurei.app/vfs"
@@ -83,9 +85,9 @@ func TestStartError(t *testing.T) {
 		{"params env", &container.StartError{
 			Fatal: true,
 			Step:  "set up params stream",
-			Err:   container.ErrReceiveEnv,
+			Err:   params.ErrReceiveEnv,
 		}, "set up params stream: environment variable not set",
-			container.ErrReceiveEnv, syscall.EBADF,
+			params.ErrReceiveEnv, syscall.EBADF,
 			"cannot set up params stream: environment variable not set"},

 		{"params", &container.StartError{
@@ -453,6 +455,15 @@ func TestContainer(t *testing.T) {
 			c.SeccompDisable = !tc.filter
 			c.RetainSession = tc.session
 			c.HostNet = tc.net
+			if info.CanDegrade {
+				if _, err := container.LandlockGetABI(); err != nil {
+					if !errors.Is(err, syscall.ENOSYS) {
+						t.Fatalf("LandlockGetABI: error = %v", err)
+					}
+					c.HostAbstract = true
+					t.Log("Landlock LSM is unavailable, enabling HostAbstract")
+				}
+			}

 			c.
 				Readonly(check.MustAbs(pathReadonly), 0755).
--- a/container/dispatcher.go
+++ b/container/dispatcher.go
@@ -16,6 +16,7 @@ import (
 	"hakurei.app/container/std"
 	"hakurei.app/ext"
 	"hakurei.app/internal/netlink"
+	"hakurei.app/internal/params"
 	"hakurei.app/message"
 )

@@ -56,7 +57,7 @@ type syscallDispatcher interface {
 	// isatty provides [Isatty].
 	isatty(fd int) bool
 	// receive provides [Receive].
-	receive(key string, e any, fdp *uintptr) (closeFunc func() error, err error)
+	receive(key string, e any, fdp *int) (closeFunc func() error, err error)

 	// bindMount provides procPaths.bindMount.
 	bindMount(msg message.Msg, source, target string, flags uintptr) error
@@ -155,8 +156,8 @@ func (direct) capBoundingSetDrop(cap uintptr) error            { return capBound
 func (direct) capAmbientClearAll() error                       { return capAmbientClearAll() }
 func (direct) capAmbientRaise(cap uintptr) error               { return capAmbientRaise(cap) }
 func (direct) isatty(fd int) bool                              { return ext.Isatty(fd) }
-func (direct) receive(key string, e any, fdp *uintptr) (func() error, error) {
-	return Receive(key, e, fdp)
+func (direct) receive(key string, e any, fdp *int) (func() error, error) {
+	return params.Receive(key, e, fdp)
 }

 func (direct) bindMount(msg message.Msg, source, target string, flags uintptr) error {
--- a/container/dispatcher_test.go
+++ b/container/dispatcher_test.go
@@ -390,7 +390,7 @@ func (k *kstub) isatty(fd int) bool {
 	return expect.Ret.(bool)
 }

-func (k *kstub) receive(key string, e any, fdp *uintptr) (closeFunc func() error, err error) {
+func (k *kstub) receive(key string, e any, fdp *int) (closeFunc func() error, err error) {
 	k.Helper()
 	expect := k.Expects("receive")

@@ -408,10 +408,17 @@ func (k *kstub) receive(key string, e any, fdp *uintptr) (closeFunc func() error
 		}
 		return nil
 	}
+
+	// avoid changing test cases
+	var fdpComp *uintptr
+	if fdp != nil {
+		fdpComp = new(uintptr(*fdp))
+	}
+
 	err = expect.Error(
 		stub.CheckArg(k.Stub, "key", key, 0),
 		stub.CheckArgReflect(k.Stub, "e", e, 1),
-		stub.CheckArgReflect(k.Stub, "fdp", fdp, 2))
+		stub.CheckArgReflect(k.Stub, "fdp", fdpComp, 2))

 	// 3 is unused so stores params
 	if expect.Args[3] != nil {
@@ -426,7 +433,7 @@ func (k *kstub) receive(key string, e any, fdp *uintptr) (closeFunc func() error
 	if expect.Args[4] != nil {
 		if v, ok := expect.Args[4].(uintptr); ok && v >= 3 {
 			if fdp != nil {
-				*fdp = v
+				*fdp = int(v)
 			}
 		}
 	}
--- a/container/init.go
+++ b/container/init.go
@@ -19,6 +19,7 @@ import (
 	"hakurei.app/container/seccomp"
 	"hakurei.app/ext"
 	"hakurei.app/fhs"
+	"hakurei.app/internal/params"
 	"hakurei.app/message"
 )

@@ -147,35 +148,33 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	}

 	var (
-		params      initParams
-		closeSetup  func() error
-		setupFd     uintptr
-		offsetSetup int
+		param      initParams
+		closeSetup func() error
+		setupFd    int
 	)
-	if f, err := k.receive(setupEnv, &params, &setupFd); err != nil {
+	if f, err := k.receive(setupEnv, &param, &setupFd); err != nil {
 		if errors.Is(err, EBADF) {
 			k.fatal(msg, "invalid setup descriptor")
 		}
-		if errors.Is(err, ErrReceiveEnv) {
+		if errors.Is(err, params.ErrReceiveEnv) {
 			k.fatal(msg, setupEnv+" not set")
 		}

 		k.fatalf(msg, "cannot decode init setup payload: %v", err)
 	} else {
-		if params.Ops == nil {
+		if param.Ops == nil {
 			k.fatal(msg, "invalid setup parameters")
 		}
-		if params.ParentPerm == 0 {
-			params.ParentPerm = 0755
+		if param.ParentPerm == 0 {
+			param.ParentPerm = 0755
 		}

-		msg.SwapVerbose(params.Verbose)
+		msg.SwapVerbose(param.Verbose)
 		msg.Verbose("received setup parameters")
 		closeSetup = f
-		offsetSetup = int(setupFd + 1)
 	}

-	if !params.HostNet {
+	if !param.HostNet {
 		ctx, cancel := signal.NotifyContext(context.Background(), CancelSignal,
 			os.Interrupt, SIGTERM, SIGQUIT)
 		defer cancel() // for panics
@@ -188,7 +187,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		k.fatalf(msg, "cannot set SUID_DUMP_USER: %v", err)
 	}
 	if err := k.writeFile(fhs.Proc+"self/uid_map",
-		append([]byte{}, strconv.Itoa(params.Uid)+" "+strconv.Itoa(params.HostUid)+" 1\n"...),
+		append([]byte{}, strconv.Itoa(param.Uid)+" "+strconv.Itoa(param.HostUid)+" 1\n"...),
 		0); err != nil {
 		k.fatalf(msg, "%v", err)
 	}
@@ -198,7 +197,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		k.fatalf(msg, "%v", err)
 	}
 	if err := k.writeFile(fhs.Proc+"self/gid_map",
-		append([]byte{}, strconv.Itoa(params.Gid)+" "+strconv.Itoa(params.HostGid)+" 1\n"...),
+		append([]byte{}, strconv.Itoa(param.Gid)+" "+strconv.Itoa(param.HostGid)+" 1\n"...),
 		0); err != nil {
 		k.fatalf(msg, "%v", err)
 	}
@@ -207,8 +206,8 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	}

 	oldmask := k.umask(0)
-	if params.Hostname != "" {
-		if err := k.sethostname([]byte(params.Hostname)); err != nil {
+	if param.Hostname != "" {
+		if err := k.sethostname([]byte(param.Hostname)); err != nil {
 			k.fatalf(msg, "cannot set hostname: %v", err)
 		}
 	}
@@ -221,7 +220,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	}

 	ctx, cancel := context.WithCancel(context.Background())
-	state := &setupState{process: make(map[int]WaitStatus), Params: &params.Params, Msg: msg, Context: ctx}
+	state := &setupState{process: make(map[int]WaitStatus), Params: &param.Params, Msg: msg, Context: ctx}
 	defer cancel()

 	/* early is called right before pivot_root into intermediate root;
@@ -229,7 +228,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	difficult to obtain via library functions after pivot_root, and
 	implementations are expected to avoid changing the state of the mount
 	namespace */
-	for i, op := range *params.Ops {
+	for i, op := range *param.Ops {
 		if op == nil || !op.Valid() {
 			k.fatalf(msg, "invalid op at index %d", i)
 		}
@@ -272,7 +271,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	step sets up the container filesystem, and implementations are expected to
 	keep the host root and sysroot mount points intact but otherwise can do
 	whatever they need to. Calling chdir is allowed but discouraged. */
-	for i, op := range *params.Ops {
+	for i, op := range *param.Ops {
 		// ops already checked during early setup
 		if prefix, ok := op.prefix(); ok {
 			msg.Verbosef("%s %s", prefix, op)
@@ -328,7 +327,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		k.fatalf(msg, "cannot clear the ambient capability set: %v", err)
 	}
 	for i := uintptr(0); i <= lastcap; i++ {
-		if params.Privileged && i == CAP_SYS_ADMIN {
+		if param.Privileged && i == CAP_SYS_ADMIN {
 			continue
 		}
 		if err := k.capBoundingSetDrop(i); err != nil {
@@ -337,7 +336,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	}

 	var keep [2]uint32
-	if params.Privileged {
+	if param.Privileged {
 		keep[capToIndex(CAP_SYS_ADMIN)] |= capToMask(CAP_SYS_ADMIN)

 		if err := k.capAmbientRaise(CAP_SYS_ADMIN); err != nil {
@@ -351,13 +350,13 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		k.fatalf(msg, "cannot capset: %v", err)
 	}

-	if !params.SeccompDisable {
-		rules := params.SeccompRules
+	if !param.SeccompDisable {
+		rules := param.SeccompRules
 		if len(rules) == 0 { // non-empty rules slice always overrides presets
-			msg.Verbosef("resolving presets %#x", params.SeccompPresets)
-			rules = seccomp.Preset(params.SeccompPresets, params.SeccompFlags)
+			msg.Verbosef("resolving presets %#x", param.SeccompPresets)
+			rules = seccomp.Preset(param.SeccompPresets, param.SeccompFlags)
 		}
-		if err := k.seccompLoad(rules, params.SeccompFlags); err != nil {
+		if err := k.seccompLoad(rules, param.SeccompFlags); err != nil {
 			// this also indirectly asserts PR_SET_NO_NEW_PRIVS
 			k.fatalf(msg, "cannot load syscall filter: %v", err)
 		}
@@ -366,10 +365,10 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		msg.Verbose("syscall filter not configured")
 	}

-	extraFiles := make([]*os.File, params.Count)
+	extraFiles := make([]*os.File, param.Count)
 	for i := range extraFiles {
 		// setup fd is placed before all extra files
-		extraFiles[i] = k.newFile(uintptr(offsetSetup+i), "extra file "+strconv.Itoa(i))
+		extraFiles[i] = k.newFile(uintptr(setupFd+1+i), "extra file "+strconv.Itoa(i))
 	}
 	k.umask(oldmask)

@@ -447,7 +446,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {

 	// called right before startup of initial process, all state changes to the
 	// current process is prohibited during late
-	for i, op := range *params.Ops {
+	for i, op := range *param.Ops {
 		// ops already checked during early setup
 		if err := op.late(state, k); err != nil {
 			if m, ok := messageFromError(err); ok {
@@ -468,14 +467,14 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		k.fatalf(msg, "cannot close setup pipe: %v", err)
 	}

-	cmd := exec.Command(params.Path.String())
+	cmd := exec.Command(param.Path.String())
 	cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
-	cmd.Args = params.Args
-	cmd.Env = params.Env
+	cmd.Args = param.Args
+	cmd.Env = param.Env
 	cmd.ExtraFiles = extraFiles
-	cmd.Dir = params.Dir.String()
+	cmd.Dir = param.Dir.String()

-	msg.Verbosef("starting initial process %s", params.Path)
+	msg.Verbosef("starting initial process %s", param.Path)
 	if err := k.start(cmd); err != nil {
 		k.fatalf(msg, "%v", err)
 	}
@@ -493,7 +492,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	for {
 		select {
 		case s := <-sig:
-			if s == CancelSignal && params.ForwardCancel && cmd.Process != nil {
+			if s == CancelSignal && param.ForwardCancel && cmd.Process != nil {
 				msg.Verbose("forwarding context cancellation")
 				if err := k.signal(cmd, os.Interrupt); err != nil && !errors.Is(err, os.ErrProcessDone) {
 					k.printf(msg, "cannot forward cancellation: %v", err)
@@ -525,7 +524,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 				cancel()

 				// start timeout early
-				go func() { time.Sleep(params.AdoptWaitDelay); close(timeout) }()
+				go func() { time.Sleep(param.AdoptWaitDelay); close(timeout) }()

 				// close initial process files; this also keeps them alive
 				for _, f := range extraFiles {
--- a/container/init_test.go
+++ b/container/init_test.go
@@ -10,6 +10,7 @@ import (
 	"hakurei.app/check"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
+	"hakurei.app/internal/params"
 	"hakurei.app/internal/stub"
 )

@@ -40,7 +41,7 @@ func TestInitEntrypoint(t *testing.T) {
 				call("lockOSThread", stub.ExpectArgs{}, nil, nil),
 				call("getpid", stub.ExpectArgs{}, 1, nil),
 				call("setPtracer", stub.ExpectArgs{uintptr(0)}, nil, nil),
-				call("receive", stub.ExpectArgs{"HAKUREI_SETUP", new(initParams), new(uintptr)}, nil, ErrReceiveEnv),
+				call("receive", stub.ExpectArgs{"HAKUREI_SETUP", new(initParams), new(uintptr)}, nil, params.ErrReceiveEnv),
 				call("fatal", stub.ExpectArgs{[]any{"HAKUREI_SETUP not set"}}, nil, nil),
 			},
 		}, nil},
--- a/container/params.go
+++ b/container/params.go
@@ -1,47 +0,0 @@
-package container
-
-import (
-	"encoding/gob"
-	"errors"
-	"os"
-	"strconv"
-	"syscall"
-)
-
-// Setup appends the read end of a pipe for setup params transmission and returns its fd.
-func Setup(extraFiles *[]*os.File) (int, *os.File, error) {
-	if r, w, err := os.Pipe(); err != nil {
-		return -1, nil, err
-	} else {
-		fd := 3 + len(*extraFiles)
-		*extraFiles = append(*extraFiles, r)
-		return fd, w, nil
-	}
-}
-
-var (
-	ErrReceiveEnv = errors.New("environment variable not set")
-)
-
-// Receive retrieves setup fd from the environment and receives params.
-func Receive(key string, e any, fdp *uintptr) (func() error, error) {
-	var setup *os.File
-
-	if s, ok := os.LookupEnv(key); !ok {
-		return nil, ErrReceiveEnv
-	} else {
-		if fd, err := strconv.Atoi(s); err != nil {
-			return nil, optionalErrorUnwrap(err)
-		} else {
-			setup = os.NewFile(uintptr(fd), "setup")
-			if setup == nil {
-				return nil, syscall.EDOM
-			}
-			if fdp != nil {
-				*fdp = setup.Fd()
-			}
-		}
-	}
-
-	return setup.Close, gob.NewDecoder(setup).Decode(e)
-}
--- a/dist/hsurc.default
+++ b/dist/hsurc.default
@@ -1 +0,0 @@
-1000 0
--- a/dist/install.sh
+++ b/dist/install.sh
@@ -1,12 +0,0 @@
-#!/bin/sh
-cd "$(dirname -- "$0")" || exit 1
-
-install -vDm0755 "bin/hakurei" "${DESTDIR}/usr/bin/hakurei"
-install -vDm0755 "bin/sharefs" "${DESTDIR}/usr/bin/sharefs"
-
-install -vDm4511 "bin/hsu" "${DESTDIR}/usr/bin/hsu"
-if [ ! -f "${DESTDIR}/etc/hsurc" ]; then
-    install -vDm0400 "hsurc.default" "${DESTDIR}/etc/hsurc"
-fi
-
-install -vDm0644 "comp/_hakurei" "${DESTDIR}/usr/share/zsh/site-functions/_hakurei"
--- a/dist/release.sh
+++ b/dist/release.sh
@@ -1,37 +0,0 @@
-#!/bin/sh -e
-cd "$(dirname -- "$0")/.."
-VERSION="${HAKUREI_VERSION:-untagged}"
-prefix="${PREFIX:-/usr}"
-pname="hakurei-${VERSION}-$(go env GOARCH)"
-out="${DESTDIR:-dist}/${pname}"
-
-destroy_workdir() {
-  rm -rf "${out}"
-}
-trap destroy_workdir EXIT
-
-echo '# Preparing distribution files.'
-mkdir -p "${out}"
-cp -v "README.md" "dist/hsurc.default" "dist/install.sh" "${out}"
-cp -rv "dist/comp" "${out}"
-echo
-
-echo '# Building hakurei.'
-go generate ./...
-go build -trimpath -v -o "${out}/bin/" -ldflags "-s -w
-  -buildid= -linkmode external -extldflags=-static
-  -X hakurei.app/internal/info.buildVersion=${VERSION}
-  -X hakurei.app/internal/info.hakureiPath=${prefix}/bin/hakurei
-  -X hakurei.app/internal/info.hsuPath=${prefix}/bin/hsu
-  -X main.hakureiPath=${prefix}/bin/hakurei" ./...
-echo
-
-echo '# Testing hakurei.'
-go test -ldflags='-buildid= -linkmode external -extldflags=-static' ./...
-echo
-
-echo '# Creating distribution.'
-rm -f "${out}.tar.gz" && tar -C "${out}/.." -vczf "${out}.tar.gz" "${pname}"
-rm -rf "${out}"
-(cd "${out}/.." && sha512sum "${pname}.tar.gz" > "${pname}.tar.gz.sha512")
-echo
--- a/flake.nix
+++ b/flake.nix
@@ -137,11 +137,10 @@

                CC="musl-clang -O3 -Werror -Qunused-arguments" \
                GOCACHE="$(mktemp -d)" \
-                HAKUREI_TEST_SKIP_ACL=1 \
                PATH="${pkgs.pkgsStatic.musl.bin}/bin:$PATH" \
                DESTDIR="$out" \
                HAKUREI_VERSION="v${hakurei.version}" \
-                  ./dist/release.sh
+                  ./all.sh
              '';
        }
      );
@@ -196,6 +195,7 @@
                  ./test/interactive/vm.nix
                  ./test/interactive/hakurei.nix
                  ./test/interactive/trace.nix
+                  ./test/interactive/raceattr.nix

                  self.nixosModules.hakurei
                  home-manager.nixosModules.home-manager
--- a/internal/acl/acl_test.go
+++ b/internal/acl/acl_test.go
@@ -11,9 +11,11 @@ import (
 	"path/filepath"
 	"reflect"
 	"strconv"
+	"syscall"
 	"testing"

 	"hakurei.app/internal/acl"
+	"hakurei.app/internal/info"
 )

 const testFileName = "acl.test"
@@ -24,8 +26,14 @@ var (
 )

 func TestUpdate(t *testing.T) {
-	if os.Getenv("HAKUREI_TEST_SKIP_ACL") == "1" {
-		t.Skip("acl test skipped")
+	if info.CanDegrade {
+		name := filepath.Join(t.TempDir(), "check-degrade")
+		if err := os.WriteFile(name, nil, 0); err != nil {
+			t.Fatal(err)
+		}
+		if err := acl.Update(name, os.Geteuid()); errors.Is(err, syscall.ENOTSUP) {
+			t.Skip(err)
+		}
 	}

 	testFilePath := filepath.Join(t.TempDir(), testFileName)
--- a/internal/info/optional_skip.go
+++ b/internal/info/optional_skip.go
@@ -0,0 +1,7 @@
+//go:build !noskip
+
+package info
+
+// CanDegrade is whether tests are allowed to transparently degrade or skip due
+// to required system features being denied or unavailable.
+const CanDegrade = true
--- a/internal/info/optional_strict.go
+++ b/internal/info/optional_strict.go
@@ -0,0 +1,5 @@
+//go:build noskip
+
+package info
+
+const CanDegrade = false
--- a/internal/kobject/event.go
+++ b/internal/kobject/event.go
@@ -0,0 +1,90 @@
+package kobject
+
+import (
+	"errors"
+	"strconv"
+	"strings"
+	"unsafe"
+
+	"hakurei.app/internal/uevent"
+)
+
+// Event is a [uevent.Message] with known environment variables processed.
+type Event struct {
+	// alloc_uevent_skb: action_string
+	Action uevent.KobjectAction `json:"action"`
+	// alloc_uevent_skb: devpath
+	DevPath string `json:"devpath"`
+
+	// Uninterpreted environment variable pairs. An entry missing a separator
+	// gains the value "\x00".
+	Env map[string]string `json:"env"`
+
+	// SEQNUM value set by the kernel.
+	Sequence uint64 `json:"seqnum"`
+	// SYNTH_UUID value set on trigger, nil denotes a non-synthetic event.
+	Synth *uevent.UUID `json:"synth_uuid,omitempty"`
+	// SUBSYSTEM value set by the kernel.
+	Subsystem string `json:"subsystem"`
+}
+
+// Populate populates e with the contents of a [uevent.Message].
+//
+// The ACTION and DEVPATH environment variables are ignored and assumed to be
+// consistent with the header.
+func (e *Event) Populate(reportErr func(error), m *uevent.Message) {
+	if reportErr == nil {
+		reportErr = func(error) {}
+	}
+
+	*e = Event{
+		Action:  m.Action,
+		DevPath: m.DevPath,
+		Env:     make(map[string]string),
+	}
+
+	for _, s := range m.Env {
+		k, v, ok := strings.Cut(s, "=")
+		if !ok {
+			if _, ok = e.Env[s]; !ok {
+				e.Env[s] = "\x00"
+			}
+			continue
+		}
+
+		switch k {
+		case "ACTION", "DEVPATH":
+			continue
+
+		case "SEQNUM":
+			seq, err := strconv.ParseUint(v, 10, 64)
+			if err != nil {
+				if _e := errors.Unwrap(err); _e != nil {
+					err = _e
+				}
+				reportErr(err)
+
+				e.Env[k] = v
+				continue
+			}
+			e.Sequence = seq
+
+		case "SYNTH_UUID":
+			var uuid uevent.UUID
+			err := uuid.UnmarshalText(unsafe.Slice(unsafe.StringData(v), len(v)))
+			if err != nil {
+				reportErr(err)
+
+				e.Env[k] = v
+				continue
+			}
+			e.Synth = &uuid
+
+		case "SUBSYSTEM":
+			e.Subsystem = v
+
+		default:
+			e.Env[k] = v
+		}
+	}
+}
--- a/internal/kobject/event_test.go
+++ b/internal/kobject/event_test.go
@@ -0,0 +1,92 @@
+package kobject_test
+
+import (
+	"reflect"
+	"strconv"
+	"testing"
+
+	"hakurei.app/internal/kobject"
+	"hakurei.app/internal/uevent"
+)
+
+func TestEvent(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name string
+		msg  uevent.Message
+		want kobject.Event
+		errs []error
+	}{
+		{"sample coldboot qemu", uevent.Message{
+			Action:  uevent.KOBJ_ADD,
+			DevPath: "/devices/LNXSYSTM:00/LNXPWRBN:00",
+			Env: []string{
+				"ACTION=add",
+				"DEVPATH=/devices/LNXSYSTM:00/LNXPWRBN:00",
+				"SUBSYSTEM=acpi",
+				"SYNTH_UUID=fe4d7c9d-b8c6-4a70-9ef1-3d8a58d18eed",
+				"MODALIAS=acpi:LNXPWRBN:",
+				"SEQNUM=777",
+			}}, kobject.Event{
+			Action:  uevent.KOBJ_ADD,
+			DevPath: "/devices/LNXSYSTM:00/LNXPWRBN:00",
+			Env: map[string]string{
+				"MODALIAS": "acpi:LNXPWRBN:",
+			},
+			Sequence: 777,
+			Synth: &uevent.UUID{
+				0xfe, 0x4d, 0x7c, 0x9d,
+				0xb8, 0xc6,
+				0x4a, 0x70,
+				0x9e, 0xf1,
+				0x3d, 0x8a, 0x58, 0xd1, 0x8e, 0xed,
+			},
+			Subsystem: "acpi",
+		}, []error{}},
+
+		{"nil reportErr", uevent.Message{Env: []string{
+			"SEQNUM=\x00",
+		}}, kobject.Event{Env: map[string]string{
+			"SEQNUM": "\x00",
+		}}, nil},
+
+		{"bad SEQNUM SYNTH_UUID", uevent.Message{Env: []string{
+			"SEQNUM=\x00",
+			"SYNTH_UUID=\x00",
+			"SUBSYSTEM=\x00",
+		}}, kobject.Event{Subsystem: "\x00", Env: map[string]string{
+			"SEQNUM":     "\x00",
+			"SYNTH_UUID": "\x00",
+		}}, []error{strconv.ErrSyntax, uevent.UUIDSizeError(1)}},
+
+		{"bad sep", uevent.Message{Env: []string{
+			"SYNTH_UUID",
+		}}, kobject.Event{Env: map[string]string{
+			"SYNTH_UUID": "\x00",
+		}}, []error{}},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			var f func(error)
+			gotErrs := make([]error, 0)
+			if tc.errs != nil {
+				f = func(err error) {
+					gotErrs = append(gotErrs, err)
+				}
+			}
+
+			var got kobject.Event
+			got.Populate(f, &tc.msg)
+
+			if !reflect.DeepEqual(&got, &tc.want) {
+				t.Errorf("Populate: %#v, want %#v", got, tc.want)
+			}
+			if tc.errs != nil && !reflect.DeepEqual(gotErrs, tc.errs) {
+				t.Errorf("Populate: errs = %v, want %v", gotErrs, tc.errs)
+			}
+		})
+	}
+}
--- a/internal/outcome/dispatcher.go
+++ b/internal/outcome/dispatcher.go
@@ -17,6 +17,7 @@ import (
 	"hakurei.app/ext"
 	"hakurei.app/internal/dbus"
 	"hakurei.app/internal/info"
+	"hakurei.app/internal/params"
 	"hakurei.app/message"
 )

@@ -84,7 +85,7 @@ type syscallDispatcher interface {
 	// setDumpable provides [container.SetDumpable].
 	setDumpable(dumpable uintptr) error
 	// receive provides [container.Receive].
-	receive(key string, e any, fdp *uintptr) (closeFunc func() error, err error)
+	receive(key string, e any, fdp *int) (closeFunc func() error, err error)

 	// containerStart provides the Start method of [container.Container].
 	containerStart(z *container.Container) error
@@ -154,8 +155,8 @@ func (direct) prctl(op, arg2, arg3 uintptr) error { return ext.Prctl(op, arg2, a
 func (direct) overflowUid(msg message.Msg) int    { return container.OverflowUid(msg) }
 func (direct) overflowGid(msg message.Msg) int    { return container.OverflowGid(msg) }
 func (direct) setDumpable(dumpable uintptr) error { return ext.SetDumpable(dumpable) }
-func (direct) receive(key string, e any, fdp *uintptr) (func() error, error) {
-	return container.Receive(key, e, fdp)
+func (direct) receive(key string, e any, fdp *int) (func() error, error) {
+	return params.Receive(key, e, fdp)
 }

 func (direct) containerStart(z *container.Container) error { return z.Start() }
--- a/internal/outcome/dispatcher_test.go
+++ b/internal/outcome/dispatcher_test.go
@@ -401,12 +401,12 @@ func (k *kstub) setDumpable(dumpable uintptr) error {
 		stub.CheckArg(k.Stub, "dumpable", dumpable, 0))
 }

-func (k *kstub) receive(key string, e any, fdp *uintptr) (closeFunc func() error, err error) {
+func (k *kstub) receive(key string, e any, fdp *int) (closeFunc func() error, err error) {
 	k.Helper()
 	expect := k.Expects("receive")
 	reflect.ValueOf(e).Elem().Set(reflect.ValueOf(expect.Args[1]))
 	if expect.Args[2] != nil {
-		*fdp = expect.Args[2].(uintptr)
+		*fdp = int(expect.Args[2].(uintptr))
 	}
 	return func() error { return k.Expects("closeReceive").Err }, expect.Error(
 		stub.CheckArg(k.Stub, "key", key, 0))
@@ -690,38 +690,38 @@ func (panicMsgContext) Value(any) any               { panic("unreachable") }
 // This type is meant to be embedded in partial syscallDispatcher implementations.
 type panicDispatcher struct{}

-func (panicDispatcher) new(func(k syscallDispatcher, msg message.Msg))      { panic("unreachable") }
-func (panicDispatcher) getppid() int                                        { panic("unreachable") }
-func (panicDispatcher) getpid() int                                         { panic("unreachable") }
-func (panicDispatcher) getuid() int                                         { panic("unreachable") }
-func (panicDispatcher) getgid() int                                         { panic("unreachable") }
-func (panicDispatcher) lookupEnv(string) (string, bool)                     { panic("unreachable") }
-func (panicDispatcher) pipe() (*os.File, *os.File, error)                   { panic("unreachable") }
-func (panicDispatcher) stat(string) (os.FileInfo, error)                    { panic("unreachable") }
-func (panicDispatcher) open(string) (osFile, error)                         { panic("unreachable") }
-func (panicDispatcher) readdir(string) ([]os.DirEntry, error)               { panic("unreachable") }
-func (panicDispatcher) tempdir() string                                     { panic("unreachable") }
-func (panicDispatcher) mkdir(string, os.FileMode) error                     { panic("unreachable") }
-func (panicDispatcher) removeAll(string) error                              { panic("unreachable") }
-func (panicDispatcher) exit(int)                                            { panic("unreachable") }
-func (panicDispatcher) evalSymlinks(string) (string, error)                 { panic("unreachable") }
-func (panicDispatcher) prctl(uintptr, uintptr, uintptr) error               { panic("unreachable") }
-func (panicDispatcher) lookupGroupId(string) (string, error)                { panic("unreachable") }
-func (panicDispatcher) lookPath(string) (string, error)                     { panic("unreachable") }
-func (panicDispatcher) cmdOutput(*exec.Cmd) ([]byte, error)                 { panic("unreachable") }
-func (panicDispatcher) overflowUid(message.Msg) int                         { panic("unreachable") }
-func (panicDispatcher) overflowGid(message.Msg) int                         { panic("unreachable") }
-func (panicDispatcher) setDumpable(uintptr) error                           { panic("unreachable") }
-func (panicDispatcher) receive(string, any, *uintptr) (func() error, error) { panic("unreachable") }
-func (panicDispatcher) containerStart(*container.Container) error           { panic("unreachable") }
-func (panicDispatcher) containerServe(*container.Container) error           { panic("unreachable") }
-func (panicDispatcher) containerWait(*container.Container) error            { panic("unreachable") }
-func (panicDispatcher) mustHsuPath() *check.Absolute                        { panic("unreachable") }
-func (panicDispatcher) dbusAddress() (string, string)                       { panic("unreachable") }
-func (panicDispatcher) setupContSignal(int) (io.ReadCloser, func(), error)  { panic("unreachable") }
-func (panicDispatcher) getMsg() message.Msg                                 { panic("unreachable") }
-func (panicDispatcher) fatal(...any)                                        { panic("unreachable") }
-func (panicDispatcher) fatalf(string, ...any)                               { panic("unreachable") }
+func (panicDispatcher) new(func(k syscallDispatcher, msg message.Msg))     { panic("unreachable") }
+func (panicDispatcher) getppid() int                                       { panic("unreachable") }
+func (panicDispatcher) getpid() int                                        { panic("unreachable") }
+func (panicDispatcher) getuid() int                                        { panic("unreachable") }
+func (panicDispatcher) getgid() int                                        { panic("unreachable") }
+func (panicDispatcher) lookupEnv(string) (string, bool)                    { panic("unreachable") }
+func (panicDispatcher) pipe() (*os.File, *os.File, error)                  { panic("unreachable") }
+func (panicDispatcher) stat(string) (os.FileInfo, error)                   { panic("unreachable") }
+func (panicDispatcher) open(string) (osFile, error)                        { panic("unreachable") }
+func (panicDispatcher) readdir(string) ([]os.DirEntry, error)              { panic("unreachable") }
+func (panicDispatcher) tempdir() string                                    { panic("unreachable") }
+func (panicDispatcher) mkdir(string, os.FileMode) error                    { panic("unreachable") }
+func (panicDispatcher) removeAll(string) error                             { panic("unreachable") }
+func (panicDispatcher) exit(int)                                           { panic("unreachable") }
+func (panicDispatcher) evalSymlinks(string) (string, error)                { panic("unreachable") }
+func (panicDispatcher) prctl(uintptr, uintptr, uintptr) error              { panic("unreachable") }
+func (panicDispatcher) lookupGroupId(string) (string, error)               { panic("unreachable") }
+func (panicDispatcher) lookPath(string) (string, error)                    { panic("unreachable") }
+func (panicDispatcher) cmdOutput(*exec.Cmd) ([]byte, error)                { panic("unreachable") }
+func (panicDispatcher) overflowUid(message.Msg) int                        { panic("unreachable") }
+func (panicDispatcher) overflowGid(message.Msg) int                        { panic("unreachable") }
+func (panicDispatcher) setDumpable(uintptr) error                          { panic("unreachable") }
+func (panicDispatcher) receive(string, any, *int) (func() error, error)    { panic("unreachable") }
+func (panicDispatcher) containerStart(*container.Container) error          { panic("unreachable") }
+func (panicDispatcher) containerServe(*container.Container) error          { panic("unreachable") }
+func (panicDispatcher) containerWait(*container.Container) error           { panic("unreachable") }
+func (panicDispatcher) mustHsuPath() *check.Absolute                       { panic("unreachable") }
+func (panicDispatcher) dbusAddress() (string, string)                      { panic("unreachable") }
+func (panicDispatcher) setupContSignal(int) (io.ReadCloser, func(), error) { panic("unreachable") }
+func (panicDispatcher) getMsg() message.Msg                                { panic("unreachable") }
+func (panicDispatcher) fatal(...any)                                       { panic("unreachable") }
+func (panicDispatcher) fatalf(string, ...any)                              { panic("unreachable") }

 func (panicDispatcher) notifyContext(context.Context, ...os.Signal) (context.Context, context.CancelFunc) {
 	panic("unreachable")
--- a/internal/outcome/process.go
+++ b/internal/outcome/process.go
@@ -13,7 +13,6 @@ import (
 	"time"

 	"hakurei.app/check"
-	"hakurei.app/container"
 	"hakurei.app/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/internal/info"
@@ -372,17 +371,18 @@ func (k *outcome) start(ctx context.Context, msg message.Msg,
 	// shim runs in the same session as monitor; see shim.go for behaviour
 	cmd.Cancel = func() error { return cmd.Process.Signal(syscall.SIGCONT) }

-	var shimPipe *os.File
-	if fd, w, err := container.Setup(&cmd.ExtraFiles); err != nil {
+	var shimPipe [2]*os.File
+	if r, w, err := os.Pipe(); err != nil {
 		return cmd, nil, &hst.AppError{Step: "create shim setup pipe", Err: err}
 	} else {
-		shimPipe = w
 		cmd.Env = []string{
 			// passed through to shim by hsu
-			shimEnv + "=" + strconv.Itoa(fd),
+			shimEnv + "=" + strconv.Itoa(3+len(cmd.ExtraFiles)),
 			// interpreted by hsu
 			"HAKUREI_IDENTITY=" + k.state.identity.String(),
 		}
+		cmd.ExtraFiles = append(cmd.ExtraFiles, r)
+		shimPipe[0], shimPipe[1] = r, w
 	}

 	if len(k.supp) > 0 {
@@ -393,12 +393,16 @@ func (k *outcome) start(ctx context.Context, msg message.Msg,

 	msg.Verbosef("setuid helper at %s", hsuPath)
 	if err := cmd.Start(); err != nil {
+		_, _ = shimPipe[0].Close(), shimPipe[1].Close()
 		msg.Resume()
-		return cmd, shimPipe, &hst.AppError{Step: "start setuid wrapper", Err: err}
+		return cmd, nil, &hst.AppError{Step: "start setuid wrapper", Err: err}
+	}
+	if err := shimPipe[0].Close(); err != nil {
+		msg.Verbose(err)
 	}

 	*startTime = time.Now().UTC()
-	return cmd, shimPipe, nil
+	return cmd, shimPipe[1], nil
 }

 // serveShim serves outcomeState through the shim setup pipe.
@@ -411,11 +415,11 @@ func serveShim(msg message.Msg, shimPipe *os.File, state *outcomeState) error {
 		msg.Verbose(err.Error())
 	}
 	if err := gob.NewEncoder(shimPipe).Encode(state); err != nil {
+		_ = shimPipe.Close()
 		msg.Resume()
 		return &hst.AppError{Step: "transmit shim config", Err: err}
 	}
-	_ = shimPipe.Close()
-	return nil
+	return shimPipe.Close()
 }

 // printMessageError prints the error message according to [message.GetMessage],
--- a/internal/outcome/shim.go
+++ b/internal/outcome/shim.go
@@ -20,6 +20,7 @@ import (
 	"hakurei.app/ext"
 	"hakurei.app/fhs"
 	"hakurei.app/hst"
+	"hakurei.app/internal/params"
 	"hakurei.app/internal/pipewire"
 	"hakurei.app/message"
 )
@@ -197,7 +198,7 @@ func shimEntrypoint(k syscallDispatcher) {
 		if errors.Is(err, syscall.EBADF) {
 			k.fatal("invalid config descriptor")
 		}
-		if errors.Is(err, container.ErrReceiveEnv) {
+		if errors.Is(err, params.ErrReceiveEnv) {
 			k.fatal(shimEnv + " not set")
 		}

--- a/internal/outcome/shim_test.go
+++ b/internal/outcome/shim_test.go
@@ -16,6 +16,7 @@ import (
 	"hakurei.app/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/internal/env"
+	"hakurei.app/internal/params"
 	"hakurei.app/internal/stub"
 )

@@ -172,7 +173,7 @@ func TestShimEntrypoint(t *testing.T) {
 			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
-			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", outcomeState{}, nil}, nil, container.ErrReceiveEnv),
+			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", outcomeState{}, nil}, nil, params.ErrReceiveEnv),
 			call("fatal", stub.ExpectArgs{[]any{"HAKUREI_SHIM not set"}}, nil, nil),

 			// deferred
--- a/internal/params/params.go
+++ b/internal/params/params.go
@@ -0,0 +1,42 @@
+// Package params provides helpers for receiving setup payload from parent.
+package params
+
+import (
+	"encoding/gob"
+	"errors"
+	"os"
+	"strconv"
+	"syscall"
+)
+
+// ErrReceiveEnv is returned by [Receive] if setup fd is not present in environment.
+var ErrReceiveEnv = errors.New("environment variable not set")
+
+// Receive retrieves setup fd from the environment and receives params.
+//
+// The file descriptor written to the value pointed to by fdp must not be passed
+// to any system calls. It is made available for ordering file descriptor only.
+func Receive(key string, v any, fdp *int) (func() error, error) {
+	var setup *os.File
+
+	if s, ok := os.LookupEnv(key); !ok {
+		return nil, ErrReceiveEnv
+	} else {
+		if fd, err := strconv.Atoi(s); err != nil {
+			if _err := errors.Unwrap(err); _err != nil {
+				err = _err
+			}
+			return nil, err
+		} else {
+			setup = os.NewFile(uintptr(fd), "setup")
+			if setup == nil {
+				return nil, syscall.EDOM
+			}
+			if fdp != nil {
+				*fdp = fd
+			}
+		}
+	}
+
+	return setup.Close, gob.NewDecoder(setup).Decode(v)
+}
--- a/internal/params/params_test.go
+++ b/internal/params/params_test.go
@@ -1,4 +1,4 @@
-package container_test
+package params_test

 import (
 	"encoding/gob"
@@ -9,7 +9,7 @@ import (
 	"syscall"
 	"testing"

-	"hakurei.app/container"
+	"hakurei.app/internal/params"
 )

 func TestSetupReceive(t *testing.T) {
@@ -30,8 +30,8 @@ func TestSetupReceive(t *testing.T) {
 			})
 		}

-		if _, err := container.Receive(key, nil, nil); !errors.Is(err, container.ErrReceiveEnv) {
-			t.Errorf("Receive: error = %v, want %v", err, container.ErrReceiveEnv)
+		if _, err := params.Receive(key, nil, nil); !errors.Is(err, params.ErrReceiveEnv) {
+			t.Errorf("Receive: error = %v, want %v", err, params.ErrReceiveEnv)
 		}
 	})

@@ -39,7 +39,7 @@ func TestSetupReceive(t *testing.T) {
 		const key = "TEST_ENV_FORMAT"
 		t.Setenv(key, "")

-		if _, err := container.Receive(key, nil, nil); !errors.Is(err, strconv.ErrSyntax) {
+		if _, err := params.Receive(key, nil, nil); !errors.Is(err, strconv.ErrSyntax) {
 			t.Errorf("Receive: error = %v, want %v", err, strconv.ErrSyntax)
 		}
 	})
@@ -48,7 +48,7 @@ func TestSetupReceive(t *testing.T) {
 		const key = "TEST_ENV_RANGE"
 		t.Setenv(key, "-1")

-		if _, err := container.Receive(key, nil, nil); !errors.Is(err, syscall.EDOM) {
+		if _, err := params.Receive(key, nil, nil); !errors.Is(err, syscall.EDOM) {
 			t.Errorf("Receive: error = %v, want %v", err, syscall.EDOM)
 		}
 	})
@@ -60,16 +60,22 @@ func TestSetupReceive(t *testing.T) {

 			encoderDone := make(chan error, 1)
 			extraFiles := make([]*os.File, 0, 1)
-			deadline, _ := t.Deadline()
-			if fd, f, err := container.Setup(&extraFiles); err != nil {
+			if r, w, err := os.Pipe(); err != nil {
 				t.Fatalf("Setup: error = %v", err)
-			} else if fd != 3 {
-				t.Fatalf("Setup: fd = %d, want 3", fd)
 			} else {
-				if err = f.SetDeadline(deadline); err != nil {
-					t.Fatal(err.Error())
+				t.Cleanup(func() {
+					if err = errors.Join(r.Close(), w.Close()); err != nil {
+						t.Fatal(err)
+					}
+				})
+
+				extraFiles = append(extraFiles, r)
+				if deadline, ok := t.Deadline(); ok {
+					if err = w.SetDeadline(deadline); err != nil {
+						t.Fatal(err)
+					}
 				}
-				go func() { encoderDone <- gob.NewEncoder(f).Encode(payload) }()
+				go func() { encoderDone <- gob.NewEncoder(w).Encode(payload) }()
 			}

 			if len(extraFiles) != 1 {
@@ -87,13 +93,13 @@ func TestSetupReceive(t *testing.T) {

 			var (
 				gotPayload []uint64
-				fdp        *uintptr
+				fdp        *int
 			)
 			if !useNilFdp {
-				fdp = new(uintptr)
+				fdp = new(int)
 			}
 			var closeFile func() error
-			if f, err := container.Receive(key, &gotPayload, fdp); err != nil {
+			if f, err := params.Receive(key, &gotPayload, fdp); err != nil {
 				t.Fatalf("Receive: error = %v", err)
 			} else {
 				closeFile = f
@@ -103,7 +109,7 @@ func TestSetupReceive(t *testing.T) {
 				}
 			}
 			if !useNilFdp {
-				if int(*fdp) != dupFd {
+				if *fdp != dupFd {
 					t.Errorf("Fd: %d, want %d", *fdp, dupFd)
 				}
 			}
--- a/internal/pkg/exec.go
+++ b/internal/pkg/exec.go
@@ -397,6 +397,7 @@ const SeccompPresets = std.PresetStrict &
 func (a *execArtifact) makeContainer(
 	ctx context.Context,
 	msg message.Msg,
+	flags int,
 	hostNet bool,
 	temp, work *check.Absolute,
 	getArtifact GetArtifactFunc,
@@ -423,7 +424,9 @@ func (a *execArtifact) makeContainer(
 	z.SeccompFlags |= seccomp.AllowMultiarch
 	z.ParentPerm = 0700
 	z.HostNet = hostNet
+	z.HostAbstract = flags&CHostAbstract != 0
 	z.Hostname = "cure"
+	z.SetScheduler = flags&CSchedIdle != 0
 	z.SchedPolicy = ext.SCHED_IDLE
 	if z.HostNet {
 		z.Hostname = "cure-net"
@@ -559,6 +562,7 @@ func (c *Cache) EnterExec(
 	var z *container.Container
 	z, err = e.makeContainer(
 		ctx, c.msg,
+		c.flags,
 		hostNet,
 		temp, work,
 		func(a Artifact) (*check.Absolute, unique.Handle[Checksum]) {
@@ -598,14 +602,13 @@ func (a *execArtifact) cure(f *FContext, hostNet bool) (err error) {
 	msg := f.GetMessage()
 	var z *container.Container
 	if z, err = a.makeContainer(
-		ctx, msg, hostNet,
+		ctx, msg, f.cache.flags, hostNet,
 		f.GetTempDir(), f.GetWorkDir(),
 		f.GetArtifact,
 		f.cache.Ident,
 	); err != nil {
 		return
 	}
-	z.SetScheduler = f.cache.flags&CSchedIdle != 0

 	var status io.Writer
 	if status, err = f.GetStatusWriter(); err != nil {
--- a/internal/pkg/pkg.go
+++ b/internal/pkg/pkg.go
@@ -521,6 +521,14 @@ const (
 	// was caused by an incorrect checksum accidentally left behind while
 	// bumping a package. Only enable this if you are really sure you need it.
 	CAssumeChecksum
+
+	// CHostAbstract disables restriction of sandboxed processes from connecting
+	// to an abstract UNIX socket created by a host process.
+	//
+	// This is considered less secure in some systems, but does not introduce
+	// impurity due to [KindExecNet] being [KnownChecksum]. This flag exists
+	// to support kernels without Landlock LSM enabled.
+	CHostAbstract
 )

 // Cache is a support layer that implementations of [Artifact] can use to store
--- a/internal/pkg/pkg_test.go
+++ b/internal/pkg/pkg_test.go
@@ -24,6 +24,7 @@ import (
 	"hakurei.app/check"
 	"hakurei.app/container"
 	"hakurei.app/fhs"
+	"hakurei.app/internal/info"
 	"hakurei.app/internal/pkg"
 	"hakurei.app/internal/stub"
 	"hakurei.app/message"
@@ -289,8 +290,20 @@ func checkWithCache(t *testing.T, testCases []cacheTestCase) {
 			msg := message.New(log.New(os.Stderr, "cache: ", 0))
 			msg.SwapVerbose(testing.Verbose())

+			flags := tc.flags
+
+			if info.CanDegrade {
+				if _, err := container.LandlockGetABI(); err != nil {
+					if !errors.Is(err, syscall.ENOSYS) {
+						t.Fatalf("LandlockGetABI: error = %v", err)
+					}
+					flags |= pkg.CHostAbstract
+					t.Log("Landlock LSM is unavailable, setting CHostAbstract")
+				}
+			}
+
 			var scrubFunc func() error // scrub after hashing
-			if c, err := pkg.Open(t.Context(), msg, tc.flags, 1<<4, base); err != nil {
+			if c, err := pkg.Open(t.Context(), msg, flags, 1<<4, base); err != nil {
 				t.Fatalf("Open: error = %v", err)
 			} else {
 				t.Cleanup(c.Close)
--- a/internal/rosa/go.go
+++ b/internal/rosa/go.go
@@ -73,7 +73,7 @@ func (t Toolchain) newGoLatest() (pkg.Artifact, string) {
 	case "amd64":
 		bootstrapExtra = append(bootstrapExtra, t.newGoBootstrap())

-	case "arm64":
+	case "arm64", "riscv64":
 		bootstrapEnv = append(bootstrapEnv, "GOROOT_BOOTSTRAP=/system")
 		bootstrapExtra = t.AppendPresets(bootstrapExtra, gcc)
 		finalEnv = append(finalEnv, "CGO_ENABLED=0")
--- a/internal/rosa/kernel_riscv64.config
+++ b/internal/rosa/kernel_riscv64.config
--- a/internal/rosa/kernel_riscv64.go
+++ b/internal/rosa/kernel_riscv64.go
@@ -0,0 +1,8 @@
+package rosa
+
+import _ "embed"
+
+//go:embed kernel_riscv64.config
+var kernelConfig []byte
+
+const kernelName = "bzImage"
--- a/internal/rosa/llvm.go
+++ b/internal/rosa/llvm.go
@@ -207,6 +207,8 @@ func (t Toolchain) newLLVM() (musl, compilerRT, runtimes, clang pkg.Artifact) {
 		target = "X86"
 	case "arm64":
 		target = "AArch64"
+	case "riscv64":
+		target = "RISCV"

 	default:
 		panic("unsupported target " + runtime.GOARCH)
--- a/internal/rosa/llvm_riscv64.go
+++ b/internal/rosa/llvm_riscv64.go
@@ -0,0 +1,4 @@
+package rosa
+
+// clangPatches are patches applied to the LLVM source tree for building clang.
+var clangPatches []KV
--- a/internal/rosa/rosa.go
+++ b/internal/rosa/rosa.go
@@ -56,6 +56,8 @@ func linuxArch() string {
 		return "x86_64"
 	case "arm64":
 		return "aarch64"
+	case "riscv64":
+		return "riscv64"

 	default:
 		panic("unsupported target " + runtime.GOARCH)
--- a/internal/rosa/stage0.go
+++ b/internal/rosa/stage0.go
@@ -67,6 +67,8 @@ func NewStage0() pkg.Artifact {
 			seed = "tqM1Li15BJ-uFG8zU-XjgFxoN_kuzh1VxrSDVUVa0vGmo-NeWapSftH739sY8EAg"
 		case "arm64":
 			seed = "CJj3ZSnRyLmFHlWIQtTPQD9oikOZY4cD_mI3v_-LIYc2hhg-cq_CZFBLzQBAkFIn"
+		case "riscv64":
+			seed = "FcszJjcVWdKAnn-bt8qmUn5GUUTjv_xQjXOWkUpOplRkG3Ckob3StUoAi5KQ5-QF"

 		default:
 			panic("unsupported target " + runtime.GOARCH)
--- a/internal/uevent/coldboot.go
+++ b/internal/uevent/coldboot.go
@@ -7,6 +7,7 @@ import (
 	"log"
 	"os"
 	"path/filepath"
+	"slices"
 )

 // synthAdd is prepared bytes written to uevent to cause a synthetic add event
@@ -26,6 +27,7 @@ var synthAdd = []byte(KOBJ_ADD.String())
 func Coldboot(
 	ctx context.Context,
 	pathname string,
+	uuid *UUID,
 	visited chan<- string,
 	handleWalkErr func(error) error,
 ) error {
@@ -39,6 +41,11 @@ func Coldboot(
 		}
 	}

+	add := synthAdd
+	if uuid != nil {
+		add = slices.Concat(add, []byte{' '}, []byte(uuid.String()))
+	}
+
 	return filepath.WalkDir(filepath.Join(pathname, "devices"), func(
 		path string,
 		d fs.DirEntry,
@@ -54,7 +61,7 @@ func Coldboot(
 		if d.IsDir() || d.Name() != "uevent" {
 			return nil
 		}
-		if err = os.WriteFile(path, synthAdd, 0); err != nil {
+		if err = os.WriteFile(path, add, 0); err != nil {
 			return handleWalkErr(err)
 		}

--- a/internal/uevent/coldboot_test.go
+++ b/internal/uevent/coldboot_test.go
@@ -59,7 +59,7 @@ func TestColdboot(t *testing.T) {
 		}
 	})

-	err := uevent.Coldboot(t.Context(), d, visited, func(err error) error {
+	err := uevent.Coldboot(t.Context(), d, nil, visited, func(err error) error {
 		t.Errorf("handleWalkErr: %v", err)
 		return err
 	})
@@ -219,7 +219,7 @@ func TestColdbootError(t *testing.T) {
 				}
 			}

-			if err := uevent.Coldboot(ctx, d, visited, handleWalkErr); !reflect.DeepEqual(err, wantErr) {
+			if err := uevent.Coldboot(ctx, d, new(uevent.UUID), visited, handleWalkErr); !reflect.DeepEqual(err, wantErr) {
 				t.Errorf("Coldboot: error = %v, want %v", err, wantErr)
 			}
 		})
--- a/internal/uevent/uevent.go
+++ b/internal/uevent/uevent.go
@@ -5,10 +5,14 @@ package uevent

 import (
 	"context"
+	"encoding"
+	"encoding/hex"
 	"errors"
+	"fmt"
 	"strconv"
 	"sync/atomic"
 	"syscall"
+	"unsafe"

 	"hakurei.app/internal/netlink"
 )
@@ -121,6 +125,117 @@ func (c *Conn) receiveEvent(ctx context.Context) (*Message, error) {
 	return &msg, err
 }

+// UUID represents the value of SYNTH_UUID.
+//
+// This is not a generic UUID implementation. Do not attempt to use it for
+// anything other than passing and interpreting the SYNTH_UUID environment
+// variable of a uevent.
+type UUID [16]byte
+
+const (
+	// SizeUUID is the fixed size of string representation of [UUID] according
+	// to Documentation/ABI/testing/sysfs-uevent.
+	SizeUUID = 4 + len(UUID{})*2
+
+	// UUIDSep is the separator byte of [UUID].
+	UUIDSep = '-'
+)
+
+var (
+	_ encoding.TextAppender    = new(UUID)
+	_ encoding.TextMarshaler   = new(UUID)
+	_ encoding.TextUnmarshaler = new(UUID)
+)
+
+// String formats uuid according to Documentation/ABI/testing/sysfs-uevent.
+func (uuid *UUID) String() string {
+	s := make([]byte, 0, SizeUUID)
+	s = hex.AppendEncode(s, uuid[:4])
+	s = append(s, UUIDSep)
+	s = hex.AppendEncode(s, uuid[4:6])
+	s = append(s, UUIDSep)
+	s = hex.AppendEncode(s, uuid[6:8])
+	s = append(s, UUIDSep)
+	s = hex.AppendEncode(s, uuid[8:10])
+	s = append(s, UUIDSep)
+	s = hex.AppendEncode(s, uuid[10:16])
+	return unsafe.String(unsafe.SliceData(s), len(s))
+}
+
+func (uuid *UUID) AppendText(data []byte) ([]byte, error) {
+	return append(data, uuid.String()...), nil
+}
+func (uuid *UUID) MarshalText() ([]byte, error) {
+	return uuid.AppendText(nil)
+}
+
+var (
+	// ErrAutoUUID is returned parsing a SYNTH_UUID generated by the kernel for
+	// a synthetic event without a UUID passed in.
+	ErrAutoUUID = errors.New("UUID is not passed in")
+)
+
+// UUIDSizeError describes an incorrectly sized string representation of [UUID].
+type UUIDSizeError int
+
+func (e UUIDSizeError) Error() string {
+	return "got " + strconv.Itoa(int(e)) + " bytes " +
+		"instead of " + strconv.Itoa(SizeUUID)
+}
+
+// UUIDSeparatorError is an invalid separator in a malformed string
+// representation of [UUID].
+type UUIDSeparatorError byte
+
+func (e UUIDSeparatorError) Error() string {
+	return fmt.Sprintf("invalid UUID separator: %#U", rune(e))
+}
+
+// UnmarshalText parses data according to Documentation/ABI/testing/sysfs-uevent.
+func (uuid *UUID) UnmarshalText(data []byte) (err error) {
+	if len(data) == 1 && data[0] == '0' {
+		return ErrAutoUUID
+	}
+	if len(data) != SizeUUID {
+		return UUIDSizeError(len(data))
+	}
+
+	if _, err = hex.Decode(uuid[:], data[:8]); err != nil {
+		return
+	}
+	if data[8] != UUIDSep {
+		return UUIDSeparatorError(data[8])
+	}
+	data = data[9:]
+
+	if _, err = hex.Decode(uuid[4:], data[:4]); err != nil {
+		return
+	}
+	if data[4] != UUIDSep {
+		return UUIDSeparatorError(data[4])
+	}
+	data = data[5:]
+
+	if _, err = hex.Decode(uuid[6:], data[:4]); err != nil {
+		return
+	}
+	if data[4] != UUIDSep {
+		return UUIDSeparatorError(data[4])
+	}
+	data = data[5:]
+
+	if _, err = hex.Decode(uuid[8:], data[:4]); err != nil {
+		return
+	}
+	if data[4] != UUIDSep {
+		return UUIDSeparatorError(data[4])
+	}
+	data = data[5:]
+
+	_, err = hex.Decode(uuid[10:], data)
+	return
+}
+
 // Consume continuously receives and parses events from the kernel and handles
 // [Recoverable] and [NeedsColdboot] errors via caller-supplied functions,
 // entering coldboot when required.
@@ -145,6 +260,7 @@ func (c *Conn) receiveEvent(ctx context.Context) (*Message, error) {
 func (c *Conn) Consume(
 	ctx context.Context,
 	sysfs string,
+	uuid *UUID,
 	events chan<- *Message,
 	coldboot bool,

@@ -193,7 +309,7 @@ coldboot:
 	ctxColdboot, cancelColdboot := context.WithCancel(ctx)
 	var coldbootErr error
 	go func() {
-		coldbootErr = Coldboot(ctxColdboot, sysfs, visited, handleWalkErr)
+		coldbootErr = Coldboot(ctxColdboot, sysfs, uuid, visited, handleWalkErr)
 		close(visited)
 	}()
 	for pathname := range visited {
--- a/internal/uevent/uevent_test.go
+++ b/internal/uevent/uevent_test.go
@@ -3,8 +3,10 @@ package uevent_test
 import (
 	"context"
 	"encoding"
+	"encoding/hex"
 	"os"
 	"reflect"
+	"strings"
 	"sync"
 	"syscall"
 	"testing"
@@ -23,6 +25,12 @@ func adeT[V any, S interface {
 	*V
 }](t *testing.T, name string, v V, want string, wantErr, wantErrE error) {
 	t.Helper()
+
+	noEncode := strings.HasSuffix(name, "\x00")
+	if noEncode {
+		name = name[:len(name)-1]
+	}
+
 	f := func(t *testing.T) {
 		if name != "" {
 			t.Parallel()
@@ -46,6 +54,10 @@ func adeT[V any, S interface {
 			}
 		})

+		if noEncode {
+			return
+		}
+
 		t.Run("encode", func(t *testing.T) {
 			t.Parallel()
 			t.Helper()
@@ -114,6 +126,45 @@ func adeB[V any, S interface {
 	}
 }

+func TestUUID(t *testing.T) {
+	t.Parallel()
+
+	adeT(t, "sample", uevent.UUID{
+		0xfe, 0x4d, 0x7c, 0x9d,
+		0xb8, 0xc6,
+		0x4a, 0x70,
+		0x9e, 0xf1,
+		0x3d, 0x8a, 0x58, 0xd1, 0x8e, 0xed,
+	}, "fe4d7c9d-b8c6-4a70-9ef1-3d8a58d18eed", nil, nil)
+
+	adeT(t, "auto\x00", uevent.UUID{}, "0", uevent.ErrAutoUUID, nil)
+	adeT(t, "short\x00", uevent.UUID{}, "1", uevent.UUIDSizeError(1), nil)
+
+	adeT(t, "bad0\x00", uevent.UUID{}, "fe4d7c9\x00-b8c6-4a70-9ef1-3d8a58d18eed",
+		hex.InvalidByteError(0), nil)
+	adeT(t, "sep0\x00", uevent.UUID{}, "fe4d7c9d\x00b8c6-4a70-9ef1-3d8a58d18eed",
+		uevent.UUIDSeparatorError(0), nil)
+
+	adeT(t, "bad1\x00", uevent.UUID{}, "fe4d7c9d-b8c\x00-4a70-9ef1-3d8a58d18eed",
+		hex.InvalidByteError(0), nil)
+	adeT(t, "sep1\x00", uevent.UUID{}, "fe4d7c9d-b8c6\x004a70-9ef1-3d8a58d18eed",
+		uevent.UUIDSeparatorError(0), nil)
+
+	adeT(t, "bad2\x00", uevent.UUID{}, "fe4d7c9d-b8c6-4a7\x00-9ef1-3d8a58d18eed",
+		hex.InvalidByteError(0), nil)
+	adeT(t, "sep2\x00", uevent.UUID{}, "fe4d7c9d-b8c6-4a70\x009ef1-3d8a58d18eed",
+		uevent.UUIDSeparatorError(0), nil)
+
+	adeT(t, "bad3\x00", uevent.UUID{}, "fe4d7c9d-b8c6-4a70-9ef\x00-3d8a58d18eed",
+		hex.InvalidByteError(0), nil)
+	adeT(t, "sep3\x00", uevent.UUID{}, "fe4d7c9d-b8c6-4a70-9ef1\x003d8a58d18eed",
+		uevent.UUIDSeparatorError(0), nil)
+
+	adeT(t, "bad4\x00", uevent.UUID{}, "fe4d7c9d-b8c6-4a70-9ef1-3d8a58d18ee\x00",
+		hex.InvalidByteError(0), nil)
+
+}
+
 func TestDialConsume(t *testing.T) {
 	t.Parallel()

@@ -157,7 +208,7 @@ func TestDialConsume(t *testing.T) {
 	defer cancel()

 	consume := func(c *uevent.Conn, ctx context.Context) error {
-		return c.Consume(ctx, fhs.Sys, events, false, func(path string) {
+		return c.Consume(ctx, fhs.Sys, nil, events, false, func(path string) {
 			t.Log("coldboot visited", path)
 		}, func(err error) bool {
 			t.Log(err)
@@ -244,6 +295,11 @@ func TestErrors(t *testing.T) {
 		{"BadPortError", &uevent.BadPortError{
 			Pid: 1,
 		}, "unexpected message from port id 1 on NETLINK_KOBJECT_UEVENT"},
+
+		{"UUIDSizeError", uevent.UUIDSizeError(0xbad),
+			"got 2989 bytes instead of 36"},
+		{"UUIDSeparatorError", uevent.UUIDSeparatorError(0xfd),
+			"invalid UUID separator: U+00FD 'ý'"},
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
--- a/ldd/exec.go
+++ b/ldd/exec.go
@@ -7,7 +7,6 @@ import (
 	"io"
 	"os"
 	"os/exec"
-	"time"

 	"hakurei.app/check"
 	"hakurei.app/container"
@@ -27,9 +26,6 @@ const (

 	// lddName is the file name of ldd(1) passed to exec.LookPath.
 	lddName = "ldd"
-	// lddTimeout is the maximum duration ldd(1) is allowed to ran for before it
-	// is terminated.
-	lddTimeout = 15 * time.Second
 )

 // Resolve runs ldd(1) in a strict sandbox and connects its stdout to a [Decoder].
@@ -52,7 +48,7 @@ func Resolve(
 		}
 	}

-	c, cancel := context.WithTimeout(ctx, lddTimeout)
+	c, cancel := context.WithCancel(ctx)
 	defer cancel()

 	var toolPath *check.Absolute
--- a/package.nix
+++ b/package.nix
@@ -82,9 +82,6 @@ buildGo126Module rec {
  env = {
    # use clang instead of gcc
    CC = "clang -O3 -Werror";
-
-    # nix build environment does not allow acls
-    HAKUREI_TEST_SKIP_ACL = 1;
  };

  buildInputs = [
@@ -116,7 +113,7 @@ buildGo126Module rec {
      ];
    in
    ''
-      install -D --target-directory=$out/share/zsh/site-functions dist/comp/*
+      install -D --target-directory=$out/share/zsh/site-functions cmd/dist/comp/*

      mkdir "$out/libexec"
      mv "$out"/bin/* "$out/libexec/"
--- a/test/default.nix
+++ b/test/default.nix
@@ -44,7 +44,7 @@ testers.nixosTest {

          cd ${self.packages.${system}.hakurei.src}
          ${fhs}/bin/hakurei-fhs -c \
-            'CC="clang -O3 -Werror" go test ${if withRace then "-race" else "-count 16"} ./...' \
+            'CC="clang -O3 -Werror" go test --tags=noskip ${if withRace then "-race" else "-count 16"} ./...' \
            &> /tmp/hakurei-test.log && \
            touch /tmp/hakurei-test-ok
          touch /tmp/hakurei-test-done
--- a/test/interactive/configuration.nix
+++ b/test/interactive/configuration.nix
@@ -8,7 +8,10 @@
      description = "Alice Foobar";
      password = "foobar";
      uid = 1000;
-      extraGroups = [ "wheel" ];
+      extraGroups = [
+        "wheel"
+        "sharefs"
+      ];
    };
    untrusted = {
      isNormalUser = true;
--- a/test/interactive/raceattr.nix
+++ b/test/interactive/raceattr.nix
@@ -0,0 +1,30 @@
+{ lib, pkgs, ... }:
+{
+  security.wrappers.raceattr =
+    let
+      inherit (pkgs) buildGoModule;
+    in
+    {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${
+        (buildGoModule rec {
+          name = "raceattr";
+          pname = name;
+          tags = [ "raceattr" ];
+
+          src = builtins.path {
+            name = "${pname}-src";
+            path = lib.cleanSource ../../cmd/sharefs/test;
+            filter = path: type: (type == "directory") || (type == "regular" && lib.hasSuffix ".go" path);
+          };
+          vendorHash = null;
+
+          preBuild = ''
+            go mod init hakurei.app/raceattr >& /dev/null
+          '';
+        })
+      }/bin/raceattr";
+    };
+}
Author	SHA1	Message	Date
Kat	3546c54ced	TODO: actually write tests lol	2026-04-09 11:46:25 +10:00
Kat	f64c793352	cmd/pkgserver: add noscript warning to test web UI	2026-04-09 11:46:25 +10:00
Kat	5474a75f1a	cmd/pkgserver: relocate JS tests	2026-04-09 11:46:25 +10:00
Kat	fa64bd7b49	cmd/pkgserver: aria-describe test node summary with state The summary marker does not appear in the AOM, so setting its alt text is fruitless.	2026-04-09 11:46:25 +10:00
Kat	89859ddfa3	cmd/pkgserver: provide role descriptions for test nodes in web UI	2026-04-09 11:46:25 +10:00
Kat	7c81681eab	cmd/pkgserver: fix dark mode in test web UI	2026-04-09 11:46:25 +10:00
Kat	a958149cb5	cmd/pkgserver: serialize JS enums as ints instead of strings	2026-04-09 11:46:25 +10:00
Kat	a3ff361bc8	cmd/pkgserver: set exit code when running JS tests from CLI	2026-04-09 11:46:25 +10:00
Kat	f621cebb73	cmd/pkgserver: expose verbose StreamReporter flag via CLI	2026-04-09 11:46:25 +10:00
Kat	aed0c98146	cmd/pkgserver: implement skipping JS tests from the DSL	2026-04-09 11:46:25 +10:00
Kat	0e31d8954d	cmd/pkgserver: allow non-global JS test suites	2026-04-09 11:46:25 +10:00
Kat	4af44605ce	cmd/pkgserver: serialize raw log list for go test consumption	2026-04-09 11:46:25 +10:00
Kat	a2473404d8	cmd/pkgserver: add JSON reporter to facilitate go test integration	2026-04-09 11:46:25 +10:00
Kat	9864f8329f	cmd/pkgserver: fix multi-line JS test output display	2026-04-09 11:46:25 +10:00
Kat	b12a910d60	cmd/pkgserver: implement JS test DSL and runner	2026-04-09 11:46:25 +10:00
Kat	339aba4167	cmd/pkgserver: move StreamReporter display() to Reporter interface	2026-04-09 11:46:25 +10:00
Kat	fdbf2a43eb	cmd/pkgserver: add DOM reporter for JS tests	2026-04-09 11:46:25 +10:00
Kat	9d3b98e063	cmd/pkgserver: add basic CLI reporter for testing JS	2026-04-09 11:46:25 +10:00
Kat	0183064f25	cmd/pkgserver: enable TypeScript's strict mode	2026-04-09 11:46:25 +10:00
mae	0db8da9cba	cmd/pkgserver: remove get endpoint count field	2026-04-08 20:26:38 -05:00
mae	4ae5468cf6	cmd/pkgserver: search endpoint	2026-04-08 20:26:38 -05:00
mae	226b86fe38	cmd/pkgserver: pagination bugfix	2026-04-08 20:26:38 -05:00
Ophestra	23b5d0dd3e	cmd/pkgserver: guard sass/ts behind build tag Packaging nodejs and ruby is an immense burden for the Rosa OS base system, and these files diff poorly. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
mae	ba06769c5f	cmd/pkgserver: add size	2026-04-08 20:26:38 -05:00
Ophestra	28e84f0445	cmd/pkgserver: expose size and store pre-encoded ident This change also handles SIGSEGV correctly in newStatusHandler, and makes serving status fully zero copy. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
Ophestra	51ae9496e9	cmd/pkgserver: look up status by name once This has far less overhead. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
Ophestra	3cd8abc451	cmd/pkgserver: refer to preset in index This enables referencing back to internal/rosa through an entry obtained via the index. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
Ophestra	edf4d0d32a	cmd/pkgserver: handle unversioned value This omits the field for an unversioned artifact, and only does so once on startup. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
Ophestra	97657ad9fc	cmd/pkgserver: determine disposition route in mux This removes duplicate checks and uses the more sound check in mux. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
Ophestra	81344a1c8a	cmd/pkgserver: format get error messages This improves source code readability on smaller displays. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
Ophestra	50514edc00	cmd/pkgserver: constant string in pattern This resolves patterns at compile time. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
Ophestra	7affd5735a	cmd/pkgserver: satisfy handler signature in method This is somewhat cleaner. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
Ophestra	0a2d9dbe42	cmd/pkgserver: log instead of write encoding error This message is unlikely to be useful to the user, and output may be partially written at this point, causing the error to be even less intelligible. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
Ophestra	049f212a02	cmd/pkgserver: appropriately mark test helpers This improves usefulness of test log messages. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
Ophestra	ccecaee7ca	cmd/pkgserver: do not omit report field Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
Ophestra	365602c9b6	cmd/pkgserver: gracefully shut down on signal Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
Ophestra	85e066ccc4	cmd/pkgserver: specify full addr string in flag This allows greater flexibility. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
Ophestra	ffe37ae439	cmd/pkgserver: make report argument optional This allows serving metadata only without a populated report. This also removes the out-of-bounds read on args when no arguments are passed. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
Ophestra	222a2aa8b4	cmd/pkgserver: embed internal/rosa metadata This change also cleans up and reduces some unnecessary copies. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:38 -05:00
Ophestra	29384553bf	cmd/pkgserver: do not assume default mux This helps with testing. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:37 -05:00
Ophestra	cb0c652b18	cmd/pkgserver: create index without report This is useful for testing, where report testdata is not available. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 20:26:37 -05:00
mae	5552598bc4	cmd/pkgserver: add sort orders, change pagination rules	2026-04-08 20:26:37 -05:00
mae	3db5603e78	cmd/pkgserver: add /status endpoint	2026-04-08 20:26:37 -05:00
mae	08d120a84d	cmd/pkgserver: minimum viable frontend	2026-04-08 20:26:37 -05:00
mae	1ecdcdc243	cmd/pkgserver: api versioning	2026-04-08 20:26:37 -05:00
mae	e425c3b769	cmd/pkgserver: add get endpoint	2026-04-08 20:26:37 -05:00
mae	3d8b89e1ab	cmd/pkgserver: add count endpoint and restructure	2026-04-08 20:26:37 -05:00
mae	b2777de621	cmd/pkgserver: add status endpoint	2026-04-08 20:26:37 -05:00
mae	529a641fcd	cmd/pkgserver: add createPackageIndex	2026-04-08 20:26:37 -05:00
mae	0e34ec3093	cmd/pkgserver: add command handler	2026-04-08 20:26:37 -05:00
mae	31b2d5431c	cmd/pkgserver: replace favicon	2026-04-08 20:26:37 -05:00
mae	d6954e6bdb	cmd/pkgserver: pagination	2026-04-08 20:26:37 -05:00
mae	1cda0d83c3	cmd/pkgserver: basic web ui	2026-04-08 20:26:37 -05:00
Ophestra	e34e3b917e	internal/kobject: process uevent message This deals with environment variables generally present in every message. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 18:00:04 +09:00
Ophestra	b0ba165107	cmd/sharefs: group-accessible permission bits This works around the race in vfs via supplementary group. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 16:14:47 +09:00
Ophestra	351d6c5a35	cmd/sharefs: reproduce vfs inode file attribute race This happens in the vfs permissions check only and stale data appears to never reach userspace. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-08 15:51:36 +09:00
Ophestra	f23f73701c	cmd/mbf: optional host abstract This works around kernels with Landlock LSM disabled. Does not affect cure outcome. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-07 18:15:49 +09:00
Ophestra	876917229a	internal/rosa/go: enable riscv64 bootstrap path This is quite expensive, but no other option, unfortunately. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-07 18:11:42 +09:00
Ophestra	0558032c2d	container: do not set static deadline This usually ends up in the buffer, or completes well before the deadline, however this can still timeout on a very slow system. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-07 17:00:20 +09:00
Ophestra	c61cdc505f	internal/params: relocate from package container This does not make sense as part of the public API, so make it internal. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-07 16:37:44 +09:00
Ophestra	062edb3487	container: remove setup pipe helper The API forces use of finalizer to close the read end of the setup pipe, which is no longer considered acceptable. Exporting this as part of package container also imposes unnecessary maintenance burden. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-07 16:05:33 +09:00
Ophestra	e4355279a1	all: optionally forbid degrading in tests This enables transparently degradable tests to be forced on in environments known to support them. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-07 15:22:52 +09:00
Ophestra	289fdebead	container: transparently degrade landlock in tests Explicitly requiring landlock in tests will be supported in a future change. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-07 15:03:48 +09:00
Ophestra	9c9e190db9	ldd: remove timeout The program generally never blocks, and it is more flexible to leave it up to the caller to set a timeout. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-07 14:49:20 +09:00
Ophestra	d7d42c69a1	internal/pkg: transparently degrade landlock in tests This does not test package container, so should transparently cope with Landlock LSM being unavailable. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-07 14:44:34 +09:00
Ophestra	c758e762bd	container: skip landlock on hostnet This overlaps with net namespace, so can be skipped without degrading security. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-07 14:36:44 +09:00
Ophestra	10f8b1c221	internal/pkg: optional landlock LSM The alpine linux riscv64 kernel does not enable Landlock LSM, and kernel compilation is not yet feasible. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-07 12:44:07 +09:00
Ophestra	6907700d67	cmd/dist: set hsu tar header mode bits This has no effect, but is nice to have. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-06 23:37:38 +09:00
Ophestra	0243f3ffbd	internal/rosa/stage0: add riscv64 tarball This had not yet passed all test suites because emulator is prohibitively slow. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-06 13:57:43 +09:00
Ophestra	cd0beeaf8e	internal/uevent: optionally pass UUID during coldboot This enables rejection of non-coldboot synthetic events. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-06 12:42:47 +09:00
Ophestra	a69273ab2a	cmd/dist: replace dist/release.sh This is much more robust than a shell script. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-05 23:58:08 +09:00
Ophestra	4cd0f57e48	dist: remove redundant cleanup This breaks on shells that do not evaluate pathnames. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-04-05 16:16:37 +09:00