11b3171180
internal/rosa/glslang: glslang artifact
...
Required by mesa.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-12 22:34:17 +09:00
adbb84c3dd
internal/rosa/glslang: spirv-tools artifact
...
Required by glslang.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-12 22:27:49 +09:00
1084e31d95
internal/rosa/glslang: spirv-headers artifact
...
Required by spirv-tools.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-12 22:16:29 +09:00
27a1b8fe0a
internal/rosa/mesa: libglvnd artifact
...
Required by mesa.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-12 21:27:30 +09:00
b2141a41d7
internal/rosa/dbus: xdg-dbus-proxy artifact
...
This is currently a hakurei runtime dependency, but will eventually be removed.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-12 19:41:49 +09:00
c0dff5bc87
internal/rosa/gnu: gcc set with-multilib-list as needed
...
This breaks riscv64.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-12 18:03:45 +09:00
04513c0510
internal/rosa/gnu: gmp explicit CC
...
The configure script is hard coded to use gcc without fallback on riscv64.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-12 17:25:15 +09:00
28ebf973d6
nix: add sharefs supplementary group
...
This works around vfs inode file attribute race.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-11 23:28:18 +09:00
41aeb404ec
internal/rosa/hakurei: 0.3.7 to 0.4.0
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-11 10:53:29 +09:00
0b1009786f
release: 0.4.0
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-11 10:49:43 +09:00
b390640376
internal/landlock: relocate from package container
...
This is not possible to use directly, so remove it from the public API.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-10 23:56:45 +09:00
ad2c9f36cd
container: unexport PR_SET_NO_NEW_PRIVS wrapper
...
This is subtle to use correctly. It also does not make sense as part of the container API.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-10 23:45:51 +09:00
67db3fbb8d
check: use encoding interfaces
...
This turned out not to require specific treatment, so the shared interfaces are cleaner.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-10 22:11:53 +09:00
560cb626a1
hst: remove enablement json adapter
...
The go116 behaviour of built-in new function makes this cleaner.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-10 20:47:30 +09:00
c33a6a5b7e
hst: optionally reject insecure options
...
This prevents inadvertent use of insecure compatibility features.
Closes #30 .
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-10 19:34:02 +09:00
952082bd9b
internal/rosa/python: 3.14.3 to 3.14.4
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-10 02:38:22 +09:00
24a9b24823
internal/rosa/openssl: 3.6.1 to 3.6.2
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-10 02:38:02 +09:00
c2e61e7987
internal/rosa/libcap: 2.77 to 2.78
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-10 02:37:04 +09:00
86787b3bc5
internal/rosa/tamago: 1.26.1 to 1.26.2
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-10 02:31:57 +09:00
cdfcfe6ce0
internal/rosa/go: 1.26.1 to 1.26.2
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-10 02:18:27 +09:00
68a2f0c240
internal/rosa/llvm: remove unused field
...
This change also renames confusingly named flags field and corrects its doc comment.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-10 02:13:26 +09:00
7319c7adf9
internal/rosa/llvm: use latest version on arm64
...
This also removes arch-specific patches because they were not useful.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-10 01:07:25 +09:00
e9c890cbb2
internal/rosa/llvm: enable cross compilation
...
This now passes the test suite.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-10 00:59:14 +09:00
6f924336fc
internal/rosa/llvm: increase stack size
...
Some aarch64 regression tests fail intermittently on the default size.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-10 00:56:51 +09:00
bd88f10524
internal/rosa/llvm: 22.1.2 to 22.1.3
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-09 17:36:23 +09:00
e34e3b917e
internal/kobject: process uevent message
...
This deals with environment variables generally present in every message.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-08 18:00:04 +09:00
b0ba165107
cmd/sharefs: group-accessible permission bits
...
This works around the race in vfs via supplementary group.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-08 16:14:47 +09:00
351d6c5a35
cmd/sharefs: reproduce vfs inode file attribute race
...
This happens in the vfs permissions check only and stale data appears to never reach userspace.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-08 15:51:36 +09:00
f23f73701c
cmd/mbf: optional host abstract
...
This works around kernels with Landlock LSM disabled. Does not affect cure outcome.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-07 18:15:49 +09:00
876917229a
internal/rosa/go: enable riscv64 bootstrap path
...
This is quite expensive, but no other option, unfortunately.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-07 18:11:42 +09:00
0558032c2d
container: do not set static deadline
...
This usually ends up in the buffer, or completes well before the deadline, however this can still timeout on a very slow system.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-07 17:00:20 +09:00
c61cdc505f
internal/params: relocate from package container
...
This does not make sense as part of the public API, so make it internal.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-07 16:37:44 +09:00
062edb3487
container: remove setup pipe helper
...
The API forces use of finalizer to close the read end of the setup pipe, which is no longer considered acceptable. Exporting this as part of package container also imposes unnecessary maintenance burden.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-07 16:05:33 +09:00
e4355279a1
all: optionally forbid degrading in tests
...
This enables transparently degradable tests to be forced on in environments known to support them.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-07 15:22:52 +09:00
289fdebead
container: transparently degrade landlock in tests
...
Explicitly requiring landlock in tests will be supported in a future change.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-07 15:03:48 +09:00
9c9e190db9
ldd: remove timeout
...
The program generally never blocks, and it is more flexible to leave it up to the caller to set a timeout.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-07 14:49:20 +09:00
d7d42c69a1
internal/pkg: transparently degrade landlock in tests
...
This does not test package container, so should transparently cope with Landlock LSM being unavailable.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-07 14:44:34 +09:00
c758e762bd
container: skip landlock on hostnet
...
This overlaps with net namespace, so can be skipped without degrading security.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-07 14:36:44 +09:00
10f8b1c221
internal/pkg: optional landlock LSM
...
The alpine linux riscv64 kernel does not enable Landlock LSM, and kernel compilation is not yet feasible.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-07 12:44:07 +09:00
6907700d67
cmd/dist: set hsu tar header mode bits
...
This has no effect, but is nice to have.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-06 23:37:38 +09:00
0243f3ffbd
internal/rosa/stage0: add riscv64 tarball
...
This had not yet passed all test suites because emulator is prohibitively slow.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-06 13:57:43 +09:00
cd0beeaf8e
internal/uevent: optionally pass UUID during coldboot
...
This enables rejection of non-coldboot synthetic events.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-06 12:42:47 +09:00
a69273ab2a
cmd/dist: replace dist/release.sh
...
This is much more robust than a shell script.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-05 23:58:08 +09:00
4cd0f57e48
dist: remove redundant cleanup
...
This breaks on shells that do not evaluate pathnames.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-05 16:16:37 +09:00
33a0e6c01b
hst: conditionally skip root remount
...
This enables the writable root overlay use case.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-05 14:04:21 +09:00
d58f5c7590
dist: destroy workdir on exist
...
This no longer relies on the hermetic build system to clean up.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-05 13:32:16 +09:00
1da992e342
dist: prefix from environment
...
These are baked in, so make them configurable for the build.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-05 13:11:44 +09:00
9641805ec2
container/init: ignore finished process
...
This is not considered an error, if the process finishes while the signal is being delivered.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-05 00:38:33 +09:00
0738f4889a
internal/rosa/gnu: fetch mpc source via git
...
Eliminates the xz dependency.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-05 00:35:15 +09:00
7de3cfe221
internal/rosa/netfilter: fetch iptables source via git
...
Eliminates the xz dependency.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2026-04-05 00:19:40 +09:00
