cmd/irdump: formatted disassembly

.gitignore

@@ -7,8 +7,7 @@
 
 # go generate
 /cmd/hakurei/LICENSE
-/cmd/mbf/internal/pkgserver/ui/static
+/internal/pkg/testdata/testtool
-/internal/pkg/internal/testtool/testtool
 /internal/rosa/hakurei_current.tar.gz
 
 # cmd/dist default destination

all.sh

@@ -1,3 +1,6 @@
 #!/bin/sh -e
 
-HAKUREI_DIST_MAKE='' exec "$(dirname -- "$0")/cmd/dist/dist.sh"
+TOOLCHAIN_VERSION="$(go version)"
+cd "$(dirname -- "$0")/"
+echo "# Building cmd/dist using ${TOOLCHAIN_VERSION}."
+go run -v --tags=dist ./cmd/dist

check/absolute.go

@@ -2,7 +2,7 @@
 package check
 
 import (
-	"encoding"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"path/filepath"
@@ -30,16 +30,6 @@ func (e AbsoluteError) Is(target error) bool {
 // Absolute holds a pathname checked to be absolute.
 type Absolute struct{ pathname unique.Handle[string] }
 
-var (
-	_ encoding.TextAppender    = new(Absolute)
-	_ encoding.TextMarshaler   = new(Absolute)
-	_ encoding.TextUnmarshaler = new(Absolute)
-
-	_ encoding.BinaryAppender    = new(Absolute)
-	_ encoding.BinaryMarshaler   = new(Absolute)
-	_ encoding.BinaryUnmarshaler = new(Absolute)
-)
-
 // ok returns whether [Absolute] is not the zero value.
 func (a *Absolute) ok() bool { return a != nil && *a != (Absolute{}) }
 
@@ -94,16 +84,13 @@ func (a *Absolute) Append(elem ...string) *Absolute {
 // Dir calls [filepath.Dir] with [Absolute] as its argument.
 func (a *Absolute) Dir() *Absolute { return unsafeAbs(filepath.Dir(a.String())) }
 
-// AppendText appends the checked pathname.
+// GobEncode returns the checked pathname.
-func (a *Absolute) AppendText(data []byte) ([]byte, error) {
+func (a *Absolute) GobEncode() ([]byte, error) {
-	return append(data, a.String()...), nil
+	return []byte(a.String()), nil
 }
 
-// MarshalText returns the checked pathname.
+// GobDecode stores data if it represents an absolute pathname.
-func (a *Absolute) MarshalText() ([]byte, error) { return a.AppendText(nil) }
+func (a *Absolute) GobDecode(data []byte) error {
-
-// UnmarshalText stores data if it represents an absolute pathname.
-func (a *Absolute) UnmarshalText(data []byte) error {
 	pathname := string(data)
 	if !filepath.IsAbs(pathname) {
 		return AbsoluteError(pathname)
@@ -112,9 +99,23 @@ func (a *Absolute) UnmarshalText(data []byte) error {
 	return nil
 }
 
-func (a *Absolute) AppendBinary(data []byte) ([]byte, error) { return a.AppendText(data) }
+// MarshalJSON returns a JSON representation of the checked pathname.
-func (a *Absolute) MarshalBinary() ([]byte, error)           { return a.MarshalText() }
+func (a *Absolute) MarshalJSON() ([]byte, error) {
-func (a *Absolute) UnmarshalBinary(data []byte) error        { return a.UnmarshalText(data) }
+	return json.Marshal(a.String())
+}
+
+// UnmarshalJSON stores data if it represents an absolute pathname.
+func (a *Absolute) UnmarshalJSON(data []byte) error {
+	var pathname string
+	if err := json.Unmarshal(data, &pathname); err != nil {
+		return err
+	}
+	if !filepath.IsAbs(pathname) {
+		return AbsoluteError(pathname)
+	}
+	a.pathname = unique.Make(pathname)
+	return nil
+}
 
 // SortAbs calls [slices.SortFunc] for a slice of [Absolute].
 func SortAbs(x []*Absolute) {

check/absolute_test.go

@@ -170,20 +170,20 @@ func TestCodecAbsolute(t *testing.T) {
 
 		{"good", MustAbs("/etc"),
 			nil,
-			"\t\x7f\x06\x01\x02\xff\x82\x00\x00\x00\b\xff\x80\x00\x04/etc",
+			"\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\b\xff\x80\x00\x04/etc",
-			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x06\x00\x00\x00\t\x7f\x06\x01\x02\xff\x82\x00\x00\x00\x0f\xff\x84\x01\x04/etc\x01\xfc\xc0\xed\x00\x00\x00",
+			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x06\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x0f\xff\x84\x01\x04/etc\x01\xfc\xc0\xed\x00\x00\x00",
 
 			`"/etc"`, `{"val":"/etc","magic":3236757504}`},
 		{"not absolute", nil,
 			AbsoluteError("etc"),
-			"\t\x7f\x06\x01\x02\xff\x82\x00\x00\x00\a\xff\x80\x00\x03etc",
+			"\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\a\xff\x80\x00\x03etc",
-			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x06\x00\x00\x00\t\x7f\x06\x01\x02\xff\x82\x00\x00\x00\x0f\xff\x84\x01\x03etc\x01\xfb\x01\x81\xda\x00\x00\x00",
+			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x06\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x0f\xff\x84\x01\x03etc\x01\xfb\x01\x81\xda\x00\x00\x00",
 
 			`"etc"`, `{"val":"etc","magic":3236757504}`},
 		{"zero", nil,
 			new(AbsoluteError),
-			"\t\x7f\x06\x01\x02\xff\x82\x00\x00\x00\x04\xff\x80\x00\x00",
+			"\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x04\xff\x80\x00\x00",
-			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x06\x00\x00\x00\t\x7f\x06\x01\x02\xff\x82\x00\x00\x00\f\xff\x84\x01\x00\x01\xfb\x01\x81\xda\x00\x00\x00",
+			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x06\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\f\xff\x84\x01\x00\x01\xfb\x01\x81\xda\x00\x00\x00",
 			`""`, `{"val":"","magic":3236757504}`},
 	}
 
@@ -347,6 +347,15 @@ func TestCodecAbsolute(t *testing.T) {
 			})
 		})
 	}
+
+	t.Run("json passthrough", func(t *testing.T) {
+		t.Parallel()
+
+		wantErr := "invalid character ':' looking for beginning of value"
+		if err := new(Absolute).UnmarshalJSON([]byte(":3")); err == nil || err.Error() != wantErr {
+			t.Errorf("UnmarshalJSON: error = %v, want %s", err, wantErr)
+		}
+	})
 }
 
 func TestAbsoluteWrap(t *testing.T) {

check/overlay.go

@@ -4,23 +4,15 @@ import "strings"
 
 const (
 	// SpecialOverlayEscape is the escape string for overlay mount options.
-	//
-	// Deprecated: This is no longer used and will be removed in 0.5.
 	SpecialOverlayEscape = `\`
 	// SpecialOverlayOption is the separator string between overlay mount options.
-	//
-	// Deprecated: This is no longer used and will be removed in 0.5.
 	SpecialOverlayOption = ","
 	// SpecialOverlayPath is the separator string between overlay paths.
-	//
-	// Deprecated: This is no longer used and will be removed in 0.5.
 	SpecialOverlayPath = ":"
 )
 
 // EscapeOverlayDataSegment escapes a string for formatting into the data
 // argument of an overlay mount system call.
-//
-// Deprecated: This is no longer used and will be removed in 0.5.
 func EscapeOverlayDataSegment(s string) string {
 	if s == "" {
 		return ""

cmd/dist/dist.sh

@@ -1,10 +0,0 @@
-#!/bin/sh -e
-
-TOOLCHAIN_VERSION="$(go version)"
-cd "$(dirname -- "$0")/../.."
-echo "Building cmd/dist using ${TOOLCHAIN_VERSION}."
-FLAGS=''
-if test -n "$VERBOSE"; then
-    FLAGS="$FLAGS -v"
-fi
-go run $FLAGS --tags=dist ./cmd/dist

cmd/dist/main.go

@@ -42,19 +42,14 @@ func mustRun(ctx context.Context, name string, arg ...string) {
 var comp []byte
 
 func main() {
+	fmt.Println()
 	log.SetFlags(0)
-	log.SetPrefix("")
+	log.SetPrefix("# ")
 
-	verbose := os.Getenv("VERBOSE") != ""
-	runTests := os.Getenv("HAKUREI_DIST_MAKE") == ""
 	version := getenv("HAKUREI_VERSION", "untagged")
 	prefix := getenv("PREFIX", "/usr")
 	destdir := getenv("DESTDIR", "dist")
 
-	if verbose {
-		log.Println()
-	}
-
 	if err := os.MkdirAll(destdir, 0755); err != nil {
 		log.Fatal(err)
 	}
@@ -81,17 +76,12 @@ func main() {
 	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
 	defer cancel()
 
-	verboseFlag := "-v"
+	log.Println("Building hakurei.")
-	if !verbose {
-		verboseFlag = "-buildvcs=false"
-	}
-
-	log.Printf("Building hakurei for %s/%s.", runtime.GOOS, runtime.GOARCH)
 	mustRun(ctx, "go", "generate", "./...")
 	mustRun(
 		ctx, "go", "build",
 		"-trimpath",
-		verboseFlag, "-o", s,
+		"-v", "-o", s,
 		"-ldflags=-s -w "+
 			"-buildid= -linkmode external -extldflags=-static "+
 			"-X hakurei.app/internal/info.buildVersion="+version+" "+
@@ -100,19 +90,17 @@ func main() {
 			"-X main.hakureiPath="+prefix+"/bin/hakurei",
 		"./...",
 	)
-	log.Println()
+	fmt.Println()
 
-	if runTests {
+	log.Println("Testing Hakurei.")
-		log.Println("##### Testing Hakurei.")
+	mustRun(
-		mustRun(
+		ctx, "go", "test",
-			ctx, "go", "test",
+		"-ldflags=-buildid= -linkmode external -extldflags=-static",
-			"-ldflags=-buildid= -linkmode external -extldflags=-static",
+		"./...",
-			"./...",
+	)
-		)
+	fmt.Println()
-		log.Println()
-	}
 
-	log.Println("##### Creating distribution.")
+	log.Println("Creating distribution.")
 	const suffix = ".tar.gz"
 	distName := "hakurei-" + version + "-" + runtime.GOARCH
 	var f *os.File
@@ -133,7 +121,7 @@ func main() {
 	}()
 
 	h := sha512.New()
-	gw, _ := gzip.NewWriterLevel(io.MultiWriter(f, h), gzip.BestCompression)
+	gw := gzip.NewWriter(io.MultiWriter(f, h))
 	tw := tar.NewWriter(gw)
 
 	mustWriteHeader := func(name string, size int64, mode os.FileMode) {

cmd/hakurei/command.go

@@ -38,9 +38,8 @@ var errSuccess = errors.New("success")
 
 func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErrs, out io.Writer) command.Command {
 	var (
-		flagVerbose  bool
+		flagVerbose bool
-		flagInsecure bool
+		flagJSON    bool
-		flagJSON     bool
 	)
 	c := command.New(out, log.Printf, "hakurei", func([]string) error {
 		msg.SwapVerbose(flagVerbose)
@@ -58,7 +57,6 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 		return nil
 	}).
 		Flag(&flagVerbose, "v", command.BoolFlag(false), "Increase log verbosity").
-		Flag(&flagInsecure, "insecure", command.BoolFlag(false), "Allow use of insecure compatibility options").
 		Flag(&flagJSON, "json", command.BoolFlag(false), "Serialise output in JSON when applicable")
 
 	c.Command("shim", command.UsageInternal, func([]string) error { outcome.Shim(msg); return errSuccess })
@@ -77,12 +75,7 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				config.Container.Args = append(config.Container.Args, args[1:]...)
 			}
 
-			var flags int
+			outcome.Main(ctx, msg, config, flagIdentifierFile)
-			if flagInsecure {
-				flags |= hst.VAllowInsecure
-			}
-
-			outcome.Main(ctx, msg, config, flags, flagIdentifierFile)
 			panic("unreachable")
 		}).
 			Flag(&flagIdentifierFile, "identifier-fd", command.IntFlag(-1),
@@ -152,7 +145,7 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				}
 			}
 
-			var et hst.Enablements
+			var et hst.Enablement
 			if flagWayland {
 				et |= hst.EWayland
 			}
@@ -170,7 +163,7 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				ID:          flagID,
 				Identity:    flagIdentity,
 				Groups:      flagGroups,
-				Enablements: &et,
+				Enablements: hst.NewEnablements(et),
 
 				Container: &hst.ContainerConfig{
 					Filesystem: []hst.FilesystemConfigJSON{
@@ -289,7 +282,7 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				}
 			}
 
-			outcome.Main(ctx, msg, &config, 0, -1)
+			outcome.Main(ctx, msg, &config, -1)
 			panic("unreachable")
 		}).
 			Flag(&flagDBusConfigSession, "dbus-config", command.StringFlag("builtin"),

cmd/hakurei/command_test.go

@@ -20,7 +20,7 @@ func TestHelp(t *testing.T) {
 	}{
 		{
 			"main", []string{}, `
-Usage:	hakurei [-h | --help] [-v] [--insecure] [--json] COMMAND [OPTIONS]
+Usage:	hakurei [-h | --help] [-v] [--json] COMMAND [OPTIONS]
 
 Commands:
     run         Load and start container from configuration file

cmd/hakurei/print.go

@@ -56,7 +56,7 @@ func printShowInstance(
 	t := newPrinter(output)
 	defer t.MustFlush()
 
-	if err := config.Validate(hst.VAllowInsecure); err != nil {
+	if err := config.Validate(); err != nil {
 		valid = false
 		if m, ok := message.GetMessage(err); ok {
 			mustPrint(output, "Error: "+m+"!\n\n")

cmd/hakurei/print_test.go

@@ -32,7 +32,7 @@ var (
 		PID:     0xbeef,
 		ShimPID: 0xcafe,
 		Config: &hst.Config{
-			Enablements: new(hst.EWayland | hst.EPipeWire),
+			Enablements: hst.NewEnablements(hst.EWayland | hst.EPipeWire),
 			Identity:    1,
 			Container: &hst.ContainerConfig{
 				Shell: check.MustAbs("/bin/sh"),

cmd/mbf/cache.go

@@ -1,135 +0,0 @@
-package main
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"hakurei.app/check"
-	"hakurei.app/container"
-	"hakurei.app/internal/pkg"
-	"hakurei.app/message"
-)
-
-// cache refers to an instance of [pkg.Cache] that might be open.
-type cache struct {
-	ctx context.Context
-	msg message.Msg
-
-	// Should generally not be used directly.
-	c *pkg.Cache
-
-	cures, jobs int
-	// Primarily to work around missing landlock LSM.
-	hostAbstract bool
-	// Set SCHED_IDLE.
-	idle bool
-	// Unset [pkg.CSuppressInit].
-	verboseInit bool
-	// Loaded artifact of [rosa.QEMU].
-	qemu pkg.Artifact
-
-	base string
-}
-
-// open opens the underlying [pkg.Cache].
-func (cache *cache) open() (err error) {
-	if cache.c != nil {
-		return os.ErrInvalid
-	}
-
-	var base *check.Absolute
-	if cache.base, err = filepath.Abs(cache.base); err != nil {
-		return
-	} else if base, err = check.NewAbs(cache.base); err != nil {
-		return
-	}
-
-	var flags int
-	if cache.idle {
-		flags |= pkg.CSchedIdle
-	}
-	if cache.hostAbstract {
-		flags |= pkg.CHostAbstract
-	}
-	if !cache.verboseInit {
-		flags |= pkg.CSuppressInit
-	}
-
-	done := make(chan struct{})
-	defer close(done)
-	go func() {
-		select {
-		case <-cache.ctx.Done():
-			if testing.Testing() {
-				return
-			}
-			os.Exit(2)
-
-		case <-done:
-			return
-		}
-	}()
-
-	cache.msg.Verbosef("opening cache at %s", base)
-	cache.c, err = pkg.Open(
-		cache.ctx,
-		cache.msg,
-		flags,
-		cache.cures,
-		cache.jobs,
-		base,
-	)
-	if err != nil {
-		return
-	}
-	done <- struct{}{}
-
-	if cache.qemu != nil {
-		var pathname *check.Absolute
-		pathname, _, err = cache.c.Cure(cache.qemu)
-		if err != nil {
-			cache.c.Close()
-			return
-		}
-
-		pkg.RegisterArch("riscv64", container.BinfmtEntry{
-			Offset: 0,
-			Magic:  "\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xf3\x00",
-			Mask:   "\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff",
-			Interpreter: pathname.Append(
-				"system/bin",
-				"qemu-riscv64",
-			),
-		})
-		pkg.RegisterArch("arm64", container.BinfmtEntry{
-			Offset: 0,
-			Magic:  "\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7\x00",
-			Mask:   "\xff\xff\xff\xff\xff\xff\xff\xfc\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff",
-			Interpreter: pathname.Append(
-				"system/bin",
-				"qemu-aarch64",
-			),
-		})
-	}
-
-	return
-}
-
-// Close closes the underlying [pkg.Cache] if it is open.
-func (cache *cache) Close() {
-	if cache.c != nil {
-		cache.c.Close()
-	}
-}
-
-// Do calls f on the underlying cache and returns its error value.
-func (cache *cache) Do(f func(cache *pkg.Cache) error) error {
-	if cache.c == nil {
-		if err := cache.open(); err != nil {
-			return err
-		}
-	}
-	return f(cache.c)
-}

cmd/mbf/cache_test.go

@@ -1,37 +0,0 @@
-package main
-
-import (
-	"log"
-	"os"
-	"testing"
-
-	"hakurei.app/internal/pkg"
-	"hakurei.app/message"
-)
-
-func TestCache(t *testing.T) {
-	t.Parallel()
-
-	cm := cache{
-		ctx:  t.Context(),
-		msg:  message.New(log.New(os.Stderr, "check: ", 0)),
-		base: t.TempDir(),
-
-		hostAbstract: true, idle: true,
-	}
-	defer cm.Close()
-	cm.Close()
-
-	if err := cm.open(); err != nil {
-		t.Fatalf("open: error = %v", err)
-	}
-	if err := cm.open(); err != os.ErrInvalid {
-		t.Errorf("(duplicate) open: error = %v", err)
-	}
-
-	if err := cm.Do(func(cache *pkg.Cache) error {
-		return cache.Scrub(0)
-	}); err != nil {
-		t.Errorf("Scrub: error = %v", err)
-	}
-}

cmd/mbf/daemon.go

@@ -1,354 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/binary"
-	"errors"
-	"io"
-	"log"
-	"math"
-	"net"
-	"os"
-	"sync"
-	"syscall"
-	"testing"
-	"time"
-	"unique"
-
-	"hakurei.app/check"
-	"hakurei.app/internal/pkg"
-)
-
-// daemonTimeout is the maximum amount of time cureFromIR will wait on I/O.
-const daemonTimeout = 30 * time.Second
-
-// daemonDeadline returns the deadline corresponding to daemonTimeout, or the
-// zero value when running in a test.
-func daemonDeadline() time.Time {
-	if testing.Testing() {
-		return time.Time{}
-	}
-	return time.Now().Add(daemonTimeout)
-}
-
-const (
-	// remoteNoReply notifies that the client will not receive a cure reply.
-	remoteNoReply = 1 << iota
-)
-
-// cureFromIR services an IR curing request.
-func cureFromIR(
-	cache *pkg.Cache,
-	conn net.Conn,
-	flags uint64,
-) (pkg.Artifact, error) {
-	a, decodeErr := cache.NewDecoder(conn).Decode()
-	if decodeErr != nil {
-		_, err := conn.Write([]byte("\x00" + decodeErr.Error()))
-		return nil, errors.Join(decodeErr, err, conn.Close())
-	}
-
-	pathname, _, cureErr := cache.Cure(a)
-	if flags&remoteNoReply != 0 {
-		return a, errors.Join(cureErr, conn.Close())
-	}
-	if err := conn.SetWriteDeadline(daemonDeadline()); err != nil {
-		return a, errors.Join(cureErr, err, conn.Close())
-	}
-	if cureErr != nil {
-		_, err := conn.Write([]byte("\x00" + cureErr.Error()))
-		return a, errors.Join(cureErr, err, conn.Close())
-	}
-	_, err := conn.Write([]byte(pathname.String()))
-	if testing.Testing() && errors.Is(err, io.ErrClosedPipe) {
-		return a, nil
-	}
-	return a, errors.Join(err, conn.Close())
-}
-
-const (
-	// specialCancel is a message consisting of a single identifier referring
-	// to a curing artifact to be cancelled.
-	specialCancel = iota
-	// specialAbort requests for all pending cures to be aborted. It has no
-	// message body.
-	specialAbort
-
-	// remoteSpecial denotes a special message with custom layout.
-	remoteSpecial = math.MaxUint64
-)
-
-// writeSpecialHeader writes the header of a remoteSpecial message.
-func writeSpecialHeader(conn net.Conn, kind uint64) error {
-	var sh [16]byte
-	binary.LittleEndian.PutUint64(sh[:], remoteSpecial)
-	binary.LittleEndian.PutUint64(sh[8:], kind)
-	if n, err := conn.Write(sh[:]); err != nil {
-		return err
-	} else if n != len(sh) {
-		return io.ErrShortWrite
-	}
-	return nil
-}
-
-// cancelIdent reads an identifier from conn and cancels the corresponding cure.
-func cancelIdent(
-	cache *pkg.Cache,
-	conn net.Conn,
-) (*pkg.ID, bool, error) {
-	var ident pkg.ID
-	if _, err := io.ReadFull(conn, ident[:]); err != nil {
-		return nil, false, errors.Join(err, conn.Close())
-	}
-	ok := cache.Cancel(unique.Make(ident))
-	return &ident, ok, conn.Close()
-}
-
-// serve services connections from a [net.UnixListener].
-func serve(
-	ctx context.Context,
-	log *log.Logger,
-	cm *cache,
-	ul *net.UnixListener,
-) error {
-	ul.SetUnlinkOnClose(true)
-	if cm.c == nil {
-		if err := cm.open(); err != nil {
-			return errors.Join(err, ul.Close())
-		}
-	}
-
-	var wg sync.WaitGroup
-	defer wg.Wait()
-
-	wg.Go(func() {
-		for {
-			if ctx.Err() != nil {
-				break
-			}
-
-			conn, err := ul.AcceptUnix()
-			if err != nil {
-				if !errors.Is(err, os.ErrDeadlineExceeded) {
-					log.Println(err)
-				}
-				continue
-			}
-			wg.Go(func() {
-				done := make(chan struct{})
-				defer close(done)
-				go func() {
-					select {
-					case <-ctx.Done():
-						_ = conn.SetDeadline(time.Now())
-
-					case <-done:
-						return
-					}
-				}()
-
-				if _err := conn.SetReadDeadline(daemonDeadline()); _err != nil {
-					log.Println(_err)
-					if _err = conn.Close(); _err != nil {
-						log.Println(_err)
-					}
-					return
-				}
-
-				var word [8]byte
-				if _, _err := io.ReadFull(conn, word[:]); _err != nil {
-					log.Println(_err)
-					if _err = conn.Close(); _err != nil {
-						log.Println(_err)
-					}
-					return
-				}
-				flags := binary.LittleEndian.Uint64(word[:])
-
-				if flags == remoteSpecial {
-					if _, _err := io.ReadFull(conn, word[:]); _err != nil {
-						log.Println(_err)
-						if _err = conn.Close(); _err != nil {
-							log.Println(_err)
-						}
-						return
-					}
-					switch special := binary.LittleEndian.Uint64(word[:]); special {
-					default:
-						log.Printf("invalid special %d", special)
-
-					case specialCancel:
-						if id, ok, _err := cancelIdent(cm.c, conn); _err != nil {
-							log.Println(_err)
-						} else if !ok {
-							log.Println(
-								"attempting to cancel invalid artifact",
-								pkg.Encode(*id),
-							)
-						} else {
-							log.Println(
-								"cancelled artifact",
-								pkg.Encode(*id),
-							)
-						}
-
-					case specialAbort:
-						log.Println("aborting all pending cures")
-						cm.c.Abort()
-						if _err := conn.Close(); _err != nil {
-							log.Println(_err)
-						}
-					}
-
-					return
-				}
-
-				if a, _err := cureFromIR(cm.c, conn, flags); _err != nil {
-					log.Println(_err)
-				} else {
-					log.Printf(
-						"fulfilled artifact %s",
-						pkg.Encode(cm.c.Ident(a).Value()),
-					)
-				}
-			})
-		}
-	})
-
-	<-ctx.Done()
-	if err := ul.SetDeadline(time.Now()); err != nil {
-		return errors.Join(err, ul.Close())
-	}
-	wg.Wait()
-	return ul.Close()
-}
-
-// dial wraps [net.DialUnix] with a context.
-func dial(ctx context.Context, addr *net.UnixAddr) (
-	done chan<- struct{},
-	conn *net.UnixConn,
-	err error,
-) {
-	conn, err = net.DialUnix("unix", nil, addr)
-	if err != nil {
-		return
-	}
-
-	d := make(chan struct{})
-	done = d
-	go func() {
-		select {
-		case <-ctx.Done():
-			_ = conn.SetDeadline(time.Now())
-
-		case <-d:
-			return
-		}
-	}()
-	return
-}
-
-// cureRemote cures a [pkg.Artifact] on a daemon.
-func cureRemote(
-	ctx context.Context,
-	addr *net.UnixAddr,
-	a pkg.Artifact,
-	flags uint64,
-) (*check.Absolute, error) {
-	if flags == remoteSpecial {
-		return nil, syscall.EINVAL
-	}
-
-	done, conn, err := dial(ctx, addr)
-	if err != nil {
-		return nil, err
-	}
-	defer close(done)
-
-	if n, flagErr := conn.Write(binary.LittleEndian.AppendUint64(nil, flags)); flagErr != nil {
-		return nil, errors.Join(flagErr, conn.Close())
-	} else if n != 8 {
-		return nil, errors.Join(io.ErrShortWrite, conn.Close())
-	}
-
-	if err = pkg.NewIR().EncodeAll(conn, a); err != nil {
-		return nil, errors.Join(err, conn.Close())
-	} else if err = conn.CloseWrite(); err != nil {
-		return nil, errors.Join(err, conn.Close())
-	}
-
-	if flags&remoteNoReply != 0 {
-		return nil, conn.Close()
-	}
-
-	payload, recvErr := io.ReadAll(conn)
-	if err = errors.Join(recvErr, conn.Close()); err != nil {
-		if errors.Is(err, os.ErrDeadlineExceeded) {
-			if cancelErr := ctx.Err(); cancelErr != nil {
-				err = cancelErr
-			}
-		}
-		return nil, err
-	}
-
-	if len(payload) > 0 && payload[0] == 0 {
-		return nil, errors.New(string(payload[1:]))
-	}
-
-	var p *check.Absolute
-	p, err = check.NewAbs(string(payload))
-	return p, err
-}
-
-// cancelRemote cancels a [pkg.Artifact] curing on a daemon.
-func cancelRemote(
-	ctx context.Context,
-	addr *net.UnixAddr,
-	a pkg.Artifact,
-	wait bool,
-) error {
-	done, conn, err := dial(ctx, addr)
-	if err != nil {
-		return err
-	}
-	defer close(done)
-
-	if err = writeSpecialHeader(conn, specialCancel); err != nil {
-		return errors.Join(err, conn.Close())
-	}
-
-	var n int
-	id := pkg.NewIR().Ident(a).Value()
-	if n, err = conn.Write(id[:]); err != nil {
-		return errors.Join(err, conn.Close())
-	} else if n != len(id) {
-		return errors.Join(io.ErrShortWrite, conn.Close())
-	}
-	if wait {
-		if _, err = conn.Read(make([]byte, 1)); err == io.EOF {
-			err = nil
-		}
-	}
-	return errors.Join(err, conn.Close())
-}
-
-// abortRemote aborts all [pkg.Artifact] curing on a daemon.
-func abortRemote(
-	ctx context.Context,
-	addr *net.UnixAddr,
-	wait bool,
-) error {
-	done, conn, err := dial(ctx, addr)
-	if err != nil {
-		return err
-	}
-	defer close(done)
-
-	err = writeSpecialHeader(conn, specialAbort)
-	if wait && err == nil {
-		if _, err = conn.Read(make([]byte, 1)); err == io.EOF {
-			err = nil
-		}
-	}
-	return errors.Join(err, conn.Close())
-}

cmd/mbf/daemon_test.go

@@ -1,146 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"io"
-	"log"
-	"net"
-	"os"
-	"path/filepath"
-	"slices"
-	"strings"
-	"testing"
-	"time"
-
-	"hakurei.app/check"
-	"hakurei.app/internal/pkg"
-	"hakurei.app/message"
-)
-
-func TestNoReply(t *testing.T) {
-	t.Parallel()
-	if !daemonDeadline().IsZero() {
-		t.Fatal("daemonDeadline did not return the zero value")
-	}
-
-	c, err := pkg.Open(
-		t.Context(),
-		message.New(log.New(os.Stderr, "cir: ", 0)),
-		0, 0, 0,
-		check.MustAbs(t.TempDir()),
-	)
-	if err != nil {
-		t.Fatalf("Open: error = %v", err)
-	}
-	defer c.Close()
-
-	client, server := net.Pipe()
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		go func() {
-			<-t.Context().Done()
-			if _err := client.SetDeadline(time.Now()); _err != nil && !errors.Is(_err, io.ErrClosedPipe) {
-				panic(_err)
-			}
-		}()
-
-		if _err := c.EncodeAll(
-			client,
-			pkg.NewFile("check", []byte{0}),
-		); _err != nil {
-			panic(_err)
-		} else if _err = client.Close(); _err != nil {
-			panic(_err)
-		}
-	}()
-
-	a, cureErr := cureFromIR(c, server, remoteNoReply)
-	if cureErr != nil {
-		t.Fatalf("cureFromIR: error = %v", cureErr)
-	}
-
-	<-done
-	wantIdent := pkg.MustDecode("fiZf-ZY_Yq6qxJNrHbMiIPYCsGkUiKCRsZrcSELXTqZWtCnESlHmzV5ThhWWGGYG")
-	if gotIdent := c.Ident(a).Value(); gotIdent != wantIdent {
-		t.Errorf(
-			"cureFromIR: %s, want %s",
-			pkg.Encode(gotIdent), pkg.Encode(wantIdent),
-		)
-	}
-}
-
-func TestDaemon(t *testing.T) {
-	t.Parallel()
-
-	var buf bytes.Buffer
-	logger := log.New(&buf, "daemon: ", 0)
-
-	addr := net.UnixAddr{
-		Name: filepath.Join(t.TempDir(), "daemon"),
-		Net:  "unix",
-	}
-
-	ctx, cancel := context.WithCancel(t.Context())
-	defer cancel()
-
-	cm := cache{
-		ctx:  ctx,
-		msg:  message.New(logger),
-		base: t.TempDir(),
-	}
-	defer cm.Close()
-
-	ul, err := net.ListenUnix("unix", &addr)
-	if err != nil {
-		t.Fatalf("ListenUnix: error = %v", err)
-	}
-
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		if _err := serve(ctx, logger, &cm, ul); _err != nil {
-			panic(_err)
-		}
-	}()
-
-	if err = cancelRemote(ctx, &addr, pkg.NewFile("nonexistent", nil), true); err != nil {
-		t.Fatalf("cancelRemote: error = %v", err)
-	}
-
-	if err = abortRemote(ctx, &addr, true); err != nil {
-		t.Fatalf("abortRemote: error = %v", err)
-	}
-
-	// keep this last for synchronisation
-	var p *check.Absolute
-	p, err = cureRemote(ctx, &addr, pkg.NewFile("check", []byte{0}), 0)
-	if err != nil {
-		t.Fatalf("cureRemote: error = %v", err)
-	}
-
-	cancel()
-	<-done
-
-	const want = "fiZf-ZY_Yq6qxJNrHbMiIPYCsGkUiKCRsZrcSELXTqZWtCnESlHmzV5ThhWWGGYG"
-	if got := filepath.Base(p.String()); got != want {
-		t.Errorf("cureRemote: %s, want %s", got, want)
-	}
-
-	wantLog := []string{
-		"",
-		"daemon: aborting all pending cures",
-		"daemon: attempting to cancel invalid artifact kQm9fmnCmXST1-MMmxzcau2oKZCXXrlZydo4PkeV5hO_2PKfeC8t98hrbV_ZZx_j",
-		"daemon: fulfilled artifact fiZf-ZY_Yq6qxJNrHbMiIPYCsGkUiKCRsZrcSELXTqZWtCnESlHmzV5ThhWWGGYG",
-	}
-	gotLog := strings.Split(buf.String(), "\n")
-	slices.Sort(gotLog)
-	if !slices.Equal(gotLog, wantLog) {
-		t.Errorf(
-			"serve: logged\n%s\nwant\n%s",
-			strings.Join(gotLog, "\n"), strings.Join(wantLog, "\n"),
-		)
-	}
-}

cmd/mbf/info.go

@@ -1,114 +0,0 @@
-package main
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"strings"
-
-	"hakurei.app/internal/pkg"
-	"hakurei.app/internal/rosa"
-)
-
-// commandInfo implements the info subcommand.
-func commandInfo(
-	cm *cache,
-	args []string,
-	w io.Writer,
-	writeStatus bool,
-	r *rosa.Report,
-) (err error) {
-	if len(args) == 0 {
-		return errors.New("info requires at least 1 argument")
-	}
-
-	// recovered by HandleAccess
-	mustPrintln := func(a ...any) {
-		if _, _err := fmt.Fprintln(w, a...); _err != nil {
-			panic(_err)
-		}
-	}
-	mustPrint := func(a ...any) {
-		if _, _err := fmt.Fprint(w, a...); _err != nil {
-			panic(_err)
-		}
-	}
-
-	for i, name := range args {
-		if p, ok := rosa.ResolveName(name); !ok {
-			return fmt.Errorf("unknown artifact %q", name)
-		} else {
-			var suffix string
-			if version := rosa.Std.Version(p); version != rosa.Unversioned {
-				suffix += "-" + version
-			}
-			mustPrintln("name        : " + name + suffix)
-
-			meta := rosa.GetMetadata(p)
-			mustPrintln("description : " + meta.Description)
-			if meta.Website != "" {
-				mustPrintln("website     : " +
-					strings.TrimSuffix(meta.Website, "/"))
-			}
-			if len(meta.Dependencies) > 0 {
-				mustPrint("depends on  :")
-				for _, d := range meta.Dependencies {
-					s := rosa.GetMetadata(d).Name
-					if version := rosa.Std.Version(d); version != rosa.Unversioned {
-						s += "-" + version
-					}
-					mustPrint(" " + s)
-				}
-				mustPrintln()
-			}
-
-			const statusPrefix = "status      : "
-			if writeStatus {
-				if r == nil {
-					var f io.ReadSeekCloser
-					err = cm.Do(func(cache *pkg.Cache) (err error) {
-						f, err = cache.OpenStatus(rosa.Std.Load(p))
-						return
-					})
-					if err != nil {
-						if errors.Is(err, os.ErrNotExist) {
-							mustPrintln(
-								statusPrefix + "not yet cured",
-							)
-						} else {
-							return
-						}
-					} else {
-						mustPrint(statusPrefix)
-						_, err = io.Copy(w, f)
-						if err = errors.Join(err, f.Close()); err != nil {
-							return
-						}
-					}
-				} else if err = cm.Do(func(cache *pkg.Cache) (err error) {
-					status, n := r.ArtifactOf(cache.Ident(rosa.Std.Load(p)))
-					if status == nil {
-						mustPrintln(
-							statusPrefix + "not in report",
-						)
-					} else {
-						mustPrintln("size        :", n)
-						mustPrint(statusPrefix)
-						if _, err = w.Write(status); err != nil {
-							return
-						}
-					}
-					return
-				}); err != nil {
-					return
-				}
-			}
-
-			if i != len(args)-1 {
-				mustPrintln()
-			}
-		}
-	}
-	return nil
-}

cmd/mbf/info_test.go

@@ -1,181 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"log"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"syscall"
-	"testing"
-	"unsafe"
-
-	"hakurei.app/internal/pkg"
-	"hakurei.app/internal/rosa"
-	"hakurei.app/message"
-)
-
-func TestInfo(t *testing.T) {
-	t.Parallel()
-
-	testCases := []struct {
-		name    string
-		args    []string
-		status  map[string]string
-		report  string
-		want    string
-		wantErr any
-	}{
-		{"qemu", []string{"qemu"}, nil, "", `
-name        : qemu-` + rosa.Std.Version(rosa.QEMU) + `
-description : a generic and open source machine emulator and virtualizer
-website     : https://www.qemu.org
-depends on  : glib-` + rosa.Std.Version(rosa.GLib) + ` zstd-` + rosa.Std.Version(rosa.Zstd) + `
-`, nil},
-
-		{"multi", []string{"hakurei", "hakurei-dist"}, nil, "", `
-name        : hakurei-` + rosa.Std.Version(rosa.Hakurei) + `
-description : low-level userspace tooling for Rosa OS
-website     : https://hakurei.app
-
-name        : hakurei-dist-` + rosa.Std.Version(rosa.HakureiDist) + `
-description : low-level userspace tooling for Rosa OS (distribution tarball)
-website     : https://hakurei.app
-`, nil},
-
-		{"nonexistent", []string{"zlib", "\x00"}, nil, "", `
-name        : zlib-` + rosa.Std.Version(rosa.Zlib) + `
-description : lossless data-compression library
-website     : https://zlib.net
-
-`, fmt.Errorf("unknown artifact %q", "\x00")},
-
-		{"status cache", []string{"zlib", "zstd"}, map[string]string{
-			"zstd":    "internal/pkg (amd64) on satori\n",
-			"hakurei": "internal/pkg (amd64) on satori\n\n",
-		}, "", `
-name        : zlib-` + rosa.Std.Version(rosa.Zlib) + `
-description : lossless data-compression library
-website     : https://zlib.net
-status      : not yet cured
-
-name        : zstd-` + rosa.Std.Version(rosa.Zstd) + `
-description : a fast compression algorithm
-website     : https://facebook.github.io/zstd
-status      : internal/pkg (amd64) on satori
-`, nil},
-
-		{"status cache perm", []string{"zlib"}, map[string]string{
-			"zlib": "\x00",
-		}, "", `
-name        : zlib-` + rosa.Std.Version(rosa.Zlib) + `
-description : lossless data-compression library
-website     : https://zlib.net
-`, func(cm *cache) error {
-			return &os.PathError{
-				Op:   "open",
-				Path: filepath.Join(cm.base, "status", pkg.Encode(cm.c.Ident(rosa.Std.Load(rosa.Zlib)).Value())),
-				Err:  syscall.EACCES,
-			}
-		}},
-
-		{"status report", []string{"zlib"}, nil, strings.Repeat("\x00", len(pkg.Checksum{})+8), `
-name        : zlib-` + rosa.Std.Version(rosa.Zlib) + `
-description : lossless data-compression library
-website     : https://zlib.net
-status      : not in report
-`, nil},
-	}
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			var (
-				cm  *cache
-				buf strings.Builder
-				r   *rosa.Report
-			)
-
-			if tc.status != nil || tc.report != "" {
-				cm = &cache{
-					ctx:  context.Background(),
-					msg:  message.New(log.New(os.Stderr, "info: ", 0)),
-					base: t.TempDir(),
-				}
-				defer cm.Close()
-			}
-
-			if tc.report != "" {
-				pathname := filepath.Join(t.TempDir(), "report")
-				err := os.WriteFile(
-					pathname,
-					unsafe.Slice(unsafe.StringData(tc.report), len(tc.report)),
-					0400,
-				)
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				r, err = rosa.OpenReport(pathname)
-				if err != nil {
-					t.Fatal(err)
-				}
-				defer func() {
-					if err = r.Close(); err != nil {
-						t.Fatal(err)
-					}
-				}()
-			}
-
-			if tc.status != nil {
-				for name, status := range tc.status {
-					p, ok := rosa.ResolveName(name)
-					if !ok {
-						t.Fatalf("invalid name %q", name)
-					}
-					perm := os.FileMode(0400)
-					if status == "\x00" {
-						perm = 0
-					}
-					if err := cm.Do(func(cache *pkg.Cache) error {
-						return os.WriteFile(filepath.Join(
-							cm.base,
-							"status",
-							pkg.Encode(cache.Ident(rosa.Std.Load(p)).Value()),
-						), unsafe.Slice(unsafe.StringData(status), len(status)), perm)
-					}); err != nil {
-						t.Fatalf("Do: error = %v", err)
-					}
-				}
-			}
-
-			var wantErr error
-			switch c := tc.wantErr.(type) {
-			case error:
-				wantErr = c
-			case func(cm *cache) error:
-				wantErr = c(cm)
-			default:
-				if tc.wantErr != nil {
-					t.Fatalf("invalid wantErr %#v", tc.wantErr)
-				}
-			}
-
-			if err := commandInfo(
-				cm,
-				tc.args,
-				&buf,
-				cm != nil,
-				r,
-			); !reflect.DeepEqual(err, wantErr) {
-				t.Fatalf("commandInfo: error = %v, want %v", err, wantErr)
-			}
-
-			if got := buf.String(); got != strings.TrimPrefix(tc.want, "\n") {
-				t.Errorf("commandInfo:\n%s\nwant\n%s", got, tc.want)
-			}
-		})
-	}
-}

cmd/mbf/internal/pkgserver/api.go

@@ -1,202 +0,0 @@
-// Package pkgserver implements the package metadata service backend.
-package pkgserver
-
-import (
-	"context"
-	"encoding/json"
-	"log"
-	"net/http"
-	"net/url"
-	"path"
-	"strconv"
-	"sync"
-	"time"
-
-	"hakurei.app/internal/info"
-	"hakurei.app/internal/rosa"
-)
-
-// for lazy initialisation of serveInfo
-var (
-	infoPayload struct {
-		// Current package count.
-		Count int `json:"count"`
-		// Hakurei version, set at link time.
-		HakureiVersion string `json:"hakurei_version"`
-	}
-	infoPayloadOnce sync.Once
-)
-
-// handleInfo writes constant system information.
-func handleInfo(w http.ResponseWriter, _ *http.Request) {
-	infoPayloadOnce.Do(func() {
-		infoPayload.Count = int(rosa.PresetUnexportedStart)
-		infoPayload.HakureiVersion = info.Version()
-	})
-	// TODO(mae): cache entire response if no additional fields are planned
-	writeAPIPayload(w, infoPayload)
-}
-
-// newStatusHandler returns a [http.HandlerFunc] that offers status files for
-// viewing or download, if available.
-func (index *packageIndex) newStatusHandler(disposition bool) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		m, ok := index.names[path.Base(r.URL.Path)]
-		if !ok || !m.HasReport {
-			http.NotFound(w, r)
-			return
-		}
-
-		contentType := "text/plain; charset=utf-8"
-		if disposition {
-			contentType = "application/octet-stream"
-
-			// quoting like this is unsound, but okay, because metadata is hardcoded
-			contentDisposition := `attachment; filename="`
-			contentDisposition += m.Name + "-"
-			if m.Version != "" {
-				contentDisposition += m.Version + "-"
-			}
-			contentDisposition += m.ids + `.log"`
-			w.Header().Set("Content-Disposition", contentDisposition)
-		}
-		w.Header().Set("Content-Type", contentType)
-		w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
-		if err := func() (err error) {
-			defer index.handleAccess(&err)()
-			_, err = w.Write(m.status)
-			return
-		}(); err != nil {
-			log.Println(err)
-			http.Error(
-				w, "cannot deliver status, contact maintainers",
-				http.StatusInternalServerError,
-			)
-		}
-	}
-}
-
-// handleGet writes a slice of metadata with specified order.
-func (index *packageIndex) handleGet(w http.ResponseWriter, r *http.Request) {
-	q := r.URL.Query()
-	limit, err := strconv.Atoi(q.Get("limit"))
-	if err != nil || limit > 100 || limit < 1 {
-		http.Error(
-			w, "limit must be an integer between 1 and 100",
-			http.StatusBadRequest,
-		)
-		return
-	}
-	i, err := strconv.Atoi(q.Get("index"))
-	if err != nil || i >= len(index.sorts[0]) || i < 0 {
-		http.Error(
-			w, "index must be an integer between 0 and "+
-				strconv.Itoa(int(rosa.PresetUnexportedStart-1)),
-			http.StatusBadRequest,
-		)
-		return
-	}
-	sort, err := strconv.Atoi(q.Get("sort"))
-	if err != nil || sort >= len(index.sorts) || sort < 0 {
-		http.Error(
-			w, "sort must be an integer between 0 and "+
-				strconv.Itoa(sortOrderEnd),
-			http.StatusBadRequest,
-		)
-		return
-	}
-	values := index.sorts[sort][i:min(i+limit, len(index.sorts[sort]))]
-	writeAPIPayload(w, &struct {
-		Values []*metadata `json:"values"`
-	}{values})
-}
-
-func (index *packageIndex) handleSearch(w http.ResponseWriter, r *http.Request) {
-	q := r.URL.Query()
-	limit, err := strconv.Atoi(q.Get("limit"))
-	if err != nil || limit > 100 || limit < 1 {
-		http.Error(
-			w, "limit must be an integer between 1 and 100",
-			http.StatusBadRequest,
-		)
-		return
-	}
-	i, err := strconv.Atoi(q.Get("index"))
-	if err != nil || i >= len(index.sorts[0]) || i < 0 {
-		http.Error(
-			w, "index must be an integer between 0 and "+
-				strconv.Itoa(int(rosa.PresetUnexportedStart-1)),
-			http.StatusBadRequest,
-		)
-		return
-	}
-	search, err := url.QueryUnescape(q.Get("search"))
-	if len(search) > 100 || err != nil {
-		http.Error(
-			w, "search must be a string between 0 and 100 characters long",
-			http.StatusBadRequest,
-		)
-		return
-	}
-	desc := q.Get("desc") == "true"
-	n, res, err := index.performSearchQuery(limit, i, search, desc)
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
-	}
-	writeAPIPayload(w, &struct {
-		Count  int            `json:"count"`
-		Values []searchResult `json:"values"`
-	}{n, res})
-}
-
-// apiVersion is the name of the current API revision, as part of the pattern.
-const apiVersion = "v1"
-
-// registerAPI registers API handler functions.
-func (index *packageIndex) registerAPI(mux *http.ServeMux) {
-	mux.HandleFunc("GET /api/"+apiVersion+"/info", handleInfo)
-	mux.HandleFunc("GET /api/"+apiVersion+"/get", index.handleGet)
-	mux.HandleFunc("GET /api/"+apiVersion+"/search", index.handleSearch)
-	mux.HandleFunc("GET /api/"+apiVersion+"/status/", index.newStatusHandler(false))
-	mux.HandleFunc("GET /status/", index.newStatusHandler(true))
-}
-
-// Register arranges for mux to service API requests.
-func Register(ctx context.Context, mux *http.ServeMux, report *rosa.Report) error {
-	var index packageIndex
-	index.search = make(searchCache)
-	if err := index.populate(report); err != nil {
-		return err
-	}
-	ticker := time.NewTicker(1 * time.Minute)
-	go func() {
-		for {
-			select {
-			case <-ctx.Done():
-				ticker.Stop()
-				return
-			case <-ticker.C:
-				index.search.clean()
-			}
-		}
-	}()
-	index.registerAPI(mux)
-	return nil
-}
-
-// writeAPIPayload sets headers common to API responses and encodes payload as
-// JSON for the response body.
-func writeAPIPayload(w http.ResponseWriter, payload any) {
-	w.Header().Set("Content-Type", "application/json; charset=utf-8")
-	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
-	w.Header().Set("Pragma", "no-cache")
-	w.Header().Set("Expires", "0")
-
-	if err := json.NewEncoder(w).Encode(payload); err != nil {
-		log.Println(err)
-		http.Error(
-			w, "cannot encode payload, contact maintainers",
-			http.StatusInternalServerError,
-		)
-	}
-}

cmd/mbf/internal/pkgserver/api_test.go

@@ -1,181 +0,0 @@
-package pkgserver
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"slices"
-	"strconv"
-	"testing"
-
-	"hakurei.app/internal/info"
-	"hakurei.app/internal/rosa"
-)
-
-// prefix is prepended to every API path.
-const prefix = "/api/" + apiVersion + "/"
-
-func TestAPIInfo(t *testing.T) {
-	t.Parallel()
-
-	w := httptest.NewRecorder()
-	handleInfo(w, httptest.NewRequestWithContext(
-		t.Context(),
-		http.MethodGet,
-		prefix+"info",
-		nil,
-	))
-
-	resp := w.Result()
-	checkStatus(t, resp, http.StatusOK)
-	checkAPIHeader(t, w.Header())
-
-	checkPayload(t, resp, struct {
-		Count          int    `json:"count"`
-		HakureiVersion string `json:"hakurei_version"`
-	}{int(rosa.PresetUnexportedStart), info.Version()})
-}
-
-func TestAPIGet(t *testing.T) {
-	t.Parallel()
-	const target = prefix + "get"
-
-	index := newIndex(t)
-	newRequest := func(suffix string) *httptest.ResponseRecorder {
-		w := httptest.NewRecorder()
-		index.handleGet(w, httptest.NewRequestWithContext(
-			t.Context(),
-			http.MethodGet,
-			target+suffix,
-			nil,
-		))
-		return w
-	}
-
-	checkValidate := func(t *testing.T, suffix string, vmin, vmax int, wantErr string) {
-		t.Run("invalid", func(t *testing.T) {
-			t.Parallel()
-
-			w := newRequest("?" + suffix + "=invalid")
-			resp := w.Result()
-			checkError(t, resp, wantErr, http.StatusBadRequest)
-		})
-
-		t.Run("min", func(t *testing.T) {
-			t.Parallel()
-
-			w := newRequest("?" + suffix + "=" + strconv.Itoa(vmin-1))
-			resp := w.Result()
-			checkError(t, resp, wantErr, http.StatusBadRequest)
-
-			w = newRequest("?" + suffix + "=" + strconv.Itoa(vmin))
-			resp = w.Result()
-			checkStatus(t, resp, http.StatusOK)
-		})
-
-		t.Run("max", func(t *testing.T) {
-			t.Parallel()
-
-			w := newRequest("?" + suffix + "=" + strconv.Itoa(vmax+1))
-			resp := w.Result()
-			checkError(t, resp, wantErr, http.StatusBadRequest)
-
-			w = newRequest("?" + suffix + "=" + strconv.Itoa(vmax))
-			resp = w.Result()
-			checkStatus(t, resp, http.StatusOK)
-		})
-	}
-
-	t.Run("limit", func(t *testing.T) {
-		t.Parallel()
-		checkValidate(
-			t, "index=0&sort=0&limit", 1, 100,
-			"limit must be an integer between 1 and 100",
-		)
-	})
-
-	t.Run("index", func(t *testing.T) {
-		t.Parallel()
-		checkValidate(
-			t, "limit=1&sort=0&index", 0, int(rosa.PresetUnexportedStart-1),
-			"index must be an integer between 0 and "+strconv.Itoa(int(rosa.PresetUnexportedStart-1)),
-		)
-	})
-
-	t.Run("sort", func(t *testing.T) {
-		t.Parallel()
-		checkValidate(
-			t, "index=0&limit=1&sort", 0, int(sortOrderEnd),
-			"sort must be an integer between 0 and "+strconv.Itoa(int(sortOrderEnd)),
-		)
-	})
-
-	checkWithSuffix := func(name, suffix string, want []*metadata) {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			w := newRequest(suffix)
-			resp := w.Result()
-			checkStatus(t, resp, http.StatusOK)
-			checkAPIHeader(t, w.Header())
-			checkPayloadFunc(t, resp, func(got *struct {
-				Values []*metadata `json:"values"`
-			}) bool {
-				return slices.EqualFunc(got.Values, want, func(a, b *metadata) bool {
-					return (a.Version == b.Version ||
-						a.Version == rosa.Unversioned ||
-						b.Version == rosa.Unversioned) &&
-						a.HasReport == b.HasReport &&
-						a.Name == b.Name &&
-						a.Description == b.Description &&
-						a.Website == b.Website
-				})
-			})
-
-		})
-	}
-
-	checkWithSuffix("declarationAscending", "?limit=2&index=1&sort=0", []*metadata{
-		{
-			Metadata: rosa.GetMetadata(1),
-			Version:  rosa.Std.Version(1),
-		},
-		{
-			Metadata: rosa.GetMetadata(2),
-			Version:  rosa.Std.Version(2),
-		},
-	})
-	checkWithSuffix("declarationAscending offset", "?limit=3&index=5&sort=0", []*metadata{
-		{
-			Metadata: rosa.GetMetadata(5),
-			Version:  rosa.Std.Version(5),
-		},
-		{
-			Metadata: rosa.GetMetadata(6),
-			Version:  rosa.Std.Version(6),
-		},
-		{
-			Metadata: rosa.GetMetadata(7),
-			Version:  rosa.Std.Version(7),
-		},
-	})
-	checkWithSuffix("declarationDescending", "?limit=3&index=0&sort=1", []*metadata{
-		{
-			Metadata: rosa.GetMetadata(rosa.PresetUnexportedStart - 1),
-			Version:  rosa.Std.Version(rosa.PresetUnexportedStart - 1),
-		},
-		{
-			Metadata: rosa.GetMetadata(rosa.PresetUnexportedStart - 2),
-			Version:  rosa.Std.Version(rosa.PresetUnexportedStart - 2),
-		},
-		{
-			Metadata: rosa.GetMetadata(rosa.PresetUnexportedStart - 3),
-			Version:  rosa.Std.Version(rosa.PresetUnexportedStart - 3),
-		},
-	})
-	checkWithSuffix("declarationDescending offset", "?limit=1&index=37&sort=1", []*metadata{
-		{
-			Metadata: rosa.GetMetadata(rosa.PresetUnexportedStart - 38),
-			Version:  rosa.Std.Version(rosa.PresetUnexportedStart - 38),
-		},
-	})
-}

cmd/mbf/internal/pkgserver/index.go

@@ -1,106 +0,0 @@
-package pkgserver
-
-import (
-	"cmp"
-	"errors"
-	"slices"
-	"strings"
-
-	"hakurei.app/internal/pkg"
-	"hakurei.app/internal/rosa"
-)
-
-const (
-	declarationAscending = iota
-	declarationDescending
-	nameAscending
-	nameDescending
-	sizeAscending
-	sizeDescending
-
-	sortOrderEnd = iota - 1
-)
-
-// packageIndex refers to metadata by name and various sort orders.
-type packageIndex struct {
-	sorts  [sortOrderEnd + 1][rosa.PresetUnexportedStart]*metadata
-	names  map[string]*metadata
-	search searchCache
-	// Taken from [rosa.Report] if available.
-	handleAccess func(*error) func()
-}
-
-// metadata holds [rosa.Metadata] extended with additional information.
-type metadata struct {
-	p rosa.PArtifact
-	*rosa.Metadata
-
-	// Populated via [rosa.Toolchain.Version], [rosa.Unversioned] is equivalent
-	// to the zero value. Otherwise, the zero value is invalid.
-	Version string `json:"version,omitempty"`
-	// Output data size, available if present in report.
-	Size int64 `json:"size,omitempty"`
-	// Whether the underlying [pkg.Artifact] is present in the report.
-	HasReport bool `json:"report"`
-
-	// Ident string encoded ahead of time.
-	ids string
-	// Backed by [rosa.Report], access must be prepared by HandleAccess.
-	status []byte
-}
-
-// populate deterministically populates packageIndex, optionally with a report.
-func (index *packageIndex) populate(report *rosa.Report) (err error) {
-	if report != nil {
-		defer report.HandleAccess(&err)()
-		index.handleAccess = report.HandleAccess
-	}
-
-	var work [rosa.PresetUnexportedStart]*metadata
-	index.names = make(map[string]*metadata)
-	ir := pkg.NewIR()
-	for p := range rosa.PresetUnexportedStart {
-		m := metadata{
-			p: p,
-
-			Metadata: rosa.GetMetadata(p),
-			Version:  rosa.Std.Version(p),
-		}
-		if m.Version == "" {
-			return errors.New("invalid version from " + m.Name)
-		}
-		if m.Version == rosa.Unversioned {
-			m.Version = ""
-		}
-
-		if report != nil {
-			id := ir.Ident(rosa.Std.Load(p))
-			m.ids = pkg.Encode(id.Value())
-			m.status, m.Size = report.ArtifactOf(id)
-			m.HasReport = m.Size >= 0
-		}
-
-		work[p] = &m
-		index.names[m.Name] = &m
-	}
-
-	index.sorts[declarationAscending] = work
-	index.sorts[declarationDescending] = work
-	slices.Reverse(index.sorts[declarationDescending][:])
-
-	index.sorts[nameAscending] = work
-	slices.SortFunc(index.sorts[nameAscending][:], func(a, b *metadata) int {
-		return strings.Compare(a.Name, b.Name)
-	})
-	index.sorts[nameDescending] = index.sorts[nameAscending]
-	slices.Reverse(index.sorts[nameDescending][:])
-
-	index.sorts[sizeAscending] = work
-	slices.SortFunc(index.sorts[sizeAscending][:], func(a, b *metadata) int {
-		return cmp.Compare(a.Size, b.Size)
-	})
-	index.sorts[sizeDescending] = index.sorts[sizeAscending]
-	slices.Reverse(index.sorts[sizeDescending][:])
-
-	return
-}

cmd/mbf/internal/pkgserver/index_test.go

@@ -1,96 +0,0 @@
-package pkgserver
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"reflect"
-	"testing"
-)
-
-// newIndex returns the address of a newly populated packageIndex.
-func newIndex(t *testing.T) *packageIndex {
-	t.Helper()
-
-	var index packageIndex
-	if err := index.populate(nil); err != nil {
-		t.Fatalf("populate: error = %v", err)
-	}
-	return &index
-}
-
-// checkStatus checks response status code.
-func checkStatus(t *testing.T, resp *http.Response, want int) {
-	t.Helper()
-
-	if resp.StatusCode != want {
-		t.Errorf(
-			"StatusCode: %s, want %s",
-			http.StatusText(resp.StatusCode),
-			http.StatusText(want),
-		)
-	}
-}
-
-// checkHeader checks the value of a header entry.
-func checkHeader(t *testing.T, h http.Header, key, want string) {
-	t.Helper()
-
-	if got := h.Get(key); got != want {
-		t.Errorf("%s: %q, want %q", key, got, want)
-	}
-}
-
-// checkAPIHeader checks common entries set for API endpoints.
-func checkAPIHeader(t *testing.T, h http.Header) {
-	t.Helper()
-
-	checkHeader(t, h, "Content-Type", "application/json; charset=utf-8")
-	checkHeader(t, h, "Cache-Control", "no-cache, no-store, must-revalidate")
-	checkHeader(t, h, "Pragma", "no-cache")
-	checkHeader(t, h, "Expires", "0")
-}
-
-// checkPayloadFunc checks the JSON response of an API endpoint by passing it to f.
-func checkPayloadFunc[T any](
-	t *testing.T,
-	resp *http.Response,
-	f func(got *T) bool,
-) {
-	t.Helper()
-
-	var got T
-	r := io.Reader(resp.Body)
-	if testing.Verbose() {
-		var buf bytes.Buffer
-		r = io.TeeReader(r, &buf)
-		defer func() { t.Helper(); t.Log(buf.String()) }()
-	}
-	if err := json.NewDecoder(r).Decode(&got); err != nil {
-		t.Fatalf("Decode: error = %v", err)
-	}
-
-	if !f(&got) {
-		t.Errorf("Body: %#v", got)
-	}
-}
-
-// checkPayload checks the JSON response of an API endpoint.
-func checkPayload[T any](t *testing.T, resp *http.Response, want T) {
-	t.Helper()
-
-	checkPayloadFunc(t, resp, func(got *T) bool {
-		return reflect.DeepEqual(got, &want)
-	})
-}
-
-func checkError(t *testing.T, resp *http.Response, error string, code int) {
-	t.Helper()
-
-	checkStatus(t, resp, code)
-	if got, _ := io.ReadAll(resp.Body); string(got) != fmt.Sprintln(error) {
-		t.Errorf("Body: %q, want %q", string(got), error)
-	}
-}

cmd/mbf/internal/pkgserver/search.go

@@ -1,81 +0,0 @@
-package pkgserver
-
-import (
-	"cmp"
-	"maps"
-	"regexp"
-	"slices"
-	"time"
-)
-
-type searchCache map[string]searchCacheEntry
-type searchResult struct {
-	NameIndices [][]int `json:"name_matches"`
-	DescIndices [][]int `json:"desc_matches,omitempty"`
-	Score       float64 `json:"score"`
-	*metadata
-}
-type searchCacheEntry struct {
-	query   string
-	results []searchResult
-	expiry  time.Time
-}
-
-func (index *packageIndex) performSearchQuery(limit int, i int, search string, desc bool) (int, []searchResult, error) {
-	query := search
-	if desc {
-		query += ";withDesc"
-	}
-	entry, ok := index.search[query]
-	if ok && len(entry.results) > 0 {
-		return len(entry.results), entry.results[min(i, len(entry.results)-1):min(i+limit, len(entry.results))], nil
-	}
-
-	regex, err := regexp.Compile(search)
-	if err != nil {
-		return 0, make([]searchResult, 0), err
-	}
-	res := make([]searchResult, 0)
-	for p := range maps.Values(index.names) {
-		nameIndices := regex.FindAllIndex([]byte(p.Name), -1)
-		var descIndices [][]int = nil
-		if desc {
-			descIndices = regex.FindAllIndex([]byte(p.Description), -1)
-		}
-		if nameIndices == nil && descIndices == nil {
-			continue
-		}
-		score := float64(indexsum(nameIndices)) / (float64(len(nameIndices)) + 1)
-		if desc {
-			score += float64(indexsum(descIndices)) / (float64(len(descIndices)) + 1) / 10.0
-		}
-		res = append(res, searchResult{
-			NameIndices: nameIndices,
-			DescIndices: descIndices,
-			Score:       score,
-			metadata:    p,
-		})
-	}
-	slices.SortFunc(res[:], func(a, b searchResult) int { return -cmp.Compare(a.Score, b.Score) })
-	expiry := time.Now().Add(1 * time.Minute)
-	entry = searchCacheEntry{
-		query:   search,
-		results: res,
-		expiry:  expiry,
-	}
-	index.search[query] = entry
-
-	return len(res), res[i:min(i+limit, len(entry.results))], nil
-}
-func (s *searchCache) clean() {
-	maps.DeleteFunc(*s, func(_ string, v searchCacheEntry) bool {
-		return v.expiry.Before(time.Now())
-	})
-}
-func indexsum(in [][]int) int {
-	sum := 0
-	for i := 0; i < len(in); i++ {
-		sum += in[i][1] - in[i][0]
-	}
-	return sum
-}

cmd/mbf/internal/pkgserver/ui/index.html

@@ -1,57 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <link rel="stylesheet" href="style.css">
-    <title>Hakurei PkgServer</title>
-    <script src="index.js"></script>
-</head>
-<body>
-<h1>Hakurei PkgServer</h1>
-<div class="top-controls" id="top-controls-regular">
-    <p>Showing entries <span id="entry-counter"></span>.</p>
-    <span id="search-bar">
-        <label for="search">Search: </label>
-        <input type="text" name="search" id="search"/>
-        <button onclick="doSearch()">Find</button>
-        <label for="include-desc">Include descriptions: </label>
-        <input type="checkbox" name="include-desc" id="include-desc" checked/>
-    </span>
-    <div><label for="count">Entries per page: </label><select name="count" id="count">
-        <option value="10">10</option>
-        <option value="20">20</option>
-        <option value="30">30</option>
-        <option value="50">50</option>
-    </select></div>
-    <div><label for="sort">Sort by: </label><select name="sort" id="sort">
-        <option value="0">Definition (ascending)</option>
-        <option value="1">Definition (descending)</option>
-        <option value="2">Name (ascending)</option>
-        <option value="3">Name (descending)</option>
-        <option value="4">Size (ascending)</option>
-        <option value="5">Size (descending)</option>
-    </select></div>
-</div>
-<div class="top-controls" id="search-top-controls" hidden>
-    <p>Showing search results <span id="search-entry-counter"></span> for query "<span id="search-query"></span>".</p>
-    <button onclick="exitSearch()">Back</button>
-    <div><label for="search-count">Entries per page: </label><select name="search-count" id="search-count">
-        <option value="10">10</option>
-        <option value="20">20</option>
-        <option value="30">30</option>
-        <option value="50">50</option>
-    </select></div>
-    <p>Sorted by best match</p>
-</div>
-<div class="page-controls"><a href="javascript:prevPage()">&laquo; Previous</a> <input type="text" class="page-number" value="1"/> <a href="javascript:nextPage()">Next &raquo;</a></div>
-<table id="pkg-list">
-    <tr><td>Loading...</td></tr>
-</table>
-<div class="page-controls"><a href="javascript:prevPage()">&laquo; Previous</a> <input type="text" class="page-number" value="1"/> <a href="javascript:nextPage()">Next &raquo;</a></div>
-<footer>
-    <p>&copy;<a href="https://hakurei.app/">Hakurei</a> (<span id="hakurei-version">unknown</span>). Licensed under the MIT license.</p>
-</footer>
-<script>main();</script>
-</body>
-</html>

cmd/mbf/internal/pkgserver/ui/index.ts

@@ -1,331 +0,0 @@
-interface PackageIndexEntry {
-    name: string
-    size?: number
-    description?: string
-    website?: string
-    version?: string
-    report?: boolean
-}
-
-function entryToHTML(entry: PackageIndexEntry | SearchResult): HTMLTableRowElement {
-    let v = entry.version != null ? `<span>${escapeHtml(entry.version)}</span>` : ""
-    let s = entry.size != null && entry.size > 0 ? `<p>Size: ${toByteSizeString(entry.size)} (${entry.size})</p>` : ""
-    let n: string
-    let d: string
-    if ('name_matches' in entry) {
-        n = `<h2>${nameMatches(entry as SearchResult)} ${v}</h2>`
-    } else {
-        n = `<h2>${escapeHtml(entry.name)} ${v}</h2>`
-    }
-    if ('desc_matches' in entry && STATE.getIncludeDescriptions()) {
-        d = descMatches(entry as SearchResult)
-    } else {
-        d = (entry as PackageIndexEntry).description != null ? `<p>${escapeHtml((entry as PackageIndexEntry).description)}</p>` : ""
-    }
-    let w = entry.website != null ? `<a href="${encodeURI(entry.website)}">Website</a>` : ""
-    let r = entry.report ? `Log (<a href=\"${encodeURI('/api/v1/status/' + entry.name)}\">View</a> | <a href=\"${encodeURI('/status/' + entry.name)}\">Download</a>)` : ""
-    let row = <HTMLTableRowElement>(document.createElement('tr'))
-    row.innerHTML = `<td>
-            ${n}
-            ${d}
-            ${s}
-            ${w}
-            ${r}
-        </td>`
-    return row
-}
-
-function nameMatches(sr: SearchResult): string {
-    return markMatches(sr.name, sr.name_matches)
-}
-
-function descMatches(sr: SearchResult): string {
-    return markMatches(sr.description!, sr.desc_matches)
-}
-
-function markMatches(str: string, indices: [number, number][]): string {
-    if (indices == null) {
-        return str
-    }
-    let out: string = ""
-    let j = 0
-    for (let i = 0; i < str.length; i++) {
-        if (j < indices.length) {
-            if (i === indices[j][0]) {
-                out += `<mark>${escapeHtmlChar(str[i])}`
-                continue
-            }
-            if (i === indices[j][1]) {
-                out += `</mark>${escapeHtmlChar(str[i])}`
-                j++
-                continue
-            }
-        }
-        out += escapeHtmlChar(str[i])
-    }
-    if (indices[j] !== undefined) {
-        out += "</mark>"
-    }
-    return out
-}
-
-function toByteSizeString(bytes: number): string {
-    if (bytes == null) return `unspecified`
-    if (bytes < 1024) return `${bytes}B`
-    if (bytes < Math.pow(1024, 2)) return `${(bytes / 1024).toFixed(2)}kiB`
-    if (bytes < Math.pow(1024, 3)) return `${(bytes / Math.pow(1024, 2)).toFixed(2)}MiB`
-    if (bytes < Math.pow(1024, 4)) return `${(bytes / Math.pow(1024, 3)).toFixed(2)}GiB`
-    if (bytes < Math.pow(1024, 5)) return `${(bytes / Math.pow(1024, 4)).toFixed(2)}TiB`
-    return "not only is it big, it's large"
-}
-
-const API_VERSION = 1
-const ENDPOINT = `/api/v${API_VERSION}`
-
-interface InfoPayload {
-    count?: number
-    hakurei_version?: string
-}
-
-async function infoRequest(): Promise<InfoPayload> {
-    const res = await fetch(`${ENDPOINT}/info`)
-    const payload = await res.json()
-    return payload as InfoPayload
-}
-
-interface GetPayload {
-    values?: PackageIndexEntry[]
-}
-
-enum SortOrders {
-    DeclarationAscending,
-    DeclarationDescending,
-    NameAscending,
-    NameDescending
-}
-
-async function getRequest(limit: number, index: number, sort: SortOrders): Promise<GetPayload> {
-    const res = await fetch(`${ENDPOINT}/get?limit=${limit}&index=${index}&sort=${sort.valueOf()}`)
-    const payload = await res.json()
-    return payload as GetPayload
-}
-
-interface SearchResult extends PackageIndexEntry {
-    name_matches: [number, number][]
-    desc_matches: [number, number][]
-    score: number
-}
-
-interface SearchPayload {
-    count?: number
-    values?: SearchResult[]
-}
-
-async function searchRequest(limit: number, index: number, search: string, desc: boolean): Promise<SearchPayload> {
-    const res = await fetch(`${ENDPOINT}/search?limit=${limit}&index=${index}&search=${encodeURIComponent(search)}&desc=${desc}`)
-    if (!res.ok) {
-        exitSearch()
-        alert("invalid search query!")
-        return Promise.reject(res.statusText)
-    }
-    const payload = await res.json()
-    return payload as SearchPayload
-}
-
-class State {
-    entriesPerPage: number = 10
-    entryIndex: number = 0
-    maxTotal: number = 0
-    maxEntries: number = 0
-    sort: SortOrders = SortOrders.DeclarationAscending
-    search: boolean = false
-
-    getEntriesPerPage(): number {
-        return this.entriesPerPage
-    }
-
-    setEntriesPerPage(entriesPerPage: number) {
-        this.entriesPerPage = entriesPerPage
-        this.setEntryIndex(Math.floor(this.getEntryIndex() / entriesPerPage) * entriesPerPage)
-    }
-
-    getEntryIndex(): number {
-        return this.entryIndex
-    }
-
-    setEntryIndex(entryIndex: number) {
-        this.entryIndex = entryIndex
-        this.updatePage()
-        this.updateRange()
-        this.updateListings()
-    }
-
-    getMaxTotal(): number {
-        return this.maxTotal
-    }
-
-    setMaxTotal(max: number) {
-        this.maxTotal = max
-    }
-
-    getSortOrder(): SortOrders {
-        return this.sort
-    }
-
-    setSortOrder(sortOrder: SortOrders) {
-        this.sort = sortOrder
-        this.setEntryIndex(0)
-    }
-
-    updatePage() {
-        let page = Math.ceil(((this.getEntryIndex() + this.getEntriesPerPage()) - 1) / this.getEntriesPerPage())
-        for (let e of document.getElementsByClassName("page-number")) {
-            (e as HTMLInputElement).value = String(page)
-        }
-    }
-
-    updateRange() {
-        let max = Math.min(this.getEntryIndex() + this.getEntriesPerPage(), this.getMaxTotal())
-        document.getElementById("entry-counter")!.textContent = `${this.getEntryIndex() + 1}-${max} of ${this.getMaxTotal()}`
-        if (this.search) {
-            document.getElementById("search-entry-counter")!.textContent = `${this.getEntryIndex() + 1}-${max} of ${this.maxTotal}/${this.maxEntries}`
-            document.getElementById("search-query")!.innerHTML = `<code>${escapeHtml(this.getSearchQuery())}</code>`
-        }
-    }
-
-    getSearchQuery(): string {
-        let queryString = document.getElementById("search")!;
-        return (queryString as HTMLInputElement).value
-    }
-
-    getIncludeDescriptions(): boolean {
-        let includeDesc = document.getElementById("include-desc")!;
-        return (includeDesc as HTMLInputElement).checked
-    }
-
-    updateListings() {
-        if (this.search) {
-            searchRequest(this.getEntriesPerPage(), this.getEntryIndex(), this.getSearchQuery(), this.getIncludeDescriptions())
-                .then(res => {
-                    let table = document.getElementById("pkg-list")!
-                    table.innerHTML = ''
-                    for (let row of res.values!) {
-                        table.appendChild(entryToHTML(row))
-                    }
-                    STATE.maxTotal = res.count!
-                    STATE.updateRange()
-                    if(res.count! < 1) {
-                        exitSearch()
-                        alert("no results found!")
-                    }
-                })
-        } else {
-            getRequest(this.getEntriesPerPage(), this.getEntryIndex(), this.getSortOrder())
-                .then(res => {
-                    let table = document.getElementById("pkg-list")!
-                    table.innerHTML = ''
-                    for (let row of res.values!) {
-                        table.appendChild(entryToHTML(row))
-                    }
-                })
-        }
-    }
-}
-
-let STATE: State
-
-
-function lastPageIndex(): number {
-    return Math.floor(STATE.getMaxTotal() / STATE.getEntriesPerPage()) * STATE.getEntriesPerPage()
-}
-
-function setPage(page: number) {
-    STATE.setEntryIndex(Math.max(0, Math.min(STATE.getEntriesPerPage() * (page - 1), lastPageIndex())))
-}
-
-
-function escapeHtml(str?: string): string {
-    let out: string = ''
-    if (str == undefined) return ""
-    for (let i = 0; i < str.length; i++) {
-        out += escapeHtmlChar(str[i])
-    }
-    return out
-}
-
-function escapeHtmlChar(char: string): string {
-    if (char.length != 1) return char
-    switch (char[0]) {
-        case '&':
-            return "&amp;"
-        case '<':
-            return "&lt;"
-        case '>':
-            return "&gt;"
-        case '"':
-            return "&quot;"
-        case "'":
-            return "&apos;"
-        default:
-            return char
-    }
-}
-
-function firstPage() {
-    STATE.setEntryIndex(0)
-}
-
-function prevPage() {
-    let index = STATE.getEntryIndex()
-    STATE.setEntryIndex(Math.max(0, index - STATE.getEntriesPerPage()))
-}
-
-function lastPage() {
-    STATE.setEntryIndex(lastPageIndex())
-}
-
-function nextPage() {
-    let index = STATE.getEntryIndex()
-    STATE.setEntryIndex(Math.min(lastPageIndex(), index + STATE.getEntriesPerPage()))
-}
-
-function doSearch() {
-    document.getElementById("top-controls-regular")!.toggleAttribute("hidden");
-    document.getElementById("search-top-controls")!.toggleAttribute("hidden");
-    STATE.search = true;
-    STATE.setEntryIndex(0);
-}
-
-function exitSearch() {
-    document.getElementById("top-controls-regular")!.toggleAttribute("hidden");
-    document.getElementById("search-top-controls")!.toggleAttribute("hidden");
-    STATE.search = false;
-    STATE.setMaxTotal(STATE.maxEntries)
-    STATE.setEntryIndex(0)
-}
-
-function main() {
-    STATE = new State()
-    infoRequest()
-        .then(res => {
-            STATE.maxEntries = res.count!
-            STATE.setMaxTotal(STATE.maxEntries)
-            document.getElementById("hakurei-version")!.textContent = res.hakurei_version!
-            STATE.updateRange()
-            STATE.updateListings()
-        })
-    for (let e of document.getElementsByClassName("page-number")) {
-        e.addEventListener("change", (_) => {
-            setPage(parseInt((e as HTMLInputElement).value))
-        })
-    }
-    document.getElementById("count")?.addEventListener("change", (event) => {
-        STATE.setEntriesPerPage(parseInt((event.target as HTMLSelectElement).value))
-    })
-    document.getElementById("sort")?.addEventListener("change", (event) => {
-        STATE.setSortOrder(parseInt((event.target as HTMLSelectElement).value))
-    })
-    document.getElementById("search")?.addEventListener("keyup", (event) => {
-        if (event.key === 'Enter') doSearch()
-    })
-}

cmd/mbf/internal/pkgserver/ui/style.css

@@ -1,21 +0,0 @@
-.page-number {
-  width: 2em;
-  text-align: center;
-}
-.page-number {
-  width: 2em;
-  text-align: center;
-}
-
-@media (prefers-color-scheme: dark) {
-  html {
-    background-color: #2c2c2c;
-    color: ghostwhite;
-  }
-}
-@media (prefers-color-scheme: light) {
-  html {
-    background-color: #d3d3d3;
-    color: black;
-  }
-}

cmd/mbf/internal/pkgserver/ui/tsconfig.json

@@ -1,8 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2024",
-    "strict": true,
-    "alwaysStrict": true,
-    "outDir": "static"
-  }
-}

cmd/mbf/internal/pkgserver/ui/ui.go

@@ -1,9 +0,0 @@
-// Package ui holds the static web UI.
-package ui
-
-import "net/http"
-
-// Register arranges for mux to serve the embedded frontend.
-func Register(mux *http.ServeMux) {
-	mux.Handle("GET /", http.FileServer(http.FS(static)))
-}

cmd/mbf/internal/pkgserver/ui/ui_full.go

@@ -1,21 +0,0 @@
-//go:build frontend
-
-package ui
-
-import (
-	"embed"
-	"io/fs"
-)
-
-//go:generate tsc
-//go:generate cp index.html style.css static
-//go:embed static
-var _static embed.FS
-
-var static = func() fs.FS {
-	if f, err := fs.Sub(_static, "static"); err != nil {
-		panic(err)
-	} else {
-		return f
-	}
-}()

cmd/mbf/internal/pkgserver/ui/ui_stub.go

@@ -1,7 +0,0 @@
-//go:build !frontend
-
-package ui
-
-import "testing/fstest"
-
-var static fstest.MapFS

cmd/mbf/main.go

@@ -14,18 +14,16 @@ package main
 
 import (
 	"context"
-	"crypto/sha512"
 	"errors"
 	"fmt"
 	"io"
 	"log"
-	"net"
-	"net/http"
 	"os"
 	"os/signal"
 	"path/filepath"
 	"runtime"
 	"strconv"
+	"strings"
 	"sync"
 	"sync/atomic"
 	"syscall"
@@ -42,9 +40,6 @@ import (
 	"hakurei.app/internal/pkg"
 	"hakurei.app/internal/rosa"
 	"hakurei.app/message"
-
-	"hakurei.app/cmd/mbf/internal/pkgserver"
-	"hakurei.app/cmd/mbf/internal/pkgserver/ui"
 )
 
 func main() {
@@ -58,141 +53,77 @@ func main() {
 		log.Fatal("this program must not run as root")
 	}
 
+	var cache *pkg.Cache
 	ctx, stop := signal.NotifyContext(context.Background(),
 		syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP)
 	defer stop()
+	defer func() {
+		if cache != nil {
+			cache.Close()
+		}
 
-	var cm cache
+		if r := recover(); r != nil {
-	defer func() { cm.Close() }()
+			fmt.Println(r)
+			log.Fatal("consider scrubbing the on-disk cache")
+		}
+	}()
 
 	var (
 		flagQuiet bool
-		flagQEMU  bool
+		flagCures int
-		flagArch  string
+		flagBase  string
-		flagCheck bool
+		flagIdle  bool
-		flagLTO   bool
 
-		flagCrossOverride int
+		flagHostAbstract bool
-
-		addr net.UnixAddr
 	)
-	c := command.New(os.Stderr, log.Printf, "mbf", func([]string) error {
+	c := command.New(os.Stderr, log.Printf, "mbf", func([]string) (err error) {
 		msg.SwapVerbose(!flagQuiet)
-		cm.ctx, cm.msg = ctx, msg
+
-		cm.base = os.ExpandEnv(cm.base)
+		flagBase = os.ExpandEnv(flagBase)
-		if cm.base == "" {
+		if flagBase == "" {
-			cm.base = "cache"
+			flagBase = "cache"
 		}
 
-		addr.Net = "unix"
+		var base *check.Absolute
-		addr.Name = os.ExpandEnv(addr.Name)
+		if flagBase, err = filepath.Abs(flagBase); err != nil {
-		if addr.Name == "" {
+			return
-			addr.Name = filepath.Join(cm.base, "daemon")
+		} else if base, err = check.NewAbs(flagBase); err != nil {
+			return
 		}
 
 		var flags int
-		if !flagCheck {
+		if flagIdle {
-			flags |= rosa.OptSkipCheck
+			flags |= pkg.CSchedIdle
 		}
-		if !flagLTO {
+		if flagHostAbstract {
-			flags |= rosa.OptLLVMNoLTO
+			flags |= pkg.CHostAbstract
-		}
-		rosa.DropCaches("", flags)
-		cross := flagArch != "" && flagArch != runtime.GOARCH
-		if flagQEMU || cross {
-			cm.qemu = rosa.Std.Load(rosa.QEMU)
 		}
+		cache, err = pkg.Open(ctx, msg, flags, flagCures, base)
 
-		if cross {
+		return
-			if flagCrossOverride != -1 {
-				flags = flagCrossOverride
-			}
-
-			rosa.DropCaches(flagArch, flags)
-			if !rosa.HasStage0() {
-				return pkg.UnsupportedArchError(flagArch)
-			}
-		}
-
-		return nil
 	}).Flag(
 		&flagQuiet,
 		"q", command.BoolFlag(false),
 		"Do not print cure messages",
 	).Flag(
-		&flagQEMU,
+		&flagCures,
-		"register", command.BoolFlag(false),
-		"Enable additional target architectures",
-	).Flag(
-		&flagArch,
-		"arch", command.StringFlag(runtime.GOARCH),
-		"Target architecture",
-	).Flag(
-		&flagLTO,
-		"lto", command.BoolFlag(false),
-		"Enable LTO in stage2 and stage3 LLVM toolchains",
-	).Flag(
-		&flagCheck,
-		"check", command.BoolFlag(true),
-		"Run test suites",
-	).Flag(
-		&flagCrossOverride,
-		"cross-flags", command.IntFlag(-1),
-		"Override non-native target preset flags",
-	).Flag(
-		&cm.verboseInit,
-		"v", command.BoolFlag(false),
-		"Do not suppress verbose output from init",
-	).Flag(
-		&cm.cures,
 		"cures", command.IntFlag(0),
 		"Maximum number of dependencies to cure at any given time",
 	).Flag(
-		&cm.jobs,
+		&flagBase,
-		"jobs", command.IntFlag(0),
-		"Preferred number of jobs to run, when applicable",
-	).Flag(
-		&cm.base,
 		"d", command.StringFlag("$MBF_CACHE_DIR"),
 		"Directory to store cured artifacts",
 	).Flag(
-		&cm.idle,
+		&flagIdle,
 		"sched-idle", command.BoolFlag(false),
 		"Set SCHED_IDLE scheduling policy",
 	).Flag(
-		&cm.hostAbstract,
+		&flagHostAbstract,
 		"host-abstract", command.BoolFlag(
 			os.Getenv("MBF_HOST_ABSTRACT") != "",
 		),
 		"Do not restrict networked cure containers from connecting to host "+
 			"abstract UNIX sockets",
-	).Flag(
-		&addr.Name,
-		"socket", command.StringFlag("$MBF_DAEMON_SOCKET"),
-		"Pathname of socket to bind to",
-	)
-
-	c.NewCommand(
-		"checksum", "Compute checksum of data read from standard input",
-		func([]string) error {
-			done := make(chan struct{})
-			defer close(done)
-			go func() {
-				select {
-				case <-ctx.Done():
-					os.Exit(1)
-				case <-done:
-					return
-				}
-			}()
-
-			h := sha512.New384()
-			if _, err := io.Copy(h, os.Stdin); err != nil {
-				return err
-			}
-			log.Println(pkg.Encode(pkg.Checksum(h.Sum(nil))))
-			return nil
-		},
 	)
 
 	{
@@ -206,9 +137,7 @@ func main() {
 				if flagShifts < 0 || flagShifts > 31 {
 					flagShifts = 12
 				}
-				return cm.Do(func(cache *pkg.Cache) error {
+				return cache.Scrub(runtime.NumCPU() << flagShifts)
-					return cache.Scrub(runtime.NumCPU() << flagShifts)
-				})
 			},
 		).Flag(
 			&flagShifts,
@@ -219,7 +148,6 @@ func main() {
 
 	{
 		var (
-			flagBind   string
 			flagStatus bool
 			flagReport string
 		)
@@ -227,7 +155,9 @@ func main() {
 			"info",
 			"Display out-of-band metadata of an artifact",
 			func(args []string) (err error) {
-				const shutdownTimeout = 15 * time.Second
+				if len(args) == 0 {
+					return errors.New("info requires at least 1 argument")
+				}
 
 				var r *rosa.Report
 				if flagReport != "" {
@@ -242,46 +172,88 @@ func main() {
 					defer r.HandleAccess(&err)()
 				}
 
-				if flagBind == "" {
+				for i, name := range args {
-					return commandInfo(&cm, args, os.Stdout, flagStatus, r)
+					if p, ok := rosa.ResolveName(name); !ok {
-				}
+						return fmt.Errorf("unknown artifact %q", name)
+					} else {
+						var suffix string
+						if version := rosa.Std.Version(p); version != rosa.Unversioned {
+							suffix += "-" + version
+						}
+						fmt.Println("name        : " + name + suffix)
 
-				var mux http.ServeMux
+						meta := rosa.GetMetadata(p)
-				ui.Register(&mux)
+						fmt.Println("description : " + meta.Description)
-				if err = pkgserver.Register(ctx, &mux, r); err != nil {
+						if meta.Website != "" {
-					return
+							fmt.Println("website     : " +
-				}
+								strings.TrimSuffix(meta.Website, "/"))
+						}
+						if len(meta.Dependencies) > 0 {
+							fmt.Print("depends on  :")
+							for _, d := range meta.Dependencies {
+								s := rosa.GetMetadata(d).Name
+								if version := rosa.Std.Version(d); version != rosa.Unversioned {
+									s += "-" + version
+								}
+								fmt.Print(" " + s)
+							}
+							fmt.Println()
+						}
 
-				server := http.Server{Addr: flagBind, Handler: &mux}
+						const statusPrefix = "status      : "
-				go func() {
+						if flagStatus {
-					<-ctx.Done()
+							if r == nil {
-					cc, cancel := context.WithTimeout(context.Background(), shutdownTimeout)
+								var f io.ReadSeekCloser
-					defer cancel()
+								f, err = cache.OpenStatus(rosa.Std.Load(p))
-					if _err := server.Shutdown(cc); _err != nil {
+								if err != nil {
-						log.Fatal(_err)
+									if errors.Is(err, os.ErrNotExist) {
+										fmt.Println(
+											statusPrefix + "not yet cured",
+										)
+									} else {
+										return
+									}
+								} else {
+									fmt.Print(statusPrefix)
+									_, err = io.Copy(os.Stdout, f)
+									if err = errors.Join(err, f.Close()); err != nil {
+										return
+									}
+								}
+							} else {
+								status, n := r.ArtifactOf(cache.Ident(rosa.Std.Load(p)))
+								if status == nil {
+									fmt.Println(
+										statusPrefix + "not in report",
+									)
+								} else {
+									fmt.Println("size        :", n)
+									fmt.Print(statusPrefix)
+									if _, err = os.Stdout.Write(status); err != nil {
+										return
+									}
+								}
+							}
+						}
+
+						if i != len(args)-1 {
+							fmt.Println()
+						}
 					}
-				}()
-
-				msg.Verbosef("listening on %q", flagBind)
-				err = server.ListenAndServe()
-				if errors.Is(err, http.ErrServerClosed) {
-					err = nil
 				}
-				return
+				return nil
 			},
-		).Flag(
+		).
-			&flagBind,
+			Flag(
-			"bind", command.StringFlag(""),
+				&flagStatus,
-			"TCP address for the server to listen on",
+				"status", command.BoolFlag(false),
-		).Flag(
+				"Display cure status if available",
-			&flagStatus,
+			).
-			"status", command.BoolFlag(false),
+			Flag(
-			"Display cure status if available",
+				&flagReport,
-		).Flag(
+				"report", command.StringFlag(""),
-			&flagReport,
+				"Load cure status from this report file instead of cache",
-			"report", command.StringFlag(""),
+			)
-			"Load cure status from this report file instead of cache",
-		)
 	}
 
 	c.NewCommand(
@@ -315,9 +287,7 @@ func main() {
 			if ext.Isatty(int(w.Fd())) {
 				return errors.New("output appears to be a terminal")
 			}
-			return cm.Do(func(cache *pkg.Cache) error {
+			return rosa.WriteReport(msg, w, cache)
-				return rosa.WriteReport(msg, w, cache)
-			})
 		},
 	)
 
@@ -380,26 +350,14 @@ func main() {
 					" package(s) are out of date"))
 			}
 			return errors.Join(errs...)
-		}).Flag(
+		}).
-			&flagJobs,
+			Flag(
-			"j", command.IntFlag(32),
+				&flagJobs,
-			"Maximum number of simultaneous connections",
+				"j", command.IntFlag(32),
-		)
+				"Maximum number of simultaneous connections",
+			)
 	}
 
-	c.NewCommand(
-		"daemon",
-		"Service artifact IR with Rosa OS extensions",
-		func(args []string) error {
-			ul, err := net.ListenUnix("unix", &addr)
-			if err != nil {
-				return err
-			}
-			log.Printf("listening on pathname socket at %s", addr.Name)
-			return serve(ctx, log.Default(), &cm, ul)
-		},
-	)
-
 	{
 		var (
 			flagGentoo   string
@@ -424,37 +382,25 @@ func main() {
 					rosa.SetGentooStage3(flagGentoo, checksum)
 				}
 
+				_, _, _, stage1 := (t - 2).NewLLVM()
+				_, _, _, stage2 := (t - 1).NewLLVM()
+				_, _, _, stage3 := t.NewLLVM()
 				var (
 					pathname *check.Absolute
 					checksum [2]unique.Handle[pkg.Checksum]
 				)
 
-				if err = cm.Do(func(cache *pkg.Cache) (err error) {
+				if pathname, _, err = cache.Cure(stage1); err != nil {
-					pathname, _, err = cache.Cure(
+					return err
-						(t - 2).Load(rosa.LLVM),
-					)
-					return
-				}); err != nil {
-					return
 				}
 				log.Println("stage1:", pathname)
 
-				if err = cm.Do(func(cache *pkg.Cache) (err error) {
+				if pathname, checksum[0], err = cache.Cure(stage2); err != nil {
-					pathname, checksum[0], err = cache.Cure(
+					return err
-						(t - 1).Load(rosa.LLVM),
-					)
-					return
-				}); err != nil {
-					return
 				}
 				log.Println("stage2:", pathname)
-				if err = cm.Do(func(cache *pkg.Cache) (err error) {
+				if pathname, checksum[1], err = cache.Cure(stage3); err != nil {
-					pathname, checksum[1], err = cache.Cure(
+					return err
-						t.Load(rosa.LLVM),
-					)
-					return
-				}); err != nil {
-					return
 				}
 				log.Println("stage3:", pathname)
 
@@ -471,44 +417,39 @@ func main() {
 				}
 
 				if flagStage0 {
-					if err = cm.Do(func(cache *pkg.Cache) (err error) {
+					if pathname, _, err = cache.Cure(
-						pathname, _, err = cache.Cure(
+						t.Load(rosa.Stage0),
-							t.Load(rosa.Stage0),
+					); err != nil {
-						)
+						return err
-						return
-					}); err != nil {
-						return
 					}
 					log.Println(pathname)
 				}
 
 				return
 			},
-		).Flag(
+		).
-			&flagGentoo,
+			Flag(
-			"gentoo", command.StringFlag(""),
+				&flagGentoo,
-			"Bootstrap from a Gentoo stage3 tarball",
+				"gentoo", command.StringFlag(""),
-		).Flag(
+				"Bootstrap from a Gentoo stage3 tarball",
-			&flagChecksum,
+			).
-			"checksum", command.StringFlag(""),
+			Flag(
-			"Checksum of Gentoo stage3 tarball",
+				&flagChecksum,
-		).Flag(
+				"checksum", command.StringFlag(""),
-			&flagStage0,
+				"Checksum of Gentoo stage3 tarball",
-			"stage0", command.BoolFlag(false),
+			).
-			"Create bootstrap stage0 tarball",
+			Flag(
-		)
+				&flagStage0,
+				"stage0", command.BoolFlag(false),
+				"Create bootstrap stage0 tarball",
+			)
 	}
 
 	{
 		var (
-			flagDump    string
+			flagDump   string
-			flagEnter   bool
+			flagEnter  bool
-			flagExport  string
+			flagExport string
-			flagRemote  bool
-			flagNoReply bool
-
-			flagBoot bool
-			flagStd  bool
 		)
 		c.NewCommand(
 			"cure",
@@ -522,20 +463,9 @@ func main() {
 					return fmt.Errorf("unknown artifact %q", args[0])
 				}
 
-				t := rosa.Std
-				if flagBoot {
-					t -= 2
-				} else if flagStd {
-					t -= 1
-				}
-
 				switch {
 				default:
-					var pathname *check.Absolute
+					pathname, _, err := cache.Cure(rosa.Std.Load(p))
-					err := cm.Do(func(cache *pkg.Cache) (err error) {
-						pathname, _, err = cache.Cure(t.Load(p))
-						return
-					})
 					if err != nil {
 						return err
 					}
@@ -575,7 +505,7 @@ func main() {
 						return err
 					}
 
-					if err = pkg.NewIR().EncodeAll(f, rosa.Std.Load(p)); err != nil {
+					if err = cache.EncodeAll(f, rosa.Std.Load(p)); err != nil {
 						_ = f.Close()
 						return err
 					}
@@ -583,76 +513,33 @@ func main() {
 					return f.Close()
 
 				case flagEnter:
-					return cm.Do(func(cache *pkg.Cache) error {
+					return cache.EnterExec(
-						return cache.EnterExec(
+						ctx,
-							ctx,
+						rosa.Std.Load(p),
-							t.Load(p),
+						true, os.Stdin, os.Stdout, os.Stderr,
-							true, os.Stdin, os.Stdout, os.Stderr,
+						rosa.AbsSystem.Append("bin", "mksh"),
-							rosa.AbsSystem.Append("bin", "mksh"),
+						"sh",
-							"sh",
+					)
-						)
-					})
-
-				case flagRemote:
-					var flags uint64
-					if flagNoReply {
-						flags |= remoteNoReply
-					}
-					a := t.Load(p)
-					pathname, err := cureRemote(ctx, &addr, a, flags)
-					if !flagNoReply && err == nil {
-						log.Println(pathname)
-					}
-
-					if errors.Is(err, context.Canceled) {
-						cc, cancel := context.WithDeadline(context.Background(), daemonDeadline())
-						defer cancel()
-
-						if _err := cancelRemote(cc, &addr, a, false); _err != nil {
-							log.Println(err)
-						}
-					}
-
-					return err
 				}
 			},
-		).Flag(
+		).
-			&flagDump,
+			Flag(
-			"dump", command.StringFlag(""),
+				&flagDump,
-			"Write IR to specified pathname and terminate",
+				"dump", command.StringFlag(""),
-		).Flag(
+				"Write IR to specified pathname and terminate",
-			&flagExport,
+			).
-			"export", command.StringFlag(""),
+			Flag(
-			"Export cured artifact to specified pathname",
+				&flagExport,
-		).Flag(
+				"export", command.StringFlag(""),
-			&flagEnter,
+				"Export cured artifact to specified pathname",
-			"enter", command.BoolFlag(false),
+			).
-			"Enter cure container with an interactive shell",
+			Flag(
-		).Flag(
+				&flagEnter,
-			&flagRemote,
+				"enter", command.BoolFlag(false),
-			"daemon", command.BoolFlag(false),
+				"Enter cure container with an interactive shell",
-			"Cure artifact on the daemon",
+			)
-		).Flag(
-			&flagNoReply,
-			"no-reply", command.BoolFlag(false),
-			"Do not receive a reply from the daemon",
-		).Flag(
-			&flagBoot,
-			"boot", command.BoolFlag(false),
-			"Build on the stage0 toolchain",
-		).Flag(
-			&flagStd,
-			"std", command.BoolFlag(false),
-			"Build on the intermediate toolchain",
-		)
 	}
 
-	c.NewCommand(
-		"abort",
-		"Abort all pending cures on the daemon",
-		func([]string) error { return abortRemote(ctx, &addr, false) },
-	)
-
 	{
 		var (
 			flagNet     bool
@@ -664,7 +551,7 @@ func main() {
 			"shell",
 			"Interactive shell in the specified Rosa OS environment",
 			func(args []string) error {
-				presets := make([]rosa.PArtifact, len(args)+3)
+				presets := make([]rosa.PArtifact, len(args))
 				for i, arg := range args {
 					p, ok := rosa.ResolveName(arg)
 					if !ok {
@@ -672,24 +559,21 @@ func main() {
 					}
 					presets[i] = p
 				}
-
-				base := rosa.LLVM
-				if !flagWithToolchain {
-					base = rosa.Musl
-				}
-				presets = append(presets,
-					base,
-					rosa.Mksh,
-					rosa.Toybox,
-				)
-
 				root := make(pkg.Collect, 0, 6+len(args))
 				root = rosa.Std.AppendPresets(root, presets...)
 
-				if err := cm.Do(func(cache *pkg.Cache) error {
+				if flagWithToolchain {
-					_, _, err := cache.Cure(&root)
+					musl, compilerRT, runtimes, clang := (rosa.Std - 1).NewLLVM()
-					return err
+					root = append(root, musl, compilerRT, runtimes, clang)
-				}); err == nil {
+				} else {
+					root = append(root, rosa.Std.Load(rosa.Musl))
+				}
+				root = append(root,
+					rosa.Std.Load(rosa.Mksh),
+					rosa.Std.Load(rosa.Toybox),
+				)
+
+				if _, _, err := cache.Cure(&root); err == nil {
 					return errors.New("unreachable")
 				} else if !pkg.IsCollected(err) {
 					return err
@@ -701,22 +585,11 @@ func main() {
 				}
 				cured := make(map[pkg.Artifact]cureRes)
 				for _, a := range root {
-					if err := cm.Do(func(cache *pkg.Cache) error {
+					pathname, checksum, err := cache.Cure(a)
-						pathname, checksum, err := cache.Cure(a)
+					if err != nil {
-						if err == nil {
-							cured[a] = cureRes{pathname, checksum}
-						}
-						return err
-					}); err != nil {
-						return err
-					}
-				}
-
-				// explicitly open for direct error-free use from this point
-				if cm.c == nil {
-					if err := cm.open(); err != nil {
 						return err
 					}
+					cured[a] = cureRes{pathname, checksum}
 				}
 
 				layers := pkg.PromoteLayers(root, func(a pkg.Artifact) (
@@ -726,7 +599,7 @@ func main() {
 					res := cured[a]
 					return res.pathname, res.checksum
 				}, func(i int, d pkg.Artifact) {
-					r := pkg.Encode(cm.c.Ident(d).Value())
+					r := pkg.Encode(cache.Ident(d).Value())
 					if s, ok := d.(fmt.Stringer); ok {
 						if name := s.String(); name != "" {
 							r += "-" + name
@@ -745,7 +618,6 @@ func main() {
 				z.Hostname = "localhost"
 				z.Uid, z.Gid = (1<<10)-1, (1<<10)-1
 				z.Stdin, z.Stdout, z.Stderr = os.Stdin, os.Stdout, os.Stderr
-				z.Quiet = !cm.verboseInit
 				if s, ok := os.LookupEnv("TERM"); ok {
 					z.Env = append(z.Env, "TERM="+s)
 				}
@@ -791,19 +663,22 @@ func main() {
 				}
 				return z.Wait()
 			},
-		).Flag(
+		).
-			&flagNet,
+			Flag(
-			"net", command.BoolFlag(false),
+				&flagNet,
-			"Share host net namespace",
+				"net", command.BoolFlag(false),
-		).Flag(
+				"Share host net namespace",
-			&flagSession,
+			).
-			"session", command.BoolFlag(true),
+			Flag(
-			"Retain session",
+				&flagSession,
-		).Flag(
+				"session", command.BoolFlag(true),
-			&flagWithToolchain,
+				"Retain session",
-			"with-toolchain", command.BoolFlag(false),
+			).
-			"Include the stage2 LLVM toolchain",
+			Flag(
-		)
+				&flagWithToolchain,
+				"with-toolchain", command.BoolFlag(false),
+				"Include the stage2 LLVM toolchain",
+			)
 
 	}
 
@@ -814,7 +689,9 @@ func main() {
 	)
 
 	c.MustParse(os.Args[1:], func(err error) {
-		cm.Close()
+		if cache != nil {
+			cache.Close()
+		}
 		if w, ok := err.(interface{ Unwrap() []error }); !ok {
 			log.Fatal(err)
 		} else {

cmd/mbf/main_test.go

@@ -1,47 +0,0 @@
-package main
-
-import (
-	"net"
-	"os"
-	"testing"
-
-	"hakurei.app/internal/rosa"
-)
-
-func TestMain(m *testing.M) {
-	rosa.DropCaches("", rosa.OptLLVMNoLTO)
-	os.Exit(m.Run())
-}
-
-func TestCureAll(t *testing.T) {
-	t.Parallel()
-	const env = "ROSA_TEST_DAEMON"
-
-	if !testing.Verbose() {
-		t.Skip("verbose flag not set")
-	}
-
-	pathname, ok := os.LookupEnv(env)
-	if !ok {
-		t.Skip(env + " not set")
-	}
-
-	addr := net.UnixAddr{Net: "unix", Name: pathname}
-	t.Cleanup(func() {
-		if t.Failed() {
-			if err := abortRemote(t.Context(), &addr, false); err != nil {
-				t.Fatal(err)
-			}
-		}
-	})
-
-	for i := range rosa.PresetEnd {
-		p := rosa.PArtifact(i)
-		t.Run(rosa.GetMetadata(p).Name, func(t *testing.T) {
-			_, err := cureRemote(t.Context(), &addr, rosa.Std.Load(p), 0)
-			if err != nil {
-				t.Error(err)
-			}
-		})
-	}
-}

cmd/sharefs/test/configuration.nix

@@ -20,14 +20,11 @@
   };
 
   virtualisation = {
-    # Hopefully reduces spurious test failures:
-    memorySize = if pkgs.stdenv.hostPlatform.is32bit then 2046 else 8192;
-
     diskSize = 6 * 1024;
 
     qemu.options = [
       # Increase test performance:
-      "-smp 16"
+      "-smp 8"
     ];
   };
 

cmd/sharefs/test/default.nix

@@ -28,7 +28,7 @@ testers.nixosTest {
         # For go tests:
         (pkgs.writeShellScriptBin "sharefs-workload-hakurei-tests" ''
           cp -r "${self.packages.${system}.hakurei.src}" "/sdcard/hakurei" && cd "/sdcard/hakurei"
-          ${fhs}/bin/hakurei-fhs -c 'ROSA_SKIP_BINFMT=1 CC="clang -O3 -Werror" go test ./...'
+          ${fhs}/bin/hakurei-fhs -c 'CC="clang -O3 -Werror" go test ./...'
         '')
       ];
 

container/binfmt.go

@@ -1,46 +0,0 @@
-package container
-
-import (
-	"strings"
-	"unsafe"
-
-	"hakurei.app/check"
-)
-
-// escapeBinfmt escapes magic/mask sequences in a [BinfmtEntry].
-func escapeBinfmt(buf *strings.Builder, s string) string {
-	const lowerhex = "0123456789abcdef"
-
-	buf.Reset()
-	for _, c := range unsafe.Slice(unsafe.StringData(s), len(s)) {
-		switch c {
-		case 0, '\\', ':':
-			buf.WriteString(`\x`)
-			buf.WriteByte(lowerhex[c>>4])
-			buf.WriteByte(lowerhex[c&0xf])
-
-		default:
-			buf.WriteByte(c)
-		}
-	}
-	return buf.String()
-}
-
-// BinfmtEntry is an entry to be registered by the init process.
-type BinfmtEntry struct {
-	// The offset of the magic/mask in the file, counted in bytes.
-	Offset byte
-	// The byte sequence binfmt_misc is matching for.
-	Magic string
-	// An (optional, defaults to all 0xff) mask.
-	Mask string
-	// The program that should be invoked with the binary as first argument.
-	Interpreter *check.Absolute
-}
-
-// Valid returns whether e can be registered into the kernel.
-func (e *BinfmtEntry) Valid() bool {
-	return e != nil &&
-		int(e.Offset)+max(len(e.Magic), len(e.Mask)) < 128 &&
-		e.Interpreter != nil && len(e.Interpreter.String()) < 128
-}

container/binfmt_test.go

@@ -1,62 +0,0 @@
-package container
-
-import (
-	"strings"
-	"testing"
-
-	"hakurei.app/fhs"
-)
-
-func TestEscapeBinfmt(t *testing.T) {
-	t.Parallel()
-
-	testCases := []struct {
-		name  string
-		magic string
-		want  string
-	}{
-		{"packed DOS applications", "\x0eDEX", "\x0eDEX"},
-
-		{"riscv64 magic",
-			"\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xf3\x00",
-			"\x7fELF\x02\x01\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\x02\\x00\xf3\\x00"},
-		{"riscv64 mask",
-			"\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff",
-			"\xff\xff\xff\xff\xff\xff\xff\\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff"},
-	}
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			got := escapeBinfmt(new(strings.Builder), tc.magic)
-			if got != tc.want {
-				t.Errorf("escapeBinfmt: %q, want %q", got, tc.want)
-			}
-		})
-	}
-}
-
-func TestBinfmtEntry(t *testing.T) {
-	t.Parallel()
-
-	testCases := []struct {
-		name  string
-		e     BinfmtEntry
-		valid bool
-	}{
-		{"zero", BinfmtEntry{}, false},
-		{"large offset", BinfmtEntry{Offset: 128}, false},
-		{"long magic", BinfmtEntry{Magic: strings.Repeat("\x00", 128)}, false},
-		{"long mask", BinfmtEntry{Mask: strings.Repeat("\x00", 128)}, false},
-		{"valid", BinfmtEntry{Interpreter: fhs.AbsRoot}, true},
-	}
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			if tc.e.Valid() != tc.valid {
-				t.Errorf("Valid: %v", !tc.valid)
-			}
-		})
-	}
-}

container/capability.go

@@ -18,7 +18,6 @@ const (
 	CAP_SETPCAP      = 0x8
 	CAP_NET_ADMIN    = 0xc
 	CAP_DAC_OVERRIDE = 0x1
-	CAP_SETFCAP      = 0x1f
 )
 
 type (

container/container.go

@@ -21,7 +21,6 @@ import (
 	"hakurei.app/container/std"
 	"hakurei.app/ext"
 	"hakurei.app/fhs"
-	"hakurei.app/internal/landlock"
 	"hakurei.app/message"
 )
 
@@ -67,9 +66,6 @@ type (
 		// Copied to the underlying [exec.Cmd].
 		WaitDelay time.Duration
 
-		// Suppress verbose output of init.
-		Quiet bool
-
 		cmd *exec.Cmd
 		ctx context.Context
 		msg message.Msg
@@ -91,20 +87,12 @@ type (
 		// Time to wait for processes lingering after the initial process terminates.
 		AdoptWaitDelay time.Duration
 
-		// Map uid/gid 0 in the init process. Requires [FstypeProc] attached to
-		// [fhs.Proc] in the container filesystem.
-		InitAsRoot bool
 		// Mapped Uid in user namespace.
 		Uid int
 		// Mapped Gid in user namespace.
 		Gid int
 		// Hostname value in UTS namespace.
 		Hostname string
-		// Register binfmt_misc entries.
-		Binfmt []BinfmtEntry
-		// Alternative pathname to attach binfmt_misc filesystem. The zero value
-		// requires [FstypeProc] to be made available at [fhs.Proc].
-		BinfmtPath *check.Absolute
 		// Sequential container setup ops.
 		*Ops
 
@@ -224,9 +212,6 @@ func (p *Container) Start() error {
 	if p.cmd.Process != nil {
 		return errors.New("container: already started")
 	}
-	if !p.InitAsRoot && len(p.Binfmt) > 0 {
-		return errors.New("container: init as root required, but not enabled")
-	}
 
 	if err := ensureCloseOnExec(); err != nil {
 		return err
@@ -297,18 +282,6 @@ func (p *Container) Start() error {
 	if !p.HostNet {
 		p.cmd.SysProcAttr.Cloneflags |= CLONE_NEWNET
 	}
-	if p.InitAsRoot {
-		p.cmd.SysProcAttr.AmbientCaps = append(p.cmd.SysProcAttr.AmbientCaps,
-			// mappings during init as root
-			CAP_SETFCAP,
-		)
-
-		if !p.SeccompDisable &&
-			len(p.SeccompRules) == 0 &&
-			p.SeccompPresets&std.PresetDenyNS != 0 {
-			return errors.New("container: as root requires late namespace creation")
-		}
-	}
 
 	// place setup pipe before user supplied extra files, this is later restored by init
 	if r, w, err := os.Pipe(); err != nil {
@@ -334,7 +307,7 @@ func (p *Container) Start() error {
 		done <- func() error {
 			// PR_SET_NO_NEW_PRIVS: thread-directed but acts on all processes
 			// created from the calling thread
-			if err := setNoNewPrivs(); err != nil {
+			if err := SetNoNewPrivs(); err != nil {
 				return &StartError{
 					Fatal: true,
 					Step:  "prctl(PR_SET_NO_NEW_PRIVS)",
@@ -344,14 +317,12 @@ func (p *Container) Start() error {
 
 			// landlock: depends on per-thread state but acts on a process group
 			{
-				rulesetAttr := &landlock.RulesetAttr{
+				rulesetAttr := &RulesetAttr{Scoped: LANDLOCK_SCOPE_SIGNAL}
-					Scoped: landlock.LANDLOCK_SCOPE_SIGNAL,
-				}
 				if !p.HostAbstract {
-					rulesetAttr.Scoped |= landlock.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
+					rulesetAttr.Scoped |= LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
 				}
 
-				if abi, err := landlock.GetABI(); err != nil {
+				if abi, err := LandlockGetABI(); err != nil {
 					if p.HostAbstract || !p.HostNet {
 						// landlock can be skipped here as it restricts access
 						// to resources already covered by namespaces (pid, net)
@@ -368,6 +339,8 @@ func (p *Container) Start() error {
 						Err:    ENOSYS,
 						Origin: true,
 					}
+				} else {
+					p.msg.Verbosef("landlock abi version %d", abi)
 				}
 
 				if rulesetFd, err := rulesetAttr.Create(0); err != nil {
@@ -377,7 +350,8 @@ func (p *Container) Start() error {
 						Err:   err,
 					}
 				} else {
-					if err = landlock.RestrictSelf(rulesetFd, 0); err != nil {
+					p.msg.Verbosef("enforcing landlock ruleset %s", rulesetAttr)
+					if err = LandlockRestrictSelf(rulesetFd, 0); err != nil {
 						_ = Close(rulesetFd)
 						return &StartError{
 							Fatal: true,
@@ -433,6 +407,7 @@ func (p *Container) Start() error {
 				}
 			}
 
+			p.msg.Verbose("starting container init")
 			if err := p.cmd.Start(); err != nil {
 				return &StartError{
 					Step:        "start container init",
@@ -503,6 +478,7 @@ func (p *Container) Serve() (err error) {
 			}
 
 		case <-done:
+			p.msg.Verbose("setup payload took", time.Since(t))
 			return
 		}
 	}(p.setup[1])
@@ -512,7 +488,7 @@ func (p *Container) Serve() (err error) {
 		Getuid(),
 		Getgid(),
 		len(p.ExtraFiles),
-		p.msg.IsVerbose() && !p.Quiet,
+		p.msg.IsVerbose(),
 	})
 }
 

container/container_test.go

@@ -16,8 +16,6 @@ import (
 	"strings"
 	"syscall"
 	"testing"
-	"time"
-	"unsafe"
 
 	"hakurei.app/check"
 	"hakurei.app/command"
@@ -28,7 +26,6 @@ import (
 	"hakurei.app/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/internal/info"
-	"hakurei.app/internal/landlock"
 	"hakurei.app/internal/params"
 	"hakurei.app/ldd"
 	"hakurei.app/message"
@@ -235,9 +232,6 @@ func earlyMnt(mnt ...*vfs.MountInfoEntry) func(*testing.T, context.Context) []*v
 	return func(*testing.T, context.Context) []*vfs.MountInfoEntry { return mnt }
 }
 
-//go:linkname toHost hakurei.app/container.toHost
-func toHost(name string) string
-
 var containerTestCases = []struct {
 	name    string
 	filter  bool
@@ -337,15 +331,13 @@ var containerTestCases = []struct {
 		func(t *testing.T, ctx context.Context) []*vfs.MountInfoEntry {
 			return []*vfs.MountInfoEntry{
 				ent("/", hst.PrivateTmp, "rw", "overlay", "overlay",
-					"rw"+
+					"rw,lowerdir="+
-						",lowerdir+="+
+						container.InternalToHostOvlEscape(ctx.Value(testVal("lower0")).(*check.Absolute).String())+":"+
-						toHost(ctx.Value(testVal("lower0")).(*check.Absolute).String())+
+						container.InternalToHostOvlEscape(ctx.Value(testVal("lower1")).(*check.Absolute).String())+
-						",lowerdir+="+
-						toHost(ctx.Value(testVal("lower1")).(*check.Absolute).String())+
 						",upperdir="+
-						toHost(ctx.Value(testVal("upper")).(*check.Absolute).String())+
+						container.InternalToHostOvlEscape(ctx.Value(testVal("upper")).(*check.Absolute).String())+
 						",workdir="+
-						toHost(ctx.Value(testVal("work")).(*check.Absolute).String())+
+						container.InternalToHostOvlEscape(ctx.Value(testVal("work")).(*check.Absolute).String())+
 						",redirect_dir=nofollow,uuid=on,userxattr"),
 			}
 		},
@@ -395,11 +387,9 @@ var containerTestCases = []struct {
 		func(t *testing.T, ctx context.Context) []*vfs.MountInfoEntry {
 			return []*vfs.MountInfoEntry{
 				ent("/", hst.PrivateTmp, "rw", "overlay", "overlay",
-					"ro"+
+					"ro,lowerdir="+
-						",lowerdir+="+
+						container.InternalToHostOvlEscape(ctx.Value(testVal("lower0")).(*check.Absolute).String())+":"+
-						toHost(ctx.Value(testVal("lower0")).(*check.Absolute).String())+
+						container.InternalToHostOvlEscape(ctx.Value(testVal("lower1")).(*check.Absolute).String())+
-						",lowerdir+="+
-						toHost(ctx.Value(testVal("lower1")).(*check.Absolute).String())+
 						",redirect_dir=nofollow,userxattr"),
 			}
 		},
@@ -409,11 +399,39 @@ var containerTestCases = []struct {
 func TestContainer(t *testing.T) {
 	t.Parallel()
 
-	var suffix string
+	t.Run("cancel", testContainerCancel(nil, func(t *testing.T, c *container.Container) {
-runTests:
+		wantErr := context.Canceled
+		wantExitCode := 0
+		if err := c.Wait(); !reflect.DeepEqual(err, wantErr) {
+			if m, ok := container.InternalMessageFromError(err); ok {
+				t.Error(m)
+			}
+			t.Errorf("Wait: error = %#v, want %#v", err, wantErr)
+		}
+		if ps := c.ProcessState(); ps == nil {
+			t.Errorf("ProcessState unexpectedly returned nil")
+		} else if code := ps.ExitCode(); code != wantExitCode {
+			t.Errorf("ExitCode: %d, want %d", code, wantExitCode)
+		}
+	}))
+
+	t.Run("forward", testContainerCancel(func(c *container.Container) {
+		c.ForwardCancel = true
+	}, func(t *testing.T, c *container.Container) {
+		var exitError *exec.ExitError
+		if err := c.Wait(); !errors.As(err, &exitError) {
+			if m, ok := container.InternalMessageFromError(err); ok {
+				t.Error(m)
+			}
+			t.Errorf("Wait: error = %v", err)
+		}
+		if code := exitError.ExitCode(); code != blockExitCodeInterrupt {
+			t.Errorf("ExitCode: %d, want %d", code, blockExitCodeInterrupt)
+		}
+	}))
+
 	for i, tc := range containerTestCases {
-		_suffix := suffix
+		t.Run(tc.name, func(t *testing.T) {
-		t.Run(tc.name+_suffix, func(t *testing.T) {
 			t.Parallel()
 
 			wantOps, wantOpsCtx := tc.ops(t)
@@ -437,10 +455,8 @@ runTests:
 			c.SeccompDisable = !tc.filter
 			c.RetainSession = tc.session
 			c.HostNet = tc.net
-			c.InitAsRoot = _suffix != ""
-			c.Env = append(c.Env, "HAKUREI_TEST_SUFFIX="+_suffix)
 			if info.CanDegrade {
-				if _, err := landlock.GetABI(); err != nil {
+				if _, err := container.LandlockGetABI(); err != nil {
 					if !errors.Is(err, syscall.ENOSYS) {
 						t.Fatalf("LandlockGetABI: error = %v", err)
 					}
@@ -448,9 +464,6 @@ runTests:
 					t.Log("Landlock LSM is unavailable, enabling HostAbstract")
 				}
 			}
-			if c.InitAsRoot {
-				c.SeccompPresets &= ^std.PresetDenyNS
-			}
 
 			c.
 				Readonly(check.MustAbs(pathReadonly), 0755).
@@ -519,11 +532,6 @@ runTests:
 			}
 		})
 	}
-
-	if suffix == "" {
-		suffix = " as root"
-		goto runTests
-	}
 }
 
 func ent(root, target, vfsOptstr, fsType, source, fsOptstr string) *vfs.MountInfoEntry {
@@ -546,118 +554,49 @@ func hostnameFromTestCase(name string) string {
 }
 
 func testContainerCancel(
-	t *testing.T,
 	containerExtra func(c *container.Container),
-	waitCheck func(ps *os.ProcessState, waitErr error),
+	waitCheck func(t *testing.T, c *container.Container),
-) {
+) func(t *testing.T) {
-	ctx, cancel := context.WithCancel(t.Context())
+	return func(t *testing.T) {
-
-	c := helperNewContainer(ctx, "block")
-	c.Stdout, c.Stderr = os.Stdout, os.Stderr
-	if containerExtra != nil {
-		containerExtra(c)
-	}
-
-	ready := make(chan struct{})
-	var waitErr error
-	r, w, err := os.Pipe()
-	if err != nil {
-		t.Fatalf("cannot pipe: %v", err)
-	}
-
-	c.ExtraFiles = append(c.ExtraFiles, w)
-	go func() {
-		defer close(ready)
-		if _, _err := r.Read(make([]byte, 1)); _err != nil {
-			panic(_err)
-		}
-	}()
-
-	if err = c.Start(); err != nil {
-		if m, ok := container.InternalMessageFromError(err); ok {
-			t.Fatal(m)
-		} else {
-			t.Fatalf("cannot start container: %v", err)
-		}
-	}
-
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		waitErr = c.Wait()
-		_ = r.SetReadDeadline(time.Now())
-	}()
-
-	if err = c.Serve(); err != nil {
-		if m, ok := container.InternalMessageFromError(err); ok {
-			t.Error(m)
-		} else {
-			t.Errorf("cannot serve setup params: %v", err)
-		}
-	}
-	<-ready
-	cancel()
-	<-done
-	waitCheck(c.ProcessState(), waitErr)
-}
-
-func TestForward(t *testing.T) {
-	t.Parallel()
-
-	f := func(ps *os.ProcessState, waitErr error) {
-		var exitError *exec.ExitError
-		if !errors.As(waitErr, &exitError) {
-			if m, ok := container.InternalMessageFromError(waitErr); ok {
-				t.Error(m)
-			}
-			t.Errorf("Wait: error = %v", waitErr)
-		}
-		if code := exitError.ExitCode(); code != blockExitCodeInterrupt {
-			t.Errorf("ExitCode: %d, want %d", code, blockExitCodeInterrupt)
-		}
-	}
-	t.Run("direct", func(t *testing.T) {
 		t.Parallel()
-		testContainerCancel(t, func(c *container.Container) {
+		ctx, cancel := context.WithCancel(t.Context())
-			c.ForwardCancel = true
-		}, f)
-	})
-	t.Run("as root", func(t *testing.T) {
-		testContainerCancel(t, func(c *container.Container) {
-			c.ForwardCancel = true
-			c.InitAsRoot = true
-			c.Proc(fhs.AbsProc)
-		}, f)
-	})
-}
 
-func TestCancel(t *testing.T) {
+		c := helperNewContainer(ctx, "block")
-	t.Parallel()
+		c.Stdout, c.Stderr = os.Stdout, os.Stderr
+		if containerExtra != nil {
+			containerExtra(c)
+		}
 
-	f := func(ps *os.ProcessState, waitErr error) {
+		ready := make(chan struct{})
-		wantErr := context.Canceled
+		if r, w, err := os.Pipe(); err != nil {
-		if !reflect.DeepEqual(waitErr, wantErr) {
+			t.Fatalf("cannot pipe: %v", err)
-			if m, ok := container.InternalMessageFromError(waitErr); ok {
+		} else {
+			c.ExtraFiles = append(c.ExtraFiles, w)
+			go func() {
+				defer close(ready)
+				if _, err = r.Read(make([]byte, 1)); err != nil {
+					panic(err.Error())
+				}
+			}()
+		}
+
+		if err := c.Start(); err != nil {
+			if m, ok := container.InternalMessageFromError(err); ok {
+				t.Fatal(m)
+			} else {
+				t.Fatalf("cannot start container: %v", err)
+			}
+		} else if err = c.Serve(); err != nil {
+			if m, ok := container.InternalMessageFromError(err); ok {
 				t.Error(m)
+			} else {
+				t.Errorf("cannot serve setup params: %v", err)
 			}
-			t.Errorf("Wait: error = %#v, want %#v", waitErr, wantErr)
-		}
-		if ps == nil {
-			t.Errorf("ProcessState unexpectedly returned nil")
-		} else if code := ps.ExitCode(); code != 0 {
-			t.Errorf("ExitCode: %d, want %d", code, 0)
 		}
+		<-ready
+		cancel()
+		waitCheck(t, c)
 	}
-	t.Run("direct", func(t *testing.T) {
-		t.Parallel()
-		testContainerCancel(t, nil, f)
-	})
-	t.Run("as root", func(t *testing.T) {
-		testContainerCancel(t, func(c *container.Container) {
-			c.InitAsRoot = true
-			c.Proc(fhs.AbsProc)
-		}, f)
-	})
 }
 
 func TestContainerString(t *testing.T) {
@@ -693,8 +632,6 @@ func init() {
 		})
 
 		c.Command("container", command.UsageInternal, func(args []string) error {
-			asRoot := os.Getenv("HAKUREI_TEST_SUFFIX") == " as root"
-
 			if len(args) != 1 {
 				return syscall.EINVAL
 			}
@@ -712,66 +649,6 @@ func init() {
 				return fmt.Errorf("gid: %d, want %d", gid, tc.gid)
 			}
 
-			// no attack surface increase during as root due to no_new_privs
-			var wantBounding uintptr = 1
-			asRootNot := " not"
-			if !asRoot {
-				wantBounding = 0
-				asRootNot = ""
-			}
-
-			const (
-				PR_CAP_AMBIENT        = 0x2f
-				PR_CAP_AMBIENT_IS_SET = 0x1
-			)
-			for i := range container.LastCap(nil) + 1 {
-				r, _, errno := syscall.Syscall(
-					syscall.SYS_PRCTL,
-					PR_CAP_AMBIENT,
-					PR_CAP_AMBIENT_IS_SET,
-					i,
-				)
-				if errno != 0 {
-					return os.NewSyscallError("prctl", errno)
-				}
-				if r != 0 {
-					return fmt.Errorf("capability %d in ambient set", i)
-				}
-
-				r, _, errno = syscall.Syscall(
-					syscall.SYS_PRCTL,
-					syscall.PR_CAPBSET_READ,
-					i,
-					0,
-				)
-				if errno != 0 {
-					return os.NewSyscallError("prctl", errno)
-				}
-				if r != wantBounding {
-					return fmt.Errorf("capability %d%s in bounding set", i, asRootNot)
-				}
-			}
-
-			const _LINUX_CAPABILITY_VERSION_3 = 0x20080522
-			var capData struct {
-				effective   uint32
-				permitted   uint32
-				inheritable uint32
-			}
-			if _, _, errno := syscall.Syscall(syscall.SYS_CAPGET, uintptr(unsafe.Pointer(&struct {
-				version uint32
-				pid     int32
-			}{_LINUX_CAPABILITY_VERSION_3, 0})), uintptr(unsafe.Pointer(&capData)), 0); errno != 0 {
-				return os.NewSyscallError("capget", errno)
-			}
-
-			if max(capData.effective, capData.permitted, capData.inheritable) != 0 {
-				return fmt.Errorf(
-					"effective = %d, permitted = %d, inheritable = %d",
-					capData.effective, capData.permitted, capData.inheritable,
-				)
-			}
-
 			wantHost := hostnameFromTestCase(tc.name)
 			if host, err := os.Hostname(); err != nil {
 				return fmt.Errorf("cannot get hostname: %v", err)
@@ -889,7 +766,7 @@ func TestMain(m *testing.M) {
 		}
 		c.MustParse(os.Args[1:], func(err error) {
 			if err != nil {
-				log.Fatal(err)
+				log.Fatal(err.Error())
 			}
 		})
 		return

container/dispatcher.go

@@ -65,8 +65,6 @@ type syscallDispatcher interface {
 	remount(msg message.Msg, target string, flags uintptr) error
 	// mountTmpfs provides mountTmpfs.
 	mountTmpfs(fsname, target string, flags uintptr, size int, perm os.FileMode) error
-	// mountOverlay provides mountOverlay.
-	mountOverlay(target string, options [][2]string) error
 	// ensureFile provides ensureFile.
 	ensureFile(name string, perm, pperm os.FileMode) error
 	// mustLoopback provides mustLoopback.
@@ -150,7 +148,7 @@ func (direct) lockOSThread() { runtime.LockOSThread() }
 
 func (direct) setPtracer(pid uintptr) error       { return ext.SetPtracer(pid) }
 func (direct) setDumpable(dumpable uintptr) error { return ext.SetDumpable(dumpable) }
-func (direct) setNoNewPrivs() error               { return setNoNewPrivs() }
+func (direct) setNoNewPrivs() error               { return SetNoNewPrivs() }
 
 func (direct) lastcap(msg message.Msg) uintptr                 { return LastCap(msg) }
 func (direct) capset(hdrp *capHeader, datap *[2]capData) error { return capset(hdrp, datap) }
@@ -171,9 +169,6 @@ func (direct) remount(msg message.Msg, target string, flags uintptr) error {
 func (k direct) mountTmpfs(fsname, target string, flags uintptr, size int, perm os.FileMode) error {
 	return mountTmpfs(k, fsname, target, flags, size, perm)
 }
-func (k direct) mountOverlay(target string, options [][2]string) error {
-	return mountOverlay(target, options)
-}
 func (direct) ensureFile(name string, perm, pperm os.FileMode) error {
 	return ensureFile(name, perm, pperm)
 }

container/dispatcher_test.go

@@ -468,14 +468,6 @@ func (k *kstub) mountTmpfs(fsname, target string, flags uintptr, size int, perm
 		stub.CheckArg(k.Stub, "perm", perm, 4))
 }
 
-func (k *kstub) mountOverlay(target string, options [][2]string) error {
-	k.Helper()
-	return k.Expects("mountOverlay").Error(
-		stub.CheckArg(k.Stub, "target", target, 0),
-		stub.CheckArgReflect(k.Stub, "options", options, 1),
-	)
-}
-
 func (k *kstub) ensureFile(name string, perm, pperm os.FileMode) error {
 	k.Helper()
 	return k.Expects("ensureFile").Error(

container/errors.go

@@ -118,10 +118,6 @@ func errnoFallback(op, path string, err error) (syscall.Errno, *os.PathError) {
 
 // mount wraps syscall.Mount for error handling.
 func mount(source, target, fstype string, flags uintptr, data string) error {
-	if max(len(source), len(target), len(data))+1 > os.Getpagesize() {
-		return &MountError{source, target, fstype, flags, data, syscall.ENOMEM}
-	}
-
 	err := syscall.Mount(source, target, fstype, flags, data)
 	if err == nil {
 		return nil

container/init.go

@@ -11,13 +11,11 @@ import (
 	"path/filepath"
 	"slices"
 	"strconv"
-	"strings"
 	"sync"
 	"sync/atomic"
 	. "syscall"
 	"time"
 
-	"hakurei.app/check"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/ext"
 	"hakurei.app/fhs"
@@ -184,33 +182,23 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		cancel()
 	}
 
-	uid, gid := param.Uid, param.Gid
-	if param.InitAsRoot {
-		uid, gid = 0, 0
-	}
-
 	// write uid/gid map here so parent does not need to set dumpable
 	if err := k.setDumpable(ext.SUID_DUMP_USER); err != nil {
 		k.fatalf(msg, "cannot set SUID_DUMP_USER: %v", err)
 	}
-	if err := k.writeFile(
+	if err := k.writeFile(fhs.Proc+"self/uid_map",
-		fhs.Proc+"self/uid_map",
+		append([]byte{}, strconv.Itoa(param.Uid)+" "+strconv.Itoa(param.HostUid)+" 1\n"...),
-		[]byte(strconv.Itoa(uid)+" "+strconv.Itoa(param.HostUid)+" 1\n"),
+		0); err != nil {
-		0,
-	); err != nil {
 		k.fatalf(msg, "%v", err)
 	}
-	if err := k.writeFile(
+	if err := k.writeFile(fhs.Proc+"self/setgroups",
-		fhs.Proc+"self/setgroups",
 		[]byte("deny\n"),
-		0,
+		0); err != nil && !os.IsNotExist(err) {
-	); err != nil && !os.IsNotExist(err) {
 		k.fatalf(msg, "%v", err)
 	}
 	if err := k.writeFile(fhs.Proc+"self/gid_map",
-		[]byte(strconv.Itoa(gid)+" "+strconv.Itoa(param.HostGid)+" 1\n"),
+		append([]byte{}, strconv.Itoa(param.Gid)+" "+strconv.Itoa(param.HostGid)+" 1\n"...),
-		0,
+		0); err != nil {
-	); err != nil {
 		k.fatalf(msg, "%v", err)
 	}
 	if err := k.setDumpable(ext.SUID_DUMP_DISABLE); err != nil {
@@ -235,23 +223,6 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	state := &setupState{process: make(map[int]WaitStatus), Params: &param.Params, Msg: msg, Context: ctx}
 	defer cancel()
 
-	if err := k.mount(SourceTmpfsRootfs, intermediateHostPath, FstypeTmpfs, MS_NODEV|MS_NOSUID, zeroString); err != nil {
-		k.fatalf(msg, "cannot mount intermediate root: %v", optionalErrorUnwrap(err))
-	}
-	if err := k.chdir(intermediateHostPath); err != nil {
-		k.fatalf(msg, "cannot enter intermediate host path: %v", err)
-	}
-
-	if len(param.Binfmt) > 0 {
-		for i, e := range param.Binfmt {
-			if pathname, err := k.evalSymlinks(e.Interpreter.String()); err != nil {
-				k.fatal(msg, err)
-			} else if param.Binfmt[i].Interpreter, err = check.NewAbs(pathname); err != nil {
-				k.fatal(msg, err)
-			}
-		}
-	}
-
 	/* early is called right before pivot_root into intermediate root;
 	this step is mostly for gathering information that would otherwise be
 	difficult to obtain via library functions after pivot_root, and
@@ -271,6 +242,13 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		}
 	}
 
+	if err := k.mount(SourceTmpfsRootfs, intermediateHostPath, FstypeTmpfs, MS_NODEV|MS_NOSUID, zeroString); err != nil {
+		k.fatalf(msg, "cannot mount intermediate root: %v", optionalErrorUnwrap(err))
+	}
+	if err := k.chdir(intermediateHostPath); err != nil {
+		k.fatalf(msg, "cannot enter intermediate host path: %v", err)
+	}
+
 	if err := k.mkdir(sysrootDir, 0755); err != nil {
 		k.fatalf(msg, "%v", err)
 	}
@@ -307,48 +285,6 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		}
 	}
 
-	if len(param.Binfmt) > 0 {
-		const interpreter = "/interpreter"
-
-		if param.BinfmtPath == nil {
-			param.BinfmtPath = fhs.AbsProcSys.Append("fs/binfmt_misc")
-		}
-		binfmt := sysrootPath + param.BinfmtPath.String()
-		if err := k.mkdirAll(binfmt, 0); err != nil {
-			k.fatal(msg, err)
-		}
-		if err := k.mount(
-			SourceBinfmtMisc,
-			binfmt,
-			FstypeBinfmtMisc,
-			MS_NOSUID|MS_NOEXEC|MS_NODEV,
-			zeroString,
-		); err != nil {
-			k.fatal(msg, err)
-		}
-
-		var buf strings.Builder
-		buf.Grow(1920)
-
-		register := binfmt + "/register"
-		for i, e := range param.Binfmt {
-			if err := k.symlink(hostPath+e.Interpreter.String(), interpreter); err != nil {
-				k.fatal(msg, err)
-			} else if err = k.writeFile(register, []byte(":"+
-				strconv.Itoa(i)+":"+
-				"M:"+
-				strconv.Itoa(int(e.Offset))+":"+
-				escapeBinfmt(&buf, e.Magic)+":"+
-				escapeBinfmt(&buf, e.Mask)+":"+
-				interpreter+":"+
-				"F"), 0); err != nil {
-				k.fatal(msg, err)
-			} else if err = k.remove(interpreter); err != nil {
-				k.fatal(msg, err)
-			}
-		}
-	}
-
 	// setup requiring host root complete at this point
 	if err := k.mount(hostDir, hostDir, zeroString, MS_SILENT|MS_REC|MS_PRIVATE, zeroString); err != nil {
 		k.fatalf(msg, "cannot make host root rprivate: %v", optionalErrorUnwrap(err))
@@ -387,19 +323,11 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		}
 	}
 
-	var keepCaps []uintptr
-	if param.Privileged {
-		keepCaps = append(keepCaps, CAP_SYS_ADMIN, CAP_SETPCAP)
-	}
-	if param.InitAsRoot {
-		keepCaps = append(keepCaps, CAP_SETFCAP)
-	}
-
 	if err := k.capAmbientClearAll(); err != nil {
 		k.fatalf(msg, "cannot clear the ambient capability set: %v", err)
 	}
-	for i := range lastcap + 1 {
+	for i := uintptr(0); i <= lastcap; i++ {
-		if slices.Contains(keepCaps, i) {
+		if param.Privileged && i == CAP_SYS_ADMIN {
 			continue
 		}
 		if err := k.capBoundingSetDrop(i); err != nil {
@@ -408,23 +336,20 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	}
 
 	var keep [2]uint32
-	for _, c := range keepCaps {
+	if param.Privileged {
-		keep[capToIndex(c)] |= capToMask(c)
+		keep[capToIndex(CAP_SYS_ADMIN)] |= capToMask(CAP_SYS_ADMIN)
-	}
 
+		if err := k.capAmbientRaise(CAP_SYS_ADMIN); err != nil {
+			k.fatalf(msg, "cannot raise CAP_SYS_ADMIN: %v", err)
+		}
+	}
 	if err := k.capset(
 		&capHeader{_LINUX_CAPABILITY_VERSION_3, 0},
-		&[2]capData{{keep[0], keep[0], keep[0]}, {keep[1], keep[1], keep[1]}},
+		&[2]capData{{0, keep[0], keep[0]}, {0, keep[1], keep[1]}},
 	); err != nil {
 		k.fatalf(msg, "cannot capset: %v", err)
 	}
 
-	for _, c := range keepCaps {
-		if err := k.capAmbientRaise(c); err != nil {
-			k.fatalf(msg, "cannot raise %#x: %v", c, err)
-		}
-	}
-
 	if !param.SeccompDisable {
 		rules := param.SeccompRules
 		if len(rules) == 0 { // non-empty rules slice always overrides presets
@@ -549,14 +474,6 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	cmd.ExtraFiles = extraFiles
 	cmd.Dir = param.Dir.String()
 
-	if param.InitAsRoot {
-		cmd.SysProcAttr = &SysProcAttr{
-			Cloneflags:  CLONE_NEWUSER,
-			UidMappings: []SysProcIDMap{{ContainerID: param.Uid, HostID: 0, Size: 1}},
-			GidMappings: []SysProcIDMap{{ContainerID: param.Gid, HostID: 0, Size: 1}},
-		}
-	}
-
 	msg.Verbosef("starting initial process %s", param.Path)
 	if err := k.start(cmd); err != nil {
 		k.fatalf(msg, "%v", err)

container/init_test.go

@@ -332,8 +332,6 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("fatalf", stub.ExpectArgs{"invalid op at index %d", []any{0}}, nil, nil),
 				/* end early */
@@ -372,8 +370,6 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("fatalf", stub.ExpectArgs{"invalid op at index %d", []any{0}}, nil, nil),
 				/* end early */
@@ -412,8 +408,6 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", stub.UniqueError(61)),
 				call("fatalf", stub.ExpectArgs{"cannot prepare op at index %d: %v", []any{0, stub.UniqueError(61)}}, nil, nil),
@@ -453,8 +447,6 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", &os.PathError{Op: "readlink", Path: "/", Err: stub.UniqueError(60)}),
 				call("fatal", stub.ExpectArgs{[]any{"cannot readlink /: unique error 60 injected by the test suite"}}, nil, nil),
@@ -494,6 +486,9 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				/* begin early */
+				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
+				/* end early */
 				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, stub.UniqueError(58)),
 				call("fatalf", stub.ExpectArgs{"cannot mount intermediate root: %v", []any{stub.UniqueError(58)}}, nil, nil),
 			},
@@ -531,6 +526,9 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				/* begin early */
+				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
+				/* end early */
 				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
 				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, stub.UniqueError(56)),
 				call("fatalf", stub.ExpectArgs{"cannot enter intermediate host path: %v", []any{stub.UniqueError(56)}}, nil, nil),
@@ -569,11 +567,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, stub.UniqueError(54)),
 				call("fatalf", stub.ExpectArgs{"%v", []any{stub.UniqueError(54)}}, nil, nil),
 			},
@@ -611,11 +609,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, stub.UniqueError(52)),
 				call("fatalf", stub.ExpectArgs{"cannot bind sysroot: %v", []any{stub.UniqueError(52)}}, nil, nil),
@@ -654,11 +652,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, stub.UniqueError(50)),
@@ -698,11 +696,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -743,11 +741,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -789,11 +787,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -844,11 +842,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -899,11 +897,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -955,11 +953,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1012,11 +1010,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1071,11 +1069,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1131,11 +1129,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1192,11 +1190,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1254,11 +1252,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1317,11 +1315,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1381,11 +1379,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1446,11 +1444,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1512,11 +1510,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1586,11 +1584,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1624,6 +1622,7 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x5)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x6)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x7)}, nil, nil),
+				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x9)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xa)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xb)}, nil, nil),
@@ -1655,9 +1654,8 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x26)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x27)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x28)}, nil, nil),
-				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0x200100, 0x200100, 0x200100}, {0, 0, 0}}}, nil, nil),
 				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x15)}, nil, stub.UniqueError(19)),
-				call("fatalf", stub.ExpectArgs{"cannot raise %#x: %v", []any{uintptr(0x15), stub.UniqueError(19)}}, nil, nil),
+				call("fatalf", stub.ExpectArgs{"cannot raise CAP_SYS_ADMIN: %v", []any{stub.UniqueError(19)}}, nil, nil),
 			},
 		}, nil},
 
@@ -1693,11 +1691,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1731,6 +1729,7 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x5)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x6)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x7)}, nil, nil),
+				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x9)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xa)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xb)}, nil, nil),
@@ -1762,7 +1761,8 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x26)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x27)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x28)}, nil, nil),
-				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0x200100, 0x200100, 0x200100}, {0, 0, 0}}}, nil, stub.UniqueError(17)),
+				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x15)}, nil, nil),
+				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0, 0x200000, 0x200000}, {0, 0, 0}}}, nil, stub.UniqueError(17)),
 				call("fatalf", stub.ExpectArgs{"cannot capset: %v", []any{stub.UniqueError(17)}}, nil, nil),
 			},
 		}, nil},
@@ -1799,11 +1799,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1837,6 +1837,7 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x5)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x6)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x7)}, nil, nil),
+				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x9)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xa)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xb)}, nil, nil),
@@ -1868,9 +1869,8 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x26)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x27)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x28)}, nil, nil),
-				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0x200100, 0x200100, 0x200100}, {0, 0, 0}}}, nil, nil),
 				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x15)}, nil, nil),
-				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
+				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0, 0x200000, 0x200000}, {0, 0, 0}}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"resolving presets %#x", []any{std.FilterPreset(0xf)}}, nil, nil),
 				call("seccompLoad", stub.ExpectArgs{seccomp.Preset(0xf, 0), seccomp.ExportFlag(0)}, nil, stub.UniqueError(15)),
 				call("fatalf", stub.ExpectArgs{"cannot load syscall filter: %v", []any{stub.UniqueError(15)}}, nil, nil),
@@ -1908,11 +1908,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2032,11 +2032,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(4), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2132,11 +2132,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(4), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2232,11 +2232,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(4), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2323,11 +2323,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(4), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2418,11 +2418,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(4), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2520,11 +2520,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2659,11 +2659,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2697,6 +2697,7 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x5)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x6)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x7)}, nil, nil),
+				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x9)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xa)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xb)}, nil, nil),
@@ -2728,9 +2729,8 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x26)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x27)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x28)}, nil, nil),
-				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0x200100, 0x200100, 0x200100}, {0, 0, 0}}}, nil, nil),
 				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x15)}, nil, nil),
-				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
+				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0, 0x200000, 0x200000}, {0, 0, 0}}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"resolving presets %#x", []any{std.FilterPreset(0xf)}}, nil, nil),
 				call("seccompLoad", stub.ExpectArgs{seccomp.Preset(0xf, 0), seccomp.ExportFlag(0)}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"%d filter rules loaded", []any{73}}, nil, nil),

container/initoverlay.go

@@ -4,9 +4,9 @@ import (
 	"encoding/gob"
 	"fmt"
 	"slices"
+	"strings"
 
 	"hakurei.app/check"
-	"hakurei.app/ext"
 	"hakurei.app/fhs"
 )
 
@@ -150,7 +150,7 @@ func (o *MountOverlayOp) early(_ *setupState, k syscallDispatcher) error {
 			if v, err := k.evalSymlinks(o.Upper.String()); err != nil {
 				return err
 			} else {
-				o.upper = toHost(v)
+				o.upper = check.EscapeOverlayDataSegment(toHost(v))
 			}
 		}
 
@@ -158,7 +158,7 @@ func (o *MountOverlayOp) early(_ *setupState, k syscallDispatcher) error {
 			if v, err := k.evalSymlinks(o.Work.String()); err != nil {
 				return err
 			} else {
-				o.work = toHost(v)
+				o.work = check.EscapeOverlayDataSegment(toHost(v))
 			}
 		}
 	}
@@ -168,39 +168,12 @@ func (o *MountOverlayOp) early(_ *setupState, k syscallDispatcher) error {
 		if v, err := k.evalSymlinks(a.String()); err != nil {
 			return err
 		} else {
-			o.lower[i] = toHost(v)
+			o.lower[i] = check.EscapeOverlayDataSegment(toHost(v))
 		}
 	}
 	return nil
 }
 
-// mountOverlay sets up an overlay mount via [ext.FS].
-func mountOverlay(target string, options [][2]string) error {
-	fs, err := ext.OpenFS(SourceOverlay, 0)
-	if err != nil {
-		return err
-	}
-	if err = fs.SetString("source", SourceOverlay); err != nil {
-		_ = fs.Close()
-		return err
-	}
-	for _, option := range options {
-		if err = fs.SetString(option[0], option[1]); err != nil {
-			_ = fs.Close()
-			return err
-		}
-	}
-	if err = fs.SetFlag(OptionOverlayUserxattr); err != nil {
-		_ = fs.Close()
-		return err
-	}
-	if err = fs.Mount(target, 0); err != nil {
-		_ = fs.Close()
-		return err
-	}
-	return fs.Close()
-}
-
 func (o *MountOverlayOp) apply(state *setupState, k syscallDispatcher) error {
 	target := o.Target.String()
 	if !o.noPrefix {
@@ -221,7 +194,7 @@ func (o *MountOverlayOp) apply(state *setupState, k syscallDispatcher) error {
 		}
 	}
 
-	options := make([][2]string, 0, 2+len(o.lower))
+	options := make([]string, 0, 4)
 
 	if o.upper == zeroString && o.work == zeroString { // readonly
 		if len(o.Lower) < 2 {
@@ -232,16 +205,15 @@ func (o *MountOverlayOp) apply(state *setupState, k syscallDispatcher) error {
 		if len(o.Lower) == 0 {
 			return &OverlayArgumentError{OverlayEmptyLower, zeroString}
 		}
-		options = append(options, [][2]string{
+		options = append(options,
-			{OptionOverlayUpperdir, o.upper},
+			OptionOverlayUpperdir+"="+o.upper,
-			{OptionOverlayWorkdir, o.work},
+			OptionOverlayWorkdir+"="+o.work)
-		}...)
-	}
-	for _, lower := range o.lower {
-		options = append(options, [2]string{OptionOverlayLowerdir + "+", lower})
 	}
+	options = append(options,
+		OptionOverlayLowerdir+"="+strings.Join(o.lower, check.SpecialOverlayPath),
+		OptionOverlayUserxattr)
 
-	return k.mountOverlay(target, options)
+	return k.mount(SourceOverlay, target, FstypeOverlay, 0, strings.Join(options, check.SpecialOverlayOption))
 }
 
 func (o *MountOverlayOp) late(*setupState, syscallDispatcher) error { return nil }

container/initoverlay_test.go

@@ -97,12 +97,13 @@ func TestMountOverlayOp(t *testing.T) {
 			call("mkdirAll", stub.ExpectArgs{"/sysroot", os.FileMode(0705)}, nil, nil),
 			call("mkdirTemp", stub.ExpectArgs{"/", "overlay.upper.*"}, "overlay.upper.32768", nil),
 			call("mkdirTemp", stub.ExpectArgs{"/", "overlay.work.*"}, "overlay.work.32768", nil),
-			call("mountOverlay", stub.ExpectArgs{"/sysroot", [][2]string{
+			call("mount", stub.ExpectArgs{"overlay", "/sysroot", "overlay", uintptr(0), "" +
-				{"upperdir", "overlay.upper.32768"},
+				"upperdir=overlay.upper.32768," +
-				{"workdir", "overlay.work.32768"},
+				"workdir=overlay.work.32768," +
-				{"lowerdir+", `/host/var/lib/planterette/base/debian:f92c9052`},
+				"lowerdir=" +
-				{"lowerdir+", `/host/var/lib/planterette/app/org.chromium.Chromium@debian:f92c9052`},
+				`/host/var/lib/planterette/base/debian\:f92c9052:` +
-			}}, nil, nil),
+				`/host/var/lib/planterette/app/org.chromium.Chromium@debian\:f92c9052,` +
+				"userxattr"}, nil, nil),
 		}, nil},
 
 		{"short lower ro", &Params{ParentPerm: 0755}, &MountOverlayOp{
@@ -128,10 +129,11 @@ func TestMountOverlayOp(t *testing.T) {
 			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store0"}, "/mnt-root/nix/.ro-store0", nil),
 		}, nil, []stub.Call{
 			call("mkdirAll", stub.ExpectArgs{"/nix/store", os.FileMode(0755)}, nil, nil),
-			call("mountOverlay", stub.ExpectArgs{"/nix/store", [][2]string{
+			call("mount", stub.ExpectArgs{"overlay", "/nix/store", "overlay", uintptr(0), "" +
-				{"lowerdir+", "/host/mnt-root/nix/.ro-store"},
+				"lowerdir=" +
-				{"lowerdir+", "/host/mnt-root/nix/.ro-store0"},
+				"/host/mnt-root/nix/.ro-store:" +
-			}}, nil, nil),
+				"/host/mnt-root/nix/.ro-store0," +
+				"userxattr"}, nil, nil),
 		}, nil},
 
 		{"success ro", &Params{ParentPerm: 0755}, &MountOverlayOp{
@@ -145,10 +147,11 @@ func TestMountOverlayOp(t *testing.T) {
 			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store0"}, "/mnt-root/nix/.ro-store0", nil),
 		}, nil, []stub.Call{
 			call("mkdirAll", stub.ExpectArgs{"/sysroot/nix/store", os.FileMode(0755)}, nil, nil),
-			call("mountOverlay", stub.ExpectArgs{"/sysroot/nix/store", [][2]string{
+			call("mount", stub.ExpectArgs{"overlay", "/sysroot/nix/store", "overlay", uintptr(0), "" +
-				{"lowerdir+", "/host/mnt-root/nix/.ro-store"},
+				"lowerdir=" +
-				{"lowerdir+", "/host/mnt-root/nix/.ro-store0"},
+				"/host/mnt-root/nix/.ro-store:" +
-			}}, nil, nil),
+				"/host/mnt-root/nix/.ro-store0," +
+				"userxattr"}, nil, nil),
 		}, nil},
 
 		{"nil lower", &Params{ParentPerm: 0700}, &MountOverlayOp{
@@ -216,11 +219,7 @@ func TestMountOverlayOp(t *testing.T) {
 			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store"}, "/mnt-root/nix/ro-store", nil),
 		}, nil, []stub.Call{
 			call("mkdirAll", stub.ExpectArgs{"/sysroot/nix/store", os.FileMode(0700)}, nil, nil),
-			call("mountOverlay", stub.ExpectArgs{"/sysroot/nix/store", [][2]string{
+			call("mount", stub.ExpectArgs{"overlay", "/sysroot/nix/store", "overlay", uintptr(0), "upperdir=/host/mnt-root/nix/.rw-store/.upper,workdir=/host/mnt-root/nix/.rw-store/.work,lowerdir=/host/mnt-root/nix/ro-store,userxattr"}, nil, stub.UniqueError(0)),
-				{"upperdir", "/host/mnt-root/nix/.rw-store/.upper"},
-				{"workdir", "/host/mnt-root/nix/.rw-store/.work"},
-				{"lowerdir+", "/host/mnt-root/nix/ro-store"},
-			}}, nil, stub.UniqueError(0)),
 		}, stub.UniqueError(0)},
 
 		{"success single layer", &Params{ParentPerm: 0700}, &MountOverlayOp{
@@ -234,11 +233,11 @@ func TestMountOverlayOp(t *testing.T) {
 			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store"}, "/mnt-root/nix/ro-store", nil),
 		}, nil, []stub.Call{
 			call("mkdirAll", stub.ExpectArgs{"/sysroot/nix/store", os.FileMode(0700)}, nil, nil),
-			call("mountOverlay", stub.ExpectArgs{"/sysroot/nix/store", [][2]string{
+			call("mount", stub.ExpectArgs{"overlay", "/sysroot/nix/store", "overlay", uintptr(0), "" +
-				{"upperdir", "/host/mnt-root/nix/.rw-store/.upper"},
+				"upperdir=/host/mnt-root/nix/.rw-store/.upper," +
-				{"workdir", "/host/mnt-root/nix/.rw-store/.work"},
+				"workdir=/host/mnt-root/nix/.rw-store/.work," +
-				{"lowerdir+", "/host/mnt-root/nix/ro-store"},
+				"lowerdir=/host/mnt-root/nix/ro-store," +
-			}}, nil, nil),
+				"userxattr"}, nil, nil),
 		}, nil},
 
 		{"success", &Params{ParentPerm: 0700}, &MountOverlayOp{
@@ -262,15 +261,16 @@ func TestMountOverlayOp(t *testing.T) {
 			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store3"}, "/mnt-root/nix/ro-store3", nil),
 		}, nil, []stub.Call{
 			call("mkdirAll", stub.ExpectArgs{"/sysroot/nix/store", os.FileMode(0700)}, nil, nil),
-			call("mountOverlay", stub.ExpectArgs{"/sysroot/nix/store", [][2]string{
+			call("mount", stub.ExpectArgs{"overlay", "/sysroot/nix/store", "overlay", uintptr(0), "" +
-				{"upperdir", "/host/mnt-root/nix/.rw-store/.upper"},
+				"upperdir=/host/mnt-root/nix/.rw-store/.upper," +
-				{"workdir", "/host/mnt-root/nix/.rw-store/.work"},
+				"workdir=/host/mnt-root/nix/.rw-store/.work," +
-				{"lowerdir+", "/host/mnt-root/nix/ro-store"},
+				"lowerdir=" +
-				{"lowerdir+", "/host/mnt-root/nix/ro-store0"},
+				"/host/mnt-root/nix/ro-store:" +
-				{"lowerdir+", "/host/mnt-root/nix/ro-store1"},
+				"/host/mnt-root/nix/ro-store0:" +
-				{"lowerdir+", "/host/mnt-root/nix/ro-store2"},
+				"/host/mnt-root/nix/ro-store1:" +
-				{"lowerdir+", "/host/mnt-root/nix/ro-store3"},
+				"/host/mnt-root/nix/ro-store2:" +
-			}}, nil, nil),
+				"/host/mnt-root/nix/ro-store3," +
+				"userxattr"}, nil, nil),
 		}, nil},
 	})
 

container/landlock.go

@@ -1,4 +1,4 @@
-package landlock
+package container
 
 import (
 	"strings"
@@ -14,11 +14,11 @@ const (
 	LANDLOCK_CREATE_RULESET_VERSION = 1 << iota
 )
 
-// AccessFS is bitmask of handled filesystem actions.
+// LandlockAccessFS is bitmask of handled filesystem actions.
-type AccessFS uint64
+type LandlockAccessFS uint64
 
 const (
-	LANDLOCK_ACCESS_FS_EXECUTE AccessFS = 1 << iota
+	LANDLOCK_ACCESS_FS_EXECUTE LandlockAccessFS = 1 << iota
 	LANDLOCK_ACCESS_FS_WRITE_FILE
 	LANDLOCK_ACCESS_FS_READ_FILE
 	LANDLOCK_ACCESS_FS_READ_DIR
@@ -38,8 +38,8 @@ const (
 	_LANDLOCK_ACCESS_FS_DELIM
 )
 
-// String returns a space-separated string of [AccessFS] flags.
+// String returns a space-separated string of [LandlockAccessFS] flags.
-func (f AccessFS) String() string {
+func (f LandlockAccessFS) String() string {
 	switch f {
 	case LANDLOCK_ACCESS_FS_EXECUTE:
 		return "execute"
@@ -90,8 +90,8 @@ func (f AccessFS) String() string {
 		return "fs_ioctl_dev"
 
 	default:
-		var c []AccessFS
+		var c []LandlockAccessFS
-		for i := AccessFS(1); i < _LANDLOCK_ACCESS_FS_DELIM; i <<= 1 {
+		for i := LandlockAccessFS(1); i < _LANDLOCK_ACCESS_FS_DELIM; i <<= 1 {
 			if f&i != 0 {
 				c = append(c, i)
 			}
@@ -107,18 +107,18 @@ func (f AccessFS) String() string {
 	}
 }
 
-// AccessNet is bitmask of handled network actions.
+// LandlockAccessNet is bitmask of handled network actions.
-type AccessNet uint64
+type LandlockAccessNet uint64
 
 const (
-	LANDLOCK_ACCESS_NET_BIND_TCP AccessNet = 1 << iota
+	LANDLOCK_ACCESS_NET_BIND_TCP LandlockAccessNet = 1 << iota
 	LANDLOCK_ACCESS_NET_CONNECT_TCP
 
 	_LANDLOCK_ACCESS_NET_DELIM
 )
 
-// String returns a space-separated string of [AccessNet] flags.
+// String returns a space-separated string of [LandlockAccessNet] flags.
-func (f AccessNet) String() string {
+func (f LandlockAccessNet) String() string {
 	switch f {
 	case LANDLOCK_ACCESS_NET_BIND_TCP:
 		return "bind_tcp"
@@ -127,8 +127,8 @@ func (f AccessNet) String() string {
 		return "connect_tcp"
 
 	default:
-		var c []AccessNet
+		var c []LandlockAccessNet
-		for i := AccessNet(1); i < _LANDLOCK_ACCESS_NET_DELIM; i <<= 1 {
+		for i := LandlockAccessNet(1); i < _LANDLOCK_ACCESS_NET_DELIM; i <<= 1 {
 			if f&i != 0 {
 				c = append(c, i)
 			}
@@ -144,18 +144,18 @@ func (f AccessNet) String() string {
 	}
 }
 
-// Scope is bitmask of scopes restricting a Landlock domain from accessing outside resources.
+// LandlockScope is bitmask of scopes restricting a Landlock domain from accessing outside resources.
-type Scope uint64
+type LandlockScope uint64
 
 const (
-	LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET Scope = 1 << iota
+	LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET LandlockScope = 1 << iota
 	LANDLOCK_SCOPE_SIGNAL
 
 	_LANDLOCK_SCOPE_DELIM
 )
 
-// String returns a space-separated string of [Scope] flags.
+// String returns a space-separated string of [LandlockScope] flags.
-func (f Scope) String() string {
+func (f LandlockScope) String() string {
 	switch f {
 	case LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET:
 		return "abstract_unix_socket"
@@ -164,8 +164,8 @@ func (f Scope) String() string {
 		return "signal"
 
 	default:
-		var c []Scope
+		var c []LandlockScope
-		for i := Scope(1); i < _LANDLOCK_SCOPE_DELIM; i <<= 1 {
+		for i := LandlockScope(1); i < _LANDLOCK_SCOPE_DELIM; i <<= 1 {
 			if f&i != 0 {
 				c = append(c, i)
 			}
@@ -184,12 +184,12 @@ func (f Scope) String() string {
 // RulesetAttr is equivalent to struct landlock_ruleset_attr.
 type RulesetAttr struct {
 	// Bitmask of handled filesystem actions.
-	HandledAccessFS AccessFS
+	HandledAccessFS LandlockAccessFS
 	// Bitmask of handled network actions.
-	HandledAccessNet AccessNet
+	HandledAccessNet LandlockAccessNet
 	// Bitmask of scopes restricting a Landlock domain from accessing outside
 	// resources (e.g. IPCs).
-	Scoped Scope
+	Scoped LandlockScope
 }
 
 // String returns a user-facing description of [RulesetAttr].
@@ -239,13 +239,13 @@ func (rulesetAttr *RulesetAttr) Create(flags uintptr) (fd int, err error) {
 	return fd, nil
 }
 
-// GetABI returns the ABI version supported by the kernel.
+// LandlockGetABI returns the ABI version supported by the kernel.
-func GetABI() (int, error) {
+func LandlockGetABI() (int, error) {
 	return (*RulesetAttr)(nil).Create(LANDLOCK_CREATE_RULESET_VERSION)
 }
 
-// RestrictSelf applies a loaded ruleset to the calling thread.
+// LandlockRestrictSelf applies a loaded ruleset to the calling thread.
-func RestrictSelf(rulesetFd int, flags uintptr) error {
+func LandlockRestrictSelf(rulesetFd int, flags uintptr) error {
 	r, _, errno := syscall.Syscall(
 		ext.SYS_LANDLOCK_RESTRICT_SELF,
 		uintptr(rulesetFd),

container/landlock_test.go

@@ -0,0 +1,65 @@
+package container_test
+
+import (
+	"testing"
+	"unsafe"
+
+	"hakurei.app/container"
+)
+
+func TestLandlockString(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name        string
+		rulesetAttr *container.RulesetAttr
+		want        string
+	}{
+		{"nil", nil, "NULL"},
+		{"zero", new(container.RulesetAttr), "0"},
+		{"some", &container.RulesetAttr{Scoped: container.LANDLOCK_SCOPE_SIGNAL}, "scoped: signal"},
+		{"set", &container.RulesetAttr{
+			HandledAccessFS:  container.LANDLOCK_ACCESS_FS_MAKE_SYM | container.LANDLOCK_ACCESS_FS_IOCTL_DEV | container.LANDLOCK_ACCESS_FS_WRITE_FILE,
+			HandledAccessNet: container.LANDLOCK_ACCESS_NET_BIND_TCP,
+			Scoped:           container.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | container.LANDLOCK_SCOPE_SIGNAL,
+		}, "fs: write_file make_sym fs_ioctl_dev, net: bind_tcp, scoped: abstract_unix_socket signal"},
+		{"all", &container.RulesetAttr{
+			HandledAccessFS: container.LANDLOCK_ACCESS_FS_EXECUTE |
+				container.LANDLOCK_ACCESS_FS_WRITE_FILE |
+				container.LANDLOCK_ACCESS_FS_READ_FILE |
+				container.LANDLOCK_ACCESS_FS_READ_DIR |
+				container.LANDLOCK_ACCESS_FS_REMOVE_DIR |
+				container.LANDLOCK_ACCESS_FS_REMOVE_FILE |
+				container.LANDLOCK_ACCESS_FS_MAKE_CHAR |
+				container.LANDLOCK_ACCESS_FS_MAKE_DIR |
+				container.LANDLOCK_ACCESS_FS_MAKE_REG |
+				container.LANDLOCK_ACCESS_FS_MAKE_SOCK |
+				container.LANDLOCK_ACCESS_FS_MAKE_FIFO |
+				container.LANDLOCK_ACCESS_FS_MAKE_BLOCK |
+				container.LANDLOCK_ACCESS_FS_MAKE_SYM |
+				container.LANDLOCK_ACCESS_FS_REFER |
+				container.LANDLOCK_ACCESS_FS_TRUNCATE |
+				container.LANDLOCK_ACCESS_FS_IOCTL_DEV,
+			HandledAccessNet: container.LANDLOCK_ACCESS_NET_BIND_TCP |
+				container.LANDLOCK_ACCESS_NET_CONNECT_TCP,
+			Scoped: container.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET |
+				container.LANDLOCK_SCOPE_SIGNAL,
+		}, "fs: execute write_file read_file read_dir remove_dir remove_file make_char make_dir make_reg make_sock make_fifo make_block make_sym fs_refer fs_truncate fs_ioctl_dev, net: bind_tcp connect_tcp, scoped: abstract_unix_socket signal"},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			if got := tc.rulesetAttr.String(); got != tc.want {
+				t.Errorf("String: %s, want %s", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestLandlockAttrSize(t *testing.T) {
+	t.Parallel()
+	want := 24
+	if got := unsafe.Sizeof(container.RulesetAttr{}); got != uintptr(want) {
+		t.Errorf("Sizeof: %d, want %d", got, want)
+	}
+}

container/mount.go

@@ -40,9 +40,6 @@ const (
 	// SourceMqueue is used when mounting mqueue.
 	// Note that any source value is allowed when fstype is [FstypeMqueue].
 	SourceMqueue = "mqueue"
-	// SourceBinfmtMisc is used when mounting binfmt_misc.
-	// Note that any source value is allowed when fstype is [SourceBinfmtMisc].
-	SourceBinfmtMisc = "binfmt_misc"
 	// SourceOverlay is used when mounting overlay.
 	// Note that any source value is allowed when fstype is [FstypeOverlay].
 	SourceOverlay = "overlay"
@@ -73,9 +70,6 @@ const (
 	// FstypeMqueue represents the mqueue pseudo-filesystem.
 	// This filesystem type is usually mounted on /dev/mqueue.
 	FstypeMqueue = "mqueue"
-	// FstypeBinfmtMisc represents the binfmt_misc pseudo-filesystem.
-	// This filesystem type is usually mounted on /proc/sys/fs/binfmt_misc.
-	FstypeBinfmtMisc = "binfmt_misc"
 	// FstypeOverlay represents the overlay pseudo-filesystem.
 	// This filesystem type can be mounted anywhere in the container filesystem.
 	FstypeOverlay = "overlay"

container/path_test.go

@@ -10,6 +10,7 @@ import (
 	"testing"
 	"unsafe"
 
+	"hakurei.app/check"
 	"hakurei.app/vfs"
 )
 
@@ -49,6 +50,9 @@ func TestToHost(t *testing.T) {
 	}
 }
 
+// InternalToHostOvlEscape exports toHost passed to [check.EscapeOverlayDataSegment].
+func InternalToHostOvlEscape(s string) string { return check.EscapeOverlayDataSegment(toHost(s)) }
+
 func TestCreateFile(t *testing.T) {
 	t.Run("nonexistent", func(t *testing.T) {
 		t.Run("mkdir", func(t *testing.T) {

container/syscall.go

@@ -7,8 +7,8 @@ import (
 	"hakurei.app/ext"
 )
 
-// setNoNewPrivs sets the calling thread's no_new_privs attribute.
+// SetNoNewPrivs sets the calling thread's no_new_privs attribute.
-func setNoNewPrivs() error {
+func SetNoNewPrivs() error {
 	return ext.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0)
 }
 

ext/fs.go

@@ -1,267 +0,0 @@
-package ext
-
-import (
-	"os"
-	"runtime"
-	"syscall"
-	"unsafe"
-)
-
-// include/uapi/linux/mount.h
-
-/*
- * move_mount() flags.
- */
-const (
-	MOVE_MOUNT_F_SYMLINKS   = 1 << iota /* Follow symlinks on from path */
-	MOVE_MOUNT_F_AUTOMOUNTS             /* Follow automounts on from path */
-	MOVE_MOUNT_F_EMPTY_PATH             /* Empty from path permitted */
-	_
-	MOVE_MOUNT_T_SYMLINKS   /* Follow symlinks on to path */
-	MOVE_MOUNT_T_AUTOMOUNTS /* Follow automounts on to path */
-	MOVE_MOUNT_T_EMPTY_PATH /* Empty to path permitted */
-	_
-	MOVE_MOUNT_SET_GROUP /* Set sharing group instead */
-	MOVE_MOUNT_BENEATH   /* Mount beneath top mount */
-)
-
-/*
- * fsopen() flags.
- */
-const (
-	FSOPEN_CLOEXEC = 1 << iota
-)
-
-/*
- * fspick() flags.
- */
-const (
-	FSPICK_CLOEXEC = 1 << iota
-	FSPICK_SYMLINK_NOFOLLOW
-	FSPICK_NO_AUTOMOUNT
-	FSPICK_EMPTY_PATH
-)
-
-/*
- * The type of fsconfig() call made.
- */
-const (
-	FSCONFIG_SET_FLAG        = iota /* Set parameter, supplying no value */
-	FSCONFIG_SET_STRING             /* Set parameter, supplying a string value */
-	FSCONFIG_SET_BINARY             /* Set parameter, supplying a binary blob value */
-	FSCONFIG_SET_PATH               /* Set parameter, supplying an object by path */
-	FSCONFIG_SET_PATH_EMPTY         /* Set parameter, supplying an object by (empty) path */
-	FSCONFIG_SET_FD                 /* Set parameter, supplying an object by fd */
-	FSCONFIG_CMD_CREATE             /* Create new or reuse existing superblock */
-	FSCONFIG_CMD_RECONFIGURE        /* Invoke superblock reconfiguration */
-	FSCONFIG_CMD_CREATE_EXCL        /* Create new superblock, fail if reusing existing superblock */
-)
-
-/*
- * fsmount() flags.
- */
-const (
-	FSMOUNT_CLOEXEC = 1 << iota
-)
-
-/*
- * Mount attributes.
- */
-const (
-	MOUNT_ATTR_RDONLY      = 0x00000001 /* Mount read-only */
-	MOUNT_ATTR_NOSUID      = 0x00000002 /* Ignore suid and sgid bits */
-	MOUNT_ATTR_NODEV       = 0x00000004 /* Disallow access to device special files */
-	MOUNT_ATTR_NOEXEC      = 0x00000008 /* Disallow program execution */
-	MOUNT_ATTR__ATIME      = 0x00000070 /* Setting on how atime should be updated */
-	MOUNT_ATTR_RELATIME    = 0x00000000 /* - Update atime relative to mtime/ctime. */
-	MOUNT_ATTR_NOATIME     = 0x00000010 /* - Do not update access times. */
-	MOUNT_ATTR_STRICTATIME = 0x00000020 /* - Always perform atime updates */
-	MOUNT_ATTR_NODIRATIME  = 0x00000080 /* Do not update directory access times */
-	MOUNT_ATTR_IDMAP       = 0x00100000 /* Idmap mount to @userns_fd in struct mount_attr. */
-	MOUNT_ATTR_NOSYMFOLLOW = 0x00200000 /* Do not follow symlinks */
-)
-
-// FS provides low-level wrappers around the suite of file-descriptor-based
-// mount facilities in Linux.
-type FS struct {
-	fd uintptr
-	c  runtime.Cleanup
-}
-
-// newFS allocates a new [FS] for the specified fd.
-func newFS(fd uintptr) *FS {
-	fs := FS{fd: fd}
-	fs.c = runtime.AddCleanup(&fs, func(fd uintptr) {
-		_ = syscall.Close(int(fd))
-	}, fd)
-	return &fs
-}
-
-// Close closes the underlying filesystem context.
-func (fs *FS) Close() error {
-	if fs == nil {
-		return syscall.EINVAL
-	}
-	err := syscall.Close(int(fs.fd))
-	fs.c.Stop()
-	return err
-}
-
-// OpenFS creates a new filesystem context.
-func OpenFS(fsname string, flags int) (fs *FS, err error) {
-	var s *byte
-	s, err = syscall.BytePtrFromString(fsname)
-	if err != nil {
-		return
-	}
-	fd, _, errno := syscall.Syscall(
-		SYS_FSOPEN,
-		uintptr(unsafe.Pointer(s)),
-		uintptr(flags|FSOPEN_CLOEXEC),
-		0,
-	)
-	if errno != 0 {
-		err = os.NewSyscallError("fsopen", errno)
-	} else {
-		fs = newFS(fd)
-	}
-	return
-}
-
-// PickFS selects filesystem for reconfiguration.
-func PickFS(dirfd int, pathname string, flags int) (fs *FS, err error) {
-	var s *byte
-	s, err = syscall.BytePtrFromString(pathname)
-	if err != nil {
-		return
-	}
-	fd, _, errno := syscall.Syscall(
-		SYS_FSPICK,
-		uintptr(dirfd),
-		uintptr(unsafe.Pointer(s)),
-		uintptr(flags|FSPICK_CLOEXEC),
-	)
-	if errno != 0 {
-		err = os.NewSyscallError("fspick", errno)
-	} else {
-		fs = newFS(fd)
-	}
-	return
-}
-
-// config configures new or existing filesystem context.
-func (fs *FS) config(cmd uint, key *byte, value unsafe.Pointer, aux int) (err error) {
-	_, _, errno := syscall.Syscall6(
-		SYS_FSCONFIG,
-		fs.fd,
-		uintptr(cmd),
-		uintptr(unsafe.Pointer(key)),
-		uintptr(value),
-		uintptr(aux),
-		0,
-	)
-	if errno != 0 {
-		err = os.NewSyscallError("fsconfig", errno)
-	}
-	return
-}
-
-// SetFlag sets the flag parameter named by key. ([FSCONFIG_SET_FLAG])
-func (fs *FS) SetFlag(key string) (err error) {
-	var s *byte
-	s, err = syscall.BytePtrFromString(key)
-	if err != nil {
-		return
-	}
-
-	return fs.config(FSCONFIG_SET_FLAG, s, nil, 0)
-}
-
-// SetString sets the string parameter named by key to the value specified by
-// value. ([FSCONFIG_SET_STRING])
-func (fs *FS) SetString(key, value string) (err error) {
-	var s0 *byte
-	s0, err = syscall.BytePtrFromString(key)
-	if err != nil {
-		return
-	}
-
-	var s1 *byte
-	s1, err = syscall.BytePtrFromString(value)
-	if err != nil {
-		return
-	}
-
-	return fs.config(FSCONFIG_SET_STRING, s0, unsafe.Pointer(s1), 0)
-}
-
-// mount instantiates mount object from filesystem context.
-func (fs *FS) mount(flags, attrFlags int) (fsfd int, err error) {
-	r, _, errno := syscall.Syscall(
-		SYS_FSMOUNT,
-		fs.fd,
-		uintptr(flags|FSMOUNT_CLOEXEC),
-		uintptr(attrFlags),
-	)
-	fsfd = int(r)
-	if errno != 0 {
-		err = os.NewSyscallError("fsmount", errno)
-	}
-	return
-}
-
-// MoveMount moves or attaches mount object to filesystem.
-func MoveMount(
-	fromDirfd int,
-	fromPathname string,
-	toDirfd int,
-	toPathname string,
-	flags int,
-) (err error) {
-	var s0 *byte
-	s0, err = syscall.BytePtrFromString(fromPathname)
-	if err != nil {
-		return
-	}
-
-	var s1 *byte
-	s1, err = syscall.BytePtrFromString(toPathname)
-	if err != nil {
-		return
-	}
-
-	_, _, errno := syscall.Syscall6(
-		SYS_MOVE_MOUNT,
-		uintptr(fromDirfd),
-		uintptr(unsafe.Pointer(s0)),
-		uintptr(toDirfd),
-		uintptr(unsafe.Pointer(s1)),
-		uintptr(flags),
-		0,
-	)
-	if errno != 0 {
-		err = os.NewSyscallError("move_mount", errno)
-	}
-	return
-}
-
-// Mount attaches the underlying filesystem context to the specified pathname.
-func (fs *FS) Mount(pathname string, attrFlags int) error {
-	if err := fs.config(FSCONFIG_CMD_CREATE_EXCL, nil, nil, 0); err != nil {
-		return err
-	}
-	fd, err := fs.mount(0, attrFlags)
-	if err != nil {
-		return err
-	}
-	err = MoveMount(
-		fd, "",
-		-1, pathname,
-		MOVE_MOUNT_F_EMPTY_PATH,
-	)
-	closeErr := syscall.Close(fd)
-	if err == nil {
-		err = closeErr
-	}
-	return err
-}

fhs/abs.go

@@ -42,8 +42,6 @@ var (
 	AbsDevShm = unsafeAbs(DevShm)
 	// AbsProc is [Proc] as [check.Absolute].
 	AbsProc = unsafeAbs(Proc)
-	// AbsProcSys is [ProcSys] as [check.Absolute].
-	AbsProcSys = unsafeAbs(ProcSys)
 	// AbsProcSelfExe is [ProcSelfExe] as [check.Absolute].
 	AbsProcSelfExe = unsafeAbs(ProcSelfExe)
 	// AbsSys is [Sys] as [check.Absolute].

hst/config.go

@@ -140,29 +140,21 @@ var (
 	ErrInsecure = errors.New("configuration is insecure")
 )
 
-const (
-	// VAllowInsecure allows use of compatibility options considered insecure
-	// under any configuration, to work around ecosystem-wide flaws.
-	VAllowInsecure = 1 << iota
-)
-
 // Validate checks [Config] and returns [AppError] if an invalid value is encountered.
-func (config *Config) Validate(flags int) error {
+func (config *Config) Validate() error {
-	const step = "validate configuration"
-
 	if config == nil {
-		return &AppError{Step: step, Err: ErrConfigNull,
+		return &AppError{Step: "validate configuration", Err: ErrConfigNull,
 			Msg: "invalid configuration"}
 	}
 
 	// this is checked again in hsu
 	if config.Identity < IdentityStart || config.Identity > IdentityEnd {
-		return &AppError{Step: step, Err: ErrIdentityBounds,
+		return &AppError{Step: "validate configuration", Err: ErrIdentityBounds,
 			Msg: "identity " + strconv.Itoa(config.Identity) + " out of range"}
 	}
 
 	if config.SchedPolicy < 0 || config.SchedPolicy > ext.SCHED_LAST {
-		return &AppError{Step: step, Err: ErrSchedPolicyBounds,
+		return &AppError{Step: "validate configuration", Err: ErrSchedPolicyBounds,
 			Msg: "scheduling policy " +
 				strconv.Itoa(int(config.SchedPolicy)) +
 				" out of range"}
@@ -176,51 +168,34 @@ func (config *Config) Validate(flags int) error {
 	}
 
 	if config.Container == nil {
-		return &AppError{Step: step, Err: ErrConfigNull,
+		return &AppError{Step: "validate configuration", Err: ErrConfigNull,
 			Msg: "configuration missing container state"}
 	}
 	if config.Container.Home == nil {
-		return &AppError{Step: step, Err: ErrConfigNull,
+		return &AppError{Step: "validate configuration", Err: ErrConfigNull,
 			Msg: "container configuration missing path to home directory"}
 	}
 	if config.Container.Shell == nil {
-		return &AppError{Step: step, Err: ErrConfigNull,
+		return &AppError{Step: "validate configuration", Err: ErrConfigNull,
 			Msg: "container configuration missing path to shell"}
 	}
 	if config.Container.Path == nil {
-		return &AppError{Step: step, Err: ErrConfigNull,
+		return &AppError{Step: "validate configuration", Err: ErrConfigNull,
 			Msg: "container configuration missing path to initial program"}
 	}
 
 	for key := range config.Container.Env {
 		if strings.IndexByte(key, '=') != -1 || strings.IndexByte(key, 0) != -1 {
-			return &AppError{Step: step, Err: ErrEnviron,
+			return &AppError{Step: "validate configuration", Err: ErrEnviron,
 				Msg: "invalid environment variable " + strconv.Quote(key)}
 		}
 	}
 
-	et := config.Enablements.Unwrap()
+	if et := config.Enablements.Unwrap(); !config.DirectPulse && et&EPulse != 0 {
-	if !config.DirectPulse && et&EPulse != 0 {
+		return &AppError{Step: "validate configuration", Err: ErrInsecure,
-		return &AppError{Step: step, Err: ErrInsecure,
 			Msg: "enablement PulseAudio is insecure and no longer supported"}
 	}
 
-	if flags&VAllowInsecure == 0 {
-		switch {
-		case et&EWayland != 0 && config.DirectWayland:
-			return &AppError{Step: step, Err: ErrInsecure,
-				Msg: "direct_wayland is insecure and no longer supported"}
-
-		case et&EPipeWire != 0 && config.DirectPipeWire:
-			return &AppError{Step: step, Err: ErrInsecure,
-				Msg: "direct_pipewire is insecure and no longer supported"}
-
-		case et&EPulse != 0 && config.DirectPulse:
-			return &AppError{Step: step, Err: ErrInsecure,
-				Msg: "direct_pulse is insecure and no longer supported"}
-		}
-	}
-
 	return nil
 }
 

hst/config_test.go

@@ -14,109 +14,65 @@ func TestConfigValidate(t *testing.T) {
 	testCases := []struct {
 		name    string
 		config  *hst.Config
-		flags   int
 		wantErr error
 	}{
-		{"nil", nil, 0, &hst.AppError{Step: "validate configuration", Err: hst.ErrConfigNull,
+		{"nil", nil, &hst.AppError{Step: "validate configuration", Err: hst.ErrConfigNull,
 			Msg: "invalid configuration"}},
-
+		{"identity lower", &hst.Config{Identity: -1}, &hst.AppError{Step: "validate configuration", Err: hst.ErrIdentityBounds,
-		{"identity lower", &hst.Config{Identity: -1}, 0, &hst.AppError{Step: "validate configuration", Err: hst.ErrIdentityBounds,
 			Msg: "identity -1 out of range"}},
-		{"identity upper", &hst.Config{Identity: 10000}, 0, &hst.AppError{Step: "validate configuration", Err: hst.ErrIdentityBounds,
+		{"identity upper", &hst.Config{Identity: 10000}, &hst.AppError{Step: "validate configuration", Err: hst.ErrIdentityBounds,
 			Msg: "identity 10000 out of range"}},
-
+		{"sched lower", &hst.Config{SchedPolicy: -1}, &hst.AppError{Step: "validate configuration", Err: hst.ErrSchedPolicyBounds,
-		{"sched lower", &hst.Config{SchedPolicy: -1}, 0, &hst.AppError{Step: "validate configuration", Err: hst.ErrSchedPolicyBounds,
 			Msg: "scheduling policy -1 out of range"}},
-		{"sched upper", &hst.Config{SchedPolicy: 0xcafe}, 0, &hst.AppError{Step: "validate configuration", Err: hst.ErrSchedPolicyBounds,
+		{"sched upper", &hst.Config{SchedPolicy: 0xcafe}, &hst.AppError{Step: "validate configuration", Err: hst.ErrSchedPolicyBounds,
 			Msg: "scheduling policy 51966 out of range"}},
-
+		{"dbus session", &hst.Config{SessionBus: &hst.BusConfig{See: []string{""}}},
-		{"dbus session", &hst.Config{SessionBus: &hst.BusConfig{See: []string{""}}}, 0,
 			&hst.BadInterfaceError{Interface: "", Segment: "session"}},
-		{"dbus system", &hst.Config{SystemBus: &hst.BusConfig{See: []string{""}}}, 0,
+		{"dbus system", &hst.Config{SystemBus: &hst.BusConfig{See: []string{""}}},
 			&hst.BadInterfaceError{Interface: "", Segment: "system"}},
-
+		{"container", &hst.Config{}, &hst.AppError{Step: "validate configuration", Err: hst.ErrConfigNull,
-		{"container", &hst.Config{}, 0, &hst.AppError{Step: "validate configuration", Err: hst.ErrConfigNull,
 			Msg: "configuration missing container state"}},
-		{"home", &hst.Config{Container: &hst.ContainerConfig{}}, 0, &hst.AppError{Step: "validate configuration", Err: hst.ErrConfigNull,
+		{"home", &hst.Config{Container: &hst.ContainerConfig{}}, &hst.AppError{Step: "validate configuration", Err: hst.ErrConfigNull,
 			Msg: "container configuration missing path to home directory"}},
 		{"shell", &hst.Config{Container: &hst.ContainerConfig{
 			Home: fhs.AbsTmp,
-		}}, 0, &hst.AppError{Step: "validate configuration", Err: hst.ErrConfigNull,
+		}}, &hst.AppError{Step: "validate configuration", Err: hst.ErrConfigNull,
 			Msg: "container configuration missing path to shell"}},
 		{"path", &hst.Config{Container: &hst.ContainerConfig{
 			Home:  fhs.AbsTmp,
 			Shell: fhs.AbsTmp,
-		}}, 0, &hst.AppError{Step: "validate configuration", Err: hst.ErrConfigNull,
+		}}, &hst.AppError{Step: "validate configuration", Err: hst.ErrConfigNull,
 			Msg: "container configuration missing path to initial program"}},
-
 		{"env equals", &hst.Config{Container: &hst.ContainerConfig{
 			Home:  fhs.AbsTmp,
 			Shell: fhs.AbsTmp,
 			Path:  fhs.AbsTmp,
 			Env:   map[string]string{"TERM=": ""},
-		}}, 0, &hst.AppError{Step: "validate configuration", Err: hst.ErrEnviron,
+		}}, &hst.AppError{Step: "validate configuration", Err: hst.ErrEnviron,
 			Msg: `invalid environment variable "TERM="`}},
 		{"env NUL", &hst.Config{Container: &hst.ContainerConfig{
 			Home:  fhs.AbsTmp,
 			Shell: fhs.AbsTmp,
 			Path:  fhs.AbsTmp,
 			Env:   map[string]string{"TERM\x00": ""},
-		}}, 0, &hst.AppError{Step: "validate configuration", Err: hst.ErrEnviron,
+		}}, &hst.AppError{Step: "validate configuration", Err: hst.ErrEnviron,
 			Msg: `invalid environment variable "TERM\x00"`}},
-
+		{"insecure pulse", &hst.Config{Enablements: hst.NewEnablements(hst.EPulse), Container: &hst.ContainerConfig{
-		{"insecure pulse", &hst.Config{Enablements: new(hst.EPulse), Container: &hst.ContainerConfig{
 			Home:  fhs.AbsTmp,
 			Shell: fhs.AbsTmp,
 			Path:  fhs.AbsTmp,
-		}}, 0, &hst.AppError{Step: "validate configuration", Err: hst.ErrInsecure,
+		}}, &hst.AppError{Step: "validate configuration", Err: hst.ErrInsecure,
 			Msg: "enablement PulseAudio is insecure and no longer supported"}},
-
-		{"direct wayland", &hst.Config{Enablements: new(hst.EWayland), DirectWayland: true, Container: &hst.ContainerConfig{
-			Home:  fhs.AbsTmp,
-			Shell: fhs.AbsTmp,
-			Path:  fhs.AbsTmp,
-		}}, 0, &hst.AppError{Step: "validate configuration", Err: hst.ErrInsecure,
-			Msg: "direct_wayland is insecure and no longer supported"}},
-		{"direct wayland allow", &hst.Config{Enablements: new(hst.EWayland), DirectWayland: true, Container: &hst.ContainerConfig{
-			Home:  fhs.AbsTmp,
-			Shell: fhs.AbsTmp,
-			Path:  fhs.AbsTmp,
-		}}, hst.VAllowInsecure, nil},
-
-		{"direct pipewire", &hst.Config{Enablements: new(hst.EPipeWire), DirectPipeWire: true, Container: &hst.ContainerConfig{
-			Home:  fhs.AbsTmp,
-			Shell: fhs.AbsTmp,
-			Path:  fhs.AbsTmp,
-		}}, 0, &hst.AppError{Step: "validate configuration", Err: hst.ErrInsecure,
-			Msg: "direct_pipewire is insecure and no longer supported"}},
-		{"direct pipewire allow", &hst.Config{Enablements: new(hst.EPipeWire), DirectPipeWire: true, Container: &hst.ContainerConfig{
-			Home:  fhs.AbsTmp,
-			Shell: fhs.AbsTmp,
-			Path:  fhs.AbsTmp,
-		}}, hst.VAllowInsecure, nil},
-
-		{"direct pulse", &hst.Config{Enablements: new(hst.EPulse), DirectPulse: true, Container: &hst.ContainerConfig{
-			Home:  fhs.AbsTmp,
-			Shell: fhs.AbsTmp,
-			Path:  fhs.AbsTmp,
-		}}, 0, &hst.AppError{Step: "validate configuration", Err: hst.ErrInsecure,
-			Msg: "direct_pulse is insecure and no longer supported"}},
-		{"direct pulse allow", &hst.Config{Enablements: new(hst.EPulse), DirectPulse: true, Container: &hst.ContainerConfig{
-			Home:  fhs.AbsTmp,
-			Shell: fhs.AbsTmp,
-			Path:  fhs.AbsTmp,
-		}}, hst.VAllowInsecure, nil},
-
 		{"valid", &hst.Config{Container: &hst.ContainerConfig{
 			Home:  fhs.AbsTmp,
 			Shell: fhs.AbsTmp,
 			Path:  fhs.AbsTmp,
-		}}, 0, nil},
+		}}, nil},
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
-			if err := tc.config.Validate(tc.flags); !reflect.DeepEqual(err, tc.wantErr) {
+			if err := tc.config.Validate(); !reflect.DeepEqual(err, tc.wantErr) {
 				t.Errorf("Validate: error = %#v, want %#v", err, tc.wantErr)
 			}
 		})

hst/enablement.go

@@ -7,12 +7,12 @@ import (
 	"syscall"
 )
 
-// Enablements denotes optional host service to export to the target user.
+// Enablement represents an optional host service to export to the target user.
-type Enablements byte
+type Enablement byte
 
 const (
 	// EWayland exposes a Wayland pathname socket via security-context-v1.
-	EWayland Enablements = 1 << iota
+	EWayland Enablement = 1 << iota
 	// EX11 adds the target user via X11 ChangeHosts and exposes the X11
 	// pathname socket.
 	EX11
@@ -28,8 +28,8 @@ const (
 	EM
 )
 
-// String returns a string representation of the flags set on [Enablements].
+// String returns a string representation of the flags set on [Enablement].
-func (e Enablements) String() string {
+func (e Enablement) String() string {
 	switch e {
 	case 0:
 		return "(no enablements)"
@@ -47,7 +47,7 @@ func (e Enablements) String() string {
 		buf := new(strings.Builder)
 		buf.Grow(32)
 
-		for i := Enablements(1); i < EM; i <<= 1 {
+		for i := Enablement(1); i < EM; i <<= 1 {
 			if e&i != 0 {
 				buf.WriteString(", " + i.String())
 			}
@@ -60,6 +60,12 @@ func (e Enablements) String() string {
 	}
 }
 
+// NewEnablements returns the address of [Enablement] as [Enablements].
+func NewEnablements(e Enablement) *Enablements { return (*Enablements)(&e) }
+
+// Enablements is the [json] adapter for [Enablement].
+type Enablements Enablement
+
 // enablementsJSON is the [json] representation of [Enablements].
 type enablementsJSON = struct {
 	Wayland  bool `json:"wayland,omitempty"`
@@ -69,21 +75,24 @@ type enablementsJSON = struct {
 	Pulse    bool `json:"pulse,omitempty"`
 }
 
-// Unwrap returns the value pointed to by e.
+// Unwrap returns the underlying [Enablement].
-func (e *Enablements) Unwrap() Enablements {
+func (e *Enablements) Unwrap() Enablement {
 	if e == nil {
 		return 0
 	}
-	return *e
+	return Enablement(*e)
 }
 
-func (e Enablements) MarshalJSON() ([]byte, error) {
+func (e *Enablements) MarshalJSON() ([]byte, error) {
+	if e == nil {
+		return nil, syscall.EINVAL
+	}
 	return json.Marshal(&enablementsJSON{
-		Wayland:  e&EWayland != 0,
+		Wayland:  Enablement(*e)&EWayland != 0,
-		X11:      e&EX11 != 0,
+		X11:      Enablement(*e)&EX11 != 0,
-		DBus:     e&EDBus != 0,
+		DBus:     Enablement(*e)&EDBus != 0,
-		PipeWire: e&EPipeWire != 0,
+		PipeWire: Enablement(*e)&EPipeWire != 0,
-		Pulse:    e&EPulse != 0,
+		Pulse:    Enablement(*e)&EPulse != 0,
 	})
 }
 
@@ -97,21 +106,22 @@ func (e *Enablements) UnmarshalJSON(data []byte) error {
 		return err
 	}
 
-	*e = 0
+	var ve Enablement
 	if v.Wayland {
-		*e |= EWayland
+		ve |= EWayland
 	}
 	if v.X11 {
-		*e |= EX11
+		ve |= EX11
 	}
 	if v.DBus {
-		*e |= EDBus
+		ve |= EDBus
 	}
 	if v.PipeWire {
-		*e |= EPipeWire
+		ve |= EPipeWire
 	}
 	if v.Pulse {
-		*e |= EPulse
+		ve |= EPulse
 	}
+	*e = Enablements(ve)
 	return nil
 }

hst/enablement_test.go

@@ -13,7 +13,7 @@ func TestEnablementString(t *testing.T) {
 	t.Parallel()
 
 	testCases := []struct {
-		flags hst.Enablements
+		flags hst.Enablement
 		want  string
 	}{
 		{0, "(no enablements)"},
@@ -59,13 +59,13 @@ func TestEnablements(t *testing.T) {
 		sData string
 	}{
 		{"nil", nil, "null", `{"value":null,"magic":3236757504}`},
-		{"zero", new(hst.Enablements(0)), `{}`, `{"value":{},"magic":3236757504}`},
+		{"zero", hst.NewEnablements(0), `{}`, `{"value":{},"magic":3236757504}`},
-		{"wayland", new(hst.EWayland), `{"wayland":true}`, `{"value":{"wayland":true},"magic":3236757504}`},
+		{"wayland", hst.NewEnablements(hst.EWayland), `{"wayland":true}`, `{"value":{"wayland":true},"magic":3236757504}`},
-		{"x11", new(hst.EX11), `{"x11":true}`, `{"value":{"x11":true},"magic":3236757504}`},
+		{"x11", hst.NewEnablements(hst.EX11), `{"x11":true}`, `{"value":{"x11":true},"magic":3236757504}`},
-		{"dbus", new(hst.EDBus), `{"dbus":true}`, `{"value":{"dbus":true},"magic":3236757504}`},
+		{"dbus", hst.NewEnablements(hst.EDBus), `{"dbus":true}`, `{"value":{"dbus":true},"magic":3236757504}`},
-		{"pipewire", new(hst.EPipeWire), `{"pipewire":true}`, `{"value":{"pipewire":true},"magic":3236757504}`},
+		{"pipewire", hst.NewEnablements(hst.EPipeWire), `{"pipewire":true}`, `{"value":{"pipewire":true},"magic":3236757504}`},
-		{"pulse", new(hst.EPulse), `{"pulse":true}`, `{"value":{"pulse":true},"magic":3236757504}`},
+		{"pulse", hst.NewEnablements(hst.EPulse), `{"pulse":true}`, `{"value":{"pulse":true},"magic":3236757504}`},
-		{"all", new(hst.EM - 1), `{"wayland":true,"x11":true,"dbus":true,"pipewire":true,"pulse":true}`, `{"value":{"wayland":true,"x11":true,"dbus":true,"pipewire":true,"pulse":true},"magic":3236757504}`},
+		{"all", hst.NewEnablements(hst.EM - 1), `{"wayland":true,"x11":true,"dbus":true,"pipewire":true,"pulse":true}`, `{"value":{"wayland":true,"x11":true,"dbus":true,"pipewire":true,"pulse":true},"magic":3236757504}`},
 	}
 
 	for _, tc := range testCases {
@@ -137,7 +137,7 @@ func TestEnablements(t *testing.T) {
 		})
 
 		t.Run("val", func(t *testing.T) {
-			if got := new(hst.EWayland | hst.EPulse).Unwrap(); got != hst.EWayland|hst.EPulse {
+			if got := hst.NewEnablements(hst.EWayland | hst.EPulse).Unwrap(); got != hst.EWayland|hst.EPulse {
 				t.Errorf("Unwrap: %v", got)
 			}
 		})
@@ -146,6 +146,9 @@ func TestEnablements(t *testing.T) {
 	t.Run("passthrough", func(t *testing.T) {
 		t.Parallel()
 
+		if _, err := (*hst.Enablements)(nil).MarshalJSON(); !errors.Is(err, syscall.EINVAL) {
+			t.Errorf("MarshalJSON: error = %v", err)
+		}
 		if err := (*hst.Enablements)(nil).UnmarshalJSON(nil); !errors.Is(err, syscall.EINVAL) {
 			t.Errorf("UnmarshalJSON: error = %v", err)
 		}

hst/hst.go

@@ -72,7 +72,7 @@ func Template() *Config {
 	return &Config{
 		ID: "org.chromium.Chromium",
 
-		Enablements: new(EWayland | EDBus | EPipeWire),
+		Enablements: NewEnablements(EWayland | EDBus | EPipeWire),
 
 		SessionBus: &BusConfig{
 			See: nil,

internal/landlock/landlock_test.go

@@ -1,65 +0,0 @@
-package landlock_test
-
-import (
-	"testing"
-	"unsafe"
-
-	"hakurei.app/internal/landlock"
-)
-
-func TestLandlockString(t *testing.T) {
-	t.Parallel()
-
-	testCases := []struct {
-		name        string
-		rulesetAttr *landlock.RulesetAttr
-		want        string
-	}{
-		{"nil", nil, "NULL"},
-		{"zero", new(landlock.RulesetAttr), "0"},
-		{"some", &landlock.RulesetAttr{Scoped: landlock.LANDLOCK_SCOPE_SIGNAL}, "scoped: signal"},
-		{"set", &landlock.RulesetAttr{
-			HandledAccessFS:  landlock.LANDLOCK_ACCESS_FS_MAKE_SYM | landlock.LANDLOCK_ACCESS_FS_IOCTL_DEV | landlock.LANDLOCK_ACCESS_FS_WRITE_FILE,
-			HandledAccessNet: landlock.LANDLOCK_ACCESS_NET_BIND_TCP,
-			Scoped:           landlock.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | landlock.LANDLOCK_SCOPE_SIGNAL,
-		}, "fs: write_file make_sym fs_ioctl_dev, net: bind_tcp, scoped: abstract_unix_socket signal"},
-		{"all", &landlock.RulesetAttr{
-			HandledAccessFS: landlock.LANDLOCK_ACCESS_FS_EXECUTE |
-				landlock.LANDLOCK_ACCESS_FS_WRITE_FILE |
-				landlock.LANDLOCK_ACCESS_FS_READ_FILE |
-				landlock.LANDLOCK_ACCESS_FS_READ_DIR |
-				landlock.LANDLOCK_ACCESS_FS_REMOVE_DIR |
-				landlock.LANDLOCK_ACCESS_FS_REMOVE_FILE |
-				landlock.LANDLOCK_ACCESS_FS_MAKE_CHAR |
-				landlock.LANDLOCK_ACCESS_FS_MAKE_DIR |
-				landlock.LANDLOCK_ACCESS_FS_MAKE_REG |
-				landlock.LANDLOCK_ACCESS_FS_MAKE_SOCK |
-				landlock.LANDLOCK_ACCESS_FS_MAKE_FIFO |
-				landlock.LANDLOCK_ACCESS_FS_MAKE_BLOCK |
-				landlock.LANDLOCK_ACCESS_FS_MAKE_SYM |
-				landlock.LANDLOCK_ACCESS_FS_REFER |
-				landlock.LANDLOCK_ACCESS_FS_TRUNCATE |
-				landlock.LANDLOCK_ACCESS_FS_IOCTL_DEV,
-			HandledAccessNet: landlock.LANDLOCK_ACCESS_NET_BIND_TCP |
-				landlock.LANDLOCK_ACCESS_NET_CONNECT_TCP,
-			Scoped: landlock.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET |
-				landlock.LANDLOCK_SCOPE_SIGNAL,
-		}, "fs: execute write_file read_file read_dir remove_dir remove_file make_char make_dir make_reg make_sock make_fifo make_block make_sym fs_refer fs_truncate fs_ioctl_dev, net: bind_tcp connect_tcp, scoped: abstract_unix_socket signal"},
-	}
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			if got := tc.rulesetAttr.String(); got != tc.want {
-				t.Errorf("String: %s, want %s", got, tc.want)
-			}
-		})
-	}
-}
-
-func TestLandlockAttrSize(t *testing.T) {
-	t.Parallel()
-	want := 24
-	if got := unsafe.Sizeof(landlock.RulesetAttr{}); got != uintptr(want) {
-		t.Errorf("Sizeof: %d, want %d", got, want)
-	}
-}

internal/outcome/finalise.go

@@ -32,14 +32,7 @@ type outcome struct {
 	syscallDispatcher
 }
 
-// finalise prepares an outcome for main.
+func (k *outcome) finalise(ctx context.Context, msg message.Msg, id *hst.ID, config *hst.Config) error {
-func (k *outcome) finalise(
-	ctx context.Context,
-	msg message.Msg,
-	id *hst.ID,
-	config *hst.Config,
-	flags int,
-) error {
 	if ctx == nil || id == nil {
 		// unreachable
 		panic("invalid call to finalise")
@@ -50,7 +43,7 @@ func (k *outcome) finalise(
 	}
 	k.ctx = ctx
 
-	if err := config.Validate(flags); err != nil {
+	if err := config.Validate(); err != nil {
 		return err
 	}
 

internal/outcome/outcome.go

@@ -194,7 +194,7 @@ type outcomeStateSys struct {
 	// Copied from [hst.Config]. Safe for read by outcomeOp.toSystem.
 	appId string
 	// Copied from [hst.Config]. Safe for read by outcomeOp.toSystem.
-	et hst.Enablements
+	et hst.Enablement
 
 	// Copied from [hst.Config]. Safe for read by spWaylandOp.toSystem only.
 	directWayland bool

internal/outcome/process.go

@@ -297,12 +297,12 @@ func (k *outcome) main(msg message.Msg, identifierFd int) {
 					// accumulate enablements of remaining instances
 					var (
 						// alive enablement bits
-						rt hst.Enablements
+						rt hst.Enablement
 						// alive instance count
 						n int
 					)
 					for eh := range entries {
-						var et hst.Enablements
+						var et hst.Enablement
 						if et, err = eh.Load(nil); err != nil {
 							perror(err, "read state header of instance "+eh.ID.String())
 						} else {

internal/outcome/run.go

@@ -18,13 +18,7 @@ import (
 func IsPollDescriptor(fd uintptr) bool
 
 // Main runs an app according to [hst.Config] and terminates. Main does not return.
-func Main(
+func Main(ctx context.Context, msg message.Msg, config *hst.Config, fd int) {
-	ctx context.Context,
-	msg message.Msg,
-	config *hst.Config,
-	flags int,
-	fd int,
-) {
 	// avoids runtime internals or standard streams
 	if fd >= 0 {
 		if IsPollDescriptor(uintptr(fd)) || fd < 3 {
@@ -40,7 +34,7 @@ func Main(
 	k := outcome{syscallDispatcher: direct{msg}}
 
 	finaliseTime := time.Now()
-	if err := k.finalise(ctx, msg, &id, config, flags); err != nil {
+	if err := k.finalise(ctx, msg, &id, config); err != nil {
 		printMessageError(msg.GetLogger().Fatalln, "cannot seal app:", err)
 		panic("unreachable")
 	}

internal/outcome/run_test.go

@@ -288,7 +288,7 @@ func TestOutcomeRun(t *testing.T) {
 				},
 				Filter: true,
 			},
-			Enablements: new(hst.EWayland | hst.EDBus | hst.EPipeWire | hst.EPulse),
+			Enablements: hst.NewEnablements(hst.EWayland | hst.EDBus | hst.EPipeWire | hst.EPulse),
 
 			Container: &hst.ContainerConfig{
 				Filesystem: []hst.FilesystemConfigJSON{
@@ -427,7 +427,7 @@ func TestOutcomeRun(t *testing.T) {
 			DirectPipeWire: true,
 
 			ID:          "org.chromium.Chromium",
-			Enablements: new(hst.EWayland | hst.EDBus | hst.EPipeWire | hst.EPulse),
+			Enablements: hst.NewEnablements(hst.EWayland | hst.EDBus | hst.EPipeWire | hst.EPulse),
 			Container: &hst.ContainerConfig{
 				Env: nil,
 				Filesystem: []hst.FilesystemConfigJSON{

internal/outcome/sppulse_test.go

@@ -21,7 +21,7 @@ func TestSpPulseOp(t *testing.T) {
 	newConfig := func() *hst.Config {
 		config := hst.Template()
 		config.DirectPulse = true
-		config.Enablements = new(hst.EPulse)
+		config.Enablements = hst.NewEnablements(hst.EPulse)
 		return config
 	}
 

internal/pkg/asm.go

@@ -0,0 +1,216 @@
+package pkg
+
+import (
+	"encoding/binary"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+)
+
+type asmOutLine struct {
+	pos       int
+	word      int
+	kindData  int64
+	valueData []byte
+	indent    int
+	kind      string
+	value     string
+}
+
+var spacingLine = asmOutLine{
+	pos:       -1,
+	kindData:  -1,
+	valueData: nil,
+	indent:    0,
+	kind:      "",
+	value:     "",
+}
+
+func Disassemble(r io.Reader, real bool, showHeader bool, force bool, raw bool) (s string, err error) {
+	var lines []asmOutLine
+	sb := new(strings.Builder)
+	header := true
+	pos := new(int)
+
+	for err == nil {
+		if header {
+			var kind uint64
+			var size uint64
+			var bsize []byte
+			p := *pos
+			if _, kind, err = nextUint64(r, pos); err != nil {
+				break
+			}
+			if bsize, size, err = nextUint64(r, pos); err != nil {
+				break
+			}
+			if showHeader {
+				lines = append(lines, asmOutLine{p, 8, int64(kind), bsize, 0, "head  " + intToKind(kind), ""})
+			}
+			for i := 0; uint64(i) < size; i++ {
+				var did Checksum
+				var dkind uint64
+				p := *pos
+				if _, dkind, err = nextUint64(r, pos); err != nil {
+					break
+				}
+				if _, did, err = nextIdent(r, pos); err != nil {
+					break
+				}
+				if showHeader {
+					lines = append(lines, asmOutLine{p, 8, int64(dkind), nil, 1, intToKind(dkind), Encode(did)})
+				}
+			}
+			header = false
+		}
+		var k uint32
+		p := *pos
+		if _, k, err = nextUint32(r, pos); err != nil {
+			break
+		}
+		kind := IRValueKind(k)
+		switch kind {
+		case IRKindEnd:
+			var a uint32
+			var ba []byte
+			if ba, a, err = nextUint32(r, pos); err != nil {
+				break
+			}
+			if a&1 != 0 {
+				var sum Checksum
+				if _, sum, err = nextIdent(r, pos); err != nil {
+					break
+				}
+				lines = append(lines, asmOutLine{p, 4, int64(kind), ba, 1, "end ", Encode(sum)})
+			} else {
+				lines = append(lines, asmOutLine{p, 4, int64(kind), []byte{0, 0, 0, 0}, 1, "end ", ""})
+			}
+			lines = append(lines, spacingLine)
+			header = true
+			continue
+
+		case IRKindIdent:
+			var a []byte
+			// discard ancillary
+			if a, _, err = nextUint32(r, pos); err != nil {
+				break
+			}
+			var sum Checksum
+			if _, sum, err = nextIdent(r, pos); err != nil {
+				break
+			}
+
+			lines = append(lines, asmOutLine{p, 4, int64(kind), a, 1, "id  ", Encode(sum)})
+			continue
+		case IRKindUint32:
+			var i uint32
+			var bi []byte
+			if bi, i, err = nextUint32(r, pos); err != nil {
+				break
+			}
+			lines = append(lines, asmOutLine{p, 4, int64(kind), bi, 1, "int ", strconv.FormatUint(uint64(i), 10)})
+		case IRKindString:
+			var l uint32
+			var bl []byte
+			if bl, l, err = nextUint32(r, pos); err != nil {
+				break
+			}
+			s := make([]byte, l+(wordSize-(l)%wordSize)%wordSize)
+			var n int
+			if n, err = r.Read(s); err != nil {
+				break
+			}
+			*pos = *pos + n
+
+			lines = append(lines, asmOutLine{p, 4, int64(kind), bl, 1, "str ", strconv.Quote(string(s[:l]))})
+			continue
+		default:
+			var bi []byte
+			if bi, _, err = nextUint32(r, pos); err != nil {
+				break
+			}
+			lines = append(lines, asmOutLine{p, 4, int64(kind), bi, 1, "????", ""})
+		}
+	}
+	if err != io.EOF {
+		return
+	}
+	err = nil
+	for _, line := range lines {
+		if raw {
+			if line.pos != -1 {
+				sb.WriteString(fmt.Sprintf("%s\t%s\n", line.kind, line.value))
+			}
+		} else {
+			if line.pos == -1 {
+				sb.WriteString("\n")
+			} else if line.word == 4 {
+				sb.WriteString(fmt.Sprintf("%06x:  %04x %04x%s          %s  %s\n", line.pos, binary.LittleEndian.AppendUint32(nil, uint32(line.kindData)), line.valueData, headerSpacing(showHeader), line.kind, line.value))
+			} else {
+				kind := binary.LittleEndian.AppendUint64(nil, uint64(line.kindData))
+				value := line.valueData
+				if len(value) == 8 {
+					sb.WriteString(fmt.Sprintf("%06x:  %04x %04x %04x %04x      %s  %s\n", line.pos, kind[:4], kind[4:], value[:4], value[4:], line.kind, line.value))
+				} else {
+					sb.WriteString(fmt.Sprintf("%06x:  %04x %04x                        %s  %s\n", line.pos, kind[:4], kind[4:], line.kind, line.value))
+				}
+
+			}
+		}
+
+	}
+	return sb.String(), err
+}
+func nextUint32(r io.Reader, pos *int) ([]byte, uint32, error) {
+	i := make([]byte, 4)
+	_, err := r.Read(i)
+	if err != nil {
+		return i, 0, err
+	}
+	p := *pos + 4
+	*pos = p
+	return i, binary.LittleEndian.Uint32(i), nil
+}
+func nextUint64(r io.Reader, pos *int) ([]byte, uint64, error) {
+	i := make([]byte, 8)
+	_, err := r.Read(i)
+	if err != nil {
+		return i, 0, err
+	}
+	p := *pos + 8
+	*pos = p
+	return i, binary.LittleEndian.Uint64(i), nil
+}
+func nextIdent(r io.Reader, pos *int) ([]byte, Checksum, error) {
+	i := make([]byte, 48)
+	if _, err := r.Read(i); err != nil {
+		return i, Checksum{}, err
+	}
+	p := *pos + 48
+	*pos = p
+	return i, Checksum(i), nil
+}
+func intToKind(i uint64) string {
+	switch Kind(i) {
+	case KindHTTPGet:
+		return "http"
+	case KindTar:
+		return "tar "
+	case KindExec:
+		return "exec"
+	case KindExecNet:
+		return "exen"
+	case KindFile:
+		return "file"
+	default:
+		return fmt.Sprintf("$%d  ", i-KindCustomOffset)
+	}
+}
+func headerSpacing(showHeader bool) string {
+	if showHeader {
+		return "              "
+	}
+
+	return ""
+}

internal/pkg/dir_test.go

@@ -64,6 +64,78 @@ func TestFlatten(t *testing.T) {
 			{Mode: fs.ModeDir | 0700, Path: "work"},
 		}, pkg.MustDecode("E4vEZKhCcL2gPZ2Tt59FS3lDng-d_2SKa2i5G_RbDfwGn6EemptFaGLPUDiOa94C"), nil},
 
+		{"sample cache file", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX": {Mode: 0400, Data: []byte{0}},
+			"checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq": {Mode: 0400, Data: []byte{0, 0, 0, 0, 0xad, 0xb, 0, 4, 0xfe, 0xfe, 0, 0, 0xfe, 0xca, 0, 0}},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
+			"identifier/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
+			"identifier/cafebabecafebabecafebabecafebabecafebabecafebabecafebabecafebabe": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
+			"identifier/deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
+
+			"work": {Mode: fs.ModeDir | 0700},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0700, Path: "."},
+
+			{Mode: fs.ModeDir | 0700, Path: "checksum"},
+			{Mode: 0400, Path: "checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq", Data: []byte{0, 0, 0, 0, 0xad, 0xb, 0, 4, 0xfe, 0xfe, 0, 0, 0xfe, 0xca, 0, 0}},
+			{Mode: 0400, Path: "checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX", Data: []byte{0}},
+
+			{Mode: fs.ModeDir | 0700, Path: "identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq", Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/cafebabecafebabecafebabecafebabecafebabecafebabecafebabecafebabe", Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef", Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX", Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
+
+			{Mode: fs.ModeDir | 0700, Path: "work"},
+		}, pkg.MustDecode("St9rlE-mGZ5gXwiv_hzQ_B8bZP-UUvSNmf4nHUZzCMOumb6hKnheZSe0dmnuc4Q2"), nil},
+
+		{"sample http get cure", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU": {Mode: 0400, Data: []byte("\x7f\xe1\x69\xa2\xdd\x63\x96\x26\x83\x79\x61\x8b\xf0\x3f\xd5\x16\x9a\x39\x3a\xdb\xcf\xb1\xbc\x8d\x33\xff\x75\xee\x62\x56\xa9\xf0\x27\xac\x13\x94\x69")},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/oM-2pUlk-mOxK1t3aMWZer69UdOQlAXiAgMrpZ1476VoOqpYVP1aGFS9_HYy-D8_": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU")},
+
+			"work": {Mode: fs.ModeDir | 0700},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0700, Path: "."},
+
+			{Mode: fs.ModeDir | 0700, Path: "checksum"},
+			{Mode: 0400, Path: "checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU", Data: []byte("\x7f\xe1\x69\xa2\xdd\x63\x96\x26\x83\x79\x61\x8b\xf0\x3f\xd5\x16\x9a\x39\x3a\xdb\xcf\xb1\xbc\x8d\x33\xff\x75\xee\x62\x56\xa9\xf0\x27\xac\x13\x94\x69")},
+
+			{Mode: fs.ModeDir | 0700, Path: "identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/oM-2pUlk-mOxK1t3aMWZer69UdOQlAXiAgMrpZ1476VoOqpYVP1aGFS9_HYy-D8_", Data: []byte("../checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU")},
+
+			{Mode: fs.ModeDir | 0700, Path: "work"},
+		}, pkg.MustDecode("L_0RFHpr9JUS4Zp14rz2dESSRvfLzpvqsLhR1-YjQt8hYlmEdVl7vI3_-v8UNPKs"), nil},
+
+		{"sample directory step simple", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0500},
+
+			"check": {Mode: 0400, Data: []byte{0, 0}},
+
+			"lib":            {Mode: fs.ModeDir | 0700},
+			"lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
+
+			"lib/pkgconfig": {Mode: fs.ModeDir | 0700},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0500, Path: "."},
+
+			{Mode: 0400, Path: "check", Data: []byte{0, 0}},
+
+			{Mode: fs.ModeDir | 0700, Path: "lib"},
+			{Mode: fs.ModeSymlink | 0777, Path: "lib/libedac.so", Data: []byte("/proc/nonexistent/libedac.so")},
+
+			{Mode: fs.ModeDir | 0700, Path: "lib/pkgconfig"},
+		}, pkg.MustDecode("qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b"), nil},
+
 		{"sample directory step garbage", fstest.MapFS{
 			".": {Mode: fs.ModeDir | 0500},
 
@@ -79,6 +151,421 @@ func TestFlatten(t *testing.T) {
 
 			{Mode: fs.ModeDir | 0500, Path: "lib/pkgconfig"},
 		}, pkg.MustDecode("CUx-3hSbTWPsbMfDhgalG4Ni_GmR9TnVX8F99tY_P5GtkYvczg9RrF5zO0jX9XYT"), nil},
+
+		{"sample directory", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b":                {Mode: fs.ModeDir | 0500},
+			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/check":          {Mode: 0400, Data: []byte{0, 0}},
+			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib":            {Mode: fs.ModeDir | 0700},
+			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib/pkgconfig":  {Mode: fs.ModeDir | 0700},
+			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
+			"identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
+
+			"work": {Mode: fs.ModeDir | 0700},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0700, Path: "."},
+
+			{Mode: fs.ModeDir | 0700, Path: "checksum"},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b"},
+			{Mode: 0400, Path: "checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/check", Data: []byte{0, 0}},
+			{Mode: fs.ModeDir | 0700, Path: "checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib"},
+			{Mode: fs.ModeSymlink | 0777, Path: "checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib/libedac.so", Data: []byte("/proc/nonexistent/libedac.so")},
+			{Mode: fs.ModeDir | 0700, Path: "checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib/pkgconfig"},
+
+			{Mode: fs.ModeDir | 0700, Path: "identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY", Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa", Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
+
+			{Mode: fs.ModeDir | 0700, Path: "work"},
+		}, pkg.MustDecode("WVpvsVqVKg9Nsh744x57h51AuWUoUR2nnh8Md-EYBQpk6ziyTuUn6PLtF2e0Eu_d"), nil},
+
+		{"sample no assume checksum", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M":       {Mode: fs.ModeDir | 0500},
+			"checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M/check": {Mode: 0400, Data: []byte{}},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/_wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M")},
+			"identifier/_wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M")},
+
+			"work": {Mode: fs.ModeDir | 0700},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0700, Path: "."},
+
+			{Mode: fs.ModeDir | 0700, Path: "checksum"},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M"},
+			{Mode: 0400, Path: "checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M/check", Data: []byte{}},
+
+			{Mode: fs.ModeDir | 0700, Path: "identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/_wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", Data: []byte("../checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/_wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", Data: []byte("../checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M")},
+
+			{Mode: fs.ModeDir | 0700, Path: "work"},
+		}, pkg.MustDecode("OC290t23aimNo2Rp2pPwan5GI2KRLRdOwYxXQMD9jw0QROgHnNXWodoWdV0hwu2w"), nil},
+
+		{"sample tar step unpack", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0500},
+
+			"checksum": {Mode: fs.ModeDir | 0500},
+			"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP":                {Mode: fs.ModeDir | 0500},
+			"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/check":          {Mode: 0400, Data: []byte{0, 0}},
+			"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib":            {Mode: fs.ModeDir | 0500},
+			"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/pkgconfig":  {Mode: fs.ModeDir | 0500},
+			"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
+
+			"identifier": {Mode: fs.ModeDir | 0500},
+			"identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
+			"identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
+
+			"work": {Mode: fs.ModeDir | 0500},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0500, Path: "."},
+
+			{Mode: fs.ModeDir | 0500, Path: "checksum"},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP"},
+			{Mode: 0400, Path: "checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/check", Data: []byte{0, 0}},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib"},
+			{Mode: fs.ModeSymlink | 0777, Path: "checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/libedac.so", Data: []byte("/proc/nonexistent/libedac.so")},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/pkgconfig"},
+
+			{Mode: fs.ModeDir | 0500, Path: "identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY", Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa", Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
+
+			{Mode: fs.ModeDir | 0500, Path: "work"},
+		}, pkg.MustDecode("cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM"), nil},
+
+		{"sample tar", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM":                                                                                          {Mode: fs.ModeDir | 0500},
+			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum":                                                                                 {Mode: fs.ModeDir | 0500},
+			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP":                {Mode: fs.ModeDir | 0500},
+			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/check":          {Mode: 0400, Data: []byte{0, 0}},
+			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib":            {Mode: fs.ModeDir | 0500},
+			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
+			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/pkgconfig":  {Mode: fs.ModeDir | 0500},
+			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/identifier":                                                                               {Mode: fs.ModeDir | 0500},
+			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY":              {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
+			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa":              {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
+			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/work":                                                                                     {Mode: fs.ModeDir | 0500},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/W5S65DEhawz_WKaok5NjUKLmnD9dNl5RPauNJjcOVcB3VM4eGhSaLGmXbL8vZpiw": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
+			"identifier/rg7F1D5hwv6o4xctjD5zDq4i5MD0mArTsUIWfhUbik8xC6Bsyt3mjXXOm3goojTz": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0700, Path: "."},
+
+			{Mode: fs.ModeDir | 0700, Path: "checksum"},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM"},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum"},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP"},
+			{Mode: 0400, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/check", Data: []byte{0, 0}},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib"},
+			{Mode: fs.ModeSymlink | 0777, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/libedac.so", Data: []byte("/proc/nonexistent/libedac.so")},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/pkgconfig"},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY", Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
+			{Mode: fs.ModeSymlink | 0777, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa", Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/work"},
+
+			{Mode: fs.ModeDir | 0700, Path: "identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/W5S65DEhawz_WKaok5NjUKLmnD9dNl5RPauNJjcOVcB3VM4eGhSaLGmXbL8vZpiw", Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/rg7F1D5hwv6o4xctjD5zDq4i5MD0mArTsUIWfhUbik8xC6Bsyt3mjXXOm3goojTz", Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
+
+			{Mode: fs.ModeDir | 0700, Path: "temp"},
+			{Mode: fs.ModeDir | 0700, Path: "work"},
+		}, pkg.MustDecode("NQTlc466JmSVLIyWklm_u8_g95jEEb98PxJU-kjwxLpfdjwMWJq0G8ze9R4Vo1Vu"), nil},
+
+		{"sample tar expand step unpack", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0500},
+
+			"libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0500, Path: "."},
+
+			{Mode: fs.ModeSymlink | 0777, Path: "libedac.so", Data: []byte("/proc/nonexistent/libedac.so")},
+		}, pkg.MustDecode("CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN"), nil},
+
+		{"sample tar expand", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN":            {Mode: fs.ModeDir | 0500},
+			"checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/W5S65DEhawz_WKaok5NjUKLmnD9dNl5RPauNJjcOVcB3VM4eGhSaLGmXbL8vZpiw": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
+			"identifier/_v1blm2h-_KA-dVaawdpLas6MjHc6rbhhFS8JWwx8iJxZGUu8EBbRrhr5AaZ9PJL": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0700, Path: "."},
+
+			{Mode: fs.ModeDir | 0700, Path: "checksum"},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN"},
+			{Mode: fs.ModeSymlink | 0777, Path: "checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN/libedac.so", Data: []byte("/proc/nonexistent/libedac.so")},
+
+			{Mode: fs.ModeDir | 0700, Path: "identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/W5S65DEhawz_WKaok5NjUKLmnD9dNl5RPauNJjcOVcB3VM4eGhSaLGmXbL8vZpiw", Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/_v1blm2h-_KA-dVaawdpLas6MjHc6rbhhFS8JWwx8iJxZGUu8EBbRrhr5AaZ9PJL", Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
+
+			{Mode: fs.ModeDir | 0700, Path: "temp"},
+			{Mode: fs.ModeDir | 0700, Path: "work"},
+		}, pkg.MustDecode("hSoSSgCYTNonX3Q8FjvjD1fBl-E-BQyA6OTXro2OadXqbST4tZ-akGXszdeqphRe"), nil},
+
+		{"testtool", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0500},
+
+			"check": {Mode: 0400, Data: []byte{0}},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0500, Path: "."},
+
+			{Mode: 0400, Path: "check", Data: []byte{0}},
+		}, pkg.MustDecode("GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9"), nil},
+
+		{"sample exec container", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9":       {Mode: fs.ModeDir | 0500},
+			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check": {Mode: 0400, Data: []byte{0}},
+			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
+			"checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb":       {Mode: 0400, Data: []byte{}},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
+			"identifier/dztPS6jRjiZtCF4_p8AzfnxGp6obkhrgFVsxdodbKWUoAEVtDz3MykepJB4kI_ks": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0700, Path: "."},
+
+			{Mode: fs.ModeDir | 0700, Path: "checksum"},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9"},
+			{Mode: 0400, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check", Data: []byte{0}},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"},
+			{Mode: 0400, Path: "checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb", Data: []byte{}},
+
+			{Mode: fs.ModeDir | 0700, Path: "identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/dztPS6jRjiZtCF4_p8AzfnxGp6obkhrgFVsxdodbKWUoAEVtDz3MykepJB4kI_ks", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			{Mode: fs.ModeDir | 0700, Path: "temp"},
+			{Mode: fs.ModeDir | 0700, Path: "work"},
+		}, pkg.MustDecode("Q5DluWQCAeohLoiGRImurwFp3vdz9IfQCoj7Fuhh73s4KQPRHpEQEnHTdNHmB8Fx"), nil},
+
+		{"testtool net", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0500},
+
+			"check": {Mode: 0400, Data: []byte("net")},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0500, Path: "."},
+
+			{Mode: 0400, Path: "check", Data: []byte("net")},
+		}, pkg.MustDecode("a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W"), nil},
+
+		{"sample exec net container", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
+			"checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb":       {Mode: 0400, Data: []byte{}},
+			"checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W":       {Mode: fs.ModeDir | 0500},
+			"checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W/check": {Mode: 0400, Data: []byte("net")},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/G8qPxD9puvvoOVV7lrT80eyDeIl3G_CCFoKw12c8mCjMdG1zF7NEPkwYpNubClK3": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W")},
+			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
+			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0700, Path: "."},
+
+			{Mode: fs.ModeDir | 0700, Path: "checksum"},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"},
+			{Mode: 0400, Path: "checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb", Data: []byte{}},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W"},
+			{Mode: 0400, Path: "checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W/check", Data: []byte("net")},
+
+			{Mode: fs.ModeDir | 0700, Path: "identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/G8qPxD9puvvoOVV7lrT80eyDeIl3G_CCFoKw12c8mCjMdG1zF7NEPkwYpNubClK3", Data: []byte("../checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			{Mode: fs.ModeDir | 0700, Path: "temp"},
+			{Mode: fs.ModeDir | 0700, Path: "work"},
+		}, pkg.MustDecode("bPYvvqxpfV7xcC1EptqyKNK1klLJgYHMDkzBcoOyK6j_Aj5hb0mXNPwTwPSK5F6Z"), nil},
+
+		{"sample exec container overlay root", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9":       {Mode: fs.ModeDir | 0500},
+			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check": {Mode: 0400, Data: []byte{0}},
+			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/RdMA-mubnrHuu3Ky1wWyxauSYCO0ZH_zCPUj3uDHqkfwv5sGcByoF_g5PjlGiClb": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0700, Path: "."},
+
+			{Mode: fs.ModeDir | 0700, Path: "checksum"},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9"},
+			{Mode: 0400, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check", Data: []byte{0}},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"},
+
+			{Mode: fs.ModeDir | 0700, Path: "identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/RdMA-mubnrHuu3Ky1wWyxauSYCO0ZH_zCPUj3uDHqkfwv5sGcByoF_g5PjlGiClb", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			{Mode: fs.ModeDir | 0700, Path: "temp"},
+			{Mode: fs.ModeDir | 0700, Path: "work"},
+		}, pkg.MustDecode("PO2DSSCa4yoSgEYRcCSZfQfwow1yRigL3Ry-hI0RDI4aGuFBha-EfXeSJnG_5_Rl"), nil},
+
+		{"sample exec container overlay work", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9":       {Mode: fs.ModeDir | 0500},
+			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check": {Mode: 0400, Data: []byte{0}},
+			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/5hlaukCirnXE4W_RSLJFOZN47Z5RiHnacXzdFp_70cLgiJUGR6cSb_HaFftkzi0-": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0700, Path: "."},
+
+			{Mode: fs.ModeDir | 0700, Path: "checksum"},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9"},
+			{Mode: 0400, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check", Data: []byte{0}},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"},
+
+			{Mode: fs.ModeDir | 0700, Path: "identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/5hlaukCirnXE4W_RSLJFOZN47Z5RiHnacXzdFp_70cLgiJUGR6cSb_HaFftkzi0-", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			{Mode: fs.ModeDir | 0700, Path: "temp"},
+			{Mode: fs.ModeDir | 0700, Path: "work"},
+		}, pkg.MustDecode("iaRt6l_Wm2n-h5UsDewZxQkCmjZjyL8r7wv32QT2kyV55-Lx09Dq4gfg9BiwPnKs"), nil},
+
+		{"sample exec container multiple layers", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9":       {Mode: fs.ModeDir | 0500},
+			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check": {Mode: 0400, Data: []byte{0}},
+			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
+			"checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb":       {Mode: 0400, Data: []byte{}},
+			"checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK":       {Mode: fs.ModeDir | 0500},
+			"checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK/check": {Mode: 0400, Data: []byte("layers")},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
+			"identifier/B-kc5iJMx8GtlCua4dz6BiJHnDAOUfPjgpbKq4e-QEn0_CZkSYs3fOA1ve06qMs2": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK")},
+			"identifier/p1t_drXr34i-jZNuxDMLaMOdL6tZvQqhavNafGynGqxOZoXAUTSn7kqNh3Ovv3DT": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0700, Path: "."},
+
+			{Mode: fs.ModeDir | 0700, Path: "checksum"},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9"},
+			{Mode: 0400, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check", Data: []byte{0}},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"},
+			{Mode: 0400, Path: "checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb", Data: []byte{}},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK"},
+			{Mode: 0400, Path: "checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK/check", Data: []byte("layers")},
+
+			{Mode: fs.ModeDir | 0700, Path: "identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/B-kc5iJMx8GtlCua4dz6BiJHnDAOUfPjgpbKq4e-QEn0_CZkSYs3fOA1ve06qMs2", Data: []byte("../checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/p1t_drXr34i-jZNuxDMLaMOdL6tZvQqhavNafGynGqxOZoXAUTSn7kqNh3Ovv3DT", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			{Mode: fs.ModeDir | 0700, Path: "temp"},
+			{Mode: fs.ModeDir | 0700, Path: "work"},
+		}, pkg.MustDecode("O2YzyR7IUGU5J2CADy0hUZ3A5NkP_Vwzs4UadEdn2oMZZVWRtH0xZGJ3HXiimTnZ"), nil},
+
+		{"sample exec container layer promotion", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9":       {Mode: fs.ModeDir | 0500},
+			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check": {Mode: 0400, Data: []byte{0}},
+			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/kvJIqZo5DKFOxC2ZQ-8_nPaQzEAz9cIm3p6guO-uLqm-xaiPu7oRkSnsu411jd_U": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			"identifier/xXTIYcXmgJWNLC91c417RRrNM9cjELwEZHpGvf8Fk_GNP5agRJp_SicD0w9aMeLJ": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0700, Path: "."},
+
+			{Mode: fs.ModeDir | 0700, Path: "checksum"},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9"},
+			{Mode: 0400, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check", Data: []byte{0}},
+			{Mode: fs.ModeDir | 0500, Path: "checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"},
+
+			{Mode: fs.ModeDir | 0700, Path: "identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/kvJIqZo5DKFOxC2ZQ-8_nPaQzEAz9cIm3p6guO-uLqm-xaiPu7oRkSnsu411jd_U", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/xXTIYcXmgJWNLC91c417RRrNM9cjELwEZHpGvf8Fk_GNP5agRJp_SicD0w9aMeLJ", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+
+			{Mode: fs.ModeDir | 0700, Path: "temp"},
+			{Mode: fs.ModeDir | 0700, Path: "work"},
+		}, pkg.MustDecode("3EaW6WibLi9gl03_UieiFPaFcPy5p4x3JPxrnLJxGaTI-bh3HU9DK9IMx7c3rrNm"), nil},
+
+		{"sample file short", fstest.MapFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX": {Mode: 0400, Data: []byte{0}},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/3376ALA7hIUm2LbzH2fDvRezgzod1eTK_G6XjyOgbM2u-6swvkFaF0BOwSl_juBi": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
+
+			"work": {Mode: fs.ModeDir | 0700},
+		}, []pkg.FlatEntry{
+			{Mode: fs.ModeDir | 0700, Path: "."},
+			{Mode: fs.ModeDir | 0700, Path: "checksum"},
+			{Mode: 0400, Path: "checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX", Data: []byte{0}},
+
+			{Mode: fs.ModeDir | 0700, Path: "identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/3376ALA7hIUm2LbzH2fDvRezgzod1eTK_G6XjyOgbM2u-6swvkFaF0BOwSl_juBi", Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
+
+			{Mode: fs.ModeDir | 0700, Path: "work"},
+		}, pkg.MustDecode("iR6H5OIsyOW4EwEgtm9rGzGF6DVtyHLySEtwnFE8bnus9VJcoCbR4JIek7Lw-vwT"), nil},
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {

internal/pkg/exec.go

@@ -9,10 +9,8 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"runtime"
 	"slices"
 	"strconv"
-	"sync"
 	"syscall"
 	"time"
 	"unique"
@@ -29,11 +27,6 @@ import (
 // AbsWork is the container pathname [TContext.GetWorkDir] is mounted on.
 var AbsWork = fhs.AbsRoot.Append("work/")
 
-// EnvJobs is the name of the environment variable holding a decimal
-// representation of the preferred job count. Its value must not affect cure
-// outcome.
-const EnvJobs = "CURE_JOBS"
-
 // ExecPath is a slice of [Artifact] and the [check.Absolute] pathname to make
 // it available at under in the container.
 type ExecPath struct {
@@ -96,32 +89,6 @@ func MustPath(pathname string, writable bool, a ...Artifact) ExecPath {
 	return ExecPath{check.MustAbs(pathname), a, writable}
 }
 
-var (
-	binfmt   map[string]container.BinfmtEntry
-	binfmtMu sync.RWMutex
-)
-
-// RegisterArch arranges for [KindExec] and [KindExecNet] to support a new
-// architecture via a binfmt_misc entry. Each architecture must be registered
-// at most once.
-func RegisterArch(arch string, e container.BinfmtEntry) {
-	if arch == "" {
-		panic(UnsupportedArchError(arch))
-	}
-
-	binfmtMu.Lock()
-	defer binfmtMu.Unlock()
-
-	if binfmt == nil {
-		binfmt = make(map[string]container.BinfmtEntry)
-	}
-
-	if _, ok := binfmt[arch]; ok {
-		panic("attempting to register " + strconv.Quote(arch) + " twice")
-	}
-	binfmt[arch] = e
-}
-
 const (
 	// ExecTimeoutDefault replaces out of range [NewExec] timeout values.
 	ExecTimeoutDefault = 15 * time.Minute
@@ -138,8 +105,6 @@ type execArtifact struct {
 	// Caller-supplied user-facing reporting name, guaranteed to be nonzero
 	// during initialisation.
 	name string
-	// Target architecture.
-	arch string
 	// Caller-supplied inner mount points.
 	paths []ExecPath
 
@@ -162,40 +127,28 @@ type execArtifact struct {
 
 var _ fmt.Stringer = new(execArtifact)
 
-// execMeasuredArtifact is like execArtifact but implements [KnownChecksum] and
+// execNetArtifact is like execArtifact but implements [KnownChecksum] and has
-// has its resulting container optionally keep the host net namespace.
+// its resulting container keep the host net namespace.
-type execMeasuredArtifact struct {
+type execNetArtifact struct {
 	checksum Checksum
 
-	// Whether to keep host net namespace.
-	hostNet bool
-
 	execArtifact
 }
 
-var _ KnownChecksum = new(execMeasuredArtifact)
+var _ KnownChecksum = new(execNetArtifact)
 
 // Checksum returns the caller-supplied checksum.
-func (a *execMeasuredArtifact) Checksum() Checksum { return a.checksum }
+func (a *execNetArtifact) Checksum() Checksum { return a.checksum }
 
-// Kind returns [KindExecNet], or [KindExec] if hostNet is false.
+// Kind returns the hardcoded [Kind] constant.
-func (a *execMeasuredArtifact) Kind() Kind {
+func (*execNetArtifact) Kind() Kind { return KindExecNet }
-	if a == nil || a.hostNet {
-		return KindExecNet
-	}
-	return KindExec
-}
 
 // Cure cures the [Artifact] in the container described by the caller. The
-// container optionally retains host networking.
+// container retains host networking.
-func (a *execMeasuredArtifact) Cure(f *FContext) error {
+func (a *execNetArtifact) Cure(f *FContext) error {
-	return a.cure(f, a.hostNet)
+	return a.cure(f, true)
 }
 
-// ErrNetChecksum is panicked by [NewExec] if host net namespace is requested
-// with a nil checksum.
-var ErrNetChecksum = errors.New("attempting to keep net namespace without checksum")
-
 // NewExec returns a new [Artifact] that executes the program path in a
 // container with specified paths bind mounted read-only in order. A private
 // instance of /proc and /dev is made available to the container.
@@ -209,7 +162,7 @@ var ErrNetChecksum = errors.New("attempting to keep net namespace without checks
 // regular or symlink.
 //
 // If checksum is non-nil, the resulting [Artifact] implements [KnownChecksum]
-// and its container optionally runs in the host net namespace.
+// and its container runs in the host net namespace.
 //
 // The container is allowed to run for the specified duration before the initial
 // process and all processes originating from it is terminated. A zero or
@@ -220,10 +173,10 @@ var ErrNetChecksum = errors.New("attempting to keep net namespace without checks
 // container and does not affect curing outcome. Because of this, it is omitted
 // from parameter data for computing identifier.
 func NewExec(
-	name, arch string,
+	name string,
 	checksum *Checksum,
 	timeout time.Duration,
-	hostNet, exclusive bool,
+	exclusive bool,
 
 	dir *check.Absolute,
 	env []string,
@@ -235,23 +188,17 @@ func NewExec(
 	if name == "" {
 		name = "exec-" + filepath.Base(pathname.String())
 	}
-	if arch == "" {
-		arch = runtime.GOARCH
-	}
 	if timeout <= 0 {
 		timeout = ExecTimeoutDefault
 	}
 	if timeout > ExecTimeoutMax {
 		timeout = ExecTimeoutMax
 	}
-	a := execArtifact{name, arch, paths, dir, env, pathname, args, timeout, exclusive}
+	a := execArtifact{name, paths, dir, env, pathname, args, timeout, exclusive}
 	if checksum == nil {
-		if hostNet {
-			panic(ErrNetChecksum)
-		}
 		return &a
 	}
-	return &execMeasuredArtifact{*checksum, hostNet, a}
+	return &execNetArtifact{*checksum, a}
 }
 
 // Kind returns the hardcoded [Kind] constant.
@@ -259,7 +206,6 @@ func (*execArtifact) Kind() Kind { return KindExec }
 
 // Params writes paths, executable pathname and args.
 func (a *execArtifact) Params(ctx *IContext) {
-	ctx.WriteString(a.arch)
 	ctx.WriteString(a.name)
 
 	ctx.WriteUint32(uint32(len(a.paths)))
@@ -306,26 +252,11 @@ func (a *execArtifact) Params(ctx *IContext) {
 	}
 }
 
-// UnsupportedArchError describes an unsupported or invalid architecture.
-type UnsupportedArchError string
-
-func (e UnsupportedArchError) Error() string {
-	if e == "" {
-		return "invalid architecture name"
-	}
-	return "unsupported architecture " + string(e)
-}
-
 // readExecArtifact interprets IR values and returns the address of execArtifact
 // or execNetArtifact.
 func readExecArtifact(r *IRReader, net bool) Artifact {
 	r.DiscardAll()
 
-	arch := r.ReadString()
-	if arch == "" {
-		panic(UnsupportedArchError(arch))
-	}
-
 	name := r.ReadString()
 
 	sz := r.ReadUint32()
@@ -376,17 +307,22 @@ func readExecArtifact(r *IRReader, net bool) Artifact {
 	exclusive := r.ReadUint32() != 0
 
 	checksum, ok := r.Finalise()
-	var checksumP *Checksum
-	if ok {
-		checksumP = new(checksum.Value())
-	}
 
-	if net && !ok {
+	var checksumP *Checksum
-		panic(ErrExpectedChecksum)
+	if net {
+		if !ok {
+			panic(ErrExpectedChecksum)
+		}
+		checksumVal := checksum.Value()
+		checksumP = &checksumVal
+	} else {
+		if ok {
+			panic(ErrUnexpectedChecksum)
+		}
 	}
 
 	return NewExec(
-		name, arch, checksumP, timeout, net, exclusive, dir, env, pathname, args, paths...,
+		name, checksumP, timeout, exclusive, dir, env, pathname, args, paths...,
 	)
 }
 
@@ -461,7 +397,7 @@ const SeccompPresets = std.PresetStrict &
 func (a *execArtifact) makeContainer(
 	ctx context.Context,
 	msg message.Msg,
-	flags, jobs int,
+	flags int,
 	hostNet bool,
 	temp, work *check.Absolute,
 	getArtifact GetArtifactFunc,
@@ -495,22 +431,10 @@ func (a *execArtifact) makeContainer(
 	if z.HostNet {
 		z.Hostname = "cure-net"
 	}
-	z.Quiet = flags&CSuppressInit != 0
 	z.Uid, z.Gid = (1<<10)-1, (1<<10)-1
-	z.Dir, z.Path, z.Args = a.dir, a.path, a.args
-	z.Env = slices.Concat(a.env, []string{EnvJobs + "=" + strconv.Itoa(jobs)})
-	z.Grow(len(a.paths) + 4)
 
-	if a.arch != runtime.GOARCH {
+	z.Dir, z.Env, z.Path, z.Args = a.dir, a.env, a.path, a.args
-		binfmtMu.RLock()
+	z.Grow(len(a.paths) + 4)
-		e, ok := binfmt[a.arch]
-		binfmtMu.RUnlock()
-		if !ok {
-			return nil, UnsupportedArchError(a.arch)
-		}
-		z.Binfmt = []container.BinfmtEntry{e}
-		z.InitAsRoot = true
-	}
 
 	for i, b := range a.paths {
 		if i == overlayWorkIndex {
@@ -598,9 +522,9 @@ func (c *Cache) EnterExec(
 	case *execArtifact:
 		e = f
 
-	case *execMeasuredArtifact:
+	case *execNetArtifact:
 		e = &f.execArtifact
-		hostNet = f.hostNet
+		hostNet = true
 
 	default:
 		return ErrNotExec
@@ -639,7 +563,6 @@ func (c *Cache) EnterExec(
 	z, err = e.makeContainer(
 		ctx, c.msg,
 		c.flags,
-		c.jobs,
 		hostNet,
 		temp, work,
 		func(a Artifact) (*check.Absolute, unique.Handle[Checksum]) {
@@ -679,7 +602,7 @@ func (a *execArtifact) cure(f *FContext, hostNet bool) (err error) {
 	msg := f.GetMessage()
 	var z *container.Container
 	if z, err = a.makeContainer(
-		ctx, msg, f.cache.flags, f.GetJobs(), hostNet,
+		ctx, msg, f.cache.flags, hostNet,
 		f.GetTempDir(), f.GetWorkDir(),
 		f.GetArtifact,
 		f.cache.Ident,
@@ -701,6 +624,12 @@ func (a *execArtifact) cure(f *FContext, hostNet bool) (err error) {
 			_ = stdout.Close()
 			return
 		}
+		defer func() {
+			if err != nil && !errors.As(err, new(*exec.ExitError)) {
+				_ = stdout.Close()
+				_ = stderr.Close()
+			}
+		}()
 
 		brStdout, brStderr := f.cache.getReader(stdout), f.cache.getReader(stderr)
 		stdoutDone, stderrDone := make(chan struct{}), make(chan struct{})
@@ -715,11 +644,6 @@ func (a *execArtifact) cure(f *FContext, hostNet bool) (err error) {
 			io.TeeReader(brStderr, status),
 		)
 		defer func() {
-			if err != nil && !errors.As(err, new(*exec.ExitError)) {
-				_ = stdout.Close()
-				_ = stderr.Close()
-			}
-
 			<-stdoutDone
 			<-stderrDone
 			f.cache.putReader(brStdout)

internal/pkg/exec_test.go

@@ -1,69 +1,44 @@
 package pkg_test
 
+//go:generate env CGO_ENABLED=0 go build -tags testtool -o testdata/testtool ./testdata
+
 import (
 	_ "embed"
 	"encoding/gob"
 	"errors"
-	"io/fs"
 	"net"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"slices"
 	"testing"
+	"unique"
 
 	"hakurei.app/check"
-	"hakurei.app/container"
 	"hakurei.app/hst"
-	"hakurei.app/internal/info"
 	"hakurei.app/internal/pkg"
 	"hakurei.app/internal/stub"
-
-	"hakurei.app/internal/pkg/internal/testtool/expected"
 )
 
 // testtoolBin is the container test tool binary made available to the
 // execArtifact for testing its curing environment.
 //
-//go:generate env CGO_ENABLED=0 go build -tags testtool -o internal/testtool ./internal/testtool
+//go:embed testdata/testtool
-//go:embed internal/testtool/testtool
 var testtoolBin []byte
 
-func init() {
-	pathname, err := filepath.Abs("internal/testtool/testtool")
-	if err != nil {
-		panic(err)
-	}
-	pkg.RegisterArch("cafe", container.BinfmtEntry{
-		Magic:       expected.Magic,
-		Interpreter: check.MustAbs(pathname),
-	})
-}
-
 func TestExec(t *testing.T) {
 	t.Parallel()
 
-	wantOffline := expectsFS{
+	wantChecksumOffline := pkg.MustDecode(
-		".": {Mode: fs.ModeDir | 0500},
+		"GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9",
-
+	)
-		"check": {Mode: 0400, Data: []byte{0}},
-	}
-	wantOfflineEncode := pkg.Encode(wantOffline.hash())
-	failingArtifact := &stubArtifact{
-		kind:   pkg.KindTar,
-		params: []byte("doomed artifact"),
-		cure: func(t *pkg.TContext) error {
-			return stub.UniqueError(0xcafe)
-		},
-	}
 
 	checkWithCache(t, []cacheTestCase{
-		{"offline", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
+		{"offline", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-offline", "", new(wantOffline.hash()), 0, false, false,
+					"exec-offline", nil, 0, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -83,38 +58,46 @@ func TestExec(t *testing.T) {
 						},
 					}),
 					pkg.MustPath("/opt", false, testtool),
-				), ignorePathname, wantOffline, nil},
+				), ignorePathname, wantChecksumOffline, nil},
 
 				{"error passthrough", pkg.NewExec(
-					"", "", nil, 0, false, true,
+					"", nil, 0, true,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1"},
 					check.MustAbs("/opt/bin/testtool"),
 					[]string{"testtool"},
 
-					pkg.MustPath("/proc/nonexistent", false, failingArtifact),
+					pkg.MustPath("/proc/nonexistent", false, &stubArtifact{
-				), nil, nil, &pkg.DependencyCureError{
+						kind:   pkg.KindTar,
+						params: []byte("doomed artifact"),
+						cure: func(t *pkg.TContext) error {
+							return stub.UniqueError(0xcafe)
+						},
+					}),
+				), nil, pkg.Checksum{}, &pkg.DependencyCureError{
 					{
-						A:   failingArtifact,
+						Ident: unique.Make(pkg.ID(pkg.MustDecode(
+							"Sowo6oZRmG6xVtUaxB6bDWZhVsqAJsIJWUp0OPKlE103cY0lodx7dem8J-qQF0Z1",
+						))),
 						Err: stub.UniqueError(0xcafe),
 					},
 				}},
 
 				{"invalid paths", pkg.NewExec(
-					"", "", nil, 0, false, false,
+					"", nil, 0, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1"},
 					check.MustAbs("/opt/bin/testtool"),
 					[]string{"testtool"},
 
 					pkg.ExecPath{},
-				), nil, nil, pkg.ErrInvalidPaths},
+				), nil, pkg.Checksum{}, pkg.ErrInvalidPaths},
 			})
 
 			// check init failure passthrough
 			var exitError *exec.ExitError
 			if _, _, err := c.Cure(pkg.NewExec(
-				"", "", nil, 0, false, false,
+				"", nil, 0, false,
 				pkg.AbsWork,
 				nil,
 				check.MustAbs("/opt/bin/testtool"),
@@ -125,37 +108,17 @@ func TestExec(t *testing.T) {
 			}
 
 			testtoolDestroy(t, base, c)
-		}, expectsFS{
+		}, pkg.MustDecode("Q5DluWQCAeohLoiGRImurwFp3vdz9IfQCoj7Fuhh73s4KQPRHpEQEnHTdNHmB8Fx")},
-			".": {Mode: fs.ModeDir | 0700},
 
-			"checksum":                                 {Mode: fs.ModeDir | 0700},
+		{"net", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
-			"checksum/" + wantOfflineEncode:            {Mode: fs.ModeDir | 0500},
-			"checksum/" + wantOfflineEncode + "/check": {Mode: 0400, Data: []byte{0}},
-			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU": {Mode: fs.ModeDir | 0500},
-			"checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb": {Mode: 0400, Data: []byte{}},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
-			"identifier/" + expected.Offline:                                              {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
-			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			"substitute": {Mode: fs.ModeDir | 0700},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}},
-
-		{"net", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
-			wantNet := expectsFS{
+			wantChecksum := pkg.MustDecode(
-				".": {Mode: fs.ModeDir | 0500},
+				"a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W",
-
+			)
-				"check": {Mode: 0400, Data: []byte("net")},
-			}
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-net", "", new(wantNet.hash()), 0, true, false,
+					"exec-net", &wantChecksum, 0, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -175,36 +138,18 @@ func TestExec(t *testing.T) {
 						},
 					}),
 					pkg.MustPath("/opt", false, testtool),
-				), ignorePathname, wantNet, nil},
+				), ignorePathname, wantChecksum, nil},
 			})
 
 			testtoolDestroy(t, base, c)
-		}, expectsFS{
+		}, pkg.MustDecode("bPYvvqxpfV7xcC1EptqyKNK1klLJgYHMDkzBcoOyK6j_Aj5hb0mXNPwTwPSK5F6Z")},
-			".": {Mode: fs.ModeDir | 0700},
 
-			"checksum": {Mode: fs.ModeDir | 0700},
+		{"overlay root", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
-			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
-			"checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb":       {Mode: 0400, Data: []byte{}},
-			"checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W":       {Mode: fs.ModeDir | 0500},
-			"checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W/check": {Mode: 0400, Data: []byte("net")},
-
-			"identifier":                 {Mode: fs.ModeDir | 0700},
-			"identifier/" + expected.Net: {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W")},
-			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
-			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			"substitute": {Mode: fs.ModeDir | 0700},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}},
-
-		{"overlay root", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-overlay-root", "", nil, 0, false, false,
+					"exec-overlay-root", nil, 0, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1", "HAKUREI_ROOT=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -218,34 +163,18 @@ func TestExec(t *testing.T) {
 						},
 					}),
 					pkg.MustPath("/opt", false, testtool),
-				), ignorePathname, wantOffline, nil},
+				), ignorePathname, wantChecksumOffline, nil},
 			})
 
 			testtoolDestroy(t, base, c)
-		}, expectsFS{
+		}, pkg.MustDecode("PO2DSSCa4yoSgEYRcCSZfQfwow1yRigL3Ry-hI0RDI4aGuFBha-EfXeSJnG_5_Rl")},
-			".": {Mode: fs.ModeDir | 0700},
 
-			"checksum":                                 {Mode: fs.ModeDir | 0700},
+		{"overlay work", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
-			"checksum/" + wantOfflineEncode:            {Mode: fs.ModeDir | 0500},
-			"checksum/" + wantOfflineEncode + "/check": {Mode: 0400, Data: []byte{0}},
-			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU": {Mode: fs.ModeDir | 0500},
-
-			"identifier":                     {Mode: fs.ModeDir | 0700},
-			"identifier/" + expected.OvlRoot: {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
-			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			"substitute": {Mode: fs.ModeDir | 0700},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}},
-
-		{"overlay work", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-overlay-work", "", nil, 0, false, false,
+					"exec-overlay-work", nil, 0, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1", "HAKUREI_ROOT=1"},
 					check.MustAbs("/work/bin/testtool"),
@@ -264,34 +193,18 @@ func TestExec(t *testing.T) {
 							return os.MkdirAll(t.GetWorkDir().String(), 0700)
 						},
 					}), pkg.Path(pkg.AbsWork, false /* ignored */, testtool),
-				), ignorePathname, wantOffline, nil},
+				), ignorePathname, wantChecksumOffline, nil},
 			})
 
 			testtoolDestroy(t, base, c)
-		}, expectsFS{
+		}, pkg.MustDecode("iaRt6l_Wm2n-h5UsDewZxQkCmjZjyL8r7wv32QT2kyV55-Lx09Dq4gfg9BiwPnKs")},
-			".": {Mode: fs.ModeDir | 0700},
 
-			"checksum":                                 {Mode: fs.ModeDir | 0700},
+		{"multiple layers", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
-			"checksum/" + wantOfflineEncode:            {Mode: fs.ModeDir | 0500},
-			"checksum/" + wantOfflineEncode + "/check": {Mode: 0400, Data: []byte{0}},
-			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU": {Mode: fs.ModeDir | 0500},
-
-			"identifier":                  {Mode: fs.ModeDir | 0700},
-			"identifier/" + expected.Work: {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
-			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			"substitute": {Mode: fs.ModeDir | 0700},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}},
-
-		{"multiple layers", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-multiple-layers", "", nil, 0, false, false,
+					"exec-multiple-layers", nil, 0, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1", "HAKUREI_ROOT=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -332,39 +245,18 @@ func TestExec(t *testing.T) {
 						},
 					}),
 					pkg.MustPath("/opt", false, testtool),
-				), ignorePathname, wantOffline, nil},
+				), ignorePathname, wantChecksumOffline, nil},
 			})
 
 			testtoolDestroy(t, base, c)
-		}, expectsFS{
+		}, pkg.MustDecode("O2YzyR7IUGU5J2CADy0hUZ3A5NkP_Vwzs4UadEdn2oMZZVWRtH0xZGJ3HXiimTnZ")},
-			".": {Mode: fs.ModeDir | 0700},
 
-			"checksum":                                 {Mode: fs.ModeDir | 0700},
+		{"overlay layer promotion", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
-			"checksum/" + wantOfflineEncode:            {Mode: fs.ModeDir | 0500},
-			"checksum/" + wantOfflineEncode + "/check": {Mode: 0400, Data: []byte{0}},
-			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
-			"checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb":       {Mode: 0400, Data: []byte{}},
-			"checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK":       {Mode: fs.ModeDir | 0500},
-			"checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK/check": {Mode: 0400, Data: []byte("layers")},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
-			"identifier/B-kc5iJMx8GtlCua4dz6BiJHnDAOUfPjgpbKq4e-QEn0_CZkSYs3fOA1ve06qMs2": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK")},
-			"identifier/" + expected.Layers:                                               {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
-			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			"substitute": {Mode: fs.ModeDir | 0700},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}},
-
-		{"overlay layer promotion", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-layer-promotion", "", nil, 0, false, true,
+					"exec-layer-promotion", nil, 0, true,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1", "HAKUREI_ROOT=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -384,93 +276,11 @@ func TestExec(t *testing.T) {
 						},
 					}),
 					pkg.MustPath("/opt", false, testtool),
-				), ignorePathname, wantOffline, nil},
+				), ignorePathname, wantChecksumOffline, nil},
 			})
 
 			testtoolDestroy(t, base, c)
-		}, expectsFS{
+		}, pkg.MustDecode("3EaW6WibLi9gl03_UieiFPaFcPy5p4x3JPxrnLJxGaTI-bh3HU9DK9IMx7c3rrNm")},
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum":                                 {Mode: fs.ModeDir | 0700},
-			"checksum/" + wantOfflineEncode:            {Mode: fs.ModeDir | 0500},
-			"checksum/" + wantOfflineEncode + "/check": {Mode: 0400, Data: []byte{0}},
-			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU": {Mode: fs.ModeDir | 0500},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/kvJIqZo5DKFOxC2ZQ-8_nPaQzEAz9cIm3p6guO-uLqm-xaiPu7oRkSnsu411jd_U": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-			"identifier/" + expected.Promote:                                              {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
-
-			"substitute": {Mode: fs.ModeDir | 0700},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}},
-
-		{"binfmt", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
-			if info.CanDegrade && os.Getenv("ROSA_SKIP_BINFMT") != "" {
-				t.Skip("binfmt_misc test explicitly skipped")
-			}
-
-			cureMany(t, c, []cureStep{
-				{"container", pkg.NewExec(
-					"exec-binfmt", "cafe", nil, 0, false, true,
-					pkg.AbsWork,
-					[]string{"HAKUREI_TEST=1", "HAKUREI_BINFMT=1"},
-					check.MustAbs("/opt/bin/sample"),
-					[]string{"sample"},
-
-					pkg.MustPath("/", true, &stubArtifact{
-						kind:   pkg.KindTar,
-						params: []byte("empty directory"),
-						cure: func(t *pkg.TContext) error {
-							return os.MkdirAll(t.GetWorkDir().String(), 0700)
-						},
-					}),
-					pkg.MustPath("/opt", false, overrideIdent{pkg.ID{0xfe, 0xff}, &stubArtifact{
-						kind: pkg.KindTar,
-						cure: func(t *pkg.TContext) error {
-							work := t.GetWorkDir()
-							if err := os.MkdirAll(
-								work.Append("bin").String(),
-								0700,
-							); err != nil {
-								return err
-							}
-
-							return os.WriteFile(t.GetWorkDir().Append(
-								"bin",
-								"sample",
-							).String(), []byte(expected.Full), 0500)
-						},
-					}}),
-				), ignorePathname, expectsFS{
-					".": {Mode: fs.ModeDir | 0500},
-
-					"check": {Mode: 0400, Data: []byte("binfmt")},
-				}, nil},
-			})
-		}, expectsFS{
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum": {Mode: fs.ModeDir | 0700},
-			"checksum/5aevg3YpDxjqQZ-pdvXK7YqgkL5JKqcoStYQxeD96kuYar6K2mRQWMHib6NQRnpV":            {Mode: fs.ModeDir | 0500},
-			"checksum/5aevg3YpDxjqQZ-pdvXK7YqgkL5JKqcoStYQxeD96kuYar6K2mRQWMHib6NQRnpV/bin":        {Mode: fs.ModeDir | 0700},
-			"checksum/5aevg3YpDxjqQZ-pdvXK7YqgkL5JKqcoStYQxeD96kuYar6K2mRQWMHib6NQRnpV/bin/sample": {Mode: 0500, Data: []byte("\xca\xfe\xba\xbe\xfd\xfd:3")},
-			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":            {Mode: fs.ModeDir | 0500},
-			"checksum/UnDo4B5KneEUY5b4vRUk_y9MWgkWuw2N8f8a2XayO686xXur-aZmX2-7n_8tKMe3":            {Mode: fs.ModeDir | 0500},
-			"checksum/UnDo4B5KneEUY5b4vRUk_y9MWgkWuw2N8f8a2XayO686xXur-aZmX2-7n_8tKMe3/check":      {Mode: 0400, Data: []byte("binfmt")},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/6VQTJ1lI5BmVuI1YFYJ8ClO3MRORvTTrcWFDcUU-l5Ga8EofxCxGlSTYN-u8dKj_": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/UnDo4B5KneEUY5b4vRUk_y9MWgkWuw2N8f8a2XayO686xXur-aZmX2-7n_8tKMe3")},
-			"identifier/_v8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/5aevg3YpDxjqQZ-pdvXK7YqgkL5JKqcoStYQxeD96kuYar6K2mRQWMHib6NQRnpV")},
-			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			"substitute": {Mode: fs.ModeDir | 0700},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}},
 	})
 }
 

internal/pkg/file_test.go

@@ -1,7 +1,6 @@
 package pkg_test
 
 import (
-	"io/fs"
 	"testing"
 
 	"hakurei.app/check"
@@ -11,27 +10,18 @@ import (
 func TestFile(t *testing.T) {
 	t.Parallel()
 
-	want := expectsFile{0}
 	checkWithCache(t, []cacheTestCase{
 		{"file", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			cureMany(t, c, []cureStep{
 				{"short", pkg.NewFile("null", []byte{0}), base.Append(
 					"identifier",
 					"3376ALA7hIUm2LbzH2fDvRezgzod1eTK_G6XjyOgbM2u-6swvkFaF0BOwSl_juBi",
-				), want, nil},
+				), pkg.MustDecode(
+					"vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX",
+				), nil},
 			})
-		}, expectsFS{
+		}, pkg.MustDecode(
-			".": {Mode: fs.ModeDir | 0700},
+			"iR6H5OIsyOW4EwEgtm9rGzGF6DVtyHLySEtwnFE8bnus9VJcoCbR4JIek7Lw-vwT",
-
+		)},
-			"checksum":                            {Mode: fs.ModeDir | 0700},
-			"checksum/" + pkg.Encode(want.hash()): {Mode: 0400, Data: []byte{0}},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/3376ALA7hIUm2LbzH2fDvRezgzod1eTK_G6XjyOgbM2u-6swvkFaF0BOwSl_juBi": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
-
-			"substitute": {Mode: fs.ModeDir | 0700},
-
-			"work": {Mode: fs.ModeDir | 0700},
-		}},
 	})
 }

internal/pkg/internal/testtool/expected/expected.go

@@ -1,9 +0,0 @@
-// Package expected contains data shared between test helper and test harness.
-package expected
-
-const (
-	// Magic are magic bytes in the binfmt test case.
-	Magic = "\xca\xfe\xba\xbe\xfd\xfd"
-	// Full is the full content of the binfmt test case executable.
-	Full = Magic + ":3"
-)

internal/pkg/internal/testtool/expected/sum_amd64.go

@@ -1,10 +0,0 @@
-package expected
-
-const (
-	Offline = "q5ktDTq0miP-VvB2blxqXQeaRXCUWgP_KbC18KNtUDtyoaI_h5mHmGuPMArVEBDs"
-	OvlRoot = "NacZGXwuRkTvcHaG08a22ujJ8qCWN0RSoFlRSR5FSt0ZcBbJ28FRvkYsHEtX7G8i"
-	Layers  = "WBJDrATtX6rIE5yAu8ePX3WmDF0Tt9kFiue0m3cRnyRoVx1my8a67fh3CAW486oP"
-	Net     = "CmYtj2sNB3LHtqiDuck_Lz3MjLLIiwyP8N4NDitQ1Icvv__LVP9p8tm-sHeQaKKp"
-	Promote = "TX3eCloaQFkV-SZIH6Jg6E5WKH--rcXY1P0jnZKmLFKWrNqnOzd4G9eIBh6i5ywN"
-	Work    = "OuNiLSC68pZhAOr1YQ4WbV1tzASA0nxLEBcK7lO7MqxDY_j8dmP_C612RTuF23Lu"
-)

internal/pkg/internal/testtool/expected/sum_arm64.go

@@ -1,10 +0,0 @@
-package expected
-
-const (
-	Offline = "WapqyoPxbWSnq07dWHt71mHaJXq99pAjJfFlELlJljSiZMhTFqqlzU1_mN86shSj"
-	OvlRoot = "V9anFOiRvjGfAeBhLl14AL8TKdWZyD0WTPYe4fS9mOBw8iW5Lmarvt6TG6MV8uWm"
-	Layers  = "tKx7JNRoSBdK_7MdzI-nwTNV2wmiPzwYdcd17oLmXKL_iLmUzUiA79qTqdrTasrv"
-	Net     = "aXyDLzBCJ9XltXZIfetEVsEkrqHfcXuD5XE_FcUnYbN3emwL55N6P8LlHzNfGnM5"
-	Promote = "3k4V16n96Lq04gjFSKmm4sFjyQ883FFBNXgTy9s_DjeTwxT3pg_iacEh8yMb_S4m"
-	Work    = "6Q49MhFWRE3Ne6MycwAotgl1GtoU5WCHqJNWG2byYZCY-zX-IxPrWiKk7bKkNzhE"
-)

internal/pkg/internal/testtool/expected/sum_riscv64.go

@@ -1,10 +0,0 @@
-package expected
-
-const (
-	Offline = "Z6yXE5gOJScL3srmnVMWgCXccDiUNZ5snSrf6RkXuU1_U0rX_kGVwsfHUgNG_awd"
-	OvlRoot = "zYXJHFRLuxvUhuisZEXgGgVvdQd6piMfp5jmtT6jdVjvC2gICXquOq-UTwlrSD5I"
-	Layers  = "_F8EDazHbcLeT0sVSQXRN_kn9IjduqJcDYgzXpsT-hpKU4EBcZ0PISN2zchpqMbm"
-	Net     = "CA_FAaSIYJgapBEHV40doxpH23PdUEy_6s1TZc7wfSPN0XYqwGpMceXXDSabGveO"
-	Promote = "_3LPrLp--4h9k4GsNNApu9hHtAafq-GUhfU6d4hJKBDKT3bz_szOsvkXxc5sK53d"
-	Work    = "FEgHeiCD_WT4wsfB-9kDH5n6cRWCEYtJmXdKZgmUUukAOoXumH_hLlosXREC-tqq"
-)

internal/pkg/ir.go

@@ -3,6 +3,7 @@ package pkg
 import (
 	"bufio"
 	"bytes"
+	"context"
 	"crypto/sha512"
 	"encoding/binary"
 	"errors"
@@ -10,7 +11,6 @@ import (
 	"io"
 	"slices"
 	"strconv"
-	"sync"
 	"syscall"
 	"unique"
 	"unsafe"
@@ -39,48 +39,22 @@ func panicToError(errP *error) {
 	}
 }
 
-// irCache implements [IRCache].
-type irCache struct {
-	// Artifact to [unique.Handle] of identifier cache.
-	artifact sync.Map
-	// Identifier free list, must not be accessed directly.
-	identPool sync.Pool
-}
-
-// zeroIRCache returns the initialised value of irCache.
-func zeroIRCache() irCache {
-	return irCache{
-		identPool: sync.Pool{New: func() any { return new(extIdent) }},
-	}
-}
-
-// IRCache provides memory management and caching primitives for IR and
-// identifier operations against [Artifact] implementations.
-//
-// The zero value is not safe for use.
-type IRCache struct{ irCache }
-
-// NewIR returns the address of a new [IRCache].
-func NewIR() *IRCache {
-	return &IRCache{zeroIRCache()}
-}
-
 // IContext is passed to [Artifact.Params] and provides methods for writing
 // values to the IR writer. It does not expose the underlying [io.Writer].
 //
 // IContext is valid until [Artifact.Params] returns.
 type IContext struct {
-	// Address of underlying irCache, should be zeroed or made unusable after
+	// Address of underlying [Cache], should be zeroed or made unusable after
 	// [Artifact.Params] returns and must not be exposed directly.
-	ic *irCache
+	cache *Cache
 	// Written to by various methods, should be zeroed after [Artifact.Params]
 	// returns and must not be exposed directly.
 	w io.Writer
-	// Optional [Artifact] to cureRes cache, replaces [IRKindIdent] with
-	// checksum values if non-nil.
-	inputs map[Artifact]cureRes
 }
 
+// Unwrap returns the underlying [context.Context].
+func (i *IContext) Unwrap() context.Context { return i.cache.ctx }
+
 // irZero is a zero IR word.
 var irZero [wordSize]byte
 
@@ -162,19 +136,11 @@ func (i *IContext) mustWrite(p []byte) {
 // WriteIdent is not defined for an [Artifact] not part of the slice returned by
 // [Artifact.Dependencies].
 func (i *IContext) WriteIdent(a Artifact) {
-	buf := i.ic.getIdentBuf()
+	buf := i.cache.getIdentBuf()
-	defer i.ic.putIdentBuf(buf)
+	defer i.cache.putIdentBuf(buf)
 
 	IRKindIdent.encodeHeader(0).put(buf[:])
-	if i.inputs != nil {
+	*(*ID)(buf[wordSize:]) = i.cache.Ident(a).Value()
-		res, ok := i.inputs[a]
-		if !ok {
-			panic(InvalidLookupError(i.ic.Ident(a).Value()))
-		}
-		*(*ID)(buf[wordSize:]) = res.checksum.Value()
-	} else {
-		*(*ID)(buf[wordSize:]) = i.ic.Ident(a).Value()
-	}
 	i.mustWrite(buf[:])
 }
 
@@ -217,45 +183,20 @@ func (i *IContext) WriteString(s string) {
 
 // Encode writes a deterministic, efficient representation of a to w and returns
 // the first non-nil error encountered while writing to w.
-func (ic *irCache) Encode(w io.Writer, a Artifact) (err error) {
+func (c *Cache) Encode(w io.Writer, a Artifact) (err error) {
-	return ic.encode(w, a, nil)
-}
-
-// encode implements Encode but replaces identifiers with their cured checksums
-// for a non-nil ident. Caller must acquire Cache.identMu.
-func (ic *irCache) encode(
-	w io.Writer,
-	a Artifact,
-	inputs map[Artifact]cureRes,
-) (err error) {
 	deps := a.Dependencies()
 	idents := make([]*extIdent, len(deps))
-	if inputs == nil {
+	for i, d := range deps {
-		for i, d := range deps {
+		dbuf, did := c.unsafeIdent(d, true)
-			dbuf, did := ic.unsafeIdent(d, true)
+		if dbuf == nil {
-			if dbuf == nil {
+			dbuf = c.getIdentBuf()
-				dbuf = ic.getIdentBuf()
-				binary.LittleEndian.PutUint64(dbuf[:], uint64(d.Kind()))
-				*(*ID)(dbuf[wordSize:]) = did.Value()
-			} else {
-				ic.storeIdent(d, dbuf)
-			}
-			defer ic.putIdentBuf(dbuf)
-			idents[i] = dbuf
-		}
-	} else {
-		for i, d := range deps {
-			res, ok := inputs[d]
-			if !ok {
-				return InvalidLookupError(ic.Ident(d).Value())
-			}
-
-			dbuf := ic.getIdentBuf()
 			binary.LittleEndian.PutUint64(dbuf[:], uint64(d.Kind()))
-			*(*ID)(dbuf[wordSize:]) = res.checksum.Value()
+			*(*ID)(dbuf[wordSize:]) = did.Value()
-			defer ic.putIdentBuf(dbuf)
+		} else {
-			idents[i] = dbuf
+			c.storeIdent(d, dbuf)
 		}
+		defer c.putIdentBuf(dbuf)
+		idents[i] = dbuf
 	}
 	slices.SortFunc(idents, func(a, b *extIdent) int {
 		return bytes.Compare(a[:], b[:])
@@ -280,10 +221,10 @@ func (ic *irCache) encode(
 	}
 
 	func() {
-		i := IContext{ic, w, inputs}
+		i := IContext{c, w}
 
 		defer panicToError(&err)
-		defer func() { i.ic, i.w = nil, nil }()
+		defer func() { i.cache, i.w = nil, nil }()
 
 		a.Params(&i)
 	}()
@@ -292,7 +233,7 @@ func (ic *irCache) encode(
 	}
 
 	var f IREndFlag
-	kcBuf := ic.getIdentBuf()
+	kcBuf := c.getIdentBuf()
 	sz := wordSize
 	if kc, ok := a.(KnownChecksum); ok {
 		f |= IREndKnownChecksum
@@ -302,13 +243,13 @@ func (ic *irCache) encode(
 	IRKindEnd.encodeHeader(uint32(f)).put(kcBuf[:])
 
 	_, err = w.Write(kcBuf[:sz])
-	ic.putIdentBuf(kcBuf)
+	c.putIdentBuf(kcBuf)
 	return
 }
 
 // encodeAll implements EncodeAll by recursively encoding dependencies and
 // performs deduplication by value via the encoded map.
-func (ic *irCache) encodeAll(
+func (c *Cache) encodeAll(
 	w io.Writer,
 	a Artifact,
 	encoded map[Artifact]struct{},
@@ -318,13 +259,13 @@ func (ic *irCache) encodeAll(
 	}
 
 	for _, d := range a.Dependencies() {
-		if err = ic.encodeAll(w, d, encoded); err != nil {
+		if err = c.encodeAll(w, d, encoded); err != nil {
 			return
 		}
 	}
 
 	encoded[a] = struct{}{}
-	return ic.Encode(w, a)
+	return c.Encode(w, a)
 }
 
 // EncodeAll writes a self-describing IR stream of a to w and returns the first
@@ -342,8 +283,8 @@ func (ic *irCache) encodeAll(
 // the ident cache, nor does it contribute identifiers it computes back to the
 // ident cache. Because of this, multiple invocations of EncodeAll will have
 // similar cost and does not amortise when combined with a call to Cure.
-func (ic *irCache) EncodeAll(w io.Writer, a Artifact) error {
+func (c *Cache) EncodeAll(w io.Writer, a Artifact) error {
-	return ic.encodeAll(w, a, make(map[Artifact]struct{}))
+	return c.encodeAll(w, a, make(map[Artifact]struct{}))
 }
 
 // ErrRemainingIR is returned for a [IRReadFunc] that failed to call
@@ -468,12 +409,6 @@ func (e InvalidKindError) Error() string {
 // register is not safe for concurrent use. register must not be called after
 // the first instance of [Cache] has been opened.
 func register(k Kind, f IRReadFunc) {
-	openMu.Lock()
-	defer openMu.Unlock()
-
-	if opened {
-		panic("attempting to register after open")
-	}
 	if _, ok := irArtifact[k]; ok {
 		panic("attempting to register " + strconv.Itoa(int(k)) + " twice")
 	}

internal/pkg/ir_test.go

@@ -3,7 +3,6 @@ package pkg_test
 import (
 	"bytes"
 	"io"
-	"io/fs"
 	"reflect"
 	"testing"
 
@@ -39,7 +38,7 @@ func TestIRRoundtrip(t *testing.T) {
 		)},
 
 		{"exec offline", pkg.NewExec(
-			"exec-offline", "", nil, 0, false, false,
+			"exec-offline", nil, 0, false,
 			pkg.AbsWork,
 			[]string{"HAKUREI_TEST=1"},
 			check.MustAbs("/opt/bin/testtool"),
@@ -59,9 +58,9 @@ func TestIRRoundtrip(t *testing.T) {
 		)},
 
 		{"exec net", pkg.NewExec(
-			"exec-net", "",
+			"exec-net",
 			(*pkg.Checksum)(bytes.Repeat([]byte{0xfc}, len(pkg.Checksum{}))),
-			0, false, false,
+			0, false,
 			pkg.AbsWork,
 			[]string{"HAKUREI_TEST=1"},
 			check.MustAbs("/opt/bin/testtool"),
@@ -80,28 +79,6 @@ func TestIRRoundtrip(t *testing.T) {
 			)),
 		)},
 
-		{"exec measured", pkg.NewExec(
-			"exec-measured", "",
-			(*pkg.Checksum)(bytes.Repeat([]byte{0xfd}, len(pkg.Checksum{}))),
-			0, false, false,
-			pkg.AbsWork,
-			[]string{"HAKUREI_TEST=1"},
-			check.MustAbs("/opt/bin/testtool"),
-			[]string{"testtool", "measured"},
-
-			pkg.MustPath("/file", false, pkg.NewFile("file", []byte(
-				"stub file",
-			))), pkg.MustPath("/.hakurei", false, pkg.NewHTTPGetTar(
-				nil, "file:///hakurei.tar",
-				pkg.Checksum(bytes.Repeat([]byte{0xfd}, len(pkg.Checksum{}))),
-				pkg.TarUncompressed,
-			)), pkg.MustPath("/opt", false, pkg.NewHTTPGetTar(
-				nil, "file:///testtool.tar.gz",
-				pkg.Checksum(bytes.Repeat([]byte{0xfd}, len(pkg.Checksum{}))),
-				pkg.TarGzip,
-			)),
-		)},
-
 		{"file anonymous", pkg.NewFile("", []byte{0})},
 		{"file", pkg.NewFile("stub", []byte("stub"))},
 	}
@@ -128,13 +105,9 @@ func TestIRRoundtrip(t *testing.T) {
 				if err := <-done; err != nil {
 					t.Fatalf("EncodeAll: error = %v", err)
 				}
-			}, expectsFS{
+			}, pkg.MustDecode(
-				".":          {Mode: fs.ModeDir | 0700},
+				"E4vEZKhCcL2gPZ2Tt59FS3lDng-d_2SKa2i5G_RbDfwGn6EemptFaGLPUDiOa94C",
-				"checksum":   {Mode: fs.ModeDir | 0700},
+			),
-				"identifier": {Mode: fs.ModeDir | 0700},
-				"substitute": {Mode: fs.ModeDir | 0700},
-				"work":       {Mode: fs.ModeDir | 0700},
-			},
 		}
 	}
 	checkWithCache(t, testCasesCache)

internal/pkg/net_test.go

@@ -3,12 +3,12 @@ package pkg_test
 import (
 	"crypto/sha512"
 	"io"
-	"io/fs"
 	"net/http"
 	"reflect"
 	"testing"
 	"testing/fstest"
 	"unique"
+	"unsafe"
 
 	"hakurei.app/check"
 	"hakurei.app/internal/pkg"
@@ -33,14 +33,20 @@ func TestHTTPGet(t *testing.T) {
 
 	checkWithCache(t, []cacheTestCase{
 		{"direct", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
-			r := newRContext(t, c)
+			var r pkg.RContext
+			rCacheVal := reflect.ValueOf(&r).Elem().FieldByName("cache")
+			reflect.NewAt(
+				rCacheVal.Type(),
+				unsafe.Pointer(rCacheVal.UnsafeAddr()),
+			).Elem().Set(reflect.ValueOf(c))
+
 			f := pkg.NewHTTPGet(
 				&client,
 				"file:///testdata",
 				testdataChecksum.Value(),
 			)
 			var got []byte
-			if rc, err := f.Cure(r); err != nil {
+			if rc, err := f.Cure(&r); err != nil {
 				t.Fatalf("Cure: error = %v", err)
 			} else if got, err = io.ReadAll(rc); err != nil {
 				t.Fatalf("ReadAll: error = %v", err)
@@ -59,7 +65,7 @@ func TestHTTPGet(t *testing.T) {
 			wantErrMismatch := &pkg.ChecksumMismatchError{
 				Got: testdataChecksum.Value(),
 			}
-			if rc, err := f.Cure(r); err != nil {
+			if rc, err := f.Cure(&r); err != nil {
 				t.Fatalf("Cure: error = %v", err)
 			} else if got, err = io.ReadAll(rc); err != nil {
 				t.Fatalf("ReadAll: error = %v", err)
@@ -70,7 +76,7 @@ func TestHTTPGet(t *testing.T) {
 			}
 
 			// check fallback validation
-			if rc, err := f.Cure(r); err != nil {
+			if rc, err := f.Cure(&r); err != nil {
 				t.Fatalf("Cure: error = %v", err)
 			} else if err = rc.Close(); !reflect.DeepEqual(err, wantErrMismatch) {
 				t.Fatalf("Close: error = %#v, want %#v", err, wantErrMismatch)
@@ -83,19 +89,18 @@ func TestHTTPGet(t *testing.T) {
 				pkg.Checksum{},
 			)
 			wantErrNotFound := pkg.ResponseStatusError(http.StatusNotFound)
-			if _, err := f.Cure(r); !reflect.DeepEqual(err, wantErrNotFound) {
+			if _, err := f.Cure(&r); !reflect.DeepEqual(err, wantErrNotFound) {
 				t.Fatalf("Cure: error = %#v, want %#v", err, wantErrNotFound)
 			}
-		}, expectsFS{
+		}, pkg.MustDecode("E4vEZKhCcL2gPZ2Tt59FS3lDng-d_2SKa2i5G_RbDfwGn6EemptFaGLPUDiOa94C")},
-			".":          {Mode: fs.ModeDir | 0700},
-			"checksum":   {Mode: fs.ModeDir | 0700},
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"substitute": {Mode: fs.ModeDir | 0700},
-			"work":       {Mode: fs.ModeDir | 0700},
-		}},
 
 		{"cure", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
-			r := newRContext(t, c)
+			var r pkg.RContext
+			rCacheVal := reflect.ValueOf(&r).Elem().FieldByName("cache")
+			reflect.NewAt(
+				rCacheVal.Type(),
+				unsafe.Pointer(rCacheVal.UnsafeAddr()),
+			).Elem().Set(reflect.ValueOf(c))
 
 			f := pkg.NewHTTPGet(
 				&client,
@@ -115,7 +120,7 @@ func TestHTTPGet(t *testing.T) {
 			}
 
 			var got []byte
-			if rc, err := f.Cure(r); err != nil {
+			if rc, err := f.Cure(&r); err != nil {
 				t.Fatalf("Cure: error = %v", err)
 			} else if got, err = io.ReadAll(rc); err != nil {
 				t.Fatalf("ReadAll: error = %v", err)
@@ -131,7 +136,7 @@ func TestHTTPGet(t *testing.T) {
 				"file:///testdata",
 				testdataChecksum.Value(),
 			)
-			if rc, err := f.Cure(r); err != nil {
+			if rc, err := f.Cure(&r); err != nil {
 				t.Fatalf("Cure: error = %v", err)
 			} else if got, err = io.ReadAll(rc); err != nil {
 				t.Fatalf("ReadAll: error = %v", err)
@@ -151,18 +156,6 @@ func TestHTTPGet(t *testing.T) {
 			if _, _, err := c.Cure(f); !reflect.DeepEqual(err, wantErrNotFound) {
 				t.Fatalf("Pathname: error = %#v, want %#v", err, wantErrNotFound)
 			}
-		}, expectsFS{
+		}, pkg.MustDecode("L_0RFHpr9JUS4Zp14rz2dESSRvfLzpvqsLhR1-YjQt8hYlmEdVl7vI3_-v8UNPKs")},
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum": {Mode: fs.ModeDir | 0700},
-			"checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU": {Mode: 0400, Data: []byte("\x7f\xe1\x69\xa2\xdd\x63\x96\x26\x83\x79\x61\x8b\xf0\x3f\xd5\x16\x9a\x39\x3a\xdb\xcf\xb1\xbc\x8d\x33\xff\x75\xee\x62\x56\xa9\xf0\x27\xac\x13\x94\x69")},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/oM-2pUlk-mOxK1t3aMWZer69UdOQlAXiAgMrpZ1476VoOqpYVP1aGFS9_HYy-D8_": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU")},
-
-			"substitute": {Mode: fs.ModeDir | 0700},
-
-			"work": {Mode: fs.ModeDir | 0700},
-		}},
 	})
 }

internal/pkg/tar.go

@@ -43,7 +43,8 @@ var _ fmt.Stringer = new(tarArtifactNamed)
 func (a *tarArtifactNamed) String() string { return a.name + "-unpack" }
 
 // NewTar returns a new [Artifact] backed by the supplied [Artifact] and
-// compression method. The source [Artifact] must be a [FileArtifact].
+// compression method. The source [Artifact] must be compatible with
+// [TContext.Open].
 func NewTar(a Artifact, compression uint32) Artifact {
 	ta := tarArtifact{a, compression}
 	if s, ok := a.(fmt.Stringer); ok {

internal/pkg/tar_test.go

@@ -20,31 +20,6 @@ import (
 func TestTar(t *testing.T) {
 	t.Parallel()
 
-	want := expectsFS{
-		".": {Mode: fs.ModeDir | 0500},
-
-		"checksum": {Mode: fs.ModeDir | 0500},
-		"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP":                {Mode: fs.ModeDir | 0500},
-		"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/check":          {Mode: 0400, Data: []byte{0, 0}},
-		"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib":            {Mode: fs.ModeDir | 0500},
-		"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/pkgconfig":  {Mode: fs.ModeDir | 0500},
-		"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
-
-		"identifier": {Mode: fs.ModeDir | 0500},
-		"identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
-		"identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
-
-		"work": {Mode: fs.ModeDir | 0500},
-	}
-	wantEncode := pkg.Encode(want.hash())
-
-	wantExpand := expectsFS{
-		".": {Mode: fs.ModeDir | 0500},
-
-		"libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
-	}
-	wantExpandEncode := pkg.Encode(wantExpand.hash())
-
 	checkWithCache(t, []cacheTestCase{
 		{"http", 0, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			checkTarHTTP(t, base, c, fstest.MapFS{
@@ -62,32 +37,10 @@ func TestTar(t *testing.T) {
 				"identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
 
 				"work": {Mode: fs.ModeDir | 0700},
-			}, want)
+			}, pkg.MustDecode(
-		}, expectsFS{
+				"cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM",
-			".": {Mode: fs.ModeDir | 0700},
+			))
-
+		}, pkg.MustDecode("NQTlc466JmSVLIyWklm_u8_g95jEEb98PxJU-kjwxLpfdjwMWJq0G8ze9R4Vo1Vu")},
-			"checksum":                             {Mode: fs.ModeDir | 0700},
-			"checksum/" + wantEncode:               {Mode: fs.ModeDir | 0500},
-			"checksum/" + wantEncode + "/checksum": {Mode: fs.ModeDir | 0500},
-			"checksum/" + wantEncode + "/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP":                {Mode: fs.ModeDir | 0500},
-			"checksum/" + wantEncode + "/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/check":          {Mode: 0400, Data: []byte{0, 0}},
-			"checksum/" + wantEncode + "/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib":            {Mode: fs.ModeDir | 0500},
-			"checksum/" + wantEncode + "/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
-			"checksum/" + wantEncode + "/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/pkgconfig":  {Mode: fs.ModeDir | 0500},
-			"checksum/" + wantEncode + "/identifier": {Mode: fs.ModeDir | 0500},
-			"checksum/" + wantEncode + "/identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
-			"checksum/" + wantEncode + "/identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
-			"checksum/" + wantEncode + "/work": {Mode: fs.ModeDir | 0500},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/W5S65DEhawz_WKaok5NjUKLmnD9dNl5RPauNJjcOVcB3VM4eGhSaLGmXbL8vZpiw": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantEncode)},
-			"identifier/rg7F1D5hwv6o4xctjD5zDq4i5MD0mArTsUIWfhUbik8xC6Bsyt3mjXXOm3goojTz": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantEncode)},
-
-			"substitute": {Mode: fs.ModeDir | 0700},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}},
 
 		{"http expand", 0, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			checkTarHTTP(t, base, c, fstest.MapFS{
@@ -95,23 +48,10 @@ func TestTar(t *testing.T) {
 
 				"lib":            {Mode: fs.ModeDir | 0700},
 				"lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
-			}, wantExpand)
+			}, pkg.MustDecode(
-		}, expectsFS{
+				"CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN",
-			".": {Mode: fs.ModeDir | 0700},
+			))
-
+		}, pkg.MustDecode("hSoSSgCYTNonX3Q8FjvjD1fBl-E-BQyA6OTXro2OadXqbST4tZ-akGXszdeqphRe")},
-			"checksum":                     {Mode: fs.ModeDir | 0700},
-			"checksum/" + wantExpandEncode: {Mode: fs.ModeDir | 0500},
-			"checksum/" + wantExpandEncode + "/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/W5S65DEhawz_WKaok5NjUKLmnD9dNl5RPauNJjcOVcB3VM4eGhSaLGmXbL8vZpiw": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantExpandEncode)},
-			"identifier/_v1blm2h-_KA-dVaawdpLas6MjHc6rbhhFS8JWwx8iJxZGUu8EBbRrhr5AaZ9PJL": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantExpandEncode)},
-
-			"substitute": {Mode: fs.ModeDir | 0700},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}},
 	})
 }
 
@@ -120,7 +60,7 @@ func checkTarHTTP(
 	base *check.Absolute,
 	c *pkg.Cache,
 	testdataFsys fs.FS,
-	want expectsKnown,
+	wantChecksum pkg.Checksum,
 ) {
 	var testdata string
 	{
@@ -254,24 +194,24 @@ func checkTarHTTP(
 		{"file", a, base.Append(
 			"identifier",
 			pkg.Encode(wantIdent),
-		), want, nil},
+		), wantChecksum, nil},
 
 		{"directory", pkg.NewTar(
 			&tarDir,
 			pkg.TarGzip,
-		), ignorePathname, want, nil},
+		), ignorePathname, wantChecksum, nil},
 
 		{"multiple entries", pkg.NewTar(
 			&tarDirMulti,
 			pkg.TarGzip,
-		), nil, nil, errors.New(
+		), nil, pkg.Checksum{}, errors.New(
 			"input directory does not contain a single regular file",
 		)},
 
 		{"bad type", pkg.NewTar(
 			&tarDirType,
 			pkg.TarGzip,
-		), nil, nil, errors.New(
+		), nil, pkg.Checksum{}, errors.New(
 			"input directory does not contain a single regular file",
 		)},
 
@@ -281,6 +221,6 @@ func checkTarHTTP(
 			cure: func(t *pkg.TContext) error {
 				return stub.UniqueError(0xcafe)
 			},
-		}, pkg.TarGzip), nil, nil, stub.UniqueError(0xcafe)},
+		}, pkg.TarGzip), nil, pkg.Checksum{}, stub.UniqueError(0xcafe)},
 	})
 }

internal/pkg/testdata/main.go

@@ -9,38 +9,18 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
-	"runtime"
 	"slices"
-	"strconv"
 	"strings"
 
+	"hakurei.app/check"
 	"hakurei.app/fhs"
 	"hakurei.app/vfs"
-
-	"hakurei.app/internal/pkg/internal/testtool/expected"
 )
 
 func main() {
 	log.SetFlags(0)
 	log.SetPrefix("testtool: ")
 
-	if os.Getenv("HAKUREI_BINFMT") == "1" {
-		wantArgs := []string{"/interpreter", "/opt/bin/sample"}
-		if !slices.Equal(os.Args, wantArgs) {
-			log.Fatalf("Args: %q, want %q", os.Args, wantArgs)
-		}
-
-		if err := os.WriteFile("check", []byte("binfmt"), 0400); err != nil {
-			log.Fatal(err)
-		}
-
-		return
-	}
-
-	environ := slices.DeleteFunc(slices.Clone(os.Environ()), func(s string) bool {
-		return s == "CURE_JOBS="+strconv.Itoa(runtime.NumCPU())
-	})
-
 	var hostNet, layers, promote bool
 	if len(os.Args) == 2 && os.Args[0] == "testtool" {
 		switch os.Args[1] {
@@ -68,15 +48,15 @@ func main() {
 
 	var overlayRoot bool
 	wantEnv := []string{"HAKUREI_TEST=1"}
-	if len(environ) == 2 {
+	if len(os.Environ()) == 2 {
 		overlayRoot = true
 		if !layers && !promote {
 			log.SetPrefix("testtool(overlay root): ")
 		}
 		wantEnv = []string{"HAKUREI_TEST=1", "HAKUREI_ROOT=1"}
 	}
-	if !slices.Equal(wantEnv, environ) {
+	if !slices.Equal(wantEnv, os.Environ()) {
-		log.Fatalf("Environ: %q, want %q", environ, wantEnv)
+		log.Fatalf("Environ: %q, want %q", os.Environ(), wantEnv)
 	}
 
 	var overlayWork bool
@@ -162,40 +142,59 @@ func main() {
 	}
 
 	const checksumEmptyDir = "MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"
-	ident := expected.Offline
+	ident := "dztPS6jRjiZtCF4_p8AzfnxGp6obkhrgFVsxdodbKWUoAEVtDz3MykepJB4kI_ks"
 	log.Println(m)
 	next := func() { m = m.Next; log.Println(m) }
 
 	if overlayRoot {
-		ident = expected.OvlRoot
+		ident = "RdMA-mubnrHuu3Ky1wWyxauSYCO0ZH_zCPUj3uDHqkfwv5sGcByoF_g5PjlGiClb"
 
 		if m.Root != "/" || m.Target != "/" ||
 			m.Source != "overlay" || m.FsType != "overlay" {
 			log.Fatal("unexpected root mount entry")
 		}
-		var lowerdir []string
+		var lowerdir string
 		for _, o := range strings.Split(m.FsOptstr, ",") {
-			const lowerdirKey = "lowerdir+="
+			const lowerdirKey = "lowerdir="
 			if strings.HasPrefix(o, lowerdirKey) {
-				lowerdir = append(lowerdir, o[len(lowerdirKey):])
+				lowerdir = o[len(lowerdirKey):]
 			}
 		}
 		if !layers {
-			if len(lowerdir) != 1 || filepath.Base(lowerdir[0]) != checksumEmptyDir {
+			if filepath.Base(lowerdir) != checksumEmptyDir {
 				log.Fatal("unexpected artifact checksum")
 			}
 		} else {
-			ident = expected.Layers
+			ident = "p1t_drXr34i-jZNuxDMLaMOdL6tZvQqhavNafGynGqxOZoXAUTSn7kqNh3Ovv3DT"
 
-			if len(lowerdir) != 2 ||
+			lowerdirsEscaped := strings.Split(lowerdir, ":")
-				filepath.Base(lowerdir[0]) != "MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU" ||
+			lowerdirs := lowerdirsEscaped[:0]
-				filepath.Base(lowerdir[1]) != "nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK" {
+			// ignore the option separator since it does not appear in ident
-				log.Fatalf("unexpected lowerdirs %s", strings.Join(lowerdir, ", "))
+			for i, e := range lowerdirsEscaped {
+				if len(e) > 0 &&
+					e[len(e)-1] == check.SpecialOverlayEscape[0] &&
+					(len(e) == 1 || e[len(e)-2] != check.SpecialOverlayEscape[0]) {
+					// ignore escaped pathname separator since it does not
+					// appear in ident
+
+					e = e[:len(e)-1]
+					if len(lowerdirsEscaped) != i {
+						lowerdirsEscaped[i+1] = e + lowerdirsEscaped[i+1]
+						continue
+					}
+				}
+				lowerdirs = append(lowerdirs, e)
+			}
+
+			if len(lowerdirs) != 2 ||
+				filepath.Base(lowerdirs[0]) != "MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU" ||
+				filepath.Base(lowerdirs[1]) != "nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK" {
+				log.Fatalf("unexpected lowerdirs %s", strings.Join(lowerdirs, ", "))
 			}
 		}
 	} else {
 		if hostNet {
-			ident = expected.Net
+			ident = "G8qPxD9puvvoOVV7lrT80eyDeIl3G_CCFoKw12c8mCjMdG1zF7NEPkwYpNubClK3"
 		}
 
 		if m.Root != "/sysroot" || m.Target != "/" {
@@ -214,14 +213,14 @@ func main() {
 	}
 
 	if promote {
-		ident = expected.Promote
+		ident = "xXTIYcXmgJWNLC91c417RRrNM9cjELwEZHpGvf8Fk_GNP5agRJp_SicD0w9aMeLJ"
 	}
 
 	next() // testtool artifact
 
 	next()
 	if overlayWork {
-		ident = expected.Work
+		ident = "5hlaukCirnXE4W_RSLJFOZN47Z5RiHnacXzdFp_70cLgiJUGR6cSb_HaFftkzi0-"
 		if m.Root != "/" || m.Target != "/work" ||
 			m.Source != "overlay" || m.FsType != "overlay" {
 			log.Fatal("unexpected work mount entry")

internal/rosa/acl.go

@@ -7,10 +7,10 @@ func (t Toolchain) newAttr() (pkg.Artifact, string) {
 		version  = "2.5.2"
 		checksum = "YWEphrz6vg1sUMmHHVr1CRo53pFXRhq_pjN-AlG8UgwZK1y6m7zuDhxqJhD0SV0l"
 	)
-	return t.NewPackage("attr", version, newTar(
+	return t.NewPackage("attr", version, pkg.NewHTTPGetTar(
-		"https://download.savannah.nongnu.org/releases/attr/"+
+		nil, "https://download.savannah.nongnu.org/releases/attr/"+
 			"attr-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		Patches: []KV{
@@ -81,10 +81,10 @@ func (t Toolchain) newACL() (pkg.Artifact, string) {
 		version  = "2.3.2"
 		checksum = "-fY5nwH4K8ZHBCRXrzLdguPkqjKI6WIiGu4dBtrZ1o0t6AIU73w8wwJz_UyjIS0P"
 	)
-	return t.NewPackage("acl", version, newTar(
+	return t.NewPackage("acl", version, pkg.NewHTTPGetTar(
-		"https://download.savannah.nongnu.org/releases/acl/"+
+		nil, "https://download.savannah.nongnu.org/releases/acl/"+
 			"acl-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), nil, &MakeHelper{
 		// makes assumptions about uid_map/gid_map

internal/rosa/all.go

@@ -6,7 +6,6 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
-	"runtime"
 	"strconv"
 	"sync"
 
@@ -17,7 +16,9 @@ import (
 type PArtifact int
 
 const (
-	LLVM PArtifact = iota
+	LLVMCompilerRT PArtifact = iota
+	LLVMRuntimes
+	LLVMClang
 
 	// EarlyInit is the Rosa OS init program.
 	EarlyInit
@@ -63,7 +64,6 @@ const (
 	GenInitCPIO
 	Gettext
 	Git
-	Glslang
 	GnuTLS
 	Go
 	Gperf
@@ -71,43 +71,27 @@ const (
 	Gzip
 	Hakurei
 	HakureiDist
-	Hwdata
 	IPTables
 	Kmod
-	LIT
-	LibX11
 	LibXau
-	LibXext
-	LibXrandr
-	LibXrender
-	LibXxf86vm
-	Libarchive
 	Libbsd
 	Libcap
-	Libconfig
-	LibdisplayInfo
-	Libdrm
 	Libev
 	Libexpat
 	Libffi
 	Libgd
-	Libglvnd
 	Libiconv
 	Libmd
 	Libmnl
 	Libnftnl
-	Libpciaccess
-	Libpng
 	Libpsl
 	Libseccomp
 	Libtasn1
 	Libtool
 	Libucontext
 	Libunistring
-	Libxshmfence
 	Libxml2
 	Libxslt
-	Libxtrans
 	M4
 	MPC
 	MPFR
@@ -135,36 +119,22 @@ const (
 	PerlTermReadKey
 	PerlTextCharWidth
 	PerlTextWrapI18N
-	PerlUnicodeLineBreak
+	PerlUnicodeGCString
 	PerlYAMLTiny
 	PkgConfig
 	Procps
 	Python
-	PythonFlitCore
-	PythonHatchling
 	PythonIniConfig
-	PythonMako
-	PythonMarkupSafe
 	PythonPackaging
-	PythonPathspec
 	PythonPluggy
 	PythonPyTest
-	PythonPyYAML
-	PythonPycparser
 	PythonPygments
-	PythonSetuptools
-	PythonSetuptoolsSCM
-	PythonTroveClassifiers
-	PythonVCSVersioning
-	PythonWheel
 	QEMU
 	Rdfind
 	Readline
 	Rsync
 	Sed
-	SPIRVHeaders
+	Setuptools
-	SPIRVLLVMTranslator
-	SPIRVTools
 	SquashfsTools
 	Strace
 	TamaGo
@@ -174,42 +144,23 @@ const (
 	toyboxEarly
 	Unzip
 	UtilLinux
-	VIM
 	Wayland
 	WaylandProtocols
 	XCB
 	XCBProto
-	XCBUtilKeysyms
+	Xproto
-	XDGDBusProxy
 	XZ
-	XorgProto
 	Zlib
 	Zstd
 
 	// PresetUnexportedStart is the first unexported preset.
 	PresetUnexportedStart
 
-	stage0Dist = iota - 1
+	buildcatrust = iota - 1
-	llvmSource
-	// earlyCompilerRT is an early, standalone compiler-rt installation for the
-	// standalone runtimes build.
-	//
-	// earlyCompilerRT must only be loaded by [LLVM].
-	earlyCompilerRT
-	// earlyRuntimes is an early, standalone installation of LLVM runtimes to
-	// work around the cmake build system leaking the system LLVM installation
-	// when invoking the newly built toolchain.
-	//
-	// earlyRuntimes must only be loaded by [LLVM].
-	earlyRuntimes
-
-	buildcatrust
 	utilMacros
 
 	// Musl is a standalone libc that does not depend on the toolchain.
 	Musl
-	// muslHeaders is a system installation of [Musl] headers.
-	muslHeaders
 
 	// gcc is a hacked-to-pieces GCC toolchain meant for use in intermediate
 	// stages only. This preset and its direct output must never be exposed.
@@ -354,40 +305,15 @@ var (
 	}
 	// artifactsOnce is for lazy initialisation of artifacts.
 	artifactsOnce [_toolchainEnd][len(artifactsM)]sync.Once
-
-	// arch is the target architecture.
-	arch = runtime.GOARCH
-
-	// presetOpts globally modifies behaviour of presets.
-	presetOpts int
 )
 
-const (
-	// OptSkipCheck skips running all test suites.
-	OptSkipCheck = 1 << iota
-	// OptLLVMNoLTO disables LTO in all [LLVM] stages.
-	OptLLVMNoLTO
-)
-
-// Arch returns the target architecture.
-func Arch() string { return arch }
-
-// Flags returns the current preset flags
-func Flags() int { return presetOpts }
-
 // zero zeros the value pointed to by p.
 func zero[T any](p *T) { var v T; *p = v }
 
 // DropCaches arranges for all cached [pkg.Artifact] to be freed some time after
 // it returns. Must not be used concurrently with any other function from this
 // package.
-func DropCaches(targetArch string, flags int) {
+func DropCaches() {
-	if targetArch == "" {
-		targetArch = runtime.GOARCH
-	}
-
-	arch = targetArch
-	presetOpts = flags
 	zero(&artifacts)
 	zero(&artifactsOnce)
 }

internal/rosa/all_test.go

@@ -20,16 +20,13 @@ func TestLoad(t *testing.T) {
 }
 
 func BenchmarkAll(b *testing.B) {
-	arch, flags := rosa.Arch(), rosa.Flags()
-	b.Cleanup(func() { rosa.DropCaches(arch, flags) })
-
 	for b.Loop() {
 		for i := range rosa.PresetEnd {
 			rosa.Std.Load(rosa.PArtifact(i))
 		}
 
 		b.StopTimer()
-		rosa.DropCaches("", 0)
+		rosa.DropCaches()
 		b.StartTimer()
 	}
 }

internal/rosa/argp-standalone.go

@@ -7,10 +7,10 @@ func (t Toolchain) newArgpStandalone() (pkg.Artifact, string) {
 		version  = "1.3"
 		checksum = "vtW0VyO2pJ-hPyYmDI2zwSLS8QL0sPAUKC1t3zNYbwN2TmsaE-fADhaVtNd3eNFl"
 	)
-	return t.NewPackage("argp-standalone", version, newTar(
+	return t.NewPackage("argp-standalone", version, pkg.NewHTTPGetTar(
-		"http://www.lysator.liu.se/~nisse/misc/"+
+		nil, "http://www.lysator.liu.se/~nisse/misc/"+
 			"argp-standalone-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		Env: []string{

internal/rosa/busybox.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"net/http"
 	"os"
+	"runtime"
 	"time"
 
 	"hakurei.app/fhs"
@@ -87,7 +88,7 @@ func (a busyboxBin) Cure(t *pkg.TContext) (err error) {
 // the https://busybox.net/downloads/binaries/ binary release.
 func newBusyboxBin() pkg.Artifact {
 	var version, url, checksum string
-	switch arch {
+	switch runtime.GOARCH {
 	case "amd64":
 		version = "1.35.0"
 		url = "https://busybox.net/downloads/binaries/" +
@@ -100,11 +101,11 @@ func newBusyboxBin() pkg.Artifact {
 		checksum = "npJjBO7iwhjW6Kx2aXeSxf8kXhVgTCDChOZTTsI8ZfFfa3tbsklxRiidZQdrVERg"
 
 	default:
-		panic("unsupported target " + arch)
+		panic("unsupported target " + runtime.GOARCH)
 	}
 
 	return pkg.NewExec(
-		"busybox-bin-"+version, arch, nil, pkg.ExecTimeoutMax, false, false,
+		"busybox-bin-"+version, nil, pkg.ExecTimeoutMax, false,
 		fhs.AbsRoot, []string{
 			"PATH=/system/bin",
 		},

internal/rosa/bzip2.go

@@ -7,9 +7,9 @@ func (t Toolchain) newBzip2() (pkg.Artifact, string) {
 		version  = "1.0.8"
 		checksum = "cTLykcco7boom-s05H1JVsQi1AtChYL84nXkg_92Dm1Xt94Ob_qlMg_-NSguIK-c"
 	)
-	return t.NewPackage("bzip2", version, newTar(
+	return t.NewPackage("bzip2", version, pkg.NewHTTPGetTar(
-		"https://sourceware.org/pub/bzip2/bzip2-"+version+".tar.gz",
+		nil, "https://sourceware.org/pub/bzip2/bzip2-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable:    true,

internal/rosa/cmake.go

@@ -10,14 +10,13 @@ import (
 
 func (t Toolchain) newCMake() (pkg.Artifact, string) {
 	const (
-		version  = "4.3.2"
+		version  = "4.3.1"
-		checksum = "6QylwRVKletndTSkZTV2YBRwgd_9rUVgav_QW23HpjUgV21AVYZOUOal8tdBDmO7"
+		checksum = "RHpzZiM1kJ5bwLjo9CpXSeHJJg3hTtV9QxBYpQoYwKFtRh5YhGWpShrqZCSOzQN6"
 	)
-	return t.NewPackage("cmake", version, newFromGitHubRelease(
+	return t.NewPackage("cmake", version, pkg.NewHTTPGetTar(
-		"Kitware/CMake",
+		nil, "https://github.com/Kitware/CMake/releases/download/"+
-		"v"+version,
+			"v"+version+"/cmake-"+version+".tar.gz",
-		"cmake-"+version+".tar.gz",
+		mustDecode(checksum),
-		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		// test suite expects writable source tree
@@ -91,7 +90,7 @@ index 2ead810437..f85cbb8b1c 100644
 		ConfigureName: "/usr/src/cmake/bootstrap",
 		Configure: []KV{
 			{"prefix", "/system"},
-			{"parallel", jobsE},
+			{"parallel", `"$(nproc)"`},
 			{"--"},
 			{"-DCMAKE_USE_OPENSSL", "OFF"},
 			{"-DCMake_TEST_NO_NETWORK", "ON"},
@@ -119,27 +118,31 @@ func init() {
 
 // CMakeHelper is the [CMake] build system helper.
 type CMakeHelper struct {
+	// Joined with name with a dash if non-empty.
+	Variant string
+
 	// Path elements joined with source.
 	Append []string
 
-	// Value of CMAKE_BUILD_TYPE. The zero value is equivalent to "Release".
-	BuildType string
 	// CMake CACHE entries.
 	Cache []KV
 	// Runs after install.
 	Script string
 
-	// Replaces the default test command.
-	Test string
-	// Whether to skip running tests.
-	SkipTest bool
-
 	// Whether to generate Makefile instead.
 	Make bool
 }
 
 var _ Helper = new(CMakeHelper)
 
+// name returns its arguments and an optional variant string joined with '-'.
+func (attr *CMakeHelper) name(name, version string) string {
+	if attr != nil && attr.Variant != "" {
+		name += "-" + attr.Variant
+	}
+	return name + "-" + version
+}
+
 // extra returns a hardcoded slice of [CMake] and [Ninja].
 func (attr *CMakeHelper) extra(int) P {
 	if attr != nil && attr.Make {
@@ -166,30 +169,22 @@ func (*CMakeHelper) wantsDir() string { return "/cure/" }
 // script generates the cure script.
 func (attr *CMakeHelper) script(name string) string {
 	if attr == nil {
-		attr = new(CMakeHelper)
+		attr = &CMakeHelper{
+			Cache: []KV{
+				{"CMAKE_BUILD_TYPE", "Release"},
+			},
+		}
+	}
+	if len(attr.Cache) == 0 {
+		panic("CACHE must be non-empty")
 	}
 
 	generate := "Ninja"
-	test := "ninja " + jobsFlagE + " test"
+	jobs := ""
 	if attr.Make {
 		generate = "'Unix Makefiles'"
-		test = "make " + jobsFlagE + " test"
+		jobs += ` "--parallel=$(nproc)"`
 	}
-	if attr.Test != "" {
-		test = attr.Test
-	}
-
-	script := attr.Script
-	if !attr.SkipTest && presetOpts&OptSkipCheck == 0 {
-		script += "\n" + test
-	}
-
-	cache := make([]KV, 1, 1+len(attr.Cache))
-	cache[0] = KV{"CMAKE_BUILD_TYPE", "Release"}
-	if attr.BuildType != "" {
-		cache[0][1] = attr.BuildType
-	}
-	cache = append(cache, attr.Cache...)
 
 	return `
 cmake -G ` + generate + ` \
@@ -198,7 +193,7 @@ cmake -G ` + generate + ` \
 	-DCMAKE_ASM_COMPILER_TARGET="${ROSA_TRIPLE}" \
 	-DCMAKE_INSTALL_LIBDIR=lib \
 	` + strings.Join(slices.Collect(func(yield func(string) bool) {
-		for _, v := range cache {
+		for _, v := range attr.Cache {
 			if !yield("-D" + v[0] + "=" + v[1]) {
 				return
 			}
@@ -206,7 +201,7 @@ cmake -G ` + generate + ` \
 	}), " \\\n\t") + ` \
 	-DCMAKE_INSTALL_PREFIX=/system \
 	'/usr/src/` + name + `/` + filepath.Join(attr.Append...) + `'
-cmake --build . --parallel=` + jobsE + `
+cmake --build .` + jobs + `
 cmake --install . --prefix=/work/system
-` + script
+` + attr.Script
 }

internal/rosa/connman.go

@@ -7,10 +7,10 @@ func (t Toolchain) newConnman() (pkg.Artifact, string) {
 		version  = "2.0"
 		checksum = "MhVTdJOhndnZn2SWd8URKo_Pj7Zvc14tntEbrVOf9L3yVWJvpb3v3Q6104tWJgtW"
 	)
-	return t.NewPackage("connman", version, newTar(
+	return t.NewPackage("connman", version, pkg.NewHTTPGetTar(
-		"https://git.kernel.org/pub/scm/network/connman/connman.git/"+
+		nil, "https://git.kernel.org/pub/scm/network/connman/connman.git/"+
 			"snapshot/connman-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		Patches: []KV{

internal/rosa/curl.go

@@ -4,18 +4,18 @@ import "hakurei.app/internal/pkg"
 
 func (t Toolchain) newCurl() (pkg.Artifact, string) {
 	const (
-		version  = "8.20.0"
+		version  = "8.19.0"
-		checksum = "xyHXwrngIRGMasuzhn-I5MSCOhktwINbsWt1f_LuR-5jRVvyx_g6U1EQfDLEbr9r"
+		checksum = "YHuVLVVp8q_Y7-JWpID5ReNjq2Zk6t7ArHB6ngQXilp_R5l3cubdxu3UKo-xDByv"
 	)
-	return t.NewPackage("curl", version, newTar(
+	return t.NewPackage("curl", version, pkg.NewHTTPGetTar(
-		"https://curl.se/download/curl-"+version+".tar.bz2",
+		nil, "https://curl.se/download/curl-"+version+".tar.bz2",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarBzip2,
 	), &PackageAttr{
 		// remove broken test
 		Writable: true,
 		ScriptEarly: `
-chmod +w tests/data && rm -f tests/data/test459
+chmod +w tests/data && rm tests/data/test459
 `,
 	}, &MakeHelper{
 		Configure: []KV{
@@ -25,7 +25,7 @@ chmod +w tests/data && rm -f tests/data/test459
 			{"disable-smb"},
 		},
 		Check: []string{
-			"TFLAGS=" + jobsLFlagE,
+			`TFLAGS="-j$(expr "$(nproc)" '*' 2)"`,
 			"test-nonflaky",
 		},
 	},

internal/rosa/dbus.go

@@ -7,11 +7,11 @@ func (t Toolchain) newDBus() (pkg.Artifact, string) {
 		version  = "1.16.2"
 		checksum = "INwOuNdrDG7XW5ilW_vn8JSxEa444rRNc5ho97i84I1CNF09OmcFcV-gzbF4uCyg"
 	)
-	return t.NewPackage("dbus", version, newFromGitLab(
+	return t.NewPackage("dbus", version, pkg.NewHTTPGetTar(
-		"gitlab.freedesktop.org",
+		nil, "https://gitlab.freedesktop.org/dbus/dbus/-/archive/"+
-		"dbus/dbus",
+			"dbus-"+version+"/dbus-dbus-"+version+".tar.bz2",
-		"dbus-"+version,
+		mustDecode(checksum),
-		checksum,
+		pkg.TarBzip2,
 	), &PackageAttr{
 		// OSError: [Errno 30] Read-only file system: '/usr/src/dbus/subprojects/packagecache'
 		Writable: true,
@@ -44,38 +44,3 @@ func init() {
 		ID: 5356,
 	}
 }
-
-func (t Toolchain) newXDGDBusProxy() (pkg.Artifact, string) {
-	const (
-		version  = "0.1.7"
-		checksum = "UW5Pe-TP-XAaN-kTbxrkOQ7eYdmlAQlr2pdreLtPT0uwdAz-7rzDP8V_8PWuZBup"
-	)
-	return t.NewPackage("xdg-dbus-proxy", version, newFromGitHub(
-		"flatpak/xdg-dbus-proxy",
-		version,
-		checksum,
-	), nil, &MesonHelper{
-		Setup: []KV{
-			{"Dman", "disabled"},
-		},
-	},
-		DBus,
-
-		GLib,
-	), version
-}
-func init() {
-	artifactsM[XDGDBusProxy] = Metadata{
-		f: Toolchain.newXDGDBusProxy,
-
-		Name:        "xdg-dbus-proxy",
-		Description: "a filtering proxy for D-Bus connections",
-		Website:     "https://github.com/flatpak/xdg-dbus-proxy",
-
-		Dependencies: P{
-			GLib,
-		},
-
-		ID: 58434,
-	}
-}

internal/rosa/dtc.go

@@ -7,10 +7,10 @@ func (t Toolchain) newDTC() (pkg.Artifact, string) {
 		version  = "1.7.2"
 		checksum = "vUoiRynPyYRexTpS6USweT5p4SVHvvVJs8uqFkkVD-YnFjwf6v3elQ0-Etrh00Dt"
 	)
-	return t.NewPackage("dtc", version, newTar(
+	return t.NewPackage("dtc", version, pkg.NewHTTPGetTar(
-		"https://git.kernel.org/pub/scm/utils/dtc/dtc.git/snapshot/"+
+		nil, "https://git.kernel.org/pub/scm/utils/dtc/dtc.git/snapshot/"+
 			"dtc-v"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		// works around buggy test:

internal/rosa/elfutils.go

@@ -4,13 +4,13 @@ import "hakurei.app/internal/pkg"
 
 func (t Toolchain) newElfutils() (pkg.Artifact, string) {
 	const (
-		version  = "0.195"
+		version  = "0.194"
-		checksum = "JrGnBD38w8Mj0ZxDw3fKlRBFcLvRKu8rcYnX35R9yTlUSYnzTazyLboG-a2CsJlu"
+		checksum = "Q3XUygUPv9vR1TkWucwUsQ8Kb1_F6gzk-KMPELr3cC_4AcTrprhVPMvN0CKkiYRa"
 	)
-	return t.NewPackage("elfutils", version, newTar(
+	return t.NewPackage("elfutils", version, pkg.NewHTTPGetTar(
-		"https://sourceware.org/elfutils/ftp/"+
+		nil, "https://sourceware.org/elfutils/ftp/"+
 			version+"/elfutils-"+version+".tar.bz2",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarBzip2,
 	), &PackageAttr{
 		Env: []string{

internal/rosa/etc.go

@@ -135,11 +135,10 @@ func newIANAEtc() pkg.Artifact {
 		version  = "20251215"
 		checksum = "kvKz0gW_rGG5QaNK9ZWmWu1IEgYAdmhj_wR7DYrh3axDfIql_clGRHmelP7525NJ"
 	)
-	return newFromGitHubRelease(
+	return pkg.NewHTTPGetTar(
-		"Mic92/iana-etc",
+		nil, "https://github.com/Mic92/iana-etc/releases/download/"+
-		version,
+			version+"/iana-etc-"+version+".tar.gz",
-		"iana-etc-"+version+".tar.gz",
+		mustDecode(checksum),
-		checksum,
 		pkg.TarGzip,
 	)
 }

internal/rosa/fakeroot.go

@@ -7,11 +7,11 @@ func (t Toolchain) newFakeroot() (pkg.Artifact, string) {
 		version  = "1.37.2"
 		checksum = "4ve-eDqVspzQ6VWDhPS0NjW3aSenBJcPAJq_BFT7OOFgUdrQzoTBxZWipDAGWxF8"
 	)
-	return t.NewPackage("fakeroot", version, newFromGitLab(
+	return t.NewPackage("fakeroot", version, pkg.NewHTTPGetTar(
-		"salsa.debian.org",
+		nil, "https://salsa.debian.org/clint/fakeroot/-/archive/upstream/"+
-		"clint/fakeroot",
+			version+"/fakeroot-upstream-"+version+".tar.bz2",
-		"upstream/"+version,
+		mustDecode(checksum),
-		checksum,
+		pkg.TarBzip2,
 	), &PackageAttr{
 		Patches: []KV{
 			{"remove-broken-docs", `diff --git a/doc/Makefile.am b/doc/Makefile.am

internal/rosa/flex.go

@@ -9,11 +9,10 @@ func (t Toolchain) newFlex() (pkg.Artifact, string) {
 		version  = "2.6.4"
 		checksum = "p9POjQU7VhgOf3x5iFro8fjhy0NOanvA7CTeuWS_veSNgCixIJshTrWVkc5XLZkB"
 	)
-	return t.NewPackage("flex", version, newFromGitHubRelease(
+	return t.NewPackage("flex", version, pkg.NewHTTPGetTar(
-		"westes/flex",
+		nil, "https://github.com/westes/flex/releases/download/"+
-		"v"+version,
+			"v"+version+"/flex-"+version+".tar.gz",
-		"flex-"+version+".tar.gz",
+		mustDecode(checksum),
-		checksum,
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil),
 		M4,

internal/rosa/fuse.go

@@ -7,11 +7,10 @@ func (t Toolchain) newFuse() (pkg.Artifact, string) {
 		version  = "3.18.2"
 		checksum = "iL-7b7eUtmlVSf5cSq0dzow3UiqSjBmzV3cI_ENPs1tXcHdktkG45j1V12h-4jZe"
 	)
-	return t.NewPackage("fuse", version, newFromGitHubRelease(
+	return t.NewPackage("fuse", version, pkg.NewHTTPGetTar(
-		"libfuse/libfuse",
+		nil, "https://github.com/libfuse/libfuse/releases/download/"+
-		"fuse-"+version,
+			"fuse-"+version+"/fuse-"+version+".tar.gz",
-		"fuse-"+version+".tar.gz",
+		mustDecode(checksum),
-		checksum,
 		pkg.TarGzip,
 	), nil, &MesonHelper{
 		Setup: []KV{

internal/rosa/git.go

@@ -9,20 +9,17 @@ import (
 
 func (t Toolchain) newGit() (pkg.Artifact, string) {
 	const (
-		version  = "2.54.0"
+		version  = "2.53.0"
-		checksum = "7vGKtFOJGqY8DO4e8UMRax7dLgImXKQz5MMalec6MlgYrsarffSJjgOughwRFpSH"
+		checksum = "rlqSTeNgSeVKJA7nvzGqddFH8q3eFEPB4qRZft-4zth8wTHnbTbm7J90kp_obHGm"
 	)
-	return t.NewPackage("git", version, newTar(
+	return t.NewPackage("git", version, pkg.NewHTTPGetTar(
-		"https://www.kernel.org/pub/software/scm/git/"+
+		nil, "https://www.kernel.org/pub/software/scm/git/"+
 			"git-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		ScriptEarly: `
 ln -s ../../system/bin/perl /usr/bin/ || true
-
-# test suite assumes apache
-rm -f /system/bin/httpd
 `,
 
 		// uses source tree as scratch space
@@ -41,7 +38,6 @@ function disable_test {
 	fi
 }
 
-disable_test t1800-hook
 disable_test t5319-multi-pack-index
 disable_test t1305-config-include
 disable_test t3900-i18n-commit
@@ -55,13 +51,6 @@ disable_test t9300-fast-import
 disable_test t0211-trace2-perf
 disable_test t1517-outside-repo
 disable_test t2200-add-update
-disable_test t0027-auto-crlf
-disable_test t7513-interpret-trailers
-disable_test t7703-repack-geometric
-disable_test t7002-mv-sparse-checkout
-disable_test t1451-fsck-buffer
-disable_test t4104-apply-boundary
-disable_test t4200-rerere
 `,
 		Check: []string{
 			"-C t",
@@ -69,14 +58,11 @@ disable_test t4200-rerere
 			"prove",
 		},
 		Install: `make \
-	` + jobsFlagE + ` \
+	"-j$(nproc)" \
 	DESTDIR=/work \
 	NO_INSTALL_HARDLINKS=1 \
 	install`,
 	},
-		// test suite hangs on mksh
-		Bash,
-
 		Diffutils,
 		Autoconf,
 		Gettext,
@@ -112,7 +98,7 @@ func (t Toolchain) NewViaGit(
 	return t.New(strings.TrimSuffix(
 		path.Base(url),
 		".git",
-	)+"-src-"+path.Base(rev), THostNet, t.AppendPresets(nil,
+	)+"-src-"+path.Base(rev), 0, t.AppendPresets(nil,
 		NSSCACert,
 		Git,
 	), &checksum, nil, `
@@ -128,8 +114,3 @@ git \
 rm -rf /work/.git
 `, resolvconf())
 }
-
-// newTagRemote is a helper around NewViaGit for a tag on a git remote.
-func (t Toolchain) newTagRemote(url, tag, checksum string) pkg.Artifact {
-	return t.NewViaGit(url, "refs/tags/"+tag, mustDecode(checksum))
-}

internal/rosa/glslang.go

@@ -1,239 +0,0 @@
-package rosa
-
-import (
-	"slices"
-	"strings"
-
-	"hakurei.app/internal/pkg"
-)
-
-func (t Toolchain) newSPIRVHeaders() (pkg.Artifact, string) {
-	const (
-		version  = "1.4.341.0"
-		checksum = "0PL43-19Iaw4k7_D8J8BvoJ-iLgCVSYZ2ThgDPGfAJwIJFtre7l0cnQtLjcY-JvD"
-	)
-	return t.NewPackage("spirv-headers", version, newFromGitHub(
-		"KhronosGroup/SPIRV-Headers",
-		"vulkan-sdk-"+version,
-		checksum,
-	), nil, &CMakeHelper{
-		// upstream has no tests
-		SkipTest: true,
-	}), version
-}
-func init() {
-	artifactsM[SPIRVHeaders] = Metadata{
-		f: Toolchain.newSPIRVHeaders,
-
-		Name:        "spirv-headers",
-		Description: "machine-readable files for the SPIR-V Registry",
-		Website:     "https://github.com/KhronosGroup/SPIRV-Headers",
-
-		ID: 230542,
-
-		// upstream changed version scheme, anitya incapable of filtering them
-		latest: func(v *Versions) string {
-			for _, s := range v.Stable {
-				fields := strings.SplitN(s, ".", 4)
-				if len(fields) != 4 {
-					continue
-				}
-				if slices.ContainsFunc(fields, func(f string) bool {
-					return slices.ContainsFunc([]byte(f), func(d byte) bool {
-						return d < '0' || d > '9'
-					})
-				}) {
-					continue
-				}
-				return s
-			}
-			return v.Latest
-		},
-	}
-}
-
-func (t Toolchain) newSPIRVTools() (pkg.Artifact, string) {
-	const (
-		version  = "2026.1"
-		checksum = "ZSQPQx8NltCDzQLk4qlaVxyWRWeI_JtsjEpeFt3kezTanl9DTHfLixSUCezMFBjv"
-	)
-	return t.NewPackage("spirv-tools", version, newFromGitHub(
-		"KhronosGroup/SPIRV-Tools",
-		"v"+version,
-		checksum,
-	), nil, &CMakeHelper{
-		Cache: []KV{
-			{"SPIRV-Headers_SOURCE_DIR", "/system"},
-		},
-	},
-		Python,
-
-		SPIRVHeaders,
-	), version
-}
-func init() {
-	artifactsM[SPIRVTools] = Metadata{
-		f: Toolchain.newSPIRVTools,
-
-		Name:        "spirv-tools",
-		Description: "an API and commands for processing SPIR-V modules",
-		Website:     "https://github.com/KhronosGroup/SPIRV-Tools",
-
-		Dependencies: P{
-			SPIRVHeaders,
-		},
-
-		ID: 14894,
-
-		latest: (*Versions).getStable,
-	}
-}
-
-func (t Toolchain) newGlslang() (pkg.Artifact, string) {
-	const (
-		version  = "16.3.0"
-		checksum = "xyqDf8k3-D0_BXHGi0uLgMglnJ05Rf3j73QgbDs3sGtKNdBIQhY8JfqX1NcNoJQN"
-	)
-	return t.NewPackage("glslang", version, newFromGitHub(
-		"KhronosGroup/glslang",
-		version,
-		checksum,
-	), &PackageAttr{
-		// test suite writes to source
-		Writable: true,
-		Chmod:    true,
-	}, &CMakeHelper{
-		Cache: []KV{
-			{"BUILD_SHARED_LIBS", "ON"},
-			{"ALLOW_EXTERNAL_SPIRV_TOOLS", "ON"},
-		},
-	},
-		Python,
-		Bash,
-		Diffutils,
-
-		SPIRVTools,
-	), version
-}
-func init() {
-	artifactsM[Glslang] = Metadata{
-		f: Toolchain.newGlslang,
-
-		Name:        "glslang",
-		Description: "reference front end for GLSL/ESSL",
-		Website:     "https://github.com/KhronosGroup/glslang",
-
-		ID: 205796,
-	}
-}
-
-func (t Toolchain) newSPIRVLLVMTranslator() (pkg.Artifact, string) {
-	const (
-		version  = "22.1.2"
-		checksum = "JZAaV5ewYcm-35YA_U2BM2IcsQouZtX1BLZR0zh2vSlfEXMsT5OCtY4Gh5RJkcGy"
-	)
-	skipChecks := []string{
-		// error: line 13: OpTypeCooperativeMatrixKHR Scope is limited to Workgroup and Subgroup
-		"cooperative_matrix_constant_null.spvasm",
-	}
-
-	switch arch {
-	case "arm64":
-		skipChecks = append(skipChecks,
-			// LLVM ERROR: unsupported calling convention
-			"DebugInfo/COFF/no-cus.ll",
-			"DebugInfo/Generic/2009-11-05-DeadGlobalVariable.ll",
-			"DebugInfo/Generic/2009-11-10-CurrentFn.ll",
-			"DebugInfo/Generic/2010-01-05-DbgScope.ll",
-			"DebugInfo/Generic/2010-03-12-llc-crash.ll",
-			"DebugInfo/Generic/2010-03-24-MemberFn.ll",
-			"DebugInfo/Generic/2010-04-19-FramePtr.ll",
-			"DebugInfo/Generic/2010-06-29-InlinedFnLocalVar.ll",
-			"DebugInfo/Generic/2010-10-01-crash.ll",
-			"DebugInfo/Generic/PR20038.ll",
-			"DebugInfo/Generic/constant-pointers.ll",
-			"DebugInfo/Generic/dead-argument-order.ll",
-			"DebugInfo/Generic/debug-info-eis-option.ll",
-			"DebugInfo/Generic/def-line.ll",
-			"DebugInfo/Generic/discriminator.ll",
-			"DebugInfo/Generic/dwarf-public-names.ll",
-			"DebugInfo/Generic/enum.ll",
-			"DebugInfo/Generic/func-using-decl.ll",
-			"DebugInfo/Generic/global.ll",
-			"DebugInfo/Generic/imported-name-inlined.ll",
-			"DebugInfo/Generic/incorrect-variable-debugloc1.ll",
-			"DebugInfo/Generic/inline-scopes.ll",
-			"DebugInfo/Generic/inlined-arguments.ll",
-			"DebugInfo/Generic/inlined-vars.ll",
-			"DebugInfo/Generic/linear-dbg-value.ll",
-			"DebugInfo/Generic/linkage-name-abstract.ll",
-			"DebugInfo/Generic/member-order.ll",
-			"DebugInfo/Generic/missing-abstract-variable.ll",
-			"DebugInfo/Generic/multiline.ll",
-			"DebugInfo/Generic/namespace_function_definition.ll",
-			"DebugInfo/Generic/namespace_inline_function_definition.ll",
-			"DebugInfo/Generic/noscopes.ll",
-			"DebugInfo/Generic/ptrsize.ll",
-			"DebugInfo/Generic/restrict.ll",
-			"DebugInfo/Generic/two-cus-from-same-file.ll",
-			"DebugInfo/Generic/version.ll",
-			"DebugInfo/LocalAddressSpace.ll",
-			"DebugInfo/UnknownBaseType.ll",
-			"DebugInfo/expr-opcode.ll",
-		)
-	}
-
-	return t.NewPackage("spirv-llvm-translator", version, newFromGitHub(
-		"KhronosGroup/SPIRV-LLVM-Translator",
-		"v"+version, checksum,
-	), &PackageAttr{
-		Patches: []KV{
-			{"remove-early-prefix", `diff --git a/CMakeLists.txt b/CMakeLists.txt
-index c000a77e..86f79b03 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -172,5 +172,5 @@ install(
-   FILES
-     ${CMAKE_BINARY_DIR}/LLVMSPIRVLib.pc
-   DESTINATION
--    ${CMAKE_INSTALL_PREFIX}/lib${LLVM_LIBDIR_SUFFIX}/pkgconfig
-+    lib${LLVM_LIBDIR_SUFFIX}/pkgconfig
- )
-`},
-		},
-
-		// litArgs emits shell syntax
-		ScriptEarly: `
-export LIT_OPTS=` + litArgs(true, skipChecks...) + `
-`,
-	}, &CMakeHelper{
-		Cache: []KV{
-			{"CMAKE_SKIP_BUILD_RPATH", "ON"},
-			{"BUILD_SHARED_LIBS", "ON"},
-			{"LLVM_SPIRV_ENABLE_LIBSPIRV_DIS", "ON"},
-			{"LLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR", "/system"},
-			{"LLVM_EXTERNAL_LIT", "/system/bin/lit"},
-			{"LLVM_INCLUDE_TESTS", "ON"},
-		},
-	},
-		Bash,
-		LIT,
-
-		SPIRVTools,
-	), version
-}
-func init() {
-	artifactsM[SPIRVLLVMTranslator] = Metadata{
-		f: Toolchain.newSPIRVLLVMTranslator,
-
-		Name:        "spirv-llvm-translator",
-		Description: "bi-directional translation between SPIR-V and LLVM IR",
-		Website:     "https://github.com/KhronosGroup/SPIRV-LLVM-Translator",
-
-		Dependencies: P{
-			SPIRVTools,
-		},
-
-		ID: 227273,
-	}
-}

internal/rosa/gnu.go

@@ -1,55 +1,19 @@
 package rosa
 
 import (
-	"slices"
+	"runtime"
-	"strconv"
-	"strings"
 
 	"hakurei.app/internal/pkg"
 )
 
-// skipGNUTests generates a string for skipping specific tests by number in a
-// GNU test suite. This is nontrivial because the test suite does not support
-// excluding tests in any way, so ranges for all but the skipped tests have to
-// be specified instead.
-//
-// For example, to skip test 764, ranges around the skipped test must be
-// specified:
-//
-//	1-763 765-
-//
-// Tests are numbered starting from 1. The resulting string is unquoted.
-func skipGNUTests(tests ...int) string {
-	tests = slices.Clone(tests)
-	slices.Sort(tests)
-
-	var buf strings.Builder
-
-	if tests[0] != 1 {
-		buf.WriteString("1-")
-	}
-
-	for i, n := range tests {
-		if n != 1 && (i == 0 || tests[i-1] != n-1) {
-			buf.WriteString(strconv.Itoa(n - 1))
-			buf.WriteString(" ")
-		}
-		if i == len(tests)-1 || tests[i+1] != n+1 {
-			buf.WriteString(strconv.Itoa(n + 1))
-			buf.WriteString("-")
-		}
-	}
-	return buf.String()
-}
-
 func (t Toolchain) newM4() (pkg.Artifact, string) {
 	const (
 		version  = "1.4.21"
 		checksum = "pPa6YOo722Jw80l1OsH1tnUaklnPFjFT-bxGw5iAVrZTm1P8FQaWao_NXop46-pm"
 	)
-	return t.NewPackage("m4", version, newTar(
+	return t.NewPackage("m4", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/m4/m4-"+version+".tar.bz2",
+		nil, "https://ftpmirror.gnu.org/gnu/m4/m4-"+version+".tar.bz2",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarBzip2,
 	), &PackageAttr{
 		Writable: true,
@@ -79,19 +43,11 @@ func (t Toolchain) newBison() (pkg.Artifact, string) {
 		version  = "3.8.2"
 		checksum = "BhRM6K7URj1LNOkIDCFDctSErLS-Xo5d9ba9seg10o6ACrgC1uNhED7CQPgIY29Y"
 	)
-	return t.NewPackage("bison", version, newTar(
+	return t.NewPackage("bison", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/bison/bison-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/bison/bison-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
-	), nil, &MakeHelper{
+	), nil, (*MakeHelper)(nil),
-		Check: []string{
-			"TESTSUITEFLAGS=" + jobsFlagE + "' " + skipGNUTests(
-				// clang miscompiles (SIGILL)
-				764,
-			) + "'",
-			"check",
-		},
-	},
 		M4,
 		Diffutils,
 		Sed,
@@ -111,17 +67,15 @@ func init() {
 
 func (t Toolchain) newSed() (pkg.Artifact, string) {
 	const (
-		version  = "4.10"
+		version  = "4.9"
-		checksum = "TXTRFQJCyflb-bpBRI2S5Y1DpplwvT7-KfXtpqN4AdZgZ5OtI6yStn1-bkhDKx51"
+		checksum = "pe7HWH4PHNYrazOTlUoE1fXmhn2GOPFN_xE62i0llOr3kYGrH1g2_orDz0UtZ9Nt"
 	)
-	return t.NewPackage("sed", version, newTar(
+	return t.NewPackage("sed", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/sed/sed-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/sed/sed-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil),
 		Diffutils,
-
-		KernelHeaders,
 	), version
 }
 func init() {
@@ -141,15 +95,15 @@ func (t Toolchain) newAutoconf() (pkg.Artifact, string) {
 		version  = "2.73"
 		checksum = "yGabDTeOfaCUB0JX-h3REYLYzMzvpDwFmFFzHNR7QilChCUNE4hR6q7nma4viDYg"
 	)
-	return t.NewPackage("autoconf", version, newTar(
+	return t.NewPackage("autoconf", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/autoconf/autoconf-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/autoconf/autoconf-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		Flag: TExclusive,
 	}, &MakeHelper{
 		Check: []string{
-			"TESTSUITEFLAGS=" + jobsFlagE,
+			`TESTSUITEFLAGS="-j$(nproc)"`,
 			"check",
 		},
 	},
@@ -181,9 +135,9 @@ func (t Toolchain) newAutomake() (pkg.Artifact, string) {
 		version  = "1.18.1"
 		checksum = "FjvLG_GdQP7cThTZJLDMxYpRcKdpAVG-YDs1Fj1yaHlSdh_Kx6nRGN14E0r_BjcG"
 	)
-	return t.NewPackage("automake", version, newTar(
+	return t.NewPackage("automake", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/automake/automake-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/automake/automake-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable: true,
@@ -225,16 +179,13 @@ func (t Toolchain) newLibtool() (pkg.Artifact, string) {
 		version  = "2.5.4"
 		checksum = "pa6LSrQggh8mSJHQfwGjysAApmZlGJt8wif2cCLzqAAa2jpsTY0jZ-6stS3BWZ2Q"
 	)
-	return t.NewPackage("libtool", version, newTar(
+	return t.NewPackage("libtool", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/libtool/libtool-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/libtool/libtool-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), nil, &MakeHelper{
-		// _Z2a2c: symbol not found
-		SkipCheck: t.isStage0(),
-
 		Check: []string{
-			"TESTSUITEFLAGS=" + jobsFlagE,
+			`TESTSUITEFLAGS="-j$(nproc)"`,
 			"check",
 		},
 	},
@@ -259,9 +210,9 @@ func (t Toolchain) newGzip() (pkg.Artifact, string) {
 		version  = "1.14"
 		checksum = "NWhjUavnNfTDFkZJyAUonL9aCOak8GVajWX2OMlzpFnuI0ErpBFyj88mz2xSjz0q"
 	)
-	return t.NewPackage("gzip", version, newTar(
+	return t.NewPackage("gzip", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/gzip/gzip-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/gzip/gzip-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), nil, &MakeHelper{
 		// dependency loop
@@ -285,9 +236,9 @@ func (t Toolchain) newGettext() (pkg.Artifact, string) {
 		version  = "1.0"
 		checksum = "3MasKeEdPeFEgWgzsBKk7JqWqql1wEMbgPmzAfs-mluyokoW0N8oQVxPQoOnSdgC"
 	)
-	return t.NewPackage("gettext", version, newTar(
+	return t.NewPackage("gettext", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/gettext/gettext-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/gettext/gettext-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable: true,
@@ -331,9 +282,9 @@ func (t Toolchain) newDiffutils() (pkg.Artifact, string) {
 		version  = "3.12"
 		checksum = "9J5VAq5oA7eqwzS1Yvw-l3G5o-TccUrNQR3PvyB_lgdryOFAfxtvQfKfhdpquE44"
 	)
-	return t.NewPackage("diffutils", version, newTar(
+	return t.NewPackage("diffutils", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/diffutils/diffutils-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/diffutils/diffutils-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable: true,
@@ -364,9 +315,9 @@ func (t Toolchain) newPatch() (pkg.Artifact, string) {
 		version  = "2.8"
 		checksum = "MA0BQc662i8QYBD-DdGgyyfTwaeALZ1K0yusV9rAmNiIsQdX-69YC4t9JEGXZkeR"
 	)
-	return t.NewPackage("patch", version, newTar(
+	return t.NewPackage("patch", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/patch/patch-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/patch/patch-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable: true,
@@ -396,9 +347,9 @@ func (t Toolchain) newBash() (pkg.Artifact, string) {
 		version  = "5.3"
 		checksum = "4LQ_GRoB_ko-Ih8QPf_xRKA02xAm_TOxQgcJLmFDT6udUPxTAWrsj-ZNeuTusyDq"
 	)
-	return t.NewPackage("bash", version, newTar(
+	return t.NewPackage("bash", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/bash/bash-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/bash/bash-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		Flag: TEarly,
@@ -423,12 +374,12 @@ func init() {
 
 func (t Toolchain) newCoreutils() (pkg.Artifact, string) {
 	const (
-		version  = "9.11"
+		version  = "9.10"
-		checksum = "t8UMed5wpFEoC56aa42_yidfOAaRGzOfj7MRtQkkqgGbpXiskNA8bd-EmVSQkZie"
+		checksum = "o-B9wssRnZySzJUI1ZJAgw-bZtj1RC67R9po2AcM2OjjS8FQIl16IRHpC6IwO30i"
 	)
-	return t.NewPackage("coreutils", version, newTar(
+	return t.NewPackage("coreutils", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/coreutils/coreutils-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/coreutils/coreutils-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable: true,
@@ -436,13 +387,106 @@ func (t Toolchain) newCoreutils() (pkg.Artifact, string) {
 test_disable() { chmod +w "$2" && echo "$1" > "$2"; }
 
 test_disable '#!/bin/sh' gnulib-tests/test-c32ispunct.sh
+test_disable '#!/bin/sh' tests/split/line-bytes.sh
 test_disable '#!/bin/sh' tests/ls/hyperlink.sh
-test_disable '#!/bin/sh' tests/misc/user.sh
 test_disable 'int main(){return 0;}' gnulib-tests/test-chown.c
 test_disable 'int main(){return 0;}' gnulib-tests/test-fchownat.c
 test_disable 'int main(){return 0;}' gnulib-tests/test-lchown.c
 `,
 
+		Patches: []KV{
+			{"tests-fix-job-control", `From 21d287324aa43aa3a31f39619ade0deac7fd6013 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?P=C3=A1draig=20Brady?= <P@draigBrady.com>
+Date: Tue, 24 Feb 2026 15:44:41 +0000
+Subject: [PATCH] tests: fix job control triggering test termination
+
+This avoids the test harness being terminated like:
+  make[1]: *** [Makefile:24419: check-recursive] Hangup
+  make[3]: *** [Makefile:24668: check-TESTS] Hangup
+  make: *** [Makefile:24922: check] Hangup
+  make[2]: *** [Makefile:24920: check-am] Hangup
+  make[4]: *** [Makefile:24685: tests/misc/usage_vs_refs.log] Error 129
+  ...
+
+This happened sometimes when the tests were being run non interactively.
+For example when run like:
+
+  setsid make TESTS="tests/timeout/timeout.sh \
+   tests/tail/overlay-headers.sh" SUBDIRS=. -j2 check
+
+Note the race window can be made bigger by adding a sleep
+after tail is stopped in overlay-headers.sh
+
+The race can trigger the kernel to induce its job control
+mechanism to prevent stuck processes.
+I.e. where it sends SIGHUP + SIGCONT to a process group
+when it determines that group may become orphaned,
+and there are stopped processes in that group.
+
+* tests/tail/overlay-headers.sh: Use setsid(1) to keep the stopped
+tail process in a separate process group, thus avoiding any kernel
+job control protection mechanism.
+* tests/timeout/timeout.sh: Use setsid(1) to avoid the kernel
+checking the main process group when sleep(1) is reparented.
+Fixes https://bugs.gnu.org/80477
+---
+ tests/tail/overlay-headers.sh |  8 +++++++-
+ tests/timeout/timeout.sh      | 11 ++++++++---
+ 2 files changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/tests/tail/overlay-headers.sh b/tests/tail/overlay-headers.sh
+index be9b6a7df..1e6da0a3f 100755
+--- a/tests/tail/overlay-headers.sh
++++ b/tests/tail/overlay-headers.sh
+@@ -20,6 +20,8 @@
+ . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
+ print_ver_ tail sleep
+ 
++setsid true || skip_ 'setsid required to control groups'
++
+ # Function to count number of lines from tail
+ # while ignoring transient errors due to resource limits
+ countlines_ ()
+@@ -54,7 +56,11 @@ echo start > file2 || framework_failure_
+ env sleep 60 & sleep=$!
+ 
+ # Note don't use timeout(1) here as it currently
+-# does not propagate SIGCONT
++# does not propagate SIGCONT.
++# Note use setsid here to ensure we're in a separate process group
++# as we're going to STOP this tail process, and this can trigger
++# the kernel to send SIGHUP to a group if other tests have
++# processes that are reparented. (See tests/timeout/timeout.sh).
+ tail $fastpoll --pid=$sleep -f file1 file2 > out & pid=$!
+ 
+ # Ensure tail is running
+diff --git a/tests/timeout/timeout.sh b/tests/timeout/timeout.sh
+index 9a395416b..fbb043312 100755
+--- a/tests/timeout/timeout.sh
++++ b/tests/timeout/timeout.sh
+@@ -56,9 +56,14 @@ returns_ 124 timeout --foreground -s0 -k1 .1 sleep 10 && fail=1
+ ) || fail=1
+ 
+ # Don't be confused when starting off with a child (Bug#9098).
+-out=$(sleep .1 & exec timeout .5 sh -c 'sleep 2; echo foo')
+-status=$?
+-test "$out" = "" && test $status = 124 || fail=1
++# Use setsid to avoid sleep being in the test's process group, as
++# upon reparenting it can trigger an orphaned process group SIGHUP
++# (if there were stopped processes in other tests).
++if setsid true; then
++  out=$(setsid sleep .1 & exec timeout .5 sh -c 'sleep 2; echo foo')
++  status=$?
++  test "$out" = "" && test $status = 124 || fail=1
++fi
+ 
+ # Verify --verbose output
+ cat > exp <<\EOF
+-- 
+2.53.0
+`},
+		},
+
 		Flag: TEarly,
 	}, &MakeHelper{
 		Configure: []KV{
@@ -472,9 +516,9 @@ func (t Toolchain) newTexinfo() (pkg.Artifact, string) {
 		version  = "7.3"
 		checksum = "RRmC8Xwdof7JuZJeWGAQ_GeASIHAuJFQMbNONXBz5InooKIQGmqmWRjGNGEr5n4-"
 	)
-	return t.NewPackage("texinfo", version, newTar(
+	return t.NewPackage("texinfo", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/texinfo/texinfo-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/texinfo/texinfo-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), nil, &MakeHelper{
 		// nonstandard glibc extension
@@ -505,9 +549,9 @@ func (t Toolchain) newGperf() (pkg.Artifact, string) {
 		version  = "3.3"
 		checksum = "RtIy9pPb_Bb8-31J2Nw-rRGso2JlS-lDlVhuNYhqR7Nt4xM_nObznxAlBMnarJv7"
 	)
-	return t.NewPackage("gperf", version, newTar(
+	return t.NewPackage("gperf", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gperf/gperf-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gperf/gperf-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil),
 		Diffutils,
@@ -530,9 +574,9 @@ func (t Toolchain) newGawk() (pkg.Artifact, string) {
 		version  = "5.4.0"
 		checksum = "m0RkIolC-PI7EY5q8pcx5Y-0twlIW0Yp3wXXmV-QaHorSdf8BhZ7kW9F8iWomz0C"
 	)
-	return t.NewPackage("gawk", version, newTar(
+	return t.NewPackage("gawk", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/gawk/gawk-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/gawk/gawk-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		Flag: TEarly,
@@ -558,9 +602,9 @@ func (t Toolchain) newGrep() (pkg.Artifact, string) {
 		version  = "3.12"
 		checksum = "qMB4RjaPNRRYsxix6YOrjE8gyAT1zVSTy4nW4wKW9fqa0CHYAuWgPwDTirENzm_1"
 	)
-	return t.NewPackage("grep", version, newTar(
+	return t.NewPackage("grep", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/grep/grep-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/grep/grep-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable: true,
@@ -595,6 +639,7 @@ func (t Toolchain) newFindutils() (pkg.Artifact, string) {
 		nil, "https://ftpmirror.gnu.org/gnu/findutils/findutils-"+version+".tar.xz",
 		mustDecode(checksum),
 	), &PackageAttr{
+		SourceKind: SourceKindTarXZ,
 		ScriptEarly: `
 echo '#!/bin/sh' > gnulib-tests/test-c32ispunct.sh
 echo 'int main(){return 0;}' > tests/xargs/test-sigusr.c
@@ -622,9 +667,9 @@ func (t Toolchain) newBC() (pkg.Artifact, string) {
 		version  = "1.08.2"
 		checksum = "8h6f3hjV80XiFs6v9HOPF2KEyg1kuOgn5eeFdVspV05ODBVQss-ey5glc8AmneLy"
 	)
-	return t.NewPackage("bc", version, newTar(
+	return t.NewPackage("bc", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/bc/bc-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/bc/bc-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		// source expected to be writable
@@ -651,9 +696,9 @@ func (t Toolchain) newLibiconv() (pkg.Artifact, string) {
 		version  = "1.19"
 		checksum = "UibB6E23y4MksNqYmCCrA3zTFO6vJugD1DEDqqWYFZNuBsUWMVMcncb_5pPAr88x"
 	)
-	return t.NewPackage("libiconv", version, newTar(
+	return t.NewPackage("libiconv", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/libiconv/libiconv-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/libiconv/libiconv-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil)), version
 }
@@ -674,9 +719,9 @@ func (t Toolchain) newTar() (pkg.Artifact, string) {
 		version  = "1.35"
 		checksum = "zSaoSlVUDW0dSfm4sbL4FrXLFR8U40Fh3zY5DWhR5NCIJ6GjU6Kc4VZo2-ZqpBRA"
 	)
-	return t.NewPackage("tar", version, newTar(
+	return t.NewPackage("tar", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/tar/tar-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/tar/tar-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), nil, &MakeHelper{
 		Configure: []KV{
@@ -688,7 +733,7 @@ func (t Toolchain) newTar() (pkg.Artifact, string) {
 			// very expensive
 			"TARTEST_SKIP_LARGE_FILES=1",
 
-			"TESTSUITEFLAGS=" + jobsFlagE,
+			`TESTSUITEFLAGS="-j$(nproc)"`,
 			"check",
 		},
 	},
@@ -713,20 +758,15 @@ func init() {
 
 func (t Toolchain) newParallel() (pkg.Artifact, string) {
 	const (
-		version  = "20260422"
+		version  = "20260322"
-		checksum = "eTsepxgqhXpMEhPd55qh-W5y4vjKn0x9TD2mzbJCNZYtFf4lT4Wzoqr74HGJYBEH"
+		checksum = "gHoPmFkOO62ev4xW59HqyMlodhjp8LvTsBOwsVKHUUdfrt7KwB8koXmSVqQ4VOrB"
 	)
-	return t.NewPackage("parallel", version, newTar(
+	return t.NewPackage("parallel", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/parallel/parallel-"+version+".tar.bz2",
+		nil, "https://ftpmirror.gnu.org/gnu/parallel/parallel-"+version+".tar.bz2",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarBzip2,
-	), &PackageAttr{
+	), nil, (*MakeHelper)(nil),
-		ScriptEarly: `
-ln -s ../system/bin/bash /bin/
-`,
-	}, (*MakeHelper)(nil),
 		Perl,
-		Bash,
 	), version
 }
 func init() {
@@ -750,9 +790,9 @@ func (t Toolchain) newLibunistring() (pkg.Artifact, string) {
 		version  = "1.4.2"
 		checksum = "iW9BbfLoVlXjWoLTZ4AekQSu4cFBnLcZ4W8OHWbv0AhJNgD3j65_zqaLMzFKylg2"
 	)
-	return t.NewPackage("libunistring", version, newTar(
+	return t.NewPackage("libunistring", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/libunistring/libunistring-"+version+".tar.gz",
+		nil, "https://ftp.gnu.org/gnu/libunistring/libunistring-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable: true,
@@ -783,9 +823,9 @@ func (t Toolchain) newLibtasn1() (pkg.Artifact, string) {
 		version  = "4.21.0"
 		checksum = "9DYI3UYbfYLy8JsKUcY6f0irskbfL0fHZA91Q-JEOA3kiUwpodyjemRsYRjUpjuq"
 	)
-	return t.NewPackage("libtasn1", version, newTar(
+	return t.NewPackage("libtasn1", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/libtasn1/libtasn1-"+version+".tar.gz",
+		nil, "https://ftpmirror.gnu.org/gnu/libtasn1/libtasn1-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil)), version
 }
@@ -806,9 +846,9 @@ func (t Toolchain) newReadline() (pkg.Artifact, string) {
 		version  = "8.3"
 		checksum = "r-lcGRJq_MvvBpOq47Z2Y1OI2iqrmtcqhTLVXR0xWo37ZpC2uT_md7gKq5o_qTMV"
 	)
-	return t.NewPackage("readline", version, newTar(
+	return t.NewPackage("readline", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/readline/readline-"+version+".tar.gz",
+		nil, "https://ftp.gnu.org/gnu/readline/readline-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), nil, &MakeHelper{
 		Configure: []KV{
@@ -842,16 +882,17 @@ func (t Toolchain) newGnuTLS() (pkg.Artifact, string) {
 	)
 
 	var configureExtra []KV
-	switch arch {
+	switch runtime.GOARCH {
 	case "arm64":
 		configureExtra = []KV{
 			{"disable-hardware-acceleration"},
 		}
 	}
 
-	return t.NewPackage("gnutls", version, t.newTagRemote(
+	return t.NewPackage("gnutls", version, t.NewViaGit(
 		"https://gitlab.com/gnutls/gnutls.git",
-		version, checksum,
+		"refs/tags/"+version,
+		mustDecode(checksum),
 	), &PackageAttr{
 		Patches: []KV{
 			{"bootstrap-remove-gtk-doc", `diff --git a/bootstrap.conf b/bootstrap.conf
@@ -1021,9 +1062,9 @@ func (t Toolchain) newBinutils() (pkg.Artifact, string) {
 		version  = "2.46.0"
 		checksum = "4kK1_EXQipxSqqyvwD4LbiMLFKCUApjq6PeG4XJP4dzxYGqDeqXfh8zLuTyOuOVR"
 	)
-	return t.NewPackage("binutils", version, newTar(
+	return t.NewPackage("binutils", version, pkg.NewHTTPGetTar(
-		"https://ftpmirror.gnu.org/gnu/binutils/binutils-"+version+".tar.bz2",
+		nil, "https://ftpmirror.gnu.org/gnu/binutils/binutils-"+version+".tar.bz2",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarBzip2,
 	), nil, (*MakeHelper)(nil),
 		Bash,
@@ -1046,16 +1087,12 @@ func (t Toolchain) newGMP() (pkg.Artifact, string) {
 		version  = "6.3.0"
 		checksum = "yrgbgEDWKDdMWVHh7gPbVl56-sRtVVhfvv0M_LX7xMUUk_mvZ1QOJEAnt7g4i3k5"
 	)
-	return t.NewPackage("gmp", version, newTar(
+	return t.NewPackage("gmp", version, pkg.NewHTTPGetTar(
-		"https://gcc.gnu.org/pub/gcc/infrastructure/"+
+		nil, "https://gcc.gnu.org/pub/gcc/infrastructure/"+
 			"gmp-"+version+".tar.bz2",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarBzip2,
-	), &PackageAttr{
+	), nil, (*MakeHelper)(nil),
-		Env: []string{
-			"CC=cc",
-		},
-	}, (*MakeHelper)(nil),
 		M4,
 	), version
 }
@@ -1076,10 +1113,10 @@ func (t Toolchain) newMPFR() (pkg.Artifact, string) {
 		version  = "4.2.2"
 		checksum = "wN3gx0zfIuCn9r3VAn_9bmfvAYILwrRfgBjYSD1IjLqyLrLojNN5vKyQuTE9kA-B"
 	)
-	return t.NewPackage("mpfr", version, newTar(
+	return t.NewPackage("mpfr", version, pkg.NewHTTPGetTar(
-		"https://gcc.gnu.org/pub/gcc/infrastructure/"+
+		nil, "https://gcc.gnu.org/pub/gcc/infrastructure/"+
 			"mpfr-"+version+".tar.bz2",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarBzip2,
 	), nil, (*MakeHelper)(nil),
 		GMP,
@@ -1103,13 +1140,13 @@ func init() {
 
 func (t Toolchain) newMPC() (pkg.Artifact, string) {
 	const (
-		version  = "1.4.1"
+		version  = "1.4.0"
-		checksum = "ZffaZyWkvIw0iPvRe5EJ7O-VvHtSkbbb3K_7SgPtK810NvGan7nbF0T5-6tozjQN"
+		checksum = "TbrxLiE3ipQrHz_F3Xzz4zqBAnkMWyjhNwIK6wh9360RZ39xMt8rxfW3LxA9SnvU"
 	)
-	return t.NewPackage("mpc", version, newFromGitLab(
+	return t.NewPackage("mpc", version, t.NewViaGit(
-		"gitlab.inria.fr",
+		"https://gitlab.inria.fr/mpc/mpc.git",
-		"mpc/mpc",
+		"refs/tags/"+version,
-		version, checksum,
+		mustDecode(checksum),
 	), &PackageAttr{
 		// does not find mpc-impl.h otherwise
 		EnterSource: true,
@@ -1142,20 +1179,13 @@ func init() {
 
 func (t Toolchain) newGCC() (pkg.Artifact, string) {
 	const (
-		version  = "16.1.0"
+		version  = "15.2.0"
-		checksum = "4ASoWbxaA2FW7PAB0zzHDPC5XnNhyaAyjtDPpGzceSLeYnEIXsNYZR3PA_Zu5P0K"
+		checksum = "TXJ5WrbXlGLzy1swghQTr4qxgDCyIZFgJry51XEPTBZ8QYbVmFeB4lZbSMtPJ-a1"
 	)
-
+	return t.NewPackage("gcc", version, pkg.NewHTTPGetTar(
-	var configureExtra []KV
+		nil, "https://ftp.tsukuba.wide.ad.jp/software/gcc/releases/"+
-	switch arch {
-	case "amd64", "arm64":
-		configureExtra = append(configureExtra, KV{"with-multilib-list", "''"})
-	}
-
-	return t.NewPackage("gcc", version, newTar(
-		"https://ftp.tsukuba.wide.ad.jp/software/gcc/releases/"+
 			"gcc-"+version+"/gcc-"+version+".tar.gz",
-		checksum,
+		mustDecode(checksum),
 		pkg.TarGzip,
 	), &PackageAttr{
 		Patches: []KV{
@@ -1317,8 +1347,9 @@ ln -s system/lib /work/
 		// it also saturates the CPU for a consequential amount of time.
 		Flag: TExclusive,
 	}, &MakeHelper{
-		Configure: append([]KV{
+		Configure: []KV{
 			{"disable-multilib"},
+			{"with-multilib-list", `""`},
 			{"enable-default-pie"},
 			{"disable-nls"},
 			{"with-gnu-as"},
@@ -1326,7 +1357,7 @@ ln -s system/lib /work/
 			{"with-system-zlib"},
 			{"enable-languages", "c,c++,go"},
 			{"with-native-system-header-dir", "/system/include"},
-		}, configureExtra...),
+		},
 		Make: []string{
 			"BOOT_CFLAGS='-O2 -g'",
 			"bootstrap",