From cbf18b302d51c3e667ebe06cfebb14b90ccc93b7 Mon Sep 17 00:00:00 2001
From: Ophestra <cat@gensokyo.uk>
Date: Thu, 21 May 2026 15:35:48 +0900
Subject: [PATCH] internal/rosa/package: migrate nss

Signed-off-by: Ophestra <cat@gensokyo.uk>
---
 internal/rosa/bison.go       |   2 +-
 internal/rosa/cmake.go       |   7 +--
 internal/rosa/git.go         |  10 ++--
 internal/rosa/go.go          |   4 +-
 internal/rosa/hakurei.go     |   4 +-
 internal/rosa/images.go      |   8 +--
 internal/rosa/llvm.go        |  86 +++++++++++++--------------
 internal/rosa/make.go        |   9 ++-
 internal/rosa/meson.go       |   5 +-
 internal/rosa/ninja.go       |  13 ++--
 internal/rosa/nss.go         | 112 -----------------------------------
 internal/rosa/package/nss.az |  99 +++++++++++++++++++++++++++++++
 internal/rosa/perl.go        |   7 +--
 internal/rosa/python.go      |  15 +++--
 internal/rosa/rosa.go        |  16 +++--
 internal/rosa/state.go       |   2 +
 internal/rosa/tamago.go      |   2 +-
 internal/rosa/toybox.go      |   4 +-
 18 files changed, 196 insertions(+), 209 deletions(-)
 delete mode 100644 internal/rosa/nss.go
 create mode 100644 internal/rosa/package/nss.az

diff --git a/internal/rosa/bison.go b/internal/rosa/bison.go
index 4a16d911..68f97a68 100644
--- a/internal/rosa/bison.go
+++ b/internal/rosa/bison.go
@@ -61,7 +61,7 @@ func (t Toolchain) newBison() (pkg.Artifact, string) {
 		},
 	},
 		H("m4"),
-		diffutils,
+		_diffutils,
 		H("sed"),
 	), version
 }
diff --git a/internal/rosa/cmake.go b/internal/rosa/cmake.go
index bb488abd..cbce846e 100644
--- a/internal/rosa/cmake.go
+++ b/internal/rosa/cmake.go
@@ -6,8 +6,7 @@ import (
 	"strings"
 )
 
-// CMake is the package used by [CMakeHelper].
-var CMake = H("cmake")
+var _cmake = H("cmake")
 
 // CMakeHelper is the [CMake] build system helper.
 type CMakeHelper struct {
@@ -35,9 +34,9 @@ var _ Helper = new(CMakeHelper)
 // extra returns a hardcoded slice of [CMake] and [Ninja].
 func (attr *CMakeHelper) extra(int) P {
 	if attr != nil && attr.Make {
-		return P{CMake, Make}
+		return P{_cmake, _make}
 	}
-	return P{CMake, Ninja}
+	return P{_cmake, _ninja}
 }
 
 // wantsChmod returns false.
diff --git a/internal/rosa/git.go b/internal/rosa/git.go
index 0954477f..c7f8c5b9 100644
--- a/internal/rosa/git.go
+++ b/internal/rosa/git.go
@@ -7,8 +7,10 @@ import (
 	"hakurei.app/internal/pkg"
 )
 
-// Git is the package used by [Toolchain.NewViaGit].
-var Git = H("git")
+var (
+	_git       = H("git")
+	_nssCACert = H("nss-cacert")
+)
 
 // NewViaGit returns a [pkg.Artifact] for cloning a git repository.
 func (t Toolchain) NewViaGit(
@@ -19,8 +21,8 @@ func (t Toolchain) NewViaGit(
 		path.Base(url),
 		".git",
 	)+"-src-"+path.Base(rev), THostNet, t.Append(nil,
-		nssCACert,
-		Git,
+		_nssCACert,
+		_git,
 	), &checksum, nil, `
 git \
 	-c advice.detachedHead=false \
diff --git a/internal/rosa/go.go b/internal/rosa/go.go
index ef8a3a1c..e1acbaff 100644
--- a/internal/rosa/go.go
+++ b/internal/rosa/go.go
@@ -12,7 +12,7 @@ var _go = H("go")
 func (t Toolchain) newGoBootstrap() pkg.Artifact {
 	const checksum = "8o9JL_ToiQKadCTb04nvBDkp8O1xiWOolAxVEqaTGodieNe4lOFEjlOxN3bwwe23"
 	return t.New("go1.4-bootstrap", 0, t.Append(nil,
-		bash,
+		_bash,
 	), nil, []string{
 		"CGO_ENABLED=0",
 	}, `
@@ -41,7 +41,7 @@ func (t Toolchain) newGo(
 		name = "make"
 	}
 	return t.New("go"+version, 0, t.Append(extra,
-		bash,
+		_bash,
 	), nil, slices.Concat([]string{
 		"CC=cc",
 		"GOCACHE=/tmp/gocache",
diff --git a/internal/rosa/hakurei.go b/internal/rosa/hakurei.go
index 8fe74c07..6fb289bd 100644
--- a/internal/rosa/hakurei.go
+++ b/internal/rosa/hakurei.go
@@ -16,7 +16,7 @@ go build -o /bin/hostname /usr/src/hostname/main.go
 
 	name := "hakurei" + suffix
 	return t.NewPackage(name, hakureiVersion, t.NewPatchedSource(
-		"hakurei", hakureiVersion, hakureiSource, false, hakureiPatches...,
+		"hakurei-"+hakureiVersion, hakureiSource, false, hakureiPatches...,
 	), &PackageAttr{
 		Writable: true,
 		Env: []string{
@@ -58,7 +58,7 @@ HAKUREI_VERSION='v` + hakureiVersion + `'
 		H("wayland"),
 		H("wayland-protocols"),
 
-		kernelHeaders,
+		_kernelHeaders,
 	)
 }
 func init() {
diff --git a/internal/rosa/images.go b/internal/rosa/images.go
index c42ef3ed..8a65f82f 100644
--- a/internal/rosa/images.go
+++ b/internal/rosa/images.go
@@ -5,7 +5,7 @@ import (
 	"hakurei.app/internal/pkg"
 )
 
-var earlyInit = H("earlyinit")
+var _earlyInit = H("earlyinit")
 
 func init() {
 	meta := Metadata{
@@ -41,7 +41,7 @@ func init() {
 		), nil, nil, `
 mksquashfs /mnt/system /work/system.img
 `, pkg.Path(fhs.AbsRoot.Append("mnt"), false, t.Append(nil,
-			musl,
+			_musl,
 			Mksh,
 			Toybox,
 
@@ -60,8 +60,8 @@ func init() {
 	}
 	native.MustRegister(meta.Name, func(t Toolchain) (*Metadata, pkg.Artifact) {
 		return &meta, t.New("initramfs", TNoToolchain, t.Append(nil,
-			zstd,
-			earlyInit,
+			_zstd,
+			_earlyInit,
 			H("gen_init_cpio"),
 		), nil, nil, `
 gen_init_cpio -t 4294967295 -c /usr/src/initramfs | zstd > /work/initramfs.zst
diff --git a/internal/rosa/llvm.go b/internal/rosa/llvm.go
index 7db15d1e..11f8ad0b 100644
--- a/internal/rosa/llvm.go
+++ b/internal/rosa/llvm.go
@@ -9,21 +9,21 @@ import (
 )
 
 var (
-	llvmSource      = H("llvm-project")
-	muslHeaders     = H("musl-headers")
-	earlyCompilerRT = H("early-compiler-rt")
-	earlyRuntimes   = H("early-runtimes")
-	musl            = H("musl")
+	_llvmSource      = H("llvm-project")
+	_muslHeaders     = H("musl-headers")
+	_earlyCompilerRT = H("early-compiler-rt")
+	_earlyRuntimes   = H("early-runtimes")
+	_musl            = H("musl")
 
-	bash      = H("bash")
-	gawk      = H("gawk")
-	coreutils = H("coreutils")
-	diffutils = H("diffutils")
-	findutils = H("findutils")
+	_bash      = H("bash")
+	_gawk      = H("gawk")
+	_coreutils = H("coreutils")
+	_diffutils = H("diffutils")
+	_findutils = H("findutils")
 
-	zlib          = H("zlib")
-	zstd          = H("zstd")
-	kernelHeaders = H("kernel-headers")
+	_zlib          = H("zlib")
+	_zstd          = H("zstd")
+	_kernelHeaders = H("kernel-headers")
 )
 
 // litArgs returns LIT arguments for optional verbosity and check skipping.
@@ -53,11 +53,9 @@ func init() {
 			Name:        "early-compiler-rt",
 			Description: "early LLVM runtime: compiler-rt",
 
-			Dependencies: P{
-				musl,
-			},
+			Dependencies: P{_musl},
 		}
-		_meta, source := t.MustLoad(llvmSource)
+		_meta, source := t.MustLoad(_llvmSource)
 		meta.Version = _meta.Version
 		major, _, _ := strings.Cut(meta.Version, ".")
 		return &meta, t.NewPackage("early-compiler-rt", meta.Version, source, &PackageAttr{
@@ -106,10 +104,10 @@ ln -s \
 	"/work/system/lib/${ROSA_TRIPLE}/crtendS.o"
 `,
 		},
-			Python,
+			_python,
 
-			muslHeaders,
-			kernelHeaders,
+			_muslHeaders,
+			_kernelHeaders,
 		)
 	})
 
@@ -119,10 +117,10 @@ ln -s \
 			Description: "early LLVM runtimes: libunwind, libcxx, libcxxabi",
 
 			Dependencies: P{
-				earlyCompilerRT,
+				_earlyCompilerRT,
 			},
 		}
-		_meta, source := t.MustLoad(llvmSource)
+		_meta, source := t.MustLoad(_llvmSource)
 		meta.Version = _meta.Version
 
 		return &meta, t.NewPackage("early-runtimes", meta.Version, source, &PackageAttr{
@@ -162,12 +160,12 @@ ln -s \
 			},
 			SkipTest: true,
 		},
-			Python,
+			_python,
 
-			zlib,
-			zstd,
-			earlyCompilerRT,
-			kernelHeaders,
+			_zlib,
+			_zstd,
+			_earlyCompilerRT,
+			_kernelHeaders,
 		)
 	})
 
@@ -184,7 +182,7 @@ ln -s \
 
 			ID: 1830,
 		}
-		return &meta, t.NewPatchedSource("llvm", version, newFromGitHub(
+		return &meta, t.NewPatchedSource("llvm-"+version, newFromGitHub(
 			"llvm/llvm-project",
 			"llvmorg-"+version,
 			checksum,
@@ -198,22 +196,22 @@ ln -s \
 			Website:     "https://llvm.org",
 
 			Dependencies: P{
-				zlib,
-				zstd,
-				musl,
+				_zlib,
+				_zstd,
+				_musl,
 			},
 		}
-		_meta, source := t.MustLoad(llvmSource)
+		_meta, source := t.MustLoad(_llvmSource)
 		meta.Version = _meta.Version
 
-		early := muslHeaders
+		early := _muslHeaders
 		if t.stage.isStage0() {
 			// The LLVM build system uses the system installation when building with
 			// LLVM_LINK_LLVM_DYLIB, since it builds runtimes after the fact, using
 			// the just-built toolchain. This is unacceptable in stage0 due to the
 			// potential version difference. Later stages bootstrap off of runtimes
 			// of its previous stage via 3-stage determinism.
-			early = earlyRuntimes
+			early = _earlyRuntimes
 		}
 
 		cache := []KV{
@@ -351,18 +349,18 @@ chmod +w /bin && ln -s \
 ninja ` + jobsFlagE + ` check-all
 `,
 		},
-			Python,
-			Perl,
-			diffutils,
-			bash,
-			gawk,
-			coreutils,
-			findutils,
+			_python,
+			_perl,
+			_diffutils,
+			_bash,
+			_gawk,
+			_coreutils,
+			_findutils,
 
-			zlib,
-			zstd,
+			_zlib,
+			_zstd,
 			early,
-			kernelHeaders,
+			_kernelHeaders,
 		)
 
 	})
diff --git a/internal/rosa/make.go b/internal/rosa/make.go
index 73fac69c..793509c9 100644
--- a/internal/rosa/make.go
+++ b/internal/rosa/make.go
@@ -5,8 +5,7 @@ import (
 	"strings"
 )
 
-// Make is the build system used by [MakeHelper].
-var Make = H("make")
+var _make = H("make")
 
 // MakeHelper is the [Make] build system helper.
 type MakeHelper struct {
@@ -52,11 +51,11 @@ var _ Helper = new(MakeHelper)
 
 // extra returns make and other optional dependencies.
 func (attr *MakeHelper) extra(flag int) P {
-	extra := P{Make}
+	extra := P{_make}
 	if (attr == nil || !attr.OmitDefaults) && flag&TEarly == 0 {
 		extra = append(extra,
-			gawk,
-			coreutils,
+			_gawk,
+			_coreutils,
 		)
 	}
 	return extra
diff --git a/internal/rosa/meson.go b/internal/rosa/meson.go
index 737a727c..c324cf88 100644
--- a/internal/rosa/meson.go
+++ b/internal/rosa/meson.go
@@ -5,8 +5,7 @@ import (
 	"strings"
 )
 
-// Meson is the meson package used by [MesonHelper].
-var Meson = H("meson")
+var _meson = H("meson")
 
 // MesonHelper is the [Meson] build system helper.
 type MesonHelper struct {
@@ -26,7 +25,7 @@ type MesonHelper struct {
 var _ Helper = new(MesonHelper)
 
 // extra returns hardcoded meson runtime dependencies.
-func (*MesonHelper) extra(int) P { return P{Meson} }
+func (*MesonHelper) extra(int) P { return P{_meson} }
 
 // wantsChmod returns false.
 func (*MesonHelper) wantsChmod() bool { return false }
diff --git a/internal/rosa/ninja.go b/internal/rosa/ninja.go
index 0f29d186..74f82998 100644
--- a/internal/rosa/ninja.go
+++ b/internal/rosa/ninja.go
@@ -2,8 +2,7 @@ package rosa
 
 import "hakurei.app/internal/pkg"
 
-// Ninja is the build system used by [CMakeHelper] and [MesonHelper].
-var Ninja = H("ninja")
+var _ninja = H("ninja")
 
 func init() {
 	const (
@@ -19,11 +18,11 @@ func init() {
 		ID: 2089,
 	}
 	native.MustRegister(meta.Name, func(t Toolchain) (*Metadata, pkg.Artifact) {
-		_, _python := t.Load(Python)
-		_, _bash := t.Load(bash)
+		_, python := t.Load(_python)
+		_, bash := t.Load(_bash)
 		return &meta, t.New(meta.Name+"-"+version, 0, []pkg.Artifact{
-			_python,
-			_bash,
+			python,
+			bash,
 		}, nil, nil, `
 cd "$(mktemp -d)"
 python3 /usr/src/ninja/configure.py \
@@ -43,7 +42,7 @@ cp ninja /work/system/bin/
 				"NjLGvSbgPy_B-y-o1hdanlzEzaYeStFcvFGxpYV3KYlhrWWFRcugYhM3ZMzOA9B_",
 				pkg.TarGzip,
 			)), pkg.Path(AbsUsrSrc.Append("ninja"), true, t.NewPatchedSource(
-			meta.Name, version, newFromGitHub(
+			meta.Name+"-"+version, newFromGitHub(
 				"ninja-build/ninja",
 				"v"+version,
 				checksum,
diff --git a/internal/rosa/nss.go b/internal/rosa/nss.go
deleted file mode 100644
index a9aed1c4..00000000
--- a/internal/rosa/nss.go
+++ /dev/null
@@ -1,112 +0,0 @@
-package rosa
-
-import (
-	"strings"
-
-	"hakurei.app/internal/pkg"
-)
-
-var (
-	unzip     = H("unzip")
-	nss       = H("nss")
-	nssCACert = H("nss-cacert")
-)
-
-func (t Toolchain) newNSS() (pkg.Artifact, string) {
-	const (
-		version  = "3.123.1"
-		checksum = "g811Z_fc74ssg-s6BeXRG-ipSfJggD6hrxjVJxrOBIz98CE7piv0OLwzIRLMQpwR"
-
-		version0  = "4_38_2"
-		checksum0 = "25x2uJeQnOHIiq_zj17b4sYqKgeoU8-IsySUptoPcdHZ52PohFZfGuIisBreWzx0"
-	)
-	return t.NewPackage("nss", version, newFromGitHub(
-		"nss-dev/nss",
-		"NSS_"+strings.Join(strings.SplitN(version, ".", 3), "_")+"_RTM",
-		checksum,
-	), &PackageAttr{
-		Paths: []pkg.ExecPath{
-			pkg.Path(AbsUsrSrc.Append("nspr.zip"), false, pkg.NewHTTPGet(
-				nil, "https://hg-edge.mozilla.org/projects/nspr/archive/"+
-					"NSPR_"+version0+"_RTM.zip",
-				mustDecode(checksum0),
-			)),
-		},
-
-		// uses source tree as scratch space
-		Writable: true,
-		Chmod:    true,
-
-		ScriptEarly: `
-unzip /usr/src/nspr.zip -d /usr/src
-mv '/usr/src/nspr-NSPR_` + version0 + `_RTM' /usr/src/nspr
-`,
-	}, &MakeHelper{
-		OmitDefaults:  true,
-		SkipConfigure: true,
-		InPlace:       true,
-
-		SkipCheck: true,
-		Make: []string{
-			"CCC=clang++",
-			"NSDISTMODE=copy",
-			"BUILD_OPT=1",
-			"USE_64=1",
-			"nss_build_all",
-		},
-		Install: `
-mkdir -p /work/system/nss
-cp -r \
-	/usr/src/dist/. \
-	lib/ckfw/builtins/certdata.txt \
-	/work/system/nss
-`,
-	},
-		Perl,
-		Python,
-		unzip,
-		gawk,
-		coreutils,
-
-		zlib,
-		kernelHeaders,
-	), version
-}
-func init() {
-	native.mustRegister(Toolchain.newNSS, &Metadata{
-		Name:        "nss",
-		Description: "Network Security Services",
-		Website:     "https://firefox-source-docs.mozilla.org/security/nss/index.html",
-
-		Dependencies: P{
-			zlib,
-		},
-
-		ID: 2503,
-	})
-}
-
-func (t Toolchain) newNSSCACert() (pkg.Artifact, string) {
-	return t.New("nss-cacert", 0, t.Append(nil,
-		bash,
-
-		nss,
-		H("buildcatrust"),
-	), nil, nil, `
-mkdir -p /work/system/etc/ssl/{certs/unbundled,certs/hashed,trust-source}
-buildcatrust \
-	--certdata_input /system/nss/certdata.txt \
-	--ca_bundle_output /work/system/etc/ssl/certs/ca-bundle.crt \
-	--ca_standard_bundle_output /work/system/etc/ssl/certs/ca-no-trust-rules-bundle.crt \
-	--ca_unpacked_output /work/system/etc/ssl/certs/unbundled \
-	--ca_hashed_unpacked_output /work/system/etc/ssl/certs/hashed \
-	--p11kit_output /work/system/etc/ssl/trust-source/ca-bundle.trust.p11-kit
-`), Unversioned
-}
-func init() {
-	native.mustRegister(Toolchain.newNSSCACert, &Metadata{
-		Name:        "nss-cacert",
-		Description: "bundle of X.509 certificates of public Certificate Authorities",
-		Website:     "https://curl.se/docs/caextract.html",
-	})
-}
diff --git a/internal/rosa/package/nss.az b/internal/rosa/package/nss.az
new file mode 100644
index 00000000..f9cbb817
--- /dev/null
+++ b/internal/rosa/package/nss.az
@@ -0,0 +1,99 @@
+package nspr {
+	description = "nspr source tree";
+	anitya = 7953;
+	exclude = true;
+
+	version* = "4.38.2";
+	output = remoteTar {
+		url = "https://ftp.mozilla.org/pub/nspr/releases/v"+version+
+			"/src/nspr-"+version+".tar.gz";
+		checksum = "BcKpVmN6bdBaoZyzht_SpGHnO1CRN5YHeVyWW2skfCKIdhy3ppKe1zMh85QBEsV_";
+		compress = gzip;
+	};
+}
+
+package nss {
+	description = "Network Security Services";
+	website = "https://firefox-source-docs.mozilla.org/security/nss/index.html";
+	anitya = 2503;
+
+	version* = "3.123.1";
+	source = remoteGitHub {
+		suffix = "nss-dev/nss";
+		tag = "NSS_"+join {
+			elems = split {
+				s = version;
+				sep = ".";
+				n = 3;
+			};
+			sep = "_";
+		}+"_RTM";
+		checksum = "g811Z_fc74ssg-s6BeXRG-ipSfJggD6hrxjVJxrOBIz98CE7piv0OLwzIRLMQpwR";
+	};
+	extra = [ nspr ];
+
+	enterSource = true;
+	writable = true;
+	chmod = true;
+	early = "\nln -s extra/nspr/nspr /usr/src/nspr\n";
+
+	exec = make {
+		omitDefaults = true;
+		skipConfigure = true;
+		inPlace = true;
+
+		make = [
+			"CCC=clang++",
+			"NSDISTMODE=copy",
+			"BUILD_OPT=1",
+			"USE_64=1",
+			"nss_build_all",
+		];
+		skipCheck = true;
+		install = `
+cp -r \
+	/usr/src/dist/. \
+	lib/ckfw/builtins/certdata.txt \
+	/work/
+`;
+	};
+
+	inputs = [
+		perl,
+		python,
+		gawk,
+		coreutils,
+
+		zlib,
+		kernel-headers,
+	];
+
+	runtime = [ zlib ];
+}
+
+package nss-cacert {
+	description = "bundle of X.509 certificates of public Certificate Authorities";
+	website = "https://curl.se/docs/caextract.html";
+	version = unversioned;
+
+	source = nss;
+
+	exec = generic {
+		build = `
+mkdir -p /work/system/etc/ssl/{certs/unbundled,certs/hashed,trust-source}
+buildcatrust \
+	--certdata_input certdata.txt \
+	--ca_bundle_output /work/system/etc/ssl/certs/ca-bundle.crt \
+	--ca_standard_bundle_output /work/system/etc/ssl/certs/ca-no-trust-rules-bundle.crt \
+	--ca_unpacked_output /work/system/etc/ssl/certs/unbundled \
+	--ca_hashed_unpacked_output /work/system/etc/ssl/certs/hashed \
+	--p11kit_output /work/system/etc/ssl/trust-source/ca-bundle.trust.p11-kit
+`;
+	};
+
+	inputs = [
+		bash,
+
+		buildcatrust,
+	];
+}
diff --git a/internal/rosa/perl.go b/internal/rosa/perl.go
index f0b32153..c17ce109 100644
--- a/internal/rosa/perl.go
+++ b/internal/rosa/perl.go
@@ -6,8 +6,7 @@ import (
 	"hakurei.app/internal/pkg"
 )
 
-// Perl is the perl interpreter used by [MakeMakerHelper].
-var Perl = H("perl")
+var _perl = H("perl")
 
 // MakeMakerHelper is the [Perl] MakeMaker helper.
 type MakeMakerHelper struct {
@@ -16,7 +15,7 @@ type MakeMakerHelper struct {
 }
 
 // extra returns perl.
-func (*MakeMakerHelper) extra(int) P { return P{Perl, Make} }
+func (*MakeMakerHelper) extra(int) P { return P{_perl, _make} }
 
 // wantsChmod returns true.
 func (*MakeMakerHelper) wantsChmod() bool { return true }
@@ -64,6 +63,6 @@ func (t Toolchain) newViaPerlMakeMaker(
 	return t.NewPackage("perl-"+name, version, source, &PackageAttr{
 		Patches: patches,
 	}, (*MakeMakerHelper)(nil), slices.Concat(extra, P{
-		Perl,
+		_perl,
 	})...)
 }
diff --git a/internal/rosa/python.go b/internal/rosa/python.go
index d80aee76..af4580e8 100644
--- a/internal/rosa/python.go
+++ b/internal/rosa/python.go
@@ -6,8 +6,10 @@ import (
 	"hakurei.app/internal/pkg"
 )
 
-// Python is the python interpreter used by [PipHelper].
-var Python = H("python")
+var (
+	_python       = H("python")
+	_pythonPyTest = H("python-pytest")
+)
 
 // PipHelper is the [Python] pip packaging helper.
 type PipHelper struct {
@@ -29,15 +31,12 @@ type PipHelper struct {
 
 var _ Helper = new(PipHelper)
 
-// pythonPyTest is used by [PipHelper] for automated testing.
-var pythonPyTest = H("python-pytest")
-
 // extra returns python, or pytest if defaults are assumed.
 func (attr *PipHelper) extra(int) P {
 	if attr == nil || (!attr.SkipCheck && attr.Check == "") {
-		return P{pythonPyTest}
+		return P{_pythonPyTest}
 	}
-	return P{Python}
+	return P{_python}
 }
 
 // wantsChmod returns true.
@@ -113,7 +112,7 @@ func (s *S) newPythonPackage(
 				Website:     website,
 				Version:     version,
 
-				Dependencies: slices.Concat(P{Python}, extra),
+				Dependencies: slices.Concat(P{_python}, extra),
 
 				ID: id,
 			}, t.NewPackage(name, version, source, attrP, attr, slices.Concat(
diff --git a/internal/rosa/rosa.go b/internal/rosa/rosa.go
index aee3fdb4..e3d8a41a 100644
--- a/internal/rosa/rosa.go
+++ b/internal/rosa/rosa.go
@@ -302,7 +302,7 @@ mkdir -vp /work/system/bin
 
 		base := LLVM
 		if flag&TNoToolchain != 0 {
-			base = musl
+			base = _musl
 		}
 
 		support = slices.Concat(extra, t.S.New(t.stage-1).Append([]pkg.Artifact{
@@ -345,7 +345,7 @@ var patch = H("patch")
 // NewPatchedSource returns [pkg.Artifact] of source with patches applied. If
 // passthrough is true, source is returned as is for zero length patches.
 func (t Toolchain) NewPatchedSource(
-	name, version string,
+	name string,
 	source pkg.Artifact,
 	passthrough bool,
 	patches ...KV,
@@ -363,7 +363,7 @@ func (t Toolchain) NewPatchedSource(
 	}
 	paths[0] = pkg.Path(AbsUsrSrc.Append(name), false, source)
 
-	aname := name + "-" + version + "-src"
+	aname := name + "-src"
 	script := `
 cp -r /usr/src/` + name + `/. /work/.
 chmod -R +w /work && cd /work
@@ -491,6 +491,10 @@ func (t Toolchain) NewPackage(
 	if source == nil {
 		panic("source must be non-nil")
 	}
+	rn := name
+	if version != Unversioned {
+		rn = name + "-" + version
+	}
 	wantsChmod, wantsWrite := helper.wantsChmod(), helper.wantsWrite()
 	extraRes := make([]pkg.Artifact, 0, 1<<3+len(extra))
 	{
@@ -519,7 +523,7 @@ func (t Toolchain) NewPackage(
 		sourceSuffix = ".tar.xz"
 		scriptEarly += `
 tar -C /usr/src/ -xf '/usr/src/` + name + `.tar.xz'
-mv '/usr/src/` + name + `-` + version + `' '/usr/src/` + name + `'
+mv '/usr/src/` + rn + `' '/usr/src/` + name + `'
 `
 	}
 
@@ -544,7 +548,7 @@ cd '/usr/src/` + name + `/'
 	}
 
 	return t.New(
-		name+"-"+version,
+		rn,
 		attr.Flag,
 		extraRes,
 		attr.KnownChecksum,
@@ -554,7 +558,7 @@ cd '/usr/src/` + name + `/'
 			pkg.Path(AbsUsrSrc.Append(
 				name+sourceSuffix,
 			), attr.Writable || wantsWrite, t.NewPatchedSource(
-				name, version, source, !attr.Chmod && !wantsChmod, attr.Patches...,
+				rn, source, !attr.Chmod && !wantsChmod, attr.Patches...,
 			)),
 		})...,
 	)
diff --git a/internal/rosa/state.go b/internal/rosa/state.go
index 8c087f32..bb10a323 100644
--- a/internal/rosa/state.go
+++ b/internal/rosa/state.go
@@ -450,6 +450,8 @@ func (s *S) getFrame() azalea.Frame {
 		}
 
 		s.frame.Val = map[unique.Handle[azalea.Ident]]any{
+			k("unversioned"): Unversioned,
+
 			k("triple"):       s.triple(),
 			k("linuxArch"):    s.linuxArch(),
 			k("earlyLDFLAGS"): s.earlyLDFLAGS(false),
diff --git a/internal/rosa/tamago.go b/internal/rosa/tamago.go
index a9ea12c8..74c8b680 100644
--- a/internal/rosa/tamago.go
+++ b/internal/rosa/tamago.go
@@ -8,7 +8,7 @@ func (t Toolchain) newTamaGo() (pkg.Artifact, string) {
 		checksum = "-nH3MjAzDDLTeJ2hRKYJcJwo5-Ikci4zOHfB8j1vKn7zrF9TS6zYaoLi8qohGwAE"
 	)
 	return t.New("tamago-go"+version, 0, t.Append(nil,
-		bash,
+		_bash,
 		_go,
 	), nil, []string{
 		"CC=cc",
diff --git a/internal/rosa/toybox.go b/internal/rosa/toybox.go
index 4065e90a..7ced9c32 100644
--- a/internal/rosa/toybox.go
+++ b/internal/rosa/toybox.go
@@ -58,10 +58,10 @@ mkdir -p /work/usr/bin
 ln -s ../../system/bin/env /work/usr/bin
 `,
 	},
-		bash,
+		_bash,
 		gzip,
 
-		kernelHeaders,
+		_kernelHeaders,
 	), version
 }
 func init() {