internal/rosa: mesa artifact

This has many dependencies.

Signed-off-by: Ophestra <cat@gensokyo.uk>

all.sh

@@ -1,10 +1,3 @@
 #!/bin/sh -e
 
-TOOLCHAIN_VERSION="$(go version)"
-cd "$(dirname -- "$0")/"
-echo "Building cmd/dist using ${TOOLCHAIN_VERSION}."
-FLAGS=''
-if test -n "$VERBOSE"; then
-    FLAGS="$FLAGS -v"
-fi
-go run $FLAGS --tags=dist ./cmd/dist
+HAKUREI_DIST_MAKE='' exec "$(dirname -- "$0")/cmd/dist/dist.sh"

cmd/dist/dist.sh

@@ -0,0 +1,10 @@
+#!/bin/sh -e
+
+TOOLCHAIN_VERSION="$(go version)"
+cd "$(dirname -- "$0")/../.."
+echo "Building cmd/dist using ${TOOLCHAIN_VERSION}."
+FLAGS=''
+if test -n "$VERBOSE"; then
+    FLAGS="$FLAGS -v"
+fi
+go run $FLAGS --tags=dist ./cmd/dist

cmd/dist/main.go

@@ -46,6 +46,7 @@ func main() {
 	log.SetPrefix("")
 
 	verbose := os.Getenv("VERBOSE") != ""
+	runTests := os.Getenv("HAKUREI_DIST_MAKE") == ""
 	version := getenv("HAKUREI_VERSION", "untagged")
 	prefix := getenv("PREFIX", "/usr")
 	destdir := getenv("DESTDIR", "dist")
@@ -101,13 +102,15 @@ func main() {
 	)
 	log.Println()
 
-	log.Println("##### Testing Hakurei.")
-	mustRun(
-		ctx, "go", "test",
-		"-ldflags=-buildid= -linkmode external -extldflags=-static",
-		"./...",
-	)
-	log.Println()
+	if runTests {
+		log.Println("##### Testing Hakurei.")
+		mustRun(
+			ctx, "go", "test",
+			"-ldflags=-buildid= -linkmode external -extldflags=-static",
+			"./...",
+		)
+		log.Println()
+	}
 
 	log.Println("##### Creating distribution.")
 	const suffix = ".tar.gz"

cmd/mbf/cache.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"hakurei.app/check"
+	"hakurei.app/container"
 	"hakurei.app/internal/pkg"
 	"hakurei.app/message"
 )
@@ -19,9 +20,15 @@ type cache struct {
 	// Should generally not be used directly.
 	c *pkg.Cache
 
-	cures, jobs        int
-	hostAbstract, idle bool
-	verboseInit        bool
+	cures, jobs int
+	// Primarily to work around missing landlock LSM.
+	hostAbstract bool
+	// Set SCHED_IDLE.
+	idle bool
+	// Unset [pkg.CSuppressInit].
+	verboseInit bool
+	// Loaded artifact of [rosa.QEMU].
+	qemu pkg.Artifact
 
 	base string
 }
@@ -74,6 +81,39 @@ func (cache *cache) open() (err error) {
 		cache.jobs,
 		base,
 	)
+	if err != nil {
+		return
+	}
+	done <- struct{}{}
+
+	if cache.qemu != nil {
+		var pathname *check.Absolute
+		pathname, _, err = cache.c.Cure(cache.qemu)
+		if err != nil {
+			cache.c.Close()
+			return
+		}
+
+		pkg.RegisterArch("riscv64", container.BinfmtEntry{
+			Offset: 0,
+			Magic:  "\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xf3\x00",
+			Mask:   "\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff",
+			Interpreter: pathname.Append(
+				"system/bin",
+				"qemu-riscv64",
+			),
+		})
+		pkg.RegisterArch("arm64", container.BinfmtEntry{
+			Offset: 0,
+			Magic:  "\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7\x00",
+			Mask:   "\xff\xff\xff\xff\xff\xff\xff\xfc\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff",
+			Interpreter: pathname.Append(
+				"system/bin",
+				"qemu-aarch64",
+			),
+		})
+	}
+
 	return
 }
 

cmd/mbf/main.go

@@ -67,9 +67,13 @@ func main() {
 
 	var (
 		flagQuiet bool
+		flagQEMU  bool
+		flagArch  string
 		flagCheck bool
 		flagLTO   bool
 
+		flagCrossOverride int
+
 		addr net.UnixAddr
 	)
 	c := command.New(os.Stderr, log.Printf, "mbf", func([]string) error {
@@ -93,13 +97,36 @@ func main() {
 		if !flagLTO {
 			flags |= rosa.OptLLVMNoLTO
 		}
-		rosa.DropCaches(flags)
+		rosa.DropCaches("", flags)
+		cross := flagArch != "" && flagArch != runtime.GOARCH
+		if flagQEMU || cross {
+			cm.qemu = rosa.Std.Load(rosa.QEMU)
+		}
+
+		if cross {
+			if flagCrossOverride != -1 {
+				flags = flagCrossOverride
+			}
+
+			rosa.DropCaches(flagArch, flags)
+			if !rosa.HasStage0() {
+				return pkg.UnsupportedArchError(flagArch)
+			}
+		}
 
 		return nil
 	}).Flag(
 		&flagQuiet,
 		"q", command.BoolFlag(false),
 		"Do not print cure messages",
+	).Flag(
+		&flagQEMU,
+		"register", command.BoolFlag(false),
+		"Enable additional target architectures",
+	).Flag(
+		&flagArch,
+		"arch", command.StringFlag(runtime.GOARCH),
+		"Target architecture",
 	).Flag(
 		&flagLTO,
 		"lto", command.BoolFlag(false),
@@ -108,6 +135,10 @@ func main() {
 		&flagCheck,
 		"check", command.BoolFlag(true),
 		"Run test suites",
+	).Flag(
+		&flagCrossOverride,
+		"cross-flags", command.IntFlag(-1),
+		"Override non-native target preset flags",
 	).Flag(
 		&cm.verboseInit,
 		"v", command.BoolFlag(false),
@@ -475,6 +506,8 @@ func main() {
 			flagExport  string
 			flagRemote  bool
 			flagNoReply bool
+			flagFaults  bool
+			flagPop     bool
 
 			flagBoot bool
 			flagStd  bool
@@ -583,6 +616,49 @@ func main() {
 					}
 
 					return err
+
+				case flagFaults:
+					var faults []pkg.Fault
+					if err := cm.Do(func(cache *pkg.Cache) (err error) {
+						faults, err = cache.ReadFaults(t.Load(p))
+						return
+					}); err != nil {
+						return err
+					}
+
+					for _, fault := range faults {
+						log.Printf("%s: %s ago", fault.String(), time.Since(fault.Time()))
+					}
+					return nil
+
+				case flagPop:
+					var faults []pkg.Fault
+					if err := cm.Do(func(cache *pkg.Cache) (err error) {
+						faults, err = cache.ReadFaults(t.Load(p))
+						return
+					}); err != nil {
+						return err
+					}
+
+					if len(faults) == 0 {
+						return errors.New("no fault entries found")
+					}
+					fault := faults[len(faults)-1]
+					r, err := fault.Open()
+					if err != nil {
+						return err
+					}
+					if _, err = io.Copy(os.Stdout, r); err != nil {
+						_ = r.Close()
+						return err
+					}
+					fmt.Println()
+					if err = r.Close(); err != nil {
+						return err
+					}
+
+					log.Printf("faulting cure terminated %s ago", time.Since(fault.Time()))
+					return fault.Destroy()
 				}
 			},
 		).Flag(
@@ -613,9 +689,40 @@ func main() {
 			&flagStd,
 			"std", command.BoolFlag(false),
 			"Build on the intermediate toolchain",
+		).Flag(
+			&flagFaults,
+			"faults", command.BoolFlag(false),
+			"Display fault entries of the specified artifact",
+		).Flag(
+			&flagPop,
+			"pop", command.BoolFlag(false),
+			"Display and destroy the most recent fault entry",
 		)
 	}
 
+	c.NewCommand(
+		"clear",
+		"Remove all fault entries from the cache",
+		func([]string) error {
+			return cm.Do(func(*pkg.Cache) error {
+				pathname := filepath.Join(cm.base, "fault")
+				dents, err := os.ReadDir(pathname)
+				if err != nil {
+					return err
+				}
+
+				for _, dent := range dents {
+					msg.Verbosef("destroying entry %s", dent.Name())
+					if err = os.Remove(filepath.Join(pathname, dent.Name())); err != nil {
+						return err
+					}
+				}
+				log.Printf("destroyed %d fault entries", len(dents))
+				return nil
+			})
+		},
+	)
+
 	c.NewCommand(
 		"abort",
 		"Abort all pending cures on the daemon",

cmd/mbf/main_test.go

@@ -9,7 +9,7 @@ import (
 )
 
 func TestMain(m *testing.M) {
-	rosa.DropCaches(rosa.OptLLVMNoLTO)
+	rosa.DropCaches("", rosa.OptLLVMNoLTO)
 	os.Exit(m.Run())
 }
 

cmd/sharefs/test/configuration.nix

@@ -20,11 +20,14 @@
   };
 
   virtualisation = {
+    # Hopefully reduces spurious test failures:
+    memorySize = if pkgs.stdenv.hostPlatform.is32bit then 2046 else 8192;
+
     diskSize = 6 * 1024;
 
     qemu.options = [
       # Increase test performance:
-      "-smp 8"
+      "-smp 16"
     ];
   };
 

cmd/sharefs/test/default.nix

@@ -28,7 +28,7 @@ testers.nixosTest {
         # For go tests:
         (pkgs.writeShellScriptBin "sharefs-workload-hakurei-tests" ''
           cp -r "${self.packages.${system}.hakurei.src}" "/sdcard/hakurei" && cd "/sdcard/hakurei"
-          ${fhs}/bin/hakurei-fhs -c 'CC="clang -O3 -Werror" go test ./...'
+          ${fhs}/bin/hakurei-fhs -c 'ROSA_SKIP_BINFMT=1 CC="clang -O3 -Werror" go test ./...'
         '')
       ];
 

container/binfmt.go

@@ -0,0 +1,46 @@
+package container
+
+import (
+	"strings"
+	"unsafe"
+
+	"hakurei.app/check"
+)
+
+// escapeBinfmt escapes magic/mask sequences in a [BinfmtEntry].
+func escapeBinfmt(buf *strings.Builder, s string) string {
+	const lowerhex = "0123456789abcdef"
+
+	buf.Reset()
+	for _, c := range unsafe.Slice(unsafe.StringData(s), len(s)) {
+		switch c {
+		case 0, '\\', ':':
+			buf.WriteString(`\x`)
+			buf.WriteByte(lowerhex[c>>4])
+			buf.WriteByte(lowerhex[c&0xf])
+
+		default:
+			buf.WriteByte(c)
+		}
+	}
+	return buf.String()
+}
+
+// BinfmtEntry is an entry to be registered by the init process.
+type BinfmtEntry struct {
+	// The offset of the magic/mask in the file, counted in bytes.
+	Offset byte
+	// The byte sequence binfmt_misc is matching for.
+	Magic string
+	// An (optional, defaults to all 0xff) mask.
+	Mask string
+	// The program that should be invoked with the binary as first argument.
+	Interpreter *check.Absolute
+}
+
+// Valid returns whether e can be registered into the kernel.
+func (e *BinfmtEntry) Valid() bool {
+	return e != nil &&
+		int(e.Offset)+max(len(e.Magic), len(e.Mask)) < 128 &&
+		e.Interpreter != nil && len(e.Interpreter.String()) < 128
+}

container/binfmt_test.go

@@ -0,0 +1,62 @@
+package container
+
+import (
+	"strings"
+	"testing"
+
+	"hakurei.app/fhs"
+)
+
+func TestEscapeBinfmt(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name  string
+		magic string
+		want  string
+	}{
+		{"packed DOS applications", "\x0eDEX", "\x0eDEX"},
+
+		{"riscv64 magic",
+			"\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xf3\x00",
+			"\x7fELF\x02\x01\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\x02\\x00\xf3\\x00"},
+		{"riscv64 mask",
+			"\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff",
+			"\xff\xff\xff\xff\xff\xff\xff\\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff"},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := escapeBinfmt(new(strings.Builder), tc.magic)
+			if got != tc.want {
+				t.Errorf("escapeBinfmt: %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestBinfmtEntry(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name  string
+		e     BinfmtEntry
+		valid bool
+	}{
+		{"zero", BinfmtEntry{}, false},
+		{"large offset", BinfmtEntry{Offset: 128}, false},
+		{"long magic", BinfmtEntry{Magic: strings.Repeat("\x00", 128)}, false},
+		{"long mask", BinfmtEntry{Mask: strings.Repeat("\x00", 128)}, false},
+		{"valid", BinfmtEntry{Interpreter: fhs.AbsRoot}, true},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			if tc.e.Valid() != tc.valid {
+				t.Errorf("Valid: %v", !tc.valid)
+			}
+		})
+	}
+}

container/capability.go

@@ -18,6 +18,7 @@ const (
 	CAP_SETPCAP      = 0x8
 	CAP_NET_ADMIN    = 0xc
 	CAP_DAC_OVERRIDE = 0x1
+	CAP_SETFCAP      = 0x1f
 )
 
 type (

container/container.go

@@ -91,12 +91,20 @@ type (
 		// Time to wait for processes lingering after the initial process terminates.
 		AdoptWaitDelay time.Duration
 
+		// Map uid/gid 0 in the init process. Requires [FstypeProc] attached to
+		// [fhs.Proc] in the container filesystem.
+		InitAsRoot bool
 		// Mapped Uid in user namespace.
 		Uid int
 		// Mapped Gid in user namespace.
 		Gid int
 		// Hostname value in UTS namespace.
 		Hostname string
+		// Register binfmt_misc entries.
+		Binfmt []BinfmtEntry
+		// Alternative pathname to attach binfmt_misc filesystem. The zero value
+		// requires [FstypeProc] to be made available at [fhs.Proc].
+		BinfmtPath *check.Absolute
 		// Sequential container setup ops.
 		*Ops
 
@@ -216,6 +224,9 @@ func (p *Container) Start() error {
 	if p.cmd.Process != nil {
 		return errors.New("container: already started")
 	}
+	if !p.InitAsRoot && len(p.Binfmt) > 0 {
+		return errors.New("container: init as root required, but not enabled")
+	}
 
 	if err := ensureCloseOnExec(); err != nil {
 		return err
@@ -286,6 +297,18 @@ func (p *Container) Start() error {
 	if !p.HostNet {
 		p.cmd.SysProcAttr.Cloneflags |= CLONE_NEWNET
 	}
+	if p.InitAsRoot {
+		p.cmd.SysProcAttr.AmbientCaps = append(p.cmd.SysProcAttr.AmbientCaps,
+			// mappings during init as root
+			CAP_SETFCAP,
+		)
+
+		if !p.SeccompDisable &&
+			len(p.SeccompRules) == 0 &&
+			p.SeccompPresets&std.PresetDenyNS != 0 {
+			return errors.New("container: as root requires late namespace creation")
+		}
+	}
 
 	// place setup pipe before user supplied extra files, this is later restored by init
 	if r, w, err := os.Pipe(); err != nil {

container/container_test.go

@@ -16,7 +16,8 @@ import (
 	"strings"
 	"syscall"
 	"testing"
-	_ "unsafe" // for go:linkname
+	"time"
+	"unsafe"
 
 	"hakurei.app/check"
 	"hakurei.app/command"
@@ -408,39 +409,11 @@ var containerTestCases = []struct {
 func TestContainer(t *testing.T) {
 	t.Parallel()
 
-	t.Run("cancel", testContainerCancel(nil, func(t *testing.T, c *container.Container) {
-		wantErr := context.Canceled
-		wantExitCode := 0
-		if err := c.Wait(); !reflect.DeepEqual(err, wantErr) {
-			if m, ok := container.InternalMessageFromError(err); ok {
-				t.Error(m)
-			}
-			t.Errorf("Wait: error = %#v, want %#v", err, wantErr)
-		}
-		if ps := c.ProcessState(); ps == nil {
-			t.Errorf("ProcessState unexpectedly returned nil")
-		} else if code := ps.ExitCode(); code != wantExitCode {
-			t.Errorf("ExitCode: %d, want %d", code, wantExitCode)
-		}
-	}))
-
-	t.Run("forward", testContainerCancel(func(c *container.Container) {
-		c.ForwardCancel = true
-	}, func(t *testing.T, c *container.Container) {
-		var exitError *exec.ExitError
-		if err := c.Wait(); !errors.As(err, &exitError) {
-			if m, ok := container.InternalMessageFromError(err); ok {
-				t.Error(m)
-			}
-			t.Errorf("Wait: error = %v", err)
-		}
-		if code := exitError.ExitCode(); code != blockExitCodeInterrupt {
-			t.Errorf("ExitCode: %d, want %d", code, blockExitCodeInterrupt)
-		}
-	}))
-
+	var suffix string
+runTests:
 	for i, tc := range containerTestCases {
-		t.Run(tc.name, func(t *testing.T) {
+		_suffix := suffix
+		t.Run(tc.name+_suffix, func(t *testing.T) {
 			t.Parallel()
 
 			wantOps, wantOpsCtx := tc.ops(t)
@@ -464,6 +437,8 @@ func TestContainer(t *testing.T) {
 			c.SeccompDisable = !tc.filter
 			c.RetainSession = tc.session
 			c.HostNet = tc.net
+			c.InitAsRoot = _suffix != ""
+			c.Env = append(c.Env, "HAKUREI_TEST_SUFFIX="+_suffix)
 			if info.CanDegrade {
 				if _, err := landlock.GetABI(); err != nil {
 					if !errors.Is(err, syscall.ENOSYS) {
@@ -473,6 +448,9 @@ func TestContainer(t *testing.T) {
 					t.Log("Landlock LSM is unavailable, enabling HostAbstract")
 				}
 			}
+			if c.InitAsRoot {
+				c.SeccompPresets &= ^std.PresetDenyNS
+			}
 
 			c.
 				Readonly(check.MustAbs(pathReadonly), 0755).
@@ -541,6 +519,11 @@ func TestContainer(t *testing.T) {
 			}
 		})
 	}
+
+	if suffix == "" {
+		suffix = " as root"
+		goto runTests
+	}
 }
 
 func ent(root, target, vfsOptstr, fsType, source, fsOptstr string) *vfs.MountInfoEntry {
@@ -563,49 +546,118 @@ func hostnameFromTestCase(name string) string {
 }
 
 func testContainerCancel(
+	t *testing.T,
 	containerExtra func(c *container.Container),
-	waitCheck func(t *testing.T, c *container.Container),
-) func(t *testing.T) {
-	return func(t *testing.T) {
-		t.Parallel()
-		ctx, cancel := context.WithCancel(t.Context())
+	waitCheck func(ps *os.ProcessState, waitErr error),
+) {
+	ctx, cancel := context.WithCancel(t.Context())
 
-		c := helperNewContainer(ctx, "block")
-		c.Stdout, c.Stderr = os.Stdout, os.Stderr
-		if containerExtra != nil {
-			containerExtra(c)
-		}
-
-		ready := make(chan struct{})
-		if r, w, err := os.Pipe(); err != nil {
-			t.Fatalf("cannot pipe: %v", err)
-		} else {
-			c.ExtraFiles = append(c.ExtraFiles, w)
-			go func() {
-				defer close(ready)
-				if _, err = r.Read(make([]byte, 1)); err != nil {
-					panic(err.Error())
-				}
-			}()
-		}
-
-		if err := c.Start(); err != nil {
-			if m, ok := container.InternalMessageFromError(err); ok {
-				t.Fatal(m)
-			} else {
-				t.Fatalf("cannot start container: %v", err)
-			}
-		} else if err = c.Serve(); err != nil {
-			if m, ok := container.InternalMessageFromError(err); ok {
-				t.Error(m)
-			} else {
-				t.Errorf("cannot serve setup params: %v", err)
-			}
-		}
-		<-ready
-		cancel()
-		waitCheck(t, c)
+	c := helperNewContainer(ctx, "block")
+	c.Stdout, c.Stderr = os.Stdout, os.Stderr
+	if containerExtra != nil {
+		containerExtra(c)
 	}
+
+	ready := make(chan struct{})
+	var waitErr error
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("cannot pipe: %v", err)
+	}
+
+	c.ExtraFiles = append(c.ExtraFiles, w)
+	go func() {
+		defer close(ready)
+		if _, _err := r.Read(make([]byte, 1)); _err != nil {
+			panic(_err)
+		}
+	}()
+
+	if err = c.Start(); err != nil {
+		if m, ok := container.InternalMessageFromError(err); ok {
+			t.Fatal(m)
+		} else {
+			t.Fatalf("cannot start container: %v", err)
+		}
+	}
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		waitErr = c.Wait()
+		_ = r.SetReadDeadline(time.Now())
+	}()
+
+	if err = c.Serve(); err != nil {
+		if m, ok := container.InternalMessageFromError(err); ok {
+			t.Error(m)
+		} else {
+			t.Errorf("cannot serve setup params: %v", err)
+		}
+	}
+	<-ready
+	cancel()
+	<-done
+	waitCheck(c.ProcessState(), waitErr)
+}
+
+func TestForward(t *testing.T) {
+	t.Parallel()
+
+	f := func(ps *os.ProcessState, waitErr error) {
+		var exitError *exec.ExitError
+		if !errors.As(waitErr, &exitError) {
+			if m, ok := container.InternalMessageFromError(waitErr); ok {
+				t.Error(m)
+			}
+			t.Errorf("Wait: error = %v", waitErr)
+		}
+		if code := exitError.ExitCode(); code != blockExitCodeInterrupt {
+			t.Errorf("ExitCode: %d, want %d", code, blockExitCodeInterrupt)
+		}
+	}
+	t.Run("direct", func(t *testing.T) {
+		t.Parallel()
+		testContainerCancel(t, func(c *container.Container) {
+			c.ForwardCancel = true
+		}, f)
+	})
+	t.Run("as root", func(t *testing.T) {
+		testContainerCancel(t, func(c *container.Container) {
+			c.ForwardCancel = true
+			c.InitAsRoot = true
+			c.Proc(fhs.AbsProc)
+		}, f)
+	})
+}
+
+func TestCancel(t *testing.T) {
+	t.Parallel()
+
+	f := func(ps *os.ProcessState, waitErr error) {
+		wantErr := context.Canceled
+		if !reflect.DeepEqual(waitErr, wantErr) {
+			if m, ok := container.InternalMessageFromError(waitErr); ok {
+				t.Error(m)
+			}
+			t.Errorf("Wait: error = %#v, want %#v", waitErr, wantErr)
+		}
+		if ps == nil {
+			t.Errorf("ProcessState unexpectedly returned nil")
+		} else if code := ps.ExitCode(); code != 0 {
+			t.Errorf("ExitCode: %d, want %d", code, 0)
+		}
+	}
+	t.Run("direct", func(t *testing.T) {
+		t.Parallel()
+		testContainerCancel(t, nil, f)
+	})
+	t.Run("as root", func(t *testing.T) {
+		testContainerCancel(t, func(c *container.Container) {
+			c.InitAsRoot = true
+			c.Proc(fhs.AbsProc)
+		}, f)
+	})
 }
 
 func TestContainerString(t *testing.T) {
@@ -641,6 +693,8 @@ func init() {
 		})
 
 		c.Command("container", command.UsageInternal, func(args []string) error {
+			asRoot := os.Getenv("HAKUREI_TEST_SUFFIX") == " as root"
+
 			if len(args) != 1 {
 				return syscall.EINVAL
 			}
@@ -658,6 +712,66 @@ func init() {
 				return fmt.Errorf("gid: %d, want %d", gid, tc.gid)
 			}
 
+			// no attack surface increase during as root due to no_new_privs
+			var wantBounding uintptr = 1
+			asRootNot := " not"
+			if !asRoot {
+				wantBounding = 0
+				asRootNot = ""
+			}
+
+			const (
+				PR_CAP_AMBIENT        = 0x2f
+				PR_CAP_AMBIENT_IS_SET = 0x1
+			)
+			for i := range container.LastCap(nil) + 1 {
+				r, _, errno := syscall.Syscall(
+					syscall.SYS_PRCTL,
+					PR_CAP_AMBIENT,
+					PR_CAP_AMBIENT_IS_SET,
+					i,
+				)
+				if errno != 0 {
+					return os.NewSyscallError("prctl", errno)
+				}
+				if r != 0 {
+					return fmt.Errorf("capability %d in ambient set", i)
+				}
+
+				r, _, errno = syscall.Syscall(
+					syscall.SYS_PRCTL,
+					syscall.PR_CAPBSET_READ,
+					i,
+					0,
+				)
+				if errno != 0 {
+					return os.NewSyscallError("prctl", errno)
+				}
+				if r != wantBounding {
+					return fmt.Errorf("capability %d%s in bounding set", i, asRootNot)
+				}
+			}
+
+			const _LINUX_CAPABILITY_VERSION_3 = 0x20080522
+			var capData struct {
+				effective   uint32
+				permitted   uint32
+				inheritable uint32
+			}
+			if _, _, errno := syscall.Syscall(syscall.SYS_CAPGET, uintptr(unsafe.Pointer(&struct {
+				version uint32
+				pid     int32
+			}{_LINUX_CAPABILITY_VERSION_3, 0})), uintptr(unsafe.Pointer(&capData)), 0); errno != 0 {
+				return os.NewSyscallError("capget", errno)
+			}
+
+			if max(capData.effective, capData.permitted, capData.inheritable) != 0 {
+				return fmt.Errorf(
+					"effective = %d, permitted = %d, inheritable = %d",
+					capData.effective, capData.permitted, capData.inheritable,
+				)
+			}
+
 			wantHost := hostnameFromTestCase(tc.name)
 			if host, err := os.Hostname(); err != nil {
 				return fmt.Errorf("cannot get hostname: %v", err)
@@ -775,7 +889,7 @@ func TestMain(m *testing.M) {
 		}
 		c.MustParse(os.Args[1:], func(err error) {
 			if err != nil {
-				log.Fatal(err.Error())
+				log.Fatal(err)
 			}
 		})
 		return

container/init.go

@@ -11,11 +11,13 @@ import (
 	"path/filepath"
 	"slices"
 	"strconv"
+	"strings"
 	"sync"
 	"sync/atomic"
 	. "syscall"
 	"time"
 
+	"hakurei.app/check"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/ext"
 	"hakurei.app/fhs"
@@ -182,23 +184,33 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		cancel()
 	}
 
+	uid, gid := param.Uid, param.Gid
+	if param.InitAsRoot {
+		uid, gid = 0, 0
+	}
+
 	// write uid/gid map here so parent does not need to set dumpable
 	if err := k.setDumpable(ext.SUID_DUMP_USER); err != nil {
 		k.fatalf(msg, "cannot set SUID_DUMP_USER: %v", err)
 	}
-	if err := k.writeFile(fhs.Proc+"self/uid_map",
-		append([]byte{}, strconv.Itoa(param.Uid)+" "+strconv.Itoa(param.HostUid)+" 1\n"...),
-		0); err != nil {
+	if err := k.writeFile(
+		fhs.Proc+"self/uid_map",
+		[]byte(strconv.Itoa(uid)+" "+strconv.Itoa(param.HostUid)+" 1\n"),
+		0,
+	); err != nil {
 		k.fatalf(msg, "%v", err)
 	}
-	if err := k.writeFile(fhs.Proc+"self/setgroups",
+	if err := k.writeFile(
+		fhs.Proc+"self/setgroups",
 		[]byte("deny\n"),
-		0); err != nil && !os.IsNotExist(err) {
+		0,
+	); err != nil && !os.IsNotExist(err) {
 		k.fatalf(msg, "%v", err)
 	}
 	if err := k.writeFile(fhs.Proc+"self/gid_map",
-		append([]byte{}, strconv.Itoa(param.Gid)+" "+strconv.Itoa(param.HostGid)+" 1\n"...),
-		0); err != nil {
+		[]byte(strconv.Itoa(gid)+" "+strconv.Itoa(param.HostGid)+" 1\n"),
+		0,
+	); err != nil {
 		k.fatalf(msg, "%v", err)
 	}
 	if err := k.setDumpable(ext.SUID_DUMP_DISABLE); err != nil {
@@ -230,6 +242,16 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		k.fatalf(msg, "cannot enter intermediate host path: %v", err)
 	}
 
+	if len(param.Binfmt) > 0 {
+		for i, e := range param.Binfmt {
+			if pathname, err := k.evalSymlinks(e.Interpreter.String()); err != nil {
+				k.fatal(msg, err)
+			} else if param.Binfmt[i].Interpreter, err = check.NewAbs(pathname); err != nil {
+				k.fatal(msg, err)
+			}
+		}
+	}
+
 	/* early is called right before pivot_root into intermediate root;
 	this step is mostly for gathering information that would otherwise be
 	difficult to obtain via library functions after pivot_root, and
@@ -285,6 +307,48 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		}
 	}
 
+	if len(param.Binfmt) > 0 {
+		const interpreter = "/interpreter"
+
+		if param.BinfmtPath == nil {
+			param.BinfmtPath = fhs.AbsProcSys.Append("fs/binfmt_misc")
+		}
+		binfmt := sysrootPath + param.BinfmtPath.String()
+		if err := k.mkdirAll(binfmt, 0); err != nil {
+			k.fatal(msg, err)
+		}
+		if err := k.mount(
+			SourceBinfmtMisc,
+			binfmt,
+			FstypeBinfmtMisc,
+			MS_NOSUID|MS_NOEXEC|MS_NODEV,
+			zeroString,
+		); err != nil {
+			k.fatal(msg, err)
+		}
+
+		var buf strings.Builder
+		buf.Grow(1920)
+
+		register := binfmt + "/register"
+		for i, e := range param.Binfmt {
+			if err := k.symlink(hostPath+e.Interpreter.String(), interpreter); err != nil {
+				k.fatal(msg, err)
+			} else if err = k.writeFile(register, []byte(":"+
+				strconv.Itoa(i)+":"+
+				"M:"+
+				strconv.Itoa(int(e.Offset))+":"+
+				escapeBinfmt(&buf, e.Magic)+":"+
+				escapeBinfmt(&buf, e.Mask)+":"+
+				interpreter+":"+
+				"F"), 0); err != nil {
+				k.fatal(msg, err)
+			} else if err = k.remove(interpreter); err != nil {
+				k.fatal(msg, err)
+			}
+		}
+	}
+
 	// setup requiring host root complete at this point
 	if err := k.mount(hostDir, hostDir, zeroString, MS_SILENT|MS_REC|MS_PRIVATE, zeroString); err != nil {
 		k.fatalf(msg, "cannot make host root rprivate: %v", optionalErrorUnwrap(err))
@@ -323,11 +387,19 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		}
 	}
 
+	var keepCaps []uintptr
+	if param.Privileged {
+		keepCaps = append(keepCaps, CAP_SYS_ADMIN, CAP_SETPCAP)
+	}
+	if param.InitAsRoot {
+		keepCaps = append(keepCaps, CAP_SETFCAP)
+	}
+
 	if err := k.capAmbientClearAll(); err != nil {
 		k.fatalf(msg, "cannot clear the ambient capability set: %v", err)
 	}
-	for i := uintptr(0); i <= lastcap; i++ {
-		if param.Privileged && i == CAP_SYS_ADMIN {
+	for i := range lastcap + 1 {
+		if slices.Contains(keepCaps, i) {
 			continue
 		}
 		if err := k.capBoundingSetDrop(i); err != nil {
@@ -336,20 +408,23 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	}
 
 	var keep [2]uint32
-	if param.Privileged {
-		keep[capToIndex(CAP_SYS_ADMIN)] |= capToMask(CAP_SYS_ADMIN)
-
-		if err := k.capAmbientRaise(CAP_SYS_ADMIN); err != nil {
-			k.fatalf(msg, "cannot raise CAP_SYS_ADMIN: %v", err)
-		}
+	for _, c := range keepCaps {
+		keep[capToIndex(c)] |= capToMask(c)
 	}
+
 	if err := k.capset(
 		&capHeader{_LINUX_CAPABILITY_VERSION_3, 0},
-		&[2]capData{{0, keep[0], keep[0]}, {0, keep[1], keep[1]}},
+		&[2]capData{{keep[0], keep[0], keep[0]}, {keep[1], keep[1], keep[1]}},
 	); err != nil {
 		k.fatalf(msg, "cannot capset: %v", err)
 	}
 
+	for _, c := range keepCaps {
+		if err := k.capAmbientRaise(c); err != nil {
+			k.fatalf(msg, "cannot raise %#x: %v", c, err)
+		}
+	}
+
 	if !param.SeccompDisable {
 		rules := param.SeccompRules
 		if len(rules) == 0 { // non-empty rules slice always overrides presets
@@ -474,6 +549,14 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	cmd.ExtraFiles = extraFiles
 	cmd.Dir = param.Dir.String()
 
+	if param.InitAsRoot {
+		cmd.SysProcAttr = &SysProcAttr{
+			Cloneflags:  CLONE_NEWUSER,
+			UidMappings: []SysProcIDMap{{ContainerID: param.Uid, HostID: 0, Size: 1}},
+			GidMappings: []SysProcIDMap{{ContainerID: param.Gid, HostID: 0, Size: 1}},
+		}
+	}
+
 	msg.Verbosef("starting initial process %s", param.Path)
 	if err := k.start(cmd); err != nil {
 		k.fatalf(msg, "%v", err)

container/init_test.go

@@ -1624,7 +1624,6 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x5)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x6)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x7)}, nil, nil),
-				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x9)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xa)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xb)}, nil, nil),
@@ -1656,8 +1655,9 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x26)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x27)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x28)}, nil, nil),
+				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0x200100, 0x200100, 0x200100}, {0, 0, 0}}}, nil, nil),
 				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x15)}, nil, stub.UniqueError(19)),
-				call("fatalf", stub.ExpectArgs{"cannot raise CAP_SYS_ADMIN: %v", []any{stub.UniqueError(19)}}, nil, nil),
+				call("fatalf", stub.ExpectArgs{"cannot raise %#x: %v", []any{uintptr(0x15), stub.UniqueError(19)}}, nil, nil),
 			},
 		}, nil},
 
@@ -1731,7 +1731,6 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x5)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x6)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x7)}, nil, nil),
-				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x9)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xa)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xb)}, nil, nil),
@@ -1763,8 +1762,7 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x26)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x27)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x28)}, nil, nil),
-				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x15)}, nil, nil),
-				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0, 0x200000, 0x200000}, {0, 0, 0}}}, nil, stub.UniqueError(17)),
+				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0x200100, 0x200100, 0x200100}, {0, 0, 0}}}, nil, stub.UniqueError(17)),
 				call("fatalf", stub.ExpectArgs{"cannot capset: %v", []any{stub.UniqueError(17)}}, nil, nil),
 			},
 		}, nil},
@@ -1839,7 +1837,6 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x5)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x6)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x7)}, nil, nil),
-				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x9)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xa)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xb)}, nil, nil),
@@ -1871,8 +1868,9 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x26)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x27)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x28)}, nil, nil),
+				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0x200100, 0x200100, 0x200100}, {0, 0, 0}}}, nil, nil),
 				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x15)}, nil, nil),
-				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0, 0x200000, 0x200000}, {0, 0, 0}}}, nil, nil),
+				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"resolving presets %#x", []any{std.FilterPreset(0xf)}}, nil, nil),
 				call("seccompLoad", stub.ExpectArgs{seccomp.Preset(0xf, 0), seccomp.ExportFlag(0)}, nil, stub.UniqueError(15)),
 				call("fatalf", stub.ExpectArgs{"cannot load syscall filter: %v", []any{stub.UniqueError(15)}}, nil, nil),
@@ -2699,7 +2697,6 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x5)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x6)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x7)}, nil, nil),
-				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x9)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xa)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xb)}, nil, nil),
@@ -2731,8 +2728,9 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x26)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x27)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x28)}, nil, nil),
+				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0x200100, 0x200100, 0x200100}, {0, 0, 0}}}, nil, nil),
 				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x15)}, nil, nil),
-				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0, 0x200000, 0x200000}, {0, 0, 0}}}, nil, nil),
+				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"resolving presets %#x", []any{std.FilterPreset(0xf)}}, nil, nil),
 				call("seccompLoad", stub.ExpectArgs{seccomp.Preset(0xf, 0), seccomp.ExportFlag(0)}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"%d filter rules loaded", []any{73}}, nil, nil),

container/mount.go

@@ -40,6 +40,9 @@ const (
 	// SourceMqueue is used when mounting mqueue.
 	// Note that any source value is allowed when fstype is [FstypeMqueue].
 	SourceMqueue = "mqueue"
+	// SourceBinfmtMisc is used when mounting binfmt_misc.
+	// Note that any source value is allowed when fstype is [SourceBinfmtMisc].
+	SourceBinfmtMisc = "binfmt_misc"
 	// SourceOverlay is used when mounting overlay.
 	// Note that any source value is allowed when fstype is [FstypeOverlay].
 	SourceOverlay = "overlay"
@@ -70,6 +73,9 @@ const (
 	// FstypeMqueue represents the mqueue pseudo-filesystem.
 	// This filesystem type is usually mounted on /dev/mqueue.
 	FstypeMqueue = "mqueue"
+	// FstypeBinfmtMisc represents the binfmt_misc pseudo-filesystem.
+	// This filesystem type is usually mounted on /proc/sys/fs/binfmt_misc.
+	FstypeBinfmtMisc = "binfmt_misc"
 	// FstypeOverlay represents the overlay pseudo-filesystem.
 	// This filesystem type can be mounted anywhere in the container filesystem.
 	FstypeOverlay = "overlay"

fhs/abs.go

@@ -42,6 +42,8 @@ var (
 	AbsDevShm = unsafeAbs(DevShm)
 	// AbsProc is [Proc] as [check.Absolute].
 	AbsProc = unsafeAbs(Proc)
+	// AbsProcSys is [ProcSys] as [check.Absolute].
+	AbsProcSys = unsafeAbs(ProcSys)
 	// AbsProcSelfExe is [ProcSelfExe] as [check.Absolute].
 	AbsProcSelfExe = unsafeAbs(ProcSelfExe)
 	// AbsSys is [Sys] as [check.Absolute].

internal/pkg/exec.go

@@ -9,8 +9,10 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"slices"
 	"strconv"
+	"sync"
 	"syscall"
 	"time"
 	"unique"
@@ -94,6 +96,32 @@ func MustPath(pathname string, writable bool, a ...Artifact) ExecPath {
 	return ExecPath{check.MustAbs(pathname), a, writable}
 }
 
+var (
+	binfmt   map[string]container.BinfmtEntry
+	binfmtMu sync.RWMutex
+)
+
+// RegisterArch arranges for [KindExec] and [KindExecNet] to support a new
+// architecture via a binfmt_misc entry. Each architecture must be registered
+// at most once.
+func RegisterArch(arch string, e container.BinfmtEntry) {
+	if arch == "" {
+		panic(UnsupportedArchError(arch))
+	}
+
+	binfmtMu.Lock()
+	defer binfmtMu.Unlock()
+
+	if binfmt == nil {
+		binfmt = make(map[string]container.BinfmtEntry)
+	}
+
+	if _, ok := binfmt[arch]; ok {
+		panic("attempting to register " + strconv.Quote(arch) + " twice")
+	}
+	binfmt[arch] = e
+}
+
 const (
 	// ExecTimeoutDefault replaces out of range [NewExec] timeout values.
 	ExecTimeoutDefault = 15 * time.Minute
@@ -110,6 +138,8 @@ type execArtifact struct {
 	// Caller-supplied user-facing reporting name, guaranteed to be nonzero
 	// during initialisation.
 	name string
+	// Target architecture.
+	arch string
 	// Caller-supplied inner mount points.
 	paths []ExecPath
 
@@ -132,28 +162,40 @@ type execArtifact struct {
 
 var _ fmt.Stringer = new(execArtifact)
 
-// execNetArtifact is like execArtifact but implements [KnownChecksum] and has
-// its resulting container keep the host net namespace.
-type execNetArtifact struct {
+// execMeasuredArtifact is like execArtifact but implements [KnownChecksum] and
+// has its resulting container optionally keep the host net namespace.
+type execMeasuredArtifact struct {
 	checksum Checksum
 
+	// Whether to keep host net namespace.
+	hostNet bool
+
 	execArtifact
 }
 
-var _ KnownChecksum = new(execNetArtifact)
+var _ KnownChecksum = new(execMeasuredArtifact)
 
 // Checksum returns the caller-supplied checksum.
-func (a *execNetArtifact) Checksum() Checksum { return a.checksum }
+func (a *execMeasuredArtifact) Checksum() Checksum { return a.checksum }
 
-// Kind returns the hardcoded [Kind] constant.
-func (*execNetArtifact) Kind() Kind { return KindExecNet }
+// Kind returns [KindExecNet], or [KindExec] if hostNet is false.
+func (a *execMeasuredArtifact) Kind() Kind {
+	if a == nil || a.hostNet {
+		return KindExecNet
+	}
+	return KindExec
+}
 
 // Cure cures the [Artifact] in the container described by the caller. The
-// container retains host networking.
-func (a *execNetArtifact) Cure(f *FContext) error {
-	return a.cure(f, true)
+// container optionally retains host networking.
+func (a *execMeasuredArtifact) Cure(f *FContext) error {
+	return a.cure(f, a.hostNet)
 }
 
+// ErrNetChecksum is panicked by [NewExec] if host net namespace is requested
+// with a nil checksum.
+var ErrNetChecksum = errors.New("attempting to keep net namespace without checksum")
+
 // NewExec returns a new [Artifact] that executes the program path in a
 // container with specified paths bind mounted read-only in order. A private
 // instance of /proc and /dev is made available to the container.
@@ -167,7 +209,7 @@ func (a *execNetArtifact) Cure(f *FContext) error {
 // regular or symlink.
 //
 // If checksum is non-nil, the resulting [Artifact] implements [KnownChecksum]
-// and its container runs in the host net namespace.
+// and its container optionally runs in the host net namespace.
 //
 // The container is allowed to run for the specified duration before the initial
 // process and all processes originating from it is terminated. A zero or
@@ -178,10 +220,10 @@ func (a *execNetArtifact) Cure(f *FContext) error {
 // container and does not affect curing outcome. Because of this, it is omitted
 // from parameter data for computing identifier.
 func NewExec(
-	name string,
+	name, arch string,
 	checksum *Checksum,
 	timeout time.Duration,
-	exclusive bool,
+	hostNet, exclusive bool,
 
 	dir *check.Absolute,
 	env []string,
@@ -193,17 +235,23 @@ func NewExec(
 	if name == "" {
 		name = "exec-" + filepath.Base(pathname.String())
 	}
+	if arch == "" {
+		arch = runtime.GOARCH
+	}
 	if timeout <= 0 {
 		timeout = ExecTimeoutDefault
 	}
 	if timeout > ExecTimeoutMax {
 		timeout = ExecTimeoutMax
 	}
-	a := execArtifact{name, paths, dir, env, pathname, args, timeout, exclusive}
+	a := execArtifact{name, arch, paths, dir, env, pathname, args, timeout, exclusive}
 	if checksum == nil {
+		if hostNet {
+			panic(ErrNetChecksum)
+		}
 		return &a
 	}
-	return &execNetArtifact{*checksum, a}
+	return &execMeasuredArtifact{*checksum, hostNet, a}
 }
 
 // Kind returns the hardcoded [Kind] constant.
@@ -211,6 +259,7 @@ func (*execArtifact) Kind() Kind { return KindExec }
 
 // Params writes paths, executable pathname and args.
 func (a *execArtifact) Params(ctx *IContext) {
+	ctx.WriteString(a.arch)
 	ctx.WriteString(a.name)
 
 	ctx.WriteUint32(uint32(len(a.paths)))
@@ -257,11 +306,26 @@ func (a *execArtifact) Params(ctx *IContext) {
 	}
 }
 
+// UnsupportedArchError describes an unsupported or invalid architecture.
+type UnsupportedArchError string
+
+func (e UnsupportedArchError) Error() string {
+	if e == "" {
+		return "invalid architecture name"
+	}
+	return "unsupported architecture " + string(e)
+}
+
 // readExecArtifact interprets IR values and returns the address of execArtifact
 // or execNetArtifact.
 func readExecArtifact(r *IRReader, net bool) Artifact {
 	r.DiscardAll()
 
+	arch := r.ReadString()
+	if arch == "" {
+		panic(UnsupportedArchError(arch))
+	}
+
 	name := r.ReadString()
 
 	sz := r.ReadUint32()
@@ -312,22 +376,17 @@ func readExecArtifact(r *IRReader, net bool) Artifact {
 	exclusive := r.ReadUint32() != 0
 
 	checksum, ok := r.Finalise()
-
 	var checksumP *Checksum
-	if net {
-		if !ok {
-			panic(ErrExpectedChecksum)
-		}
-		checksumVal := checksum.Value()
-		checksumP = &checksumVal
-	} else {
-		if ok {
-			panic(ErrUnexpectedChecksum)
-		}
+	if ok {
+		checksumP = new(checksum.Value())
+	}
+
+	if net && !ok {
+		panic(ErrExpectedChecksum)
 	}
 
 	return NewExec(
-		name, checksumP, timeout, exclusive, dir, env, pathname, args, paths...,
+		name, arch, checksumP, timeout, net, exclusive, dir, env, pathname, args, paths...,
 	)
 }
 
@@ -442,6 +501,17 @@ func (a *execArtifact) makeContainer(
 	z.Env = slices.Concat(a.env, []string{EnvJobs + "=" + strconv.Itoa(jobs)})
 	z.Grow(len(a.paths) + 4)
 
+	if a.arch != runtime.GOARCH {
+		binfmtMu.RLock()
+		e, ok := binfmt[a.arch]
+		binfmtMu.RUnlock()
+		if !ok {
+			return nil, UnsupportedArchError(a.arch)
+		}
+		z.Binfmt = []container.BinfmtEntry{e}
+		z.InitAsRoot = true
+	}
+
 	for i, b := range a.paths {
 		if i == overlayWorkIndex {
 			if err = os.MkdirAll(work.String(), 0700); err != nil {
@@ -528,9 +598,9 @@ func (c *Cache) EnterExec(
 	case *execArtifact:
 		e = f
 
-	case *execNetArtifact:
+	case *execMeasuredArtifact:
 		e = &f.execArtifact
-		hostNet = true
+		hostNet = f.hostNet
 
 	default:
 		return ErrNotExec
@@ -631,12 +701,6 @@ func (a *execArtifact) cure(f *FContext, hostNet bool) (err error) {
 			_ = stdout.Close()
 			return
 		}
-		defer func() {
-			if err != nil && !errors.As(err, new(*exec.ExitError)) {
-				_ = stdout.Close()
-				_ = stderr.Close()
-			}
-		}()
 
 		brStdout, brStderr := f.cache.getReader(stdout), f.cache.getReader(stderr)
 		stdoutDone, stderrDone := make(chan struct{}), make(chan struct{})
@@ -651,6 +715,11 @@ func (a *execArtifact) cure(f *FContext, hostNet bool) (err error) {
 			io.TeeReader(brStderr, status),
 		)
 		defer func() {
+			if err != nil && !errors.As(err, new(*exec.ExitError)) {
+				_ = stdout.Close()
+				_ = stderr.Close()
+			}
+
 			<-stdoutDone
 			<-stderrDone
 			f.cache.putReader(brStdout)

internal/pkg/exec_test.go

@@ -1,6 +1,7 @@
 package pkg_test
 
 import (
+	"bytes"
 	_ "embed"
 	"encoding/gob"
 	"errors"
@@ -8,12 +9,14 @@ import (
 	"net"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"slices"
 	"testing"
-	"unique"
 
 	"hakurei.app/check"
+	"hakurei.app/container"
 	"hakurei.app/hst"
+	"hakurei.app/internal/info"
 	"hakurei.app/internal/pkg"
 	"hakurei.app/internal/stub"
 
@@ -27,6 +30,17 @@ import (
 //go:embed internal/testtool/testtool
 var testtoolBin []byte
 
+func init() {
+	pathname, err := filepath.Abs("internal/testtool/testtool")
+	if err != nil {
+		panic(err)
+	}
+	pkg.RegisterArch("cafe", container.BinfmtEntry{
+		Magic:       expected.Magic,
+		Interpreter: check.MustAbs(pathname),
+	})
+}
+
 func TestExec(t *testing.T) {
 	t.Parallel()
 
@@ -36,14 +50,21 @@ func TestExec(t *testing.T) {
 		"check": {Mode: 0400, Data: []byte{0}},
 	}
 	wantOfflineEncode := pkg.Encode(wantOffline.hash())
+	failingArtifact := &stubArtifact{
+		kind:   pkg.KindTar,
+		params: []byte("doomed artifact"),
+		cure: func(t *pkg.TContext) error {
+			return stub.UniqueError(0xcafe)
+		},
+	}
 
 	checkWithCache(t, []cacheTestCase{
-		{"offline", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
+		{"offline", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-offline", nil, 0, false,
+					"exec-offline", "", new(wantOffline.hash()), 0, false, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -65,31 +86,47 @@ func TestExec(t *testing.T) {
 					pkg.MustPath("/opt", false, testtool),
 				), ignorePathname, wantOffline, nil},
 
-				{"error passthrough", pkg.NewExec(
-					"", nil, 0, true,
+				{"substitution", pkg.NewExec(
+					"exec-offline", "", new(wantOffline.hash()), 0, false, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1"},
 					check.MustAbs("/opt/bin/testtool"),
 					[]string{"testtool"},
 
-					pkg.MustPath("/proc/nonexistent", false, &stubArtifact{
+					pkg.MustPath("/file", false, newStubFile(
+						pkg.KindHTTPGet,
+						pkg.ID{0xfe, 0},
+						nil,
+						nil, nil,
+					)),
+					// substitution miss fails in testtool due to differing idents
+					pkg.MustPath("/.hakurei", false, &stubArtifact{
 						kind:   pkg.KindTar,
-						params: []byte("doomed artifact"),
+						params: []byte("empty directory (substituted)"),
 						cure: func(t *pkg.TContext) error {
-							return stub.UniqueError(0xcafe)
+							return os.MkdirAll(t.GetWorkDir().String(), 0700)
 						},
 					}),
+					pkg.MustPath("/opt", false, testtool),
+				), ignorePathname, wantOffline, nil},
+
+				{"error passthrough", pkg.NewExec(
+					"", "", nil, 0, false, true,
+					pkg.AbsWork,
+					[]string{"HAKUREI_TEST=1"},
+					check.MustAbs("/opt/bin/testtool"),
+					[]string{"testtool"},
+
+					pkg.MustPath("/proc/nonexistent", false, failingArtifact),
 				), nil, nil, &pkg.DependencyCureError{
 					{
-						Ident: unique.Make(pkg.ID(pkg.MustDecode(
-							"Sowo6oZRmG6xVtUaxB6bDWZhVsqAJsIJWUp0OPKlE103cY0lodx7dem8J-qQF0Z1",
-						))),
+						A:   failingArtifact,
 						Err: stub.UniqueError(0xcafe),
 					},
 				}},
 
 				{"invalid paths", pkg.NewExec(
-					"", nil, 0, false,
+					"", "", nil, 0, false, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -100,18 +137,41 @@ func TestExec(t *testing.T) {
 			})
 
 			// check init failure passthrough
-			var exitError *exec.ExitError
-			if _, _, err := c.Cure(pkg.NewExec(
-				"", nil, 0, false,
+			initFailureArtifact := pkg.NewExec(
+				"", "", nil, 0, false, false,
 				pkg.AbsWork,
 				nil,
 				check.MustAbs("/opt/bin/testtool"),
 				[]string{"testtool"},
-			)); !errors.As(err, &exitError) ||
+			)
+			var exitError *exec.ExitError
+			if _, _, err := c.Cure(initFailureArtifact); !errors.As(err, &exitError) ||
 				exitError.ExitCode() != hst.ExitFailure {
 				t.Fatalf("Cure: error = %v, want init exit status 1", err)
 			}
 
+			var faultStatus []byte
+			if faults, err := c.ReadFaults(initFailureArtifact); err != nil {
+				t.Fatal(err)
+			} else if len(faults) != 1 {
+				t.Fatalf("ReadFaults: %v", faults)
+			} else if faultStatus, err = os.ReadFile(faults[0].String()); err != nil {
+				t.Fatal(err)
+			} else if err = faults[0].Destroy(); err != nil {
+				t.Fatal(err)
+			} else {
+				t.Logf("destroyed expected fault at %s", faults[0].Time().UTC())
+			}
+
+			if !bytes.HasPrefix(faultStatus, []byte(
+				"internal/pkg ",
+			)) || !bytes.Contains(faultStatus, []byte(
+				"\ninit: fork/exec /opt/bin/testtool: no such file or directory\n",
+			)) {
+				t.Errorf("unexpected status:\n%s", string(faultStatus))
+			}
+
+			destroyStatus(t, base, 2, 1)
 			testtoolDestroy(t, base, c)
 		}, expectsFS{
 			".": {Mode: fs.ModeDir | 0700},
@@ -123,15 +183,19 @@ func TestExec(t *testing.T) {
 			"checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb": {Mode: 0400, Data: []byte{}},
 
 			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/IY91PCtOpCYy21AaIK0c9f8-Z6fb2_2ewoHWkt4dxoLf0GOrWqS8yAGFLV84b1Dw": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
+			"identifier/QwS7SmiatdqryQYgESdGw7Yw2PcpNf0vNfpvUA0t92BTlKiUjfCrXyMW17G2X77X": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
 			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
 			"identifier/" + expected.Offline:                                              {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
 			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
 
+			"substitute": {Mode: fs.ModeDir | 0700},
+
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
 		}},
 
-		{"net", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
+		{"net", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			wantNet := expectsFS{
@@ -141,7 +205,7 @@ func TestExec(t *testing.T) {
 			}
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-net", new(wantNet.hash()), 0, false,
+					"exec-net", "", new(wantNet.hash()), 0, true, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -164,6 +228,7 @@ func TestExec(t *testing.T) {
 				), ignorePathname, wantNet, nil},
 			})
 
+			destroyStatus(t, base, 2, 0)
 			testtoolDestroy(t, base, c)
 		}, expectsFS{
 			".": {Mode: fs.ModeDir | 0700},
@@ -179,16 +244,18 @@ func TestExec(t *testing.T) {
 			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
 			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
 
+			"substitute": {Mode: fs.ModeDir | 0700},
+
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
 		}},
 
-		{"overlay root", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
+		{"overlay root", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-overlay-root", nil, 0, false,
+					"exec-overlay-root", "", nil, 0, false, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1", "HAKUREI_ROOT=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -205,6 +272,7 @@ func TestExec(t *testing.T) {
 				), ignorePathname, wantOffline, nil},
 			})
 
+			destroyStatus(t, base, 2, 0)
 			testtoolDestroy(t, base, c)
 		}, expectsFS{
 			".": {Mode: fs.ModeDir | 0700},
@@ -218,16 +286,18 @@ func TestExec(t *testing.T) {
 			"identifier/" + expected.OvlRoot: {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
 			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
 
+			"substitute": {Mode: fs.ModeDir | 0700},
+
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
 		}},
 
-		{"overlay work", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
+		{"overlay work", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-overlay-work", nil, 0, false,
+					"exec-overlay-work", "", nil, 0, false, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1", "HAKUREI_ROOT=1"},
 					check.MustAbs("/work/bin/testtool"),
@@ -249,6 +319,7 @@ func TestExec(t *testing.T) {
 				), ignorePathname, wantOffline, nil},
 			})
 
+			destroyStatus(t, base, 2, 0)
 			testtoolDestroy(t, base, c)
 		}, expectsFS{
 			".": {Mode: fs.ModeDir | 0700},
@@ -262,16 +333,18 @@ func TestExec(t *testing.T) {
 			"identifier/" + expected.Work: {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
 			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
 
+			"substitute": {Mode: fs.ModeDir | 0700},
+
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
 		}},
 
-		{"multiple layers", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
+		{"multiple layers", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-multiple-layers", nil, 0, false,
+					"exec-multiple-layers", "", nil, 0, false, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1", "HAKUREI_ROOT=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -315,6 +388,7 @@ func TestExec(t *testing.T) {
 				), ignorePathname, wantOffline, nil},
 			})
 
+			destroyStatus(t, base, 2, 0)
 			testtoolDestroy(t, base, c)
 		}, expectsFS{
 			".": {Mode: fs.ModeDir | 0700},
@@ -333,16 +407,18 @@ func TestExec(t *testing.T) {
 			"identifier/" + expected.Layers:                                               {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
 			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
 
+			"substitute": {Mode: fs.ModeDir | 0700},
+
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
 		}},
 
-		{"overlay layer promotion", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
+		{"overlay layer promotion", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-layer-promotion", nil, 0, true,
+					"exec-layer-promotion", "", nil, 0, false, true,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1", "HAKUREI_ROOT=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -365,6 +441,7 @@ func TestExec(t *testing.T) {
 				), ignorePathname, wantOffline, nil},
 			})
 
+			destroyStatus(t, base, 2, 0)
 			testtoolDestroy(t, base, c)
 		}, expectsFS{
 			".": {Mode: fs.ModeDir | 0700},
@@ -379,6 +456,75 @@ func TestExec(t *testing.T) {
 			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
 			"identifier/" + expected.Promote:                                              {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
 
+			"substitute": {Mode: fs.ModeDir | 0700},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}},
+
+		{"binfmt", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
+			if info.CanDegrade && os.Getenv("ROSA_SKIP_BINFMT") != "" {
+				t.Skip("binfmt_misc test explicitly skipped")
+			}
+
+			cureMany(t, c, []cureStep{
+				{"container", pkg.NewExec(
+					"exec-binfmt", "cafe", nil, 0, false, true,
+					pkg.AbsWork,
+					[]string{"HAKUREI_TEST=1", "HAKUREI_BINFMT=1"},
+					check.MustAbs("/opt/bin/sample"),
+					[]string{"sample"},
+
+					pkg.MustPath("/", true, &stubArtifact{
+						kind:   pkg.KindTar,
+						params: []byte("empty directory"),
+						cure: func(t *pkg.TContext) error {
+							return os.MkdirAll(t.GetWorkDir().String(), 0700)
+						},
+					}),
+					pkg.MustPath("/opt", false, overrideIdent{pkg.ID{0xfe, 0xff}, &stubArtifact{
+						kind: pkg.KindTar,
+						cure: func(t *pkg.TContext) error {
+							work := t.GetWorkDir()
+							if err := os.MkdirAll(
+								work.Append("bin").String(),
+								0700,
+							); err != nil {
+								return err
+							}
+
+							return os.WriteFile(t.GetWorkDir().Append(
+								"bin",
+								"sample",
+							).String(), []byte(expected.Full), 0500)
+						},
+					}}),
+				), ignorePathname, expectsFS{
+					".": {Mode: fs.ModeDir | 0500},
+
+					"check": {Mode: 0400, Data: []byte("binfmt")},
+				}, nil},
+			})
+
+			destroyStatus(t, base, 2, 0)
+		}, expectsFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/5aevg3YpDxjqQZ-pdvXK7YqgkL5JKqcoStYQxeD96kuYar6K2mRQWMHib6NQRnpV":            {Mode: fs.ModeDir | 0500},
+			"checksum/5aevg3YpDxjqQZ-pdvXK7YqgkL5JKqcoStYQxeD96kuYar6K2mRQWMHib6NQRnpV/bin":        {Mode: fs.ModeDir | 0700},
+			"checksum/5aevg3YpDxjqQZ-pdvXK7YqgkL5JKqcoStYQxeD96kuYar6K2mRQWMHib6NQRnpV/bin/sample": {Mode: 0500, Data: []byte("\xca\xfe\xba\xbe\xfd\xfd:3")},
+			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":            {Mode: fs.ModeDir | 0500},
+			"checksum/UnDo4B5KneEUY5b4vRUk_y9MWgkWuw2N8f8a2XayO686xXur-aZmX2-7n_8tKMe3":            {Mode: fs.ModeDir | 0500},
+			"checksum/UnDo4B5KneEUY5b4vRUk_y9MWgkWuw2N8f8a2XayO686xXur-aZmX2-7n_8tKMe3/check":      {Mode: 0400, Data: []byte("binfmt")},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/6VQTJ1lI5BmVuI1YFYJ8ClO3MRORvTTrcWFDcUU-l5Ga8EofxCxGlSTYN-u8dKj_": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/UnDo4B5KneEUY5b4vRUk_y9MWgkWuw2N8f8a2XayO686xXur-aZmX2-7n_8tKMe3")},
+			"identifier/_v8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/5aevg3YpDxjqQZ-pdvXK7YqgkL5JKqcoStYQxeD96kuYar6K2mRQWMHib6NQRnpV")},
+			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
 		}},

internal/pkg/file_test.go

@@ -29,6 +29,8 @@ func TestFile(t *testing.T) {
 			"identifier": {Mode: fs.ModeDir | 0700},
 			"identifier/3376ALA7hIUm2LbzH2fDvRezgzod1eTK_G6XjyOgbM2u-6swvkFaF0BOwSl_juBi": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
 
+			"substitute": {Mode: fs.ModeDir | 0700},
+
 			"work": {Mode: fs.ModeDir | 0700},
 		}},
 	})

internal/pkg/internal/testtool/expected/doc.go

@@ -1,2 +0,0 @@
-// Package expected contains expected identifiers for exec artifact tests.
-package expected

internal/pkg/internal/testtool/expected/expected.go

@@ -0,0 +1,9 @@
+// Package expected contains data shared between test helper and test harness.
+package expected
+
+const (
+	// Magic are magic bytes in the binfmt test case.
+	Magic = "\xca\xfe\xba\xbe\xfd\xfd"
+	// Full is the full content of the binfmt test case executable.
+	Full = Magic + ":3"
+)

internal/pkg/internal/testtool/expected/sum_amd64.go

@@ -1,10 +1,10 @@
 package expected
 
 const (
-	Offline = "dztPS6jRjiZtCF4_p8AzfnxGp6obkhrgFVsxdodbKWUoAEVtDz3MykepJB4kI_ks"
-	OvlRoot = "RdMA-mubnrHuu3Ky1wWyxauSYCO0ZH_zCPUj3uDHqkfwv5sGcByoF_g5PjlGiClb"
-	Layers  = "p1t_drXr34i-jZNuxDMLaMOdL6tZvQqhavNafGynGqxOZoXAUTSn7kqNh3Ovv3DT"
-	Net     = "G8qPxD9puvvoOVV7lrT80eyDeIl3G_CCFoKw12c8mCjMdG1zF7NEPkwYpNubClK3"
-	Promote = "xXTIYcXmgJWNLC91c417RRrNM9cjELwEZHpGvf8Fk_GNP5agRJp_SicD0w9aMeLJ"
-	Work    = "5hlaukCirnXE4W_RSLJFOZN47Z5RiHnacXzdFp_70cLgiJUGR6cSb_HaFftkzi0-"
+	Offline = "q5ktDTq0miP-VvB2blxqXQeaRXCUWgP_KbC18KNtUDtyoaI_h5mHmGuPMArVEBDs"
+	OvlRoot = "NacZGXwuRkTvcHaG08a22ujJ8qCWN0RSoFlRSR5FSt0ZcBbJ28FRvkYsHEtX7G8i"
+	Layers  = "WBJDrATtX6rIE5yAu8ePX3WmDF0Tt9kFiue0m3cRnyRoVx1my8a67fh3CAW486oP"
+	Net     = "CmYtj2sNB3LHtqiDuck_Lz3MjLLIiwyP8N4NDitQ1Icvv__LVP9p8tm-sHeQaKKp"
+	Promote = "TX3eCloaQFkV-SZIH6Jg6E5WKH--rcXY1P0jnZKmLFKWrNqnOzd4G9eIBh6i5ywN"
+	Work    = "OuNiLSC68pZhAOr1YQ4WbV1tzASA0nxLEBcK7lO7MqxDY_j8dmP_C612RTuF23Lu"
 )

internal/pkg/internal/testtool/expected/sum_arm64.go

@@ -0,0 +1,10 @@
+package expected
+
+const (
+	Offline = "WapqyoPxbWSnq07dWHt71mHaJXq99pAjJfFlELlJljSiZMhTFqqlzU1_mN86shSj"
+	OvlRoot = "V9anFOiRvjGfAeBhLl14AL8TKdWZyD0WTPYe4fS9mOBw8iW5Lmarvt6TG6MV8uWm"
+	Layers  = "tKx7JNRoSBdK_7MdzI-nwTNV2wmiPzwYdcd17oLmXKL_iLmUzUiA79qTqdrTasrv"
+	Net     = "aXyDLzBCJ9XltXZIfetEVsEkrqHfcXuD5XE_FcUnYbN3emwL55N6P8LlHzNfGnM5"
+	Promote = "3k4V16n96Lq04gjFSKmm4sFjyQ883FFBNXgTy9s_DjeTwxT3pg_iacEh8yMb_S4m"
+	Work    = "6Q49MhFWRE3Ne6MycwAotgl1GtoU5WCHqJNWG2byYZCY-zX-IxPrWiKk7bKkNzhE"
+)

internal/pkg/internal/testtool/expected/sum_riscv64.go

@@ -0,0 +1,10 @@
+package expected
+
+const (
+	Offline = "Z6yXE5gOJScL3srmnVMWgCXccDiUNZ5snSrf6RkXuU1_U0rX_kGVwsfHUgNG_awd"
+	OvlRoot = "zYXJHFRLuxvUhuisZEXgGgVvdQd6piMfp5jmtT6jdVjvC2gICXquOq-UTwlrSD5I"
+	Layers  = "_F8EDazHbcLeT0sVSQXRN_kn9IjduqJcDYgzXpsT-hpKU4EBcZ0PISN2zchpqMbm"
+	Net     = "CA_FAaSIYJgapBEHV40doxpH23PdUEy_6s1TZc7wfSPN0XYqwGpMceXXDSabGveO"
+	Promote = "_3LPrLp--4h9k4GsNNApu9hHtAafq-GUhfU6d4hJKBDKT3bz_szOsvkXxc5sK53d"
+	Work    = "FEgHeiCD_WT4wsfB-9kDH5n6cRWCEYtJmXdKZgmUUukAOoXumH_hLlosXREC-tqq"
+)

internal/pkg/internal/testtool/main.go

@@ -24,6 +24,19 @@ func main() {
 	log.SetFlags(0)
 	log.SetPrefix("testtool: ")
 
+	if os.Getenv("HAKUREI_BINFMT") == "1" {
+		wantArgs := []string{"/interpreter", "/opt/bin/sample"}
+		if !slices.Equal(os.Args, wantArgs) {
+			log.Fatalf("Args: %q, want %q", os.Args, wantArgs)
+		}
+
+		if err := os.WriteFile("check", []byte("binfmt"), 0400); err != nil {
+			log.Fatal(err)
+		}
+
+		return
+	}
+
 	environ := slices.DeleteFunc(slices.Clone(os.Environ()), func(s string) bool {
 		return s == "CURE_JOBS="+strconv.Itoa(runtime.NumCPU())
 	})

internal/pkg/ir.go

@@ -76,6 +76,9 @@ type IContext struct {
 	// Written to by various methods, should be zeroed after [Artifact.Params]
 	// returns and must not be exposed directly.
 	w io.Writer
+	// Optional [Artifact] to cureRes cache, replaces [IRKindIdent] with
+	// checksum values if non-nil.
+	inputs map[Artifact]cureRes
 }
 
 // irZero is a zero IR word.
@@ -163,7 +166,15 @@ func (i *IContext) WriteIdent(a Artifact) {
 	defer i.ic.putIdentBuf(buf)
 
 	IRKindIdent.encodeHeader(0).put(buf[:])
-	*(*ID)(buf[wordSize:]) = i.ic.Ident(a).Value()
+	if i.inputs != nil {
+		res, ok := i.inputs[a]
+		if !ok {
+			panic(InvalidLookupError(i.ic.Ident(a).Value()))
+		}
+		*(*ID)(buf[wordSize:]) = res.checksum.Value()
+	} else {
+		*(*ID)(buf[wordSize:]) = i.ic.Ident(a).Value()
+	}
 	i.mustWrite(buf[:])
 }
 
@@ -207,19 +218,44 @@ func (i *IContext) WriteString(s string) {
 // Encode writes a deterministic, efficient representation of a to w and returns
 // the first non-nil error encountered while writing to w.
 func (ic *irCache) Encode(w io.Writer, a Artifact) (err error) {
+	return ic.encode(w, a, nil)
+}
+
+// encode implements Encode but replaces identifiers with their cured checksums
+// for a non-nil ident. Caller must acquire Cache.identMu.
+func (ic *irCache) encode(
+	w io.Writer,
+	a Artifact,
+	inputs map[Artifact]cureRes,
+) (err error) {
 	deps := a.Dependencies()
 	idents := make([]*extIdent, len(deps))
-	for i, d := range deps {
-		dbuf, did := ic.unsafeIdent(d, true)
-		if dbuf == nil {
-			dbuf = ic.getIdentBuf()
-			binary.LittleEndian.PutUint64(dbuf[:], uint64(d.Kind()))
-			*(*ID)(dbuf[wordSize:]) = did.Value()
-		} else {
-			ic.storeIdent(d, dbuf)
+	if inputs == nil {
+		for i, d := range deps {
+			dbuf, did := ic.unsafeIdent(d, true)
+			if dbuf == nil {
+				dbuf = ic.getIdentBuf()
+				binary.LittleEndian.PutUint64(dbuf[:], uint64(d.Kind()))
+				*(*ID)(dbuf[wordSize:]) = did.Value()
+			} else {
+				ic.storeIdent(d, dbuf)
+			}
+			defer ic.putIdentBuf(dbuf)
+			idents[i] = dbuf
+		}
+	} else {
+		for i, d := range deps {
+			res, ok := inputs[d]
+			if !ok {
+				return InvalidLookupError(ic.Ident(d).Value())
+			}
+
+			dbuf := ic.getIdentBuf()
+			binary.LittleEndian.PutUint64(dbuf[:], uint64(d.Kind()))
+			*(*ID)(dbuf[wordSize:]) = res.checksum.Value()
+			defer ic.putIdentBuf(dbuf)
+			idents[i] = dbuf
 		}
-		defer ic.putIdentBuf(dbuf)
-		idents[i] = dbuf
 	}
 	slices.SortFunc(idents, func(a, b *extIdent) int {
 		return bytes.Compare(a[:], b[:])
@@ -244,7 +280,7 @@ func (ic *irCache) Encode(w io.Writer, a Artifact) (err error) {
 	}
 
 	func() {
-		i := IContext{ic, w}
+		i := IContext{ic, w, inputs}
 
 		defer panicToError(&err)
 		defer func() { i.ic, i.w = nil, nil }()

internal/pkg/ir_test.go

@@ -39,7 +39,7 @@ func TestIRRoundtrip(t *testing.T) {
 		)},
 
 		{"exec offline", pkg.NewExec(
-			"exec-offline", nil, 0, false,
+			"exec-offline", "", nil, 0, false, false,
 			pkg.AbsWork,
 			[]string{"HAKUREI_TEST=1"},
 			check.MustAbs("/opt/bin/testtool"),
@@ -59,9 +59,9 @@ func TestIRRoundtrip(t *testing.T) {
 		)},
 
 		{"exec net", pkg.NewExec(
-			"exec-net",
+			"exec-net", "",
 			(*pkg.Checksum)(bytes.Repeat([]byte{0xfc}, len(pkg.Checksum{}))),
-			0, false,
+			0, false, false,
 			pkg.AbsWork,
 			[]string{"HAKUREI_TEST=1"},
 			check.MustAbs("/opt/bin/testtool"),
@@ -80,6 +80,28 @@ func TestIRRoundtrip(t *testing.T) {
 			)),
 		)},
 
+		{"exec measured", pkg.NewExec(
+			"exec-measured", "",
+			(*pkg.Checksum)(bytes.Repeat([]byte{0xfd}, len(pkg.Checksum{}))),
+			0, false, false,
+			pkg.AbsWork,
+			[]string{"HAKUREI_TEST=1"},
+			check.MustAbs("/opt/bin/testtool"),
+			[]string{"testtool", "measured"},
+
+			pkg.MustPath("/file", false, pkg.NewFile("file", []byte(
+				"stub file",
+			))), pkg.MustPath("/.hakurei", false, pkg.NewHTTPGetTar(
+				nil, "file:///hakurei.tar",
+				pkg.Checksum(bytes.Repeat([]byte{0xfd}, len(pkg.Checksum{}))),
+				pkg.TarUncompressed,
+			)), pkg.MustPath("/opt", false, pkg.NewHTTPGetTar(
+				nil, "file:///testtool.tar.gz",
+				pkg.Checksum(bytes.Repeat([]byte{0xfd}, len(pkg.Checksum{}))),
+				pkg.TarGzip,
+			)),
+		)},
+
 		{"file anonymous", pkg.NewFile("", []byte{0})},
 		{"file", pkg.NewFile("stub", []byte("stub"))},
 	}
@@ -110,6 +132,7 @@ func TestIRRoundtrip(t *testing.T) {
 				".":          {Mode: fs.ModeDir | 0700},
 				"checksum":   {Mode: fs.ModeDir | 0700},
 				"identifier": {Mode: fs.ModeDir | 0700},
+				"substitute": {Mode: fs.ModeDir | 0700},
 				"work":       {Mode: fs.ModeDir | 0700},
 			},
 		}

internal/pkg/net_test.go

@@ -90,6 +90,7 @@ func TestHTTPGet(t *testing.T) {
 			".":          {Mode: fs.ModeDir | 0700},
 			"checksum":   {Mode: fs.ModeDir | 0700},
 			"identifier": {Mode: fs.ModeDir | 0700},
+			"substitute": {Mode: fs.ModeDir | 0700},
 			"work":       {Mode: fs.ModeDir | 0700},
 		}},
 
@@ -159,6 +160,8 @@ func TestHTTPGet(t *testing.T) {
 			"identifier": {Mode: fs.ModeDir | 0700},
 			"identifier/oM-2pUlk-mOxK1t3aMWZer69UdOQlAXiAgMrpZ1476VoOqpYVP1aGFS9_HYy-D8_": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU")},
 
+			"substitute": {Mode: fs.ModeDir | 0700},
+
 			"work": {Mode: fs.ModeDir | 0700},
 		}},
 	})

internal/pkg/pkg.go

@@ -4,6 +4,7 @@ package pkg
 import (
 	"bufio"
 	"bytes"
+	"cmp"
 	"context"
 	"crypto/sha512"
 	"encoding/base64"
@@ -15,6 +16,7 @@ import (
 	"io/fs"
 	"maps"
 	"os"
+	"os/signal"
 	"path/filepath"
 	"runtime"
 	"slices"
@@ -24,6 +26,7 @@ import (
 	"sync/atomic"
 	"syscall"
 	"testing"
+	"time"
 	"unique"
 	"unsafe"
 
@@ -247,7 +250,14 @@ func (t *TContext) destroy(errP *error) {
 			*errP = errors.Join(*errP, err)
 		}
 		if *errP != nil {
-			*errP = errors.Join(*errP, os.Remove(t.statusPath.String()))
+			*errP = errors.Join(*errP, os.Rename(
+				t.statusPath.String(), t.cache.base.Append(
+					dirFault,
+					t.ids+"."+strconv.FormatUint(uint64(
+						time.Now().UnixNano(),
+					), 10),
+				).String(),
+			))
 		}
 		t.status = nil
 	}
@@ -508,33 +518,34 @@ const (
 )
 
 const (
-	// fileLock is the file name appended to Cache.base for guaranteeing
-	// exclusive access to the cache directory.
+	// fileLock is the lock file for exclusive access to the cache directory.
 	fileLock = "lock"
-	// fileVariant is the file name appended to Cache.base holding the variant
-	// identification string set by a prior call to [SetExtension].
+	// fileVariant is a file holding the variant identification string set by a
+	// prior call to [SetExtension].
 	fileVariant = "variant"
 
-	// dirIdentifier is the directory name appended to Cache.base for storing
-	// artifacts named after their [ID].
+	// dirSubstitute holds symlinks to artifacts by checksum, named after their
+	// substitute identifier.
+	dirSubstitute = "substitute"
+	// dirIdentifier holds symlinks to artifacts by checksum,  named after their
+	// IR-based identifier.
 	dirIdentifier = "identifier"
-	// dirChecksum is the directory name appended to Cache.base for storing
-	// artifacts named after their [Checksum].
+	// dirChecksum holds artifacts named after their [Checksum].
 	dirChecksum = "checksum"
-	// dirStatus is the directory name appended to Cache.base for storing
-	// artifact metadata and logs named after their [ID].
+	// dirStatus holds artifact metadata and logs named after their IR-based
+	// identifier. For [FloodArtifact], the same file is also available under
+	// its substitute identifier.
 	dirStatus = "status"
+	// dirFault holds status files of faulted cures.
+	dirFault = "fault"
 
-	// dirWork is the directory name appended to Cache.base for working
-	// pathnames set up during [Cache.Cure].
+	// dirWork holds working pathnames set up during [Cache.Cure].
 	dirWork = "work"
-	// dirTemp is the directory name appended to Cache.base for scratch space
-	// pathnames allocated during [Cache.Cure].
+	// dirTemp holds scratch space allocated during [Cache.Cure].
 	dirTemp = "temp"
 
-	// dirExecScratch is the directory name appended to Cache.base for scratch
-	// space setting up the container started by [Cache.EnterExec]. Exclusivity
-	// via Cache.inExec.
+	// dirExecScratch is scratch space set up for the container started by
+	// [Cache.EnterExec]. Exclusivity via Cache.inExec.
 	dirExecScratch = "scratch"
 
 	// checksumLinknamePrefix is prepended to the encoded [Checksum] value
@@ -621,6 +632,9 @@ const (
 	// CSuppressInit arranges for verbose output of the container init to be
 	// suppressed regardless of [message.Msg] state.
 	CSuppressInit
+
+	// CIgnoreSubstitutes disables content-based dependency substitution.
+	CIgnoreSubstitutes
 )
 
 // toplevel holds [context.WithCancel] over caller-supplied context, where all
@@ -676,6 +690,11 @@ type Cache struct {
 	// Synchronises access to dirChecksum.
 	checksumMu sync.RWMutex
 
+	// Presence of an alternative in the cache. Keys are not valid identifiers
+	// and must not be used as such.
+	substitute map[unique.Handle[ID]]unique.Handle[Checksum]
+	// Synchronises access to substitute and corresponding filesystem entries.
+	substituteMu sync.RWMutex
 	// Identifier to content pair cache.
 	ident map[unique.Handle[ID]]unique.Handle[Checksum]
 	// Identifier to error pair for unrecoverably faulted [Artifact].
@@ -886,11 +905,14 @@ func (c *Cache) Scrub(checks int) error {
 		checks = runtime.NumCPU()
 	}
 
+	c.substituteMu.Lock()
+	defer c.substituteMu.Unlock()
 	c.identMu.Lock()
 	defer c.identMu.Unlock()
 	c.checksumMu.Lock()
 	defer c.checksumMu.Unlock()
 
+	c.substitute = make(map[unique.Handle[ID]]unique.Handle[Checksum])
 	c.ident = make(map[unique.Handle[ID]]unique.Handle[Checksum])
 	c.identErr = make(map[unique.Handle[ID]]error)
 	c.artifact.Clear()
@@ -998,47 +1020,52 @@ func (c *Cache) Scrub(checks int) error {
 		wg.Wait()
 	}
 
-	dir = c.base.Append(dirIdentifier)
-	if entries, readdirErr := os.ReadDir(dir.String()); readdirErr != nil {
-		addErr(dir, readdirErr)
-	} else {
-		wg.Add(len(entries))
-		for _, ent := range entries {
-			w <- checkEntry{ent, func(ent os.DirEntry, want *Checksum) bool {
-				got := p.Get().(*Checksum)
-				defer p.Put(got)
+	for _, suffix := range []string{
+		dirSubstitute,
+		dirIdentifier,
+	} {
+		dir = c.base.Append(suffix)
+		if entries, readdirErr := os.ReadDir(dir.String()); readdirErr != nil {
+			addErr(dir, readdirErr)
+		} else {
+			wg.Add(len(entries))
+			for _, ent := range entries {
+				w <- checkEntry{ent, func(ent os.DirEntry, want *Checksum) bool {
+					got := p.Get().(*Checksum)
+					defer p.Put(got)
 
-				pathname := dir.Append(ent.Name())
-				if linkname, err := os.Readlink(
-					pathname.String(),
-				); err != nil {
-					seMu.Lock()
-					se.Errs[pathname.Handle()] = append(se.Errs[pathname.Handle()], err)
-					se.DanglingIdentifiers = append(se.DanglingIdentifiers, *want)
-					seMu.Unlock()
-					return false
-				} else if err = Decode(got, filepath.Base(linkname)); err != nil {
-					seMu.Lock()
-					lnp := dir.Append(linkname)
-					se.Errs[lnp.Handle()] = append(se.Errs[lnp.Handle()], err)
-					se.DanglingIdentifiers = append(se.DanglingIdentifiers, *want)
-					seMu.Unlock()
-					return false
-				}
-
-				if _, err := os.Stat(pathname.String()); err != nil {
-					if !errors.Is(err, os.ErrNotExist) {
-						addErr(pathname, err)
+					pathname := dir.Append(ent.Name())
+					if linkname, err := os.Readlink(
+						pathname.String(),
+					); err != nil {
+						seMu.Lock()
+						se.Errs[pathname.Handle()] = append(se.Errs[pathname.Handle()], err)
+						se.DanglingIdentifiers = append(se.DanglingIdentifiers, *want)
+						seMu.Unlock()
+						return false
+					} else if err = Decode(got, filepath.Base(linkname)); err != nil {
+						seMu.Lock()
+						lnp := dir.Append(linkname)
+						se.Errs[lnp.Handle()] = append(se.Errs[lnp.Handle()], err)
+						se.DanglingIdentifiers = append(se.DanglingIdentifiers, *want)
+						seMu.Unlock()
+						return false
 					}
-					seMu.Lock()
-					se.DanglingIdentifiers = append(se.DanglingIdentifiers, *want)
-					seMu.Unlock()
-					return false
-				}
-				return true
-			}}
+
+					if _, err := os.Stat(pathname.String()); err != nil {
+						if !errors.Is(err, os.ErrNotExist) {
+							addErr(pathname, err)
+						}
+						seMu.Lock()
+						se.DanglingIdentifiers = append(se.DanglingIdentifiers, *want)
+						seMu.Unlock()
+						return false
+					}
+					return true
+				}}
+			}
+			wg.Wait()
 		}
-		wg.Wait()
 	}
 
 	dir = c.base.Append(dirStatus)
@@ -1186,6 +1213,52 @@ func (c *Cache) finaliseIdent(
 	close(done)
 }
 
+// zeroChecksum is a zero [Checksum] handle, used for comparison only.
+var zeroChecksum unique.Handle[Checksum]
+
+// loadSubstitute returns a checksum corresponding to a substitute identifier,
+// or zeroChecksum if an alternative is not available.
+func (c *Cache) loadSubstitute(
+	substitute unique.Handle[ID],
+) (unique.Handle[Checksum], error) {
+	c.substituteMu.RLock()
+	if checksum, ok := c.substitute[substitute]; ok {
+		c.substituteMu.RUnlock()
+		return checksum, nil
+	}
+
+	linkname, err := os.Readlink(c.base.Append(
+		dirSubstitute,
+		Encode(substitute.Value()),
+	).String())
+	c.substituteMu.RUnlock()
+
+	if err != nil {
+		if !errors.Is(err, os.ErrNotExist) {
+			return zeroChecksum, err
+		}
+
+		c.substituteMu.Lock()
+		c.substitute[substitute] = zeroChecksum
+		c.substituteMu.Unlock()
+		return zeroChecksum, nil
+	}
+
+	var checksum unique.Handle[Checksum]
+	buf := c.getIdentBuf()
+	err = Decode((*Checksum)(buf[:]), filepath.Base(linkname))
+	if err == nil {
+		checksum = unique.Make(Checksum(buf[:]))
+
+		c.substituteMu.Lock()
+		c.substitute[substitute] = checksum
+		c.substituteMu.Unlock()
+	}
+	c.putIdentBuf(buf)
+
+	return checksum, err
+}
+
 // Done returns a channel that is closed when the ongoing cure of an [Artifact]
 // referred to by the specified identifier completes. Done may return nil if
 // no ongoing cure of the specified identifier exists.
@@ -1420,8 +1493,8 @@ func (c *Cache) Cure(a Artifact) (
 
 // CureError wraps a non-nil error returned attempting to cure an [Artifact].
 type CureError struct {
-	Ident unique.Handle[ID]
-	Err   error
+	A   Artifact
+	Err error
 }
 
 // Unwrap returns the underlying error.
@@ -1434,40 +1507,63 @@ func (e *CureError) Error() string { return e.Err.Error() }
 type DependencyCureError []*CureError
 
 // unwrapM recursively expands underlying errors into a caller-supplied map.
-func (e *DependencyCureError) unwrapM(me map[unique.Handle[ID]]*CureError) {
+func (e *DependencyCureError) unwrapM(
+	ctx context.Context,
+	ir *IRCache,
+	me map[unique.Handle[ID]]*CureError,
+) {
 	for _, err := range *e {
-		if _, ok := me[err.Ident]; ok {
+		if ctx.Err() != nil {
+			break
+		}
+
+		id := ir.Ident(err.A)
+		if _, ok := me[id]; ok {
 			continue
 		}
 		if _e, ok := err.Err.(*DependencyCureError); ok {
-			_e.unwrapM(me)
+			_e.unwrapM(ctx, ir, me)
 			continue
 		}
-		me[err.Ident] = err
+		me[id] = err
 	}
 }
 
 // unwrap recursively expands and deduplicates underlying errors.
-func (e *DependencyCureError) unwrap() DependencyCureError {
+func (e *DependencyCureError) unwrap(
+	ctx context.Context,
+	ir *IRCache,
+) DependencyCureError {
 	me := make(map[unique.Handle[ID]]*CureError)
-	e.unwrapM(me)
-	errs := slices.AppendSeq(
-		make(DependencyCureError, 0, len(me)),
-		maps.Values(me),
-	)
+	e.unwrapM(ctx, ir, me)
+	type ent struct {
+		id  unique.Handle[ID]
+		err *CureError
+	}
+	errs := make([]*ent, 0, len(me))
+	for id, err := range me {
+		errs = append(errs, &ent{id, err})
+	}
 
 	var identBuf [2]ID
-	slices.SortFunc(errs, func(a, b *CureError) int {
-		identBuf[0], identBuf[1] = a.Ident.Value(), b.Ident.Value()
+	slices.SortFunc(errs, func(a, b *ent) int {
+		identBuf[0], identBuf[1] = a.id.Value(), b.id.Value()
 		return slices.Compare(identBuf[0][:], identBuf[1][:])
 	})
 
-	return errs
+	_errs := make(DependencyCureError, len(errs))
+	for i, v := range errs {
+		_errs[i] = v.err
+	}
+	return _errs
 }
 
 // Unwrap returns a deduplicated slice of underlying errors.
 func (e *DependencyCureError) Unwrap() []error {
-	errs := e.unwrap()
+	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
+	defer cancel()
+
+	errs := e.unwrap(ctx, NewIR())
 	_errs := make([]error, len(errs))
 	for i, err := range errs {
 		_errs[i] = err
@@ -1477,14 +1573,23 @@ func (e *DependencyCureError) Unwrap() []error {
 
 // Error returns a user-facing multiline error message.
 func (e *DependencyCureError) Error() string {
-	errs := e.unwrap()
+	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
+	defer cancel()
+
+	ir := NewIR()
+	errs := e.unwrap(ctx, ir)
 	if len(errs) == 0 {
 		return "invalid dependency cure outcome"
 	}
 	var buf strings.Builder
 	buf.WriteString("errors curing dependencies:")
 	for _, err := range errs {
-		buf.WriteString("\n\t" + Encode(err.Ident.Value()) + ": " + err.Error())
+		buf.WriteString("\n\t" +
+			reportName(err.A, ir.Ident(err.A)) + ": " +
+			err.Error())
+	}
+	if ctx.Err() != nil {
+		buf.WriteString("\nerror resolution cancelled")
 	}
 	return buf.String()
 }
@@ -1654,16 +1759,44 @@ func (c *Cache) cure(a Artifact, curesExempt bool) (
 		return
 	}
 
-	var checksums string
+	var (
+		checksums   string
+		substitute  unique.Handle[ID]
+		alternative *check.Absolute
+	)
 	defer func() {
 		if err == nil && checksums != "" {
+			linkname := checksumLinknamePrefix + checksums
+
 			err = os.Symlink(
-				checksumLinknamePrefix+checksums,
+				linkname,
 				pathname.String(),
 			)
 			if err == nil {
 				err = zeroTimes(pathname.String())
 			}
+
+			if err == nil && alternative != nil {
+				c.substituteMu.Lock()
+				err = os.Symlink(
+					linkname,
+					alternative.String(),
+				)
+				if errors.Is(err, os.ErrExist) {
+					c.msg.Verbosef(
+						"creating alternative over %s for artifact %s",
+						Encode(substitute.Value()), ids,
+					)
+					err = nil
+				}
+				if err == nil {
+					err = zeroTimes(alternative.String())
+				}
+				if err == nil && checksum != zeroChecksum {
+					c.substitute[substitute] = checksum
+				}
+				c.substituteMu.Unlock()
+			}
 		}
 	}()
 
@@ -1860,11 +1993,64 @@ func (c *Cache) cure(a Artifact, curesExempt bool) (
 			f.deps[deps[i]] = p
 		}
 
+		sh := sha512.New384()
+		err = c.encode(sh, a, f.deps)
+		if err != nil {
+			return
+		}
+
+		buf := c.getIdentBuf()
+		sh.Sum(buf[wordSize:wordSize])
+		substitute = unique.Make(ID(buf[wordSize:]))
+		substitutes := Encode(substitute.Value())
+		c.putIdentBuf(buf)
+		alternative = c.base.Append(
+			dirSubstitute,
+			substitutes,
+		)
+
+		if c.flags&CIgnoreSubstitutes == 0 {
+			var substituteChecksum unique.Handle[Checksum]
+			substituteChecksum, err = c.loadSubstitute(substitute)
+			if err != nil {
+				return
+			}
+			if substituteChecksum != zeroChecksum {
+				checksum = substituteChecksum
+				checksums = Encode(checksum.Value())
+				checksumPathname = c.base.Append(
+					dirChecksum,
+					checksums,
+				)
+				if _, err = os.Lstat(c.base.Append(
+					dirStatus,
+					substitutes,
+				).String()); err == nil {
+					err = os.Symlink(substitutes, c.base.Append(
+						dirStatus,
+						ids,
+					).String())
+				} else if errors.Is(err, os.ErrNotExist) {
+					err = nil
+				}
+				return
+			}
+		}
+
 		defer f.destroy(&err)
 		if err = c.enterCure(a, curesExempt); err != nil {
 			return
 		}
 		err = ca.Cure(&f)
+		if err == nil && f.status != nil {
+			err = os.Link(c.base.Append(
+				dirStatus,
+				ids,
+			).String(), c.base.Append(
+				dirStatus,
+				substitutes,
+			).String())
+		}
 		c.exitCure(a, curesExempt)
 		if err != nil {
 			return
@@ -1957,7 +2143,7 @@ func (pending *pendingArtifactDep) cure(c *Cache) {
 	}
 
 	pending.errsMu.Lock()
-	*pending.errs = append(*pending.errs, &CureError{c.Ident(pending.a), err})
+	*pending.errs = append(*pending.errs, &CureError{pending.a, err})
 	pending.errsMu.Unlock()
 }
 
@@ -1973,6 +2159,52 @@ func (c *Cache) OpenStatus(a Artifact) (r io.ReadSeekCloser, err error) {
 	return
 }
 
+// Fault holds the pathname and termination time of an [Artifact] fault entry.
+type Fault struct {
+	*check.Absolute
+	t uint64
+}
+
+// Time returns the instant in time where the fault occurred.
+func (f Fault) Time() time.Time { return time.Unix(0, int64(f.t)) }
+
+// Open opens the underlying entry for reading.
+func (f Fault) Open() (io.ReadCloser, error) { return os.Open(f.Absolute.String()) }
+
+// Destroy removes the underlying fault entry.
+func (f Fault) Destroy() error { return os.Remove(f.Absolute.String()) }
+
+// ReadFaults returns fault entries for an [Artifact].
+func (c *Cache) ReadFaults(a Artifact) (faults []Fault, err error) {
+	prefix := Encode(c.Ident(a).Value()) + "."
+	var dents []os.DirEntry
+	if dents, err = os.ReadDir(c.base.Append(dirFault).String()); err != nil {
+		return
+	}
+
+	for _, dent := range dents {
+		name := dent.Name()
+		if !strings.HasPrefix(name, prefix) {
+			continue
+		}
+		var t uint64
+		t, err = strconv.ParseUint(name[len(prefix):], 10, 64)
+		if err != nil {
+			return
+		}
+
+		faults = append(faults, Fault{c.base.Append(
+			dirFault,
+			name,
+		), t})
+	}
+
+	slices.SortFunc(faults, func(a, b Fault) int {
+		return cmp.Compare(a.t, b.t)
+	})
+	return
+}
+
 // Abort cancels all pending cures and waits for them to clean up, but does not
 // close the cache.
 func (c *Cache) Abort() {
@@ -2072,9 +2304,11 @@ func open(
 	}
 
 	for _, name := range []string{
+		dirSubstitute,
 		dirIdentifier,
 		dirChecksum,
 		dirStatus,
+		dirFault,
 		dirWork,
 	} {
 		if err := os.MkdirAll(
@@ -2097,6 +2331,7 @@ func open(
 
 		irCache: zeroIRCache(),
 
+		substitute:   make(map[unique.Handle[ID]]unique.Handle[Checksum]),
 		ident:        make(map[unique.Handle[ID]]unique.Handle[Checksum]),
 		identErr:     make(map[unique.Handle[ID]]error),
 		identPending: make(map[unique.Handle[ID]]*pendingCure),

internal/pkg/pkg_test.go

@@ -21,6 +21,7 @@ import (
 	"syscall"
 	"testing"
 	"testing/fstest"
+	"time"
 	"unique"
 	"unsafe"
 
@@ -244,6 +245,41 @@ func newDestroyArtifactFunc(a pkg.Artifact) func(
 	}
 }
 
+// destroyStatus counts non-substitution status entries and destroys them.
+func destroyStatus(t *testing.T, base *check.Absolute, c, s int) {
+	dents, err := os.ReadDir(base.Append("status").String())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var gotC, gotS int
+	for _, dent := range dents {
+		if err = os.Remove(base.Append(
+			"status",
+			dent.Name(),
+		).String()); err != nil {
+			t.Fatal(err)
+		}
+
+		if dent.Type().IsRegular() {
+			gotC++
+			continue
+		}
+		if dent.Type()&fs.ModeSymlink == fs.ModeSymlink {
+			gotS++
+			continue
+		}
+		t.Errorf("%s: %s", dent.Name(), dent.Type())
+	}
+
+	if gotC != c {
+		t.Errorf("status: c = %d, want %d", gotC, c)
+	}
+	if gotS != s {
+		t.Errorf("status: s = %d, want %d", gotS, s)
+	}
+}
+
 func TestIdent(t *testing.T) {
 	t.Parallel()
 
@@ -392,6 +428,12 @@ type cacheTestCase struct {
 	want  expectsFS
 }
 
+const (
+	// checkDestroySubstitutes arranges for substitutes to be destroyed before
+	// measurement during checkWithCache.
+	checkDestroySubstitutes = 1 << (iota + 32)
+)
+
 // checkWithCache runs a slice of cacheTestCase.
 func checkWithCache(t *testing.T, testCases []cacheTestCase) {
 	t.Helper()
@@ -423,7 +465,7 @@ func checkWithCache(t *testing.T, testCases []cacheTestCase) {
 			msg := message.New(log.New(os.Stderr, "cache: ", 0))
 			msg.SwapVerbose(testing.Verbose())
 
-			flags := tc.flags
+			flags := tc.flags | pkg.CSuppressInit
 
 			if info.CanDegrade {
 				if _, err := landlock.GetABI(); err != nil {
@@ -472,10 +514,27 @@ func checkWithCache(t *testing.T, testCases []cacheTestCase) {
 				}
 			}
 
-			// destroy non-deterministic status files
-			if err := os.RemoveAll(base.Append("status").String()); err != nil {
+			// destroy non-deterministic substitutes
+			if tc.flags&checkDestroySubstitutes != 0 {
+				substitute := base.Append("substitute")
+				if err := os.RemoveAll(substitute.String()); err != nil {
+					t.Fatal(err)
+				} else if err = os.Mkdir(substitute.String(), 0700); err != nil {
+					t.Fatal(err)
+				}
+			}
+
+			// destroy empty status directory
+			if err := syscall.Rmdir(base.Append("status").String()); err != nil {
+				t.Error(expectsFrom(base.Append("status").String()))
 				t.Fatal(err)
 			}
+
+			// destroy empty fault directory
+			if err := os.Remove(base.Append("fault").String()); err != nil {
+				t.Fatal(err)
+			}
+
 			want := tc.want.hash()
 
 			var checksum pkg.Checksum
@@ -539,12 +598,31 @@ func cureMany(t *testing.T, c *pkg.Cache, steps []cureStep) {
 	for _, step := range steps {
 		t.Log("cure step:", step.name)
 		if pathname, checksum, err := c.Cure(step.a); !reflect.DeepEqual(err, step.err) {
+			faults, _err := c.ReadFaults(step.a)
+			if _err != nil {
+				t.Errorf("ReadFaults: error = %v", _err)
+			}
+
+			var p []byte
+			for _, fault := range faults {
+				p, _err = os.ReadFile(fault.String())
+				if _err != nil {
+					t.Error(_err)
+					continue
+				}
+				t.Log(string(p))
+				t.Logf("faulting cure terminated %s ago", time.Since(faults[0].Time()))
+			}
 			t.Fatalf("Cure: error = %v, want %v", err, step.err)
 		} else if step.pathname != ignorePathname && !pathname.Is(step.pathname) {
 			t.Fatalf("Cure: pathname = %q, want %q", pathname, step.pathname)
 		} else if step.output == nil || checksum != makeChecksumH(step.output.hash()) {
 			if pathname != nil {
-				t.Fatal(expectsFrom(pathname.String()))
+				if name, _err := filepath.EvalSymlinks(pathname.String()); _err != nil {
+					t.Fatal(_err)
+				} else {
+					t.Fatal(expectsFrom(name))
+				}
 			} else if checksum != (unique.Handle[pkg.Checksum]{}) {
 				t.Fatalf("Cure: unexpected checksum %s", pkg.Encode(checksum.Value()))
 			}
@@ -631,6 +709,15 @@ func TestCache(t *testing.T) {
 				"identifier",
 				"cafebabecafebabecafebabecafebabecafebabecafebabecafebabecafebabe",
 			)
+			failingFile := newStubFile(
+				pkg.KindHTTPGet,
+				pkg.ID{0xff, 3},
+				nil,
+				nil, struct {
+					_ []byte
+					stub.UniqueError
+				}{UniqueError: 0xbad},
+			)
 
 			cureMany(t, c, []cureStep{
 				{"initial file", newStubFile(
@@ -712,22 +799,14 @@ func TestCache(t *testing.T) {
 				{"noncomparable error", &stubArtifactF{
 					kind:   pkg.KindExec,
 					params: []byte("artifact with dependency returning noncomparable error"),
-					deps: []pkg.Artifact{newStubFile(
-						pkg.KindHTTPGet,
-						pkg.ID{0xff, 3},
-						nil,
-						nil, struct {
-							_ []byte
-							stub.UniqueError
-						}{UniqueError: 0xbad},
-					)},
+					deps:   []pkg.Artifact{failingFile},
 
 					cure: func(f *pkg.FContext) error {
 						panic("attempting to cure impossible artifact")
 					},
 				}, nil, nil, &pkg.DependencyCureError{
 					{
-						Ident: unique.Make(pkg.ID{0xff, 3}),
+						A: failingFile,
 						Err: struct {
 							_ []byte
 							stub.UniqueError
@@ -784,6 +863,8 @@ func TestCache(t *testing.T) {
 			"identifier/cafebabecafebabecafebabecafebabecafebabecafebabecafebabecafebabe": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
 			"identifier/deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
 
+			"substitute": {Mode: fs.ModeDir | 0700},
+
 			"work": {Mode: fs.ModeDir | 0700},
 		}},
 
@@ -968,11 +1049,87 @@ func TestCache(t *testing.T) {
 				}}, nil, nil, pkg.InvalidFileModeError(
 					fs.ModeSymlink | 0777,
 				)},
+
+				{"alternative", &stubArtifactF{
+					kind:   pkg.KindExec,
+					params: []byte("substitutable artifact"),
+					deps: []pkg.Artifact{newStubFile(
+						pkg.KindHTTPGet,
+						pkg.ID{0xff, 8},
+						nil,
+						[]byte("substitutable dependency"),
+						nil,
+					)},
+
+					cure: func(f *pkg.FContext) error {
+						return makeSample(&f.TContext)
+					},
+				}, base.Append(
+					"identifier",
+					"xMDWovje7OfyIaDy_2VnjpKxRqSOQ_LoeD946t-3WsS2V2SeMJ7nDGrNfpa4Pbc-",
+				), want, nil},
+
+				{"substitutable", &stubArtifactF{
+					kind:   pkg.KindExec,
+					params: []byte("substitutable artifact"),
+					deps: []pkg.Artifact{newStubFile(
+						pkg.KindHTTPGet,
+						pkg.ID{0xff, 10},
+						nil,
+						[]byte("substitutable dependency"),
+						nil,
+					)},
+
+					cure: func(f *pkg.FContext) error {
+						panic("substitution missed")
+					},
+				}, base.Append(
+					"identifier",
+					"k2ilgG5KQ9NXnMoT2oB6NdwOnSPRn_H24oXQc4l6qOYIxIG9XfuEczeyrR8UEv_f",
+				), want, nil},
 			})
+
+			if c0, err := unsafeOpen(
+				t.Context(),
+				message.New(nil),
+				0, 0, 0, base, false,
+			); err != nil {
+				t.Fatalf("open: error = %v", err)
+			} else {
+				t.Cleanup(c.Close)
+				cureMany(t, c0, []cureStep{
+					{"substitutable", &stubArtifactF{
+						kind:   pkg.KindExec,
+						params: []byte("substitutable artifact"),
+						deps: []pkg.Artifact{newStubFile(
+							pkg.KindHTTPGet,
+							pkg.ID{0xff, 0xff, 0xfd, 0xfd},
+							nil,
+							[]byte("substitutable dependency"),
+							nil,
+						)},
+
+						cure: func(f *pkg.FContext) error {
+							panic("substitution missed")
+						},
+					}, base.Append(
+						"identifier",
+						"_EmV5nsYZ2UWHgRmLDMU8i-rJWDx-kv5_1pFrzQI7vMMCM5mAXivO8UZtVfOqMR_",
+					), want, nil},
+				})
+			}
+
+			if dents, err := os.ReadDir(base.Append("status").String()); err != nil {
+				t.Fatal(err)
+			} else if len(dents) > 0 {
+				t.Errorf("ReadDir: %v", dents)
+			}
+
 		}, expectsFS{
 			".": {Mode: fs.ModeDir | 0700},
 
 			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/7lfQ4QwSpV8nw7IDh0JiQ_jqUPrPv3_Vfie034RxsSy-cy4vO8DVvxgpx2LW08oO":                {Mode: 0400, Data: []byte("substitutable dependency")},
 			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b":                {Mode: fs.ModeDir | 0500},
 			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/check":          {Mode: 0400, Data: []byte{0, 0}},
 			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib":            {Mode: fs.ModeDir | 0700},
@@ -982,6 +1139,15 @@ func TestCache(t *testing.T) {
 			"identifier": {Mode: fs.ModeDir | 0700},
 			"identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
 			"identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
+			"identifier/_EmV5nsYZ2UWHgRmLDMU8i-rJWDx-kv5_1pFrzQI7vMMCM5mAXivO8UZtVfOqMR_": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
+			"identifier/___9_QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/7lfQ4QwSpV8nw7IDh0JiQ_jqUPrPv3_Vfie034RxsSy-cy4vO8DVvxgpx2LW08oO")},
+			"identifier/_wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/7lfQ4QwSpV8nw7IDh0JiQ_jqUPrPv3_Vfie034RxsSy-cy4vO8DVvxgpx2LW08oO")},
+			"identifier/_woAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/7lfQ4QwSpV8nw7IDh0JiQ_jqUPrPv3_Vfie034RxsSy-cy4vO8DVvxgpx2LW08oO")},
+			"identifier/k2ilgG5KQ9NXnMoT2oB6NdwOnSPRn_H24oXQc4l6qOYIxIG9XfuEczeyrR8UEv_f": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
+			"identifier/xMDWovje7OfyIaDy_2VnjpKxRqSOQ_LoeD946t-3WsS2V2SeMJ7nDGrNfpa4Pbc-": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+			"substitute/OyBGorh72Z9kVw35JUa8FbqDbpR4DqT-MX1jic0uKN5PdYmUBiAF38BRsIRnBigf": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
 
 			"work": {Mode: fs.ModeDir | 0700},
 		}},
@@ -1057,6 +1223,7 @@ func TestCache(t *testing.T) {
 			".":          {Mode: fs.ModeDir | 0700},
 			"checksum":   {Mode: fs.ModeDir | 0700},
 			"identifier": {Mode: fs.ModeDir | 0700},
+			"substitute": {Mode: fs.ModeDir | 0700},
 			"work":       {Mode: fs.ModeDir | 0700},
 		}},
 
@@ -1115,6 +1282,7 @@ func TestCache(t *testing.T) {
 			".":          {Mode: fs.ModeDir | 0700},
 			"checksum":   {Mode: fs.ModeDir | 0700},
 			"identifier": {Mode: fs.ModeDir | 0700},
+			"substitute": {Mode: fs.ModeDir | 0700},
 			"work":       {Mode: fs.ModeDir | 0700},
 		}},
 
@@ -1176,6 +1344,8 @@ func TestCache(t *testing.T) {
 			"identifier/_wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M")},
 			"identifier/_wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M")},
 
+			"substitute": {Mode: fs.ModeDir | 0700},
+
 			"work": {Mode: fs.ModeDir | 0700},
 		}},
 
@@ -1226,6 +1396,7 @@ func TestCache(t *testing.T) {
 			".":          {Mode: fs.ModeDir | 0700},
 			"checksum":   {Mode: fs.ModeDir | 0700},
 			"identifier": {Mode: fs.ModeDir | 0700},
+			"substitute": {Mode: fs.ModeDir | 0700},
 			"work":       {Mode: fs.ModeDir | 0700},
 		}},
 	}
@@ -1285,6 +1456,11 @@ func TestErrors(t *testing.T) {
 		{"UnsupportedVariantError", pkg.UnsupportedVariantError(
 			"rosa",
 		), `unsupported variant "rosa"`},
+
+		{"UnsupportedArchError zero", pkg.UnsupportedArchError(""),
+			"invalid architecture name"},
+		{"UnsupportedArchError", pkg.UnsupportedArchError("riscv64"),
+			"unsupported architecture riscv64"},
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -1400,6 +1576,14 @@ errors during scrub:
 func TestDependencyCureError(t *testing.T) {
 	t.Parallel()
 
+	makeIdent := func(ident ...byte) pkg.Artifact {
+		var a overrideIdent
+		copy(a.id[:], ident)
+		// does not compare equal
+		a.TrivialArtifact = new(stubArtifact)
+		return a
+	}
+
 	testCases := []struct {
 		name   string
 		err    pkg.DependencyCureError
@@ -1407,51 +1591,51 @@ func TestDependencyCureError(t *testing.T) {
 		unwrap []error
 	}{
 		{"simple", pkg.DependencyCureError{
-			{Ident: unique.Make(pkg.ID{0xff, 9}), Err: stub.UniqueError(0xbad09)},
-			{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
-			{Ident: unique.Make(pkg.ID{0xff, 0xf}), Err: stub.UniqueError(0xbad0f)},
-			{Ident: unique.Make(pkg.ID{0xff, 1}), Err: stub.UniqueError(0xbad01)},
+			{A: makeIdent(0xff, 9), Err: stub.UniqueError(0xbad09)},
+			{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
+			{A: makeIdent(0xff, 0xf), Err: stub.UniqueError(0xbad0f)},
+			{A: makeIdent(0xff, 1), Err: stub.UniqueError(0xbad01)},
 		}, `errors curing dependencies:
 	_wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765184 injected by the test suite
 	_wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765185 injected by the test suite
 	_wkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765193 injected by the test suite
 	_w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765199 injected by the test suite`, []error{
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 1}), Err: stub.UniqueError(0xbad01)},
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 9}), Err: stub.UniqueError(0xbad09)},
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 0xf}), Err: stub.UniqueError(0xbad0f)},
+			&pkg.CureError{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
+			&pkg.CureError{A: makeIdent(0xff, 1), Err: stub.UniqueError(0xbad01)},
+			&pkg.CureError{A: makeIdent(0xff, 9), Err: stub.UniqueError(0xbad09)},
+			&pkg.CureError{A: makeIdent(0xff, 0xf), Err: stub.UniqueError(0xbad0f)},
 		}},
 
 		{"dedup", pkg.DependencyCureError{
-			{Ident: unique.Make(pkg.ID{0xff, 9}), Err: stub.UniqueError(0xbad09)},
-			{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
-			{Ident: unique.Make(pkg.ID{0xff, 0xfd}), Err: &pkg.DependencyCureError{
-				{Ident: unique.Make(pkg.ID{0xff, 9}), Err: stub.UniqueError(0xbad09)},
-				{Ident: unique.Make(pkg.ID{0xff, 0xc}), Err: &pkg.DependencyCureError{
-					{Ident: unique.Make(pkg.ID{0xff, 0xf}), Err: stub.UniqueError(0xbad0f)},
-					{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
+			{A: makeIdent(0xff, 9), Err: stub.UniqueError(0xbad09)},
+			{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
+			{A: makeIdent(0xff, 0xfd), Err: &pkg.DependencyCureError{
+				{A: makeIdent(0xff, 9), Err: stub.UniqueError(0xbad09)},
+				{A: makeIdent(0xff, 0xc), Err: &pkg.DependencyCureError{
+					{A: makeIdent(0xff, 0xf), Err: stub.UniqueError(0xbad0f)},
+					{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
 				}},
-				{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
-				{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
+				{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
+				{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
 			}},
-			{Ident: unique.Make(pkg.ID{0xff, 0xff}), Err: &pkg.DependencyCureError{
-				{Ident: unique.Make(pkg.ID{0xff, 9}), Err: stub.UniqueError(0xbad09)},
-				{Ident: unique.Make(pkg.ID{0xff, 0xc}), Err: &pkg.DependencyCureError{
-					{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
+			{A: makeIdent(0xff, 0xff), Err: &pkg.DependencyCureError{
+				{A: makeIdent(0xff, 9), Err: stub.UniqueError(0xbad09)},
+				{A: makeIdent(0xff, 0xc), Err: &pkg.DependencyCureError{
+					{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
 				}},
-				{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
+				{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
 			}},
-			{Ident: unique.Make(pkg.ID{0xff, 0xf}), Err: stub.UniqueError(0xbad0f)},
-			{Ident: unique.Make(pkg.ID{0xff, 1}), Err: stub.UniqueError(0xbad01)},
+			{A: makeIdent(0xff, 0xf), Err: stub.UniqueError(0xbad0f)},
+			{A: makeIdent(0xff, 1), Err: stub.UniqueError(0xbad01)},
 		}, `errors curing dependencies:
 	_wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765184 injected by the test suite
 	_wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765185 injected by the test suite
 	_wkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765193 injected by the test suite
 	_w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765199 injected by the test suite`, []error{
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 1}), Err: stub.UniqueError(0xbad01)},
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 9}), Err: stub.UniqueError(0xbad09)},
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 0xf}), Err: stub.UniqueError(0xbad0f)},
+			&pkg.CureError{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
+			&pkg.CureError{A: makeIdent(0xff, 1), Err: stub.UniqueError(0xbad01)},
+			&pkg.CureError{A: makeIdent(0xff, 9), Err: stub.UniqueError(0xbad09)},
+			&pkg.CureError{A: makeIdent(0xff, 0xf), Err: stub.UniqueError(0xbad0f)},
 		}},
 	}
 	for _, tc := range testCases {
@@ -1492,6 +1676,25 @@ func (a earlyFailureF) Cure(*pkg.FContext) error {
 	return stub.UniqueError(0xcafe)
 }
 
+func BenchmarkEarlyDCE(b *testing.B) {
+	msg := message.New(log.New(os.Stderr, "dce: ", 0))
+	msg.SwapVerbose(testing.Verbose())
+	c, err := pkg.Open(b.Context(), msg, 0, 0, 0, check.MustAbs(b.TempDir()))
+	if err != nil {
+		b.Fatal(err)
+	}
+	_, _, err = c.Cure(earlyFailureF(8))
+	if !errors.Is(err, stub.UniqueError(0xcafe)) {
+		b.Fatalf("Cure: error = %v", err)
+	}
+	c.Close()
+	dce := err.(*pkg.DependencyCureError)
+
+	for b.Loop() {
+		dce.Unwrap()
+	}
+}
+
 func TestDependencyCureErrorEarly(t *testing.T) {
 	t.Parallel()
 
@@ -1505,6 +1708,7 @@ func TestDependencyCureErrorEarly(t *testing.T) {
 			".":          {Mode: fs.ModeDir | 0700},
 			"checksum":   {Mode: fs.ModeDir | 0700},
 			"identifier": {Mode: fs.ModeDir | 0700},
+			"substitute": {Mode: fs.ModeDir | 0700},
 			"work":       {Mode: fs.ModeDir | 0700},
 		}},
 	})

internal/pkg/tar_test.go

@@ -83,6 +83,8 @@ func TestTar(t *testing.T) {
 			"identifier/W5S65DEhawz_WKaok5NjUKLmnD9dNl5RPauNJjcOVcB3VM4eGhSaLGmXbL8vZpiw": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantEncode)},
 			"identifier/rg7F1D5hwv6o4xctjD5zDq4i5MD0mArTsUIWfhUbik8xC6Bsyt3mjXXOm3goojTz": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantEncode)},
 
+			"substitute": {Mode: fs.ModeDir | 0700},
+
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
 		}},
@@ -105,6 +107,8 @@ func TestTar(t *testing.T) {
 			"identifier/W5S65DEhawz_WKaok5NjUKLmnD9dNl5RPauNJjcOVcB3VM4eGhSaLGmXbL8vZpiw": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantExpandEncode)},
 			"identifier/_v1blm2h-_KA-dVaawdpLas6MjHc6rbhhFS8JWwx8iJxZGUu8EBbRrhr5AaZ9PJL": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantExpandEncode)},
 
+			"substitute": {Mode: fs.ModeDir | 0700},
+
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
 		}},

internal/rosa/all.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"runtime"
 	"strconv"
 	"sync"
 
@@ -55,6 +56,8 @@ const (
 	Fakeroot
 	Findutils
 	Flex
+	FontUtil
+	Freetype
 	Fuse
 	GMP
 	GLib
@@ -70,21 +73,30 @@ const (
 	Gzip
 	Hakurei
 	HakureiDist
+	Hwdata
 	IPTables
 	Kmod
 	LIT
 	LibX11
 	LibXau
+	LibXdmcp
 	LibXext
+	LibXfixes
+	LibXfont2
 	LibXrandr
 	LibXrender
 	LibXxf86vm
+	Libarchive
 	Libbsd
 	Libcap
+	Libconfig
+	LibdisplayInfo
 	Libdrm
+	Libepoxy
 	Libev
 	Libexpat
 	Libffi
+	Libfontenc
 	Libgd
 	Libglvnd
 	Libiconv
@@ -96,17 +108,28 @@ const (
 	Libpsl
 	Libseccomp
 	Libtasn1
+	Libtirpc
 	Libtool
 	Libucontext
 	Libunistring
-	Libxshmfence
+	Libva
+	LibxcbRenderUtil
+	LibxcbUtil
+	LibxcbUtilImage
+	LibxcbUtilKeysyms
+	LibxcbUtilWM
+	Libxcvt
+	Libxkbfile
 	Libxml2
+	Libxshmfence
 	Libxslt
 	Libxtrans
+	LMSensors
 	M4
 	MPC
 	MPFR
 	Make
+	Mesa
 	Meson
 	Mksh
 	MuslFts
@@ -128,10 +151,12 @@ const (
 	PerlPodParser
 	PerlSGMLS
 	PerlTermReadKey
+	PerlTestCmd
 	PerlTextCharWidth
 	PerlTextWrapI18N
 	PerlUnicodeLineBreak
 	PerlYAMLTiny
+	Pixman
 	PkgConfig
 	Procps
 	Python
@@ -169,20 +194,25 @@ const (
 	toyboxEarly
 	Unzip
 	UtilLinux
+	VIM
 	Wayland
 	WaylandProtocols
 	XCB
 	XCBProto
 	XDGDBusProxy
 	XZ
+	Xkbcomp
+	XkeyboardConfig
 	XorgProto
+	Xserver
 	Zlib
 	Zstd
 
 	// PresetUnexportedStart is the first unexported preset.
 	PresetUnexportedStart
 
-	llvmSource = iota - 1
+	stage0Dist = iota - 1
+	llvmSource
 	// earlyCompilerRT is an early, standalone compiler-rt installation for the
 	// standalone runtimes build.
 	//
@@ -347,6 +377,9 @@ var (
 	// artifactsOnce is for lazy initialisation of artifacts.
 	artifactsOnce [_toolchainEnd][len(artifactsM)]sync.Once
 
+	// arch is the target architecture.
+	arch = runtime.GOARCH
+
 	// presetOpts globally modifies behaviour of presets.
 	presetOpts int
 )
@@ -358,6 +391,9 @@ const (
 	OptLLVMNoLTO
 )
 
+// Arch returns the target architecture.
+func Arch() string { return arch }
+
 // Flags returns the current preset flags
 func Flags() int { return presetOpts }
 
@@ -367,7 +403,12 @@ func zero[T any](p *T) { var v T; *p = v }
 // DropCaches arranges for all cached [pkg.Artifact] to be freed some time after
 // it returns. Must not be used concurrently with any other function from this
 // package.
-func DropCaches(flags int) {
+func DropCaches(targetArch string, flags int) {
+	if targetArch == "" {
+		targetArch = runtime.GOARCH
+	}
+
+	arch = targetArch
 	presetOpts = flags
 	zero(&artifacts)
 	zero(&artifactsOnce)

internal/rosa/all_test.go

@@ -20,8 +20,8 @@ func TestLoad(t *testing.T) {
 }
 
 func BenchmarkAll(b *testing.B) {
-	flags := rosa.Flags()
-	b.Cleanup(func() { rosa.DropCaches(flags) })
+	arch, flags := rosa.Arch(), rosa.Flags()
+	b.Cleanup(func() { rosa.DropCaches(arch, flags) })
 
 	for b.Loop() {
 		for i := range rosa.PresetEnd {
@@ -29,7 +29,7 @@ func BenchmarkAll(b *testing.B) {
 		}
 
 		b.StopTimer()
-		rosa.DropCaches(0)
+		rosa.DropCaches("", 0)
 		b.StartTimer()
 	}
 }

internal/rosa/busybox.go

@@ -5,7 +5,6 @@ import (
 	"io"
 	"net/http"
 	"os"
-	"runtime"
 	"time"
 
 	"hakurei.app/fhs"
@@ -88,7 +87,7 @@ func (a busyboxBin) Cure(t *pkg.TContext) (err error) {
 // the https://busybox.net/downloads/binaries/ binary release.
 func newBusyboxBin() pkg.Artifact {
 	var version, url, checksum string
-	switch runtime.GOARCH {
+	switch arch {
 	case "amd64":
 		version = "1.35.0"
 		url = "https://busybox.net/downloads/binaries/" +
@@ -101,11 +100,11 @@ func newBusyboxBin() pkg.Artifact {
 		checksum = "npJjBO7iwhjW6Kx2aXeSxf8kXhVgTCDChOZTTsI8ZfFfa3tbsklxRiidZQdrVERg"
 
 	default:
-		panic("unsupported target " + runtime.GOARCH)
+		panic("unsupported target " + arch)
 	}
 
 	return pkg.NewExec(
-		"busybox-bin-"+version, nil, pkg.ExecTimeoutMax, false,
+		"busybox-bin-"+version, arch, nil, pkg.ExecTimeoutMax, false, false,
 		fhs.AbsRoot, []string{
 			"PATH=/system/bin",
 		},

internal/rosa/curl.go

@@ -4,8 +4,8 @@ import "hakurei.app/internal/pkg"
 
 func (t Toolchain) newCurl() (pkg.Artifact, string) {
 	const (
-		version  = "8.19.0"
-		checksum = "YHuVLVVp8q_Y7-JWpID5ReNjq2Zk6t7ArHB6ngQXilp_R5l3cubdxu3UKo-xDByv"
+		version  = "8.20.0"
+		checksum = "xyHXwrngIRGMasuzhn-I5MSCOhktwINbsWt1f_LuR-5jRVvyx_g6U1EQfDLEbr9r"
 	)
 	return t.NewPackage("curl", version, newTar(
 		"https://curl.se/download/curl-"+version+".tar.bz2",

internal/rosa/freetype.go

@@ -0,0 +1,27 @@
+package rosa
+
+import "hakurei.app/internal/pkg"
+
+func (t Toolchain) newFreetype() (pkg.Artifact, string) {
+	const (
+		version  = "2.14.3"
+		checksum = "-WfLv8fVJNyCHpP_lriiDzOcVbBL9ajdQ3tl8AzIIUa9-8sVpU9irxOmSMgRHWYz"
+	)
+	return t.NewPackage("freetype", version, newTar(
+		"https://download.savannah.gnu.org/releases/freetype/"+
+			"freetype-"+version+".tar.gz",
+		checksum,
+		pkg.TarGzip,
+	), nil, (*MakeHelper)(nil)), version
+}
+func init() {
+	artifactsM[Freetype] = Metadata{
+		f: Toolchain.newFreetype,
+
+		Name:        "freetype",
+		Description: "a freely available software library to render fonts",
+		Website:     "http://www.freetype.org/",
+
+		ID: 854,
+	}
+}

internal/rosa/git.go

@@ -55,6 +55,14 @@ disable_test t9300-fast-import
 disable_test t0211-trace2-perf
 disable_test t1517-outside-repo
 disable_test t2200-add-update
+disable_test t0027-auto-crlf
+disable_test t7513-interpret-trailers
+disable_test t7703-repack-geometric
+disable_test t7002-mv-sparse-checkout
+disable_test t1451-fsck-buffer
+disable_test t4104-apply-boundary
+disable_test t4200-rerere
+disable_test t5515-fetch-merge-logic
 `,
 		Check: []string{
 			"-C t",
@@ -105,7 +113,7 @@ func (t Toolchain) NewViaGit(
 	return t.New(strings.TrimSuffix(
 		path.Base(url),
 		".git",
-	)+"-src-"+path.Base(rev), 0, t.AppendPresets(nil,
+	)+"-src-"+path.Base(rev), THostNet, t.AppendPresets(nil,
 		NSSCACert,
 		Git,
 	), &checksum, nil, `

internal/rosa/glslang.go

@@ -91,8 +91,8 @@ func init() {
 
 func (t Toolchain) newGlslang() (pkg.Artifact, string) {
 	const (
-		version  = "16.2.0"
-		checksum = "6_UuF9reLRDaVkgO-9IfB3kMwme3lQZM8LL8YsJwPdUFkrjzxJtf2A9X3w9nFxj2"
+		version  = "16.3.0"
+		checksum = "xyqDf8k3-D0_BXHGi0uLgMglnJ05Rf3j73QgbDs3sGtKNdBIQhY8JfqX1NcNoJQN"
 	)
 	return t.NewPackage("glslang", version, newFromGitHub(
 		"KhronosGroup/glslang",
@@ -132,15 +132,75 @@ func (t Toolchain) newSPIRVLLVMTranslator() (pkg.Artifact, string) {
 		version  = "22.1.2"
 		checksum = "JZAaV5ewYcm-35YA_U2BM2IcsQouZtX1BLZR0zh2vSlfEXMsT5OCtY4Gh5RJkcGy"
 	)
+	skipChecks := []string{
+		// error: line 13: OpTypeCooperativeMatrixKHR Scope is limited to Workgroup and Subgroup
+		"cooperative_matrix_constant_null.spvasm",
+	}
+
+	switch arch {
+	case "arm64":
+		skipChecks = append(skipChecks,
+			// LLVM ERROR: unsupported calling convention
+			"DebugInfo/COFF/no-cus.ll",
+			"DebugInfo/Generic/2009-11-05-DeadGlobalVariable.ll",
+			"DebugInfo/Generic/2009-11-10-CurrentFn.ll",
+			"DebugInfo/Generic/2010-01-05-DbgScope.ll",
+			"DebugInfo/Generic/2010-03-12-llc-crash.ll",
+			"DebugInfo/Generic/2010-03-24-MemberFn.ll",
+			"DebugInfo/Generic/2010-04-19-FramePtr.ll",
+			"DebugInfo/Generic/2010-06-29-InlinedFnLocalVar.ll",
+			"DebugInfo/Generic/2010-10-01-crash.ll",
+			"DebugInfo/Generic/PR20038.ll",
+			"DebugInfo/Generic/constant-pointers.ll",
+			"DebugInfo/Generic/dead-argument-order.ll",
+			"DebugInfo/Generic/debug-info-eis-option.ll",
+			"DebugInfo/Generic/def-line.ll",
+			"DebugInfo/Generic/discriminator.ll",
+			"DebugInfo/Generic/dwarf-public-names.ll",
+			"DebugInfo/Generic/enum.ll",
+			"DebugInfo/Generic/func-using-decl.ll",
+			"DebugInfo/Generic/global.ll",
+			"DebugInfo/Generic/imported-name-inlined.ll",
+			"DebugInfo/Generic/incorrect-variable-debugloc1.ll",
+			"DebugInfo/Generic/inline-scopes.ll",
+			"DebugInfo/Generic/inlined-arguments.ll",
+			"DebugInfo/Generic/inlined-vars.ll",
+			"DebugInfo/Generic/linear-dbg-value.ll",
+			"DebugInfo/Generic/linkage-name-abstract.ll",
+			"DebugInfo/Generic/member-order.ll",
+			"DebugInfo/Generic/missing-abstract-variable.ll",
+			"DebugInfo/Generic/multiline.ll",
+			"DebugInfo/Generic/namespace_function_definition.ll",
+			"DebugInfo/Generic/namespace_inline_function_definition.ll",
+			"DebugInfo/Generic/noscopes.ll",
+			"DebugInfo/Generic/ptrsize.ll",
+			"DebugInfo/Generic/restrict.ll",
+			"DebugInfo/Generic/two-cus-from-same-file.ll",
+			"DebugInfo/Generic/version.ll",
+			"DebugInfo/LocalAddressSpace.ll",
+			"DebugInfo/UnknownBaseType.ll",
+			"DebugInfo/expr-opcode.ll",
+		)
+	}
+
 	return t.NewPackage("spirv-llvm-translator", version, newFromGitHub(
 		"KhronosGroup/SPIRV-LLVM-Translator",
 		"v"+version, checksum,
 	), &PackageAttr{
 		Patches: []KV{
 			{"remove-early-prefix", `diff --git a/CMakeLists.txt b/CMakeLists.txt
-index c000a77e..86f79b03 100644
+index c000a77e..f18f3fde 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
+@@ -164,7 +164,7 @@ install(
+     ${LLVM_SPIRV_INCLUDE_DIRS}/LLVMSPIRVOpts.h
+     ${LLVM_SPIRV_INCLUDE_DIRS}/LLVMSPIRVExtensions.inc
+   DESTINATION
+-    ${CMAKE_INSTALL_PREFIX}/include/LLVMSPIRVLib
++    include/LLVMSPIRVLib
+ )
+ 
+ configure_file(LLVMSPIRVLib.pc.in ${CMAKE_BINARY_DIR}/LLVMSPIRVLib.pc @ONLY)
 @@ -172,5 +172,5 @@ install(
    FILES
      ${CMAKE_BINARY_DIR}/LLVMSPIRVLib.pc
@@ -148,14 +208,12 @@ index c000a77e..86f79b03 100644
 -    ${CMAKE_INSTALL_PREFIX}/lib${LLVM_LIBDIR_SUFFIX}/pkgconfig
 +    lib${LLVM_LIBDIR_SUFFIX}/pkgconfig
  )
-`},
+;`},
 		},
 
 		// litArgs emits shell syntax
 		ScriptEarly: `
-export LIT_OPTS=` + litArgs(true,
-			// error: line 13: OpTypeCooperativeMatrixKHR Scope is limited to Workgroup and Subgroup
-			"cooperative_matrix_constant_null.spvasm") + `
+export LIT_OPTS=` + litArgs(true, skipChecks...) + `
 `,
 	}, &CMakeHelper{
 		Cache: []KV{

internal/rosa/gnu.go

@@ -1,7 +1,6 @@
 package rosa
 
 import (
-	"runtime"
 	"slices"
 	"strconv"
 	"strings"
@@ -843,7 +842,7 @@ func (t Toolchain) newGnuTLS() (pkg.Artifact, string) {
 	)
 
 	var configureExtra []KV
-	switch runtime.GOARCH {
+	switch arch {
 	case "arm64":
 		configureExtra = []KV{
 			{"disable-hardware-acceleration"},
@@ -1143,12 +1142,12 @@ func init() {
 
 func (t Toolchain) newGCC() (pkg.Artifact, string) {
 	const (
-		version  = "15.2.0"
-		checksum = "TXJ5WrbXlGLzy1swghQTr4qxgDCyIZFgJry51XEPTBZ8QYbVmFeB4lZbSMtPJ-a1"
+		version  = "16.1.0"
+		checksum = "4ASoWbxaA2FW7PAB0zzHDPC5XnNhyaAyjtDPpGzceSLeYnEIXsNYZR3PA_Zu5P0K"
 	)
 
 	var configureExtra []KV
-	switch runtime.GOARCH {
+	switch arch {
 	case "amd64", "arm64":
 		configureExtra = append(configureExtra, KV{"with-multilib-list", "''"})
 	}

internal/rosa/go.go

@@ -1,7 +1,6 @@
 package rosa
 
 import (
-	"runtime"
 	"slices"
 
 	"hakurei.app/internal/pkg"
@@ -35,6 +34,10 @@ func (t Toolchain) newGo(
 	script string,
 	extra ...pkg.Artifact,
 ) pkg.Artifact {
+	name := "all"
+	if presetOpts&OptSkipCheck != 0 {
+		name = "make"
+	}
 	return t.New("go"+version, 0, t.AppendPresets(extra,
 		Bash,
 	), nil, slices.Concat([]string{
@@ -48,7 +51,7 @@ cp -r /usr/src/go /work/system
 cd /work/system/go/src
 chmod -R +w ..
 `+script+`
-./all.bash
+./`+name+`.bash
 
 mkdir /work/system/bin
 ln -s \
@@ -69,7 +72,7 @@ func (t Toolchain) newGoLatest() (pkg.Artifact, string) {
 
 		finalEnv []string
 	)
-	switch runtime.GOARCH {
+	switch arch {
 	case "amd64":
 		bootstrapExtra = append(bootstrapExtra, t.newGoBootstrap())
 
@@ -79,7 +82,7 @@ func (t Toolchain) newGoLatest() (pkg.Artifact, string) {
 		finalEnv = append(finalEnv, "CGO_ENABLED=0")
 
 	default:
-		panic("unsupported target " + runtime.GOARCH)
+		panic("unsupported target " + arch)
 	}
 
 	go119 := t.newGo(
@@ -104,7 +107,7 @@ echo \
 		[]string{"CGO_ENABLED=0"}, `
 sed -i \
 	's,/lib/ld-musl-`+linuxArch()+`.so.1,/system/bin/linker,' \
-	cmd/link/internal/`+runtime.GOARCH+`/obj.go
+	cmd/link/internal/`+arch+`/obj.go
 
 rm \
 	crypto/tls/handshake_client_test.go \
@@ -122,17 +125,17 @@ echo \
 		[]string{"CGO_ENABLED=0"}, `
 sed -i \
 	's,/lib/ld-musl-`+linuxArch()+`.so.1,/system/bin/linker,' \
-	cmd/link/internal/`+runtime.GOARCH+`/obj.go
+	cmd/link/internal/`+arch+`/obj.go
 `, go121,
 	)
 
 	go125 := t.newGo(
-		"1.25.9",
-		"gShJb9uOMk5AxqPSwvn53ZO56S6PyP6nfojzrHUiJ3krAvrgjJpYa6-DPA-jxbpN",
+		"1.25.10",
+		"TwKwatkpwal-j9U2sDSRPEdM3YesI4Gm88YgGV59wtU-L85K9gA7UPy9SCxn6PMb",
 		[]string{"CGO_ENABLED=0"}, `
 sed -i \
 	's,/lib/ld-musl-`+linuxArch()+`.so.1,/system/bin/linker,' \
-	cmd/link/internal/`+runtime.GOARCH+`/obj.go
+	cmd/link/internal/`+arch+`/obj.go
 
 rm \
 	os/root_unix_test.go \
@@ -141,8 +144,8 @@ rm \
 	)
 
 	const (
-		version  = "1.26.2"
-		checksum = "v-6BE89_1g3xYf-9oIYpJKFXlo3xKHYJj2_VGkaUq8ZVkIVQmLwrto-xGG03OISH"
+		version  = "1.26.3"
+		checksum = "lEiFocZFnN5fKvZzmwVdqc9pYUjAuhzqZGbuiOqxUP4XdcY8yECisKcqsQ_eNn1N"
 	)
 	return t.newGo(
 		version,
@@ -150,7 +153,7 @@ rm \
 		finalEnv, `
 sed -i \
 	's,/lib/ld-musl-`+linuxArch()+`.so.1,/system/bin/linker,' \
-	cmd/link/internal/`+runtime.GOARCH+`/obj.go
+	cmd/link/internal/`+arch+`/obj.go
 sed -i \
 	's/cpu.X86.HasAVX512VBMI/& \&\& cpu.X86.HasPOPCNT/' \
 	internal/runtime/gc/scan/scan_amd64.go

internal/rosa/gtk.go

@@ -7,8 +7,8 @@ import (
 
 func (t Toolchain) newGLib() (pkg.Artifact, string) {
 	const (
-		version  = "2.88.0"
-		checksum = "T79Cg4z6j-sDZ2yIwvbY4ccRv2-fbwbqgcw59F5NQ6qJT6z4v261vbYp3dHO6Ma3"
+		version  = "2.88.1"
+		checksum = "Rkszn6W4RHjyspyqfXdVAVawdwDJCuS0Zu0f7qot7tbJhnw2fUDoUUJB40m-1MCX"
 	)
 	return t.NewPackage("glib", version, t.newTagRemote(
 		"https://gitlab.gnome.org/GNOME/glib.git",

internal/rosa/hakurei.go

@@ -96,9 +96,13 @@ mkdir -p /work/system/bin/
 	}
 	artifactsM[HakureiDist] = Metadata{
 		f: func(t Toolchain) (pkg.Artifact, string) {
+			name := "all"
+			if presetOpts&OptSkipCheck != 0 {
+				name = "make"
+			}
 			return t.newHakurei("-dist", `
 export HAKUREI_VERSION
-DESTDIR=/work /usr/src/hakurei/all.sh
+DESTDIR=/work /usr/src/hakurei/`+name+`.sh
 `, true), hakureiVersion
 		},
 

internal/rosa/hakurei_release.go

@@ -4,13 +4,13 @@ package rosa
 
 import "hakurei.app/internal/pkg"
 
-const hakureiVersion = "0.4.1"
+const hakureiVersion = "0.4.2"
 
 // hakureiSource is the source code of a hakurei release.
 var hakureiSource = newTar(
 	"https://git.gensokyo.uk/rosa/hakurei/archive/"+
 		"v"+hakureiVersion+".tar.gz",
-	"8bHvZcjUQOXUPbKL-qq99pHFTPnn-h7j1fkJudbGs8waLm3OmkI6eHfQev5bug2y",
+	"jadgaOrxv5ABGvzQ_Rk0aPGz7U8K-427TbMhQNQ32scSizEnlR44Pu7NoWYWVZWq",
 	pkg.TarGzip,
 )
 

internal/rosa/hwdata.go

@@ -0,0 +1,34 @@
+package rosa
+
+import "hakurei.app/internal/pkg"
+
+func (t Toolchain) newHwdata() (pkg.Artifact, string) {
+	const (
+		version  = "0.407"
+		checksum = "6p1XD0CRuzt6hLfjv4ShKBW934BexmoPkRrmwxD4J63fBVCzVBRHyF8pVJdW_Xjm"
+	)
+	return t.NewPackage("hwdata", version, newFromGitHub(
+		"vcrhonek/hwdata",
+		"v"+version, checksum,
+	), &PackageAttr{
+		Writable:    true,
+		EnterSource: true,
+	}, &MakeHelper{
+		// awk: fatal: cannot open file `hwdata.spec' for reading: No such file or directory
+		InPlace: true,
+
+		// lspci: Unknown option 'A' (see "lspci --help")
+		SkipCheck: true,
+	}), version
+}
+func init() {
+	artifactsM[Hwdata] = Metadata{
+		f: Toolchain.newHwdata,
+
+		Name:        "hwdata",
+		Description: "contains various hardware identification and configuration data",
+		Website:     "https://github.com/vcrhonek/hwdata",
+
+		ID: 5387,
+	}
+}

internal/rosa/kernel.go

@@ -2,12 +2,12 @@ package rosa
 
 import "hakurei.app/internal/pkg"
 
-const kernelVersion = "6.12.84"
+const kernelVersion = "6.12.87"
 
 var kernelSource = newTar(
 	"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/"+
 		"snapshot/linux-"+kernelVersion+".tar.gz",
-	"GJLUEu68r3DpLYoTcMl4wA_ThMBs_Zwc0gZsp82ii_3AOfcVxpI639IKfq2jAAY2",
+	"QTl5teIy0K5KsOLYGHQ3FbnPCZNRH2bySXVzghiOoHDdM3zAcSPUkmdly85lMzHx",
 	pkg.TarGzip,
 )
 
@@ -29,8 +29,22 @@ func init() {
 }
 
 func (t Toolchain) newKernelHeaders() (pkg.Artifact, string) {
+	const checksum = "lCmBNcMeUmXifg0vecKOPy3GAaFcJSmOPnf3wit9xYTDSTsFADPt1xxUFfmTn1fD"
 	return t.NewPackage("kernel-headers", kernelVersion, kernelSource, &PackageAttr{
-		Flag: TEarly,
+		Flag:          TEarly,
+		KnownChecksum: new(mustDecode(checksum)),
+
+		Paths: []pkg.ExecPath{
+			// updated manually for API changes
+			pkg.Path(AbsUsrSrc.Append("version.h"), false, pkg.NewFile(
+				"version.h", []byte(`#define LINUX_VERSION_CODE 396372
+#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + ((c) > 255 ? 255 : (c)))
+#define LINUX_VERSION_MAJOR 6
+#define LINUX_VERSION_PATCHLEVEL 12
+#define LINUX_VERSION_SUBLEVEL 84
+`),
+			)),
+		},
 	}, &MakeHelper{
 		SkipConfigure: true,
 
@@ -43,7 +57,11 @@ func (t Toolchain) newKernelHeaders() (pkg.Artifact, string) {
 			"INSTALL_HDR_PATH=/work/system",
 			"headers_install",
 		},
-		Install: "# headers installed during make",
+		Install: `
+cat \
+	/usr/src/version.h > \
+	/work/system/include/linux/version.h
+`,
 	},
 		Rsync,
 	), kernelVersion

internal/rosa/libarchive.go

@@ -0,0 +1,100 @@
+package rosa
+
+import "hakurei.app/internal/pkg"
+
+func (t Toolchain) newLibarchive() (pkg.Artifact, string) {
+	const (
+		version  = "3.8.7"
+		checksum = "CUJK4MDQmZmATClgQBH2Wt-7Ts4iiSUlg1J_TVb6-5IK3rVUgVLIMc5k-bnWB9w3"
+	)
+	return t.NewPackage("libarchive", version, newFromGitHub(
+		"libarchive/libarchive",
+		"v"+version, checksum,
+	), &PackageAttr{
+		Paths: []pkg.ExecPath{
+			pkg.Path(AbsUsrSrc.Append(
+				"CTestCustom.cmake",
+			), false, pkg.NewFile("CTestCustom.cmake", []byte(`
+list(APPEND CTEST_CUSTOM_TESTS_IGNORE
+	"libarchive_test_archive_string_conversion_fail_c"
+	"libarchive_test_archive_string_conversion_fail_latin1"
+	"libarchive_test_archive_string_update_utf8_koi8"
+	"libarchive_test_gnutar_filename_encoding_KOI8R_UTF8"
+	"libarchive_test_gnutar_filename_encoding_KOI8R_CP866"
+	"libarchive_test_gnutar_filename_encoding_CP1251_UTF8"
+	"libarchive_test_gnutar_filename_encoding_Russian_Russia"
+	"libarchive_test_gnutar_filename_encoding_EUCJP_UTF8"
+	"libarchive_test_gnutar_filename_encoding_EUCJP_CP932"
+	"libarchive_test_gnutar_filename_encoding_CP932_UTF8"
+	"libarchive_test_pax_filename_encoding_KOI8R"
+	"libarchive_test_pax_filename_encoding_CP1251"
+	"libarchive_test_pax_filename_encoding_EUCJP"
+	"libarchive_test_pax_filename_encoding_CP932"
+	"libarchive_test_read_format_cpio_filename_UTF8_eucJP"
+	"libarchive_test_read_format_cpio_filename_CP866_KOI8R"
+	"libarchive_test_read_format_cpio_filename_KOI8R_CP866"
+	"libarchive_test_read_format_cpio_filename_UTF8_KOI8R"
+	"libarchive_test_read_format_cpio_filename_UTF8_CP866"
+	"libarchive_test_read_format_cpio_filename_eucJP_CP932"
+	"libarchive_test_read_format_cpio_filename_UTF8_CP932"
+	"libarchive_test_read_format_cpio_filename_CP866_CP1251"
+	"libarchive_test_read_format_cpio_filename_CP866_CP1251_win"
+	"libarchive_test_read_format_cpio_filename_KOI8R_CP1251"
+	"libarchive_test_read_format_cpio_filename_UTF8_CP1251"
+	"libarchive_test_read_format_gtar_filename_CP866_KOI8R"
+	"libarchive_test_read_format_gtar_filename_KOI8R_CP866"
+	"libarchive_test_read_format_gtar_filename_eucJP_CP932"
+	"libarchive_test_read_format_gtar_filename_CP866_CP1251"
+	"libarchive_test_read_format_gtar_filename_CP866_CP1251_win"
+	"libarchive_test_read_format_gtar_filename_KOI8R_CP1251"
+	"libarchive_test_read_format_rar_unicode_CP932"
+	"libarchive_test_read_format_zip_filename_CP932_eucJP"
+	"libarchive_test_read_format_zip_filename_UTF8_eucJP"
+	"libarchive_test_read_format_zip_filename_CP866_KOI8R"
+	"libarchive_test_read_format_zip_filename_KOI8R_CP866"
+	"libarchive_test_read_format_zip_filename_UTF8_KOI8R"
+	"libarchive_test_read_format_zip_filename_UTF8_CP866"
+	"libarchive_test_read_format_zip_filename_CP932_CP932"
+	"libarchive_test_read_format_zip_filename_UTF8_CP932"
+	"libarchive_test_read_format_zip_filename_CP866_CP1251"
+	"libarchive_test_read_format_zip_filename_CP866_CP1251_win"
+	"libarchive_test_read_format_zip_filename_KOI8R_CP1251"
+	"libarchive_test_read_format_zip_filename_UTF8_CP1251"
+	"libarchive_test_ustar_filename_encoding_KOI8R_UTF8"
+	"libarchive_test_ustar_filename_encoding_KOI8R_CP866"
+	"libarchive_test_ustar_filename_encoding_CP1251_UTF8"
+	"libarchive_test_ustar_filename_encoding_Russian_Russia"
+	"libarchive_test_ustar_filename_encoding_EUCJP_UTF8"
+	"libarchive_test_ustar_filename_encoding_EUCJP_CP932"
+	"libarchive_test_ustar_filename_encoding_CP932_UTF8"
+	"libarchive_test_zip_filename_encoding_KOI8R"
+	"libarchive_test_zip_filename_encoding_ru_RU_CP1251"
+	"libarchive_test_zip_filename_encoding_Russian_Russia"
+	"libarchive_test_zip_filename_encoding_EUCJP"
+	"libarchive_test_zip_filename_encoding_CP932"
+	"libarchive_test_read_format_cab_filename"
+	"libarchive_test_read_format_lha_filename"
+	"libarchive_test_read_format_tar_filename"
+	"libarchive_test_read_format_ustar_filename"
+	"libarchive_test_read_append_wrong_filter"
+)
+`))),
+		},
+
+		Writable: true,
+		ScriptEarly: `
+install -Dv /usr/src/CTestCustom.cmake /cure/
+`,
+	}, (*CMakeHelper)(nil)), version
+}
+func init() {
+	artifactsM[Libarchive] = Metadata{
+		f: Toolchain.newLibarchive,
+
+		Name:        "libarchive",
+		Description: "multi-format archive and compression library",
+		Website:     "https://www.libarchive.org/",
+
+		ID: 1558,
+	}
+}

internal/rosa/libbsd.go

@@ -4,8 +4,8 @@ import "hakurei.app/internal/pkg"
 
 func (t Toolchain) newLibmd() (pkg.Artifact, string) {
 	const (
-		version  = "1.1.0"
-		checksum = "9apYqPPZm0j5HQT8sCsVIhnVIqRD7XgN7kPIaTwTqnTuUq5waUAMq4M7ev8CODJ1"
+		version  = "1.2.0"
+		checksum = "1rJ6joAO0wwMZvSfnRNkc1MOhywyAq7SM8VmF92NvDtv7Qdl1LRbjm5fg_DFFtGj"
 	)
 	return t.NewPackage("libmd", version, t.newTagRemote(
 		"https://git.hadrons.org/git/libmd.git",

internal/rosa/libconfig.go

@@ -0,0 +1,50 @@
+package rosa
+
+import "hakurei.app/internal/pkg"
+
+func (t Toolchain) newLibconfig() (pkg.Artifact, string) {
+	const (
+		version  = "1.8.2"
+		checksum = "fD32hjeAZuTz98g6WYHRwsxphrgrEFqxi5Z1jlJemPckPBfxpS3i5HgshAuA6vmT"
+	)
+	return t.NewPackage("libconfig", version, newFromGitHub(
+		"hyperrealm/libconfig",
+		"v"+version,
+		checksum,
+	), &PackageAttr{
+		Patches: []KV{
+			{"disable-broken-tests", `diff --git a/tests/tests.c b/tests/tests.c
+index eba7eae..f916d2e 100644
+--- a/tests/tests.c
++++ b/tests/tests.c
+@@ -753,7 +753,6 @@ int main(int argc, char **argv)
+   int failures;
+ 
+   TT_SUITE_START(LibConfigTests);
+-  TT_SUITE_TEST(LibConfigTests, ParsingAndFormatting);
+   TT_SUITE_TEST(LibConfigTests, ParseInvalidFiles);
+   TT_SUITE_TEST(LibConfigTests, ParseInvalidStrings);
+   TT_SUITE_TEST(LibConfigTests, BigInt1);
+@@ -768,7 +767,6 @@ int main(int argc, char **argv)
+   TT_SUITE_TEST(LibConfigTests, OverrideSetting);
+   TT_SUITE_TEST(LibConfigTests, SettingLookups);
+   TT_SUITE_TEST(LibConfigTests, ReadStream);
+-  TT_SUITE_TEST(LibConfigTests, BinaryAndHex);
+   TT_SUITE_RUN(LibConfigTests);
+   failures = TT_SUITE_NUM_FAILURES(LibConfigTests);
+   TT_SUITE_END(LibConfigTests);
+`},
+		},
+	}, (*CMakeHelper)(nil)), version
+}
+func init() {
+	artifactsM[Libconfig] = Metadata{
+		f: Toolchain.newLibconfig,
+
+		Name:        "libconfig",
+		Description: "a simple library for processing structured configuration files",
+		Website:     "https://hyperrealm.github.io/libconfig/",
+
+		ID: 1580,
+	}
+}

internal/rosa/libdisplay-info.go

@@ -0,0 +1,30 @@
+package rosa
+
+import "hakurei.app/internal/pkg"
+
+func (t Toolchain) newLibdisplayInfo() (pkg.Artifact, string) {
+	const (
+		version  = "0.3.0"
+		checksum = "yjOqPUHHYgRtpqGw5RI1n2Q1_hO5j0LiFNMbjcRWV4Nf71XwwoC9fZMlKBDeLchT"
+	)
+	return t.NewPackage("libdisplay-info", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"emersion/libdisplay-info",
+		version, checksum,
+	), nil, (*MesonHelper)(nil),
+		Diffutils,
+
+		Hwdata,
+	), version
+}
+func init() {
+	artifactsM[LibdisplayInfo] = Metadata{
+		f: Toolchain.newLibdisplayInfo,
+
+		Name:        "libdisplay-info",
+		Description: "EDID and DisplayID library",
+		Website:     "https://gitlab.freedesktop.org/emersion/libdisplay-info",
+
+		ID: 326668,
+	}
+}

internal/rosa/libepoxy.go

@@ -0,0 +1,33 @@
+package rosa
+
+import "hakurei.app/internal/pkg"
+
+func (t Toolchain) newLibepoxy() (pkg.Artifact, string) {
+	const (
+		version  = "1.5.10"
+		checksum = "OHI8wshrlGw6BMGrmSyejJtwzM2gPhyFJrTsKxULyKMmYrfgcOe7Iw2ibVoUND_Q"
+	)
+	return t.NewPackage("libepoxy", version, newFromGitHub(
+		"anholt/libepoxy",
+		version,
+		checksum,
+	), nil, &MesonHelper{
+		Setup: []KV{
+			{"Dglx", "no"},
+			{"Degl", "no"},
+		},
+	},
+		LibX11,
+	), version
+}
+func init() {
+	artifactsM[Libepoxy] = Metadata{
+		f: Toolchain.newLibepoxy,
+
+		Name:        "libepoxy",
+		Description: "a library for handling OpenGL function pointer management",
+		Website:     "https://github.com/anholt/libepoxy",
+
+		ID: 6090,
+	}
+}

internal/rosa/libexpat.go

@@ -8,8 +8,8 @@ import (
 
 func (t Toolchain) newLibexpat() (pkg.Artifact, string) {
 	const (
-		version  = "2.8.0"
-		checksum = "pnwZ_JSif-OfoWIwk2JYXWHagOWMA3Sh-Ea0p-4Rz9U9mDEeAebhyvnfD7OYOMCk"
+		version  = "2.8.1"
+		checksum = "iMEtbOJhQfGof2GxSlxffQSI1va_NDDQ9VIuqcPbNZ0291Dr8wttD5QecYyjIQap"
 	)
 	return t.NewPackage("libexpat", version, newFromGitHubRelease(
 		"libexpat/libexpat",

internal/rosa/libtirpc.go

@@ -0,0 +1,44 @@
+package rosa
+
+import (
+	"strings"
+
+	"hakurei.app/internal/pkg"
+)
+
+func (t Toolchain) newLibtirpc() (pkg.Artifact, string) {
+	const (
+		version  = "1.3.7"
+		checksum = "nzFfu7LNvnSNiNAryD1vtnNWnU-Xqee8KqfXUKoBf5yjb5-dkeRkYuRijdCoYLof"
+	)
+	return t.NewPackage("libtirpc", version, t.newTagRemote(
+		"git://linux-nfs.org/~steved/libtirpc",
+		"libtirpc-"+
+			strings.Join(strings.SplitN(version, ".", 3), "-"),
+		checksum,
+	), nil, &MakeHelper{
+		Generate: "sh -e ./bootstrap",
+		Configure: []KV{
+			{"CFLAGS", `"$(pkg-config --cflags libbsd-overlay) ${CFLAGS:-}"`},
+			{"disable-gssapi"},
+		},
+	},
+		Automake,
+		Libtool,
+		PkgConfig,
+
+		Libbsd,
+		KernelHeaders,
+	), version
+}
+func init() {
+	artifactsM[Libtirpc] = Metadata{
+		f: Toolchain.newLibtirpc,
+
+		Name:        "libtirpc",
+		Description: "a port of Suns Transport-Independent RPC library to Linux",
+		Website:     "https://sourceforge.net/projects/libtirpc/",
+
+		ID: 1740,
+	}
+}

internal/rosa/libucontext.go

@@ -4,8 +4,8 @@ import "hakurei.app/internal/pkg"
 
 func (t Toolchain) newLibucontext() (pkg.Artifact, string) {
 	const (
-		version  = "1.5"
-		checksum = "Ggk7FMmDNBdCx1Z9PcNWWW6LSpjGYssn2vU0GK5BLXJYw7ZxZbA2m_eSgT9TFnIG"
+		version  = "1.5.1"
+		checksum = "mUgeyJknjMxT-5fORzz-rqhZfP3Y7EZGBhOwvhuX7MsF4Pk9wkuwtrLf5IML-jWu"
 	)
 	return t.NewPackage("libucontext", version, newFromGitHub(
 		"kaniini/libucontext",

internal/rosa/llvm.go

@@ -2,7 +2,6 @@ package rosa
 
 import (
 	"regexp"
-	"runtime"
 	"slices"
 	"strings"
 
@@ -248,7 +247,7 @@ func (t Toolchain) newLLVM() (pkg.Artifact, string) {
 			// unwind: fails on musl
 			"eh_frame_fde_pc_range",
 		}
-		switch runtime.GOARCH {
+		switch arch {
 		case "arm64":
 			skipChecks = append(skipChecks,
 				// LLVM: intermittently crashes
@@ -275,7 +274,9 @@ func (t Toolchain) newLLVM() (pkg.Artifact, string) {
 	}
 
 	version := t.Version(llvmSource)
-	return t.NewPackage("llvm", version, t.Load(llvmSource), nil, &CMakeHelper{
+	return t.NewPackage("llvm", version, t.Load(llvmSource), &PackageAttr{
+		Flag: TExclusive,
+	}, &CMakeHelper{
 		Append: []string{"llvm"},
 
 		Cache: cache,
@@ -319,8 +320,8 @@ ninja ` + jobsFlagE + ` check-all
 }
 func init() {
 	const (
-		version  = "22.1.4"
-		checksum = "Bk3t-tV5sD5T0bqefFMcLeFuAwXnhFipywZmqst5hAZs97QQWGKB_5XyAFjj5tDB"
+		version  = "22.1.5"
+		checksum = "32gOaLPHcUlo3hkdk5RbFumTE01XKeCAYZcpvn8IDHF95egXVfDFSl6eZL3ChMen"
 	)
 
 	artifactsM[llvmSource] = Metadata{

internal/rosa/lm-sensors.go

@@ -0,0 +1,59 @@
+package rosa
+
+import "hakurei.app/internal/pkg"
+
+func (t Toolchain) newLMSensors() (pkg.Artifact, string) {
+	const (
+		version  = "3-6-2"
+		checksum = "7JYNutrihe-FP6r3ftf96uFZJJWPfxnBHL0ALSMA-vovaXVRr-sAjlLitw7WWpCI"
+	)
+	return t.NewPackage("lm_sensors", version, newFromGitHub(
+		"lm-sensors/lm-sensors",
+		"V"+version,
+		checksum,
+	), &PackageAttr{
+		Writable:    true,
+		Chmod:       true,
+		EnterSource: true,
+
+		ScriptEarly: `
+ln -s \
+	../../system/bin/perl \
+	/usr/bin/
+`,
+	}, &MakeHelper{
+		InPlace:       true,
+		SkipConfigure: true,
+
+		Make: []string{
+			"CC=cc",
+			"ETCDIR=/system/etc",
+			"PREFIX=/system",
+		},
+
+		Check: []string{
+			"CC=cc",
+			"check",
+		},
+
+		Install: "make DESTDIR=/work PREFIX=/system install",
+	},
+		Perl,
+		PerlTestCmd,
+
+		M4,
+		Bison,
+		Flex,
+	), version
+}
+func init() {
+	artifactsM[LMSensors] = Metadata{
+		f: Toolchain.newLMSensors,
+
+		Name:        "lm_sensors",
+		Description: "user-space support for hardware monitoring drivers",
+		Website:     "https://hwmon.wiki.kernel.org/lm_sensors",
+
+		ID: 1831,
+	}
+}

internal/rosa/mesa.go

@@ -1,6 +1,10 @@
 package rosa
 
-import "hakurei.app/internal/pkg"
+import (
+	"strings"
+
+	"hakurei.app/internal/pkg"
+)
 
 func (t Toolchain) newLibglvnd() (pkg.Artifact, string) {
 	const (
@@ -12,8 +16,22 @@ func (t Toolchain) newLibglvnd() (pkg.Artifact, string) {
 		"glvnd/libglvnd",
 		"v"+version,
 		checksum,
-	), nil, (*MesonHelper)(nil),
+	), nil, &MesonHelper{
+		Setup: []KV{
+			{"Dx11", "enabled"},
+			{"Dglx", "enabled"},
+		},
+		ScriptCompiled: `
+export DISPLAY=':0'
+Xvfb &
+XVFB_PID="$!"
+trap 'kill $XVFB_PID && wait $XVFB_PID' EXIT
+`,
+	},
 		Binutils, // symbols check fail with llvm nm
+		Xserver,  // test suite wants X server
+
+		LibXext,
 	), version
 }
 func init() {
@@ -24,6 +42,10 @@ func init() {
 		Description: "The GL Vendor-Neutral Dispatch library",
 		Website:     "https://gitlab.freedesktop.org/glvnd/libglvnd",
 
+		Dependencies: P{
+			LibXext,
+		},
+
 		ID: 12098,
 	}
 }
@@ -64,3 +86,180 @@ func init() {
 		ID: 1596,
 	}
 }
+
+func (t Toolchain) newLibva() (pkg.Artifact, string) {
+	const (
+		version  = "2.23.0"
+		checksum = "UmF5tPyWIG_w5kiR3KFpoYbF7UUcaak5tyc-RhOheNTwQlLkPlifreFYCM9FQxbq"
+	)
+	return t.NewPackage("libva", version, newFromGitHub(
+		"intel/libva",
+		version,
+		checksum,
+	), nil, &MesonHelper{
+		Setup: []KV{
+			{"Dwith_x11", "yes"},
+			{"Dwith_glx", "yes"},
+			{"Dwith_wayland", "yes"},
+		},
+	},
+		Libdrm,
+		LibXfixes,
+		Libglvnd,
+		Wayland,
+		KernelHeaders,
+	), version
+}
+func init() {
+	artifactsM[Libva] = Metadata{
+		f: Toolchain.newLibva,
+
+		Name:        "libva",
+		Description: "an implementation for VA-API (Video Acceleration API)",
+		Website:     "https://01.org/vaapi",
+
+		Dependencies: P{
+			Libdrm,
+			LibXfixes,
+			Libglvnd,
+			Wayland,
+		},
+
+		ID: 1752,
+	}
+}
+
+func (t Toolchain) newMesa() (pkg.Artifact, string) {
+	const (
+		version  = "26.1.0"
+		checksum = "zU0fjqevySBaoi_5SLW3e2UffmGeBdxOuHmAHTH68n2hV-sjYoqg30koLqFXuk5y"
+	)
+	return t.NewPackage("mesa", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"mesa/mesa",
+		"mesa-"+version,
+		checksum,
+	), nil, &MesonHelper{
+		Setup: []KV{
+			{"Dplatforms", "x11,wayland"},
+			{"Dvideo-codecs", "all"},
+
+			{"Dglvnd", "enabled"},
+			{"Dgbm", "enabled"},
+
+			{"Dgallium-drivers", strings.Join([]string{
+				"asahi",     // Apple AGX
+				"crocus",    // Intel legacy
+				"etnaviv",   // Vivante GPU designs (mostly NXP/Marvell SoCs)
+				"freedreno", // Qualcomm Adreno (all Qualcomm SoCs)
+				"i915",      // Intel extra legacy
+				"iris",      // new Intel (Broadwell+)
+				"lima",      // ARM Mali 4xx
+				"llvmpipe",  // software renderer
+				"nouveau",   // Nvidia
+				"panfrost",  // ARM Mali Midgard and up (T/G series)
+				"r300",      // very old AMD
+				"r600",      // less old AMD
+				"radeonsi",  // new AMD (GCN+)
+				"softpipe",  // older software renderer
+				"svga",      // VMWare virtualized GPU
+				"tegra",     // Nvidia Tegra SoCs
+				"v3d",       // Broadcom VC5 (Raspberry Pi 4)
+				"vc4",       // Broadcom VC4 (Raspberry Pi 0-3)
+				"virgl",     // QEMU virtualized GPU (aka VirGL)
+				"zink",      // generic OpenGL over Vulkan, experimental
+
+				// d3d12: WSL emulated GPU (aka Dozen)
+				// ethosu: accelerator
+				// rocket: accelerator
+			}, ",")},
+
+			{"Dvulkan-drivers", strings.Join([]string{
+				"amd",         // AMD (aka RADV)
+				"broadcom",    // Broadcom VC5 (Raspberry Pi 4, aka V3D)
+				"freedreno",   // Qualcomm Adreno (all Qualcomm SoCs)
+				"intel",       // new Intel (aka ANV)
+				"intel_hasvk", // Intel Haswell/Broadwell, "legacy" Vulkan driver (https://www.phoronix.com/news/Intel-HasVK-Drop-Dead-Code)
+				"panfrost",    // ARM Mali Midgard and up (T/G series)
+				"swrast",      // software renderer (aka Lavapipe)
+				"virtio",      // QEMU virtualized GPU (aka VirGL)
+				"imagination", // PowerVR Rogue
+				"asahi",       // Apple AGX
+				"gfxstream",   // Android virtualized GPU
+
+				// nouveau: Nouveau (aka NVK), requires rust
+				// microsoft-experimental: WSL virtualized GPU (aka DZN/Dozen)
+				// kosmickrisp: macOS-specific
+			}, ",")},
+			{"Dvulkan-layers", strings.Join([]string{
+				"device-select",
+				"intel-nullhw",
+				"overlay",
+				"screenshot",
+				"anti-lag",
+				"vram-report-limit",
+			}, ",")},
+
+			{"Dfreedreno-kmds", "msm,virtio"},
+			{"Damdgpu-virtio", "true"},
+		},
+	},
+		M4,
+		PythonPackaging,
+		PythonMako,
+		PythonPyYAML,
+		PythonPycparser,
+		Glslang,
+		SPIRVLLVMTranslator,
+
+		Zlib,
+		Zstd,
+		Gzip,
+		Ncurses,
+		Libglvnd,
+		Libexpat,
+		Libva,
+		Libdrm,
+		Elfutils,
+		Bison,
+		Flex,
+		LMSensors,
+		Libconfig,
+		LibdisplayInfo,
+		Wayland,
+		WaylandProtocols,
+		Libxshmfence,
+		LibXxf86vm,
+		LibXrandr,
+		LibxcbUtilKeysyms,
+		Libpng,
+		Libarchive,
+		KernelHeaders,
+	), version
+}
+func init() {
+	artifactsM[Mesa] = Metadata{
+		f: Toolchain.newMesa,
+
+		Name:        "mesa",
+		Description: "open source implementations of OpenGL, OpenGL ES, Vulkan, OpenCL, and more",
+		Website:     "https://mesa3d.org",
+
+		Dependencies: P{
+			Libdrm,
+			Elfutils,
+			LMSensors,
+			LibdisplayInfo,
+			Wayland,
+			Libxshmfence,
+			LibXxf86vm,
+			LibXrandr,
+			LibxcbUtilKeysyms,
+			Libpng,
+		},
+
+		ID: 1970,
+
+		latest: (*Versions).getStable,
+	}
+}

internal/rosa/mksh.go

@@ -7,6 +7,10 @@ func (t Toolchain) newMksh() (pkg.Artifact, string) {
 		version  = "59c"
 		checksum = "0Zj-k4nXEu3IuJY4lvwD2OrC2t27GdZj8SPy4DoaeuBRH1padWb7oREpYgwY8JNq"
 	)
+	scriptTest := "./test.sh -C regress:no-ctty\n"
+	if presetOpts&OptSkipCheck != 0 {
+		scriptTest = ""
+	}
 	return t.New("mksh-"+version, 0, t.AppendPresets(nil,
 		Perl,
 		Coreutils,
@@ -18,8 +22,7 @@ cd "$(mktemp -d)"
 sh /usr/src/mksh/Build.sh -r
 CPPFLAGS="${CPPFLAGS} -DMKSH_BINSHPOSIX -DMKSH_BINSHREDUCED" \
 sh /usr/src/mksh/Build.sh -r -L
-./test.sh -C regress:no-ctty
-
+`+scriptTest+`
 mkdir -p /work/system/bin/
 cp -v mksh /work/system/bin/
 cp -v lksh /work/system/bin/sh

internal/rosa/perl.go

@@ -382,3 +382,27 @@ func init() {
 		ID: 3549,
 	}
 }
+
+func (t Toolchain) newPerlTestCmd() (pkg.Artifact, string) {
+	const (
+		version  = "1.09"
+		checksum = "gpGUwyC9IozDiYSgW_kXARNfXsTPFa6cTowJmmCBbPqcs2-pONZca_SB06FGy-7H"
+	)
+	return t.newViaPerlMakeMaker("Test::Cmd", version, newFromCPAN(
+		"NEILB",
+		"Test-Cmd",
+		version,
+		checksum,
+	), nil), version
+}
+func init() {
+	artifactsM[PerlTestCmd] = Metadata{
+		f: Toolchain.newPerlTestCmd,
+
+		Name:        "perl-Test::Cmd",
+		Description: "portable testing of commands and scripts",
+		Website:     "https://metacpan.org/release/Test-Cmd",
+
+		ID: 6014,
+	}
+}

internal/rosa/pixman.go

@@ -0,0 +1,31 @@
+package rosa
+
+import "hakurei.app/internal/pkg"
+
+func (t Toolchain) newPixman() (pkg.Artifact, string) {
+	const (
+		version  = "0.46.4"
+		checksum = "iECDxLG9SxUrvGHqeDoaBa-b3uqdT5DC4zudjtrwb8Wodq82pyacmFNEAo4SDsiE"
+	)
+	return t.NewPackage("pixman", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"pixman/pixman",
+		"pixman-"+version,
+		checksum,
+	), nil, &MesonHelper{
+		Setup: []KV{
+			{"Dtests", "enabled"},
+		},
+	}), version
+}
+func init() {
+	artifactsM[Pixman] = Metadata{
+		f: Toolchain.newPixman,
+
+		Name:        "pixman",
+		Description: "a low-level software library for pixel manipulation",
+		Website:     "https://pixman.org/",
+
+		ID: 3648,
+	}
+}

internal/rosa/python.go

@@ -9,8 +9,8 @@ import (
 
 func (t Toolchain) newPython() (pkg.Artifact, string) {
 	const (
-		version  = "3.14.4"
-		checksum = "X0VRAAGOlCVldh4J9tRAE-YrJtDvqfQTJaqxKPXNX6YTPlwpR9GwA5WRIZDO-63s"
+		version  = "3.14.5"
+		checksum = "zYIpDlk2ftZ-UVGCQS1rthle2OHoyXV653ztWiopKV1NhmIJf1K2hHbkwM4DozQ9"
 	)
 	return t.NewPackage("python", version, newTar(
 		"https://www.python.org/ftp/python/"+version+
@@ -395,8 +395,8 @@ func init() {
 
 func init() {
 	const (
-		version  = "2026.4.28.13"
-		checksum = "Z3MbmMXtmWHCM3-EvJehb9MzDqX7Ce_Xg86D5g5nxFRWMKqwHwnQ8R-AlKf-32HU"
+		version  = "2026.5.7.17"
+		checksum = "1Fcps0gK9P4ofwGL8MISN9k1Q40-quxX7NDpIna50TmziBNrZy-0Vz0I9yIeHCoP"
 	)
 	artifactsM[PythonTroveClassifiers] = newPythonPackage(
 		"trove-classifiers", 88298,

internal/rosa/qemu.go

@@ -62,6 +62,7 @@ EOF
 			{"disable-download"},
 			{"disable-docs"},
 
+			{"static"},
 			{"target-list-exclude", "" +
 				// fails to load firmware
 				"ppc-linux-user," +

internal/rosa/rosa.go

@@ -4,7 +4,6 @@ package rosa
 import (
 	"errors"
 	"path"
-	"runtime"
 	"slices"
 	"strconv"
 	"strings"
@@ -54,10 +53,9 @@ var (
 	AbsSystem = fhs.AbsRoot.Append("system")
 )
 
-// linuxArch returns the architecture name used by linux corresponding to
-// [runtime.GOARCH].
+// linuxArch returns the architecture name used by linux corresponding to arch.
 func linuxArch() string {
-	switch runtime.GOARCH {
+	switch arch {
 	case "amd64":
 		return "x86_64"
 	case "arm64":
@@ -66,11 +64,11 @@ func linuxArch() string {
 		return "riscv64"
 
 	default:
-		panic("unsupported target " + runtime.GOARCH)
+		panic("unsupported target " + arch)
 	}
 }
 
-// triplet returns the Rosa OS host triple corresponding to [runtime.GOARCH].
+// triplet returns the Rosa OS host triple corresponding to arch.
 func triplet() string {
 	return linuxArch() + "-rosa-linux-musl"
 }
@@ -80,9 +78,9 @@ type perArch[T any] map[string]T
 
 // unwrap returns the value for the current architecture.
 func (p perArch[T]) unwrap() T {
-	v, ok := p[runtime.GOARCH]
+	v, ok := p[arch]
 	if !ok {
-		panic("unsupported target " + runtime.GOARCH)
+		panic("unsupported target " + arch)
 	}
 	return v
 }
@@ -222,6 +220,8 @@ const (
 	TEarly
 	// TNoToolchain excludes the LLVM toolchain.
 	TNoToolchain
+	// THostNet arranges for a [pkg.KindExecNet] to be created.
+	THostNet
 )
 
 var (
@@ -268,7 +268,7 @@ func (t Toolchain) New(
 		support = append(support, extra...)
 		support = append(support, cureEtc{})
 		if t == toolchainStage0 {
-			support = append(support, NewStage0())
+			support = append(support, t.Load(stage0Dist))
 		} else {
 			support = append(support, _toolchainBusybox.New("gentoo", 0, nil, nil, nil, `
 tar -C /work -xf /usr/src/stage3.tar.xz
@@ -327,7 +327,9 @@ mkdir -vp /work/system/bin
 	}
 
 	return pkg.NewExec(
-		name, knownChecksum, pkg.ExecTimeoutMax, flag&TExclusive != 0,
+		name, arch, knownChecksum, pkg.ExecTimeoutMax,
+		flag&THostNet != 0,
+		flag&TExclusive != 0,
 		fhs.AbsRoot, env,
 		AbsSystem.Append("bin", "sh"),
 		[]string{"sh", absCureScript.String()},
@@ -410,6 +412,9 @@ type Helper interface {
 
 // PackageAttr holds build-system-agnostic attributes.
 type PackageAttr struct {
+	// Measure output if populated. Required by [THostNet].
+	KnownChecksum *pkg.Checksum
+
 	// Mount the source tree writable.
 	Writable bool
 	// Do not pass through [Toolchain.NewPatchedSource].
@@ -547,7 +552,7 @@ cd '/usr/src/` + name + `/'
 		name+"-"+version,
 		attr.Flag,
 		extraRes,
-		nil,
+		attr.KnownChecksum,
 		attr.Env,
 		scriptEarly+helper.script(name),
 		slices.Concat(attr.Paths, []pkg.ExecPath{

internal/rosa/rosa_test.go

@@ -28,7 +28,7 @@ var (
 )
 
 func TestMain(m *testing.M) {
-	rosa.DropCaches(rosa.OptLLVMNoLTO)
+	rosa.DropCaches("", rosa.OptLLVMNoLTO)
 	container.TryArgv0(nil)
 
 	code := m.Run()
@@ -94,14 +94,14 @@ func TestCureAll(t *testing.T) {
 }
 
 func BenchmarkStage3(b *testing.B) {
-	flags := rosa.Flags()
-	b.Cleanup(func() { rosa.DropCaches(flags) })
+	arch, flags := rosa.Arch(), rosa.Flags()
+	b.Cleanup(func() { rosa.DropCaches(arch, flags) })
 
 	for b.Loop() {
 		rosa.Std.Load(rosa.LLVM)
 
 		b.StopTimer()
-		rosa.DropCaches(0)
+		rosa.DropCaches("", 0)
 		b.StartTimer()
 	}
 }

internal/rosa/stage0.go

@@ -1,8 +1,6 @@
 package rosa
 
 import (
-	"sync"
-
 	"hakurei.app/fhs"
 	"hakurei.app/internal/pkg"
 )
@@ -32,25 +30,32 @@ func init() {
 	}
 }
 
-var (
-	// stage0 stores the tarball unpack artifact.
-	stage0 pkg.Artifact
-	// stage0Once is for lazy initialisation of stage0.
-	stage0Once sync.Once
-)
+func init() {
+	const version = "20260504"
+	artifactsM[stage0Dist] = Metadata{
+		f: func(Toolchain) (pkg.Artifact, string) {
+			return newTar(
+				"https://hakurei.app/seed/"+version+"/"+
+					"stage0-"+triplet()+".tar.bz2",
+				perArch[string]{
+					"amd64":   "IQjFDkiAVLo1XzflgMMiLP3gnVY2hhDMTzl-QqJDCQhcLQ3lLtRzjI5WCxGyW_lk",
+					"arm64":   "6fmwl2Umx2QssKQvxxb1JOGkAjzfA_MXKku0jVdGjYGb35OvwEVA5NYtd0HIy3yH",
+					"riscv64": "Z2ODV0rIoo9iQRUIu35bsaOBeXc_9qQfGcyb2aGneatzNUJlXh5emSpEV2bOklUL",
+				}.unwrap(),
+				pkg.TarBzip2,
+			), version
+		},
 
-// NewStage0 returns a stage0 distribution created from curing [Stage0].
-func NewStage0() pkg.Artifact {
-	stage0Once.Do(func() {
-		stage0 = newTar(
-			"https://hakurei.app/seed/20260504/"+
-				"stage0-"+triplet()+".tar.bz2",
-			perArch[string]{
-				"amd64": "IQjFDkiAVLo1XzflgMMiLP3gnVY2hhDMTzl-QqJDCQhcLQ3lLtRzjI5WCxGyW_lk",
-				"arm64": "6fmwl2Umx2QssKQvxxb1JOGkAjzfA_MXKku0jVdGjYGb35OvwEVA5NYtd0HIy3yH",
-			}.unwrap(),
-			pkg.TarBzip2,
-		)
-	})
-	return stage0
+		Name:        "stage0-dist",
+		Description: "Rosa OS stage0 bootstrap seed",
+	}
+}
+
+// HasStage0 returns whether a stage0 distribution is available.
+func HasStage0() (ok bool) {
+	func() {
+		defer func() { ok = recover() == nil }()
+		toolchainStage0.Load(stage0Dist)
+	}()
+	return
 }

internal/rosa/tamago.go

@@ -1,15 +1,11 @@
 package rosa
 
-import (
-	"runtime"
-
-	"hakurei.app/internal/pkg"
-)
+import "hakurei.app/internal/pkg"
 
 func (t Toolchain) newTamaGo() (pkg.Artifact, string) {
 	const (
-		version  = "1.26.2"
-		checksum = "5xlhWq2NGhYCjt0y73QkydJ386lxg6-HkiO84ne6ByQSJBDat7-HSVzNA6jy7Laz"
+		version  = "1.26.3"
+		checksum = "-nH3MjAzDDLTeJ2hRKYJcJwo5-Ikci4zOHfB8j1vKn7zrF9TS6zYaoLi8qohGwAE"
 	)
 	return t.New("tamago-go"+version, 0, t.AppendPresets(nil,
 		Bash,
@@ -26,7 +22,7 @@ chmod -R +w ..
 
 sed -i \
 	's,/lib/ld-musl-`+linuxArch()+`.so.1,/system/bin/linker,' \
-	cmd/link/internal/`+runtime.GOARCH+`/obj.go
+	cmd/link/internal/`+arch+`/obj.go
 sed -i \
 	's/cpu.X86.HasAVX512VBMI/& \&\& cpu.X86.HasPOPCNT/' \
 	internal/runtime/gc/scan/scan_amd64.go

internal/rosa/vim.go

@@ -0,0 +1,45 @@
+package rosa
+
+import "hakurei.app/internal/pkg"
+
+func (t Toolchain) newVIM() (pkg.Artifact, string) {
+	const (
+		version  = "9.2.0461"
+		checksum = "18Rr_5oIf_PkKuqVkN4CMZIGkZEgpN1vamlrsvPLBjn4mN98CRuoJmhzRZ7MoVYM"
+	)
+	return t.NewPackage("vim", version, newFromGitHub(
+		"vim/vim",
+		"v"+version,
+		checksum,
+	), &PackageAttr{
+		Chmod:       true,
+		Writable:    true,
+		EnterSource: true,
+	}, &MakeHelper{
+		InPlace: true,
+		Configure: []KV{
+			{"with-tlib", "ncursesw"},
+		},
+		Check: []string{"test"},
+
+		// very expensive
+		SkipCheck: true,
+	},
+		Ncurses,
+	), version
+}
+func init() {
+	artifactsM[VIM] = Metadata{
+		f: Toolchain.newVIM,
+
+		Name:        "vim",
+		Description: "a greatly improved version of the good old UNIX editor Vi",
+		Website:     "https://www.vim.org",
+
+		Dependencies: P{
+			Ncurses,
+		},
+
+		ID: 5092,
+	}
+}

internal/rosa/x.go

@@ -186,6 +186,166 @@ func init() {
 	}
 }
 
+func (t Toolchain) newLibxcbUtilKeysyms() (pkg.Artifact, string) {
+	const (
+		version  = "0.4.1"
+		checksum = "-EEje12UEjtFBuIjb6Fy4cxEghV20BXwQ1BLvhtvSuVcrFkp_X-ZHRM48wAspXZ4"
+	)
+	return t.NewPackage("libxcb-util-keysyms", version, newTar(
+		"https://xcb.freedesktop.org/dist/xcb-util-keysyms-"+version+".tar.gz",
+		checksum,
+		pkg.TarGzip,
+	), nil, (*MakeHelper)(nil),
+		PkgConfig,
+
+		XCB,
+	), version
+}
+func init() {
+	artifactsM[LibxcbUtilKeysyms] = Metadata{
+		f: Toolchain.newLibxcbUtilKeysyms,
+
+		Name:        "libxcb-util-keysyms",
+		Description: "standard X key constants and conversion to/from keycodes",
+		Website:     "https://gitlab.freedesktop.org/xorg/lib/libxcb-keysyms",
+
+		Dependencies: P{
+			XCB,
+		},
+
+		ID: 5168,
+	}
+}
+
+func (t Toolchain) newLibxcbUtilImage() (pkg.Artifact, string) {
+	const (
+		version  = "0.4.1"
+		checksum = "47pvXmFwaUBZIrJ4CE9xjTQIFyxeqoNAL-DshlB11GZ_jjI3G1a6KF0K7mtBQ1E7"
+	)
+	return t.NewPackage("libxcb-util-image", version, newTar(
+		"https://xcb.freedesktop.org/dist/xcb-util-image-"+version+".tar.gz",
+		checksum,
+		pkg.TarGzip,
+	), nil, (*MakeHelper)(nil),
+		PkgConfig,
+
+		LibxcbUtil,
+	), version
+}
+func init() {
+	artifactsM[LibxcbUtilImage] = Metadata{
+		f: Toolchain.newLibxcbUtilImage,
+
+		Name:        "libxcb-util-image",
+		Description: "XCB port of Xlib's XImage and XShmImage functions",
+		Website:     "https://gitlab.freedesktop.org/xorg/lib/libxcb-image",
+
+		Dependencies: P{
+			LibxcbUtil,
+		},
+
+		ID: 5168,
+	}
+}
+
+func (t Toolchain) newLibxcbUtilWM() (pkg.Artifact, string) {
+	const (
+		version  = "0.4.2"
+		checksum = "g0VZgMU9hcIgyXb3XxBR9xqsvUMBd9qt_Dbmwoj2h5y24pODr_S_D0DhRsuXUNjF"
+	)
+	return t.NewPackage("libxcb-util-wm", version, newTar(
+		"https://xcb.freedesktop.org/dist/xcb-util-wm-"+version+".tar.gz",
+		checksum,
+		pkg.TarGzip,
+	), nil, (*MakeHelper)(nil),
+		M4,
+		PkgConfig,
+
+		XCB,
+	), version
+}
+func init() {
+	artifactsM[LibxcbUtilWM] = Metadata{
+		f: Toolchain.newLibxcbUtilWM,
+
+		Name:        "libxcb-util-wm",
+		Description: "XCB client and window-manager helpers for ICCCM & EWMH",
+		Website:     "https://gitlab.freedesktop.org/xorg/lib/libxcb-wm",
+
+		Dependencies: P{
+			XCB,
+		},
+
+		ID: 5170,
+	}
+}
+
+func (t Toolchain) newLibxcbUtil() (pkg.Artifact, string) {
+	const (
+		version  = "0.4.1"
+		checksum = "YMXGQUQbF6PoEAGflvYnJYsLWjti6sL_ifY47wIXTNGVM3tQ8u41nkBYN4K1D5CD"
+	)
+	return t.NewPackage("libxcb-util", version, newTar(
+		"https://www.x.org/releases/individual/xcb/"+
+			"xcb-util-"+version+".tar.gz",
+		checksum,
+		pkg.TarGzip,
+	), nil, (*MakeHelper)(nil),
+		PkgConfig,
+
+		utilMacros,
+		XCB,
+	), version
+}
+func init() {
+	artifactsM[LibxcbUtil] = Metadata{
+		f: Toolchain.newLibxcbUtil,
+
+		Name:        "libxcb-util",
+		Description: "XCB utility libraries",
+		Website:     "https://gitlab.freedesktop.org/xorg/lib/libxcb-util",
+
+		Dependencies: P{
+			XCB,
+		},
+
+		ID: 5165,
+	}
+}
+
+func (t Toolchain) newLibxcbRenderUtil() (pkg.Artifact, string) {
+	const (
+		version  = "0.3.10"
+		checksum = "n08L8PyCoOd7v2vb6fSVq5Pq6JtteXVh9K2wrQMTNwGMf_Fjpi6i3HWF-TMFSVTI"
+	)
+	return t.NewPackage("libxcb-render-util", version, newTar(
+		"https://www.x.org/releases/individual/xcb/"+
+			"xcb-util-renderutil-"+version+".tar.gz",
+		checksum,
+		pkg.TarGzip,
+	), nil, (*MakeHelper)(nil),
+		PkgConfig,
+
+		utilMacros,
+		XCB,
+	), version
+}
+func init() {
+	artifactsM[LibxcbRenderUtil] = Metadata{
+		f: Toolchain.newLibxcbRenderUtil,
+
+		Name:        "libxcb-render-util",
+		Description: "XCB convenience functions for the Render extension",
+		Website:     "https://gitlab.freedesktop.org/xorg/lib/libxcb-render-util",
+
+		Dependencies: P{
+			XCB,
+		},
+
+		ID: 5169,
+	}
+}
+
 func (t Toolchain) newLibX11() (pkg.Artifact, string) {
 	const (
 		version  = "1.8.13"
@@ -267,6 +427,44 @@ func init() {
 	}
 }
 
+func (t Toolchain) newLibXfixes() (pkg.Artifact, string) {
+	const (
+		version  = "6.0.2"
+		checksum = "_-kJfKZ7cE3NNeMr6NLSXCmsyP7MVEHVPLNfxatz2qBy3_fZJvPMQwZNOC9y6V5L"
+	)
+	return t.NewPackage("libXfixes", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"xorg/lib/libxfixes",
+		"libXfixes-"+version,
+		checksum,
+	), nil, &MakeHelper{
+		Generate: "NOCONFIGURE=1 ./autogen.sh",
+	},
+		Automake,
+		Libtool,
+		PkgConfig,
+
+		utilMacros,
+		XorgProto,
+		LibX11,
+	), version
+}
+func init() {
+	artifactsM[LibXfixes] = Metadata{
+		f: Toolchain.newLibXfixes,
+
+		Name:        "libXfixes",
+		Description: "Xlib-based library for the XFIXES Extension",
+		Website:     "https://www.freedesktop.org/wiki/Software/FixesExt/",
+
+		Dependencies: P{
+			LibX11,
+		},
+
+		ID: 1775,
+	}
+}
+
 func (t Toolchain) newLibXrender() (pkg.Artifact, string) {
 	const (
 		version  = "0.9.12"
@@ -415,6 +613,264 @@ func init() {
 	}
 }
 
+func (t Toolchain) newFontUtil() (pkg.Artifact, string) {
+	const (
+		version  = "1.4.2"
+		checksum = "YWiaIxkq-N2yNdbGa_RF1S0UkQq6xsgoRT73WZP2DOmyH_CJ0TAkpQjId657MQmh"
+	)
+	return t.NewPackage("font-util", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"xorg/font/util",
+		"font-util-"+version,
+		checksum,
+	), nil, &MakeHelper{
+		Generate: "NOCONFIGURE=1 ./autogen.sh",
+	},
+		Automake,
+		Libtool,
+		PkgConfig,
+
+		utilMacros,
+	), version
+}
+func init() {
+	artifactsM[FontUtil] = Metadata{
+		f: Toolchain.newFontUtil,
+
+		Name:        "font-util",
+		Description: "X.Org font package creation/installation utilities",
+		Website:     "https://gitlab.freedesktop.org/xorg/font/util",
+
+		ID: 15055,
+	}
+}
+
+func (t Toolchain) newLibfontenc() (pkg.Artifact, string) {
+	const (
+		version  = "1.1.9"
+		checksum = "XqosXfbVwaoYzG9vVyRCl3eatwjASoJdLZsxQ37NN8S_jTyqNmbxpRSJGImJj7RS"
+	)
+	return t.NewPackage("libfontenc", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"xorg/lib/libfontenc",
+		"libfontenc-"+version,
+		checksum,
+	), nil, &MakeHelper{
+		Generate: "NOCONFIGURE=1 ./autogen.sh",
+	},
+		Automake,
+		Libtool,
+		PkgConfig,
+
+		utilMacros,
+		FontUtil,
+		XorgProto,
+	), version
+}
+func init() {
+	artifactsM[Libfontenc] = Metadata{
+		f: Toolchain.newLibfontenc,
+
+		Name:        "libfontenc",
+		Description: "X font encoding library",
+		Website:     "https://gitlab.freedesktop.org/xorg/lib/libfontenc",
+
+		ID: 1613,
+	}
+}
+
+func (t Toolchain) newLibxkbfile() (pkg.Artifact, string) {
+	const (
+		version  = "1.2.0"
+		checksum = "WUtph1ab0AyATahlwljchBxZJcpjYrjyhCK9DW2VO0uXEXaN22GWmUaibcA83i_B"
+	)
+	return t.NewPackage("libxkbfile", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"xorg/lib/libxkbfile",
+		"libxkbfile-"+version,
+		checksum,
+	), nil, (*MesonHelper)(nil),
+		LibX11,
+	), version
+}
+func init() {
+	artifactsM[Libxkbfile] = Metadata{
+		f: Toolchain.newLibxkbfile,
+
+		Name:        "libxkbfile",
+		Description: "XKB file handling routines",
+		Website:     "http://www.x.org/wiki/XKB",
+
+		Dependencies: P{
+			LibX11,
+		},
+
+		ID: 1781,
+	}
+}
+
+func (t Toolchain) newXkbcomp() (pkg.Artifact, string) {
+	const (
+		version  = "1.5.0"
+		checksum = "ttICW8ZPbljI-nw2kknvxFhwFoDK40iAMBeZDLAHYsHf3B6UPO_zc9TpzZYRRyZH"
+	)
+	return t.NewPackage("xkbcomp", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"xorg/app/xkbcomp",
+		"xkbcomp-"+version,
+		checksum,
+	), nil, &MakeHelper{
+		Generate: "NOCONFIGURE=1 ./autogen.sh",
+	},
+		Automake,
+		Libtool,
+		PkgConfig,
+		Bison,
+
+		utilMacros,
+		Libxkbfile,
+	), version
+}
+func init() {
+	artifactsM[Xkbcomp] = Metadata{
+		f: Toolchain.newXkbcomp,
+
+		Name:        "xkbcomp",
+		Description: "XKB keyboard description compiler",
+		Website:     "http://www.x.org/wiki/XKB",
+
+		Dependencies: P{
+			Libxkbfile,
+		},
+
+		ID: 15018,
+	}
+}
+
+func (t Toolchain) newLibXfont2() (pkg.Artifact, string) {
+	const (
+		version  = "2.0.7"
+		checksum = "jv9BZNA02493KB8j1lfAErF5SA3ZFcAhm3_UVJ--Bp1maz-vNprl_wXpkHApBi9M"
+	)
+	return t.NewPackage("libXfont2", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"xorg/lib/libxfont",
+		"libXfont2-"+version,
+		checksum,
+	), nil, &MakeHelper{
+		Generate: "NOCONFIGURE=1 ./autogen.sh",
+	},
+		Automake,
+		Libtool,
+		PkgConfig,
+
+		utilMacros,
+		Freetype,
+		XorgProto,
+		Libxtrans,
+		Libfontenc,
+	), version
+}
+func init() {
+	artifactsM[LibXfont2] = Metadata{
+		f: Toolchain.newLibXfont2,
+
+		Name:        "libXfont2",
+		Description: "X font handling library for server & utilities",
+		Website:     "https://gitlab.freedesktop.org/xorg/lib/libxfont",
+
+		Dependencies: P{
+			Freetype,
+			Libfontenc,
+		},
+
+		ID: 17165,
+	}
+}
+
+func (t Toolchain) newLibxcvt() (pkg.Artifact, string) {
+	const (
+		version  = "0.1.3"
+		checksum = "IfIA7SxlHMWh681e1AgYmZcRAfkZd5LlzmqcMRifNY5nNVRrUx_wnoaidAv0Yu03"
+	)
+	return t.NewPackage("libxcvt", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"xorg/lib/libxcvt",
+		"libxcvt-"+version,
+		checksum,
+	), nil, (*MesonHelper)(nil)), version
+}
+func init() {
+	artifactsM[Libxcvt] = Metadata{
+		f: Toolchain.newLibxcvt,
+
+		Name:        "libxcvt",
+		Description: "VESA CVT standard timing modeline generation library & utility",
+		Website:     "https://gitlab.freedesktop.org/xorg/lib/libxcvt",
+
+		ID: 235147,
+	}
+}
+
+func (t Toolchain) newLibXdmcp() (pkg.Artifact, string) {
+	const (
+		version  = "1.1.5"
+		checksum = "N6AJSv9pmeBedFn8KuSIOUGvTken4rkypNWVE2KfPlliwkfIbhfXrt5YHZkBMUHp"
+	)
+	return t.NewPackage("libXdmcp", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"xorg/lib/libxdmcp",
+		"libXdmcp-"+version,
+		checksum,
+	), nil, &MakeHelper{
+		Generate: "NOCONFIGURE=1 ./autogen.sh",
+	},
+		Automake,
+		Libtool,
+		PkgConfig,
+
+		utilMacros,
+		XorgProto,
+	), version
+}
+func init() {
+	artifactsM[LibXdmcp] = Metadata{
+		f: Toolchain.newLibXdmcp,
+
+		Name:        "libXdmcp",
+		Description: "X Display Manager Control Protocol library",
+		Website:     "https://gitlab.freedesktop.org/xorg/lib/libxdmcp",
+
+		ID: 1772,
+	}
+}
+
+func (t Toolchain) newXkeyboardConfig() (pkg.Artifact, string) {
+	const (
+		version  = "2.47"
+		checksum = "E03PsPIaRrxPAuKgDGSQyPiJB49wXtyyvdV0lVx3_G-pelMMlaFLkoTDHTHG_qgA"
+	)
+	return t.NewPackage("xkeyboard-config", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"xkeyboard-config/xkeyboard-config",
+		"xkeyboard-config-"+version,
+		checksum,
+	), nil, (*MesonHelper)(nil),
+		Perl,
+	), version
+}
+func init() {
+	artifactsM[XkeyboardConfig] = Metadata{
+		f: Toolchain.newXkeyboardConfig,
+
+		Name:        "xkeyboard-config",
+		Description: "the non-arch keyboard configuration database for X Window",
+		Website:     "https://www.freedesktop.org/wiki/Software/XKeyboardConfig/",
+
+		ID: 5191,
+	}
+}
+
 func (t Toolchain) newLibpciaccess() (pkg.Artifact, string) {
 	const (
 		version  = "0.19"
@@ -446,3 +902,87 @@ func init() {
 		ID: 1703,
 	}
 }
+
+func (t Toolchain) newXserver() (pkg.Artifact, string) {
+	const (
+		version  = "21.1.22"
+		checksum = "prLT2wKecBu5m9w1ThgIt0GvenNpjKXoOyvTiMA1oQTlP0QHh6QiWsdvH3OmUwNo"
+	)
+	return t.NewPackage("xserver", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"xorg/xserver",
+		"xorg-server-"+version,
+		checksum,
+	), nil, &MesonHelper{
+		Setup: []KV{
+			{"Dxorg", "true"},
+			{"Dxephyr", "true"},
+			{"Dxnest", "true"},
+			{"Dipv6", "false"},
+
+			{"Dudev", "false"},
+			{"Dudev_kms", "false"},
+			{"Dglx", "false"},
+			// ../../usr/src/xserver/glamor/glamor_glx.c:24:10: fatal error: 'epoxy/glx.h' file not found
+			{"Dglamor", "false"},
+		},
+	},
+		Gawk,
+
+		XorgProto,
+		Libxtrans,
+		Libxshmfence,
+		Pixman,
+		Libbsd,
+		Xkbcomp,
+		XkeyboardConfig,
+		LibXfont2,
+		DBus,
+		FontUtil,
+		Libxcvt,
+		LibXext,
+		Libmd,
+		LibXdmcp,
+		Libtirpc,
+		Libepoxy,
+		LibxcbUtil,
+		LibxcbUtilImage,
+		LibxcbUtilWM,
+		LibxcbUtilKeysyms,
+		LibxcbRenderUtil,
+		Libpciaccess,
+		KernelHeaders,
+	), version
+}
+func init() {
+	artifactsM[Xserver] = Metadata{
+		f: Toolchain.newXserver,
+
+		Name:        "xserver",
+		Description: "X server",
+		Website:     "https://gitlab.freedesktop.org/xorg/xserver",
+
+		Dependencies: P{
+			Xkbcomp,
+			XkeyboardConfig,
+
+			XCB,
+			Pixman,
+			Libmd,
+			Libbsd,
+			Libtirpc,
+			Libxcvt,
+			LibXdmcp,
+			LibXfont2,
+			Libpciaccess,
+
+			// Xephyr
+			LibxcbUtilImage,
+			LibxcbUtilWM,
+			LibxcbUtilKeysyms,
+			LibxcbRenderUtil,
+		},
+
+		ID: 5250,
+	}
+}

make.sh

@@ -0,0 +1,3 @@
+#!/bin/sh -e
+
+HAKUREI_DIST_MAKE=1 exec "$(dirname -- "$0")/cmd/dist/dist.sh"

options.md

@@ -35,7 +35,7 @@ package
 
 
 *Default:*
-` <derivation hakurei-static-x86_64-unknown-linux-musl-0.4.1> `
+` <derivation hakurei-static-x86_64-unknown-linux-musl-0.4.2> `
 
 
 
@@ -842,7 +842,7 @@ package
 
 
 *Default:*
-` <derivation hakurei-hsu-0.4.1> `
+` <derivation hakurei-hsu-0.4.2> `
 
 
 

package.nix

@@ -30,7 +30,7 @@
 
 buildGo126Module rec {
   pname = "hakurei";
-  version = "0.4.1";
+  version = "0.4.2";
 
   srcFiltered = builtins.path {
     name = "${pname}-src";