internal/rosa/package/kernel: 6.12.94 to 6.18.37

Finally jumping from 6.12 to 6.18, and the patches can be dropped.

Signed-off-by: Ophestra <cat@gensokyo.uk>

.gitignore

@@ -1,5 +1,4 @@
 # produced by tools and text editors
-*.swp
 *.qcow2
 *.test
 *.out

internal/pkg/archive.go

@@ -303,8 +303,8 @@ func init() {
 	})
 }
 
-// Inputs returns a slice containing the backing file.
-func (a archiveArtifact) Inputs() []Artifact {
+// Dependencies returns a slice containing the backing file.
+func (a archiveArtifact) Dependencies() []Artifact {
 	return []Artifact{a.f}
 }
 

internal/pkg/compress.go

@@ -66,8 +66,8 @@ func init() {
 	})
 }
 
-// Inputs returns a slice containing the backing file.
-func (a *decompressArtifact) Inputs() []Artifact {
+// Dependencies returns a slice containing the backing file.
+func (a *decompressArtifact) Dependencies() []Artifact {
 	return []Artifact{a.f}
 }
 

internal/pkg/exec.go

@@ -407,9 +407,9 @@ func init() {
 		func(r *IRReader) Artifact { return readExecArtifact(r, true) })
 }
 
-// Inputs returns a slice of all artifacts collected from caller-supplied
+// Dependencies returns a slice of all artifacts collected from caller-supplied
 // [ExecPath].
-func (a *execArtifact) Inputs() []Artifact {
+func (a *execArtifact) Dependencies() []Artifact {
 	artifacts := make([][]Artifact, 0, len(a.paths))
 	for _, p := range a.paths {
 		artifacts = append(artifacts, p.A)
@@ -617,7 +617,7 @@ func (c *Cache) EnterExec(
 		return ErrNotExec
 	}
 
-	deps := Collect(a.Inputs())
+	deps := Collect(a.Dependencies())
 	if _, _, err = c.Cure(&deps); err == nil {
 		return errors.New("unreachable")
 	} else if !IsCollected(err) {

internal/pkg/file.go

@@ -63,8 +63,8 @@ func init() {
 	})
 }
 
-// Inputs returns a nil slice.
-func (*fileArtifact) Inputs() []Artifact { return nil }
+// Dependencies returns a nil slice.
+func (*fileArtifact) Dependencies() []Artifact { return nil }
 
 // IsExclusive returns false: Cure returns a prepopulated buffer.
 func (*fileArtifact) IsExclusive() bool { return false }

internal/pkg/ir.go

@@ -241,7 +241,7 @@ func (ic *irCache) encode(
 	a Artifact,
 	inputs map[Artifact]cureRes,
 ) (err error) {
-	deps := a.Inputs()
+	deps := a.Dependencies()
 	idents := make([]*extIdent, len(deps))
 	if inputs == nil {
 		for i, d := range deps {
@@ -330,7 +330,7 @@ func (ic *irCache) encodeAll(
 		return
 	}
 
-	for _, d := range a.Inputs() {
+	for _, d := range a.Dependencies() {
 		if err = ic.encodeAll(w, d, encoded); err != nil {
 			return
 		}

internal/pkg/net.go

@@ -54,8 +54,8 @@ func init() {
 	})
 }
 
-// Inputs returns a nil slice.
-func (*httpArtifact) Inputs() []Artifact { return nil }
+// Dependencies returns a nil slice.
+func (*httpArtifact) Dependencies() []Artifact { return nil }
 
 // IsExclusive returns false: Cure returns as soon as a response is received.
 func (*httpArtifact) IsExclusive() bool { return false }

internal/pkg/pkg.go

@@ -330,8 +330,8 @@ func (c *common) Open(a Artifact) (r io.ReadCloser, err error) {
 type FContext struct {
 	TContext
 
-	// Cured top-level inputs looked up by Pathname.
-	inputs map[Artifact]cureRes
+	// Cured top-level dependencies looked up by Pathname.
+	deps map[Artifact]cureRes
 }
 
 // linkSubstitute links status for substitute if populated.
@@ -373,7 +373,7 @@ func (f *FContext) GetArtifact(a Artifact) (
 	pathname *check.Absolute,
 	checksum unique.Handle[Checksum],
 ) {
-	if res, ok := f.inputs[a]; ok {
+	if res, ok := f.deps[a]; ok {
 		return res.pathname, res.checksum
 	}
 	panic(InvalidLookupError(f.cache.Ident(a).Value()))
@@ -405,13 +405,13 @@ type Artifact interface {
 	// Result must remain identical across multiple invocations.
 	Params(ctx *IContext)
 
-	// Inputs returns a slice of [Artifact] the current instance has access to
-	// while producing its output.
+	// Dependencies returns a slice of [Artifact] that the current instance
+	// depends on to produce its contents.
 	//
 	// Callers must not modify the retuned slice.
 	//
 	// Result must remain identical across multiple invocations.
-	Inputs() []Artifact
+	Dependencies() []Artifact
 
 	// IsExclusive returns whether the [Artifact] is exclusive. Exclusive
 	// artifacts might not run in parallel with each other, and are still
@@ -770,8 +770,6 @@ type Cache struct {
 
 	// Optional external cache implementation.
 	extern External
-	// Caches responses from extern.
-	externCache map[unique.Handle[ID]]unique.Handle[Checksum]
 	// Synchronises access to extern.
 	externMu sync.RWMutex
 
@@ -932,7 +930,6 @@ func readlinkChecksum(a *check.Absolute, buf *Checksum) error {
 // SetExternal sets e as the [External] implementation of c.
 func (c *Cache) SetExternal(e External) {
 	c.externMu.Lock()
-	c.externCache = make(map[unique.Handle[ID]]unique.Handle[Checksum])
 	c.extern = e
 	c.externMu.Unlock()
 }
@@ -1851,88 +1848,38 @@ func (r *RContext) NewMeasuredReader(
 	return r.cache.newMeasuredReader(rc, checksum)
 }
 
-// tryChecksum dereferences a symlink to a cure outcome.
-func (c *Cache) tryChecksum(pathname *check.Absolute) (
-	checksum unique.Handle[Checksum],
-	err error,
-) {
-	_, err = os.Lstat(pathname.String())
-	if err == nil {
-		var name string
-		if name, err = os.Readlink(pathname.String()); err != nil {
-			return
-		}
-		buf := c.getIdentBuf()
-		err = Decode((*Checksum)(buf[:]), filepath.Base(name))
-		if err == nil {
-			checksum = unique.Make(Checksum(buf[:]))
-		}
-		c.putIdentBuf(buf)
-	}
-	return
-}
-
-// tryLocal attempts to obtain an [Artifact] outcome from the filesystem.
-func (c *Cache) tryLocal(id unique.Handle[ID]) (unique.Handle[Checksum], error) {
-	return c.tryChecksum(c.base.Append(
-		dirIdentifier,
-		Encode(id.Value()),
-	))
-}
-
 // tryExtern attempts to obtain an [Artifact] outcome from extern.
 func (c *Cache) tryExtern(ctx context.Context, id unique.Handle[ID]) (
 	unique.Handle[Checksum],
+	io.ReadCloser,
 	error,
 ) {
 	c.externMu.RLock()
 	defer c.externMu.RUnlock()
 
-	checksum, ok := c.externCache[id]
-	if !ok {
-		if c.extern == nil {
-			return zeroChecksum, nil
-		}
-
-		v, err := c.extern.Artifact(ctx, id)
-		if err != nil {
-			return zeroChecksum, err
-		}
-		if v == nil {
-			return zeroChecksum, nil
-		}
-		checksum = unique.Make(*v)
-
-		var got unique.Handle[Checksum]
-		if _, got, err = c.Cure(c.extern.Checksum(checksum)); err != nil {
-			return checksum, err
-		} else if got != checksum {
-			return zeroChecksum, &ChecksumMismatchError{got.Value(), checksum.Value()}
-		}
+	if c.extern == nil {
+		return zeroChecksum, nil, nil
 	}
-	return checksum, nil
-}
 
-// cureMany concurrently collects outcome of multiple [Artifact].
-func (c *Cache) cureMany(inputs []Artifact, r map[Artifact]cureRes) error {
-	var wg sync.WaitGroup
-	wg.Add(len(inputs))
-	res := make([]cureRes, len(inputs))
-	errs := make(DependencyCureError, 0, len(inputs))
-	var errsMu sync.Mutex
-	for i, d := range inputs {
-		pending := pendingArtifactDep{d, &res[i], &errs, &errsMu, &wg}
-		go pending.cure(c)
+	v, err := c.extern.Artifact(ctx, id)
+	if err != nil {
+		return zeroChecksum, nil, err
 	}
-	wg.Wait()
+	if v == nil {
+		return zeroChecksum, nil, nil
+	}
+	checksum := unique.Make(*v)
 
-	if len(errs) > 0 {
-		return &errs
+	var got unique.Handle[Checksum]
+	if _, got, err = c.Cure(c.extern.Checksum(checksum)); err != nil {
+		return checksum, nil, err
+	} else if got != checksum {
+		return zeroChecksum, nil, &ChecksumMismatchError{got.Value(), checksum.Value()}
 	}
-	for i, p := range res {
-		r[inputs[i]] = p
-	}
-	return nil
+
+	var status io.ReadCloser
+	status, err = c.extern.Status(&RContext{common{ctx, c}}, id)
+	return checksum, status, err
 }
 
 // cure implements Cure without acquiring a read lock on abortMu. cure must not
@@ -1970,8 +1917,21 @@ func (c *Cache) cure(a Artifact, curesExempt bool) (
 		defer func() { c.finaliseIdent(done, id, checksum, err) }()
 	}
 
-	checksum, err = c.tryChecksum(pathname)
-	if err == nil || !errors.Is(err, os.ErrNotExist) {
+	_, err = os.Lstat(pathname.String())
+	if err == nil {
+		var name string
+		if name, err = os.Readlink(pathname.String()); err != nil {
+			return
+		}
+		buf := c.getIdentBuf()
+		err = Decode((*Checksum)(buf[:]), filepath.Base(name))
+		if err == nil {
+			checksum = unique.Make(Checksum(buf[:]))
+		}
+		c.putIdentBuf(buf)
+		return
+	}
+	if !errors.Is(err, os.ErrNotExist) {
 		return
 	}
 
@@ -2193,14 +2153,30 @@ func (c *Cache) cure(a Artifact, curesExempt bool) (
 		break
 
 	case FloodArtifact:
-		inputs := a.Inputs()
-		f := FContext{t, make(map[Artifact]cureRes, len(inputs))}
-		if err = c.cureMany(inputs, f.inputs); err != nil {
+		deps := a.Dependencies()
+		f := FContext{t, make(map[Artifact]cureRes, len(deps))}
+
+		var wg sync.WaitGroup
+		wg.Add(len(deps))
+		res := make([]cureRes, len(deps))
+		errs := make(DependencyCureError, 0, len(deps))
+		var errsMu sync.Mutex
+		for i, d := range deps {
+			pending := pendingArtifactDep{d, &res[i], &errs, &errsMu, &wg}
+			go pending.cure(c)
+		}
+		wg.Wait()
+
+		if len(errs) > 0 {
+			err = &errs
 			return
 		}
+		for i, p := range res {
+			f.deps[deps[i]] = p
+		}
 
 		sh := sha512.New384()
-		err = c.encode(sh, a, f.inputs)
+		err = c.encode(sh, a, f.deps)
 		if err != nil {
 			return
 		}
@@ -2245,8 +2221,11 @@ func (c *Cache) cure(a Artifact, curesExempt bool) (
 
 		defer f.destroy(&err)
 
-		var externChecksum unique.Handle[Checksum]
-		if externChecksum, err = c.tryExtern(ctx, id); err != nil {
+		var (
+			externChecksum unique.Handle[Checksum]
+			externStatus   io.ReadCloser
+		)
+		if externChecksum, externStatus, err = c.tryExtern(ctx, id); err != nil {
 			if c.msg.IsVerbose() {
 				c.msg.Verbosef("extern %s: %v", reportName(ca, id), err)
 			}
@@ -2254,6 +2233,9 @@ func (c *Cache) cure(a Artifact, curesExempt bool) (
 		}
 		if externChecksum != zeroChecksum {
 			if checksum != zeroChecksum && externChecksum != checksum {
+				if externStatus != nil {
+					_ = externStatus.Close()
+				}
 				err = &ChecksumMismatchError{externChecksum.Value(), checksum.Value()}
 				if c.msg.IsVerbose() {
 					c.msg.Verbosef("extern %s: %v", reportName(ca, id), err)
@@ -2261,14 +2243,6 @@ func (c *Cache) cure(a Artifact, curesExempt bool) (
 				return
 			}
 
-			var externStatus io.ReadCloser
-			c.externMu.RLock()
-			externStatus, err = c.extern.Status(&RContext{common{ctx, c}}, id)
-			c.externMu.RUnlock()
-			if err != nil {
-				return
-			}
-
 			checksum = externChecksum
 			checksums = Encode(checksum.Value())
 			checksumPathname = c.base.Append(
@@ -2696,8 +2670,6 @@ func IsCollected(err error) bool { return errors.As(err, new(Collected)) }
 // [pkg.Artifact]. It returns [Collected].
 type Collect []Artifact
 
-var _ Artifact = new(Collect)
-
 // Cure returns [Collected].
 func (*Collect) Cure(*FContext) error { return Collected{} }
 
@@ -2707,8 +2679,8 @@ func (*Collect) Kind() Kind { return kindCollection }
 // Params is a noop: dependencies are already represented in the header.
 func (*Collect) Params(*IContext) {}
 
-// Inputs returns [Collect] as is.
-func (c *Collect) Inputs() []Artifact { return *c }
+// Dependencies returns [Collect] as is.
+func (c *Collect) Dependencies() []Artifact { return *c }
 
 // IsExclusive returns false: Cure is a noop.
 func (*Collect) IsExclusive() bool { return false }

internal/pkg/pkg_test.go

@@ -140,11 +140,11 @@ type stubArtifact struct {
 	cure func(t *pkg.TContext) error
 }
 
-func (a *stubArtifact) Kind() pkg.Kind             { return a.kind }
-func (a *stubArtifact) Params(ctx *pkg.IContext)   { ctx.Write(a.params) }
-func (a *stubArtifact) Inputs() []pkg.Artifact     { return a.deps }
-func (a *stubArtifact) Cure(t *pkg.TContext) error { return a.cure(t) }
-func (*stubArtifact) IsExclusive() bool            { return false }
+func (a *stubArtifact) Kind() pkg.Kind               { return a.kind }
+func (a *stubArtifact) Params(ctx *pkg.IContext)     { ctx.Write(a.params) }
+func (a *stubArtifact) Dependencies() []pkg.Artifact { return a.deps }
+func (a *stubArtifact) Cure(t *pkg.TContext) error   { return a.cure(t) }
+func (*stubArtifact) IsExclusive() bool              { return false }
 
 // A stubArtifactF implements [FloodArtifact] with hardcoded behaviour.
 type stubArtifactF struct {
@@ -156,11 +156,11 @@ type stubArtifactF struct {
 	cure func(f *pkg.FContext) error
 }
 
-func (a *stubArtifactF) Kind() pkg.Kind             { return a.kind }
-func (a *stubArtifactF) Params(ctx *pkg.IContext)   { ctx.Write(a.params) }
-func (a *stubArtifactF) Inputs() []pkg.Artifact     { return a.deps }
-func (a *stubArtifactF) Cure(f *pkg.FContext) error { return a.cure(f) }
-func (a *stubArtifactF) IsExclusive() bool          { return a.excl }
+func (a *stubArtifactF) Kind() pkg.Kind               { return a.kind }
+func (a *stubArtifactF) Params(ctx *pkg.IContext)     { ctx.Write(a.params) }
+func (a *stubArtifactF) Dependencies() []pkg.Artifact { return a.deps }
+func (a *stubArtifactF) Cure(f *pkg.FContext) error   { return a.cure(f) }
+func (a *stubArtifactF) IsExclusive() bool            { return a.excl }
 
 // A stubFile implements [FileArtifact] with hardcoded behaviour.
 type stubFile struct {
@@ -1883,7 +1883,7 @@ func (earlyFailureF) Kind() pkg.Kind       { return pkg.KindExec }
 func (earlyFailureF) Params(*pkg.IContext) {}
 func (earlyFailureF) IsExclusive() bool    { return false }
 
-func (a earlyFailureF) Inputs() []pkg.Artifact {
+func (a earlyFailureF) Dependencies() []pkg.Artifact {
 	deps := make([]pkg.Artifact, a)
 	for i := range deps {
 		deps[i] = a - 1

internal/pkg/tar.go

@@ -58,8 +58,8 @@ func init() {
 	})
 }
 
-// Inputs returns a slice containing the backing file.
-func (a *tarArtifact) Inputs() []Artifact {
+// Dependencies returns a slice containing the backing file.
+func (a *tarArtifact) Dependencies() []Artifact {
 	return []Artifact{a.f}
 }
 

internal/rosa/busybox.go

@@ -26,8 +26,8 @@ func (a busyboxBin) Params(*pkg.IContext) {}
 // IsExclusive returns false: Cure performs a trivial filesystem write.
 func (busyboxBin) IsExclusive() bool { return false }
 
-// Inputs returns the underlying busybox [pkg.FileArtifact].
-func (a busyboxBin) Inputs() []pkg.Artifact {
+// Dependencies returns the underlying busybox [pkg.FileArtifact].
+func (a busyboxBin) Dependencies() []pkg.Artifact {
 	return []pkg.Artifact{a.bin}
 }
 

internal/rosa/etc.go

@@ -118,8 +118,8 @@ func init() {
 // IsExclusive returns false: Cure performs a few trivial filesystem writes.
 func (cureEtc) IsExclusive() bool { return false }
 
-// Inputs returns a slice containing the backing iana-etc release.
-func (a cureEtc) Inputs() []pkg.Artifact {
+// Dependencies returns a slice containing the backing iana-etc release.
+func (a cureEtc) Dependencies() []pkg.Artifact {
 	if !a.minimal {
 		return []pkg.Artifact{ianaEtc}
 	}

internal/rosa/llvm.go

@@ -341,13 +341,6 @@ ln -s \
 
 		return &meta, t.NewPackage("llvm", meta.Version, source, &PackageAttr{
 			Flag: TExclusive,
-			Bin: []string{
-				"chmod",
-				"mkdir",
-				"rm",
-				"tr",
-				"awk",
-			},
 		}, &CMakeHelper{
 			Append: []string{"llvm"},
 
@@ -365,7 +358,16 @@ ln -s clang++ /work/system/bin/c++
 			// on 3-stage determinism to test later stages.
 			SkipTest: t.stage.isStage0(),
 
-			Test: "ninja " + jobsFlagE + " check-all",
+			Test: `
+chmod +w /bin && ln -s \
+	../system/bin/chmod \
+	../system/bin/mkdir \
+	../system/bin/rm \
+	../system/bin/tr \
+	../system/bin/awk \
+	/bin
+ninja ` + jobsFlagE + ` check-all
+`,
 		},
 			_python,
 			_perl,

internal/rosa/package/acl/package.az

@@ -13,8 +13,10 @@ package attr {
 
 	patches = [ "musl-errno.patch" ];
 
-	bin = [ "perl" ];
-	populateUsrBin = true;
+	early = `
+ln -s ../../system/bin/perl /usr/bin
+`;
+
 	exec = make {};
 
 	inputs = [

internal/rosa/package/git.az

@@ -12,6 +12,8 @@ package git {
 	};
 
 	early = `
+ln -s ../../system/bin/perl /usr/bin/ || true
+
 # test suite assumes apache
 rm -f /system/bin/httpd
 `;
@@ -20,8 +22,6 @@ rm -f /system/bin/httpd
 	enterSource = true;
 	env = [ "NO_RUST=YesPlease" ];
 
-	bin = [ "perl" ];
-	populateUsrBin = true;
 	exec = make {
 		inPlace = true;
 		generate = "make configure";

internal/rosa/package/gnu.az

@@ -511,7 +511,10 @@ package parallel {
 		compress = bzip2;
 	};
 
-	bin = [ "bash" ];
+	early = `
+ln -s ../system/bin/bash /bin/
+`;
+
 	exec = make {};
 
 	inputs = [

internal/rosa/package/gnutls/package.az

@@ -34,8 +34,7 @@ echo 'int main(){return 0;}' > tests/mini-dtls-fragments.c
 			"with-zstd": "link";
 
 			"": arch {
-				// miscompilation on arm64
-				arm64 = "--disable-hardware-acceleration";
+				arm64 = "disable-hardware-acceleration";
 			};
 		};
 	};

internal/rosa/package/kernel/package.az

@@ -134,7 +134,6 @@ rm -v "/work/system/lib/modules/$(make -f /usr/src/kernel/Makefile kernelversion
 		gawk,
 		coreutils,
 		diffutils,
-		bash,
 		python,
 
 		xz,

internal/rosa/package/libcap.az

@@ -12,7 +12,6 @@ package libcap {
 	};
 
 	// uses source tree as scratch space
-	enterSource = true;
 	writable = true;
 	chmod = true;
 
@@ -21,7 +20,8 @@ package libcap {
 		"lib=lib",
 	];
 
-	bin = [ "bash" ];
+	early = "\nln -s ../system/bin/bash /bin/\n";
+
 	exec = make {
 		skipConfigure = true;
 		inPlace = true;

internal/rosa/package/libinput.az

@@ -11,7 +11,8 @@ package libinput {
 		checksum = "GxBGPN6YybQxrD2MDsIL8gdDYImXn4NAJi6EvTx_Hb_1jcbjwCrjeyjY2upUyTMi";
 	};
 
-	bin = [ "bash" ];
+	early = "ln -sf ../system/bin/bash /bin/\n";
+
 	exec = meson {
 		setup = {
 			"Dmtdev": "false";

internal/rosa/package/libseccomp/fix-export-oob-read.patch

@@ -0,0 +1,13 @@
+diff --git a/src/api.c b/src/api.c
+index adccef3..65a277a 100644
+--- a/src/api.c
++++ b/src/api.c
+@@ -786,7 +786,7 @@ API int seccomp_export_bpf_mem(const scmp_filter_ctx ctx, void *buf,
+                if (BPF_PGM_SIZE(program) > *len)
+                        rc = _rc_filter(-ERANGE);
+                else
+-                       memcpy(buf, program->blks, *len);
++                       memcpy(buf, program->blks, BPF_PGM_SIZE(program));
+        }
+        *len = BPF_PGM_SIZE(program);
+ 

internal/rosa/package/libseccomp/package.az

@@ -3,16 +3,18 @@ package libseccomp {
 	website = "https://github.com/seccomp/libseccomp";
 	anitya = 13823;
 
-	version# = "2.6.1";
+	version# = "2.6.0";
 	source = remoteGitHubRelease {
 		suffix = "seccomp/libseccomp";
 		tag = "v"+version;
 		name = "libseccomp-"+version+".tar.gz";
-		checksum = "YiiUqaQA9EUDSeC3CifYJLJHT9DwkqQtW21ek0H3HzEG7_I9Yn5-pLt5ybQqpEEt";
+		checksum = "mMu-iR71guPjFbb31u-YexBaanKE_nYPjPux-vuBiPfS_0kbwJdfCGlkofaUm-EY";
 		compress = gzip;
 	};
+	patches = [ "fix-export-oob-read.patch" ];
+
+	early = "\nln -s ../system/bin/bash /bin/\n";
 
-	bin = [ "bash" ];
 	exec = make {};
 
 	inputs = [

internal/rosa/package/libva.az

@@ -3,11 +3,11 @@ package libva {
 	website = "https://01.org/vaapi";
 	anitya = 1752;
 
-	version# = "2.24.0";
+	version# = "2.23.0";
 	source = remoteGitHub {
 		suffix = "intel/libva";
 		tag = version;
-		checksum = "Jb5bdeHXLPPTWFlmauKDZlfAjFiXiILs17Pp7F8kAiyctFiDItpzYY0prIlnW7mu";
+		checksum = "UmF5tPyWIG_w5kiR3KFpoYbF7UUcaak5tyc-RhOheNTwQlLkPlifreFYCM9FQxbq";
 	};
 
 	exec = meson {

internal/rosa/package/lm_sensors.az

@@ -14,8 +14,12 @@ package lm_sensors {
 	chmod = true;
 	enterSource = true;
 
-	bin = [ "perl" ];
-	populateUsrBin = true;
+	early = `
+ln -s \
+	../../system/bin/perl \
+	/usr/bin/
+`;
+
 	exec = make {
 		inPlace = true;
 		skipConfigure = true;

internal/rosa/package/mesa.az

@@ -4,12 +4,12 @@ package mesa {
 	anitya = 1970;
 	latest = anityaFallback;
 
-	version# = "26.1.4";
+	version# = "26.1.3";
 	source = remoteGitLab {
 		domain = "gitlab.freedesktop.org";
 		suffix = "mesa/mesa";
 		ref = "mesa-"+version;
-		checksum = "E13xE-PmYKdhuh2f_7lExKSamVCnXm7qKmzZVBzMuzaMA-EGi7ZDdf2UwZrrUpK_";
+		checksum = "3Uk4-DVrqPhTb4NrLVSOvqpzzSI0kyAwDFgrP5RMzRZdnnGpnJ111llBTUYPlQGj";
 	};
 
 	exec = meson {

internal/rosa/package/netfilter/package.az

@@ -81,13 +81,13 @@ sed -i \
 	extensions/libebt_snat.txlate
 `;
 
-	bin = [ "bash" ];
 	exec = make {
 		generate = "./autogen.sh";
 		configure = {
 			"enable-static";
 		};
 		preCheck = `
+ln -s ../system/bin/bash /bin/
 chmod +w /etc/ && ln -s ../usr/src/iptables/etc/ethertypes /etc/
 `;
 	};

internal/rosa/package/ninja.az

@@ -15,7 +15,6 @@ package ninja {
 		"CFLAGS=-std=c++17",
 	];
 
-	bin = [ "echo" ];
 	exec = generic {
 		build = `
 python3 /usr/src/ninja/configure.py \
@@ -23,10 +22,12 @@ python3 /usr/src/ninja/configure.py \
 	--bootstrap
 python3 /usr/src/ninja/configure.py \
 	--gtest-source-dir=/usr/src/extra/googletest
-./ninja ` + jobsFlagE + ` all
-`;
+./ninja ` + jobsFlagE + ` all`;
 
-		check = "./ninja_test";
+		check = `
+chmod +w /bin/
+ln -s ../system/bin/echo /bin/
+./ninja_test`;
 
 		install = `
 mkdir -p /work/system/bin/

internal/rosa/package/noto.az

@@ -3,11 +3,11 @@ package noto {
 	website = "https://fonts.google.com/noto";
 	anitya = 10671;
 
-	version# = "2026.07.01";
+	version# = "2026.06.01";
 	source = remoteGitHub {
 		suffix = "notofonts/notofonts.github.io";
 		tag = "noto-monthly-release-"+version;
-		checksum = "4DdHW0aUDkcT-b3KNSNmPl_A2n4lrIeVmqjitDgUm4blGmGQjnMOtI4J9EjjYc06";
+		checksum = "QpCYYssOY-OIFKn0_K_7JG7Ij2VDbIkccWrWTC4db1ZPPE1yZnLrf7Kja-IuB4XS";
 	};
 
 	enterSource = true;

internal/rosa/package/pcre2.az

@@ -12,8 +12,11 @@ package pcre2 {
 		compress = bzip2;
 	};
 
-	// RunGrepTest expects /bin/echo
-	bin = [ "echo" ];
+	early = `
+# RunGrepTest expects /bin/echo
+ln -s ../system/bin/toybox /bin/echo
+`;
+
 	exec = make {
 		configure = {
 			"enable-jit";

internal/rosa/package/qemu/package.az

@@ -53,10 +53,6 @@ EOF
 				sep = ",";
 			};
 		};
-
-		check = [
-			"TIMEOUT_MULTIPLIER=5",
-		];
 	};
 
 	inputs = [

internal/rosa/package/rdfind.az

@@ -10,9 +10,10 @@ package rdfind {
 		compress = gzip;
 	};
 
-	// test suite hard codes /bin/echo
-	bin = [ "echo" ];
-	exec = make {};
+	exec = make {
+		// test suite hard codes /bin/echo
+		preCheck = "\nln -s ../system/bin/toybox /bin/echo\n";
+	};
 
 	inputs = [ nettle ];
 	runtime = [ nettle ];

internal/rosa/package/util-linux.az

@@ -23,7 +23,8 @@ package util-linux {
 		compress = gzip;
 	};
 
-	bin = [ "bash" ];
+	early = "\nln -s ../system/bin/bash /bin/\n";
+
 	exec = make {
 		configure = {
 			"disable-use-tty-group";

internal/rosa/package/x.az

@@ -781,7 +781,6 @@ package xwayland {
 		checksum = "0D0bs8EbDzlyLIULvm6lizqzdx4g1-umdbjVVO7zk-cS1kVIaSkKronCqj95tz-A";
 	};
 
-	bin = [ "bash" ];
 	exec = meson {
 		setup = {
 			"Dipv6": "false";
@@ -789,6 +788,10 @@ package xwayland {
 		};
 	};
 
+	early = `
+ln -sf ../system/bin/bash /bin/
+`;
+
 	inputs = [
 		bash,
 		gawk,

internal/rosa/rosa.go

@@ -414,10 +414,6 @@ type PackageAttr struct {
 
 	// Passed to [Toolchain.NewPatchedSource].
 	Patches []KV
-	// Programs to make available in /bin/.
-	Bin []string
-	// Whether to replace /usr/bin/ with a symlink to /bin/.
-	PopulateUsrBin bool
 
 	// Unregistered extras.
 	Extra []pkg.Artifact
@@ -548,26 +544,6 @@ cd '/usr/src/` + name + `/'
 		})
 	}
 
-	bin := attr.Bin
-	if attr.PopulateUsrBin {
-		scriptEarly += `
-chmod +w /usr/ /usr/bin/
-rm -rf /usr/bin/
-ln -s ../bin /usr/`
-		bin = append(bin, "env")
-	}
-
-	if t.stage != stageGentoo && len(bin) > 0 {
-		scriptEarly += "\nchmod +w /bin/" +
-			"\n(set -o braceexpand && ln -sf ../system/bin/"
-		if len(bin) > 1 {
-			scriptEarly += "{'" + strings.Join(bin, "','") + "'}"
-		} else {
-			scriptEarly += "'" + bin[0] + "'"
-		}
-		scriptEarly += " /bin/)\n"
-	}
-
 	return t.New(
 		rn,
 		attr.Flag,

internal/rosa/state.go

@@ -1004,17 +1004,15 @@ func (ctx *evalContext) pf(
 		k("block"):       &meta.Blocked,
 		k("latest"):      &meta.latest,
 
-		k("writable"):       &attr.Writable,
-		k("chmod"):          &attr.Chmod,
-		k("enterSource"):    &attr.EnterSource,
-		k("env"):            &attr.Env,
-		k("early"):          &attr.ScriptEarly,
-		k("bin"):            &attr.Bin,
-		k("populateUsrBin"): &attr.PopulateUsrBin,
-		k("patches"):        &patches,
-		k("files"):          &files,
-		k("exclusive"):      &excl,
-		k("toyboxEarly"):    &early,
+		k("writable"):    &attr.Writable,
+		k("chmod"):       &attr.Chmod,
+		k("enterSource"): &attr.EnterSource,
+		k("env"):         &attr.Env,
+		k("early"):       &attr.ScriptEarly,
+		k("patches"):     &patches,
+		k("files"):       &files,
+		k("exclusive"):   &excl,
+		k("toyboxEarly"): &early,
 
 		k("checksum"): &kc,
 		k("output"):   &output,