release: 0.4.3

Signed-off-by: Ophestra <cat@gensokyo.uk>

.gitignore

@@ -8,7 +8,7 @@
 # go generate
 /cmd/hakurei/LICENSE
 /cmd/mbf/internal/pkgserver/ui/static
-/internal/pkg/testdata/testtool
+/internal/pkg/internal/testtool/testtool
 /internal/rosa/hakurei_current.tar.gz
 
 # cmd/dist default destination

all.sh

@@ -1,10 +1,3 @@
 #!/bin/sh -e
 
-TOOLCHAIN_VERSION="$(go version)"
+HAKUREI_DIST_MAKE='' exec "$(dirname -- "$0")/cmd/dist/dist.sh"
-cd "$(dirname -- "$0")/"
-echo "Building cmd/dist using ${TOOLCHAIN_VERSION}."
-FLAGS=''
-if test -n "$VERBOSE"; then
-    FLAGS="$FLAGS -v"
-fi
-go run $FLAGS --tags=dist ./cmd/dist

cmd/dist/VERSION

@@ -0,0 +1 @@
+v0.4.3

cmd/dist/dist.sh

@@ -0,0 +1,10 @@
+#!/bin/sh -e
+
+TOOLCHAIN_VERSION="$(go version)"
+cd "$(dirname -- "$0")/../.."
+echo "Building cmd/dist using ${TOOLCHAIN_VERSION}."
+FLAGS=''
+if test -n "$VERBOSE"; then
+    FLAGS="$FLAGS -v"
+fi
+go run $FLAGS --tags=dist ./cmd/dist

cmd/dist/main.go

@@ -18,8 +18,13 @@ import (
 	"os/signal"
 	"path/filepath"
 	"runtime"
+	"strings"
 )
 
+//go:generate sh -c "git describe --tags > VERSION"
+//go:embed VERSION
+var version string
+
 // getenv looks up an environment variable, and returns fallback if it is unset.
 func getenv(key, fallback string) string {
 	if v, ok := os.LookupEnv(key); ok {
@@ -46,7 +51,8 @@ func main() {
 	log.SetPrefix("")
 
 	verbose := os.Getenv("VERBOSE") != ""
-	version := getenv("HAKUREI_VERSION", "untagged")
+	runTests := os.Getenv("HAKUREI_DIST_MAKE") == ""
+	version = getenv("HAKUREI_VERSION", strings.TrimSpace(version))
 	prefix := getenv("PREFIX", "/usr")
 	destdir := getenv("DESTDIR", "dist")
 
@@ -101,13 +107,15 @@ func main() {
 	)
 	log.Println()
 
-	log.Println("##### Testing Hakurei.")
+	if runTests {
-	mustRun(
+		log.Println("##### Testing Hakurei.")
-		ctx, "go", "test",
+		mustRun(
-		"-ldflags=-buildid= -linkmode external -extldflags=-static",
+			ctx, "go", "test",
-		"./...",
+			"-ldflags=-buildid= -linkmode external -extldflags=-static",
-	)
+			"./...",
-	log.Println()
+		)
+		log.Println()
+	}
 
 	log.Println("##### Creating distribution.")
 	const suffix = ".tar.gz"

cmd/mbf/cache.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"hakurei.app/check"
+	"hakurei.app/container"
 	"hakurei.app/internal/pkg"
 	"hakurei.app/message"
 )
@@ -19,8 +20,15 @@ type cache struct {
 	// Should generally not be used directly.
 	c *pkg.Cache
 
-	cures, jobs        int
+	cures, jobs int
-	hostAbstract, idle bool
+	// Primarily to work around missing landlock LSM.
+	hostAbstract bool
+	// Set SCHED_IDLE.
+	idle bool
+	// Unset [pkg.CSuppressInit].
+	verboseInit bool
+	// Loaded artifact of [rosa.QEMU].
+	qemu pkg.Artifact
 
 	base string
 }
@@ -45,6 +53,9 @@ func (cache *cache) open() (err error) {
 	if cache.hostAbstract {
 		flags |= pkg.CHostAbstract
 	}
+	if !cache.verboseInit {
+		flags |= pkg.CSuppressInit
+	}
 
 	done := make(chan struct{})
 	defer close(done)
@@ -70,6 +81,39 @@ func (cache *cache) open() (err error) {
 		cache.jobs,
 		base,
 	)
+	if err != nil {
+		return
+	}
+	done <- struct{}{}
+
+	if cache.qemu != nil {
+		var pathname *check.Absolute
+		pathname, _, err = cache.c.Cure(cache.qemu)
+		if err != nil {
+			cache.c.Close()
+			return
+		}
+
+		pkg.RegisterArch("riscv64", container.BinfmtEntry{
+			Offset: 0,
+			Magic:  "\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xf3\x00",
+			Mask:   "\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff",
+			Interpreter: pathname.Append(
+				"system/bin",
+				"qemu-riscv64",
+			),
+		})
+		pkg.RegisterArch("arm64", container.BinfmtEntry{
+			Offset: 0,
+			Magic:  "\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7\x00",
+			Mask:   "\xff\xff\xff\xff\xff\xff\xff\xfc\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff",
+			Interpreter: pathname.Append(
+				"system/bin",
+				"qemu-aarch64",
+			),
+		})
+	}
+
 	return
 }
 

cmd/mbf/info.go

@@ -6,6 +6,7 @@ import (
 	"io"
 	"os"
 	"strings"
+	"unique"
 
 	"hakurei.app/internal/pkg"
 	"hakurei.app/internal/rosa"
@@ -35,17 +36,19 @@ func commandInfo(
 		}
 	}
 
+	t := rosa.Native().Std()
 	for i, name := range args {
-		if p, ok := rosa.ResolveName(name); !ok {
+		handle := rosa.ArtifactH(unique.Make(name))
+		if meta, a := t.Load(handle); meta == nil {
 			return fmt.Errorf("unknown artifact %q", name)
 		} else {
 			var suffix string
-			if version := rosa.Std.Version(p); version != rosa.Unversioned {
+
-				suffix += "-" + version
+			if meta.Version != rosa.Unversioned {
+				suffix += "-" + meta.Version
 			}
 			mustPrintln("name        : " + name + suffix)
 
-			meta := rosa.GetMetadata(p)
 			mustPrintln("description : " + meta.Description)
 			if meta.Website != "" {
 				mustPrintln("website     : " +
@@ -54,9 +57,10 @@ func commandInfo(
 			if len(meta.Dependencies) > 0 {
 				mustPrint("depends on  :")
 				for _, d := range meta.Dependencies {
-					s := rosa.GetMetadata(d).Name
+					_meta, _ := rosa.Native().Std().MustLoad(d)
-					if version := rosa.Std.Version(d); version != rosa.Unversioned {
+					s := _meta.Name
-						s += "-" + version
+					if _meta.Version != rosa.Unversioned {
+						s += "-" + _meta.Version
 					}
 					mustPrint(" " + s)
 				}
@@ -68,7 +72,7 @@ func commandInfo(
 				if r == nil {
 					var f io.ReadSeekCloser
 					err = cm.Do(func(cache *pkg.Cache) (err error) {
-						f, err = cache.OpenStatus(rosa.Std.Load(p))
+						f, err = cache.OpenStatus(a)
 						return
 					})
 					if err != nil {
@@ -87,7 +91,7 @@ func commandInfo(
 						}
 					}
 				} else if err = cm.Do(func(cache *pkg.Cache) (err error) {
-					status, n := r.ArtifactOf(cache.Ident(rosa.Std.Load(p)))
+					status, n := r.ArtifactOf(cache.Ident(a))
 					if status == nil {
 						mustPrintln(
 							statusPrefix + "not in report",

cmd/mbf/info_test.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 	"syscall"
 	"testing"
+	"unique"
 	"unsafe"
 
 	"hakurei.app/internal/pkg"
@@ -20,6 +21,14 @@ import (
 func TestInfo(t *testing.T) {
 	t.Parallel()
 
+	_t := rosa.Native().Std()
+	qemuMeta, _ := _t.Load(rosa.H("qemu"))
+	glibMeta, _ := _t.Load(rosa.H("glib"))
+	zlibMeta, zlib := _t.Load(rosa.H("zlib"))
+	zstdMeta, _ := _t.Load(rosa.H("zstd"))
+	hakureiMeta, _ := _t.Load(rosa.H("hakurei"))
+	hakureiDistMeta, _ := _t.Load(rosa.H("hakurei-dist"))
+
 	testCases := []struct {
 		name    string
 		args    []string
@@ -29,24 +38,24 @@ func TestInfo(t *testing.T) {
 		wantErr any
 	}{
 		{"qemu", []string{"qemu"}, nil, "", `
-name        : qemu-` + rosa.Std.Version(rosa.QEMU) + `
+name        : qemu-` + qemuMeta.Version + `
 description : a generic and open source machine emulator and virtualizer
 website     : https://www.qemu.org
-depends on  : glib-` + rosa.Std.Version(rosa.GLib) + ` zstd-` + rosa.Std.Version(rosa.Zstd) + `
+depends on  : glib-` + glibMeta.Version + ` zstd-` + zstdMeta.Version + `
 `, nil},
 
 		{"multi", []string{"hakurei", "hakurei-dist"}, nil, "", `
-name        : hakurei-` + rosa.Std.Version(rosa.Hakurei) + `
+name        : hakurei-` + hakureiMeta.Version + `
 description : low-level userspace tooling for Rosa OS
 website     : https://hakurei.app
 
-name        : hakurei-dist-` + rosa.Std.Version(rosa.HakureiDist) + `
+name        : hakurei-dist-` + hakureiDistMeta.Version + `
 description : low-level userspace tooling for Rosa OS (distribution tarball)
 website     : https://hakurei.app
 `, nil},
 
 		{"nonexistent", []string{"zlib", "\x00"}, nil, "", `
-name        : zlib-` + rosa.Std.Version(rosa.Zlib) + `
+name        : zlib-` + zlibMeta.Version + `
 description : lossless data-compression library
 website     : https://zlib.net
 
@@ -56,12 +65,12 @@ website     : https://zlib.net
 			"zstd":    "internal/pkg (amd64) on satori\n",
 			"hakurei": "internal/pkg (amd64) on satori\n\n",
 		}, "", `
-name        : zlib-` + rosa.Std.Version(rosa.Zlib) + `
+name        : zlib-` + zlibMeta.Version + `
 description : lossless data-compression library
 website     : https://zlib.net
 status      : not yet cured
 
-name        : zstd-` + rosa.Std.Version(rosa.Zstd) + `
+name        : zstd-` + zstdMeta.Version + `
 description : a fast compression algorithm
 website     : https://facebook.github.io/zstd
 status      : internal/pkg (amd64) on satori
@@ -70,19 +79,19 @@ status      : internal/pkg (amd64) on satori
 		{"status cache perm", []string{"zlib"}, map[string]string{
 			"zlib": "\x00",
 		}, "", `
-name        : zlib-` + rosa.Std.Version(rosa.Zlib) + `
+name        : zlib-` + zlibMeta.Version + `
 description : lossless data-compression library
 website     : https://zlib.net
 `, func(cm *cache) error {
 			return &os.PathError{
 				Op:   "open",
-				Path: filepath.Join(cm.base, "status", pkg.Encode(cm.c.Ident(rosa.Std.Load(rosa.Zlib)).Value())),
+				Path: filepath.Join(cm.base, "status", pkg.Encode(cm.c.Ident(zlib).Value())),
 				Err:  syscall.EACCES,
 			}
 		}},
 
 		{"status report", []string{"zlib"}, nil, strings.Repeat("\x00", len(pkg.Checksum{})+8), `
-name        : zlib-` + rosa.Std.Version(rosa.Zlib) + `
+name        : zlib-` + zlibMeta.Version + `
 description : lossless data-compression library
 website     : https://zlib.net
 status      : not in report
@@ -131,8 +140,8 @@ status      : not in report
 
 			if tc.status != nil {
 				for name, status := range tc.status {
-					p, ok := rosa.ResolveName(name)
+					_, a := _t.Load(rosa.ArtifactH(unique.Make(name)))
-					if !ok {
+					if a == nil {
 						t.Fatalf("invalid name %q", name)
 					}
 					perm := os.FileMode(0400)
@@ -143,7 +152,7 @@ status      : not in report
 						return os.WriteFile(filepath.Join(
 							cm.base,
 							"status",
-							pkg.Encode(cache.Ident(rosa.Std.Load(p)).Value()),
+							pkg.Encode(cache.Ident(a).Value()),
 						), unsafe.Slice(unsafe.StringData(status), len(status)), perm)
 					}); err != nil {
 						t.Fatalf("Do: error = %v", err)

cmd/mbf/internal/pkgserver/api.go

@@ -30,7 +30,7 @@ var (
 // handleInfo writes constant system information.
 func handleInfo(w http.ResponseWriter, _ *http.Request) {
 	infoPayloadOnce.Do(func() {
-		infoPayload.Count = int(rosa.PresetUnexportedStart)
+		infoPayload.Count = len(rosa.Native().Collect())
 		infoPayload.HakureiVersion = info.Version()
 	})
 	// TODO(mae): cache entire response if no additional fields are planned
@@ -91,7 +91,7 @@ func (index *packageIndex) handleGet(w http.ResponseWriter, r *http.Request) {
 	if err != nil || i >= len(index.sorts[0]) || i < 0 {
 		http.Error(
 			w, "index must be an integer between 0 and "+
-				strconv.Itoa(int(rosa.PresetUnexportedStart-1)),
+				strconv.Itoa(len(index.sorts[0])-1),
 			http.StatusBadRequest,
 		)
 		return
@@ -125,7 +125,7 @@ func (index *packageIndex) handleSearch(w http.ResponseWriter, r *http.Request)
 	if err != nil || i >= len(index.sorts[0]) || i < 0 {
 		http.Error(
 			w, "index must be an integer between 0 and "+
-				strconv.Itoa(int(rosa.PresetUnexportedStart-1)),
+				strconv.Itoa(len(index.sorts[0])-1),
 			http.StatusBadRequest,
 		)
 		return

cmd/mbf/internal/pkgserver/api_test.go

@@ -3,7 +3,6 @@ package pkgserver
 import (
 	"net/http"
 	"net/http/httptest"
-	"slices"
 	"strconv"
 	"testing"
 
@@ -32,7 +31,7 @@ func TestAPIInfo(t *testing.T) {
 	checkPayload(t, resp, struct {
 		Count          int    `json:"count"`
 		HakureiVersion string `json:"hakurei_version"`
-	}{int(rosa.PresetUnexportedStart), info.Version()})
+	}{len(rosa.Native().Collect()), info.Version()})
 }
 
 func TestAPIGet(t *testing.T) {
@@ -93,11 +92,12 @@ func TestAPIGet(t *testing.T) {
 		)
 	})
 
+	count := len(rosa.Native().Collect())
 	t.Run("index", func(t *testing.T) {
 		t.Parallel()
 		checkValidate(
-			t, "limit=1&sort=0&index", 0, int(rosa.PresetUnexportedStart-1),
+			t, "limit=1&sort=0&index", 0, count-1,
-			"index must be an integer between 0 and "+strconv.Itoa(int(rosa.PresetUnexportedStart-1)),
+			"index must be an integer between 0 and "+strconv.Itoa(count-1),
 		)
 	})
 
@@ -108,74 +108,4 @@ func TestAPIGet(t *testing.T) {
 			"sort must be an integer between 0 and "+strconv.Itoa(int(sortOrderEnd)),
 		)
 	})
-
-	checkWithSuffix := func(name, suffix string, want []*metadata) {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			w := newRequest(suffix)
-			resp := w.Result()
-			checkStatus(t, resp, http.StatusOK)
-			checkAPIHeader(t, w.Header())
-			checkPayloadFunc(t, resp, func(got *struct {
-				Values []*metadata `json:"values"`
-			}) bool {
-				return slices.EqualFunc(got.Values, want, func(a, b *metadata) bool {
-					return (a.Version == b.Version ||
-						a.Version == rosa.Unversioned ||
-						b.Version == rosa.Unversioned) &&
-						a.HasReport == b.HasReport &&
-						a.Name == b.Name &&
-						a.Description == b.Description &&
-						a.Website == b.Website
-				})
-			})
-
-		})
-	}
-
-	checkWithSuffix("declarationAscending", "?limit=2&index=1&sort=0", []*metadata{
-		{
-			Metadata: rosa.GetMetadata(1),
-			Version:  rosa.Std.Version(1),
-		},
-		{
-			Metadata: rosa.GetMetadata(2),
-			Version:  rosa.Std.Version(2),
-		},
-	})
-	checkWithSuffix("declarationAscending offset", "?limit=3&index=5&sort=0", []*metadata{
-		{
-			Metadata: rosa.GetMetadata(5),
-			Version:  rosa.Std.Version(5),
-		},
-		{
-			Metadata: rosa.GetMetadata(6),
-			Version:  rosa.Std.Version(6),
-		},
-		{
-			Metadata: rosa.GetMetadata(7),
-			Version:  rosa.Std.Version(7),
-		},
-	})
-	checkWithSuffix("declarationDescending", "?limit=3&index=0&sort=1", []*metadata{
-		{
-			Metadata: rosa.GetMetadata(rosa.PresetUnexportedStart - 1),
-			Version:  rosa.Std.Version(rosa.PresetUnexportedStart - 1),
-		},
-		{
-			Metadata: rosa.GetMetadata(rosa.PresetUnexportedStart - 2),
-			Version:  rosa.Std.Version(rosa.PresetUnexportedStart - 2),
-		},
-		{
-			Metadata: rosa.GetMetadata(rosa.PresetUnexportedStart - 3),
-			Version:  rosa.Std.Version(rosa.PresetUnexportedStart - 3),
-		},
-	})
-	checkWithSuffix("declarationDescending offset", "?limit=1&index=37&sort=1", []*metadata{
-		{
-			Metadata: rosa.GetMetadata(rosa.PresetUnexportedStart - 38),
-			Version:  rosa.Std.Version(rosa.PresetUnexportedStart - 38),
-		},
-	})
 }

cmd/mbf/internal/pkgserver/index.go

@@ -23,7 +23,7 @@ const (
 
 // packageIndex refers to metadata by name and various sort orders.
 type packageIndex struct {
-	sorts  [sortOrderEnd + 1][rosa.PresetUnexportedStart]*metadata
+	sorts  [sortOrderEnd + 1][]*metadata
 	names  map[string]*metadata
 	search searchCache
 	// Taken from [rosa.Report] if available.
@@ -32,11 +32,11 @@ type packageIndex struct {
 
 // metadata holds [rosa.Metadata] extended with additional information.
 type metadata struct {
-	p rosa.PArtifact
+	handle rosa.ArtifactH
 	*rosa.Metadata
 
-	// Populated via [rosa.Toolchain.Version], [rosa.Unversioned] is equivalent
+	// Copied from [rosa.Metadata], [rosa.Unversioned] is equivalent to the zero
-	// to the zero value. Otherwise, the zero value is invalid.
+	// value. Otherwise, the zero value is invalid.
 	Version string `json:"version,omitempty"`
 	// Output data size, available if present in report.
 	Size int64 `json:"size,omitempty"`
@@ -56,15 +56,17 @@ func (index *packageIndex) populate(report *rosa.Report) (err error) {
 		index.handleAccess = report.HandleAccess
 	}
 
-	var work [rosa.PresetUnexportedStart]*metadata
+	handles := rosa.Native().Collect()
+	work := make([]*metadata, len(handles))
 	index.names = make(map[string]*metadata)
 	ir := pkg.NewIR()
-	for p := range rosa.PresetUnexportedStart {
+	for i, handle := range handles {
+		meta, a := rosa.Native().Std().MustLoad(handle)
 		m := metadata{
-			p: p,
+			handle: handle,
 
-			Metadata: rosa.GetMetadata(p),
+			Metadata: meta,
-			Version:  rosa.Std.Version(p),
+			Version:  meta.Version,
 		}
 		if m.Version == "" {
 			return errors.New("invalid version from " + m.Name)
@@ -74,32 +76,32 @@ func (index *packageIndex) populate(report *rosa.Report) (err error) {
 		}
 
 		if report != nil {
-			id := ir.Ident(rosa.Std.Load(p))
+			id := ir.Ident(a)
 			m.ids = pkg.Encode(id.Value())
 			m.status, m.Size = report.ArtifactOf(id)
 			m.HasReport = m.Size >= 0
 		}
 
-		work[p] = &m
+		work[i] = &m
 		index.names[m.Name] = &m
 	}
 
 	index.sorts[declarationAscending] = work
-	index.sorts[declarationDescending] = work
+	index.sorts[declarationDescending] = slices.Clone(work)
 	slices.Reverse(index.sorts[declarationDescending][:])
 
-	index.sorts[nameAscending] = work
+	index.sorts[nameAscending] = slices.Clone(work)
 	slices.SortFunc(index.sorts[nameAscending][:], func(a, b *metadata) int {
 		return strings.Compare(a.Name, b.Name)
 	})
-	index.sorts[nameDescending] = index.sorts[nameAscending]
+	index.sorts[nameDescending] = slices.Clone(index.sorts[nameAscending])
 	slices.Reverse(index.sorts[nameDescending][:])
 
-	index.sorts[sizeAscending] = work
+	index.sorts[sizeAscending] = slices.Clone(work)
 	slices.SortFunc(index.sorts[sizeAscending][:], func(a, b *metadata) int {
 		return cmp.Compare(a.Size, b.Size)
 	})
-	index.sorts[sizeDescending] = index.sorts[sizeAscending]
+	index.sorts[sizeDescending] = slices.Clone(index.sorts[sizeAscending])
 	slices.Reverse(index.sorts[sizeDescending][:])
 
 	return

cmd/mbf/internal/pkgserver/ui/index.html

@@ -4,11 +4,12 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <link rel="stylesheet" href="style.css">
-    <title>Hakurei PkgServer</title>
+    <link rel="icon" href="https://hakurei.app/favicon.ico"/>
+    <title>Rosa OS Packages</title>
     <script src="index.js"></script>
 </head>
 <body>
-<h1>Hakurei PkgServer</h1>
+<h1>Rosa OS Packages</h1>
 <div class="top-controls" id="top-controls-regular">
     <p>Showing entries <span id="entry-counter"></span>.</p>
     <span id="search-bar">
@@ -54,4 +55,4 @@
 </footer>
 <script>main();</script>
 </body>
-</html>
+</html>

cmd/mbf/main.go

@@ -58,6 +58,19 @@ func main() {
 		log.Fatal("this program must not run as root")
 	}
 
+	defer func() {
+		r := recover()
+		if r == nil {
+			return
+		}
+
+		e, ok := r.(rosa.LoadError)
+		if !ok {
+			panic(r)
+		}
+		log.Fatal(e)
+	}()
+
 	ctx, stop := signal.NotifyContext(context.Background(),
 		syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP)
 	defer stop()
@@ -67,12 +80,25 @@ func main() {
 
 	var (
 		flagQuiet bool
+		flagQEMU  bool
+		flagArch  string
 		flagCheck bool
 		flagLTO   bool
+		flagPT    bool
+
+		flagCrossOverride int
 
 		addr net.UnixAddr
 	)
 	c := command.New(os.Stderr, log.Printf, "mbf", func([]string) error {
+		if !rosa.Native().HasStageEarly() {
+			return pkg.UnsupportedArchError(runtime.GOARCH)
+		}
+
+		if flagPT {
+			log.Println("parsed in", rosa.ParseTime())
+		}
+
 		msg.SwapVerbose(!flagQuiet)
 		cm.ctx, cm.msg = ctx, msg
 		cm.base = os.ExpandEnv(cm.base)
@@ -93,13 +119,36 @@ func main() {
 		if !flagLTO {
 			flags |= rosa.OptLLVMNoLTO
 		}
-		rosa.DropCaches(flags)
+		rosa.Native().DropCaches("", flags)
+		cross := flagArch != "" && flagArch != runtime.GOARCH
+		if flagQEMU || cross {
+			_, cm.qemu = rosa.Native().Std().MustLoad(rosa.H("qemu"))
+		}
+
+		if cross {
+			if flagCrossOverride != -1 {
+				flags = flagCrossOverride
+			}
+
+			rosa.Native().DropCaches(flagArch, flags)
+			if !rosa.Native().HasStageEarly() {
+				return pkg.UnsupportedArchError(flagArch)
+			}
+		}
 
 		return nil
 	}).Flag(
 		&flagQuiet,
 		"q", command.BoolFlag(false),
 		"Do not print cure messages",
+	).Flag(
+		&flagQEMU,
+		"register", command.BoolFlag(false),
+		"Enable additional target architectures",
+	).Flag(
+		&flagArch,
+		"arch", command.StringFlag(runtime.GOARCH),
+		"Target architecture",
 	).Flag(
 		&flagLTO,
 		"lto", command.BoolFlag(false),
@@ -108,6 +157,14 @@ func main() {
 		&flagCheck,
 		"check", command.BoolFlag(true),
 		"Run test suites",
+	).Flag(
+		&flagCrossOverride,
+		"cross-flags", command.IntFlag(-1),
+		"Override non-native target preset flags",
+	).Flag(
+		&cm.verboseInit,
+		"v", command.BoolFlag(false),
+		"Do not suppress verbose output from init",
 	).Flag(
 		&cm.cures,
 		"cures", command.IntFlag(0),
@@ -135,6 +192,10 @@ func main() {
 		&addr.Name,
 		"socket", command.StringFlag("$MBF_DAEMON_SOCKET"),
 		"Pathname of socket to bind to",
+	).Flag(
+		&flagPT,
+		"parse-time", command.BoolFlag(false),
+		"Print duration of the initial azalea parse",
 	)
 
 	c.NewCommand(
@@ -296,12 +357,12 @@ func main() {
 				n atomic.Uint64
 			)
 
-			w := make(chan rosa.PArtifact)
+			w := make(chan rosa.ArtifactH)
 			var wg sync.WaitGroup
 			for range max(flagJobs, 1) {
 				wg.Go(func() {
 					for p := range w {
-						meta := rosa.GetMetadata(p)
+						meta, _ := rosa.Native().Std().MustLoad(p)
 						if meta.ID == 0 {
 							continue
 						}
@@ -314,12 +375,9 @@ func main() {
 							continue
 						}
 
-						if current, latest :=
+						if latest := meta.GetLatest(v); meta.Version != latest {
-							rosa.Std.Version(p),
-							meta.GetLatest(v); current != latest {
-
 							n.Add(1)
-							log.Printf("%s %s < %s", meta.Name, current, latest)
+							log.Printf("%s %s < %s", meta.Name, meta.Version, latest)
 							continue
 						}
 
@@ -329,9 +387,9 @@ func main() {
 			}
 
 		done:
-			for i := range rosa.PresetEnd {
+			for _, p := range rosa.Native().CollectAll() {
 				select {
-				case w <- rosa.PArtifact(i):
+				case w <- p:
 					break
 				case <-ctx.Done():
 					break done
@@ -376,9 +434,9 @@ func main() {
 			"stage3",
 			"Check for toolchain 3-stage non-determinism",
 			func(args []string) (err error) {
-				t := rosa.Std
+				s := rosa.Std
 				if flagGentoo != "" {
-					t -= 3 // magic number to discourage misuse
+					s -= 3 // magic number to discourage misuse
 
 					var checksum pkg.Checksum
 					if len(flagChecksum) != 0 {
@@ -386,7 +444,7 @@ func main() {
 							return
 						}
 					}
-					rosa.SetGentooStage3(flagGentoo, checksum)
+					rosa.Native().SetGentooStage3(flagGentoo, checksum)
 				}
 
 				var (
@@ -394,10 +452,10 @@ func main() {
 					checksum [2]unique.Handle[pkg.Checksum]
 				)
 
+				_llvm := rosa.H("llvm")
 				if err = cm.Do(func(cache *pkg.Cache) (err error) {
-					pathname, _, err = cache.Cure(
+					_, llvm := rosa.Native().New(s - 2).Load(_llvm)
-						(t - 2).Load(rosa.LLVM),
+					pathname, _, err = cache.Cure(llvm)
-					)
 					return
 				}); err != nil {
 					return
@@ -405,18 +463,16 @@ func main() {
 				log.Println("stage1:", pathname)
 
 				if err = cm.Do(func(cache *pkg.Cache) (err error) {
-					pathname, checksum[0], err = cache.Cure(
+					_, llvm := rosa.Native().New(s - 1).Load(_llvm)
-						(t - 1).Load(rosa.LLVM),
+					pathname, checksum[0], err = cache.Cure(llvm)
-					)
 					return
 				}); err != nil {
 					return
 				}
 				log.Println("stage2:", pathname)
 				if err = cm.Do(func(cache *pkg.Cache) (err error) {
-					pathname, checksum[1], err = cache.Cure(
+					_, llvm := rosa.Native().New(s).Load(_llvm)
-						t.Load(rosa.LLVM),
+					pathname, checksum[1], err = cache.Cure(llvm)
-					)
 					return
 				}); err != nil {
 					return
@@ -437,9 +493,7 @@ func main() {
 
 				if flagStage0 {
 					if err = cm.Do(func(cache *pkg.Cache) (err error) {
-						pathname, _, err = cache.Cure(
+						pathname, _, err = cache.Cure(rosa.Native().Std().NewStage0())
-							t.Load(rosa.Stage0),
-						)
 						return
 					}); err != nil {
 						return
@@ -471,6 +525,8 @@ func main() {
 			flagExport  string
 			flagRemote  bool
 			flagNoReply bool
+			flagFaults  bool
+			flagPop     bool
 
 			flagBoot bool
 			flagStd  bool
@@ -482,10 +538,6 @@ func main() {
 				if len(args) != 1 {
 					return errors.New("cure requires 1 argument")
 				}
-				p, ok := rosa.ResolveName(args[0])
-				if !ok {
-					return fmt.Errorf("unknown artifact %q", args[0])
-				}
 
 				t := rosa.Std
 				if flagBoot {
@@ -494,11 +546,16 @@ func main() {
 					t -= 1
 				}
 
+				_, a := rosa.Native().New(t).Load(rosa.ArtifactH(unique.Make(args[0])))
+				if a == nil {
+					return fmt.Errorf("unknown artifact %q", args[0])
+				}
+
 				switch {
 				default:
 					var pathname *check.Absolute
 					err := cm.Do(func(cache *pkg.Cache) (err error) {
-						pathname, _, err = cache.Cure(t.Load(p))
+						pathname, _, err = cache.Cure(a)
 						return
 					})
 					if err != nil {
@@ -540,7 +597,7 @@ func main() {
 						return err
 					}
 
-					if err = pkg.NewIR().EncodeAll(f, rosa.Std.Load(p)); err != nil {
+					if err = pkg.NewIR().EncodeAll(f, a); err != nil {
 						_ = f.Close()
 						return err
 					}
@@ -551,7 +608,7 @@ func main() {
 					return cm.Do(func(cache *pkg.Cache) error {
 						return cache.EnterExec(
 							ctx,
-							t.Load(p),
+							a,
 							true, os.Stdin, os.Stdout, os.Stderr,
 							rosa.AbsSystem.Append("bin", "mksh"),
 							"sh",
@@ -563,7 +620,6 @@ func main() {
 					if flagNoReply {
 						flags |= remoteNoReply
 					}
-					a := t.Load(p)
 					pathname, err := cureRemote(ctx, &addr, a, flags)
 					if !flagNoReply && err == nil {
 						log.Println(pathname)
@@ -579,6 +635,49 @@ func main() {
 					}
 
 					return err
+
+				case flagFaults:
+					var faults []pkg.Fault
+					if err := cm.Do(func(cache *pkg.Cache) (err error) {
+						faults, err = cache.ReadFaults(a)
+						return
+					}); err != nil {
+						return err
+					}
+
+					for _, fault := range faults {
+						log.Printf("%s: %s ago", fault.String(), time.Since(fault.Time()))
+					}
+					return nil
+
+				case flagPop:
+					var faults []pkg.Fault
+					if err := cm.Do(func(cache *pkg.Cache) (err error) {
+						faults, err = cache.ReadFaults(a)
+						return
+					}); err != nil {
+						return err
+					}
+
+					if len(faults) == 0 {
+						return errors.New("no fault entries found")
+					}
+					fault := faults[len(faults)-1]
+					r, err := fault.Open()
+					if err != nil {
+						return err
+					}
+					if _, err = io.Copy(os.Stdout, r); err != nil {
+						_ = r.Close()
+						return err
+					}
+					fmt.Println()
+					if err = r.Close(); err != nil {
+						return err
+					}
+
+					log.Printf("faulting cure terminated %s ago", time.Since(fault.Time()))
+					return fault.Destroy()
 				}
 			},
 		).Flag(
@@ -609,9 +708,40 @@ func main() {
 			&flagStd,
 			"std", command.BoolFlag(false),
 			"Build on the intermediate toolchain",
+		).Flag(
+			&flagFaults,
+			"faults", command.BoolFlag(false),
+			"Display fault entries of the specified artifact",
+		).Flag(
+			&flagPop,
+			"pop", command.BoolFlag(false),
+			"Display and destroy the most recent fault entry",
 		)
 	}
 
+	c.NewCommand(
+		"clear",
+		"Remove all fault entries from the cache",
+		func([]string) error {
+			return cm.Do(func(*pkg.Cache) error {
+				pathname := filepath.Join(cm.base, "fault")
+				dents, err := os.ReadDir(pathname)
+				if err != nil {
+					return err
+				}
+
+				for _, dent := range dents {
+					msg.Verbosef("destroying entry %s", dent.Name())
+					if err = os.Remove(filepath.Join(pathname, dent.Name())); err != nil {
+						return err
+					}
+				}
+				log.Printf("destroyed %d fault entries", len(dents))
+				return nil
+			})
+		},
+	)
+
 	c.NewCommand(
 		"abort",
 		"Abort all pending cures on the daemon",
@@ -629,27 +759,26 @@ func main() {
 			"shell",
 			"Interactive shell in the specified Rosa OS environment",
 			func(args []string) error {
-				presets := make([]rosa.PArtifact, len(args)+3)
+				handles := make([]rosa.ArtifactH, len(args), len(args)+3)
 				for i, arg := range args {
-					p, ok := rosa.ResolveName(arg)
+					handles[i] = rosa.ArtifactH(unique.Make(arg))
-					if !ok {
+					if meta, _ := rosa.Native().Std().Load(handles[i]); meta == nil {
 						return fmt.Errorf("unknown artifact %q", arg)
 					}
-					presets[i] = p
 				}
 
-				base := rosa.LLVM
+				base := rosa.H("llvm")
 				if !flagWithToolchain {
-					base = rosa.Musl
+					base = rosa.H("musl")
 				}
-				presets = append(presets,
+				handles = append(handles,
 					base,
-					rosa.Mksh,
+					rosa.H("mksh"),
-					rosa.Toybox,
+					rosa.H("toybox"),
 				)
 
 				root := make(pkg.Collect, 0, 6+len(args))
-				root = rosa.Std.AppendPresets(root, presets...)
+				root = rosa.Native().Std().Append(root, handles...)
 
 				if err := cm.Do(func(cache *pkg.Cache) error {
 					_, _, err := cache.Cure(&root)
@@ -710,6 +839,7 @@ func main() {
 				z.Hostname = "localhost"
 				z.Uid, z.Gid = (1<<10)-1, (1<<10)-1
 				z.Stdin, z.Stdout, z.Stderr = os.Stdin, os.Stdout, os.Stderr
+				z.Quiet = !cm.verboseInit
 				if s, ok := os.LookupEnv("TERM"); ok {
 					z.Env = append(z.Env, "TERM="+s)
 				}

cmd/mbf/main_test.go

@@ -9,7 +9,7 @@ import (
 )
 
 func TestMain(m *testing.M) {
-	rosa.DropCaches(rosa.OptLLVMNoLTO)
+	rosa.Native().DropCaches("", rosa.OptLLVMNoLTO)
 	os.Exit(m.Run())
 }
 
@@ -35,10 +35,10 @@ func TestCureAll(t *testing.T) {
 		}
 	})
 
-	for i := range rosa.PresetEnd {
+	for _, handle := range rosa.Native().Collect() {
-		p := rosa.PArtifact(i)
+		_, a := rosa.Native().Std().MustLoad(handle)
-		t.Run(rosa.GetMetadata(p).Name, func(t *testing.T) {
+		t.Run(handle.String(), func(t *testing.T) {
-			_, err := cureRemote(t.Context(), &addr, rosa.Std.Load(p), 0)
+			_, err := cureRemote(t.Context(), &addr, a, 0)
 			if err != nil {
 				t.Error(err)
 			}

cmd/sharefs/test/configuration.nix

@@ -20,11 +20,14 @@
   };
 
   virtualisation = {
+    # Hopefully reduces spurious test failures:
+    memorySize = if pkgs.stdenv.hostPlatform.is32bit then 2046 else 8192;
+
     diskSize = 6 * 1024;
 
     qemu.options = [
       # Increase test performance:
-      "-smp 8"
+      "-smp 16"
     ];
   };
 

cmd/sharefs/test/default.nix

@@ -28,7 +28,7 @@ testers.nixosTest {
         # For go tests:
         (pkgs.writeShellScriptBin "sharefs-workload-hakurei-tests" ''
           cp -r "${self.packages.${system}.hakurei.src}" "/sdcard/hakurei" && cd "/sdcard/hakurei"
-          ${fhs}/bin/hakurei-fhs -c 'CC="clang -O3 -Werror" go test ./...'
+          ${fhs}/bin/hakurei-fhs -c 'ROSA_SKIP_BINFMT=1 CC="clang -O3 -Werror" go test ./...'
         '')
       ];
 

container/binfmt.go

@@ -0,0 +1,46 @@
+package container
+
+import (
+	"strings"
+	"unsafe"
+
+	"hakurei.app/check"
+)
+
+// escapeBinfmt escapes magic/mask sequences in a [BinfmtEntry].
+func escapeBinfmt(buf *strings.Builder, s string) string {
+	const lowerhex = "0123456789abcdef"
+
+	buf.Reset()
+	for _, c := range unsafe.Slice(unsafe.StringData(s), len(s)) {
+		switch c {
+		case 0, '\\', ':':
+			buf.WriteString(`\x`)
+			buf.WriteByte(lowerhex[c>>4])
+			buf.WriteByte(lowerhex[c&0xf])
+
+		default:
+			buf.WriteByte(c)
+		}
+	}
+	return buf.String()
+}
+
+// BinfmtEntry is an entry to be registered by the init process.
+type BinfmtEntry struct {
+	// The offset of the magic/mask in the file, counted in bytes.
+	Offset byte
+	// The byte sequence binfmt_misc is matching for.
+	Magic string
+	// An (optional, defaults to all 0xff) mask.
+	Mask string
+	// The program that should be invoked with the binary as first argument.
+	Interpreter *check.Absolute
+}
+
+// Valid returns whether e can be registered into the kernel.
+func (e *BinfmtEntry) Valid() bool {
+	return e != nil &&
+		int(e.Offset)+max(len(e.Magic), len(e.Mask)) < 128 &&
+		e.Interpreter != nil && len(e.Interpreter.String()) < 128
+}

container/binfmt_test.go

@@ -0,0 +1,62 @@
+package container
+
+import (
+	"strings"
+	"testing"
+
+	"hakurei.app/fhs"
+)
+
+func TestEscapeBinfmt(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name  string
+		magic string
+		want  string
+	}{
+		{"packed DOS applications", "\x0eDEX", "\x0eDEX"},
+
+		{"riscv64 magic",
+			"\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xf3\x00",
+			"\x7fELF\x02\x01\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\x02\\x00\xf3\\x00"},
+		{"riscv64 mask",
+			"\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff",
+			"\xff\xff\xff\xff\xff\xff\xff\\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff"},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := escapeBinfmt(new(strings.Builder), tc.magic)
+			if got != tc.want {
+				t.Errorf("escapeBinfmt: %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestBinfmtEntry(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name  string
+		e     BinfmtEntry
+		valid bool
+	}{
+		{"zero", BinfmtEntry{}, false},
+		{"large offset", BinfmtEntry{Offset: 128}, false},
+		{"long magic", BinfmtEntry{Magic: strings.Repeat("\x00", 128)}, false},
+		{"long mask", BinfmtEntry{Mask: strings.Repeat("\x00", 128)}, false},
+		{"valid", BinfmtEntry{Interpreter: fhs.AbsRoot}, true},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			if tc.e.Valid() != tc.valid {
+				t.Errorf("Valid: %v", !tc.valid)
+			}
+		})
+	}
+}

container/capability.go

@@ -18,6 +18,7 @@ const (
 	CAP_SETPCAP      = 0x8
 	CAP_NET_ADMIN    = 0xc
 	CAP_DAC_OVERRIDE = 0x1
+	CAP_SETFCAP      = 0x1f
 )
 
 type (

container/container.go

@@ -67,6 +67,9 @@ type (
 		// Copied to the underlying [exec.Cmd].
 		WaitDelay time.Duration
 
+		// Suppress verbose output of init.
+		Quiet bool
+
 		cmd *exec.Cmd
 		ctx context.Context
 		msg message.Msg
@@ -88,12 +91,20 @@ type (
 		// Time to wait for processes lingering after the initial process terminates.
 		AdoptWaitDelay time.Duration
 
+		// Map uid/gid 0 in the init process. Requires [FstypeProc] attached to
+		// [fhs.Proc] in the container filesystem.
+		InitAsRoot bool
 		// Mapped Uid in user namespace.
 		Uid int
 		// Mapped Gid in user namespace.
 		Gid int
 		// Hostname value in UTS namespace.
 		Hostname string
+		// Register binfmt_misc entries.
+		Binfmt []BinfmtEntry
+		// Alternative pathname to attach binfmt_misc filesystem. The zero value
+		// requires [FstypeProc] to be made available at [fhs.Proc].
+		BinfmtPath *check.Absolute
 		// Sequential container setup ops.
 		*Ops
 
@@ -213,6 +224,9 @@ func (p *Container) Start() error {
 	if p.cmd.Process != nil {
 		return errors.New("container: already started")
 	}
+	if !p.InitAsRoot && len(p.Binfmt) > 0 {
+		return errors.New("container: init as root required, but not enabled")
+	}
 
 	if err := ensureCloseOnExec(); err != nil {
 		return err
@@ -283,6 +297,18 @@ func (p *Container) Start() error {
 	if !p.HostNet {
 		p.cmd.SysProcAttr.Cloneflags |= CLONE_NEWNET
 	}
+	if p.InitAsRoot {
+		p.cmd.SysProcAttr.AmbientCaps = append(p.cmd.SysProcAttr.AmbientCaps,
+			// mappings during init as root
+			CAP_SETFCAP,
+		)
+
+		if !p.SeccompDisable &&
+			len(p.SeccompRules) == 0 &&
+			p.SeccompPresets&std.PresetDenyNS != 0 {
+			return errors.New("container: as root requires late namespace creation")
+		}
+	}
 
 	// place setup pipe before user supplied extra files, this is later restored by init
 	if r, w, err := os.Pipe(); err != nil {
@@ -342,8 +368,6 @@ func (p *Container) Start() error {
 						Err:    ENOSYS,
 						Origin: true,
 					}
-				} else {
-					p.msg.Verbosef("landlock abi version %d", abi)
 				}
 
 				if rulesetFd, err := rulesetAttr.Create(0); err != nil {
@@ -353,7 +377,6 @@ func (p *Container) Start() error {
 						Err:   err,
 					}
 				} else {
-					p.msg.Verbosef("enforcing landlock ruleset %s", rulesetAttr)
 					if err = landlock.RestrictSelf(rulesetFd, 0); err != nil {
 						_ = Close(rulesetFd)
 						return &StartError{
@@ -410,7 +433,6 @@ func (p *Container) Start() error {
 				}
 			}
 
-			p.msg.Verbose("starting container init")
 			if err := p.cmd.Start(); err != nil {
 				return &StartError{
 					Step:        "start container init",
@@ -481,7 +503,6 @@ func (p *Container) Serve() (err error) {
 			}
 
 		case <-done:
-			p.msg.Verbose("setup payload took", time.Since(t))
 			return
 		}
 	}(p.setup[1])
@@ -491,7 +512,7 @@ func (p *Container) Serve() (err error) {
 		Getuid(),
 		Getgid(),
 		len(p.ExtraFiles),
-		p.msg.IsVerbose(),
+		p.msg.IsVerbose() && !p.Quiet,
 	})
 }
 

container/container_test.go

@@ -16,7 +16,8 @@ import (
 	"strings"
 	"syscall"
 	"testing"
-	_ "unsafe" // for go:linkname
+	"time"
+	"unsafe"
 
 	"hakurei.app/check"
 	"hakurei.app/command"
@@ -408,39 +409,11 @@ var containerTestCases = []struct {
 func TestContainer(t *testing.T) {
 	t.Parallel()
 
-	t.Run("cancel", testContainerCancel(nil, func(t *testing.T, c *container.Container) {
+	var suffix string
-		wantErr := context.Canceled
+runTests:
-		wantExitCode := 0
-		if err := c.Wait(); !reflect.DeepEqual(err, wantErr) {
-			if m, ok := container.InternalMessageFromError(err); ok {
-				t.Error(m)
-			}
-			t.Errorf("Wait: error = %#v, want %#v", err, wantErr)
-		}
-		if ps := c.ProcessState(); ps == nil {
-			t.Errorf("ProcessState unexpectedly returned nil")
-		} else if code := ps.ExitCode(); code != wantExitCode {
-			t.Errorf("ExitCode: %d, want %d", code, wantExitCode)
-		}
-	}))
-
-	t.Run("forward", testContainerCancel(func(c *container.Container) {
-		c.ForwardCancel = true
-	}, func(t *testing.T, c *container.Container) {
-		var exitError *exec.ExitError
-		if err := c.Wait(); !errors.As(err, &exitError) {
-			if m, ok := container.InternalMessageFromError(err); ok {
-				t.Error(m)
-			}
-			t.Errorf("Wait: error = %v", err)
-		}
-		if code := exitError.ExitCode(); code != blockExitCodeInterrupt {
-			t.Errorf("ExitCode: %d, want %d", code, blockExitCodeInterrupt)
-		}
-	}))
-
 	for i, tc := range containerTestCases {
-		t.Run(tc.name, func(t *testing.T) {
+		_suffix := suffix
+		t.Run(tc.name+_suffix, func(t *testing.T) {
 			t.Parallel()
 
 			wantOps, wantOpsCtx := tc.ops(t)
@@ -464,6 +437,8 @@ func TestContainer(t *testing.T) {
 			c.SeccompDisable = !tc.filter
 			c.RetainSession = tc.session
 			c.HostNet = tc.net
+			c.InitAsRoot = _suffix != ""
+			c.Env = append(c.Env, "HAKUREI_TEST_SUFFIX="+_suffix)
 			if info.CanDegrade {
 				if _, err := landlock.GetABI(); err != nil {
 					if !errors.Is(err, syscall.ENOSYS) {
@@ -473,6 +448,9 @@ func TestContainer(t *testing.T) {
 					t.Log("Landlock LSM is unavailable, enabling HostAbstract")
 				}
 			}
+			if c.InitAsRoot {
+				c.SeccompPresets &= ^std.PresetDenyNS
+			}
 
 			c.
 				Readonly(check.MustAbs(pathReadonly), 0755).
@@ -541,6 +519,11 @@ func TestContainer(t *testing.T) {
 			}
 		})
 	}
+
+	if suffix == "" {
+		suffix = " as root"
+		goto runTests
+	}
 }
 
 func ent(root, target, vfsOptstr, fsType, source, fsOptstr string) *vfs.MountInfoEntry {
@@ -563,49 +546,118 @@ func hostnameFromTestCase(name string) string {
 }
 
 func testContainerCancel(
+	t *testing.T,
 	containerExtra func(c *container.Container),
-	waitCheck func(t *testing.T, c *container.Container),
+	waitCheck func(ps *os.ProcessState, waitErr error),
-) func(t *testing.T) {
+) {
-	return func(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
-		t.Parallel()
-		ctx, cancel := context.WithCancel(t.Context())
 
-		c := helperNewContainer(ctx, "block")
+	c := helperNewContainer(ctx, "block")
-		c.Stdout, c.Stderr = os.Stdout, os.Stderr
+	c.Stdout, c.Stderr = os.Stdout, os.Stderr
-		if containerExtra != nil {
+	if containerExtra != nil {
-			containerExtra(c)
+		containerExtra(c)
-		}
-
-		ready := make(chan struct{})
-		if r, w, err := os.Pipe(); err != nil {
-			t.Fatalf("cannot pipe: %v", err)
-		} else {
-			c.ExtraFiles = append(c.ExtraFiles, w)
-			go func() {
-				defer close(ready)
-				if _, err = r.Read(make([]byte, 1)); err != nil {
-					panic(err.Error())
-				}
-			}()
-		}
-
-		if err := c.Start(); err != nil {
-			if m, ok := container.InternalMessageFromError(err); ok {
-				t.Fatal(m)
-			} else {
-				t.Fatalf("cannot start container: %v", err)
-			}
-		} else if err = c.Serve(); err != nil {
-			if m, ok := container.InternalMessageFromError(err); ok {
-				t.Error(m)
-			} else {
-				t.Errorf("cannot serve setup params: %v", err)
-			}
-		}
-		<-ready
-		cancel()
-		waitCheck(t, c)
 	}
+
+	ready := make(chan struct{})
+	var waitErr error
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("cannot pipe: %v", err)
+	}
+
+	c.ExtraFiles = append(c.ExtraFiles, w)
+	go func() {
+		defer close(ready)
+		if _, _err := r.Read(make([]byte, 1)); _err != nil {
+			panic(_err)
+		}
+	}()
+
+	if err = c.Start(); err != nil {
+		if m, ok := container.InternalMessageFromError(err); ok {
+			t.Fatal(m)
+		} else {
+			t.Fatalf("cannot start container: %v", err)
+		}
+	}
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		waitErr = c.Wait()
+		_ = r.SetReadDeadline(time.Now())
+	}()
+
+	if err = c.Serve(); err != nil {
+		if m, ok := container.InternalMessageFromError(err); ok {
+			t.Error(m)
+		} else {
+			t.Errorf("cannot serve setup params: %v", err)
+		}
+	}
+	<-ready
+	cancel()
+	<-done
+	waitCheck(c.ProcessState(), waitErr)
+}
+
+func TestForward(t *testing.T) {
+	t.Parallel()
+
+	f := func(ps *os.ProcessState, waitErr error) {
+		var exitError *exec.ExitError
+		if !errors.As(waitErr, &exitError) {
+			if m, ok := container.InternalMessageFromError(waitErr); ok {
+				t.Error(m)
+			}
+			t.Errorf("Wait: error = %v", waitErr)
+		}
+		if code := exitError.ExitCode(); code != blockExitCodeInterrupt {
+			t.Errorf("ExitCode: %d, want %d", code, blockExitCodeInterrupt)
+		}
+	}
+	t.Run("direct", func(t *testing.T) {
+		t.Parallel()
+		testContainerCancel(t, func(c *container.Container) {
+			c.ForwardCancel = true
+		}, f)
+	})
+	t.Run("as root", func(t *testing.T) {
+		testContainerCancel(t, func(c *container.Container) {
+			c.ForwardCancel = true
+			c.InitAsRoot = true
+			c.Proc(fhs.AbsProc)
+		}, f)
+	})
+}
+
+func TestCancel(t *testing.T) {
+	t.Parallel()
+
+	f := func(ps *os.ProcessState, waitErr error) {
+		wantErr := context.Canceled
+		if !reflect.DeepEqual(waitErr, wantErr) {
+			if m, ok := container.InternalMessageFromError(waitErr); ok {
+				t.Error(m)
+			}
+			t.Errorf("Wait: error = %#v, want %#v", waitErr, wantErr)
+		}
+		if ps == nil {
+			t.Errorf("ProcessState unexpectedly returned nil")
+		} else if code := ps.ExitCode(); code != 0 {
+			t.Errorf("ExitCode: %d, want %d", code, 0)
+		}
+	}
+	t.Run("direct", func(t *testing.T) {
+		t.Parallel()
+		testContainerCancel(t, nil, f)
+	})
+	t.Run("as root", func(t *testing.T) {
+		testContainerCancel(t, func(c *container.Container) {
+			c.InitAsRoot = true
+			c.Proc(fhs.AbsProc)
+		}, f)
+	})
 }
 
 func TestContainerString(t *testing.T) {
@@ -641,6 +693,8 @@ func init() {
 		})
 
 		c.Command("container", command.UsageInternal, func(args []string) error {
+			asRoot := os.Getenv("HAKUREI_TEST_SUFFIX") == " as root"
+
 			if len(args) != 1 {
 				return syscall.EINVAL
 			}
@@ -658,6 +712,66 @@ func init() {
 				return fmt.Errorf("gid: %d, want %d", gid, tc.gid)
 			}
 
+			// no attack surface increase during as root due to no_new_privs
+			var wantBounding uintptr = 1
+			asRootNot := " not"
+			if !asRoot {
+				wantBounding = 0
+				asRootNot = ""
+			}
+
+			const (
+				PR_CAP_AMBIENT        = 0x2f
+				PR_CAP_AMBIENT_IS_SET = 0x1
+			)
+			for i := range container.LastCap(nil) + 1 {
+				r, _, errno := syscall.Syscall(
+					syscall.SYS_PRCTL,
+					PR_CAP_AMBIENT,
+					PR_CAP_AMBIENT_IS_SET,
+					i,
+				)
+				if errno != 0 {
+					return os.NewSyscallError("prctl", errno)
+				}
+				if r != 0 {
+					return fmt.Errorf("capability %d in ambient set", i)
+				}
+
+				r, _, errno = syscall.Syscall(
+					syscall.SYS_PRCTL,
+					syscall.PR_CAPBSET_READ,
+					i,
+					0,
+				)
+				if errno != 0 {
+					return os.NewSyscallError("prctl", errno)
+				}
+				if r != wantBounding {
+					return fmt.Errorf("capability %d%s in bounding set", i, asRootNot)
+				}
+			}
+
+			const _LINUX_CAPABILITY_VERSION_3 = 0x20080522
+			var capData struct {
+				effective   uint32
+				permitted   uint32
+				inheritable uint32
+			}
+			if _, _, errno := syscall.Syscall(syscall.SYS_CAPGET, uintptr(unsafe.Pointer(&struct {
+				version uint32
+				pid     int32
+			}{_LINUX_CAPABILITY_VERSION_3, 0})), uintptr(unsafe.Pointer(&capData)), 0); errno != 0 {
+				return os.NewSyscallError("capget", errno)
+			}
+
+			if max(capData.effective, capData.permitted, capData.inheritable) != 0 {
+				return fmt.Errorf(
+					"effective = %d, permitted = %d, inheritable = %d",
+					capData.effective, capData.permitted, capData.inheritable,
+				)
+			}
+
 			wantHost := hostnameFromTestCase(tc.name)
 			if host, err := os.Hostname(); err != nil {
 				return fmt.Errorf("cannot get hostname: %v", err)
@@ -775,7 +889,7 @@ func TestMain(m *testing.M) {
 		}
 		c.MustParse(os.Args[1:], func(err error) {
 			if err != nil {
-				log.Fatal(err.Error())
+				log.Fatal(err)
 			}
 		})
 		return

container/init.go

@@ -11,11 +11,13 @@ import (
 	"path/filepath"
 	"slices"
 	"strconv"
+	"strings"
 	"sync"
 	"sync/atomic"
 	. "syscall"
 	"time"
 
+	"hakurei.app/check"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/ext"
 	"hakurei.app/fhs"
@@ -182,23 +184,33 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		cancel()
 	}
 
+	uid, gid := param.Uid, param.Gid
+	if param.InitAsRoot {
+		uid, gid = 0, 0
+	}
+
 	// write uid/gid map here so parent does not need to set dumpable
 	if err := k.setDumpable(ext.SUID_DUMP_USER); err != nil {
 		k.fatalf(msg, "cannot set SUID_DUMP_USER: %v", err)
 	}
-	if err := k.writeFile(fhs.Proc+"self/uid_map",
+	if err := k.writeFile(
-		append([]byte{}, strconv.Itoa(param.Uid)+" "+strconv.Itoa(param.HostUid)+" 1\n"...),
+		fhs.Proc+"self/uid_map",
-		0); err != nil {
+		[]byte(strconv.Itoa(uid)+" "+strconv.Itoa(param.HostUid)+" 1\n"),
+		0,
+	); err != nil {
 		k.fatalf(msg, "%v", err)
 	}
-	if err := k.writeFile(fhs.Proc+"self/setgroups",
+	if err := k.writeFile(
+		fhs.Proc+"self/setgroups",
 		[]byte("deny\n"),
-		0); err != nil && !os.IsNotExist(err) {
+		0,
+	); err != nil && !os.IsNotExist(err) {
 		k.fatalf(msg, "%v", err)
 	}
 	if err := k.writeFile(fhs.Proc+"self/gid_map",
-		append([]byte{}, strconv.Itoa(param.Gid)+" "+strconv.Itoa(param.HostGid)+" 1\n"...),
+		[]byte(strconv.Itoa(gid)+" "+strconv.Itoa(param.HostGid)+" 1\n"),
-		0); err != nil {
+		0,
+	); err != nil {
 		k.fatalf(msg, "%v", err)
 	}
 	if err := k.setDumpable(ext.SUID_DUMP_DISABLE); err != nil {
@@ -223,6 +235,23 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	state := &setupState{process: make(map[int]WaitStatus), Params: &param.Params, Msg: msg, Context: ctx}
 	defer cancel()
 
+	if err := k.mount(SourceTmpfsRootfs, intermediateHostPath, FstypeTmpfs, MS_NODEV|MS_NOSUID, zeroString); err != nil {
+		k.fatalf(msg, "cannot mount intermediate root: %v", optionalErrorUnwrap(err))
+	}
+	if err := k.chdir(intermediateHostPath); err != nil {
+		k.fatalf(msg, "cannot enter intermediate host path: %v", err)
+	}
+
+	if len(param.Binfmt) > 0 {
+		for i, e := range param.Binfmt {
+			if pathname, err := k.evalSymlinks(e.Interpreter.String()); err != nil {
+				k.fatal(msg, err)
+			} else if param.Binfmt[i].Interpreter, err = check.NewAbs(pathname); err != nil {
+				k.fatal(msg, err)
+			}
+		}
+	}
+
 	/* early is called right before pivot_root into intermediate root;
 	this step is mostly for gathering information that would otherwise be
 	difficult to obtain via library functions after pivot_root, and
@@ -242,13 +271,6 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		}
 	}
 
-	if err := k.mount(SourceTmpfsRootfs, intermediateHostPath, FstypeTmpfs, MS_NODEV|MS_NOSUID, zeroString); err != nil {
-		k.fatalf(msg, "cannot mount intermediate root: %v", optionalErrorUnwrap(err))
-	}
-	if err := k.chdir(intermediateHostPath); err != nil {
-		k.fatalf(msg, "cannot enter intermediate host path: %v", err)
-	}
-
 	if err := k.mkdir(sysrootDir, 0755); err != nil {
 		k.fatalf(msg, "%v", err)
 	}
@@ -285,6 +307,48 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		}
 	}
 
+	if len(param.Binfmt) > 0 {
+		const interpreter = "/interpreter"
+
+		if param.BinfmtPath == nil {
+			param.BinfmtPath = fhs.AbsProcSys.Append("fs/binfmt_misc")
+		}
+		binfmt := sysrootPath + param.BinfmtPath.String()
+		if err := k.mkdirAll(binfmt, 0); err != nil {
+			k.fatal(msg, err)
+		}
+		if err := k.mount(
+			SourceBinfmtMisc,
+			binfmt,
+			FstypeBinfmtMisc,
+			MS_NOSUID|MS_NOEXEC|MS_NODEV,
+			zeroString,
+		); err != nil {
+			k.fatal(msg, err)
+		}
+
+		var buf strings.Builder
+		buf.Grow(1920)
+
+		register := binfmt + "/register"
+		for i, e := range param.Binfmt {
+			if err := k.symlink(hostPath+e.Interpreter.String(), interpreter); err != nil {
+				k.fatal(msg, err)
+			} else if err = k.writeFile(register, []byte(":"+
+				strconv.Itoa(i)+":"+
+				"M:"+
+				strconv.Itoa(int(e.Offset))+":"+
+				escapeBinfmt(&buf, e.Magic)+":"+
+				escapeBinfmt(&buf, e.Mask)+":"+
+				interpreter+":"+
+				"F"), 0); err != nil {
+				k.fatal(msg, err)
+			} else if err = k.remove(interpreter); err != nil {
+				k.fatal(msg, err)
+			}
+		}
+	}
+
 	// setup requiring host root complete at this point
 	if err := k.mount(hostDir, hostDir, zeroString, MS_SILENT|MS_REC|MS_PRIVATE, zeroString); err != nil {
 		k.fatalf(msg, "cannot make host root rprivate: %v", optionalErrorUnwrap(err))
@@ -323,11 +387,19 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		}
 	}
 
+	var keepCaps []uintptr
+	if param.Privileged {
+		keepCaps = append(keepCaps, CAP_SYS_ADMIN, CAP_SETPCAP)
+	}
+	if param.InitAsRoot {
+		keepCaps = append(keepCaps, CAP_SETFCAP)
+	}
+
 	if err := k.capAmbientClearAll(); err != nil {
 		k.fatalf(msg, "cannot clear the ambient capability set: %v", err)
 	}
-	for i := uintptr(0); i <= lastcap; i++ {
+	for i := range lastcap + 1 {
-		if param.Privileged && i == CAP_SYS_ADMIN {
+		if slices.Contains(keepCaps, i) {
 			continue
 		}
 		if err := k.capBoundingSetDrop(i); err != nil {
@@ -336,20 +408,23 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	}
 
 	var keep [2]uint32
-	if param.Privileged {
+	for _, c := range keepCaps {
-		keep[capToIndex(CAP_SYS_ADMIN)] |= capToMask(CAP_SYS_ADMIN)
+		keep[capToIndex(c)] |= capToMask(c)
-
-		if err := k.capAmbientRaise(CAP_SYS_ADMIN); err != nil {
-			k.fatalf(msg, "cannot raise CAP_SYS_ADMIN: %v", err)
-		}
 	}
+
 	if err := k.capset(
 		&capHeader{_LINUX_CAPABILITY_VERSION_3, 0},
-		&[2]capData{{0, keep[0], keep[0]}, {0, keep[1], keep[1]}},
+		&[2]capData{{keep[0], keep[0], keep[0]}, {keep[1], keep[1], keep[1]}},
 	); err != nil {
 		k.fatalf(msg, "cannot capset: %v", err)
 	}
 
+	for _, c := range keepCaps {
+		if err := k.capAmbientRaise(c); err != nil {
+			k.fatalf(msg, "cannot raise %#x: %v", c, err)
+		}
+	}
+
 	if !param.SeccompDisable {
 		rules := param.SeccompRules
 		if len(rules) == 0 { // non-empty rules slice always overrides presets
@@ -474,6 +549,14 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	cmd.ExtraFiles = extraFiles
 	cmd.Dir = param.Dir.String()
 
+	if param.InitAsRoot {
+		cmd.SysProcAttr = &SysProcAttr{
+			Cloneflags:  CLONE_NEWUSER,
+			UidMappings: []SysProcIDMap{{ContainerID: param.Uid, HostID: 0, Size: 1}},
+			GidMappings: []SysProcIDMap{{ContainerID: param.Gid, HostID: 0, Size: 1}},
+		}
+	}
+
 	msg.Verbosef("starting initial process %s", param.Path)
 	if err := k.start(cmd); err != nil {
 		k.fatalf(msg, "%v", err)

container/init_test.go

@@ -332,6 +332,8 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("fatalf", stub.ExpectArgs{"invalid op at index %d", []any{0}}, nil, nil),
 				/* end early */
@@ -370,6 +372,8 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("fatalf", stub.ExpectArgs{"invalid op at index %d", []any{0}}, nil, nil),
 				/* end early */
@@ -408,6 +412,8 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", stub.UniqueError(61)),
 				call("fatalf", stub.ExpectArgs{"cannot prepare op at index %d: %v", []any{0, stub.UniqueError(61)}}, nil, nil),
@@ -447,6 +453,8 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", &os.PathError{Op: "readlink", Path: "/", Err: stub.UniqueError(60)}),
 				call("fatal", stub.ExpectArgs{[]any{"cannot readlink /: unique error 60 injected by the test suite"}}, nil, nil),
@@ -486,9 +494,6 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				/* begin early */
-				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
-				/* end early */
 				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, stub.UniqueError(58)),
 				call("fatalf", stub.ExpectArgs{"cannot mount intermediate root: %v", []any{stub.UniqueError(58)}}, nil, nil),
 			},
@@ -526,9 +531,6 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
-				/* begin early */
-				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
-				/* end early */
 				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
 				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, stub.UniqueError(56)),
 				call("fatalf", stub.ExpectArgs{"cannot enter intermediate host path: %v", []any{stub.UniqueError(56)}}, nil, nil),
@@ -567,11 +569,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, stub.UniqueError(54)),
 				call("fatalf", stub.ExpectArgs{"%v", []any{stub.UniqueError(54)}}, nil, nil),
 			},
@@ -609,11 +611,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, stub.UniqueError(52)),
 				call("fatalf", stub.ExpectArgs{"cannot bind sysroot: %v", []any{stub.UniqueError(52)}}, nil, nil),
@@ -652,11 +654,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, stub.UniqueError(50)),
@@ -696,11 +698,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -741,11 +743,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -787,11 +789,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -842,11 +844,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -897,11 +899,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -953,11 +955,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1010,11 +1012,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1069,11 +1071,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1129,11 +1131,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1190,11 +1192,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1252,11 +1254,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1315,11 +1317,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1379,11 +1381,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1444,11 +1446,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1510,11 +1512,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1584,11 +1586,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1622,7 +1624,6 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x5)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x6)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x7)}, nil, nil),
-				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x9)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xa)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xb)}, nil, nil),
@@ -1654,8 +1655,9 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x26)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x27)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x28)}, nil, nil),
+				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0x200100, 0x200100, 0x200100}, {0, 0, 0}}}, nil, nil),
 				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x15)}, nil, stub.UniqueError(19)),
-				call("fatalf", stub.ExpectArgs{"cannot raise CAP_SYS_ADMIN: %v", []any{stub.UniqueError(19)}}, nil, nil),
+				call("fatalf", stub.ExpectArgs{"cannot raise %#x: %v", []any{uintptr(0x15), stub.UniqueError(19)}}, nil, nil),
 			},
 		}, nil},
 
@@ -1691,11 +1693,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1729,7 +1731,6 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x5)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x6)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x7)}, nil, nil),
-				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x9)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xa)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xb)}, nil, nil),
@@ -1761,8 +1762,7 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x26)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x27)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x28)}, nil, nil),
-				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x15)}, nil, nil),
+				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0x200100, 0x200100, 0x200100}, {0, 0, 0}}}, nil, stub.UniqueError(17)),
-				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0, 0x200000, 0x200000}, {0, 0, 0}}}, nil, stub.UniqueError(17)),
 				call("fatalf", stub.ExpectArgs{"cannot capset: %v", []any{stub.UniqueError(17)}}, nil, nil),
 			},
 		}, nil},
@@ -1799,11 +1799,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -1837,7 +1837,6 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x5)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x6)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x7)}, nil, nil),
-				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x9)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xa)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xb)}, nil, nil),
@@ -1869,8 +1868,9 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x26)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x27)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x28)}, nil, nil),
+				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0x200100, 0x200100, 0x200100}, {0, 0, 0}}}, nil, nil),
 				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x15)}, nil, nil),
-				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0, 0x200000, 0x200000}, {0, 0, 0}}}, nil, nil),
+				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"resolving presets %#x", []any{std.FilterPreset(0xf)}}, nil, nil),
 				call("seccompLoad", stub.ExpectArgs{seccomp.Preset(0xf, 0), seccomp.ExportFlag(0)}, nil, stub.UniqueError(15)),
 				call("fatalf", stub.ExpectArgs{"cannot load syscall filter: %v", []any{stub.UniqueError(15)}}, nil, nil),
@@ -1908,11 +1908,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2032,11 +2032,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(4), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2132,11 +2132,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(4), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2232,11 +2232,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(4), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2323,11 +2323,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(4), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2418,11 +2418,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(4), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2520,11 +2520,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2659,11 +2659,11 @@ func TestInitEntrypoint(t *testing.T) {
 				call("sethostname", stub.ExpectArgs{[]byte("hakurei-check")}, nil, nil),
 				call("lastcap", stub.ExpectArgs{}, uintptr(40), nil),
 				call("mount", stub.ExpectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil),
+				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
+				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				/* begin early */
 				call("evalSymlinks", stub.ExpectArgs{"/"}, "/", nil),
 				/* end early */
-				call("mount", stub.ExpectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil),
-				call("chdir", stub.ExpectArgs{"/proc/self/fd"}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"sysroot", os.FileMode(0755)}, nil, nil),
 				call("mount", stub.ExpectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil),
 				call("mkdir", stub.ExpectArgs{"host", os.FileMode(0755)}, nil, nil),
@@ -2697,7 +2697,6 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x5)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x6)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x7)}, nil, nil),
-				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x9)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xa)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0xb)}, nil, nil),
@@ -2729,8 +2728,9 @@ func TestInitEntrypoint(t *testing.T) {
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x26)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x27)}, nil, nil),
 				call("capBoundingSetDrop", stub.ExpectArgs{uintptr(0x28)}, nil, nil),
+				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0x200100, 0x200100, 0x200100}, {0, 0, 0}}}, nil, nil),
 				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x15)}, nil, nil),
-				call("capset", stub.ExpectArgs{&capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, &[2]capData{{0, 0x200000, 0x200000}, {0, 0, 0}}}, nil, nil),
+				call("capAmbientRaise", stub.ExpectArgs{uintptr(0x8)}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"resolving presets %#x", []any{std.FilterPreset(0xf)}}, nil, nil),
 				call("seccompLoad", stub.ExpectArgs{seccomp.Preset(0xf, 0), seccomp.ExportFlag(0)}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"%d filter rules loaded", []any{73}}, nil, nil),

container/mount.go

@@ -40,6 +40,9 @@ const (
 	// SourceMqueue is used when mounting mqueue.
 	// Note that any source value is allowed when fstype is [FstypeMqueue].
 	SourceMqueue = "mqueue"
+	// SourceBinfmtMisc is used when mounting binfmt_misc.
+	// Note that any source value is allowed when fstype is [SourceBinfmtMisc].
+	SourceBinfmtMisc = "binfmt_misc"
 	// SourceOverlay is used when mounting overlay.
 	// Note that any source value is allowed when fstype is [FstypeOverlay].
 	SourceOverlay = "overlay"
@@ -70,6 +73,9 @@ const (
 	// FstypeMqueue represents the mqueue pseudo-filesystem.
 	// This filesystem type is usually mounted on /dev/mqueue.
 	FstypeMqueue = "mqueue"
+	// FstypeBinfmtMisc represents the binfmt_misc pseudo-filesystem.
+	// This filesystem type is usually mounted on /proc/sys/fs/binfmt_misc.
+	FstypeBinfmtMisc = "binfmt_misc"
 	// FstypeOverlay represents the overlay pseudo-filesystem.
 	// This filesystem type can be mounted anywhere in the container filesystem.
 	FstypeOverlay = "overlay"

fhs/abs.go

@@ -42,6 +42,8 @@ var (
 	AbsDevShm = unsafeAbs(DevShm)
 	// AbsProc is [Proc] as [check.Absolute].
 	AbsProc = unsafeAbs(Proc)
+	// AbsProcSys is [ProcSys] as [check.Absolute].
+	AbsProcSys = unsafeAbs(ProcSys)
 	// AbsProcSelfExe is [ProcSelfExe] as [check.Absolute].
 	AbsProcSelfExe = unsafeAbs(ProcSelfExe)
 	// AbsSys is [Sys] as [check.Absolute].

flake.nix

@@ -139,7 +139,6 @@
                 GOCACHE="$(mktemp -d)" \
                 PATH="${pkgs.pkgsStatic.musl.bin}/bin:$PATH" \
                 DESTDIR="$out" \
-                HAKUREI_VERSION="v${hakurei.version}" \
                   ./all.sh
               '';
         }

internal/pkg/dir_test.go

@@ -64,78 +64,6 @@ func TestFlatten(t *testing.T) {
 			{Mode: fs.ModeDir | 0700, Path: "work"},
 		}, pkg.MustDecode("E4vEZKhCcL2gPZ2Tt59FS3lDng-d_2SKa2i5G_RbDfwGn6EemptFaGLPUDiOa94C"), nil},
 
-		{"sample cache file", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum": {Mode: fs.ModeDir | 0700},
-			"checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX": {Mode: 0400, Data: []byte{0}},
-			"checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq": {Mode: 0400, Data: []byte{0, 0, 0, 0, 0xad, 0xb, 0, 4, 0xfe, 0xfe, 0, 0, 0xfe, 0xca, 0, 0}},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
-			"identifier/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
-			"identifier/cafebabecafebabecafebabecafebabecafebabecafebabecafebabecafebabe": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
-			"identifier/deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
-
-			"work": {Mode: fs.ModeDir | 0700},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0700, Path: "."},
-
-			{Mode: fs.ModeDir | 0700, Path: "checksum"},
-			{Mode: 0400, Path: "checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq", Data: []byte{0, 0, 0, 0, 0xad, 0xb, 0, 4, 0xfe, 0xfe, 0, 0, 0xfe, 0xca, 0, 0}},
-			{Mode: 0400, Path: "checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX", Data: []byte{0}},
-
-			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq", Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/cafebabecafebabecafebabecafebabecafebabecafebabecafebabecafebabe", Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef", Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX", Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
-
-			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("St9rlE-mGZ5gXwiv_hzQ_B8bZP-UUvSNmf4nHUZzCMOumb6hKnheZSe0dmnuc4Q2"), nil},
-
-		{"sample http get cure", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum": {Mode: fs.ModeDir | 0700},
-			"checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU": {Mode: 0400, Data: []byte("\x7f\xe1\x69\xa2\xdd\x63\x96\x26\x83\x79\x61\x8b\xf0\x3f\xd5\x16\x9a\x39\x3a\xdb\xcf\xb1\xbc\x8d\x33\xff\x75\xee\x62\x56\xa9\xf0\x27\xac\x13\x94\x69")},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/oM-2pUlk-mOxK1t3aMWZer69UdOQlAXiAgMrpZ1476VoOqpYVP1aGFS9_HYy-D8_": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU")},
-
-			"work": {Mode: fs.ModeDir | 0700},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0700, Path: "."},
-
-			{Mode: fs.ModeDir | 0700, Path: "checksum"},
-			{Mode: 0400, Path: "checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU", Data: []byte("\x7f\xe1\x69\xa2\xdd\x63\x96\x26\x83\x79\x61\x8b\xf0\x3f\xd5\x16\x9a\x39\x3a\xdb\xcf\xb1\xbc\x8d\x33\xff\x75\xee\x62\x56\xa9\xf0\x27\xac\x13\x94\x69")},
-
-			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/oM-2pUlk-mOxK1t3aMWZer69UdOQlAXiAgMrpZ1476VoOqpYVP1aGFS9_HYy-D8_", Data: []byte("../checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU")},
-
-			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("L_0RFHpr9JUS4Zp14rz2dESSRvfLzpvqsLhR1-YjQt8hYlmEdVl7vI3_-v8UNPKs"), nil},
-
-		{"sample directory step simple", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0500},
-
-			"check": {Mode: 0400, Data: []byte{0, 0}},
-
-			"lib":            {Mode: fs.ModeDir | 0700},
-			"lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
-
-			"lib/pkgconfig": {Mode: fs.ModeDir | 0700},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0500, Path: "."},
-
-			{Mode: 0400, Path: "check", Data: []byte{0, 0}},
-
-			{Mode: fs.ModeDir | 0700, Path: "lib"},
-			{Mode: fs.ModeSymlink | 0777, Path: "lib/libedac.so", Data: []byte("/proc/nonexistent/libedac.so")},
-
-			{Mode: fs.ModeDir | 0700, Path: "lib/pkgconfig"},
-		}, pkg.MustDecode("qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b"), nil},
-
 		{"sample directory step garbage", fstest.MapFS{
 			".": {Mode: fs.ModeDir | 0500},
 
@@ -151,421 +79,6 @@ func TestFlatten(t *testing.T) {
 
 			{Mode: fs.ModeDir | 0500, Path: "lib/pkgconfig"},
 		}, pkg.MustDecode("CUx-3hSbTWPsbMfDhgalG4Ni_GmR9TnVX8F99tY_P5GtkYvczg9RrF5zO0jX9XYT"), nil},
-
-		{"sample directory", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum": {Mode: fs.ModeDir | 0700},
-			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b":                {Mode: fs.ModeDir | 0500},
-			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/check":          {Mode: 0400, Data: []byte{0, 0}},
-			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib":            {Mode: fs.ModeDir | 0700},
-			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib/pkgconfig":  {Mode: fs.ModeDir | 0700},
-			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
-			"identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
-
-			"work": {Mode: fs.ModeDir | 0700},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0700, Path: "."},
-
-			{Mode: fs.ModeDir | 0700, Path: "checksum"},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b"},
-			{Mode: 0400, Path: "checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/check", Data: []byte{0, 0}},
-			{Mode: fs.ModeDir | 0700, Path: "checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib"},
-			{Mode: fs.ModeSymlink | 0777, Path: "checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib/libedac.so", Data: []byte("/proc/nonexistent/libedac.so")},
-			{Mode: fs.ModeDir | 0700, Path: "checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib/pkgconfig"},
-
-			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY", Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa", Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
-
-			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("WVpvsVqVKg9Nsh744x57h51AuWUoUR2nnh8Md-EYBQpk6ziyTuUn6PLtF2e0Eu_d"), nil},
-
-		{"sample no assume checksum", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum": {Mode: fs.ModeDir | 0700},
-			"checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M":       {Mode: fs.ModeDir | 0500},
-			"checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M/check": {Mode: 0400, Data: []byte{}},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/_wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M")},
-			"identifier/_wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M")},
-
-			"work": {Mode: fs.ModeDir | 0700},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0700, Path: "."},
-
-			{Mode: fs.ModeDir | 0700, Path: "checksum"},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M"},
-			{Mode: 0400, Path: "checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M/check", Data: []byte{}},
-
-			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/_wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", Data: []byte("../checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/_wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", Data: []byte("../checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M")},
-
-			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("OC290t23aimNo2Rp2pPwan5GI2KRLRdOwYxXQMD9jw0QROgHnNXWodoWdV0hwu2w"), nil},
-
-		{"sample tar step unpack", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0500},
-
-			"checksum": {Mode: fs.ModeDir | 0500},
-			"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP":                {Mode: fs.ModeDir | 0500},
-			"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/check":          {Mode: 0400, Data: []byte{0, 0}},
-			"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib":            {Mode: fs.ModeDir | 0500},
-			"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/pkgconfig":  {Mode: fs.ModeDir | 0500},
-			"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
-
-			"identifier": {Mode: fs.ModeDir | 0500},
-			"identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
-			"identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
-
-			"work": {Mode: fs.ModeDir | 0500},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0500, Path: "."},
-
-			{Mode: fs.ModeDir | 0500, Path: "checksum"},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP"},
-			{Mode: 0400, Path: "checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/check", Data: []byte{0, 0}},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib"},
-			{Mode: fs.ModeSymlink | 0777, Path: "checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/libedac.so", Data: []byte("/proc/nonexistent/libedac.so")},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/pkgconfig"},
-
-			{Mode: fs.ModeDir | 0500, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY", Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa", Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
-
-			{Mode: fs.ModeDir | 0500, Path: "work"},
-		}, pkg.MustDecode("cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM"), nil},
-
-		{"sample tar", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum": {Mode: fs.ModeDir | 0700},
-			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM":                                                                                          {Mode: fs.ModeDir | 0500},
-			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum":                                                                                 {Mode: fs.ModeDir | 0500},
-			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP":                {Mode: fs.ModeDir | 0500},
-			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/check":          {Mode: 0400, Data: []byte{0, 0}},
-			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib":            {Mode: fs.ModeDir | 0500},
-			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
-			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/pkgconfig":  {Mode: fs.ModeDir | 0500},
-			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/identifier":                                                                               {Mode: fs.ModeDir | 0500},
-			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY":              {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
-			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa":              {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
-			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/work":                                                                                     {Mode: fs.ModeDir | 0500},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/W5S65DEhawz_WKaok5NjUKLmnD9dNl5RPauNJjcOVcB3VM4eGhSaLGmXbL8vZpiw": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
-			"identifier/rg7F1D5hwv6o4xctjD5zDq4i5MD0mArTsUIWfhUbik8xC6Bsyt3mjXXOm3goojTz": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0700, Path: "."},
-
-			{Mode: fs.ModeDir | 0700, Path: "checksum"},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM"},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum"},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP"},
-			{Mode: 0400, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/check", Data: []byte{0, 0}},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib"},
-			{Mode: fs.ModeSymlink | 0777, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/libedac.so", Data: []byte("/proc/nonexistent/libedac.so")},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/pkgconfig"},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY", Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
-			{Mode: fs.ModeSymlink | 0777, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa", Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/work"},
-
-			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/W5S65DEhawz_WKaok5NjUKLmnD9dNl5RPauNJjcOVcB3VM4eGhSaLGmXbL8vZpiw", Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/rg7F1D5hwv6o4xctjD5zDq4i5MD0mArTsUIWfhUbik8xC6Bsyt3mjXXOm3goojTz", Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
-
-			{Mode: fs.ModeDir | 0700, Path: "temp"},
-			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("NQTlc466JmSVLIyWklm_u8_g95jEEb98PxJU-kjwxLpfdjwMWJq0G8ze9R4Vo1Vu"), nil},
-
-		{"sample tar expand step unpack", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0500},
-
-			"libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0500, Path: "."},
-
-			{Mode: fs.ModeSymlink | 0777, Path: "libedac.so", Data: []byte("/proc/nonexistent/libedac.so")},
-		}, pkg.MustDecode("CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN"), nil},
-
-		{"sample tar expand", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum": {Mode: fs.ModeDir | 0700},
-			"checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN":            {Mode: fs.ModeDir | 0500},
-			"checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/W5S65DEhawz_WKaok5NjUKLmnD9dNl5RPauNJjcOVcB3VM4eGhSaLGmXbL8vZpiw": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
-			"identifier/_v1blm2h-_KA-dVaawdpLas6MjHc6rbhhFS8JWwx8iJxZGUu8EBbRrhr5AaZ9PJL": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0700, Path: "."},
-
-			{Mode: fs.ModeDir | 0700, Path: "checksum"},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN"},
-			{Mode: fs.ModeSymlink | 0777, Path: "checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN/libedac.so", Data: []byte("/proc/nonexistent/libedac.so")},
-
-			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/W5S65DEhawz_WKaok5NjUKLmnD9dNl5RPauNJjcOVcB3VM4eGhSaLGmXbL8vZpiw", Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/_v1blm2h-_KA-dVaawdpLas6MjHc6rbhhFS8JWwx8iJxZGUu8EBbRrhr5AaZ9PJL", Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
-
-			{Mode: fs.ModeDir | 0700, Path: "temp"},
-			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("hSoSSgCYTNonX3Q8FjvjD1fBl-E-BQyA6OTXro2OadXqbST4tZ-akGXszdeqphRe"), nil},
-
-		{"testtool", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0500},
-
-			"check": {Mode: 0400, Data: []byte{0}},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0500, Path: "."},
-
-			{Mode: 0400, Path: "check", Data: []byte{0}},
-		}, pkg.MustDecode("GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9"), nil},
-
-		{"sample exec container", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum": {Mode: fs.ModeDir | 0700},
-			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9":       {Mode: fs.ModeDir | 0500},
-			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check": {Mode: 0400, Data: []byte{0}},
-			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
-			"checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb":       {Mode: 0400, Data: []byte{}},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
-			"identifier/dztPS6jRjiZtCF4_p8AzfnxGp6obkhrgFVsxdodbKWUoAEVtDz3MykepJB4kI_ks": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0700, Path: "."},
-
-			{Mode: fs.ModeDir | 0700, Path: "checksum"},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9"},
-			{Mode: 0400, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check", Data: []byte{0}},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"},
-			{Mode: 0400, Path: "checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb", Data: []byte{}},
-
-			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/dztPS6jRjiZtCF4_p8AzfnxGp6obkhrgFVsxdodbKWUoAEVtDz3MykepJB4kI_ks", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			{Mode: fs.ModeDir | 0700, Path: "temp"},
-			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("Q5DluWQCAeohLoiGRImurwFp3vdz9IfQCoj7Fuhh73s4KQPRHpEQEnHTdNHmB8Fx"), nil},
-
-		{"testtool net", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0500},
-
-			"check": {Mode: 0400, Data: []byte("net")},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0500, Path: "."},
-
-			{Mode: 0400, Path: "check", Data: []byte("net")},
-		}, pkg.MustDecode("a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W"), nil},
-
-		{"sample exec net container", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum": {Mode: fs.ModeDir | 0700},
-			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
-			"checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb":       {Mode: 0400, Data: []byte{}},
-			"checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W":       {Mode: fs.ModeDir | 0500},
-			"checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W/check": {Mode: 0400, Data: []byte("net")},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/G8qPxD9puvvoOVV7lrT80eyDeIl3G_CCFoKw12c8mCjMdG1zF7NEPkwYpNubClK3": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W")},
-			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
-			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0700, Path: "."},
-
-			{Mode: fs.ModeDir | 0700, Path: "checksum"},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"},
-			{Mode: 0400, Path: "checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb", Data: []byte{}},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W"},
-			{Mode: 0400, Path: "checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W/check", Data: []byte("net")},
-
-			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/G8qPxD9puvvoOVV7lrT80eyDeIl3G_CCFoKw12c8mCjMdG1zF7NEPkwYpNubClK3", Data: []byte("../checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			{Mode: fs.ModeDir | 0700, Path: "temp"},
-			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("bPYvvqxpfV7xcC1EptqyKNK1klLJgYHMDkzBcoOyK6j_Aj5hb0mXNPwTwPSK5F6Z"), nil},
-
-		{"sample exec container overlay root", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum": {Mode: fs.ModeDir | 0700},
-			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9":       {Mode: fs.ModeDir | 0500},
-			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check": {Mode: 0400, Data: []byte{0}},
-			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/RdMA-mubnrHuu3Ky1wWyxauSYCO0ZH_zCPUj3uDHqkfwv5sGcByoF_g5PjlGiClb": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0700, Path: "."},
-
-			{Mode: fs.ModeDir | 0700, Path: "checksum"},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9"},
-			{Mode: 0400, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check", Data: []byte{0}},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"},
-
-			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/RdMA-mubnrHuu3Ky1wWyxauSYCO0ZH_zCPUj3uDHqkfwv5sGcByoF_g5PjlGiClb", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			{Mode: fs.ModeDir | 0700, Path: "temp"},
-			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("PO2DSSCa4yoSgEYRcCSZfQfwow1yRigL3Ry-hI0RDI4aGuFBha-EfXeSJnG_5_Rl"), nil},
-
-		{"sample exec container overlay work", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum": {Mode: fs.ModeDir | 0700},
-			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9":       {Mode: fs.ModeDir | 0500},
-			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check": {Mode: 0400, Data: []byte{0}},
-			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/5hlaukCirnXE4W_RSLJFOZN47Z5RiHnacXzdFp_70cLgiJUGR6cSb_HaFftkzi0-": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0700, Path: "."},
-
-			{Mode: fs.ModeDir | 0700, Path: "checksum"},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9"},
-			{Mode: 0400, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check", Data: []byte{0}},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"},
-
-			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/5hlaukCirnXE4W_RSLJFOZN47Z5RiHnacXzdFp_70cLgiJUGR6cSb_HaFftkzi0-", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			{Mode: fs.ModeDir | 0700, Path: "temp"},
-			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("iaRt6l_Wm2n-h5UsDewZxQkCmjZjyL8r7wv32QT2kyV55-Lx09Dq4gfg9BiwPnKs"), nil},
-
-		{"sample exec container multiple layers", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum": {Mode: fs.ModeDir | 0700},
-			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9":       {Mode: fs.ModeDir | 0500},
-			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check": {Mode: 0400, Data: []byte{0}},
-			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
-			"checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb":       {Mode: 0400, Data: []byte{}},
-			"checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK":       {Mode: fs.ModeDir | 0500},
-			"checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK/check": {Mode: 0400, Data: []byte("layers")},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
-			"identifier/B-kc5iJMx8GtlCua4dz6BiJHnDAOUfPjgpbKq4e-QEn0_CZkSYs3fOA1ve06qMs2": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK")},
-			"identifier/p1t_drXr34i-jZNuxDMLaMOdL6tZvQqhavNafGynGqxOZoXAUTSn7kqNh3Ovv3DT": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0700, Path: "."},
-
-			{Mode: fs.ModeDir | 0700, Path: "checksum"},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9"},
-			{Mode: 0400, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check", Data: []byte{0}},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"},
-			{Mode: 0400, Path: "checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb", Data: []byte{}},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK"},
-			{Mode: 0400, Path: "checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK/check", Data: []byte("layers")},
-
-			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/B-kc5iJMx8GtlCua4dz6BiJHnDAOUfPjgpbKq4e-QEn0_CZkSYs3fOA1ve06qMs2", Data: []byte("../checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/p1t_drXr34i-jZNuxDMLaMOdL6tZvQqhavNafGynGqxOZoXAUTSn7kqNh3Ovv3DT", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-
-			{Mode: fs.ModeDir | 0700, Path: "temp"},
-			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("O2YzyR7IUGU5J2CADy0hUZ3A5NkP_Vwzs4UadEdn2oMZZVWRtH0xZGJ3HXiimTnZ"), nil},
-
-		{"sample exec container layer promotion", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum": {Mode: fs.ModeDir | 0700},
-			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9":       {Mode: fs.ModeDir | 0500},
-			"checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check": {Mode: 0400, Data: []byte{0}},
-			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/kvJIqZo5DKFOxC2ZQ-8_nPaQzEAz9cIm3p6guO-uLqm-xaiPu7oRkSnsu411jd_U": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-			"identifier/xXTIYcXmgJWNLC91c417RRrNM9cjELwEZHpGvf8Fk_GNP5agRJp_SicD0w9aMeLJ": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-
-			"temp": {Mode: fs.ModeDir | 0700},
-			"work": {Mode: fs.ModeDir | 0700},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0700, Path: "."},
-
-			{Mode: fs.ModeDir | 0700, Path: "checksum"},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9"},
-			{Mode: 0400, Path: "checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9/check", Data: []byte{0}},
-			{Mode: fs.ModeDir | 0500, Path: "checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"},
-
-			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/kvJIqZo5DKFOxC2ZQ-8_nPaQzEAz9cIm3p6guO-uLqm-xaiPu7oRkSnsu411jd_U", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/xXTIYcXmgJWNLC91c417RRrNM9cjELwEZHpGvf8Fk_GNP5agRJp_SicD0w9aMeLJ", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-
-			{Mode: fs.ModeDir | 0700, Path: "temp"},
-			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("3EaW6WibLi9gl03_UieiFPaFcPy5p4x3JPxrnLJxGaTI-bh3HU9DK9IMx7c3rrNm"), nil},
-
-		{"sample file short", fstest.MapFS{
-			".": {Mode: fs.ModeDir | 0700},
-
-			"checksum": {Mode: fs.ModeDir | 0700},
-			"checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX": {Mode: 0400, Data: []byte{0}},
-
-			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/3376ALA7hIUm2LbzH2fDvRezgzod1eTK_G6XjyOgbM2u-6swvkFaF0BOwSl_juBi": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
-
-			"work": {Mode: fs.ModeDir | 0700},
-		}, []pkg.FlatEntry{
-			{Mode: fs.ModeDir | 0700, Path: "."},
-			{Mode: fs.ModeDir | 0700, Path: "checksum"},
-			{Mode: 0400, Path: "checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX", Data: []byte{0}},
-
-			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/3376ALA7hIUm2LbzH2fDvRezgzod1eTK_G6XjyOgbM2u-6swvkFaF0BOwSl_juBi", Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
-
-			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("iR6H5OIsyOW4EwEgtm9rGzGF6DVtyHLySEtwnFE8bnus9VJcoCbR4JIek7Lw-vwT"), nil},
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {

internal/pkg/exec.go

@@ -9,8 +9,10 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"slices"
 	"strconv"
+	"sync"
 	"syscall"
 	"time"
 	"unique"
@@ -94,6 +96,32 @@ func MustPath(pathname string, writable bool, a ...Artifact) ExecPath {
 	return ExecPath{check.MustAbs(pathname), a, writable}
 }
 
+var (
+	binfmt   map[string]container.BinfmtEntry
+	binfmtMu sync.RWMutex
+)
+
+// RegisterArch arranges for [KindExec] and [KindExecNet] to support a new
+// architecture via a binfmt_misc entry. Each architecture must be registered
+// at most once.
+func RegisterArch(arch string, e container.BinfmtEntry) {
+	if arch == "" {
+		panic(UnsupportedArchError(arch))
+	}
+
+	binfmtMu.Lock()
+	defer binfmtMu.Unlock()
+
+	if binfmt == nil {
+		binfmt = make(map[string]container.BinfmtEntry)
+	}
+
+	if _, ok := binfmt[arch]; ok {
+		panic("attempting to register " + strconv.Quote(arch) + " twice")
+	}
+	binfmt[arch] = e
+}
+
 const (
 	// ExecTimeoutDefault replaces out of range [NewExec] timeout values.
 	ExecTimeoutDefault = 15 * time.Minute
@@ -110,6 +138,8 @@ type execArtifact struct {
 	// Caller-supplied user-facing reporting name, guaranteed to be nonzero
 	// during initialisation.
 	name string
+	// Target architecture.
+	arch string
 	// Caller-supplied inner mount points.
 	paths []ExecPath
 
@@ -132,28 +162,40 @@ type execArtifact struct {
 
 var _ fmt.Stringer = new(execArtifact)
 
-// execNetArtifact is like execArtifact but implements [KnownChecksum] and has
+// execMeasuredArtifact is like execArtifact but implements [KnownChecksum] and
-// its resulting container keep the host net namespace.
+// has its resulting container optionally keep the host net namespace.
-type execNetArtifact struct {
+type execMeasuredArtifact struct {
 	checksum Checksum
 
+	// Whether to keep host net namespace.
+	hostNet bool
+
 	execArtifact
 }
 
-var _ KnownChecksum = new(execNetArtifact)
+var _ KnownChecksum = new(execMeasuredArtifact)
 
 // Checksum returns the caller-supplied checksum.
-func (a *execNetArtifact) Checksum() Checksum { return a.checksum }
+func (a *execMeasuredArtifact) Checksum() Checksum { return a.checksum }
 
-// Kind returns the hardcoded [Kind] constant.
+// Kind returns [KindExecNet], or [KindExec] if hostNet is false.
-func (*execNetArtifact) Kind() Kind { return KindExecNet }
+func (a *execMeasuredArtifact) Kind() Kind {
+	if a == nil || a.hostNet {
+		return KindExecNet
+	}
+	return KindExec
+}
 
 // Cure cures the [Artifact] in the container described by the caller. The
-// container retains host networking.
+// container optionally retains host networking.
-func (a *execNetArtifact) Cure(f *FContext) error {
+func (a *execMeasuredArtifact) Cure(f *FContext) error {
-	return a.cure(f, true)
+	return a.cure(f, a.hostNet)
 }
 
+// ErrNetChecksum is panicked by [NewExec] if host net namespace is requested
+// with a nil checksum.
+var ErrNetChecksum = errors.New("attempting to keep net namespace without checksum")
+
 // NewExec returns a new [Artifact] that executes the program path in a
 // container with specified paths bind mounted read-only in order. A private
 // instance of /proc and /dev is made available to the container.
@@ -167,7 +209,7 @@ func (a *execNetArtifact) Cure(f *FContext) error {
 // regular or symlink.
 //
 // If checksum is non-nil, the resulting [Artifact] implements [KnownChecksum]
-// and its container runs in the host net namespace.
+// and its container optionally runs in the host net namespace.
 //
 // The container is allowed to run for the specified duration before the initial
 // process and all processes originating from it is terminated. A zero or
@@ -178,10 +220,10 @@ func (a *execNetArtifact) Cure(f *FContext) error {
 // container and does not affect curing outcome. Because of this, it is omitted
 // from parameter data for computing identifier.
 func NewExec(
-	name string,
+	name, arch string,
 	checksum *Checksum,
 	timeout time.Duration,
-	exclusive bool,
+	hostNet, exclusive bool,
 
 	dir *check.Absolute,
 	env []string,
@@ -193,17 +235,23 @@ func NewExec(
 	if name == "" {
 		name = "exec-" + filepath.Base(pathname.String())
 	}
+	if arch == "" {
+		arch = runtime.GOARCH
+	}
 	if timeout <= 0 {
 		timeout = ExecTimeoutDefault
 	}
 	if timeout > ExecTimeoutMax {
 		timeout = ExecTimeoutMax
 	}
-	a := execArtifact{name, paths, dir, env, pathname, args, timeout, exclusive}
+	a := execArtifact{name, arch, paths, dir, env, pathname, args, timeout, exclusive}
 	if checksum == nil {
+		if hostNet {
+			panic(ErrNetChecksum)
+		}
 		return &a
 	}
-	return &execNetArtifact{*checksum, a}
+	return &execMeasuredArtifact{*checksum, hostNet, a}
 }
 
 // Kind returns the hardcoded [Kind] constant.
@@ -211,6 +259,7 @@ func (*execArtifact) Kind() Kind { return KindExec }
 
 // Params writes paths, executable pathname and args.
 func (a *execArtifact) Params(ctx *IContext) {
+	ctx.WriteString(a.arch)
 	ctx.WriteString(a.name)
 
 	ctx.WriteUint32(uint32(len(a.paths)))
@@ -257,11 +306,26 @@ func (a *execArtifact) Params(ctx *IContext) {
 	}
 }
 
+// UnsupportedArchError describes an unsupported or invalid architecture.
+type UnsupportedArchError string
+
+func (e UnsupportedArchError) Error() string {
+	if e == "" {
+		return "invalid architecture name"
+	}
+	return "unsupported architecture " + string(e)
+}
+
 // readExecArtifact interprets IR values and returns the address of execArtifact
 // or execNetArtifact.
 func readExecArtifact(r *IRReader, net bool) Artifact {
 	r.DiscardAll()
 
+	arch := r.ReadString()
+	if arch == "" {
+		panic(UnsupportedArchError(arch))
+	}
+
 	name := r.ReadString()
 
 	sz := r.ReadUint32()
@@ -312,22 +376,17 @@ func readExecArtifact(r *IRReader, net bool) Artifact {
 	exclusive := r.ReadUint32() != 0
 
 	checksum, ok := r.Finalise()
-
 	var checksumP *Checksum
-	if net {
+	if ok {
-		if !ok {
+		checksumP = new(checksum.Value())
-			panic(ErrExpectedChecksum)
+	}
-		}
+
-		checksumVal := checksum.Value()
+	if net && !ok {
-		checksumP = &checksumVal
+		panic(ErrExpectedChecksum)
-	} else {
-		if ok {
-			panic(ErrUnexpectedChecksum)
-		}
 	}
 
 	return NewExec(
-		name, checksumP, timeout, exclusive, dir, env, pathname, args, paths...,
+		name, arch, checksumP, timeout, net, exclusive, dir, env, pathname, args, paths...,
 	)
 }
 
@@ -436,11 +495,23 @@ func (a *execArtifact) makeContainer(
 	if z.HostNet {
 		z.Hostname = "cure-net"
 	}
+	z.Quiet = flags&CSuppressInit != 0
 	z.Uid, z.Gid = (1<<10)-1, (1<<10)-1
 	z.Dir, z.Path, z.Args = a.dir, a.path, a.args
 	z.Env = slices.Concat(a.env, []string{EnvJobs + "=" + strconv.Itoa(jobs)})
 	z.Grow(len(a.paths) + 4)
 
+	if a.arch != runtime.GOARCH {
+		binfmtMu.RLock()
+		e, ok := binfmt[a.arch]
+		binfmtMu.RUnlock()
+		if !ok {
+			return nil, UnsupportedArchError(a.arch)
+		}
+		z.Binfmt = []container.BinfmtEntry{e}
+		z.InitAsRoot = true
+	}
+
 	for i, b := range a.paths {
 		if i == overlayWorkIndex {
 			if err = os.MkdirAll(work.String(), 0700); err != nil {
@@ -527,9 +598,9 @@ func (c *Cache) EnterExec(
 	case *execArtifact:
 		e = f
 
-	case *execNetArtifact:
+	case *execMeasuredArtifact:
 		e = &f.execArtifact
-		hostNet = true
+		hostNet = f.hostNet
 
 	default:
 		return ErrNotExec
@@ -630,12 +701,6 @@ func (a *execArtifact) cure(f *FContext, hostNet bool) (err error) {
 			_ = stdout.Close()
 			return
 		}
-		defer func() {
-			if err != nil && !errors.As(err, new(*exec.ExitError)) {
-				_ = stdout.Close()
-				_ = stderr.Close()
-			}
-		}()
 
 		brStdout, brStderr := f.cache.getReader(stdout), f.cache.getReader(stderr)
 		stdoutDone, stderrDone := make(chan struct{}), make(chan struct{})
@@ -650,6 +715,11 @@ func (a *execArtifact) cure(f *FContext, hostNet bool) (err error) {
 			io.TeeReader(brStderr, status),
 		)
 		defer func() {
+			if err != nil && !errors.As(err, new(*exec.ExitError)) {
+				_ = stdout.Close()
+				_ = stderr.Close()
+			}
+
 			<-stdoutDone
 			<-stderrDone
 			f.cache.putReader(brStdout)

internal/pkg/exec_test.go

@@ -1,44 +1,70 @@
 package pkg_test
 
-//go:generate env CGO_ENABLED=0 go build -tags testtool -o testdata/testtool ./testdata
-
 import (
+	"bytes"
 	_ "embed"
 	"encoding/gob"
 	"errors"
+	"io/fs"
 	"net"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"slices"
 	"testing"
-	"unique"
 
 	"hakurei.app/check"
+	"hakurei.app/container"
 	"hakurei.app/hst"
+	"hakurei.app/internal/info"
 	"hakurei.app/internal/pkg"
 	"hakurei.app/internal/stub"
+
+	"hakurei.app/internal/pkg/internal/testtool/expected"
 )
 
 // testtoolBin is the container test tool binary made available to the
 // execArtifact for testing its curing environment.
 //
-//go:embed testdata/testtool
+//go:generate env CGO_ENABLED=0 go build -tags testtool -o internal/testtool ./internal/testtool
+//go:embed internal/testtool/testtool
 var testtoolBin []byte
 
+func init() {
+	pathname, err := filepath.Abs("internal/testtool/testtool")
+	if err != nil {
+		panic(err)
+	}
+	pkg.RegisterArch("cafe", container.BinfmtEntry{
+		Magic:       expected.Magic,
+		Interpreter: check.MustAbs(pathname),
+	})
+}
+
 func TestExec(t *testing.T) {
 	t.Parallel()
 
-	wantChecksumOffline := pkg.MustDecode(
+	wantOffline := expectsFS{
-		"GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9",
+		".": {Mode: fs.ModeDir | 0500},
-	)
+
+		"check": {Mode: 0400, Data: []byte{0}},
+	}
+	wantOfflineEncode := pkg.Encode(wantOffline.hash())
+	failingArtifact := &stubArtifact{
+		kind:   pkg.KindTar,
+		params: []byte("doomed artifact"),
+		cure: func(t *pkg.TContext) error {
+			return stub.UniqueError(0xcafe)
+		},
+	}
 
 	checkWithCache(t, []cacheTestCase{
-		{"offline", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
+		{"offline", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-offline", nil, 0, false,
+					"exec-offline", "", new(wantOffline.hash()), 0, false, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -58,67 +84,128 @@ func TestExec(t *testing.T) {
 						},
 					}),
 					pkg.MustPath("/opt", false, testtool),
-				), ignorePathname, wantChecksumOffline, nil},
+				), ignorePathname, wantOffline, nil},
 
-				{"error passthrough", pkg.NewExec(
+				{"substitution", pkg.NewExec(
-					"", nil, 0, true,
+					"exec-offline", "", new(wantOffline.hash()), 0, false, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1"},
 					check.MustAbs("/opt/bin/testtool"),
 					[]string{"testtool"},
 
-					pkg.MustPath("/proc/nonexistent", false, &stubArtifact{
+					pkg.MustPath("/file", false, newStubFile(
+						pkg.KindHTTPGet,
+						pkg.ID{0xfe, 0},
+						nil,
+						nil, nil,
+					)),
+					// substitution miss fails in testtool due to differing idents
+					pkg.MustPath("/.hakurei", false, &stubArtifact{
 						kind:   pkg.KindTar,
-						params: []byte("doomed artifact"),
+						params: []byte("empty directory (substituted)"),
 						cure: func(t *pkg.TContext) error {
-							return stub.UniqueError(0xcafe)
+							return os.MkdirAll(t.GetWorkDir().String(), 0700)
 						},
 					}),
-				), nil, pkg.Checksum{}, &pkg.DependencyCureError{
+					pkg.MustPath("/opt", false, testtool),
+				), ignorePathname, wantOffline, nil},
+
+				{"error passthrough", pkg.NewExec(
+					"", "", nil, 0, false, true,
+					pkg.AbsWork,
+					[]string{"HAKUREI_TEST=1"},
+					check.MustAbs("/opt/bin/testtool"),
+					[]string{"testtool"},
+
+					pkg.MustPath("/proc/nonexistent", false, failingArtifact),
+				), nil, nil, &pkg.DependencyCureError{
 					{
-						Ident: unique.Make(pkg.ID(pkg.MustDecode(
+						A:   failingArtifact,
-							"Sowo6oZRmG6xVtUaxB6bDWZhVsqAJsIJWUp0OPKlE103cY0lodx7dem8J-qQF0Z1",
-						))),
 						Err: stub.UniqueError(0xcafe),
 					},
 				}},
 
 				{"invalid paths", pkg.NewExec(
-					"", nil, 0, false,
+					"", "", nil, 0, false, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1"},
 					check.MustAbs("/opt/bin/testtool"),
 					[]string{"testtool"},
 
 					pkg.ExecPath{},
-				), nil, pkg.Checksum{}, pkg.ErrInvalidPaths},
+				), nil, nil, pkg.ErrInvalidPaths},
 			})
 
 			// check init failure passthrough
-			var exitError *exec.ExitError
+			initFailureArtifact := pkg.NewExec(
-			if _, _, err := c.Cure(pkg.NewExec(
+				"", "", nil, 0, false, false,
-				"", nil, 0, false,
 				pkg.AbsWork,
 				nil,
 				check.MustAbs("/opt/bin/testtool"),
 				[]string{"testtool"},
-			)); !errors.As(err, &exitError) ||
+			)
+			var exitError *exec.ExitError
+			if _, _, err := c.Cure(initFailureArtifact); !errors.As(err, &exitError) ||
 				exitError.ExitCode() != hst.ExitFailure {
 				t.Fatalf("Cure: error = %v, want init exit status 1", err)
 			}
 
-			testtoolDestroy(t, base, c)
+			var faultStatus []byte
-		}, pkg.MustDecode("Q5DluWQCAeohLoiGRImurwFp3vdz9IfQCoj7Fuhh73s4KQPRHpEQEnHTdNHmB8Fx")},
+			if faults, err := c.ReadFaults(initFailureArtifact); err != nil {
+				t.Fatal(err)
+			} else if len(faults) != 1 {
+				t.Fatalf("ReadFaults: %v", faults)
+			} else if faultStatus, err = os.ReadFile(faults[0].String()); err != nil {
+				t.Fatal(err)
+			} else if err = faults[0].Destroy(); err != nil {
+				t.Fatal(err)
+			} else {
+				t.Logf("destroyed expected fault at %s", faults[0].Time().UTC())
+			}
 
-		{"net", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
+			if !bytes.HasPrefix(faultStatus, []byte(
+				"internal/pkg ",
+			)) || !bytes.Contains(faultStatus, []byte(
+				"\ninit: fork/exec /opt/bin/testtool: no such file or directory\n",
+			)) {
+				t.Errorf("unexpected status:\n%s", string(faultStatus))
+			}
+
+			destroyStatus(t, base, 2, 1)
+			testtoolDestroy(t, base, c)
+		}, expectsFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum":                                 {Mode: fs.ModeDir | 0700},
+			"checksum/" + wantOfflineEncode:            {Mode: fs.ModeDir | 0500},
+			"checksum/" + wantOfflineEncode + "/check": {Mode: 0400, Data: []byte{0}},
+			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU": {Mode: fs.ModeDir | 0500},
+			"checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb": {Mode: 0400, Data: []byte{}},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/QwS7SmiatdqryQYgESdGw7Yw2PcpNf0vNfpvUA0t92BTlKiUjfCrXyMW17G2X77X": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
+			"identifier/" + expected.Offline:                                              {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
+			"identifier/" + expected.OfflineS:                                             {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
+			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}},
+
+		{"net", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
-			wantChecksum := pkg.MustDecode(
+			wantNet := expectsFS{
-				"a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W",
+				".": {Mode: fs.ModeDir | 0500},
-			)
+
+				"check": {Mode: 0400, Data: []byte("net")},
+			}
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-net", &wantChecksum, 0, false,
+					"exec-net", "", new(wantNet.hash()), 0, true, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -138,18 +225,37 @@ func TestExec(t *testing.T) {
 						},
 					}),
 					pkg.MustPath("/opt", false, testtool),
-				), ignorePathname, wantChecksum, nil},
+				), ignorePathname, wantNet, nil},
 			})
 
+			destroyStatus(t, base, 2, 0)
 			testtoolDestroy(t, base, c)
-		}, pkg.MustDecode("bPYvvqxpfV7xcC1EptqyKNK1klLJgYHMDkzBcoOyK6j_Aj5hb0mXNPwTwPSK5F6Z")},
+		}, expectsFS{
+			".": {Mode: fs.ModeDir | 0700},
 
-		{"overlay root", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
+			"checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb":       {Mode: 0400, Data: []byte{}},
+			"checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W":       {Mode: fs.ModeDir | 0500},
+			"checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W/check": {Mode: 0400, Data: []byte("net")},
+
+			"identifier":                 {Mode: fs.ModeDir | 0700},
+			"identifier/" + expected.Net: {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W")},
+			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
+			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}},
+
+		{"overlay root", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-overlay-root", nil, 0, false,
+					"exec-overlay-root", "", nil, 0, false, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1", "HAKUREI_ROOT=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -163,18 +269,35 @@ func TestExec(t *testing.T) {
 						},
 					}),
 					pkg.MustPath("/opt", false, testtool),
-				), ignorePathname, wantChecksumOffline, nil},
+				), ignorePathname, wantOffline, nil},
 			})
 
+			destroyStatus(t, base, 2, 0)
 			testtoolDestroy(t, base, c)
-		}, pkg.MustDecode("PO2DSSCa4yoSgEYRcCSZfQfwow1yRigL3Ry-hI0RDI4aGuFBha-EfXeSJnG_5_Rl")},
+		}, expectsFS{
+			".": {Mode: fs.ModeDir | 0700},
 
-		{"overlay work", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
+			"checksum":                                 {Mode: fs.ModeDir | 0700},
+			"checksum/" + wantOfflineEncode:            {Mode: fs.ModeDir | 0500},
+			"checksum/" + wantOfflineEncode + "/check": {Mode: 0400, Data: []byte{0}},
+			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU": {Mode: fs.ModeDir | 0500},
+
+			"identifier":                     {Mode: fs.ModeDir | 0700},
+			"identifier/" + expected.OvlRoot: {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
+			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}},
+
+		{"overlay work", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-overlay-work", nil, 0, false,
+					"exec-overlay-work", "", nil, 0, false, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1", "HAKUREI_ROOT=1"},
 					check.MustAbs("/work/bin/testtool"),
@@ -193,18 +316,35 @@ func TestExec(t *testing.T) {
 							return os.MkdirAll(t.GetWorkDir().String(), 0700)
 						},
 					}), pkg.Path(pkg.AbsWork, false /* ignored */, testtool),
-				), ignorePathname, wantChecksumOffline, nil},
+				), ignorePathname, wantOffline, nil},
 			})
 
+			destroyStatus(t, base, 2, 0)
 			testtoolDestroy(t, base, c)
-		}, pkg.MustDecode("iaRt6l_Wm2n-h5UsDewZxQkCmjZjyL8r7wv32QT2kyV55-Lx09Dq4gfg9BiwPnKs")},
+		}, expectsFS{
+			".": {Mode: fs.ModeDir | 0700},
 
-		{"multiple layers", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
+			"checksum":                                 {Mode: fs.ModeDir | 0700},
+			"checksum/" + wantOfflineEncode:            {Mode: fs.ModeDir | 0500},
+			"checksum/" + wantOfflineEncode + "/check": {Mode: 0400, Data: []byte{0}},
+			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU": {Mode: fs.ModeDir | 0500},
+
+			"identifier":                  {Mode: fs.ModeDir | 0700},
+			"identifier/" + expected.Work: {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
+			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}},
+
+		{"multiple layers", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-multiple-layers", nil, 0, false,
+					"exec-multiple-layers", "", nil, 0, false, false,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1", "HAKUREI_ROOT=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -245,18 +385,40 @@ func TestExec(t *testing.T) {
 						},
 					}),
 					pkg.MustPath("/opt", false, testtool),
-				), ignorePathname, wantChecksumOffline, nil},
+				), ignorePathname, wantOffline, nil},
 			})
 
+			destroyStatus(t, base, 2, 0)
 			testtoolDestroy(t, base, c)
-		}, pkg.MustDecode("O2YzyR7IUGU5J2CADy0hUZ3A5NkP_Vwzs4UadEdn2oMZZVWRtH0xZGJ3HXiimTnZ")},
+		}, expectsFS{
+			".": {Mode: fs.ModeDir | 0700},
 
-		{"overlay layer promotion", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
+			"checksum":                                 {Mode: fs.ModeDir | 0700},
+			"checksum/" + wantOfflineEncode:            {Mode: fs.ModeDir | 0500},
+			"checksum/" + wantOfflineEncode + "/check": {Mode: 0400, Data: []byte{0}},
+			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
+			"checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb":       {Mode: 0400, Data: []byte{}},
+			"checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK":       {Mode: fs.ModeDir | 0500},
+			"checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK/check": {Mode: 0400, Data: []byte("layers")},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
+			"identifier/B-kc5iJMx8GtlCua4dz6BiJHnDAOUfPjgpbKq4e-QEn0_CZkSYs3fOA1ve06qMs2": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK")},
+			"identifier/" + expected.Layers:                                               {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
+			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}},
+
+		{"overlay layer promotion", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			testtool, testtoolDestroy := newTesttool()
 
 			cureMany(t, c, []cureStep{
 				{"container", pkg.NewExec(
-					"exec-layer-promotion", nil, 0, true,
+					"exec-layer-promotion", "", nil, 0, false, true,
 					pkg.AbsWork,
 					[]string{"HAKUREI_TEST=1", "HAKUREI_ROOT=1"},
 					check.MustAbs("/opt/bin/testtool"),
@@ -276,11 +438,96 @@ func TestExec(t *testing.T) {
 						},
 					}),
 					pkg.MustPath("/opt", false, testtool),
-				), ignorePathname, wantChecksumOffline, nil},
+				), ignorePathname, wantOffline, nil},
 			})
 
+			destroyStatus(t, base, 2, 0)
 			testtoolDestroy(t, base, c)
-		}, pkg.MustDecode("3EaW6WibLi9gl03_UieiFPaFcPy5p4x3JPxrnLJxGaTI-bh3HU9DK9IMx7c3rrNm")},
+		}, expectsFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum":                                 {Mode: fs.ModeDir | 0700},
+			"checksum/" + wantOfflineEncode:            {Mode: fs.ModeDir | 0500},
+			"checksum/" + wantOfflineEncode + "/check": {Mode: 0400, Data: []byte{0}},
+			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU": {Mode: fs.ModeDir | 0500},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/kvJIqZo5DKFOxC2ZQ-8_nPaQzEAz9cIm3p6guO-uLqm-xaiPu7oRkSnsu411jd_U": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			"identifier/" + expected.Promote:                                              {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantOfflineEncode)},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}},
+
+		{"binfmt", pkg.CValidateKnown | checkDestroySubstitutes, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
+			if info.CanDegrade && os.Getenv("ROSA_SKIP_BINFMT") != "" {
+				t.Skip("binfmt_misc test explicitly skipped")
+			}
+
+			cureMany(t, c, []cureStep{
+				{"container", pkg.NewExec(
+					"exec-binfmt", "cafe", nil, 0, false, true,
+					pkg.AbsWork,
+					[]string{"HAKUREI_TEST=1", "HAKUREI_BINFMT=1"},
+					check.MustAbs("/opt/bin/sample"),
+					[]string{"sample"},
+
+					pkg.MustPath("/", true, &stubArtifact{
+						kind:   pkg.KindTar,
+						params: []byte("empty directory"),
+						cure: func(t *pkg.TContext) error {
+							return os.MkdirAll(t.GetWorkDir().String(), 0700)
+						},
+					}),
+					pkg.MustPath("/opt", false, overrideIdent{pkg.ID{0xfe, 0xff}, &stubArtifact{
+						kind: pkg.KindTar,
+						cure: func(t *pkg.TContext) error {
+							work := t.GetWorkDir()
+							if err := os.MkdirAll(
+								work.Append("bin").String(),
+								0700,
+							); err != nil {
+								return err
+							}
+
+							return os.WriteFile(t.GetWorkDir().Append(
+								"bin",
+								"sample",
+							).String(), []byte(expected.Full), 0500)
+						},
+					}}),
+				), ignorePathname, expectsFS{
+					".": {Mode: fs.ModeDir | 0500},
+
+					"check": {Mode: 0400, Data: []byte("binfmt")},
+				}, nil},
+			})
+
+			destroyStatus(t, base, 2, 0)
+		}, expectsFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/5aevg3YpDxjqQZ-pdvXK7YqgkL5JKqcoStYQxeD96kuYar6K2mRQWMHib6NQRnpV":            {Mode: fs.ModeDir | 0500},
+			"checksum/5aevg3YpDxjqQZ-pdvXK7YqgkL5JKqcoStYQxeD96kuYar6K2mRQWMHib6NQRnpV/bin":        {Mode: fs.ModeDir | 0700},
+			"checksum/5aevg3YpDxjqQZ-pdvXK7YqgkL5JKqcoStYQxeD96kuYar6K2mRQWMHib6NQRnpV/bin/sample": {Mode: 0500, Data: []byte("\xca\xfe\xba\xbe\xfd\xfd:3")},
+			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":            {Mode: fs.ModeDir | 0500},
+			"checksum/UnDo4B5KneEUY5b4vRUk_y9MWgkWuw2N8f8a2XayO686xXur-aZmX2-7n_8tKMe3":            {Mode: fs.ModeDir | 0500},
+			"checksum/UnDo4B5KneEUY5b4vRUk_y9MWgkWuw2N8f8a2XayO686xXur-aZmX2-7n_8tKMe3/check":      {Mode: 0400, Data: []byte("binfmt")},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/6VQTJ1lI5BmVuI1YFYJ8ClO3MRORvTTrcWFDcUU-l5Ga8EofxCxGlSTYN-u8dKj_": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/UnDo4B5KneEUY5b4vRUk_y9MWgkWuw2N8f8a2XayO686xXur-aZmX2-7n_8tKMe3")},
+			"identifier/_v8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/5aevg3YpDxjqQZ-pdvXK7YqgkL5JKqcoStYQxeD96kuYar6K2mRQWMHib6NQRnpV")},
+			"identifier/vjz1MHPcGBKV7sjcs8jQP3cqxJ1hgPTiQBMCEHP9BGXjGxd-tJmEmXKaStObo5gK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}},
 	})
 }
 

internal/pkg/file_test.go

@@ -1,6 +1,7 @@
 package pkg_test
 
 import (
+	"io/fs"
 	"testing"
 
 	"hakurei.app/check"
@@ -10,18 +11,27 @@ import (
 func TestFile(t *testing.T) {
 	t.Parallel()
 
+	want := expectsFile{0}
 	checkWithCache(t, []cacheTestCase{
 		{"file", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			cureMany(t, c, []cureStep{
 				{"short", pkg.NewFile("null", []byte{0}), base.Append(
 					"identifier",
 					"3376ALA7hIUm2LbzH2fDvRezgzod1eTK_G6XjyOgbM2u-6swvkFaF0BOwSl_juBi",
-				), pkg.MustDecode(
+				), want, nil},
-					"vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX",
-				), nil},
 			})
-		}, pkg.MustDecode(
+		}, expectsFS{
-			"iR6H5OIsyOW4EwEgtm9rGzGF6DVtyHLySEtwnFE8bnus9VJcoCbR4JIek7Lw-vwT",
+			".": {Mode: fs.ModeDir | 0700},
-		)},
+
+			"checksum":                            {Mode: fs.ModeDir | 0700},
+			"checksum/" + pkg.Encode(want.hash()): {Mode: 0400, Data: []byte{0}},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/3376ALA7hIUm2LbzH2fDvRezgzod1eTK_G6XjyOgbM2u-6swvkFaF0BOwSl_juBi": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+
+			"work": {Mode: fs.ModeDir | 0700},
+		}},
 	})
 }

internal/pkg/internal/testtool/expected/expected.go

@@ -0,0 +1,9 @@
+// Package expected contains data shared between test helper and test harness.
+package expected
+
+const (
+	// Magic are magic bytes in the binfmt test case.
+	Magic = "\xca\xfe\xba\xbe\xfd\xfd"
+	// Full is the full content of the binfmt test case executable.
+	Full = Magic + ":3"
+)

internal/pkg/internal/testtool/expected/sum_amd64.go

@@ -0,0 +1,11 @@
+package expected
+
+const (
+	Offline  = "q5ktDTq0miP-VvB2blxqXQeaRXCUWgP_KbC18KNtUDtyoaI_h5mHmGuPMArVEBDs"
+	OfflineS = "IY91PCtOpCYy21AaIK0c9f8-Z6fb2_2ewoHWkt4dxoLf0GOrWqS8yAGFLV84b1Dw"
+	OvlRoot  = "NacZGXwuRkTvcHaG08a22ujJ8qCWN0RSoFlRSR5FSt0ZcBbJ28FRvkYsHEtX7G8i"
+	Layers   = "WBJDrATtX6rIE5yAu8ePX3WmDF0Tt9kFiue0m3cRnyRoVx1my8a67fh3CAW486oP"
+	Net      = "CmYtj2sNB3LHtqiDuck_Lz3MjLLIiwyP8N4NDitQ1Icvv__LVP9p8tm-sHeQaKKp"
+	Promote  = "TX3eCloaQFkV-SZIH6Jg6E5WKH--rcXY1P0jnZKmLFKWrNqnOzd4G9eIBh6i5ywN"
+	Work     = "OuNiLSC68pZhAOr1YQ4WbV1tzASA0nxLEBcK7lO7MqxDY_j8dmP_C612RTuF23Lu"
+)

internal/pkg/internal/testtool/expected/sum_arm64.go

@@ -0,0 +1,11 @@
+package expected
+
+const (
+	Offline  = "WapqyoPxbWSnq07dWHt71mHaJXq99pAjJfFlELlJljSiZMhTFqqlzU1_mN86shSj"
+	OfflineS = "ibQZHcdXgNQ1OiMX1FrburBbGPVvKEHvPilbQCkm_0oV0BQCHomyyTbYNrFMGIwl"
+	OvlRoot  = "V9anFOiRvjGfAeBhLl14AL8TKdWZyD0WTPYe4fS9mOBw8iW5Lmarvt6TG6MV8uWm"
+	Layers   = "tKx7JNRoSBdK_7MdzI-nwTNV2wmiPzwYdcd17oLmXKL_iLmUzUiA79qTqdrTasrv"
+	Net      = "aXyDLzBCJ9XltXZIfetEVsEkrqHfcXuD5XE_FcUnYbN3emwL55N6P8LlHzNfGnM5"
+	Promote  = "3k4V16n96Lq04gjFSKmm4sFjyQ883FFBNXgTy9s_DjeTwxT3pg_iacEh8yMb_S4m"
+	Work     = "6Q49MhFWRE3Ne6MycwAotgl1GtoU5WCHqJNWG2byYZCY-zX-IxPrWiKk7bKkNzhE"
+)

internal/pkg/internal/testtool/expected/sum_riscv64.go

@@ -0,0 +1,11 @@
+package expected
+
+const (
+	Offline  = "Z6yXE5gOJScL3srmnVMWgCXccDiUNZ5snSrf6RkXuU1_U0rX_kGVwsfHUgNG_awd"
+	OfflineS = "zN16xv6LKRJRipUJwupyxg2rZcvf-qpsMn_qCxUmgxlTSuNwYI70ZEb7dHW5k0gO"
+	OvlRoot  = "zYXJHFRLuxvUhuisZEXgGgVvdQd6piMfp5jmtT6jdVjvC2gICXquOq-UTwlrSD5I"
+	Layers   = "_F8EDazHbcLeT0sVSQXRN_kn9IjduqJcDYgzXpsT-hpKU4EBcZ0PISN2zchpqMbm"
+	Net      = "CA_FAaSIYJgapBEHV40doxpH23PdUEy_6s1TZc7wfSPN0XYqwGpMceXXDSabGveO"
+	Promote  = "_3LPrLp--4h9k4GsNNApu9hHtAafq-GUhfU6d4hJKBDKT3bz_szOsvkXxc5sK53d"
+	Work     = "FEgHeiCD_WT4wsfB-9kDH5n6cRWCEYtJmXdKZgmUUukAOoXumH_hLlosXREC-tqq"
+)

internal/pkg/internal/testtool/main.go

@@ -16,12 +16,27 @@ import (
 
 	"hakurei.app/fhs"
 	"hakurei.app/vfs"
+
+	"hakurei.app/internal/pkg/internal/testtool/expected"
 )
 
 func main() {
 	log.SetFlags(0)
 	log.SetPrefix("testtool: ")
 
+	if os.Getenv("HAKUREI_BINFMT") == "1" {
+		wantArgs := []string{"/interpreter", "/opt/bin/sample"}
+		if !slices.Equal(os.Args, wantArgs) {
+			log.Fatalf("Args: %q, want %q", os.Args, wantArgs)
+		}
+
+		if err := os.WriteFile("check", []byte("binfmt"), 0400); err != nil {
+			log.Fatal(err)
+		}
+
+		return
+	}
+
 	environ := slices.DeleteFunc(slices.Clone(os.Environ()), func(s string) bool {
 		return s == "CURE_JOBS="+strconv.Itoa(runtime.NumCPU())
 	})
@@ -147,12 +162,12 @@ func main() {
 	}
 
 	const checksumEmptyDir = "MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"
-	ident := "dztPS6jRjiZtCF4_p8AzfnxGp6obkhrgFVsxdodbKWUoAEVtDz3MykepJB4kI_ks"
+	ident := expected.Offline
 	log.Println(m)
 	next := func() { m = m.Next; log.Println(m) }
 
 	if overlayRoot {
-		ident = "RdMA-mubnrHuu3Ky1wWyxauSYCO0ZH_zCPUj3uDHqkfwv5sGcByoF_g5PjlGiClb"
+		ident = expected.OvlRoot
 
 		if m.Root != "/" || m.Target != "/" ||
 			m.Source != "overlay" || m.FsType != "overlay" {
@@ -170,7 +185,7 @@ func main() {
 				log.Fatal("unexpected artifact checksum")
 			}
 		} else {
-			ident = "p1t_drXr34i-jZNuxDMLaMOdL6tZvQqhavNafGynGqxOZoXAUTSn7kqNh3Ovv3DT"
+			ident = expected.Layers
 
 			if len(lowerdir) != 2 ||
 				filepath.Base(lowerdir[0]) != "MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU" ||
@@ -180,7 +195,7 @@ func main() {
 		}
 	} else {
 		if hostNet {
-			ident = "G8qPxD9puvvoOVV7lrT80eyDeIl3G_CCFoKw12c8mCjMdG1zF7NEPkwYpNubClK3"
+			ident = expected.Net
 		}
 
 		if m.Root != "/sysroot" || m.Target != "/" {
@@ -199,14 +214,14 @@ func main() {
 	}
 
 	if promote {
-		ident = "xXTIYcXmgJWNLC91c417RRrNM9cjELwEZHpGvf8Fk_GNP5agRJp_SicD0w9aMeLJ"
+		ident = expected.Promote
 	}
 
 	next() // testtool artifact
 
 	next()
 	if overlayWork {
-		ident = "5hlaukCirnXE4W_RSLJFOZN47Z5RiHnacXzdFp_70cLgiJUGR6cSb_HaFftkzi0-"
+		ident = expected.Work
 		if m.Root != "/" || m.Target != "/work" ||
 			m.Source != "overlay" || m.FsType != "overlay" {
 			log.Fatal("unexpected work mount entry")

internal/pkg/ir.go

@@ -76,6 +76,9 @@ type IContext struct {
 	// Written to by various methods, should be zeroed after [Artifact.Params]
 	// returns and must not be exposed directly.
 	w io.Writer
+	// Optional [Artifact] to cureRes cache, replaces [IRKindIdent] with
+	// checksum values if non-nil.
+	inputs map[Artifact]cureRes
 }
 
 // irZero is a zero IR word.
@@ -163,7 +166,15 @@ func (i *IContext) WriteIdent(a Artifact) {
 	defer i.ic.putIdentBuf(buf)
 
 	IRKindIdent.encodeHeader(0).put(buf[:])
-	*(*ID)(buf[wordSize:]) = i.ic.Ident(a).Value()
+	if i.inputs != nil {
+		res, ok := i.inputs[a]
+		if !ok {
+			panic(InvalidLookupError(i.ic.Ident(a).Value()))
+		}
+		*(*ID)(buf[wordSize:]) = res.checksum.Value()
+	} else {
+		*(*ID)(buf[wordSize:]) = i.ic.Ident(a).Value()
+	}
 	i.mustWrite(buf[:])
 }
 
@@ -207,19 +218,44 @@ func (i *IContext) WriteString(s string) {
 // Encode writes a deterministic, efficient representation of a to w and returns
 // the first non-nil error encountered while writing to w.
 func (ic *irCache) Encode(w io.Writer, a Artifact) (err error) {
+	return ic.encode(w, a, nil)
+}
+
+// encode implements Encode but replaces identifiers with their cured checksums
+// for a non-nil ident. Caller must acquire Cache.identMu.
+func (ic *irCache) encode(
+	w io.Writer,
+	a Artifact,
+	inputs map[Artifact]cureRes,
+) (err error) {
 	deps := a.Dependencies()
 	idents := make([]*extIdent, len(deps))
-	for i, d := range deps {
+	if inputs == nil {
-		dbuf, did := ic.unsafeIdent(d, true)
+		for i, d := range deps {
-		if dbuf == nil {
+			dbuf, did := ic.unsafeIdent(d, true)
-			dbuf = ic.getIdentBuf()
+			if dbuf == nil {
-			binary.LittleEndian.PutUint64(dbuf[:], uint64(d.Kind()))
+				dbuf = ic.getIdentBuf()
-			*(*ID)(dbuf[wordSize:]) = did.Value()
+				binary.LittleEndian.PutUint64(dbuf[:], uint64(d.Kind()))
-		} else {
+				*(*ID)(dbuf[wordSize:]) = did.Value()
-			ic.storeIdent(d, dbuf)
+			} else {
+				ic.storeIdent(d, dbuf)
+			}
+			defer ic.putIdentBuf(dbuf)
+			idents[i] = dbuf
+		}
+	} else {
+		for i, d := range deps {
+			res, ok := inputs[d]
+			if !ok {
+				return InvalidLookupError(ic.Ident(d).Value())
+			}
+
+			dbuf := ic.getIdentBuf()
+			binary.LittleEndian.PutUint64(dbuf[:], uint64(d.Kind()))
+			*(*ID)(dbuf[wordSize:]) = res.checksum.Value()
+			defer ic.putIdentBuf(dbuf)
+			idents[i] = dbuf
 		}
-		defer ic.putIdentBuf(dbuf)
-		idents[i] = dbuf
 	}
 	slices.SortFunc(idents, func(a, b *extIdent) int {
 		return bytes.Compare(a[:], b[:])
@@ -244,7 +280,7 @@ func (ic *irCache) Encode(w io.Writer, a Artifact) (err error) {
 	}
 
 	func() {
-		i := IContext{ic, w}
+		i := IContext{ic, w, inputs}
 
 		defer panicToError(&err)
 		defer func() { i.ic, i.w = nil, nil }()

internal/pkg/ir_test.go

@@ -3,6 +3,7 @@ package pkg_test
 import (
 	"bytes"
 	"io"
+	"io/fs"
 	"reflect"
 	"testing"
 
@@ -38,7 +39,7 @@ func TestIRRoundtrip(t *testing.T) {
 		)},
 
 		{"exec offline", pkg.NewExec(
-			"exec-offline", nil, 0, false,
+			"exec-offline", "", nil, 0, false, false,
 			pkg.AbsWork,
 			[]string{"HAKUREI_TEST=1"},
 			check.MustAbs("/opt/bin/testtool"),
@@ -58,9 +59,9 @@ func TestIRRoundtrip(t *testing.T) {
 		)},
 
 		{"exec net", pkg.NewExec(
-			"exec-net",
+			"exec-net", "",
 			(*pkg.Checksum)(bytes.Repeat([]byte{0xfc}, len(pkg.Checksum{}))),
-			0, false,
+			0, false, false,
 			pkg.AbsWork,
 			[]string{"HAKUREI_TEST=1"},
 			check.MustAbs("/opt/bin/testtool"),
@@ -79,6 +80,28 @@ func TestIRRoundtrip(t *testing.T) {
 			)),
 		)},
 
+		{"exec measured", pkg.NewExec(
+			"exec-measured", "",
+			(*pkg.Checksum)(bytes.Repeat([]byte{0xfd}, len(pkg.Checksum{}))),
+			0, false, false,
+			pkg.AbsWork,
+			[]string{"HAKUREI_TEST=1"},
+			check.MustAbs("/opt/bin/testtool"),
+			[]string{"testtool", "measured"},
+
+			pkg.MustPath("/file", false, pkg.NewFile("file", []byte(
+				"stub file",
+			))), pkg.MustPath("/.hakurei", false, pkg.NewHTTPGetTar(
+				nil, "file:///hakurei.tar",
+				pkg.Checksum(bytes.Repeat([]byte{0xfd}, len(pkg.Checksum{}))),
+				pkg.TarUncompressed,
+			)), pkg.MustPath("/opt", false, pkg.NewHTTPGetTar(
+				nil, "file:///testtool.tar.gz",
+				pkg.Checksum(bytes.Repeat([]byte{0xfd}, len(pkg.Checksum{}))),
+				pkg.TarGzip,
+			)),
+		)},
+
 		{"file anonymous", pkg.NewFile("", []byte{0})},
 		{"file", pkg.NewFile("stub", []byte("stub"))},
 	}
@@ -105,9 +128,13 @@ func TestIRRoundtrip(t *testing.T) {
 				if err := <-done; err != nil {
 					t.Fatalf("EncodeAll: error = %v", err)
 				}
-			}, pkg.MustDecode(
+			}, expectsFS{
-				"E4vEZKhCcL2gPZ2Tt59FS3lDng-d_2SKa2i5G_RbDfwGn6EemptFaGLPUDiOa94C",
+				".":          {Mode: fs.ModeDir | 0700},
-			),
+				"checksum":   {Mode: fs.ModeDir | 0700},
+				"identifier": {Mode: fs.ModeDir | 0700},
+				"substitute": {Mode: fs.ModeDir | 0700},
+				"work":       {Mode: fs.ModeDir | 0700},
+			},
 		}
 	}
 	checkWithCache(t, testCasesCache)

internal/pkg/net_test.go

@@ -3,6 +3,7 @@ package pkg_test
 import (
 	"crypto/sha512"
 	"io"
+	"io/fs"
 	"net/http"
 	"reflect"
 	"testing"
@@ -85,7 +86,13 @@ func TestHTTPGet(t *testing.T) {
 			if _, err := f.Cure(r); !reflect.DeepEqual(err, wantErrNotFound) {
 				t.Fatalf("Cure: error = %#v, want %#v", err, wantErrNotFound)
 			}
-		}, pkg.MustDecode("E4vEZKhCcL2gPZ2Tt59FS3lDng-d_2SKa2i5G_RbDfwGn6EemptFaGLPUDiOa94C")},
+		}, expectsFS{
+			".":          {Mode: fs.ModeDir | 0700},
+			"checksum":   {Mode: fs.ModeDir | 0700},
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"substitute": {Mode: fs.ModeDir | 0700},
+			"work":       {Mode: fs.ModeDir | 0700},
+		}},
 
 		{"cure", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			r := newRContext(t, c)
@@ -144,6 +151,18 @@ func TestHTTPGet(t *testing.T) {
 			if _, _, err := c.Cure(f); !reflect.DeepEqual(err, wantErrNotFound) {
 				t.Fatalf("Pathname: error = %#v, want %#v", err, wantErrNotFound)
 			}
-		}, pkg.MustDecode("L_0RFHpr9JUS4Zp14rz2dESSRvfLzpvqsLhR1-YjQt8hYlmEdVl7vI3_-v8UNPKs")},
+		}, expectsFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU": {Mode: 0400, Data: []byte("\x7f\xe1\x69\xa2\xdd\x63\x96\x26\x83\x79\x61\x8b\xf0\x3f\xd5\x16\x9a\x39\x3a\xdb\xcf\xb1\xbc\x8d\x33\xff\x75\xee\x62\x56\xa9\xf0\x27\xac\x13\x94\x69")},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/oM-2pUlk-mOxK1t3aMWZer69UdOQlAXiAgMrpZ1476VoOqpYVP1aGFS9_HYy-D8_": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU")},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+
+			"work": {Mode: fs.ModeDir | 0700},
+		}},
 	})
 }

internal/pkg/pkg.go

@@ -4,6 +4,7 @@ package pkg
 import (
 	"bufio"
 	"bytes"
+	"cmp"
 	"context"
 	"crypto/sha512"
 	"encoding/base64"
@@ -15,6 +16,7 @@ import (
 	"io/fs"
 	"maps"
 	"os"
+	"os/signal"
 	"path/filepath"
 	"runtime"
 	"slices"
@@ -24,6 +26,7 @@ import (
 	"sync/atomic"
 	"syscall"
 	"testing"
+	"time"
 	"unique"
 	"unsafe"
 
@@ -247,7 +250,14 @@ func (t *TContext) destroy(errP *error) {
 			*errP = errors.Join(*errP, err)
 		}
 		if *errP != nil {
-			*errP = errors.Join(*errP, os.Remove(t.statusPath.String()))
+			*errP = errors.Join(*errP, os.Rename(
+				t.statusPath.String(), t.cache.base.Append(
+					dirFault,
+					t.ids+"."+strconv.FormatUint(uint64(
+						time.Now().UnixNano(),
+					), 10),
+				).String(),
+			))
 		}
 		t.status = nil
 	}
@@ -508,33 +518,34 @@ const (
 )
 
 const (
-	// fileLock is the file name appended to Cache.base for guaranteeing
+	// fileLock is the lock file for exclusive access to the cache directory.
-	// exclusive access to the cache directory.
 	fileLock = "lock"
-	// fileVariant is the file name appended to Cache.base holding the variant
+	// fileVariant is a file holding the variant identification string set by a
-	// identification string set by a prior call to [SetExtension].
+	// prior call to [SetExtension].
 	fileVariant = "variant"
 
-	// dirIdentifier is the directory name appended to Cache.base for storing
+	// dirSubstitute holds symlinks to artifacts by checksum, named after their
-	// artifacts named after their [ID].
+	// substitute identifier.
+	dirSubstitute = "substitute"
+	// dirIdentifier holds symlinks to artifacts by checksum,  named after their
+	// IR-based identifier.
 	dirIdentifier = "identifier"
-	// dirChecksum is the directory name appended to Cache.base for storing
+	// dirChecksum holds artifacts named after their [Checksum].
-	// artifacts named after their [Checksum].
 	dirChecksum = "checksum"
-	// dirStatus is the directory name appended to Cache.base for storing
+	// dirStatus holds artifact metadata and logs named after their IR-based
-	// artifact metadata and logs named after their [ID].
+	// identifier. For [FloodArtifact], the same file is also available under
+	// its substitute identifier.
 	dirStatus = "status"
+	// dirFault holds status files of faulted cures.
+	dirFault = "fault"
 
-	// dirWork is the directory name appended to Cache.base for working
+	// dirWork holds working pathnames set up during [Cache.Cure].
-	// pathnames set up during [Cache.Cure].
 	dirWork = "work"
-	// dirTemp is the directory name appended to Cache.base for scratch space
+	// dirTemp holds scratch space allocated during [Cache.Cure].
-	// pathnames allocated during [Cache.Cure].
 	dirTemp = "temp"
 
-	// dirExecScratch is the directory name appended to Cache.base for scratch
+	// dirExecScratch is scratch space set up for the container started by
-	// space setting up the container started by [Cache.EnterExec]. Exclusivity
+	// [Cache.EnterExec]. Exclusivity via Cache.inExec.
-	// via Cache.inExec.
 	dirExecScratch = "scratch"
 
 	// checksumLinknamePrefix is prepended to the encoded [Checksum] value
@@ -617,6 +628,13 @@ const (
 	// CPromoteVariant allows [pkg.Open] to promote an unextended on-disk cache
 	// to the current extension variant. This is a one-way operation.
 	CPromoteVariant
+
+	// CSuppressInit arranges for verbose output of the container init to be
+	// suppressed regardless of [message.Msg] state.
+	CSuppressInit
+
+	// CIgnoreSubstitutes disables content-based dependency substitution.
+	CIgnoreSubstitutes
 )
 
 // toplevel holds [context.WithCancel] over caller-supplied context, where all
@@ -672,6 +690,11 @@ type Cache struct {
 	// Synchronises access to dirChecksum.
 	checksumMu sync.RWMutex
 
+	// Presence of an alternative in the cache. Keys are not valid identifiers
+	// and must not be used as such.
+	substitute map[unique.Handle[ID]]unique.Handle[Checksum]
+	// Synchronises access to substitute and corresponding filesystem entries.
+	substituteMu sync.RWMutex
 	// Identifier to content pair cache.
 	ident map[unique.Handle[ID]]unique.Handle[Checksum]
 	// Identifier to error pair for unrecoverably faulted [Artifact].
@@ -882,11 +905,14 @@ func (c *Cache) Scrub(checks int) error {
 		checks = runtime.NumCPU()
 	}
 
+	c.substituteMu.Lock()
+	defer c.substituteMu.Unlock()
 	c.identMu.Lock()
 	defer c.identMu.Unlock()
 	c.checksumMu.Lock()
 	defer c.checksumMu.Unlock()
 
+	c.substitute = make(map[unique.Handle[ID]]unique.Handle[Checksum])
 	c.ident = make(map[unique.Handle[ID]]unique.Handle[Checksum])
 	c.identErr = make(map[unique.Handle[ID]]error)
 	c.artifact.Clear()
@@ -994,47 +1020,52 @@ func (c *Cache) Scrub(checks int) error {
 		wg.Wait()
 	}
 
-	dir = c.base.Append(dirIdentifier)
+	for _, suffix := range []string{
-	if entries, readdirErr := os.ReadDir(dir.String()); readdirErr != nil {
+		dirSubstitute,
-		addErr(dir, readdirErr)
+		dirIdentifier,
-	} else {
+	} {
-		wg.Add(len(entries))
+		dir = c.base.Append(suffix)
-		for _, ent := range entries {
+		if entries, readdirErr := os.ReadDir(dir.String()); readdirErr != nil {
-			w <- checkEntry{ent, func(ent os.DirEntry, want *Checksum) bool {
+			addErr(dir, readdirErr)
-				got := p.Get().(*Checksum)
+		} else {
-				defer p.Put(got)
+			wg.Add(len(entries))
+			for _, ent := range entries {
+				w <- checkEntry{ent, func(ent os.DirEntry, want *Checksum) bool {
+					got := p.Get().(*Checksum)
+					defer p.Put(got)
 
-				pathname := dir.Append(ent.Name())
+					pathname := dir.Append(ent.Name())
-				if linkname, err := os.Readlink(
+					if linkname, err := os.Readlink(
-					pathname.String(),
+						pathname.String(),
-				); err != nil {
+					); err != nil {
-					seMu.Lock()
+						seMu.Lock()
-					se.Errs[pathname.Handle()] = append(se.Errs[pathname.Handle()], err)
+						se.Errs[pathname.Handle()] = append(se.Errs[pathname.Handle()], err)
-					se.DanglingIdentifiers = append(se.DanglingIdentifiers, *want)
+						se.DanglingIdentifiers = append(se.DanglingIdentifiers, *want)
-					seMu.Unlock()
+						seMu.Unlock()
-					return false
+						return false
-				} else if err = Decode(got, filepath.Base(linkname)); err != nil {
+					} else if err = Decode(got, filepath.Base(linkname)); err != nil {
-					seMu.Lock()
+						seMu.Lock()
-					lnp := dir.Append(linkname)
+						lnp := dir.Append(linkname)
-					se.Errs[lnp.Handle()] = append(se.Errs[lnp.Handle()], err)
+						se.Errs[lnp.Handle()] = append(se.Errs[lnp.Handle()], err)
-					se.DanglingIdentifiers = append(se.DanglingIdentifiers, *want)
+						se.DanglingIdentifiers = append(se.DanglingIdentifiers, *want)
-					seMu.Unlock()
+						seMu.Unlock()
-					return false
+						return false
-				}
-
-				if _, err := os.Stat(pathname.String()); err != nil {
-					if !errors.Is(err, os.ErrNotExist) {
-						addErr(pathname, err)
 					}
-					seMu.Lock()
+
-					se.DanglingIdentifiers = append(se.DanglingIdentifiers, *want)
+					if _, err := os.Stat(pathname.String()); err != nil {
-					seMu.Unlock()
+						if !errors.Is(err, os.ErrNotExist) {
-					return false
+							addErr(pathname, err)
-				}
+						}
-				return true
+						seMu.Lock()
-			}}
+						se.DanglingIdentifiers = append(se.DanglingIdentifiers, *want)
+						seMu.Unlock()
+						return false
+					}
+					return true
+				}}
+			}
+			wg.Wait()
 		}
-		wg.Wait()
 	}
 
 	dir = c.base.Append(dirStatus)
@@ -1182,6 +1213,52 @@ func (c *Cache) finaliseIdent(
 	close(done)
 }
 
+// zeroChecksum is a zero [Checksum] handle, used for comparison only.
+var zeroChecksum unique.Handle[Checksum]
+
+// loadSubstitute returns a checksum corresponding to a substitute identifier,
+// or zeroChecksum if an alternative is not available.
+func (c *Cache) loadSubstitute(
+	substitute unique.Handle[ID],
+) (unique.Handle[Checksum], error) {
+	c.substituteMu.RLock()
+	if checksum, ok := c.substitute[substitute]; ok {
+		c.substituteMu.RUnlock()
+		return checksum, nil
+	}
+
+	linkname, err := os.Readlink(c.base.Append(
+		dirSubstitute,
+		Encode(substitute.Value()),
+	).String())
+	c.substituteMu.RUnlock()
+
+	if err != nil {
+		if !errors.Is(err, os.ErrNotExist) {
+			return zeroChecksum, err
+		}
+
+		c.substituteMu.Lock()
+		c.substitute[substitute] = zeroChecksum
+		c.substituteMu.Unlock()
+		return zeroChecksum, nil
+	}
+
+	var checksum unique.Handle[Checksum]
+	buf := c.getIdentBuf()
+	err = Decode((*Checksum)(buf[:]), filepath.Base(linkname))
+	if err == nil {
+		checksum = unique.Make(Checksum(buf[:]))
+
+		c.substituteMu.Lock()
+		c.substitute[substitute] = checksum
+		c.substituteMu.Unlock()
+	}
+	c.putIdentBuf(buf)
+
+	return checksum, err
+}
+
 // Done returns a channel that is closed when the ongoing cure of an [Artifact]
 // referred to by the specified identifier completes. Done may return nil if
 // no ongoing cure of the specified identifier exists.
@@ -1416,8 +1493,8 @@ func (c *Cache) Cure(a Artifact) (
 
 // CureError wraps a non-nil error returned attempting to cure an [Artifact].
 type CureError struct {
-	Ident unique.Handle[ID]
+	A   Artifact
-	Err   error
+	Err error
 }
 
 // Unwrap returns the underlying error.
@@ -1430,40 +1507,63 @@ func (e *CureError) Error() string { return e.Err.Error() }
 type DependencyCureError []*CureError
 
 // unwrapM recursively expands underlying errors into a caller-supplied map.
-func (e *DependencyCureError) unwrapM(me map[unique.Handle[ID]]*CureError) {
+func (e *DependencyCureError) unwrapM(
+	ctx context.Context,
+	ir *IRCache,
+	me map[unique.Handle[ID]]*CureError,
+) {
 	for _, err := range *e {
-		if _, ok := me[err.Ident]; ok {
+		if ctx.Err() != nil {
+			break
+		}
+
+		id := ir.Ident(err.A)
+		if _, ok := me[id]; ok {
 			continue
 		}
 		if _e, ok := err.Err.(*DependencyCureError); ok {
-			_e.unwrapM(me)
+			_e.unwrapM(ctx, ir, me)
 			continue
 		}
-		me[err.Ident] = err
+		me[id] = err
 	}
 }
 
 // unwrap recursively expands and deduplicates underlying errors.
-func (e *DependencyCureError) unwrap() DependencyCureError {
+func (e *DependencyCureError) unwrap(
+	ctx context.Context,
+	ir *IRCache,
+) DependencyCureError {
 	me := make(map[unique.Handle[ID]]*CureError)
-	e.unwrapM(me)
+	e.unwrapM(ctx, ir, me)
-	errs := slices.AppendSeq(
+	type ent struct {
-		make(DependencyCureError, 0, len(me)),
+		id  unique.Handle[ID]
-		maps.Values(me),
+		err *CureError
-	)
+	}
+	errs := make([]*ent, 0, len(me))
+	for id, err := range me {
+		errs = append(errs, &ent{id, err})
+	}
 
 	var identBuf [2]ID
-	slices.SortFunc(errs, func(a, b *CureError) int {
+	slices.SortFunc(errs, func(a, b *ent) int {
-		identBuf[0], identBuf[1] = a.Ident.Value(), b.Ident.Value()
+		identBuf[0], identBuf[1] = a.id.Value(), b.id.Value()
 		return slices.Compare(identBuf[0][:], identBuf[1][:])
 	})
 
-	return errs
+	_errs := make(DependencyCureError, len(errs))
+	for i, v := range errs {
+		_errs[i] = v.err
+	}
+	return _errs
 }
 
 // Unwrap returns a deduplicated slice of underlying errors.
 func (e *DependencyCureError) Unwrap() []error {
-	errs := e.unwrap()
+	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
+	defer cancel()
+
+	errs := e.unwrap(ctx, NewIR())
 	_errs := make([]error, len(errs))
 	for i, err := range errs {
 		_errs[i] = err
@@ -1473,14 +1573,23 @@ func (e *DependencyCureError) Unwrap() []error {
 
 // Error returns a user-facing multiline error message.
 func (e *DependencyCureError) Error() string {
-	errs := e.unwrap()
+	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
+	defer cancel()
+
+	ir := NewIR()
+	errs := e.unwrap(ctx, ir)
 	if len(errs) == 0 {
 		return "invalid dependency cure outcome"
 	}
 	var buf strings.Builder
 	buf.WriteString("errors curing dependencies:")
 	for _, err := range errs {
-		buf.WriteString("\n\t" + Encode(err.Ident.Value()) + ": " + err.Error())
+		buf.WriteString("\n\t" +
+			reportName(err.A, ir.Ident(err.A)) + ": " +
+			err.Error())
+	}
+	if ctx.Err() != nil {
+		buf.WriteString("\nerror resolution cancelled")
 	}
 	return buf.String()
 }
@@ -1650,16 +1759,44 @@ func (c *Cache) cure(a Artifact, curesExempt bool) (
 		return
 	}
 
-	var checksums string
+	var (
+		checksums   string
+		substitute  unique.Handle[ID]
+		alternative *check.Absolute
+	)
 	defer func() {
 		if err == nil && checksums != "" {
+			linkname := checksumLinknamePrefix + checksums
+
 			err = os.Symlink(
-				checksumLinknamePrefix+checksums,
+				linkname,
 				pathname.String(),
 			)
 			if err == nil {
 				err = zeroTimes(pathname.String())
 			}
+
+			if err == nil && alternative != nil {
+				c.substituteMu.Lock()
+				err = os.Symlink(
+					linkname,
+					alternative.String(),
+				)
+				if errors.Is(err, os.ErrExist) {
+					c.msg.Verbosef(
+						"creating alternative over %s for artifact %s",
+						Encode(substitute.Value()), ids,
+					)
+					err = nil
+				}
+				if err == nil {
+					err = zeroTimes(alternative.String())
+				}
+				if err == nil && checksum != zeroChecksum {
+					c.substitute[substitute] = checksum
+				}
+				c.substituteMu.Unlock()
+			}
 		}
 	}()
 
@@ -1856,11 +1993,64 @@ func (c *Cache) cure(a Artifact, curesExempt bool) (
 			f.deps[deps[i]] = p
 		}
 
+		sh := sha512.New384()
+		err = c.encode(sh, a, f.deps)
+		if err != nil {
+			return
+		}
+
+		buf := c.getIdentBuf()
+		sh.Sum(buf[wordSize:wordSize])
+		substitute = unique.Make(ID(buf[wordSize:]))
+		substitutes := Encode(substitute.Value())
+		c.putIdentBuf(buf)
+		alternative = c.base.Append(
+			dirSubstitute,
+			substitutes,
+		)
+
+		if c.flags&CIgnoreSubstitutes == 0 {
+			var substituteChecksum unique.Handle[Checksum]
+			substituteChecksum, err = c.loadSubstitute(substitute)
+			if err != nil {
+				return
+			}
+			if substituteChecksum != zeroChecksum {
+				checksum = substituteChecksum
+				checksums = Encode(checksum.Value())
+				checksumPathname = c.base.Append(
+					dirChecksum,
+					checksums,
+				)
+				if _, err = os.Lstat(c.base.Append(
+					dirStatus,
+					substitutes,
+				).String()); err == nil {
+					err = os.Symlink(substitutes, c.base.Append(
+						dirStatus,
+						ids,
+					).String())
+				} else if errors.Is(err, os.ErrNotExist) {
+					err = nil
+				}
+				return
+			}
+		}
+
 		defer f.destroy(&err)
 		if err = c.enterCure(a, curesExempt); err != nil {
 			return
 		}
 		err = ca.Cure(&f)
+		if err == nil && f.status != nil {
+			err = os.Link(c.base.Append(
+				dirStatus,
+				ids,
+			).String(), c.base.Append(
+				dirStatus,
+				substitutes,
+			).String())
+		}
 		c.exitCure(a, curesExempt)
 		if err != nil {
 			return
@@ -1953,7 +2143,7 @@ func (pending *pendingArtifactDep) cure(c *Cache) {
 	}
 
 	pending.errsMu.Lock()
-	*pending.errs = append(*pending.errs, &CureError{c.Ident(pending.a), err})
+	*pending.errs = append(*pending.errs, &CureError{pending.a, err})
 	pending.errsMu.Unlock()
 }
 
@@ -1969,6 +2159,52 @@ func (c *Cache) OpenStatus(a Artifact) (r io.ReadSeekCloser, err error) {
 	return
 }
 
+// Fault holds the pathname and termination time of an [Artifact] fault entry.
+type Fault struct {
+	*check.Absolute
+	t uint64
+}
+
+// Time returns the instant in time where the fault occurred.
+func (f Fault) Time() time.Time { return time.Unix(0, int64(f.t)) }
+
+// Open opens the underlying entry for reading.
+func (f Fault) Open() (io.ReadCloser, error) { return os.Open(f.Absolute.String()) }
+
+// Destroy removes the underlying fault entry.
+func (f Fault) Destroy() error { return os.Remove(f.Absolute.String()) }
+
+// ReadFaults returns fault entries for an [Artifact].
+func (c *Cache) ReadFaults(a Artifact) (faults []Fault, err error) {
+	prefix := Encode(c.Ident(a).Value()) + "."
+	var dents []os.DirEntry
+	if dents, err = os.ReadDir(c.base.Append(dirFault).String()); err != nil {
+		return
+	}
+
+	for _, dent := range dents {
+		name := dent.Name()
+		if !strings.HasPrefix(name, prefix) {
+			continue
+		}
+		var t uint64
+		t, err = strconv.ParseUint(name[len(prefix):], 10, 64)
+		if err != nil {
+			return
+		}
+
+		faults = append(faults, Fault{c.base.Append(
+			dirFault,
+			name,
+		), t})
+	}
+
+	slices.SortFunc(faults, func(a, b Fault) int {
+		return cmp.Compare(a.t, b.t)
+	})
+	return
+}
+
 // Abort cancels all pending cures and waits for them to clean up, but does not
 // close the cache.
 func (c *Cache) Abort() {
@@ -2068,9 +2304,11 @@ func open(
 	}
 
 	for _, name := range []string{
+		dirSubstitute,
 		dirIdentifier,
 		dirChecksum,
 		dirStatus,
+		dirFault,
 		dirWork,
 	} {
 		if err := os.MkdirAll(
@@ -2093,6 +2331,7 @@ func open(
 
 		irCache: zeroIRCache(),
 
+		substitute:   make(map[unique.Handle[ID]]unique.Handle[Checksum]),
 		ident:        make(map[unique.Handle[ID]]unique.Handle[Checksum]),
 		identErr:     make(map[unique.Handle[ID]]error),
 		identPending: make(map[unique.Handle[ID]]*pendingCure),

internal/pkg/pkg_test.go

@@ -16,9 +16,12 @@ import (
 	"path/filepath"
 	"reflect"
 	"strconv"
+	"strings"
 	"sync"
 	"syscall"
 	"testing"
+	"testing/fstest"
+	"time"
 	"unique"
 	"unsafe"
 
@@ -242,6 +245,41 @@ func newDestroyArtifactFunc(a pkg.Artifact) func(
 	}
 }
 
+// destroyStatus counts non-substitution status entries and destroys them.
+func destroyStatus(t *testing.T, base *check.Absolute, c, s int) {
+	dents, err := os.ReadDir(base.Append("status").String())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var gotC, gotS int
+	for _, dent := range dents {
+		if err = os.Remove(base.Append(
+			"status",
+			dent.Name(),
+		).String()); err != nil {
+			t.Fatal(err)
+		}
+
+		if dent.Type().IsRegular() {
+			gotC++
+			continue
+		}
+		if dent.Type()&fs.ModeSymlink == fs.ModeSymlink {
+			gotS++
+			continue
+		}
+		t.Errorf("%s: %s", dent.Name(), dent.Type())
+	}
+
+	if gotC != c {
+		t.Errorf("status: c = %d, want %d", gotC, c)
+	}
+	if gotS != s {
+		t.Errorf("status: s = %d, want %d", gotS, s)
+	}
+}
+
 func TestIdent(t *testing.T) {
 	t.Parallel()
 
@@ -286,6 +324,99 @@ func TestIdent(t *testing.T) {
 	}
 }
 
+// An expectsKnown describes an expected file or directory.
+type expectsKnown interface {
+	// hash returns the checksum of the represented data.
+	hash() (checksum pkg.Checksum)
+}
+
+// An expectsChecksum is a prepared checksum value.
+type expectsChecksum pkg.Checksum
+
+// hash returns e.
+func (e expectsChecksum) hash() pkg.Checksum { return e }
+
+// An expectsFile is the contents of a file expected by the test suite.
+type expectsFile []byte
+
+// hash computes the checksum of e.
+func (e expectsFile) hash() (checksum pkg.Checksum) {
+	h := sha512.New384()
+	h.Write(e)
+	h.Sum(checksum[:0])
+	return
+}
+
+// An expectsFS describes the state of a filesystem expected by the test suite.
+type expectsFS fstest.MapFS
+
+// hash computes the checksum of e.
+func (e expectsFS) hash() (checksum pkg.Checksum) {
+	if err := pkg.HashFS(&checksum, fstest.MapFS(e), "."); err != nil {
+		panic(err)
+	}
+	return
+}
+
+// expectsFrom generates expectsFS for a filesystem directory.
+func expectsFrom(pathname string) string {
+	var buf strings.Builder
+	buf.WriteString("expectsFS{\n")
+	if err := filepath.WalkDir(pathname, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		var rel string
+		if rel, err = filepath.Rel(pathname, path); err != nil {
+			return err
+		}
+		buf.WriteString("\t" + strconv.Quote(rel) + ": {Mode: ")
+
+		var fi fs.FileInfo
+		if fi, err = d.Info(); err != nil {
+			return err
+		}
+		mode := fi.Mode()
+
+		switch {
+		case mode.IsDir():
+			buf.WriteString("fs.ModeDir | 0" +
+				strconv.FormatInt(int64(mode&^fs.ModeDir), 8))
+
+		case mode&fs.ModeSymlink != 0:
+			buf.WriteString("fs.ModeSymlink | 0" +
+				strconv.FormatInt(int64(mode&^fs.ModeSymlink), 8) +
+				", Data: []byte(")
+			var linkname string
+			if linkname, err = os.Readlink(path); err != nil {
+				return err
+			}
+			buf.WriteString(strconv.Quote(linkname))
+			buf.WriteByte(')')
+
+		case mode.IsRegular():
+			buf.WriteString("0" + strconv.FormatInt(int64(mode), 8))
+			var p []byte
+			if p, err = os.ReadFile(path); err != nil {
+				return err
+			}
+
+			if len(p) > 0 {
+				buf.WriteString(", Data: []byte(")
+				buf.WriteString(strconv.Quote(unsafe.String(unsafe.SliceData(p), len(p))))
+				buf.WriteByte(')')
+			}
+		}
+		buf.WriteString("},\n")
+		return nil
+	}); err != nil {
+		panic(err)
+	}
+	buf.WriteString("}")
+	return buf.String()
+}
+
 // cacheTestCase is a test case passed to checkWithCache where a new instance
 // of [pkg.Cache] is prepared for the test case, and is validated and removed
 // on test completion.
@@ -294,9 +425,15 @@ type cacheTestCase struct {
 	flags int
 	early func(t *testing.T, base *check.Absolute)
 	f     func(t *testing.T, base *check.Absolute, c *pkg.Cache)
-	want  pkg.Checksum
+	want  expectsFS
 }
 
+const (
+	// checkDestroySubstitutes arranges for substitutes to be destroyed before
+	// measurement during checkWithCache.
+	checkDestroySubstitutes = 1 << (iota + 32)
+)
+
 // checkWithCache runs a slice of cacheTestCase.
 func checkWithCache(t *testing.T, testCases []cacheTestCase) {
 	t.Helper()
@@ -328,7 +465,7 @@ func checkWithCache(t *testing.T, testCases []cacheTestCase) {
 			msg := message.New(log.New(os.Stderr, "cache: ", 0))
 			msg.SwapVerbose(testing.Verbose())
 
-			flags := tc.flags
+			flags := tc.flags | pkg.CSuppressInit
 
 			if info.CanDegrade {
 				if _, err := landlock.GetABI(); err != nil {
@@ -377,19 +514,34 @@ func checkWithCache(t *testing.T, testCases []cacheTestCase) {
 				}
 			}
 
-			// destroy non-deterministic status files
+			// destroy non-deterministic substitutes
-			if err := os.RemoveAll(base.Append("status").String()); err != nil {
+			if tc.flags&checkDestroySubstitutes != 0 {
+				substitute := base.Append("substitute")
+				if err := os.RemoveAll(substitute.String()); err != nil {
+					t.Fatal(err)
+				} else if err = os.Mkdir(substitute.String(), 0700); err != nil {
+					t.Fatal(err)
+				}
+			}
+
+			// destroy empty status directory
+			if err := syscall.Rmdir(base.Append("status").String()); err != nil {
+				t.Error(expectsFrom(base.Append("status").String()))
 				t.Fatal(err)
 			}
 
+			// destroy empty fault directory
+			if err := os.Remove(base.Append("fault").String()); err != nil {
+				t.Fatal(err)
+			}
+
+			want := tc.want.hash()
+
 			var checksum pkg.Checksum
 			if err := pkg.HashDir(&checksum, base); err != nil {
 				t.Fatalf("HashDir: error = %v", err)
-			} else if checksum != tc.want {
+			} else if checksum != want {
-				t.Fatalf("HashDir: %v", &pkg.ChecksumMismatchError{
+				t.Fatal(expectsFrom(base.String()))
-					Got:  checksum,
-					Want: tc.want,
-				})
 			}
 
 			if err := scrubFunc(); err != nil {
@@ -408,10 +560,10 @@ func checkWithCache(t *testing.T, testCases []cacheTestCase) {
 			// validate again to make sure scrub did not condemn anything
 			if err := pkg.HashDir(&checksum, base); err != nil {
 				t.Fatalf("HashDir: error = %v", err)
-			} else if checksum != tc.want {
+			} else if checksum != want {
 				t.Fatalf("(scrubbed) HashDir: %v", &pkg.ChecksumMismatchError{
 					Got:  checksum,
-					Want: tc.want,
+					Want: want,
 				})
 			}
 		})
@@ -425,7 +577,7 @@ type cureStep struct {
 	a pkg.Artifact
 
 	pathname *check.Absolute
-	checksum pkg.Checksum
+	output   expectsKnown
 	err      error
 }
 
@@ -446,17 +598,34 @@ func cureMany(t *testing.T, c *pkg.Cache, steps []cureStep) {
 	for _, step := range steps {
 		t.Log("cure step:", step.name)
 		if pathname, checksum, err := c.Cure(step.a); !reflect.DeepEqual(err, step.err) {
+			faults, _err := c.ReadFaults(step.a)
+			if _err != nil {
+				t.Errorf("ReadFaults: error = %v", _err)
+			}
+
+			var p []byte
+			for _, fault := range faults {
+				p, _err = os.ReadFile(fault.String())
+				if _err != nil {
+					t.Error(_err)
+					continue
+				}
+				t.Log(string(p))
+				t.Logf("faulting cure terminated %s ago", time.Since(faults[0].Time()))
+			}
 			t.Fatalf("Cure: error = %v, want %v", err, step.err)
 		} else if step.pathname != ignorePathname && !pathname.Is(step.pathname) {
 			t.Fatalf("Cure: pathname = %q, want %q", pathname, step.pathname)
-		} else if checksum != makeChecksumH(step.checksum) {
+		} else if step.output == nil || checksum != makeChecksumH(step.output.hash()) {
-			if checksum == (unique.Handle[pkg.Checksum]{}) {
+			if pathname != nil {
-				checksum = unique.Make(pkg.Checksum{})
+				if name, _err := filepath.EvalSymlinks(pathname.String()); _err != nil {
+					t.Fatal(_err)
+				} else {
+					t.Fatal(expectsFrom(name))
+				}
+			} else if checksum != (unique.Handle[pkg.Checksum]{}) {
+				t.Fatalf("Cure: unexpected checksum %s", pkg.Encode(checksum.Value()))
 			}
-			t.Fatalf(
-				"Cure: checksum = %s, want %s",
-				pkg.Encode(checksum.Value()), pkg.Encode(step.checksum),
-			)
 		} else {
 			v := any(err)
 			if err == nil {
@@ -517,18 +686,12 @@ func newWantScrubError(base *check.Absolute) *pkg.ScrubError {
 func TestCache(t *testing.T) {
 	t.Parallel()
 
-	const testdata = "" +
+	testdata := expectsFile("" +
 		"\x00\x00\x00\x00" +
 		"\xad\x0b\x00" +
 		"\x04" +
 		"\xfe\xfe\x00\x00" +
-		"\xfe\xca\x00\x00"
+		"\xfe\xca\x00\x00")
-
-	testdataChecksum := func() pkg.Checksum {
-		h := sha512.New384()
-		h.Write([]byte(testdata))
-		return (pkg.Checksum)(h.Sum(nil))
-	}()
 
 	testCases := []cacheTestCase{
 		{"file", pkg.CValidateKnown | pkg.CAssumeChecksum, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
@@ -546,36 +709,45 @@ func TestCache(t *testing.T) {
 				"identifier",
 				"cafebabecafebabecafebabecafebabecafebabecafebabecafebabecafebabe",
 			)
+			failingFile := newStubFile(
+				pkg.KindHTTPGet,
+				pkg.ID{0xff, 3},
+				nil,
+				nil, struct {
+					_ []byte
+					stub.UniqueError
+				}{UniqueError: 0xbad},
+			)
 
 			cureMany(t, c, []cureStep{
 				{"initial file", newStubFile(
 					pkg.KindHTTPGet,
 					identifier,
-					&testdataChecksum,
+					new(testdata.hash()),
-					[]byte(testdata), nil,
+					testdata, nil,
-				), wantPathname, testdataChecksum, nil},
+				), wantPathname, testdata, nil},
 
 				{"identical content", newStubFile(
 					pkg.KindHTTPGet,
 					identifier0,
-					&testdataChecksum,
+					new(testdata.hash()),
-					[]byte(testdata), nil,
+					testdata, nil,
-				), wantPathname0, testdataChecksum, nil},
+				), wantPathname0, testdata, nil},
 
 				{"existing entry", newStubFile(
 					pkg.KindHTTPGet,
 					identifier,
-					&testdataChecksum,
+					new(testdata.hash()),
-					[]byte(testdata), nil,
+					testdata, nil,
-				), wantPathname, testdataChecksum, nil},
+				), wantPathname, testdata, nil},
 
 				{"checksum mismatch", newStubFile(
 					pkg.KindHTTPGet,
 					pkg.ID{0xff, 0},
 					new(pkg.Checksum),
-					[]byte(testdata), nil,
+					testdata, nil,
-				), nil, pkg.Checksum{}, &pkg.ChecksumMismatchError{
+				), nil, nil, &pkg.ChecksumMismatchError{
-					Got: testdataChecksum,
+					Got: testdata.hash(),
 				}},
 
 				{"store without validation", newStubFile(
@@ -586,7 +758,7 @@ func TestCache(t *testing.T) {
 				), base.Append(
 					"identifier",
 					"vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX",
-				), pkg.Checksum{
+				), expectsChecksum{
 					0xbe, 0xc0, 0x21, 0xb4, 0xf3, 0x68,
 					0xe3, 0x06, 0x91, 0x34, 0xe0, 0x12,
 					0xc2, 0xb4, 0x30, 0x70, 0x83, 0xd3,
@@ -600,7 +772,7 @@ func TestCache(t *testing.T) {
 				{"incomplete implementation", struct{ pkg.Artifact }{&stubArtifact{
 					kind:   pkg.KindExec,
 					params: []byte("artifact overridden to be incomplete"),
-				}}, nil, pkg.Checksum{}, pkg.InvalidArtifactError(pkg.MustDecode(
+				}}, nil, nil, pkg.InvalidArtifactError(pkg.MustDecode(
 					"E__uZ1sLIvb84vzSm5Uezb03RogsiaeTt1nfIVv8TKnnf4LqwtSi-smdHhlkZrUJ",
 				))},
 
@@ -609,40 +781,32 @@ func TestCache(t *testing.T) {
 					pkg.ID{0xff, 1},
 					nil,
 					nil, stub.UniqueError(0xcafe),
-				), nil, pkg.Checksum{}, stub.UniqueError(0xcafe)},
+				), nil, nil, stub.UniqueError(0xcafe)},
 
 				{"error caching", newStubFile(
 					pkg.KindHTTPGet,
 					pkg.ID{0xff, 1},
 					nil,
 					nil, nil,
-				), nil, pkg.Checksum{}, stub.UniqueError(0xcafe)},
+				), nil, nil, stub.UniqueError(0xcafe)},
 
-				{"cache hit bad type", overrideChecksum{testdataChecksum, overrideIdent{pkg.ID{0xff, 2}, &stubArtifact{
+				{"cache hit bad type", overrideChecksum{testdata.hash(), overrideIdent{pkg.ID{0xff, 2}, &stubArtifact{
 					kind: pkg.KindTar,
-				}}}, nil, pkg.Checksum{}, pkg.InvalidFileModeError(
+				}}}, nil, nil, pkg.InvalidFileModeError(
 					0400,
 				)},
 
 				{"noncomparable error", &stubArtifactF{
 					kind:   pkg.KindExec,
 					params: []byte("artifact with dependency returning noncomparable error"),
-					deps: []pkg.Artifact{newStubFile(
+					deps:   []pkg.Artifact{failingFile},
-						pkg.KindHTTPGet,
-						pkg.ID{0xff, 3},
-						nil,
-						nil, struct {
-							_ []byte
-							stub.UniqueError
-						}{UniqueError: 0xbad},
-					)},
 
 					cure: func(f *pkg.FContext) error {
 						panic("attempting to cure impossible artifact")
 					},
-				}, nil, pkg.Checksum{}, &pkg.DependencyCureError{
+				}, nil, nil, &pkg.DependencyCureError{
 					{
-						Ident: unique.Make(pkg.ID{0xff, 3}),
+						A: failingFile,
 						Err: struct {
 							_ []byte
 							stub.UniqueError
@@ -662,18 +826,18 @@ func TestCache(t *testing.T) {
 				cureMany(t, c0, []cureStep{
 					{"cache hit ident", overrideIdent{
 						id: identifier,
-					}, wantPathname, testdataChecksum, nil},
+					}, wantPathname, testdata, nil},
 
 					{"cache miss checksum match", newStubFile(
 						pkg.KindHTTPGet,
-						testdataChecksum,
+						testdata.hash(),
 						nil,
-						[]byte(testdata),
+						testdata,
 						nil,
 					), base.Append(
 						"identifier",
-						pkg.Encode(testdataChecksum),
+						pkg.Encode(testdata.hash()),
-					), testdataChecksum, nil},
+					), testdata, nil},
 				})
 
 				// cure after close
@@ -686,7 +850,23 @@ func TestCache(t *testing.T) {
 					t.Fatalf("(closed) Cure: error = %v", err)
 				}
 			}
-		}, pkg.MustDecode("St9rlE-mGZ5gXwiv_hzQ_B8bZP-UUvSNmf4nHUZzCMOumb6hKnheZSe0dmnuc4Q2")},
+		}, expectsFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX": {Mode: 0400, Data: []byte{0}},
+			"checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq": {Mode: 0400, Data: []byte{0, 0, 0, 0, 0xad, 0xb, 0, 4, 0xfe, 0xfe, 0, 0, 0xfe, 0xca, 0, 0}},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
+			"identifier/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
+			"identifier/cafebabecafebabecafebabecafebabecafebabecafebabecafebabecafebabe": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
+			"identifier/deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/0bSFPu5Tnd-2Jj0Mv6co23PW2t3BmHc7eLFj9TgY3eIBg8zislo7xZYNBqovVLcq")},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+
+			"work": {Mode: fs.ModeDir | 0700},
+		}},
 
 		{"directory", pkg.CAssumeChecksum, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			id := pkg.MustDecode(
@@ -721,9 +901,16 @@ func TestCache(t *testing.T) {
 					).String(),
 				)
 			}
-			wantChecksum := pkg.MustDecode(
+			want := expectsFS{
-				"qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b",
+				".": {Mode: fs.ModeDir | 0500},
-			)
+
+				"check": {Mode: 0400, Data: []byte{0, 0}},
+
+				"lib":            {Mode: fs.ModeDir | 0700},
+				"lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
+
+				"lib/pkgconfig": {Mode: fs.ModeDir | 0700},
+			}
 			wantPathname := base.Append(
 				"identifier",
 				pkg.Encode(id),
@@ -777,33 +964,33 @@ func TestCache(t *testing.T) {
 			}
 
 			cureMany(t, c, []cureStep{
-				{"initial directory", overrideChecksum{wantChecksum, overrideIdent{id, &stubArtifact{
+				{"initial directory", overrideChecksum{want.hash(), overrideIdent{id, &stubArtifact{
 					kind: pkg.KindTar,
 					cure: makeSample,
-				}}}, wantPathname, wantChecksum, nil},
+				}}}, wantPathname, want, nil},
 
-				{"identical identifier", overrideChecksum{wantChecksum, overrideIdent{id, &stubArtifact{
+				{"identical identifier", overrideChecksum{want.hash(), overrideIdent{id, &stubArtifact{
 					kind: pkg.KindTar,
-				}}}, wantPathname, wantChecksum, nil},
+				}}}, wantPathname, want, nil},
 
 				{"identical checksum", overrideIdent{id0, &stubArtifact{
 					kind: pkg.KindTar,
 					cure: makeSample,
-				}}, wantPathname0, wantChecksum, nil},
+				}}, wantPathname0, want, nil},
 
 				{"cure fault", overrideIdent{pkg.ID{0xff, 0}, &stubArtifact{
 					kind: pkg.KindTar,
 					cure: func(t *pkg.TContext) error {
 						return makeGarbage(t.GetWorkDir(), stub.UniqueError(0xcafe))
 					},
-				}}, nil, pkg.Checksum{}, stub.UniqueError(0xcafe)},
+				}}, nil, nil, stub.UniqueError(0xcafe)},
 
 				{"checksum mismatch", overrideChecksum{pkg.Checksum{}, overrideIdent{pkg.ID{0xff, 1}, &stubArtifact{
 					kind: pkg.KindTar,
 					cure: func(t *pkg.TContext) error {
 						return makeGarbage(t.GetWorkDir(), nil)
 					},
-				}}}, nil, pkg.Checksum{}, &pkg.ChecksumMismatchError{
+				}}}, nil, nil, &pkg.ChecksumMismatchError{
 					Got: pkg.MustDecode(
 						"CUx-3hSbTWPsbMfDhgalG4Ni_GmR9TnVX8F99tY_P5GtkYvczg9RrF5zO0jX9XYT",
 					),
@@ -812,27 +999,27 @@ func TestCache(t *testing.T) {
 				{"cache hit bad type", newStubFile(
 					pkg.KindHTTPGet,
 					pkg.ID{0xff, 2},
-					&wantChecksum,
+					new(want.hash()),
-					[]byte(testdata), nil,
+					testdata, nil,
-				), nil, pkg.Checksum{}, pkg.InvalidFileModeError(
+				), nil, nil, pkg.InvalidFileModeError(
 					fs.ModeDir | 0500,
 				)},
 
 				{"openFile directory", overrideIdent{pkg.ID{0xff, 3}, &stubArtifact{
 					kind: pkg.KindTar,
 					cure: func(t *pkg.TContext) error {
-						r, err := t.Open(overrideChecksumFile{checksum: wantChecksum})
+						r, err := t.Open(overrideChecksumFile{checksum: want.hash()})
 						if err != nil {
 							panic(err)
 						}
 						_, err = io.ReadAll(r)
 						return err
 					},
-				}}, nil, pkg.Checksum{}, &os.PathError{
+				}}, nil, nil, &os.PathError{
 					Op: "read",
 					Path: base.Append(
 						"checksum",
-						pkg.Encode(wantChecksum),
+						pkg.Encode(want.hash()),
 					).String(),
 					Err: syscall.EISDIR,
 				}},
@@ -842,14 +1029,14 @@ func TestCache(t *testing.T) {
 					cure: func(t *pkg.TContext) error {
 						return nil
 					},
-				}}, nil, pkg.Checksum{}, pkg.NoOutputError{}},
+				}}, nil, nil, pkg.NoOutputError{}},
 
 				{"file output", overrideIdent{pkg.ID{0xff, 5}, &stubArtifact{
 					kind: pkg.KindTar,
 					cure: func(t *pkg.TContext) error {
 						return os.WriteFile(t.GetWorkDir().String(), []byte{0}, 0400)
 					},
-				}}, nil, pkg.Checksum{}, errors.New("non-file artifact produced regular file")},
+				}}, nil, nil, errors.New("non-file artifact produced regular file")},
 
 				{"symlink output", overrideIdent{pkg.ID{0xff, 6}, &stubArtifact{
 					kind: pkg.KindTar,
@@ -859,11 +1046,111 @@ func TestCache(t *testing.T) {
 							t.GetWorkDir().String(),
 						)
 					},
-				}}, nil, pkg.Checksum{}, pkg.InvalidFileModeError(
+				}}, nil, nil, pkg.InvalidFileModeError(
 					fs.ModeSymlink | 0777,
 				)},
+
+				{"alternative", &stubArtifactF{
+					kind:   pkg.KindExec,
+					params: []byte("substitutable artifact"),
+					deps: []pkg.Artifact{newStubFile(
+						pkg.KindHTTPGet,
+						pkg.ID{0xff, 8},
+						nil,
+						[]byte("substitutable dependency"),
+						nil,
+					)},
+
+					cure: func(f *pkg.FContext) error {
+						return makeSample(&f.TContext)
+					},
+				}, base.Append(
+					"identifier",
+					"xMDWovje7OfyIaDy_2VnjpKxRqSOQ_LoeD946t-3WsS2V2SeMJ7nDGrNfpa4Pbc-",
+				), want, nil},
+
+				{"substitutable", &stubArtifactF{
+					kind:   pkg.KindExec,
+					params: []byte("substitutable artifact"),
+					deps: []pkg.Artifact{newStubFile(
+						pkg.KindHTTPGet,
+						pkg.ID{0xff, 10},
+						nil,
+						[]byte("substitutable dependency"),
+						nil,
+					)},
+
+					cure: func(f *pkg.FContext) error {
+						panic("substitution missed")
+					},
+				}, base.Append(
+					"identifier",
+					"k2ilgG5KQ9NXnMoT2oB6NdwOnSPRn_H24oXQc4l6qOYIxIG9XfuEczeyrR8UEv_f",
+				), want, nil},
 			})
-		}, pkg.MustDecode("WVpvsVqVKg9Nsh744x57h51AuWUoUR2nnh8Md-EYBQpk6ziyTuUn6PLtF2e0Eu_d")},
+
+			if c0, err := unsafeOpen(
+				t.Context(),
+				message.New(nil),
+				0, 0, 0, base, false,
+			); err != nil {
+				t.Fatalf("open: error = %v", err)
+			} else {
+				t.Cleanup(c.Close)
+				cureMany(t, c0, []cureStep{
+					{"substitutable", &stubArtifactF{
+						kind:   pkg.KindExec,
+						params: []byte("substitutable artifact"),
+						deps: []pkg.Artifact{newStubFile(
+							pkg.KindHTTPGet,
+							pkg.ID{0xff, 0xff, 0xfd, 0xfd},
+							nil,
+							[]byte("substitutable dependency"),
+							nil,
+						)},
+
+						cure: func(f *pkg.FContext) error {
+							panic("substitution missed")
+						},
+					}, base.Append(
+						"identifier",
+						"_EmV5nsYZ2UWHgRmLDMU8i-rJWDx-kv5_1pFrzQI7vMMCM5mAXivO8UZtVfOqMR_",
+					), want, nil},
+				})
+			}
+
+			if dents, err := os.ReadDir(base.Append("status").String()); err != nil {
+				t.Fatal(err)
+			} else if len(dents) > 0 {
+				t.Errorf("ReadDir: %v", dents)
+			}
+
+		}, expectsFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/7lfQ4QwSpV8nw7IDh0JiQ_jqUPrPv3_Vfie034RxsSy-cy4vO8DVvxgpx2LW08oO":                {Mode: 0400, Data: []byte("substitutable dependency")},
+			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b":                {Mode: fs.ModeDir | 0500},
+			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/check":          {Mode: 0400, Data: []byte{0, 0}},
+			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib":            {Mode: fs.ModeDir | 0700},
+			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib/pkgconfig":  {Mode: fs.ModeDir | 0700},
+			"checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b/lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
+			"identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
+			"identifier/_EmV5nsYZ2UWHgRmLDMU8i-rJWDx-kv5_1pFrzQI7vMMCM5mAXivO8UZtVfOqMR_": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
+			"identifier/___9_QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/7lfQ4QwSpV8nw7IDh0JiQ_jqUPrPv3_Vfie034RxsSy-cy4vO8DVvxgpx2LW08oO")},
+			"identifier/_wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/7lfQ4QwSpV8nw7IDh0JiQ_jqUPrPv3_Vfie034RxsSy-cy4vO8DVvxgpx2LW08oO")},
+			"identifier/_woAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/7lfQ4QwSpV8nw7IDh0JiQ_jqUPrPv3_Vfie034RxsSy-cy4vO8DVvxgpx2LW08oO")},
+			"identifier/k2ilgG5KQ9NXnMoT2oB6NdwOnSPRn_H24oXQc4l6qOYIxIG9XfuEczeyrR8UEv_f": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
+			"identifier/xMDWovje7OfyIaDy_2VnjpKxRqSOQ_LoeD946t-3WsS2V2SeMJ7nDGrNfpa4Pbc-": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+			"substitute/OyBGorh72Z9kVw35JUa8FbqDbpR4DqT-MX1jic0uKN5PdYmUBiAF38BRsIRnBigf": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/qRN6in76LndiiOZJheHkwyW8UT1N5-f-bXvHfDvwrMw2fSkOoZdh8pWE1qhLk65b")},
+
+			"work": {Mode: fs.ModeDir | 0700},
+		}},
 
 		{"pending", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			wantErr := stub.UniqueError(0xcafe)
@@ -899,7 +1186,7 @@ func TestCache(t *testing.T) {
 					pkg.ID{0xff, 1},
 					nil,
 					nil, stub.UniqueError(0xbad),
-				), nil, pkg.Checksum{}, stub.UniqueError(0xbad)},
+				), nil, nil, stub.UniqueError(0xbad)},
 
 				{"file output", overrideIdent{pkg.ID{0xff, 2}, &stubArtifact{
 					kind: pkg.KindTar,
@@ -910,7 +1197,7 @@ func TestCache(t *testing.T) {
 							0400,
 						)
 					},
-				}}, nil, pkg.Checksum{}, errors.New(
+				}}, nil, nil, errors.New(
 					"non-file artifact produced regular file",
 				)},
 			})
@@ -932,7 +1219,13 @@ func TestCache(t *testing.T) {
 			for c.Done(unique.Make(pkg.ID{0xff})) != nil {
 			}
 			<-wCureDone
-		}, pkg.MustDecode("E4vEZKhCcL2gPZ2Tt59FS3lDng-d_2SKa2i5G_RbDfwGn6EemptFaGLPUDiOa94C")},
+		}, expectsFS{
+			".":          {Mode: fs.ModeDir | 0700},
+			"checksum":   {Mode: fs.ModeDir | 0700},
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"substitute": {Mode: fs.ModeDir | 0700},
+			"work":       {Mode: fs.ModeDir | 0700},
+		}},
 
 		{"cancel abort block", pkg.CValidateKnown, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			var wg sync.WaitGroup
@@ -985,7 +1278,13 @@ func TestCache(t *testing.T) {
 
 			c.Close()
 			c.Abort()
-		}, pkg.MustDecode("E4vEZKhCcL2gPZ2Tt59FS3lDng-d_2SKa2i5G_RbDfwGn6EemptFaGLPUDiOa94C")},
+		}, expectsFS{
+			".":          {Mode: fs.ModeDir | 0700},
+			"checksum":   {Mode: fs.ModeDir | 0700},
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"substitute": {Mode: fs.ModeDir | 0700},
+			"work":       {Mode: fs.ModeDir | 0700},
+		}},
 
 		{"no assume checksum", 0, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			makeGarbage := func(work *check.Absolute, wantErr error) error {
@@ -1002,10 +1301,12 @@ func TestCache(t *testing.T) {
 				return wantErr
 			}
 
-			wantChecksum := pkg.MustDecode("Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M")
+			want := expectsChecksum(pkg.MustDecode(
+				"Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M",
+			))
 
 			cureMany(t, c, []cureStep{
-				{"create", overrideChecksum{wantChecksum, overrideIdent{pkg.ID{0xff, 0}, &stubArtifact{
+				{"create", overrideChecksum{want.hash(), overrideIdent{pkg.ID{0xff, 0}, &stubArtifact{
 					kind: pkg.KindTar,
 					cure: func(t *pkg.TContext) error {
 						return makeGarbage(t.GetWorkDir(), nil)
@@ -1013,16 +1314,16 @@ func TestCache(t *testing.T) {
 				}}}, base.Append(
 					"identifier",
 					pkg.Encode(pkg.ID{0xff, 0}),
-				), wantChecksum, nil},
+				), want, nil},
 
-				{"reject", overrideChecksum{wantChecksum, overrideIdent{pkg.ID{0xfe, 1}, &stubArtifact{
+				{"reject", overrideChecksum{want.hash(), overrideIdent{pkg.ID{0xfe, 1}, &stubArtifact{
 					kind: pkg.KindTar,
 					cure: func(t *pkg.TContext) error {
 						return makeGarbage(t.GetWorkDir(), stub.UniqueError(0xbad))
 					},
-				}}}, nil, pkg.Checksum{}, stub.UniqueError(0xbad)},
+				}}}, nil, nil, stub.UniqueError(0xbad)},
 
-				{"match", overrideChecksum{wantChecksum, overrideIdent{pkg.ID{0xff, 1}, &stubArtifact{
+				{"match", overrideChecksum{want.hash(), overrideIdent{pkg.ID{0xff, 1}, &stubArtifact{
 					kind: pkg.KindTar,
 					cure: func(t *pkg.TContext) error {
 						return makeGarbage(t.GetWorkDir(), nil)
@@ -1030,9 +1331,23 @@ func TestCache(t *testing.T) {
 				}}}, base.Append(
 					"identifier",
 					pkg.Encode(pkg.ID{0xff, 1}),
-				), wantChecksum, nil},
+				), want, nil},
 			})
-		}, pkg.MustDecode("OC290t23aimNo2Rp2pPwan5GI2KRLRdOwYxXQMD9jw0QROgHnNXWodoWdV0hwu2w")},
+		}, expectsFS{
+			".": {Mode: fs.ModeDir | 0700},
+
+			"checksum": {Mode: fs.ModeDir | 0700},
+			"checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M":       {Mode: fs.ModeDir | 0500},
+			"checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M/check": {Mode: 0400, Data: []byte{}},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/_wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M")},
+			"identifier/_wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/Aubi5EG4_Y8DhL9bQ3Q4HFBhLRF7X5gt9D3CNCQfT-TeBtlRXc7Zi_JYZEMoCC7M")},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+
+			"work": {Mode: fs.ModeDir | 0700},
+		}},
 
 		{"scrub", 0, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			cureMany(t, c, []cureStep{
@@ -1044,7 +1359,7 @@ func TestCache(t *testing.T) {
 				), base.Append(
 					"identifier",
 					pkg.Encode(pkg.Checksum{0xfe, 0}),
-				), pkg.Checksum{0xff, 0}, nil},
+				), expectsChecksum{0xff, 0}, nil},
 			})
 
 			for _, p := range [][]string{
@@ -1077,7 +1392,13 @@ func TestCache(t *testing.T) {
 			if err := c.Scrub(1 << 6); !reflect.DeepEqual(err, wantErr) {
 				t.Fatalf("Scrub: error =\n%s\nwant\n%s", err, wantErr)
 			}
-		}, pkg.MustDecode("E4vEZKhCcL2gPZ2Tt59FS3lDng-d_2SKa2i5G_RbDfwGn6EemptFaGLPUDiOa94C")},
+		}, expectsFS{
+			".":          {Mode: fs.ModeDir | 0700},
+			"checksum":   {Mode: fs.ModeDir | 0700},
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"substitute": {Mode: fs.ModeDir | 0700},
+			"work":       {Mode: fs.ModeDir | 0700},
+		}},
 	}
 	checkWithCache(t, testCases)
 }
@@ -1135,6 +1456,11 @@ func TestErrors(t *testing.T) {
 		{"UnsupportedVariantError", pkg.UnsupportedVariantError(
 			"rosa",
 		), `unsupported variant "rosa"`},
+
+		{"UnsupportedArchError zero", pkg.UnsupportedArchError(""),
+			"invalid architecture name"},
+		{"UnsupportedArchError", pkg.UnsupportedArchError("riscv64"),
+			"unsupported architecture riscv64"},
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -1250,6 +1576,14 @@ errors during scrub:
 func TestDependencyCureError(t *testing.T) {
 	t.Parallel()
 
+	makeIdent := func(ident ...byte) pkg.Artifact {
+		var a overrideIdent
+		copy(a.id[:], ident)
+		// does not compare equal
+		a.TrivialArtifact = new(stubArtifact)
+		return a
+	}
+
 	testCases := []struct {
 		name   string
 		err    pkg.DependencyCureError
@@ -1257,51 +1591,51 @@ func TestDependencyCureError(t *testing.T) {
 		unwrap []error
 	}{
 		{"simple", pkg.DependencyCureError{
-			{Ident: unique.Make(pkg.ID{0xff, 9}), Err: stub.UniqueError(0xbad09)},
+			{A: makeIdent(0xff, 9), Err: stub.UniqueError(0xbad09)},
-			{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
+			{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
-			{Ident: unique.Make(pkg.ID{0xff, 0xf}), Err: stub.UniqueError(0xbad0f)},
+			{A: makeIdent(0xff, 0xf), Err: stub.UniqueError(0xbad0f)},
-			{Ident: unique.Make(pkg.ID{0xff, 1}), Err: stub.UniqueError(0xbad01)},
+			{A: makeIdent(0xff, 1), Err: stub.UniqueError(0xbad01)},
 		}, `errors curing dependencies:
 	_wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765184 injected by the test suite
 	_wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765185 injected by the test suite
 	_wkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765193 injected by the test suite
 	_w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765199 injected by the test suite`, []error{
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
+			&pkg.CureError{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 1}), Err: stub.UniqueError(0xbad01)},
+			&pkg.CureError{A: makeIdent(0xff, 1), Err: stub.UniqueError(0xbad01)},
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 9}), Err: stub.UniqueError(0xbad09)},
+			&pkg.CureError{A: makeIdent(0xff, 9), Err: stub.UniqueError(0xbad09)},
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 0xf}), Err: stub.UniqueError(0xbad0f)},
+			&pkg.CureError{A: makeIdent(0xff, 0xf), Err: stub.UniqueError(0xbad0f)},
 		}},
 
 		{"dedup", pkg.DependencyCureError{
-			{Ident: unique.Make(pkg.ID{0xff, 9}), Err: stub.UniqueError(0xbad09)},
+			{A: makeIdent(0xff, 9), Err: stub.UniqueError(0xbad09)},
-			{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
+			{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
-			{Ident: unique.Make(pkg.ID{0xff, 0xfd}), Err: &pkg.DependencyCureError{
+			{A: makeIdent(0xff, 0xfd), Err: &pkg.DependencyCureError{
-				{Ident: unique.Make(pkg.ID{0xff, 9}), Err: stub.UniqueError(0xbad09)},
+				{A: makeIdent(0xff, 9), Err: stub.UniqueError(0xbad09)},
-				{Ident: unique.Make(pkg.ID{0xff, 0xc}), Err: &pkg.DependencyCureError{
+				{A: makeIdent(0xff, 0xc), Err: &pkg.DependencyCureError{
-					{Ident: unique.Make(pkg.ID{0xff, 0xf}), Err: stub.UniqueError(0xbad0f)},
+					{A: makeIdent(0xff, 0xf), Err: stub.UniqueError(0xbad0f)},
-					{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
+					{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
 				}},
-				{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
+				{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
-				{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
+				{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
 			}},
-			{Ident: unique.Make(pkg.ID{0xff, 0xff}), Err: &pkg.DependencyCureError{
+			{A: makeIdent(0xff, 0xff), Err: &pkg.DependencyCureError{
-				{Ident: unique.Make(pkg.ID{0xff, 9}), Err: stub.UniqueError(0xbad09)},
+				{A: makeIdent(0xff, 9), Err: stub.UniqueError(0xbad09)},
-				{Ident: unique.Make(pkg.ID{0xff, 0xc}), Err: &pkg.DependencyCureError{
+				{A: makeIdent(0xff, 0xc), Err: &pkg.DependencyCureError{
-					{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
+					{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
 				}},
-				{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
+				{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
 			}},
-			{Ident: unique.Make(pkg.ID{0xff, 0xf}), Err: stub.UniqueError(0xbad0f)},
+			{A: makeIdent(0xff, 0xf), Err: stub.UniqueError(0xbad0f)},
-			{Ident: unique.Make(pkg.ID{0xff, 1}), Err: stub.UniqueError(0xbad01)},
+			{A: makeIdent(0xff, 1), Err: stub.UniqueError(0xbad01)},
 		}, `errors curing dependencies:
 	_wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765184 injected by the test suite
 	_wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765185 injected by the test suite
 	_wkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765193 injected by the test suite
 	_w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA: unique error 765199 injected by the test suite`, []error{
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 0}), Err: stub.UniqueError(0xbad00)},
+			&pkg.CureError{A: makeIdent(0xff, 0), Err: stub.UniqueError(0xbad00)},
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 1}), Err: stub.UniqueError(0xbad01)},
+			&pkg.CureError{A: makeIdent(0xff, 1), Err: stub.UniqueError(0xbad01)},
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 9}), Err: stub.UniqueError(0xbad09)},
+			&pkg.CureError{A: makeIdent(0xff, 9), Err: stub.UniqueError(0xbad09)},
-			&pkg.CureError{Ident: unique.Make(pkg.ID{0xff, 0xf}), Err: stub.UniqueError(0xbad0f)},
+			&pkg.CureError{A: makeIdent(0xff, 0xf), Err: stub.UniqueError(0xbad0f)},
 		}},
 	}
 	for _, tc := range testCases {
@@ -1342,6 +1676,25 @@ func (a earlyFailureF) Cure(*pkg.FContext) error {
 	return stub.UniqueError(0xcafe)
 }
 
+func BenchmarkEarlyDCE(b *testing.B) {
+	msg := message.New(log.New(os.Stderr, "dce: ", 0))
+	msg.SwapVerbose(testing.Verbose())
+	c, err := pkg.Open(b.Context(), msg, 0, 0, 0, check.MustAbs(b.TempDir()))
+	if err != nil {
+		b.Fatal(err)
+	}
+	_, _, err = c.Cure(earlyFailureF(8))
+	if !errors.Is(err, stub.UniqueError(0xcafe)) {
+		b.Fatalf("Cure: error = %v", err)
+	}
+	c.Close()
+	dce := err.(*pkg.DependencyCureError)
+
+	for b.Loop() {
+		dce.Unwrap()
+	}
+}
+
 func TestDependencyCureErrorEarly(t *testing.T) {
 	t.Parallel()
 
@@ -1351,7 +1704,13 @@ func TestDependencyCureErrorEarly(t *testing.T) {
 			if !errors.Is(err, stub.UniqueError(0xcafe)) {
 				t.Fatalf("Cure: error = %v", err)
 			}
-		}, pkg.MustDecode("E4vEZKhCcL2gPZ2Tt59FS3lDng-d_2SKa2i5G_RbDfwGn6EemptFaGLPUDiOa94C")},
+		}, expectsFS{
+			".":          {Mode: fs.ModeDir | 0700},
+			"checksum":   {Mode: fs.ModeDir | 0700},
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"substitute": {Mode: fs.ModeDir | 0700},
+			"work":       {Mode: fs.ModeDir | 0700},
+		}},
 	})
 }
 

internal/pkg/tar_test.go

@@ -20,6 +20,31 @@ import (
 func TestTar(t *testing.T) {
 	t.Parallel()
 
+	want := expectsFS{
+		".": {Mode: fs.ModeDir | 0500},
+
+		"checksum": {Mode: fs.ModeDir | 0500},
+		"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP":                {Mode: fs.ModeDir | 0500},
+		"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/check":          {Mode: 0400, Data: []byte{0, 0}},
+		"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib":            {Mode: fs.ModeDir | 0500},
+		"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/pkgconfig":  {Mode: fs.ModeDir | 0500},
+		"checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
+
+		"identifier": {Mode: fs.ModeDir | 0500},
+		"identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
+		"identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
+
+		"work": {Mode: fs.ModeDir | 0500},
+	}
+	wantEncode := pkg.Encode(want.hash())
+
+	wantExpand := expectsFS{
+		".": {Mode: fs.ModeDir | 0500},
+
+		"libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
+	}
+	wantExpandEncode := pkg.Encode(wantExpand.hash())
+
 	checkWithCache(t, []cacheTestCase{
 		{"http", 0, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			checkTarHTTP(t, base, c, fstest.MapFS{
@@ -37,10 +62,32 @@ func TestTar(t *testing.T) {
 				"identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
 
 				"work": {Mode: fs.ModeDir | 0700},
-			}, pkg.MustDecode(
+			}, want)
-				"cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM",
+		}, expectsFS{
-			))
+			".": {Mode: fs.ModeDir | 0700},
-		}, pkg.MustDecode("NQTlc466JmSVLIyWklm_u8_g95jEEb98PxJU-kjwxLpfdjwMWJq0G8ze9R4Vo1Vu")},
+
+			"checksum":                             {Mode: fs.ModeDir | 0700},
+			"checksum/" + wantEncode:               {Mode: fs.ModeDir | 0500},
+			"checksum/" + wantEncode + "/checksum": {Mode: fs.ModeDir | 0500},
+			"checksum/" + wantEncode + "/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP":                {Mode: fs.ModeDir | 0500},
+			"checksum/" + wantEncode + "/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/check":          {Mode: 0400, Data: []byte{0, 0}},
+			"checksum/" + wantEncode + "/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib":            {Mode: fs.ModeDir | 0500},
+			"checksum/" + wantEncode + "/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
+			"checksum/" + wantEncode + "/checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP/lib/pkgconfig":  {Mode: fs.ModeDir | 0500},
+			"checksum/" + wantEncode + "/identifier": {Mode: fs.ModeDir | 0500},
+			"checksum/" + wantEncode + "/identifier/HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
+			"checksum/" + wantEncode + "/identifier/Zx5ZG9BAwegNT3zQwCySuI2ktCXxNgxirkGLFjW4FW06PtojYVaCdtEw8yuntPLa": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/1TL00Qb8dcqayX7wTO8WNaraHvY6b-KCsctLDTrb64QBCmxj_-byK1HdIUwMaFEP")},
+			"checksum/" + wantEncode + "/work": {Mode: fs.ModeDir | 0500},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/W5S65DEhawz_WKaok5NjUKLmnD9dNl5RPauNJjcOVcB3VM4eGhSaLGmXbL8vZpiw": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantEncode)},
+			"identifier/rg7F1D5hwv6o4xctjD5zDq4i5MD0mArTsUIWfhUbik8xC6Bsyt3mjXXOm3goojTz": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantEncode)},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}},
 
 		{"http expand", 0, nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			checkTarHTTP(t, base, c, fstest.MapFS{
@@ -48,10 +95,23 @@ func TestTar(t *testing.T) {
 
 				"lib":            {Mode: fs.ModeDir | 0700},
 				"lib/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
-			}, pkg.MustDecode(
+			}, wantExpand)
-				"CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN",
+		}, expectsFS{
-			))
+			".": {Mode: fs.ModeDir | 0700},
-		}, pkg.MustDecode("hSoSSgCYTNonX3Q8FjvjD1fBl-E-BQyA6OTXro2OadXqbST4tZ-akGXszdeqphRe")},
+
+			"checksum":                     {Mode: fs.ModeDir | 0700},
+			"checksum/" + wantExpandEncode: {Mode: fs.ModeDir | 0500},
+			"checksum/" + wantExpandEncode + "/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
+
+			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/W5S65DEhawz_WKaok5NjUKLmnD9dNl5RPauNJjcOVcB3VM4eGhSaLGmXbL8vZpiw": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantExpandEncode)},
+			"identifier/_v1blm2h-_KA-dVaawdpLas6MjHc6rbhhFS8JWwx8iJxZGUu8EBbRrhr5AaZ9PJL": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/" + wantExpandEncode)},
+
+			"substitute": {Mode: fs.ModeDir | 0700},
+
+			"temp": {Mode: fs.ModeDir | 0700},
+			"work": {Mode: fs.ModeDir | 0700},
+		}},
 	})
 }
 
@@ -60,7 +120,7 @@ func checkTarHTTP(
 	base *check.Absolute,
 	c *pkg.Cache,
 	testdataFsys fs.FS,
-	wantChecksum pkg.Checksum,
+	want expectsKnown,
 ) {
 	var testdata string
 	{
@@ -194,24 +254,24 @@ func checkTarHTTP(
 		{"file", a, base.Append(
 			"identifier",
 			pkg.Encode(wantIdent),
-		), wantChecksum, nil},
+		), want, nil},
 
 		{"directory", pkg.NewTar(
 			&tarDir,
 			pkg.TarGzip,
-		), ignorePathname, wantChecksum, nil},
+		), ignorePathname, want, nil},
 
 		{"multiple entries", pkg.NewTar(
 			&tarDirMulti,
 			pkg.TarGzip,
-		), nil, pkg.Checksum{}, errors.New(
+		), nil, nil, errors.New(
 			"input directory does not contain a single regular file",
 		)},
 
 		{"bad type", pkg.NewTar(
 			&tarDirType,
 			pkg.TarGzip,
-		), nil, pkg.Checksum{}, errors.New(
+		), nil, nil, errors.New(
 			"input directory does not contain a single regular file",
 		)},
 
@@ -221,6 +281,6 @@ func checkTarHTTP(
 			cure: func(t *pkg.TContext) error {
 				return stub.UniqueError(0xcafe)
 			},
-		}, pkg.TarGzip), nil, pkg.Checksum{}, stub.UniqueError(0xcafe)},
+		}, pkg.TarGzip), nil, nil, stub.UniqueError(0xcafe)},
 	})
 }

internal/rosa/acl.go

@@ -1,110 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newAttr() (pkg.Artifact, string) {
-	const (
-		version  = "2.5.2"
-		checksum = "YWEphrz6vg1sUMmHHVr1CRo53pFXRhq_pjN-AlG8UgwZK1y6m7zuDhxqJhD0SV0l"
-	)
-	return t.NewPackage("attr", version, newTar(
-		"https://download.savannah.nongnu.org/releases/attr/"+
-			"attr-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), &PackageAttr{
-		Patches: []KV{
-			{"libgen-basename", `From 8a80d895dfd779373363c3a4b62ecce5a549efb2 Mon Sep 17 00:00:00 2001
-From: "Haelwenn (lanodan) Monnier" <contact@hacktivis.me>
-Date: Sat, 30 Mar 2024 10:17:10 +0100
-Subject: tools/attr.c: Add missing libgen.h include for basename(3)
-
-Fixes compilation issue with musl and modern C99 compilers.
-
-See: https://bugs.gentoo.org/926294
----
- tools/attr.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/tools/attr.c b/tools/attr.c
-index f12e4af..6a3c1e9 100644
---- a/tools/attr.c
-+++ b/tools/attr.c
-@@ -28,6 +28,7 @@
- #include <errno.h>
- #include <string.h>
- #include <locale.h>
-+#include <libgen.h>
- 
- #include <attr/attributes.h>
- 
--- 
-cgit v1.1`},
-
-			{"musl-errno", `diff --git a/test/attr.test b/test/attr.test
-index 6ce2f9b..e9bde92 100644
---- a/test/attr.test
-+++ b/test/attr.test
-@@ -11,7 +11,7 @@ Try various valid and invalid names
- 
- 	$ touch f
- 	$ setfattr -n user -v value f
--	> setfattr: f: Operation not supported
-+	> setfattr: f: Not supported
- 	
- 	$ setfattr -n user. -v value f
- 	> setfattr: f: Invalid argument
-`},
-		},
-
-		ScriptEarly: `
-ln -s ../../system/bin/perl /usr/bin
-`,
-	}, (*MakeHelper)(nil),
-		Perl,
-	), version
-}
-func init() {
-	artifactsM[Attr] = Metadata{
-		f: Toolchain.newAttr,
-
-		Name:        "attr",
-		Description: "Commands for Manipulating Filesystem Extended Attributes",
-		Website:     "https://savannah.nongnu.org/projects/attr/",
-
-		ID: 137,
-	}
-}
-
-func (t Toolchain) newACL() (pkg.Artifact, string) {
-	const (
-		version  = "2.3.2"
-		checksum = "-fY5nwH4K8ZHBCRXrzLdguPkqjKI6WIiGu4dBtrZ1o0t6AIU73w8wwJz_UyjIS0P"
-	)
-	return t.NewPackage("acl", version, newTar(
-		"https://download.savannah.nongnu.org/releases/acl/"+
-			"acl-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), nil, &MakeHelper{
-		// makes assumptions about uid_map/gid_map
-		SkipCheck: true,
-	},
-		Attr,
-	), version
-}
-func init() {
-	artifactsM[ACL] = Metadata{
-		f: Toolchain.newACL,
-
-		Name:        "acl",
-		Description: "Commands for Manipulating POSIX Access Control Lists",
-		Website:     "https://savannah.nongnu.org/projects/acl/",
-
-		Dependencies: P{
-			Attr,
-		},
-
-		ID: 16,
-	}
-}

internal/rosa/all.go

@@ -1,401 +0,0 @@
-package rosa
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-	"strconv"
-	"sync"
-
-	"hakurei.app/internal/pkg"
-)
-
-// PArtifact is a lazily-initialised [pkg.Artifact] preset.
-type PArtifact int
-
-const (
-	LLVM PArtifact = iota
-
-	// EarlyInit is the Rosa OS init program.
-	EarlyInit
-	// ImageSystem is the Rosa OS /system image.
-	ImageSystem
-	// ImageInitramfs is the Rosa OS initramfs archive.
-	ImageInitramfs
-
-	// Kernel is the generic Rosa OS Linux kernel.
-	Kernel
-	// KernelHeaders is an installation of kernel headers for [Kernel].
-	KernelHeaders
-	// KernelSource is a writable kernel source tree installed to [AbsUsrSrc].
-	KernelSource
-	// Firmware is firmware blobs for use with the Linux kernel.
-	Firmware
-
-	ACL
-	ArgpStandalone
-	Attr
-	Autoconf
-	Automake
-	BC
-	Bash
-	Binutils
-	Bison
-	Bzip2
-	CMake
-	Connman
-	Coreutils
-	Curl
-	DBus
-	DTC
-	Diffutils
-	Elfutils
-	Fakeroot
-	Findutils
-	Flex
-	Fuse
-	GMP
-	GLib
-	Gawk
-	GenInitCPIO
-	Gettext
-	Git
-	Glslang
-	GnuTLS
-	Go
-	Gperf
-	Grep
-	Gzip
-	Hakurei
-	HakureiDist
-	IPTables
-	Kmod
-	LIT
-	LibX11
-	LibXau
-	LibXext
-	Libbsd
-	Libcap
-	Libdrm
-	Libev
-	Libexpat
-	Libffi
-	Libgd
-	Libglvnd
-	Libiconv
-	Libmd
-	Libmnl
-	Libpciaccess
-	Libnftnl
-	Libpsl
-	Libseccomp
-	Libtasn1
-	Libtool
-	Libucontext
-	Libunistring
-	Libxshmfence
-	Libxml2
-	Libxslt
-	Libxtrans
-	M4
-	MPC
-	MPFR
-	Make
-	Meson
-	Mksh
-	MuslFts
-	MuslObstack
-	NSS
-	NSSCACert
-	Ncurses
-	Nettle
-	Ninja
-	OpenSSL
-	P11Kit
-	PCRE2
-	Parallel
-	Patch
-	Perl
-	PerlLocaleGettext
-	PerlMIMECharset
-	PerlModuleBuild
-	PerlPodParser
-	PerlSGMLS
-	PerlTermReadKey
-	PerlTextCharWidth
-	PerlTextWrapI18N
-	PerlUnicodeLineBreak
-	PerlYAMLTiny
-	PkgConfig
-	Procps
-	Python
-	PythonFlitCore
-	PythonHatchling
-	PythonIniConfig
-	PythonMako
-	PythonMarkupSafe
-	PythonPackaging
-	PythonPathspec
-	PythonPluggy
-	PythonPyTest
-	PythonPyYAML
-	PythonPygments
-	PythonSetuptools
-	PythonSetuptoolsSCM
-	PythonTroveClassifiers
-	PythonVCSVersioning
-	PythonWheel
-	QEMU
-	Rdfind
-	Readline
-	Rsync
-	Sed
-	SPIRVHeaders
-	SPIRVLLVMTranslator
-	SPIRVTools
-	SquashfsTools
-	Strace
-	TamaGo
-	Tar
-	Texinfo
-	Toybox
-	toyboxEarly
-	Unzip
-	UtilLinux
-	Wayland
-	WaylandProtocols
-	XCB
-	XCBProto
-	XDGDBusProxy
-	XZ
-	XorgProto
-	Zlib
-	Zstd
-
-	// PresetUnexportedStart is the first unexported preset.
-	PresetUnexportedStart
-
-	llvmSource = iota - 1
-	// earlyCompilerRT is an early, standalone compiler-rt installation for the
-	// standalone runtimes build.
-	//
-	// earlyCompilerRT must only be loaded by [LLVM].
-	earlyCompilerRT
-	// earlyRuntimes is an early, standalone installation of LLVM runtimes to
-	// work around the cmake build system leaking the system LLVM installation
-	// when invoking the newly built toolchain.
-	//
-	// earlyRuntimes must only be loaded by [LLVM].
-	earlyRuntimes
-
-	buildcatrust
-	utilMacros
-
-	// Musl is a standalone libc that does not depend on the toolchain.
-	Musl
-	// muslHeaders is a system installation of [Musl] headers.
-	muslHeaders
-
-	// gcc is a hacked-to-pieces GCC toolchain meant for use in intermediate
-	// stages only. This preset and its direct output must never be exposed.
-	gcc
-
-	// nettle3 is an older version of [Nettle].
-	nettle3
-
-	// Stage0 is a tarball containing all compile-time dependencies of artifacts
-	// part of the [Std] toolchain.
-	Stage0
-
-	// PresetEnd is the total number of presets and does not denote a preset.
-	PresetEnd
-)
-
-// P represents multiple [PArtifact] and is stable through JSON.
-type P []PArtifact
-
-// MarshalJSON represents [PArtifact] by their [Metadata.Name].
-func (s P) MarshalJSON() ([]byte, error) {
-	names := make([]string, len(s))
-	for i, p := range s {
-		names[i] = GetMetadata(p).Name
-	}
-	return json.Marshal(names)
-}
-
-// UnmarshalJSON resolves the value created by MarshalJSON back to [P].
-func (s *P) UnmarshalJSON(data []byte) error {
-	var names []string
-	if err := json.Unmarshal(data, &names); err != nil {
-		return err
-	}
-
-	*s = make(P, len(names))
-	for i, name := range names {
-		if p, ok := ResolveName(name); !ok {
-			return fmt.Errorf("unknown artifact %q", name)
-		} else {
-			(*s)[i] = p
-		}
-	}
-	return nil
-}
-
-// Metadata is stage-agnostic information of a [PArtifact] not directly
-// representable in the resulting [pkg.Artifact].
-type Metadata struct {
-	f func(t Toolchain) (a pkg.Artifact, version string)
-
-	// Unique package name.
-	Name string `json:"name"`
-	// Short user-facing description.
-	Description string `json:"description"`
-	// Project home page.
-	Website string `json:"website,omitempty"`
-
-	// Runtime dependencies.
-	Dependencies P `json:"dependencies"`
-
-	// Project identifier on [Anitya].
-	//
-	// [Anitya]: https://release-monitoring.org/
-	ID int `json:"-"`
-
-	// Optional custom version checking behaviour.
-	latest func(v *Versions) string
-}
-
-// GetLatest returns the latest version described by v.
-func (meta *Metadata) GetLatest(v *Versions) string {
-	if meta.latest != nil {
-		return meta.latest(v)
-	}
-	return v.Latest
-}
-
-// Unversioned denotes an unversioned [PArtifact].
-const Unversioned = "\x00"
-
-// UnpopulatedIDError is returned by [Metadata.GetLatest] for an instance of
-// [Metadata] where ID is not populated.
-type UnpopulatedIDError struct{}
-
-func (UnpopulatedIDError) Unwrap() error { return errors.ErrUnsupported }
-func (UnpopulatedIDError) Error() string { return "Anitya ID is not populated" }
-
-// Versions are package versions returned by Anitya.
-type Versions struct {
-	// The latest version for the project, as determined by the version sorting algorithm.
-	Latest string `json:"latest_version"`
-	// List of all versions that aren’t flagged as pre-release.
-	Stable []string `json:"stable_versions"`
-	// List of all versions stored, sorted from newest to oldest.
-	All []string `json:"versions"`
-}
-
-// getStable returns the first Stable version, or Latest if that is unavailable.
-func (v *Versions) getStable() string {
-	if len(v.Stable) == 0 {
-		return v.Latest
-	}
-	return v.Stable[0]
-}
-
-// GetVersions returns versions fetched from Anitya.
-func (meta *Metadata) GetVersions(ctx context.Context) (*Versions, error) {
-	if meta.ID == 0 {
-		return nil, UnpopulatedIDError{}
-	}
-
-	var resp *http.Response
-	if req, err := http.NewRequestWithContext(
-		ctx,
-		http.MethodGet,
-		"https://release-monitoring.org/api/v2/versions/?project_id="+
-			strconv.Itoa(meta.ID),
-		nil,
-	); err != nil {
-		return nil, err
-	} else {
-		req.Header.Set("User-Agent", "Rosa/1.1")
-		if resp, err = http.DefaultClient.Do(req); err != nil {
-			return nil, err
-		}
-	}
-
-	var v Versions
-	err := json.NewDecoder(resp.Body).Decode(&v)
-	return &v, errors.Join(err, resp.Body.Close())
-}
-
-var (
-	// artifactsM is an array of [PArtifact] metadata.
-	artifactsM [PresetEnd]Metadata
-
-	// artifacts stores the result of Metadata.f.
-	artifacts [_toolchainEnd][len(artifactsM)]struct {
-		a pkg.Artifact
-		v string
-	}
-	// artifactsOnce is for lazy initialisation of artifacts.
-	artifactsOnce [_toolchainEnd][len(artifactsM)]sync.Once
-
-	// presetOpts globally modifies behaviour of presets.
-	presetOpts int
-)
-
-const (
-	// OptSkipCheck skips running all test suites.
-	OptSkipCheck = 1 << iota
-	// OptLLVMNoLTO disables LTO in all [LLVM] stages.
-	OptLLVMNoLTO
-)
-
-// Flags returns the current preset flags
-func Flags() int { return presetOpts }
-
-// zero zeros the value pointed to by p.
-func zero[T any](p *T) { var v T; *p = v }
-
-// DropCaches arranges for all cached [pkg.Artifact] to be freed some time after
-// it returns. Must not be used concurrently with any other function from this
-// package.
-func DropCaches(flags int) {
-	presetOpts = flags
-	zero(&artifacts)
-	zero(&artifactsOnce)
-}
-
-// GetMetadata returns [Metadata] of a [PArtifact].
-func GetMetadata(p PArtifact) *Metadata { return &artifactsM[p] }
-
-// construct constructs a [pkg.Artifact] corresponding to a [PArtifact] once.
-func (t Toolchain) construct(p PArtifact) {
-	artifactsOnce[t][p].Do(func() {
-		artifacts[t][p].a, artifacts[t][p].v = artifactsM[p].f(t)
-	})
-}
-
-// Load returns the resulting [pkg.Artifact] of [PArtifact].
-func (t Toolchain) Load(p PArtifact) pkg.Artifact {
-	t.construct(p)
-	return artifacts[t][p].a
-}
-
-// Version returns the version string of [PArtifact].
-func (t Toolchain) Version(p PArtifact) string {
-	t.construct(p)
-	return artifacts[t][p].v
-}
-
-// ResolveName returns a [PArtifact] by name.
-func ResolveName(name string) (p PArtifact, ok bool) {
-	for i := range PresetUnexportedStart {
-		if name == artifactsM[i].Name {
-			return i, true
-		}
-	}
-	return 0, false
-}

internal/rosa/all_test.go

@@ -1,81 +0,0 @@
-package rosa_test
-
-import (
-	"testing"
-
-	"hakurei.app/internal/rosa"
-)
-
-func TestLoad(t *testing.T) {
-	t.Parallel()
-
-	for i := range rosa.PresetEnd {
-		p := rosa.PArtifact(i)
-		t.Run(rosa.GetMetadata(p).Name, func(t *testing.T) {
-			t.Parallel()
-
-			rosa.Std.Load(p)
-		})
-	}
-}
-
-func BenchmarkAll(b *testing.B) {
-	flags := rosa.Flags()
-	b.Cleanup(func() { rosa.DropCaches(flags) })
-
-	for b.Loop() {
-		for i := range rosa.PresetEnd {
-			rosa.Std.Load(rosa.PArtifact(i))
-		}
-
-		b.StopTimer()
-		rosa.DropCaches(0)
-		b.StartTimer()
-	}
-}
-
-func TestResolveName(t *testing.T) {
-	t.Parallel()
-
-	for i := range rosa.PresetUnexportedStart {
-		p := i
-		name := rosa.GetMetadata(p).Name
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			if got, ok := rosa.ResolveName(name); !ok {
-				t.Fatal("ResolveName: ok = false")
-			} else if got != p {
-				t.Fatalf("ResolveName: %d, want %d", got, p)
-			}
-		})
-	}
-}
-func TestResolveNameUnexported(t *testing.T) {
-	t.Parallel()
-
-	for i := rosa.PresetUnexportedStart; i < rosa.PresetEnd; i++ {
-		p := i
-		name := rosa.GetMetadata(p).Name
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			if got, ok := rosa.ResolveName(name); ok {
-				t.Fatalf("ResolveName: resolved unexported preset %d", got)
-			}
-		})
-	}
-}
-
-func TestUnique(t *testing.T) {
-	t.Parallel()
-
-	names := make(map[string]struct{})
-	for i := range rosa.PresetEnd {
-		name := rosa.GetMetadata(rosa.PArtifact(i)).Name
-		if _, ok := names[name]; ok {
-			t.Fatalf("name %s is not unique", name)
-		}
-		names[name] = struct{}{}
-	}
-}

internal/rosa/argp-standalone.go

@@ -1,36 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newArgpStandalone() (pkg.Artifact, string) {
-	const (
-		version  = "1.3"
-		checksum = "vtW0VyO2pJ-hPyYmDI2zwSLS8QL0sPAUKC1t3zNYbwN2TmsaE-fADhaVtNd3eNFl"
-	)
-	return t.NewPackage("argp-standalone", version, newTar(
-		"http://www.lysator.liu.se/~nisse/misc/"+
-			"argp-standalone-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), &PackageAttr{
-		Env: []string{
-			"CC=cc -std=gnu89 -fPIC",
-		},
-	}, &MakeHelper{
-		Install: `
-install -D -m644 /usr/src/argp-standalone/argp.h /work/system/include/argp.h
-install -D -m755 libargp.a /work/system/lib/libargp.a
-`,
-	},
-		Diffutils,
-	), version
-}
-func init() {
-	artifactsM[ArgpStandalone] = Metadata{
-		f: Toolchain.newArgpStandalone,
-
-		Name:        "argp-standalone",
-		Description: "hierarchical argument parsing library broken out from glibc",
-		Website:     "http://www.lysator.liu.se/~nisse/misc/",
-	}
-}

internal/rosa/azalea/azalea.go

@@ -0,0 +1,348 @@
+// Package azalea implements a proof-of-concept, domain-specific language for
+// Rosa OS software packaging.
+package azalea
+
+import (
+	"errors"
+	"io"
+	"strconv"
+	"text/scanner"
+)
+
+// idents are runes accepted in an identifier.
+var idents = [...]bool{
+	'0': true, '1': true, '2': true, '3': true, '4': true, '5': true, '6': true,
+	'7': true, '8': true, '9': true,
+
+	'A': true, 'B': true, 'C': true, 'D': true, 'E': true, 'F': true, 'G': true,
+	'H': true, 'I': true, 'J': true, 'K': true, 'L': true, 'M': true, 'N': true,
+	'O': true, 'P': true, 'Q': true, 'R': true, 'S': true, 'T': true, 'U': true,
+	'V': true, 'W': true, 'X': true, 'Y': true, 'Z': true,
+
+	'a': true, 'b': true, 'c': true, 'd': true, 'e': true, 'f': true, 'g': true,
+	'h': true, 'i': true, 'j': true, 'k': true, 'l': true, 'm': true, 'n': true,
+	'o': true, 'p': true, 'q': true, 'r': true, 's': true, 't': true, 'u': true,
+	'v': true, 'w': true, 'x': true, 'y': true, 'z': true,
+
+	'-': true, '_': true,
+}
+
+// TokenError describes an unexpected token.
+type TokenError [2]rune
+
+func (e TokenError) Error() string {
+	return "expected " + scanner.TokenString(e[0]) +
+		", found " + scanner.TokenString(e[1])
+}
+
+// ExprError is an unexpected token encountered while parsing an expression.
+type ExprError rune
+
+func (e ExprError) Error() string {
+	return "unexpected token " + scanner.TokenString(rune(e))
+}
+
+// must1 returns v, or panics if err is not nil.
+func must1[T any](v T, err error) T {
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// parser retains the current token.
+type parser struct {
+	s   scanner.Scanner
+	tok rune
+}
+
+// scan advances the underlying scanner to the next token, storing its result.
+func (p *parser) scan() rune { p.tok = p.s.Scan(); return p.tok }
+
+// expects panics with [TokenError] for an unexpected tok.
+func (p *parser) expects(expects rune) {
+	if p.tok != expects {
+		panic(TokenError{expects, p.tok})
+	}
+}
+
+// scanAs advances the scanner for an expected token.
+func (p *parser) scanAs(expects rune) { p.scan(); p.expects(expects) }
+
+// An Int is the value represented by an integer literal.
+type Int int64
+
+func (v Int) GoString() string {
+	return "azalea.Int(" + strconv.FormatInt(int64(v), 10) + ")"
+}
+
+// parseInt parses the current token as a base 10 representation of a 64-bit
+// signed integer.
+func (p *parser) parseInt() Int {
+	v, err := strconv.ParseInt(p.s.TokenText(), 10, 64)
+	return must1(Int(v), err)
+}
+
+// A String holds the unquoted content of a string literal.
+type String string
+
+func (v String) GoString() string {
+	return "azalea.String(" + strconv.Quote(string(v)) + ")"
+}
+
+// parseString parses the current token as a string.
+func (p *parser) parseString() String {
+	s, err := strconv.Unquote(p.s.TokenText())
+	return must1(String(s), err)
+}
+
+// An Ident holds the name of an identifier.
+type Ident string
+
+func (v Ident) GoString() string {
+	return "azalea.Ident(" + strconv.Quote(string(v)) + ")"
+}
+
+// A Val are statements joined by the '+' operator. Only the [String] type
+// supports concatenation.
+type Val []any
+
+// parseVal parses until the end of the [Val].
+func (p *parser) parseVal() (v Val) {
+	v = append(v, p.parseExpr())
+	for p.tok == '+' {
+		p.scan()
+		v = append(v, p.parseExpr())
+	}
+	return
+}
+
+// An Array holds statements in an array.
+type Array []Val
+
+// A KV holds a key/value pair.
+type KV struct {
+	K String
+	V Val
+}
+
+// An Arg represents an argument of [Func].
+type Arg struct {
+	K []Ident
+	V Val
+	R bool
+}
+
+// Func is a function call or package declaration.
+type Func struct {
+	// Function or package identifier.
+	Ident Ident
+	// Whether this is a package declaration.
+	Package bool
+	// Key-value arguments.
+	Args []Arg
+}
+
+// parseExpr parses the current expression.
+func (p *parser) parseExpr() any {
+	switch p.tok {
+	case scanner.Int:
+		v := p.parseInt()
+		p.scan()
+		return v
+
+	case scanner.String, scanner.RawString:
+		v := p.parseString()
+		p.scan()
+		return v
+
+	case scanner.Ident:
+		var v Func
+		v.Ident = Ident(p.s.TokenText())
+		if v.Package = v.Ident == "package"; v.Package {
+			p.scanAs(scanner.Ident)
+			v.Ident = Ident(p.s.TokenText())
+		}
+
+		p.scan()
+		switch p.tok {
+		case '{':
+			for {
+				p.scan()
+				switch p.tok {
+				case '}':
+					p.scan()
+					return v
+
+				case scanner.Ident:
+					break
+
+				default:
+					panic(TokenError{scanner.Ident, p.tok})
+				}
+
+				arg := Arg{K: []Ident{Ident(p.s.TokenText())}}
+				delim := true
+			arg:
+				for {
+					p.scan()
+					switch p.tok {
+					case ',':
+						if delim {
+							delim = false
+							continue
+						}
+						panic(ExprError(p.tok))
+
+					case scanner.Ident:
+						if delim {
+							panic(TokenError{',', p.tok})
+						}
+						delim = true
+						arg.K = append(arg.K, Ident(p.s.TokenText()))
+
+					default:
+						break arg
+					}
+				}
+				switch p.tok {
+				case '=':
+					break
+
+				case '*':
+					arg.R = true
+					p.scanAs('=')
+
+				default:
+					panic(TokenError{'=', p.tok})
+				}
+				p.scan()
+				arg.V = p.parseVal()
+				v.Args = append(v.Args, arg)
+				p.expects(';')
+			}
+
+		default:
+			return v.Ident
+		}
+
+	case '{':
+		var v []KV
+		for {
+			p.scan()
+			switch p.tok {
+			case '}':
+				p.scan()
+				return v
+
+			case scanner.String:
+				pair := KV{K: p.parseString()}
+				p.scan()
+				switch p.tok {
+				case ';':
+					break
+
+				case ':':
+					p.scan()
+					pair.V = p.parseVal()
+					p.expects(';')
+					break
+
+				default:
+					panic(ExprError(p.tok))
+				}
+				v = append(v, pair)
+
+			default:
+				panic(ExprError(p.tok))
+			}
+		}
+
+	case '[':
+		var (
+			v     Array
+			delim bool
+		)
+		p.scan()
+		for {
+			switch p.tok {
+			case ',':
+				if delim {
+					p.scan()
+					delim = false
+					continue
+				}
+				panic(ExprError(','))
+			case ']':
+				p.scan()
+				return v
+			case scanner.EOF:
+				panic(ExprError(scanner.EOF))
+			default:
+				if delim {
+					panic(TokenError{',', p.tok})
+				}
+				delim = true
+				break
+			}
+			v = append(v, p.parseVal())
+		}
+
+	default:
+		panic(ExprError(p.tok))
+	}
+}
+
+// ScanError is the error count parsing all expressions.
+type ScanError int
+
+func (ScanError) Error() string {
+	return "aborting due to scanning errors"
+}
+
+// Parse parses expressions from r.
+func Parse(r io.Reader) (e []any, err error) {
+	var p parser
+	p.s.Init(r)
+
+	p.s.Mode = scanner.ScanIdents |
+		scanner.ScanInts |
+		scanner.ScanStrings |
+		scanner.ScanRawStrings |
+		scanner.ScanComments |
+		scanner.SkipComments
+	p.s.IsIdentRune = func(ch rune, i int) bool {
+		if i == 0 && ch >= '0' && ch <= '9' {
+			return false
+		}
+		return ch > 0 && ch < rune(len(idents)) && idents[ch]
+	}
+
+	defer func() {
+		v := recover()
+		if v == nil {
+			return
+		}
+
+		_err, ok := v.(error)
+		if !ok {
+			panic(v)
+		}
+
+		if err == nil {
+			err = _err
+			return
+		}
+		err = errors.Join(err, _err)
+	}()
+
+	p.scan()
+	for p.tok != scanner.EOF {
+		e = append(e, p.parseExpr())
+	}
+
+	if p.s.ErrorCount != 0 {
+		err = ScanError(p.s.ErrorCount)
+	}
+	return
+}

internal/rosa/azalea/azalea_test.go

@@ -0,0 +1,169 @@
+package azalea_test
+
+import (
+	_ "embed"
+	"reflect"
+	"strings"
+	"testing"
+	"text/scanner"
+
+	. "hakurei.app/internal/rosa/azalea"
+)
+
+//go:embed testdata/gcc.az
+var sample string
+
+func TestParse(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name string
+		data string
+		want []any
+		err  error
+	}{
+		{"invalid", "}", nil, ExprError('}')},
+		{"bad sep", "f{v?}", nil, TokenError{'=', '?'}},
+		{"bad ident", "f{9}", nil, TokenError{scanner.Ident, scanner.Int}},
+		{"share bad sep", "f { v,,v = v; }", nil, ExprError(',')},
+		{"share missing sep", "f { v v }", nil, TokenError{',', scanner.Ident}},
+
+		{"ident", `v`, []any{Ident("v")}, nil},
+		{"concat", `f { v = v+"\xfd"+p{}+9; }`, []any{Func{
+			Ident: "f",
+
+			Args: []Arg{{K: []Ident{"v"}, V: Val{
+				Ident("v"),
+				String("\xfd"),
+				Func{Ident: "p"},
+				Int(9),
+			}}},
+		}}, nil},
+		{"truncated string concat", `f { v = v+; }`, nil,
+			ExprError(';')},
+
+		{"empty pairs", `{}`, []any{[]KV(nil)}, nil},
+		{"short kv", `{"\x00":v;}`, []any{[]KV{
+			{K: "\x00", V: Val{Ident("v")}},
+		}}, nil},
+		{"truncated kv", `{"\x00"`, nil, ExprError(scanner.EOF)},
+		{"ident kv", `{v="";}`, nil, ExprError(scanner.Ident)},
+
+		{"empty array", `[]`, []any{Array(nil)}, nil},
+		{"integer array", `[9]`, []any{Array{{Int(9)}}}, nil},
+		{"short array", `[ "\x00" ]`, []any{
+			Array{{String("\x00")}},
+		}, nil},
+		{"short array delim", `[ "\x00", ]`, []any{
+			Array{{String("\x00")}},
+		}, nil},
+		{"missing array value", `[ "\x00", , v ]`, nil, ExprError(',')},
+		{"missing array delimiter", `[ v0 v1 ]`, nil, TokenError{',', scanner.Ident}},
+		{"truncated array", `[ "\x00"`, nil,
+			ExprError(scanner.EOF)},
+
+		{"gcc", sample, []any{Func{
+			Ident:   Ident("gcc"),
+			Package: true,
+
+			Args: []Arg{
+				{K: []Ident{Ident("description")}, V: Val{String("The GNU Compiler Collection")}},
+				{K: []Ident{Ident("website")}, V: Val{String("https://www.gnu.org/software/gcc")}},
+				{K: []Ident{Ident("anitya")}, V: Val{Int(6502)}},
+
+				{K: []Ident{Ident("version")}, V: Val{String("16.1.0")}, R: true},
+				{K: []Ident{Ident("source")}, V: Val{Func{
+					Ident: Ident("remoteTar"),
+
+					Args: []Arg{
+						{K: []Ident{Ident("url")}, V: Val{
+							String("https://ftp.tsukuba.wide.ad.jp/software/gcc/releases/"),
+							String("gcc-"),
+							Ident("version"),
+							String("/gcc-"),
+							Ident("version"),
+							String(".tar.gz"),
+						}},
+						{K: []Ident{Ident("checksum")}, V: Val{String("4ASoWbxaA2FW7PAB0zzHDPC5XnNhyaAyjtDPpGzceSLeYnEIXsNYZR3PA_Zu5P0K")}},
+						{K: []Ident{Ident("compress")}, V: Val{Ident("gzip")}},
+					},
+				}}},
+				{K: []Ident{Ident("patches")}, V: Val{Array{
+					{String("musl-off64_t-loff_t.patch")},
+					{String("musl-legacy-lfs.patch")},
+				}}},
+
+				{K: []Ident{Ident("exclusive")}, V: Val{Ident("true")}},
+
+				{K: []Ident{Ident("exec")}, V: Val{Func{
+					Ident: Ident("make"),
+
+					Args: []Arg{
+						{K: []Ident{Ident("configure")}, V: Val{[]KV{
+							{K: String("disable-multilib")},
+							{K: String("enable-default-pie")},
+							{K: String("disable-nls")},
+							{K: String("with-gnu-as")},
+							{K: String("with-gnu-ld")},
+							{K: String("with-system-zlib")},
+							{K: String("enable-languages"), V: Val{String("c,c++,go")}},
+							{K: String("with-native-system-header-dir"), V: Val{String("/system/include")}},
+							{K: String("with-multilib-list"), V: Val{Func{
+								Ident: Ident("arch"),
+
+								Args: []Arg{
+									{K: []Ident{Ident("amd64"), Ident("arm64")}, V: Val{String("''")}},
+									{K: []Ident{Ident("default")}, V: Val{Ident("unset")}},
+								},
+							}}},
+						}}},
+						{K: []Ident{Ident("make")}, V: Val{Array{
+							{String("BOOT_CFLAGS='-O2 -g'")},
+							{
+								Func{Ident: Ident("noop"), Args: []Arg{{K: []Ident{Ident("key")}, V: Val{Ident("value")}}}},
+								String("\x00"),
+							},
+							{String("bootstrap")},
+						}}},
+
+						{K: []Ident{Ident("skip-check")}, V: Val{Ident("true")}},
+					},
+				}}},
+
+				{K: []Ident{Ident("inputs")}, V: Val{Array{
+					{Ident("binutils")},
+					{Ident("mpc")},
+					{Ident("zlib")},
+					{Ident("libucontext")},
+					{Ident("kernel-headers")},
+				}}},
+			},
+		}}, nil},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			p, err := Parse(strings.NewReader(tc.data))
+			if !reflect.DeepEqual(p, tc.want) {
+				t.Errorf("Parse: %#v, want %#v", p, tc.want)
+			}
+			if !reflect.DeepEqual(err, tc.err) {
+				t.Errorf("Parse: error = %v, want %v", err, tc.err)
+			}
+		})
+	}
+}
+
+func BenchmarkParse(b *testing.B) {
+	r := strings.NewReader(sample)
+	for b.Loop() {
+		if _, err := Parse(r); err != nil {
+			b.Fatal(err)
+		}
+
+		b.StopTimer()
+		r.Reset(sample)
+		b.StartTimer()
+	}
+}

internal/rosa/azalea/evaluate.go

@@ -0,0 +1,392 @@
+package azalea
+
+import (
+	"errors"
+	"fmt"
+	"maps"
+	"reflect"
+	"slices"
+	"unique"
+)
+
+// Value are types supported by the language.
+type Value interface {
+	bool | int64 | string | []string | []int64 | [][2]string
+}
+
+type (
+	// FArg is an argument passed to [F].
+	FArg struct {
+		K unique.Handle[Ident]
+		V any
+		R bool
+	}
+	// FArgs are arguments passed to [F].
+	FArgs []FArg
+
+	// PF implements the package declaration function.
+	PF func(name Ident, args FArgs) (v any, set bool, err error)
+
+	// F is the implementation of a [Func].
+	F struct {
+		F func(args FArgs) (v any, set bool, err error)
+		V map[unique.Handle[Ident]]any
+	}
+)
+
+// Apply applies named arguments and rejects unused arguments.
+func (args FArgs) Apply(v map[unique.Handle[Ident]]any) error {
+	for _, arg := range args {
+		if arg.V == nil {
+			// unset
+			continue
+		}
+
+		r, ok := v[arg.K]
+		if !ok {
+			if arg.R {
+				continue
+			}
+			return UndefinedError(arg.K.Value())
+		}
+		err := storeE(r, arg.V)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// A Frame refers to local variables and debugging information.
+type Frame struct {
+	// Local constants.
+	Val map[unique.Handle[Ident]]any
+	// Functions.
+	Func map[unique.Handle[Ident]]F
+}
+
+// UnsupportedExprError is an expression with invalid concrete type.
+type UnsupportedExprError struct{ E any }
+
+func (e UnsupportedExprError) Error() string {
+	return fmt.Sprintf("unsupported expression %#v", e.E)
+}
+
+// UndefinedError is an identifier not defined in any stack frame visible to the
+// expression containing it.
+type UndefinedError Ident
+
+func (e UndefinedError) Error() string {
+	return "undefined: " + string(e)
+}
+
+// evaluate is evaluateAny with a type parameter.
+func evaluate[T Value](d PF, s []Frame, expr any, rp *T) bool {
+	return evaluateAny(d, s, expr, rp)
+}
+
+// evaluateArray evaluates expr and returns its values as a slice.
+func evaluateArray[T Value](d PF, s []Frame, expr Array) []T {
+	r := make([]T, 0, len(expr))
+	for i := range expr {
+		var _r T
+		if evaluate(d, s, expr[i], &_r) {
+			r = append(r, _r)
+		}
+	}
+	return r
+}
+
+// TypeError is an unexpected type during evaluation.
+type TypeError struct {
+	Concrete, Asserted reflect.Type
+}
+
+func (e TypeError) Error() string {
+	return fmt.Sprintf("expected %s, got %s", e.Asserted, e.Concrete)
+}
+
+func (e TypeError) Is(err error) bool {
+	var v TypeError
+	return errors.As(err, &v) &&
+		e.Asserted == v.Asserted &&
+		e.Concrete == v.Concrete
+}
+
+// storeE is a convenience function to set the value of a result pointer.
+func storeE(rp any, r any) error {
+	pv := reflect.ValueOf(rp).Elem()
+	v := reflect.ValueOf(r)
+	pt, vt := pv.Type(), v.Type()
+	if !vt.AssignableTo(pt) {
+		return TypeError{vt, pt}
+	}
+	pv.Set(v)
+	return nil
+}
+
+// store is like storeE, but panics if error is non-nil.
+func store[T Value](rp any, r T) {
+	err := storeE(rp, r)
+	if err != nil {
+		panic(err)
+	}
+}
+
+// EvaluationError is an error and the expression it occurred in.
+type EvaluationError struct {
+	Expr any
+	Err  error
+}
+
+// Unwrap returns the underlying error.
+func (e EvaluationError) Unwrap() error { return e.Err }
+
+// Error returns a very long error description that should not be presented
+// to the user directly.
+func (e EvaluationError) Error() string {
+	return fmt.Sprintf("expression %#v: %v", e.Expr, e.Err)
+}
+
+var (
+	// IdentInputs is a special array argument in a package declaration whose
+	// values of [Ident] are kept as is when passed to a [PF].
+	IdentInputs = unique.Make(Ident("inputs"))
+	// IdentRuntime has the same semantics as [IdentInputs].
+	IdentRuntime = unique.Make(Ident("runtime"))
+	// IdentExtra has the same semantics as [IdentInputs].
+	IdentExtra = unique.Make(Ident("extra"))
+	// IdentSource is a special argument in a package declaration where an
+	// assignment of a [Val] with a single [Ident] passes through the evaluator.
+	IdentSource = unique.Make(Ident("source"))
+
+	// ErrInvalidSpecial is panicked for a special [PF] argument sharing its
+	// value or set for R.
+	ErrInvalidSpecial = errors.New("special must not be common or bound to scope")
+)
+
+// evaluateAny implements [Evaluate].
+func evaluateAny(d PF, s []Frame, expr, rp any) bool {
+	defer func() {
+		r := recover()
+		if r == nil {
+			return
+		}
+
+		err, ok := r.(error)
+		if !ok {
+			panic(r)
+		}
+
+		if _, ok = err.(EvaluationError); ok {
+			panic(err)
+		}
+		panic(EvaluationError{expr, err})
+	}()
+
+	switch e := expr.(type) {
+	case Int:
+		store(rp, int64(e))
+		return true
+
+	case String:
+		store(rp, string(e))
+		return true
+
+	case Ident:
+		var (
+			v  any
+			ok bool
+		)
+		for i := range s {
+			v, ok = s[len(s)-1-i].Val[unique.Make(e)]
+			if ok {
+				break
+			}
+		}
+		if !ok {
+			panic(UndefinedError(e))
+		}
+		if err := storeE(rp, v); err != nil {
+			panic(err)
+		}
+		return true
+
+	case Val:
+		if len(e) == 1 {
+			switch v := e[0].(type) {
+			case Ident:
+				switch v {
+				case "unset":
+					return false
+				case "true":
+					store(rp, true)
+					return true
+				case "false":
+					store(rp, false)
+					return true
+				default:
+					return evaluateAny(d, s, v, rp)
+				}
+
+			default:
+				return evaluateAny(d, s, e[0], rp)
+			}
+		}
+		var v string
+		for i := range e {
+			var _r string
+			if evaluate(d, s, e[i], &_r) {
+				v += _r
+			}
+		}
+		store(rp, v)
+		return true
+
+	case Array:
+		if len(e) > 0 && len(e[0]) == 1 {
+			if _, ok := e[0][0].(Int); ok {
+				store(rp, evaluateArray[int64](d, s, e))
+				return true
+			}
+		}
+		store(rp, evaluateArray[string](d, s, e))
+		return true
+
+	case []KV:
+		r := make([][2]string, 0, len(e))
+		for i := range e {
+			var _r string
+			if e[i].V == nil || evaluate(d, s, e[i].V, &_r) {
+				r = append(r, [2]string{string(e[i].K), _r})
+			}
+		}
+		store(rp, r)
+		return true
+
+	case Func:
+		var (
+			f  F
+			ok bool
+		)
+		if !e.Package {
+			for i := range s {
+				f, ok = s[len(s)-1-i].Func[unique.Make(e.Ident)]
+				if ok {
+					break
+				}
+			}
+			if !ok {
+				panic(UndefinedError(e.Ident))
+			}
+		}
+
+		argc := len(e.Args)
+		for _, arg := range e.Args {
+			argc += len(arg.K) - 1
+		}
+		fargs := make([]FArg, 0, len(e.Args))
+		s = append(s, Frame{})
+		fp := &s[len(s)-1]
+		if !e.Package {
+			fp.Val = maps.Clone(f.V)
+		}
+
+	args:
+		for _, arg := range e.Args {
+			names := make([]unique.Handle[Ident], len(arg.K))
+			for i, name := range arg.K {
+				names[i] = unique.Make(name)
+			}
+
+			farg := FArg{R: arg.R}
+			if e.Package {
+				for _, special := range [...]unique.Handle[Ident]{
+					IdentInputs,
+					IdentRuntime,
+					IdentExtra,
+				} {
+					if slices.Contains(names, special) {
+						if len(names) != 1 || len(arg.V) != 1 || arg.R {
+							panic(ErrInvalidSpecial)
+						}
+						farg.K = names[0]
+						if err := storeE(&farg.V, arg.V[0]); err != nil {
+							panic(err)
+						}
+						fargs = append(fargs, farg)
+						continue args
+					}
+				}
+
+				if slices.Contains(names, IdentSource) {
+					if len(names) != 1 || len(arg.V) != 1 || arg.R {
+						panic(ErrInvalidSpecial)
+					}
+					if _, ok = arg.V[0].(Ident); ok {
+						farg.K = names[0]
+						if err := storeE(&farg.V, arg.V[0]); err != nil {
+							panic(err)
+						}
+						fargs = append(fargs, farg)
+						continue args
+					}
+				}
+			}
+
+			if !evaluateAny(d, s, arg.V, &farg.V) {
+				farg.V = nil
+			}
+			for _, name := range names {
+				farg.K = name
+				fargs = append(fargs, farg)
+
+				if arg.R && farg.V != nil {
+					if fp.Val == nil {
+						fp.Val = make(map[unique.Handle[Ident]]any)
+					}
+					(*fp).Val[name] = farg.V
+				}
+			}
+		}
+
+		var (
+			v   any
+			err error
+		)
+		if !e.Package {
+			v, ok, err = f.F(fargs)
+		} else {
+			v, ok, err = d(e.Ident, fargs)
+		}
+		if err != nil {
+			panic(err)
+		} else if v != nil {
+			if err = storeE(rp, v); err != nil {
+				panic(err)
+			}
+		}
+		return ok
+
+	default:
+		panic(UnsupportedExprError{expr})
+	}
+}
+
+// Evaluate evaluates a statement and returns its value.
+func Evaluate[T any](d PF, s []Frame, expr any) (v T, set bool, err error) {
+	defer func() {
+		r := recover()
+		if r == nil {
+			return
+		}
+
+		_err, ok := r.(error)
+		if !ok {
+			panic(r)
+		}
+		err = _err
+	}()
+	set = evaluateAny(d, s, expr, &v)
+	return
+}

internal/rosa/azalea/evaluate_test.go

@@ -0,0 +1,407 @@
+package azalea_test
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+	"unique"
+
+	. "hakurei.app/internal/rosa/azalea"
+)
+
+// makeStackCheck creates a stack with a single frame with a single function "f"
+// which calls the check function internally.
+func makeStackCheck(check func(args FArgs) (any, error)) []Frame {
+	return []Frame{{Func: map[unique.Handle[Ident]]F{
+		unique.Make(Ident("f")): {F: func(
+			args FArgs,
+		) (v any, set bool, err error) {
+			set = true
+			v, err = check(args)
+			return
+		}},
+	}}}
+}
+
+// checkArgs is like makeStackCheck, but the resulting function asserts that its
+// args match the expected value.
+func checkArgs(want FArgs) []Frame {
+	return makeStackCheck(func(args FArgs) (any, error) {
+		if !reflect.DeepEqual(args, want) {
+			return nil, fmt.Errorf("%#v, want %#v", args, want)
+		}
+		return "\xfd", nil
+	})
+}
+
+func TestEvaluate(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name string
+		data string
+		s    []Frame
+		want any
+		err  error
+	}{
+		{"apply unset", `f { v = unset; }`, makeStackCheck(func(
+			args FArgs,
+		) (v any, err error) {
+			v = "\xfd"
+			err = args.Apply(map[unique.Handle[Ident]]any{
+				unique.Make(Ident("v")): &v,
+			})
+			return
+		}), "\xfd", nil},
+
+		{"apply bad type", `f { v = 9; }`, makeStackCheck(func(
+			args FArgs,
+		) (v any, err error) {
+			v = "\xfd"
+			err = args.Apply(map[unique.Handle[Ident]]any{
+				unique.Make(Ident("v")): &v,
+			})
+			return
+		}), "", TypeError{
+			Concrete: reflect.TypeFor[int64](),
+			Asserted: reflect.TypeFor[string](),
+		}},
+
+		{"apply undefined", `f { v = 9; }`, makeStackCheck(func(
+			args FArgs,
+		) (v any, err error) {
+			v = "\xfd"
+			err = args.Apply(map[unique.Handle[Ident]]any{})
+			return
+		}), "", EvaluationError{
+			Expr: Func{
+				Ident: Ident("f"),
+				Args: []Arg{
+					{K: []Ident{"v"}, V: Val{Int(9)}},
+				},
+			},
+			Err: UndefinedError("v"),
+		}},
+
+		{"apply bound undefined", `f { _v* = "\x00"; v = _v; }`, makeStackCheck(func(
+			args FArgs,
+		) (v any, err error) {
+			v = "\xfd"
+			err = args.Apply(map[unique.Handle[Ident]]any{
+				unique.Make(Ident("v")): &v,
+			})
+			return
+		}), "\x00", nil},
+
+		{"undefined function", `f {}`, nil, "", EvaluationError{
+			Expr: Func{Ident: "f"},
+			Err:  UndefinedError("f"),
+		}},
+
+		{"error wrap deep", `f { v = nil; }`, makeStackCheck(func(
+			FArgs,
+		) (any, error) {
+			panic("unreachable")
+		}), "", EvaluationError{
+			Expr: Ident("nil"),
+			Err:  UndefinedError("nil"),
+		}},
+
+		{"common inputs", `package name { inputs, v = []; }`, nil, "", EvaluationError{
+			Expr: Func{
+				Ident:   Ident("name"),
+				Package: true,
+
+				Args: []Arg{
+					{K: []Ident{
+						"inputs",
+						"v",
+					}, V: Val{Array(nil)}},
+				},
+			},
+			Err: ErrInvalidSpecial,
+		}},
+
+		{"bound inputs", `package name { inputs* = []; }`, nil, "", EvaluationError{
+			Expr: Func{
+				Ident:   Ident("name"),
+				Package: true,
+
+				Args: []Arg{
+					{K: []Ident{"inputs"}, V: Val{Array(nil)}, R: true},
+				},
+			},
+			Err: ErrInvalidSpecial,
+		}},
+
+		{"bound runtime", `package name { runtime* = []; }`, nil, "", EvaluationError{
+			Expr: Func{
+				Ident:   Ident("name"),
+				Package: true,
+
+				Args: []Arg{
+					{K: []Ident{"runtime"}, V: Val{Array(nil)}, R: true},
+				},
+			},
+			Err: ErrInvalidSpecial,
+		}},
+
+		{"concat inputs", `package name { inputs = ""+""; }`, nil, "", EvaluationError{
+			Expr: Func{
+				Ident:   Ident("name"),
+				Package: true,
+
+				Args: []Arg{
+					{K: []Ident{"inputs"}, V: Val{String(""), String("")}},
+				},
+			},
+			Err: ErrInvalidSpecial,
+		}},
+
+		{"concat source", `package name { source = ""+""; }`, nil, "", EvaluationError{
+			Expr: Func{
+				Ident:   Ident("name"),
+				Package: true,
+
+				Args: []Arg{
+					{K: []Ident{"source"}, V: Val{String(""), String("")}},
+				},
+			},
+			Err: ErrInvalidSpecial,
+		}},
+
+		{"source handle", `package name { source = name; }`, nil, FArgs{
+			{K: unique.Make(Ident("source")), V: Ident("name")},
+		}, nil},
+
+		{"integer array", `f { v = [ 0 ]; _v = [ 0, 9 ]; }`, checkArgs(FArgs{
+			{K: unique.Make(Ident("v")), V: []int64{0}},
+			{K: unique.Make(Ident("_v")), V: []int64{0, 9}},
+		}), "\xfd", nil},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			var expr Func
+			if e, err := Parse(strings.NewReader(tc.data)); err != nil {
+				t.Fatal(err)
+			} else if len(e) != 1 {
+				t.Fatalf("got expression %#v", e)
+			} else {
+				expr = e[0].(Func)
+			}
+			const rPackage = "\xff\xff\xff\xff"
+			r, set, err := Evaluate[string](func(
+				name Ident,
+				args FArgs,
+			) (v any, set bool, err error) {
+				v = rPackage
+				if !reflect.DeepEqual(args, tc.want) {
+					err = fmt.Errorf("%#v, want %#v", args, tc.want)
+				}
+				set = true
+				return
+			}, tc.s, expr)
+			if set != (err == nil) {
+				t.Error("Evaluate: unexpected unset")
+			}
+
+			if r != rPackage && r != tc.want {
+				t.Errorf("Evaluate: %q, want %q", r, tc.want)
+			}
+
+			var errEquals bool
+			if errors.As(err, new(TypeError)) {
+				errEquals = errors.Is(err, tc.err)
+			} else {
+				errEquals = reflect.DeepEqual(err, tc.err)
+			}
+			if !errEquals {
+				t.Errorf("Evaluate: error = %v, want %v", err, tc.err)
+			}
+		})
+	}
+}
+
+func TestEvaluateGCC(t *testing.T) {
+	t.Parallel()
+
+	var gcc Func
+	if e, err := Parse(strings.NewReader(sample)); err != nil {
+		t.Fatal(err)
+	} else {
+		gcc = e[0].(Func)
+	}
+
+	var got [3]FArgs
+	if r, set, err := Evaluate[string](func(
+		name Ident,
+		args FArgs,
+	) (v any, set bool, err error) {
+		v = "\x00"
+		set = true
+		got[0] = args
+		return
+	}, []Frame{{
+		Func: map[unique.Handle[Ident]]F{
+			unique.Make(Ident("remoteTar")): {F: func(
+				args FArgs,
+			) (v any, set bool, err error) {
+				var url, checksum string
+				var compress int
+				if err = args.Apply(map[unique.Handle[Ident]]any{
+					unique.Make(Ident("url")):      &url,
+					unique.Make(Ident("checksum")): &checksum,
+					unique.Make(Ident("compress")): &compress,
+				}); err != nil {
+					return
+				}
+
+				if compress != 0xcafe {
+					err = fmt.Errorf("unexpected compress %#v", compress)
+				}
+				set = true
+				v = url + "?checksum=" + checksum
+				return
+			}, V: map[unique.Handle[Ident]]any{
+				unique.Make(Ident("gzip")): 0xcafe,
+			}},
+
+			unique.Make(Ident("make")): {F: func(
+				args FArgs,
+			) (v any, set bool, err error) {
+				v = args
+				set = true
+				return
+			}},
+
+			unique.Make(Ident("arch")): {F: func(
+				args FArgs,
+			) (v any, set bool, err error) {
+				set = false
+				got[1] = args
+				return
+			}},
+
+			unique.Make(Ident("noop")): {F: func(
+				args FArgs,
+			) (v any, set bool, err error) {
+				set = false
+				set = true
+				got[2] = args
+				return
+			}, V: map[unique.Handle[Ident]]any{
+				unique.Make(Ident("value")): "\xfd",
+			}},
+		},
+	}}, gcc); err != nil {
+		t.Fatal(err)
+	} else if r != "\x00" {
+		t.Fatalf("package: %q", r)
+	} else if !set {
+		t.Fatal("package: unset")
+	}
+
+	want := [...]FArgs{
+		{
+			{K: unique.Make(Ident("description")), V: "The GNU Compiler Collection"},
+			{K: unique.Make(Ident("website")), V: "https://www.gnu.org/software/gcc"},
+			{K: unique.Make(Ident("anitya")), V: int64(6502)},
+
+			{K: unique.Make(Ident("version")), V: "16.1.0", R: true},
+			{K: unique.Make(Ident("source")), V: "https://ftp.tsukuba.wide.ad.jp/software/gcc/releases/gcc-16.1.0/gcc-16.1.0.tar.gz?checksum=4ASoWbxaA2FW7PAB0zzHDPC5XnNhyaAyjtDPpGzceSLeYnEIXsNYZR3PA_Zu5P0K"},
+			{K: unique.Make(Ident("patches")), V: []string{"musl-off64_t-loff_t.patch", "musl-legacy-lfs.patch"}},
+
+			{K: unique.Make(Ident("exclusive")), V: true},
+			{K: unique.Make(Ident("exec")), V: FArgs{
+				{K: unique.Make(Ident("configure")), V: [][2]string{
+					{"disable-multilib", ""},
+					{"enable-default-pie", ""},
+					{"disable-nls", ""},
+					{"with-gnu-as", ""},
+					{"with-gnu-ld", ""},
+					{"with-system-zlib", ""},
+					{"enable-languages", "c,c++,go"},
+					{"with-native-system-header-dir", "/system/include"},
+				}},
+				{K: unique.Make(Ident("make")), V: []string{
+					"BOOT_CFLAGS='-O2 -g'",
+					"\x00",
+					"bootstrap",
+				}},
+				{K: unique.Make(Ident("skip-check")), V: true},
+			}},
+
+			{K: unique.Make(Ident("inputs")), V: Array{
+				{Ident("binutils")},
+				{Ident("mpc")},
+				{Ident("zlib")},
+				{Ident("libucontext")},
+				{Ident("kernel-headers")},
+			}},
+		},
+		{
+			{K: unique.Make(Ident("amd64")), V: "''"},
+			{K: unique.Make(Ident("arm64")), V: "''"},
+			{K: unique.Make(Ident("default"))},
+		},
+		{{K: unique.Make(Ident("key")), V: "\xfd"}},
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("package: args = %#v, want %#v", got, want)
+	}
+}
+
+func BenchmarkEvaluate(b *testing.B) {
+	var gcc Func
+	if e, err := Parse(strings.NewReader(sample)); err != nil {
+		b.Fatal(err)
+	} else {
+		gcc = e[0].(Func)
+	}
+
+	s := []Frame{{
+		Func: map[unique.Handle[Ident]]F{
+			unique.Make(Ident("remoteTar")): {F: func(
+				FArgs,
+			) (v any, set bool, err error) {
+				return
+			}, V: map[unique.Handle[Ident]]any{
+				unique.Make(Ident("gzip")): 0xcafe,
+			}},
+
+			unique.Make(Ident("make")): {F: func(
+				FArgs,
+			) (v any, set bool, err error) {
+				return
+			}},
+
+			unique.Make(Ident("arch")): {F: func(
+				FArgs,
+			) (v any, set bool, err error) {
+				return
+			}},
+
+			unique.Make(Ident("noop")): {F: func(
+				FArgs,
+			) (v any, set bool, err error) {
+				return
+			}, V: map[unique.Handle[Ident]]any{
+				unique.Make(Ident("value")): "\xfd",
+			}},
+		},
+	}}
+	for b.Loop() {
+		if _, _, err := Evaluate[string](func(
+			Ident,
+			FArgs,
+		) (v any, set bool, err error) {
+			return
+		}, s, gcc); err != nil {
+			b.Fatal(err)
+		}
+	}
+}

internal/rosa/azalea/testdata/gcc.az

@@ -0,0 +1,57 @@
+package gcc {
+	description = "The GNU Compiler Collection";
+	website = "https://www.gnu.org/software/gcc";
+	anitya = 6502;
+
+	version* = "16.1.0";
+	source = remoteTar {
+		url = "https://ftp.tsukuba.wide.ad.jp/software/gcc/releases/"+
+			"gcc-"+version+"/gcc-"+version+".tar.gz";
+		checksum = "4ASoWbxaA2FW7PAB0zzHDPC5XnNhyaAyjtDPpGzceSLeYnEIXsNYZR3PA_Zu5P0K";
+		compress = gzip;
+	};
+	patches = [
+		"musl-off64_t-loff_t.patch",
+		"musl-legacy-lfs.patch",
+	];
+
+	// GCC spends most of its time in its many configure scripts, however
+	// it also saturates the CPU for a consequential amount of time.
+	exclusive = true;
+
+	exec = make {
+		configure = {
+			"disable-multilib";
+			"enable-default-pie";
+			"disable-nls";
+			"with-gnu-as";
+			"with-gnu-ld";
+			"with-system-zlib";
+			"enable-languages": "c,c++,go";
+			"with-native-system-header-dir": "/system/include";
+			"with-multilib-list": arch {
+				amd64, arm64 = "''";
+				default = unset;
+			};
+		};
+		make = [
+			"BOOT_CFLAGS='-O2 -g'",
+			noop { key = value; } + "\x00",
+			"bootstrap",
+		];
+
+		// This toolchain is hacked to pieces, it is not expected to ever work
+		// well in its current state. That does not matter as long as the
+		// toolchain it produces passes its own test suite.
+		skip-check = true;
+	};
+
+	inputs = [
+		binutils,
+
+		mpc,
+		zlib,
+		libucontext,
+		kernel-headers,
+	];
+}

internal/rosa/builtins.go

@@ -0,0 +1,106 @@
+package rosa
+
+import (
+	"path"
+	"slices"
+	"strconv"
+	"strings"
+
+	"hakurei.app/internal/pkg"
+)
+
+const (
+	// jobsE is expression for preferred job count set by [pkg].
+	jobsE = `"$` + pkg.EnvJobs + `"`
+	// jobsFlagE is expression for flag with preferred job count.
+	jobsFlagE = `"-j$` + pkg.EnvJobs + `"`
+	// jobsLE is expression for twice of preferred job count set by [pkg].
+	jobsLE = `"$(expr ` + jobsE + ` '*' 2)"`
+	// jobsLFlagE is expression for flag with double of preferred job count.
+	jobsLFlagE = `"-j$(expr ` + jobsE + ` '*' 2)"`
+)
+
+// newTar wraps [pkg.NewHTTPGetTar] with a simpler function signature.
+func newTar(url, checksum string, compression uint32) pkg.Artifact {
+	return pkg.NewHTTPGetTar(nil, url, mustDecode(checksum), compression)
+}
+
+// newFromCPAN is a helper for downloading release from CPAN.
+func newFromCPAN(author, name, version, checksum string) pkg.Artifact {
+	return newTar(
+		"https://cpan.metacpan.org/authors/id/"+
+			author[:1]+"/"+author[:2]+"/"+author+"/"+
+			name+"-"+version+".tar.gz",
+		checksum,
+		pkg.TarGzip,
+	)
+}
+
+// newFromGitLab is a helper for downloading source from GitLab.
+func newFromGitLab(domain, suffix, ref, checksum string) pkg.Artifact {
+	return newTar(
+		"https://"+domain+"/"+suffix+"/-/archive/"+
+			ref+"/"+path.Base(suffix)+"-"+
+			strings.ReplaceAll(ref, "/", "-")+".tar.bz2",
+		checksum,
+		pkg.TarBzip2,
+	)
+}
+
+// newFromGitHub is a helper for downloading source from Microsoft Github.
+func newFromGitHub(suffix, tag, checksum string) pkg.Artifact {
+	return newTar(
+		"https://github.com/"+suffix+
+			"/archive/refs/tags/"+tag+".tar.gz",
+		checksum,
+		pkg.TarGzip,
+	)
+}
+
+// newFromGitHubRelease is a helper for downloading release tarball from
+// Microsoft Github.
+func newFromGitHubRelease(
+	suffix, tag, name, checksum string,
+	compression uint32,
+) pkg.Artifact {
+	return newTar(
+		"https://github.com/"+suffix+
+			"/releases/download/"+tag+"/"+name,
+		checksum,
+		compression,
+	)
+}
+
+// skipGNUTests generates a string for skipping specific tests by number in a
+// GNU test suite. This is nontrivial because the test suite does not support
+// excluding tests in any way, so ranges for all but the skipped tests have to
+// be specified instead.
+//
+// For example, to skip test 764, ranges around the skipped test must be
+// specified:
+//
+//	1-763 765-
+//
+// Tests are numbered starting from 1. The resulting string is unquoted.
+func skipGNUTests(tests ...int64) string {
+	tests = slices.Clone(tests)
+	slices.Sort(tests)
+
+	var buf strings.Builder
+
+	if tests[0] != 1 {
+		buf.WriteString("1-")
+	}
+
+	for i, n := range tests {
+		if n != 1 && (i == 0 || tests[i-1] != n-1) {
+			buf.WriteString(strconv.Itoa(int(n - 1)))
+			buf.WriteString(" ")
+		}
+		if i == len(tests)-1 || tests[i+1] != n+1 {
+			buf.WriteString(strconv.Itoa(int(n + 1)))
+			buf.WriteString("-")
+		}
+	}
+	return buf.String()
+}

internal/rosa/builtins_test.go

@@ -11,18 +11,18 @@ func TestSkipGNUTests(t *testing.T) {
 	t.Parallel()
 
 	testCases := []struct {
-		tests []int
+		tests []int64
 		want  string
 	}{
-		{[]int{764}, "1-763 765-"},
+		{[]int64{764}, "1-763 765-"},
-		{[]int{764, 0xcafe, 37, 9}, "1-8 10-36 38-763 765-51965 51967-"},
+		{[]int64{764, 0xcafe, 37, 9}, "1-8 10-36 38-763 765-51965 51967-"},
-		{[]int{1, 2, 0xbed}, "3-3052 3054-"},
+		{[]int64{1, 2, 0xbed}, "3-3052 3054-"},
-		{[]int{3, 4}, "1-2 5-"},
+		{[]int64{3, 4}, "1-2 5-"},
 	}
 	for _, tc := range testCases {
 		t.Run(strings.Join(slices.Collect(func(yield func(string) bool) {
 			for _, n := range tc.tests {
-				yield(strconv.Itoa(n))
+				yield(strconv.Itoa(int(n)))
 			}
 		}), ","), func(t *testing.T) {
 			t.Parallel()

internal/rosa/busybox.go

@@ -5,7 +5,6 @@ import (
 	"io"
 	"net/http"
 	"os"
-	"runtime"
 	"time"
 
 	"hakurei.app/fhs"
@@ -86,13 +85,13 @@ func (a busyboxBin) Cure(t *pkg.TContext) (err error) {
 
 // newBusyboxBin returns a [pkg.Artifact] containing a busybox installation from
 // the https://busybox.net/downloads/binaries/ binary release.
-func newBusyboxBin() pkg.Artifact {
+func (s *S) newBusyboxBin() pkg.Artifact {
 	var version, url, checksum string
-	switch runtime.GOARCH {
+	switch s.arch {
 	case "amd64":
 		version = "1.35.0"
 		url = "https://busybox.net/downloads/binaries/" +
-			version + "-" + linuxArch() + "-linux-musl/busybox"
+			version + "-" + s.linuxArch() + "-linux-musl/busybox"
 		checksum = "L7OBIsPu9enNHn7FqpBT1kOg_mCLNmetSeNMA3i4Y60Z5jTgnlX3qX3zcQtLx5AB"
 	case "arm64":
 		version = "1.31.0"
@@ -101,11 +100,11 @@ func newBusyboxBin() pkg.Artifact {
 		checksum = "npJjBO7iwhjW6Kx2aXeSxf8kXhVgTCDChOZTTsI8ZfFfa3tbsklxRiidZQdrVERg"
 
 	default:
-		panic("unsupported target " + runtime.GOARCH)
+		panic("unsupported target " + s.arch)
 	}
 
 	return pkg.NewExec(
-		"busybox-bin-"+version, nil, pkg.ExecTimeoutMax, false,
+		"busybox-bin-"+version, s.arch, nil, pkg.ExecTimeoutMax, false, false,
 		fhs.AbsRoot, []string{
 			"PATH=/system/bin",
 		},

internal/rosa/bzip2.go

@@ -1,38 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newBzip2() (pkg.Artifact, string) {
-	const (
-		version  = "1.0.8"
-		checksum = "cTLykcco7boom-s05H1JVsQi1AtChYL84nXkg_92Dm1Xt94Ob_qlMg_-NSguIK-c"
-	)
-	return t.NewPackage("bzip2", version, newTar(
-		"https://sourceware.org/pub/bzip2/bzip2-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), &PackageAttr{
-		Writable:    true,
-		EnterSource: true,
-	}, &MakeHelper{
-		// uses source tree as scratch space
-		SkipConfigure: true,
-		SkipCheck:     true,
-		InPlace:       true,
-		Make: []string{
-			"CC=cc",
-		},
-		Install: "make PREFIX=/work/system install",
-	}), version
-}
-func init() {
-	artifactsM[Bzip2] = Metadata{
-		f: Toolchain.newBzip2,
-
-		Name:        "bzip2",
-		Description: "a freely available, patent free, high-quality data compressor",
-		Website:     "https://sourceware.org/bzip2/",
-
-		ID: 237,
-	}
-}

internal/rosa/cmake.go

@@ -4,118 +4,12 @@ import (
 	"path/filepath"
 	"slices"
 	"strings"
-
-	"hakurei.app/internal/pkg"
 )
 
-func (t Toolchain) newCMake() (pkg.Artifact, string) {
+var (
-	const (
+	_cmake = H("cmake")
-		version  = "4.3.2"
+	_ninja = H("ninja")
-		checksum = "6QylwRVKletndTSkZTV2YBRwgd_9rUVgav_QW23HpjUgV21AVYZOUOal8tdBDmO7"
+)
-	)
-	return t.NewPackage("cmake", version, newFromGitHubRelease(
-		"Kitware/CMake",
-		"v"+version,
-		"cmake-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), &PackageAttr{
-		// test suite expects writable source tree
-		Writable: true,
-
-		// expected to be writable in the copy made during bootstrap
-		Chmod: true,
-
-		Patches: []KV{
-			{"bootstrap-test-no-openssl", `diff --git a/Tests/BootstrapTest.cmake b/Tests/BootstrapTest.cmake
-index 137de78bc1..b4da52e664 100644
---- a/Tests/BootstrapTest.cmake
-+++ b/Tests/BootstrapTest.cmake
-@@ -9,7 +9,7 @@ if(NOT nproc EQUAL 0)
- endif()
- message(STATUS "running bootstrap: ${bootstrap} ${ninja_arg} ${parallel_arg}")
- execute_process(
--  COMMAND ${bootstrap} ${ninja_arg} ${parallel_arg}
-+  COMMAND ${bootstrap} ${ninja_arg} ${parallel_arg} -- -DCMAKE_USE_OPENSSL=OFF
-   WORKING_DIRECTORY "${bin_dir}"
-   RESULT_VARIABLE result
-   )
-`},
-
-			{"disable-broken-tests-musl", `diff --git a/Tests/CMakeLists.txt b/Tests/CMakeLists.txt
-index 2ead810437..f85cbb8b1c 100644
---- a/Tests/CMakeLists.txt
-+++ b/Tests/CMakeLists.txt
-@@ -384,7 +384,6 @@ if(BUILD_TESTING)
-     add_subdirectory(CMakeLib)
-   endif()
-   add_subdirectory(CMakeOnly)
--  add_subdirectory(RunCMake)
- 
-   add_subdirectory(FindPackageModeMakefileTest)
- 
-@@ -528,9 +527,6 @@ if(BUILD_TESTING)
-                                  -DCMake_TEST_CUDA:BOOL=${CMake_TEST_CUDA}
-                                  -DCMake_INSTALL_NAME_TOOL_BUG:BOOL=${CMake_INSTALL_NAME_TOOL_BUG}
-                                  )
--  ADD_TEST_MACRO(ExportImport ExportImport)
--  set_property(TEST ExportImport APPEND
--    PROPERTY LABELS "CUDA")
-   ADD_TEST_MACRO(Unset Unset)
-   ADD_TEST_MACRO(PolicyScope PolicyScope)
-   ADD_TEST_MACRO(EmptyLibrary EmptyLibrary)
-@@ -624,7 +620,6 @@ if(BUILD_TESTING)
-   # run test for BundleUtilities on supported platforms/compilers
-   if((MSVC OR
-       MINGW OR
--      CMAKE_SYSTEM_NAME MATCHES "Linux" OR
-       CMAKE_SYSTEM_NAME MATCHES "Darwin")
-     AND NOT CMAKE_GENERATOR STREQUAL "Watcom WMake")
- 
-@@ -3095,10 +3090,6 @@ if(BUILD_TESTING)
-     "${CMake_SOURCE_DIR}/Tests/CTestTestFdSetSize/test.cmake.in"
-     "${CMake_BINARY_DIR}/Tests/CTestTestFdSetSize/test.cmake"
-     @ONLY ESCAPE_QUOTES)
--  add_test(CTestTestFdSetSize ${CMAKE_CTEST_COMMAND}
--    -S "${CMake_BINARY_DIR}/Tests/CTestTestFdSetSize/test.cmake" -j20 -V --timeout 120
--    --output-log "${CMake_BINARY_DIR}/Tests/CTestTestFdSetSize/testOutput.log"
--    )
- 
-   if(CMAKE_TESTS_CDASH_SERVER)
-     set(regex "^([^:]+)://([^/]+)(.*)$")
-`},
-		},
-	}, &MakeHelper{
-		OmitDefaults: true,
-
-		ConfigureName: "/usr/src/cmake/bootstrap",
-		Configure: []KV{
-			{"prefix", "/system"},
-			{"parallel", jobsE},
-			{"--"},
-			{"-DCMAKE_USE_OPENSSL", "OFF"},
-			{"-DCMake_TEST_NO_NETWORK", "ON"},
-		},
-		Check: []string{
-			"CTEST_OUTPUT_ON_FAILURE=1",
-			"CTEST_PARALLEL_LEVEL=128",
-			"test",
-		},
-	},
-		KernelHeaders,
-	), version
-}
-func init() {
-	artifactsM[CMake] = Metadata{
-		f: Toolchain.newCMake,
-
-		Name:        "cmake",
-		Description: "cross-platform, open-source build system",
-		Website:     "https://cmake.org/",
-
-		ID: 306,
-	}
-}
 
 // CMakeHelper is the [CMake] build system helper.
 type CMakeHelper struct {
@@ -143,9 +37,9 @@ var _ Helper = new(CMakeHelper)
 // extra returns a hardcoded slice of [CMake] and [Ninja].
 func (attr *CMakeHelper) extra(int) P {
 	if attr != nil && attr.Make {
-		return P{CMake, Make}
+		return P{_cmake, _make}
 	}
-	return P{CMake, Ninja}
+	return P{_cmake, _ninja}
 }
 
 // wantsChmod returns false.
@@ -157,14 +51,11 @@ func (*CMakeHelper) wantsWrite() bool { return false }
 // scriptEarly returns the zero value.
 func (*CMakeHelper) scriptEarly() string { return "" }
 
-// createDir returns true.
-func (*CMakeHelper) createDir() bool { return true }
-
 // wantsDir returns a hardcoded, deterministic pathname.
-func (*CMakeHelper) wantsDir() string { return "/cure/" }
+func (*CMakeHelper) wantsDir() (string, bool) { return "/cure/", true }
 
 // script generates the cure script.
-func (attr *CMakeHelper) script(name string) string {
+func (attr *CMakeHelper) script(t Toolchain, name string) string {
 	if attr == nil {
 		attr = new(CMakeHelper)
 	}
@@ -180,7 +71,7 @@ func (attr *CMakeHelper) script(name string) string {
 	}
 
 	script := attr.Script
-	if !attr.SkipTest && presetOpts&OptSkipCheck == 0 {
+	if !attr.SkipTest && t.opts&OptSkipCheck == 0 {
 		script += "\n" + test
 	}
 

internal/rosa/curl.go

@@ -1,56 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newCurl() (pkg.Artifact, string) {
-	const (
-		version  = "8.19.0"
-		checksum = "YHuVLVVp8q_Y7-JWpID5ReNjq2Zk6t7ArHB6ngQXilp_R5l3cubdxu3UKo-xDByv"
-	)
-	return t.NewPackage("curl", version, newTar(
-		"https://curl.se/download/curl-"+version+".tar.bz2",
-		checksum,
-		pkg.TarBzip2,
-	), &PackageAttr{
-		// remove broken test
-		Writable: true,
-		ScriptEarly: `
-chmod +w tests/data && rm -f tests/data/test459
-`,
-	}, &MakeHelper{
-		Configure: []KV{
-			{"with-openssl"},
-			{"with-ca-bundle", "/system/etc/ssl/certs/ca-bundle.crt"},
-
-			{"disable-smb"},
-		},
-		Check: []string{
-			"TFLAGS=" + jobsLFlagE,
-			"test-nonflaky",
-		},
-	},
-		Perl,
-		Python,
-		PkgConfig,
-		Diffutils,
-
-		Libpsl,
-		OpenSSL,
-	), version
-}
-func init() {
-	artifactsM[Curl] = Metadata{
-		f: Toolchain.newCurl,
-
-		Name:        "curl",
-		Description: "command line tool and library for transferring data with URLs",
-		Website:     "https://curl.se/",
-
-		Dependencies: P{
-			Libpsl,
-			OpenSSL,
-		},
-
-		ID: 381,
-	}
-}

internal/rosa/dbus.go

@@ -1,81 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newDBus() (pkg.Artifact, string) {
-	const (
-		version  = "1.16.2"
-		checksum = "INwOuNdrDG7XW5ilW_vn8JSxEa444rRNc5ho97i84I1CNF09OmcFcV-gzbF4uCyg"
-	)
-	return t.NewPackage("dbus", version, newFromGitLab(
-		"gitlab.freedesktop.org",
-		"dbus/dbus",
-		"dbus-"+version,
-		checksum,
-	), &PackageAttr{
-		// OSError: [Errno 30] Read-only file system: '/usr/src/dbus/subprojects/packagecache'
-		Writable: true,
-		// PermissionError: [Errno 13] Permission denied: '/usr/src/dbus/subprojects/packagecache'
-		Chmod: true,
-	}, &MesonHelper{
-		Setup: []KV{
-			{"Depoll", "enabled"},
-			{"Dinotify", "enabled"},
-			{"Dx11_autolaunch", "disabled"},
-		},
-	},
-		GLib,
-		Libexpat,
-	), version
-}
-func init() {
-	artifactsM[DBus] = Metadata{
-		f: Toolchain.newDBus,
-
-		Name:        "dbus",
-		Description: "a message bus system",
-		Website:     "https://www.freedesktop.org/wiki/Software/dbus/",
-
-		Dependencies: P{
-			GLib,
-			Libexpat,
-		},
-
-		ID: 5356,
-	}
-}
-
-func (t Toolchain) newXDGDBusProxy() (pkg.Artifact, string) {
-	const (
-		version  = "0.1.7"
-		checksum = "UW5Pe-TP-XAaN-kTbxrkOQ7eYdmlAQlr2pdreLtPT0uwdAz-7rzDP8V_8PWuZBup"
-	)
-	return t.NewPackage("xdg-dbus-proxy", version, newFromGitHub(
-		"flatpak/xdg-dbus-proxy",
-		version,
-		checksum,
-	), nil, &MesonHelper{
-		Setup: []KV{
-			{"Dman", "disabled"},
-		},
-	},
-		DBus,
-
-		GLib,
-	), version
-}
-func init() {
-	artifactsM[XDGDBusProxy] = Metadata{
-		f: Toolchain.newXDGDBusProxy,
-
-		Name:        "xdg-dbus-proxy",
-		Description: "a filtering proxy for D-Bus connections",
-		Website:     "https://github.com/flatpak/xdg-dbus-proxy",
-
-		Dependencies: P{
-			GLib,
-		},
-
-		ID: 58434,
-	}
-}

internal/rosa/dtc.go

@@ -1,43 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newDTC() (pkg.Artifact, string) {
-	const (
-		version  = "1.7.2"
-		checksum = "vUoiRynPyYRexTpS6USweT5p4SVHvvVJs8uqFkkVD-YnFjwf6v3elQ0-Etrh00Dt"
-	)
-	return t.NewPackage("dtc", version, newTar(
-		"https://git.kernel.org/pub/scm/utils/dtc/dtc.git/snapshot/"+
-			"dtc-v"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), &PackageAttr{
-		// works around buggy test:
-		// fdtdump-runtest.sh /usr/src/dtc/tests/fdtdump.dts
-		Writable: true,
-		Chmod:    true,
-	}, &MesonHelper{
-		Setup: []KV{
-			{"Dyaml", "disabled"},
-			{"Dstatic-build", "true"},
-		},
-	},
-		Flex,
-		Bison,
-		M4,
-		Coreutils,
-		Diffutils,
-	), version
-}
-func init() {
-	artifactsM[DTC] = Metadata{
-		f: Toolchain.newDTC,
-
-		Name:        "dtc",
-		Description: "The Device Tree Compiler",
-		Website:     "https://git.kernel.org/pub/scm/utils/dtc/dtc.git/",
-
-		ID: 16911,
-	}
-}

internal/rosa/elfutils.go

@@ -1,59 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newElfutils() (pkg.Artifact, string) {
-	const (
-		version  = "0.195"
-		checksum = "JrGnBD38w8Mj0ZxDw3fKlRBFcLvRKu8rcYnX35R9yTlUSYnzTazyLboG-a2CsJlu"
-	)
-	return t.NewPackage("elfutils", version, newTar(
-		"https://sourceware.org/elfutils/ftp/"+
-			version+"/elfutils-"+version+".tar.bz2",
-		checksum,
-		pkg.TarBzip2,
-	), &PackageAttr{
-		Env: []string{
-			"CC=cc" +
-				// nonstandard glibc extension
-				" -DFNM_EXTMATCH=0",
-		},
-	}, &MakeHelper{
-		// nonstandard glibc extension
-		SkipCheck: true,
-
-		Configure: []KV{
-			{"enable-deterministic-archives"},
-		},
-	},
-		M4,
-		PkgConfig,
-
-		Zlib,
-		Bzip2,
-		Zstd,
-		ArgpStandalone,
-		MuslFts,
-		MuslObstack,
-		KernelHeaders,
-	), version
-}
-func init() {
-	artifactsM[Elfutils] = Metadata{
-		f: Toolchain.newElfutils,
-
-		Name:        "elfutils",
-		Description: "utilities and libraries to handle ELF files and DWARF data",
-		Website:     "https://sourceware.org/elfutils/",
-
-		Dependencies: P{
-			Zlib,
-			Bzip2,
-			Zstd,
-			MuslFts,
-			MuslObstack,
-		},
-
-		ID: 5679,
-	}
-}

internal/rosa/fakeroot.go

@@ -1,58 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newFakeroot() (pkg.Artifact, string) {
-	const (
-		version  = "1.37.2"
-		checksum = "4ve-eDqVspzQ6VWDhPS0NjW3aSenBJcPAJq_BFT7OOFgUdrQzoTBxZWipDAGWxF8"
-	)
-	return t.NewPackage("fakeroot", version, newFromGitLab(
-		"salsa.debian.org",
-		"clint/fakeroot",
-		"upstream/"+version,
-		checksum,
-	), &PackageAttr{
-		Patches: []KV{
-			{"remove-broken-docs", `diff --git a/doc/Makefile.am b/doc/Makefile.am
-index f135ad9..85c784c 100644
---- a/doc/Makefile.am
-+++ b/doc/Makefile.am
-@@ -1,5 +1,4 @@
- AUTOMAKE_OPTIONS=foreign
--SUBDIRS = de es fr nl pt ro sv
- 
- man_MANS = faked.1 fakeroot.1
- 
-`},
-		},
-
-		Env: []string{
-			"CONFIG_SHELL=/bin/sh",
-		},
-	}, &MakeHelper{
-		Generate: "./bootstrap",
-
-		// makes assumptions about /etc/passwd
-		SkipCheck: true,
-	},
-		Automake,
-		Libtool,
-		PkgConfig,
-
-		Attr,
-		Libcap,
-		KernelHeaders,
-	), version
-}
-func init() {
-	artifactsM[Fakeroot] = Metadata{
-		f: Toolchain.newFakeroot,
-
-		Name:        "fakeroot",
-		Description: "tool for simulating superuser privileges",
-		Website:     "https://salsa.debian.org/clint/fakeroot",
-
-		ID: 12048,
-	}
-}

internal/rosa/flex.go

@@ -1,32 +0,0 @@
-package rosa
-
-import (
-	"hakurei.app/internal/pkg"
-)
-
-func (t Toolchain) newFlex() (pkg.Artifact, string) {
-	const (
-		version  = "2.6.4"
-		checksum = "p9POjQU7VhgOf3x5iFro8fjhy0NOanvA7CTeuWS_veSNgCixIJshTrWVkc5XLZkB"
-	)
-	return t.NewPackage("flex", version, newFromGitHubRelease(
-		"westes/flex",
-		"v"+version,
-		"flex-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), nil, (*MakeHelper)(nil),
-		M4,
-	), version
-}
-func init() {
-	artifactsM[Flex] = Metadata{
-		f: Toolchain.newFlex,
-
-		Name:        "flex",
-		Description: "scanner generator for lexing in C and C++",
-		Website:     "https://github.com/westes/flex/",
-
-		ID: 819,
-	}
-}

internal/rosa/fuse.go

@@ -1,43 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newFuse() (pkg.Artifact, string) {
-	const (
-		version  = "3.18.2"
-		checksum = "iL-7b7eUtmlVSf5cSq0dzow3UiqSjBmzV3cI_ENPs1tXcHdktkG45j1V12h-4jZe"
-	)
-	return t.NewPackage("fuse", version, newFromGitHubRelease(
-		"libfuse/libfuse",
-		"fuse-"+version,
-		"fuse-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), nil, &MesonHelper{
-		Setup: []KV{
-			{"Ddefault_library", "both"},
-			{"Dtests", "true"},
-			{"Duseroot", "false"},
-			{"Dinitscriptdir", "/system/etc"},
-		},
-
-		ScriptCompiled: "python3 -m pytest test/",
-		// this project uses pytest
-		SkipTest: true,
-	},
-		PythonPyTest,
-
-		KernelHeaders,
-	), version
-}
-func init() {
-	artifactsM[Fuse] = Metadata{
-		f: Toolchain.newFuse,
-
-		Name:        "fuse",
-		Description: "the reference implementation of the Linux FUSE interface",
-		Website:     "https://github.com/libfuse/libfuse/",
-
-		ID: 861,
-	}
-}

internal/rosa/git.go

@@ -7,95 +7,10 @@ import (
 	"hakurei.app/internal/pkg"
 )
 
-func (t Toolchain) newGit() (pkg.Artifact, string) {
+var (
-	const (
+	_git       = H("git")
-		version  = "2.54.0"
+	_nssCACert = H("nss-cacert")
-		checksum = "7vGKtFOJGqY8DO4e8UMRax7dLgImXKQz5MMalec6MlgYrsarffSJjgOughwRFpSH"
+)
-	)
-	return t.NewPackage("git", version, newTar(
-		"https://www.kernel.org/pub/software/scm/git/"+
-			"git-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), &PackageAttr{
-		ScriptEarly: `
-ln -s ../../system/bin/perl /usr/bin/ || true
-
-# test suite assumes apache
-rm -f /system/bin/httpd
-`,
-
-		// uses source tree as scratch space
-		EnterSource: true,
-	}, &MakeHelper{
-		InPlace:  true,
-		Generate: "make configure",
-		ScriptMakeEarly: `
-function disable_test {
-	local test=$1 pattern=${2:-''}
-	if [ $# -eq 1 ]; then
-		rm "t/${test}.sh"
-	else
-		sed -i "t/${test}.sh" \
-			-e "/^\s*test_expect_.*$pattern/,/^\s*' *\$/{s/^/: #/}"
-	fi
-}
-
-disable_test t1800-hook
-disable_test t5319-multi-pack-index
-disable_test t1305-config-include
-disable_test t3900-i18n-commit
-disable_test t3507-cherry-pick-conflict
-disable_test t4201-shortlog
-disable_test t5303-pack-corruption-resilience
-disable_test t4301-merge-tree-write-tree
-disable_test t8005-blame-i18n
-disable_test t9350-fast-export
-disable_test t9300-fast-import
-disable_test t0211-trace2-perf
-disable_test t1517-outside-repo
-disable_test t2200-add-update
-`,
-		Check: []string{
-			"-C t",
-			`GIT_PROVE_OPTS="--jobs 32 --failures"`,
-			"prove",
-		},
-		Install: `make \
-	` + jobsFlagE + ` \
-	DESTDIR=/work \
-	NO_INSTALL_HARDLINKS=1 \
-	install`,
-	},
-		// test suite hangs on mksh
-		Bash,
-
-		Diffutils,
-		Autoconf,
-		Gettext,
-
-		Zlib,
-		Curl,
-		Libexpat,
-	), version
-}
-func init() {
-	artifactsM[Git] = Metadata{
-		f: Toolchain.newGit,
-
-		Name:        "git",
-		Description: "distributed version control system",
-		Website:     "https://www.git-scm.com/",
-
-		Dependencies: P{
-			Zlib,
-			Curl,
-			Libexpat,
-		},
-
-		ID: 5350,
-	}
-}
 
 // NewViaGit returns a [pkg.Artifact] for cloning a git repository.
 func (t Toolchain) NewViaGit(
@@ -105,9 +20,9 @@ func (t Toolchain) NewViaGit(
 	return t.New(strings.TrimSuffix(
 		path.Base(url),
 		".git",
-	)+"-src-"+path.Base(rev), 0, t.AppendPresets(nil,
+	)+"-src-"+path.Base(rev), THostNet, t.Append(nil,
-		NSSCACert,
+		_nssCACert,
-		Git,
+		_git,
 	), &checksum, nil, `
 git \
 	-c advice.detachedHead=false \

internal/rosa/glslang.go

@@ -1,190 +0,0 @@
-package rosa
-
-import (
-	"slices"
-	"strings"
-
-	"hakurei.app/internal/pkg"
-)
-
-func (t Toolchain) newSPIRVHeaders() (pkg.Artifact, string) {
-	const (
-		version  = "1.4.341.0"
-		checksum = "0PL43-19Iaw4k7_D8J8BvoJ-iLgCVSYZ2ThgDPGfAJwIJFtre7l0cnQtLjcY-JvD"
-	)
-	return t.NewPackage("spirv-headers", version, newFromGitHub(
-		"KhronosGroup/SPIRV-Headers",
-		"vulkan-sdk-"+version,
-		checksum,
-	), nil, &CMakeHelper{
-		// upstream has no tests
-		SkipTest: true,
-	}), version
-}
-func init() {
-	artifactsM[SPIRVHeaders] = Metadata{
-		f: Toolchain.newSPIRVHeaders,
-
-		Name:        "spirv-headers",
-		Description: "machine-readable files for the SPIR-V Registry",
-		Website:     "https://github.com/KhronosGroup/SPIRV-Headers",
-
-		ID: 230542,
-
-		// upstream changed version scheme, anitya incapable of filtering them
-		latest: func(v *Versions) string {
-			for _, s := range v.Stable {
-				fields := strings.SplitN(s, ".", 4)
-				if len(fields) != 4 {
-					continue
-				}
-				if slices.ContainsFunc(fields, func(f string) bool {
-					return slices.ContainsFunc([]byte(f), func(d byte) bool {
-						return d < '0' || d > '9'
-					})
-				}) {
-					continue
-				}
-				return s
-			}
-			return v.Latest
-		},
-	}
-}
-
-func (t Toolchain) newSPIRVTools() (pkg.Artifact, string) {
-	const (
-		version  = "2026.1"
-		checksum = "ZSQPQx8NltCDzQLk4qlaVxyWRWeI_JtsjEpeFt3kezTanl9DTHfLixSUCezMFBjv"
-	)
-	return t.NewPackage("spirv-tools", version, newFromGitHub(
-		"KhronosGroup/SPIRV-Tools",
-		"v"+version,
-		checksum,
-	), nil, &CMakeHelper{
-		Cache: []KV{
-			{"SPIRV-Headers_SOURCE_DIR", "/system"},
-		},
-	},
-		Python,
-
-		SPIRVHeaders,
-	), version
-}
-func init() {
-	artifactsM[SPIRVTools] = Metadata{
-		f: Toolchain.newSPIRVTools,
-
-		Name:        "spirv-tools",
-		Description: "an API and commands for processing SPIR-V modules",
-		Website:     "https://github.com/KhronosGroup/SPIRV-Tools",
-
-		Dependencies: P{
-			SPIRVHeaders,
-		},
-
-		ID: 14894,
-
-		latest: (*Versions).getStable,
-	}
-}
-
-func (t Toolchain) newGlslang() (pkg.Artifact, string) {
-	const (
-		version  = "16.2.0"
-		checksum = "6_UuF9reLRDaVkgO-9IfB3kMwme3lQZM8LL8YsJwPdUFkrjzxJtf2A9X3w9nFxj2"
-	)
-	return t.NewPackage("glslang", version, newFromGitHub(
-		"KhronosGroup/glslang",
-		version,
-		checksum,
-	), &PackageAttr{
-		// test suite writes to source
-		Writable: true,
-		Chmod:    true,
-	}, &CMakeHelper{
-		Cache: []KV{
-			{"BUILD_SHARED_LIBS", "ON"},
-			{"ALLOW_EXTERNAL_SPIRV_TOOLS", "ON"},
-		},
-	},
-		Python,
-		Bash,
-		Diffutils,
-
-		SPIRVTools,
-	), version
-}
-func init() {
-	artifactsM[Glslang] = Metadata{
-		f: Toolchain.newGlslang,
-
-		Name:        "glslang",
-		Description: "reference front end for GLSL/ESSL",
-		Website:     "https://github.com/KhronosGroup/glslang",
-
-		ID: 205796,
-	}
-}
-
-func (t Toolchain) newSPIRVLLVMTranslator() (pkg.Artifact, string) {
-	const (
-		version  = "22.1.2"
-		checksum = "JZAaV5ewYcm-35YA_U2BM2IcsQouZtX1BLZR0zh2vSlfEXMsT5OCtY4Gh5RJkcGy"
-	)
-	return t.NewPackage("spirv-llvm-translator", version, newFromGitHub(
-		"KhronosGroup/SPIRV-LLVM-Translator",
-		"v"+version, checksum,
-	), &PackageAttr{
-		Patches: []KV{
-			{"remove-early-prefix", `diff --git a/CMakeLists.txt b/CMakeLists.txt
-index c000a77e..86f79b03 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -172,5 +172,5 @@ install(
-   FILES
-     ${CMAKE_BINARY_DIR}/LLVMSPIRVLib.pc
-   DESTINATION
--    ${CMAKE_INSTALL_PREFIX}/lib${LLVM_LIBDIR_SUFFIX}/pkgconfig
-+    lib${LLVM_LIBDIR_SUFFIX}/pkgconfig
- )
-`},
-		},
-
-		// litArgs emits shell syntax
-		ScriptEarly: `
-export LIT_OPTS=` + litArgs(true,
-			// error: line 13: OpTypeCooperativeMatrixKHR Scope is limited to Workgroup and Subgroup
-			"cooperative_matrix_constant_null.spvasm") + `
-`,
-	}, &CMakeHelper{
-		Cache: []KV{
-			{"CMAKE_SKIP_BUILD_RPATH", "ON"},
-			{"BUILD_SHARED_LIBS", "ON"},
-			{"LLVM_SPIRV_ENABLE_LIBSPIRV_DIS", "ON"},
-			{"LLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR", "/system"},
-			{"LLVM_EXTERNAL_LIT", "/system/bin/lit"},
-			{"LLVM_INCLUDE_TESTS", "ON"},
-		},
-	},
-		Bash,
-		LIT,
-
-		SPIRVTools,
-	), version
-}
-func init() {
-	artifactsM[SPIRVLLVMTranslator] = Metadata{
-		f: Toolchain.newSPIRVLLVMTranslator,
-
-		Name:        "spirv-llvm-translator",
-		Description: "bi-directional translation between SPIR-V and LLVM IR",
-		Website:     "https://github.com/KhronosGroup/SPIRV-LLVM-Translator",
-
-		Dependencies: P{
-			SPIRVTools,
-		},
-
-		ID: 227273,
-	}
-}

internal/rosa/go.go

@@ -1,91 +1,118 @@
 package rosa
 
 import (
-	"runtime"
 	"slices"
 
 	"hakurei.app/internal/pkg"
 )
 
-// newGoBootstrap returns the Go bootstrap toolchain.
+var _go = H("go")
-func (t Toolchain) newGoBootstrap() pkg.Artifact {
-	const checksum = "8o9JL_ToiQKadCTb04nvBDkp8O1xiWOolAxVEqaTGodieNe4lOFEjlOxN3bwwe23"
-	return t.New("go1.4-bootstrap", 0, t.AppendPresets(nil,
-		Bash,
-	), nil, []string{
-		"CGO_ENABLED=0",
-	}, `
-mkdir -p /var/tmp/ /work/system/
-cp -r /usr/src/go /work/system/
-cd /work/system/go/src
-chmod -R +w ..
-
-./make.bash
-`, pkg.Path(AbsUsrSrc.Append("go"), false, newTar(
-		"https://dl.google.com/go/go1.4-bootstrap-20171003.tar.gz",
-		checksum,
-		pkg.TarGzip,
-	)))
-}
 
 // newGo returns a specific version of the Go toolchain.
 func (t Toolchain) newGo(
 	version, checksum string,
 	env []string,
 	script string,
-	extra ...pkg.Artifact,
+	boot pkg.Artifact,
 ) pkg.Artifact {
-	return t.New("go"+version, 0, t.AppendPresets(extra,
+	return t.NewPackage("go", version, newTar(
-		Bash,
+		"https://go.dev/dl/go"+version+".src.tar.gz",
-	), nil, slices.Concat([]string{
+		checksum,
-		"CC=cc",
+		pkg.TarGzip,
-		"GOCACHE=/tmp/gocache",
+	), &PackageAttr{
-		"GOROOT_BOOTSTRAP=/system/go",
+		EnterSource: true,
-		"TMPDIR=/dev/shm/go",
+		Env: slices.Concat([]string{
-	}, env), `
+			"CC=cc",
-mkdir /work/system "${TMPDIR}"
+			"GOCACHE=/tmp/gocache",
-cp -r /usr/src/go /work/system
+			"GOROOT_BOOTSTRAP=/system/go",
-cd /work/system/go/src
+			"TMPDIR=/dev/shm/go",
+		}, env),
+
+		Extra: []pkg.Artifact{boot},
+	}, &GenericHelper{
+		InPlace: true,
+		Build: `
+mkdir /work/system/ "${TMPDIR}"
+cp -r . /work/system/go
+cd /work/system/go/src/
 chmod -R +w ..
-`+script+`
+` + script + `
-./all.bash
+set +u
+. ./make.bash "$@" --no-banner
+set -u
+`,
+		Check: "bash run.bash --no-rebuild\n",
+		Install: `
+../bin/go tool dist banner # print build info
 
 mkdir /work/system/bin
 ln -s \
 	../go/bin/go \
 	../go/bin/gofmt \
 	/work/system/bin
-`, pkg.Path(AbsUsrSrc.Append("go"), false, newTar(
+`,
-		"https://go.dev/dl/go"+version+".src.tar.gz",
+	},
-		checksum,
+		_bash,
-		pkg.TarGzip,
+	)
-	)))
 }
 
-func (t Toolchain) newGoLatest() (pkg.Artifact, string) {
+func init() {
-	var (
+	const (
-		bootstrapEnv   []string
+		version  = "1.26.3"
-		bootstrapExtra []pkg.Artifact
+		checksum = "lEiFocZFnN5fKvZzmwVdqc9pYUjAuhzqZGbuiOqxUP4XdcY8yECisKcqsQ_eNn1N"
-
-		finalEnv []string
 	)
-	switch runtime.GOARCH {
+	meta := Metadata{
-	case "amd64":
+		Name:        "go",
-		bootstrapExtra = append(bootstrapExtra, t.newGoBootstrap())
+		Description: "the Go programming language toolchain",
+		Website:     "https://go.dev",
+		Version:     version,
 
-	case "arm64", "riscv64":
+		ID: 1227,
-		bootstrapEnv = append(bootstrapEnv, "GOROOT_BOOTSTRAP=/system")
-		bootstrapExtra = t.AppendPresets(bootstrapExtra, gcc)
-		finalEnv = append(finalEnv, "CGO_ENABLED=0")
-
-	default:
-		panic("unsupported target " + runtime.GOARCH)
 	}
+	native.MustRegister(meta.Name, func(t Toolchain) (*Metadata, pkg.Artifact) {
+		var (
+			bootstrapEnv   []string
+			bootstrapEarly pkg.Artifact
 
-	go119 := t.newGo(
+			finalEnv []string
-		"1.19",
+		)
-		"9_e0aFHsIkVxWVGsp9T2RvvjOc3p4n9o9S8tkNe9Cvgzk_zI2FhRQB7ioQkeAAro",
+		switch t.arch {
-		append(bootstrapEnv, "CGO_ENABLED=0"), `
+		case "amd64":
+			bootstrapEarly = t.NewPackage("go", "1.4-bootstrap", newTar(
+				"https://dl.google.com/go/go1.4-bootstrap-20171003.tar.gz",
+				"8o9JL_ToiQKadCTb04nvBDkp8O1xiWOolAxVEqaTGodieNe4lOFEjlOxN3bwwe23",
+				pkg.TarGzip,
+			), &PackageAttr{
+				EnterSource: true,
+				Env: []string{
+					"CGO_ENABLED=0",
+				},
+			}, &GenericHelper{
+				InPlace: true,
+				Build: `
+mkdir /work/system/
+cp -r . /work/system/go
+cd /work/system/go/src/
+mkdir -p /var/tmp/
+./make.bash
+`,
+			},
+				_bash,
+			)
+
+		case "arm64", "riscv64":
+			bootstrapEnv = append(bootstrapEnv, "GOROOT_BOOTSTRAP=/system")
+			_, bootstrapEarly = t.MustLoad(H("gcc"))
+			finalEnv = append(finalEnv, "CGO_ENABLED=0")
+
+		default:
+			panic("unsupported target " + t.arch)
+		}
+
+		go119 := t.newGo(
+			"1.19",
+			"9_e0aFHsIkVxWVGsp9T2RvvjOc3p4n9o9S8tkNe9Cvgzk_zI2FhRQB7ioQkeAAro",
+			append(bootstrapEnv, "CGO_ENABLED=0"), `
 rm \
 	crypto/tls/handshake_client_test.go \
 	cmd/pprof/pprof_test.go \
@@ -96,15 +123,15 @@ sed -i \
 echo \
 	'type syscallDescriptor = int' >> \
 	os/rawconn_test.go
-`, bootstrapExtra...)
+`, bootstrapEarly)
 
-	go121 := t.newGo(
+		go121 := t.newGo(
-		"1.21.13",
+			"1.21.13",
-		"YtrDka402BOAEwywx03Vz4QlVwoBiguJHzG7PuythMCPHXS8CVMLvzmvgEbu4Tzu",
+			"YtrDka402BOAEwywx03Vz4QlVwoBiguJHzG7PuythMCPHXS8CVMLvzmvgEbu4Tzu",
-		[]string{"CGO_ENABLED=0"}, `
+			[]string{"CGO_ENABLED=0"}, `
 sed -i \
-	's,/lib/ld-musl-`+linuxArch()+`.so.1,/system/bin/linker,' \
+	's,/lib/ld-musl-`+t.linuxArch()+`.so.1,/system/bin/linker,' \
-	cmd/link/internal/`+runtime.GOARCH+`/obj.go
+	cmd/link/internal/`+t.arch+`/obj.go
 
 rm \
 	crypto/tls/handshake_client_test.go \
@@ -114,43 +141,39 @@ echo \
 	'type syscallDescriptor = int' >> \
 	os/rawconn_test.go
 `, go119,
-	)
+		)
 
-	go123 := t.newGo(
+		go123 := t.newGo(
-		"1.23.12",
+			"1.23.12",
-		"wcI32bl1tkqbgcelGtGWPI4RtlEddd-PTd76Eb-k7nXA5LbE9yTNdIL9QSOOxMOs",
+			"wcI32bl1tkqbgcelGtGWPI4RtlEddd-PTd76Eb-k7nXA5LbE9yTNdIL9QSOOxMOs",
-		[]string{"CGO_ENABLED=0"}, `
+			[]string{"CGO_ENABLED=0"}, `
 sed -i \
-	's,/lib/ld-musl-`+linuxArch()+`.so.1,/system/bin/linker,' \
+	's,/lib/ld-musl-`+t.linuxArch()+`.so.1,/system/bin/linker,' \
-	cmd/link/internal/`+runtime.GOARCH+`/obj.go
+	cmd/link/internal/`+t.arch+`/obj.go
 `, go121,
-	)
+		)
 
-	go125 := t.newGo(
+		go125 := t.newGo(
-		"1.25.9",
+			"1.25.10",
-		"gShJb9uOMk5AxqPSwvn53ZO56S6PyP6nfojzrHUiJ3krAvrgjJpYa6-DPA-jxbpN",
+			"TwKwatkpwal-j9U2sDSRPEdM3YesI4Gm88YgGV59wtU-L85K9gA7UPy9SCxn6PMb",
-		[]string{"CGO_ENABLED=0"}, `
+			[]string{"CGO_ENABLED=0"}, `
 sed -i \
-	's,/lib/ld-musl-`+linuxArch()+`.so.1,/system/bin/linker,' \
+	's,/lib/ld-musl-`+t.linuxArch()+`.so.1,/system/bin/linker,' \
-	cmd/link/internal/`+runtime.GOARCH+`/obj.go
+	cmd/link/internal/`+t.arch+`/obj.go
 
 rm \
 	os/root_unix_test.go \
 	net/smtp/smtp_test.go
 `, go123,
-	)
+		)
 
-	const (
+		return &meta, t.newGo(
-		version  = "1.26.2"
+			version,
-		checksum = "v-6BE89_1g3xYf-9oIYpJKFXlo3xKHYJj2_VGkaUq8ZVkIVQmLwrto-xGG03OISH"
+			checksum,
-	)
+			finalEnv, `
-	return t.newGo(
-		version,
-		checksum,
-		finalEnv, `
 sed -i \
-	's,/lib/ld-musl-`+linuxArch()+`.so.1,/system/bin/linker,' \
+	's,/lib/ld-musl-`+t.linuxArch()+`.so.1,/system/bin/linker,' \
-	cmd/link/internal/`+runtime.GOARCH+`/obj.go
+	cmd/link/internal/`+t.arch+`/obj.go
 sed -i \
 	's/cpu.X86.HasAVX512VBMI/& \&\& cpu.X86.HasPOPCNT/' \
 	internal/runtime/gc/scan/scan_amd64.go
@@ -160,16 +183,7 @@ rm \
 	cmd/cgo/internal/testsanitizers/tsan_test.go \
 	cmd/cgo/internal/testsanitizers/cshared_test.go
 `, go125,
-	), version
+		)
-}
-func init() {
-	artifactsM[Go] = Metadata{
-		f: Toolchain.newGoLatest,
 
-		Name:        "go",
+	})
-		Description: "the Go programming language toolchain",
-		Website:     "https://go.dev/",
-
-		ID: 1227,
-	}
 }

internal/rosa/gtk.go

@@ -1,60 +0,0 @@
-package rosa
-
-import (
-	"hakurei.app/fhs"
-	"hakurei.app/internal/pkg"
-)
-
-func (t Toolchain) newGLib() (pkg.Artifact, string) {
-	const (
-		version  = "2.88.0"
-		checksum = "T79Cg4z6j-sDZ2yIwvbY4ccRv2-fbwbqgcw59F5NQ6qJT6z4v261vbYp3dHO6Ma3"
-	)
-	return t.NewPackage("glib", version, t.newTagRemote(
-		"https://gitlab.gnome.org/GNOME/glib.git",
-		version, checksum,
-	), &PackageAttr{
-		Paths: []pkg.ExecPath{
-			pkg.Path(fhs.AbsEtc.Append(
-				"machine-id",
-			), false, pkg.NewFile(
-				"glib-machine-id",
-				[]byte("ffffffffffffffffffffffffffffffff\n"),
-			)),
-			pkg.Path(AbsSystem.Append(
-				"var/lib/dbus/machine-id",
-			), false, pkg.NewFile(
-				"glib-machine-id",
-				[]byte("fefefefefefefefefefefefefefefefe\n"),
-			)),
-		},
-	}, &MesonHelper{
-		Setup: []KV{
-			{"Ddefault_library", "both"},
-		},
-	},
-		PythonPackaging,
-		Bash,
-
-		PCRE2,
-		Libffi,
-		Zlib,
-	), version
-}
-func init() {
-	artifactsM[GLib] = Metadata{
-		f: Toolchain.newGLib,
-
-		Name:        "glib",
-		Description: "the GNU library of miscellaneous stuff",
-		Website:     "https://developer.gnome.org/glib/",
-
-		Dependencies: P{
-			PCRE2,
-			Libffi,
-			Zlib,
-		},
-
-		ID: 10024,
-	}
-}

internal/rosa/hakurei.go

@@ -1,109 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newHakurei(
-	suffix, script string,
-	withHostname bool,
-) pkg.Artifact {
-	hostname := `
-echo 'Building test helper (hostname).'
-go build -o /bin/hostname /usr/src/hostname/main.go
-`
-	if !withHostname {
-		hostname = ""
-	}
-
-	return t.New("hakurei"+suffix+"-"+hakureiVersion, 0, t.AppendPresets(nil,
-		Go,
-		PkgConfig,
-
-		// dist tarball
-		Gzip,
-
-		// statically linked
-		Libseccomp,
-		ACL,
-		Fuse,
-		XCB,
-		Wayland,
-		WaylandProtocols,
-
-		KernelHeaders,
-	), nil, []string{
-		"CGO_ENABLED=1",
-		"GOCACHE=/tmp/gocache",
-		"CC=clang -O3 -Werror",
-	}, hostname+`
-cd /usr/src/hakurei
-
-HAKUREI_VERSION='v`+hakureiVersion+`'
-`+script, pkg.Path(AbsUsrSrc.Append("hakurei"), true, t.NewPatchedSource(
-		"hakurei", hakureiVersion, hakureiSource, false, hakureiPatches...,
-	)), pkg.Path(AbsUsrSrc.Append("hostname", "main.go"), false, pkg.NewFile(
-		"hostname.go",
-		[]byte(`
-package main
-
-import "os"
-
-func main() {
-	if name, err := os.Hostname(); err != nil {
-		panic(err)
-	} else {
-		os.Stdout.WriteString(name)
-	}
-}
-`),
-	)))
-}
-func init() {
-	artifactsM[Hakurei] = Metadata{
-		f: func(t Toolchain) (pkg.Artifact, string) {
-			return t.newHakurei("", `
-mkdir -p /work/system/libexec/hakurei/
-
-echo '# Building hakurei.'
-go generate -v ./...
-go build -trimpath -v -tags=rosa -o /work/system/libexec/hakurei -ldflags="-s -w
-	-buildid=
-	-linkmode external
-	-extldflags=-static
-	-X hakurei.app/internal/info.buildVersion=${HAKUREI_VERSION}
-	-X hakurei.app/internal/info.hakureiPath=/system/bin/hakurei
-	-X hakurei.app/internal/info.hsuPath=/system/bin/hsu
-	-X main.hakureiPath=/system/bin/hakurei
-" ./...
-echo
-
-echo '# Testing hakurei.'
-go test -ldflags='-buildid= -linkmode external -extldflags=-static' ./...
-echo
-
-mkdir -p /work/system/bin/
-(cd /work/system/libexec/hakurei && mv \
-	hakurei \
-	sharefs \
-	../../bin/)
-`, true), hakureiVersion
-		},
-
-		Name:        "hakurei",
-		Description: "low-level userspace tooling for Rosa OS",
-		Website:     "https://hakurei.app/",
-
-		ID: 388834,
-	}
-	artifactsM[HakureiDist] = Metadata{
-		f: func(t Toolchain) (pkg.Artifact, string) {
-			return t.newHakurei("-dist", `
-export HAKUREI_VERSION
-DESTDIR=/work /usr/src/hakurei/all.sh
-`, true), hakureiVersion
-		},
-
-		Name:        "hakurei-dist",
-		Description: "low-level userspace tooling for Rosa OS (distribution tarball)",
-		Website:     "https://hakurei.app/",
-	}
-}

internal/rosa/hakurei_current.go

@@ -1,26 +0,0 @@
-//go:build current
-
-package rosa
-
-import (
-	_ "embed"
-
-	"hakurei.app/internal/pkg"
-)
-
-const hakureiVersion = "1.0-current"
-
-// hakureiSourceTarball is a compressed tarball of the hakurei source code.
-//
-//go:generate tar -zc -C ../.. --exclude .git --exclude *.tar.gz -f hakurei_current.tar.gz .
-//go:embed hakurei_current.tar.gz
-var hakureiSourceTarball []byte
-
-// hakureiSource is the source code at the time this package is compiled.
-var hakureiSource = pkg.NewTar(pkg.NewFile(
-	"hakurei-current.tar.gz",
-	hakureiSourceTarball,
-), pkg.TarGzip)
-
-// hakureiPatches are patches applied against the compile-time source tree.
-var hakureiPatches []KV

internal/rosa/hakurei_release.go

@@ -1,18 +0,0 @@
-//go:build !current
-
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-const hakureiVersion = "0.4.0"
-
-// hakureiSource is the source code of a hakurei release.
-var hakureiSource = newTar(
-	"https://git.gensokyo.uk/rosa/hakurei/archive/"+
-		"v"+hakureiVersion+".tar.gz",
-	"wfQ9DqCW0Fw9o91wj-I55waoqzB-UqzzuC0_2h-P-1M78SgZ1WHSPCDJMth6EyC2",
-	pkg.TarGzip,
-)
-
-// hakureiPatches are patches applied against a hakurei release.
-var hakureiPatches []KV

internal/rosa/images.go

@@ -6,70 +6,46 @@ import (
 )
 
 func init() {
-	artifactsM[EarlyInit] = Metadata{
+	meta := Metadata{
-		Name:        "earlyinit",
-		Description: "Rosa OS initramfs init program",
-
-		f: func(t Toolchain) (pkg.Artifact, string) {
-			return t.newHakurei("-early-init", `
-mkdir -p /work/system/libexec/hakurei/
-
-echo '# Building earlyinit.'
-go build -trimpath -v -o /work/system/libexec/hakurei -ldflags="-s -w
-	-buildid=
-	-linkmode external
-	-extldflags=-static
-	-X hakurei.app/internal/info.buildVersion=${HAKUREI_VERSION}
-" ./cmd/earlyinit
-echo
-`, false), Unversioned
-		},
-	}
-}
-
-func (t Toolchain) newImageSystem() (pkg.Artifact, string) {
-	return t.New("system.img", TNoToolchain, t.AppendPresets(nil,
-		SquashfsTools,
-	), nil, nil, `
-mksquashfs /mnt/system /work/system.img
-`, pkg.Path(fhs.AbsRoot.Append("mnt"), false, t.AppendPresets(nil,
-		Musl,
-		Mksh,
-		Toybox,
-
-		Kmod,
-		Kernel,
-		Firmware,
-	)...)), Unversioned
-}
-func init() {
-	artifactsM[ImageSystem] = Metadata{
 		Name:        "system-image",
 		Description: "Rosa OS system image",
-
+		Version:     Unversioned,
-		f: Toolchain.newImageSystem,
 	}
+	native.MustRegister(meta.Name, func(t Toolchain) (*Metadata, pkg.Artifact) {
+		return &meta, t.New("system.img", TNoToolchain, t.Append(nil,
+			H("squashfs-tools"),
+		), nil, nil, `
+mksquashfs /mnt/system /work/system.img
+`, pkg.Path(fhs.AbsRoot.Append("mnt"), false, t.Append(nil,
+			_musl,
+			_mksh,
+			_toybox,
+
+			H("kmod"),
+			H("kernel"),
+			H("firmware"),
+		)...))
+	})
 }
 
-func (t Toolchain) newImageInitramfs() (pkg.Artifact, string) {
+func init() {
-	return t.New("initramfs", TNoToolchain, t.AppendPresets(nil,
+	meta := Metadata{
-		Zstd,
+		Name:        "initramfs-image",
-		EarlyInit,
+		Description: "Rosa OS initramfs image",
-		GenInitCPIO,
+		Version:     Unversioned,
-	), nil, nil, `
+	}
+	native.MustRegister(meta.Name, func(t Toolchain) (*Metadata, pkg.Artifact) {
+		return &meta, t.New("initramfs", TNoToolchain, t.Append(nil,
+			_zstd,
+			H("earlyinit"),
+			H("gen_init_cpio"),
+		), nil, nil, `
 gen_init_cpio -t 4294967295 -c /usr/src/initramfs | zstd > /work/initramfs.zst
 `, pkg.Path(AbsUsrSrc.Append("initramfs"), false, pkg.NewFile("initramfs", []byte(`
 dir /dev 0755 0 0
 nod /dev/null 0666 0 0 c 1 3
 nod /dev/console 0600 0 0 c 5 1
 file /init /system/libexec/hakurei/earlyinit 0555 0 0
-`)))), Unversioned
+`))))
-}
+	})
-func init() {
-	artifactsM[ImageInitramfs] = Metadata{
-		Name:        "initramfs-image",
-		Description: "Rosa OS initramfs image",
-
-		f: Toolchain.newImageInitramfs,
-	}
 }

internal/rosa/kernel_amd64.go

@@ -1,8 +0,0 @@
-package rosa
-
-import _ "embed"
-
-//go:embed kernel_amd64.config
-var kernelConfig []byte
-
-const kernelName = "bzImage"

internal/rosa/kernel_arm64.go

@@ -1,8 +0,0 @@
-package rosa
-
-import _ "embed"
-
-//go:embed kernel_arm64.config
-var kernelConfig []byte
-
-const kernelName = "vmlinuz.efi"

internal/rosa/kernel_riscv64.go

@@ -1,8 +0,0 @@
-package rosa
-
-import _ "embed"
-
-//go:embed kernel_riscv64.config
-var kernelConfig []byte
-
-const kernelName = "bzImage"

internal/rosa/kmod.go

@@ -1,50 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newKmod() (pkg.Artifact, string) {
-	const (
-		version  = "34.2"
-		checksum = "0K7POeTKxMhExsaTsnKAC6LUNsRSfe6sSZxWONPbOu-GI_pXOw3toU_BIoqfBhJV"
-	)
-	return t.NewPackage("kmod", version, newTar(
-		"https://www.kernel.org/pub/linux/utils/kernel/"+
-			"kmod/kmod-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), nil, &MesonHelper{
-		Setup: []KV{
-			{"Dmoduledir", "/system/lib/modules"},
-			{"Dsysconfdir", "/system/etc"},
-			{"Dbashcompletiondir", "no"},
-			{"Dfishcompletiondir", "no"},
-			{"Dxz", "disabled"},
-			{"Dmanpages", "false"},
-		},
-
-		// makes assumptions about the running kernel
-		SkipTest: true,
-	},
-		Zlib,
-		Zstd,
-		OpenSSL,
-		KernelHeaders,
-	), version
-}
-func init() {
-	artifactsM[Kmod] = Metadata{
-		f: Toolchain.newKmod,
-
-		Name:        "kmod",
-		Description: "a set of tools to handle common tasks with Linux kernel modules",
-		Website:     "https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git",
-
-		Dependencies: P{
-			Zlib,
-			Zstd,
-			OpenSSL,
-		},
-
-		ID: 1517,
-	}
-}

internal/rosa/libbsd.go

@@ -1,62 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newLibmd() (pkg.Artifact, string) {
-	const (
-		version  = "1.1.0"
-		checksum = "9apYqPPZm0j5HQT8sCsVIhnVIqRD7XgN7kPIaTwTqnTuUq5waUAMq4M7ev8CODJ1"
-	)
-	return t.NewPackage("libmd", version, t.newTagRemote(
-		"https://git.hadrons.org/git/libmd.git",
-		version, checksum,
-	), nil, &MakeHelper{
-		Generate: "echo '" + version + "' > .dist-version && ./autogen",
-		ScriptMakeEarly: `
-install -D /usr/src/libmd/src/helper.c src/helper.c
-`,
-	},
-		Automake,
-		Libtool,
-	), version
-}
-func init() {
-	artifactsM[Libmd] = Metadata{
-		f: Toolchain.newLibmd,
-
-		Name:        "libmd",
-		Description: "Message Digest functions from BSD systems",
-		Website:     "https://www.hadrons.org/software/libmd/",
-
-		ID: 15525,
-	}
-}
-
-func (t Toolchain) newLibbsd() (pkg.Artifact, string) {
-	const (
-		version  = "0.12.2"
-		checksum = "NVS0xFLTwSP8JiElEftsZ-e1_C-IgJhHrHE77RwKt5178M7r087waO-zYx2_dfGX"
-	)
-	return t.NewPackage("libbsd", version, t.newTagRemote(
-		"https://gitlab.freedesktop.org/libbsd/libbsd.git",
-		version, checksum,
-	), nil, &MakeHelper{
-		Generate: "echo '" + version + "' > .dist-version && ./autogen",
-	},
-		Automake,
-		Libtool,
-
-		Libmd,
-	), version
-}
-func init() {
-	artifactsM[Libbsd] = Metadata{
-		f: Toolchain.newLibbsd,
-
-		Name:        "libbsd",
-		Description: "provides useful functions commonly found on BSD systems",
-		Website:     "https://libbsd.freedesktop.org/",
-
-		ID: 1567,
-	}
-}

internal/rosa/libcap.go

@@ -1,54 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newLibcap() (pkg.Artifact, string) {
-	const (
-		version  = "2.78"
-		checksum = "wFdUkBhFMD9InPnrBZyegWrlPSAg_9JiTBC-eSFyWWlmbzL2qjh2mKxr9Kx2a8ut"
-	)
-	return t.NewPackage("libcap", version, newTar(
-		"https://git.kernel.org/pub/scm/libs/libcap/libcap.git/"+
-			"snapshot/libcap-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), &PackageAttr{
-		// uses source tree as scratch space
-		Writable: true,
-		Chmod:    true,
-
-		Env: []string{
-			"prefix=/system",
-			"lib=lib",
-		},
-		ScriptEarly: `
-ln -s ../system/bin/bash /bin/
-`,
-	}, &MakeHelper{
-		SkipConfigure: true,
-		InPlace:       true,
-
-		Make: []string{
-			"CC=cc",
-			"all",
-		},
-		Check: []string{
-			"CC=cc",
-			"test",
-		},
-	},
-		Bash,
-		Diffutils,
-	), version
-}
-func init() {
-	artifactsM[Libcap] = Metadata{
-		f: Toolchain.newLibcap,
-
-		Name:        "libcap",
-		Description: "a library for getting and setting POSIX.1e draft 15 capabilities",
-		Website:     "https://sites.google.com/site/fullycapable/",
-
-		ID: 1569,
-	}
-}

internal/rosa/libev.go

@@ -1,26 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newLibev() (pkg.Artifact, string) {
-	const (
-		version  = "4.33"
-		checksum = "774eSXV_4k8PySRprUDChbEwsw-kzjIFnJ3MpNOl5zDpamBRvC3BqPyRxvkwcL6_"
-	)
-	return t.NewPackage("libev", version, newTar(
-		"https://dist.schmorp.de/libev/Attic/libev-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), nil, (*MakeHelper)(nil)), version
-}
-func init() {
-	artifactsM[Libev] = Metadata{
-		f: Toolchain.newLibev,
-
-		Name:        "libev",
-		Description: "a full-featured and high-performance event loop",
-		Website:     "http://libev.schmorp.de/",
-
-		ID: 1605,
-	}
-}

internal/rosa/libexpat.go

@@ -1,34 +0,0 @@
-package rosa
-
-import (
-	"strings"
-
-	"hakurei.app/internal/pkg"
-)
-
-func (t Toolchain) newLibexpat() (pkg.Artifact, string) {
-	const (
-		version  = "2.8.0"
-		checksum = "pnwZ_JSif-OfoWIwk2JYXWHagOWMA3Sh-Ea0p-4Rz9U9mDEeAebhyvnfD7OYOMCk"
-	)
-	return t.NewPackage("libexpat", version, newFromGitHubRelease(
-		"libexpat/libexpat",
-		"R_"+strings.ReplaceAll(version, ".", "_"),
-		"expat-"+version+".tar.bz2",
-		checksum,
-		pkg.TarBzip2,
-	), nil, (*MakeHelper)(nil),
-		Bash,
-	), version
-}
-func init() {
-	artifactsM[Libexpat] = Metadata{
-		f: Toolchain.newLibexpat,
-
-		Name:        "libexpat",
-		Description: "a stream-oriented XML parser library",
-		Website:     "https://libexpat.github.io/",
-
-		ID: 770,
-	}
-}

internal/rosa/libffi.go

@@ -1,30 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newLibffi() (pkg.Artifact, string) {
-	const (
-		version  = "3.5.2"
-		checksum = "2_Q-ZNBBbVhltfL5zEr0wljxPegUimTK4VeMSiwJEGksls3n4gj3lV0Ly3vviSFH"
-	)
-	return t.NewPackage("libffi", version, newFromGitHubRelease(
-		"libffi/libffi",
-		"v"+version,
-		"libffi-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), nil, (*MakeHelper)(nil),
-		KernelHeaders,
-	), version
-}
-func init() {
-	artifactsM[Libffi] = Metadata{
-		f: Toolchain.newLibffi,
-
-		Name:        "libffi",
-		Description: "a portable, high level programming interface to various calling conventions",
-		Website:     "https://sourceware.org/libffi/",
-
-		ID: 1611,
-	}
-}

internal/rosa/libgd.go

@@ -1,40 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newLibgd() (pkg.Artifact, string) {
-	const (
-		version  = "2.3.3"
-		checksum = "8T-sh1_FJT9K9aajgxzh8ot6vWIF-xxjcKAHvTak9MgGUcsFfzP8cAvvv44u2r36"
-	)
-	return t.NewPackage("libgd", version, newFromGitHubRelease(
-		"libgd/libgd",
-		"gd-"+version,
-		"libgd-"+version+".tar.gz", checksum,
-		pkg.TarGzip,
-	), &PackageAttr{
-		Env: []string{
-			"TMPDIR=/dev/shm/gd",
-		},
-		ScriptEarly: `
-mkdir /dev/shm/gd
-`,
-	}, (*MakeHelper)(nil),
-		Zlib,
-	), version
-}
-func init() {
-	artifactsM[Libgd] = Metadata{
-		f: Toolchain.newLibgd,
-
-		Name:        "libgd",
-		Description: "an open source code library for the dynamic creation of images",
-		Website:     "https://libgd.github.io/",
-
-		Dependencies: P{
-			Zlib,
-		},
-
-		ID: 880,
-	}
-}

internal/rosa/libpsl.go

@@ -1,37 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newLibpsl() (pkg.Artifact, string) {
-	const (
-		version  = "0.21.5"
-		checksum = "XjfxSzh7peG2Vg4vJlL8z4JZJLcXqbuP6pLWkrGCmRxlnYUFTKNBqWGHCxEOlCad"
-	)
-	return t.NewPackage("libpsl", version, newFromGitHubRelease(
-		"rockdaboot/libpsl",
-		version,
-		"libpsl-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), &PackageAttr{
-		Writable: true,
-		ScriptEarly: `
-test_disable() { chmod +w "$2" && echo "$1" > "$2"; }
-
-test_disable 'int main(){return 0;}' tests/test-is-public-builtin.c
-`,
-	}, (*MakeHelper)(nil),
-		Python,
-	), version
-}
-func init() {
-	artifactsM[Libpsl] = Metadata{
-		f: Toolchain.newLibpsl,
-
-		Name:        "libpsl",
-		Description: "provides functions to work with the Mozilla Public Suffix List",
-		Website:     "https://rockdaboot.github.io/libpsl/",
-
-		ID: 7305,
-	}
-}

internal/rosa/libseccomp.go

@@ -1,55 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newLibseccomp() (pkg.Artifact, string) {
-	const (
-		version  = "2.6.0"
-		checksum = "mMu-iR71guPjFbb31u-YexBaanKE_nYPjPux-vuBiPfS_0kbwJdfCGlkofaUm-EY"
-	)
-	return t.NewPackage("libseccomp", version, newFromGitHubRelease(
-		"seccomp/libseccomp",
-		"v"+version,
-		"libseccomp-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), &PackageAttr{
-		ScriptEarly: `
-ln -s ../system/bin/bash /bin/
-`,
-
-		Patches: []KV{
-			{"fix-export-oob-read", `diff --git a/src/api.c b/src/api.c
-index adccef3..65a277a 100644
---- a/src/api.c
-+++ b/src/api.c
-@@ -786,7 +786,7 @@ API int seccomp_export_bpf_mem(const scmp_filter_ctx ctx, void *buf,
-                if (BPF_PGM_SIZE(program) > *len)
-                        rc = _rc_filter(-ERANGE);
-                else
--                       memcpy(buf, program->blks, *len);
-+                       memcpy(buf, program->blks, BPF_PGM_SIZE(program));
-        }
-        *len = BPF_PGM_SIZE(program);
- 
-`},
-		},
-	}, (*MakeHelper)(nil),
-		Bash,
-		Diffutils,
-		Gperf,
-
-		KernelHeaders,
-	), version
-}
-func init() {
-	artifactsM[Libseccomp] = Metadata{
-		f: Toolchain.newLibseccomp,
-
-		Name:        "libseccomp",
-		Description: "an interface to the Linux Kernel's syscall filtering mechanism",
-		Website:     "https://github.com/seccomp/libseccomp/",
-
-		ID: 13823,
-	}
-}

internal/rosa/libucontext.go

@@ -1,39 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newLibucontext() (pkg.Artifact, string) {
-	const (
-		version  = "1.5"
-		checksum = "Ggk7FMmDNBdCx1Z9PcNWWW6LSpjGYssn2vU0GK5BLXJYw7ZxZbA2m_eSgT9TFnIG"
-	)
-	return t.NewPackage("libucontext", version, newFromGitHub(
-		"kaniini/libucontext",
-		"libucontext-"+version,
-		checksum,
-	), &PackageAttr{
-		// uses source tree as scratch space
-		Writable:    true,
-		Chmod:       true,
-		EnterSource: true,
-	}, &MakeHelper{
-		OmitDefaults:  true,
-		SkipConfigure: true,
-		InPlace:       true,
-		Make: []string{
-			"ARCH=" + linuxArch(),
-		},
-		Install: "make prefix=/system DESTDIR=/work install",
-	}), version
-}
-func init() {
-	artifactsM[Libucontext] = Metadata{
-		f: Toolchain.newLibucontext,
-
-		Name:        "libucontext",
-		Description: "ucontext implementation featuring glibc-compatible ABI",
-		Website:     "https://github.com/kaniini/libucontext/",
-
-		ID: 17085,
-	}
-}

internal/rosa/libxml2.go

@@ -1,32 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newLibxml2() (pkg.Artifact, string) {
-	const (
-		version  = "2.15.3"
-		checksum = "oJy74htGlEpf70KPvpW18fYJo0RQQkCXZRwqUz6NoXborS3HCq3Nm4gsyaSeNmUH"
-	)
-	return t.NewPackage("libxml2", version, newFromGitLab(
-		"gitlab.gnome.org",
-		"GNOME/libxml2",
-		"v"+version, checksum,
-	), &PackageAttr{
-		// can't create shell.out: Read-only file system
-		Writable: true,
-	}, (*MesonHelper)(nil),
-		Git,
-		Diffutils,
-	), version
-}
-func init() {
-	artifactsM[Libxml2] = Metadata{
-		f: Toolchain.newLibxml2,
-
-		Name:        "libxml2",
-		Description: "an XML toolkit implemented in C",
-		Website:     "https://gitlab.gnome.org/GNOME/libxml2/",
-
-		ID: 1783,
-	}
-}

internal/rosa/libxslt.go

@@ -1,42 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newLibxslt() (pkg.Artifact, string) {
-	const (
-		version  = "1.1.45"
-		checksum = "67ks7v8od2oWaEGf23Sst_Xbn_8brQyolQjqxPoO-lK35k_WJhi2Px5JJgbk-nfn"
-	)
-	return t.NewPackage("libxslt", version, newFromGitLab(
-		"gitlab.gnome.org",
-		"GNOME/libxslt",
-		"v"+version, checksum,
-	), nil, &MakeHelper{
-		Generate: "NOCONFIGURE=1 ./autogen.sh",
-
-		// python libxml2 cyclic dependency
-		SkipCheck: true,
-	},
-		Automake,
-		Libtool,
-		Python,
-		PkgConfig,
-
-		Libxml2,
-	), version
-}
-func init() {
-	artifactsM[Libxslt] = Metadata{
-		f: Toolchain.newLibxslt,
-
-		Name:        "libxslt",
-		Description: "an XSLT processor based on libxml2",
-		Website:     "https://gitlab.gnome.org/GNOME/libxslt/",
-
-		Dependencies: P{
-			Libxml2,
-		},
-
-		ID: 13301,
-	}
-}

internal/rosa/llvm.go

@@ -1,15 +1,34 @@
 package rosa
 
 import (
+	"io/fs"
 	"regexp"
-	"runtime"
 	"slices"
 	"strings"
+	"unsafe"
 
 	"hakurei.app/internal/pkg"
 )
 
-// litArgs returns [LIT] arguments for optional verbosity and check skipping.
+var (
+	_llvmSource      = H("llvm-project")
+	_muslHeaders     = H("musl-headers")
+	_earlyCompilerRT = H("early-compiler-rt")
+	_earlyRuntimes   = H("early-runtimes")
+	_musl            = H("musl")
+
+	_bash      = H("bash")
+	_gawk      = H("gawk")
+	_coreutils = H("coreutils")
+	_diffutils = H("diffutils")
+	_findutils = H("findutils")
+
+	_zlib          = H("zlib")
+	_zstd          = H("zstd")
+	_kernelHeaders = H("kernel-headers")
+)
+
+// litArgs returns LIT arguments for optional verbosity and check skipping.
 func litArgs(verbose bool, skipChecks ...string) string {
 	args := []string{"-sv"}
 	if verbose {
@@ -30,251 +49,316 @@ func litArgs(verbose bool, skipChecks ...string) string {
 	return "'" + strings.Join(args, " ") + "'"
 }
 
-func (t Toolchain) newEarlyCompilerRT() (pkg.Artifact, string) {
+func init() {
-	version := t.Version(llvmSource)
+	var llvmPatches []KV
-	major, _, _ := strings.Cut(version, ".")
+	for _, name := range [...]string{
-	return t.NewPackage("early-compiler-rt", version, t.Load(llvmSource), &PackageAttr{
+		"increase-stack-size-unconditional",
-		Flag: TExclusive,
+		"add-rosa-vendor",
-	}, &CMakeHelper{
+		"xfail-broken-tests",
-		Append: []string{"compiler-rt"},
+		"path-system-include",
+		"path-system-libraries",
+	} {
+		p, err := fs.ReadFile(nativeB, "package/llvm/"+name+".patch")
+		if err != nil {
+			panic(err)
+		}
+		llvmPatches = append(llvmPatches, KV{
+			name,
+			unsafe.String(unsafe.SliceData(p), len(p)),
+		})
+	}
 
-		Cache: []KV{
+	native.MustRegister("early-compiler-rt", func(t Toolchain) (*Metadata, pkg.Artifact) {
-			// libc++ not yet available
+		meta := Metadata{
-			{"CMAKE_CXX_COMPILER_TARGET", ""},
+			Name:        "early-compiler-rt",
+			Description: "early LLVM runtime: compiler-rt",
 
-			{"LLVM_HOST_TRIPLE", `"${ROSA_TRIPLE}"`},
+			Dependencies: P{_musl},
-			{"LLVM_DEFAULT_TARGET_TRIPLE", `"${ROSA_TRIPLE}"`},
+		}
-			{"LLVM_ENABLE_PER_TARGET_RUNTIME_DIR", "ON"},
+		_meta, source := t.MustLoad(_llvmSource)
+		meta.Version = _meta.Version
+		major, _, _ := strings.Cut(meta.Version, ".")
+		return &meta, t.NewPackage("early-compiler-rt", meta.Version, source, &PackageAttr{
+			Flag: TExclusive,
+		}, &CMakeHelper{
+			Append: []string{"compiler-rt"},
 
-			{"COMPILER_RT_BUILD_BUILTINS", "ON"},
+			Cache: []KV{
-			{"COMPILER_RT_DEFAULT_TARGET_ONLY", "OFF"},
+				{"ENABLE_LINKER_BUILD_ID", "ON"},
-			{"COMPILER_RT_SANITIZERS_TO_BUILD", "asan"},
 
-			// does not work without libunwind
+				// libc++ not yet available
-			{"COMPILER_RT_BUILD_CTX_PROFILE", "OFF"},
+				{"CMAKE_CXX_COMPILER_TARGET", ""},
-			{"COMPILER_RT_BUILD_LIBFUZZER", "OFF"},
+
-			{"COMPILER_RT_BUILD_MEMPROF", "OFF"},
+				{"LLVM_HOST_TRIPLE", `"${ROSA_TRIPLE}"`},
-			{"COMPILER_RT_BUILD_PROFILE", "OFF"},
+				{"LLVM_DEFAULT_TARGET_TRIPLE", `"${ROSA_TRIPLE}"`},
-			{"COMPILER_RT_BUILD_XRAY", "OFF"},
+				{"LLVM_ENABLE_RTTI", "ON"},
-		},
+				{"LLVM_BUILD_LLVM_DYLIB", "ON"},
-		SkipTest: true,
+				{"LLVM_LINK_LLVM_DYLIB", "ON"},
-		Script: `
+				{"LLVM_ENABLE_PER_TARGET_RUNTIME_DIR", "ON"},
+
+				{"COMPILER_RT_BUILD_BUILTINS", "ON"},
+				{"COMPILER_RT_DEFAULT_TARGET_ONLY", "ON"},
+				{"COMPILER_RT_USE_BUILTINS_LIBRARY", "ON"},
+				{"COMPILER_RT_SANITIZERS_TO_BUILD", "asan"},
+				{"COMPILER_RT_BUILD_GWP_ASAN", "OFF"},
+
+				// does not work without libunwind
+				{"COMPILER_RT_BUILD_CTX_PROFILE", "OFF"},
+				{"COMPILER_RT_BUILD_LIBFUZZER", "OFF"},
+				{"COMPILER_RT_BUILD_MEMPROF", "OFF"},
+				{"COMPILER_RT_BUILD_PROFILE", "OFF"},
+				{"COMPILER_RT_BUILD_XRAY", "OFF"},
+			},
+			SkipTest: true,
+			Script: `
 mkdir -p "/work/system/lib/clang/` + major + `/lib/"
 ln -s \
 	"../../../${ROSA_TRIPLE}" \
 	"/work/system/lib/clang/` + major + `/lib/"
 
 ln -s \
-	"clang_rt.crtbegin-` + linuxArch() + `.o" \
+	"clang_rt.crtbegin-` + t.linuxArch() + `.o" \
 	"/work/system/lib/${ROSA_TRIPLE}/crtbeginS.o"
 ln -s \
-	"clang_rt.crtend-` + linuxArch() + `.o" \
+	"clang_rt.crtend-` + t.linuxArch() + `.o" \
 	"/work/system/lib/${ROSA_TRIPLE}/crtendS.o"
 `,
-	},
-		Python,
-
-		muslHeaders,
-		KernelHeaders,
-	), version
-}
-func init() {
-	artifactsM[earlyCompilerRT] = Metadata{
-		f: Toolchain.newEarlyCompilerRT,
-
-		Name:        "early-compiler-rt",
-		Description: "early LLVM runtime: compiler-rt",
-
-		Dependencies: P{
-			Musl,
 		},
-	}
+			_python,
-}
 
-func (t Toolchain) newEarlyRuntimes() (pkg.Artifact, string) {
+			_muslHeaders,
-	version := t.Version(llvmSource)
+			_kernelHeaders,
-	return t.NewPackage("early-runtimes", version, t.Load(llvmSource), &PackageAttr{
+		)
-		Flag: TExclusive,
+	})
-	}, &CMakeHelper{
-		Append: []string{"runtimes"},
 
-		Cache: []KV{
+	native.MustRegister("early-runtimes", func(t Toolchain) (*Metadata, pkg.Artifact) {
-			// libc++ not yet available
+		meta := Metadata{
-			{"CMAKE_CXX_COMPILER_WORKS", "ON"},
+			Name:        "early-runtimes",
+			Description: "early LLVM runtimes: libunwind, libcxx, libcxxabi",
+
+			Dependencies: P{
+				_earlyCompilerRT,
+			},
+		}
+		_meta, source := t.MustLoad(_llvmSource)
+		meta.Version = _meta.Version
+
+		return &meta, t.NewPackage("early-runtimes", meta.Version, source, &PackageAttr{
+			Flag: TExclusive,
+		}, &CMakeHelper{
+			Append: []string{"runtimes"},
+
+			Cache: []KV{
+				{"ENABLE_LINKER_BUILD_ID", "ON"},
+
+				// libc++ not yet available
+				{"CMAKE_CXX_COMPILER_WORKS", "ON"},
+
+				{"LLVM_HOST_TRIPLE", `"${ROSA_TRIPLE}"`},
+				{"LLVM_DEFAULT_TARGET_TRIPLE", `"${ROSA_TRIPLE}"`},
+				{"LLVM_ENABLE_RTTI", "ON"},
+				{"LLVM_BUILD_LLVM_DYLIB", "ON"},
+				{"LLVM_LINK_LLVM_DYLIB", "ON"},
+				{"LLVM_ENABLE_RUNTIMES", "'libunwind;libcxx;libcxxabi'"},
+
+				{"LIBUNWIND_ENABLE_ASSERTIONS", "OFF"},
+				{"LIBUNWIND_USE_COMPILER_RT", "ON"},
+				{"LIBCXX_HAS_MUSL_LIBC", "ON"},
+				{"LIBCXX_USE_COMPILER_RT", "ON"},
+				{"LIBCXX_CXX_ABI", "libcxxabi"},
+				{"LIBCXX_ENABLE_STATIC_ABI_LIBRARY", "OFF"},
+				{"LIBCXX_HARDENING_MODE", "fast"},
+				{"LIBCXX_HAS_ATOMIC_LIB", "OFF"},
+				{"LIBCXXABI_USE_COMPILER_RT", "ON"},
+				{"LIBCXXABI_USE_LLVM_UNWINDER", "ON"},
+				{"LIBCXXABI_ENABLE_STATIC_UNWINDER", "OFF"},
+				{"LIBCXXABI_HAS_CXA_THREAD_ATEXIT_IMPL", "OFF"},
+
+				{"LLVM_ENABLE_ZLIB", "FORCE_ON"},
+				{"LLVM_ENABLE_ZSTD", "FORCE_ON"},
+				{"LLVM_ENABLE_LIBXML2", "OFF"},
+			},
+			SkipTest: true,
+		},
+			_python,
+
+			_zlib,
+			_zstd,
+			_earlyCompilerRT,
+			_kernelHeaders,
+		)
+	})
+
+	const (
+		version  = "22.1.6"
+		checksum = "vwMyqgc_09d__u49IlXGlxnp8eFlvpibhYQgVxQg-sGdoZlzyapMV4uX4UAjE7rA"
+	)
+
+	native.MustRegister("llvm-project", func(t Toolchain) (*Metadata, pkg.Artifact) {
+		meta := Metadata{
+			Name:        "llvm-project",
+			Description: "LLVM monorepo with Rosa OS patches",
+			Version:     version,
+
+			ID: 1830,
+		}
+		return &meta, t.NewPatchedSource("llvm-"+version, newFromGitHub(
+			"llvm/llvm-project",
+			"llvmorg-"+version,
+			checksum,
+		), true, llvmPatches...)
+	})
+
+	native.MustRegister("llvm", func(t Toolchain) (*Metadata, pkg.Artifact) {
+		meta := Metadata{
+			Name:        "llvm",
+			Description: "a collection of modular and reusable compiler and toolchain technologies",
+			Website:     "https://llvm.org",
+
+			Dependencies: P{
+				_zlib,
+				_zstd,
+				_musl,
+			},
+		}
+		_meta, source := t.MustLoad(_llvmSource)
+		meta.Version = _meta.Version
+
+		early := _muslHeaders
+		if t.stage.isStage0() {
+			// The LLVM build system uses the system installation when building with
+			// LLVM_LINK_LLVM_DYLIB, since it builds runtimes after the fact, using
+			// the just-built toolchain. This is unacceptable in stage0 due to the
+			// potential version difference. Later stages bootstrap off of runtimes
+			// of its previous stage via 3-stage determinism.
+			early = _earlyRuntimes
+		}
+
+		cache := []KV{
+			{"ENABLE_LINKER_BUILD_ID", "ON"},
+			{"COMPILER_RT_USE_BUILTINS_LIBRARY", "ON"},
+			{"COMPILER_RT_DEFAULT_TARGET_ONLY", "ON"},
+			{"COMPILER_RT_BUILD_GWP_ASAN", "OFF"},
+			{"LIBCXX_CXX_ABI", "libcxxabi"},
+			{"LIBCXX_USE_COMPILER_RT", "ON"},
+			{"LIBCXX_ENABLE_STATIC_ABI_LIBRARY", "OFF"},
+			{"LIBCXX_HAS_MUSL_LIBC", "ON"},
+			{"LIBCXX_HARDENING_MODE", "fast"},
+			{"LIBCXXABI_USE_LLVM_UNWINDER", "ON"},
+			{"LIBCXXABI_ENABLE_STATIC_UNWINDER", "OFF"},
+			{"LIBCXXABI_USE_COMPILER_RT", "ON"},
+			{"LLVM_INSTALL_BINUTILS_SYMLINKS", "ON"},
+			{"LLVM_INSTALL_UTILS", "ON"},
+			{"LLVM_BUILD_LLVM_DYLIB", "ON"},
+			{"LLVM_LINK_LLVM_DYLIB", "ON"},
+			{"LLVM_APPEND_VC_REV", "OFF"},
+			{"LLVM_ENABLE_RTTI", "ON"},
+			{"LLVM_ENABLE_ZLIB", "FORCE_ON"},
+			{"LLVM_ENABLE_ZSTD", "FORCE_ON"},
+			{"LLVM_ENABLE_PER_TARGET_RUNTIME_DIR", "ON"},
+			{"LLVM_INCLUDE_BENCHMARKS", "OFF"},
+			{"CLANG_DEFAULT_RTLIB", "compiler-rt"},
+			{"CLANG_DEFAULT_UNWINDLIB", "libunwind"},
+			{"CLANG_DEFAULT_CXX_STDLIB", "libc++"},
+			{"CLANG_CONFIG_FILE_SYSTEM_DIR", "/system/etc/clang"},
+			{"LLVM_ENABLE_FFI", "OFF"},
+			{"LLVM_ENABLE_LIBXML2", "OFF"},
+			{"LLVM_ENABLE_LIBCXX", "ON"},
+			{"LLVM_ENABLE_LLD", "ON"},
+			{"LIBUNWIND_ENABLE_ASSERTIONS", "OFF"},
+			{"LIBUNWIND_USE_COMPILER_RT", "ON"},
 
 			{"LLVM_HOST_TRIPLE", `"${ROSA_TRIPLE}"`},
 			{"LLVM_DEFAULT_TARGET_TRIPLE", `"${ROSA_TRIPLE}"`},
-			{"LLVM_ENABLE_RUNTIMES", "'libunwind;libcxx;libcxxabi'"},
+			{"LLVM_ENABLE_PROJECTS", "'" + strings.Join([]string{
-
+				"clang",
-			{"LIBUNWIND_USE_COMPILER_RT", "ON"},
+				"lld",
-			{"LIBCXX_HAS_MUSL_LIBC", "ON"},
+			}, ";") + "'"},
-			{"LIBCXX_USE_COMPILER_RT", "ON"},
+			{"LLVM_ENABLE_RUNTIMES", "'" + strings.Join([]string{
-			{"LIBCXX_HAS_ATOMIC_LIB", "OFF"},
+				"compiler-rt",
-			{"LIBCXXABI_USE_COMPILER_RT", "ON"},
+				"libcxx",
-			{"LIBCXXABI_USE_LLVM_UNWINDER", "ON"},
+				"libcxxabi",
-			{"LIBCXXABI_HAS_CXA_THREAD_ATEXIT_IMPL", "OFF"},
+				"libunwind",
-
+				"libclc",
-			{"LLVM_ENABLE_ZLIB", "FORCE_ON"},
+			}, ";") + "'"},
-			{"LLVM_ENABLE_ZSTD", "FORCE_ON"},
-			{"LLVM_ENABLE_LIBXML2", "OFF"},
-		},
-		SkipTest: true,
-	},
-		Python,
-
-		Zlib,
-		Zstd,
-		earlyCompilerRT,
-		KernelHeaders,
-	), version
-}
-func init() {
-	artifactsM[earlyRuntimes] = Metadata{
-		f: Toolchain.newEarlyRuntimes,
-
-		Name:        "early-runtimes",
-		Description: "early LLVM runtimes: libunwind, libcxx, libcxxabi",
-
-		Dependencies: P{
-			earlyCompilerRT,
-		},
-	}
-}
-
-func (t Toolchain) newLLVM() (pkg.Artifact, string) {
-	var early PArtifact = muslHeaders
-	if t.isStage0() {
-		// The LLVM build system is buggy around LLVM_LINK_LLVM_DYLIB and leaks
-		// the system installation when invoking the newly built toolchain. This
-		// is worked around in stage0 by providing standalone builds of
-		// runtimes. Later stages rely on 3-stage determinism and allows the
-		// system installation from its previous stage to leak through.
-		early = earlyRuntimes
-	}
-
-	cache := []KV{
-		{"ENABLE_LINKER_BUILD_ID", "ON"},
-		{"COMPILER_RT_USE_BUILTINS_LIBRARY", "ON"},
-		{"COMPILER_RT_DEFAULT_TARGET_ONLY", "ON"},
-		{"COMPILER_RT_BUILD_GWP_ASAN", "OFF"},
-		{"LIBCXX_CXX_ABI", "libcxxabi"},
-		{"LIBCXX_USE_COMPILER_RT", "ON"},
-		{"LIBCXX_ENABLE_STATIC_ABI_LIBRARY", "OFF"},
-		{"LIBCXX_HAS_MUSL_LIBC", "ON"},
-		{"LIBCXX_HARDENING_MODE", "fast"},
-		{"LIBCXXABI_USE_LLVM_UNWINDER", "ON"},
-		{"LIBCXXABI_ENABLE_STATIC_UNWINDER", "OFF"},
-		{"LIBCXXABI_USE_COMPILER_RT", "ON"},
-		{"LLVM_INSTALL_BINUTILS_SYMLINKS", "ON"},
-		{"LLVM_INSTALL_UTILS", "ON"},
-		{"LLVM_BUILD_LLVM_DYLIB", "ON"},
-		{"LLVM_LINK_LLVM_DYLIB", "ON"},
-		{"LLVM_APPEND_VC_REV", "OFF"},
-		{"LLVM_ENABLE_RTTI", "ON"},
-		{"LLVM_ENABLE_ZLIB", "FORCE_ON"},
-		{"LLVM_ENABLE_ZSTD", "FORCE_ON"},
-		{"LLVM_ENABLE_PER_TARGET_RUNTIME_DIR", "ON"},
-		{"CLANG_DEFAULT_RTLIB", "compiler-rt"},
-		{"CLANG_DEFAULT_UNWINDLIB", "libunwind"},
-		{"CLANG_DEFAULT_CXX_STDLIB", "libc++"},
-		{"CLANG_CONFIG_FILE_SYSTEM_DIR", "/system/etc/clang"},
-		{"LLVM_ENABLE_FFI", "OFF"},
-		{"LLVM_ENABLE_LIBXML2", "OFF"},
-		{"LLVM_ENABLE_LIBCXX", "ON"},
-		{"LLVM_ENABLE_LLD", "ON"},
-		{"LIBUNWIND_ENABLE_ASSERTIONS", "OFF"},
-		{"LIBUNWIND_USE_COMPILER_RT", "ON"},
-
-		{"LLVM_HOST_TRIPLE", `"${ROSA_TRIPLE}"`},
-		{"LLVM_DEFAULT_TARGET_TRIPLE", `"${ROSA_TRIPLE}"`},
-		{"LLVM_ENABLE_PROJECTS", "'" + strings.Join([]string{
-			"clang",
-			"lld",
-		}, ";") + "'"},
-		{"LLVM_ENABLE_RUNTIMES", "'" + strings.Join([]string{
-			"compiler-rt",
-			"libcxx",
-			"libcxxabi",
-			"libunwind",
-			"libclc",
-		}, ";") + "'"},
-	}
-
-	if !t.isStage0() {
-		skipChecks := []string{
-			// expensive, pointless to run here
-			"benchmarks",
-			// LLVM ERROR: Tried to execute an unknown external function: roundevenf
-			"ExecutionEngine/Interpreter/intrinsics.ll",
-			// clang: deadlocks with LLVM_BUILD_LLVM_DYLIB
-			"crash-recovery-modules",
-			// clang: fatal error: '__config_site' file not found
-			"CodeGen/PowerPC/ppc-xmmintrin.c",
-			"CodeGen/PowerPC/ppc-mmintrin.c",
-			"CodeGen/PowerPC/ppc-emmintrin.c",
-			"CodeGen/PowerPC/ppc-pmmintrin.c",
-			"CodeGen/PowerPC/ppc-tmmintrin.c",
-			"CodeGen/PowerPC/ppc-smmintrin.c",
-			"CodeGenCUDA/amdgpu-alias-undef-symbols.cu",
-			// cxx: fails on musl
-			"close.dont-get-rid-of-buffer",
-			"re/re.traits",
-			"std/time",
-			"localization/locales",
-			"localization/locale.categories",
-			"selftest/dsl/dsl.sh.py",
-			"input.output/iostream.format",
-			"locale-specific_form",
-			// cxx: deadlocks
-			"std/thread/thread.jthread",
-			// unwind: fails on musl
-			"eh_frame_fde_pc_range",
-		}
-		switch runtime.GOARCH {
-		case "arm64":
-			skipChecks = append(skipChecks,
-				// LLVM: intermittently crashes
-				"ExecutionEngine/OrcLazy/multiple-compile-threads-basic.ll",
-				// unwind: unexpectedly passes
-				"unwind_leaffunction",
-			)
 		}
 
-		if presetOpts&OptLLVMNoLTO == 0 {
+		if !t.stage.isStage0() {
+			skipChecks := []string{
+				// expensive, pointless to run here
+				"benchmarks",
+				// LLVM ERROR: Tried to execute an unknown external function: roundevenf
+				"ExecutionEngine/Interpreter/intrinsics.ll",
+				// clang: deadlocks with LLVM_BUILD_LLVM_DYLIB
+				"crash-recovery-modules",
+				// clang: fatal error: '__config_site' file not found
+				"CodeGen/PowerPC/ppc-xmmintrin.c",
+				"CodeGen/PowerPC/ppc-mmintrin.c",
+				"CodeGen/PowerPC/ppc-emmintrin.c",
+				"CodeGen/PowerPC/ppc-pmmintrin.c",
+				"CodeGen/PowerPC/ppc-tmmintrin.c",
+				"CodeGen/PowerPC/ppc-smmintrin.c",
+				"CodeGenCUDA/amdgpu-alias-undef-symbols.cu",
+				// cxx: fails on musl
+				"close.dont-get-rid-of-buffer",
+				"re/re.traits",
+				"std/time",
+				"localization/locales",
+				"localization/locale.categories",
+				"selftest/dsl/dsl.sh.py",
+				"input.output/iostream.format",
+				"locale-specific_form",
+				// cxx: deadlocks
+				"std/thread/thread.jthread",
+				// unwind: fails on musl
+				"eh_frame_fde_pc_range",
+			}
+			switch t.arch {
+			case "arm64":
+				skipChecks = append(skipChecks,
+					// LLVM: intermittently crashes
+					"ExecutionEngine/OrcLazy/multiple-compile-threads-basic.ll",
+					// unwind: unexpectedly passes
+					"unwind_leaffunction",
+				)
+			}
+
+			if t.opts&OptLLVMNoLTO == 0 {
+				cache = append(cache, []KV{
+					// very expensive
+					{"LLVM_ENABLE_LTO", "Thin"},
+				}...)
+			}
+
 			cache = append(cache, []KV{
-				// very expensive
+				// symbols: clock_gettime, mallopt
-				{"LLVM_ENABLE_LTO", "Thin"},
+				{"COMPILER_RT_INCLUDE_TESTS", "OFF"},
+
+				{"LLVM_BUILD_TESTS", "ON"},
+				{"LLVM_LIT_ARGS", litArgs(true, skipChecks...)},
 			}...)
 		}
 
-		cache = append(cache, []KV{
+		return &meta, t.NewPackage("llvm", meta.Version, source, &PackageAttr{
-			// symbols: clock_gettime, mallopt
+			Flag: TExclusive,
-			{"COMPILER_RT_INCLUDE_TESTS", "OFF"},
+		}, &CMakeHelper{
+			Append: []string{"llvm"},
 
-			{"LLVM_BUILD_TESTS", "ON"},
+			Cache: cache,
-			{"LLVM_LIT_ARGS", litArgs(true, skipChecks...)},
+			Script: `
-		}...)
-	}
-
-	version := t.Version(llvmSource)
-	return t.NewPackage("llvm", version, t.Load(llvmSource), nil, &CMakeHelper{
-		Append: []string{"llvm"},
-
-		Cache: cache,
-		Script: `
 ln -s ld.lld /work/system/bin/ld
 ln -s clang /work/system/bin/cc
 ln -s clang /work/system/bin/cpp
 ln -s clang++ /work/system/bin/c++
 `,
 
-		// LLVM_LINK_LLVM_DYLIB causes llvm test suite to leak system
+			// LLVM_LINK_LLVM_DYLIB causes llvm test suite to leak system
-		// installation into test environment, and the tests end up testing the
+			// installation into test environment, and the tests end up testing the
-		// system installation instead. Tests are disabled on stage0 and relies
+			// system installation instead. Tests are disabled on stage0 and relies
-		// on 3-stage determinism to test later stages.
+			// on 3-stage determinism to test later stages.
-		SkipTest: t.isStage0(),
+			SkipTest: t.stage.isStage0(),
 
-		Test: `
+			Test: `
 chmod +w /bin && ln -s \
 	../system/bin/chmod \
 	../system/bin/mkdir \
@@ -284,53 +368,20 @@ chmod +w /bin && ln -s \
 	/bin
 ninja ` + jobsFlagE + ` check-all
 `,
-	},
-		Python,
-		Perl,
-		Diffutils,
-		Bash,
-		Gawk,
-		Coreutils,
-		Findutils,
-
-		Zlib,
-		Zstd,
-		early,
-		KernelHeaders,
-	), version
-}
-func init() {
-	const (
-		version  = "22.1.4"
-		checksum = "Bk3t-tV5sD5T0bqefFMcLeFuAwXnhFipywZmqst5hAZs97QQWGKB_5XyAFjj5tDB"
-	)
-
-	artifactsM[llvmSource] = Metadata{
-		f: func(t Toolchain) (pkg.Artifact, string) {
-			return t.NewPatchedSource("llvm", version, newFromGitHub(
-				"llvm/llvm-project",
-				"llvmorg-"+version,
-				checksum,
-			), true, llvmPatches...), version
 		},
+			_python,
+			_perl,
+			_diffutils,
+			_bash,
+			_gawk,
+			_coreutils,
+			_findutils,
 
-		Name:        "llvm-project",
+			_zlib,
-		Description: "LLVM monorepo with Rosa OS patches",
+			_zstd,
+			early,
+			_kernelHeaders,
+		)
 
-		ID: 1830,
+	})
-	}
-
-	artifactsM[LLVM] = Metadata{
-		f: Toolchain.newLLVM,
-
-		Name:        "llvm",
-		Description: "a collection of modular and reusable compiler and toolchain technologies",
-		Website:     "https://llvm.org",
-
-		Dependencies: P{
-			Zlib,
-			Zstd,
-			Musl,
-		},
-	}
 }

internal/rosa/llvm_patches.go

@@ -1,191 +0,0 @@
-package rosa
-
-// llvmPatches are centralised patches against latest LLVM monorepo.
-var llvmPatches = []KV{
-	{"increase-stack-size-unconditional", `diff --git a/llvm/lib/Support/Threading.cpp b/llvm/lib/Support/Threading.cpp
-index 9da357a7ebb9..b2931510c1ae 100644
---- a/llvm/lib/Support/Threading.cpp
-+++ b/llvm/lib/Support/Threading.cpp
-@@ -80,7 +80,7 @@ unsigned llvm::ThreadPoolStrategy::compute_thread_count() const {
- // keyword.
- #include "llvm/Support/thread.h"
- 
--#if defined(__APPLE__)
-+#if defined(__APPLE__) || 1
-   // Darwin's default stack size for threads except the main one is only 512KB,
-   // which is not enough for some/many normal LLVM compilations. This implements
-   // the same interface as std::thread but requests the same stack size as the
-`},
-
-	{"add-rosa-vendor", `diff --git a/llvm/include/llvm/TargetParser/Triple.h b/llvm/include/llvm/TargetParser/Triple.h
-index 9c83abeeb3b1..5acfe5836a23 100644
---- a/llvm/include/llvm/TargetParser/Triple.h
-+++ b/llvm/include/llvm/TargetParser/Triple.h
-@@ -190,6 +190,7 @@ public:
- 
-     Apple,
-     PC,
-+    Rosa,
-     SCEI,
-     Freescale,
-     IBM,
-diff --git a/llvm/lib/TargetParser/Triple.cpp b/llvm/lib/TargetParser/Triple.cpp
-index a4f9dd42c0fe..cb5a12387034 100644
---- a/llvm/lib/TargetParser/Triple.cpp
-+++ b/llvm/lib/TargetParser/Triple.cpp
-@@ -279,6 +279,7 @@ StringRef Triple::getVendorTypeName(VendorType Kind) {
-   case NVIDIA: return "nvidia";
-   case OpenEmbedded: return "oe";
-   case PC: return "pc";
-+  case Rosa: return "rosa";
-   case SCEI: return "scei";
-   case SUSE: return "suse";
-   case Meta:
-@@ -689,6 +690,7 @@ static Triple::VendorType parseVendor(StringRef VendorName) {
-   return StringSwitch<Triple::VendorType>(VendorName)
-       .Case("apple", Triple::Apple)
-       .Case("pc", Triple::PC)
-+      .Case("rosa", Triple::Rosa)
-       .Case("scei", Triple::SCEI)
-       .Case("sie", Triple::SCEI)
-       .Case("fsl", Triple::Freescale)
-`},
-
-	{"xfail-broken-tests", `diff --git a/clang/test/Modules/timestamps.c b/clang/test/Modules/timestamps.c
-index 50fdce630255..4b4465a75617 100644
---- a/clang/test/Modules/timestamps.c
-+++ b/clang/test/Modules/timestamps.c
-@@ -1,3 +1,5 @@
-+// XFAIL: target={{.*-rosa-linux-musl}}
-+
- /// Verify timestamps that gets embedded in the module
- #include <c-header.h>
- 
-`},
-
-	{"path-system-include", `diff --git a/clang/lib/Driver/ToolChains/Linux.cpp b/clang/lib/Driver/ToolChains/Linux.cpp
-index 8ac8d4eb9181..e46b04a898ca 100644
---- a/clang/lib/Driver/ToolChains/Linux.cpp
-+++ b/clang/lib/Driver/ToolChains/Linux.cpp
-@@ -671,6 +671,12 @@ void Linux::AddClangSystemIncludeArgs(const ArgList &DriverArgs,
-     addExternCSystemInclude(
-         DriverArgs, CC1Args,
-         concat(SysRoot, "/usr/include", MultiarchIncludeDir));
-+  if (!MultiarchIncludeDir.empty() &&
-+      D.getVFS().exists(concat(SysRoot, "/system/include", MultiarchIncludeDir)))
-+    addExternCSystemInclude(
-+        DriverArgs, CC1Args,
-+        concat(SysRoot, "/system/include", MultiarchIncludeDir));
-+
- 
-   if (getTriple().getOS() == llvm::Triple::RTEMS)
-     return;
-@@ -681,6 +687,7 @@ void Linux::AddClangSystemIncludeArgs(const ArgList &DriverArgs,
-   addExternCSystemInclude(DriverArgs, CC1Args, concat(SysRoot, "/include"));
- 
-   addExternCSystemInclude(DriverArgs, CC1Args, concat(SysRoot, "/usr/include"));
-+  addExternCSystemInclude(DriverArgs, CC1Args, concat(SysRoot, "/system/include"));
- 
-   if (!DriverArgs.hasArg(options::OPT_nobuiltininc) && getTriple().isMusl())
-     addSystemInclude(DriverArgs, CC1Args, ResourceDirInclude);
-`},
-
-	{"path-system-libraries", `diff --git a/clang/lib/Driver/ToolChains/Linux.cpp b/clang/lib/Driver/ToolChains/Linux.cpp
-index d525b417b4ea..fdc411f2239c 100644
---- a/clang/lib/Driver/ToolChains/Linux.cpp
-+++ b/clang/lib/Driver/ToolChains/Linux.cpp
-@@ -302,6 +302,7 @@ Linux::Linux(const Driver &D, const llvm::Triple &Triple, const ArgList &Args)
-   const bool IsHexagon = Arch == llvm::Triple::hexagon;
-   const bool IsRISCV = Triple.isRISCV();
-   const bool IsCSKY = Triple.isCSKY();
-+  const bool IsRosa = Triple.getVendor() == llvm::Triple::Rosa;
- 
-   if (IsCSKY && !SelectedMultilibs.empty())
-     SysRoot = SysRoot + SelectedMultilibs.back().osSuffix();
-@@ -337,12 +338,23 @@ Linux::Linux(const Driver &D, const llvm::Triple &Triple, const ArgList &Args)
-   const std::string OSLibDir = std::string(getOSLibDir(Triple, Args));
-   const std::string MultiarchTriple = getMultiarchTriple(D, Triple, SysRoot);
- 
-+  if (IsRosa) {
-+    ExtraOpts.push_back("-rpath");
-+    ExtraOpts.push_back("/system/lib");
-+    ExtraOpts.push_back("-rpath");
-+    ExtraOpts.push_back(concat("/system/lib", Triple.str()));
-+  }
-+
-   // mips32: Debian multilib, we use /libo32, while in other case, /lib is
-   // used. We need add both libo32 and /lib.
-   if (Arch == llvm::Triple::mips || Arch == llvm::Triple::mipsel) {
-     Generic_GCC::AddMultilibPaths(D, SysRoot, "libo32", MultiarchTriple, Paths);
--    addPathIfExists(D, concat(SysRoot, "/libo32"), Paths);
--    addPathIfExists(D, concat(SysRoot, "/usr/libo32"), Paths);
-+    if (!IsRosa) {
-+      addPathIfExists(D, concat(SysRoot, "/libo32"), Paths);
-+      addPathIfExists(D, concat(SysRoot, "/usr/libo32"), Paths);
-+    } else {
-+      addPathIfExists(D, concat(SysRoot, "/system/libo32"), Paths);
-+    }
-   }
-   Generic_GCC::AddMultilibPaths(D, SysRoot, OSLibDir, MultiarchTriple, Paths);
- 
-@@ -360,18 +372,30 @@ Linux::Linux(const Driver &D, const llvm::Triple &Triple, const ArgList &Args)
-         Paths);
-   }
- 
--  addPathIfExists(D, concat(SysRoot, "/usr/lib", MultiarchTriple), Paths);
--  addPathIfExists(D, concat(SysRoot, "/usr", OSLibDir), Paths);
-+  if (!IsRosa) {
-+    addPathIfExists(D, concat(SysRoot, "/usr/lib", MultiarchTriple), Paths);
-+    addPathIfExists(D, concat(SysRoot, "/usr", OSLibDir), Paths);
-+  } else {
-+    addPathIfExists(D, concat(SysRoot, "/system/lib", MultiarchTriple), Paths);
-+    addPathIfExists(D, concat(SysRoot, "/system", OSLibDir), Paths);
-+  }
-   if (IsRISCV) {
-     StringRef ABIName = tools::riscv::getRISCVABI(Args, Triple);
-     addPathIfExists(D, concat(SysRoot, "/", OSLibDir, ABIName), Paths);
--    addPathIfExists(D, concat(SysRoot, "/usr", OSLibDir, ABIName), Paths);
-+    if (!IsRosa)
-+      addPathIfExists(D, concat(SysRoot, "/usr", OSLibDir, ABIName), Paths);
-+    else
-+      addPathIfExists(D, concat(SysRoot, "/system", OSLibDir, ABIName), Paths);
-   }
- 
-   Generic_GCC::AddMultiarchPaths(D, SysRoot, OSLibDir, Paths);
- 
--  addPathIfExists(D, concat(SysRoot, "/lib"), Paths);
--  addPathIfExists(D, concat(SysRoot, "/usr/lib"), Paths);
-+  if (!IsRosa) {
-+    addPathIfExists(D, concat(SysRoot, "/lib"), Paths);
-+    addPathIfExists(D, concat(SysRoot, "/usr/lib"), Paths);
-+  } else {
-+    addPathIfExists(D, concat(SysRoot, "/system/lib"), Paths);
-+  }
- }
- 
- ToolChain::RuntimeLibType Linux::GetDefaultRuntimeLibType() const {
-@@ -572,6 +596,9 @@ std::string Linux::getDynamicLinker(const ArgList &Args) const {
-     return Triple.isArch64Bit() ? "/system/bin/linker64" : "/system/bin/linker";
-   }
-   if (Triple.isMusl()) {
-+    if (Triple.getVendor() == llvm::Triple::Rosa)
-+      return "/system/bin/linker";
-+
-     std::string ArchName;
-     bool IsArm = false;
- 
-diff --git a/clang/tools/clang-installapi/Options.cpp b/clang/tools/clang-installapi/Options.cpp
-index f484d6f33ad8..dca55e72d67e 100644
---- a/clang/tools/clang-installapi/Options.cpp
-+++ b/clang/tools/clang-installapi/Options.cpp
-@@ -514,7 +514,7 @@ bool Options::processFrontendOptions(InputArgList &Args) {
-     FEOpts.FwkPaths = std::move(FrameworkPaths);
- 
-   // Add default framework/library paths.
--  PathSeq DefaultLibraryPaths = {"/usr/lib", "/usr/local/lib"};
-+  PathSeq DefaultLibraryPaths = {"/usr/lib", "/system/lib", "/usr/local/lib"};
-   PathSeq DefaultFrameworkPaths = {"/Library/Frameworks",
-                                    "/System/Library/Frameworks"};
- 
-`},
-}

internal/rosa/make.go

@@ -3,40 +3,9 @@ package rosa
 import (
 	"slices"
 	"strings"
-
-	"hakurei.app/internal/pkg"
 )
 
-func (t Toolchain) newMake() (pkg.Artifact, string) {
+var _make = H("make")
-	const (
-		version  = "4.4.1"
-		checksum = "YS_B07ZcAy9PbaK5_vKGj64SrxO2VMpnMKfc9I0Q9IC1rn0RwOH7802pJoj2Mq4a"
-	)
-	return t.New("make-"+version, TEarly, nil, nil, nil, `
-cd "$(mktemp -d)"
-/usr/src/make/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}" \
-	--disable-dependency-tracking
-./build.sh
-./make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("make"), false, newTar(
-		"https://ftpmirror.gnu.org/gnu/make/make-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	))), version
-}
-func init() {
-	artifactsM[Make] = Metadata{
-		f: Toolchain.newMake,
-
-		Name:        "make",
-		Description: "a tool which controls the generation of executables and other non-source files",
-		Website:     "https://www.gnu.org/software/make/",
-
-		ID: 1877,
-	}
-}
 
 // MakeHelper is the [Make] build system helper.
 type MakeHelper struct {
@@ -70,6 +39,8 @@ type MakeHelper struct {
 	Make []string
 	// Whether to skip the check target.
 	SkipCheck bool
+	// Whether to skip the check target during stage0.
+	SkipCheckEarly bool
 	// Name of the check target, zero value is equivalent to "check".
 	Check []string
 	// Replaces the default install command.
@@ -80,11 +51,11 @@ var _ Helper = new(MakeHelper)
 
 // extra returns make and other optional dependencies.
 func (attr *MakeHelper) extra(flag int) P {
-	extra := P{Make}
+	extra := P{_make}
 	if (attr == nil || !attr.OmitDefaults) && flag&TEarly == 0 {
 		extra = append(extra,
-			Gawk,
+			_gawk,
-			Coreutils,
+			_coreutils,
 		)
 	}
 	return extra
@@ -111,19 +82,16 @@ func (attr *MakeHelper) scriptEarly() string {
 	return generate
 }
 
-// createDir returns false.
-func (*MakeHelper) createDir() bool { return false }
-
 // wantsDir requests a new directory in TMPDIR, or omits the cd statement if InPlace.
-func (attr *MakeHelper) wantsDir() string {
+func (attr *MakeHelper) wantsDir() (string, bool) {
 	if attr != nil && attr.InPlace {
-		return helperInPlace
+		return helperInPlace, false
 	}
-	return `"$(mktemp -d)"`
+	return `"$(mktemp -d)"`, false
 }
 
 // script generates the cure script.
-func (attr *MakeHelper) script(name string) string {
+func (attr *MakeHelper) script(t Toolchain, name string) string {
 	if attr == nil {
 		attr = new(MakeHelper)
 	}
@@ -194,7 +162,8 @@ make \
 	}
 	scriptMake += "\n"
 
-	if !attr.SkipCheck && presetOpts&OptSkipCheck == 0 {
+	if !attr.SkipCheck && t.opts&OptSkipCheck == 0 &&
+		(!attr.SkipCheckEarly || !t.stage.isStage0()) {
 		scriptMake += attr.ScriptCheckEarly + `make \
 	` + jobsFlagE + ` \
 	`

internal/rosa/mesa.go

@@ -1,66 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newLibglvnd() (pkg.Artifact, string) {
-	const (
-		version  = "1.7.0"
-		checksum = "eIQJK2sgFQDHdeFkQO87TrSUaZRFG4y2DrwA8Ut-sGboI59uw1OOiIVqq2AIwnGY"
-	)
-	return t.NewPackage("libglvnd", version, newFromGitLab(
-		"gitlab.freedesktop.org",
-		"glvnd/libglvnd",
-		"v"+version,
-		checksum,
-	), nil, (*MesonHelper)(nil),
-		Binutils, // symbols check fail with llvm nm
-	), version
-}
-func init() {
-	artifactsM[Libglvnd] = Metadata{
-		f: Toolchain.newLibglvnd,
-
-		Name:        "libglvnd",
-		Description: "The GL Vendor-Neutral Dispatch library",
-		Website:     "https://gitlab.freedesktop.org/glvnd/libglvnd",
-
-		ID: 12098,
-	}
-}
-
-func (t Toolchain) newLibdrm() (pkg.Artifact, string) {
-	const (
-		version  = "2.4.133"
-		checksum = "bfj296NcR9DndO11hqDbSRFPqaweSLMqRk3dlCPZpM6FONX1WZ9J4JdbTDMUd1rU"
-	)
-	return t.NewPackage("libdrm", version, newFromGitLab(
-		"gitlab.freedesktop.org",
-		"mesa/libdrm",
-		"libdrm-"+version,
-		checksum,
-	), nil, &MesonHelper{
-		Setup: []KV{
-			{"Dintel", "enabled"},
-		},
-	},
-		Binutils, // symbols check fail with llvm nm
-
-		Libpciaccess,
-		KernelHeaders,
-	), version
-}
-func init() {
-	artifactsM[Libdrm] = Metadata{
-		f: Toolchain.newLibdrm,
-
-		Name:        "libdrm",
-		Description: "a userspace library for accessing the DRM",
-		Website:     "https://dri.freedesktop.org/",
-
-		Dependencies: P{
-			Libpciaccess,
-		},
-
-		ID: 1596,
-	}
-}

internal/rosa/meson.go

@@ -3,72 +3,9 @@ package rosa
 import (
 	"slices"
 	"strings"
-
-	"hakurei.app/internal/pkg"
 )
 
-func (t Toolchain) newMeson() (pkg.Artifact, string) {
+var _meson = H("meson")
-	const (
-		version  = "1.11.1"
-		checksum = "uvILRxdopwc6Dy17UbIeClcQr0qHqyTaqyk1M9OqWKN9PwB9N6UVAiyN8kSSz3r2"
-	)
-	return t.NewPackage("meson", version, newFromGitHub(
-		"mesonbuild/meson",
-		version,
-		checksum,
-	), &PackageAttr{
-		Env: []string{
-			"CMAKE_MAKE_PROGRAM=ninja",
-		},
-	}, &PipHelper{
-		EnterSource: true,
-		Check: `
-cd 'test cases'
-rm -rf \
-	'common/32 has header' \
-	'common/66 vcstag' \
-	'common/153 wrap file should not failed' \
-	'common/184 openmp' \
-	'common/189 check header' \
-	'linuxlike/6 subdir include order' \
-	'linuxlike/9 compiler checks with dependencies' \
-	'linuxlike/13 cmake dependency' \
-	'frameworks/15 llvm' \
-	'frameworks/29 blocks'
-cd ..
-
-python3 ./run_project_tests.py \
-	-v \
-	` + jobsFlagE + ` \
-	--failfast \
-	--backend=ninja
-`,
-	},
-		PythonSetuptools,
-		PkgConfig,
-		CMake,
-		Ninja,
-		PythonPyTest,
-	), version
-}
-func init() {
-	artifactsM[Meson] = Metadata{
-		f: Toolchain.newMeson,
-
-		Name:        "meson",
-		Description: "an open source build system",
-		Website:     "https://mesonbuild.com/",
-
-		Dependencies: P{
-			Python,
-			PkgConfig,
-			CMake,
-			Ninja,
-		},
-
-		ID: 6472,
-	}
-}
 
 // MesonHelper is the [Meson] build system helper.
 type MesonHelper struct {
@@ -88,7 +25,7 @@ type MesonHelper struct {
 var _ Helper = new(MesonHelper)
 
 // extra returns hardcoded meson runtime dependencies.
-func (*MesonHelper) extra(int) P { return P{Meson} }
+func (*MesonHelper) extra(int) P { return P{_meson} }
 
 // wantsChmod returns false.
 func (*MesonHelper) wantsChmod() bool { return false }
@@ -99,14 +36,11 @@ func (*MesonHelper) wantsWrite() bool { return false }
 // scriptEarly returns the zero value.
 func (*MesonHelper) scriptEarly() string { return "" }
 
-// createDir returns false.
-func (*MesonHelper) createDir() bool { return false }
-
 // wantsDir requests a new directory in TMPDIR.
-func (*MesonHelper) wantsDir() string { return `"$(mktemp -d)"` }
+func (*MesonHelper) wantsDir() (string, bool) { return `"$(mktemp -d)"`, false }
 
 // script generates the cure script.
-func (attr *MesonHelper) script(name string) string {
+func (attr *MesonHelper) script(t Toolchain, name string) string {
 	if attr == nil {
 		attr = new(MesonHelper)
 	}
@@ -117,7 +51,7 @@ func (attr *MesonHelper) script(name string) string {
 	}
 
 	var scriptTest string
-	if !attr.SkipTest && presetOpts&OptSkipCheck == 0 {
+	if !attr.SkipTest && t.opts&OptSkipCheck == 0 {
 		scriptTest = `
 meson test \
 	--print-errorlogs`
@@ -128,7 +62,7 @@ cd "$(mktemp -d)"
 meson setup \
 	` + strings.Join(slices.Collect(func(yield func(string) bool) {
 		for _, v := range append([]KV{
-			{"wrap-mode", "nodownload"},
+			{"wrap-mode", "nofallback"},
 			{"prefix", "/system"},
 			{"buildtype", "release"},
 		}, attr.Setup...) {

internal/rosa/mksh.go

@@ -1,45 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newMksh() (pkg.Artifact, string) {
-	const (
-		version  = "59c"
-		checksum = "0Zj-k4nXEu3IuJY4lvwD2OrC2t27GdZj8SPy4DoaeuBRH1padWb7oREpYgwY8JNq"
-	)
-	return t.New("mksh-"+version, 0, t.AppendPresets(nil,
-		Perl,
-		Coreutils,
-	), nil, []string{
-		"LDSTATIC=-static",
-		"CPPFLAGS=-DMKSH_DEFAULT_PROFILEDIR=\\\"/system/etc\\\"",
-	}, `
-cd "$(mktemp -d)"
-sh /usr/src/mksh/Build.sh -r
-CPPFLAGS="${CPPFLAGS} -DMKSH_BINSHPOSIX -DMKSH_BINSHREDUCED" \
-sh /usr/src/mksh/Build.sh -r -L
-./test.sh -C regress:no-ctty
-
-mkdir -p /work/system/bin/
-cp -v mksh /work/system/bin/
-cp -v lksh /work/system/bin/sh
-
-mkdir -p /work/bin/
-ln -vs ../system/bin/sh /work/bin/
-`, pkg.Path(AbsUsrSrc.Append("mksh"), false, newTar(
-		"https://mbsd.evolvis.org/MirOS/dist/mir/mksh/mksh-R"+version+".tgz",
-		checksum,
-		pkg.TarGzip,
-	))), version
-}
-func init() {
-	artifactsM[Mksh] = Metadata{
-		f: Toolchain.newMksh,
-
-		Name:        "mksh",
-		Description: "MirBSD Korn Shell",
-		Website:     "https://www.mirbsd.org/mksh",
-
-		ID: 5590,
-	}
-}

internal/rosa/musl-fts.go

@@ -1,36 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newMuslFts() (pkg.Artifact, string) {
-	const (
-		version  = "1.2.7"
-		checksum = "N_p_ZApX3eHt7xoDCw1hLf6XdJOw7ZSx7xPvpvAP0knG2zgU0zeN5w8tt5Pg60XJ"
-	)
-	return t.NewPackage("musl-fts", version, newFromGitHub(
-		"void-linux/musl-fts",
-		"v"+version,
-		checksum,
-	), &PackageAttr{
-		Env: []string{
-			"CC=cc -fPIC",
-		},
-	}, &MakeHelper{
-		Generate: "./bootstrap.sh",
-	},
-		Automake,
-		Libtool,
-		PkgConfig,
-	), version
-}
-func init() {
-	artifactsM[MuslFts] = Metadata{
-		f: Toolchain.newMuslFts,
-
-		Name:        "musl-fts",
-		Description: "implementation of fts(3) functions which are missing in musl libc",
-		Website:     "https://github.com/void-linux/musl-fts",
-
-		ID: 26980,
-	}
-}

internal/rosa/musl-obstack.go

@@ -1,36 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newMuslObstack() (pkg.Artifact, string) {
-	const (
-		version  = "1.2.3"
-		checksum = "tVRY_KjIlkkMszcaRlkKdBVQHIXTT_T_TiMxbwErlILXrOBosocg8KklppZhNdCG"
-	)
-	return t.NewPackage("musl-obstack", version, newFromGitHub(
-		"void-linux/musl-obstack",
-		"v"+version,
-		checksum,
-	), &PackageAttr{
-		Env: []string{
-			"CC=cc -fPIC",
-		},
-	}, &MakeHelper{
-		Generate: "./bootstrap.sh",
-	},
-		Automake,
-		Libtool,
-		PkgConfig,
-	), version
-}
-func init() {
-	artifactsM[MuslObstack] = Metadata{
-		f: Toolchain.newMuslObstack,
-
-		Name:        "musl-obstack",
-		Description: "obstack functions and macros separated from glibc",
-		Website:     "https://github.com/void-linux/musl-obstack",
-
-		ID: 146206,
-	}
-}

internal/rosa/musl.go

@@ -1,81 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newMusl(headers bool) (pkg.Artifact, string) {
-	const (
-		version  = "1.2.6"
-		checksum = "WtWb_OV_XxLDAB5NerOL9loLlHVadV00MmGk65PPBU1evaolagoMHfvpZp_vxEzS"
-	)
-
-	name := "musl"
-	helper := MakeHelper{
-		OmitDefaults: true,
-		SkipCheck:    true,
-		Script: `
-mkdir -p /work/system/bin
-COMPAT_LINKER_NAME="ld-musl-` + linuxArch() + `.so.1"
-ln -vs ../lib/libc.so /work/system/bin/linker
-ln -vs ../lib/libc.so /work/system/bin/ldd
-ln -vs libc.so "/work/system/lib/${COMPAT_LINKER_NAME}"
-rm -v "/work/lib/${COMPAT_LINKER_NAME}"
-rmdir -v /work/lib
-`,
-	}
-
-	if headers {
-		name += "-headers"
-		helper.Make = []string{
-			"DESTDIR=/work",
-			"install-headers",
-		}
-		helper.Install = "# headers installed during make"
-		helper.Script = ""
-	}
-
-	env := []string{
-		"LDFLAGS=" + earlyLDFLAGS(false),
-	}
-	if t.isStage0() {
-		env = append(env,
-			"CC=clang",
-			"AR=ar",
-			"RANLIB=ranlib",
-		)
-	}
-
-	return t.NewPackage(name, version, newTar(
-		"https://musl.libc.org/releases/musl-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), &PackageAttr{
-		// expected to be writable in copies
-		Chmod: true,
-
-		Env: env,
-	}, &helper,
-		Coreutils,
-	), version
-}
-func init() {
-	artifactsM[Musl] = Metadata{
-		f: func(t Toolchain) (pkg.Artifact, string) {
-			return t.newMusl(false)
-		},
-
-		Name:        "musl",
-		Description: "an implementation of the C standard library",
-		Website:     "https://musl.libc.org/",
-
-		ID: 11688,
-	}
-
-	artifactsM[muslHeaders] = Metadata{
-		f: func(t Toolchain) (pkg.Artifact, string) {
-			return t.newMusl(true)
-		},
-
-		Name:        "musl-headers",
-		Description: "system installation of musl headers",
-	}
-}

internal/rosa/ncurses.go

@@ -1,38 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newNcurses() (pkg.Artifact, string) {
-	const (
-		version  = "6.6"
-		checksum = "XvWp4xi6hR_hH8XUoGY26L_pqBSDapJYulhzZqPuR0KNklqypqNc1yNXU-nOjf5w"
-	)
-	return t.NewPackage("ncurses", version, newTar(
-		"https://ftpmirror.gnu.org/gnu/ncurses/ncurses-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), nil, &MakeHelper{
-		// "tests" are actual demo programs, not a test suite.
-		SkipCheck: true,
-
-		Configure: []KV{
-			{"with-pkg-config"},
-			{"enable-pc-files"},
-			{"with-shared"},
-			{"with-cxx-shared"},
-		},
-	},
-		PkgConfig,
-	), version
-}
-func init() {
-	artifactsM[Ncurses] = Metadata{
-		f: Toolchain.newNcurses,
-
-		Name:        "ncurses",
-		Description: "a free software emulation of curses in System V Release 4.0 (SVr4)",
-		Website:     "https://invisible-island.net/ncurses/",
-
-		ID: 373226,
-	}
-}

internal/rosa/netfilter.go

@@ -1,147 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newLibmnl() (pkg.Artifact, string) {
-	const (
-		version  = "1.0.5"
-		checksum = "DN-vbbvQDpxXJm0TJ6xlluILvfrB86avrCTX50XyE9SEFSAZ_o8nuKc5Gu0Am7-u"
-	)
-	return t.NewPackage("libmnl", version, newTar(
-		"https://www.netfilter.org/projects/libmnl/files/"+
-			"libmnl-"+version+".tar.bz2",
-		checksum,
-		pkg.TarBzip2,
-	), &PackageAttr{
-		Patches: []KV{
-			{"libbsd-sys-queue", `diff --git a/examples/netfilter/nfct-daemon.c b/examples/netfilter/nfct-daemon.c
-index d223ac2..a7878d0 100644
---- a/examples/netfilter/nfct-daemon.c
-+++ b/examples/netfilter/nfct-daemon.c
-@@ -20,7 +20,7 @@
- #include <linux/netfilter/nfnetlink.h>
- #include <linux/netfilter/nfnetlink_conntrack.h>
- 
--#include <sys/queue.h>
-+#include <bsd/sys/queue.h>
- 
- struct nstats {
- 	LIST_ENTRY(nstats)	list;
-`},
-		},
-	}, &MakeHelper{
-		Configure: []KV{
-			{"enable-static"},
-		},
-	},
-		Libbsd,
-		KernelHeaders,
-	), version
-}
-func init() {
-	artifactsM[Libmnl] = Metadata{
-		f: Toolchain.newLibmnl,
-
-		Name:        "libmnl",
-		Description: "a minimalistic user-space library oriented to Netlink developers",
-		Website:     "https://www.netfilter.org/projects/libmnl/",
-
-		ID: 1663,
-	}
-}
-
-func (t Toolchain) newLibnftnl() (pkg.Artifact, string) {
-	const (
-		version  = "1.3.1"
-		checksum = "91ou66K-I17iX6DB6hiQkhhC_v4DFW5iDGzwjVRNbJNEmKqowLZBlh3FY-ZDO0r9"
-	)
-	return t.NewPackage("libnftnl", version, t.newTagRemote(
-		"https://git.netfilter.org/libnftnl",
-		"libnftnl-"+version, checksum,
-	), &PackageAttr{
-		Env: []string{
-			"CFLAGS=-D_GNU_SOURCE",
-		},
-	}, &MakeHelper{
-		Generate: "./autogen.sh",
-		Configure: []KV{
-			{"enable-static"},
-		},
-	},
-		Automake,
-		Libtool,
-		PkgConfig,
-
-		Libmnl,
-		KernelHeaders,
-	), version
-}
-func init() {
-	artifactsM[Libnftnl] = Metadata{
-		f: Toolchain.newLibnftnl,
-
-		Name:        "libnftnl",
-		Description: "a userspace library providing a low-level netlink API to the in-kernel nf_tables subsystem",
-		Website:     "https://www.netfilter.org/projects/libnftnl/",
-
-		Dependencies: P{
-			Libmnl,
-		},
-
-		ID: 1681,
-	}
-}
-
-func (t Toolchain) newIPTables() (pkg.Artifact, string) {
-	const (
-		version  = "1.8.13"
-		checksum = "TUA-cFIAsiMvtRR-XzQvXzoIhJUOc9J2gQDJCbBRjmgmVfGfPTCf58wL7e-cUKVQ"
-	)
-	return t.NewPackage("iptables", version, t.newTagRemote(
-		"https://git.netfilter.org/iptables",
-		"v"+version, checksum,
-	), &PackageAttr{
-		ScriptEarly: `
-rm \
-	extensions/libxt_connlabel.txlate \
-	extensions/libxt_conntrack.txlate
-sed -i \
-	's/de:ad:0:be:ee:ff/DE:AD:00:BE:EE:FF/g' \
-	extensions/libebt_dnat.txlate \
-	extensions/libebt_snat.txlate
-`,
-	}, &MakeHelper{
-		Generate: "./autogen.sh",
-		Configure: []KV{
-			{"enable-static"},
-		},
-		ScriptCheckEarly: `
-ln -s ../system/bin/bash /bin/
-chmod +w /etc/ && ln -s ../usr/src/iptables/etc/ethertypes /etc/
-		`,
-	},
-		Automake,
-		Libtool,
-		PkgConfig,
-		Bash,
-		Python,
-
-		Libnftnl,
-		KernelHeaders,
-	), version
-}
-func init() {
-	artifactsM[IPTables] = Metadata{
-		f: Toolchain.newIPTables,
-
-		Name:        "iptables",
-		Description: "the userspace command line program used to configure the Linux 2.4.x and later packet filtering ruleset",
-		Website:     "https://www.netfilter.org/projects/iptables/",
-
-		Dependencies: P{
-			Libnftnl,
-		},
-
-		ID: 1394,
-	}
-}

internal/rosa/nettle.go

@@ -1,35 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newNettle() (pkg.Artifact, string) {
-	const (
-		version  = "4.0"
-		checksum = "6agC-vHzzoqAlaX3K9tX8yHgrm03HLqPZzVzq8jh_ePbuPMIvpxereu_uRJFmQK7"
-	)
-	return t.NewPackage("nettle", version, newTar(
-		"https://ftpmirror.gnu.org/gnu/nettle/nettle-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), nil, (*MakeHelper)(nil),
-		M4,
-		Diffutils,
-
-		GMP,
-	), version
-}
-func init() {
-	artifactsM[Nettle] = Metadata{
-		f: Toolchain.newNettle,
-
-		Name:        "nettle",
-		Description: "a low-level cryptographic library",
-		Website:     "https://www.lysator.liu.se/~nisse/nettle/",
-
-		Dependencies: P{
-			GMP,
-		},
-
-		ID: 2073,
-	}
-}

internal/rosa/nettle3.go

@@ -1,33 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newNettle3() (pkg.Artifact, string) {
-	const (
-		version  = "3.10.2"
-		checksum = "07aXlj10X5llf67jIqRQAA1pgLSgb0w_JYggZVPuKNoc-B-_usb5Kr8FrfBe7g1S"
-	)
-	return t.NewPackage("nettle", version, newTar(
-		"https://ftpmirror.gnu.org/gnu/nettle/nettle-"+version+".tar.gz",
-		checksum,
-		pkg.TarGzip,
-	), nil, (*MakeHelper)(nil),
-		M4,
-		Diffutils,
-
-		GMP,
-	), version
-}
-func init() {
-	artifactsM[nettle3] = Metadata{
-		f: Toolchain.newNettle3,
-
-		Name:        "nettle3",
-		Description: "a low-level cryptographic library",
-		Website:     "https://www.lysator.liu.se/~nisse/nettle/",
-
-		Dependencies: P{
-			GMP,
-		},
-	}
-}

internal/rosa/ninja.go

@@ -1,49 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newNinja() (pkg.Artifact, string) {
-	const (
-		version  = "1.13.2"
-		checksum = "ygKWMa0YV2lWKiFro5hnL-vcKbc_-RACZuPu0Io8qDvgQlZ0dxv7hPNSFkt4214v"
-	)
-	return t.New("ninja-"+version, 0, []pkg.Artifact{
-		t.Load(Python),
-		t.Load(Bash),
-	}, nil, nil, `
-cd "$(mktemp -d)"
-python3 /usr/src/ninja/configure.py \
-	--verbose \
-	--bootstrap \
-	--gtest-source-dir=/usr/src/googletest
-./ninja `+jobsFlagE+` all
-./ninja_test
-
-mkdir -p /work/system/bin/
-cp ninja /work/system/bin/
-`, pkg.Path(AbsUsrSrc.Append("googletest"), false,
-		newFromGitHubRelease(
-			"google/googletest",
-			"v1.16.0",
-			"googletest-1.16.0.tar.gz",
-			"NjLGvSbgPy_B-y-o1hdanlzEzaYeStFcvFGxpYV3KYlhrWWFRcugYhM3ZMzOA9B_",
-			pkg.TarGzip,
-		)), pkg.Path(AbsUsrSrc.Append("ninja"), true, t.NewPatchedSource(
-		"ninja", version, newFromGitHub(
-			"ninja-build/ninja",
-			"v"+version,
-			checksum,
-		), false,
-	))), version
-}
-func init() {
-	artifactsM[Ninja] = Metadata{
-		f: Toolchain.newNinja,
-
-		Name:        "ninja",
-		Description: "a small build system with a focus on speed",
-		Website:     "https://ninja-build.org/",
-
-		ID: 2089,
-	}
-}