internal/pkg: skip resolved cure errors

This significantly improves error resolution performance. Signed-off-by: Ophestra <cat@gensokyo.uk>
internal/pkg: buffer tar reader
2026-02-11 17:50:18 +09:00 · 2026-02-11 02:08:44 +09:00 · 2026-02-11 02:02:46 +09:00 · 2026-02-11 01:36:41 +09:00 · 2026-02-11 00:40:54 +09:00 · 2026-02-10 22:31:08 +09:00
24 changed files with 1180 additions and 660 deletions
--- a/cmd/irdump/main.go
+++ b/cmd/irdump/main.go
@@ -1,76 +0,0 @@
-package main
-
-import (
-	"errors"
-	"log"
-	"os"
-
-	"hakurei.app/command"
-	"hakurei.app/internal/pkg"
-)
-
-func main() {
-	log.SetFlags(0)
-	log.SetPrefix("irdump: ")
-
-	var (
-		flagOutput string
-		flagReal   bool
-		flagHeader bool
-		flagForce  bool
-		flagRaw    bool
-	)
-	c := command.New(os.Stderr, log.Printf, "irdump", func(args []string) (err error) {
-		var input *os.File
-		if len(args) != 1 {
-			return errors.New("irdump requires 1 argument")
-		}
-		if input, err = os.Open(args[0]); err != nil {
-			return
-		}
-		defer input.Close()
-
-		var output *os.File
-		if flagOutput == "" {
-			output = os.Stdout
-		} else {
-			defer output.Close()
-			if output, err = os.Create(flagOutput); err != nil {
-				return
-			}
-		}
-
-		var out string
-		if out, err = pkg.Disassemble(input, flagReal, flagHeader, flagForce, flagRaw); err != nil {
-			return
-		}
-		if _, err = output.WriteString(out); err != nil {
-			return
-		}
-		return
-	}).Flag(
-		&flagOutput,
-		"o", command.StringFlag(""),
-		"Output file for asm (leave empty for stdout)",
-	).Flag(
-		&flagReal,
-		"r", command.BoolFlag(false),
-		"skip label generation; idents print real value",
-	).Flag(
-		&flagHeader,
-		"H", command.BoolFlag(false),
-		"display artifact headers",
-	).Flag(
-		&flagForce,
-		"f", command.BoolFlag(false),
-		"force display (skip validations)",
-	).Flag(
-		&flagRaw,
-		"R", command.BoolFlag(false),
-		"don't format output",
-	)
-
-	c.MustParse(os.Args[1:], func(err error) {
-		log.Fatal(err)
-	})
-}
--- a/cmd/mbf/main.go
+++ b/cmd/mbf/main.go
@@ -109,46 +109,92 @@ func main() {
 		)
 	}

-	c.NewCommand(
-		"stage3",
-		"Check for toolchain 3-stage non-determinism",
-		func(args []string) (err error) {
-			_, _, _, stage1 := (rosa.Std - 2).NewLLVM()
-			_, _, _, stage2 := (rosa.Std - 1).NewLLVM()
-			_, _, _, stage3 := rosa.Std.NewLLVM()
-			var (
-				pathname *check.Absolute
-				checksum [2]unique.Handle[pkg.Checksum]
-			)
+	{
+		var (
+			flagGentoo   string
+			flagChecksum string

-			if pathname, _, err = cache.Cure(stage1); err != nil {
-				return err
-			}
-			log.Println("stage1:", pathname)
+			flagStage0 bool
+		)
+		c.NewCommand(
+			"stage3",
+			"Check for toolchain 3-stage non-determinism",
+			func(args []string) (err error) {
+				std := rosa.Std
+				if flagGentoo != "" {
+					std -= 3 // magic number to discourage misuse

-			if pathname, checksum[0], err = cache.Cure(stage2); err != nil {
-				return err
-			}
-			log.Println("stage2:", pathname)
-			if pathname, checksum[1], err = cache.Cure(stage3); err != nil {
-				return err
-			}
-			log.Println("stage3:", pathname)
-
-			if checksum[0] != checksum[1] {
-				err = &pkg.ChecksumMismatchError{
-					Got:  checksum[0].Value(),
-					Want: checksum[1].Value(),
+					var checksum pkg.Checksum
+					if len(flagChecksum) != 0 {
+						if err = pkg.Decode(&checksum, flagChecksum); err != nil {
+							return
+						}
+					}
+					rosa.SetGentooStage3(flagGentoo, checksum)
 				}
-			} else {
-				log.Println(
-					"stage2 is identical to stage3",
-					"("+pkg.Encode(checksum[0].Value())+")",
+
+				_, _, _, stage1 := (std - 2).NewLLVM()
+				_, _, _, stage2 := (std - 1).NewLLVM()
+				_, _, _, stage3 := std.NewLLVM()
+				var (
+					pathname *check.Absolute
+					checksum [2]unique.Handle[pkg.Checksum]
 				)
-			}
-			return
-		},
-	)
+
+				if pathname, _, err = cache.Cure(stage1); err != nil {
+					return err
+				}
+				log.Println("stage1:", pathname)
+
+				if pathname, checksum[0], err = cache.Cure(stage2); err != nil {
+					return err
+				}
+				log.Println("stage2:", pathname)
+				if pathname, checksum[1], err = cache.Cure(stage3); err != nil {
+					return err
+				}
+				log.Println("stage3:", pathname)
+
+				if checksum[0] != checksum[1] {
+					err = &pkg.ChecksumMismatchError{
+						Got:  checksum[0].Value(),
+						Want: checksum[1].Value(),
+					}
+				} else {
+					log.Println(
+						"stage2 is identical to stage3",
+						"("+pkg.Encode(checksum[0].Value())+")",
+					)
+				}
+
+				if flagStage0 {
+					if pathname, _, err = cache.Cure(
+						std.Load(rosa.Stage0),
+					); err != nil {
+						return err
+					}
+					log.Println(pathname)
+				}
+
+				return
+			},
+		).
+			Flag(
+				&flagGentoo,
+				"gentoo", command.StringFlag(""),
+				"Bootstrap from a Gentoo stage3 tarball",
+			).
+			Flag(
+				&flagChecksum,
+				"checksum", command.StringFlag(""),
+				"Checksum of Gentoo stage3 tarball",
+			).
+			Flag(
+				&flagStage0,
+				"stage0", command.BoolFlag(false),
+				"Create bootstrap stage0 tarball",
+			)
+	}

 	{
 		var (
--- a/container/container_test.go
+++ b/container/container_test.go
@@ -274,13 +274,13 @@ var containerTestCases = []struct {
 			Dev(check.MustAbs("/dev"), true),
 		),
 		earlyMnt(
-			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore),
-			ent("/null", "/dev/null", ignore, "devtmpfs", "devtmpfs", ignore),
-			ent("/zero", "/dev/zero", ignore, "devtmpfs", "devtmpfs", ignore),
-			ent("/full", "/dev/full", ignore, "devtmpfs", "devtmpfs", ignore),
-			ent("/random", "/dev/random", ignore, "devtmpfs", "devtmpfs", ignore),
-			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", "devtmpfs", ignore),
-			ent("/tty", "/dev/tty", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", ignore, ignore),
+			ent("/null", "/dev/null", ignore, "devtmpfs", ignore, ignore),
+			ent("/zero", "/dev/zero", ignore, "devtmpfs", ignore, ignore),
+			ent("/full", "/dev/full", ignore, "devtmpfs", ignore, ignore),
+			ent("/random", "/dev/random", ignore, "devtmpfs", ignore, ignore),
+			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", ignore, ignore),
+			ent("/tty", "/dev/tty", ignore, "devtmpfs", ignore, ignore),
 			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
 			ent("/", "/dev/mqueue", "rw,nosuid,nodev,noexec,relatime", "mqueue", "mqueue", "rw"),
 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
@@ -292,13 +292,13 @@ var containerTestCases = []struct {
 			Dev(check.MustAbs("/dev"), false),
 		),
 		earlyMnt(
-			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore),
-			ent("/null", "/dev/null", ignore, "devtmpfs", "devtmpfs", ignore),
-			ent("/zero", "/dev/zero", ignore, "devtmpfs", "devtmpfs", ignore),
-			ent("/full", "/dev/full", ignore, "devtmpfs", "devtmpfs", ignore),
-			ent("/random", "/dev/random", ignore, "devtmpfs", "devtmpfs", ignore),
-			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", "devtmpfs", ignore),
-			ent("/tty", "/dev/tty", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", ignore, ignore),
+			ent("/null", "/dev/null", ignore, "devtmpfs", ignore, ignore),
+			ent("/zero", "/dev/zero", ignore, "devtmpfs", ignore, ignore),
+			ent("/full", "/dev/full", ignore, "devtmpfs", ignore, ignore),
+			ent("/random", "/dev/random", ignore, "devtmpfs", ignore, ignore),
+			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", ignore, ignore),
+			ent("/tty", "/dev/tty", ignore, "devtmpfs", ignore, ignore),
 			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
 		),
@@ -690,14 +690,22 @@ func init() {
 						return fmt.Errorf("got more than %d entries", len(mnt))
 					}

-					// ugly hack but should be reliable and is less likely to false negative than comparing by parsed flags
-					cur.VfsOptstr = strings.TrimSuffix(cur.VfsOptstr, ",relatime")
-					cur.VfsOptstr = strings.TrimSuffix(cur.VfsOptstr, ",noatime")
-					mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",relatime")
-					mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",noatime")
-
-					cur.FsOptstr = strings.Replace(cur.FsOptstr, ",seclabel", "", 1)
-					mnt[i].FsOptstr = strings.Replace(mnt[i].FsOptstr, ",seclabel", "", 1)
+					// ugly hack but should be reliable and is less likely to
+					//false negative than comparing by parsed flags
+					for _, s := range []string{
+						"relatime",
+						"noatime",
+					} {
+						cur.VfsOptstr = strings.TrimSuffix(cur.VfsOptstr, ","+s)
+						mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ","+s)
+					}
+					for _, s := range []string{
+						"seclabel",
+						"inode64",
+					} {
+						cur.FsOptstr = strings.Replace(cur.FsOptstr, ","+s, "", 1)
+						mnt[i].FsOptstr = strings.Replace(mnt[i].FsOptstr, ","+s, "", 1)
+					}

 					if !cur.EqualWithIgnore(mnt[i], "\x00") {
 						fail = true
--- a/container/seccomp/presets_riscv64_test.go
+++ b/container/seccomp/presets_riscv64_test.go
@@ -0,0 +1,27 @@
+package seccomp_test
+
+import (
+	. "hakurei.app/container/seccomp"
+	. "hakurei.app/container/std"
+)
+
+var bpfExpected = bpfLookup{
+	{AllowMultiarch | AllowCAN |
+		AllowBluetooth, PresetExt |
+		PresetDenyNS | PresetDenyTTY | PresetDenyDevel |
+		PresetLinux32}: toHash(
+		"a1c4ffa35f4bfbf38061184760b9a09edfcb4964c3b534395e47327b83f3fb61f2f9573ddfcc4772424cc2f5dd12fd32471e6531dbe10e85eda3797dd4fa179f"),
+
+	{0, 0}: toHash(
+		"f3910fd727d087def593e3876c2c6ab9ace71d82ec8cbc992a26223e7bba85e1d7a0b56c5fc6303703f24595825dad8561637edaedd5384b34a6cd080946633c"),
+	{0, PresetExt}: toHash(
+		"741438c5e3f11c36c92ae8c5934f13440675c6e719541c2dbffeda79a10081bcfd9ad8314a60c1d1f53db86c8080c13fffa3bbcf7fe753935679b4b902737286"),
+	{0, PresetStrict}: toHash(
+		"79e9e464d02405c6d74fd2c771bd72a1311e488221c73a9c32db9270219837c54fccec2f36fe2474895547e60c311514567e2e6cf4e7a7fcf909c1ecd1e254a7"),
+	{0, PresetDenyNS | PresetDenyTTY | PresetDenyDevel}: toHash(
+		"3c443715a6c1e557a284862ea8efb70a5d4ecbe67d1226627323e861cd3646fb3e7768ec5b94b93760b7f652cf6916f66e317a4fbf8716d10c3673aa4fc3ae58"),
+	{0, PresetExt | PresetDenyDevel}: toHash(
+		"4448a74e8cc75a4ab63799c4f2cc2a5af63e5f4e8e9b8ac15a1873d647dfa67a4c67b39ed466d8dd32abc64136d401879fc6185c9ab00feeaf59ccf4305f8201"),
+	{0, PresetExt | PresetDenyNS | PresetDenyDevel}: toHash(
+		"c7c86e793cb7192f5f6c735f372cda27eb43ae1045e587f8eadb64c849520a3280b6570a3d7b601d32cddb38021585a2234db38e506cebfd10aa3d6c75440f17"),
+}
--- a/container/std/mksysnum_linux.pl
+++ b/container/std/mksysnum_linux.pl
@@ -12,6 +12,7 @@ my %syscall_cutoff_arch = (
 	"x86" => 340,
 	"x86_64" => 302,
 	"aarch64" => 281,
+	"riscv64" => 281,
 );

 print <<EOF;
--- a/container/std/syscall_extra_linux_riscv64.go
+++ b/container/std/syscall_extra_linux_riscv64.go
@@ -0,0 +1,55 @@
+package std
+
+import "syscall"
+
+const (
+	SYS_NEWFSTATAT = syscall.SYS_FSTATAT
+)
+
+var syscallNumExtra = map[string]ScmpSyscall{
+	"uselib":          SNR_USELIB,
+	"clock_adjtime64": SNR_CLOCK_ADJTIME64,
+	"clock_settime64": SNR_CLOCK_SETTIME64,
+	"umount":          SNR_UMOUNT,
+	"chown":           SNR_CHOWN,
+	"chown32":         SNR_CHOWN32,
+	"fchown32":        SNR_FCHOWN32,
+	"lchown":          SNR_LCHOWN,
+	"lchown32":        SNR_LCHOWN32,
+	"setgid32":        SNR_SETGID32,
+	"setgroups32":     SNR_SETGROUPS32,
+	"setregid32":      SNR_SETREGID32,
+	"setresgid32":     SNR_SETRESGID32,
+	"setresuid32":     SNR_SETRESUID32,
+	"setreuid32":      SNR_SETREUID32,
+	"setuid32":        SNR_SETUID32,
+	"modify_ldt":      SNR_MODIFY_LDT,
+	"subpage_prot":    SNR_SUBPAGE_PROT,
+	"switch_endian":   SNR_SWITCH_ENDIAN,
+	"vm86":            SNR_VM86,
+	"vm86old":         SNR_VM86OLD,
+}
+
+const (
+	SNR_USELIB          ScmpSyscall = __PNR_uselib
+	SNR_CLOCK_ADJTIME64 ScmpSyscall = __PNR_clock_adjtime64
+	SNR_CLOCK_SETTIME64 ScmpSyscall = __PNR_clock_settime64
+	SNR_UMOUNT          ScmpSyscall = __PNR_umount
+	SNR_CHOWN           ScmpSyscall = __PNR_chown
+	SNR_CHOWN32         ScmpSyscall = __PNR_chown32
+	SNR_FCHOWN32        ScmpSyscall = __PNR_fchown32
+	SNR_LCHOWN          ScmpSyscall = __PNR_lchown
+	SNR_LCHOWN32        ScmpSyscall = __PNR_lchown32
+	SNR_SETGID32        ScmpSyscall = __PNR_setgid32
+	SNR_SETGROUPS32     ScmpSyscall = __PNR_setgroups32
+	SNR_SETREGID32      ScmpSyscall = __PNR_setregid32
+	SNR_SETRESGID32     ScmpSyscall = __PNR_setresgid32
+	SNR_SETRESUID32     ScmpSyscall = __PNR_setresuid32
+	SNR_SETREUID32      ScmpSyscall = __PNR_setreuid32
+	SNR_SETUID32        ScmpSyscall = __PNR_setuid32
+	SNR_MODIFY_LDT      ScmpSyscall = __PNR_modify_ldt
+	SNR_SUBPAGE_PROT    ScmpSyscall = __PNR_subpage_prot
+	SNR_SWITCH_ENDIAN   ScmpSyscall = __PNR_switch_endian
+	SNR_VM86            ScmpSyscall = __PNR_vm86
+	SNR_VM86OLD         ScmpSyscall = __PNR_vm86old
+)
--- a/container/std/syscall_linux_riscv64.go
+++ b/container/std/syscall_linux_riscv64.go
@@ -0,0 +1,719 @@
+// mksysnum_linux.pl /usr/include/riscv64-linux-gnu/asm/unistd.h
+// Code generated by the command above; DO NOT EDIT.
+
+package std
+
+import . "syscall"
+
+var syscallNum = map[string]ScmpSyscall{
+	"io_setup":                SNR_IO_SETUP,
+	"io_destroy":              SNR_IO_DESTROY,
+	"io_submit":               SNR_IO_SUBMIT,
+	"io_cancel":               SNR_IO_CANCEL,
+	"io_getevents":            SNR_IO_GETEVENTS,
+	"setxattr":                SNR_SETXATTR,
+	"lsetxattr":               SNR_LSETXATTR,
+	"fsetxattr":               SNR_FSETXATTR,
+	"getxattr":                SNR_GETXATTR,
+	"lgetxattr":               SNR_LGETXATTR,
+	"fgetxattr":               SNR_FGETXATTR,
+	"listxattr":               SNR_LISTXATTR,
+	"llistxattr":              SNR_LLISTXATTR,
+	"flistxattr":              SNR_FLISTXATTR,
+	"removexattr":             SNR_REMOVEXATTR,
+	"lremovexattr":            SNR_LREMOVEXATTR,
+	"fremovexattr":            SNR_FREMOVEXATTR,
+	"getcwd":                  SNR_GETCWD,
+	"lookup_dcookie":          SNR_LOOKUP_DCOOKIE,
+	"eventfd2":                SNR_EVENTFD2,
+	"epoll_create1":           SNR_EPOLL_CREATE1,
+	"epoll_ctl":               SNR_EPOLL_CTL,
+	"epoll_pwait":             SNR_EPOLL_PWAIT,
+	"dup":                     SNR_DUP,
+	"dup3":                    SNR_DUP3,
+	"fcntl":                   SNR_FCNTL,
+	"inotify_init1":           SNR_INOTIFY_INIT1,
+	"inotify_add_watch":       SNR_INOTIFY_ADD_WATCH,
+	"inotify_rm_watch":        SNR_INOTIFY_RM_WATCH,
+	"ioctl":                   SNR_IOCTL,
+	"ioprio_set":              SNR_IOPRIO_SET,
+	"ioprio_get":              SNR_IOPRIO_GET,
+	"flock":                   SNR_FLOCK,
+	"mknodat":                 SNR_MKNODAT,
+	"mkdirat":                 SNR_MKDIRAT,
+	"unlinkat":                SNR_UNLINKAT,
+	"symlinkat":               SNR_SYMLINKAT,
+	"linkat":                  SNR_LINKAT,
+	"umount2":                 SNR_UMOUNT2,
+	"mount":                   SNR_MOUNT,
+	"pivot_root":              SNR_PIVOT_ROOT,
+	"nfsservctl":              SNR_NFSSERVCTL,
+	"statfs":                  SNR_STATFS,
+	"fstatfs":                 SNR_FSTATFS,
+	"truncate":                SNR_TRUNCATE,
+	"ftruncate":               SNR_FTRUNCATE,
+	"fallocate":               SNR_FALLOCATE,
+	"faccessat":               SNR_FACCESSAT,
+	"chdir":                   SNR_CHDIR,
+	"fchdir":                  SNR_FCHDIR,
+	"chroot":                  SNR_CHROOT,
+	"fchmod":                  SNR_FCHMOD,
+	"fchmodat":                SNR_FCHMODAT,
+	"fchownat":                SNR_FCHOWNAT,
+	"fchown":                  SNR_FCHOWN,
+	"openat":                  SNR_OPENAT,
+	"close":                   SNR_CLOSE,
+	"vhangup":                 SNR_VHANGUP,
+	"pipe2":                   SNR_PIPE2,
+	"quotactl":                SNR_QUOTACTL,
+	"getdents64":              SNR_GETDENTS64,
+	"lseek":                   SNR_LSEEK,
+	"read":                    SNR_READ,
+	"write":                   SNR_WRITE,
+	"readv":                   SNR_READV,
+	"writev":                  SNR_WRITEV,
+	"pread64":                 SNR_PREAD64,
+	"pwrite64":                SNR_PWRITE64,
+	"preadv":                  SNR_PREADV,
+	"pwritev":                 SNR_PWRITEV,
+	"sendfile":                SNR_SENDFILE,
+	"pselect6":                SNR_PSELECT6,
+	"ppoll":                   SNR_PPOLL,
+	"signalfd4":               SNR_SIGNALFD4,
+	"vmsplice":                SNR_VMSPLICE,
+	"splice":                  SNR_SPLICE,
+	"tee":                     SNR_TEE,
+	"readlinkat":              SNR_READLINKAT,
+	"newfstatat":              SNR_NEWFSTATAT,
+	"fstat":                   SNR_FSTAT,
+	"sync":                    SNR_SYNC,
+	"fsync":                   SNR_FSYNC,
+	"fdatasync":               SNR_FDATASYNC,
+	"sync_file_range":         SNR_SYNC_FILE_RANGE,
+	"timerfd_create":          SNR_TIMERFD_CREATE,
+	"timerfd_settime":         SNR_TIMERFD_SETTIME,
+	"timerfd_gettime":         SNR_TIMERFD_GETTIME,
+	"utimensat":               SNR_UTIMENSAT,
+	"acct":                    SNR_ACCT,
+	"capget":                  SNR_CAPGET,
+	"capset":                  SNR_CAPSET,
+	"personality":             SNR_PERSONALITY,
+	"exit":                    SNR_EXIT,
+	"exit_group":              SNR_EXIT_GROUP,
+	"waitid":                  SNR_WAITID,
+	"set_tid_address":         SNR_SET_TID_ADDRESS,
+	"unshare":                 SNR_UNSHARE,
+	"futex":                   SNR_FUTEX,
+	"set_robust_list":         SNR_SET_ROBUST_LIST,
+	"get_robust_list":         SNR_GET_ROBUST_LIST,
+	"nanosleep":               SNR_NANOSLEEP,
+	"getitimer":               SNR_GETITIMER,
+	"setitimer":               SNR_SETITIMER,
+	"kexec_load":              SNR_KEXEC_LOAD,
+	"init_module":             SNR_INIT_MODULE,
+	"delete_module":           SNR_DELETE_MODULE,
+	"timer_create":            SNR_TIMER_CREATE,
+	"timer_gettime":           SNR_TIMER_GETTIME,
+	"timer_getoverrun":        SNR_TIMER_GETOVERRUN,
+	"timer_settime":           SNR_TIMER_SETTIME,
+	"timer_delete":            SNR_TIMER_DELETE,
+	"clock_settime":           SNR_CLOCK_SETTIME,
+	"clock_gettime":           SNR_CLOCK_GETTIME,
+	"clock_getres":            SNR_CLOCK_GETRES,
+	"clock_nanosleep":         SNR_CLOCK_NANOSLEEP,
+	"syslog":                  SNR_SYSLOG,
+	"ptrace":                  SNR_PTRACE,
+	"sched_setparam":          SNR_SCHED_SETPARAM,
+	"sched_setscheduler":      SNR_SCHED_SETSCHEDULER,
+	"sched_getscheduler":      SNR_SCHED_GETSCHEDULER,
+	"sched_getparam":          SNR_SCHED_GETPARAM,
+	"sched_setaffinity":       SNR_SCHED_SETAFFINITY,
+	"sched_getaffinity":       SNR_SCHED_GETAFFINITY,
+	"sched_yield":             SNR_SCHED_YIELD,
+	"sched_get_priority_max":  SNR_SCHED_GET_PRIORITY_MAX,
+	"sched_get_priority_min":  SNR_SCHED_GET_PRIORITY_MIN,
+	"sched_rr_get_interval":   SNR_SCHED_RR_GET_INTERVAL,
+	"restart_syscall":         SNR_RESTART_SYSCALL,
+	"kill":                    SNR_KILL,
+	"tkill":                   SNR_TKILL,
+	"tgkill":                  SNR_TGKILL,
+	"sigaltstack":             SNR_SIGALTSTACK,
+	"rt_sigsuspend":           SNR_RT_SIGSUSPEND,
+	"rt_sigaction":            SNR_RT_SIGACTION,
+	"rt_sigprocmask":          SNR_RT_SIGPROCMASK,
+	"rt_sigpending":           SNR_RT_SIGPENDING,
+	"rt_sigtimedwait":         SNR_RT_SIGTIMEDWAIT,
+	"rt_sigqueueinfo":         SNR_RT_SIGQUEUEINFO,
+	"rt_sigreturn":            SNR_RT_SIGRETURN,
+	"setpriority":             SNR_SETPRIORITY,
+	"getpriority":             SNR_GETPRIORITY,
+	"reboot":                  SNR_REBOOT,
+	"setregid":                SNR_SETREGID,
+	"setgid":                  SNR_SETGID,
+	"setreuid":                SNR_SETREUID,
+	"setuid":                  SNR_SETUID,
+	"setresuid":               SNR_SETRESUID,
+	"getresuid":               SNR_GETRESUID,
+	"setresgid":               SNR_SETRESGID,
+	"getresgid":               SNR_GETRESGID,
+	"setfsuid":                SNR_SETFSUID,
+	"setfsgid":                SNR_SETFSGID,
+	"times":                   SNR_TIMES,
+	"setpgid":                 SNR_SETPGID,
+	"getpgid":                 SNR_GETPGID,
+	"getsid":                  SNR_GETSID,
+	"setsid":                  SNR_SETSID,
+	"getgroups":               SNR_GETGROUPS,
+	"setgroups":               SNR_SETGROUPS,
+	"uname":                   SNR_UNAME,
+	"sethostname":             SNR_SETHOSTNAME,
+	"setdomainname":           SNR_SETDOMAINNAME,
+	"getrlimit":               SNR_GETRLIMIT,
+	"setrlimit":               SNR_SETRLIMIT,
+	"getrusage":               SNR_GETRUSAGE,
+	"umask":                   SNR_UMASK,
+	"prctl":                   SNR_PRCTL,
+	"getcpu":                  SNR_GETCPU,
+	"gettimeofday":            SNR_GETTIMEOFDAY,
+	"settimeofday":            SNR_SETTIMEOFDAY,
+	"adjtimex":                SNR_ADJTIMEX,
+	"getpid":                  SNR_GETPID,
+	"getppid":                 SNR_GETPPID,
+	"getuid":                  SNR_GETUID,
+	"geteuid":                 SNR_GETEUID,
+	"getgid":                  SNR_GETGID,
+	"getegid":                 SNR_GETEGID,
+	"gettid":                  SNR_GETTID,
+	"sysinfo":                 SNR_SYSINFO,
+	"mq_open":                 SNR_MQ_OPEN,
+	"mq_unlink":               SNR_MQ_UNLINK,
+	"mq_timedsend":            SNR_MQ_TIMEDSEND,
+	"mq_timedreceive":         SNR_MQ_TIMEDRECEIVE,
+	"mq_notify":               SNR_MQ_NOTIFY,
+	"mq_getsetattr":           SNR_MQ_GETSETATTR,
+	"msgget":                  SNR_MSGGET,
+	"msgctl":                  SNR_MSGCTL,
+	"msgrcv":                  SNR_MSGRCV,
+	"msgsnd":                  SNR_MSGSND,
+	"semget":                  SNR_SEMGET,
+	"semctl":                  SNR_SEMCTL,
+	"semtimedop":              SNR_SEMTIMEDOP,
+	"semop":                   SNR_SEMOP,
+	"shmget":                  SNR_SHMGET,
+	"shmctl":                  SNR_SHMCTL,
+	"shmat":                   SNR_SHMAT,
+	"shmdt":                   SNR_SHMDT,
+	"socket":                  SNR_SOCKET,
+	"socketpair":              SNR_SOCKETPAIR,
+	"bind":                    SNR_BIND,
+	"listen":                  SNR_LISTEN,
+	"accept":                  SNR_ACCEPT,
+	"connect":                 SNR_CONNECT,
+	"getsockname":             SNR_GETSOCKNAME,
+	"getpeername":             SNR_GETPEERNAME,
+	"sendto":                  SNR_SENDTO,
+	"recvfrom":                SNR_RECVFROM,
+	"setsockopt":              SNR_SETSOCKOPT,
+	"getsockopt":              SNR_GETSOCKOPT,
+	"shutdown":                SNR_SHUTDOWN,
+	"sendmsg":                 SNR_SENDMSG,
+	"recvmsg":                 SNR_RECVMSG,
+	"readahead":               SNR_READAHEAD,
+	"brk":                     SNR_BRK,
+	"munmap":                  SNR_MUNMAP,
+	"mremap":                  SNR_MREMAP,
+	"add_key":                 SNR_ADD_KEY,
+	"request_key":             SNR_REQUEST_KEY,
+	"keyctl":                  SNR_KEYCTL,
+	"clone":                   SNR_CLONE,
+	"execve":                  SNR_EXECVE,
+	"mmap":                    SNR_MMAP,
+	"fadvise64":               SNR_FADVISE64,
+	"swapon":                  SNR_SWAPON,
+	"swapoff":                 SNR_SWAPOFF,
+	"mprotect":                SNR_MPROTECT,
+	"msync":                   SNR_MSYNC,
+	"mlock":                   SNR_MLOCK,
+	"munlock":                 SNR_MUNLOCK,
+	"mlockall":                SNR_MLOCKALL,
+	"munlockall":              SNR_MUNLOCKALL,
+	"mincore":                 SNR_MINCORE,
+	"madvise":                 SNR_MADVISE,
+	"remap_file_pages":        SNR_REMAP_FILE_PAGES,
+	"mbind":                   SNR_MBIND,
+	"get_mempolicy":           SNR_GET_MEMPOLICY,
+	"set_mempolicy":           SNR_SET_MEMPOLICY,
+	"migrate_pages":           SNR_MIGRATE_PAGES,
+	"move_pages":              SNR_MOVE_PAGES,
+	"rt_tgsigqueueinfo":       SNR_RT_TGSIGQUEUEINFO,
+	"perf_event_open":         SNR_PERF_EVENT_OPEN,
+	"accept4":                 SNR_ACCEPT4,
+	"recvmmsg":                SNR_RECVMMSG,
+	"wait4":                   SNR_WAIT4,
+	"prlimit64":               SNR_PRLIMIT64,
+	"fanotify_init":           SNR_FANOTIFY_INIT,
+	"fanotify_mark":           SNR_FANOTIFY_MARK,
+	"name_to_handle_at":       SNR_NAME_TO_HANDLE_AT,
+	"open_by_handle_at":       SNR_OPEN_BY_HANDLE_AT,
+	"clock_adjtime":           SNR_CLOCK_ADJTIME,
+	"syncfs":                  SNR_SYNCFS,
+	"setns":                   SNR_SETNS,
+	"sendmmsg":                SNR_SENDMMSG,
+	"process_vm_readv":        SNR_PROCESS_VM_READV,
+	"process_vm_writev":       SNR_PROCESS_VM_WRITEV,
+	"kcmp":                    SNR_KCMP,
+	"finit_module":            SNR_FINIT_MODULE,
+	"sched_setattr":           SNR_SCHED_SETATTR,
+	"sched_getattr":           SNR_SCHED_GETATTR,
+	"renameat2":               SNR_RENAMEAT2,
+	"seccomp":                 SNR_SECCOMP,
+	"getrandom":               SNR_GETRANDOM,
+	"memfd_create":            SNR_MEMFD_CREATE,
+	"bpf":                     SNR_BPF,
+	"execveat":                SNR_EXECVEAT,
+	"userfaultfd":             SNR_USERFAULTFD,
+	"membarrier":              SNR_MEMBARRIER,
+	"mlock2":                  SNR_MLOCK2,
+	"copy_file_range":         SNR_COPY_FILE_RANGE,
+	"preadv2":                 SNR_PREADV2,
+	"pwritev2":                SNR_PWRITEV2,
+	"pkey_mprotect":           SNR_PKEY_MPROTECT,
+	"pkey_alloc":              SNR_PKEY_ALLOC,
+	"pkey_free":               SNR_PKEY_FREE,
+	"statx":                   SNR_STATX,
+	"io_pgetevents":           SNR_IO_PGETEVENTS,
+	"rseq":                    SNR_RSEQ,
+	"kexec_file_load":         SNR_KEXEC_FILE_LOAD,
+	"pidfd_send_signal":       SNR_PIDFD_SEND_SIGNAL,
+	"io_uring_setup":          SNR_IO_URING_SETUP,
+	"io_uring_enter":          SNR_IO_URING_ENTER,
+	"io_uring_register":       SNR_IO_URING_REGISTER,
+	"open_tree":               SNR_OPEN_TREE,
+	"move_mount":              SNR_MOVE_MOUNT,
+	"fsopen":                  SNR_FSOPEN,
+	"fsconfig":                SNR_FSCONFIG,
+	"fsmount":                 SNR_FSMOUNT,
+	"fspick":                  SNR_FSPICK,
+	"pidfd_open":              SNR_PIDFD_OPEN,
+	"clone3":                  SNR_CLONE3,
+	"close_range":             SNR_CLOSE_RANGE,
+	"openat2":                 SNR_OPENAT2,
+	"pidfd_getfd":             SNR_PIDFD_GETFD,
+	"faccessat2":              SNR_FACCESSAT2,
+	"process_madvise":         SNR_PROCESS_MADVISE,
+	"epoll_pwait2":            SNR_EPOLL_PWAIT2,
+	"mount_setattr":           SNR_MOUNT_SETATTR,
+	"quotactl_fd":             SNR_QUOTACTL_FD,
+	"landlock_create_ruleset": SNR_LANDLOCK_CREATE_RULESET,
+	"landlock_add_rule":       SNR_LANDLOCK_ADD_RULE,
+	"landlock_restrict_self":  SNR_LANDLOCK_RESTRICT_SELF,
+	"memfd_secret":            SNR_MEMFD_SECRET,
+	"process_mrelease":        SNR_PROCESS_MRELEASE,
+	"futex_waitv":             SNR_FUTEX_WAITV,
+	"set_mempolicy_home_node": SNR_SET_MEMPOLICY_HOME_NODE,
+	"cachestat":               SNR_CACHESTAT,
+	"fchmodat2":               SNR_FCHMODAT2,
+	"map_shadow_stack":        SNR_MAP_SHADOW_STACK,
+	"futex_wake":              SNR_FUTEX_WAKE,
+	"futex_wait":              SNR_FUTEX_WAIT,
+	"futex_requeue":           SNR_FUTEX_REQUEUE,
+	"statmount":               SNR_STATMOUNT,
+	"listmount":               SNR_LISTMOUNT,
+	"lsm_get_self_attr":       SNR_LSM_GET_SELF_ATTR,
+	"lsm_set_self_attr":       SNR_LSM_SET_SELF_ATTR,
+	"lsm_list_modules":        SNR_LSM_LIST_MODULES,
+	"mseal":                   SNR_MSEAL,
+	"setxattrat":              SNR_SETXATTRAT,
+	"getxattrat":              SNR_GETXATTRAT,
+	"listxattrat":             SNR_LISTXATTRAT,
+	"removexattrat":           SNR_REMOVEXATTRAT,
+}
+
+const (
+	SYS_USERFAULTFD             = 282
+	SYS_MEMBARRIER              = 283
+	SYS_MLOCK2                  = 284
+	SYS_COPY_FILE_RANGE         = 285
+	SYS_PREADV2                 = 286
+	SYS_PWRITEV2                = 287
+	SYS_PKEY_MPROTECT           = 288
+	SYS_PKEY_ALLOC              = 289
+	SYS_PKEY_FREE               = 290
+	SYS_STATX                   = 291
+	SYS_IO_PGETEVENTS           = 292
+	SYS_RSEQ                    = 293
+	SYS_KEXEC_FILE_LOAD         = 294
+	SYS_PIDFD_SEND_SIGNAL       = 424
+	SYS_IO_URING_SETUP          = 425
+	SYS_IO_URING_ENTER          = 426
+	SYS_IO_URING_REGISTER       = 427
+	SYS_OPEN_TREE               = 428
+	SYS_MOVE_MOUNT              = 429
+	SYS_FSOPEN                  = 430
+	SYS_FSCONFIG                = 431
+	SYS_FSMOUNT                 = 432
+	SYS_FSPICK                  = 433
+	SYS_PIDFD_OPEN              = 434
+	SYS_CLONE3                  = 435
+	SYS_CLOSE_RANGE             = 436
+	SYS_OPENAT2                 = 437
+	SYS_PIDFD_GETFD             = 438
+	SYS_FACCESSAT2              = 439
+	SYS_PROCESS_MADVISE         = 440
+	SYS_EPOLL_PWAIT2            = 441
+	SYS_MOUNT_SETATTR           = 442
+	SYS_QUOTACTL_FD             = 443
+	SYS_LANDLOCK_CREATE_RULESET = 444
+	SYS_LANDLOCK_ADD_RULE       = 445
+	SYS_LANDLOCK_RESTRICT_SELF  = 446
+	SYS_MEMFD_SECRET            = 447
+	SYS_PROCESS_MRELEASE        = 448
+	SYS_FUTEX_WAITV             = 449
+	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
+	SYS_FCHMODAT2               = 452
+	SYS_MAP_SHADOW_STACK        = 453
+	SYS_FUTEX_WAKE              = 454
+	SYS_FUTEX_WAIT              = 455
+	SYS_FUTEX_REQUEUE           = 456
+	SYS_STATMOUNT               = 457
+	SYS_LISTMOUNT               = 458
+	SYS_LSM_GET_SELF_ATTR       = 459
+	SYS_LSM_SET_SELF_ATTR       = 460
+	SYS_LSM_LIST_MODULES        = 461
+	SYS_MSEAL                   = 462
+	SYS_SETXATTRAT              = 463
+	SYS_GETXATTRAT              = 464
+	SYS_LISTXATTRAT             = 465
+	SYS_REMOVEXATTRAT           = 466
+	SYS_OPEN_TREE_ATTR          = 467
+	SYS_FILE_GETATTR            = 468
+	SYS_FILE_SETATTR            = 469
+)
+
+const (
+	SNR_IO_SETUP                ScmpSyscall = SYS_IO_SETUP
+	SNR_IO_DESTROY              ScmpSyscall = SYS_IO_DESTROY
+	SNR_IO_SUBMIT               ScmpSyscall = SYS_IO_SUBMIT
+	SNR_IO_CANCEL               ScmpSyscall = SYS_IO_CANCEL
+	SNR_IO_GETEVENTS            ScmpSyscall = SYS_IO_GETEVENTS
+	SNR_SETXATTR                ScmpSyscall = SYS_SETXATTR
+	SNR_LSETXATTR               ScmpSyscall = SYS_LSETXATTR
+	SNR_FSETXATTR               ScmpSyscall = SYS_FSETXATTR
+	SNR_GETXATTR                ScmpSyscall = SYS_GETXATTR
+	SNR_LGETXATTR               ScmpSyscall = SYS_LGETXATTR
+	SNR_FGETXATTR               ScmpSyscall = SYS_FGETXATTR
+	SNR_LISTXATTR               ScmpSyscall = SYS_LISTXATTR
+	SNR_LLISTXATTR              ScmpSyscall = SYS_LLISTXATTR
+	SNR_FLISTXATTR              ScmpSyscall = SYS_FLISTXATTR
+	SNR_REMOVEXATTR             ScmpSyscall = SYS_REMOVEXATTR
+	SNR_LREMOVEXATTR            ScmpSyscall = SYS_LREMOVEXATTR
+	SNR_FREMOVEXATTR            ScmpSyscall = SYS_FREMOVEXATTR
+	SNR_GETCWD                  ScmpSyscall = SYS_GETCWD
+	SNR_LOOKUP_DCOOKIE          ScmpSyscall = SYS_LOOKUP_DCOOKIE
+	SNR_EVENTFD2                ScmpSyscall = SYS_EVENTFD2
+	SNR_EPOLL_CREATE1           ScmpSyscall = SYS_EPOLL_CREATE1
+	SNR_EPOLL_CTL               ScmpSyscall = SYS_EPOLL_CTL
+	SNR_EPOLL_PWAIT             ScmpSyscall = SYS_EPOLL_PWAIT
+	SNR_DUP                     ScmpSyscall = SYS_DUP
+	SNR_DUP3                    ScmpSyscall = SYS_DUP3
+	SNR_FCNTL                   ScmpSyscall = SYS_FCNTL
+	SNR_INOTIFY_INIT1           ScmpSyscall = SYS_INOTIFY_INIT1
+	SNR_INOTIFY_ADD_WATCH       ScmpSyscall = SYS_INOTIFY_ADD_WATCH
+	SNR_INOTIFY_RM_WATCH        ScmpSyscall = SYS_INOTIFY_RM_WATCH
+	SNR_IOCTL                   ScmpSyscall = SYS_IOCTL
+	SNR_IOPRIO_SET              ScmpSyscall = SYS_IOPRIO_SET
+	SNR_IOPRIO_GET              ScmpSyscall = SYS_IOPRIO_GET
+	SNR_FLOCK                   ScmpSyscall = SYS_FLOCK
+	SNR_MKNODAT                 ScmpSyscall = SYS_MKNODAT
+	SNR_MKDIRAT                 ScmpSyscall = SYS_MKDIRAT
+	SNR_UNLINKAT                ScmpSyscall = SYS_UNLINKAT
+	SNR_SYMLINKAT               ScmpSyscall = SYS_SYMLINKAT
+	SNR_LINKAT                  ScmpSyscall = SYS_LINKAT
+	SNR_UMOUNT2                 ScmpSyscall = SYS_UMOUNT2
+	SNR_MOUNT                   ScmpSyscall = SYS_MOUNT
+	SNR_PIVOT_ROOT              ScmpSyscall = SYS_PIVOT_ROOT
+	SNR_NFSSERVCTL              ScmpSyscall = SYS_NFSSERVCTL
+	SNR_STATFS                  ScmpSyscall = SYS_STATFS
+	SNR_FSTATFS                 ScmpSyscall = SYS_FSTATFS
+	SNR_TRUNCATE                ScmpSyscall = SYS_TRUNCATE
+	SNR_FTRUNCATE               ScmpSyscall = SYS_FTRUNCATE
+	SNR_FALLOCATE               ScmpSyscall = SYS_FALLOCATE
+	SNR_FACCESSAT               ScmpSyscall = SYS_FACCESSAT
+	SNR_CHDIR                   ScmpSyscall = SYS_CHDIR
+	SNR_FCHDIR                  ScmpSyscall = SYS_FCHDIR
+	SNR_CHROOT                  ScmpSyscall = SYS_CHROOT
+	SNR_FCHMOD                  ScmpSyscall = SYS_FCHMOD
+	SNR_FCHMODAT                ScmpSyscall = SYS_FCHMODAT
+	SNR_FCHOWNAT                ScmpSyscall = SYS_FCHOWNAT
+	SNR_FCHOWN                  ScmpSyscall = SYS_FCHOWN
+	SNR_OPENAT                  ScmpSyscall = SYS_OPENAT
+	SNR_CLOSE                   ScmpSyscall = SYS_CLOSE
+	SNR_VHANGUP                 ScmpSyscall = SYS_VHANGUP
+	SNR_PIPE2                   ScmpSyscall = SYS_PIPE2
+	SNR_QUOTACTL                ScmpSyscall = SYS_QUOTACTL
+	SNR_GETDENTS64              ScmpSyscall = SYS_GETDENTS64
+	SNR_LSEEK                   ScmpSyscall = SYS_LSEEK
+	SNR_READ                    ScmpSyscall = SYS_READ
+	SNR_WRITE                   ScmpSyscall = SYS_WRITE
+	SNR_READV                   ScmpSyscall = SYS_READV
+	SNR_WRITEV                  ScmpSyscall = SYS_WRITEV
+	SNR_PREAD64                 ScmpSyscall = SYS_PREAD64
+	SNR_PWRITE64                ScmpSyscall = SYS_PWRITE64
+	SNR_PREADV                  ScmpSyscall = SYS_PREADV
+	SNR_PWRITEV                 ScmpSyscall = SYS_PWRITEV
+	SNR_SENDFILE                ScmpSyscall = SYS_SENDFILE
+	SNR_PSELECT6                ScmpSyscall = SYS_PSELECT6
+	SNR_PPOLL                   ScmpSyscall = SYS_PPOLL
+	SNR_SIGNALFD4               ScmpSyscall = SYS_SIGNALFD4
+	SNR_VMSPLICE                ScmpSyscall = SYS_VMSPLICE
+	SNR_SPLICE                  ScmpSyscall = SYS_SPLICE
+	SNR_TEE                     ScmpSyscall = SYS_TEE
+	SNR_READLINKAT              ScmpSyscall = SYS_READLINKAT
+	SNR_NEWFSTATAT              ScmpSyscall = SYS_NEWFSTATAT
+	SNR_FSTAT                   ScmpSyscall = SYS_FSTAT
+	SNR_SYNC                    ScmpSyscall = SYS_SYNC
+	SNR_FSYNC                   ScmpSyscall = SYS_FSYNC
+	SNR_FDATASYNC               ScmpSyscall = SYS_FDATASYNC
+	SNR_SYNC_FILE_RANGE         ScmpSyscall = SYS_SYNC_FILE_RANGE
+	SNR_TIMERFD_CREATE          ScmpSyscall = SYS_TIMERFD_CREATE
+	SNR_TIMERFD_SETTIME         ScmpSyscall = SYS_TIMERFD_SETTIME
+	SNR_TIMERFD_GETTIME         ScmpSyscall = SYS_TIMERFD_GETTIME
+	SNR_UTIMENSAT               ScmpSyscall = SYS_UTIMENSAT
+	SNR_ACCT                    ScmpSyscall = SYS_ACCT
+	SNR_CAPGET                  ScmpSyscall = SYS_CAPGET
+	SNR_CAPSET                  ScmpSyscall = SYS_CAPSET
+	SNR_PERSONALITY             ScmpSyscall = SYS_PERSONALITY
+	SNR_EXIT                    ScmpSyscall = SYS_EXIT
+	SNR_EXIT_GROUP              ScmpSyscall = SYS_EXIT_GROUP
+	SNR_WAITID                  ScmpSyscall = SYS_WAITID
+	SNR_SET_TID_ADDRESS         ScmpSyscall = SYS_SET_TID_ADDRESS
+	SNR_UNSHARE                 ScmpSyscall = SYS_UNSHARE
+	SNR_FUTEX                   ScmpSyscall = SYS_FUTEX
+	SNR_SET_ROBUST_LIST         ScmpSyscall = SYS_SET_ROBUST_LIST
+	SNR_GET_ROBUST_LIST         ScmpSyscall = SYS_GET_ROBUST_LIST
+	SNR_NANOSLEEP               ScmpSyscall = SYS_NANOSLEEP
+	SNR_GETITIMER               ScmpSyscall = SYS_GETITIMER
+	SNR_SETITIMER               ScmpSyscall = SYS_SETITIMER
+	SNR_KEXEC_LOAD              ScmpSyscall = SYS_KEXEC_LOAD
+	SNR_INIT_MODULE             ScmpSyscall = SYS_INIT_MODULE
+	SNR_DELETE_MODULE           ScmpSyscall = SYS_DELETE_MODULE
+	SNR_TIMER_CREATE            ScmpSyscall = SYS_TIMER_CREATE
+	SNR_TIMER_GETTIME           ScmpSyscall = SYS_TIMER_GETTIME
+	SNR_TIMER_GETOVERRUN        ScmpSyscall = SYS_TIMER_GETOVERRUN
+	SNR_TIMER_SETTIME           ScmpSyscall = SYS_TIMER_SETTIME
+	SNR_TIMER_DELETE            ScmpSyscall = SYS_TIMER_DELETE
+	SNR_CLOCK_SETTIME           ScmpSyscall = SYS_CLOCK_SETTIME
+	SNR_CLOCK_GETTIME           ScmpSyscall = SYS_CLOCK_GETTIME
+	SNR_CLOCK_GETRES            ScmpSyscall = SYS_CLOCK_GETRES
+	SNR_CLOCK_NANOSLEEP         ScmpSyscall = SYS_CLOCK_NANOSLEEP
+	SNR_SYSLOG                  ScmpSyscall = SYS_SYSLOG
+	SNR_PTRACE                  ScmpSyscall = SYS_PTRACE
+	SNR_SCHED_SETPARAM          ScmpSyscall = SYS_SCHED_SETPARAM
+	SNR_SCHED_SETSCHEDULER      ScmpSyscall = SYS_SCHED_SETSCHEDULER
+	SNR_SCHED_GETSCHEDULER      ScmpSyscall = SYS_SCHED_GETSCHEDULER
+	SNR_SCHED_GETPARAM          ScmpSyscall = SYS_SCHED_GETPARAM
+	SNR_SCHED_SETAFFINITY       ScmpSyscall = SYS_SCHED_SETAFFINITY
+	SNR_SCHED_GETAFFINITY       ScmpSyscall = SYS_SCHED_GETAFFINITY
+	SNR_SCHED_YIELD             ScmpSyscall = SYS_SCHED_YIELD
+	SNR_SCHED_GET_PRIORITY_MAX  ScmpSyscall = SYS_SCHED_GET_PRIORITY_MAX
+	SNR_SCHED_GET_PRIORITY_MIN  ScmpSyscall = SYS_SCHED_GET_PRIORITY_MIN
+	SNR_SCHED_RR_GET_INTERVAL   ScmpSyscall = SYS_SCHED_RR_GET_INTERVAL
+	SNR_RESTART_SYSCALL         ScmpSyscall = SYS_RESTART_SYSCALL
+	SNR_KILL                    ScmpSyscall = SYS_KILL
+	SNR_TKILL                   ScmpSyscall = SYS_TKILL
+	SNR_TGKILL                  ScmpSyscall = SYS_TGKILL
+	SNR_SIGALTSTACK             ScmpSyscall = SYS_SIGALTSTACK
+	SNR_RT_SIGSUSPEND           ScmpSyscall = SYS_RT_SIGSUSPEND
+	SNR_RT_SIGACTION            ScmpSyscall = SYS_RT_SIGACTION
+	SNR_RT_SIGPROCMASK          ScmpSyscall = SYS_RT_SIGPROCMASK
+	SNR_RT_SIGPENDING           ScmpSyscall = SYS_RT_SIGPENDING
+	SNR_RT_SIGTIMEDWAIT         ScmpSyscall = SYS_RT_SIGTIMEDWAIT
+	SNR_RT_SIGQUEUEINFO         ScmpSyscall = SYS_RT_SIGQUEUEINFO
+	SNR_RT_SIGRETURN            ScmpSyscall = SYS_RT_SIGRETURN
+	SNR_SETPRIORITY             ScmpSyscall = SYS_SETPRIORITY
+	SNR_GETPRIORITY             ScmpSyscall = SYS_GETPRIORITY
+	SNR_REBOOT                  ScmpSyscall = SYS_REBOOT
+	SNR_SETREGID                ScmpSyscall = SYS_SETREGID
+	SNR_SETGID                  ScmpSyscall = SYS_SETGID
+	SNR_SETREUID                ScmpSyscall = SYS_SETREUID
+	SNR_SETUID                  ScmpSyscall = SYS_SETUID
+	SNR_SETRESUID               ScmpSyscall = SYS_SETRESUID
+	SNR_GETRESUID               ScmpSyscall = SYS_GETRESUID
+	SNR_SETRESGID               ScmpSyscall = SYS_SETRESGID
+	SNR_GETRESGID               ScmpSyscall = SYS_GETRESGID
+	SNR_SETFSUID                ScmpSyscall = SYS_SETFSUID
+	SNR_SETFSGID                ScmpSyscall = SYS_SETFSGID
+	SNR_TIMES                   ScmpSyscall = SYS_TIMES
+	SNR_SETPGID                 ScmpSyscall = SYS_SETPGID
+	SNR_GETPGID                 ScmpSyscall = SYS_GETPGID
+	SNR_GETSID                  ScmpSyscall = SYS_GETSID
+	SNR_SETSID                  ScmpSyscall = SYS_SETSID
+	SNR_GETGROUPS               ScmpSyscall = SYS_GETGROUPS
+	SNR_SETGROUPS               ScmpSyscall = SYS_SETGROUPS
+	SNR_UNAME                   ScmpSyscall = SYS_UNAME
+	SNR_SETHOSTNAME             ScmpSyscall = SYS_SETHOSTNAME
+	SNR_SETDOMAINNAME           ScmpSyscall = SYS_SETDOMAINNAME
+	SNR_GETRLIMIT               ScmpSyscall = SYS_GETRLIMIT
+	SNR_SETRLIMIT               ScmpSyscall = SYS_SETRLIMIT
+	SNR_GETRUSAGE               ScmpSyscall = SYS_GETRUSAGE
+	SNR_UMASK                   ScmpSyscall = SYS_UMASK
+	SNR_PRCTL                   ScmpSyscall = SYS_PRCTL
+	SNR_GETCPU                  ScmpSyscall = SYS_GETCPU
+	SNR_GETTIMEOFDAY            ScmpSyscall = SYS_GETTIMEOFDAY
+	SNR_SETTIMEOFDAY            ScmpSyscall = SYS_SETTIMEOFDAY
+	SNR_ADJTIMEX                ScmpSyscall = SYS_ADJTIMEX
+	SNR_GETPID                  ScmpSyscall = SYS_GETPID
+	SNR_GETPPID                 ScmpSyscall = SYS_GETPPID
+	SNR_GETUID                  ScmpSyscall = SYS_GETUID
+	SNR_GETEUID                 ScmpSyscall = SYS_GETEUID
+	SNR_GETGID                  ScmpSyscall = SYS_GETGID
+	SNR_GETEGID                 ScmpSyscall = SYS_GETEGID
+	SNR_GETTID                  ScmpSyscall = SYS_GETTID
+	SNR_SYSINFO                 ScmpSyscall = SYS_SYSINFO
+	SNR_MQ_OPEN                 ScmpSyscall = SYS_MQ_OPEN
+	SNR_MQ_UNLINK               ScmpSyscall = SYS_MQ_UNLINK
+	SNR_MQ_TIMEDSEND            ScmpSyscall = SYS_MQ_TIMEDSEND
+	SNR_MQ_TIMEDRECEIVE         ScmpSyscall = SYS_MQ_TIMEDRECEIVE
+	SNR_MQ_NOTIFY               ScmpSyscall = SYS_MQ_NOTIFY
+	SNR_MQ_GETSETATTR           ScmpSyscall = SYS_MQ_GETSETATTR
+	SNR_MSGGET                  ScmpSyscall = SYS_MSGGET
+	SNR_MSGCTL                  ScmpSyscall = SYS_MSGCTL
+	SNR_MSGRCV                  ScmpSyscall = SYS_MSGRCV
+	SNR_MSGSND                  ScmpSyscall = SYS_MSGSND
+	SNR_SEMGET                  ScmpSyscall = SYS_SEMGET
+	SNR_SEMCTL                  ScmpSyscall = SYS_SEMCTL
+	SNR_SEMTIMEDOP              ScmpSyscall = SYS_SEMTIMEDOP
+	SNR_SEMOP                   ScmpSyscall = SYS_SEMOP
+	SNR_SHMGET                  ScmpSyscall = SYS_SHMGET
+	SNR_SHMCTL                  ScmpSyscall = SYS_SHMCTL
+	SNR_SHMAT                   ScmpSyscall = SYS_SHMAT
+	SNR_SHMDT                   ScmpSyscall = SYS_SHMDT
+	SNR_SOCKET                  ScmpSyscall = SYS_SOCKET
+	SNR_SOCKETPAIR              ScmpSyscall = SYS_SOCKETPAIR
+	SNR_BIND                    ScmpSyscall = SYS_BIND
+	SNR_LISTEN                  ScmpSyscall = SYS_LISTEN
+	SNR_ACCEPT                  ScmpSyscall = SYS_ACCEPT
+	SNR_CONNECT                 ScmpSyscall = SYS_CONNECT
+	SNR_GETSOCKNAME             ScmpSyscall = SYS_GETSOCKNAME
+	SNR_GETPEERNAME             ScmpSyscall = SYS_GETPEERNAME
+	SNR_SENDTO                  ScmpSyscall = SYS_SENDTO
+	SNR_RECVFROM                ScmpSyscall = SYS_RECVFROM
+	SNR_SETSOCKOPT              ScmpSyscall = SYS_SETSOCKOPT
+	SNR_GETSOCKOPT              ScmpSyscall = SYS_GETSOCKOPT
+	SNR_SHUTDOWN                ScmpSyscall = SYS_SHUTDOWN
+	SNR_SENDMSG                 ScmpSyscall = SYS_SENDMSG
+	SNR_RECVMSG                 ScmpSyscall = SYS_RECVMSG
+	SNR_READAHEAD               ScmpSyscall = SYS_READAHEAD
+	SNR_BRK                     ScmpSyscall = SYS_BRK
+	SNR_MUNMAP                  ScmpSyscall = SYS_MUNMAP
+	SNR_MREMAP                  ScmpSyscall = SYS_MREMAP
+	SNR_ADD_KEY                 ScmpSyscall = SYS_ADD_KEY
+	SNR_REQUEST_KEY             ScmpSyscall = SYS_REQUEST_KEY
+	SNR_KEYCTL                  ScmpSyscall = SYS_KEYCTL
+	SNR_CLONE                   ScmpSyscall = SYS_CLONE
+	SNR_EXECVE                  ScmpSyscall = SYS_EXECVE
+	SNR_MMAP                    ScmpSyscall = SYS_MMAP
+	SNR_FADVISE64               ScmpSyscall = SYS_FADVISE64
+	SNR_SWAPON                  ScmpSyscall = SYS_SWAPON
+	SNR_SWAPOFF                 ScmpSyscall = SYS_SWAPOFF
+	SNR_MPROTECT                ScmpSyscall = SYS_MPROTECT
+	SNR_MSYNC                   ScmpSyscall = SYS_MSYNC
+	SNR_MLOCK                   ScmpSyscall = SYS_MLOCK
+	SNR_MUNLOCK                 ScmpSyscall = SYS_MUNLOCK
+	SNR_MLOCKALL                ScmpSyscall = SYS_MLOCKALL
+	SNR_MUNLOCKALL              ScmpSyscall = SYS_MUNLOCKALL
+	SNR_MINCORE                 ScmpSyscall = SYS_MINCORE
+	SNR_MADVISE                 ScmpSyscall = SYS_MADVISE
+	SNR_REMAP_FILE_PAGES        ScmpSyscall = SYS_REMAP_FILE_PAGES
+	SNR_MBIND                   ScmpSyscall = SYS_MBIND
+	SNR_GET_MEMPOLICY           ScmpSyscall = SYS_GET_MEMPOLICY
+	SNR_SET_MEMPOLICY           ScmpSyscall = SYS_SET_MEMPOLICY
+	SNR_MIGRATE_PAGES           ScmpSyscall = SYS_MIGRATE_PAGES
+	SNR_MOVE_PAGES              ScmpSyscall = SYS_MOVE_PAGES
+	SNR_RT_TGSIGQUEUEINFO       ScmpSyscall = SYS_RT_TGSIGQUEUEINFO
+	SNR_PERF_EVENT_OPEN         ScmpSyscall = SYS_PERF_EVENT_OPEN
+	SNR_ACCEPT4                 ScmpSyscall = SYS_ACCEPT4
+	SNR_RECVMMSG                ScmpSyscall = SYS_RECVMMSG
+	SNR_WAIT4                   ScmpSyscall = SYS_WAIT4
+	SNR_PRLIMIT64               ScmpSyscall = SYS_PRLIMIT64
+	SNR_FANOTIFY_INIT           ScmpSyscall = SYS_FANOTIFY_INIT
+	SNR_FANOTIFY_MARK           ScmpSyscall = SYS_FANOTIFY_MARK
+	SNR_NAME_TO_HANDLE_AT       ScmpSyscall = SYS_NAME_TO_HANDLE_AT
+	SNR_OPEN_BY_HANDLE_AT       ScmpSyscall = SYS_OPEN_BY_HANDLE_AT
+	SNR_CLOCK_ADJTIME           ScmpSyscall = SYS_CLOCK_ADJTIME
+	SNR_SYNCFS                  ScmpSyscall = SYS_SYNCFS
+	SNR_SETNS                   ScmpSyscall = SYS_SETNS
+	SNR_SENDMMSG                ScmpSyscall = SYS_SENDMMSG
+	SNR_PROCESS_VM_READV        ScmpSyscall = SYS_PROCESS_VM_READV
+	SNR_PROCESS_VM_WRITEV       ScmpSyscall = SYS_PROCESS_VM_WRITEV
+	SNR_KCMP                    ScmpSyscall = SYS_KCMP
+	SNR_FINIT_MODULE            ScmpSyscall = SYS_FINIT_MODULE
+	SNR_SCHED_SETATTR           ScmpSyscall = SYS_SCHED_SETATTR
+	SNR_SCHED_GETATTR           ScmpSyscall = SYS_SCHED_GETATTR
+	SNR_RENAMEAT2               ScmpSyscall = SYS_RENAMEAT2
+	SNR_SECCOMP                 ScmpSyscall = SYS_SECCOMP
+	SNR_GETRANDOM               ScmpSyscall = SYS_GETRANDOM
+	SNR_MEMFD_CREATE            ScmpSyscall = SYS_MEMFD_CREATE
+	SNR_BPF                     ScmpSyscall = SYS_BPF
+	SNR_EXECVEAT                ScmpSyscall = SYS_EXECVEAT
+	SNR_USERFAULTFD             ScmpSyscall = SYS_USERFAULTFD
+	SNR_MEMBARRIER              ScmpSyscall = SYS_MEMBARRIER
+	SNR_MLOCK2                  ScmpSyscall = SYS_MLOCK2
+	SNR_COPY_FILE_RANGE         ScmpSyscall = SYS_COPY_FILE_RANGE
+	SNR_PREADV2                 ScmpSyscall = SYS_PREADV2
+	SNR_PWRITEV2                ScmpSyscall = SYS_PWRITEV2
+	SNR_PKEY_MPROTECT           ScmpSyscall = SYS_PKEY_MPROTECT
+	SNR_PKEY_ALLOC              ScmpSyscall = SYS_PKEY_ALLOC
+	SNR_PKEY_FREE               ScmpSyscall = SYS_PKEY_FREE
+	SNR_STATX                   ScmpSyscall = SYS_STATX
+	SNR_IO_PGETEVENTS           ScmpSyscall = SYS_IO_PGETEVENTS
+	SNR_RSEQ                    ScmpSyscall = SYS_RSEQ
+	SNR_KEXEC_FILE_LOAD         ScmpSyscall = SYS_KEXEC_FILE_LOAD
+	SNR_PIDFD_SEND_SIGNAL       ScmpSyscall = SYS_PIDFD_SEND_SIGNAL
+	SNR_IO_URING_SETUP          ScmpSyscall = SYS_IO_URING_SETUP
+	SNR_IO_URING_ENTER          ScmpSyscall = SYS_IO_URING_ENTER
+	SNR_IO_URING_REGISTER       ScmpSyscall = SYS_IO_URING_REGISTER
+	SNR_OPEN_TREE               ScmpSyscall = SYS_OPEN_TREE
+	SNR_MOVE_MOUNT              ScmpSyscall = SYS_MOVE_MOUNT
+	SNR_FSOPEN                  ScmpSyscall = SYS_FSOPEN
+	SNR_FSCONFIG                ScmpSyscall = SYS_FSCONFIG
+	SNR_FSMOUNT                 ScmpSyscall = SYS_FSMOUNT
+	SNR_FSPICK                  ScmpSyscall = SYS_FSPICK
+	SNR_PIDFD_OPEN              ScmpSyscall = SYS_PIDFD_OPEN
+	SNR_CLONE3                  ScmpSyscall = SYS_CLONE3
+	SNR_CLOSE_RANGE             ScmpSyscall = SYS_CLOSE_RANGE
+	SNR_OPENAT2                 ScmpSyscall = SYS_OPENAT2
+	SNR_PIDFD_GETFD             ScmpSyscall = SYS_PIDFD_GETFD
+	SNR_FACCESSAT2              ScmpSyscall = SYS_FACCESSAT2
+	SNR_PROCESS_MADVISE         ScmpSyscall = SYS_PROCESS_MADVISE
+	SNR_EPOLL_PWAIT2            ScmpSyscall = SYS_EPOLL_PWAIT2
+	SNR_MOUNT_SETATTR           ScmpSyscall = SYS_MOUNT_SETATTR
+	SNR_QUOTACTL_FD             ScmpSyscall = SYS_QUOTACTL_FD
+	SNR_LANDLOCK_CREATE_RULESET ScmpSyscall = SYS_LANDLOCK_CREATE_RULESET
+	SNR_LANDLOCK_ADD_RULE       ScmpSyscall = SYS_LANDLOCK_ADD_RULE
+	SNR_LANDLOCK_RESTRICT_SELF  ScmpSyscall = SYS_LANDLOCK_RESTRICT_SELF
+	SNR_MEMFD_SECRET            ScmpSyscall = SYS_MEMFD_SECRET
+	SNR_PROCESS_MRELEASE        ScmpSyscall = SYS_PROCESS_MRELEASE
+	SNR_FUTEX_WAITV             ScmpSyscall = SYS_FUTEX_WAITV
+	SNR_SET_MEMPOLICY_HOME_NODE ScmpSyscall = SYS_SET_MEMPOLICY_HOME_NODE
+	SNR_CACHESTAT               ScmpSyscall = SYS_CACHESTAT
+	SNR_FCHMODAT2               ScmpSyscall = SYS_FCHMODAT2
+	SNR_MAP_SHADOW_STACK        ScmpSyscall = SYS_MAP_SHADOW_STACK
+	SNR_FUTEX_WAKE              ScmpSyscall = SYS_FUTEX_WAKE
+	SNR_FUTEX_WAIT              ScmpSyscall = SYS_FUTEX_WAIT
+	SNR_FUTEX_REQUEUE           ScmpSyscall = SYS_FUTEX_REQUEUE
+	SNR_STATMOUNT               ScmpSyscall = SYS_STATMOUNT
+	SNR_LISTMOUNT               ScmpSyscall = SYS_LISTMOUNT
+	SNR_LSM_GET_SELF_ATTR       ScmpSyscall = SYS_LSM_GET_SELF_ATTR
+	SNR_LSM_SET_SELF_ATTR       ScmpSyscall = SYS_LSM_SET_SELF_ATTR
+	SNR_LSM_LIST_MODULES        ScmpSyscall = SYS_LSM_LIST_MODULES
+	SNR_MSEAL                   ScmpSyscall = SYS_MSEAL
+	SNR_SETXATTRAT              ScmpSyscall = SYS_SETXATTRAT
+	SNR_GETXATTRAT              ScmpSyscall = SYS_GETXATTRAT
+	SNR_LISTXATTRAT             ScmpSyscall = SYS_LISTXATTRAT
+	SNR_REMOVEXATTRAT           ScmpSyscall = SYS_REMOVEXATTRAT
+	SNR_OPEN_TREE_ATTR          ScmpSyscall = SYS_OPEN_TREE_ATTR
+	SNR_FILE_GETATTR            ScmpSyscall = SYS_FILE_GETATTR
+	SNR_FILE_SETATTR            ScmpSyscall = SYS_FILE_SETATTR
+)
--- a/internal/pkg/asm.go
+++ b/internal/pkg/asm.go
@@ -1,216 +0,0 @@
-package pkg
-
-import (
-	"encoding/binary"
-	"fmt"
-	"io"
-	"strconv"
-	"strings"
-)
-
-type asmOutLine struct {
-	pos       int
-	word      int
-	kindData  int64
-	valueData []byte
-	indent    int
-	kind      string
-	value     string
-}
-
-var spacingLine = asmOutLine{
-	pos:       -1,
-	kindData:  -1,
-	valueData: nil,
-	indent:    0,
-	kind:      "",
-	value:     "",
-}
-
-func Disassemble(r io.Reader, real bool, showHeader bool, force bool, raw bool) (s string, err error) {
-	var lines []asmOutLine
-	sb := new(strings.Builder)
-	header := true
-	pos := new(int)
-
-	for err == nil {
-		if header {
-			var kind uint64
-			var size uint64
-			var bsize []byte
-			p := *pos
-			if _, kind, err = nextUint64(r, pos); err != nil {
-				break
-			}
-			if bsize, size, err = nextUint64(r, pos); err != nil {
-				break
-			}
-			if showHeader {
-				lines = append(lines, asmOutLine{p, 8, int64(kind), bsize, 0, "head  " + intToKind(kind), ""})
-			}
-			for i := 0; uint64(i) < size; i++ {
-				var did Checksum
-				var dkind uint64
-				p := *pos
-				if _, dkind, err = nextUint64(r, pos); err != nil {
-					break
-				}
-				if _, did, err = nextIdent(r, pos); err != nil {
-					break
-				}
-				if showHeader {
-					lines = append(lines, asmOutLine{p, 8, int64(dkind), nil, 1, intToKind(dkind), Encode(did)})
-				}
-			}
-			header = false
-		}
-		var k uint32
-		p := *pos
-		if _, k, err = nextUint32(r, pos); err != nil {
-			break
-		}
-		kind := IRValueKind(k)
-		switch kind {
-		case IRKindEnd:
-			var a uint32
-			var ba []byte
-			if ba, a, err = nextUint32(r, pos); err != nil {
-				break
-			}
-			if a&1 != 0 {
-				var sum Checksum
-				if _, sum, err = nextIdent(r, pos); err != nil {
-					break
-				}
-				lines = append(lines, asmOutLine{p, 4, int64(kind), ba, 1, "end ", Encode(sum)})
-			} else {
-				lines = append(lines, asmOutLine{p, 4, int64(kind), []byte{0, 0, 0, 0}, 1, "end ", ""})
-			}
-			lines = append(lines, spacingLine)
-			header = true
-			continue
-
-		case IRKindIdent:
-			var a []byte
-			// discard ancillary
-			if a, _, err = nextUint32(r, pos); err != nil {
-				break
-			}
-			var sum Checksum
-			if _, sum, err = nextIdent(r, pos); err != nil {
-				break
-			}
-
-			lines = append(lines, asmOutLine{p, 4, int64(kind), a, 1, "id  ", Encode(sum)})
-			continue
-		case IRKindUint32:
-			var i uint32
-			var bi []byte
-			if bi, i, err = nextUint32(r, pos); err != nil {
-				break
-			}
-			lines = append(lines, asmOutLine{p, 4, int64(kind), bi, 1, "int ", strconv.FormatUint(uint64(i), 10)})
-		case IRKindString:
-			var l uint32
-			var bl []byte
-			if bl, l, err = nextUint32(r, pos); err != nil {
-				break
-			}
-			s := make([]byte, l+(wordSize-(l)%wordSize)%wordSize)
-			var n int
-			if n, err = r.Read(s); err != nil {
-				break
-			}
-			*pos = *pos + n
-
-			lines = append(lines, asmOutLine{p, 4, int64(kind), bl, 1, "str ", strconv.Quote(string(s[:l]))})
-			continue
-		default:
-			var bi []byte
-			if bi, _, err = nextUint32(r, pos); err != nil {
-				break
-			}
-			lines = append(lines, asmOutLine{p, 4, int64(kind), bi, 1, "????", ""})
-		}
-	}
-	if err != io.EOF {
-		return
-	}
-	err = nil
-	for _, line := range lines {
-		if raw {
-			if line.pos != -1 {
-				sb.WriteString(fmt.Sprintf("%s\t%s\n", line.kind, line.value))
-			}
-		} else {
-			if line.pos == -1 {
-				sb.WriteString("\n")
-			} else if line.word == 4 {
-				sb.WriteString(fmt.Sprintf("%06x:  %04x %04x%s          %s  %s\n", line.pos, binary.LittleEndian.AppendUint32(nil, uint32(line.kindData)), line.valueData, headerSpacing(showHeader), line.kind, line.value))
-			} else {
-				kind := binary.LittleEndian.AppendUint64(nil, uint64(line.kindData))
-				value := line.valueData
-				if len(value) == 8 {
-					sb.WriteString(fmt.Sprintf("%06x:  %04x %04x %04x %04x      %s  %s\n", line.pos, kind[:4], kind[4:], value[:4], value[4:], line.kind, line.value))
-				} else {
-					sb.WriteString(fmt.Sprintf("%06x:  %04x %04x                        %s  %s\n", line.pos, kind[:4], kind[4:], line.kind, line.value))
-				}
-
-			}
-		}
-
-	}
-	return sb.String(), err
-}
-func nextUint32(r io.Reader, pos *int) ([]byte, uint32, error) {
-	i := make([]byte, 4)
-	_, err := r.Read(i)
-	if err != nil {
-		return i, 0, err
-	}
-	p := *pos + 4
-	*pos = p
-	return i, binary.LittleEndian.Uint32(i), nil
-}
-func nextUint64(r io.Reader, pos *int) ([]byte, uint64, error) {
-	i := make([]byte, 8)
-	_, err := r.Read(i)
-	if err != nil {
-		return i, 0, err
-	}
-	p := *pos + 8
-	*pos = p
-	return i, binary.LittleEndian.Uint64(i), nil
-}
-func nextIdent(r io.Reader, pos *int) ([]byte, Checksum, error) {
-	i := make([]byte, 48)
-	if _, err := r.Read(i); err != nil {
-		return i, Checksum{}, err
-	}
-	p := *pos + 48
-	*pos = p
-	return i, Checksum(i), nil
-}
-func intToKind(i uint64) string {
-	switch Kind(i) {
-	case KindHTTPGet:
-		return "http"
-	case KindTar:
-		return "tar "
-	case KindExec:
-		return "exec"
-	case KindExecNet:
-		return "exen"
-	case KindFile:
-		return "file"
-	default:
-		return fmt.Sprintf("$%d  ", i-KindCustomOffset)
-	}
-}
-func headerSpacing(showHeader bool) string {
-	if showHeader {
-		return "              "
-	}
-
-	return ""
-}
--- a/internal/pkg/pkg.go
+++ b/internal/pkg/pkg.go
@@ -466,7 +466,7 @@ type Cache struct {
 	// Synchronises entry into exclusive artifacts for the cure method.
 	exclMu sync.Mutex
 	// Buffered I/O free list, must not be accessed directly.
-	bufioPool sync.Pool
+	brPool, bwPool sync.Pool

 	// Unlocks the on-filesystem cache. Must only be called from Close.
 	unlock func()
@@ -548,6 +548,26 @@ func (c *Cache) unsafeIdent(a Artifact, encodeKind bool) (
 	return
 }

+// getReader is like [bufio.NewReader] but for brPool.
+func (c *Cache) getReader(r io.Reader) *bufio.Reader {
+	br := c.brPool.Get().(*bufio.Reader)
+	br.Reset(r)
+	return br
+}
+
+// putReader adds br to brPool.
+func (c *Cache) putReader(br *bufio.Reader) { c.brPool.Put(br) }
+
+// getWriter is like [bufio.NewWriter] but for bwPool.
+func (c *Cache) getWriter(w io.Writer) *bufio.Writer {
+	bw := c.bwPool.Get().(*bufio.Writer)
+	bw.Reset(w)
+	return bw
+}
+
+// putWriter adds bw to bwPool.
+func (c *Cache) putWriter(bw *bufio.Writer) { c.bwPool.Put(bw) }
+
 // A ChecksumMismatchError describes an [Artifact] with unexpected content.
 type ChecksumMismatchError struct {
 	// Actual and expected checksums.
@@ -927,10 +947,10 @@ func (c *Cache) openFile(f FileArtifact) (r io.ReadCloser, err error) {
 		}
 		if c.msg.IsVerbose() {
 			rn := reportName(f, c.Ident(f))
-			c.msg.Verbosef("curing %s to memory...", rn)
+			c.msg.Verbosef("curing %s in memory...", rn)
 			defer func() {
 				if err == nil {
-					c.msg.Verbosef("cured %s to memory", rn)
+					c.msg.Verbosef("opened %s for reading", rn)
 				}
 			}()
 		}
@@ -1131,6 +1151,9 @@ type DependencyCureError []*CureError
 // unwrapM recursively expands underlying errors into a caller-supplied map.
 func (e *DependencyCureError) unwrapM(me map[unique.Handle[ID]]*CureError) {
 	for _, err := range *e {
+		if _, ok := me[err.Ident]; ok {
+			continue
+		}
 		if _e, ok := err.Err.(*DependencyCureError); ok {
 			_e.unwrapM(me)
 			continue
@@ -1214,13 +1237,6 @@ func (c *Cache) exitCure(a Artifact, curesExempt bool) {
 	<-c.cures
 }

-// getWriter is like [bufio.NewWriter] but for bufioPool.
-func (c *Cache) getWriter(w io.Writer) *bufio.Writer {
-	bw := c.bufioPool.Get().(*bufio.Writer)
-	bw.Reset(w)
-	return bw
-}
-
 // measuredReader implements [io.ReadCloser] and measures the checksum during
 // Close. If the underlying reader is not read to EOF, Close blocks until all
 // remaining data is consumed and validated.
@@ -1303,9 +1319,6 @@ func (r *RContext) NewMeasuredReader(
 	return r.cache.newMeasuredReader(rc, checksum)
 }

-// putWriter adds bw to bufioPool.
-func (c *Cache) putWriter(bw *bufio.Writer) { c.bufioPool.Put(bw) }
-
 // cure implements Cure without checking the full dependency graph.
 func (c *Cache) cure(a Artifact, curesExempt bool) (
 	pathname *check.Absolute,
@@ -1713,13 +1726,16 @@ func open(
 		msg:  msg,
 		base: base,

+		identPool: sync.Pool{New: func() any { return new(extIdent) }},
+
 		ident:        make(map[unique.Handle[ID]]unique.Handle[Checksum]),
 		identErr:     make(map[unique.Handle[ID]]error),
 		identPending: make(map[unique.Handle[ID]]<-chan struct{}),
+
+		brPool: sync.Pool{New: func() any { return new(bufio.Reader) }},
+		bwPool: sync.Pool{New: func() any { return new(bufio.Writer) }},
 	}
 	c.ctx, c.cancel = context.WithCancel(ctx)
-	c.identPool.New = func() any { return new(extIdent) }
-	c.bufioPool.New = func() any { return new(bufio.Writer) }

 	if lock || !testing.Testing() {
 		if unlock, err := lockedfile.MutexAt(
--- a/internal/pkg/tar.go
+++ b/internal/pkg/tar.go
@@ -10,8 +10,7 @@ import (
 	"io/fs"
 	"net/http"
 	"os"
-
-	"hakurei.app/container/check"
+	"path"
 )

 const (
@@ -100,7 +99,6 @@ func (e DisallowedTypeflagError) Error() string {

 // Cure cures the [Artifact], producing a directory located at work.
 func (a *tarArtifact) Cure(t *TContext) (err error) {
-	temp := t.GetTempDir()
 	var tr io.ReadCloser
 	if tr, err = t.Open(a.f); err != nil {
 		return
@@ -116,7 +114,9 @@ func (a *tarArtifact) Cure(t *TContext) (err error) {
 			err = closeErr
 		}
 	}(tr)
-	tr = io.NopCloser(tr)
+	br := t.cache.getReader(tr)
+	defer t.cache.putReader(br)
+	tr = io.NopCloser(br)

 	switch a.compression {
 	case TarUncompressed:
@@ -137,14 +137,24 @@ func (a *tarArtifact) Cure(t *TContext) (err error) {
 	}

 	type dirTargetPerm struct {
-		path *check.Absolute
+		path string
 		mode fs.FileMode
 	}
 	var madeDirectories []dirTargetPerm

-	if err = os.MkdirAll(temp.String(), 0700); err != nil {
+	if err = os.MkdirAll(t.GetTempDir().String(), 0700); err != nil {
 		return
 	}
+	var root *os.Root
+	if root, err = os.OpenRoot(t.GetTempDir().String()); err != nil {
+		return
+	}
+	defer func() {
+		closeErr := root.Close()
+		if err == nil {
+			err = closeErr
+		}
+	}()

 	var header *tar.Header
 	r := tar.NewReader(tr)
@@ -158,9 +168,8 @@ func (a *tarArtifact) Cure(t *TContext) (err error) {
 			}
 		}

-		pathname := temp.Append(header.Name)
 		if typeflag >= '0' && typeflag <= '9' && typeflag != tar.TypeDir {
-			if err = os.MkdirAll(pathname.Dir().String(), 0700); err != nil {
+			if err = root.MkdirAll(path.Dir(header.Name), 0700); err != nil {
 				return
 			}
 		}
@@ -168,8 +177,8 @@ func (a *tarArtifact) Cure(t *TContext) (err error) {
 		switch typeflag {
 		case tar.TypeReg:
 			var f *os.File
-			if f, err = os.OpenFile(
-				pathname.String(),
+			if f, err = root.OpenFile(
+				header.Name,
 				os.O_CREATE|os.O_EXCL|os.O_WRONLY,
 				header.FileInfo().Mode()&0500,
 			); err != nil {
@@ -184,26 +193,29 @@ func (a *tarArtifact) Cure(t *TContext) (err error) {
 			break

 		case tar.TypeLink:
-			if err = os.Link(
-				temp.Append(header.Linkname).String(),
-				pathname.String(),
+			if err = root.Link(
+				header.Linkname,
+				header.Name,
 			); err != nil {
 				return
 			}
 			break

 		case tar.TypeSymlink:
-			if err = os.Symlink(header.Linkname, pathname.String()); err != nil {
+			if err = root.Symlink(
+				header.Linkname,
+				header.Name,
+			); err != nil {
 				return
 			}
 			break

 		case tar.TypeDir:
 			madeDirectories = append(madeDirectories, dirTargetPerm{
-				path: pathname,
+				path: header.Name,
 				mode: header.FileInfo().Mode(),
 			})
-			if err = os.MkdirAll(pathname.String(), 0700); err != nil {
+			if err = root.MkdirAll(header.Name, 0700); err != nil {
 				return
 			}
 			break
@@ -220,7 +232,7 @@ func (a *tarArtifact) Cure(t *TContext) (err error) {
 	}
 	if err == nil {
 		for _, e := range madeDirectories {
-			if err = os.Chmod(e.path.String(), e.mode&0500); err != nil {
+			if err = root.Chmod(e.path, e.mode&0500); err != nil {
 				return
 			}
 		}
@@ -228,6 +240,7 @@ func (a *tarArtifact) Cure(t *TContext) (err error) {
 		return
 	}

+	temp := t.GetTempDir()
 	if err = os.Chmod(temp.String(), 0700); err != nil {
 		return
 	}
--- a/internal/rosa/all.go
+++ b/internal/rosa/all.go
@@ -16,6 +16,7 @@ const (
 	Automake
 	Bash
 	Binutils
+	Bzip2
 	CMake
 	Coreutils
 	Curl
@@ -82,6 +83,10 @@ const (
 	// stages only. This preset and its direct output must never be exposed.
 	gcc

+	// Stage0 is a tarball containing all compile-time dependencies of artifacts
+	// part of the [Std] toolchain.
+	Stage0
+
 	// _presetEnd is the total number of presets and does not denote a preset.
 	_presetEnd
 )
@@ -113,6 +118,7 @@ func ResolveName(name string) (p PArtifact, ok bool) {
 		"automake":          Automake,
 		"bash":              Bash,
 		"binutils":          Binutils,
+		"bzip2":             Bzip2,
 		"cmake":             CMake,
 		"coreutils":         Coreutils,
 		"curl":              Curl,
--- a/internal/rosa/bzip2.go
+++ b/internal/rosa/bzip2.go
@@ -0,0 +1,22 @@
+package rosa
+
+import "hakurei.app/internal/pkg"
+
+func (t Toolchain) newBzip2() pkg.Artifact {
+	const (
+		version  = "1.0.8"
+		checksum = "cTLykcco7boom-s05H1JVsQi1AtChYL84nXkg_92Dm1Xt94Ob_qlMg_-NSguIK-c"
+	)
+	return t.New("bzip2-"+version, 0, []pkg.Artifact{
+		t.Load(Make),
+	}, nil, nil, `
+cd /usr/src/bzip2
+make CC=cc
+make PREFIX=/work/system install
+`, pkg.Path(AbsUsrSrc.Append("bzip2"), true, pkg.NewHTTPGetTar(
+		nil, "https://sourceware.org/pub/bzip2/bzip2-"+version+".tar.gz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	)))
+}
+func init() { artifactsF[Bzip2] = Toolchain.newBzip2 }
--- a/internal/rosa/cmake.go
+++ b/internal/rosa/cmake.go
@@ -97,7 +97,7 @@ func (t Toolchain) NewViaCMake(
 	}

 	sourcePath := AbsUsrSrc.Append(name)
-	return t.New(name+"-"+variant+"-"+version, attr.Flag, stage3Concat(t, extra,
+	return t.New(name+"-"+variant+"-"+version, attr.Flag, stage0Concat(t, extra,
 		t.Load(CMake),
 		t.Load(Ninja),
 	), nil, slices.Concat([]string{
--- a/internal/rosa/hakurei.go
+++ b/internal/rosa/hakurei.go
@@ -6,8 +6,8 @@ import (

 func (t Toolchain) newHakurei(suffix, script string) pkg.Artifact {
 	const (
-		version  = "0.3.4"
-		checksum = "wVwSLo75a2OnH5tgxNWXR_YhiOJUFnYM_9-sJtxAEOKhcPE0BJafs6PU8o5JzyCT"
+		version  = "0.3.5"
+		checksum = "6Tn38NLezRD2d3aGdFg5qFfqn8_KvC6HwMKwJMPvaHmVw8xRgxn8B0PObswl2mOk"
 	)
 	return t.New("hakurei"+suffix+"-"+version, 0, []pkg.Artifact{
 		t.Load(Go),
@@ -44,213 +44,12 @@ chmod -R +w /usr/src/hakurei
 cd /usr/src/hakurei

 HAKUREI_VERSION='v`+version+`'
-`+script, pkg.Path(AbsUsrSrc.Append("hakurei"), true, t.NewPatchedSource("hakurei", version, pkg.NewHTTPGetTar(
+`+script, pkg.Path(AbsUsrSrc.Append("hakurei"), true, pkg.NewHTTPGetTar(
 		nil, "https://git.gensokyo.uk/security/hakurei/archive/"+
 			"v"+version+".tar.gz",
 		mustDecode(checksum),
 		pkg.TarGzip,
-	), true, [2]string{"dist-00-tests", `From 67e453f5c4de915de23ecbe5980e595758f0f2fb Mon Sep 17 00:00:00 2001
-From: Ophestra <cat@gensokyo.uk>
-Date: Tue, 27 Jan 2026 06:49:48 +0900
-Subject: [PATCH] dist: run tests
-
-This used to be impossible due to nix jank which has been addressed.
-
-Signed-off-by: Ophestra <cat@gensokyo.uk>
---
- dist/release.sh          | 21 ++++++++++++++++-----
- flake.nix                | 32 ++++++++++++++++++++------------
- internal/acl/acl_test.go |  2 +-
- package.nix              |  2 +-
- 4 files changed, 38 insertions(+), 19 deletions(-)
-
-diff --git a/dist/release.sh b/dist/release.sh
-index 4dcb278..0ba9104 100755
--- a/dist/release.sh
-+++ b/dist/release.sh
-@@ -2,19 +2,30 @@
- cd "$(dirname -- "$0")/.."
- VERSION="${HAKUREI_VERSION:-untagged}"
- pname="hakurei-${VERSION}"
-out="dist/${pname}"
-+out="${DESTDIR:-dist}/${pname}"
- 
-+echo '# Preparing distribution files.'
- mkdir -p "${out}"
- cp -v "README.md" "dist/hsurc.default" "dist/install.sh" "${out}"
- cp -rv "dist/comp" "${out}"
-+echo
- 
-+echo '# Building hakurei.'
- go generate ./...
-go build -trimpath -v -o "${out}/bin/" -ldflags "-s -w -buildid= -extldflags '-static'
-+go build -trimpath -v -o "${out}/bin/" -ldflags "-s -w
-+  -buildid= -extldflags '-static'
-   -X hakurei.app/internal/info.buildVersion=${VERSION}
-   -X hakurei.app/internal/info.hakureiPath=/usr/bin/hakurei
-   -X hakurei.app/internal/info.hsuPath=/usr/bin/hsu
-   -X main.hakureiPath=/usr/bin/hakurei" ./...
-+echo
- 
-rm -f "./${out}.tar.gz" && tar -C dist -czf "${out}.tar.gz" "${pname}"
-rm -rf "./${out}"
-(cd dist && sha512sum "${pname}.tar.gz" > "${pname}.tar.gz.sha512")
-+echo '# Testing hakurei.'
-+go test -ldflags='-buildid= -extldflags=-static' ./...
-+echo
-+
-+echo '# Creating distribution.'
-+rm -f "${out}.tar.gz" && tar -C "${out}/.." -vczf "${out}.tar.gz" "${pname}"
-+rm -rf "${out}"
-+(cd "${out}/.." && sha512sum "${pname}.tar.gz" > "${pname}.tar.gz.sha512")
-+echo
-diff --git a/flake.nix b/flake.nix
-index 9e09c61..2340b92 100644
--- a/flake.nix
-+++ b/flake.nix
-@@ -143,19 +143,27 @@
-             "bin/mount.fuse.sharefs" = "${hakurei}/libexec/sharefs";
-           };
- 
-          dist = pkgs.runCommand "${hakurei.name}-dist" { buildInputs = hakurei.targetPkgs ++ [ pkgs.pkgsStatic.musl ]; } ''
-            # go requires XDG_CACHE_HOME for the build cache
-            export XDG_CACHE_HOME="$(mktemp -d)"
-+          dist =
-+            pkgs.runCommand "${hakurei.name}-dist"
-+              {
-+                buildInputs = hakurei.targetPkgs ++ [
-+                  pkgs.pkgsStatic.musl
-+                ];
-+              }
-+              ''
-+                cd $(mktemp -d) \
-+                    && cp -r ${hakurei.src}/. . \
-+                    && chmod +w cmd && cp -r ${hsu.src}/. cmd/hsu/ \
-+                    && chmod -R +w .
- 
-            # get a different workdir as go does not like /build
-            cd $(mktemp -d) \
-                && cp -r ${hakurei.src}/. . \
-                && chmod +w cmd && cp -r ${hsu.src}/. cmd/hsu/ \
-                && chmod -R +w .
-
-            export HAKUREI_VERSION="v${hakurei.version}"
-            CC="clang -O3 -Werror" ./dist/release.sh && mkdir $out && cp -v "dist/hakurei-$HAKUREI_VERSION.tar.gz"* $out
-          '';
-+                CC="musl-clang -O3 -Werror -Qunused-arguments" \
-+                GOCACHE="$(mktemp -d)" \
-+                HAKUREI_TEST_SKIP_ACL=1 \
-+                PATH="${pkgs.pkgsStatic.musl.bin}/bin:$PATH" \
-+                DESTDIR="$out" \
-+                HAKUREI_VERSION="v${hakurei.version}" \
-+                  ./dist/release.sh
-+              '';
-         }
-       );
- 
-diff --git a/internal/acl/acl_test.go b/internal/acl/acl_test.go
-index af6da55..19ce45a 100644
--- a/internal/acl/acl_test.go
-+++ b/internal/acl/acl_test.go
-@@ -24,7 +24,7 @@ var (
- )
- 
- func TestUpdate(t *testing.T) {
-	if os.Getenv("GO_TEST_SKIP_ACL") == "1" {
-+	if os.Getenv("HAKUREI_TEST_SKIP_ACL") == "1" {
- 		t.Skip("acl test skipped")
- 	}
- 
-diff --git a/package.nix b/package.nix
-index 00c4401..2eaa2ec 100644
--- a/package.nix
-+++ b/package.nix
-@@ -89,7 +89,7 @@ buildGoModule rec {
-     CC = "clang -O3 -Werror";
- 
-     # nix build environment does not allow acls
-    GO_TEST_SKIP_ACL = 1;
-+    HAKUREI_TEST_SKIP_ACL = 1;
-   };
- 
-   buildInputs = [`}, [2]string{"container-tests", `From bf14a412e47344fff2681f4b24d1ecc7415bfcb0 Mon Sep 17 00:00:00 2001
-From: Ophestra <cat@gensokyo.uk>
-Date: Sat, 31 Jan 2026 10:59:56 +0900
-Subject: [PATCH] container: fix host-dependent test cases
-
-These are not fully controlled by hakurei and may change depending on host configuration.
-
-Signed-off-by: Ophestra <cat@gensokyo.uk>
---
- container/container_test.go | 27 +++++++++++++++------------
- 1 file changed, 15 insertions(+), 12 deletions(-)
-
-diff --git a/container/container_test.go b/container/container_test.go
-index d737a18..98713cb 100644
--- a/container/container_test.go
-+++ b/container/container_test.go
-@@ -275,12 +275,12 @@ var containerTestCases = []struct {
- 		),
- 		earlyMnt(
- 			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore),
-			ent("/null", "/dev/null", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/zero", "/dev/zero", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/full", "/dev/full", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/random", "/dev/random", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/urandom", "/dev/urandom", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/tty", "/dev/tty", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-+			ent("/null", "/dev/null", ignore, "devtmpfs", "devtmpfs", ignore),
-+			ent("/zero", "/dev/zero", ignore, "devtmpfs", "devtmpfs", ignore),
-+			ent("/full", "/dev/full", ignore, "devtmpfs", "devtmpfs", ignore),
-+			ent("/random", "/dev/random", ignore, "devtmpfs", "devtmpfs", ignore),
-+			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", "devtmpfs", ignore),
-+			ent("/tty", "/dev/tty", ignore, "devtmpfs", "devtmpfs", ignore),
- 			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
- 			ent("/", "/dev/mqueue", "rw,nosuid,nodev,noexec,relatime", "mqueue", "mqueue", "rw"),
- 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
-@@ -293,12 +293,12 @@ var containerTestCases = []struct {
- 		),
- 		earlyMnt(
- 			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore),
-			ent("/null", "/dev/null", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/zero", "/dev/zero", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/full", "/dev/full", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/random", "/dev/random", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/urandom", "/dev/urandom", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/tty", "/dev/tty", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-+			ent("/null", "/dev/null", ignore, "devtmpfs", "devtmpfs", ignore),
-+			ent("/zero", "/dev/zero", ignore, "devtmpfs", "devtmpfs", ignore),
-+			ent("/full", "/dev/full", ignore, "devtmpfs", "devtmpfs", ignore),
-+			ent("/random", "/dev/random", ignore, "devtmpfs", "devtmpfs", ignore),
-+			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", "devtmpfs", ignore),
-+			ent("/tty", "/dev/tty", ignore, "devtmpfs", "devtmpfs", ignore),
- 			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
- 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
- 		),
-@@ -696,6 +696,9 @@ func init() {
- 					mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",relatime")
- 					mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",noatime")
- 
-+					cur.FsOptstr = strings.Replace(cur.FsOptstr, ",seclabel", "", 1)
-+					mnt[i].FsOptstr = strings.Replace(mnt[i].FsOptstr, ",seclabel", "", 1)
-+
- 					if !cur.EqualWithIgnore(mnt[i], "\x00") {
- 						fail = true
- 						log.Printf("[FAIL] %s", cur)`}, [2]string{"dist-01-tarball-name", `diff --git a/dist/release.sh b/dist/release.sh
-index 0ba9104..2990ee1 100755
--- a/dist/release.sh
-+++ b/dist/release.sh
-@@ -1,7 +1,7 @@
- #!/bin/sh -e
- cd "$(dirname -- "$0")/.."
- VERSION="${HAKUREI_VERSION:-untagged}"
-pname="hakurei-${VERSION}"
-+pname="hakurei-${VERSION}-$(go env GOARCH)"
- out="${DESTDIR:-dist}/${pname}"
-
- echo '# Preparing distribution files.'
-`}),
-	), pkg.Path(AbsUsrSrc.Append("hostname", "main.go"), false, pkg.NewFile(
+	)), pkg.Path(AbsUsrSrc.Append("hostname", "main.go"), false, pkg.NewFile(
 		"hostname.go",
 		[]byte(`
 package main
--- a/internal/rosa/llvm.go
+++ b/internal/rosa/llvm.go
@@ -160,7 +160,7 @@ ln -s ld.lld /work/system/bin/ld
 			[2]string{"LIBCXX_USE_COMPILER_RT", "ON"},
 		)

-		if t > toolchainStage3 {
+		if t > toolchainStage0 {
 			// libcxxabi fails to compile if c++ headers not prefixed in /usr
 			// is found by the compiler, and doing this is easier than
 			// overriding CXXFLAGS; not using mv here to avoid chown failures
@@ -199,7 +199,7 @@ cp -r /system/include /usr/include && rm -rf /system/include

 		Paths: attr.paths,
 		Flag:  TExclusive,
-	}, stage3Concat(t, attr.extra,
+	}, stage0Concat(t, attr.extra,
 		t.Load(Libffi),
 		t.Load(Python),
 		t.Load(Perl),
@@ -233,7 +233,7 @@ func (t Toolchain) newLLVM() (musl, compilerRT, runtimes, clang pkg.Artifact) {
 	}

 	compilerRT = t.newLLVMVariant("compiler-rt", &llvmAttr{
-		env: stage3ExclConcat(t, []string{},
+		env: stage0ExclConcat(t, []string{},
 			"LDFLAGS="+earlyLDFLAGS(false),
 		),
 		cmake: [][2]string{
@@ -276,7 +276,7 @@ ln -s \

 	musl = t.NewMusl(&MuslAttr{
 		Extra: []pkg.Artifact{compilerRT},
-		Env: stage3ExclConcat(t, []string{
+		Env: stage0ExclConcat(t, []string{
 			"CC=clang",
 			"LIBCC=/system/lib/clang/21/lib/" +
 				triplet() + "/libclang_rt.builtins.a",
@@ -288,7 +288,7 @@ ln -s \
 	})

 	runtimes = t.newLLVMVariant("runtimes", &llvmAttr{
-		env: stage3ExclConcat(t, []string{},
+		env: stage0ExclConcat(t, []string{},
 			"LDFLAGS="+earlyLDFLAGS(false),
 		),
 		flags: llvmRuntimeLibunwind | llvmRuntimeLibcxx | llvmRuntimeLibcxxABI,
@@ -308,7 +308,7 @@ ln -s \

 	clang = t.newLLVMVariant("clang", &llvmAttr{
 		flags: llvmProjectClang | llvmProjectLld,
-		env: stage3ExclConcat(t, []string{},
+		env: stage0ExclConcat(t, []string{},
 			"CFLAGS="+earlyCFLAGS,
 			"CXXFLAGS="+earlyCXXFLAGS(),
 			"LDFLAGS="+earlyLDFLAGS(false),
--- a/internal/rosa/make.go
+++ b/internal/rosa/make.go
@@ -36,8 +36,8 @@ type MakeAttr struct {

 	// Do not include default extras.
 	OmitDefaults bool
-	// Dependencies not provided by stage3.
-	NonStage3 []pkg.Artifact
+	// Dependencies not provided by stage0.
+	NonStage0 []pkg.Artifact

 	// Additional environment variables.
 	Env []string
@@ -148,8 +148,8 @@ func (t Toolchain) NewViaMake(
 		panic("cannot remain in root")
 	}

-	return t.New(name+"-"+version, attr.Flag, stage3Concat(t,
-		attr.NonStage3,
+	return t.New(name+"-"+version, attr.Flag, stage0Concat(t,
+		attr.NonStage0,
 		finalExtra...,
 	), nil, attr.Env, scriptEarly+`
 /usr/src/`+name+`/configure \
--- a/internal/rosa/mksh.go
+++ b/internal/rosa/mksh.go
@@ -7,7 +7,7 @@ func (t Toolchain) newMksh() pkg.Artifact {
 		version  = "59c"
 		checksum = "0Zj-k4nXEu3IuJY4lvwD2OrC2t27GdZj8SPy4DoaeuBRH1padWb7oREpYgwY8JNq"
 	)
-	return t.New("mksh-"+version, 0, stage3Concat(t, []pkg.Artifact{},
+	return t.New("mksh-"+version, 0, stage0Concat(t, []pkg.Artifact{},
 		t.Load(Perl),
 		t.Load(Coreutils),
 	), nil, []string{
--- a/internal/rosa/musl.go
+++ b/internal/rosa/musl.go
@@ -42,7 +42,7 @@ rmdir -v /work/lib
 		script = ""
 	}

-	return t.New("musl-"+version, 0, stage3Concat(t, attr.Extra,
+	return t.New("musl-"+version, 0, stage0Concat(t, attr.Extra,
 		t.Load(Make),
 		t.Load(Coreutils),
 	), nil, slices.Concat([]string{
--- a/internal/rosa/perl.go
+++ b/internal/rosa/perl.go
@@ -27,7 +27,7 @@ make \
 	"-j$(nproc)" \
 	TEST_JOBS=256 \
 	test_harness
-make DESTDIR=/work install
+./perl -Ilib -I. installperl --destdir=/work
 `, pkg.Path(AbsUsrSrc.Append("perl"), true, t.NewPatchedSource(
 		"perl", version, pkg.NewHTTPGetTar(
 			nil, "https://www.cpan.org/src/5.0/perl-"+version+".tar.gz",
--- a/internal/rosa/rosa.go
+++ b/internal/rosa/rosa.go
@@ -2,6 +2,7 @@
 package rosa

 import (
+	"errors"
 	"log"
 	"runtime"
 	"slices"
@@ -82,11 +83,11 @@ func earlyLDFLAGS(static bool) string {
 	return s
 }

-// earlyCFLAGS is reference CFLAGS for the stage3 toolchain.
+// earlyCFLAGS is reference CFLAGS for the stage0 toolchain.
 const earlyCFLAGS = "-Qunused-arguments " +
 	"-isystem/system/include"

-// earlyCXXFLAGS returns reference CXXFLAGS for the stage3 toolchain
+// earlyCXXFLAGS returns reference CXXFLAGS for the stage0 toolchain
 // corresponding to [runtime.GOARCH].
 func earlyCXXFLAGS() string {
 	return "--start-no-unused-arguments " +
@@ -101,16 +102,30 @@ func earlyCXXFLAGS() string {
 type Toolchain uintptr

 const (
-	// toolchainBusybox denotes a busybox installation from the busyboxBin
-	// binary distribution. This is for decompressing unsupported formats.
-	toolchainBusybox Toolchain = iota
+	// _toolchainBusybox denotes a busybox installation from the busyboxBin
+	// binary distribution. This is defined as a toolchain to make use of the
+	// toolchain abstractions to preprocess toolchainGentoo and is not a real,
+	// functioning toolchain. It does not contain any compilers.
+	_toolchainBusybox Toolchain = iota

-	// toolchainStage3 denotes the Gentoo stage3 toolchain. Special care must be
-	// taken to compile correctly against this toolchain.
-	toolchainStage3
+	// toolchainGentoo denotes the toolchain in a Gentoo stage3 tarball. Special
+	// care must be taken to compile correctly against this toolchain.
+	toolchainGentoo
+
+	// toolchainIntermediateGentoo is like to toolchainIntermediate, but
+	// compiled against toolchainGentoo.
+	toolchainIntermediateGentoo
+
+	// toolchainStdGentoo is like Std, but bootstrapped from toolchainGentoo.
+	// This toolchain creates the first [Stage0] distribution.
+	toolchainStdGentoo
+
+	// toolchainStage0 denotes the stage0 toolchain. Special care must be taken
+	// to compile correctly against this toolchain.
+	toolchainStage0

 	// toolchainIntermediate denotes the intermediate toolchain compiled against
-	// toolchainStage3. This toolchain should be functionally identical to [Std]
+	// toolchainStage0. This toolchain should be functionally identical to [Std]
 	// and is used to bootstrap [Std].
 	toolchainIntermediate

@@ -122,19 +137,19 @@ const (
 	_toolchainEnd
 )

-// stage3Concat concatenates s and values. If the current toolchain is
-// toolchainStage3, stage3Concat returns s as is.
-func stage3Concat[S ~[]E, E any](t Toolchain, s S, values ...E) S {
-	if t == toolchainStage3 {
+// stage0Concat concatenates s and values. If the current toolchain is
+// toolchainStage0, stage0Concat returns s as is.
+func stage0Concat[S ~[]E, E any](t Toolchain, s S, values ...E) S {
+	if t == toolchainStage0 || t == toolchainGentoo {
 		return s
 	}
 	return slices.Concat(s, values)
 }

-// stage3ExclConcat concatenates s and values. If the current toolchain is not
-// toolchainStage3, stage3ExclConcat returns s as is.
-func stage3ExclConcat[S ~[]E, E any](t Toolchain, s S, values ...E) S {
-	if t == toolchainStage3 {
+// stage0ExclConcat concatenates s and values. If the current toolchain is not
+// toolchainStage0, stage0ExclConcat returns s as is.
+func stage0ExclConcat[S ~[]E, E any](t Toolchain, s S, values ...E) S {
+	if t == toolchainStage0 || t == toolchainGentoo {
 		return slices.Concat(s, values)
 	}
 	return s
@@ -173,7 +188,7 @@ func fixupEnviron(env, extras []string, paths ...string) []string {

 // absCureScript is the absolute pathname [Toolchain.New] places the fixed-up
 // build script under.
-var absCureScript = fhs.AbsUsrBin.Append(".cure-script")
+var absCureScript = AbsSystem.Append("bin", ".cure-script")

 const (
 	// TExclusive denotes an exclusive [pkg.Artifact].
@@ -182,12 +197,31 @@ const (
 	TEarly
 )

+var (
+	// gentooStage3 is the url of a Gentoo stage3 tarball.
+	gentooStage3 string
+	// gentooStage3Checksum is the expected checksum of gentooStage3.
+	gentooStage3Checksum pkg.Checksum
+)
+
+// SetGentooStage3 sets the Gentoo stage3 tarball url and checksum. It panics
+// if given zero values or if these values have already been set.
+func SetGentooStage3(url string, checksum pkg.Checksum) {
+	if gentooStage3 != "" {
+		panic(errors.New("attempting to set Gentoo stage3 url twice"))
+	}
+	if url == "" {
+		panic(errors.New("attempting to set Gentoo stage3 url to the zero value"))
+	}
+	gentooStage3, gentooStage3Checksum = url, checksum
+}
+
 // New returns a [pkg.Artifact] compiled on this toolchain.
 func (t Toolchain) New(
 	name string,
 	flag int,
 	extra []pkg.Artifact,
-	checksum *pkg.Checksum,
+	knownChecksum *pkg.Checksum,
 	env []string,
 	script string,

@@ -195,57 +229,47 @@ func (t Toolchain) New(
 ) pkg.Artifact {
 	const lcMessages = "LC_MESSAGES=C.UTF-8"

-	var (
-		path    = AbsSystem.Append("bin", "sh")
-		args    = []string{"sh", absCureScript.String()}
-		support []pkg.Artifact
-	)
+	var support []pkg.Artifact
 	switch t {
-	case toolchainBusybox:
+	case _toolchainBusybox:
 		name += "-early"
 		support = slices.Concat([]pkg.Artifact{newBusyboxBin()}, extra)
-		path = AbsSystem.Append("bin", "busybox")
-		args[0] = "hush"
 		env = fixupEnviron(env, nil, "/system/bin")

-	case toolchainStage3:
+	case toolchainGentoo, toolchainStage0:
 		name += "-boot"
-		var seed string
-		switch runtime.GOARCH {
-		case "amd64":
-			seed = "c5_FwMnRN8RZpTdBLGYkL4RR8ampdaZN2JbkgrFLe8-QHQAVQy08APVvIL6eT7KW"
-		case "arm64":
-			seed = "79uRbRI44PyknQQ9RlFUQrwqplup7vImiIk6klefL8TN-fT42TXMS_v4XszwexCb"
-
-		default:
-			panic("unsupported target " + runtime.GOARCH)
-		}
-		path = fhs.AbsRoot.Append("bin", "bash")
-		args[0] = "bash"
-		support = slices.Concat([]pkg.Artifact{
-			cureEtc{},
-			toolchainBusybox.New("stage3", 0, nil, nil, nil, `
+		support = append(support, cureEtc{})
+		if t == toolchainStage0 {
+			support = append(support, NewStage0())
+		} else {
+			support = append(support, _toolchainBusybox.New("gentoo", 0, nil, nil, nil, `
 tar -C /work -xf /usr/src/stage3.tar.xz
 rm -rf /work/dev/ /work/proc/
 ln -vs ../usr/bin /work/bin
+mkdir -vp /work/system/bin
+(cd /work/system/bin && ln -vs \
+	../../bin/sh \
+	../../usr/lib/llvm/*/bin/* \
+	.)
 `, pkg.Path(AbsUsrSrc.Append("stage3.tar.xz"), false,
 				pkg.NewHTTPGet(
-					nil, "https://basement.gensokyo.uk/seed/"+seed,
-					mustDecode(seed),
+					nil, gentooStage3,
+					gentooStage3Checksum,
 				),
-			)),
-		}, extra)
+			)))
+		}
+		support = slices.Concat(support, extra)
 		env = fixupEnviron(env, []string{
 			EnvTriplet + "=" + triplet(),
 			lcMessages,
 			"LDFLAGS=" + earlyLDFLAGS(true),
 		}, "/system/bin",
 			"/usr/bin",
-			"/usr/lib/llvm/21/bin",
 		)

-	case toolchainIntermediate, Std:
-		if t < Std {
+	case toolchainIntermediateGentoo, toolchainStdGentoo,
+		toolchainIntermediate, Std:
+		if t == toolchainIntermediateGentoo || t == toolchainIntermediate {
 			name += "-std"
 		}

@@ -279,9 +303,10 @@ ln -vs ../usr/bin /work/bin
 	}

 	return pkg.NewExec(
-		name, checksum, pkg.ExecTimeoutMax, flag&TExclusive != 0,
+		name, knownChecksum, pkg.ExecTimeoutMax, flag&TExclusive != 0,
 		fhs.AbsRoot, env,
-		path, args,
+		AbsSystem.Append("bin", "sh"),
+		[]string{"sh", absCureScript.String()},

 		slices.Concat([]pkg.ExecPath{pkg.Path(
 			fhs.AbsRoot, true,
@@ -328,7 +353,7 @@ cat /usr/src/` + name + `-patches/* | \
 `
 		aname += "-patched"
 	}
-	return t.New(aname, 0, stage3Concat(t, []pkg.Artifact{},
+	return t.New(aname, 0, stage0Concat(t, []pkg.Artifact{},
 		t.Load(Patch),
 	), nil, nil, script, paths...)
 }
--- a/internal/rosa/stage0.go
+++ b/internal/rosa/stage0.go
@@ -0,0 +1,73 @@
+package rosa
+
+import (
+	"runtime"
+	"sync"
+
+	"hakurei.app/internal/pkg"
+)
+
+func (t Toolchain) newStage0() pkg.Artifact {
+	musl, compilerRT, runtimes, clang := t.NewLLVM()
+	return t.New("rosa-stage0", 0, []pkg.Artifact{
+		musl,
+		compilerRT,
+		runtimes,
+		clang,
+
+		t.Load(Bzip2),
+
+		t.Load(Patch),
+		t.Load(Make),
+		t.Load(CMake),
+		t.Load(Ninja),
+
+		t.Load(Libffi),
+		t.Load(Python),
+		t.Load(Perl),
+		t.Load(Diffutils),
+		t.Load(Bash),
+		t.Load(Gawk),
+		t.Load(Coreutils),
+		t.Load(Findutils),
+
+		t.Load(KernelHeaders),
+	}, nil, nil, `
+umask 377
+tar \
+	-vjc \
+	-C / \
+	-f /work/stage0-`+triplet()+`.tar.bz2 \
+	system bin usr/bin/env
+`)
+}
+func init() { artifactsF[Stage0] = Toolchain.newStage0 }
+
+var (
+	// stage0 stores the tarball unpack artifact.
+	stage0 pkg.Artifact
+	// stage0Once is for lazy initialisation of stage0.
+	stage0Once sync.Once
+)
+
+// NewStage0 returns a stage0 distribution created from curing [Stage0].
+func NewStage0() pkg.Artifact {
+	stage0Once.Do(func() {
+		var seed string
+		switch runtime.GOARCH {
+		case "amd64":
+			seed = "tqM1Li15BJ-uFG8zU-XjgFxoN_kuzh1VxrSDVUVa0vGmo-NeWapSftH739sY8EAg"
+
+		default:
+			panic("unsupported target " + runtime.GOARCH)
+		}
+
+		stage0 = pkg.NewHTTPGetTar(
+			nil, "https://hakurei.app/seed/20260210/"+
+				"stage0-"+triplet()+".tar.bz2",
+			mustDecode(seed),
+			pkg.TarBzip2,
+		)
+	})
+	return stage0
+}
--- a/internal/rosa/toybox.go
+++ b/internal/rosa/toybox.go
@@ -7,16 +7,18 @@ func (t Toolchain) newToybox(suffix, script string) pkg.Artifact {
 		version  = "0.8.13"
 		checksum = "rZ1V1ATDte2WeQZanxLVoiRGdfPXhMlEo5-exX-e-ml8cGn9qOv0ABEUVZpX3wTI"
 	)
-	return t.New("toybox-"+version+suffix, TEarly, stage3Concat(t, []pkg.Artifact{},
+	return t.New("toybox-"+version+suffix, TEarly, stage0Concat(t, []pkg.Artifact{},
 		t.Load(Make),
 		t.Load(Bash),
 		t.Load(Gzip),

 		t.Load(KernelHeaders),
-	), nil, stage3Concat(t, []string{},
+	), nil, stage0Concat(t, []string{},
 		"ROSA_CHECK=make USER=cure tests",
 	), `
-ln -s ../system/bin/bash /bin/ || true
+chmod +w /bin/
+ln -rs "$(which bash)" /bin/ || true
+
 cd /usr/src/toybox
 chmod +w kconfig tests
 rm \
--- a/options.md
+++ b/options.md
@@ -35,7 +35,7 @@ package


 *Default:*
-` <derivation hakurei-static-x86_64-unknown-linux-musl-0.3.4> `
+` <derivation hakurei-static-x86_64-unknown-linux-musl-0.3.5> `



@@ -805,7 +805,7 @@ package


 *Default:*
-` <derivation hakurei-hsu-0.3.4> `
+` <derivation hakurei-hsu-0.3.5> `



--- a/package.nix
+++ b/package.nix
@@ -35,7 +35,7 @@

 buildGoModule rec {
  pname = "hakurei";
-  version = "0.3.4";
+  version = "0.3.5";

  srcFiltered = builtins.path {
    name = "${pname}-src";
Author	SHA1	Message	Date
Ophestra	17b64bb42c	internal/pkg: skip resolved cure errors Some checks are pending Test / Flake checks (push) Blocked by required conditions Details Test / Create distribution (push) Successful in 1m0s Details Test / Sandbox (push) Successful in 2m44s Details Test / Hakurei (push) Successful in 4m2s Details Test / ShareFS (push) Successful in 4m2s Details Test / Hpkg (push) Successful in 4m30s Details Test / Sandbox (race detector) (push) Successful in 5m7s Details Test / Hakurei (race detector) (push) Successful in 6m5s Details This significantly improves error resolution performance. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-11 17:50:18 +09:00
Ophestra	dbb89dfb0f	internal/pkg: buffer tar reader All checks were successful Test / Create distribution (push) Successful in 1m2s Details Test / Sandbox (push) Successful in 2m48s Details Test / Hakurei (push) Successful in 4m0s Details Test / ShareFS (push) Successful in 4m10s Details Test / Hpkg (push) Successful in 4m44s Details Test / Sandbox (race detector) (push) Successful in 5m34s Details Test / Hakurei (race detector) (push) Successful in 8m7s Details Test / Flake checks (push) Successful in 1m49s Details This significantly improves performance and is a good assumption since the primary use case of FileArtifact is over the network. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-11 02:08:44 +09:00
Ophestra	de06ea2be4	internal/pkg: read buffer free list All checks were successful Test / Create distribution (push) Successful in 1m0s Details Test / Sandbox (push) Successful in 2m53s Details Test / Hakurei (push) Successful in 4m30s Details Test / ShareFS (push) Successful in 4m28s Details Test / Hpkg (push) Successful in 5m6s Details Test / Sandbox (race detector) (push) Successful in 5m18s Details Test / Hakurei (race detector) (push) Successful in 6m35s Details Test / Flake checks (push) Successful in 2m3s Details Reader has a non-insignificant buffer that is worth saving as well. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-11 02:02:46 +09:00
Ophestra	1ef7bedfb5	internal/rosa/toybox: do not assume bash location All checks were successful Test / Create distribution (push) Successful in 59s Details Test / Sandbox (push) Successful in 2m36s Details Test / Hakurei (push) Successful in 3m52s Details Test / ShareFS (push) Successful in 3m58s Details Test / Hpkg (push) Successful in 4m27s Details Test / Sandbox (race detector) (push) Successful in 5m7s Details Test / Hakurei (race detector) (push) Successful in 5m54s Details Test / Flake checks (push) Successful in 1m43s Details For compatibility with Gentoo stage3 as bootstrap seed. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-11 01:36:41 +09:00
Ophestra	05a828c474	internal/pkg: validate tar pathnames All checks were successful Test / Create distribution (push) Successful in 59s Details Test / Sandbox (push) Successful in 2m35s Details Test / ShareFS (push) Successful in 3m59s Details Test / Hpkg (push) Successful in 4m46s Details Test / Sandbox (race detector) (push) Successful in 5m2s Details Test / Hakurei (race detector) (push) Successful in 5m57s Details Test / Hakurei (push) Successful in 4m24s Details Test / Flake checks (push) Successful in 1m50s Details TContext no longer validates FileArtifact ahead of time, validation outcome is instead determined after consuming the reader to EOF. All data must therefore be treated as untrusted input until the reader is closed. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-11 00:40:54 +09:00
Ophestra	0061d11f93	internal/rosa: use self-hosted stage0 All checks were successful Test / Create distribution (push) Successful in 59s Details Test / Sandbox (push) Successful in 2m42s Details Test / Hakurei (push) Successful in 3m53s Details Test / ShareFS (push) Successful in 4m3s Details Test / Hpkg (push) Successful in 4m31s Details Test / Sandbox (race detector) (push) Successful in 5m4s Details Test / Hakurei (race detector) (push) Successful in 5m58s Details Test / Flake checks (push) Successful in 3m10s Details This removes the bootstrap dependency on Gentoo stage3 tarball. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-10 22:31:08 +09:00
Ophestra	fb101a02f2	internal/rosa: self-host stage0 tarball All checks were successful Test / Create distribution (push) Successful in 2m26s Details Test / Sandbox (push) Successful in 5m22s Details Test / Hakurei (push) Successful in 6m37s Details Test / ShareFS (push) Successful in 6m39s Details Test / Hpkg (push) Successful in 7m10s Details Test / Sandbox (race detector) (push) Successful in 7m15s Details Test / Hakurei (race detector) (push) Successful in 8m15s Details Test / Flake checks (push) Successful in 1m51s Details This replaces gentoo stage3 tarballs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-10 21:22:46 +09:00
Ophestra	3dbd67d113	internal/rosa: consistent stage0 paths All checks were successful Test / Create distribution (push) Successful in 2m2s Details Test / Hakurei (push) Successful in 6m35s Details Test / ShareFS (push) Successful in 6m33s Details Test / Sandbox (race detector) (push) Successful in 6m52s Details Test / Hpkg (push) Successful in 7m20s Details Test / Hakurei (race detector) (push) Successful in 7m46s Details Test / Sandbox (push) Successful in 1m37s Details Test / Flake checks (push) Successful in 1m50s Details This makes using the gentoo stage3 as our stage0 compatible with Rosa OS stage0 tarballs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-10 19:28:47 +09:00
Ophestra	f511f0a9e9	internal/rosa: bzip2 artifact All checks were successful Test / Create distribution (push) Successful in 30s Details Test / Sandbox (push) Successful in 45s Details Test / ShareFS (push) Successful in 2m44s Details Test / Hakurei (push) Successful in 3m1s Details Test / Hpkg (push) Successful in 3m31s Details Test / Sandbox (race detector) (push) Successful in 5m10s Details Test / Hakurei (race detector) (push) Successful in 3m13s Details Test / Flake checks (push) Successful in 1m48s Details For creating the stage0 tarball. Might be replaced by a custom artifact at some point. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-09 02:26:52 +09:00
Ophestra	47995137b3	internal/rosa/perl: skip installing manpages All checks were successful Test / Create distribution (push) Successful in 59s Details Test / Sandbox (push) Successful in 2m48s Details Test / Hakurei (push) Successful in 4m13s Details Test / ShareFS (push) Successful in 4m10s Details Test / Hpkg (push) Successful in 4m48s Details Test / Sandbox (race detector) (push) Successful in 5m5s Details Test / Hakurei (race detector) (push) Successful in 7m0s Details Test / Flake checks (push) Successful in 1m48s Details Perl manpages ignore prefix and gets installed to /. This change does not use the configure script because it is completely broken and specifying either "none" or a single space character (undocumented) has no effect. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-09 01:50:52 +09:00
Ophestra	e1b8607101	internal/rosa: rename stage0 toolchain All checks were successful Test / Create distribution (push) Successful in 1m2s Details Test / Sandbox (push) Successful in 1m48s Details Test / Sandbox (race detector) (push) Successful in 2m52s Details Test / Hakurei (push) Successful in 3m1s Details Test / ShareFS (push) Successful in 3m16s Details Test / Hakurei (race detector) (push) Successful in 3m58s Details Test / Hpkg (push) Successful in 3m57s Details Test / Flake checks (push) Successful in 1m48s Details This is stage0 relative to Rosa OS, and stage3 relative to the toolchain it is compiled on (Gentoo in this case). Referring to the toolchain itself as stage3 is counterintuitive and misleading. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-09 00:55:07 +09:00
Ophestra	3d3bd45b95	internal/rosa/hakurei: 0.3.4 to 0.3.5 All checks were successful Test / Create distribution (push) Successful in 59s Details Test / Sandbox (push) Successful in 2m37s Details Test / ShareFS (push) Successful in 3m59s Details Test / Hpkg (push) Successful in 4m33s Details Test / Sandbox (race detector) (push) Successful in 5m0s Details Test / Hakurei (race detector) (push) Successful in 6m16s Details Test / Hakurei (push) Successful in 3m0s Details Test / Flake checks (push) Successful in 2m7s Details This removes all backport patches. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-09 00:27:45 +09:00
Ophestra	9fb0b2452e	release: 0.3.5 All checks were successful Release / Create release (push) Successful in 1m1s Details Test / Hakurei (push) Successful in 3m47s Details Test / Create distribution (push) Successful in 30s Details Test / ShareFS (push) Successful in 36s Details Test / Sandbox (push) Successful in 44s Details Test / Hpkg (push) Successful in 45s Details Test / Sandbox (race detector) (push) Successful in 4m39s Details Test / Hakurei (race detector) (push) Successful in 1m52s Details Test / Flake checks (push) Successful in 1m50s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-09 00:11:20 +09:00
Ophestra	a3e87dd0ef	container: ignore uninterpreted source All checks were successful Test / Create distribution (push) Successful in 29s Details Test / ShareFS (push) Successful in 36s Details Test / Sandbox (push) Successful in 43s Details Test / Sandbox (race detector) (push) Successful in 43s Details Test / Hakurei (push) Successful in 49s Details Test / Hpkg (push) Successful in 46s Details Test / Hakurei (race detector) (push) Successful in 50s Details Test / Flake checks (push) Successful in 1m55s Details These can be set to anything by the distribution. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-08 19:39:39 +09:00
Ophestra	90a38c0708	container: strip host-dependent opts in test cases All checks were successful Test / Create distribution (push) Successful in 33s Details Test / ShareFS (push) Successful in 40s Details Test / Sandbox (push) Successful in 50s Details Test / Hpkg (push) Successful in 51s Details Test / Hakurei (push) Successful in 55s Details Test / Sandbox (race detector) (push) Successful in 2m34s Details Test / Hakurei (race detector) (push) Successful in 3m28s Details Test / Flake checks (push) Successful in 1m54s Details This change also improves plumbing for stripping options. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-08 19:35:20 +09:00
Ophestra	39cc8caa93	container: add riscv64 constants All checks were successful Test / Create distribution (push) Successful in 1m0s Details Test / Sandbox (push) Successful in 2m35s Details Test / Hakurei (push) Successful in 3m56s Details Test / ShareFS (push) Successful in 3m57s Details Test / Hpkg (push) Successful in 4m30s Details Test / Sandbox (race detector) (push) Successful in 5m5s Details Test / Hakurei (race detector) (push) Successful in 6m0s Details Test / Flake checks (push) Successful in 1m40s Details This target is unlikely to become viable any time soon. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-08 19:03:47 +09:00