Merge remote-tracking branch 'origin/staging' into staging

cmd/irdump: formatted disassembly
cmd/irdump: basic disassembler
2026-02-08 04:13:14 -06:00 · 2026-02-08 04:12:35 -06:00 · 2026-02-08 04:12:35 -06:00 · 2026-02-08 04:12:35 -06:00 · 2026-02-08 18:54:45 +09:00 · 2026-02-08 03:54:07 -06:00
24 changed files with 663 additions and 1215 deletions
--- a/cmd/irdump/main.go
+++ b/cmd/irdump/main.go
@@ -0,0 +1,76 @@
+package main
+
+import (
+	"errors"
+	"log"
+	"os"
+
+	"hakurei.app/command"
+	"hakurei.app/internal/pkg"
+)
+
+func main() {
+	log.SetFlags(0)
+	log.SetPrefix("irdump: ")
+
+	var (
+		flagOutput string
+		flagReal   bool
+		flagHeader bool
+		flagForce  bool
+		flagRaw    bool
+	)
+	c := command.New(os.Stderr, log.Printf, "irdump", func(args []string) (err error) {
+		var input *os.File
+		if len(args) != 1 {
+			return errors.New("irdump requires 1 argument")
+		}
+		if input, err = os.Open(args[0]); err != nil {
+			return
+		}
+		defer input.Close()
+
+		var output *os.File
+		if flagOutput == "" {
+			output = os.Stdout
+		} else {
+			defer output.Close()
+			if output, err = os.Create(flagOutput); err != nil {
+				return
+			}
+		}
+
+		var out string
+		if out, err = pkg.Disassemble(input, flagReal, flagHeader, flagForce, flagRaw); err != nil {
+			return
+		}
+		if _, err = output.WriteString(out); err != nil {
+			return
+		}
+		return
+	}).Flag(
+		&flagOutput,
+		"o", command.StringFlag(""),
+		"Output file for asm (leave empty for stdout)",
+	).Flag(
+		&flagReal,
+		"r", command.BoolFlag(false),
+		"skip label generation; idents print real value",
+	).Flag(
+		&flagHeader,
+		"H", command.BoolFlag(false),
+		"display artifact headers",
+	).Flag(
+		&flagForce,
+		"f", command.BoolFlag(false),
+		"force display (skip validations)",
+	).Flag(
+		&flagRaw,
+		"R", command.BoolFlag(false),
+		"don't format output",
+	)
+
+	c.MustParse(os.Args[1:], func(err error) {
+		log.Fatal(err)
+	})
+}
--- a/cmd/mbf/main.go
+++ b/cmd/mbf/main.go
@@ -109,92 +109,46 @@ func main() {
 		)
 	}

-	{
-		var (
-			flagGentoo   string
-			flagChecksum string
-
-			flagStage0 bool
-		)
-		c.NewCommand(
-			"stage3",
-			"Check for toolchain 3-stage non-determinism",
-			func(args []string) (err error) {
-				std := rosa.Std
-				if flagGentoo != "" {
-					std -= 3 // magic number to discourage misuse
-
-					var checksum pkg.Checksum
-					if len(flagChecksum) != 0 {
-						if err = pkg.Decode(&checksum, flagChecksum); err != nil {
-							return
-						}
-					}
-					rosa.SetGentooStage3(flagGentoo, checksum)
-				}
-
-				_, _, _, stage1 := (std - 2).NewLLVM()
-				_, _, _, stage2 := (std - 1).NewLLVM()
-				_, _, _, stage3 := std.NewLLVM()
-				var (
-					pathname *check.Absolute
-					checksum [2]unique.Handle[pkg.Checksum]
-				)
-
-				if pathname, _, err = cache.Cure(stage1); err != nil {
-					return err
-				}
-				log.Println("stage1:", pathname)
-
-				if pathname, checksum[0], err = cache.Cure(stage2); err != nil {
-					return err
-				}
-				log.Println("stage2:", pathname)
-				if pathname, checksum[1], err = cache.Cure(stage3); err != nil {
-					return err
-				}
-				log.Println("stage3:", pathname)
-
-				if checksum[0] != checksum[1] {
-					err = &pkg.ChecksumMismatchError{
-						Got:  checksum[0].Value(),
-						Want: checksum[1].Value(),
-					}
-				} else {
-					log.Println(
-						"stage2 is identical to stage3",
-						"("+pkg.Encode(checksum[0].Value())+")",
-					)
-				}
-
-				if flagStage0 {
-					if pathname, _, err = cache.Cure(
-						std.Load(rosa.Stage0),
-					); err != nil {
-						return err
-					}
-					log.Println(pathname)
-				}
-
-				return
-			},
-		).
-			Flag(
-				&flagGentoo,
-				"gentoo", command.StringFlag(""),
-				"Bootstrap from a Gentoo stage3 tarball",
-			).
-			Flag(
-				&flagChecksum,
-				"checksum", command.StringFlag(""),
-				"Checksum of Gentoo stage3 tarball",
-			).
-			Flag(
-				&flagStage0,
-				"stage0", command.BoolFlag(false),
-				"Create bootstrap stage0 tarball",
+	c.NewCommand(
+		"stage3",
+		"Check for toolchain 3-stage non-determinism",
+		func(args []string) (err error) {
+			_, _, _, stage1 := (rosa.Std - 2).NewLLVM()
+			_, _, _, stage2 := (rosa.Std - 1).NewLLVM()
+			_, _, _, stage3 := rosa.Std.NewLLVM()
+			var (
+				pathname *check.Absolute
+				checksum [2]unique.Handle[pkg.Checksum]
 			)
-	}
+
+			if pathname, _, err = cache.Cure(stage1); err != nil {
+				return err
+			}
+			log.Println("stage1:", pathname)
+
+			if pathname, checksum[0], err = cache.Cure(stage2); err != nil {
+				return err
+			}
+			log.Println("stage2:", pathname)
+			if pathname, checksum[1], err = cache.Cure(stage3); err != nil {
+				return err
+			}
+			log.Println("stage3:", pathname)
+
+			if checksum[0] != checksum[1] {
+				err = &pkg.ChecksumMismatchError{
+					Got:  checksum[0].Value(),
+					Want: checksum[1].Value(),
+				}
+			} else {
+				log.Println(
+					"stage2 is identical to stage3",
+					"("+pkg.Encode(checksum[0].Value())+")",
+				)
+			}
+			return
+		},
+	)

 	{
 		var (
--- a/container/container_test.go
+++ b/container/container_test.go
@@ -274,13 +274,13 @@ var containerTestCases = []struct {
 			Dev(check.MustAbs("/dev"), true),
 		),
 		earlyMnt(
-			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", ignore, ignore),
-			ent("/null", "/dev/null", ignore, "devtmpfs", ignore, ignore),
-			ent("/zero", "/dev/zero", ignore, "devtmpfs", ignore, ignore),
-			ent("/full", "/dev/full", ignore, "devtmpfs", ignore, ignore),
-			ent("/random", "/dev/random", ignore, "devtmpfs", ignore, ignore),
-			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", ignore, ignore),
-			ent("/tty", "/dev/tty", ignore, "devtmpfs", ignore, ignore),
+			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore),
+			ent("/null", "/dev/null", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/zero", "/dev/zero", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/full", "/dev/full", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/random", "/dev/random", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/tty", "/dev/tty", ignore, "devtmpfs", "devtmpfs", ignore),
 			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
 			ent("/", "/dev/mqueue", "rw,nosuid,nodev,noexec,relatime", "mqueue", "mqueue", "rw"),
 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
@@ -292,13 +292,13 @@ var containerTestCases = []struct {
 			Dev(check.MustAbs("/dev"), false),
 		),
 		earlyMnt(
-			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", ignore, ignore),
-			ent("/null", "/dev/null", ignore, "devtmpfs", ignore, ignore),
-			ent("/zero", "/dev/zero", ignore, "devtmpfs", ignore, ignore),
-			ent("/full", "/dev/full", ignore, "devtmpfs", ignore, ignore),
-			ent("/random", "/dev/random", ignore, "devtmpfs", ignore, ignore),
-			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", ignore, ignore),
-			ent("/tty", "/dev/tty", ignore, "devtmpfs", ignore, ignore),
+			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore),
+			ent("/null", "/dev/null", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/zero", "/dev/zero", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/full", "/dev/full", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/random", "/dev/random", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/tty", "/dev/tty", ignore, "devtmpfs", "devtmpfs", ignore),
 			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
 		),
@@ -690,22 +690,14 @@ func init() {
 						return fmt.Errorf("got more than %d entries", len(mnt))
 					}

-					// ugly hack but should be reliable and is less likely to
-					//false negative than comparing by parsed flags
-					for _, s := range []string{
-						"relatime",
-						"noatime",
-					} {
-						cur.VfsOptstr = strings.TrimSuffix(cur.VfsOptstr, ","+s)
-						mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ","+s)
-					}
-					for _, s := range []string{
-						"seclabel",
-						"inode64",
-					} {
-						cur.FsOptstr = strings.Replace(cur.FsOptstr, ","+s, "", 1)
-						mnt[i].FsOptstr = strings.Replace(mnt[i].FsOptstr, ","+s, "", 1)
-					}
+					// ugly hack but should be reliable and is less likely to false negative than comparing by parsed flags
+					cur.VfsOptstr = strings.TrimSuffix(cur.VfsOptstr, ",relatime")
+					cur.VfsOptstr = strings.TrimSuffix(cur.VfsOptstr, ",noatime")
+					mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",relatime")
+					mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",noatime")
+
+					cur.FsOptstr = strings.Replace(cur.FsOptstr, ",seclabel", "", 1)
+					mnt[i].FsOptstr = strings.Replace(mnt[i].FsOptstr, ",seclabel", "", 1)

 					if !cur.EqualWithIgnore(mnt[i], "\x00") {
 						fail = true
--- a/container/seccomp/presets_riscv64_test.go
+++ b/container/seccomp/presets_riscv64_test.go
@@ -1,27 +0,0 @@
-package seccomp_test
-
-import (
-	. "hakurei.app/container/seccomp"
-	. "hakurei.app/container/std"
-)
-
-var bpfExpected = bpfLookup{
-	{AllowMultiarch | AllowCAN |
-		AllowBluetooth, PresetExt |
-		PresetDenyNS | PresetDenyTTY | PresetDenyDevel |
-		PresetLinux32}: toHash(
-		"a1c4ffa35f4bfbf38061184760b9a09edfcb4964c3b534395e47327b83f3fb61f2f9573ddfcc4772424cc2f5dd12fd32471e6531dbe10e85eda3797dd4fa179f"),
-
-	{0, 0}: toHash(
-		"f3910fd727d087def593e3876c2c6ab9ace71d82ec8cbc992a26223e7bba85e1d7a0b56c5fc6303703f24595825dad8561637edaedd5384b34a6cd080946633c"),
-	{0, PresetExt}: toHash(
-		"741438c5e3f11c36c92ae8c5934f13440675c6e719541c2dbffeda79a10081bcfd9ad8314a60c1d1f53db86c8080c13fffa3bbcf7fe753935679b4b902737286"),
-	{0, PresetStrict}: toHash(
-		"79e9e464d02405c6d74fd2c771bd72a1311e488221c73a9c32db9270219837c54fccec2f36fe2474895547e60c311514567e2e6cf4e7a7fcf909c1ecd1e254a7"),
-	{0, PresetDenyNS | PresetDenyTTY | PresetDenyDevel}: toHash(
-		"3c443715a6c1e557a284862ea8efb70a5d4ecbe67d1226627323e861cd3646fb3e7768ec5b94b93760b7f652cf6916f66e317a4fbf8716d10c3673aa4fc3ae58"),
-	{0, PresetExt | PresetDenyDevel}: toHash(
-		"4448a74e8cc75a4ab63799c4f2cc2a5af63e5f4e8e9b8ac15a1873d647dfa67a4c67b39ed466d8dd32abc64136d401879fc6185c9ab00feeaf59ccf4305f8201"),
-	{0, PresetExt | PresetDenyNS | PresetDenyDevel}: toHash(
-		"c7c86e793cb7192f5f6c735f372cda27eb43ae1045e587f8eadb64c849520a3280b6570a3d7b601d32cddb38021585a2234db38e506cebfd10aa3d6c75440f17"),
-}
--- a/container/std/mksysnum_linux.pl
+++ b/container/std/mksysnum_linux.pl
@@ -12,7 +12,6 @@ my %syscall_cutoff_arch = (
 	"x86" => 340,
 	"x86_64" => 302,
 	"aarch64" => 281,
-	"riscv64" => 281,
 );

 print <<EOF;
--- a/container/std/syscall_extra_linux_riscv64.go
+++ b/container/std/syscall_extra_linux_riscv64.go
@@ -1,55 +0,0 @@
-package std
-
-import "syscall"
-
-const (
-	SYS_NEWFSTATAT = syscall.SYS_FSTATAT
-)
-
-var syscallNumExtra = map[string]ScmpSyscall{
-	"uselib":          SNR_USELIB,
-	"clock_adjtime64": SNR_CLOCK_ADJTIME64,
-	"clock_settime64": SNR_CLOCK_SETTIME64,
-	"umount":          SNR_UMOUNT,
-	"chown":           SNR_CHOWN,
-	"chown32":         SNR_CHOWN32,
-	"fchown32":        SNR_FCHOWN32,
-	"lchown":          SNR_LCHOWN,
-	"lchown32":        SNR_LCHOWN32,
-	"setgid32":        SNR_SETGID32,
-	"setgroups32":     SNR_SETGROUPS32,
-	"setregid32":      SNR_SETREGID32,
-	"setresgid32":     SNR_SETRESGID32,
-	"setresuid32":     SNR_SETRESUID32,
-	"setreuid32":      SNR_SETREUID32,
-	"setuid32":        SNR_SETUID32,
-	"modify_ldt":      SNR_MODIFY_LDT,
-	"subpage_prot":    SNR_SUBPAGE_PROT,
-	"switch_endian":   SNR_SWITCH_ENDIAN,
-	"vm86":            SNR_VM86,
-	"vm86old":         SNR_VM86OLD,
-}
-
-const (
-	SNR_USELIB          ScmpSyscall = __PNR_uselib
-	SNR_CLOCK_ADJTIME64 ScmpSyscall = __PNR_clock_adjtime64
-	SNR_CLOCK_SETTIME64 ScmpSyscall = __PNR_clock_settime64
-	SNR_UMOUNT          ScmpSyscall = __PNR_umount
-	SNR_CHOWN           ScmpSyscall = __PNR_chown
-	SNR_CHOWN32         ScmpSyscall = __PNR_chown32
-	SNR_FCHOWN32        ScmpSyscall = __PNR_fchown32
-	SNR_LCHOWN          ScmpSyscall = __PNR_lchown
-	SNR_LCHOWN32        ScmpSyscall = __PNR_lchown32
-	SNR_SETGID32        ScmpSyscall = __PNR_setgid32
-	SNR_SETGROUPS32     ScmpSyscall = __PNR_setgroups32
-	SNR_SETREGID32      ScmpSyscall = __PNR_setregid32
-	SNR_SETRESGID32     ScmpSyscall = __PNR_setresgid32
-	SNR_SETRESUID32     ScmpSyscall = __PNR_setresuid32
-	SNR_SETREUID32      ScmpSyscall = __PNR_setreuid32
-	SNR_SETUID32        ScmpSyscall = __PNR_setuid32
-	SNR_MODIFY_LDT      ScmpSyscall = __PNR_modify_ldt
-	SNR_SUBPAGE_PROT    ScmpSyscall = __PNR_subpage_prot
-	SNR_SWITCH_ENDIAN   ScmpSyscall = __PNR_switch_endian
-	SNR_VM86            ScmpSyscall = __PNR_vm86
-	SNR_VM86OLD         ScmpSyscall = __PNR_vm86old
-)
--- a/container/std/syscall_linux_riscv64.go
+++ b/container/std/syscall_linux_riscv64.go
@@ -1,719 +0,0 @@
-// mksysnum_linux.pl /usr/include/riscv64-linux-gnu/asm/unistd.h
-// Code generated by the command above; DO NOT EDIT.
-
-package std
-
-import . "syscall"
-
-var syscallNum = map[string]ScmpSyscall{
-	"io_setup":                SNR_IO_SETUP,
-	"io_destroy":              SNR_IO_DESTROY,
-	"io_submit":               SNR_IO_SUBMIT,
-	"io_cancel":               SNR_IO_CANCEL,
-	"io_getevents":            SNR_IO_GETEVENTS,
-	"setxattr":                SNR_SETXATTR,
-	"lsetxattr":               SNR_LSETXATTR,
-	"fsetxattr":               SNR_FSETXATTR,
-	"getxattr":                SNR_GETXATTR,
-	"lgetxattr":               SNR_LGETXATTR,
-	"fgetxattr":               SNR_FGETXATTR,
-	"listxattr":               SNR_LISTXATTR,
-	"llistxattr":              SNR_LLISTXATTR,
-	"flistxattr":              SNR_FLISTXATTR,
-	"removexattr":             SNR_REMOVEXATTR,
-	"lremovexattr":            SNR_LREMOVEXATTR,
-	"fremovexattr":            SNR_FREMOVEXATTR,
-	"getcwd":                  SNR_GETCWD,
-	"lookup_dcookie":          SNR_LOOKUP_DCOOKIE,
-	"eventfd2":                SNR_EVENTFD2,
-	"epoll_create1":           SNR_EPOLL_CREATE1,
-	"epoll_ctl":               SNR_EPOLL_CTL,
-	"epoll_pwait":             SNR_EPOLL_PWAIT,
-	"dup":                     SNR_DUP,
-	"dup3":                    SNR_DUP3,
-	"fcntl":                   SNR_FCNTL,
-	"inotify_init1":           SNR_INOTIFY_INIT1,
-	"inotify_add_watch":       SNR_INOTIFY_ADD_WATCH,
-	"inotify_rm_watch":        SNR_INOTIFY_RM_WATCH,
-	"ioctl":                   SNR_IOCTL,
-	"ioprio_set":              SNR_IOPRIO_SET,
-	"ioprio_get":              SNR_IOPRIO_GET,
-	"flock":                   SNR_FLOCK,
-	"mknodat":                 SNR_MKNODAT,
-	"mkdirat":                 SNR_MKDIRAT,
-	"unlinkat":                SNR_UNLINKAT,
-	"symlinkat":               SNR_SYMLINKAT,
-	"linkat":                  SNR_LINKAT,
-	"umount2":                 SNR_UMOUNT2,
-	"mount":                   SNR_MOUNT,
-	"pivot_root":              SNR_PIVOT_ROOT,
-	"nfsservctl":              SNR_NFSSERVCTL,
-	"statfs":                  SNR_STATFS,
-	"fstatfs":                 SNR_FSTATFS,
-	"truncate":                SNR_TRUNCATE,
-	"ftruncate":               SNR_FTRUNCATE,
-	"fallocate":               SNR_FALLOCATE,
-	"faccessat":               SNR_FACCESSAT,
-	"chdir":                   SNR_CHDIR,
-	"fchdir":                  SNR_FCHDIR,
-	"chroot":                  SNR_CHROOT,
-	"fchmod":                  SNR_FCHMOD,
-	"fchmodat":                SNR_FCHMODAT,
-	"fchownat":                SNR_FCHOWNAT,
-	"fchown":                  SNR_FCHOWN,
-	"openat":                  SNR_OPENAT,
-	"close":                   SNR_CLOSE,
-	"vhangup":                 SNR_VHANGUP,
-	"pipe2":                   SNR_PIPE2,
-	"quotactl":                SNR_QUOTACTL,
-	"getdents64":              SNR_GETDENTS64,
-	"lseek":                   SNR_LSEEK,
-	"read":                    SNR_READ,
-	"write":                   SNR_WRITE,
-	"readv":                   SNR_READV,
-	"writev":                  SNR_WRITEV,
-	"pread64":                 SNR_PREAD64,
-	"pwrite64":                SNR_PWRITE64,
-	"preadv":                  SNR_PREADV,
-	"pwritev":                 SNR_PWRITEV,
-	"sendfile":                SNR_SENDFILE,
-	"pselect6":                SNR_PSELECT6,
-	"ppoll":                   SNR_PPOLL,
-	"signalfd4":               SNR_SIGNALFD4,
-	"vmsplice":                SNR_VMSPLICE,
-	"splice":                  SNR_SPLICE,
-	"tee":                     SNR_TEE,
-	"readlinkat":              SNR_READLINKAT,
-	"newfstatat":              SNR_NEWFSTATAT,
-	"fstat":                   SNR_FSTAT,
-	"sync":                    SNR_SYNC,
-	"fsync":                   SNR_FSYNC,
-	"fdatasync":               SNR_FDATASYNC,
-	"sync_file_range":         SNR_SYNC_FILE_RANGE,
-	"timerfd_create":          SNR_TIMERFD_CREATE,
-	"timerfd_settime":         SNR_TIMERFD_SETTIME,
-	"timerfd_gettime":         SNR_TIMERFD_GETTIME,
-	"utimensat":               SNR_UTIMENSAT,
-	"acct":                    SNR_ACCT,
-	"capget":                  SNR_CAPGET,
-	"capset":                  SNR_CAPSET,
-	"personality":             SNR_PERSONALITY,
-	"exit":                    SNR_EXIT,
-	"exit_group":              SNR_EXIT_GROUP,
-	"waitid":                  SNR_WAITID,
-	"set_tid_address":         SNR_SET_TID_ADDRESS,
-	"unshare":                 SNR_UNSHARE,
-	"futex":                   SNR_FUTEX,
-	"set_robust_list":         SNR_SET_ROBUST_LIST,
-	"get_robust_list":         SNR_GET_ROBUST_LIST,
-	"nanosleep":               SNR_NANOSLEEP,
-	"getitimer":               SNR_GETITIMER,
-	"setitimer":               SNR_SETITIMER,
-	"kexec_load":              SNR_KEXEC_LOAD,
-	"init_module":             SNR_INIT_MODULE,
-	"delete_module":           SNR_DELETE_MODULE,
-	"timer_create":            SNR_TIMER_CREATE,
-	"timer_gettime":           SNR_TIMER_GETTIME,
-	"timer_getoverrun":        SNR_TIMER_GETOVERRUN,
-	"timer_settime":           SNR_TIMER_SETTIME,
-	"timer_delete":            SNR_TIMER_DELETE,
-	"clock_settime":           SNR_CLOCK_SETTIME,
-	"clock_gettime":           SNR_CLOCK_GETTIME,
-	"clock_getres":            SNR_CLOCK_GETRES,
-	"clock_nanosleep":         SNR_CLOCK_NANOSLEEP,
-	"syslog":                  SNR_SYSLOG,
-	"ptrace":                  SNR_PTRACE,
-	"sched_setparam":          SNR_SCHED_SETPARAM,
-	"sched_setscheduler":      SNR_SCHED_SETSCHEDULER,
-	"sched_getscheduler":      SNR_SCHED_GETSCHEDULER,
-	"sched_getparam":          SNR_SCHED_GETPARAM,
-	"sched_setaffinity":       SNR_SCHED_SETAFFINITY,
-	"sched_getaffinity":       SNR_SCHED_GETAFFINITY,
-	"sched_yield":             SNR_SCHED_YIELD,
-	"sched_get_priority_max":  SNR_SCHED_GET_PRIORITY_MAX,
-	"sched_get_priority_min":  SNR_SCHED_GET_PRIORITY_MIN,
-	"sched_rr_get_interval":   SNR_SCHED_RR_GET_INTERVAL,
-	"restart_syscall":         SNR_RESTART_SYSCALL,
-	"kill":                    SNR_KILL,
-	"tkill":                   SNR_TKILL,
-	"tgkill":                  SNR_TGKILL,
-	"sigaltstack":             SNR_SIGALTSTACK,
-	"rt_sigsuspend":           SNR_RT_SIGSUSPEND,
-	"rt_sigaction":            SNR_RT_SIGACTION,
-	"rt_sigprocmask":          SNR_RT_SIGPROCMASK,
-	"rt_sigpending":           SNR_RT_SIGPENDING,
-	"rt_sigtimedwait":         SNR_RT_SIGTIMEDWAIT,
-	"rt_sigqueueinfo":         SNR_RT_SIGQUEUEINFO,
-	"rt_sigreturn":            SNR_RT_SIGRETURN,
-	"setpriority":             SNR_SETPRIORITY,
-	"getpriority":             SNR_GETPRIORITY,
-	"reboot":                  SNR_REBOOT,
-	"setregid":                SNR_SETREGID,
-	"setgid":                  SNR_SETGID,
-	"setreuid":                SNR_SETREUID,
-	"setuid":                  SNR_SETUID,
-	"setresuid":               SNR_SETRESUID,
-	"getresuid":               SNR_GETRESUID,
-	"setresgid":               SNR_SETRESGID,
-	"getresgid":               SNR_GETRESGID,
-	"setfsuid":                SNR_SETFSUID,
-	"setfsgid":                SNR_SETFSGID,
-	"times":                   SNR_TIMES,
-	"setpgid":                 SNR_SETPGID,
-	"getpgid":                 SNR_GETPGID,
-	"getsid":                  SNR_GETSID,
-	"setsid":                  SNR_SETSID,
-	"getgroups":               SNR_GETGROUPS,
-	"setgroups":               SNR_SETGROUPS,
-	"uname":                   SNR_UNAME,
-	"sethostname":             SNR_SETHOSTNAME,
-	"setdomainname":           SNR_SETDOMAINNAME,
-	"getrlimit":               SNR_GETRLIMIT,
-	"setrlimit":               SNR_SETRLIMIT,
-	"getrusage":               SNR_GETRUSAGE,
-	"umask":                   SNR_UMASK,
-	"prctl":                   SNR_PRCTL,
-	"getcpu":                  SNR_GETCPU,
-	"gettimeofday":            SNR_GETTIMEOFDAY,
-	"settimeofday":            SNR_SETTIMEOFDAY,
-	"adjtimex":                SNR_ADJTIMEX,
-	"getpid":                  SNR_GETPID,
-	"getppid":                 SNR_GETPPID,
-	"getuid":                  SNR_GETUID,
-	"geteuid":                 SNR_GETEUID,
-	"getgid":                  SNR_GETGID,
-	"getegid":                 SNR_GETEGID,
-	"gettid":                  SNR_GETTID,
-	"sysinfo":                 SNR_SYSINFO,
-	"mq_open":                 SNR_MQ_OPEN,
-	"mq_unlink":               SNR_MQ_UNLINK,
-	"mq_timedsend":            SNR_MQ_TIMEDSEND,
-	"mq_timedreceive":         SNR_MQ_TIMEDRECEIVE,
-	"mq_notify":               SNR_MQ_NOTIFY,
-	"mq_getsetattr":           SNR_MQ_GETSETATTR,
-	"msgget":                  SNR_MSGGET,
-	"msgctl":                  SNR_MSGCTL,
-	"msgrcv":                  SNR_MSGRCV,
-	"msgsnd":                  SNR_MSGSND,
-	"semget":                  SNR_SEMGET,
-	"semctl":                  SNR_SEMCTL,
-	"semtimedop":              SNR_SEMTIMEDOP,
-	"semop":                   SNR_SEMOP,
-	"shmget":                  SNR_SHMGET,
-	"shmctl":                  SNR_SHMCTL,
-	"shmat":                   SNR_SHMAT,
-	"shmdt":                   SNR_SHMDT,
-	"socket":                  SNR_SOCKET,
-	"socketpair":              SNR_SOCKETPAIR,
-	"bind":                    SNR_BIND,
-	"listen":                  SNR_LISTEN,
-	"accept":                  SNR_ACCEPT,
-	"connect":                 SNR_CONNECT,
-	"getsockname":             SNR_GETSOCKNAME,
-	"getpeername":             SNR_GETPEERNAME,
-	"sendto":                  SNR_SENDTO,
-	"recvfrom":                SNR_RECVFROM,
-	"setsockopt":              SNR_SETSOCKOPT,
-	"getsockopt":              SNR_GETSOCKOPT,
-	"shutdown":                SNR_SHUTDOWN,
-	"sendmsg":                 SNR_SENDMSG,
-	"recvmsg":                 SNR_RECVMSG,
-	"readahead":               SNR_READAHEAD,
-	"brk":                     SNR_BRK,
-	"munmap":                  SNR_MUNMAP,
-	"mremap":                  SNR_MREMAP,
-	"add_key":                 SNR_ADD_KEY,
-	"request_key":             SNR_REQUEST_KEY,
-	"keyctl":                  SNR_KEYCTL,
-	"clone":                   SNR_CLONE,
-	"execve":                  SNR_EXECVE,
-	"mmap":                    SNR_MMAP,
-	"fadvise64":               SNR_FADVISE64,
-	"swapon":                  SNR_SWAPON,
-	"swapoff":                 SNR_SWAPOFF,
-	"mprotect":                SNR_MPROTECT,
-	"msync":                   SNR_MSYNC,
-	"mlock":                   SNR_MLOCK,
-	"munlock":                 SNR_MUNLOCK,
-	"mlockall":                SNR_MLOCKALL,
-	"munlockall":              SNR_MUNLOCKALL,
-	"mincore":                 SNR_MINCORE,
-	"madvise":                 SNR_MADVISE,
-	"remap_file_pages":        SNR_REMAP_FILE_PAGES,
-	"mbind":                   SNR_MBIND,
-	"get_mempolicy":           SNR_GET_MEMPOLICY,
-	"set_mempolicy":           SNR_SET_MEMPOLICY,
-	"migrate_pages":           SNR_MIGRATE_PAGES,
-	"move_pages":              SNR_MOVE_PAGES,
-	"rt_tgsigqueueinfo":       SNR_RT_TGSIGQUEUEINFO,
-	"perf_event_open":         SNR_PERF_EVENT_OPEN,
-	"accept4":                 SNR_ACCEPT4,
-	"recvmmsg":                SNR_RECVMMSG,
-	"wait4":                   SNR_WAIT4,
-	"prlimit64":               SNR_PRLIMIT64,
-	"fanotify_init":           SNR_FANOTIFY_INIT,
-	"fanotify_mark":           SNR_FANOTIFY_MARK,
-	"name_to_handle_at":       SNR_NAME_TO_HANDLE_AT,
-	"open_by_handle_at":       SNR_OPEN_BY_HANDLE_AT,
-	"clock_adjtime":           SNR_CLOCK_ADJTIME,
-	"syncfs":                  SNR_SYNCFS,
-	"setns":                   SNR_SETNS,
-	"sendmmsg":                SNR_SENDMMSG,
-	"process_vm_readv":        SNR_PROCESS_VM_READV,
-	"process_vm_writev":       SNR_PROCESS_VM_WRITEV,
-	"kcmp":                    SNR_KCMP,
-	"finit_module":            SNR_FINIT_MODULE,
-	"sched_setattr":           SNR_SCHED_SETATTR,
-	"sched_getattr":           SNR_SCHED_GETATTR,
-	"renameat2":               SNR_RENAMEAT2,
-	"seccomp":                 SNR_SECCOMP,
-	"getrandom":               SNR_GETRANDOM,
-	"memfd_create":            SNR_MEMFD_CREATE,
-	"bpf":                     SNR_BPF,
-	"execveat":                SNR_EXECVEAT,
-	"userfaultfd":             SNR_USERFAULTFD,
-	"membarrier":              SNR_MEMBARRIER,
-	"mlock2":                  SNR_MLOCK2,
-	"copy_file_range":         SNR_COPY_FILE_RANGE,
-	"preadv2":                 SNR_PREADV2,
-	"pwritev2":                SNR_PWRITEV2,
-	"pkey_mprotect":           SNR_PKEY_MPROTECT,
-	"pkey_alloc":              SNR_PKEY_ALLOC,
-	"pkey_free":               SNR_PKEY_FREE,
-	"statx":                   SNR_STATX,
-	"io_pgetevents":           SNR_IO_PGETEVENTS,
-	"rseq":                    SNR_RSEQ,
-	"kexec_file_load":         SNR_KEXEC_FILE_LOAD,
-	"pidfd_send_signal":       SNR_PIDFD_SEND_SIGNAL,
-	"io_uring_setup":          SNR_IO_URING_SETUP,
-	"io_uring_enter":          SNR_IO_URING_ENTER,
-	"io_uring_register":       SNR_IO_URING_REGISTER,
-	"open_tree":               SNR_OPEN_TREE,
-	"move_mount":              SNR_MOVE_MOUNT,
-	"fsopen":                  SNR_FSOPEN,
-	"fsconfig":                SNR_FSCONFIG,
-	"fsmount":                 SNR_FSMOUNT,
-	"fspick":                  SNR_FSPICK,
-	"pidfd_open":              SNR_PIDFD_OPEN,
-	"clone3":                  SNR_CLONE3,
-	"close_range":             SNR_CLOSE_RANGE,
-	"openat2":                 SNR_OPENAT2,
-	"pidfd_getfd":             SNR_PIDFD_GETFD,
-	"faccessat2":              SNR_FACCESSAT2,
-	"process_madvise":         SNR_PROCESS_MADVISE,
-	"epoll_pwait2":            SNR_EPOLL_PWAIT2,
-	"mount_setattr":           SNR_MOUNT_SETATTR,
-	"quotactl_fd":             SNR_QUOTACTL_FD,
-	"landlock_create_ruleset": SNR_LANDLOCK_CREATE_RULESET,
-	"landlock_add_rule":       SNR_LANDLOCK_ADD_RULE,
-	"landlock_restrict_self":  SNR_LANDLOCK_RESTRICT_SELF,
-	"memfd_secret":            SNR_MEMFD_SECRET,
-	"process_mrelease":        SNR_PROCESS_MRELEASE,
-	"futex_waitv":             SNR_FUTEX_WAITV,
-	"set_mempolicy_home_node": SNR_SET_MEMPOLICY_HOME_NODE,
-	"cachestat":               SNR_CACHESTAT,
-	"fchmodat2":               SNR_FCHMODAT2,
-	"map_shadow_stack":        SNR_MAP_SHADOW_STACK,
-	"futex_wake":              SNR_FUTEX_WAKE,
-	"futex_wait":              SNR_FUTEX_WAIT,
-	"futex_requeue":           SNR_FUTEX_REQUEUE,
-	"statmount":               SNR_STATMOUNT,
-	"listmount":               SNR_LISTMOUNT,
-	"lsm_get_self_attr":       SNR_LSM_GET_SELF_ATTR,
-	"lsm_set_self_attr":       SNR_LSM_SET_SELF_ATTR,
-	"lsm_list_modules":        SNR_LSM_LIST_MODULES,
-	"mseal":                   SNR_MSEAL,
-	"setxattrat":              SNR_SETXATTRAT,
-	"getxattrat":              SNR_GETXATTRAT,
-	"listxattrat":             SNR_LISTXATTRAT,
-	"removexattrat":           SNR_REMOVEXATTRAT,
-}
-
-const (
-	SYS_USERFAULTFD             = 282
-	SYS_MEMBARRIER              = 283
-	SYS_MLOCK2                  = 284
-	SYS_COPY_FILE_RANGE         = 285
-	SYS_PREADV2                 = 286
-	SYS_PWRITEV2                = 287
-	SYS_PKEY_MPROTECT           = 288
-	SYS_PKEY_ALLOC              = 289
-	SYS_PKEY_FREE               = 290
-	SYS_STATX                   = 291
-	SYS_IO_PGETEVENTS           = 292
-	SYS_RSEQ                    = 293
-	SYS_KEXEC_FILE_LOAD         = 294
-	SYS_PIDFD_SEND_SIGNAL       = 424
-	SYS_IO_URING_SETUP          = 425
-	SYS_IO_URING_ENTER          = 426
-	SYS_IO_URING_REGISTER       = 427
-	SYS_OPEN_TREE               = 428
-	SYS_MOVE_MOUNT              = 429
-	SYS_FSOPEN                  = 430
-	SYS_FSCONFIG                = 431
-	SYS_FSMOUNT                 = 432
-	SYS_FSPICK                  = 433
-	SYS_PIDFD_OPEN              = 434
-	SYS_CLONE3                  = 435
-	SYS_CLOSE_RANGE             = 436
-	SYS_OPENAT2                 = 437
-	SYS_PIDFD_GETFD             = 438
-	SYS_FACCESSAT2              = 439
-	SYS_PROCESS_MADVISE         = 440
-	SYS_EPOLL_PWAIT2            = 441
-	SYS_MOUNT_SETATTR           = 442
-	SYS_QUOTACTL_FD             = 443
-	SYS_LANDLOCK_CREATE_RULESET = 444
-	SYS_LANDLOCK_ADD_RULE       = 445
-	SYS_LANDLOCK_RESTRICT_SELF  = 446
-	SYS_MEMFD_SECRET            = 447
-	SYS_PROCESS_MRELEASE        = 448
-	SYS_FUTEX_WAITV             = 449
-	SYS_SET_MEMPOLICY_HOME_NODE = 450
-	SYS_CACHESTAT               = 451
-	SYS_FCHMODAT2               = 452
-	SYS_MAP_SHADOW_STACK        = 453
-	SYS_FUTEX_WAKE              = 454
-	SYS_FUTEX_WAIT              = 455
-	SYS_FUTEX_REQUEUE           = 456
-	SYS_STATMOUNT               = 457
-	SYS_LISTMOUNT               = 458
-	SYS_LSM_GET_SELF_ATTR       = 459
-	SYS_LSM_SET_SELF_ATTR       = 460
-	SYS_LSM_LIST_MODULES        = 461
-	SYS_MSEAL                   = 462
-	SYS_SETXATTRAT              = 463
-	SYS_GETXATTRAT              = 464
-	SYS_LISTXATTRAT             = 465
-	SYS_REMOVEXATTRAT           = 466
-	SYS_OPEN_TREE_ATTR          = 467
-	SYS_FILE_GETATTR            = 468
-	SYS_FILE_SETATTR            = 469
-)
-
-const (
-	SNR_IO_SETUP                ScmpSyscall = SYS_IO_SETUP
-	SNR_IO_DESTROY              ScmpSyscall = SYS_IO_DESTROY
-	SNR_IO_SUBMIT               ScmpSyscall = SYS_IO_SUBMIT
-	SNR_IO_CANCEL               ScmpSyscall = SYS_IO_CANCEL
-	SNR_IO_GETEVENTS            ScmpSyscall = SYS_IO_GETEVENTS
-	SNR_SETXATTR                ScmpSyscall = SYS_SETXATTR
-	SNR_LSETXATTR               ScmpSyscall = SYS_LSETXATTR
-	SNR_FSETXATTR               ScmpSyscall = SYS_FSETXATTR
-	SNR_GETXATTR                ScmpSyscall = SYS_GETXATTR
-	SNR_LGETXATTR               ScmpSyscall = SYS_LGETXATTR
-	SNR_FGETXATTR               ScmpSyscall = SYS_FGETXATTR
-	SNR_LISTXATTR               ScmpSyscall = SYS_LISTXATTR
-	SNR_LLISTXATTR              ScmpSyscall = SYS_LLISTXATTR
-	SNR_FLISTXATTR              ScmpSyscall = SYS_FLISTXATTR
-	SNR_REMOVEXATTR             ScmpSyscall = SYS_REMOVEXATTR
-	SNR_LREMOVEXATTR            ScmpSyscall = SYS_LREMOVEXATTR
-	SNR_FREMOVEXATTR            ScmpSyscall = SYS_FREMOVEXATTR
-	SNR_GETCWD                  ScmpSyscall = SYS_GETCWD
-	SNR_LOOKUP_DCOOKIE          ScmpSyscall = SYS_LOOKUP_DCOOKIE
-	SNR_EVENTFD2                ScmpSyscall = SYS_EVENTFD2
-	SNR_EPOLL_CREATE1           ScmpSyscall = SYS_EPOLL_CREATE1
-	SNR_EPOLL_CTL               ScmpSyscall = SYS_EPOLL_CTL
-	SNR_EPOLL_PWAIT             ScmpSyscall = SYS_EPOLL_PWAIT
-	SNR_DUP                     ScmpSyscall = SYS_DUP
-	SNR_DUP3                    ScmpSyscall = SYS_DUP3
-	SNR_FCNTL                   ScmpSyscall = SYS_FCNTL
-	SNR_INOTIFY_INIT1           ScmpSyscall = SYS_INOTIFY_INIT1
-	SNR_INOTIFY_ADD_WATCH       ScmpSyscall = SYS_INOTIFY_ADD_WATCH
-	SNR_INOTIFY_RM_WATCH        ScmpSyscall = SYS_INOTIFY_RM_WATCH
-	SNR_IOCTL                   ScmpSyscall = SYS_IOCTL
-	SNR_IOPRIO_SET              ScmpSyscall = SYS_IOPRIO_SET
-	SNR_IOPRIO_GET              ScmpSyscall = SYS_IOPRIO_GET
-	SNR_FLOCK                   ScmpSyscall = SYS_FLOCK
-	SNR_MKNODAT                 ScmpSyscall = SYS_MKNODAT
-	SNR_MKDIRAT                 ScmpSyscall = SYS_MKDIRAT
-	SNR_UNLINKAT                ScmpSyscall = SYS_UNLINKAT
-	SNR_SYMLINKAT               ScmpSyscall = SYS_SYMLINKAT
-	SNR_LINKAT                  ScmpSyscall = SYS_LINKAT
-	SNR_UMOUNT2                 ScmpSyscall = SYS_UMOUNT2
-	SNR_MOUNT                   ScmpSyscall = SYS_MOUNT
-	SNR_PIVOT_ROOT              ScmpSyscall = SYS_PIVOT_ROOT
-	SNR_NFSSERVCTL              ScmpSyscall = SYS_NFSSERVCTL
-	SNR_STATFS                  ScmpSyscall = SYS_STATFS
-	SNR_FSTATFS                 ScmpSyscall = SYS_FSTATFS
-	SNR_TRUNCATE                ScmpSyscall = SYS_TRUNCATE
-	SNR_FTRUNCATE               ScmpSyscall = SYS_FTRUNCATE
-	SNR_FALLOCATE               ScmpSyscall = SYS_FALLOCATE
-	SNR_FACCESSAT               ScmpSyscall = SYS_FACCESSAT
-	SNR_CHDIR                   ScmpSyscall = SYS_CHDIR
-	SNR_FCHDIR                  ScmpSyscall = SYS_FCHDIR
-	SNR_CHROOT                  ScmpSyscall = SYS_CHROOT
-	SNR_FCHMOD                  ScmpSyscall = SYS_FCHMOD
-	SNR_FCHMODAT                ScmpSyscall = SYS_FCHMODAT
-	SNR_FCHOWNAT                ScmpSyscall = SYS_FCHOWNAT
-	SNR_FCHOWN                  ScmpSyscall = SYS_FCHOWN
-	SNR_OPENAT                  ScmpSyscall = SYS_OPENAT
-	SNR_CLOSE                   ScmpSyscall = SYS_CLOSE
-	SNR_VHANGUP                 ScmpSyscall = SYS_VHANGUP
-	SNR_PIPE2                   ScmpSyscall = SYS_PIPE2
-	SNR_QUOTACTL                ScmpSyscall = SYS_QUOTACTL
-	SNR_GETDENTS64              ScmpSyscall = SYS_GETDENTS64
-	SNR_LSEEK                   ScmpSyscall = SYS_LSEEK
-	SNR_READ                    ScmpSyscall = SYS_READ
-	SNR_WRITE                   ScmpSyscall = SYS_WRITE
-	SNR_READV                   ScmpSyscall = SYS_READV
-	SNR_WRITEV                  ScmpSyscall = SYS_WRITEV
-	SNR_PREAD64                 ScmpSyscall = SYS_PREAD64
-	SNR_PWRITE64                ScmpSyscall = SYS_PWRITE64
-	SNR_PREADV                  ScmpSyscall = SYS_PREADV
-	SNR_PWRITEV                 ScmpSyscall = SYS_PWRITEV
-	SNR_SENDFILE                ScmpSyscall = SYS_SENDFILE
-	SNR_PSELECT6                ScmpSyscall = SYS_PSELECT6
-	SNR_PPOLL                   ScmpSyscall = SYS_PPOLL
-	SNR_SIGNALFD4               ScmpSyscall = SYS_SIGNALFD4
-	SNR_VMSPLICE                ScmpSyscall = SYS_VMSPLICE
-	SNR_SPLICE                  ScmpSyscall = SYS_SPLICE
-	SNR_TEE                     ScmpSyscall = SYS_TEE
-	SNR_READLINKAT              ScmpSyscall = SYS_READLINKAT
-	SNR_NEWFSTATAT              ScmpSyscall = SYS_NEWFSTATAT
-	SNR_FSTAT                   ScmpSyscall = SYS_FSTAT
-	SNR_SYNC                    ScmpSyscall = SYS_SYNC
-	SNR_FSYNC                   ScmpSyscall = SYS_FSYNC
-	SNR_FDATASYNC               ScmpSyscall = SYS_FDATASYNC
-	SNR_SYNC_FILE_RANGE         ScmpSyscall = SYS_SYNC_FILE_RANGE
-	SNR_TIMERFD_CREATE          ScmpSyscall = SYS_TIMERFD_CREATE
-	SNR_TIMERFD_SETTIME         ScmpSyscall = SYS_TIMERFD_SETTIME
-	SNR_TIMERFD_GETTIME         ScmpSyscall = SYS_TIMERFD_GETTIME
-	SNR_UTIMENSAT               ScmpSyscall = SYS_UTIMENSAT
-	SNR_ACCT                    ScmpSyscall = SYS_ACCT
-	SNR_CAPGET                  ScmpSyscall = SYS_CAPGET
-	SNR_CAPSET                  ScmpSyscall = SYS_CAPSET
-	SNR_PERSONALITY             ScmpSyscall = SYS_PERSONALITY
-	SNR_EXIT                    ScmpSyscall = SYS_EXIT
-	SNR_EXIT_GROUP              ScmpSyscall = SYS_EXIT_GROUP
-	SNR_WAITID                  ScmpSyscall = SYS_WAITID
-	SNR_SET_TID_ADDRESS         ScmpSyscall = SYS_SET_TID_ADDRESS
-	SNR_UNSHARE                 ScmpSyscall = SYS_UNSHARE
-	SNR_FUTEX                   ScmpSyscall = SYS_FUTEX
-	SNR_SET_ROBUST_LIST         ScmpSyscall = SYS_SET_ROBUST_LIST
-	SNR_GET_ROBUST_LIST         ScmpSyscall = SYS_GET_ROBUST_LIST
-	SNR_NANOSLEEP               ScmpSyscall = SYS_NANOSLEEP
-	SNR_GETITIMER               ScmpSyscall = SYS_GETITIMER
-	SNR_SETITIMER               ScmpSyscall = SYS_SETITIMER
-	SNR_KEXEC_LOAD              ScmpSyscall = SYS_KEXEC_LOAD
-	SNR_INIT_MODULE             ScmpSyscall = SYS_INIT_MODULE
-	SNR_DELETE_MODULE           ScmpSyscall = SYS_DELETE_MODULE
-	SNR_TIMER_CREATE            ScmpSyscall = SYS_TIMER_CREATE
-	SNR_TIMER_GETTIME           ScmpSyscall = SYS_TIMER_GETTIME
-	SNR_TIMER_GETOVERRUN        ScmpSyscall = SYS_TIMER_GETOVERRUN
-	SNR_TIMER_SETTIME           ScmpSyscall = SYS_TIMER_SETTIME
-	SNR_TIMER_DELETE            ScmpSyscall = SYS_TIMER_DELETE
-	SNR_CLOCK_SETTIME           ScmpSyscall = SYS_CLOCK_SETTIME
-	SNR_CLOCK_GETTIME           ScmpSyscall = SYS_CLOCK_GETTIME
-	SNR_CLOCK_GETRES            ScmpSyscall = SYS_CLOCK_GETRES
-	SNR_CLOCK_NANOSLEEP         ScmpSyscall = SYS_CLOCK_NANOSLEEP
-	SNR_SYSLOG                  ScmpSyscall = SYS_SYSLOG
-	SNR_PTRACE                  ScmpSyscall = SYS_PTRACE
-	SNR_SCHED_SETPARAM          ScmpSyscall = SYS_SCHED_SETPARAM
-	SNR_SCHED_SETSCHEDULER      ScmpSyscall = SYS_SCHED_SETSCHEDULER
-	SNR_SCHED_GETSCHEDULER      ScmpSyscall = SYS_SCHED_GETSCHEDULER
-	SNR_SCHED_GETPARAM          ScmpSyscall = SYS_SCHED_GETPARAM
-	SNR_SCHED_SETAFFINITY       ScmpSyscall = SYS_SCHED_SETAFFINITY
-	SNR_SCHED_GETAFFINITY       ScmpSyscall = SYS_SCHED_GETAFFINITY
-	SNR_SCHED_YIELD             ScmpSyscall = SYS_SCHED_YIELD
-	SNR_SCHED_GET_PRIORITY_MAX  ScmpSyscall = SYS_SCHED_GET_PRIORITY_MAX
-	SNR_SCHED_GET_PRIORITY_MIN  ScmpSyscall = SYS_SCHED_GET_PRIORITY_MIN
-	SNR_SCHED_RR_GET_INTERVAL   ScmpSyscall = SYS_SCHED_RR_GET_INTERVAL
-	SNR_RESTART_SYSCALL         ScmpSyscall = SYS_RESTART_SYSCALL
-	SNR_KILL                    ScmpSyscall = SYS_KILL
-	SNR_TKILL                   ScmpSyscall = SYS_TKILL
-	SNR_TGKILL                  ScmpSyscall = SYS_TGKILL
-	SNR_SIGALTSTACK             ScmpSyscall = SYS_SIGALTSTACK
-	SNR_RT_SIGSUSPEND           ScmpSyscall = SYS_RT_SIGSUSPEND
-	SNR_RT_SIGACTION            ScmpSyscall = SYS_RT_SIGACTION
-	SNR_RT_SIGPROCMASK          ScmpSyscall = SYS_RT_SIGPROCMASK
-	SNR_RT_SIGPENDING           ScmpSyscall = SYS_RT_SIGPENDING
-	SNR_RT_SIGTIMEDWAIT         ScmpSyscall = SYS_RT_SIGTIMEDWAIT
-	SNR_RT_SIGQUEUEINFO         ScmpSyscall = SYS_RT_SIGQUEUEINFO
-	SNR_RT_SIGRETURN            ScmpSyscall = SYS_RT_SIGRETURN
-	SNR_SETPRIORITY             ScmpSyscall = SYS_SETPRIORITY
-	SNR_GETPRIORITY             ScmpSyscall = SYS_GETPRIORITY
-	SNR_REBOOT                  ScmpSyscall = SYS_REBOOT
-	SNR_SETREGID                ScmpSyscall = SYS_SETREGID
-	SNR_SETGID                  ScmpSyscall = SYS_SETGID
-	SNR_SETREUID                ScmpSyscall = SYS_SETREUID
-	SNR_SETUID                  ScmpSyscall = SYS_SETUID
-	SNR_SETRESUID               ScmpSyscall = SYS_SETRESUID
-	SNR_GETRESUID               ScmpSyscall = SYS_GETRESUID
-	SNR_SETRESGID               ScmpSyscall = SYS_SETRESGID
-	SNR_GETRESGID               ScmpSyscall = SYS_GETRESGID
-	SNR_SETFSUID                ScmpSyscall = SYS_SETFSUID
-	SNR_SETFSGID                ScmpSyscall = SYS_SETFSGID
-	SNR_TIMES                   ScmpSyscall = SYS_TIMES
-	SNR_SETPGID                 ScmpSyscall = SYS_SETPGID
-	SNR_GETPGID                 ScmpSyscall = SYS_GETPGID
-	SNR_GETSID                  ScmpSyscall = SYS_GETSID
-	SNR_SETSID                  ScmpSyscall = SYS_SETSID
-	SNR_GETGROUPS               ScmpSyscall = SYS_GETGROUPS
-	SNR_SETGROUPS               ScmpSyscall = SYS_SETGROUPS
-	SNR_UNAME                   ScmpSyscall = SYS_UNAME
-	SNR_SETHOSTNAME             ScmpSyscall = SYS_SETHOSTNAME
-	SNR_SETDOMAINNAME           ScmpSyscall = SYS_SETDOMAINNAME
-	SNR_GETRLIMIT               ScmpSyscall = SYS_GETRLIMIT
-	SNR_SETRLIMIT               ScmpSyscall = SYS_SETRLIMIT
-	SNR_GETRUSAGE               ScmpSyscall = SYS_GETRUSAGE
-	SNR_UMASK                   ScmpSyscall = SYS_UMASK
-	SNR_PRCTL                   ScmpSyscall = SYS_PRCTL
-	SNR_GETCPU                  ScmpSyscall = SYS_GETCPU
-	SNR_GETTIMEOFDAY            ScmpSyscall = SYS_GETTIMEOFDAY
-	SNR_SETTIMEOFDAY            ScmpSyscall = SYS_SETTIMEOFDAY
-	SNR_ADJTIMEX                ScmpSyscall = SYS_ADJTIMEX
-	SNR_GETPID                  ScmpSyscall = SYS_GETPID
-	SNR_GETPPID                 ScmpSyscall = SYS_GETPPID
-	SNR_GETUID                  ScmpSyscall = SYS_GETUID
-	SNR_GETEUID                 ScmpSyscall = SYS_GETEUID
-	SNR_GETGID                  ScmpSyscall = SYS_GETGID
-	SNR_GETEGID                 ScmpSyscall = SYS_GETEGID
-	SNR_GETTID                  ScmpSyscall = SYS_GETTID
-	SNR_SYSINFO                 ScmpSyscall = SYS_SYSINFO
-	SNR_MQ_OPEN                 ScmpSyscall = SYS_MQ_OPEN
-	SNR_MQ_UNLINK               ScmpSyscall = SYS_MQ_UNLINK
-	SNR_MQ_TIMEDSEND            ScmpSyscall = SYS_MQ_TIMEDSEND
-	SNR_MQ_TIMEDRECEIVE         ScmpSyscall = SYS_MQ_TIMEDRECEIVE
-	SNR_MQ_NOTIFY               ScmpSyscall = SYS_MQ_NOTIFY
-	SNR_MQ_GETSETATTR           ScmpSyscall = SYS_MQ_GETSETATTR
-	SNR_MSGGET                  ScmpSyscall = SYS_MSGGET
-	SNR_MSGCTL                  ScmpSyscall = SYS_MSGCTL
-	SNR_MSGRCV                  ScmpSyscall = SYS_MSGRCV
-	SNR_MSGSND                  ScmpSyscall = SYS_MSGSND
-	SNR_SEMGET                  ScmpSyscall = SYS_SEMGET
-	SNR_SEMCTL                  ScmpSyscall = SYS_SEMCTL
-	SNR_SEMTIMEDOP              ScmpSyscall = SYS_SEMTIMEDOP
-	SNR_SEMOP                   ScmpSyscall = SYS_SEMOP
-	SNR_SHMGET                  ScmpSyscall = SYS_SHMGET
-	SNR_SHMCTL                  ScmpSyscall = SYS_SHMCTL
-	SNR_SHMAT                   ScmpSyscall = SYS_SHMAT
-	SNR_SHMDT                   ScmpSyscall = SYS_SHMDT
-	SNR_SOCKET                  ScmpSyscall = SYS_SOCKET
-	SNR_SOCKETPAIR              ScmpSyscall = SYS_SOCKETPAIR
-	SNR_BIND                    ScmpSyscall = SYS_BIND
-	SNR_LISTEN                  ScmpSyscall = SYS_LISTEN
-	SNR_ACCEPT                  ScmpSyscall = SYS_ACCEPT
-	SNR_CONNECT                 ScmpSyscall = SYS_CONNECT
-	SNR_GETSOCKNAME             ScmpSyscall = SYS_GETSOCKNAME
-	SNR_GETPEERNAME             ScmpSyscall = SYS_GETPEERNAME
-	SNR_SENDTO                  ScmpSyscall = SYS_SENDTO
-	SNR_RECVFROM                ScmpSyscall = SYS_RECVFROM
-	SNR_SETSOCKOPT              ScmpSyscall = SYS_SETSOCKOPT
-	SNR_GETSOCKOPT              ScmpSyscall = SYS_GETSOCKOPT
-	SNR_SHUTDOWN                ScmpSyscall = SYS_SHUTDOWN
-	SNR_SENDMSG                 ScmpSyscall = SYS_SENDMSG
-	SNR_RECVMSG                 ScmpSyscall = SYS_RECVMSG
-	SNR_READAHEAD               ScmpSyscall = SYS_READAHEAD
-	SNR_BRK                     ScmpSyscall = SYS_BRK
-	SNR_MUNMAP                  ScmpSyscall = SYS_MUNMAP
-	SNR_MREMAP                  ScmpSyscall = SYS_MREMAP
-	SNR_ADD_KEY                 ScmpSyscall = SYS_ADD_KEY
-	SNR_REQUEST_KEY             ScmpSyscall = SYS_REQUEST_KEY
-	SNR_KEYCTL                  ScmpSyscall = SYS_KEYCTL
-	SNR_CLONE                   ScmpSyscall = SYS_CLONE
-	SNR_EXECVE                  ScmpSyscall = SYS_EXECVE
-	SNR_MMAP                    ScmpSyscall = SYS_MMAP
-	SNR_FADVISE64               ScmpSyscall = SYS_FADVISE64
-	SNR_SWAPON                  ScmpSyscall = SYS_SWAPON
-	SNR_SWAPOFF                 ScmpSyscall = SYS_SWAPOFF
-	SNR_MPROTECT                ScmpSyscall = SYS_MPROTECT
-	SNR_MSYNC                   ScmpSyscall = SYS_MSYNC
-	SNR_MLOCK                   ScmpSyscall = SYS_MLOCK
-	SNR_MUNLOCK                 ScmpSyscall = SYS_MUNLOCK
-	SNR_MLOCKALL                ScmpSyscall = SYS_MLOCKALL
-	SNR_MUNLOCKALL              ScmpSyscall = SYS_MUNLOCKALL
-	SNR_MINCORE                 ScmpSyscall = SYS_MINCORE
-	SNR_MADVISE                 ScmpSyscall = SYS_MADVISE
-	SNR_REMAP_FILE_PAGES        ScmpSyscall = SYS_REMAP_FILE_PAGES
-	SNR_MBIND                   ScmpSyscall = SYS_MBIND
-	SNR_GET_MEMPOLICY           ScmpSyscall = SYS_GET_MEMPOLICY
-	SNR_SET_MEMPOLICY           ScmpSyscall = SYS_SET_MEMPOLICY
-	SNR_MIGRATE_PAGES           ScmpSyscall = SYS_MIGRATE_PAGES
-	SNR_MOVE_PAGES              ScmpSyscall = SYS_MOVE_PAGES
-	SNR_RT_TGSIGQUEUEINFO       ScmpSyscall = SYS_RT_TGSIGQUEUEINFO
-	SNR_PERF_EVENT_OPEN         ScmpSyscall = SYS_PERF_EVENT_OPEN
-	SNR_ACCEPT4                 ScmpSyscall = SYS_ACCEPT4
-	SNR_RECVMMSG                ScmpSyscall = SYS_RECVMMSG
-	SNR_WAIT4                   ScmpSyscall = SYS_WAIT4
-	SNR_PRLIMIT64               ScmpSyscall = SYS_PRLIMIT64
-	SNR_FANOTIFY_INIT           ScmpSyscall = SYS_FANOTIFY_INIT
-	SNR_FANOTIFY_MARK           ScmpSyscall = SYS_FANOTIFY_MARK
-	SNR_NAME_TO_HANDLE_AT       ScmpSyscall = SYS_NAME_TO_HANDLE_AT
-	SNR_OPEN_BY_HANDLE_AT       ScmpSyscall = SYS_OPEN_BY_HANDLE_AT
-	SNR_CLOCK_ADJTIME           ScmpSyscall = SYS_CLOCK_ADJTIME
-	SNR_SYNCFS                  ScmpSyscall = SYS_SYNCFS
-	SNR_SETNS                   ScmpSyscall = SYS_SETNS
-	SNR_SENDMMSG                ScmpSyscall = SYS_SENDMMSG
-	SNR_PROCESS_VM_READV        ScmpSyscall = SYS_PROCESS_VM_READV
-	SNR_PROCESS_VM_WRITEV       ScmpSyscall = SYS_PROCESS_VM_WRITEV
-	SNR_KCMP                    ScmpSyscall = SYS_KCMP
-	SNR_FINIT_MODULE            ScmpSyscall = SYS_FINIT_MODULE
-	SNR_SCHED_SETATTR           ScmpSyscall = SYS_SCHED_SETATTR
-	SNR_SCHED_GETATTR           ScmpSyscall = SYS_SCHED_GETATTR
-	SNR_RENAMEAT2               ScmpSyscall = SYS_RENAMEAT2
-	SNR_SECCOMP                 ScmpSyscall = SYS_SECCOMP
-	SNR_GETRANDOM               ScmpSyscall = SYS_GETRANDOM
-	SNR_MEMFD_CREATE            ScmpSyscall = SYS_MEMFD_CREATE
-	SNR_BPF                     ScmpSyscall = SYS_BPF
-	SNR_EXECVEAT                ScmpSyscall = SYS_EXECVEAT
-	SNR_USERFAULTFD             ScmpSyscall = SYS_USERFAULTFD
-	SNR_MEMBARRIER              ScmpSyscall = SYS_MEMBARRIER
-	SNR_MLOCK2                  ScmpSyscall = SYS_MLOCK2
-	SNR_COPY_FILE_RANGE         ScmpSyscall = SYS_COPY_FILE_RANGE
-	SNR_PREADV2                 ScmpSyscall = SYS_PREADV2
-	SNR_PWRITEV2                ScmpSyscall = SYS_PWRITEV2
-	SNR_PKEY_MPROTECT           ScmpSyscall = SYS_PKEY_MPROTECT
-	SNR_PKEY_ALLOC              ScmpSyscall = SYS_PKEY_ALLOC
-	SNR_PKEY_FREE               ScmpSyscall = SYS_PKEY_FREE
-	SNR_STATX                   ScmpSyscall = SYS_STATX
-	SNR_IO_PGETEVENTS           ScmpSyscall = SYS_IO_PGETEVENTS
-	SNR_RSEQ                    ScmpSyscall = SYS_RSEQ
-	SNR_KEXEC_FILE_LOAD         ScmpSyscall = SYS_KEXEC_FILE_LOAD
-	SNR_PIDFD_SEND_SIGNAL       ScmpSyscall = SYS_PIDFD_SEND_SIGNAL
-	SNR_IO_URING_SETUP          ScmpSyscall = SYS_IO_URING_SETUP
-	SNR_IO_URING_ENTER          ScmpSyscall = SYS_IO_URING_ENTER
-	SNR_IO_URING_REGISTER       ScmpSyscall = SYS_IO_URING_REGISTER
-	SNR_OPEN_TREE               ScmpSyscall = SYS_OPEN_TREE
-	SNR_MOVE_MOUNT              ScmpSyscall = SYS_MOVE_MOUNT
-	SNR_FSOPEN                  ScmpSyscall = SYS_FSOPEN
-	SNR_FSCONFIG                ScmpSyscall = SYS_FSCONFIG
-	SNR_FSMOUNT                 ScmpSyscall = SYS_FSMOUNT
-	SNR_FSPICK                  ScmpSyscall = SYS_FSPICK
-	SNR_PIDFD_OPEN              ScmpSyscall = SYS_PIDFD_OPEN
-	SNR_CLONE3                  ScmpSyscall = SYS_CLONE3
-	SNR_CLOSE_RANGE             ScmpSyscall = SYS_CLOSE_RANGE
-	SNR_OPENAT2                 ScmpSyscall = SYS_OPENAT2
-	SNR_PIDFD_GETFD             ScmpSyscall = SYS_PIDFD_GETFD
-	SNR_FACCESSAT2              ScmpSyscall = SYS_FACCESSAT2
-	SNR_PROCESS_MADVISE         ScmpSyscall = SYS_PROCESS_MADVISE
-	SNR_EPOLL_PWAIT2            ScmpSyscall = SYS_EPOLL_PWAIT2
-	SNR_MOUNT_SETATTR           ScmpSyscall = SYS_MOUNT_SETATTR
-	SNR_QUOTACTL_FD             ScmpSyscall = SYS_QUOTACTL_FD
-	SNR_LANDLOCK_CREATE_RULESET ScmpSyscall = SYS_LANDLOCK_CREATE_RULESET
-	SNR_LANDLOCK_ADD_RULE       ScmpSyscall = SYS_LANDLOCK_ADD_RULE
-	SNR_LANDLOCK_RESTRICT_SELF  ScmpSyscall = SYS_LANDLOCK_RESTRICT_SELF
-	SNR_MEMFD_SECRET            ScmpSyscall = SYS_MEMFD_SECRET
-	SNR_PROCESS_MRELEASE        ScmpSyscall = SYS_PROCESS_MRELEASE
-	SNR_FUTEX_WAITV             ScmpSyscall = SYS_FUTEX_WAITV
-	SNR_SET_MEMPOLICY_HOME_NODE ScmpSyscall = SYS_SET_MEMPOLICY_HOME_NODE
-	SNR_CACHESTAT               ScmpSyscall = SYS_CACHESTAT
-	SNR_FCHMODAT2               ScmpSyscall = SYS_FCHMODAT2
-	SNR_MAP_SHADOW_STACK        ScmpSyscall = SYS_MAP_SHADOW_STACK
-	SNR_FUTEX_WAKE              ScmpSyscall = SYS_FUTEX_WAKE
-	SNR_FUTEX_WAIT              ScmpSyscall = SYS_FUTEX_WAIT
-	SNR_FUTEX_REQUEUE           ScmpSyscall = SYS_FUTEX_REQUEUE
-	SNR_STATMOUNT               ScmpSyscall = SYS_STATMOUNT
-	SNR_LISTMOUNT               ScmpSyscall = SYS_LISTMOUNT
-	SNR_LSM_GET_SELF_ATTR       ScmpSyscall = SYS_LSM_GET_SELF_ATTR
-	SNR_LSM_SET_SELF_ATTR       ScmpSyscall = SYS_LSM_SET_SELF_ATTR
-	SNR_LSM_LIST_MODULES        ScmpSyscall = SYS_LSM_LIST_MODULES
-	SNR_MSEAL                   ScmpSyscall = SYS_MSEAL
-	SNR_SETXATTRAT              ScmpSyscall = SYS_SETXATTRAT
-	SNR_GETXATTRAT              ScmpSyscall = SYS_GETXATTRAT
-	SNR_LISTXATTRAT             ScmpSyscall = SYS_LISTXATTRAT
-	SNR_REMOVEXATTRAT           ScmpSyscall = SYS_REMOVEXATTRAT
-	SNR_OPEN_TREE_ATTR          ScmpSyscall = SYS_OPEN_TREE_ATTR
-	SNR_FILE_GETATTR            ScmpSyscall = SYS_FILE_GETATTR
-	SNR_FILE_SETATTR            ScmpSyscall = SYS_FILE_SETATTR
-)
--- a/internal/pkg/asm.go
+++ b/internal/pkg/asm.go
@@ -0,0 +1,216 @@
+package pkg
+
+import (
+	"encoding/binary"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+)
+
+type asmOutLine struct {
+	pos       int
+	word      int
+	kindData  int64
+	valueData []byte
+	indent    int
+	kind      string
+	value     string
+}
+
+var spacingLine = asmOutLine{
+	pos:       -1,
+	kindData:  -1,
+	valueData: nil,
+	indent:    0,
+	kind:      "",
+	value:     "",
+}
+
+func Disassemble(r io.Reader, real bool, showHeader bool, force bool, raw bool) (s string, err error) {
+	var lines []asmOutLine
+	sb := new(strings.Builder)
+	header := true
+	pos := new(int)
+
+	for err == nil {
+		if header {
+			var kind uint64
+			var size uint64
+			var bsize []byte
+			p := *pos
+			if _, kind, err = nextUint64(r, pos); err != nil {
+				break
+			}
+			if bsize, size, err = nextUint64(r, pos); err != nil {
+				break
+			}
+			if showHeader {
+				lines = append(lines, asmOutLine{p, 8, int64(kind), bsize, 0, "head  " + intToKind(kind), ""})
+			}
+			for i := 0; uint64(i) < size; i++ {
+				var did Checksum
+				var dkind uint64
+				p := *pos
+				if _, dkind, err = nextUint64(r, pos); err != nil {
+					break
+				}
+				if _, did, err = nextIdent(r, pos); err != nil {
+					break
+				}
+				if showHeader {
+					lines = append(lines, asmOutLine{p, 8, int64(dkind), nil, 1, intToKind(dkind), Encode(did)})
+				}
+			}
+			header = false
+		}
+		var k uint32
+		p := *pos
+		if _, k, err = nextUint32(r, pos); err != nil {
+			break
+		}
+		kind := IRValueKind(k)
+		switch kind {
+		case IRKindEnd:
+			var a uint32
+			var ba []byte
+			if ba, a, err = nextUint32(r, pos); err != nil {
+				break
+			}
+			if a&1 != 0 {
+				var sum Checksum
+				if _, sum, err = nextIdent(r, pos); err != nil {
+					break
+				}
+				lines = append(lines, asmOutLine{p, 4, int64(kind), ba, 1, "end ", Encode(sum)})
+			} else {
+				lines = append(lines, asmOutLine{p, 4, int64(kind), []byte{0, 0, 0, 0}, 1, "end ", ""})
+			}
+			lines = append(lines, spacingLine)
+			header = true
+			continue
+
+		case IRKindIdent:
+			var a []byte
+			// discard ancillary
+			if a, _, err = nextUint32(r, pos); err != nil {
+				break
+			}
+			var sum Checksum
+			if _, sum, err = nextIdent(r, pos); err != nil {
+				break
+			}
+
+			lines = append(lines, asmOutLine{p, 4, int64(kind), a, 1, "id  ", Encode(sum)})
+			continue
+		case IRKindUint32:
+			var i uint32
+			var bi []byte
+			if bi, i, err = nextUint32(r, pos); err != nil {
+				break
+			}
+			lines = append(lines, asmOutLine{p, 4, int64(kind), bi, 1, "int ", strconv.FormatUint(uint64(i), 10)})
+		case IRKindString:
+			var l uint32
+			var bl []byte
+			if bl, l, err = nextUint32(r, pos); err != nil {
+				break
+			}
+			s := make([]byte, l+(wordSize-(l)%wordSize)%wordSize)
+			var n int
+			if n, err = r.Read(s); err != nil {
+				break
+			}
+			*pos = *pos + n
+
+			lines = append(lines, asmOutLine{p, 4, int64(kind), bl, 1, "str ", strconv.Quote(string(s[:l]))})
+			continue
+		default:
+			var bi []byte
+			if bi, _, err = nextUint32(r, pos); err != nil {
+				break
+			}
+			lines = append(lines, asmOutLine{p, 4, int64(kind), bi, 1, "????", ""})
+		}
+	}
+	if err != io.EOF {
+		return
+	}
+	err = nil
+	for _, line := range lines {
+		if raw {
+			if line.pos != -1 {
+				sb.WriteString(fmt.Sprintf("%s\t%s\n", line.kind, line.value))
+			}
+		} else {
+			if line.pos == -1 {
+				sb.WriteString("\n")
+			} else if line.word == 4 {
+				sb.WriteString(fmt.Sprintf("%06x:  %04x %04x%s          %s  %s\n", line.pos, binary.LittleEndian.AppendUint32(nil, uint32(line.kindData)), line.valueData, headerSpacing(showHeader), line.kind, line.value))
+			} else {
+				kind := binary.LittleEndian.AppendUint64(nil, uint64(line.kindData))
+				value := line.valueData
+				if len(value) == 8 {
+					sb.WriteString(fmt.Sprintf("%06x:  %04x %04x %04x %04x      %s  %s\n", line.pos, kind[:4], kind[4:], value[:4], value[4:], line.kind, line.value))
+				} else {
+					sb.WriteString(fmt.Sprintf("%06x:  %04x %04x                        %s  %s\n", line.pos, kind[:4], kind[4:], line.kind, line.value))
+				}
+
+			}
+		}
+
+	}
+	return sb.String(), err
+}
+func nextUint32(r io.Reader, pos *int) ([]byte, uint32, error) {
+	i := make([]byte, 4)
+	_, err := r.Read(i)
+	if err != nil {
+		return i, 0, err
+	}
+	p := *pos + 4
+	*pos = p
+	return i, binary.LittleEndian.Uint32(i), nil
+}
+func nextUint64(r io.Reader, pos *int) ([]byte, uint64, error) {
+	i := make([]byte, 8)
+	_, err := r.Read(i)
+	if err != nil {
+		return i, 0, err
+	}
+	p := *pos + 8
+	*pos = p
+	return i, binary.LittleEndian.Uint64(i), nil
+}
+func nextIdent(r io.Reader, pos *int) ([]byte, Checksum, error) {
+	i := make([]byte, 48)
+	if _, err := r.Read(i); err != nil {
+		return i, Checksum{}, err
+	}
+	p := *pos + 48
+	*pos = p
+	return i, Checksum(i), nil
+}
+func intToKind(i uint64) string {
+	switch Kind(i) {
+	case KindHTTPGet:
+		return "http"
+	case KindTar:
+		return "tar "
+	case KindExec:
+		return "exec"
+	case KindExecNet:
+		return "exen"
+	case KindFile:
+		return "file"
+	default:
+		return fmt.Sprintf("$%d  ", i-KindCustomOffset)
+	}
+}
+func headerSpacing(showHeader bool) string {
+	if showHeader {
+		return "              "
+	}
+
+	return ""
+}
--- a/internal/pkg/pkg.go
+++ b/internal/pkg/pkg.go
@@ -466,7 +466,7 @@ type Cache struct {
 	// Synchronises entry into exclusive artifacts for the cure method.
 	exclMu sync.Mutex
 	// Buffered I/O free list, must not be accessed directly.
-	brPool, bwPool sync.Pool
+	bufioPool sync.Pool

 	// Unlocks the on-filesystem cache. Must only be called from Close.
 	unlock func()
@@ -548,26 +548,6 @@ func (c *Cache) unsafeIdent(a Artifact, encodeKind bool) (
 	return
 }

-// getReader is like [bufio.NewReader] but for brPool.
-func (c *Cache) getReader(r io.Reader) *bufio.Reader {
-	br := c.brPool.Get().(*bufio.Reader)
-	br.Reset(r)
-	return br
-}
-
-// putReader adds br to brPool.
-func (c *Cache) putReader(br *bufio.Reader) { c.brPool.Put(br) }
-
-// getWriter is like [bufio.NewWriter] but for bwPool.
-func (c *Cache) getWriter(w io.Writer) *bufio.Writer {
-	bw := c.bwPool.Get().(*bufio.Writer)
-	bw.Reset(w)
-	return bw
-}
-
-// putWriter adds bw to bwPool.
-func (c *Cache) putWriter(bw *bufio.Writer) { c.bwPool.Put(bw) }
-
 // A ChecksumMismatchError describes an [Artifact] with unexpected content.
 type ChecksumMismatchError struct {
 	// Actual and expected checksums.
@@ -947,10 +927,10 @@ func (c *Cache) openFile(f FileArtifact) (r io.ReadCloser, err error) {
 		}
 		if c.msg.IsVerbose() {
 			rn := reportName(f, c.Ident(f))
-			c.msg.Verbosef("curing %s in memory...", rn)
+			c.msg.Verbosef("curing %s to memory...", rn)
 			defer func() {
 				if err == nil {
-					c.msg.Verbosef("opened %s for reading", rn)
+					c.msg.Verbosef("cured %s to memory", rn)
 				}
 			}()
 		}
@@ -1151,9 +1131,6 @@ type DependencyCureError []*CureError
 // unwrapM recursively expands underlying errors into a caller-supplied map.
 func (e *DependencyCureError) unwrapM(me map[unique.Handle[ID]]*CureError) {
 	for _, err := range *e {
-		if _, ok := me[err.Ident]; ok {
-			continue
-		}
 		if _e, ok := err.Err.(*DependencyCureError); ok {
 			_e.unwrapM(me)
 			continue
@@ -1237,6 +1214,13 @@ func (c *Cache) exitCure(a Artifact, curesExempt bool) {
 	<-c.cures
 }

+// getWriter is like [bufio.NewWriter] but for bufioPool.
+func (c *Cache) getWriter(w io.Writer) *bufio.Writer {
+	bw := c.bufioPool.Get().(*bufio.Writer)
+	bw.Reset(w)
+	return bw
+}
+
 // measuredReader implements [io.ReadCloser] and measures the checksum during
 // Close. If the underlying reader is not read to EOF, Close blocks until all
 // remaining data is consumed and validated.
@@ -1319,6 +1303,9 @@ func (r *RContext) NewMeasuredReader(
 	return r.cache.newMeasuredReader(rc, checksum)
 }

+// putWriter adds bw to bufioPool.
+func (c *Cache) putWriter(bw *bufio.Writer) { c.bufioPool.Put(bw) }
+
 // cure implements Cure without checking the full dependency graph.
 func (c *Cache) cure(a Artifact, curesExempt bool) (
 	pathname *check.Absolute,
@@ -1726,16 +1713,13 @@ func open(
 		msg:  msg,
 		base: base,

-		identPool: sync.Pool{New: func() any { return new(extIdent) }},
-
 		ident:        make(map[unique.Handle[ID]]unique.Handle[Checksum]),
 		identErr:     make(map[unique.Handle[ID]]error),
 		identPending: make(map[unique.Handle[ID]]<-chan struct{}),
-
-		brPool: sync.Pool{New: func() any { return new(bufio.Reader) }},
-		bwPool: sync.Pool{New: func() any { return new(bufio.Writer) }},
 	}
 	c.ctx, c.cancel = context.WithCancel(ctx)
+	c.identPool.New = func() any { return new(extIdent) }
+	c.bufioPool.New = func() any { return new(bufio.Writer) }

 	if lock || !testing.Testing() {
 		if unlock, err := lockedfile.MutexAt(
--- a/internal/pkg/tar.go
+++ b/internal/pkg/tar.go
@@ -10,7 +10,8 @@ import (
 	"io/fs"
 	"net/http"
 	"os"
-	"path"
+
+	"hakurei.app/container/check"
 )

 const (
@@ -99,6 +100,7 @@ func (e DisallowedTypeflagError) Error() string {

 // Cure cures the [Artifact], producing a directory located at work.
 func (a *tarArtifact) Cure(t *TContext) (err error) {
+	temp := t.GetTempDir()
 	var tr io.ReadCloser
 	if tr, err = t.Open(a.f); err != nil {
 		return
@@ -114,9 +116,7 @@ func (a *tarArtifact) Cure(t *TContext) (err error) {
 			err = closeErr
 		}
 	}(tr)
-	br := t.cache.getReader(tr)
-	defer t.cache.putReader(br)
-	tr = io.NopCloser(br)
+	tr = io.NopCloser(tr)

 	switch a.compression {
 	case TarUncompressed:
@@ -137,24 +137,14 @@ func (a *tarArtifact) Cure(t *TContext) (err error) {
 	}

 	type dirTargetPerm struct {
-		path string
+		path *check.Absolute
 		mode fs.FileMode
 	}
 	var madeDirectories []dirTargetPerm

-	if err = os.MkdirAll(t.GetTempDir().String(), 0700); err != nil {
+	if err = os.MkdirAll(temp.String(), 0700); err != nil {
 		return
 	}
-	var root *os.Root
-	if root, err = os.OpenRoot(t.GetTempDir().String()); err != nil {
-		return
-	}
-	defer func() {
-		closeErr := root.Close()
-		if err == nil {
-			err = closeErr
-		}
-	}()

 	var header *tar.Header
 	r := tar.NewReader(tr)
@@ -168,8 +158,9 @@ func (a *tarArtifact) Cure(t *TContext) (err error) {
 			}
 		}

+		pathname := temp.Append(header.Name)
 		if typeflag >= '0' && typeflag <= '9' && typeflag != tar.TypeDir {
-			if err = root.MkdirAll(path.Dir(header.Name), 0700); err != nil {
+			if err = os.MkdirAll(pathname.Dir().String(), 0700); err != nil {
 				return
 			}
 		}
@@ -177,8 +168,8 @@ func (a *tarArtifact) Cure(t *TContext) (err error) {
 		switch typeflag {
 		case tar.TypeReg:
 			var f *os.File
-			if f, err = root.OpenFile(
-				header.Name,
+			if f, err = os.OpenFile(
+				pathname.String(),
 				os.O_CREATE|os.O_EXCL|os.O_WRONLY,
 				header.FileInfo().Mode()&0500,
 			); err != nil {
@@ -193,29 +184,26 @@ func (a *tarArtifact) Cure(t *TContext) (err error) {
 			break

 		case tar.TypeLink:
-			if err = root.Link(
-				header.Linkname,
-				header.Name,
+			if err = os.Link(
+				temp.Append(header.Linkname).String(),
+				pathname.String(),
 			); err != nil {
 				return
 			}
 			break

 		case tar.TypeSymlink:
-			if err = root.Symlink(
-				header.Linkname,
-				header.Name,
-			); err != nil {
+			if err = os.Symlink(header.Linkname, pathname.String()); err != nil {
 				return
 			}
 			break

 		case tar.TypeDir:
 			madeDirectories = append(madeDirectories, dirTargetPerm{
-				path: header.Name,
+				path: pathname,
 				mode: header.FileInfo().Mode(),
 			})
-			if err = root.MkdirAll(header.Name, 0700); err != nil {
+			if err = os.MkdirAll(pathname.String(), 0700); err != nil {
 				return
 			}
 			break
@@ -232,7 +220,7 @@ func (a *tarArtifact) Cure(t *TContext) (err error) {
 	}
 	if err == nil {
 		for _, e := range madeDirectories {
-			if err = root.Chmod(e.path, e.mode&0500); err != nil {
+			if err = os.Chmod(e.path.String(), e.mode&0500); err != nil {
 				return
 			}
 		}
@@ -240,7 +228,6 @@ func (a *tarArtifact) Cure(t *TContext) (err error) {
 		return
 	}

-	temp := t.GetTempDir()
 	if err = os.Chmod(temp.String(), 0700); err != nil {
 		return
 	}
--- a/internal/rosa/all.go
+++ b/internal/rosa/all.go
@@ -16,7 +16,6 @@ const (
 	Automake
 	Bash
 	Binutils
-	Bzip2
 	CMake
 	Coreutils
 	Curl
@@ -83,10 +82,6 @@ const (
 	// stages only. This preset and its direct output must never be exposed.
 	gcc

-	// Stage0 is a tarball containing all compile-time dependencies of artifacts
-	// part of the [Std] toolchain.
-	Stage0
-
 	// _presetEnd is the total number of presets and does not denote a preset.
 	_presetEnd
 )
@@ -118,7 +113,6 @@ func ResolveName(name string) (p PArtifact, ok bool) {
 		"automake":          Automake,
 		"bash":              Bash,
 		"binutils":          Binutils,
-		"bzip2":             Bzip2,
 		"cmake":             CMake,
 		"coreutils":         Coreutils,
 		"curl":              Curl,
--- a/internal/rosa/bzip2.go
+++ b/internal/rosa/bzip2.go
@@ -1,22 +0,0 @@
-package rosa
-
-import "hakurei.app/internal/pkg"
-
-func (t Toolchain) newBzip2() pkg.Artifact {
-	const (
-		version  = "1.0.8"
-		checksum = "cTLykcco7boom-s05H1JVsQi1AtChYL84nXkg_92Dm1Xt94Ob_qlMg_-NSguIK-c"
-	)
-	return t.New("bzip2-"+version, 0, []pkg.Artifact{
-		t.Load(Make),
-	}, nil, nil, `
-cd /usr/src/bzip2
-make CC=cc
-make PREFIX=/work/system install
-`, pkg.Path(AbsUsrSrc.Append("bzip2"), true, pkg.NewHTTPGetTar(
-		nil, "https://sourceware.org/pub/bzip2/bzip2-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
-	)))
-}
-func init() { artifactsF[Bzip2] = Toolchain.newBzip2 }
--- a/internal/rosa/cmake.go
+++ b/internal/rosa/cmake.go
@@ -97,7 +97,7 @@ func (t Toolchain) NewViaCMake(
 	}

 	sourcePath := AbsUsrSrc.Append(name)
-	return t.New(name+"-"+variant+"-"+version, attr.Flag, stage0Concat(t, extra,
+	return t.New(name+"-"+variant+"-"+version, attr.Flag, stage3Concat(t, extra,
 		t.Load(CMake),
 		t.Load(Ninja),
 	), nil, slices.Concat([]string{
--- a/internal/rosa/hakurei.go
+++ b/internal/rosa/hakurei.go
@@ -6,8 +6,8 @@ import (

 func (t Toolchain) newHakurei(suffix, script string) pkg.Artifact {
 	const (
-		version  = "0.3.5"
-		checksum = "6Tn38NLezRD2d3aGdFg5qFfqn8_KvC6HwMKwJMPvaHmVw8xRgxn8B0PObswl2mOk"
+		version  = "0.3.4"
+		checksum = "wVwSLo75a2OnH5tgxNWXR_YhiOJUFnYM_9-sJtxAEOKhcPE0BJafs6PU8o5JzyCT"
 	)
 	return t.New("hakurei"+suffix+"-"+version, 0, []pkg.Artifact{
 		t.Load(Go),
@@ -44,12 +44,213 @@ chmod -R +w /usr/src/hakurei
 cd /usr/src/hakurei

 HAKUREI_VERSION='v`+version+`'
-`+script, pkg.Path(AbsUsrSrc.Append("hakurei"), true, pkg.NewHTTPGetTar(
+`+script, pkg.Path(AbsUsrSrc.Append("hakurei"), true, t.NewPatchedSource("hakurei", version, pkg.NewHTTPGetTar(
 		nil, "https://git.gensokyo.uk/security/hakurei/archive/"+
 			"v"+version+".tar.gz",
 		mustDecode(checksum),
 		pkg.TarGzip,
-	)), pkg.Path(AbsUsrSrc.Append("hostname", "main.go"), false, pkg.NewFile(
+	), true, [2]string{"dist-00-tests", `From 67e453f5c4de915de23ecbe5980e595758f0f2fb Mon Sep 17 00:00:00 2001
+From: Ophestra <cat@gensokyo.uk>
+Date: Tue, 27 Jan 2026 06:49:48 +0900
+Subject: [PATCH] dist: run tests
+
+This used to be impossible due to nix jank which has been addressed.
+
+Signed-off-by: Ophestra <cat@gensokyo.uk>
+---
+ dist/release.sh          | 21 ++++++++++++++++-----
+ flake.nix                | 32 ++++++++++++++++++++------------
+ internal/acl/acl_test.go |  2 +-
+ package.nix              |  2 +-
+ 4 files changed, 38 insertions(+), 19 deletions(-)
+
+diff --git a/dist/release.sh b/dist/release.sh
+index 4dcb278..0ba9104 100755
+--- a/dist/release.sh
+++ b/dist/release.sh
+@@ -2,19 +2,30 @@
+ cd "$(dirname -- "$0")/.."
+ VERSION="${HAKUREI_VERSION:-untagged}"
+ pname="hakurei-${VERSION}"
+-out="dist/${pname}"
+out="${DESTDIR:-dist}/${pname}"
+ 
+echo '# Preparing distribution files.'
+ mkdir -p "${out}"
+ cp -v "README.md" "dist/hsurc.default" "dist/install.sh" "${out}"
+ cp -rv "dist/comp" "${out}"
+echo
+ 
+echo '# Building hakurei.'
+ go generate ./...
+-go build -trimpath -v -o "${out}/bin/" -ldflags "-s -w -buildid= -extldflags '-static'
+go build -trimpath -v -o "${out}/bin/" -ldflags "-s -w
+  -buildid= -extldflags '-static'
+   -X hakurei.app/internal/info.buildVersion=${VERSION}
+   -X hakurei.app/internal/info.hakureiPath=/usr/bin/hakurei
+   -X hakurei.app/internal/info.hsuPath=/usr/bin/hsu
+   -X main.hakureiPath=/usr/bin/hakurei" ./...
+echo
+ 
+-rm -f "./${out}.tar.gz" && tar -C dist -czf "${out}.tar.gz" "${pname}"
+-rm -rf "./${out}"
+-(cd dist && sha512sum "${pname}.tar.gz" > "${pname}.tar.gz.sha512")
+echo '# Testing hakurei.'
+go test -ldflags='-buildid= -extldflags=-static' ./...
+echo
+
+echo '# Creating distribution.'
+rm -f "${out}.tar.gz" && tar -C "${out}/.." -vczf "${out}.tar.gz" "${pname}"
+rm -rf "${out}"
+(cd "${out}/.." && sha512sum "${pname}.tar.gz" > "${pname}.tar.gz.sha512")
+echo
+diff --git a/flake.nix b/flake.nix
+index 9e09c61..2340b92 100644
+--- a/flake.nix
+++ b/flake.nix
+@@ -143,19 +143,27 @@
+             "bin/mount.fuse.sharefs" = "${hakurei}/libexec/sharefs";
+           };
+ 
+-          dist = pkgs.runCommand "${hakurei.name}-dist" { buildInputs = hakurei.targetPkgs ++ [ pkgs.pkgsStatic.musl ]; } ''
+-            # go requires XDG_CACHE_HOME for the build cache
+-            export XDG_CACHE_HOME="$(mktemp -d)"
+          dist =
+            pkgs.runCommand "${hakurei.name}-dist"
+              {
+                buildInputs = hakurei.targetPkgs ++ [
+                  pkgs.pkgsStatic.musl
+                ];
+              }
+              ''
+                cd $(mktemp -d) \
+                    && cp -r ${hakurei.src}/. . \
+                    && chmod +w cmd && cp -r ${hsu.src}/. cmd/hsu/ \
+                    && chmod -R +w .
+ 
+-            # get a different workdir as go does not like /build
+-            cd $(mktemp -d) \
+-                && cp -r ${hakurei.src}/. . \
+-                && chmod +w cmd && cp -r ${hsu.src}/. cmd/hsu/ \
+-                && chmod -R +w .
+-
+-            export HAKUREI_VERSION="v${hakurei.version}"
+-            CC="clang -O3 -Werror" ./dist/release.sh && mkdir $out && cp -v "dist/hakurei-$HAKUREI_VERSION.tar.gz"* $out
+-          '';
+                CC="musl-clang -O3 -Werror -Qunused-arguments" \
+                GOCACHE="$(mktemp -d)" \
+                HAKUREI_TEST_SKIP_ACL=1 \
+                PATH="${pkgs.pkgsStatic.musl.bin}/bin:$PATH" \
+                DESTDIR="$out" \
+                HAKUREI_VERSION="v${hakurei.version}" \
+                  ./dist/release.sh
+              '';
+         }
+       );
+ 
+diff --git a/internal/acl/acl_test.go b/internal/acl/acl_test.go
+index af6da55..19ce45a 100644
+--- a/internal/acl/acl_test.go
+++ b/internal/acl/acl_test.go
+@@ -24,7 +24,7 @@ var (
+ )
+ 
+ func TestUpdate(t *testing.T) {
+-	if os.Getenv("GO_TEST_SKIP_ACL") == "1" {
+	if os.Getenv("HAKUREI_TEST_SKIP_ACL") == "1" {
+ 		t.Skip("acl test skipped")
+ 	}
+ 
+diff --git a/package.nix b/package.nix
+index 00c4401..2eaa2ec 100644
+--- a/package.nix
+++ b/package.nix
+@@ -89,7 +89,7 @@ buildGoModule rec {
+     CC = "clang -O3 -Werror";
+ 
+     # nix build environment does not allow acls
+-    GO_TEST_SKIP_ACL = 1;
+    HAKUREI_TEST_SKIP_ACL = 1;
+   };
+ 
+   buildInputs = [`}, [2]string{"container-tests", `From bf14a412e47344fff2681f4b24d1ecc7415bfcb0 Mon Sep 17 00:00:00 2001
+From: Ophestra <cat@gensokyo.uk>
+Date: Sat, 31 Jan 2026 10:59:56 +0900
+Subject: [PATCH] container: fix host-dependent test cases
+
+These are not fully controlled by hakurei and may change depending on host configuration.
+
+Signed-off-by: Ophestra <cat@gensokyo.uk>
+---
+ container/container_test.go | 27 +++++++++++++++------------
+ 1 file changed, 15 insertions(+), 12 deletions(-)
+
+diff --git a/container/container_test.go b/container/container_test.go
+index d737a18..98713cb 100644
+--- a/container/container_test.go
+++ b/container/container_test.go
+@@ -275,12 +275,12 @@ var containerTestCases = []struct {
+ 		),
+ 		earlyMnt(
+ 			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore),
+-			ent("/null", "/dev/null", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/zero", "/dev/zero", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/full", "/dev/full", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/random", "/dev/random", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/urandom", "/dev/urandom", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/tty", "/dev/tty", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/null", "/dev/null", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/zero", "/dev/zero", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/full", "/dev/full", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/random", "/dev/random", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/tty", "/dev/tty", ignore, "devtmpfs", "devtmpfs", ignore),
+ 			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
+ 			ent("/", "/dev/mqueue", "rw,nosuid,nodev,noexec,relatime", "mqueue", "mqueue", "rw"),
+ 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
+@@ -293,12 +293,12 @@ var containerTestCases = []struct {
+ 		),
+ 		earlyMnt(
+ 			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore),
+-			ent("/null", "/dev/null", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/zero", "/dev/zero", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/full", "/dev/full", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/random", "/dev/random", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/urandom", "/dev/urandom", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/tty", "/dev/tty", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/null", "/dev/null", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/zero", "/dev/zero", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/full", "/dev/full", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/random", "/dev/random", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/tty", "/dev/tty", ignore, "devtmpfs", "devtmpfs", ignore),
+ 			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
+ 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
+ 		),
+@@ -696,6 +696,9 @@ func init() {
+ 					mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",relatime")
+ 					mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",noatime")
+ 
+					cur.FsOptstr = strings.Replace(cur.FsOptstr, ",seclabel", "", 1)
+					mnt[i].FsOptstr = strings.Replace(mnt[i].FsOptstr, ",seclabel", "", 1)
+
+ 					if !cur.EqualWithIgnore(mnt[i], "\x00") {
+ 						fail = true
+ 						log.Printf("[FAIL] %s", cur)`}, [2]string{"dist-01-tarball-name", `diff --git a/dist/release.sh b/dist/release.sh
+index 0ba9104..2990ee1 100755
+--- a/dist/release.sh
+++ b/dist/release.sh
+@@ -1,7 +1,7 @@
+ #!/bin/sh -e
+ cd "$(dirname -- "$0")/.."
+ VERSION="${HAKUREI_VERSION:-untagged}"
+-pname="hakurei-${VERSION}"
+pname="hakurei-${VERSION}-$(go env GOARCH)"
+ out="${DESTDIR:-dist}/${pname}"
+
+ echo '# Preparing distribution files.'
+`}),
+	), pkg.Path(AbsUsrSrc.Append("hostname", "main.go"), false, pkg.NewFile(
 		"hostname.go",
 		[]byte(`
 package main
--- a/internal/rosa/llvm.go
+++ b/internal/rosa/llvm.go
@@ -160,7 +160,7 @@ ln -s ld.lld /work/system/bin/ld
 			[2]string{"LIBCXX_USE_COMPILER_RT", "ON"},
 		)

-		if t > toolchainStage0 {
+		if t > toolchainStage3 {
 			// libcxxabi fails to compile if c++ headers not prefixed in /usr
 			// is found by the compiler, and doing this is easier than
 			// overriding CXXFLAGS; not using mv here to avoid chown failures
@@ -199,7 +199,7 @@ cp -r /system/include /usr/include && rm -rf /system/include

 		Paths: attr.paths,
 		Flag:  TExclusive,
-	}, stage0Concat(t, attr.extra,
+	}, stage3Concat(t, attr.extra,
 		t.Load(Libffi),
 		t.Load(Python),
 		t.Load(Perl),
@@ -233,7 +233,7 @@ func (t Toolchain) newLLVM() (musl, compilerRT, runtimes, clang pkg.Artifact) {
 	}

 	compilerRT = t.newLLVMVariant("compiler-rt", &llvmAttr{
-		env: stage0ExclConcat(t, []string{},
+		env: stage3ExclConcat(t, []string{},
 			"LDFLAGS="+earlyLDFLAGS(false),
 		),
 		cmake: [][2]string{
@@ -276,7 +276,7 @@ ln -s \

 	musl = t.NewMusl(&MuslAttr{
 		Extra: []pkg.Artifact{compilerRT},
-		Env: stage0ExclConcat(t, []string{
+		Env: stage3ExclConcat(t, []string{
 			"CC=clang",
 			"LIBCC=/system/lib/clang/21/lib/" +
 				triplet() + "/libclang_rt.builtins.a",
@@ -288,7 +288,7 @@ ln -s \
 	})

 	runtimes = t.newLLVMVariant("runtimes", &llvmAttr{
-		env: stage0ExclConcat(t, []string{},
+		env: stage3ExclConcat(t, []string{},
 			"LDFLAGS="+earlyLDFLAGS(false),
 		),
 		flags: llvmRuntimeLibunwind | llvmRuntimeLibcxx | llvmRuntimeLibcxxABI,
@@ -308,7 +308,7 @@ ln -s \

 	clang = t.newLLVMVariant("clang", &llvmAttr{
 		flags: llvmProjectClang | llvmProjectLld,
-		env: stage0ExclConcat(t, []string{},
+		env: stage3ExclConcat(t, []string{},
 			"CFLAGS="+earlyCFLAGS,
 			"CXXFLAGS="+earlyCXXFLAGS(),
 			"LDFLAGS="+earlyLDFLAGS(false),
--- a/internal/rosa/make.go
+++ b/internal/rosa/make.go
@@ -36,8 +36,8 @@ type MakeAttr struct {

 	// Do not include default extras.
 	OmitDefaults bool
-	// Dependencies not provided by stage0.
-	NonStage0 []pkg.Artifact
+	// Dependencies not provided by stage3.
+	NonStage3 []pkg.Artifact

 	// Additional environment variables.
 	Env []string
@@ -148,8 +148,8 @@ func (t Toolchain) NewViaMake(
 		panic("cannot remain in root")
 	}

-	return t.New(name+"-"+version, attr.Flag, stage0Concat(t,
-		attr.NonStage0,
+	return t.New(name+"-"+version, attr.Flag, stage3Concat(t,
+		attr.NonStage3,
 		finalExtra...,
 	), nil, attr.Env, scriptEarly+`
 /usr/src/`+name+`/configure \
--- a/internal/rosa/mksh.go
+++ b/internal/rosa/mksh.go
@@ -7,7 +7,7 @@ func (t Toolchain) newMksh() pkg.Artifact {
 		version  = "59c"
 		checksum = "0Zj-k4nXEu3IuJY4lvwD2OrC2t27GdZj8SPy4DoaeuBRH1padWb7oREpYgwY8JNq"
 	)
-	return t.New("mksh-"+version, 0, stage0Concat(t, []pkg.Artifact{},
+	return t.New("mksh-"+version, 0, stage3Concat(t, []pkg.Artifact{},
 		t.Load(Perl),
 		t.Load(Coreutils),
 	), nil, []string{
--- a/internal/rosa/musl.go
+++ b/internal/rosa/musl.go
@@ -42,7 +42,7 @@ rmdir -v /work/lib
 		script = ""
 	}

-	return t.New("musl-"+version, 0, stage0Concat(t, attr.Extra,
+	return t.New("musl-"+version, 0, stage3Concat(t, attr.Extra,
 		t.Load(Make),
 		t.Load(Coreutils),
 	), nil, slices.Concat([]string{
--- a/internal/rosa/perl.go
+++ b/internal/rosa/perl.go
@@ -27,7 +27,7 @@ make \
 	"-j$(nproc)" \
 	TEST_JOBS=256 \
 	test_harness
-./perl -Ilib -I. installperl --destdir=/work
+make DESTDIR=/work install
 `, pkg.Path(AbsUsrSrc.Append("perl"), true, t.NewPatchedSource(
 		"perl", version, pkg.NewHTTPGetTar(
 			nil, "https://www.cpan.org/src/5.0/perl-"+version+".tar.gz",
--- a/internal/rosa/rosa.go
+++ b/internal/rosa/rosa.go
@@ -2,7 +2,6 @@
 package rosa

 import (
-	"errors"
 	"log"
 	"runtime"
 	"slices"
@@ -83,11 +82,11 @@ func earlyLDFLAGS(static bool) string {
 	return s
 }

-// earlyCFLAGS is reference CFLAGS for the stage0 toolchain.
+// earlyCFLAGS is reference CFLAGS for the stage3 toolchain.
 const earlyCFLAGS = "-Qunused-arguments " +
 	"-isystem/system/include"

-// earlyCXXFLAGS returns reference CXXFLAGS for the stage0 toolchain
+// earlyCXXFLAGS returns reference CXXFLAGS for the stage3 toolchain
 // corresponding to [runtime.GOARCH].
 func earlyCXXFLAGS() string {
 	return "--start-no-unused-arguments " +
@@ -102,30 +101,16 @@ func earlyCXXFLAGS() string {
 type Toolchain uintptr

 const (
-	// _toolchainBusybox denotes a busybox installation from the busyboxBin
-	// binary distribution. This is defined as a toolchain to make use of the
-	// toolchain abstractions to preprocess toolchainGentoo and is not a real,
-	// functioning toolchain. It does not contain any compilers.
-	_toolchainBusybox Toolchain = iota
+	// toolchainBusybox denotes a busybox installation from the busyboxBin
+	// binary distribution. This is for decompressing unsupported formats.
+	toolchainBusybox Toolchain = iota

-	// toolchainGentoo denotes the toolchain in a Gentoo stage3 tarball. Special
-	// care must be taken to compile correctly against this toolchain.
-	toolchainGentoo
-
-	// toolchainIntermediateGentoo is like to toolchainIntermediate, but
-	// compiled against toolchainGentoo.
-	toolchainIntermediateGentoo
-
-	// toolchainStdGentoo is like Std, but bootstrapped from toolchainGentoo.
-	// This toolchain creates the first [Stage0] distribution.
-	toolchainStdGentoo
-
-	// toolchainStage0 denotes the stage0 toolchain. Special care must be taken
-	// to compile correctly against this toolchain.
-	toolchainStage0
+	// toolchainStage3 denotes the Gentoo stage3 toolchain. Special care must be
+	// taken to compile correctly against this toolchain.
+	toolchainStage3

 	// toolchainIntermediate denotes the intermediate toolchain compiled against
-	// toolchainStage0. This toolchain should be functionally identical to [Std]
+	// toolchainStage3. This toolchain should be functionally identical to [Std]
 	// and is used to bootstrap [Std].
 	toolchainIntermediate

@@ -137,49 +122,19 @@ const (
 	_toolchainEnd
 )

-// isStage0 returns whether t is a stage0 toolchain.
-func (t Toolchain) isStage0() bool {
-	switch t {
-	case toolchainGentoo, toolchainStage0:
-		return true
-	default:
-		return false
-	}
-}
-
-// isIntermediate returns whether t is an intermediate toolchain.
-func (t Toolchain) isIntermediate() bool {
-	switch t {
-	case toolchainIntermediateGentoo, toolchainIntermediate:
-		return true
-	default:
-		return false
-	}
-}
-
-// isStd returns whether t is considered functionally equivalent to [Std].
-func (t Toolchain) isStd() bool {
-	switch t {
-	case toolchainStdGentoo, Std:
-		return true
-	default:
-		return false
-	}
-}
-
-// stage0Concat concatenates s and values. If the current toolchain is
-// toolchainStage0, stage0Concat returns s as is.
-func stage0Concat[S ~[]E, E any](t Toolchain, s S, values ...E) S {
-	if t.isStage0() {
+// stage3Concat concatenates s and values. If the current toolchain is
+// toolchainStage3, stage3Concat returns s as is.
+func stage3Concat[S ~[]E, E any](t Toolchain, s S, values ...E) S {
+	if t == toolchainStage3 {
 		return s
 	}
 	return slices.Concat(s, values)
 }

-// stage0ExclConcat concatenates s and values. If the current toolchain is not
-// toolchainStage0, stage0ExclConcat returns s as is.
-func stage0ExclConcat[S ~[]E, E any](t Toolchain, s S, values ...E) S {
-	if t.isStage0() {
+// stage3ExclConcat concatenates s and values. If the current toolchain is not
+// toolchainStage3, stage3ExclConcat returns s as is.
+func stage3ExclConcat[S ~[]E, E any](t Toolchain, s S, values ...E) S {
+	if t == toolchainStage3 {
 		return slices.Concat(s, values)
 	}
 	return s
@@ -218,7 +173,7 @@ func fixupEnviron(env, extras []string, paths ...string) []string {

 // absCureScript is the absolute pathname [Toolchain.New] places the fixed-up
 // build script under.
-var absCureScript = AbsSystem.Append("bin", ".cure-script")
+var absCureScript = fhs.AbsUsrBin.Append(".cure-script")

 const (
 	// TExclusive denotes an exclusive [pkg.Artifact].
@@ -227,31 +182,12 @@ const (
 	TEarly
 )

-var (
-	// gentooStage3 is the url of a Gentoo stage3 tarball.
-	gentooStage3 string
-	// gentooStage3Checksum is the expected checksum of gentooStage3.
-	gentooStage3Checksum pkg.Checksum
-)
-
-// SetGentooStage3 sets the Gentoo stage3 tarball url and checksum. It panics
-// if given zero values or if these values have already been set.
-func SetGentooStage3(url string, checksum pkg.Checksum) {
-	if gentooStage3 != "" {
-		panic(errors.New("attempting to set Gentoo stage3 url twice"))
-	}
-	if url == "" {
-		panic(errors.New("attempting to set Gentoo stage3 url to the zero value"))
-	}
-	gentooStage3, gentooStage3Checksum = url, checksum
-}
-
 // New returns a [pkg.Artifact] compiled on this toolchain.
 func (t Toolchain) New(
 	name string,
 	flag int,
 	extra []pkg.Artifact,
-	knownChecksum *pkg.Checksum,
+	checksum *pkg.Checksum,
 	env []string,
 	script string,

@@ -259,47 +195,57 @@ func (t Toolchain) New(
 ) pkg.Artifact {
 	const lcMessages = "LC_MESSAGES=C.UTF-8"

-	var support []pkg.Artifact
+	var (
+		path    = AbsSystem.Append("bin", "sh")
+		args    = []string{"sh", absCureScript.String()}
+		support []pkg.Artifact
+	)
 	switch t {
-	case _toolchainBusybox:
+	case toolchainBusybox:
 		name += "-early"
 		support = slices.Concat([]pkg.Artifact{newBusyboxBin()}, extra)
+		path = AbsSystem.Append("bin", "busybox")
+		args[0] = "hush"
 		env = fixupEnviron(env, nil, "/system/bin")

-	case toolchainGentoo, toolchainStage0:
+	case toolchainStage3:
 		name += "-boot"
-		support = append(support, cureEtc{})
-		if t == toolchainStage0 {
-			support = append(support, NewStage0())
-		} else {
-			support = append(support, _toolchainBusybox.New("gentoo", 0, nil, nil, nil, `
+		var seed string
+		switch runtime.GOARCH {
+		case "amd64":
+			seed = "c5_FwMnRN8RZpTdBLGYkL4RR8ampdaZN2JbkgrFLe8-QHQAVQy08APVvIL6eT7KW"
+		case "arm64":
+			seed = "79uRbRI44PyknQQ9RlFUQrwqplup7vImiIk6klefL8TN-fT42TXMS_v4XszwexCb"
+
+		default:
+			panic("unsupported target " + runtime.GOARCH)
+		}
+		path = fhs.AbsRoot.Append("bin", "bash")
+		args[0] = "bash"
+		support = slices.Concat([]pkg.Artifact{
+			cureEtc{},
+			toolchainBusybox.New("stage3", 0, nil, nil, nil, `
 tar -C /work -xf /usr/src/stage3.tar.xz
 rm -rf /work/dev/ /work/proc/
 ln -vs ../usr/bin /work/bin
-mkdir -vp /work/system/bin
-(cd /work/system/bin && ln -vs \
-	../../bin/sh \
-	../../usr/lib/llvm/*/bin/* \
-	.)
 `, pkg.Path(AbsUsrSrc.Append("stage3.tar.xz"), false,
 				pkg.NewHTTPGet(
-					nil, gentooStage3,
-					gentooStage3Checksum,
+					nil, "https://basement.gensokyo.uk/seed/"+seed,
+					mustDecode(seed),
 				),
-			)))
-		}
-		support = slices.Concat(support, extra)
+			)),
+		}, extra)
 		env = fixupEnviron(env, []string{
 			EnvTriplet + "=" + triplet(),
 			lcMessages,
 			"LDFLAGS=" + earlyLDFLAGS(true),
 		}, "/system/bin",
 			"/usr/bin",
+			"/usr/lib/llvm/21/bin",
 		)

-	case toolchainIntermediateGentoo, toolchainStdGentoo,
-		toolchainIntermediate, Std:
-		if t.isIntermediate() {
+	case toolchainIntermediate, Std:
+		if t < Std {
 			name += "-std"
 		}

@@ -333,10 +279,9 @@ mkdir -vp /work/system/bin
 	}

 	return pkg.NewExec(
-		name, knownChecksum, pkg.ExecTimeoutMax, flag&TExclusive != 0,
+		name, checksum, pkg.ExecTimeoutMax, flag&TExclusive != 0,
 		fhs.AbsRoot, env,
-		AbsSystem.Append("bin", "sh"),
-		[]string{"sh", absCureScript.String()},
+		path, args,

 		slices.Concat([]pkg.ExecPath{pkg.Path(
 			fhs.AbsRoot, true,
@@ -383,7 +328,7 @@ cat /usr/src/` + name + `-patches/* | \
 `
 		aname += "-patched"
 	}
-	return t.New(aname, 0, stage0Concat(t, []pkg.Artifact{},
+	return t.New(aname, 0, stage3Concat(t, []pkg.Artifact{},
 		t.Load(Patch),
 	), nil, nil, script, paths...)
 }
--- a/internal/rosa/stage0.go
+++ b/internal/rosa/stage0.go
@@ -1,75 +0,0 @@
-package rosa
-
-import (
-	"runtime"
-	"sync"
-
-	"hakurei.app/internal/pkg"
-)
-
-func (t Toolchain) newStage0() pkg.Artifact {
-	musl, compilerRT, runtimes, clang := t.NewLLVM()
-	return t.New("rosa-stage0", 0, []pkg.Artifact{
-		musl,
-		compilerRT,
-		runtimes,
-		clang,
-
-		t.Load(Bzip2),
-
-		t.Load(Patch),
-		t.Load(Make),
-		t.Load(CMake),
-		t.Load(Ninja),
-
-		t.Load(Libffi),
-		t.Load(Python),
-		t.Load(Perl),
-		t.Load(Diffutils),
-		t.Load(Bash),
-		t.Load(Gawk),
-		t.Load(Coreutils),
-		t.Load(Findutils),
-
-		t.Load(KernelHeaders),
-	}, nil, nil, `
-umask 377
-tar \
-	-vjc \
-	-C / \
-	-f /work/stage0-`+triplet()+`.tar.bz2 \
-	system bin usr/bin/env
-`)
-}
-func init() { artifactsF[Stage0] = Toolchain.newStage0 }
-
-var (
-	// stage0 stores the tarball unpack artifact.
-	stage0 pkg.Artifact
-	// stage0Once is for lazy initialisation of stage0.
-	stage0Once sync.Once
-)
-
-// NewStage0 returns a stage0 distribution created from curing [Stage0].
-func NewStage0() pkg.Artifact {
-	stage0Once.Do(func() {
-		var seed string
-		switch runtime.GOARCH {
-		case "amd64":
-			seed = "tqM1Li15BJ-uFG8zU-XjgFxoN_kuzh1VxrSDVUVa0vGmo-NeWapSftH739sY8EAg"
-		case "arm64":
-			seed = "CJj3ZSnRyLmFHlWIQtTPQD9oikOZY4cD_mI3v_-LIYc2hhg-cq_CZFBLzQBAkFIn"
-
-		default:
-			panic("unsupported target " + runtime.GOARCH)
-		}
-
-		stage0 = pkg.NewHTTPGetTar(
-			nil, "https://hakurei.app/seed/20260210/"+
-				"stage0-"+triplet()+".tar.bz2",
-			mustDecode(seed),
-			pkg.TarBzip2,
-		)
-	})
-	return stage0
-}
--- a/internal/rosa/toybox.go
+++ b/internal/rosa/toybox.go
@@ -7,18 +7,16 @@ func (t Toolchain) newToybox(suffix, script string) pkg.Artifact {
 		version  = "0.8.13"
 		checksum = "rZ1V1ATDte2WeQZanxLVoiRGdfPXhMlEo5-exX-e-ml8cGn9qOv0ABEUVZpX3wTI"
 	)
-	return t.New("toybox-"+version+suffix, TEarly, stage0Concat(t, []pkg.Artifact{},
+	return t.New("toybox-"+version+suffix, TEarly, stage3Concat(t, []pkg.Artifact{},
 		t.Load(Make),
 		t.Load(Bash),
 		t.Load(Gzip),

 		t.Load(KernelHeaders),
-	), nil, stage0Concat(t, []string{},
+	), nil, stage3Concat(t, []string{},
 		"ROSA_CHECK=make USER=cure tests",
 	), `
-chmod +w /bin/
-ln -rs "$(which bash)" /bin/ || true
-
+ln -s ../system/bin/bash /bin/ || true
 cd /usr/src/toybox
 chmod +w kconfig tests
 rm \
--- a/options.md
+++ b/options.md
@@ -35,7 +35,7 @@ package


 *Default:*
-` <derivation hakurei-static-x86_64-unknown-linux-musl-0.3.5> `
+` <derivation hakurei-static-x86_64-unknown-linux-musl-0.3.4> `



@@ -805,7 +805,7 @@ package


 *Default:*
-` <derivation hakurei-hsu-0.3.5> `
+` <derivation hakurei-hsu-0.3.4> `



--- a/package.nix
+++ b/package.nix
@@ -35,7 +35,7 @@

 buildGoModule rec {
  pname = "hakurei";
-  version = "0.3.5";
+  version = "0.3.4";

  srcFiltered = builtins.path {
    name = "${pname}-src";
Author	SHA1	Message	Date
mae	f3c3fbd0bc	Merge remote-tracking branch 'origin/staging' into staging	2026-02-08 04:13:14 -06:00
mae	c72ec688d9	cmd/irdump: formatted disassembly	2026-02-08 04:12:35 -06:00
mae	cfa5bca32a	cmd/irdump: basic disassembler	2026-02-08 04:12:35 -06:00
mae	03feb85b7f	cmd/irdump: create cli	2026-02-08 04:12:35 -06:00
maemachinebroke	ec6f72ca10	merge upstream	2026-02-08 18:54:45 +09:00
Ophestra	ce881862f0	dist: include target in filename Backport patch will be removed in the next release. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-08 03:54:07 -06:00
Ophestra	f698d6f324	internal/rosa/go: 1.25.6 to 1.25.7 Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-08 03:54:07 -06:00
Ophestra	3040510670	internal/rosa/go: alternative bootstrap path For targets where the bootstrap toolchain is not available. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-08 03:54:03 -06:00
mae	15dadee24a	cmd/irdump: formatted disassembly	2026-02-08 03:09:20 -06:00
mae	58431161b5	cmd/irdump: basic disassembler	2026-02-08 03:09:19 -06:00
mae	c60762fe85	cmd/irdump: create cli	2026-02-07 20:34:23 -06:00
Ophestra	6ee3ed1711	internal/rosa/go: alternative bootstrap path All checks were successful Test / Create distribution (push) Successful in 1m0s Details Test / Sandbox (push) Successful in 2m44s Details Test / ShareFS (push) Successful in 4m13s Details Test / Hpkg (push) Successful in 4m47s Details Test / Sandbox (race detector) (push) Successful in 5m16s Details Test / Hakurei (race detector) (push) Successful in 3m29s Details Test / Hakurei (push) Successful in 2m34s Details Test / Flake checks (push) Successful in 1m40s Details For targets where the bootstrap toolchain is not available. Signed-off-by: Ophestra <cat@gensokyo.uk>	2026-02-08 01:45:21 +09:00