internal/rosa: disable broken tests

These fail when running as users with supplementary groups, since they are unmapped in the container. This was not the case in the development container where all groups were dropped, so the failure was missed.

Signed-off-by: Ophestra <cat@gensokyo.uk>

cmd/mbf/main.go

@@ -146,91 +146,15 @@ func main() {
 			if len(args) != 1 {
 				return errors.New("cure requires 1 argument")
 			}
-			var p rosa.PArtifact
-			switch args[0] {
-			case "acl":
-				p = rosa.ACL
-			case "attr":
-				p = rosa.Attr
-			case "autoconf":
-				p = rosa.Autoconf
-			case "bash":
-				p = rosa.Bash
-			case "busybox":
-				p = rosa.Busybox
-			case "cmake":
-				p = rosa.CMake
-			case "coreutils":
-				p = rosa.Coreutils
-			case "diffutils":
-				p = rosa.Diffutils
-			case "gettext":
-				p = rosa.Gettext
-			case "git":
-				p = rosa.Git
-			case "go":
-				p = rosa.Go
-			case "gperf":
-				p = rosa.Gperf
-			case "hakurei":
-				p = rosa.Hakurei
-			case "kernel-headers":
-				p = rosa.KernelHeaders
-			case "libXau":
-				p = rosa.LibXau
-			case "libexpat":
-				p = rosa.Libexpat
-			case "libseccomp":
-				p = rosa.Libseccomp
-			case "libxml2":
-				p = rosa.Libxml2
-			case "libffi":
-				p = rosa.Libffi
-			case "libgd":
-				p = rosa.Libgd
-			case "m4":
-				p = rosa.M4
-			case "make":
-				p = rosa.Make
-			case "meson":
-				p = rosa.Meson
-			case "ninja":
-				p = rosa.Ninja
-			case "patch":
-				p = rosa.Patch
-			case "perl":
-				p = rosa.Perl
-			case "pkg-config":
-				p = rosa.PkgConfig
-			case "python":
-				p = rosa.Python
-			case "rsync":
-				p = rosa.Rsync
-			case "setuptools":
-				p = rosa.Setuptools
-			case "wayland":
-				p = rosa.Wayland
-			case "wayland-protocols":
-				p = rosa.WaylandProtocols
-			case "xcb":
-				p = rosa.XCB
-			case "xcb-proto":
-				p = rosa.XCBProto
-			case "xproto":
-				p = rosa.Xproto
-			case "zlib":
-				p = rosa.Zlib
-
-			default:
+			if p, ok := rosa.ResolveName(args[0]); !ok {
 				return fmt.Errorf("unsupported artifact %q", args[0])
+			} else {
+				pathname, _, err := cache.Cure(rosa.Std.Load(p))
+				if err == nil {
+					log.Println(pathname)
+				}
+				return err
 			}
-
-			pathname, _, err := cache.Cure(rosa.Std.Load(p))
-			if err == nil {
-				log.Println(pathname)
-			}
-			return err
-
 		},
 	)
 

container/container_test.go

@@ -275,12 +275,12 @@ var containerTestCases = []struct {
 		),
 		earlyMnt(
 			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore),
-			ent("/null", "/dev/null", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/zero", "/dev/zero", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/full", "/dev/full", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/random", "/dev/random", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/urandom", "/dev/urandom", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/tty", "/dev/tty", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/null", "/dev/null", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/zero", "/dev/zero", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/full", "/dev/full", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/random", "/dev/random", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/tty", "/dev/tty", ignore, "devtmpfs", "devtmpfs", ignore),
 			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
 			ent("/", "/dev/mqueue", "rw,nosuid,nodev,noexec,relatime", "mqueue", "mqueue", "rw"),
 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
@@ -293,12 +293,12 @@ var containerTestCases = []struct {
 		),
 		earlyMnt(
 			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore),
-			ent("/null", "/dev/null", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/zero", "/dev/zero", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/full", "/dev/full", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/random", "/dev/random", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/urandom", "/dev/urandom", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-			ent("/tty", "/dev/tty", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/null", "/dev/null", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/zero", "/dev/zero", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/full", "/dev/full", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/random", "/dev/random", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", "devtmpfs", ignore),
+			ent("/tty", "/dev/tty", ignore, "devtmpfs", "devtmpfs", ignore),
 			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
 		),
@@ -696,6 +696,9 @@ func init() {
 					mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",relatime")
 					mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",noatime")
 
+					cur.FsOptstr = strings.Replace(cur.FsOptstr, ",seclabel", "", 1)
+					mnt[i].FsOptstr = strings.Replace(mnt[i].FsOptstr, ",seclabel", "", 1)
+
 					if !cur.EqualWithIgnore(mnt[i], "\x00") {
 						fail = true
 						log.Printf("[FAIL] %s", cur)

dist/release.sh

@@ -2,19 +2,30 @@
 cd "$(dirname -- "$0")/.."
 VERSION="${HAKUREI_VERSION:-untagged}"
 pname="hakurei-${VERSION}"
-out="dist/${pname}"
+out="${DESTDIR:-dist}/${pname}"
 
+echo '# Preparing distribution files.'
 mkdir -p "${out}"
 cp -v "README.md" "dist/hsurc.default" "dist/install.sh" "${out}"
 cp -rv "dist/comp" "${out}"
+echo
 
+echo '# Building hakurei.'
 go generate ./...
-go build -trimpath -v -o "${out}/bin/" -ldflags "-s -w -buildid= -extldflags '-static'
+go build -trimpath -v -o "${out}/bin/" -ldflags "-s -w
+  -buildid= -extldflags '-static'
   -X hakurei.app/internal/info.buildVersion=${VERSION}
   -X hakurei.app/internal/info.hakureiPath=/usr/bin/hakurei
   -X hakurei.app/internal/info.hsuPath=/usr/bin/hsu
   -X main.hakureiPath=/usr/bin/hakurei" ./...
+echo
 
-rm -f "./${out}.tar.gz" && tar -C dist -czf "${out}.tar.gz" "${pname}"
-rm -rf "./${out}"
-(cd dist && sha512sum "${pname}.tar.gz" > "${pname}.tar.gz.sha512")
+echo '# Testing hakurei.'
+go test -ldflags='-buildid= -extldflags=-static' ./...
+echo
+
+echo '# Creating distribution.'
+rm -f "${out}.tar.gz" && tar -C "${out}/.." -vczf "${out}.tar.gz" "${pname}"
+rm -rf "${out}"
+(cd "${out}/.." && sha512sum "${pname}.tar.gz" > "${pname}.tar.gz.sha512")
+echo

flake.nix

@@ -143,19 +143,27 @@
             "bin/mount.fuse.sharefs" = "${hakurei}/libexec/sharefs";
           };
 
-          dist = pkgs.runCommand "${hakurei.name}-dist" { buildInputs = hakurei.targetPkgs ++ [ pkgs.pkgsStatic.musl ]; } ''
-            # go requires XDG_CACHE_HOME for the build cache
-            export XDG_CACHE_HOME="$(mktemp -d)"
+          dist =
+            pkgs.runCommand "${hakurei.name}-dist"
+              {
+                buildInputs = hakurei.targetPkgs ++ [
+                  pkgs.pkgsStatic.musl
+                ];
+              }
+              ''
+                cd $(mktemp -d) \
+                    && cp -r ${hakurei.src}/. . \
+                    && chmod +w cmd && cp -r ${hsu.src}/. cmd/hsu/ \
+                    && chmod -R +w .
 
-            # get a different workdir as go does not like /build
-            cd $(mktemp -d) \
-                && cp -r ${hakurei.src}/. . \
-                && chmod +w cmd && cp -r ${hsu.src}/. cmd/hsu/ \
-                && chmod -R +w .
-
-            export HAKUREI_VERSION="v${hakurei.version}"
-            CC="clang -O3 -Werror" ./dist/release.sh && mkdir $out && cp -v "dist/hakurei-$HAKUREI_VERSION.tar.gz"* $out
-          '';
+                CC="musl-clang -O3 -Werror -Qunused-arguments" \
+                GOCACHE="$(mktemp -d)" \
+                HAKUREI_TEST_SKIP_ACL=1 \
+                PATH="${pkgs.pkgsStatic.musl.bin}/bin:$PATH" \
+                DESTDIR="$out" \
+                HAKUREI_VERSION="v${hakurei.version}" \
+                  ./dist/release.sh
+              '';
         }
       );
 

internal/acl/acl_test.go

@@ -24,7 +24,7 @@ var (
 )
 
 func TestUpdate(t *testing.T) {
-	if os.Getenv("GO_TEST_SKIP_ACL") == "1" {
+	if os.Getenv("HAKUREI_TEST_SKIP_ACL") == "1" {
 		t.Skip("acl test skipped")
 	}
 

internal/pkg/dir_test.go

@@ -76,7 +76,7 @@ func TestFlatten(t *testing.T) {
 			"checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU": {Mode: 0400, Data: []byte("\x7f\xe1\x69\xa2\xdd\x63\x96\x26\x83\x79\x61\x8b\xf0\x3f\xd5\x16\x9a\x39\x3a\xdb\xcf\xb1\xbc\x8d\x33\xff\x75\xee\x62\x56\xa9\xf0\x27\xac\x13\x94\x69")},
 
 			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/NqVORkT6L9HX6Za7kT2zcibY10qFqBaxEjPiYFrBQX-ZFr3yxCzJxbKOP0zVjeWb": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU")},
+			"identifier/00BNNr-PsNMtowTpEG86ZeI7eQKoD-pjSCPAal1e5MYqr_N7FLpyXKdXLXE8WEBF": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU")},
 
 			"work": {Mode: fs.ModeDir | 0700},
 		}, []pkg.FlatEntry{
@@ -86,10 +86,10 @@ func TestFlatten(t *testing.T) {
 			{Mode: 0400, Path: "checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU", Data: []byte("\x7f\xe1\x69\xa2\xdd\x63\x96\x26\x83\x79\x61\x8b\xf0\x3f\xd5\x16\x9a\x39\x3a\xdb\xcf\xb1\xbc\x8d\x33\xff\x75\xee\x62\x56\xa9\xf0\x27\xac\x13\x94\x69")},
 
 			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/NqVORkT6L9HX6Za7kT2zcibY10qFqBaxEjPiYFrBQX-ZFr3yxCzJxbKOP0zVjeWb", Data: []byte("../checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/00BNNr-PsNMtowTpEG86ZeI7eQKoD-pjSCPAal1e5MYqr_N7FLpyXKdXLXE8WEBF", Data: []byte("../checksum/fLYGIMHgN1louE-JzITJZJo2SDniPu-IHBXubtvQWFO-hXnDVKNuscV7-zlyr5fU")},
 
 			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("bqtn69RkV5E7V7GhhgCFjcvbxmaqrO8DywamM4Tyjf10F6EJBHjXiIa_tFRtF4iN"), nil},
+		}, pkg.MustDecode("KkdL8x2a84V8iYZop5jSTyba54xSgf_NZ1R0c4nSp9xTdk3SK_zUKGhNJ2uK8wMY"), nil},
 
 		{"sample directory step simple", fstest.MapFS{
 			".": {Mode: fs.ModeDir | 0500},
@@ -208,8 +208,8 @@ func TestFlatten(t *testing.T) {
 			"checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/work":                                                                                     {Mode: fs.ModeDir | 0500},
 
 			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/-P_1iw6yVq_letMHncqcExSE0bYcDhYI5OdY6b1wKASf-Corufvj__XTBUq2Qd2a": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
-			"identifier/0_rRxIqbX9LK9L_KDbuafotFz6HFkonNgO9gXhK1asM_Y1Pxn0amg756vRTo6m74": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
+			"identifier/5-NfJKBlUgVhAP_JeCjjo1UxF72x8QVMgeKPWd8s0J-RYvRJy6veTQDwmgxOvr6v": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
+			"identifier/VWakDFDSjNMvdzwxG0Y1IKFdCzExgiQnjg-vv2srsZObwh-5WOJx7H5HtCgDXHcq": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
 
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
@@ -230,12 +230,12 @@ func TestFlatten(t *testing.T) {
 			{Mode: fs.ModeDir | 0500, Path: "checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM/work"},
 
 			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/-P_1iw6yVq_letMHncqcExSE0bYcDhYI5OdY6b1wKASf-Corufvj__XTBUq2Qd2a", Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/0_rRxIqbX9LK9L_KDbuafotFz6HFkonNgO9gXhK1asM_Y1Pxn0amg756vRTo6m74", Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/5-NfJKBlUgVhAP_JeCjjo1UxF72x8QVMgeKPWd8s0J-RYvRJy6veTQDwmgxOvr6v", Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/VWakDFDSjNMvdzwxG0Y1IKFdCzExgiQnjg-vv2srsZObwh-5WOJx7H5HtCgDXHcq", Data: []byte("../checksum/cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM")},
 
 			{Mode: fs.ModeDir | 0700, Path: "temp"},
 			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("sxbgyX-bPoezbha214n2lbQhiVfTUBkhZ0EX6zI7mmkMdrCdwuMwhMBJphLQsy94"), nil},
+		}, pkg.MustDecode("nnOiyjjjvgZChsGtO4rA1JHckwYBBbxwNfecPJp62OFP6aoYUxHQ5UtYsrDpnwan"), nil},
 
 		{"sample tar expand step unpack", fstest.MapFS{
 			".": {Mode: fs.ModeDir | 0500},
@@ -255,8 +255,8 @@ func TestFlatten(t *testing.T) {
 			"checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN/libedac.so": {Mode: fs.ModeSymlink | 0777, Data: []byte("/proc/nonexistent/libedac.so")},
 
 			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/-P_1iw6yVq_letMHncqcExSE0bYcDhYI5OdY6b1wKASf-Corufvj__XTBUq2Qd2a": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
-			"identifier/0_rRxIqbX9LK9L_KDbuafotFz6HFkonNgO9gXhK1asM_Y1Pxn0amg756vRTo6m74": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
+			"identifier/VWakDFDSjNMvdzwxG0Y1IKFdCzExgiQnjg-vv2srsZObwh-5WOJx7H5HtCgDXHcq": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
+			"identifier/v3z1m-ofUqJz4_rasXRlTw5NgKk63RLvd5JKBpDeiNaYiUKSGN5KJbJGJHMt7cTf": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
 
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
@@ -268,12 +268,12 @@ func TestFlatten(t *testing.T) {
 			{Mode: fs.ModeSymlink | 0777, Path: "checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN/libedac.so", Data: []byte("/proc/nonexistent/libedac.so")},
 
 			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/-P_1iw6yVq_letMHncqcExSE0bYcDhYI5OdY6b1wKASf-Corufvj__XTBUq2Qd2a", Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/0_rRxIqbX9LK9L_KDbuafotFz6HFkonNgO9gXhK1asM_Y1Pxn0amg756vRTo6m74", Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/VWakDFDSjNMvdzwxG0Y1IKFdCzExgiQnjg-vv2srsZObwh-5WOJx7H5HtCgDXHcq", Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/v3z1m-ofUqJz4_rasXRlTw5NgKk63RLvd5JKBpDeiNaYiUKSGN5KJbJGJHMt7cTf", Data: []byte("../checksum/CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN")},
 
 			{Mode: fs.ModeDir | 0700, Path: "temp"},
 			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("4I8wx_h7NSJTlG5lbuz-GGEXrOg0GYC3M_503LYEBhv5XGWXfNIdIY9Q3eVSYldX"), nil},
+		}, pkg.MustDecode("bQVH19N7dX50SdQ6JNVYbFdDZV4t8IaM4dhxGvjACpdoEgJ2jZJfYKLH4ya7ZD_s"), nil},
 
 		{"testtool", fstest.MapFS{
 			".": {Mode: fs.ModeDir | 0500},
@@ -295,9 +295,9 @@ func TestFlatten(t *testing.T) {
 			"checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb":       {Mode: 0400, Data: []byte{}},
 
 			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/U2cbgVgEtjfRuvHfE1cQnZ3t8yoexULQyo_VLgvxAVJSsobMcNaFIsuDWtmt7kzK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			"identifier/LRxdkRYNKnZT6bKiu5W8ATeAAmq3n_5AAJkF6G0EpAOEloiZvADJBkfixgtgF1Z9": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
 			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
-			"identifier/nfeISfLeFDr1k-g3hpE1oZ440kTqDdfF8TDpoLdbTPqaMMIl95oiqcvqjRkMjubA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			"identifier/cGvuAdKA2tThRa4w3ZI2c5S5TXDx4j2qvfFM7pzf7y5vBz7NisBV06ThBXw_97xK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
 
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
@@ -311,13 +311,13 @@ func TestFlatten(t *testing.T) {
 			{Mode: 0400, Path: "checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb", Data: []byte{}},
 
 			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/U2cbgVgEtjfRuvHfE1cQnZ3t8yoexULQyo_VLgvxAVJSsobMcNaFIsuDWtmt7kzK", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/LRxdkRYNKnZT6bKiu5W8ATeAAmq3n_5AAJkF6G0EpAOEloiZvADJBkfixgtgF1Z9", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
 			{Mode: fs.ModeSymlink | 0777, Path: "identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/nfeISfLeFDr1k-g3hpE1oZ440kTqDdfF8TDpoLdbTPqaMMIl95oiqcvqjRkMjubA", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/cGvuAdKA2tThRa4w3ZI2c5S5TXDx4j2qvfFM7pzf7y5vBz7NisBV06ThBXw_97xK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
 
 			{Mode: fs.ModeDir | 0700, Path: "temp"},
 			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("UiV6kMz7KrTsc_yphiyQzFLqjRanHxUOwrBMtkKuWo4mOO6WgPFAcoUEeSp7eVIW"), nil},
+		}, pkg.MustDecode("BQb5SCAo0Rw0YBGqjGemK1jH3jk0cgxAQ-JyeqVRqaqmEevJ3jtXNL8HB470XNnB"), nil},
 
 		{"testtool net", fstest.MapFS{
 			".": {Mode: fs.ModeDir | 0500},
@@ -340,8 +340,8 @@ func TestFlatten(t *testing.T) {
 
 			"identifier": {Mode: fs.ModeDir | 0700},
 			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
-			"identifier/QdsJhGgnk5N2xdUNGcndXQxFKifxf1V_2t9X8CQ-pDcg24x6mGJC_BiLfGbs6Qml": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W")},
-			"identifier/nfeISfLeFDr1k-g3hpE1oZ440kTqDdfF8TDpoLdbTPqaMMIl95oiqcvqjRkMjubA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			"identifier/TAspufRsG2I_TsxUUj2b7bUnCHgcVSdh6aOZpzL0W5Bjn4EZmOGzjofaOWd8J11H": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W")},
+			"identifier/cGvuAdKA2tThRa4w3ZI2c5S5TXDx4j2qvfFM7pzf7y5vBz7NisBV06ThBXw_97xK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
 
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
@@ -355,13 +355,13 @@ func TestFlatten(t *testing.T) {
 			{Mode: 0400, Path: "checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W/check", Data: []byte("net")},
 
 			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/QdsJhGgnk5N2xdUNGcndXQxFKifxf1V_2t9X8CQ-pDcg24x6mGJC_BiLfGbs6Qml", Data: []byte("../checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/TAspufRsG2I_TsxUUj2b7bUnCHgcVSdh6aOZpzL0W5Bjn4EZmOGzjofaOWd8J11H", Data: []byte("../checksum/a1F_i9PVQI4qMcoHgTQkORuyWLkC1GLIxOhDt2JpU1NGAxWc5VJzdlfRK-PYBh3W")},
 			{Mode: fs.ModeSymlink | 0777, Path: "identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/nfeISfLeFDr1k-g3hpE1oZ440kTqDdfF8TDpoLdbTPqaMMIl95oiqcvqjRkMjubA", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/cGvuAdKA2tThRa4w3ZI2c5S5TXDx4j2qvfFM7pzf7y5vBz7NisBV06ThBXw_97xK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
 
 			{Mode: fs.ModeDir | 0700, Path: "temp"},
 			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("ek4K-0d4iRSArkY2TCs3WK34DbiYeOmhE_4vsJTSu_6roY4ZF3YG6eKRooal-i1o"), nil},
+		}, pkg.MustDecode("hJ7nCMLea_09Z7Fi4ALXOgubMNwK7C61THdQobpQJhH3tnr7PJ86aY98Mte3rBje"), nil},
 
 		{"sample exec container overlay root", fstest.MapFS{
 			".": {Mode: fs.ModeDir | 0700},
@@ -372,8 +372,8 @@ func TestFlatten(t *testing.T) {
 			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
 
 			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/5ey2wpmMpj483YYa7ZZQciYLA2cx3_l167JCqWW4Pd-5DVp81dj9EsBtVTwYptF6": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-			"identifier/nfeISfLeFDr1k-g3hpE1oZ440kTqDdfF8TDpoLdbTPqaMMIl95oiqcvqjRkMjubA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			"identifier/UB9HPeMgMPJf3Ut4jLWwnCtu_P3Lr29i8Erf084bHe8jjzBMKPDNxQ3RMrirkH6H": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			"identifier/cGvuAdKA2tThRa4w3ZI2c5S5TXDx4j2qvfFM7pzf7y5vBz7NisBV06ThBXw_97xK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
 
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
@@ -386,12 +386,12 @@ func TestFlatten(t *testing.T) {
 			{Mode: fs.ModeDir | 0500, Path: "checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"},
 
 			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/5ey2wpmMpj483YYa7ZZQciYLA2cx3_l167JCqWW4Pd-5DVp81dj9EsBtVTwYptF6", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/nfeISfLeFDr1k-g3hpE1oZ440kTqDdfF8TDpoLdbTPqaMMIl95oiqcvqjRkMjubA", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/UB9HPeMgMPJf3Ut4jLWwnCtu_P3Lr29i8Erf084bHe8jjzBMKPDNxQ3RMrirkH6H", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/cGvuAdKA2tThRa4w3ZI2c5S5TXDx4j2qvfFM7pzf7y5vBz7NisBV06ThBXw_97xK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
 
 			{Mode: fs.ModeDir | 0700, Path: "temp"},
 			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("VIqqpf0ip9jcyw63i6E8lCMGUcLivQBe4Bevt3WusNac-1MSy5bzB647qGUBzl-W"), nil},
+		}, pkg.MustDecode("PAZyVTxxROg4eCQX3yKuiIlB1k9VFXmtvvyy7QxoqaFhYwGZpT4wYec4R2dTtfyh"), nil},
 
 		{"sample exec container overlay work", fstest.MapFS{
 			".": {Mode: fs.ModeDir | 0700},
@@ -402,8 +402,8 @@ func TestFlatten(t *testing.T) {
 			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
 
 			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/acaDzHZv40dZaz4cGAXayqbRMgbEOuiuiUijZL8IgDQvyeCNMFE3onBMYfny-kXA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-			"identifier/nfeISfLeFDr1k-g3hpE1oZ440kTqDdfF8TDpoLdbTPqaMMIl95oiqcvqjRkMjubA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			"identifier/Fud5ldJfpsgLt-rkLWrLO-aVYhQm-esTswetjxydPeQMK4jHNJ_1fGHVahaiCZ9y": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			"identifier/cGvuAdKA2tThRa4w3ZI2c5S5TXDx4j2qvfFM7pzf7y5vBz7NisBV06ThBXw_97xK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
 
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
@@ -416,12 +416,12 @@ func TestFlatten(t *testing.T) {
 			{Mode: fs.ModeDir | 0500, Path: "checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"},
 
 			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/acaDzHZv40dZaz4cGAXayqbRMgbEOuiuiUijZL8IgDQvyeCNMFE3onBMYfny-kXA", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/nfeISfLeFDr1k-g3hpE1oZ440kTqDdfF8TDpoLdbTPqaMMIl95oiqcvqjRkMjubA", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/Fud5ldJfpsgLt-rkLWrLO-aVYhQm-esTswetjxydPeQMK4jHNJ_1fGHVahaiCZ9y", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/cGvuAdKA2tThRa4w3ZI2c5S5TXDx4j2qvfFM7pzf7y5vBz7NisBV06ThBXw_97xK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
 
 			{Mode: fs.ModeDir | 0700, Path: "temp"},
 			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("q8x2zQg4YZbKpPqKlEBj_uxXD9vOBaZ852qOuIsl9QdO73I_UMNpuUoPLtunxUYl"), nil},
+		}, pkg.MustDecode("uMZyWOQGjhI1oNKfJyw8I6EtUmWkOsZNeUEZLjy1lmkAV7cR1hmOKsOlXs4RkuEC"), nil},
 
 		{"sample exec container multiple layers", fstest.MapFS{
 			".": {Mode: fs.ModeDir | 0700},
@@ -435,10 +435,10 @@ func TestFlatten(t *testing.T) {
 			"checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK/check": {Mode: 0400, Data: []byte("layers")},
 
 			"identifier": {Mode: fs.ModeDir | 0700},
+			"identifier/YK1yDoi_qaUuXSPeVLJnaL8CBuZC4LoCarId5vdBCTLU82-vZFIfLDlaJuLM1iBj": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK")},
 			"identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
-			"identifier/nfeISfLeFDr1k-g3hpE1oZ440kTqDdfF8TDpoLdbTPqaMMIl95oiqcvqjRkMjubA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-			"identifier/rXLKjjYfGSyoWmuvEJooHkvGJIZaC0IAWnKGvtPZkM15gBxAgW7mIXcxRVNOXAr4": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK")},
-			"identifier/tfjrsVuBuFgzWgwz-yPppFtylYuC1VFWnKhyBiHbWTGkyz8lt7Ee9QXWaIHPXs4x": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			"identifier/cGvuAdKA2tThRa4w3ZI2c5S5TXDx4j2qvfFM7pzf7y5vBz7NisBV06ThBXw_97xK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			"identifier/g6gj2JWNXN-oNikou626vDqcMeZCn_TcV4xKuizBaPAWcasG2sVvItb5kZovMrzE": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
 
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
@@ -454,14 +454,14 @@ func TestFlatten(t *testing.T) {
 			{Mode: 0400, Path: "checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK/check", Data: []byte("layers")},
 
 			{Mode: fs.ModeDir | 0700, Path: "identifier"},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/YK1yDoi_qaUuXSPeVLJnaL8CBuZC4LoCarId5vdBCTLU82-vZFIfLDlaJuLM1iBj", Data: []byte("../checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK")},
 			{Mode: fs.ModeSymlink | 0777, Path: "identifier/_gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", Data: []byte("../checksum/OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/nfeISfLeFDr1k-g3hpE1oZ440kTqDdfF8TDpoLdbTPqaMMIl95oiqcvqjRkMjubA", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/rXLKjjYfGSyoWmuvEJooHkvGJIZaC0IAWnKGvtPZkM15gBxAgW7mIXcxRVNOXAr4", Data: []byte("../checksum/nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/tfjrsVuBuFgzWgwz-yPppFtylYuC1VFWnKhyBiHbWTGkyz8lt7Ee9QXWaIHPXs4x", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/cGvuAdKA2tThRa4w3ZI2c5S5TXDx4j2qvfFM7pzf7y5vBz7NisBV06ThBXw_97xK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/g6gj2JWNXN-oNikou626vDqcMeZCn_TcV4xKuizBaPAWcasG2sVvItb5kZovMrzE", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
 
 			{Mode: fs.ModeDir | 0700, Path: "temp"},
 			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("SITnQ6PTV12PAQQjIuLUxkvsXQiC9Gq_HJQlcb4BPL5YnRHnx8lsW7PRM9YMLBsx"), nil},
+		}, pkg.MustDecode("OG6C_fL-U4dZndkiKJvXf31qrM7DNpmCGxbWASwhWK_e8twIwC_ZvMvw142pVqz-"), nil},
 
 		{"sample exec container layer promotion", fstest.MapFS{
 			".": {Mode: fs.ModeDir | 0700},
@@ -472,9 +472,9 @@ func TestFlatten(t *testing.T) {
 			"checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU":       {Mode: fs.ModeDir | 0500},
 
 			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/1tQZOGmVk_JkpyiG84AKW_BXmlK_MvHUbh5WtMuthGbHUq7i7nL1bvdF-LoJbqNh": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-			"identifier/O-6VjlIUxc4PYLf5v35uhIeL8kkYCbHYklqlmDjFPXe0m4j6GkUDg5qwTzBRESnf": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-			"identifier/nfeISfLeFDr1k-g3hpE1oZ440kTqDdfF8TDpoLdbTPqaMMIl95oiqcvqjRkMjubA": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			"identifier/CuKcA4aAApOvWqI6-KzZEDyGLltRdBjOTyrTibam2fFVxtXmGL_RVuElOFTVlKfq": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			"identifier/cGvuAdKA2tThRa4w3ZI2c5S5TXDx4j2qvfFM7pzf7y5vBz7NisBV06ThBXw_97xK": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			"identifier/ywzI31S5McuYu7vzI2kqpSC_nsNzpWBXVCwPoLAYi9QVT0mODgzqoo9jYYaczPbf": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
 
 			"temp": {Mode: fs.ModeDir | 0700},
 			"work": {Mode: fs.ModeDir | 0700},
@@ -487,13 +487,13 @@ func TestFlatten(t *testing.T) {
 			{Mode: fs.ModeDir | 0500, Path: "checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"},
 
 			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/1tQZOGmVk_JkpyiG84AKW_BXmlK_MvHUbh5WtMuthGbHUq7i7nL1bvdF-LoJbqNh", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/O-6VjlIUxc4PYLf5v35uhIeL8kkYCbHYklqlmDjFPXe0m4j6GkUDg5qwTzBRESnf", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/nfeISfLeFDr1k-g3hpE1oZ440kTqDdfF8TDpoLdbTPqaMMIl95oiqcvqjRkMjubA", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/CuKcA4aAApOvWqI6-KzZEDyGLltRdBjOTyrTibam2fFVxtXmGL_RVuElOFTVlKfq", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/cGvuAdKA2tThRa4w3ZI2c5S5TXDx4j2qvfFM7pzf7y5vBz7NisBV06ThBXw_97xK", Data: []byte("../checksum/MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/ywzI31S5McuYu7vzI2kqpSC_nsNzpWBXVCwPoLAYi9QVT0mODgzqoo9jYYaczPbf", Data: []byte("../checksum/GPa4aBakdSJd7Tz7LYj_VJFoojzyZinmVcG3k6M5xI6CZ821J5sXLhLDDuS47gi9")},
 
 			{Mode: fs.ModeDir | 0700, Path: "temp"},
 			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("fuC20BhMKr86TYzNPP2A-9P7mGLvdcOiG10exlhRvZm8ySI7csf0LhW3im_26l1N"), nil},
+		}, pkg.MustDecode("CKt376G_wCHRR26hBxLnoXyz5boEOX12AiHbQM2qz4bejKtfmys3Swqh60eKFn9y"), nil},
 
 		{"sample file short", fstest.MapFS{
 			".": {Mode: fs.ModeDir | 0700},
@@ -502,7 +502,7 @@ func TestFlatten(t *testing.T) {
 			"checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX": {Mode: 0400, Data: []byte{0}},
 
 			"identifier": {Mode: fs.ModeDir | 0700},
-			"identifier/lIx_W4M7tVOcQ8jh08EJOfXf4brRmkEEjvUa7c17vVUzlmtUxlhhrgqmc9aZhjbn": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
+			"identifier/3nNZXzfgfDW2aHqmgf1VpJUYxe1GMzU7eA9Q_NnNVTDPpPOCTYKEVX-yscOiLT-e": {Mode: fs.ModeSymlink | 0777, Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
 
 			"work": {Mode: fs.ModeDir | 0700},
 		}, []pkg.FlatEntry{
@@ -511,10 +511,10 @@ func TestFlatten(t *testing.T) {
 			{Mode: 0400, Path: "checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX", Data: []byte{0}},
 
 			{Mode: fs.ModeDir | 0700, Path: "identifier"},
-			{Mode: fs.ModeSymlink | 0777, Path: "identifier/lIx_W4M7tVOcQ8jh08EJOfXf4brRmkEEjvUa7c17vVUzlmtUxlhhrgqmc9aZhjbn", Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
+			{Mode: fs.ModeSymlink | 0777, Path: "identifier/3nNZXzfgfDW2aHqmgf1VpJUYxe1GMzU7eA9Q_NnNVTDPpPOCTYKEVX-yscOiLT-e", Data: []byte("../checksum/vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX")},
 
 			{Mode: fs.ModeDir | 0700, Path: "work"},
-		}, pkg.MustDecode("hnrfmJtivNKcgtETsKnU9gP_OwPgpNY3DSUJnmxnmeOODSO-YBvEBiTgieY4AAd7"), nil},
+		}, pkg.MustDecode("azjTvqkTjLhFzvPDM4DEHiHyLupOnRq9GCikVN6DEElR1Gxz_BDo4SA0zZzaYUGa"), nil},
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {

internal/pkg/exec.go

@@ -18,6 +18,7 @@ import (
 	"hakurei.app/container"
 	"hakurei.app/container/check"
 	"hakurei.app/container/fhs"
+	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
 	"hakurei.app/message"
 )
@@ -302,6 +303,7 @@ func (a *execArtifact) cure(f *FContext, hostNet bool) (err error) {
 	z := container.New(ctx, f.GetMessage())
 	z.WaitDelay = execWaitDelay
 	z.SeccompPresets |= std.PresetStrict & ^std.PresetDenyNS
+	z.SeccompFlags |= seccomp.AllowMultiarch
 	z.ParentPerm = 0700
 	z.HostNet = hostNet
 	z.Hostname = "cure"

internal/pkg/exec_test.go

@@ -78,7 +78,7 @@ func TestExec(t *testing.T) {
 				), nil, pkg.Checksum{}, &pkg.DependencyCureError{
 					{
 						Ident: unique.Make(pkg.ID(pkg.MustDecode(
-							"CWEoJqnSBpWf8uryC2qnIe3O1a_FZWUWZGbiVPsQFGW7pvDHiSwoK3QCU9-uxN87",
+							"zegItlAz7Lr1xFyzCtHTz_eL08KNuccT3S8b7zqekz3lZxqdELdqTlGjvUYPVykW",
 						))),
 						Err: stub.UniqueError(0xcafe),
 					},
@@ -109,7 +109,7 @@ func TestExec(t *testing.T) {
 			}
 
 			testtoolDestroy(t, base, c)
-		}, pkg.MustDecode("UiV6kMz7KrTsc_yphiyQzFLqjRanHxUOwrBMtkKuWo4mOO6WgPFAcoUEeSp7eVIW")},
+		}, pkg.MustDecode("BQb5SCAo0Rw0YBGqjGemK1jH3jk0cgxAQ-JyeqVRqaqmEevJ3jtXNL8HB470XNnB")},
 
 		{"net", nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			c.SetStrict(true)
@@ -144,7 +144,7 @@ func TestExec(t *testing.T) {
 			})
 
 			testtoolDestroy(t, base, c)
-		}, pkg.MustDecode("ek4K-0d4iRSArkY2TCs3WK34DbiYeOmhE_4vsJTSu_6roY4ZF3YG6eKRooal-i1o")},
+		}, pkg.MustDecode("hJ7nCMLea_09Z7Fi4ALXOgubMNwK7C61THdQobpQJhH3tnr7PJ86aY98Mte3rBje")},
 
 		{"overlay root", nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			c.SetStrict(true)
@@ -170,7 +170,7 @@ func TestExec(t *testing.T) {
 			})
 
 			testtoolDestroy(t, base, c)
-		}, pkg.MustDecode("VIqqpf0ip9jcyw63i6E8lCMGUcLivQBe4Bevt3WusNac-1MSy5bzB647qGUBzl-W")},
+		}, pkg.MustDecode("PAZyVTxxROg4eCQX3yKuiIlB1k9VFXmtvvyy7QxoqaFhYwGZpT4wYec4R2dTtfyh")},
 
 		{"overlay work", nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			c.SetStrict(true)
@@ -201,7 +201,7 @@ func TestExec(t *testing.T) {
 			})
 
 			testtoolDestroy(t, base, c)
-		}, pkg.MustDecode("q8x2zQg4YZbKpPqKlEBj_uxXD9vOBaZ852qOuIsl9QdO73I_UMNpuUoPLtunxUYl")},
+		}, pkg.MustDecode("uMZyWOQGjhI1oNKfJyw8I6EtUmWkOsZNeUEZLjy1lmkAV7cR1hmOKsOlXs4RkuEC")},
 
 		{"multiple layers", nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			c.SetStrict(true)
@@ -254,7 +254,7 @@ func TestExec(t *testing.T) {
 			})
 
 			testtoolDestroy(t, base, c)
-		}, pkg.MustDecode("SITnQ6PTV12PAQQjIuLUxkvsXQiC9Gq_HJQlcb4BPL5YnRHnx8lsW7PRM9YMLBsx")},
+		}, pkg.MustDecode("OG6C_fL-U4dZndkiKJvXf31qrM7DNpmCGxbWASwhWK_e8twIwC_ZvMvw142pVqz-")},
 
 		{"overlay layer promotion", nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			c.SetStrict(true)
@@ -286,7 +286,7 @@ func TestExec(t *testing.T) {
 			})
 
 			testtoolDestroy(t, base, c)
-		}, pkg.MustDecode("fuC20BhMKr86TYzNPP2A-9P7mGLvdcOiG10exlhRvZm8ySI7csf0LhW3im_26l1N")},
+		}, pkg.MustDecode("CKt376G_wCHRR26hBxLnoXyz5boEOX12AiHbQM2qz4bejKtfmys3Swqh60eKFn9y")},
 	})
 }
 

internal/pkg/file_test.go

@@ -17,13 +17,13 @@ func TestFile(t *testing.T) {
 			cureMany(t, c, []cureStep{
 				{"short", pkg.NewFile("null", []byte{0}), base.Append(
 					"identifier",
-					"lIx_W4M7tVOcQ8jh08EJOfXf4brRmkEEjvUa7c17vVUzlmtUxlhhrgqmc9aZhjbn",
+					"3nNZXzfgfDW2aHqmgf1VpJUYxe1GMzU7eA9Q_NnNVTDPpPOCTYKEVX-yscOiLT-e",
 				), pkg.MustDecode(
 					"vsAhtPNo4waRNOASwrQwcIPTqb3SBuJOXw2G4T1mNmVZM-wrQTRllmgXqcIIoRcX",
 				), nil},
 			})
 		}, pkg.MustDecode(
-			"hnrfmJtivNKcgtETsKnU9gP_OwPgpNY3DSUJnmxnmeOODSO-YBvEBiTgieY4AAd7",
+			"azjTvqkTjLhFzvPDM4DEHiHyLupOnRq9GCikVN6DEElR1Gxz_BDo4SA0zZzaYUGa",
 		)},
 	})
 }

internal/pkg/net.go

@@ -78,6 +78,7 @@ func (a *httpArtifact) Cure(r *RContext) (rc io.ReadCloser, err error) {
 	if err != nil {
 		return
 	}
+	req.Header.Set("User-Agent", "Hakurei/1.1")
 
 	var resp *http.Response
 	if resp, err = a.doFunc(req); err != nil {

internal/pkg/net_test.go

@@ -109,7 +109,7 @@ func TestHTTPGet(t *testing.T) {
 			)
 			wantPathname := base.Append(
 				"identifier",
-				"NqVORkT6L9HX6Za7kT2zcibY10qFqBaxEjPiYFrBQX-ZFr3yxCzJxbKOP0zVjeWb",
+				"00BNNr-PsNMtowTpEG86ZeI7eQKoD-pjSCPAal1e5MYqr_N7FLpyXKdXLXE8WEBF",
 			)
 			if pathname, checksum, err := c.Cure(f); err != nil {
 				t.Fatalf("Cure: error = %v", err)
@@ -156,6 +156,6 @@ func TestHTTPGet(t *testing.T) {
 			if _, _, err := c.Cure(f); !reflect.DeepEqual(err, wantErrNotFound) {
 				t.Fatalf("Pathname: error = %#v, want %#v", err, wantErrNotFound)
 			}
-		}, pkg.MustDecode("bqtn69RkV5E7V7GhhgCFjcvbxmaqrO8DywamM4Tyjf10F6EJBHjXiIa_tFRtF4iN")},
+		}, pkg.MustDecode("KkdL8x2a84V8iYZop5jSTyba54xSgf_NZ1R0c4nSp9xTdk3SK_zUKGhNJ2uK8wMY")},
 	})
 }

internal/pkg/pkg.go

@@ -589,12 +589,21 @@ func (c *Cache) unsafeIdent(a Artifact, encodeKind bool) (
 	h := sha512.New384()
 	binary.LittleEndian.PutUint64(buf[:], uint64(a.Kind()))
 	h.Write(buf[:wordSize])
-	i := IContext{c, h}
-	a.Params(&i)
-	i.cache, i.h = nil, nil
 	for _, dn := range idents {
 		h.Write(dn[:])
 	}
+	kcBuf := c.getIdentBuf()
+	if kc, ok := a.(KnownChecksum); ok {
+		*(*Checksum)(kcBuf[:]) = kc.Checksum()
+	} else {
+		*(*Checksum)(kcBuf[:]) = Checksum{}
+	}
+	h.Write((*Checksum)(kcBuf[:])[:])
+	c.putIdentBuf(kcBuf)
+
+	i := IContext{c, h}
+	a.Params(&i)
+	i.cache, i.h = nil, nil
 
 	h.Sum(buf[wordSize:wordSize])
 	return

internal/pkg/pkg_test.go

@@ -218,7 +218,7 @@ func TestIdent(t *testing.T) {
 			},
 			nil,
 		}, unique.Make[pkg.ID](pkg.MustDecode(
-			"HnySzeLQvSBZuTUcvfmLEX_OmH4yJWWH788NxuLuv7kVn8_uPM6Ks4rqFWM2NZJY",
+			"v86qCz5fDqUsjA3KY_4LIrEh3aQnp04plNiWJ5_ap06McHSSBlROyKIFEwx3c0O7",
 		))},
 	}
 
@@ -531,7 +531,7 @@ func TestCache(t *testing.T) {
 					kind:   pkg.KindExec,
 					params: []byte("artifact overridden to be incomplete"),
 				}}, nil, pkg.Checksum{}, pkg.InvalidArtifactError(pkg.MustDecode(
-					"da4kLKa94g1wN2M0qcKflqgf2-Y2UL36iehhczqsIIW8G0LGvM7S8jjtnBc0ftB0",
+					"0z3fA0YngFaRRCQRrxKburhpAGz3gkYIZ346X_tAwOr_ldelYg1nTifI3-WX8hQD",
 				))},
 
 				{"error passthrough", newStubFile(

internal/pkg/tar_test.go

@@ -40,7 +40,7 @@ func TestTar(t *testing.T) {
 			}, pkg.MustDecode(
 				"cTw0h3AmYe7XudSoyEMByduYXqGi-N5ZkTZ0t9K5elsu3i_jNIVF5T08KR1roBFM",
 			))
-		}, pkg.MustDecode("sxbgyX-bPoezbha214n2lbQhiVfTUBkhZ0EX6zI7mmkMdrCdwuMwhMBJphLQsy94")},
+		}, pkg.MustDecode("nnOiyjjjvgZChsGtO4rA1JHckwYBBbxwNfecPJp62OFP6aoYUxHQ5UtYsrDpnwan")},
 
 		{"http expand", nil, func(t *testing.T, base *check.Absolute, c *pkg.Cache) {
 			checkTarHTTP(t, base, c, fstest.MapFS{
@@ -51,7 +51,7 @@ func TestTar(t *testing.T) {
 			}, pkg.MustDecode(
 				"CH3AiUrCCcVOjOYLaMKKK1Da78989JtfHeIsxMzWOQFiN4mrCLDYpoDxLWqJWCUN",
 			))
-		}, pkg.MustDecode("4I8wx_h7NSJTlG5lbuz-GGEXrOg0GYC3M_503LYEBhv5XGWXfNIdIY9Q3eVSYldX")},
+		}, pkg.MustDecode("bQVH19N7dX50SdQ6JNVYbFdDZV4t8IaM4dhxGvjACpdoEgJ2jZJfYKLH4ya7ZD_s")},
 	})
 }
 
@@ -99,13 +99,17 @@ func checkTarHTTP(
 	wantIdent := func() pkg.ID {
 		h := sha512.New384()
 		h.Write([]byte{byte(pkg.KindTar), 0, 0, 0, 0, 0, 0, 0})
-		h.Write([]byte{pkg.TarGzip, 0, 0, 0, 0, 0, 0, 0})
-		h.Write([]byte{byte(pkg.KindHTTPGet), 0, 0, 0, 0, 0, 0, 0})
 
+		h.Write([]byte{byte(pkg.KindHTTPGet), 0, 0, 0, 0, 0, 0, 0})
 		h0 := sha512.New384()
 		h0.Write([]byte{byte(pkg.KindHTTPGet), 0, 0, 0, 0, 0, 0, 0})
+		h0.Write(testdataChecksum[:])
 		h0.Write([]byte("file:///testdata"))
 		h.Write(h0.Sum(nil))
+
+		h.Write(make([]byte, len(pkg.Checksum{})))
+		h.Write([]byte{pkg.TarGzip, 0, 0, 0, 0, 0, 0, 0})
+
 		return pkg.ID(h.Sum(nil))
 	}()
 

internal/pkg/testdata/main.go

@@ -142,12 +142,12 @@ func main() {
 	}
 
 	const checksumEmptyDir = "MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU"
-	ident := "U2cbgVgEtjfRuvHfE1cQnZ3t8yoexULQyo_VLgvxAVJSsobMcNaFIsuDWtmt7kzK"
+	ident := "LRxdkRYNKnZT6bKiu5W8ATeAAmq3n_5AAJkF6G0EpAOEloiZvADJBkfixgtgF1Z9"
 	log.Println(m)
 	next := func() { m = m.Next; log.Println(m) }
 
 	if overlayRoot {
-		ident = "5ey2wpmMpj483YYa7ZZQciYLA2cx3_l167JCqWW4Pd-5DVp81dj9EsBtVTwYptF6"
+		ident = "UB9HPeMgMPJf3Ut4jLWwnCtu_P3Lr29i8Erf084bHe8jjzBMKPDNxQ3RMrirkH6H"
 
 		if m.Root != "/" || m.Target != "/" ||
 			m.Source != "overlay" || m.FsType != "overlay" {
@@ -165,7 +165,7 @@ func main() {
 				log.Fatal("unexpected artifact checksum")
 			}
 		} else {
-			ident = "tfjrsVuBuFgzWgwz-yPppFtylYuC1VFWnKhyBiHbWTGkyz8lt7Ee9QXWaIHPXs4x"
+			ident = "g6gj2JWNXN-oNikou626vDqcMeZCn_TcV4xKuizBaPAWcasG2sVvItb5kZovMrzE"
 
 			lowerdirsEscaped := strings.Split(lowerdir, ":")
 			lowerdirs := lowerdirsEscaped[:0]
@@ -194,7 +194,7 @@ func main() {
 		}
 	} else {
 		if hostNet {
-			ident = "QdsJhGgnk5N2xdUNGcndXQxFKifxf1V_2t9X8CQ-pDcg24x6mGJC_BiLfGbs6Qml"
+			ident = "TAspufRsG2I_TsxUUj2b7bUnCHgcVSdh6aOZpzL0W5Bjn4EZmOGzjofaOWd8J11H"
 		}
 
 		if m.Root != "/sysroot" || m.Target != "/" {
@@ -213,14 +213,14 @@ func main() {
 	}
 
 	if promote {
-		ident = "O-6VjlIUxc4PYLf5v35uhIeL8kkYCbHYklqlmDjFPXe0m4j6GkUDg5qwTzBRESnf"
+		ident = "ywzI31S5McuYu7vzI2kqpSC_nsNzpWBXVCwPoLAYi9QVT0mODgzqoo9jYYaczPbf"
 	}
 
 	next() // testtool artifact
 
 	next()
 	if overlayWork {
-		ident = "acaDzHZv40dZaz4cGAXayqbRMgbEOuiuiUijZL8IgDQvyeCNMFE3onBMYfny-kXA"
+		ident = "Fud5ldJfpsgLt-rkLWrLO-aVYhQm-esTswetjxydPeQMK4jHNJ_1fGHVahaiCZ9y"
 		if m.Root != "/" || m.Target != "/work" ||
 			m.Source != "overlay" || m.FsType != "overlay" {
 			log.Fatal("unexpected work mount entry")

internal/rosa/acl.go

@@ -7,23 +7,9 @@ func (t Toolchain) newAttr() pkg.Artifact {
 		version  = "2.5.2"
 		checksum = "YWEphrz6vg1sUMmHHVr1CRo53pFXRhq_pjN-AlG8UgwZK1y6m7zuDhxqJhD0SV0l"
 	)
-	return t.New("attr-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-		t.Load(Perl),
-	}, nil, nil, `
-ln -s ../../system/bin/perl /usr/bin
-
-cd "$(mktemp -d)"
-/usr/src/attr/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}" \
-	--enable-static
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("attr"), true, t.NewPatchedSource(
+	return t.NewViaMake("attr", version, t.NewPatchedSource(
 		"attr", version, pkg.NewHTTPGetTar(
-			nil,
-			"https://download.savannah.nongnu.org/releases/attr/"+
+			nil, "https://download.savannah.nongnu.org/releases/attr/"+
 				"attr-"+version+".tar.gz",
 			mustDecode(checksum),
 			pkg.TarGzip,
@@ -66,7 +52,16 @@ index 6ce2f9b..e9bde92 100644
         $ setfattr -n user. -v value f
         > setfattr: f: Invalid argument
 `},
-	)))
+	), &MakeAttr{
+		ScriptEarly: `
+ln -s ../../system/bin/perl /usr/bin
+`,
+		Configure: [][2]string{
+			{"enable-static"},
+		},
+	},
+		t.Load(Perl),
+	)
 }
 func init() { artifactsF[Attr] = Toolchain.newAttr }
 
@@ -75,24 +70,21 @@ func (t Toolchain) newACL() pkg.Artifact {
 		version  = "2.3.2"
 		checksum = "-fY5nwH4K8ZHBCRXrzLdguPkqjKI6WIiGu4dBtrZ1o0t6AIU73w8wwJz_UyjIS0P"
 	)
-	return t.New("acl-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-
-		t.Load(Attr),
-	}, nil, nil, `
-cd "$(mktemp -d)"
-/usr/src/acl/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}" \
-	--enable-static
-make "-j$(nproc)"
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("acl"), true, pkg.NewHTTPGetTar(
+	return t.NewViaMake("acl", version, pkg.NewHTTPGetTar(
 		nil,
 		"https://download.savannah.nongnu.org/releases/acl/"+
 			"acl-"+version+".tar.gz",
 		mustDecode(checksum),
 		pkg.TarGzip,
-	)))
+	), &MakeAttr{
+		Configure: [][2]string{
+			{"enable-static"},
+		},
+
+		// makes assumptions about uid_map/gid_map
+		SkipCheck: true,
+	},
+		t.Load(Attr),
+	)
 }
 func init() { artifactsF[ACL] = Toolchain.newACL }

internal/rosa/all.go

@@ -14,15 +14,20 @@ const (
 	Attr
 	Autoconf
 	Bash
-	Busybox
 	CMake
 	Coreutils
 	Diffutils
+	Findutils
+	Fuse
+	Gawk
 	Gettext
 	Git
 	Go
 	Gperf
+	Gzip
 	Hakurei
+	HakureiDist
+	IniConfig
 	KernelHeaders
 	LibXau
 	Libexpat
@@ -33,20 +38,33 @@ const (
 	M4
 	Make
 	Meson
+	Mksh
+	NSS
+	NSSCACert
 	Ninja
+	Packaging
 	Patch
 	Perl
 	PkgConfig
+	Pluggy
+	PyTest
+	Pygments
 	Python
 	Rsync
+	Sed
 	Setuptools
+	Toybox
+	toyboxEarly
 	Wayland
 	WaylandProtocols
 	XCB
 	XCBProto
 	Xproto
+	XZ
 	Zlib
 
+	buildcatrust
+
 	// _presetEnd is the total number of presets and does not denote a preset.
 	_presetEnd
 )
@@ -68,3 +86,61 @@ func (t Toolchain) Load(p PArtifact) pkg.Artifact {
 	})
 	return artifacts[t][p]
 }
+
+// ResolveName returns a [PArtifact] by name.
+func ResolveName(name string) (p PArtifact, ok bool) {
+	p, ok = map[string]PArtifact{
+		"acl":               ACL,
+		"attr":              Attr,
+		"autoconf":          Autoconf,
+		"bash":              Bash,
+		"cmake":             CMake,
+		"coreutils":         Coreutils,
+		"diffutils":         Diffutils,
+		"findutils":         Findutils,
+		"fuse":              Fuse,
+		"gawk":              Gawk,
+		"gettext":           Gettext,
+		"git":               Git,
+		"go":                Go,
+		"gperf":             Gperf,
+		"gzip":              Gzip,
+		"hakurei":           Hakurei,
+		"hakurei-dist":      HakureiDist,
+		"iniconfig":         IniConfig,
+		"kernel-headers":    KernelHeaders,
+		"libXau":            LibXau,
+		"libexpat":          Libexpat,
+		"libseccomp":        Libseccomp,
+		"libxml2":           Libxml2,
+		"libffi":            Libffi,
+		"libgd":             Libgd,
+		"m4":                M4,
+		"make":              Make,
+		"meson":             Meson,
+		"mksh":              Mksh,
+		"nss":               NSS,
+		"nss-cacert":        NSSCACert,
+		"ninja":             Ninja,
+		"packaging":         Packaging,
+		"patch":             Patch,
+		"perl":              Perl,
+		"pkg-config":        PkgConfig,
+		"pluggy":            Pluggy,
+		"pytest":            PyTest,
+		"pygments":          Pygments,
+		"python":            Python,
+		"rsync":             Rsync,
+		"sed":               Sed,
+		"setuptools":        Setuptools,
+		"toybox":            Toybox,
+		"wayland":           Wayland,
+		"wayland-protocols": WaylandProtocols,
+		"xcb":               XCB,
+		"xcb-proto":         XCBProto,
+		"xproto":            Xproto,
+		"xz":                XZ,
+		"zlib":              Zlib,
+	}[name]
+	return
+}

internal/rosa/busybox.go

@@ -5,8 +5,7 @@ import (
 	"io"
 	"net/http"
 	"os"
-	"slices"
-	"strings"
+	"runtime"
 	"time"
 
 	"hakurei.app/container/fhs"
@@ -78,10 +77,23 @@ func (a busyboxBin) Cure(t *pkg.TContext) (err error) {
 // newBusyboxBin returns a [pkg.Artifact] containing a busybox installation from
 // the https://busybox.net/downloads/binaries/ binary release.
 func newBusyboxBin() pkg.Artifact {
-	const (
-		version  = "1.35.0"
+	var version, url, checksum string
+	switch runtime.GOARCH {
+	case "amd64":
+		version = "1.35.0"
+		url = "https://busybox.net/downloads/binaries/" +
+			version + "-" + linuxArch() + "-linux-musl/busybox"
 		checksum = "L7OBIsPu9enNHn7FqpBT1kOg_mCLNmetSeNMA3i4Y60Z5jTgnlX3qX3zcQtLx5AB"
-	)
+	case "arm64":
+		version = "1.31.0"
+		url = "https://busybox.net/downloads/binaries/" +
+			version + "-defconfig-multiarch-musl/busybox-armv8l"
+		checksum = "npJjBO7iwhjW6Kx2aXeSxf8kXhVgTCDChOZTTsI8ZfFfa3tbsklxRiidZQdrVERg"
+
+	default:
+		panic("unsupported target " + runtime.GOARCH)
+	}
+
 	return pkg.NewExec(
 		"busybox-bin-"+version, nil, pkg.ExecTimeoutMax, false,
 		fhs.AbsRoot, []string{
@@ -96,264 +108,8 @@ func newBusyboxBin() pkg.Artifact {
 			&http.Client{Transport: &http.Transport{
 				// busybox website is really slow to respond
 				TLSHandshakeTimeout: 2 * time.Minute,
-			}},
-			"https://busybox.net/downloads/binaries/"+
-				version+"-"+linuxArch()+"-linux-musl/busybox",
+			}}, url,
 			mustDecode(checksum),
 		)}),
 	)
 }
-
-func (t Toolchain) newBusybox() pkg.Artifact {
-	const (
-		version  = "1.37.0"
-		checksum = "Ial94Tnt7esJ_YEeb0AxunVL6MGYFyOw7Rtu2o87CXCi1TLrc6rlznVsN1rZk7it"
-	)
-
-	var env []string
-	if t == toolchainStage3 {
-		env = append(env, "EXTRA_LDFLAGS=-static")
-	}
-
-	return t.New("busybox-"+version, false, stage3Concat(t, []pkg.Artifact{},
-		t.Load(Make),
-		t.Load(KernelHeaders),
-	), nil, slices.Concat([]string{
-		"ROSA_BUSYBOX_ENABLE=" + strings.Join([]string{
-			"STATIC",
-			"PIE",
-		}, " "),
-		"ROSA_BUSYBOX_DISABLE=" + strings.Join([]string{
-			"FEATURE_IPV6",
-			"FEATURE_PREFER_IPV4_ADDRESS",
-			"FEATURE_HWIB",
-			"ARP",
-			"ARPING",
-			"BRCTL",
-			"FEATURE_BRCTL_FANCY",
-			"FEATURE_BRCTL_SHOW",
-			"DNSD",
-			"ETHER_WAKE",
-			"FTPD",
-			"FEATURE_FTPD_WRITE",
-			"FEATURE_FTPD_ACCEPT_BROKEN_LIST",
-			"FEATURE_FTPD_AUTHENTICATION",
-			"FTPGET",
-			"FTPPUT",
-			"FEATURE_FTPGETPUT_LONG_OPTIONS",
-			"HOSTNAME",
-			"DNSDOMAINNAME",
-			"HTTPD",
-			"FEATURE_HTTPD_PORT_DEFAULT",
-			"FEATURE_HTTPD_RANGES",
-			"FEATURE_HTTPD_SETUID",
-			"FEATURE_HTTPD_BASIC_AUTH",
-			"FEATURE_HTTPD_AUTH_MD5",
-			"FEATURE_HTTPD_CGI",
-			"FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR",
-			"FEATURE_HTTPD_SET_REMOTE_PORT_TO_ENV",
-			"FEATURE_HTTPD_ENCODE_URL_STR",
-			"FEATURE_HTTPD_ERROR_PAGES",
-			"FEATURE_HTTPD_PROXY",
-			"FEATURE_HTTPD_GZIP",
-			"FEATURE_HTTPD_ETAG",
-			"FEATURE_HTTPD_LAST_MODIFIED",
-			"FEATURE_HTTPD_DATE",
-			"FEATURE_HTTPD_ACL_IP",
-			"IFCONFIG",
-			"FEATURE_IFCONFIG_STATUS",
-			"FEATURE_IFCONFIG_SLIP",
-			"FEATURE_IFCONFIG_MEMSTART_IOADDR_IRQ",
-			"FEATURE_IFCONFIG_HW",
-			"FEATURE_IFCONFIG_BROADCAST_PLUS",
-			"IFENSLAVE",
-			"IFPLUGD",
-			"IFUP",
-			"IFDOWN",
-			"IFUPDOWN_IFSTATE_PATH",
-			"FEATURE_IFUPDOWN_IP",
-			"FEATURE_IFUPDOWN_IPV4",
-			"FEATURE_IFUPDOWN_IPV6",
-			"FEATURE_IFUPDOWN_MAPPING",
-			"INETD",
-			"FEATURE_INETD_SUPPORT_BUILTIN_ECHO",
-			"FEATURE_INETD_SUPPORT_BUILTIN_DISCARD",
-			"FEATURE_INETD_SUPPORT_BUILTIN_TIME",
-			"FEATURE_INETD_SUPPORT_BUILTIN_DAYTIME",
-			"FEATURE_INETD_SUPPORT_BUILTIN_CHARGEN",
-			"IP",
-			"IPADDR",
-			"IPLINK",
-			"IPROUTE",
-			"IPTUNNEL",
-			"IPRULE",
-			"IPNEIGH",
-			"FEATURE_IP_ADDRESS",
-			"FEATURE_IP_LINK",
-			"FEATURE_IP_LINK_CAN",
-			"FEATURE_IP_ROUTE",
-			"FEATURE_IP_ROUTE_DIR",
-			"FEATURE_IP_TUNNEL",
-			"FEATURE_IP_RULE",
-			"FEATURE_IP_NEIGH",
-			"IPCALC",
-			"FEATURE_IPCALC_LONG_OPTIONS",
-			"FEATURE_IPCALC_FANCY",
-			"FAKEIDENTD",
-			"NAMEIF",
-			"FEATURE_NAMEIF_EXTENDED",
-			"NBDCLIENT",
-			"NC",
-			"NC_SERVER",
-			"NC_EXTRA",
-			"NC_110_COMPAT",
-			"NETSTAT",
-			"FEATURE_NETSTAT_WIDE",
-			"FEATURE_NETSTAT_PRG",
-			"NSLOOKUP",
-			"FEATURE_NSLOOKUP_BIG",
-			"FEATURE_NSLOOKUP_LONG_OPTIONS",
-			"NTPD",
-			"FEATURE_NTPD_SERVER",
-			"FEATURE_NTPD_CONF",
-			"FEATURE_NTP_AUTH",
-			"PING",
-			"PING6",
-			"FEATURE_FANCY_PING",
-			"PSCAN",
-			"ROUTE",
-			"SLATTACH",
-			"SSL_CLIENT",
-			"TC",
-			"FEATURE_TC_INGRESS",
-			"TCPSVD",
-			"UDPSVD",
-			"TELNET",
-			"FEATURE_TELNET_TTYPE",
-			"FEATURE_TELNET_AUTOLOGIN",
-			"FEATURE_TELNET_WIDTH",
-			"TELNETD",
-			"FEATURE_TELNETD_STANDALONE",
-			"FEATURE_TELNETD_PORT_DEFAULT",
-			"FEATURE_TELNETD_INETD_WAIT",
-			"TFTP",
-			"FEATURE_TFTP_PROGRESS_BAR",
-			"FEATURE_TFTP_HPA_COMPAT",
-			"TFTPD",
-			"FEATURE_TFTP_GET",
-			"FEATURE_TFTP_PUT",
-			"FEATURE_TFTP_BLOCKSIZE",
-			"TLS",
-			"TRACEROUTE",
-			"TRACEROUTE6",
-			"FEATURE_TRACEROUTE_VERBOSE",
-			"FEATURE_TRACEROUTE_USE_ICMP",
-			"TUNCTL",
-			"FEATURE_TUNCTL_UG",
-			"VCONFIG",
-			"WGET",
-			"FEATURE_WGET_LONG_OPTIONS",
-			"FEATURE_WGET_STATUSBAR",
-			"FEATURE_WGET_FTP",
-			"FEATURE_WGET_AUTHENTICATION",
-			"FEATURE_WGET_TIMEOUT",
-			"FEATURE_WGET_HTTPS",
-			"FEATURE_WGET_OPENSSL",
-			"WHOIS",
-			"ZCIP",
-			"UDHCPD",
-			"FEATURE_UDHCPD_BOOTP",
-			"FEATURE_UDHCPD_WRITE_LEASES_EARLY",
-			"DHCPD_LEASES_FILE",
-			"DUMPLEASES",
-			"DHCPRELAY",
-			"UDHCPC",
-			"FEATURE_UDHCPC_ARPING",
-			"FEATURE_UDHCPC_SANITIZEOPT",
-			"UDHCPC_DEFAULT_SCRIPT",
-			"UDHCPC6_DEFAULT_SCRIPT",
-			"UDHCPC6",
-			"FEATURE_UDHCPC6_RFC3646",
-			"FEATURE_UDHCPC6_RFC4704",
-			"FEATURE_UDHCPC6_RFC4833",
-			"FEATURE_UDHCPC6_RFC5970",
-		}, " "),
-	}, env), `
-config_enable() {
-	for ent in "$@"; do
-		sed "s/^# CONFIG_${ent}.*/CONFIG_${ent}=y/" -i .config
-		shift
-	done
-}
-
-config_disable() {
-	for ent in "$@"; do
-		sed "s/^CONFIG_${ent}=y/# CONFIG_${ent} is not set/" -i .config
-		shift
-	done
-}
-
-cat > /bin/gcc << EOF
-exec clang \
-	-Wno-ignored-optimization-argument \
-	${LDFLAGS} \
-	\$@
-EOF
-chmod +x /bin/gcc
-
-cd /usr/src/busybox
-chmod +w editors editors/awk.c
-patch -p 1 < /usr/src/patches/awk-fix-literal-backslash.patch
-
-cd "$(mktemp -d)"
-make \
-	KBUILD_SRC=/usr/src/busybox \
-	-f /usr/src/busybox/Makefile \
-	defconfig
-
-config_enable $ROSA_BUSYBOX_ENABLE
-config_disable $ROSA_BUSYBOX_DISABLE
-ln -s ../system/bin/pwd /bin/pwd || true
-make CFLAGS_busybox="${LDFLAGS} ${EXTRA_LDFLAGS}" "-j$(nproc)"
-
-mkdir -p /system/bin/ /work/bin/
-cp busybox /system/bin/
-
-mkdir -pv /work/system/bin/
-busybox --install -s /work/system/bin/
-cp -v busybox /work/system/bin/
-ln -vs ../system/bin/hush /work/bin/sh
-mkdir -vp /work/usr/bin/
-ln -vs ../../system/bin/busybox /work/usr/bin/env
-`, pkg.Path(AbsUsrSrc.Append("busybox"), true, pkg.NewHTTPGetTar(
-		&http.Client{Transport: &http.Transport{
-			// busybox website is really slow to respond
-			TLSHandshakeTimeout: 2 * time.Minute,
-		}},
-		"https://busybox.net/downloads/busybox-"+version+".tar.bz2",
-		mustDecode(checksum),
-		pkg.TarBzip2,
-	)), pkg.Path(
-		AbsUsrSrc.Append("patches", "awk-fix-literal-backslash.patch"), false,
-		pkg.NewFile("awk-fix-literal-backslash.patch", []byte(`diff --git a/editors/awk.c b/editors/awk.c
-index 64e752f4b..40f5ba7f7 100644
---- a/editors/awk.c
-+++ b/editors/awk.c
-@@ -2636,8 +2636,13 @@ static int awk_sub(node *rn, const char *repl, int nm, var *src, var *dest /*,in
- 					resbuf = qrealloc(resbuf, residx + replen + n, &resbufsize);
- 					memcpy(resbuf + residx, sp + pmatch[j].rm_so - start_ofs, n);
- 					residx += n;
--				} else
-+				} else {
-+/* '\\' and '&' following a backslash keep its original meaning, any other
-+ * occurrence of a '\\' should be treated as literal */
-+					if (bslash && c != '\\' && c != '&')
-+						resbuf[residx++] = '\\';
- 					resbuf[residx++] = c;
-+				}
- 				bslash = 0;
- 			}
- 		}`)),
-	))
-}
-func init() { artifactsF[Busybox] = Toolchain.newBusybox }

internal/rosa/cmake.go

@@ -13,13 +13,10 @@ func (t Toolchain) newCMake() pkg.Artifact {
 		version  = "4.2.1"
 		checksum = "Y3OdbMsob6Xk2y1DCME6z4Fryb5_TkFD7knRT8dTNIRtSqbiCJyyDN9AxggN_I75"
 	)
-	return t.New("cmake-"+version, false, []pkg.Artifact{
+	return t.New("cmake-"+version, 0, []pkg.Artifact{
 		t.Load(Make),
 		t.Load(KernelHeaders),
 	}, nil, nil, `
-# expected to be writable in the copy made during bootstrap
-chmod -R +w /usr/src/cmake/Tests
-
 cd "$(mktemp -d)"
 /usr/src/cmake/bootstrap \
 	--prefix=/system \
@@ -28,25 +25,25 @@ cd "$(mktemp -d)"
 	-DCMAKE_USE_OPENSSL=OFF
 make "-j$(nproc)"
 make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("cmake"), true,
-		pkg.NewHTTPGetTar(
+`, pkg.Path(AbsUsrSrc.Append("cmake"), true, t.NewPatchedSource(
+		// expected to be writable in the copy made during bootstrap
+		"cmake", version, pkg.NewHTTPGetTar(
 			nil, "https://github.com/Kitware/CMake/releases/download/"+
 				"v"+version+"/cmake-"+version+".tar.gz",
 			mustDecode(checksum),
 			pkg.TarGzip,
-		)))
+		), false,
+	)))
 }
 func init() { artifactsF[CMake] = Toolchain.newCMake }
 
 // CMakeAttr holds the project-specific attributes that will be applied to a new
-// [pkg.Artifact] compiled via CMake.
+// [pkg.Artifact] compiled via [CMake].
 type CMakeAttr struct {
 	// Path elements joined with source.
 	Append []string
 	// Use source tree as scratch space.
 	Writable bool
-	// Dependencies concatenated with the build system itself.
-	Extra []pkg.Artifact
 
 	// CMake CACHE entries.
 	Cache [][2]string
@@ -60,15 +57,16 @@ type CMakeAttr struct {
 	// Override the default installation prefix [AbsSystem].
 	Prefix *check.Absolute
 
-	// Return an exclusive artifact.
-	Exclusive bool
+	// Passed through to [Toolchain.New].
+	Flag int
 }
 
-// NewViaCMake returns a [pkg.Artifact] for compiling and installing via CMake.
+// NewViaCMake returns a [pkg.Artifact] for compiling and installing via [CMake].
 func (t Toolchain) NewViaCMake(
 	name, version, variant string,
 	source pkg.Artifact,
 	attr *CMakeAttr,
+	extra ...pkg.Artifact,
 ) pkg.Artifact {
 	if name == "" || version == "" || variant == "" {
 		panic("names must be non-empty")
@@ -97,7 +95,7 @@ chmod -R +w "${ROSA_SOURCE}"
 	}
 
 	sourcePath := AbsUsrSrc.Append(name)
-	return t.New(name+"-"+variant+"-"+version, attr.Exclusive, stage3Concat(t, attr.Extra,
+	return t.New(name+"-"+variant+"-"+version, attr.Flag, stage3Concat(t, extra,
 		t.Load(CMake),
 		t.Load(Ninja),
 	), nil, slices.Concat([]string{

internal/rosa/fuse.go

@@ -0,0 +1,45 @@
+package rosa
+
+import "hakurei.app/internal/pkg"
+
+func (t Toolchain) newFuse() pkg.Artifact {
+	const (
+		version  = "3.18.1"
+		checksum = "COb-BgJRWXLbt9XUkNeuiroQizpMifXqxgieE1SlkMXhs_WGSyJStrmyewAw2hd6"
+	)
+	return t.New("fuse-"+version, 0, []pkg.Artifact{
+		t.Load(Python),
+		t.Load(Meson),
+		t.Load(Ninja),
+
+		t.Load(IniConfig),
+		t.Load(Packaging),
+		t.Load(Pluggy),
+		t.Load(Pygments),
+		t.Load(PyTest),
+
+		t.Load(KernelHeaders),
+	}, nil, nil, `
+cd "$(mktemp -d)"
+meson setup \
+	--reconfigure \
+	--buildtype=release \
+	--prefix=/system \
+	--prefer-static \
+	-Dtests=true \
+	-Duseroot=false \
+	-Dinitscriptdir=/system/init.d \
+	-Ddefault_library=both \
+	. /usr/src/fuse
+meson compile
+python3 -m pytest test/
+meson install \
+	--destdir=/work
+`, pkg.Path(AbsUsrSrc.Append("fuse"), false, pkg.NewHTTPGetTar(
+		nil, "https://github.com/libfuse/libfuse/releases/download/"+
+			"fuse-"+version+"/fuse-"+version+".tar.gz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	)))
+}
+func init() { artifactsF[Fuse] = Toolchain.newFuse }

internal/rosa/git.go

@@ -9,25 +9,64 @@ func (t Toolchain) newGit() pkg.Artifact {
 		version  = "2.52.0"
 		checksum = "uH3J1HAN_c6PfGNJd2OBwW4zo36n71wmkdvityYnrh8Ak0D1IifiAvEWz9Vi9DmS"
 	)
-	return t.New("git-"+version, false, stage3Concat(t, []pkg.Artifact{},
-		t.Load(Make),
+	return t.NewViaMake("git", version, t.NewPatchedSource(
+		"git", version, pkg.NewHTTPGetTar(
+			nil, "https://www.kernel.org/pub/software/scm/git/"+
+				"git-"+version+".tar.gz",
+			mustDecode(checksum),
+			pkg.TarGzip,
+		), false,
+	), &MakeAttr{
+		// uses source tree as scratch space
+		Writable: true,
+		InPlace:  true,
+
+		// test suite in subdirectory
+		SkipCheck: true,
+
+		Make: []string{"all"},
+		ScriptEarly: `
+cd /usr/src/git
+
+make configure
+`,
+		Script: `
+ln -s ../../system/bin/perl /usr/bin/ || true
+
+function disable_test {
+	local test=$1 pattern=$2
+	if [ $# -eq 1 ]; then
+		rm "t/${test}.sh"
+	else
+		sed -i "t/${test}.sh" \
+			-e "/^\s*test_expect_.*$pattern/,/^\s*' *\$/{s/^/: #/}"
+	fi
+}
+
+disable_test t5319-multi-pack-index
+disable_test t1305-config-include
+disable_test t3900-i18n-commit
+disable_test t3507-cherry-pick-conflict
+disable_test t4201-shortlog
+disable_test t5303-pack-corruption-resilience
+disable_test t4301-merge-tree-write-tree
+disable_test t8005-blame-i18n
+disable_test t9350-fast-export
+disable_test t9300-fast-import
+
+make \
+	-C t \
+	GIT_PROVE_OPTS="--jobs 32 --failures" \
+	prove
+`,
+	},
 		t.Load(Perl),
+		t.Load(Diffutils),
 		t.Load(M4),
 		t.Load(Autoconf),
 		t.Load(Gettext),
 
 		t.Load(Zlib),
-	), nil, nil, `
-chmod -R +w /usr/src/git && cd /usr/src/git
-make configure
-./configure --prefix=/system
-make "-j$(nproc)" all
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("git"), true, pkg.NewHTTPGetTar(
-		nil, "https://www.kernel.org/pub/software/scm/git/"+
-			"git-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
-	)))
+	)
 }
 func init() { artifactsF[Git] = Toolchain.newGit }

internal/rosa/gnu.go

@@ -1,91 +1,99 @@
 package rosa
 
-import "hakurei.app/internal/pkg"
+import (
+	"runtime"
+	"strconv"
 
-func (t Toolchain) newMake() pkg.Artifact {
-	const (
-		version  = "4.4.1"
-		checksum = "YS_B07ZcAy9PbaK5_vKGj64SrxO2VMpnMKfc9I0Q9IC1rn0RwOH7802pJoj2Mq4a"
-	)
-	return t.New("make-"+version, false, nil, nil, nil, `
-cd "$(mktemp -d)"
-/usr/src/make/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}" \
-	--disable-dependency-tracking
-./build.sh
-./make DESTDIR=/work install check
-`, pkg.Path(AbsUsrSrc.Append("make"), false, pkg.NewHTTPGetTar(
-		nil,
-		"https://ftp.gnu.org/gnu/make/make-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
-	)))
-}
-func init() { artifactsF[Make] = Toolchain.newMake }
+	"hakurei.app/internal/pkg"
+)
 
 func (t Toolchain) newM4() pkg.Artifact {
 	const (
 		version  = "1.4.20"
 		checksum = "RT0_L3m4Co86bVBY3lCFAEs040yI1WdeNmRylFpah8IZovTm6O4wI7qiHJN3qsW9"
 	)
-	return t.New("m4-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-	}, nil, nil, `
-cd /usr/src/m4
-chmod +w tests/test-c32ispunct.sh && echo '#!/bin/sh' > tests/test-c32ispunct.sh
-
-cd "$(mktemp -d)"
-/usr/src/m4/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}"
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("m4"), true, pkg.NewHTTPGetTar(
-		nil,
-		"https://ftp.gnu.org/gnu/m4/m4-"+version+".tar.bz2",
+	return t.NewViaMake("m4", version, pkg.NewHTTPGetTar(
+		nil, "https://ftpmirror.gnu.org/gnu/m4/m4-"+version+".tar.bz2",
 		mustDecode(checksum),
 		pkg.TarBzip2,
-	)))
+	), &MakeAttr{
+		Writable: true,
+		ScriptEarly: `
+cd /usr/src/m4
+chmod +w tests/test-c32ispunct.sh && echo '#!/bin/sh' > tests/test-c32ispunct.sh
+`,
+	},
+		t.Load(Diffutils),
+	)
 }
 func init() { artifactsF[M4] = Toolchain.newM4 }
 
+func (t Toolchain) newSed() pkg.Artifact {
+	const (
+		version  = "4.9"
+		checksum = "pe7HWH4PHNYrazOTlUoE1fXmhn2GOPFN_xE62i0llOr3kYGrH1g2_orDz0UtZ9Nt"
+	)
+	return t.NewViaMake("sed", version, pkg.NewHTTPGetTar(
+		nil, "https://ftpmirror.gnu.org/gnu/sed/sed-"+version+".tar.gz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	), nil,
+		t.Load(Diffutils),
+	)
+}
+func init() { artifactsF[Sed] = Toolchain.newSed }
+
 func (t Toolchain) newAutoconf() pkg.Artifact {
 	const (
 		version  = "2.72"
 		checksum = "-c5blYkC-xLDer3TWEqJTyh1RLbOd1c5dnRLKsDnIrg_wWNOLBpaqMY8FvmUFJ33"
 	)
-	return t.New("autoconf-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-		t.Load(M4),
-		t.Load(Perl),
-	}, nil, nil, `
-cd "$(mktemp -d)"
-/usr/src/autoconf/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}"
-make \
-	"-j$(nproc)" \
-	TESTSUITEFLAGS="-j$(nproc)" \
-	check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("autoconf"), false, pkg.NewHTTPGetTar(
+	return t.NewViaMake("autoconf", version, pkg.NewHTTPGetTar(
 		nil,
-		"https://ftp.gnu.org/gnu/autoconf/autoconf-"+version+".tar.gz",
+		"https://ftpmirror.gnu.org/gnu/autoconf/autoconf-"+version+".tar.gz",
 		mustDecode(checksum),
 		pkg.TarGzip,
-	)))
+	), &MakeAttr{
+		Env: []string{
+			"TESTSUITEFLAGS=" + strconv.Itoa(runtime.NumCPU()),
+		},
+	},
+		t.Load(M4),
+		t.Load(Perl),
+		t.Load(Bash),
+		t.Load(Diffutils),
+	)
 }
 func init() { artifactsF[Autoconf] = Toolchain.newAutoconf }
 
+func (t Toolchain) newGzip() pkg.Artifact {
+	const (
+		version  = "1.14"
+		checksum = "NWhjUavnNfTDFkZJyAUonL9aCOak8GVajWX2OMlzpFnuI0ErpBFyj88mz2xSjz0q"
+	)
+	return t.NewViaMake("gzip", version, pkg.NewHTTPGetTar(
+		nil, "https://ftpmirror.gnu.org/gnu/gzip/gzip-"+version+".tar.gz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	), &MakeAttr{
+		// dependency loop
+		SkipCheck: true,
+	})
+}
+func init() { artifactsF[Gzip] = Toolchain.newGzip }
+
 func (t Toolchain) newGettext() pkg.Artifact {
 	const (
-		version  = "0.26"
-		checksum = "IMu7yDZX7xL5UO1ZxXc-iBMbY9LLEUlOroyuSlHMZwg9MKtxG7HIm8F2LheDua0y"
+		version  = "1.0"
+		checksum = "3MasKeEdPeFEgWgzsBKk7JqWqql1wEMbgPmzAfs-mluyokoW0N8oQVxPQoOnSdgC"
 	)
-	return t.New("gettext-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-	}, nil, nil, `
+	return t.NewViaMake("gettext", version, pkg.NewHTTPGetTar(
+		nil, "https://ftpmirror.gnu.org/gnu/gettext/gettext-"+version+".tar.gz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	), &MakeAttr{
+		Writable: true,
+		ScriptEarly: `
 cd /usr/src/gettext
 test_disable() { chmod +w "$2" && echo "$1" > "$2"; }
 
@@ -99,18 +107,15 @@ test_disable '#!/bin/sh' gettext-tools/tests/format-c-5
 test_disable '#!/bin/sh' gettext-tools/gnulib-tests/test-c32ispunct.sh
 test_disable 'int main(){return 0;}' gettext-tools/gnulib-tests/test-stdcountof-h.c
 
-cd "$(mktemp -d)"
-/usr/src/gettext/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}"
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("gettext"), true, pkg.NewHTTPGetTar(
-		nil,
-		"https://ftp.gnu.org/pub/gnu/gettext/gettext-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
-	)))
+touch gettext-tools/autotools/archive.dir.tar
+`,
+	},
+		t.Load(Diffutils),
+		t.Load(Gzip),
+		t.Load(Sed),
+
+		t.Load(KernelHeaders),
+	)
 }
 func init() { artifactsF[Gettext] = Toolchain.newGettext }
 
@@ -119,27 +124,22 @@ func (t Toolchain) newDiffutils() pkg.Artifact {
 		version  = "3.12"
 		checksum = "9J5VAq5oA7eqwzS1Yvw-l3G5o-TccUrNQR3PvyB_lgdryOFAfxtvQfKfhdpquE44"
 	)
-	return t.New("diffutils-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-	}, nil, nil, `
+	return t.NewViaMake("diffutils", version, pkg.NewHTTPGetTar(
+		nil, "https://ftpmirror.gnu.org/gnu/diffutils/diffutils-"+version+".tar.gz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	), &MakeAttr{
+		Writable: true,
+		ScriptEarly: `
 cd /usr/src/diffutils
 test_disable() { chmod +w "$2" && echo "$1" > "$2"; }
 
 test_disable '#!/bin/sh' gnulib-tests/test-c32ispunct.sh
 test_disable 'int main(){return 0;}' gnulib-tests/test-c32ispunct.c
-
-cd "$(mktemp -d)"
-/usr/src/diffutils/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}"
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("diffutils"), true, pkg.NewHTTPGetTar(
-		nil,
-		"https://ftp.gnu.org/gnu/diffutils/diffutils-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
-	)))
+test_disable '#!/bin/sh' tests/cmp
+`,
+		Flag: TEarly,
+	})
 }
 func init() { artifactsF[Diffutils] = Toolchain.newDiffutils }
 
@@ -148,27 +148,21 @@ func (t Toolchain) newPatch() pkg.Artifact {
 		version  = "2.8"
 		checksum = "MA0BQc662i8QYBD-DdGgyyfTwaeALZ1K0yusV9rAmNiIsQdX-69YC4t9JEGXZkeR"
 	)
-	return t.New("patch-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-	}, nil, nil, `
+	return t.NewViaMake("patch", version, pkg.NewHTTPGetTar(
+		nil, "https://ftpmirror.gnu.org/gnu/patch/patch-"+version+".tar.gz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	), &MakeAttr{
+		Writable: true,
+		ScriptEarly: `
 cd /usr/src/patch
 test_disable() { chmod +w "$2" && echo "$1" > "$2"; }
 
 test_disable '#!/bin/sh' tests/ed-style
 test_disable '#!/bin/sh' tests/need-filename
-
-cd "$(mktemp -d)"
-/usr/src/patch/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}"
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("patch"), true, pkg.NewHTTPGetTar(
-		nil,
-		"https://ftp.gnu.org/gnu/patch/patch-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
-	)))
+`,
+		Flag: TEarly,
+	})
 }
 func init() { artifactsF[Patch] = Toolchain.newPatch }
 
@@ -177,22 +171,17 @@ func (t Toolchain) newBash() pkg.Artifact {
 		version  = "5.3"
 		checksum = "4LQ_GRoB_ko-Ih8QPf_xRKA02xAm_TOxQgcJLmFDT6udUPxTAWrsj-ZNeuTusyDq"
 	)
-	return t.New("bash-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-	}, nil, nil, `
-cd "$(mktemp -d)"
-/usr/src/bash/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}" \
-	--without-bash-malloc
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("bash"), true, pkg.NewHTTPGetTar(
-		nil,
-		"https://ftp.gnu.org/gnu/bash/bash-"+version+".tar.gz",
+	return t.NewViaMake("bash", version, pkg.NewHTTPGetTar(
+		nil, "https://ftpmirror.gnu.org/gnu/bash/bash-"+version+".tar.gz",
 		mustDecode(checksum),
 		pkg.TarGzip,
-	)))
+	), &MakeAttr{
+		Script: "ln -s bash /work/system/bin/sh\n",
+		Configure: [][2]string{
+			{"without-bash-malloc"},
+		},
+		Flag: TEarly,
+	})
 }
 func init() { artifactsF[Bash] = Toolchain.newBash }
 
@@ -201,29 +190,30 @@ func (t Toolchain) newCoreutils() pkg.Artifact {
 		version  = "9.9"
 		checksum = "B1_TaXj1j5aiVIcazLWu8Ix03wDV54uo2_iBry4qHG6Y-9bjDpUPlkNLmU_3Nvw6"
 	)
-	return t.New("coreutils-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-		t.Load(Perl),
-
-		t.Load(KernelHeaders),
-	}, nil, nil, `
+	return t.NewViaMake("coreutils", version, pkg.NewHTTPGetTar(
+		nil, "https://ftpmirror.gnu.org/gnu/coreutils/coreutils-"+version+".tar.gz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	), &MakeAttr{
+		Writable: true,
+		ScriptEarly: `
 cd /usr/src/coreutils
 test_disable() { chmod +w "$2" && echo "$1" > "$2"; }
 
 test_disable '#!/bin/sh' gnulib-tests/test-c32ispunct.sh
+test_disable '#!/bin/sh' tests/split/line-bytes.sh
+test_disable '#!/bin/sh' tests/dd/no-allocate.sh
+test_disable 'int main(){return 0;}' gnulib-tests/test-chown.c
+test_disable 'int main(){return 0;}' gnulib-tests/test-fchownat.c
+test_disable 'int main(){return 0;}' gnulib-tests/test-lchown.c
+`,
+		Flag: TEarly,
+	},
+		t.Load(Perl),
+		t.Load(Bash),
 
-cd "$(mktemp -d)"
-/usr/src/coreutils/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}"
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("coreutils"), true, pkg.NewHTTPGetTar(
-		nil,
-		"https://ftp.gnu.org/gnu/coreutils/coreutils-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
-	)))
+		t.Load(KernelHeaders),
+	)
 }
 func init() { artifactsF[Coreutils] = Toolchain.newCoreutils }
 
@@ -232,19 +222,57 @@ func (t Toolchain) newGperf() pkg.Artifact {
 		version  = "3.3"
 		checksum = "RtIy9pPb_Bb8-31J2Nw-rRGso2JlS-lDlVhuNYhqR7Nt4xM_nObznxAlBMnarJv7"
 	)
-	return t.New("gperf-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-	}, nil, nil, `
-cd "$(mktemp -d)"
-/usr/src/gperf/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}"
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("gperf"), true, pkg.NewHTTPGetTar(
-		nil, "https://ftp.gnu.org/pub/gnu/gperf/gperf-"+version+".tar.gz",
+	return t.NewViaMake("gperf", version, pkg.NewHTTPGetTar(
+		nil, "https://ftpmirror.gnu.org/gperf/gperf-"+version+".tar.gz",
 		mustDecode(checksum),
 		pkg.TarGzip,
-	)))
+	), nil,
+		t.Load(Diffutils),
+	)
 }
 func init() { artifactsF[Gperf] = Toolchain.newGperf }
+
+func (t Toolchain) newGawk() pkg.Artifact {
+	const (
+		version  = "5.3.2"
+		checksum = "uIs0d14h_d2DgMGYwrPtegGNyt_bxzG3D6Fe-MmExx_pVoVkQaHzrtmiXVr6NHKk"
+	)
+	return t.NewViaMake("gawk", version, pkg.NewHTTPGetTar(
+		nil, "https://ftpmirror.gnu.org/gnu/gawk/gawk-"+version+".tar.gz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	), &MakeAttr{
+		Flag: TEarly,
+
+		// dependency loop
+		SkipCheck: true,
+	})
+}
+func init() { artifactsF[Gawk] = Toolchain.newGawk }
+
+func (t Toolchain) newFindutils() pkg.Artifact {
+	const (
+		version  = "4.10.0"
+		checksum = "ZXABdNBQXL7QjTygynRRTdXYWxQKZ0Wn5eMd3NUnxR0xaS0u0VfcKoTlbo50zxv6"
+	)
+	return t.NewViaMake("findutils", version, pkg.NewHTTPGet(
+		nil, "https://ftpmirror.gnu.org/gnu/findutils/findutils-"+version+".tar.xz",
+		mustDecode(checksum),
+	), &MakeAttr{
+		SourceSuffix: ".tar.xz",
+		ScriptEarly: `
+cd /usr/src/
+tar xf findutils.tar.xz
+mv findutils-` + version + ` findutils
+
+cd findutils
+echo '#!/bin/sh' > gnulib-tests/test-c32ispunct.sh
+echo 'int main(){return 0;}' > tests/xargs/test-sigusr.c
+`,
+	},
+		t.Load(Diffutils),
+		t.Load(XZ),
+		t.Load(Sed),
+	)
+}
+func init() { artifactsF[Findutils] = Toolchain.newFindutils }

internal/rosa/go.go

@@ -10,7 +10,7 @@ import (
 // newGoBootstrap returns the Go bootstrap toolchain.
 func (t Toolchain) newGoBootstrap() pkg.Artifact {
 	const checksum = "8o9JL_ToiQKadCTb04nvBDkp8O1xiWOolAxVEqaTGodieNe4lOFEjlOxN3bwwe23"
-	return t.New("go1.4-bootstrap", false, []pkg.Artifact{
+	return t.New("go1.4-bootstrap", 0, []pkg.Artifact{
 		t.Load(Bash),
 	}, nil, []string{
 		"CGO_ENABLED=0",
@@ -20,19 +20,7 @@ cp -r /usr/src/go /work
 cd /work/go/src
 chmod -R +w ..
 
-ln -s ../system/bin/busybox /bin/pwd
-cat << EOF > /bin/hostname
-#!/bin/sh
-echo cure
-EOF
-chmod +x /bin/hostname
-
-rm \
-	cmd/objdump/objdump_test.go \
-	syscall/creds_test.go \
-	net/multicast_test.go
-
-./all.bash
+./make.bash
 cd /work/
 mkdir system/
 mv go/ system/
@@ -50,7 +38,7 @@ func (t Toolchain) newGo(
 	script string,
 	extra ...pkg.Artifact,
 ) pkg.Artifact {
-	return t.New("go"+version, false, slices.Concat([]pkg.Artifact{
+	return t.New("go"+version, 0, slices.Concat([]pkg.Artifact{
 		t.Load(Bash),
 	}, extra), nil, slices.Concat([]string{
 		"CC=cc",
@@ -83,7 +71,11 @@ func (t Toolchain) newGoLatest() pkg.Artifact {
 		"9_e0aFHsIkVxWVGsp9T2RvvjOc3p4n9o9S8tkNe9Cvgzk_zI2FhRQB7ioQkeAAro",
 		[]string{"CGO_ENABLED=0"}, `
 rm \
-	crypto/tls/handshake_client_test.go
+	crypto/tls/handshake_client_test.go \
+	os/os_unix_test.go
+echo \
+	'type syscallDescriptor = int' >> \
+	os/rawconn_test.go
 `, t.newGoBootstrap(),
 	)
 
@@ -97,7 +89,11 @@ sed -i \
 
 rm \
 	crypto/tls/handshake_client_test.go \
-	crypto/tls/handshake_server_test.go
+	crypto/tls/handshake_server_test.go \
+	os/os_unix_test.go
+echo \
+	'type syscallDescriptor = int' >> \
+	os/rawconn_test.go
 `, go119,
 	)
 
@@ -118,6 +114,9 @@ sed -i \
 sed -i \
 	's,/lib/ld-musl-`+linuxArch()+`.so.1,/system/bin/linker,' \
 	cmd/link/internal/`+runtime.GOARCH+`/obj.go
+
+rm \
+	os/root_unix_test.go
 `, go123,
 	)
 

internal/rosa/hakurei.go

@@ -4,19 +4,22 @@ import (
 	"hakurei.app/internal/pkg"
 )
 
-func (t Toolchain) newHakurei() pkg.Artifact {
+func (t Toolchain) newHakurei(suffix, script string) pkg.Artifact {
 	const (
-		version  = "0.3.3"
-		checksum = "iMN9qzDB000noZ6dOHh_aSdrhRZPopjyWHd0KFVjxjQLQstAOvLYZEZ74btlL0pu"
+		version  = "0.3.4"
+		checksum = "wVwSLo75a2OnH5tgxNWXR_YhiOJUFnYM_9-sJtxAEOKhcPE0BJafs6PU8o5JzyCT"
 	)
-	return t.New("hakurei-"+version, false, []pkg.Artifact{
+	return t.New("hakurei"+suffix+"-"+version, 0, []pkg.Artifact{
 		t.Load(Go),
+
+		t.Load(Gzip),
 		t.Load(PkgConfig),
 
 		t.Load(KernelHeaders),
 		t.Load(Libseccomp),
 		t.Load(ACL),
 		t.Load(Attr),
+		t.Load(Fuse),
 
 		t.Load(Xproto),
 		t.Load(LibXau),
@@ -29,6 +32,7 @@ func (t Toolchain) newHakurei() pkg.Artifact {
 		t.Load(Wayland),
 		t.Load(WaylandProtocols),
 	}, nil, []string{
+		"CGO_ENABLED=1",
 		"GOCACHE=/tmp/gocache",
 		"CC=clang -O3 -Werror",
 	}, `
@@ -38,32 +42,202 @@ echo
 
 chmod -R +w /usr/src/hakurei
 cd /usr/src/hakurei
-mkdir -p /work/system/{bin,libexec/hakurei}
 
-echo '# Building hakurei.'
-go generate -v ./...
-go build -trimpath -v -o /work/system/libexec/hakurei -ldflags="-s -w
-	-buildid=
-	-extldflags=-static
-	-X hakurei.app/internal/info.buildVersion='v`+version+`'
-	-X hakurei.app/internal/info.hakureiPath=/system/bin/hakurei
-	-X hakurei.app/internal/info.hsuPath=/system/bin/hsu
-	-X main.hakureiPath=/system/bin/hakurei" ./...
-echo
-
-echo '# Testing hakurei.'
-go test -ldflags='-buildid= -extldflags=-static' ./...
-echo
-
-mv \
-	/work/system/libexec/hakurei/{hakurei,hpkg} \
-	/work/system/bin
-`, pkg.Path(AbsUsrSrc.Append("hakurei"), true, pkg.NewHTTPGetTar(
+HAKUREI_VERSION='v`+version+`'
+`+script, pkg.Path(AbsUsrSrc.Append("hakurei"), true, t.NewPatchedSource("hakurei", version, pkg.NewHTTPGetTar(
 		nil, "https://git.gensokyo.uk/security/hakurei/archive/"+
 			"v"+version+".tar.gz",
 		mustDecode(checksum),
 		pkg.TarGzip,
-	)), pkg.Path(AbsUsrSrc.Append("hostname", "main.go"), false, pkg.NewFile(
+	), true, [2]string{"dist", `From 67e453f5c4de915de23ecbe5980e595758f0f2fb Mon Sep 17 00:00:00 2001
+From: Ophestra <cat@gensokyo.uk>
+Date: Tue, 27 Jan 2026 06:49:48 +0900
+Subject: [PATCH] dist: run tests
+
+This used to be impossible due to nix jank which has been addressed.
+
+Signed-off-by: Ophestra <cat@gensokyo.uk>
+---
+ dist/release.sh          | 21 ++++++++++++++++-----
+ flake.nix                | 32 ++++++++++++++++++++------------
+ internal/acl/acl_test.go |  2 +-
+ package.nix              |  2 +-
+ 4 files changed, 38 insertions(+), 19 deletions(-)
+
+diff --git a/dist/release.sh b/dist/release.sh
+index 4dcb278..0ba9104 100755
+--- a/dist/release.sh
++++ b/dist/release.sh
+@@ -2,19 +2,30 @@
+ cd "$(dirname -- "$0")/.."
+ VERSION="${HAKUREI_VERSION:-untagged}"
+ pname="hakurei-${VERSION}"
+-out="dist/${pname}"
++out="${DESTDIR:-dist}/${pname}"
+ 
++echo '# Preparing distribution files.'
+ mkdir -p "${out}"
+ cp -v "README.md" "dist/hsurc.default" "dist/install.sh" "${out}"
+ cp -rv "dist/comp" "${out}"
++echo
+ 
++echo '# Building hakurei.'
+ go generate ./...
+-go build -trimpath -v -o "${out}/bin/" -ldflags "-s -w -buildid= -extldflags '-static'
++go build -trimpath -v -o "${out}/bin/" -ldflags "-s -w
++  -buildid= -extldflags '-static'
+   -X hakurei.app/internal/info.buildVersion=${VERSION}
+   -X hakurei.app/internal/info.hakureiPath=/usr/bin/hakurei
+   -X hakurei.app/internal/info.hsuPath=/usr/bin/hsu
+   -X main.hakureiPath=/usr/bin/hakurei" ./...
++echo
+ 
+-rm -f "./${out}.tar.gz" && tar -C dist -czf "${out}.tar.gz" "${pname}"
+-rm -rf "./${out}"
+-(cd dist && sha512sum "${pname}.tar.gz" > "${pname}.tar.gz.sha512")
++echo '# Testing hakurei.'
++go test -ldflags='-buildid= -extldflags=-static' ./...
++echo
++
++echo '# Creating distribution.'
++rm -f "${out}.tar.gz" && tar -C "${out}/.." -vczf "${out}.tar.gz" "${pname}"
++rm -rf "${out}"
++(cd "${out}/.." && sha512sum "${pname}.tar.gz" > "${pname}.tar.gz.sha512")
++echo
+diff --git a/flake.nix b/flake.nix
+index 9e09c61..2340b92 100644
+--- a/flake.nix
++++ b/flake.nix
+@@ -143,19 +143,27 @@
+             "bin/mount.fuse.sharefs" = "${hakurei}/libexec/sharefs";
+           };
+ 
+-          dist = pkgs.runCommand "${hakurei.name}-dist" { buildInputs = hakurei.targetPkgs ++ [ pkgs.pkgsStatic.musl ]; } ''
+-            # go requires XDG_CACHE_HOME for the build cache
+-            export XDG_CACHE_HOME="$(mktemp -d)"
++          dist =
++            pkgs.runCommand "${hakurei.name}-dist"
++              {
++                buildInputs = hakurei.targetPkgs ++ [
++                  pkgs.pkgsStatic.musl
++                ];
++              }
++              ''
++                cd $(mktemp -d) \
++                    && cp -r ${hakurei.src}/. . \
++                    && chmod +w cmd && cp -r ${hsu.src}/. cmd/hsu/ \
++                    && chmod -R +w .
+ 
+-            # get a different workdir as go does not like /build
+-            cd $(mktemp -d) \
+-                && cp -r ${hakurei.src}/. . \
+-                && chmod +w cmd && cp -r ${hsu.src}/. cmd/hsu/ \
+-                && chmod -R +w .
+-
+-            export HAKUREI_VERSION="v${hakurei.version}"
+-            CC="clang -O3 -Werror" ./dist/release.sh && mkdir $out && cp -v "dist/hakurei-$HAKUREI_VERSION.tar.gz"* $out
+-          '';
++                CC="musl-clang -O3 -Werror -Qunused-arguments" \
++                GOCACHE="$(mktemp -d)" \
++                HAKUREI_TEST_SKIP_ACL=1 \
++                PATH="${pkgs.pkgsStatic.musl.bin}/bin:$PATH" \
++                DESTDIR="$out" \
++                HAKUREI_VERSION="v${hakurei.version}" \
++                  ./dist/release.sh
++              '';
+         }
+       );
+ 
+diff --git a/internal/acl/acl_test.go b/internal/acl/acl_test.go
+index af6da55..19ce45a 100644
+--- a/internal/acl/acl_test.go
++++ b/internal/acl/acl_test.go
+@@ -24,7 +24,7 @@ var (
+ )
+ 
+ func TestUpdate(t *testing.T) {
+-	if os.Getenv("GO_TEST_SKIP_ACL") == "1" {
++	if os.Getenv("HAKUREI_TEST_SKIP_ACL") == "1" {
+ 		t.Skip("acl test skipped")
+ 	}
+ 
+diff --git a/package.nix b/package.nix
+index 00c4401..2eaa2ec 100644
+--- a/package.nix
++++ b/package.nix
+@@ -89,7 +89,7 @@ buildGoModule rec {
+     CC = "clang -O3 -Werror";
+ 
+     # nix build environment does not allow acls
+-    GO_TEST_SKIP_ACL = 1;
++    HAKUREI_TEST_SKIP_ACL = 1;
+   };
+ 
+   buildInputs = [`}, [2]string{"container-tests", `From bf14a412e47344fff2681f4b24d1ecc7415bfcb0 Mon Sep 17 00:00:00 2001
+From: Ophestra <cat@gensokyo.uk>
+Date: Sat, 31 Jan 2026 10:59:56 +0900
+Subject: [PATCH] container: fix host-dependent test cases
+
+These are not fully controlled by hakurei and may change depending on host configuration.
+
+Signed-off-by: Ophestra <cat@gensokyo.uk>
+---
+ container/container_test.go | 27 +++++++++++++++------------
+ 1 file changed, 15 insertions(+), 12 deletions(-)
+
+diff --git a/container/container_test.go b/container/container_test.go
+index d737a18..98713cb 100644
+--- a/container/container_test.go
++++ b/container/container_test.go
+@@ -275,12 +275,12 @@ var containerTestCases = []struct {
+ 		),
+ 		earlyMnt(
+ 			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore),
+-			ent("/null", "/dev/null", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/zero", "/dev/zero", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/full", "/dev/full", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/random", "/dev/random", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/urandom", "/dev/urandom", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/tty", "/dev/tty", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
++			ent("/null", "/dev/null", ignore, "devtmpfs", "devtmpfs", ignore),
++			ent("/zero", "/dev/zero", ignore, "devtmpfs", "devtmpfs", ignore),
++			ent("/full", "/dev/full", ignore, "devtmpfs", "devtmpfs", ignore),
++			ent("/random", "/dev/random", ignore, "devtmpfs", "devtmpfs", ignore),
++			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", "devtmpfs", ignore),
++			ent("/tty", "/dev/tty", ignore, "devtmpfs", "devtmpfs", ignore),
+ 			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
+ 			ent("/", "/dev/mqueue", "rw,nosuid,nodev,noexec,relatime", "mqueue", "mqueue", "rw"),
+ 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
+@@ -293,12 +293,12 @@ var containerTestCases = []struct {
+ 		),
+ 		earlyMnt(
+ 			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore),
+-			ent("/null", "/dev/null", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/zero", "/dev/zero", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/full", "/dev/full", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/random", "/dev/random", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/urandom", "/dev/urandom", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+-			ent("/tty", "/dev/tty", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
++			ent("/null", "/dev/null", ignore, "devtmpfs", "devtmpfs", ignore),
++			ent("/zero", "/dev/zero", ignore, "devtmpfs", "devtmpfs", ignore),
++			ent("/full", "/dev/full", ignore, "devtmpfs", "devtmpfs", ignore),
++			ent("/random", "/dev/random", ignore, "devtmpfs", "devtmpfs", ignore),
++			ent("/urandom", "/dev/urandom", ignore, "devtmpfs", "devtmpfs", ignore),
++			ent("/tty", "/dev/tty", ignore, "devtmpfs", "devtmpfs", ignore),
+ 			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
+ 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
+ 		),
+@@ -696,6 +696,9 @@ func init() {
+ 					mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",relatime")
+ 					mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",noatime")
+ 
++					cur.FsOptstr = strings.Replace(cur.FsOptstr, ",seclabel", "", 1)
++					mnt[i].FsOptstr = strings.Replace(mnt[i].FsOptstr, ",seclabel", "", 1)
++
+ 					if !cur.EqualWithIgnore(mnt[i], "\x00") {
+ 						fail = true
+ 						log.Printf("[FAIL] %s", cur)`}),
+	), pkg.Path(AbsUsrSrc.Append("hostname", "main.go"), false, pkg.NewFile(
 		"hostname.go",
 		[]byte(`
 package main
@@ -80,4 +254,37 @@ func main() {
 `),
 	)))
 }
-func init() { artifactsF[Hakurei] = Toolchain.newHakurei }
+func init() {
+	artifactsF[Hakurei] = func(t Toolchain) pkg.Artifact {
+		return t.newHakurei("", `
+mkdir -p /work/system/libexec/hakurei/
+
+echo '# Building hakurei.'
+go generate -v ./...
+go build -trimpath -v -o /work/system/libexec/hakurei -ldflags="-s -w
+	-buildid=
+	-extldflags=-static
+	-X hakurei.app/internal/info.buildVersion="$HAKUREI_VERSION"
+	-X hakurei.app/internal/info.hakureiPath=/system/bin/hakurei
+	-X hakurei.app/internal/info.hsuPath=/system/bin/hsu
+	-X main.hakureiPath=/system/bin/hakurei" ./...
+echo
+
+echo '# Testing hakurei.'
+go test -ldflags='-buildid= -extldflags=-static' ./...
+echo
+
+mkdir -p /work/system/bin/
+(cd /work/system/libexec/hakurei && mv \
+	hakurei \
+	sharefs \
+	../../bin/)
+`)
+	}
+	artifactsF[HakureiDist] = func(t Toolchain) pkg.Artifact {
+		return t.newHakurei("-dist", `
+export HAKUREI_VERSION
+DESTDIR=/work /usr/src/hakurei/dist/release.sh
+`)
+	}
+}

internal/rosa/kernel.go

@@ -8,7 +8,7 @@ import (
 
 // newKernel is a helper for interacting with Kbuild.
 func (t Toolchain) newKernel(
-	exclusive bool,
+	flag int,
 	patches [][2]string,
 	script string,
 	extra ...pkg.Artifact,
@@ -17,7 +17,7 @@ func (t Toolchain) newKernel(
 		version  = "6.18.5"
 		checksum = "-V1e1WWl7HuePkmm84sSKF7nLuHfUs494uNMzMqXEyxcNE_PUE0FICL0oGWn44mM"
 	)
-	return t.New("kernel-"+version, exclusive, slices.Concat([]pkg.Artifact{
+	return t.New("kernel-"+version, flag, slices.Concat([]pkg.Artifact{
 		t.Load(Make),
 	}, extra), nil, nil, `
 export LLVM=1
@@ -35,7 +35,7 @@ cd /usr/src/linux
 }
 
 func (t Toolchain) newKernelHeaders() pkg.Artifact {
-	return t.newKernel(false, nil, `
+	return t.newKernel(TEarly, nil, `
 make "-j$(nproc)" \
 	INSTALL_HDR_PATH=/work/system \
 	headers_install

internal/rosa/libexpat.go

@@ -11,23 +11,18 @@ func (t Toolchain) newLibexpat() pkg.Artifact {
 		version  = "2.7.3"
 		checksum = "GmkoD23nRi9cMT0cgG1XRMrZWD82UcOMzkkvP1gkwSFWCBgeSXMuoLpa8-v8kxW-"
 	)
-	return t.New("libexpat-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-		t.Load(Bash),
-	}, nil, nil, `
-cd "$(mktemp -d)"
-/usr/src/libexpat/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}" \
-	--enable-static
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("libexpat"), false, pkg.NewHTTPGetTar(
+	return t.NewViaMake("libexpat", version, pkg.NewHTTPGetTar(
 		nil, "https://github.com/libexpat/libexpat/releases/download/"+
 			"R_"+strings.ReplaceAll(version, ".", "_")+"/"+
 			"expat-"+version+".tar.bz2",
 		mustDecode(checksum),
 		pkg.TarBzip2,
-	)))
+	), &MakeAttr{
+		Configure: [][2]string{
+			{"enable-static"},
+		},
+	},
+		t.Load(Bash),
+	)
 }
 func init() { artifactsF[Libexpat] = Toolchain.newLibexpat }

internal/rosa/libffi.go

@@ -7,23 +7,17 @@ func (t Toolchain) newLibffi() pkg.Artifact {
 		version  = "3.4.5"
 		checksum = "apIJzypF4rDudeRoI_n3K7N-zCeBLTbQlHRn9NSAZqdLAWA80mR0gXPTpHsL7oMl"
 	)
-	return t.New("libffi-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-		t.Load(KernelHeaders),
-	}, nil, nil, `
-cd "$(mktemp -d)"
-/usr/src/libffi/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}" \
-	--enable-static
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("libffi"), false, pkg.NewHTTPGetTar(
-		nil,
-		"https://github.com/libffi/libffi/releases/download/"+
+	return t.NewViaMake("libffi", version, pkg.NewHTTPGetTar(
+		nil, "https://github.com/libffi/libffi/releases/download/"+
 			"v"+version+"/libffi-"+version+".tar.gz",
 		mustDecode(checksum),
 		pkg.TarGzip,
-	)))
+	), &MakeAttr{
+		Configure: [][2]string{
+			{"enable-static"},
+		},
+	},
+		t.Load(KernelHeaders),
+	)
 }
 func init() { artifactsF[Libffi] = Toolchain.newLibffi }

internal/rosa/libgd.go

@@ -7,27 +7,24 @@ func (t Toolchain) newLibgd() pkg.Artifact {
 		version  = "2.3.3"
 		checksum = "8T-sh1_FJT9K9aajgxzh8ot6vWIF-xxjcKAHvTak9MgGUcsFfzP8cAvvv44u2r36"
 	)
-	return t.New("libgd-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-
-		t.Load(Zlib),
-	}, nil, []string{
-		"TMPDIR=/dev/shm/gd",
-	}, `
-mkdir /dev/shm/gd
-
-cd "$(mktemp -d)"
-/usr/src/libgd/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}" \
-	--enable-static
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("libgd"), true, pkg.NewHTTPGetTar(
+	return t.NewViaMake("libgd", version, pkg.NewHTTPGetTar(
 		nil, "https://github.com/libgd/libgd/releases/download/"+
 			"gd-"+version+"/libgd-"+version+".tar.gz",
 		mustDecode(checksum),
 		pkg.TarGzip,
-	)))
+	), &MakeAttr{
+		OmitDefaults: true,
+		Env: []string{
+			"TMPDIR=/dev/shm/gd",
+		},
+		ScriptEarly: `
+mkdir /dev/shm/gd
+`,
+		Configure: [][2]string{
+			{"enable-static"},
+		},
+	},
+		t.Load(Zlib),
+	)
 }
 func init() { artifactsF[Libgd] = Toolchain.newLibgd }

internal/rosa/libseccomp.go

@@ -9,28 +9,25 @@ func (t Toolchain) newLibseccomp() pkg.Artifact {
 		version  = "2.6.0"
 		checksum = "mMu-iR71guPjFbb31u-YexBaanKE_nYPjPux-vuBiPfS_0kbwJdfCGlkofaUm-EY"
 	)
-	return t.New("libseccomp-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-		t.Load(Bash),
-		t.Load(Gperf),
-
-		t.Load(KernelHeaders),
-	}, nil, nil, `
-ln -s ../system/bin/bash /bin/bash 
-
-cd "$(mktemp -d)"
-/usr/src/libseccomp/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}" \
-	--enable-static
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("libseccomp"), false, pkg.NewHTTPGetTar(
+	return t.NewViaMake("libseccomp", version, pkg.NewHTTPGetTar(
 		nil,
 		"https://github.com/seccomp/libseccomp/releases/download/"+
 			"v"+version+"/libseccomp-"+version+".tar.gz",
 		mustDecode(checksum),
 		pkg.TarGzip,
-	)))
+	), &MakeAttr{
+		ScriptEarly: `
+ln -s ../system/bin/bash /bin/
+`,
+		Configure: [][2]string{
+			{"enable-static"},
+		},
+	},
+		t.Load(Bash),
+		t.Load(Diffutils),
+		t.Load(Gperf),
+
+		t.Load(KernelHeaders),
+	)
 }
 func init() { artifactsF[Libseccomp] = Toolchain.newLibseccomp }

internal/rosa/libxml2.go

@@ -11,25 +11,24 @@ func (t Toolchain) newLibxml2() pkg.Artifact {
 		version  = "2.15.1"
 		checksum = "pYzAR3cNrEHezhEMirgiq7jbboLzwMj5GD7SQp0jhSIMdgoU4G9oU9Gxun3zzUIU"
 	)
-	return t.New("libxml2-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-	}, nil, nil, `
-cd /usr/src/
-tar xf libxml2.tar.xz
-mv libxml2-`+version+` libxml2
-
-cd "$(mktemp -d)"
-/usr/src/libxml2/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}" \
-	--enable-static
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("libxml2.tar.xz"), false, pkg.NewHTTPGet(
+	return t.NewViaMake("libxml2", version, pkg.NewHTTPGet(
 		nil, "https://download.gnome.org/sources/libxml2/"+
 			strings.Join(strings.Split(version, ".")[:2], ".")+
 			"/libxml2-"+version+".tar.xz",
 		mustDecode(checksum),
-	)))
+	), &MakeAttr{
+		ScriptEarly: `
+cd /usr/src/
+tar xf libxml2.tar.xz
+mv libxml2-` + version + ` libxml2
+`,
+		Configure: [][2]string{
+			{"enable-static"},
+		},
+		SourceSuffix: ".tar.xz",
+	},
+		t.Load(Diffutils),
+		t.Load(XZ),
+	)
 }
 func init() { artifactsF[Libxml2] = Toolchain.newLibxml2 }

internal/rosa/llvm.go

@@ -180,16 +180,6 @@ cp -r /system/include /usr/include && rm -rf /system/include
 	), &CMakeAttr{
 		Cache:  slices.Concat(cache, attr.cmake),
 		Append: cmakeAppend,
-		Extra: stage3Concat(t, attr.extra,
-			t.Load(Libffi),
-			t.Load(Python),
-			t.Load(Perl),
-			t.Load(Diffutils),
-			t.Load(Bash),
-			t.Load(Coreutils),
-
-			t.Load(KernelHeaders),
-		),
 		Prefix: attr.prefix,
 
 		Env: slices.Concat([]string{
@@ -198,8 +188,19 @@ cp -r /system/include /usr/include && rm -rf /system/include
 		}, attr.env),
 		ScriptEarly: scriptEarly, Script: script + attr.script,
 
-		Exclusive: true,
-	})
+		Flag: TExclusive,
+	}, stage3Concat(t, attr.extra,
+		t.Load(Libffi),
+		t.Load(Python),
+		t.Load(Perl),
+		t.Load(Diffutils),
+		t.Load(Bash),
+		t.Load(Gawk),
+		t.Load(Coreutils),
+		t.Load(Findutils),
+
+		t.Load(KernelHeaders),
+	)...)
 }
 
 // newLLVM returns LLVM toolchain across multiple [pkg.Artifact].
@@ -208,6 +209,8 @@ func (t Toolchain) newLLVM() (musl, compilerRT, runtimes, clang pkg.Artifact) {
 	switch runtime.GOARCH {
 	case "386", "amd64":
 		target = "X86"
+	case "arm64":
+		target = "AArch64"
 
 	default:
 		panic("unsupported target " + runtime.GOARCH)
@@ -229,6 +232,7 @@ func (t Toolchain) newLLVM() (musl, compilerRT, runtimes, clang pkg.Artifact) {
 
 			{"COMPILER_RT_BUILD_BUILTINS", "ON"},
 			{"COMPILER_RT_DEFAULT_TARGET_ONLY", "ON"},
+			{"COMPILER_RT_SANITIZERS_TO_BUILD", "asan"},
 			{"LLVM_ENABLE_PER_TARGET_RUNTIME_DIR", "ON"},
 
 			// does not work without libunwind
@@ -236,7 +240,6 @@ func (t Toolchain) newLLVM() (musl, compilerRT, runtimes, clang pkg.Artifact) {
 			{"COMPILER_RT_BUILD_LIBFUZZER", "OFF"},
 			{"COMPILER_RT_BUILD_MEMPROF", "OFF"},
 			{"COMPILER_RT_BUILD_PROFILE", "OFF"},
-			{"COMPILER_RT_BUILD_SANITIZERS", "OFF"},
 			{"COMPILER_RT_BUILD_XRAY", "OFF"},
 		},
 		append: []string{"compiler-rt"},
@@ -253,10 +256,10 @@ ln -s \
 	"${ROSA_INSTALL_PREFIX}/lib/clang/21/lib/"
 
 ln -s \
-	"clang_rt.crtbegin-$(uname -m).o" \
+	"clang_rt.crtbegin-` + linuxArch() + `.o" \
 	"${ROSA_INSTALL_PREFIX}/lib/${ROSA_TRIPLE}/crtbeginS.o"
 ln -s \
-	"clang_rt.crtend-$(uname -m).o" \
+	"clang_rt.crtend-` + linuxArch() + `.o" \
 	"${ROSA_INSTALL_PREFIX}/lib/${ROSA_TRIPLE}/crtendS.o"
 `,
 	})

internal/rosa/make.go

@@ -0,0 +1,160 @@
+package rosa
+
+import (
+	"slices"
+	"strings"
+
+	"hakurei.app/internal/pkg"
+)
+
+func (t Toolchain) newMake() pkg.Artifact {
+	const (
+		version  = "4.4.1"
+		checksum = "YS_B07ZcAy9PbaK5_vKGj64SrxO2VMpnMKfc9I0Q9IC1rn0RwOH7802pJoj2Mq4a"
+	)
+	return t.New("make-"+version, TEarly, nil, nil, nil, `
+cd "$(mktemp -d)"
+/usr/src/make/configure \
+	--prefix=/system \
+	--build="${ROSA_TRIPLE}" \
+	--disable-dependency-tracking
+./build.sh
+./make DESTDIR=/work install check
+`, pkg.Path(AbsUsrSrc.Append("make"), false, pkg.NewHTTPGetTar(
+		nil, "https://ftpmirror.gnu.org/gnu/make/make-"+version+".tar.gz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	)))
+}
+func init() { artifactsF[Make] = Toolchain.newMake }
+
+// MakeAttr holds the project-specific attributes that will be applied to a new
+// [pkg.Artifact] compiled via [Make].
+type MakeAttr struct {
+	// Mount the source tree writable.
+	Writable bool
+
+	// Do not include default extras.
+	OmitDefaults bool
+	// Dependencies not provided by stage3.
+	NonStage3 []pkg.Artifact
+
+	// Additional environment variables.
+	Env []string
+	// Runs before cmake.
+	ScriptEarly string
+	// Runs after cmake.
+	Script string
+
+	// Remain in working directory set up during ScriptEarly.
+	InPlace bool
+
+	// Flags passed to the configure script.
+	Configure [][2]string
+	// Extra make targets.
+	Make []string
+	// Target triple, zero value is equivalent to the Rosa OS triple.
+	Build string
+	// Whether to skip the check target.
+	SkipCheck bool
+	// Name of the check target, zero value is equivalent to "check".
+	CheckName string
+
+	// Suffix appended to the source pathname.
+	SourceSuffix string
+
+	// Passed through to [Toolchain.New].
+	Flag int
+}
+
+// NewViaMake returns a [pkg.Artifact] for compiling and installing via [Make].
+func (t Toolchain) NewViaMake(
+	name, version string,
+	source pkg.Artifact,
+	attr *MakeAttr,
+	extra ...pkg.Artifact,
+) pkg.Artifact {
+	if name == "" || version == "" {
+		panic("names must be non-empty")
+	}
+	if attr == nil {
+		attr = new(MakeAttr)
+	}
+	build := `"${ROSA_TRIPLE}"`
+	if attr.Build != "" {
+		build = attr.Build
+	}
+
+	var configureFlags string
+	if len(attr.Configure) > 0 {
+		const sep = " \\\n\t"
+		configureFlags += sep + strings.Join(
+			slices.Collect(func(yield func(string) bool) {
+				for _, v := range attr.Configure {
+					s := v[0]
+					if v[1] == "" || (v[0] != "" &&
+						v[0][0] >= 'a' &&
+						v[0][0] <= 'z') {
+						s = "--" + s
+					}
+					if v[1] != "" {
+						s += "=" + v[1]
+					}
+					if !yield(s) {
+						return
+					}
+				}
+			}),
+			sep,
+		)
+	}
+
+	var buildFlag string
+	if attr.Build != `""` {
+		buildFlag = ` \
+	--build=` + build
+	}
+
+	makeTargets := make([]string, 1, 2+len(attr.Make))
+	if !attr.SkipCheck {
+		if attr.CheckName == "" {
+			makeTargets = append(makeTargets, "check")
+		} else {
+			makeTargets = append(makeTargets, attr.CheckName)
+		}
+	}
+	makeTargets = append(makeTargets, attr.Make...)
+	if len(makeTargets) == 1 {
+		makeTargets = nil
+	}
+
+	finalExtra := []pkg.Artifact{
+		t.Load(Make),
+	}
+	if attr.OmitDefaults || attr.Flag&TEarly == 0 {
+		finalExtra = append(finalExtra,
+			t.Load(Gawk),
+			t.Load(Coreutils),
+		)
+	}
+	finalExtra = append(finalExtra, extra...)
+
+	scriptEarly := attr.ScriptEarly
+	if !attr.InPlace {
+		scriptEarly += "\ncd \"$(mktemp -d)\""
+	} else if scriptEarly == "" {
+		panic("cannot remain in root")
+	}
+
+	return t.New(name+"-"+version, attr.Flag, stage3Concat(t,
+		attr.NonStage3,
+		finalExtra...,
+	), nil, attr.Env, scriptEarly+`
+/usr/src/`+name+`/configure \
+	--prefix=/system`+buildFlag+configureFlags+`
+make "-j$(nproc)"`+strings.Join(makeTargets, " ")+`
+make DESTDIR=/work install
+`+attr.Script, pkg.Path(AbsUsrSrc.Append(
+		name+attr.SourceSuffix,
+	), attr.Writable, source))
+}

internal/rosa/meson.go

@@ -7,7 +7,7 @@ func (t Toolchain) newMeson() pkg.Artifact {
 		version  = "1.10.1"
 		checksum = "w895BXF_icncnXatT_OLCFe2PYEtg4KrKooMgUYdN-nQVvbFX3PvYWHGEpogsHtd"
 	)
-	return t.New("meson-"+version, false, []pkg.Artifact{
+	return t.New("meson-"+version, 0, []pkg.Artifact{
 		t.Load(Python),
 		t.Load(Setuptools),
 	}, nil, nil, `

internal/rosa/mksh.go

@@ -0,0 +1,36 @@
+package rosa
+
+import "hakurei.app/internal/pkg"
+
+func (t Toolchain) newMksh() pkg.Artifact {
+	const (
+		version  = "59c"
+		checksum = "0Zj-k4nXEu3IuJY4lvwD2OrC2t27GdZj8SPy4DoaeuBRH1padWb7oREpYgwY8JNq"
+	)
+	return t.New("mksh-"+version, 0, stage3Concat(t, []pkg.Artifact{},
+		t.Load(Perl),
+		t.Load(Coreutils),
+	), nil, []string{
+		"LDSTATIC=-static",
+		"CPPFLAGS=-DMKSH_DEFAULT_PROFILEDIR=\\\"/system/etc\\\"",
+	}, `
+cd "$(mktemp -d)"
+sh /usr/src/mksh/Build.sh -r
+CPPFLAGS="${CPPFLAGS} -DMKSH_BINSHPOSIX -DMKSH_BINSHREDUCED" \
+sh /usr/src/mksh/Build.sh -r -L
+./test.sh -C regress:no-ctty
+
+mkdir -p /work/system/bin/
+cp -v mksh /work/system/bin/
+cp -v lksh /work/system/bin/sh
+
+mkdir -p /work/bin/
+ln -vs ../system/bin/sh /work/bin/
+`, pkg.Path(AbsUsrSrc.Append("mksh"), false, pkg.NewHTTPGetTar(
+		nil,
+		"https://mbsd.evolvis.org/MirOS/dist/mir/mksh/mksh-R"+version+".tgz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	)))
+}
+func init() { artifactsF[Mksh] = Toolchain.newMksh }

internal/rosa/musl.go

@@ -30,7 +30,7 @@ func (t Toolchain) NewMusl(attr *MuslAttr) pkg.Artifact {
 	target := "install"
 	script := `
 mkdir -p /work/system/bin
-COMPAT_LINKER_NAME="ld-musl-$(uname -m).so.1"
+COMPAT_LINKER_NAME="ld-musl-` + linuxArch() + `.so.1"
 ln -vs ../lib/libc.so /work/system/bin/linker
 ln -vs ../lib/libc.so /work/system/bin/ldd
 ln -vs libc.so "/work/system/lib/${COMPAT_LINKER_NAME}"
@@ -42,23 +42,23 @@ rmdir -v /work/lib
 		script = ""
 	}
 
-	return t.New("musl-"+version, false, stage3Concat(t, attr.Extra,
+	return t.New("musl-"+version, 0, stage3Concat(t, attr.Extra,
 		t.Load(Make),
+		t.Load(Coreutils),
 	), nil, slices.Concat([]string{
 		"ROSA_MUSL_TARGET=" + target,
 	}, attr.Env), `
-# expected to be writable in copies
-chmod -R +w /usr/src/musl/
-
 cd "$(mktemp -d)"
 /usr/src/musl/configure \
 	--prefix=/system \
 	--target="${ROSA_TRIPLE}"
 make "-j$(nproc)" DESTDIR=/work "${ROSA_MUSL_TARGET}"
-`+script, pkg.Path(AbsUsrSrc.Append("musl"), true, pkg.NewHTTPGetTar(
-		nil,
-		"https://musl.libc.org/releases/musl-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+`+script, pkg.Path(AbsUsrSrc.Append("musl"), false, t.NewPatchedSource(
+		// expected to be writable in copies
+		"musl", version, pkg.NewHTTPGetTar(
+			nil, "https://musl.libc.org/releases/musl-"+version+".tar.gz",
+			mustDecode(checksum),
+			pkg.TarGzip,
+		), false,
 	)))
 }

internal/rosa/ninja.go

@@ -7,29 +7,33 @@ func (t Toolchain) newNinja() pkg.Artifact {
 		version  = "1.13.2"
 		checksum = "ygKWMa0YV2lWKiFro5hnL-vcKbc_-RACZuPu0Io8qDvgQlZ0dxv7hPNSFkt4214v"
 	)
-	return t.New("ninja-"+version, false, []pkg.Artifact{
+	return t.New("ninja-"+version, 0, []pkg.Artifact{
 		t.Load(CMake),
 		t.Load(Python),
+		t.Load(Bash),
 	}, nil, nil, `
-chmod -R +w /usr/src/ninja/
-mkdir -p /work/system/bin/ && cd /work/system/bin/
+cd "$(mktemp -d)"
 python3 /usr/src/ninja/configure.py \
 	--bootstrap \
 	--gtest-source-dir=/usr/src/googletest
 ./ninja all
 ./ninja_test
+
+mkdir -p /work/system/bin/
+cp ninja /work/system/bin/
 `, pkg.Path(AbsUsrSrc.Append("googletest"), false,
 		pkg.NewHTTPGetTar(
 			nil, "https://github.com/google/googletest/releases/download/"+
 				"v1.16.0/googletest-1.16.0.tar.gz",
 			mustDecode("NjLGvSbgPy_B-y-o1hdanlzEzaYeStFcvFGxpYV3KYlhrWWFRcugYhM3ZMzOA9B_"),
 			pkg.TarGzip,
-		)), pkg.Path(AbsUsrSrc.Append("ninja"), true,
-		pkg.NewHTTPGetTar(
+		)), pkg.Path(AbsUsrSrc.Append("ninja"), true, t.NewPatchedSource(
+		"ninja", version, pkg.NewHTTPGetTar(
 			nil, "https://github.com/ninja-build/ninja/archive/refs/tags/"+
 				"v"+version+".tar.gz",
 			mustDecode(checksum),
 			pkg.TarGzip,
-		)))
+		), false,
+	)))
 }
 func init() { artifactsF[Ninja] = Toolchain.newNinja }

internal/rosa/perl.go

@@ -7,12 +7,13 @@ func (t Toolchain) newPerl() pkg.Artifact {
 		version  = "5.42.0"
 		checksum = "2KR7Jbpk-ZVn1a30LQRwbgUvg2AXlPQZfzrqCr31qD5-yEsTwVQ_W76eZH-EdxM9"
 	)
-	return t.New("perl-"+version, false, []pkg.Artifact{
+	return t.New("perl-"+version, TEarly, []pkg.Artifact{
 		t.Load(Make),
 	}, nil, nil, `
-chmod -R +w /usr/src/perl && cd /usr/src/perl
+cd /usr/src/perl
 
 echo 'print STDOUT "1..0 # Skip broken test\n";' > ext/Pod-Html/t/htmldir3.t
+rm -f /system/bin/ps # perl does not like toybox ps
 
 ./Configure \
 	-des \
@@ -27,11 +28,12 @@ make \
 	TEST_JOBS=256 \
 	test_harness
 make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("perl"), true, pkg.NewHTTPGetTar(
-		nil,
-		"https://www.cpan.org/src/5.0/perl-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+`, pkg.Path(AbsUsrSrc.Append("perl"), true, t.NewPatchedSource(
+		"perl", version, pkg.NewHTTPGetTar(
+			nil, "https://www.cpan.org/src/5.0/perl-"+version+".tar.gz",
+			mustDecode(checksum),
+			pkg.TarGzip,
+		), false,
 	)))
 }
 func init() { artifactsF[Perl] = Toolchain.newPerl }

internal/rosa/pkg-config.go

@@ -7,23 +7,17 @@ func (t Toolchain) newPkgConfig() pkg.Artifact {
 		version  = "0.29.2"
 		checksum = "gi7yAvkwo20Inys1tHbeYZ3Wjdm5VPkrnO0Q6_QZPCAwa1zrA8F4a63cdZDd-717"
 	)
-	return t.New("pkg-config-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-	}, nil, nil, `
-cd "$(mktemp -d)"
-/usr/src/pkg-config/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}" \
-	CFLAGS='-Wno-int-conversion' \
-	--with-internal-glib
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("pkg-config"), true, pkg.NewHTTPGetTar(
+	return t.NewViaMake("pkg-config", version, pkg.NewHTTPGetTar(
 		nil,
 		"https://pkgconfig.freedesktop.org/releases/"+
 			"pkg-config-"+version+".tar.gz",
 		mustDecode(checksum),
 		pkg.TarGzip,
-	)))
+	), &MakeAttr{
+		Configure: [][2]string{
+			{"CFLAGS", "'-Wno-int-conversion'"},
+			{"with-internal-glib"},
+		},
+	})
 }
 func init() { artifactsF[PkgConfig] = Toolchain.newPkgConfig }

internal/rosa/python.go

@@ -1,6 +1,7 @@
 package rosa
 
 import (
+	"slices"
 	"strings"
 
 	"hakurei.app/internal/pkg"
@@ -11,65 +12,81 @@ func (t Toolchain) newPython() pkg.Artifact {
 		version  = "3.14.2"
 		checksum = "7nZunVMGj0viB-CnxpcRego2C90X5wFsMTgsoewd5z-KSZY2zLuqaBwG-14zmKys"
 	)
-	skipTests := []string{
-		// requires internet access (http://www.pythontest.net/)
-		"test_asyncio",
-		"test_socket",
-		"test_urllib2",
-		"test_urllibnet",
-		"test_urllib2net",
+	return t.NewViaMake("python", version, t.NewPatchedSource("python", version, pkg.NewHTTPGetTar(
+		nil, "https://www.python.org/ftp/python/"+version+
+			"/Python-"+version+".tgz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	), false), &MakeAttr{
+		// test_synopsis_sourceless assumes this is writable and checks __pycache__
+		Writable: true,
 
-		// makes assumptions about uid_map/gid_map
-		"test_os",
-		"test_subprocess",
+		Env: []string{
+			"EXTRATESTOPTS=-j0 -x " + strings.Join([]string{
+				// requires internet access (http://www.pythontest.net/)
+				"test_asyncio",
+				"test_socket",
+				"test_urllib2",
+				"test_urllibnet",
+				"test_urllib2net",
 
-		// somehow picks up mtime of source code
-		"test_zipfile",
+				// makes assumptions about uid_map/gid_map
+				"test_os",
+				"test_subprocess",
 
-		// requires gcc
-		"test_ctypes",
+				// somehow picks up mtime of source code
+				"test_zipfile",
 
-		// breaks on llvm
-		"test_dbm_gnu",
-	}
-	return t.New("python-"+version, false, []pkg.Artifact{
-		t.Load(Make),
+				// requires gcc
+				"test_ctypes",
+
+				// breaks on llvm
+				"test_dbm_gnu",
+			}, " -x "),
+
+			// _ctypes appears to infer something from the linker name
+			"LDFLAGS=-Wl,--dynamic-linker=/system/lib/" +
+				"ld-musl-" + linuxArch() + ".so.1",
+		},
+
+		ScriptEarly: `
+export HOME="$(mktemp -d)"
+`,
+
+		CheckName: "test",
+	},
 		t.Load(Zlib),
 		t.Load(Libffi),
-	}, nil, []string{
-		"EXTRATESTOPTS=-j0 -x " + strings.Join(skipTests, " -x "),
-
-		// _ctypes appears to infer something from the linker name
-		"LDFLAGS=-Wl,--dynamic-linker=/system/lib/" +
-			"ld-musl-" + linuxArch() + ".so.1",
-	}, `
-# test_synopsis_sourceless assumes this is writable and checks __pycache__
-chmod -R +w /usr/src/python/
-
-export HOME="$(mktemp -d)"
-cd "$(mktemp -d)"
-/usr/src/python/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}"
-make "-j$(nproc)"
-make test
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("python"), true,
-		pkg.NewHTTPGetTar(
-			nil, "https://www.python.org/ftp/python/"+version+
-				"/Python-"+version+".tgz",
-			mustDecode(checksum),
-			pkg.TarGzip,
-		)))
+	)
 }
 func init() { artifactsF[Python] = Toolchain.newPython }
 
+// newViaPip is a helper for installing python dependencies via pip.
+func (t Toolchain) newViaPip(
+	name, version, abi, platform, checksum, prefix string,
+	extra ...pkg.Artifact,
+) pkg.Artifact {
+	wname := name + "-" + version + "-py3-" + abi + "-" + platform + ".whl"
+	return t.New(name+"-"+version, 0, slices.Concat([]pkg.Artifact{
+		t.Load(Python),
+	}, extra), nil, nil, `
+pip3 install \
+	--no-index \
+	--prefix=/system \
+	--root=/work \
+	/usr/src/`+wname+`
+`, pkg.Path(AbsUsrSrc.Append(wname), false, pkg.NewHTTPGet(
+		nil, prefix+wname,
+		mustDecode(checksum),
+	)))
+}
+
 func (t Toolchain) newSetuptools() pkg.Artifact {
 	const (
 		version  = "80.10.1"
 		checksum = "p3rlwEmy1krcUH1KabprQz1TCYjJ8ZUjOQknQsWh3q-XEqLGEd3P4VrCc7ouHGXU"
 	)
-	return t.New("setuptools-"+version, false, []pkg.Artifact{
+	return t.New("setuptools-"+version, 0, []pkg.Artifact{
 		t.Load(Python),
 	}, nil, nil, `
 pip3 install \
@@ -85,3 +102,50 @@ pip3 install \
 	)))
 }
 func init() { artifactsF[Setuptools] = Toolchain.newSetuptools }
+
+func (t Toolchain) newPygments() pkg.Artifact {
+	return t.newViaPip("pygments", "2.19.2", "none", "any",
+		"ak_lwTalmSr7W4Mjy2XBZPG9I6a0gwSy2pS87N8x4QEuZYif0ie9z0OcfRfi9msd",
+		"https://files.pythonhosted.org/packages/"+
+			"c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/")
+}
+func init() { artifactsF[Pygments] = Toolchain.newPygments }
+
+func (t Toolchain) newPluggy() pkg.Artifact {
+	return t.newViaPip("pluggy", "1.6.0", "none", "any",
+		"2HWYBaEwM66-y1hSUcWI1MyE7dVVuNNRW24XD6iJBey4YaUdAK8WeXdtFMQGC-4J",
+		"https://files.pythonhosted.org/packages/"+
+			"54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/")
+}
+func init() { artifactsF[Pluggy] = Toolchain.newPluggy }
+
+func (t Toolchain) newPackaging() pkg.Artifact {
+	return t.newViaPip("packaging", "26.0", "none", "any",
+		"iVVXcqdwHDskPKoCFUlh2x8J0Gyq-bhO4ns9DvUJ7oJjeOegRYtSIvLV33Bki-pP",
+		"https://files.pythonhosted.org/packages/"+
+			"b7/b9/c538f279a4e237a006a2c98387d081e9eb060d203d8ed34467cc0f0b9b53/")
+}
+func init() { artifactsF[Packaging] = Toolchain.newPackaging }
+
+func (t Toolchain) newIniConfig() pkg.Artifact {
+	const version = "2.3.0"
+	return t.newViaPip("iniconfig", version, "none", "any",
+		"SDgs4S5bXi77aVOeKTPv2TUrS3M9rduiK4DpU0hCmDsSBWqnZcWInq9lsx6INxut",
+		"https://github.com/pytest-dev/iniconfig/releases/download/"+
+			"v"+version+"/")
+}
+func init() { artifactsF[IniConfig] = Toolchain.newIniConfig }
+
+func (t Toolchain) newPyTest() pkg.Artifact {
+	const version = "9.0.2"
+	return t.newViaPip("pytest", version, "none", "any",
+		"IM2wDbLke1EtZhF92zvAjUl_Hms1uKDtM7U8Dt4acOaChMnDg1pW7ib8U0wYGDLH",
+		"https://github.com/pytest-dev/pytest/releases/download/"+
+			version+"/",
+		t.Load(IniConfig),
+		t.Load(Packaging),
+		t.Load(Pluggy),
+		t.Load(Pygments),
+	)
+}
+func init() { artifactsF[PyTest] = Toolchain.newPyTest }

internal/rosa/rosa.go

@@ -49,6 +49,8 @@ func linuxArch() string {
 	switch runtime.GOARCH {
 	case "amd64":
 		return "x86_64"
+	case "arm64":
+		return "aarch64"
 
 	default:
 		panic("unsupported target " + runtime.GOARCH)
@@ -173,10 +175,17 @@ func fixupEnviron(env, extras []string, paths ...string) []string {
 // build script under.
 var absCureScript = fhs.AbsUsrBin.Append(".cure-script")
 
+const (
+	// TExclusive denotes an exclusive [pkg.Artifact].
+	TExclusive = 1 << iota
+	// TEarly hints for an early variant of [Toybox] to be used when available.
+	TEarly
+)
+
 // New returns a [pkg.Artifact] compiled on this toolchain.
 func (t Toolchain) New(
 	name string,
-	exclusive bool,
+	flag int,
 	extra []pkg.Artifact,
 	checksum *pkg.Checksum,
 	env []string,
@@ -187,27 +196,37 @@ func (t Toolchain) New(
 	const lcMessages = "LC_MESSAGES=C.UTF-8"
 
 	var (
-		path    = AbsSystem.Append("bin", "busybox")
-		args    = []string{"hush", absCureScript.String()}
+		path    = AbsSystem.Append("bin", "sh")
+		args    = []string{"sh", absCureScript.String()}
 		support []pkg.Artifact
 	)
 	switch t {
 	case toolchainBusybox:
 		name += "-early"
 		support = slices.Concat([]pkg.Artifact{newBusyboxBin()}, extra)
+		path = AbsSystem.Append("bin", "busybox")
+		args[0] = "hush"
 		env = fixupEnviron(env, nil, "/system/bin")
 
 	case toolchainStage3:
 		name += "-boot"
-		const (
-			version  = "20260111T160052Z"
+		var version, checksum string
+		switch runtime.GOARCH {
+		case "amd64":
+			version = "20260111T160052Z"
 			checksum = "c5_FwMnRN8RZpTdBLGYkL4RR8ampdaZN2JbkgrFLe8-QHQAVQy08APVvIL6eT7KW"
-		)
+		case "arm64":
+			version = "20260125T234618Z"
+			checksum = "79uRbRI44PyknQQ9RlFUQrwqplup7vImiIk6klefL8TN-fT42TXMS_v4XszwexCb"
+
+		default:
+			panic("unsupported target " + runtime.GOARCH)
+		}
 		path = fhs.AbsRoot.Append("bin", "bash")
 		args[0] = "bash"
 		support = slices.Concat([]pkg.Artifact{
 			cureEtc{},
-			toolchainBusybox.New("stage3-"+version, false, nil, nil, nil, `
+			toolchainBusybox.New("stage3-"+version, 0, nil, nil, nil, `
 tar -C /work -xf /usr/src/stage3.tar.xz
 rm -rf /work/dev/ /work/proc/
 ln -vs ../usr/bin /work/bin
@@ -236,13 +255,18 @@ ln -vs ../usr/bin /work/bin
 
 		boot := t - 1
 		musl, compilerRT, runtimes, clang := boot.NewLLVM()
+		toybox := Toybox
+		if flag&TEarly != 0 {
+			toybox = toyboxEarly
+		}
 		support = slices.Concat(extra, []pkg.Artifact{
 			cureEtc{newIANAEtc()},
 			musl,
 			compilerRT,
 			runtimes,
 			clang,
-			boot.Load(Busybox),
+			boot.Load(Mksh),
+			boot.Load(toybox),
 		})
 		env = fixupEnviron(env, []string{
 			EnvTriplet + "=" + triplet(),
@@ -259,7 +283,7 @@ ln -vs ../usr/bin /work/bin
 	}
 
 	return pkg.NewExec(
-		name, checksum, pkg.ExecTimeoutMax, exclusive,
+		name, checksum, pkg.ExecTimeoutMax, flag&TExclusive != 0,
 		fhs.AbsRoot, env,
 		path, args,
 
@@ -308,7 +332,7 @@ cat /usr/src/` + name + `-patches/* | \
 `
 		aname += "-patched"
 	}
-	return t.New(aname, false, stage3Concat(t, []pkg.Artifact{},
+	return t.New(aname, 0, stage3Concat(t, []pkg.Artifact{},
 		t.Load(Patch),
 	), nil, nil, script, paths...)
 }

internal/rosa/rsync.go

@@ -7,23 +7,25 @@ func (t Toolchain) newRsync() pkg.Artifact {
 		version  = "3.4.1"
 		checksum = "VBlTsBWd9z3r2-ex7GkWeWxkUc5OrlgDzikAC0pK7ufTjAJ0MbmC_N04oSVTGPiv"
 	)
-	return t.New("rsync-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-	}, nil, nil, `
-cd "$(mktemp -d)"
-/usr/src/rsync/configure --prefix=/system \
-	--build="${ROSA_TRIPLE}" \
-	--disable-openssl \
-	--disable-xxhash \
-	--disable-zstd \
-	--disable-lz4
-make "-j${nproc}"
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("rsync"), false, pkg.NewHTTPGetTar(
-		nil,
-		"https://download.samba.org/pub/rsync/src/rsync-"+version+".tar.gz",
+	return t.NewViaMake("rsync", version, pkg.NewHTTPGetTar(
+		nil, "https://download.samba.org/pub/rsync/src/"+
+			"rsync-"+version+".tar.gz",
 		mustDecode(checksum),
 		pkg.TarGzip,
-	)))
+	), &MakeAttr{
+		Configure: [][2]string{
+			{"disable-openssl"},
+			{"disable-xxhash"},
+			{"disable-zstd"},
+			{"disable-lz4"},
+		},
+
+		// circular dependency
+		SkipCheck: true,
+
+		Flag: TEarly,
+	},
+		t.Load(Gawk),
+	)
 }
 func init() { artifactsF[Rsync] = Toolchain.newRsync }

internal/rosa/ssl.go

@@ -0,0 +1,80 @@
+package rosa
+
+import (
+	"hakurei.app/internal/pkg"
+)
+
+func (t Toolchain) newNSS() pkg.Artifact {
+	const (
+		version  = "3_120"
+		checksum = "9M0SNMrj9BJp6RH2rQnMm6bZWtP0Kgj64D5JNPHF7Cxr2_8kfy3msubIcvEPwC35"
+
+		version0  = "4_38_2"
+		checksum0 = "25x2uJeQnOHIiq_zj17b4sYqKgeoU8-IsySUptoPcdHZ52PohFZfGuIisBreWzx0"
+	)
+	return t.New("nss-"+version, 0, []pkg.Artifact{
+		t.Load(Make),
+		t.Load(Perl),
+		t.Load(Python),
+
+		t.Load(Zlib),
+		t.Load(KernelHeaders),
+	}, nil, nil, `
+unzip /usr/src/nspr.zip -d /usr/src
+mv '/usr/src/nspr-NSPR_`+version0+`_RTM' /usr/src/nspr
+
+chmod -R +w /usr/src/nss
+cd /usr/src/nss
+
+make \
+	"-j$(nproc)" \
+	CCC="clang++" \
+	NSDISTMODE=copy \
+	BUILD_OPT=1 \
+	USE_64=1 \
+	nss_build_all
+mkdir -p /work/system/nss
+cp -r \
+	/usr/src/dist/. \
+	lib/ckfw/builtins/certdata.txt \
+	/work/system/nss
+`, pkg.Path(AbsUsrSrc.Append("nss"), true, pkg.NewHTTPGetTar(
+		nil, "https://github.com/nss-dev/nss/archive/refs/tags/"+
+			"NSS_"+version+"_RTM.tar.gz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	)), pkg.Path(AbsUsrSrc.Append("nspr.zip"), false, pkg.NewHTTPGet(
+		nil, "https://hg-edge.mozilla.org/projects/nspr/archive/"+
+			"NSPR_"+version0+"_RTM.zip",
+		mustDecode(checksum0),
+	)))
+}
+func init() { artifactsF[NSS] = Toolchain.newNSS }
+
+func (t Toolchain) newBuildCATrust() pkg.Artifact {
+	const version = "0.4.0"
+	return t.newViaPip("buildcatrust", version, "none", "any",
+		"k_FGzkRCLjbTWBkuBLzQJ1S8FPAz19neJZlMHm0t10F2Y0hElmvVwdSBRc03Rjo1",
+		"https://github.com/nix-community/buildcatrust/"+
+			"releases/download/v"+version+"/")
+}
+func init() { artifactsF[buildcatrust] = Toolchain.newBuildCATrust }
+
+func (t Toolchain) newNSSCACert() pkg.Artifact {
+	return t.New("nss-cacert", 0, []pkg.Artifact{
+		t.Load(Python),
+
+		t.Load(NSS),
+		t.Load(buildcatrust),
+	}, nil, nil, `
+mkdir -p /work/etc/ssl/{certs/unbundled,certs/hashed,trust-source}
+buildcatrust \
+	--certdata_input /system/nss/certdata.txt \
+	--ca_bundle_output /work/etc/ssl/certs/ca-bundle.crt \
+	--ca_standard_bundle_output /work/etc/ssl/certs/ca-no-trust-rules-bundle.crt \
+	--ca_unpacked_output /work/etc/ssl/certs/unbundled \
+	--ca_hashed_unpacked_output /work/etc/ssl/certs/hashed \
+	--p11kit_output /work/etc/ssl/trust-source/ca-bundle.trust.p11-kit
+`)
+}
+func init() { artifactsF[NSSCACert] = Toolchain.newNSSCACert }

internal/rosa/toybox.go

@@ -0,0 +1,64 @@
+package rosa
+
+import "hakurei.app/internal/pkg"
+
+func (t Toolchain) newToybox(suffix, script string) pkg.Artifact {
+	const (
+		version  = "0.8.13"
+		checksum = "rZ1V1ATDte2WeQZanxLVoiRGdfPXhMlEo5-exX-e-ml8cGn9qOv0ABEUVZpX3wTI"
+	)
+	return t.New("toybox-"+version+suffix, TEarly, stage3Concat(t, []pkg.Artifact{},
+		t.Load(Make),
+		t.Load(Bash),
+		t.Load(Gzip),
+
+		t.Load(KernelHeaders),
+	), nil, stage3Concat(t, []string{},
+		"ROSA_CHECK=make USER=cure tests",
+	), `
+ln -s ../system/bin/bash /bin/ || true
+cd /usr/src/toybox
+chmod +w kconfig tests
+rm \
+	tests/du.test \
+	tests/sed.test \
+	tests/tar.test \
+	tests/ls.test \
+	tests/taskset.test
+
+make defconfig
+sed -i \
+	's/^CONFIG_TOYBOX_ZHELP=y$/CONFIG_TOYBOX_ZHELP=0/' \
+	.config
+`+script+`
+make \
+	"-j$(nproc)" \
+	LDFLAGS="${LDFLAGS} -static"
+${ROSA_CHECK}
+PREFIX=/work/system/bin make install_flat
+
+mkdir -p /work/usr/bin
+ln -s ../../system/bin/env /work/usr/bin
+`, pkg.Path(AbsUsrSrc.Append("toybox"), true, pkg.NewHTTPGetTar(
+		nil,
+		"https://landley.net/toybox/downloads/toybox-"+version+".tar.gz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	)))
+}
+func init() {
+	artifactsF[Toybox] = func(t Toolchain) pkg.Artifact {
+		return t.newToybox("", "")
+	}
+
+	artifactsF[toyboxEarly] = func(t Toolchain) pkg.Artifact {
+		return t.newToybox("-early", `
+echo '
+CONFIG_EXPR=y
+CONFIG_TR=y
+CONFIG_AWK=y
+CONFIG_DIFF=y
+' >> .config
+`)
+	}
+}

internal/rosa/wayland.go

@@ -7,12 +7,14 @@ func (t Toolchain) newWayland() pkg.Artifact {
 		version  = "1.24.0"
 		checksum = "JxgLiFRRGw2D3uhVw8ZeDbs3V7K_d4z_ypDog2LBqiA_5y2vVbUAk5NT6D5ozm0m"
 	)
-	return t.New("wayland-"+version, false, []pkg.Artifact{
+	return t.New("wayland-"+version, 0, []pkg.Artifact{
 		t.Load(Python),
 		t.Load(Meson),
 		t.Load(PkgConfig),
 		t.Load(CMake),
 		t.Load(Ninja),
+		t.Load(Gawk),
+		t.Load(Diffutils),
 
 		t.Load(Libffi),
 		t.Load(Libexpat),
@@ -50,7 +52,7 @@ func (t Toolchain) newWaylandProtocols() pkg.Artifact {
 		version  = "1.47"
 		checksum = "B_NodZ7AQfCstcx7kgbaVjpkYOzbAQq0a4NOk-SA8bQixAE20FY3p1-6gsbPgHn9"
 	)
-	return t.New("wayland-protocols-"+version, false, []pkg.Artifact{
+	return t.New("wayland-protocols-"+version, 0, []pkg.Artifact{
 		t.Load(Python),
 		t.Load(Meson),
 		t.Load(PkgConfig),

internal/rosa/x.go

@@ -7,21 +7,17 @@ func (t Toolchain) newXproto() pkg.Artifact {
 		version  = "7.0.23"
 		checksum = "goxwWxV0jZ_3pNczXFltZWHAhq92x-aEreUGyp5Ns8dBOoOmgbpeNIu1nv0Zx07z"
 	)
-	return t.New("xproto-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-		t.Load(PkgConfig),
-	}, nil, nil, `
-cd "$(mktemp -d)"
-/usr/src/xproto/configure \
-	--prefix=/system \
-	--enable-static
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("xproto"), true, pkg.NewHTTPGetTar(
-		nil, "https://www.x.org/releases/X11R7.7/src/proto/xproto-"+version+".tar.bz2",
+	return t.NewViaMake("xproto", version, pkg.NewHTTPGetTar(
+		nil, "https://www.x.org/releases/X11R7.7/src/proto/"+
+			"xproto-"+version+".tar.bz2",
 		mustDecode(checksum),
 		pkg.TarBzip2,
-	)))
+	), &MakeAttr{
+		// buggy configure script
+		Build: `""`,
+	},
+		t.Load(PkgConfig),
+	)
 }
 func init() { artifactsF[Xproto] = Toolchain.newXproto }
 
@@ -30,23 +26,22 @@ func (t Toolchain) newLibXau() pkg.Artifact {
 		version  = "1.0.7"
 		checksum = "bm768RoZZnHRe9VjNU1Dw3BhfE60DyS9D_bgSR-JLkEEyUWT_Hb_lQripxrXto8j"
 	)
-	return t.New("libXau-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-		t.Load(PkgConfig),
-
-		t.Load(Xproto),
-	}, nil, nil, `
-cd "$(mktemp -d)"
-/usr/src/libXau/configure \
-	--prefix=/system \
-	--enable-static
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("libXau"), true, pkg.NewHTTPGetTar(
+	return t.NewViaMake("libXau", version, pkg.NewHTTPGetTar(
 		nil, "https://www.x.org/releases/X11R7.7/src/lib/"+
 			"libXau-"+version+".tar.bz2",
 		mustDecode(checksum),
 		pkg.TarBzip2,
-	)))
+	), &MakeAttr{
+		Configure: [][2]string{
+			{"enable-static"},
+		},
+
+		// buggy configure script
+		Build: `""`,
+	},
+		t.Load(PkgConfig),
+
+		t.Load(Xproto),
+	)
 }
 func init() { artifactsF[LibXau] = Toolchain.newLibXau }

internal/rosa/xcb.go

@@ -7,22 +7,17 @@ func (t Toolchain) newXCBProto() pkg.Artifact {
 		version  = "1.17.0"
 		checksum = "_NtbKaJ_iyT7XiJz25mXQ7y-niTzE8sHPvLXZPcqtNoV_-vTzqkezJ8Hp2U1enCv"
 	)
-	return t.New("xcb-proto-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-		t.Load(Python),
-	}, nil, nil, `
-cd "$(mktemp -d)"
-/usr/src/xcb-proto/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}" \
-	--enable-static
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("xcb-proto"), true, pkg.NewHTTPGetTar(
+	return t.NewViaMake("xcb-proto", version, pkg.NewHTTPGetTar(
 		nil, "https://xcb.freedesktop.org/dist/xcb-proto-"+version+".tar.gz",
 		mustDecode(checksum),
 		pkg.TarGzip,
-	)))
+	), &MakeAttr{
+		Configure: [][2]string{
+			{"enable-static"},
+		},
+	},
+		t.Load(Python),
+	)
 }
 func init() { artifactsF[XCBProto] = Toolchain.newXCBProto }
 
@@ -31,26 +26,21 @@ func (t Toolchain) newXCB() pkg.Artifact {
 		version  = "1.17.0"
 		checksum = "hjjsc79LpWM_hZjNWbDDS6qRQUXREjjekS6UbUsDq-RR1_AjgNDxhRvZf-1_kzDd"
 	)
-	return t.New("xcb-"+version, false, []pkg.Artifact{
-		t.Load(Make),
+	return t.NewViaMake("xcb", version, pkg.NewHTTPGetTar(
+		nil, "https://xcb.freedesktop.org/dist/libxcb-"+version+".tar.gz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	), &MakeAttr{
+		Configure: [][2]string{
+			{"enable-static"},
+		},
+	},
 		t.Load(Python),
 		t.Load(PkgConfig),
 
 		t.Load(XCBProto),
 		t.Load(Xproto),
 		t.Load(LibXau),
-	}, nil, nil, `
-cd "$(mktemp -d)"
-/usr/src/xcb/configure \
-	--prefix=/system \
-	--build="${ROSA_TRIPLE}" \
-	--enable-static
-make "-j$(nproc)" check
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("xcb"), true, pkg.NewHTTPGetTar(
-		nil, "https://xcb.freedesktop.org/dist/libxcb-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
-	)))
+	)
 }
 func init() { artifactsF[XCB] = Toolchain.newXCB }

internal/rosa/xz.go

@@ -0,0 +1,19 @@
+package rosa
+
+import "hakurei.app/internal/pkg"
+
+func (t Toolchain) newXZ() pkg.Artifact {
+	const (
+		version  = "5.8.2"
+		checksum = "rXT-XCp9R2q6cXqJ5qenp0cmGPfiENQiU3BWtUVeVgArfRmSsISeUJgvCR3zI0a0"
+	)
+	return t.NewViaMake("xz", version, pkg.NewHTTPGetTar(
+		nil, "https://github.com/tukaani-project/xz/releases/download/"+
+			"v"+version+"/xz-"+version+".tar.bz2",
+		mustDecode(checksum),
+		pkg.TarBzip2,
+	), nil,
+		t.Load(Diffutils),
+	)
+}
+func init() { artifactsF[XZ] = Toolchain.newXZ }

internal/rosa/zlib.go

@@ -7,19 +7,16 @@ func (t Toolchain) newZlib() pkg.Artifact {
 		version  = "1.3.1"
 		checksum = "E-eIpNzE8oJ5DsqH4UuA_0GDKuQF5csqI8ooDx2w7Vx-woJ2mb-YtSbEyIMN44mH"
 	)
-	return t.New("zlib-"+version, false, []pkg.Artifact{
-		t.Load(Make),
-	}, nil, nil, `
-cd "$(mktemp -d)"
-CC="clang -fPIC" /usr/src/zlib/configure \
-	--prefix /system
-make "-j$(nproc)" test
-make DESTDIR=/work install
-`, pkg.Path(AbsUsrSrc.Append("zlib"), true,
-		pkg.NewHTTPGetTar(
-			nil, "https://zlib.net/zlib-"+version+".tar.gz",
-			mustDecode(checksum),
-			pkg.TarGzip,
-		)))
+	return t.NewViaMake("zlib", version, pkg.NewHTTPGetTar(
+		nil, "https://zlib.net/zlib-"+version+".tar.gz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	), &MakeAttr{
+		OmitDefaults: true,
+		Env: []string{
+			"CC=clang -fPIC",
+		},
+		Build: `""`,
+	})
 }
 func init() { artifactsF[Zlib] = Toolchain.newZlib }

package.nix

@@ -89,7 +89,7 @@ buildGoModule rec {
     CC = "clang -O3 -Werror";
 
     # nix build environment does not allow acls
-    GO_TEST_SKIP_ACL = 1;
+    HAKUREI_TEST_SKIP_ACL = 1;
   };
 
   buildInputs = [