buninu-linux 0.5.1 → 0.6.0

package/initramfs/init.js

@@ -2,9 +2,19 @@ console.log("init.js: Bun runtime entered JavaScript");
 
 const { dlopen, FFIType, ptr, read } = await import("bun:ffi");
 
-console.log("init.js: loading physical musl libc for FFI");
-
-const libc = dlopen("/lib/libc.musl-x86_64.so.1", {
+// The musl file name and the number of finit_module, which musl has no
+// wrapper for, are all that differs per CPU in this file. /lib/dlopen.js has
+// the same table for the commands; it is repeated rather than imported so
+// that nothing but bun:ffi loads before the mounts below.
+const architecture = {
+  x64: { libc: "libc.musl-x86_64.so.1", SYS_finit_module: 313 },
+  arm64: { libc: "libc.musl-aarch64.so.1", SYS_finit_module: 273 },
+}[process.arch];
+if (!architecture) throw new Error(`init.js: unsupported CPU architecture ${process.arch}`);
+
+console.log(`init.js: loading physical musl libc /lib/${architecture.libc} for FFI`);
+
+const libc = dlopen(`/lib/${architecture.libc}`, {
   mount: {
     args: [FFIType.ptr, FFIType.ptr, FFIType.ptr, FFIType.u64, FFIType.ptr],
     returns: FFIType.i32,
@@ -152,11 +162,13 @@ try {
 // The input layer's character devices, so a pointing device has a
 // /dev/input/event* node for `bunterm --mouse` to read. Loading them only
 // creates those nodes: the console keyboard is unaffected, and nothing reads
-// a pointer unless it is asked to. A USB mouse also needs the usbhid stack,
-// which `cfg.all` or a --real boot brings in.
+// a pointer unless it is asked to. psmouse is the PS/2 mouse of a PC or q35;
+// QEMU's aarch64 virt machine has virtio-input instead. Each image ships only
+// the one its machine has, and tryModprobe skips the other. A USB mouse also
+// needs the usbhid stack, which `cfg.all` or a --real boot brings in.
 try {
   const { tryModprobe } = await import("/lib/modprobe.js");
-  const loaded = ["evdev", "psmouse"].filter((module) => tryModprobe(module) !== null);
+  const loaded = ["evdev", "psmouse", "virtio_input"].filter((module) => tryModprobe(module) !== null);
   const { readdirSync } = await import("node:fs");
   const devices = (() => {
     try { return readdirSync("/dev/input").filter((name) => name.startsWith("event")); } catch { return []; }
@@ -190,7 +202,11 @@ const loadModule = (path) => {
     const parameters = cString("");
     // -EEXIST is harmless when firmware or another module loaded it first.
     // musl has no finit_module wrapper, so use its generic syscall(2).
-    check(`finit_module(${path})`, libc.symbols.syscall(313, fd, ptr(parameters), 0), [-17]);
+    check(
+      `finit_module(${path})`,
+      libc.symbols.syscall(architecture.SYS_finit_module, fd, ptr(parameters), 0),
+      [-17],
+    );
   } finally {
     libc.symbols.close(fd);
   }
@@ -231,21 +247,14 @@ const bringUpLoopback = () => {
   }
 };
 
-const configureQemuNetwork = () => {
-  const release = process.env.KERNEL_RELEASE ?? "6.18.52-0-virt";
-  const modules = [
-    `lib/modules/${release}/kernel/net/core/failover.ko`,
-    `lib/modules/${release}/kernel/drivers/net/net_failover.ko`,
-    `lib/modules/${release}/kernel/drivers/net/virtio_net.ko`,
-  ];
-  if (release.endsWith("-lts")) modules.unshift(
-    `lib/modules/${release}/kernel/drivers/virtio/virtio_ring.ko`,
-    `lib/modules/${release}/kernel/drivers/virtio/virtio.ko`,
-    `lib/modules/${release}/kernel/drivers/virtio/virtio_pci_legacy_dev.ko`,
-    `lib/modules/${release}/kernel/drivers/virtio/virtio_pci_modern_dev.ko`,
-    `lib/modules/${release}/kernel/drivers/virtio/virtio_pci.ko`,
-  );
-  for (const module of modules) loadModule(`/${module}`);
+// Which virtio pieces are modules differs per kernel flavor and CPU (linux-lts
+// has virtio_pci as a module, linux-virt builds it in), so /lib/modprobe.js
+// resolves them from the shipped modules.dep and modules.builtin: the PCI
+// transport first, since nothing in modules.dep depends on it, then the NIC.
+const configureQemuNetwork = async () => {
+  const { modprobe, tryModprobe } = await import("/lib/modprobe.js");
+  tryModprobe("virtio_pci");
+  modprobe("virtio_net");
 
   const fd = check("socket(AF_INET, SOCK_DGRAM)", libc.symbols.socket(2, 2, 0));
   const ioctl = (request, value, operation) =>
@@ -264,8 +273,9 @@ const configureQemuNetwork = () => {
 
     bringUp(ioctl, "eth0");
 
-    // struct rtentry on Linux x86_64. Only gateway and flags are needed for
-    // the default route; rt_dst and rt_genmask remain 0.0.0.0.
+    // struct rtentry on 64-bit Linux, the same on x86_64 and aarch64. Only
+    // gateway and flags are needed for the default route; rt_dst and
+    // rt_genmask remain 0.0.0.0.
     const route = new Uint8Array(120);
     const routeView = new DataView(route.buffer);
     writeSockaddrIpv4(route, 8, "0.0.0.0");
@@ -359,7 +369,7 @@ try {
 
 
 try {
-  configureQemuNetwork();
+  await configureQemuNetwork();
   console.log("network: eth0 10.0.2.15/24 via 10.0.2.2");
   const response = await fetch("http://example.com");
   console.log(`fetch example.com: HTTP ${response.status}, ${response.headers.get("content-type")}`);
@@ -412,7 +422,9 @@ const launchBunmsh = () => {
 
 
 
-const launchBuninu = () => {
+let replServer = null;
+
+const launchBuninu = async () => {
 
   console.log(`
 Type bunterm in bunmsh: Graphical Terminal
@@ -420,22 +432,36 @@ Type bunterm in bunmsh: Graphical Terminal
   Supports Kitty Graphics Protocol
 `)
 
+  const classic_path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+  
+  const buninu_path = "/buninu/.local/bin:/buninu/.bun/bin:/buninu/bin"
+
   const entry = `/buninu/bin/init.js`;
   console.log(`buninu: Starting ${entry} --local`);
-  const shell = Bun.spawnSync([
-    "/bin/bun", entry, "--local"
-  ], {
-    env: {
-      ...process.env,
-      PATH:"/bin:/sbin:/usr/bin:/usr/sbin:/buninu/.bun/bin:/buninu/bin",
-      HOME:"/buninu"
-    },
-    stdin: "inherit",
-    stdout: "inherit",
-    stderr: "inherit",
-  });
-  console.log(`buninu exited with status ${shell.exitCode}; returning to Bun REPL.`);
-  return shell.exitCode;
+  replServer?.pause();
+  try {
+    const shell = Bun.spawn([
+      "/bin/bun", entry, "--local"
+    ], {
+      env: {
+        ...process.env,
+        PATH:  classic_path + ":" +
+               buninu_path,
+        HOME:"/buninu"
+      },
+      stdin: "inherit",
+      stdout: "inherit",
+      stderr: "inherit",
+    });
+    const exitCode = await shell.exited;
+    console.log(`buninu exited with status ${exitCode}; returning to Bun REPL.`);
+    return exitCode;
+  } finally {
+    // The child inherits the console directly. Keep the REPL from consuming
+    // the same input while it runs, but leave PID 1's event loop alive so its
+    // SIGCHLD handler can reap orphaned grandchildren such as Chromium.
+    replServer?.resume();
+  }
   
 }
 
@@ -551,12 +577,24 @@ Type start() to run buninu --local`);
 showWelcome();
 
 const startRepl = () => {
-  const server = repl.start({
+  const server = replServer = repl.start({
     prompt: "bun-repl> ",
     input: process.stdin,
     output: process.stdout,
     terminal: true,
   });
+  // `start()` returns a promise so PID 1's event loop can keep reaping
+  // children. Make the two convenient whole-line forms foreground commands;
+  // otherwise the REPL finishes evaluating the pending promise and resumes
+  // itself, competing with Buninu for the console input.
+  const defaultEval = server.eval.bind(server);
+  server.eval = (command, context, filename, callback) => {
+    const trimmed = command.trim();
+    if (trimmed === "start" || /^start\s*\(\s*\)\s*;?$/.test(trimmed)) {
+      command = "await start()\n";
+    }
+    return defaultEval(command, context, filename, callback);
+  };
   // Run before REPL's own line listener so its next prompt is printed after
   // the repeated welcome. Empty and whitespace-only lines both trigger it.
   server.prependListener("line", (line) => {

package/initramfs/lib/bunterm/images.js

@@ -53,6 +53,7 @@ export class ImageStore {
     this.term = term;
     this.renderer = renderer;
     this.images = new Map();      // image id → Skia Image
+    this.imageSources = new Map(); // image id → parser image object
     this.placements = new Map();  // placement key → placement
     this.counter = 0;
     this.coveredKey = "";
@@ -70,14 +71,26 @@ export class ImageStore {
     if (graphic.kind !== "placement") return "";
     const { control, image } = graphic;
     let decoded = this.images.get(image.id);
-    if (!decoded) {
+    const replacesImage = decoded && this.imageSources.get(image.id) !== image;
+    if (!decoded || replacesImage) {
       try {
-        decoded = await decodeImage(this.CanvasKit, image);
+        const replacement = await decodeImage(this.CanvasKit, image);
+        if (replacesImage) {
+          // Kitty requires retransmitting a non-zero image id to delete the
+          // old image and all its placements.  Screen-streaming clients such
+          // as casty deliberately reuse one id for every frame.
+          for (const placement of [...this.placements.values()]) {
+            if (placement.imageId === image.id) this.dispose(placement);
+          }
+          decoded.delete();
+        }
+        decoded = replacement;
       } catch (error) {
         graphic.responseMessage = `EBADPNG:${error.message}`;
         return "";
       }
       this.images.set(image.id, decoded);
+      this.imageSources.set(image.id, image);
     }
     const { cellWidth, cellHeight } = this.renderer;
     const buffer = this.term.buffer.active;
@@ -169,6 +182,7 @@ export class ImageStore {
         if (!used.has(id)) {
           image.delete();
           this.images.delete(id);
+          this.imageSources.delete(id);
         }
       }
     }
@@ -221,5 +235,6 @@ export class ImageStore {
     this.placements.clear();
     for (const image of this.images.values()) image.delete();
     this.images.clear();
+    this.imageSources.clear();
   }
 }

package/initramfs/usr/share/doc/buninu-linux/bunterm.md

@@ -80,7 +80,9 @@ hidden while it is scrolled out of view.
 `/dev/input` and never loads the mouse module.
 
 `init.js` loads `evdev` and `psmouse` at boot, so a PS/2 mouse — which is
-what QEMU's q35 machine and most PCs present — has a device node ready. A USB
+what QEMU's q35 machine and most PCs present — has a device node ready. The
+aarch64 image loads `virtio_input` in place of `psmouse`, for QEMU's
+`virtio-tablet-pci` and `virtio-keyboard-pci`. A USB
 mouse also needs the `usbhid` stack, which a `--real` image carries and
 `cfg.all` loads. The pointer follows relative devices (a mouse) and absolute
 ones (a tablet or touchscreen) alike; a device that cannot be opened is
@@ -91,6 +93,8 @@ reported and the session continues without it.
 - Needs a framebuffer: `linux-lts` has one built in, while the default
   `linux-virt` builds it as modules the image does not ship, so build with
   `--linux-lts` or `--real` (efifb/simpledrm from UEFI).
+- The aarch64 image has no framebuffer yet: `run-qemu.sh` gives QEMU's
+  `virt` machine no display device, so there is no `/dev/fb0` to draw on.
 - No selection, and no keyboard way to scroll back: the wheel is it. The
   buffer keeps 1000 lines. A program that does not enable mouse reporting
   sees no clicks — the arrow still moves, so the pointer is visibly alive.

package/initramfs/usr/share/doc/buninu-linux/tar.md

@@ -28,6 +28,8 @@ Use `-` as ARCHIVE to read from standard input or write to standard output.
 | `-z`, `--gzip` | Create gzip-compressed tar, or explicitly identify gzip input. |
 | `--zstd` | Create or read a zstd-compressed tar. A `.zst` or `.tzst` input is also detected by name. |
 | `-v` | Print names while creating/extracting; with `-t`, also show each member's size, modification time, kind and link target. |
+| `-o`, `--no-same-owner`, `--no-same-permissions`, `--overwrite` | GNU tar compatibility for extraction; these already match Bun.Archive's behaviour. |
+| `--exclude=PATTERN` | Accepted for js-udocker compatibility. Device nodes are not extracted and js-udocker removes whiteout files separately. |
 
 Short options can be combined, for example `-xzvf` or `-czf`.
 For the traditional first option word, the leading hyphen is optional, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buninu-linux",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "A Linux distribution running Bun as PID 1 with the Buninu userspace.",
   "type": "module",
   "main": "./index.js",

package/run-qemu.sh

@@ -2,19 +2,68 @@
 
 cd "$(dirname "$0")"
 
-test -f vda.img || ./build-image.sh
-
-if [ -z "$PREFIX" ] ; then
-  PREFIX=/usr
+# The guest is whatever build-uki.sh last put in vda/EFI/BOOT (it leaves only
+# one architecture there), unless BUNINU_ARCH (index.js --arch) names one.
+if [ -z "$BUNINU_ARCH" ] && [ -f vda/EFI/BOOT/BOOTAA64.EFI ]; then
+    BUNINU_ARCH=aarch64
 fi
+. ./scripts/arch.sh
+
+test -f vda.img || ./build-image.sh || exit 1
+test -f "vda/EFI/BOOT/$efi_boot_name" || {
+    echo "error: vda.img holds no $arch UKI; build one with ./index.js -b --arch $arch" >&2
+    exit 1
+}
+
+qemu="qemu-system-$arch"
+command -v "$qemu" >/dev/null || {
+    echo "error: $qemu not found (macOS: brew install qemu; Debian: apt install qemu-system)" >&2
+    exit 1
+}
 
-ovmf_filepath="$PREFIX"/share/qemu/edk2-x86_64-code.fd
+case $arch in
+    x86_64) machine=q35 distro_firmware=/usr/share/OVMF/OVMF_CODE_4M.fd ;;
+    aarch64) machine=virt distro_firmware=/usr/share/AAVMF/AAVMF_CODE.fd ;;
+esac
+
+# UEFI firmware: OVMF_FILE if set; then the edk2 build QEMU ships next to its
+# own binary (Termux's $PREFIX/share/qemu, Homebrew's share/qemu, ...); then
+# the distribution packages (Debian ovmf / qemu-efi-aarch64).
+qemu_share="$(dirname "$(command -v "$qemu")")/../share/qemu"
+ovmf_filepath=
+for candidate in "$OVMF_FILE" "$distro_firmware" "$qemu_share/edk2-$arch-code.fd" \
+    "/usr/share/qemu/edk2-$arch-code.fd"; do
+    if [ -n "$candidate" ] && [ -f "$candidate" ]; then
+        ovmf_filepath=$candidate
+        break
+    fi
+done
+test -n "$ovmf_filepath" || {
+    echo "error: no $arch UEFI firmware found; set OVMF_FILE to an edk2-$arch-code.fd" >&2
+    exit 1
+}
 
-if [ -f /usr/share/OVMF/OVMF_CODE_4M.fd ] ; then
-  ovmf_filepath=/usr/share/OVMF/OVMF_CODE_4M.fd
-elif [ -f "$OVMF_FILE" ] ; then
-  ovmf_filepath=$OVMF_FILE
+# Hardware acceleration needs the guest to match the host CPU: KVM on Linux,
+# Hypervisor.framework on macOS (Apple Silicon runs the aarch64 guest natively,
+# an Intel Mac the x86_64 one). Anything else, such as the x86_64 guest on
+# Apple Silicon or on an Android phone, is emulated with TCG. ACCEL overrides
+# the choice, e.g. ACCEL=tcg to rule acceleration out while debugging.
+case "$(uname -m)" in
+    arm64 | aarch64) host_arch=aarch64 ;;
+    *) host_arch=$(uname -m) ;;
+esac
+if [ -z "$ACCEL" ]; then
+    ACCEL=tcg
+    if [ "$host_arch" = "$arch" ]; then
+        case "$(uname -s)" in
+            Linux) [ -r /dev/kvm ] && [ -w /dev/kvm ] && ACCEL=kvm ;;
+            Darwin) [ "$(sysctl -n kern.hv_support 2>/dev/null)" = 1 ] && ACCEL=hvf ;;
+        esac
+    fi
 fi
+# TCG emulates every feature it knows; KVM and HVF pass the host CPU through.
+if [ "$ACCEL" = tcg ]; then cpu=max; else cpu=host; fi
+echo "run-qemu.sh: $arch guest on $machine, accel=$ACCEL, firmware $ovmf_filepath" >&2
 
 # User-mode networking is NAT: the guest can reach out, nothing reaches in
 # unless a port is forwarded. PORTS lists them, space-separated, as
@@ -31,9 +80,9 @@ for port in ${PORTS:-}; do
     nic="$nic,hostfwd=tcp:127.0.0.1:$host-:$guest"
 done
 
-exec qemu-system-x86_64 \
-    -machine q35,accel=tcg \
-    -cpu max \
+exec "$qemu" \
+    -machine "$machine,accel=$ACCEL" \
+    -cpu "$cpu" \
     -m 1G \
     -drive if=pflash,format=raw,readonly=on,file="$ovmf_filepath" \
     -drive if=virtio,format=raw,file=vda.img \

package/scripts/arch.sh

@@ -0,0 +1,113 @@
+# Sourced by the fetch, build and run scripts; not executable on its own.
+#
+# Everything that differs between the two guest architectures lives here:
+# the pinned packages and their SHA-256, the file names inside them, the EFI
+# removable-media name, the PE-aware objcopy that assembles the UKI and the
+# serial console. BUNINU_ARCH (index.js --arch) picks one; x86_64 is the
+# default. LINUX_FLAVOR (virt or lts) and REAL_MACHINE are read here too.
+#
+# Fetched and extracted files are kept per architecture, so both guests can
+# be built from one checkout without refetching:
+#
+#   downloads/<arch>/  the pinned archives (both repos use the same names)
+#   kernel/<arch>/     vmlinuz-<flavor> and the UKI stub
+#   native/<arch>/     bun, musl, libgcc/libstdc++ and kernel modules;
+#                      scripts/pack-initramfs.sh lays it over initramfs/
+
+case "${BUNINU_ARCH:-x86_64}" in
+    x86_64 | amd64 | x64) arch=x86_64 ;;
+    aarch64 | arm64) arch=aarch64 ;;
+    *)
+        echo "error: unsupported BUNINU_ARCH=$BUNINU_ARCH (use x86_64 or aarch64)" >&2
+        exit 1
+        ;;
+esac
+
+linux_flavor=${LINUX_FLAVOR:-virt}
+case $linux_flavor in
+    virt | lts) ;;
+    *)
+        echo "error: unsupported LINUX_FLAVOR=$linux_flavor (use virt or lts)" >&2
+        exit 1
+        ;;
+esac
+
+if [ "${REAL_MACHINE:-}" = 1 ] && [ "$arch" != x86_64 ]; then
+    echo "error: --real images are x86_64 only; its module set is PC hardware" >&2
+    exit 1
+fi
+
+# The Alpine repository keeps only the newest build of a package, so a pin
+# stops downloading when Alpine bumps it; the hashes below then fail loudly
+# rather than silently taking the new build. ALPINE_MIRROR swaps the host for
+# a closer mirror; the SHA-256 check is the same either way.
+alpine_mirror=${ALPINE_MIRROR:-https://dl-cdn.alpinelinux.org/alpine}
+alpine_base="$alpine_mirror/v3.24/main/$arch"
+
+kernel_version=6.18.53
+kernel_release="$kernel_version-0-$linux_flavor"
+linux_package="linux-$linux_flavor-$kernel_version-r0.apk"
+musl_package=musl-1.2.6-r2.apk
+stub_package=systemd-efistub-260.2-r0.apk
+libstdcpp_package=libstdc++-15.2.0-r5.apk
+libgcc_package=libgcc-15.2.0-r5.apk
+bun_version=1.4.2
+
+downloads_dir="downloads/$arch"
+kernel_dir="kernel/$arch"
+kernel_image="$kernel_dir/vmlinuz-$linux_flavor"
+native_dir="native/$arch"
+modules_root="$native_dir/lib/modules/$kernel_release"
+musl_loader="ld-musl-$arch.so.1"
+musl_libc="libc.musl-$arch.so.1"
+
+case $arch in
+    x86_64)
+        linux_virt_sha256=cad859cc46342e18002621fdde166bf2cd520dfec5e781d241de7d13e53970d6
+        linux_lts_sha256=8e3cfdd1d98e0e70c2e70a8c299ed3cd1e0939d60ad7bbd1da1cf241d794490b
+        musl_sha256=573712e2f49c15bfc20a2699f204acdfc74c772722b15e7353d768057fae0e71
+        stub_sha256=8e64a5a3afee5f930e6e6716be726dc6d405530ac7f8fa5be6251dae68671ec9
+        libstdcpp_sha256=14c987b556f5385a5db18376e788c75f37d85321b8dc1920d926ea7daac1d6f6
+        libgcc_sha256=393dcd32629f06d7d85409c272d142d0c082772d10b87ef55ee82f47de3be637
+        # Bun ships one x64 musl build; -baseline is an alias (NOTICE.md).
+        bun_build=bun-linux-x64-musl-baseline
+        bun_sha256=76e1db84e98f22f78de0a87e309bfbbf297732847f9720db36750646c85c8c18
+        efi_stub=linuxx64.efi.stub
+        efi_boot_name=BOOTX64.EFI
+        uki_objcopy=x86_64-w64-mingw32-objcopy
+        uki_objdump=x86_64-w64-mingw32-objdump
+        uki_binutils_package=binutils-mingw-w64-x86-64
+        # COM1 on q35 and on PCs.
+        serial_console=ttyS0
+        serial_major=4
+        ;;
+    aarch64)
+        linux_virt_sha256=fea61b7fd5e72e626d771f9798df56c83db658d0e221044f06fc28aacf5a118b
+        linux_lts_sha256=46885041022ea11afa1e07c40199c74146bf72d362368a844338af0c162e365c
+        musl_sha256=5e9674b7f41152fe2119093b5cb4c13eaaadb19c2d5422b2d7267913e663ee6e
+        stub_sha256=a1823d2d7082db555d528f82c1809f276c818aeb5b40f198f4565f104e055c38
+        libstdcpp_sha256=2302e766d4e4926038ec166ecb85837ee884576115236ddb565e3a5fca4a11d7
+        libgcc_sha256=369aaa6e9d099a737bad6dd3e6c2fe7bb1547ca26d22b94ee0411228f709b403
+        bun_build=bun-linux-aarch64-musl
+        bun_sha256=71760b6c8ea30623b81a4907cb815d48e2ea266f2e73e751534a44a0607950df
+        efi_stub=linuxaa64.efi.stub
+        efi_boot_name=BOOTAA64.EFI
+        # The aarch64 ELF binutils also read and write pei-aarch64-little:
+        # native binutils on an arm64 Debian, the cross package on amd64.
+        uki_objcopy=aarch64-linux-gnu-objcopy
+        uki_objdump=aarch64-linux-gnu-objdump
+        uki_binutils_package=binutils-aarch64-linux-gnu
+        # The PL011 UART of QEMU's virt machine.
+        serial_console=ttyAMA0
+        serial_major=204
+        ;;
+esac
+
+if [ "$linux_flavor" = lts ]; then
+    linux_sha256=$linux_lts_sha256
+else
+    linux_sha256=$linux_virt_sha256
+fi
+
+bun_zip="$bun_build-$bun_version.zip"
+bun_url="https://github.com/oven-sh/bun/releases/download/bun-v$bun_version/$bun_build.zip"

package/scripts/fetch.sh

@@ -2,8 +2,9 @@
 #
 # fetch <url> <name> <sha256>
 #
-# Downloads to downloads/<name>, unless a file with that exact SHA-256 is
-# already sitting there. The hash is both the cache key and the integrity
+# Downloads to $downloads_dir/<name> (downloads/<arch>/, set by
+# scripts/arch.sh), unless a file with that exact SHA-256 is already sitting
+# there. The hash is both the cache key and the integrity
 # check, so there is no weaker "file exists" path: a truncated, stale or
 # tampered file fails the first comparison, gets fetched again, and still has
 # to pass the second one before any script extracts from it.
@@ -12,7 +13,7 @@
 # a version (which changes both the name and the hash) always refetches.
 fetch() {
     local url=$1 name=$2 sha=$3
-    local path="downloads/$name"
+    local path="$downloads_dir/$name"
 
     if [ -f "$path" ] && printf '%s  %s\n' "$sha" "$path" | sha256sum --check --status; then
         echo "cached $name"
@@ -20,6 +21,7 @@ fetch() {
     fi
 
     echo "fetch  $name"
+    mkdir -p "$downloads_dir"
     curl -fL "$url" -o "$path"
     # --quiet prints only failures; a mismatch exits non-zero under `set -e`.
     printf '%s  %s\n' "$sha" "$path" | sha256sum --check --quiet

package/scripts/pack-initramfs.sh

@@ -2,13 +2,26 @@
 set -euo pipefail
 
 cd "$(dirname "$0")/.."
+
+. ./scripts/arch.sh
+
+test -x "$native_dir/bin/bun" || {
+    echo "error: no $native_dir/bin/bun yet; run the fetch stage first (./index.js -f)" >&2
+    exit 1
+}
 mkdir -p build
 
 staging="$(mktemp -d "$PWD/.initramfs.XXXXXX")"
 archive="$(mktemp "$PWD/.initramfs.XXXXXX.cpio")"
 trap 'rm -rf "$staging"; rm -f "$archive"' EXIT
 
+# initramfs/ is the same for every architecture; native/<arch>/ adds bun, the
+# musl loader, the GCC runtime and the kernel modules on top of it.
+# A checkout fetched before native/ existed still has an x86_64 bun and its
+# modules under initramfs/; they are dropped rather than packed.
 cp -a --reflink=auto initramfs/. "$staging/"
+rm -rf "$staging/bin/bun" "$staging/lib/modules"
+cp -a --reflink=auto "$native_dir/." "$staging/"
 
 # fakeroot lets cpio record the character devices without real root. Nothing
 # has mounted devtmpfs when the kernel execs Bun as PID 1, so every device
@@ -20,10 +33,11 @@ cp -a --reflink=auto initramfs/. "$staging/"
 #            This is the one device that actually blocks booting Bun as PID 1.
 #
 # The rest are cheap to include and keep /dev usable if the devtmpfs mount in
-# init.js ever fails.
+# init.js ever fails. The serial port is ttyS0 (4, 64) on x86_64 and the
+# PL011 ttyAMA0 (204, 64) on aarch64.
 fakeroot-tcp -- sh -c '
     mknod -m 0600 "$1/dev/console" c 5 1
-    mknod -m 0620 "$1/dev/ttyS0" c 4 64
+    mknod -m 0620 "$1/dev/$3" c "$4" 64
     mknod -m 0666 "$1/dev/null" c 1 3
     mknod -m 0666 "$1/dev/zero" c 1 5
     mknod -m 0666 "$1/dev/random" c 1 8
@@ -34,8 +48,8 @@ fakeroot-tcp -- sh -c '
         | sort -z \
         | cpio --null --create --format=newc --owner=0:0 --reproducible 2>/dev/null \
         > "$2"
-' sh "$staging" "$archive"
+' sh "$staging" "$archive" "$serial_console" "$serial_major"
 
 gzip -9n < "$archive" > build/initramfs.cpio.gz
 
-echo "Built build/initramfs.cpio.gz"
+echo "Built build/initramfs.cpio.gz for $arch"

package/test/host/Dockerfile

@@ -0,0 +1,13 @@
+# The "ordinary Debian 13 machine" host-test.sh builds and boots the guests on:
+# the README's build packages for both guests, QEMU with OVMF and AAVMF, node
+# to run index.js, git to clone the checkout and expect to drive the serial
+# console. Built for linux/amd64 or linux/arm64, whichever host is simulated.
+FROM debian:13-slim
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      binutils-mingw-w64-x86-64 binutils-aarch64-linux-gnu cpio curl dosfstools fakeroot mtools parted unzip \
+      ca-certificates git nodejs expect \
+      qemu-system-x86 ovmf qemu-system-arm qemu-efi-aarch64 \
+    && rm -rf /var/lib/apt/lists/*
+
+# parted asks udev to settle after writing a partition table; see ../../Dockerfile.
+RUN ln -s /bin/true /usr/local/bin/udevadm

package/test/host/boot-test.exp

@@ -0,0 +1,70 @@
+#!/usr/bin/expect -f
+# Boots vda.img with `node ./index.js -r --arch <arch>` and drives the serial
+# console: the REPL, the Buninu shell, eth0, PID 1, a tmpfs mount, a fetch from
+# inside the guest and poweroff. Each step waits for the output it expects, so
+# a hang or a wrong answer fails with a message instead of racing ahead.
+#
+# Usage: boot-test.exp <checkout> x86_64|aarch64 [boot timeout in seconds]
+
+set checkout [lindex $argv 0]
+set arch [lindex $argv 1]
+set boot_timeout [expr {[llength $argv] > 2 ? [lindex $argv 2] : 900}]
+switch -- $arch {
+    x86_64 { set js_arch x64 }
+    aarch64 { set js_arch arm64 }
+    default {
+        puts "usage: boot-test.exp <checkout> x86_64|aarch64 \[boot timeout\]"
+        exit 2
+    }
+}
+
+proc fail {message} {
+    puts "\n### FAIL: $message"
+    exit 1
+}
+
+# Sends one line to the guest, then waits for a regular expression in the
+# output. The patterns match what the command prints, not its echo.
+proc step {what line pattern} {
+    send -- "$line\r"
+    expect {
+        -re $pattern { puts "\n### ok: $what" }
+        timeout { fail "$what: no match for /$pattern/ within $::timeout s" }
+        eof { fail "$what: QEMU exited" }
+    }
+}
+
+cd $checkout
+set start [clock seconds]
+spawn node ./index.js -r --arch $arch
+
+set timeout $boot_timeout
+expect {
+    "bun-repl>" { puts "\n### ok: REPL after [expr {[clock seconds] - $start}] s" }
+    "Kernel panic" { fail "kernel panic before the REPL" }
+    timeout { fail "no REPL within $boot_timeout s" }
+    eof { fail "QEMU exited before the REPL" }
+}
+
+# bunmsh switches bracketed paste off (ESC[?2004l) before a command's output
+# and Bun colours the numbers it prints, so a line of output can carry escape
+# sequences around the text.
+set esc {(?:\x1b\[[0-9;?]*[a-zA-Z])*}
+
+set timeout 180
+step "process.arch is $js_arch" "process.arch" "'$js_arch'"
+step "Buninu shell" "start()" {\$ }
+step "uname reports $arch" "uname -a" "Linux \\(none\\) \[^\r\n\]* $arch"
+step "eth0 is 10.0.2.15" "ip -br addr" {eth0 +UP +10\.0\.2\.15/24}
+step "PID 1 is bun" "ps -eo pid,args" {\n +1 /bin/bun -e import}
+step "tmpfs mount" \
+    "mount -t tmpfs -o size=8M tmpfs /tmp/x --mkdir && echo hi > /tmp/x/f && cat /tmp/x/f && umount /tmp/x" \
+    "\n${esc}hi${esc}\r"
+step "fetch from the guest" \
+    {bun -e 'console.log((await fetch("http://example.com")).status)'} \
+    "\n${esc}200${esc}\r"
+step "poweroff" "poweroff" "reboot: Power down"
+expect {
+    eof { puts "\n### ok: QEMU exited, [expr {[clock seconds] - $start}] s in total" }
+    timeout { fail "QEMU still running after poweroff" }
+}