buninu-linux 0.7.2 → 0.7.4

package/initramfs/buninu/apps/jsgotty/gotty.js

@@ -115,6 +115,26 @@ function assetFilePath(key) {
   return assets ? assets.assetDiskPath(key) : path.join(__dirname, key);
 }
 
+function windowsConptyDllPath() {
+  const dll = assetFilePath("conpty/conpty.dll");
+  if (fs.existsSync(dll)) return dll;
+  if (!assets) return null;
+  try {
+    const dllBytes = assets.readAssetBytesSync("conpty/conpty.dll");
+    const hostBytes = assets.readAssetBytesSync("conpty/OpenConsole.exe");
+    const version = crypto.createHash("sha256").update(dllBytes).digest("hex").slice(0, 16);
+    const dir = path.join(os.tmpdir(), `jsgotty-conpty-${version}`);
+    fs.mkdirSync(dir, { recursive: true });
+    for (const [name, bytes] of [["conpty.dll", dllBytes], ["OpenConsole.exe", hostBytes]]) {
+      const dest = path.join(dir, name);
+      if (!fs.existsSync(dest)) fs.writeFileSync(dest, bytes);
+    }
+    return path.join(dir, "conpty.dll");
+  } catch (error) {
+    throw new Error(`Could not prepare bundled ConPTY: ${error.message}`);
+  }
+}
+
 //  URL-relative path -> asset key, or null when it escapes `static/`.
 //  Normalizing against "/" is what makes "../../etc/passwd" unreachable.
 function staticAssetKey(relativePath) {
@@ -1624,6 +1644,10 @@ function createPtyBackend(options) {
     if (globalThis.Bun?.semver?.satisfies?.(
         globalThis.Bun?.version, ">=1.3.14"
       )) {
+      const conptyDll = windowsConptyDllPath();
+      if (conptyDll) {
+        return new (require("./windows-conpty.js"))(options, conptyDll);
+      }
       return new BunPtyBackend(options);
     }
     return new NodePtyBackend(options);

package/initramfs/buninu/apps/jsgotty/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "jsgotty",
-  "version": "1.1.11",
+  "version": "1.1.14",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "jsgotty",
-      "version": "1.1.11",
+      "version": "1.1.14",
       "dependencies": {
         "node-addon-api": "^7.1.1",
         "ws": "^8.18.3"

package/initramfs/buninu/apps/jsgotty/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsgotty",
-  "version": "1.1.12",
+  "version": "1.1.14",
   "description": "Share your terminal as a web application: A JavaScript rewrite of GoTTY",
   "license": "MIT",
   "bin": {
@@ -8,9 +8,13 @@
   },
   "type": "commonjs",
   "assets": [
+    "conpty",
     "static",
     "README.md",
-    "README.en.md"
+    "README.en.md",
+    "LICENSE",
+    "NOTICE",
+    "LICENSES"
   ],
   "dependencies": {
     "node-addon-api": "^7.1.1",

package/initramfs/buninu/apps/jsgotty/windows-conpty.js

@@ -0,0 +1,135 @@
+// Windows PTY adapter for the out-of-band Microsoft Console package.
+// Keep the same interface as BunPtyBackend in gotty.js.
+const { dlopen, ptr } = require("bun:ffi");
+const path = require("path");
+
+const kernel = dlopen("kernel32.dll", {
+  CreatePipe: { args: ["ptr", "ptr", "ptr", "u32"], returns: "i32" },
+  InitializeProcThreadAttributeList: { args: ["ptr", "u32", "u32", "ptr"], returns: "i32" },
+  UpdateProcThreadAttribute: { args: ["ptr", "u32", "usize", "ptr", "usize", "ptr", "ptr"], returns: "i32" },
+  DeleteProcThreadAttributeList: { args: ["ptr"], returns: "void" },
+  CreateProcessW: { args: ["ptr", "ptr", "ptr", "ptr", "i32", "u32", "ptr", "ptr", "ptr", "ptr"], returns: "i32" },
+  PeekNamedPipe: { args: ["ptr", "ptr", "u32", "ptr", "ptr", "ptr"], returns: "i32" },
+  ReadFile: { args: ["ptr", "ptr", "u32", "ptr", "ptr"], returns: "i32" },
+  WriteFile: { args: ["ptr", "ptr", "u32", "ptr", "ptr"], returns: "i32" },
+  GetExitCodeProcess: { args: ["ptr", "ptr"], returns: "i32" },
+  TerminateProcess: { args: ["ptr", "u32"], returns: "i32" },
+  CloseHandle: { args: ["ptr"], returns: "i32" },
+  GetLastError: { args: [], returns: "u32" },
+}).symbols;
+
+const conptySymbols = {
+  ConptyCreatePseudoConsole: { args: ["u32", "ptr", "ptr", "u32", "ptr"], returns: "i32" },
+  ConptyResizePseudoConsole: { args: ["ptr", "u32"], returns: "i32" },
+  ConptyClosePseudoConsole: { args: ["ptr"], returns: "void" },
+};
+const wide = (value) => Buffer.from(`${value}\0`, "utf16le");
+const handle = (buffer) => Number(buffer.readBigUInt64LE(0));
+const size = (cols, rows) => ((Math.max(1, rows) & 0xffff) << 16) | (Math.max(1, cols) & 0xffff);
+const winError = (operation) => new Error(`${operation} failed: ${kernel.GetLastError()}`);
+// Windows CRT argv escaping: double backslashes before quotes and at the end.
+function quoteArg(value) {
+  let result = '"', slashes = 0;
+  for (const char of String(value)) {
+    if (char === "\\") { slashes++; continue; }
+    if (char === '"') result += "\\".repeat(slashes * 2 + 1) + '"';
+    else result += "\\".repeat(slashes) + char;
+    slashes = 0;
+  }
+  return result + "\\".repeat(slashes * 2) + '"';
+}
+
+class WindowsConptyBackend {
+  constructor(options, dllPath) {
+    this.options = options;
+    this.dataHandlers = [];
+    this.exitHandlers = [];
+    this.closed = false;
+    this.conpty = dlopen(path.resolve(dllPath), conptySymbols).symbols;
+    const inputRead = Buffer.alloc(8), inputWrite = Buffer.alloc(8);
+    const outputRead = Buffer.alloc(8), outputWrite = Buffer.alloc(8);
+    if (!kernel.CreatePipe(inputRead, inputWrite, 0, 0)) throw winError("CreatePipe input");
+    if (!kernel.CreatePipe(outputRead, outputWrite, 0, 0)) throw winError("CreatePipe output");
+    this.input = handle(inputWrite);
+    this.output = handle(outputRead);
+    const pseudo = Buffer.alloc(8);
+    const hr = this.conpty.ConptyCreatePseudoConsole(
+      size(options.width || 80, options.height || 24), handle(inputRead), handle(outputWrite), 0, pseudo);
+    kernel.CloseHandle(handle(inputRead));
+    kernel.CloseHandle(handle(outputWrite));
+    if (hr !== 0) throw new Error(`ConptyCreatePseudoConsole failed: ${hr}`);
+    this.pseudo = handle(pseudo);
+
+    const listSize = Buffer.alloc(8);
+    kernel.InitializeProcThreadAttributeList(0, 1, 0, listSize);
+    const list = Buffer.alloc(Number(listSize.readBigUInt64LE(0)));
+    if (!kernel.InitializeProcThreadAttributeList(list, 1, 0, listSize)) throw winError("InitializeProcThreadAttributeList");
+    if (!kernel.UpdateProcThreadAttribute(list, 0, 0x00020016, this.pseudo, 8, 0, 0)) throw winError("UpdateProcThreadAttribute");
+    const startup = Buffer.alloc(112);
+    startup.writeUInt32LE(112, 0);
+    startup.writeUInt32LE(0x100, 60); // STARTF_USESTDHANDLES
+    startup.writeBigUInt64LE(BigInt(ptr(list)), 104);
+    const processInfo = Buffer.alloc(24);
+    const env = { ...process.env, TERM: "xterm-256color", ...(options.headerEnv || {}) };
+    const envBlock = wide(Object.entries(env).filter(([key]) => !key.startsWith("="))
+      .map(([key, value]) => `${key}=${value}`).join("\0") + "\0");
+    const executable = Bun.which(options.command) || options.command;
+    const command = wide([executable, ...options.argv].map(quoteArg).join(" "));
+    const ok = kernel.CreateProcessW(wide(executable), command, 0, 0, 0,
+      0x00080000 | 0x00000400, envBlock, wide(process.cwd()), startup, processInfo);
+    kernel.DeleteProcThreadAttributeList(list);
+    if (!ok) throw winError("CreateProcessW");
+    this.process = handle(processInfo);
+    this.pid = processInfo.readUInt32LE(16);
+    kernel.CloseHandle(Number(processInfo.readBigUInt64LE(8)));
+    this.pollTimer = setInterval(() => this.poll(), 5);
+  }
+
+  onData(handler) { this.dataHandlers.push(handler); }
+  onExit(handler) { this.exitHandlers.push(handler); }
+  write(buffer) { this.writeBinary(buffer); }
+  writeBinary(buffer) {
+    const data = Buffer.from(buffer);
+    const written = Buffer.alloc(4);
+    for (let offset = 0; offset < data.length;) {
+      const chunk = data.subarray(offset);
+      if (!kernel.WriteFile(this.input, chunk, chunk.length, written, 0)) throw winError("WriteFile");
+      const count = written.readUInt32LE(0);
+      if (!count) throw new Error("WriteFile wrote no data");
+      offset += count;
+    }
+  }
+  resize(cols, rows) {
+    const hr = this.conpty.ConptyResizePseudoConsole(this.pseudo, size(cols, rows));
+    if (hr !== 0) throw new Error(`ConptyResizePseudoConsole failed: ${hr}`);
+  }
+  kill() { if (!this.closed) kernel.TerminateProcess(this.process, 1); }
+  close() { this.kill(); }
+
+  poll() {
+    if (this.closed) return;
+    const available = Buffer.alloc(4), readCount = Buffer.alloc(4);
+    if (kernel.PeekNamedPipe(this.output, 0, 0, 0, available, 0)) {
+      for (let bytes = available.readUInt32LE(0); bytes > 0; bytes = available.readUInt32LE(0)) {
+        const data = Buffer.alloc(Math.min(bytes, 65536));
+        if (!kernel.ReadFile(this.output, data, data.length, readCount, 0)) break;
+        const count = readCount.readUInt32LE(0);
+        if (!count) break;
+        for (const handler of this.dataHandlers) handler(data.subarray(0, count));
+        if (!kernel.PeekNamedPipe(this.output, 0, 0, 0, available, 0)) break;
+      }
+    }
+    const exitCode = Buffer.alloc(4);
+    if (kernel.GetExitCodeProcess(this.process, exitCode) && exitCode.readUInt32LE(0) !== 259) {
+      this.closed = true;
+      clearInterval(this.pollTimer);
+      this.conpty.ConptyClosePseudoConsole(this.pseudo);
+      kernel.CloseHandle(this.input);
+      kernel.CloseHandle(this.output);
+      kernel.CloseHandle(this.process);
+      for (const handler of this.exitHandlers) handler();
+    }
+  }
+}
+
+module.exports = WindowsConptyBackend;

package/initramfs/buninu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buninu",
-  "version": "0.4.17",
+  "version": "0.4.18",
   "description": "Buninu is a portable, self-bootstrapping Unix-like userspace built on Bun that runs across operating systems",
   "type": "module",
   "main": "./bin/init.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buninu-linux",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "description": "A Linux distribution running Bun as PID 1 with the Buninu userspace.",
   "type": "module",
   "main": "./index.js",

package/scripts/cpio.js

@@ -0,0 +1,107 @@
+#!/usr/bin/env bun
+// Writes the initramfs without fakeroot, cpio or gzip: a gzipped newc
+// archive of a directory tree, plus device nodes that exist only in the
+// archive. pack-initramfs.sh runs it instead of `fakeroot-tcp ... cpio |
+// gzip` when BUNINU_JS_CPIO=1. Written against node: APIs only, so it runs
+// under node as well as bun.
+//
+//   scripts/cpio.js DIRECTORY OUTPUT.cpio.gz [PATH:c:MAJOR:MINOR:MODE]...
+//
+// e.g. dev/console:c:5:1:0600. Like `find . | sort | cpio --create
+// --format=newc --owner=0:0 --reproducible` with the nodes made by mknod:
+// every entry is owned by 0:0, inode numbers count up from 1 and device
+// numbers of the containing filesystem are 0. Entries are sorted by name
+// byte by byte, so the archive does not depend on the locale. mtimes are the
+// files' own, or SOURCE_DATE_EPOCH for every entry when it is set; the
+// device nodes get SOURCE_DATE_EPOCH or the current time.
+
+import { lstatSync, readdirSync, readFileSync, readlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { constants, gzipSync } from "node:zlib";
+
+const fail = (message) => {
+  console.error(`cpio.js: ${message}`);
+  process.exit(1);
+};
+
+const [directory, output, ...deviceSpecs] = process.argv.slice(2);
+if (!directory || !output) fail("usage: cpio.js DIRECTORY OUTPUT.cpio.gz [PATH:c:MAJOR:MINOR:MODE]...");
+const epoch = process.env.SOURCE_DATE_EPOCH === undefined ? null : Number(process.env.SOURCE_DATE_EPOCH);
+if (epoch !== null && !Number.isInteger(epoch)) fail(`SOURCE_DATE_EPOCH is not a number: ${process.env.SOURCE_DATE_EPOCH}`);
+
+const S_IFMT = 0o170000;
+const S_IFDIR = 0o040000;
+const S_IFREG = 0o100000;
+const S_IFLNK = 0o120000;
+const S_IFCHR = 0o020000;
+const S_IFBLK = 0o060000;
+
+// Every path under the directory, relative to it.
+const entries = [];
+const walk = (relative) => {
+  for (const name of readdirSync(join(directory, relative))) {
+    const path = relative ? `${relative}/${name}` : name;
+    const stat = lstatSync(join(directory, path));
+    entries.push({ path, stat });
+    if (stat.isDirectory()) walk(path);
+  }
+};
+walk("");
+
+const now = Math.floor(Date.now() / 1000);
+const existing = new Set(entries.map(({ path }) => path));
+for (const spec of deviceSpecs) {
+  const [path, kind, major, minor, mode] = spec.split(":");
+  if (!path || !["c", "b"].includes(kind) || !/^\d+$/.test(major) || !/^\d+$/.test(minor) || !/^[0-7]{3,4}$/.test(mode)) {
+    fail(`bad device ${spec}; expected PATH:c:MAJOR:MINOR:MODE`);
+  }
+  if (existing.has(path)) fail(`${path} already exists in ${directory}`);
+  const parent = path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : "";
+  if (parent && !existing.has(parent)) fail(`${path}: no directory ${parent} in ${directory}`);
+  entries.push({
+    path,
+    device: { mode: (kind === "c" ? S_IFCHR : S_IFBLK) | parseInt(mode, 8), major: Number(major), minor: Number(minor) },
+  });
+  existing.add(path);
+}
+entries.sort((a, b) => Buffer.compare(Buffer.from(a.path), Buffer.from(b.path)));
+
+const chunks = [];
+const hex = (value) => (value >>> 0).toString(16).padStart(8, "0");
+const pad = (length) => { if (length % 4) chunks.push(Buffer.alloc(4 - (length % 4))); };
+const add = (name, { ino, mode, nlink, mtime, data, rdevMajor = 0, rdevMinor = 0 }) => {
+  const nameBytes = Buffer.from(`${name}\0`);
+  // magic, ino, mode, uid, gid, nlink, mtime, filesize, devmajor, devminor,
+  // rdevmajor, rdevminor, namesize, check
+  const header = Buffer.from("070701" + [ino, mode, 0, 0, nlink, mtime, data.length, 0, 0, rdevMajor, rdevMinor, nameBytes.length, 0]
+    .map(hex).join(""), "latin1");
+  chunks.push(header, nameBytes);
+  pad(header.length + nameBytes.length);
+  chunks.push(data);
+  pad(data.length);
+};
+
+entries.forEach(({ path, stat, device }, index) => {
+  const ino = index + 1;
+  if (device) {
+    add(path, { ino, mode: device.mode, nlink: 1, mtime: epoch ?? now, data: Buffer.alloc(0), rdevMajor: device.major, rdevMinor: device.minor });
+    return;
+  }
+  const type = stat.mode & S_IFMT;
+  const mtime = epoch ?? Math.floor(stat.mtimeMs / 1000);
+  let data = Buffer.alloc(0);
+  let nlink = 1;
+  if (type === S_IFREG) data = readFileSync(join(directory, path));
+  else if (type === S_IFLNK) data = Buffer.from(readlinkSync(join(directory, path)));
+  else if (type === S_IFDIR) nlink = stat.nlink;
+  else fail(`${path}: unsupported file type ${type.toString(8)}; pass device nodes as PATH:c:MAJOR:MINOR:MODE`);
+  add(path, { ino, mode: stat.mode, nlink, mtime, data });
+});
+add("TRAILER!!!", { ino: 0, mode: 0, nlink: 1, mtime: 0, data: Buffer.alloc(0) });
+// GNU cpio pads the archive to a 512-byte block.
+const total = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
+if (total % 512) chunks.push(Buffer.alloc(512 - (total % 512)));
+
+// Like `gzip -9n`: zlib leaves the name out and writes 0 as the mtime.
+writeFileSync(output, gzipSync(Buffer.concat(chunks), { level: constants.Z_BEST_COMPRESSION }));
+console.log(`cpio.js: ${output}: ${entries.length} entries`);

package/scripts/pack-initramfs.sh

@@ -50,6 +50,22 @@ mkdir -p "$staging/usr/share/icons/hicolor/512x512/apps" "$staging/usr/share/pix
 ln -sfn ../../../../../../buninu/icon.png "$staging/usr/share/icons/hicolor/512x512/apps/buninu-linux.png"
 ln -sfn ../../../buninu/icon.png "$staging/usr/share/pixmaps/buninu-linux.png"
 
+# BUNINU_JS_CPIO=1 writes the archive with scripts/cpio.js (bun or node)
+# instead of fakeroot, cpio and gzip: the device nodes below exist only in
+# the archive, so nothing needs root.
+if [ "${BUNINU_JS_CPIO:-}" = 1 ]; then
+    js=$(command -v bun || command -v node) || {
+        echo "error: BUNINU_JS_CPIO=1 needs bun or node on PATH" >&2
+        exit 1
+    }
+    "$js" scripts/cpio.js "$staging" build/initramfs.cpio.gz \
+        dev/console:c:5:1:0600 "dev/$serial_console:c:$serial_major:64:0620" \
+        dev/null:c:1:3:0666 dev/zero:c:1:5:0666 dev/random:c:1:8:0666 \
+        dev/urandom:c:1:9:0666 dev/tty:c:5:0:0666
+    echo "Built build/initramfs.cpio.gz for $arch (scripts/cpio.js)"
+    exit 0
+fi
+
 # fakeroot lets cpio record the character devices without real root. Nothing
 # has mounted devtmpfs when the kernel execs Bun as PID 1, so every device
 # Bun's startup needs has to be in the archive itself:

package/scripts/uki.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env bun
+// Assembles a UKI without binutils: the systemd EFI stub (a PE32+ image,
+// x86_64 or aarch64) with .osrel, .cmdline, .linux and .initrd added as
+// read-only data sections. build-uki.sh runs it instead of objdump/objcopy
+// when BUNINU_JS_UKI=1. Written from the PE/COFF specification against
+// node: APIs only, so it runs under node as well as bun.
+//
+//   scripts/uki.js STUB OUTPUT .osrel=FILE .cmdline=FILE .linux=FILE .initrd=FILE
+//
+// The section addresses follow build-uki.sh: the conventional offsets from
+// the image base (.osrel +0x20000, .cmdline +0x30000, .linux +0x2000000,
+// .initrd +0x3000000), moved up when the stub or the kernel is larger. The
+// stub's own headers and sections are kept where they are; the new sections
+// are appended to the file. TimeDateStamp is SOURCE_DATE_EPOCH when set,
+// otherwise the stub's own, so the output depends only on the inputs.
+
+import { readFileSync, writeFileSync } from "node:fs";
+
+const fail = (message) => {
+  console.error(`uki.js: ${message}`);
+  process.exit(1);
+};
+
+const [stubPath, outputPath, ...pairs] = process.argv.slice(2);
+if (!stubPath || !outputPath) fail("usage: uki.js STUB OUTPUT .osrel=FILE .cmdline=FILE .linux=FILE .initrd=FILE");
+const files = new Map();
+for (const pair of pairs) {
+  const separator = pair.indexOf("=");
+  if (separator < 1) fail(`expected .section=FILE, got ${pair}`);
+  files.set(pair.slice(0, separator), pair.slice(separator + 1));
+}
+const order = [".osrel", ".cmdline", ".linux", ".initrd"];
+for (const name of order) if (!files.has(name)) fail(`missing ${name}=FILE`);
+if (files.size !== order.length) fail(`only ${order.join(", ")} are supported`);
+
+const stub = readFileSync(stubPath);
+if (stub.toString("latin1", 0, 2) !== "MZ") fail(`${stubPath} is not a PE image`);
+const pe = stub.readUInt32LE(0x3c);
+if (stub.toString("latin1", pe, pe + 4) !== "PE\0\0") fail(`${stubPath} is not a PE image`);
+const coff = pe + 4;
+const sectionCount = stub.readUInt16LE(coff + 2);
+const optionalSize = stub.readUInt16LE(coff + 16);
+const optional = coff + 20;
+if (stub.readUInt16LE(optional) !== 0x20b) fail(`${stubPath} is not PE32+`);
+if (stub.readUInt32LE(coff + 8) !== 0) fail(`${stubPath} has a COFF symbol table, which is not supported`);
+const imageBase = stub.readBigUInt64LE(optional + 24);
+const sectionAlignment = stub.readUInt32LE(optional + 32);
+const fileAlignment = stub.readUInt32LE(optional + 36);
+const stubImageSize = stub.readUInt32LE(optional + 56);
+const headersSize = stub.readUInt32LE(optional + 60);
+const directoryCount = stub.readUInt32LE(optional + 108);
+// A signature (the certificate table) covers the file up to its end;
+// appending after it would invalidate it.
+if (directoryCount > 4 && stub.readUInt32LE(optional + 112 + 4 * 8 + 4) !== 0) {
+  fail(`${stubPath} is signed; adding sections would break the signature`);
+}
+
+const table = optional + optionalSize;
+let firstData = stub.length;
+for (let index = 0; index < sectionCount; index++) {
+  const header = table + index * 40;
+  const raw = stub.readUInt32LE(header + 20);
+  if (stub.readUInt32LE(header + 16) && raw) firstData = Math.min(firstData, raw);
+}
+const tableEnd = table + (sectionCount + order.length) * 40;
+if (tableEnd > Math.min(headersSize, firstData)) {
+  fail(`no room in ${stubPath}'s headers for ${order.length} more section headers`);
+}
+
+const alignUp = (value, alignment) => Math.ceil(value / alignment) * alignment;
+const data = order.map((name) => readFileSync(files.get(name)));
+const [, , kernel] = data;
+const osrel = Math.max(0x20000, alignUp(stubImageSize, 0x10000));
+const cmdline = osrel + 0x10000;
+const linux = Math.max(0x2000000, alignUp(cmdline + 0x10000, 0x1000000));
+const initrd = Math.max(0x3000000, alignUp(linux + kernel.length, 0x1000000));
+const addresses = [osrel, cmdline, linux, initrd];
+if (data[0].length > 0x10000 || data[1].length > 0x10000) fail(".osrel and .cmdline must each fit in 64 KiB");
+
+// Section contents go after everything already in the file, each at a
+// FileAlignment boundary and padded to a multiple of it.
+let offset = alignUp(stub.length, fileAlignment);
+const pointers = data.map((bytes) => {
+  const pointer = offset;
+  offset += alignUp(bytes.length, fileAlignment);
+  return pointer;
+});
+const output = Buffer.alloc(offset);
+stub.copy(output);
+order.forEach((name, index) => {
+  const header = table + (sectionCount + index) * 40;
+  const bytes = data[index];
+  output.fill(0, header, header + 40);
+  output.write(name, header, 8, "latin1");
+  output.writeUInt32LE(bytes.length, header + 8); // VirtualSize
+  output.writeUInt32LE(addresses[index], header + 12); // VirtualAddress
+  output.writeUInt32LE(alignUp(bytes.length, fileAlignment), header + 16); // SizeOfRawData
+  output.writeUInt32LE(pointers[index], header + 20); // PointerToRawData
+  // IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ: objcopy's
+  // contents,alloc,load,readonly,data.
+  output.writeUInt32LE(0x40000040, header + 36);
+  bytes.copy(output, pointers[index]);
+});
+output.writeUInt16LE(sectionCount + order.length, coff + 2);
+// SizeOfCode, SizeOfInitializedData and SizeOfUninitializedData: the raw
+// sizes of the sections of each kind, recomputed as objcopy does.
+const sizes = [0, 0, 0];
+for (let index = 0; index < sectionCount + order.length; index++) {
+  const header = table + index * 40;
+  const characteristics = output.readUInt32LE(header + 36);
+  const rawSize = output.readUInt32LE(header + 16);
+  [0x20, 0x40, 0x80].forEach((flag, kind) => { if (characteristics & flag) sizes[kind] += rawSize; });
+}
+sizes.forEach((size, kind) => output.writeUInt32LE(size >>> 0, optional + 4 + kind * 4));
+output.writeUInt32LE(alignUp(initrd + data[3].length, sectionAlignment), optional + 56); // SizeOfImage
+if (process.env.SOURCE_DATE_EPOCH !== undefined) {
+  output.writeUInt32LE(Number(process.env.SOURCE_DATE_EPOCH) >>> 0, coff + 4);
+}
+
+// The PE checksum: 16-bit one's-complement-style sum of the file with the
+// CheckSum field itself taken as zero, plus the file length.
+output.writeUInt32LE(0, optional + 64);
+let sum = 0;
+for (let index = 0; index + 1 < output.length; index += 2) {
+  sum += output.readUInt16LE(index);
+  sum = (sum & 0xffff) + (sum >>> 16);
+}
+if (output.length & 1) {
+  sum += output[output.length - 1];
+  sum = (sum & 0xffff) + (sum >>> 16);
+}
+output.writeUInt32LE(((sum & 0xffff) + output.length) >>> 0, optional + 64);
+
+writeFileSync(outputPath, output);
+const hex = (value) => `0x${value.toString(16)}`;
+console.log(`uki.js: ${outputPath}: image base ${hex(imageBase)}, ${order.map((name, index) => `${name} +${hex(addresses[index])}`).join(", ")}`);