buninu-linux 0.7.3 → 0.7.4

package/build-uki.sh

@@ -35,13 +35,33 @@ else
 fi
 printf '%s' "$consoles panic=0 PATH=/bin KERNEL_RELEASE=$kernel_release rdinit=/bin/bun -- -e import('/init.js')" > build/cmdline
 
+# Only this architecture's removable-media name may remain: firmware of the
+# other architecture ignores it, but run-qemu.sh reads the guest from it.
+for efi in vda/EFI/BOOT/*.EFI; do
+    [ "$efi" = "vda/EFI/BOOT/$efi_boot_name" ] || rm -f "$efi"
+done
+
+stub="$kernel_dir/$efi_stub"
+# BUNINU_JS_UKI=1 assembles the UKI with scripts/uki.js (bun or node) instead
+# of binutils; it lays the sections out by the same rules as below.
+if [ "${BUNINU_JS_UKI:-}" = 1 ]; then
+    js=$(command -v bun || command -v node) || {
+        echo "error: BUNINU_JS_UKI=1 needs bun or node on PATH" >&2
+        exit 1
+    }
+    "$js" scripts/uki.js "$stub" "vda/EFI/BOOT/$efi_boot_name" \
+        .osrel=build/os-release .cmdline=build/cmdline \
+        .linux="$kernel_image" .initrd=build/initramfs.cpio.gz
+    echo "Built $arch UKI with Alpine linux-$linux_flavor at vda/EFI/BOOT/$efi_boot_name (scripts/uki.js)"
+    exit 0
+fi
+
 if ! command -v "$uki_objcopy" >/dev/null || ! command -v "$uki_objdump" >/dev/null; then
     echo "error: build stage needs $uki_objcopy and $uki_objdump (Debian $uki_binutils_package)" >&2
     echo "run inside PRoot or with ./index.js --docker; see README Build environment" >&2
     exit 1
 fi
 
-stub="$kernel_dir/$efi_stub"
 pe_header() { "$uki_objdump" -p "$stub" | awk -v key="$1" '$1 == key { print $2; exit }'; }
 align_up() { echo $(( ($1 + $2 - 1) / $2 * $2 )); }
 max() { echo $(( $1 > $2 ? $1 : $2 )); }
@@ -65,12 +85,6 @@ cmdline_vma=$((image_base + cmdline_offset))
 linux_vma=$((image_base + linux_offset))
 initrd_vma=$((image_base + initrd_offset))
 
-# Only this architecture's removable-media name may remain: firmware of the
-# other architecture ignores it, but run-qemu.sh reads the guest from it.
-for efi in vda/EFI/BOOT/*.EFI; do
-    [ "$efi" = "vda/EFI/BOOT/$efi_boot_name" ] || rm -f "$efi"
-done
-
 "$uki_objcopy" \
     --add-section .osrel=build/os-release \
     --change-section-vma .osrel="$osrel_vma" \

package/check_build.js

@@ -0,0 +1,217 @@
+#!/usr/bin/env bun
+// Content checksums of the build outputs that ignore what changes from build
+// to build without changing what boots: file mtimes and inode numbers in the
+// initramfs, the PE timestamp and checksum of the UKI, and the GPT GUIDs,
+// FAT serial and FAT timestamps of the disk image. Two builds of the same
+// inputs print the same sums.
+//
+//   ./check_build.js                 build/initramfs.cpio.gz, the UKI(s) under vda/EFI/BOOT, vda.img
+//   ./check_build.js FILE...         any of: .cpio(.gz), PE/EFI, GPT disk image or bare FAT image
+//
+// Written against node: APIs only, so it runs under node as well as bun.
+
+import { createHash } from "node:crypto";
+import { readdirSync, readFileSync, existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { gunzipSync } from "node:zlib";
+
+const sha256 = (...parts) => {
+  const hasher = createHash("sha256");
+  for (const part of parts) hasher.update(part);
+  return hasher.digest("hex");
+};
+
+const u16 = (b, o) => b[o] | (b[o + 1] << 8);
+const u32 = (b, o) => (b[o] | (b[o + 1] << 8) | (b[o + 2] << 16) | (b[o + 3] << 24)) >>> 0;
+const u64 = (b, o) => u32(b, o) + u32(b, o + 4) * 2 ** 32;
+const ascii = (b, o, n) => String.fromCharCode(...b.subarray(o, o + n));
+
+// --- initramfs: newc cpio, optionally gzipped -------------------------------
+// Kept per entry: name, mode, uid, gid, device numbers of special files, size
+// and data. Dropped: inode, mtime, link count, the containing device, and
+// the order of the entries (`sort` follows the locale, and the unpacked tree
+// is the same either way): entries count sorted by name, byte by byte.
+function cpioSum(bytes) {
+  if (bytes[0] === 0x1f && bytes[1] === 0x8b) bytes = gunzipSync(bytes);
+  const entries = [];
+  let offset = 0;
+  while (offset + 110 <= bytes.length) {
+    const magic = ascii(bytes, offset, 6);
+    if (magic !== "070701" && magic !== "070702") throw new Error(`not a newc cpio entry at ${offset}`);
+    const field = (index) => parseInt(ascii(bytes, offset + 6 + index * 8, 8), 16);
+    const [mode, uid, gid, size, rdevMajor, rdevMinor, nameSize] =
+      [field(1), field(2), field(3), field(6), field(9), field(10), field(11)];
+    const name = Buffer.from(bytes.subarray(offset + 110, offset + 110 + nameSize - 1));
+    const data = (offset + 110 + nameSize + 3) & ~3;
+    const next = (data + size + 3) & ~3;
+    if (name.toString("latin1") === "TRAILER!!!") break;
+    entries.push({ name, header: `\0${mode.toString(8)} ${uid} ${gid} ${rdevMajor}:${rdevMinor} ${size}\n`, data: bytes.subarray(data, data + size) });
+    offset = next;
+  }
+  entries.sort((a, b) => Buffer.compare(a.name, b.name));
+  const hasher = createHash("sha256");
+  for (const { name, header, data } of entries) {
+    hasher.update(name);
+    hasher.update(header);
+    hasher.update(data);
+  }
+  return { sum: hasher.digest("hex"), detail: `${entries.length} entries` };
+}
+
+// --- UKI: PE image ----------------------------------------------------------
+// The whole file with the COFF TimeDateStamp and optional-header CheckSum
+// zeroed, except that the .initrd section counts by its cpio content sum.
+// The gzip output's size varies with the mtimes inside, so everything that
+// follows it is left out too: the .initrd sizes in the section table, the
+// file length (its raw data is cut out rather than zeroed), SizeOfImage and
+// SizeOfInitializedData.
+function peSum(bytes) {
+  const pe = u32(bytes, 0x3c);
+  if (ascii(bytes, pe, 4) !== "PE\0\0") throw new Error("not a PE image");
+  const coff = pe + 4;
+  const sections = u16(bytes, coff + 2);
+  const optional = coff + 20;
+  const table = optional + u16(bytes, coff + 16);
+  const copy = Uint8Array.from(bytes);
+  copy.fill(0, coff + 4, coff + 8); // TimeDateStamp
+  copy.fill(0, optional + 64, optional + 68); // CheckSum
+  let initrd = null;
+  let cut = null;
+  for (let index = 0; index < sections; index++) {
+    const header = table + index * 40;
+    const name = ascii(bytes, header, 8).replace(/\0+$/, "");
+    if (name !== ".initrd") continue;
+    const rawSize = u32(bytes, header + 16);
+    const start = u32(bytes, header + 20);
+    initrd = cpioSum(bytes.subarray(start, start + (u32(bytes, header + 8) || rawSize)));
+    cut = [start, start + rawSize];
+    copy.fill(0, header + 8, header + 12); // VirtualSize
+    copy.fill(0, header + 16, header + 20); // SizeOfRawData
+    copy.fill(0, optional + 8, optional + 12); // SizeOfInitializedData
+    copy.fill(0, optional + 56, optional + 60); // SizeOfImage
+    // Sections stored after it move with its size.
+    for (let other = 0; other < sections; other++) {
+      const otherHeader = table + other * 40;
+      if (u32(bytes, otherHeader + 20) > start) copy.fill(0, otherHeader + 20, otherHeader + 24);
+    }
+  }
+  const parts = cut ? [copy.subarray(0, cut[0]), copy.subarray(cut[1])] : [copy];
+  const sum = sha256(...parts, initrd?.sum ?? "");
+  return { sum, detail: initrd ? `.initrd ${initrd.sum.slice(0, 16)} (${initrd.detail})` : "no .initrd" };
+}
+
+// --- disk image: GPT with a FAT ESP, or a bare FAT filesystem ----------------
+// GPT: each partition's start, size and type, but not the disk or partition
+// GUIDs. FAT: the file tree (names, sizes, contents), not timestamps, serial
+// or free-space contents. .EFI files inside count by their PE sum, not their length.
+function diskSum(bytes) {
+  if (ascii(bytes, 512, 8) !== "EFI PART") return fatSum(bytes);
+  const entriesLba = u64(bytes, 512 + 72);
+  const count = u32(bytes, 512 + 80);
+  const entrySize = u32(bytes, 512 + 84);
+  const parts = [];
+  for (let index = 0; index < count; index++) {
+    const entry = entriesLba * 512 + index * entrySize;
+    const type = bytes.subarray(entry, entry + 16);
+    if (type.every((byte) => byte === 0)) continue;
+    const first = u64(bytes, entry + 32);
+    const last = u64(bytes, entry + 40);
+    const fs = fatSum(bytes.subarray(first * 512, (last + 1) * 512));
+    parts.push(`${Buffer.from(type).toString("hex")} ${first} ${last} ${fs.sum}\n`);
+  }
+  const lines = parts.map((line) => line.split(" ")[3].trim().slice(0, 16));
+  return { sum: sha256(...parts), detail: `${parts.length} partition(s), files ${lines.join(", ")}` };
+}
+
+function fatSum(bytes) {
+  const bytesPerSector = u16(bytes, 11);
+  const sectorsPerCluster = bytes[13];
+  const reserved = u16(bytes, 14);
+  const fats = bytes[16];
+  const rootEntries = u16(bytes, 17);
+  const fatSize = u16(bytes, 22) || u32(bytes, 36);
+  const totalSectors = u16(bytes, 19) || u32(bytes, 32);
+  if (bytes[510] !== 0x55 || bytes[511] !== 0xaa || !bytesPerSector) throw new Error("no FAT filesystem");
+  const rootSectors = Math.ceil((rootEntries * 32) / bytesPerSector);
+  const dataStart = (reserved + fats * fatSize + rootSectors) * bytesPerSector;
+  const clusterBytes = sectorsPerCluster * bytesPerSector;
+  const clusters = (totalSectors * bytesPerSector - dataStart) / clusterBytes;
+  const fat32 = clusters >= 65525;
+  const fat12 = clusters < 4085;
+  const fatOffset = reserved * bytesPerSector;
+  const nextCluster = (cluster) => {
+    if (fat32) return u32(bytes, fatOffset + cluster * 4) & 0x0fffffff;
+    if (!fat12) return u16(bytes, fatOffset + cluster * 2);
+    const value = u16(bytes, fatOffset + Math.floor(cluster * 1.5));
+    return cluster & 1 ? value >> 4 : value & 0xfff;
+  };
+  const end = fat32 ? 0x0ffffff8 : fat12 ? 0xff8 : 0xfff8;
+  const chain = (cluster) => {
+    const pieces = [];
+    for (; cluster >= 2 && cluster < end; cluster = nextCluster(cluster)) {
+      const start = dataStart + (cluster - 2) * clusterBytes;
+      pieces.push(bytes.subarray(start, start + clusterBytes));
+    }
+    return Buffer.concat(pieces);
+  };
+  const rootStart = (reserved + fats * fatSize) * bytesPerSector;
+  const root = fat32 ? chain(u32(bytes, 44)) : bytes.subarray(rootStart, rootStart + rootEntries * 32);
+  const files = [];
+  const walk = (directory, path) => {
+    for (let offset = 0; offset + 32 <= directory.length; offset += 32) {
+      const first = directory[offset];
+      if (first === 0) break;
+      const attributes = directory[offset + 11];
+      if (first === 0xe5 || attributes === 0x0f || attributes & 0x08) continue; // deleted, long name, label
+      const base = ascii(directory, offset, 8).trimEnd();
+      const extension = ascii(directory, offset + 8, 3).trimEnd();
+      if (base === "." || base === "..") continue;
+      const name = path + base + (extension ? "." + extension : "");
+      const cluster = (u16(directory, offset + 20) << 16) | u16(directory, offset + 26);
+      if (attributes & 0x10) {
+        files.push(`${name}/\n`);
+        walk(chain(cluster), name + "/");
+      } else {
+        const data = chain(cluster).subarray(0, u32(directory, offset + 28));
+        // A UKI's length follows its .initrd's gzip size; its PE sum covers the rest.
+        const pe = isPE(data);
+        files.push(`${name} ${pe ? "pe" : data.length} ${pe ? peSum(data).sum : sha256(data)}\n`);
+      }
+    }
+  };
+  walk(root, "/");
+  return { sum: sha256(...files), detail: files.map((line) => line.split(" ")[0].trim()).join(" ") };
+}
+
+const isPE = (bytes) => bytes[0] === 0x4d && bytes[1] === 0x5a && bytes.length > 0x40 &&
+  ascii(bytes, u32(bytes, 0x3c), 4) === "PE\0\0";
+
+function check(path) {
+  const bytes = new Uint8Array(readFileSync(path));
+  if ((bytes[0] === 0x1f && bytes[1] === 0x8b) || ascii(bytes, 0, 5) === "07070") return cpioSum(bytes);
+  if (isPE(bytes)) return peSum(bytes);
+  return diskSum(bytes);
+}
+
+const root = dirname(fileURLToPath(import.meta.url));
+let paths = process.argv.slice(2);
+if (paths.length === 0) {
+  const boot = join(root, "vda/EFI/BOOT");
+  paths = [
+    join(root, "build/initramfs.cpio.gz"),
+    ...(existsSync(boot) ? readdirSync(boot).filter((name) => /\.efi$/i.test(name)).sort().map((name) => join(boot, name)) : []),
+    join(root, "vda.img"),
+  ].filter((path) => existsSync(path));
+}
+let failed = false;
+for (const path of paths) {
+  try {
+    const { sum, detail } = check(path);
+    console.log(`${sum}  ${path}  (${detail})`);
+  } catch (error) {
+    console.error(`${path}: ${error.message}`);
+    failed = true;
+  }
+}
+process.exit(failed ? 1 : 0);

package/index.js

@@ -51,8 +51,12 @@ const stages = [
     short: "b",
     scripts: ["build-uki.sh", "build-image.sh"],
     tools: (arch) => [
-      "fakeroot", "cpio", "gzip",
-      `${architectures[arch].binutils}-objcopy`, `${architectures[arch].binutils}-objdump`,
+      // BUNINU_JS_CPIO=1: pack-initramfs.sh writes the archive with scripts/cpio.js.
+      ...(process.env.BUNINU_JS_CPIO === "1" ? [] : ["fakeroot", "cpio", "gzip"]),
+      // BUNINU_JS_UKI=1: build-uki.sh assembles the UKI with scripts/uki.js.
+      ...(process.env.BUNINU_JS_UKI === "1"
+        ? []
+        : [`${architectures[arch].binutils}-objcopy`, `${architectures[arch].binutils}-objdump`]),
       "parted", "mkfs.fat", "mmd", "mcopy",
     ],
   },
@@ -75,6 +79,7 @@ function usage() {
 Usage:
   ${pkg.name} [-f] [-b] [-r] [--arch ARCH] [--docker] [--export] [--linux-lts]
                [--real] [-- qemu arguments]
+  ${pkg.name} --check [FILE...]
 
 Stages (always run in this order, whichever you pick):
   -f, --fetch   download and verify the pinned kernel, musl, GCC runtime,
@@ -100,6 +105,12 @@ Stages (always run in this order, whichever you pick):
                 primary console, and include USB xHCI/HID keyboard modules
                 (x86_64 only)
 
+  --check [FILE...]
+                print content checksums of the build outputs that ignore
+                mtimes, timestamps and GUIDs, and exit (check_build.js; the
+                arguments after it are its own: .img, .efi or .cpio files,
+                by default the initramfs, the UKI and vda.img)
+
   -h, --help    show this
   -V, --version show name, version, runtime and platform
   --readme      render README.md in the terminal and exit
@@ -149,6 +160,8 @@ function parse(argv) {
     } else if (argument === "--readme") {
       printReadme();
       process.exit(0);
+    } else if (argument === "--check") {
+      runCheck(argv.slice(index + 1));
     } else if (argument === "--linux-lts") {
       linuxLts = true;
     } else if (argument === "--real") {
@@ -217,6 +230,14 @@ function printReadme() {
   process.stdout.write(rendered.endsWith("\n") ? rendered : rendered + "\n");
 }
 
+// --check hands everything after it to check_build.js, under the same
+// runtime, and exits with its status.
+function runCheck(args) {
+  const result = spawnSync(process.execPath, [resolve(rootDir, "check_build.js"), ...args], { stdio: "inherit" });
+  if (result.error) fail(`could not start check_build.js: ${result.error.message}`);
+  process.exit(result.status ?? 1);
+}
+
 // `command -v` without a shell: look for an executable on PATH.
 function hasTool(name) {
   for (const directory of (process.env.PATH ?? "").split(delimiter)) {
@@ -284,7 +305,7 @@ function dockerImage() {
 // into the bind-mounted checkout stays owned by that user; fakeroot provides
 // the root ownership the initramfs records.
 function dockerRun(script, env) {
-  const passEnv = ["BUNINU_ARCH", "LINUX_FLAVOR", "REAL_MACHINE", "ALPINE_MIRROR"]
+  const passEnv = ["BUNINU_ARCH", "LINUX_FLAVOR", "REAL_MACHINE", "ALPINE_MIRROR", "BUNINU_JS_UKI", "BUNINU_JS_CPIO"]
     .filter((name) => env[name] !== undefined)
     .flatMap((name) => ["--env", `${name}=${env[name]}`]);
   const user = typeof process.getuid === "function"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buninu-linux",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "A Linux distribution running Bun as PID 1 with the Buninu userspace.",
   "type": "module",
   "main": "./index.js",

package/scripts/cpio.js

@@ -0,0 +1,107 @@
+#!/usr/bin/env bun
+// Writes the initramfs without fakeroot, cpio or gzip: a gzipped newc
+// archive of a directory tree, plus device nodes that exist only in the
+// archive. pack-initramfs.sh runs it instead of `fakeroot-tcp ... cpio |
+// gzip` when BUNINU_JS_CPIO=1. Written against node: APIs only, so it runs
+// under node as well as bun.
+//
+//   scripts/cpio.js DIRECTORY OUTPUT.cpio.gz [PATH:c:MAJOR:MINOR:MODE]...
+//
+// e.g. dev/console:c:5:1:0600. Like `find . | sort | cpio --create
+// --format=newc --owner=0:0 --reproducible` with the nodes made by mknod:
+// every entry is owned by 0:0, inode numbers count up from 1 and device
+// numbers of the containing filesystem are 0. Entries are sorted by name
+// byte by byte, so the archive does not depend on the locale. mtimes are the
+// files' own, or SOURCE_DATE_EPOCH for every entry when it is set; the
+// device nodes get SOURCE_DATE_EPOCH or the current time.
+
+import { lstatSync, readdirSync, readFileSync, readlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { constants, gzipSync } from "node:zlib";
+
+const fail = (message) => {
+  console.error(`cpio.js: ${message}`);
+  process.exit(1);
+};
+
+const [directory, output, ...deviceSpecs] = process.argv.slice(2);
+if (!directory || !output) fail("usage: cpio.js DIRECTORY OUTPUT.cpio.gz [PATH:c:MAJOR:MINOR:MODE]...");
+const epoch = process.env.SOURCE_DATE_EPOCH === undefined ? null : Number(process.env.SOURCE_DATE_EPOCH);
+if (epoch !== null && !Number.isInteger(epoch)) fail(`SOURCE_DATE_EPOCH is not a number: ${process.env.SOURCE_DATE_EPOCH}`);
+
+const S_IFMT = 0o170000;
+const S_IFDIR = 0o040000;
+const S_IFREG = 0o100000;
+const S_IFLNK = 0o120000;
+const S_IFCHR = 0o020000;
+const S_IFBLK = 0o060000;
+
+// Every path under the directory, relative to it.
+const entries = [];
+const walk = (relative) => {
+  for (const name of readdirSync(join(directory, relative))) {
+    const path = relative ? `${relative}/${name}` : name;
+    const stat = lstatSync(join(directory, path));
+    entries.push({ path, stat });
+    if (stat.isDirectory()) walk(path);
+  }
+};
+walk("");
+
+const now = Math.floor(Date.now() / 1000);
+const existing = new Set(entries.map(({ path }) => path));
+for (const spec of deviceSpecs) {
+  const [path, kind, major, minor, mode] = spec.split(":");
+  if (!path || !["c", "b"].includes(kind) || !/^\d+$/.test(major) || !/^\d+$/.test(minor) || !/^[0-7]{3,4}$/.test(mode)) {
+    fail(`bad device ${spec}; expected PATH:c:MAJOR:MINOR:MODE`);
+  }
+  if (existing.has(path)) fail(`${path} already exists in ${directory}`);
+  const parent = path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : "";
+  if (parent && !existing.has(parent)) fail(`${path}: no directory ${parent} in ${directory}`);
+  entries.push({
+    path,
+    device: { mode: (kind === "c" ? S_IFCHR : S_IFBLK) | parseInt(mode, 8), major: Number(major), minor: Number(minor) },
+  });
+  existing.add(path);
+}
+entries.sort((a, b) => Buffer.compare(Buffer.from(a.path), Buffer.from(b.path)));
+
+const chunks = [];
+const hex = (value) => (value >>> 0).toString(16).padStart(8, "0");
+const pad = (length) => { if (length % 4) chunks.push(Buffer.alloc(4 - (length % 4))); };
+const add = (name, { ino, mode, nlink, mtime, data, rdevMajor = 0, rdevMinor = 0 }) => {
+  const nameBytes = Buffer.from(`${name}\0`);
+  // magic, ino, mode, uid, gid, nlink, mtime, filesize, devmajor, devminor,
+  // rdevmajor, rdevminor, namesize, check
+  const header = Buffer.from("070701" + [ino, mode, 0, 0, nlink, mtime, data.length, 0, 0, rdevMajor, rdevMinor, nameBytes.length, 0]
+    .map(hex).join(""), "latin1");
+  chunks.push(header, nameBytes);
+  pad(header.length + nameBytes.length);
+  chunks.push(data);
+  pad(data.length);
+};
+
+entries.forEach(({ path, stat, device }, index) => {
+  const ino = index + 1;
+  if (device) {
+    add(path, { ino, mode: device.mode, nlink: 1, mtime: epoch ?? now, data: Buffer.alloc(0), rdevMajor: device.major, rdevMinor: device.minor });
+    return;
+  }
+  const type = stat.mode & S_IFMT;
+  const mtime = epoch ?? Math.floor(stat.mtimeMs / 1000);
+  let data = Buffer.alloc(0);
+  let nlink = 1;
+  if (type === S_IFREG) data = readFileSync(join(directory, path));
+  else if (type === S_IFLNK) data = Buffer.from(readlinkSync(join(directory, path)));
+  else if (type === S_IFDIR) nlink = stat.nlink;
+  else fail(`${path}: unsupported file type ${type.toString(8)}; pass device nodes as PATH:c:MAJOR:MINOR:MODE`);
+  add(path, { ino, mode: stat.mode, nlink, mtime, data });
+});
+add("TRAILER!!!", { ino: 0, mode: 0, nlink: 1, mtime: 0, data: Buffer.alloc(0) });
+// GNU cpio pads the archive to a 512-byte block.
+const total = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
+if (total % 512) chunks.push(Buffer.alloc(512 - (total % 512)));
+
+// Like `gzip -9n`: zlib leaves the name out and writes 0 as the mtime.
+writeFileSync(output, gzipSync(Buffer.concat(chunks), { level: constants.Z_BEST_COMPRESSION }));
+console.log(`cpio.js: ${output}: ${entries.length} entries`);

package/scripts/pack-initramfs.sh

@@ -50,6 +50,22 @@ mkdir -p "$staging/usr/share/icons/hicolor/512x512/apps" "$staging/usr/share/pix
 ln -sfn ../../../../../../buninu/icon.png "$staging/usr/share/icons/hicolor/512x512/apps/buninu-linux.png"
 ln -sfn ../../../buninu/icon.png "$staging/usr/share/pixmaps/buninu-linux.png"
 
+# BUNINU_JS_CPIO=1 writes the archive with scripts/cpio.js (bun or node)
+# instead of fakeroot, cpio and gzip: the device nodes below exist only in
+# the archive, so nothing needs root.
+if [ "${BUNINU_JS_CPIO:-}" = 1 ]; then
+    js=$(command -v bun || command -v node) || {
+        echo "error: BUNINU_JS_CPIO=1 needs bun or node on PATH" >&2
+        exit 1
+    }
+    "$js" scripts/cpio.js "$staging" build/initramfs.cpio.gz \
+        dev/console:c:5:1:0600 "dev/$serial_console:c:$serial_major:64:0620" \
+        dev/null:c:1:3:0666 dev/zero:c:1:5:0666 dev/random:c:1:8:0666 \
+        dev/urandom:c:1:9:0666 dev/tty:c:5:0:0666
+    echo "Built build/initramfs.cpio.gz for $arch (scripts/cpio.js)"
+    exit 0
+fi
+
 # fakeroot lets cpio record the character devices without real root. Nothing
 # has mounted devtmpfs when the kernel execs Bun as PID 1, so every device
 # Bun's startup needs has to be in the archive itself:

package/scripts/uki.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env bun
+// Assembles a UKI without binutils: the systemd EFI stub (a PE32+ image,
+// x86_64 or aarch64) with .osrel, .cmdline, .linux and .initrd added as
+// read-only data sections. build-uki.sh runs it instead of objdump/objcopy
+// when BUNINU_JS_UKI=1. Written from the PE/COFF specification against
+// node: APIs only, so it runs under node as well as bun.
+//
+//   scripts/uki.js STUB OUTPUT .osrel=FILE .cmdline=FILE .linux=FILE .initrd=FILE
+//
+// The section addresses follow build-uki.sh: the conventional offsets from
+// the image base (.osrel +0x20000, .cmdline +0x30000, .linux +0x2000000,
+// .initrd +0x3000000), moved up when the stub or the kernel is larger. The
+// stub's own headers and sections are kept where they are; the new sections
+// are appended to the file. TimeDateStamp is SOURCE_DATE_EPOCH when set,
+// otherwise the stub's own, so the output depends only on the inputs.
+
+import { readFileSync, writeFileSync } from "node:fs";
+
+const fail = (message) => {
+  console.error(`uki.js: ${message}`);
+  process.exit(1);
+};
+
+const [stubPath, outputPath, ...pairs] = process.argv.slice(2);
+if (!stubPath || !outputPath) fail("usage: uki.js STUB OUTPUT .osrel=FILE .cmdline=FILE .linux=FILE .initrd=FILE");
+const files = new Map();
+for (const pair of pairs) {
+  const separator = pair.indexOf("=");
+  if (separator < 1) fail(`expected .section=FILE, got ${pair}`);
+  files.set(pair.slice(0, separator), pair.slice(separator + 1));
+}
+const order = [".osrel", ".cmdline", ".linux", ".initrd"];
+for (const name of order) if (!files.has(name)) fail(`missing ${name}=FILE`);
+if (files.size !== order.length) fail(`only ${order.join(", ")} are supported`);
+
+const stub = readFileSync(stubPath);
+if (stub.toString("latin1", 0, 2) !== "MZ") fail(`${stubPath} is not a PE image`);
+const pe = stub.readUInt32LE(0x3c);
+if (stub.toString("latin1", pe, pe + 4) !== "PE\0\0") fail(`${stubPath} is not a PE image`);
+const coff = pe + 4;
+const sectionCount = stub.readUInt16LE(coff + 2);
+const optionalSize = stub.readUInt16LE(coff + 16);
+const optional = coff + 20;
+if (stub.readUInt16LE(optional) !== 0x20b) fail(`${stubPath} is not PE32+`);
+if (stub.readUInt32LE(coff + 8) !== 0) fail(`${stubPath} has a COFF symbol table, which is not supported`);
+const imageBase = stub.readBigUInt64LE(optional + 24);
+const sectionAlignment = stub.readUInt32LE(optional + 32);
+const fileAlignment = stub.readUInt32LE(optional + 36);
+const stubImageSize = stub.readUInt32LE(optional + 56);
+const headersSize = stub.readUInt32LE(optional + 60);
+const directoryCount = stub.readUInt32LE(optional + 108);
+// A signature (the certificate table) covers the file up to its end;
+// appending after it would invalidate it.
+if (directoryCount > 4 && stub.readUInt32LE(optional + 112 + 4 * 8 + 4) !== 0) {
+  fail(`${stubPath} is signed; adding sections would break the signature`);
+}
+
+const table = optional + optionalSize;
+let firstData = stub.length;
+for (let index = 0; index < sectionCount; index++) {
+  const header = table + index * 40;
+  const raw = stub.readUInt32LE(header + 20);
+  if (stub.readUInt32LE(header + 16) && raw) firstData = Math.min(firstData, raw);
+}
+const tableEnd = table + (sectionCount + order.length) * 40;
+if (tableEnd > Math.min(headersSize, firstData)) {
+  fail(`no room in ${stubPath}'s headers for ${order.length} more section headers`);
+}
+
+const alignUp = (value, alignment) => Math.ceil(value / alignment) * alignment;
+const data = order.map((name) => readFileSync(files.get(name)));
+const [, , kernel] = data;
+const osrel = Math.max(0x20000, alignUp(stubImageSize, 0x10000));
+const cmdline = osrel + 0x10000;
+const linux = Math.max(0x2000000, alignUp(cmdline + 0x10000, 0x1000000));
+const initrd = Math.max(0x3000000, alignUp(linux + kernel.length, 0x1000000));
+const addresses = [osrel, cmdline, linux, initrd];
+if (data[0].length > 0x10000 || data[1].length > 0x10000) fail(".osrel and .cmdline must each fit in 64 KiB");
+
+// Section contents go after everything already in the file, each at a
+// FileAlignment boundary and padded to a multiple of it.
+let offset = alignUp(stub.length, fileAlignment);
+const pointers = data.map((bytes) => {
+  const pointer = offset;
+  offset += alignUp(bytes.length, fileAlignment);
+  return pointer;
+});
+const output = Buffer.alloc(offset);
+stub.copy(output);
+order.forEach((name, index) => {
+  const header = table + (sectionCount + index) * 40;
+  const bytes = data[index];
+  output.fill(0, header, header + 40);
+  output.write(name, header, 8, "latin1");
+  output.writeUInt32LE(bytes.length, header + 8); // VirtualSize
+  output.writeUInt32LE(addresses[index], header + 12); // VirtualAddress
+  output.writeUInt32LE(alignUp(bytes.length, fileAlignment), header + 16); // SizeOfRawData
+  output.writeUInt32LE(pointers[index], header + 20); // PointerToRawData
+  // IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ: objcopy's
+  // contents,alloc,load,readonly,data.
+  output.writeUInt32LE(0x40000040, header + 36);
+  bytes.copy(output, pointers[index]);
+});
+output.writeUInt16LE(sectionCount + order.length, coff + 2);
+// SizeOfCode, SizeOfInitializedData and SizeOfUninitializedData: the raw
+// sizes of the sections of each kind, recomputed as objcopy does.
+const sizes = [0, 0, 0];
+for (let index = 0; index < sectionCount + order.length; index++) {
+  const header = table + index * 40;
+  const characteristics = output.readUInt32LE(header + 36);
+  const rawSize = output.readUInt32LE(header + 16);
+  [0x20, 0x40, 0x80].forEach((flag, kind) => { if (characteristics & flag) sizes[kind] += rawSize; });
+}
+sizes.forEach((size, kind) => output.writeUInt32LE(size >>> 0, optional + 4 + kind * 4));
+output.writeUInt32LE(alignUp(initrd + data[3].length, sectionAlignment), optional + 56); // SizeOfImage
+if (process.env.SOURCE_DATE_EPOCH !== undefined) {
+  output.writeUInt32LE(Number(process.env.SOURCE_DATE_EPOCH) >>> 0, coff + 4);
+}
+
+// The PE checksum: 16-bit one's-complement-style sum of the file with the
+// CheckSum field itself taken as zero, plus the file length.
+output.writeUInt32LE(0, optional + 64);
+let sum = 0;
+for (let index = 0; index + 1 < output.length; index += 2) {
+  sum += output.readUInt16LE(index);
+  sum = (sum & 0xffff) + (sum >>> 16);
+}
+if (output.length & 1) {
+  sum += output[output.length - 1];
+  sum = (sum & 0xffff) + (sum >>> 16);
+}
+output.writeUInt32LE(((sum & 0xffff) + output.length) >>> 0, optional + 64);
+
+writeFileSync(outputPath, output);
+const hex = (value) => `0x${value.toString(16)}`;
+console.log(`uki.js: ${outputPath}: image base ${hex(imageBase)}, ${order.map((name, index) => `${name} +${hex(addresses[index])}`).join(", ")}`);