buninu-linux 0.7.3 → 0.7.5

package/NOTICE.md

@@ -103,83 +103,83 @@ the built image redistributes them.
 - License: GPL-2.0-only WITH Linux-syscall-note
 - See: `LICENSES/GPL-2.0.txt` and `LICENSES/Linux-syscall-note.txt`
 
-Linux 6.18.53 as packaged by Alpine Linux 3.24 from the `linux-lts` aport.
-The default build uses package `linux-virt`, version 6.18.53-r0.
-`--linux-lts` and `--real` use package `linux-lts`, version 6.18.53-r0.
+Linux 6.18.54 as packaged by Alpine Linux 3.24 from the `linux-lts` aport.
+The default build uses package `linux-virt`, version 6.18.54-r0.
+`--linux-lts` and `--real` use package `linux-lts`, version 6.18.54-r0.
 Each comes from the x86_64 or aarch64 repository to match `--arch`. All
 listed modules are the selected package's `.ko.gz` files decompressed without
 modification.
 
-- Upstream source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.53.tar.xz
+- Upstream source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.54.tar.xz
 - Alpine build recipe, configuration and patches (Corresponding Source),
-  pinned to the commit shipping 6.18.53-r0 (the same for both architectures):
-  https://gitlab.alpinelinux.org/alpine/aports/-/blob/00abeb21803f818099833e761976a578dd1c0380/main/linux-lts/APKBUILD
+  pinned to the commit shipping 6.18.54-r0 (the same for both architectures):
+  https://gitlab.alpinelinux.org/alpine/aports/-/blob/f8254a6d11c37b153dae6a0fd98ba378dd0d093d/main/linux-lts/APKBUILD
 - Packages:
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-virt-6.18.53-r0.apk
-  SHA-256 `cad859cc46342e18002621fdde166bf2cd520dfec5e781d241de7d13e53970d6`
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-lts-6.18.53-r0.apk
-  SHA-256 `8e3cfdd1d98e0e70c2e70a8c299ed3cd1e0939d60ad7bbd1da1cf241d794490b`
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-virt-6.18.53-r0.apk
-  SHA-256 `fea61b7fd5e72e626d771f9798df56c83db658d0e221044f06fc28aacf5a118b`
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-lts-6.18.53-r0.apk
-  SHA-256 `46885041022ea11afa1e07c40199c74146bf72d362368a844338af0c162e365c`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-virt-6.18.54-r0.apk
+  SHA-256 `57a522d2b6e9d1b6c9de6b9f7fc42aa4b8d33ebf9f2b42b4251dbee6ff2d9839`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-lts-6.18.54-r0.apk
+  SHA-256 `1d02a1b74a8a09c476a3c01782c0b8613ae2935988e65d4d31e6bef44dfb8b64`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-virt-6.18.54-r0.apk
+  SHA-256 `9a4a6fa042b60b70f453dded99762810516b35793c64d776d75986b0b110b6e0`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-lts-6.18.54-r0.apk
+  SHA-256 `f945ddcc306546c7c22cf10249f637fc6e806ecc40286fb50950558dd573e7e9`
 
 SHA-256 of files in the default x86_64 `linux-virt` image:
 
 ```text
-kernel/x86_64/vmlinuz-virt   3b6e001d41938fdf4fab7d87826fc40dfab733973a5ef96a14c892dbdec87502
-failover.ko                  f52f8dedf68be2a228e84d796170471c7103d88910a14e2307484fe94c4d1a11
-net_failover.ko              8fe715d813a1e795cf0b46d54fd67f6c625dfabf1a4eebfeec96ae34f8aab0b1
-virtio_net.ko                cdf49d6216ba92313d3e40f065c326d86eae654bcbb811ac53e7c2613e686f1e
+kernel/x86_64/vmlinuz-virt   c7ce829b618d4a9d2df79c58ea0fb2a392e606f6c47bb94696ea75610a568166
+failover.ko                  c02fc21655bd3a8598ddf29f1028a1029bcb19b1da8611d3cf3c8685d0412f84
+net_failover.ko              46e0c3d3f4cdfafabffbd1a57ef59aac0bcc0f1a4e22b114d992cd46ac264145
+virtio_net.ko                1163e07fd5391849820ede09277b0147ae7e48ef0f08f9e96da08bb2ff131c2a
 ```
 
 SHA-256 of files in an x86_64 `--linux-lts` image:
 
 ```text
-kernel/x86_64/vmlinuz-lts   1b2ba2cad7973637f0f5589f845f7b773e73920e69d26785d2ff21c6c8995dc7
-failover.ko                 0fcd683e5023a3910bac2d2eb02eff349ce00d81b572f4a9093a0c70fc1c77f3
-net_failover.ko             613809bd8d4c283b7a2b9dba5d8466cc36f478772a86e8c89de5e792bce69207
-virtio_net.ko               1fb4ce7a0b546933b1e40d67b3570aec808307dcafead342d3f4bcd5a0523b7c
-virtio_ring.ko              eba2c109827a5d3b0e869505268a68d72cd6f2f9cc68778b66145c0503d9561f
-virtio.ko                   00d107d78dc1d47a4eea335c6d6b28026ae2c783a9b7629f2cc080bdbc8d2dc3
-virtio_pci_legacy_dev.ko    370b8ad3521cbd3934c78eacc5965b20eff29c55c7fcded023c75c5d21424841
-virtio_pci_modern_dev.ko    572d719ccad98342ebce909b8dac65ef64379c3a6c97e2d1fb38ff66950d9322
-virtio_pci.ko               e64039e30729e535b3ce9394249c79147bab27dfd20b7cf9914cd635dda95fc3
+kernel/x86_64/vmlinuz-lts   d3cb46d949f3d05a7e6753ba0b9a054323e6a7b6eeb231b31a1659d8f9f51a28
+failover.ko                 3c0e33c374419512c410559561e8bc5d2fac573cb449da404bbeaf94ec7641fe
+net_failover.ko             2a5db89834e5f35ecdf114da8dbe4d4db4061371d37768d9f92eb09d479d21ab
+virtio_net.ko               1fc0c4992e4a9ad83985fbad5a5674bacceb4c8ab5329b4509656ba3350478eb
+virtio_ring.ko              3c14098101a9f30f034410efe7e91e369057d1709152a0419a3a9fc4b1367915
+virtio.ko                   f47dac1696dcab539c5d313f13bd5e06945cf921bf406e0f709e1866de72803d
+virtio_pci_legacy_dev.ko    662c0f09bcb88c7c8a79fb2159d4aa0b62044d1859a46de03fc9e57fc3501931
+virtio_pci_modern_dev.ko    006e525fda5e369b6a1669ec0e8e174c784f1ecdb7dcfb6257ffc67fd5b93525
+virtio_pci.ko               94d66ebd7f2a325ce83c9f42175432a7797969b3e3c7fcc07d2b913012f1c77f
 ```
 
 `--real` additionally includes the following modules from that same
 x86_64 `linux-lts` package for physical xHCI controllers and USB HID keyboards:
 
 ```text
-usb-common.ko               3c7f2f1de34cafbf64fa3528862539cbe8cd3830cd97110e8401b510835c8761
-usbcore.ko                  0fce52fd1836304d48d25ef322558f27304ea9247c5b234f8ac2ecb9d8f00597
-xhci-hcd.ko                 22e687fe561127ea4cd1aba21058cbf253d0541ccf315555004f5a94ed7ab727
-xhci-pci.ko                 82eb0ea3869da82d1762130a738f2ff3ae6d77b16670f69f7f09cff4e8f3e360
-xhci-pci-renesas.ko         07df52a6ee408723938bc8a32cb4a2bfe4cbcf014ff48d23fd7f7ab41c201f6f
-hid.ko                      fbe4561a8dd65cd26160cbe9b7c5af23c7920044771e2e08a8aee6aa71141053
-hid-generic.ko              acfda4f50e19c055e5d719ebc2b9b8f8c6c076552592dfaabccbe128a9862694
-usbhid.ko                   12d3648467db87c2904a11a076c17768d8d51c28fe8ec41046e7d961592a81f1
+usb-common.ko               471bed173d18c373c80e9cce646f75b71b034b3b398e6bd04c51fa065ac92e6b
+usbcore.ko                  99b20afa2057720f2aa36224909c37740cbe1068e23ba52872ed09e6c7966c29
+xhci-hcd.ko                 b3ffac428a78858532a5114ad4f2f66de253aba32932f508d62eceb29af39313
+xhci-pci.ko                 2a924cfba63360acf3a9a688a5fb69f87c2c82a02f904e972a9f5c9cb303588f
+xhci-pci-renesas.ko         2c8fa8dac908da5a13c8f87e520cc1d4a026aeb9ee58d1ac0380d696c8ef6a72
+hid.ko                      3aa16634ee8621291abfa1f9efca287299dea052678c8ead5af86003a7e493f3
+hid-generic.ko              2879395175b39a47f09e81bb00cb1a4b565103ba4583ce99169b9ef7fd943d62
+usbhid.ko                   e80b60c6dd99a87c95bd97434679aa3f069c9bce2f67a7311f179b3066cdea59
 ```
 
 SHA-256 of files in the default aarch64 `linux-virt` image:
 
 ```text
-kernel/aarch64/vmlinuz-virt  9884ee00ecfff6a0dc9821cc9981b3aca74f741950704776b4335b1e076d96e6
-failover.ko                  61b052e5ed3ef01bc6f71d84acb79bfe8cf2e5168f625fce76630dec14bf8b99
-net_failover.ko              a0b150f46c7e9aa48156a8b94916ab65a4d8947143b381af56da677436584259
-virtio_net.ko                e9c007778d2b0a7d4986cd04b724965a01ffee05ada92f75ce13bf59bef2491c
+kernel/aarch64/vmlinuz-virt  29de2da2ea7aa1d95da37c947278caca65ef3ad211dbb92ac75a6b962f96d0d2
+failover.ko                  62bfac505026e368b291e8d7e167dc90bff826c44d0db1ff4340de2201022674
+net_failover.ko              3761f107b61ae4d11a7bed402cdab1862f3d61cacc612b2e6d9bc61ad1e20d6d
+virtio_net.ko                22a95296a008f009de59e933cc1b9615396612ef5eb3922fac2b79ac672a1305
 ```
 
 SHA-256 of files in an aarch64 `--linux-lts` image:
 
 ```text
-kernel/aarch64/vmlinuz-lts  00426cce3a4b2b4972043eeb68a3a2af5645eb7a50ca853c375e41944ac66d27
-failover.ko                 b9bea5bb0c956b58faf0f803a205dafd889bfda75e7c59d234f60e65145fbec8
-net_failover.ko             d8eb3087b75aba891e93327c6c43f37362cfe49421b7cabfd12f57a34d5c215a
-virtio_net.ko               10e73397bbb424b4bdb86781297f6fc30b13091e9a77fc7059e4861c09ef609d
-virtio_pci_legacy_dev.ko    476c6762743b9a5789200a31ee339173610f975b42e588914aabf41d8ade2958
-virtio_pci_modern_dev.ko    595618d12b67c67a0f29c406f6578d10d010024ac83014855672fd3fd695d6ed
-virtio_pci.ko               545a599cb7136a509a33cd3b52e80a8cd2bfa10668b0e766dc52872ce07d510b
+kernel/aarch64/vmlinuz-lts  52521d144fe344f23ffd03297fd0e0da42578e54d3da18685cbb7f613244c001
+failover.ko                 73571d1192683fa4f6346d7082920b4ac1a3b2edfb2da9e08ec13269dcb71f5e
+net_failover.ko             ba1700cf056585843488a5a8e75884d16cee45b4d40d8ace2f977e697cb5557c
+virtio_net.ko               fea67b801481f1445be419541e7a352a07019d52acbf644fe01f21c51d8d1475
+virtio_pci_legacy_dev.ko    0cbfc93f3ef238c2565187eb8be94d1d0127bf2fe521f28b75245db12f4331ff
+virtio_pci_modern_dev.ko    3fba75f38825df5ab616492bf3fb3329c4aed1a8b7f9a98370706e70a14fc2a3
+virtio_pci.ko               92652ff84904b2b2dda1549d362ec97377f954da5463575f7e35a4ef5847c3ad
 ```
 
 ### linuxx64.efi.stub and linuxaa64.efi.stub

package/README.md

@@ -64,16 +64,23 @@
 - This guide builds a bootable `buninu-linux-<version>.img`
 - The documented build environment is Debian 13 under Termux PRoot
 - A regular Debian installation works as well.
+  * Experimental Alpine support now!
 - For a source checkout, clone into the Termux home so native Termux and PRoot
   can share it; `~` differs between them, but the absolute path is the same.
 
 ### Steps
 
-- Before anything, install Bun in Debian first:
+- Before anything, install Bun in Debian/Alpine first:
 
 ```sh
+# Debian/Ubuntu
 apt update
 apt install curl unzip
+
+# Alpine
+apk update
+apk add curl unzip bash libgcc libstdc++
+
 curl -fsSL https://bun.sh/install | bash
 ```
 
@@ -85,8 +92,12 @@ Install the build tools, enter a directory where
 you want to keep the finished image, then run the published package:
 
 ```sh
+# Debian/Ubuntu
 apt install binutils-mingw-w64-x86-64 cpio curl dosfstools fakeroot mtools parted unzip
 
+# Alpine
+apk add bash coreutils tar curl unzip parted dosfstools mtools libgcc libstdc++
+
 mkdir -p /data/data/com.termux/files/home/buninu-build
 cd /data/data/com.termux/files/home/buninu-build
 
@@ -94,7 +105,14 @@ export PATH=$HOME/.bun/bin:$PATH
 
 bun x buninu-linux --version
 
+# Debian/Ubuntu
 bun x buninu-linux -fb --real --export
+
+# Alpine
+export BUNINU_JS_CPIO=1
+export BUNINU_JS_UKI=1
+bun x buninu-linux -fb --real --export
+
 ```
 
 `--export` copies the completed `vda.img` out of bunx's package directory and
@@ -890,7 +908,7 @@ initramfs/                init.js, commands, userspace: the same for every archi
 native/<arch>/            musl and the GCC runtime (committed); bun and modules (fetched)
 ```
 
-The `--real` inputs are Alpine v3.24 `linux-lts-6.18.53-r0`, musl `1.2.6-r2`,
+The `--real` inputs are Alpine v3.24 `linux-lts-6.18.54-r0`, musl `1.2.6-r2`,
 `systemd-efistub-260.2-r0`, `libstdc++`/`libgcc` `15.2.0-r5`, and Bun 1.4.2
 `linux-x64-musl-baseline`. The aarch64 guest uses the same versions from
 Alpine's aarch64 repository and Bun's `linux-aarch64-musl`. There is no BusyBox
@@ -987,7 +1005,7 @@ The physical boot chain is firmware → the UKI stub → its embedded
 and, with the currently pinned kernel, embeds this complete command line:
 
 ```text
-console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.53-0-lts rdinit=/bin/bun -- -e import('/init.js')
+console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.54-0-lts rdinit=/bin/bun -- -e import('/init.js')
 ```
 
 Serial kernel logging is retained, while the final console makes
@@ -1011,7 +1029,7 @@ the same way). Build without `--real`; this selects Alpine `linux-virt`, omits t
 module set, and puts `ttyS0` last so serial stdio owns `/dev/console`:
 
 ```text
-console=tty0 console=ttyS0,115200 panic=0 PATH=/bin KERNEL_RELEASE=6.18.53-0-virt rdinit=/bin/bun -- -e import('/init.js')
+console=tty0 console=ttyS0,115200 panic=0 PATH=/bin KERNEL_RELEASE=6.18.54-0-virt rdinit=/bin/bun -- -e import('/init.js')
 ```
 
 Build and boot it with:
@@ -1128,7 +1146,7 @@ The default `--real` image embeds this kernel command line (shown for the
 currently pinned LTS release):
 
 ```text
-console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.53-0-lts rdinit=/bin/bun -- -e import('/init.js')
+console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.54-0-lts rdinit=/bin/bun -- -e import('/init.js')
 ```
 
 The physical display (`tty0`) is the final console and therefore owns PID 1's

package/build-uki.sh

@@ -35,13 +35,33 @@ else
 fi
 printf '%s' "$consoles panic=0 PATH=/bin KERNEL_RELEASE=$kernel_release rdinit=/bin/bun -- -e import('/init.js')" > build/cmdline
 
+# Only this architecture's removable-media name may remain: firmware of the
+# other architecture ignores it, but run-qemu.sh reads the guest from it.
+for efi in vda/EFI/BOOT/*.EFI; do
+    [ "$efi" = "vda/EFI/BOOT/$efi_boot_name" ] || rm -f "$efi"
+done
+
+stub="$kernel_dir/$efi_stub"
+# BUNINU_JS_UKI=1 assembles the UKI with scripts/uki.js (bun or node) instead
+# of binutils; it lays the sections out by the same rules as below.
+if [ "${BUNINU_JS_UKI:-}" = 1 ]; then
+    js=$(command -v bun || command -v node) || {
+        echo "error: BUNINU_JS_UKI=1 needs bun or node on PATH" >&2
+        exit 1
+    }
+    "$js" scripts/uki.js "$stub" "vda/EFI/BOOT/$efi_boot_name" \
+        .osrel=build/os-release .cmdline=build/cmdline \
+        .linux="$kernel_image" .initrd=build/initramfs.cpio.gz
+    echo "Built $arch UKI with Alpine linux-$linux_flavor at vda/EFI/BOOT/$efi_boot_name (scripts/uki.js)"
+    exit 0
+fi
+
 if ! command -v "$uki_objcopy" >/dev/null || ! command -v "$uki_objdump" >/dev/null; then
     echo "error: build stage needs $uki_objcopy and $uki_objdump (Debian $uki_binutils_package)" >&2
     echo "run inside PRoot or with ./index.js --docker; see README Build environment" >&2
     exit 1
 fi
 
-stub="$kernel_dir/$efi_stub"
 pe_header() { "$uki_objdump" -p "$stub" | awk -v key="$1" '$1 == key { print $2; exit }'; }
 align_up() { echo $(( ($1 + $2 - 1) / $2 * $2 )); }
 max() { echo $(( $1 > $2 ? $1 : $2 )); }
@@ -65,12 +85,6 @@ cmdline_vma=$((image_base + cmdline_offset))
 linux_vma=$((image_base + linux_offset))
 initrd_vma=$((image_base + initrd_offset))
 
-# Only this architecture's removable-media name may remain: firmware of the
-# other architecture ignores it, but run-qemu.sh reads the guest from it.
-for efi in vda/EFI/BOOT/*.EFI; do
-    [ "$efi" = "vda/EFI/BOOT/$efi_boot_name" ] || rm -f "$efi"
-done
-
 "$uki_objcopy" \
     --add-section .osrel=build/os-release \
     --change-section-vma .osrel="$osrel_vma" \

package/check_build.js

@@ -0,0 +1,217 @@
+#!/usr/bin/env bun
+// Content checksums of the build outputs that ignore what changes from build
+// to build without changing what boots: file mtimes and inode numbers in the
+// initramfs, the PE timestamp and checksum of the UKI, and the GPT GUIDs,
+// FAT serial and FAT timestamps of the disk image. Two builds of the same
+// inputs print the same sums.
+//
+//   ./check_build.js                 build/initramfs.cpio.gz, the UKI(s) under vda/EFI/BOOT, vda.img
+//   ./check_build.js FILE...         any of: .cpio(.gz), PE/EFI, GPT disk image or bare FAT image
+//
+// Written against node: APIs only, so it runs under node as well as bun.
+
+import { createHash } from "node:crypto";
+import { readdirSync, readFileSync, existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { gunzipSync } from "node:zlib";
+
+const sha256 = (...parts) => {
+  const hasher = createHash("sha256");
+  for (const part of parts) hasher.update(part);
+  return hasher.digest("hex");
+};
+
+const u16 = (b, o) => b[o] | (b[o + 1] << 8);
+const u32 = (b, o) => (b[o] | (b[o + 1] << 8) | (b[o + 2] << 16) | (b[o + 3] << 24)) >>> 0;
+const u64 = (b, o) => u32(b, o) + u32(b, o + 4) * 2 ** 32;
+const ascii = (b, o, n) => String.fromCharCode(...b.subarray(o, o + n));
+
+// --- initramfs: newc cpio, optionally gzipped -------------------------------
+// Kept per entry: name, mode, uid, gid, device numbers of special files, size
+// and data. Dropped: inode, mtime, link count, the containing device, and
+// the order of the entries (`sort` follows the locale, and the unpacked tree
+// is the same either way): entries count sorted by name, byte by byte.
+function cpioSum(bytes) {
+  if (bytes[0] === 0x1f && bytes[1] === 0x8b) bytes = gunzipSync(bytes);
+  const entries = [];
+  let offset = 0;
+  while (offset + 110 <= bytes.length) {
+    const magic = ascii(bytes, offset, 6);
+    if (magic !== "070701" && magic !== "070702") throw new Error(`not a newc cpio entry at ${offset}`);
+    const field = (index) => parseInt(ascii(bytes, offset + 6 + index * 8, 8), 16);
+    const [mode, uid, gid, size, rdevMajor, rdevMinor, nameSize] =
+      [field(1), field(2), field(3), field(6), field(9), field(10), field(11)];
+    const name = Buffer.from(bytes.subarray(offset + 110, offset + 110 + nameSize - 1));
+    const data = (offset + 110 + nameSize + 3) & ~3;
+    const next = (data + size + 3) & ~3;
+    if (name.toString("latin1") === "TRAILER!!!") break;
+    entries.push({ name, header: `\0${mode.toString(8)} ${uid} ${gid} ${rdevMajor}:${rdevMinor} ${size}\n`, data: bytes.subarray(data, data + size) });
+    offset = next;
+  }
+  entries.sort((a, b) => Buffer.compare(a.name, b.name));
+  const hasher = createHash("sha256");
+  for (const { name, header, data } of entries) {
+    hasher.update(name);
+    hasher.update(header);
+    hasher.update(data);
+  }
+  return { sum: hasher.digest("hex"), detail: `${entries.length} entries` };
+}
+
+// --- UKI: PE image ----------------------------------------------------------
+// The whole file with the COFF TimeDateStamp and optional-header CheckSum
+// zeroed, except that the .initrd section counts by its cpio content sum.
+// The gzip output's size varies with the mtimes inside, so everything that
+// follows it is left out too: the .initrd sizes in the section table, the
+// file length (its raw data is cut out rather than zeroed), SizeOfImage and
+// SizeOfInitializedData.
+function peSum(bytes) {
+  const pe = u32(bytes, 0x3c);
+  if (ascii(bytes, pe, 4) !== "PE\0\0") throw new Error("not a PE image");
+  const coff = pe + 4;
+  const sections = u16(bytes, coff + 2);
+  const optional = coff + 20;
+  const table = optional + u16(bytes, coff + 16);
+  const copy = Uint8Array.from(bytes);
+  copy.fill(0, coff + 4, coff + 8); // TimeDateStamp
+  copy.fill(0, optional + 64, optional + 68); // CheckSum
+  let initrd = null;
+  let cut = null;
+  for (let index = 0; index < sections; index++) {
+    const header = table + index * 40;
+    const name = ascii(bytes, header, 8).replace(/\0+$/, "");
+    if (name !== ".initrd") continue;
+    const rawSize = u32(bytes, header + 16);
+    const start = u32(bytes, header + 20);
+    initrd = cpioSum(bytes.subarray(start, start + (u32(bytes, header + 8) || rawSize)));
+    cut = [start, start + rawSize];
+    copy.fill(0, header + 8, header + 12); // VirtualSize
+    copy.fill(0, header + 16, header + 20); // SizeOfRawData
+    copy.fill(0, optional + 8, optional + 12); // SizeOfInitializedData
+    copy.fill(0, optional + 56, optional + 60); // SizeOfImage
+    // Sections stored after it move with its size.
+    for (let other = 0; other < sections; other++) {
+      const otherHeader = table + other * 40;
+      if (u32(bytes, otherHeader + 20) > start) copy.fill(0, otherHeader + 20, otherHeader + 24);
+    }
+  }
+  const parts = cut ? [copy.subarray(0, cut[0]), copy.subarray(cut[1])] : [copy];
+  const sum = sha256(...parts, initrd?.sum ?? "");
+  return { sum, detail: initrd ? `.initrd ${initrd.sum.slice(0, 16)} (${initrd.detail})` : "no .initrd" };
+}
+
+// --- disk image: GPT with a FAT ESP, or a bare FAT filesystem ----------------
+// GPT: each partition's start, size and type, but not the disk or partition
+// GUIDs. FAT: the file tree (names, sizes, contents), not timestamps, serial
+// or free-space contents. .EFI files inside count by their PE sum, not their length.
+function diskSum(bytes) {
+  if (ascii(bytes, 512, 8) !== "EFI PART") return fatSum(bytes);
+  const entriesLba = u64(bytes, 512 + 72);
+  const count = u32(bytes, 512 + 80);
+  const entrySize = u32(bytes, 512 + 84);
+  const parts = [];
+  for (let index = 0; index < count; index++) {
+    const entry = entriesLba * 512 + index * entrySize;
+    const type = bytes.subarray(entry, entry + 16);
+    if (type.every((byte) => byte === 0)) continue;
+    const first = u64(bytes, entry + 32);
+    const last = u64(bytes, entry + 40);
+    const fs = fatSum(bytes.subarray(first * 512, (last + 1) * 512));
+    parts.push(`${Buffer.from(type).toString("hex")} ${first} ${last} ${fs.sum}\n`);
+  }
+  const lines = parts.map((line) => line.split(" ")[3].trim().slice(0, 16));
+  return { sum: sha256(...parts), detail: `${parts.length} partition(s), files ${lines.join(", ")}` };
+}
+
+function fatSum(bytes) {
+  const bytesPerSector = u16(bytes, 11);
+  const sectorsPerCluster = bytes[13];
+  const reserved = u16(bytes, 14);
+  const fats = bytes[16];
+  const rootEntries = u16(bytes, 17);
+  const fatSize = u16(bytes, 22) || u32(bytes, 36);
+  const totalSectors = u16(bytes, 19) || u32(bytes, 32);
+  if (bytes[510] !== 0x55 || bytes[511] !== 0xaa || !bytesPerSector) throw new Error("no FAT filesystem");
+  const rootSectors = Math.ceil((rootEntries * 32) / bytesPerSector);
+  const dataStart = (reserved + fats * fatSize + rootSectors) * bytesPerSector;
+  const clusterBytes = sectorsPerCluster * bytesPerSector;
+  const clusters = (totalSectors * bytesPerSector - dataStart) / clusterBytes;
+  const fat32 = clusters >= 65525;
+  const fat12 = clusters < 4085;
+  const fatOffset = reserved * bytesPerSector;
+  const nextCluster = (cluster) => {
+    if (fat32) return u32(bytes, fatOffset + cluster * 4) & 0x0fffffff;
+    if (!fat12) return u16(bytes, fatOffset + cluster * 2);
+    const value = u16(bytes, fatOffset + Math.floor(cluster * 1.5));
+    return cluster & 1 ? value >> 4 : value & 0xfff;
+  };
+  const end = fat32 ? 0x0ffffff8 : fat12 ? 0xff8 : 0xfff8;
+  const chain = (cluster) => {
+    const pieces = [];
+    for (; cluster >= 2 && cluster < end; cluster = nextCluster(cluster)) {
+      const start = dataStart + (cluster - 2) * clusterBytes;
+      pieces.push(bytes.subarray(start, start + clusterBytes));
+    }
+    return Buffer.concat(pieces);
+  };
+  const rootStart = (reserved + fats * fatSize) * bytesPerSector;
+  const root = fat32 ? chain(u32(bytes, 44)) : bytes.subarray(rootStart, rootStart + rootEntries * 32);
+  const files = [];
+  const walk = (directory, path) => {
+    for (let offset = 0; offset + 32 <= directory.length; offset += 32) {
+      const first = directory[offset];
+      if (first === 0) break;
+      const attributes = directory[offset + 11];
+      if (first === 0xe5 || attributes === 0x0f || attributes & 0x08) continue; // deleted, long name, label
+      const base = ascii(directory, offset, 8).trimEnd();
+      const extension = ascii(directory, offset + 8, 3).trimEnd();
+      if (base === "." || base === "..") continue;
+      const name = path + base + (extension ? "." + extension : "");
+      const cluster = (u16(directory, offset + 20) << 16) | u16(directory, offset + 26);
+      if (attributes & 0x10) {
+        files.push(`${name}/\n`);
+        walk(chain(cluster), name + "/");
+      } else {
+        const data = chain(cluster).subarray(0, u32(directory, offset + 28));
+        // A UKI's length follows its .initrd's gzip size; its PE sum covers the rest.
+        const pe = isPE(data);
+        files.push(`${name} ${pe ? "pe" : data.length} ${pe ? peSum(data).sum : sha256(data)}\n`);
+      }
+    }
+  };
+  walk(root, "/");
+  return { sum: sha256(...files), detail: files.map((line) => line.split(" ")[0].trim()).join(" ") };
+}
+
+const isPE = (bytes) => bytes[0] === 0x4d && bytes[1] === 0x5a && bytes.length > 0x40 &&
+  ascii(bytes, u32(bytes, 0x3c), 4) === "PE\0\0";
+
+function check(path) {
+  const bytes = new Uint8Array(readFileSync(path));
+  if ((bytes[0] === 0x1f && bytes[1] === 0x8b) || ascii(bytes, 0, 5) === "07070") return cpioSum(bytes);
+  if (isPE(bytes)) return peSum(bytes);
+  return diskSum(bytes);
+}
+
+const root = dirname(fileURLToPath(import.meta.url));
+let paths = process.argv.slice(2);
+if (paths.length === 0) {
+  const boot = join(root, "vda/EFI/BOOT");
+  paths = [
+    join(root, "build/initramfs.cpio.gz"),
+    ...(existsSync(boot) ? readdirSync(boot).filter((name) => /\.efi$/i.test(name)).sort().map((name) => join(boot, name)) : []),
+    join(root, "vda.img"),
+  ].filter((path) => existsSync(path));
+}
+let failed = false;
+for (const path of paths) {
+  try {
+    const { sum, detail } = check(path);
+    console.log(`${sum}  ${path}  (${detail})`);
+  } catch (error) {
+    console.error(`${path}: ${error.message}`);
+    failed = true;
+  }
+}
+process.exit(failed ? 1 : 0);

package/fetch-alpine.sh

@@ -1,5 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
+# What this script creates is packed with its modes: the same umask as
+# PRoot and most hosts, not native Termux's 0077.
+umask 022
 
 cd "$(dirname "$0")"
 

package/fetch-bun.sh

@@ -1,5 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
+# What this script creates is packed with its modes: the same umask as
+# PRoot and most hosts, not native Termux's 0077.
+umask 022
 
 cd "$(dirname "$0")"
 

package/index.js

@@ -51,8 +51,12 @@ const stages = [
     short: "b",
     scripts: ["build-uki.sh", "build-image.sh"],
     tools: (arch) => [
-      "fakeroot", "cpio", "gzip",
-      `${architectures[arch].binutils}-objcopy`, `${architectures[arch].binutils}-objdump`,
+      // BUNINU_JS_CPIO=1: pack-initramfs.sh writes the archive with scripts/cpio.js.
+      ...(process.env.BUNINU_JS_CPIO === "1" ? [] : ["fakeroot", "cpio", "gzip"]),
+      // BUNINU_JS_UKI=1: build-uki.sh assembles the UKI with scripts/uki.js.
+      ...(process.env.BUNINU_JS_UKI === "1"
+        ? []
+        : [`${architectures[arch].binutils}-objcopy`, `${architectures[arch].binutils}-objdump`]),
       "parted", "mkfs.fat", "mmd", "mcopy",
     ],
   },
@@ -75,6 +79,7 @@ function usage() {
 Usage:
   ${pkg.name} [-f] [-b] [-r] [--arch ARCH] [--docker] [--export] [--linux-lts]
                [--real] [-- qemu arguments]
+  ${pkg.name} --check [FILE...]
 
 Stages (always run in this order, whichever you pick):
   -f, --fetch   download and verify the pinned kernel, musl, GCC runtime,
@@ -100,6 +105,12 @@ Stages (always run in this order, whichever you pick):
                 primary console, and include USB xHCI/HID keyboard modules
                 (x86_64 only)
 
+  --check [FILE...]
+                print content checksums of the build outputs that ignore
+                mtimes, timestamps and GUIDs, and exit (check_build.js; the
+                arguments after it are its own: .img, .efi or .cpio files,
+                by default the initramfs, the UKI and vda.img)
+
   -h, --help    show this
   -V, --version show name, version, runtime and platform
   --readme      render README.md in the terminal and exit
@@ -109,6 +120,10 @@ initramfs/init.js needs, -r just boots what is already there. Anything after
 -- goes to qemu-system-x86_64 or qemu-system-aarch64 verbatim (for example:
 -r -- -smp 4).
 
+With BUNINU_JS_TOOLS=1 in the environment, fetch and build are done in
+JavaScript (scripts/fetch.js, scripts/build.js) and need only node or bun:
+no Debian toolchain and no Docker.
+
 Fetch and build need the Debian toolchain from README "Build environment"
 (PRoot, a Debian or Ubuntu host, or --docker); run needs QEMU (Termux
 pkg, apt, or brew install qemu). Tools missing for the stages you picked are
@@ -149,6 +164,8 @@ function parse(argv) {
     } else if (argument === "--readme") {
       printReadme();
       process.exit(0);
+    } else if (argument === "--check") {
+      runCheck(argv.slice(index + 1));
     } else if (argument === "--linux-lts") {
       linuxLts = true;
     } else if (argument === "--real") {
@@ -217,6 +234,14 @@ function printReadme() {
   process.stdout.write(rendered.endsWith("\n") ? rendered : rendered + "\n");
 }
 
+// --check hands everything after it to check_build.js, under the same
+// runtime, and exits with its status.
+function runCheck(args) {
+  const result = spawnSync(process.execPath, [resolve(rootDir, "check_build.js"), ...args], { stdio: "inherit" });
+  if (result.error) fail(`could not start check_build.js: ${result.error.message}`);
+  process.exit(result.status ?? 1);
+}
+
 // `command -v` without a shell: look for an executable on PATH.
 function hasTool(name) {
   for (const directory of (process.env.PATH ?? "").split(delimiter)) {
@@ -229,13 +254,18 @@ function hasTool(name) {
   return false;
 }
 
-const inDocker = (stage) => useDocker && stage.flag !== "run";
+// BUNINU_JS_TOOLS=1: fetch and build run scripts/fetch.js and scripts/build.js
+// in this process instead of the shell scripts, so they need no toolchain
+// and no Docker; run is unchanged.
+const jsTools = process.env.BUNINU_JS_TOOLS === "1";
+const usesJs = (stage) => jsTools && stage.flag !== "run";
+const inDocker = (stage) => useDocker && stage.flag !== "run" && !jsTools;
 
 function checkTools(selectedStages) {
   const missing = [];
   for (const stage of selectedStages) {
     const arch = stage.flag === "run" ? runArch : buildArch;
-    for (const tool of inDocker(stage) ? ["docker"] : stage.tools(arch)) {
+    for (const tool of inDocker(stage) ? ["docker"] : usesJs(stage) ? [] : stage.tools(arch)) {
       if (!hasTool(tool)) missing.push(`${tool} (for --${stage.flag})`);
     }
   }
@@ -284,7 +314,7 @@ function dockerImage() {
 // into the bind-mounted checkout stays owned by that user; fakeroot provides
 // the root ownership the initramfs records.
 function dockerRun(script, env) {
-  const passEnv = ["BUNINU_ARCH", "LINUX_FLAVOR", "REAL_MACHINE", "ALPINE_MIRROR"]
+  const passEnv = ["BUNINU_ARCH", "LINUX_FLAVOR", "REAL_MACHINE", "ALPINE_MIRROR", "BUNINU_JS_UKI", "BUNINU_JS_CPIO"]
     .filter((name) => env[name] !== undefined)
     .flatMap((name) => ["--env", `${name}=${env[name]}`]);
   const user = typeof process.getuid === "function"
@@ -327,12 +357,46 @@ const stageEnv = {
   ...(real && { REAL_MACHINE: "1" }),
 };
 
+// The arch.js config for the JS stages, from the same settings as stageEnv.
+const jsConfig = async (env) => (await import("./scripts/arch.js")).config({
+  arch: env.BUNINU_ARCH,
+  flavor: env.LINUX_FLAVOR,
+  real: env.REAL_MACHINE === "1",
+  mirror: env.ALPINE_MIRROR,
+});
+
+async function runJs(stage, env) {
+  const module = stage.flag === "fetch" ? "scripts/fetch.js" : "scripts/build.js";
+  console.log(`\n==> [${stage.flag} js] ${module}`);
+  try {
+    const cfg = await jsConfig(env);
+    if (stage.flag === "fetch") await (await import("./scripts/fetch.js")).fetchAll(cfg);
+    else await (await import("./scripts/build.js")).buildAll(cfg);
+  } catch (error) {
+    fail(`${module}: ${error.message}`);
+  }
+}
+
 for (const stage of ordered) {
   // run-qemu.sh builds a missing vda.img itself, which needs the build
-  // toolchain; with Docker that has to happen in the container first.
-  if (stage.flag === "run" && useDocker && !selected.has(stages[1]) &&
+  // toolchain; with Docker that has to happen in the container first, and
+  // with BUNINU_JS_TOOLS=1 scripts/build.js writes it.
+  if (stage.flag === "run" && (useDocker || jsTools) && !selected.has(stages[1]) &&
       !existsSync(resolve(rootDir, "vda.img"))) {
-    runScript(stages[1], "build-image.sh", [], { ...stageEnv, BUNINU_ARCH: runArch });
+    if (jsTools) {
+      console.log("\n==> [build js] scripts/build.js image");
+      try {
+        (await import("./scripts/build.js")).image(await jsConfig({ ...stageEnv, BUNINU_ARCH: runArch }));
+      } catch (error) {
+        fail(`scripts/build.js: ${error.message}`);
+      }
+    } else {
+      runScript(stages[1], "build-image.sh", [], { ...stageEnv, BUNINU_ARCH: runArch });
+    }
+  }
+  if (usesJs(stage)) {
+    await runJs(stage, stageEnv);
+    continue;
   }
   for (const script of stage.scripts) {
     runScript(stage, script, stage.flag === "run" ? passthrough : [], stageEnv);