buninu-linux 0.7.3 → 0.7.5

package/scripts/cpio.js

@@ -0,0 +1,107 @@
+#!/usr/bin/env bun
+// Writes the initramfs without fakeroot, cpio or gzip: a gzipped newc
+// archive of a directory tree, plus device nodes that exist only in the
+// archive. pack-initramfs.sh runs it instead of `fakeroot-tcp ... cpio |
+// gzip` when BUNINU_JS_CPIO=1. Written against node: APIs only, so it runs
+// under node as well as bun.
+//
+//   scripts/cpio.js DIRECTORY OUTPUT.cpio.gz [PATH:c:MAJOR:MINOR:MODE]...
+//
+// e.g. dev/console:c:5:1:0600. Like `find . | sort | cpio --create
+// --format=newc --owner=0:0 --reproducible` with the nodes made by mknod:
+// every entry is owned by 0:0, inode numbers count up from 1 and device
+// numbers of the containing filesystem are 0. Entries are sorted by name
+// byte by byte, so the archive does not depend on the locale. mtimes are the
+// files' own, or SOURCE_DATE_EPOCH for every entry when it is set; the
+// device nodes get SOURCE_DATE_EPOCH or the current time.
+
+import { lstatSync, readdirSync, readFileSync, readlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { constants, gzipSync } from "node:zlib";
+
+const fail = (message) => {
+  console.error(`cpio.js: ${message}`);
+  process.exit(1);
+};
+
+const [directory, output, ...deviceSpecs] = process.argv.slice(2);
+if (!directory || !output) fail("usage: cpio.js DIRECTORY OUTPUT.cpio.gz [PATH:c:MAJOR:MINOR:MODE]...");
+const epoch = process.env.SOURCE_DATE_EPOCH === undefined ? null : Number(process.env.SOURCE_DATE_EPOCH);
+if (epoch !== null && !Number.isInteger(epoch)) fail(`SOURCE_DATE_EPOCH is not a number: ${process.env.SOURCE_DATE_EPOCH}`);
+
+const S_IFMT = 0o170000;
+const S_IFDIR = 0o040000;
+const S_IFREG = 0o100000;
+const S_IFLNK = 0o120000;
+const S_IFCHR = 0o020000;
+const S_IFBLK = 0o060000;
+
+// Every path under the directory, relative to it.
+const entries = [];
+const walk = (relative) => {
+  for (const name of readdirSync(join(directory, relative))) {
+    const path = relative ? `${relative}/${name}` : name;
+    const stat = lstatSync(join(directory, path));
+    entries.push({ path, stat });
+    if (stat.isDirectory()) walk(path);
+  }
+};
+walk("");
+
+const now = Math.floor(Date.now() / 1000);
+const existing = new Set(entries.map(({ path }) => path));
+for (const spec of deviceSpecs) {
+  const [path, kind, major, minor, mode] = spec.split(":");
+  if (!path || !["c", "b"].includes(kind) || !/^\d+$/.test(major) || !/^\d+$/.test(minor) || !/^[0-7]{3,4}$/.test(mode)) {
+    fail(`bad device ${spec}; expected PATH:c:MAJOR:MINOR:MODE`);
+  }
+  if (existing.has(path)) fail(`${path} already exists in ${directory}`);
+  const parent = path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : "";
+  if (parent && !existing.has(parent)) fail(`${path}: no directory ${parent} in ${directory}`);
+  entries.push({
+    path,
+    device: { mode: (kind === "c" ? S_IFCHR : S_IFBLK) | parseInt(mode, 8), major: Number(major), minor: Number(minor) },
+  });
+  existing.add(path);
+}
+entries.sort((a, b) => Buffer.compare(Buffer.from(a.path), Buffer.from(b.path)));
+
+const chunks = [];
+const hex = (value) => (value >>> 0).toString(16).padStart(8, "0");
+const pad = (length) => { if (length % 4) chunks.push(Buffer.alloc(4 - (length % 4))); };
+const add = (name, { ino, mode, nlink, mtime, data, rdevMajor = 0, rdevMinor = 0 }) => {
+  const nameBytes = Buffer.from(`${name}\0`);
+  // magic, ino, mode, uid, gid, nlink, mtime, filesize, devmajor, devminor,
+  // rdevmajor, rdevminor, namesize, check
+  const header = Buffer.from("070701" + [ino, mode, 0, 0, nlink, mtime, data.length, 0, 0, rdevMajor, rdevMinor, nameBytes.length, 0]
+    .map(hex).join(""), "latin1");
+  chunks.push(header, nameBytes);
+  pad(header.length + nameBytes.length);
+  chunks.push(data);
+  pad(data.length);
+};
+
+entries.forEach(({ path, stat, device }, index) => {
+  const ino = index + 1;
+  if (device) {
+    add(path, { ino, mode: device.mode, nlink: 1, mtime: epoch ?? now, data: Buffer.alloc(0), rdevMajor: device.major, rdevMinor: device.minor });
+    return;
+  }
+  const type = stat.mode & S_IFMT;
+  const mtime = epoch ?? Math.floor(stat.mtimeMs / 1000);
+  let data = Buffer.alloc(0);
+  let nlink = 1;
+  if (type === S_IFREG) data = readFileSync(join(directory, path));
+  else if (type === S_IFLNK) data = Buffer.from(readlinkSync(join(directory, path)));
+  else if (type === S_IFDIR) nlink = stat.nlink;
+  else fail(`${path}: unsupported file type ${type.toString(8)}; pass device nodes as PATH:c:MAJOR:MINOR:MODE`);
+  add(path, { ino, mode: stat.mode, nlink, mtime, data });
+});
+add("TRAILER!!!", { ino: 0, mode: 0, nlink: 1, mtime: 0, data: Buffer.alloc(0) });
+// GNU cpio pads the archive to a 512-byte block.
+const total = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
+if (total % 512) chunks.push(Buffer.alloc(512 - (total % 512)));
+
+// Like `gzip -9n`: zlib leaves the name out and writes 0 as the mtime.
+writeFileSync(output, gzipSync(Buffer.concat(chunks), { level: constants.Z_BEST_COMPRESSION }));
+console.log(`cpio.js: ${output}: ${entries.length} entries`);

package/scripts/fetch.js

@@ -0,0 +1,194 @@
+// The fetch stage, as fetch-alpine.sh, fetch-bun.sh and scripts/fetch.sh do
+// it: download the pinned Alpine packages and Bun release, verify their
+// SHA-256, and lay out kernel/<arch>/ and native/<arch>/.
+//
+//   node scripts/fetch.js            both parts; BUNINU_ARCH, LINUX_FLAVOR,
+//                                    REAL_MACHINE and ALPINE_MIRROR as in arch.js
+//
+// Unlike fetch-alpine.sh, the release's module directory is emptied first,
+// so modules from an earlier --real fetch do not stay behind; and a download
+// lands under its final name only once its hash matched.
+
+import { createHash } from "node:crypto";
+import {
+  chmodSync,
+  copyFileSync,
+  createReadStream,
+  createWriteStream,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { spawnSync } from "node:child_process";
+import { dirname, join } from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { gunzipSync } from "node:zlib";
+import { config, rootDir, runIfMain, withUmask022 } from "./arch.js";
+import { filterAliases, select, trimDependencies } from "./modules.js";
+
+const sha256File = async (path) => {
+  const hash = createHash("sha256");
+  await pipeline(createReadStream(path), hash);
+  return hash.digest("hex");
+};
+
+/**
+ * Downloads `url` to downloadsDir/name unless a file with that SHA-256 is
+ * already there. The hash is both the cache key and the integrity check.
+ */
+export const download = async (cfg, url, name, sha256) => {
+  const path = join(cfg.downloadsDir, name);
+  if (existsSync(path) && (await sha256File(path)) === sha256) {
+    console.log(`cached ${name}`);
+    return path;
+  }
+  console.log(`fetch  ${name}`);
+  mkdirSync(cfg.downloadsDir, { recursive: true });
+  const response = await fetch(url, { redirect: "follow" });
+  if (!response.ok || !response.body) throw new Error(`${url}: HTTP ${response.status}`);
+  const partial = `${path}.part`;
+  const hash = createHash("sha256");
+  const hashing = new TransformStream({ transform(chunk, controller) { hash.update(chunk); controller.enqueue(chunk); } });
+  await pipeline(Readable.fromWeb(response.body.pipeThrough(hashing)), createWriteStream(partial));
+  const actual = hash.digest("hex");
+  if (actual !== sha256) {
+    rmSync(partial, { force: true });
+    throw new Error(`${name}: SHA-256 ${actual}, expected ${sha256}`);
+  }
+  renameSync(partial, path);
+  return path;
+};
+
+/**
+ * The regular files of a tar archive (gzip members concatenated, as an .apk
+ * is), by name. pax ("x") and GNU long-name ("L") headers give names longer
+ * than the ustar fields.
+ */
+export const readTar = (path) => {
+  const data = gunzipSync(readFileSync(path));
+  const files = new Map();
+  let longName = null;
+  for (let offset = 0; offset + 512 <= data.length;) {
+    const header = data.subarray(offset, offset + 512);
+    if (header.every((byte) => byte === 0)) { offset += 512; continue; }
+    const field = (start, length) => header.toString("utf8", start, start + length).replace(/\0.*$/s, "");
+    const size = Number.parseInt(field(124, 12).trim() || "0", 8);
+    const type = String.fromCharCode(header[156] || 0x30);
+    const body = data.subarray(offset + 512, offset + 512 + size);
+    offset += 512 + Math.ceil(size / 512) * 512;
+    if (type === "x") {
+      // pax records: "LENGTH key=value\n"
+      for (const record of body.toString("utf8").split("\n")) {
+        const match = /^\d+ path=(.*)$/.exec(record);
+        if (match) longName = match[1];
+      }
+      continue;
+    }
+    if (type === "L") { longName = body.toString("utf8").replace(/\0.*$/s, ""); continue; }
+    if (type === "g") continue;
+    const prefix = field(345, 155);
+    const name = longName ?? (prefix ? `${prefix}/${field(0, 100)}` : field(0, 100));
+    longName = null;
+    if (type === "0" || type === "\0") files.set(name.replace(/^\.\//, ""), body);
+  }
+  return {
+    get(name) {
+      const bytes = files.get(name);
+      if (!bytes) throw new Error(`${path}: no ${name}`);
+      return bytes;
+    },
+  };
+};
+
+const writeTo = (path, bytes) => {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, bytes);
+};
+
+// Both run with umask 022 (see arch.js withUmask022): native/ and kernel/
+// are packed with their modes.
+
+/** fetch-alpine.sh: the kernel, its selected modules, musl's loader and the EFI stub. */
+export const fetchAlpine = (cfg = config()) => withUmask022(async () => {
+  mkdirSync(cfg.kernelDir, { recursive: true });
+  mkdirSync(join(cfg.nativeDir, "lib"), { recursive: true });
+  const linux = readTar(await download(cfg, `${cfg.alpineBase}/${cfg.linuxPackage}`, cfg.linuxPackage, cfg.linuxSha256));
+  const musl = readTar(await download(cfg, `${cfg.alpineBase}/${cfg.muslPackage}`, cfg.muslPackage, cfg.muslSha256));
+  const stub = readTar(await download(cfg, `${cfg.alpineBase}/${cfg.stubPackage}`, cfg.stubPackage, cfg.stubSha256));
+
+  // On aarch64 vmlinuz is an EFI zboot image, started by the stub like the x86_64 bzImage.
+  writeTo(cfg.kernelImage, linux.get(`boot/vmlinuz-${cfg.flavor}`));
+  writeTo(join(cfg.nativeDir, "lib", cfg.muslLoader), musl.get(`lib/${cfg.muslLoader}`));
+  writeTo(join(cfg.kernelDir, cfg.efiStub), stub.get(`usr/lib/systemd/boot/efi/${cfg.efiStub}`));
+
+  const release = `lib/modules/${cfg.kernelRelease}`;
+  const dep = linux.get(`${release}/modules.dep`).toString();
+  const builtin = linux.get(`${release}/modules.builtin`);
+  const { selected, notes } = select({ dep, builtin: builtin.toString(), packageName: cfg.linuxPackage, arch: cfg.arch, flavor: cfg.flavor, real: cfg.real });
+  for (const note of notes) console.error(note);
+  rmSync(cfg.modulesRoot, { recursive: true, force: true });
+  writeTo(join(cfg.modulesRoot, "modules.builtin"), builtin);
+  for (const path of selected) {
+    writeTo(join(cfg.modulesRoot, path.replace(/\.gz$/, "")), gunzipSync(linux.get(`${release}/${path}`)));
+  }
+  writeTo(join(cfg.modulesRoot, "modules.dep"), trimDependencies(dep, selected));
+  writeTo(join(cfg.modulesRoot, "modules.alias"), filterAliases(linux.get(`${release}/modules.alias`).toString(), selected));
+
+  chmodSync(join(cfg.nativeDir, "lib", cfg.muslLoader), 0o755);
+  console.log(`Fetched Alpine ${cfg.arch} linux-${cfg.flavor} kernel, ${selected.length} modules, musl, and the ${cfg.efiStub} UKI stub.`);
+});
+
+/** fetch-bun.sh: Bun from its release zip, and the GCC runtime it links against. */
+export const fetchBun = (cfg = config()) => withUmask022(async () => {
+  for (const directory of [
+    cfg.downloadsDir,
+    join(cfg.nativeDir, "bin"),
+    join(cfg.nativeDir, "lib"),
+    join(rootDir, "initramfs/dev"),
+    join(rootDir, "initramfs/proc"),
+    join(rootDir, "initramfs/sys"),
+    join(rootDir, "initramfs/tmp"),
+  ]) {
+    mkdirSync(directory, { recursive: true });
+  }
+  const zip = await download(cfg, cfg.bunUrl, cfg.bunZip, cfg.bunSha256);
+  const libstdcpp = readTar(await download(cfg, `${cfg.alpineBase}/${cfg.libstdcppPackage}`, cfg.libstdcppPackage, cfg.libstdcppSha256));
+  const libgcc = readTar(await download(cfg, `${cfg.alpineBase}/${cfg.libgccPackage}`, cfg.libgccPackage, cfg.libgccSha256));
+  const loader = join(cfg.nativeDir, "lib", cfg.muslLoader);
+  if (!existsSync(loader) || statSync(loader).size === 0) {
+    throw new Error("fetch stage incomplete: run fetchAlpine first (node scripts/fetch.js runs both)");
+  }
+  // initramfs/bin/unzip: the same reader the guest has.
+  const unzip = spawnSync(process.execPath, [
+    join(rootDir, "initramfs/bin/unzip"),
+    "-p",
+    zip,
+    `${cfg.bunBuild}/bun`,
+  ], { maxBuffer: 1 << 30 });
+  if (unzip.status !== 0) throw new Error(`unzip ${zip}: ${unzip.stderr}`);
+  writeTo(join(cfg.nativeDir, "bin", "bun"), unzip.stdout);
+  writeTo(join(cfg.nativeDir, "lib", "libstdc++.so.6"), libstdcpp.get("usr/lib/libstdc++.so.6.0.34"));
+  writeTo(join(cfg.nativeDir, "lib", "libgcc_s.so.1"), libgcc.get("usr/lib/libgcc_s.so.1"));
+  // libc as a distinct inode from the active dynamic loader: dlopen on the
+  // loader inode itself deadlocks, while this physical copy is FFI-safe.
+  copyFileSync(loader, join(cfg.nativeDir, "lib", cfg.muslLibc));
+  chmodSync(join(rootDir, "initramfs/init.js"), 0o755);
+  chmodSync(join(cfg.nativeDir, "bin", "bun"), 0o755);
+  for (const name of readdirSync(join(cfg.nativeDir, "lib"))) {
+    if (/\.so/.test(name)) chmodSync(join(cfg.nativeDir, "lib", name), 0o755);
+  }
+  console.log(`Fetched Bun ${cfg.bunVersion} and its ${cfg.arch} musl runtime into ${cfg.nativeDir}/.`);
+});
+
+export const fetchAll = async (cfg = config()) => {
+  await fetchAlpine(cfg);
+  await fetchBun(cfg);
+};
+
+runIfMain(import.meta.url, () => fetchAll());

package/scripts/modules.js

@@ -0,0 +1,158 @@
+// The kernel modules the initramfs ships, as fetch-alpine.sh picks them: each
+// requested by name, with what the package's modules.dep says it needs. The
+// image gets a modules.dep trimmed to the shipped set, the fs-* lines and
+// the device ids of the shipped modules from modules.alias, and the
+// package's modules.builtin; /lib/modprobe.js reads those three files.
+//
+// fetch.js uses select(), trimDependencies() and filterAliases().
+
+// Network: virtio-net for QEMU (init.js loads these at boot). virtio_pci is
+// the PCI transport for every virtio device; linux-virt builds it in,
+// linux-lts has it as a module that nothing in modules.dep pulls in.
+// Storage: what /bin/mount loads on demand. Pointing devices for
+// `bunterm --mouse`. The framebuffer for bunterm on lts. Sound for QEMU's and
+// PCs' usual devices. --real adds the USB keyboard, PC storage and ACPI
+// drivers, and the wired and USB network drivers.
+const required = (names) => names.map((name) => ({ name }));
+const optional = (names) => names.map((name) => ({ name, optional: true }));
+
+export const requests = ({ arch, flavor, real }) => [
+  ...required([
+    "failover",
+    "net_failover",
+    "virtio_net",
+  ]),
+  ...optional([
+    "virtio_pci",
+  ]),
+  ...required([
+    "virtio_blk",
+    "ext4",
+    "vfat",
+    "exfat",
+    "ntfs3",
+    "nls_utf8",
+    "nls_cp437",
+    "nls_iso8859-1",
+  ]),
+  ...optional([
+    "ext2",
+  ]),
+  ...required([
+    "evdev",
+    arch === "x86_64" ? "psmouse" : "virtio_input",
+  ]),
+  ...(flavor === "lts" ? optional([
+    "simpledrm",
+  ]) : []),
+  ...optional([
+    "snd-ens1371",
+    "snd-hda-intel",
+    "snd-hda-codec-generic",
+    "snd-hda-codec-hdmi",
+    "snd-usb-audio",
+  ]),
+  ...(real ? required([
+    // USB keyboard
+    "usb-common",
+    "usbcore",
+    "xhci-hcd",
+    "xhci-pci",
+    "xhci-pci-renesas",
+    "hid",
+    "hid-generic",
+    "usbhid",
+    // SATA/AHCI, PATA, NVMe (with Intel VMD), USB mass storage and UAS
+    "sd_mod",
+    "ahci",
+    "ata_generic",
+    "pata_acpi",
+    "nvme",
+    "vmd",
+    "usb-storage",
+    "uas",
+    // ACPI: battery, AC adapter, power button, thermal zones
+    "battery",
+    "ac",
+    "button",
+    "thermal",
+    // Wired NICs: Intel, Realtek (with its PHY), Qualcomm Atheros, Broadcom
+    "e1000",
+    "e1000e",
+    "igb",
+    "igc",
+    "r8169",
+    "realtek",
+    "alx",
+    "tg3",
+    // USB NICs and Android tethering (RNDIS, CDC ECM/NCM/EEM, subset, zaurus)
+    "r8152",
+    "ax88179_178a",
+    "cdc_ether",
+    "rndis_host",
+    "cdc_ncm",
+    "cdc_eem",
+    "cdc_subset",
+    "zaurus",
+  ]) : []),
+];
+
+/**
+ * The modules.dep paths (".ko.gz", relative to the release directory) to
+ * ship, dependencies after the module that pulled them in, and notes about
+ * optional modules the kernel neither builds in nor packages.
+ */
+export const select = ({ dep, builtin, packageName, ...target }) => {
+  const lines = dep.split("\n");
+  const builtinLines = builtin.split("\n");
+  const selected = [];
+  const seen = new Set();
+  const notes = [];
+  const find = (name) => lines.find((line) => line.includes(`/${name}.ko.gz:`));
+  const add = (name) => {
+    // An explicit stack instead of recursion; the order matches the shell's
+    // depth-first walk.
+    const stack = [name];
+    while (stack.length) {
+      const current = stack.pop();
+      const line = find(current);
+      if (!line) throw new Error(`module ${current} is not in ${packageName}`);
+      const path = line.slice(0, line.indexOf(":"));
+      if (seen.has(path)) continue;
+      seen.add(path);
+      selected.push(path);
+      const dependencies = line.slice(line.indexOf(":") + 1).trim().split(/\s+/).filter(Boolean)
+        .map((dependency) => dependency.slice(dependency.lastIndexOf("/") + 1).replace(/\.ko\.gz$/, ""));
+      stack.push(...dependencies.reverse());
+    }
+  };
+  for (const { name, optional } of requests(target)) {
+    if (!optional || find(name)) add(name);
+    else if (!builtinLines.some((line) => line.endsWith(`/${name}.ko`))) {
+      notes.push(`note: module ${name} is not in ${target.arch} ${packageName}; skipped`);
+    }
+  }
+  return { selected, notes };
+};
+
+/** modules.dep with only the shipped modules' lines, .ko.gz renamed .ko. */
+export const trimDependencies = (dep, selected) => {
+  const wanted = new Set(selected);
+  return dep.split("\n")
+    .filter((line) => line.includes(":") && wanted.has(line.slice(0, line.indexOf(":"))))
+    .map((line) => `${line.replaceAll(".ko.gz", ".ko")}\n`)
+    .join("");
+};
+
+/** modules.alias: the fs-* names, and the pci:/usb:/virtio: ids of shipped modules. */
+export const filterAliases = (alias, selected) => {
+  const shipped = new Set(selected.map((path) => path.slice(path.lastIndexOf("/") + 1).replace(/\.ko\.gz$/, "").replaceAll("-", "_")));
+  return alias.split("\n")
+    .filter((line) => {
+      const fields = line.trim().split(/\s+/);
+      if (/^fs-/.test(fields[1] ?? "")) return true;
+      return /^(pci|usb|virtio):/.test(fields[1] ?? "") && shipped.has((fields[2] ?? "").replaceAll("-", "_"));
+    })
+    .map((line) => `${line}\n`)
+    .join("");
+};

package/scripts/pack-initramfs.sh

@@ -1,5 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
+# What this script creates is packed with its modes: the same umask as
+# PRoot and most hosts, not native Termux's 0077.
+umask 022
 
 cd "$(dirname "$0")/.."
 
@@ -22,6 +25,12 @@ trap 'rm -rf "$staging"; rm -f "$archive"' EXIT
 cp -a --reflink=auto initramfs/. "$staging/"
 rm -rf "$staging/bin/bun" "$staging/lib/modules"
 cp -a --reflink=auto "$native_dir/." "$staging/"
+# Only this kernel's modules: native/<arch>/ keeps every release fetched so
+# far (an older pin, the other flavor), and none of those can load.
+for release_dir in "$staging/lib/modules"/*; do
+    [ -e "$release_dir" ] || continue
+    [ "${release_dir##*/}" = "$kernel_release" ] || rm -rf "$release_dir"
+done
 # Keep the project README canonical while making it available to
 # buninu-linux-help from the conventional installed-document path.
 cp README.md "$staging/usr/share/doc/buninu-linux/README.md"
@@ -50,6 +59,30 @@ mkdir -p "$staging/usr/share/icons/hicolor/512x512/apps" "$staging/usr/share/pix
 ln -sfn ../../../../../../buninu/icon.png "$staging/usr/share/icons/hicolor/512x512/apps/buninu-linux.png"
 ln -sfn ../../../buninu/icon.png "$staging/usr/share/pixmaps/buninu-linux.png"
 
+# The modes git would check out with umask 022: directories 755, files 755
+# when their owner may execute them and 644 otherwise (symlinks untouched).
+# A checkout made under another umask (native Termux's 0077 gives 600/700)
+# then packs the same archive.
+find "$staging" -type d -exec chmod 755 {} +
+find "$staging" -type f -perm -100 -exec chmod 755 {} +
+find "$staging" -type f ! -perm -100 -exec chmod 644 {} +
+
+# BUNINU_JS_CPIO=1 writes the archive with scripts/cpio.js (bun or node)
+# instead of fakeroot, cpio and gzip: the device nodes below exist only in
+# the archive, so nothing needs root.
+if [ "${BUNINU_JS_CPIO:-}" = 1 ]; then
+    js=$(command -v bun || command -v node) || {
+        echo "error: BUNINU_JS_CPIO=1 needs bun or node on PATH" >&2
+        exit 1
+    }
+    "$js" scripts/cpio.js "$staging" build/initramfs.cpio.gz \
+        dev/console:c:5:1:0600 "dev/$serial_console:c:$serial_major:64:0620" \
+        dev/null:c:1:3:0666 dev/zero:c:1:5:0666 dev/random:c:1:8:0666 \
+        dev/urandom:c:1:9:0666 dev/tty:c:5:0:0666
+    echo "Built build/initramfs.cpio.gz for $arch (scripts/cpio.js)"
+    exit 0
+fi
+
 # fakeroot lets cpio record the character devices without real root. Nothing
 # has mounted devtmpfs when the kernel execs Bun as PID 1, so every device
 # Bun's startup needs has to be in the archive itself: