buninu-linux 0.7.3 → 0.7.5

package/scripts/pack.js

@@ -0,0 +1,184 @@
+// The initramfs, as scripts/pack-initramfs.sh packs it with BUNINU_JS_CPIO=1:
+// initramfs/ with native/<arch>/ laid over it, the README, licenses and
+// os-release added, written by scripts/cpio.js to build/initramfs.cpio.gz.
+//
+//   node scripts/pack.js             BUNINU_ARCH as in arch.js; SOURCE_DATE_EPOCH
+//                                    fixes every mtime, as cpio.js does
+
+import { spawnSync } from "node:child_process";
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  readlinkSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  utimesSync,
+  lutimesSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { config, jsRuntime, rootDir, runIfMain } from "./arch.js";
+
+/**
+ * `cp -a SOURCE/. TARGET/`: modes, times and symlinks kept, directories
+ * merged into ones already there (and given the source's mode, as cp -a does).
+ */
+export const copyTree = (source, target) => {
+  const stat = lstatSync(source);
+  if (stat.isSymbolicLink()) {
+    rmSync(target, { force: true });
+    symlinkSync(readlinkSync(source), target);
+    lutimesSync(target, stat.atime, stat.mtime);
+  } else if (stat.isDirectory()) {
+    mkdirSync(target, { recursive: true });
+    for (const name of readdirSync(source)) copyTree(join(source, name), join(target, name));
+    chmodSync(target, stat.mode & 0o7777);
+    utimesSync(target, stat.atime, stat.mtime);
+  } else if (stat.isFile()) {
+    rmSync(target, { force: true });
+    copyFileSync(source, target);
+    chmodSync(target, stat.mode & 0o7777);
+    utimesSync(target, stat.atime, stat.mtime);
+  } else {
+    throw new Error(`${source}: not a file, directory or symlink`);
+  }
+};
+
+/**
+ * The modes git would check out with umask 022: directories 755, files 755
+ * when their owner may execute them and 644 otherwise; symlinks untouched.
+ * A checkout made under another umask (native Termux's 0077 gives 600/700)
+ * then packs the same archive.
+ */
+export const normalizeModes = (path) => {
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink()) return;
+  if (stat.isDirectory()) {
+    chmodSync(path, 0o755);
+    for (const name of readdirSync(path)) normalizeModes(join(path, name));
+  } else if (stat.isFile()) {
+    chmodSync(path, stat.mode & 0o100 ? 0o755 : 0o644);
+  }
+};
+
+/** `cp FILE TARGET`: contents and mode, a new mtime. */
+const copyFile = (source, target) => {
+  rmSync(target, { force: true });
+  copyFileSync(source, target);
+  chmodSync(target, statSync(source).mode & 0o777 & ~process.umask());
+};
+
+/** `ln -sfn TARGET LINK` */
+const link = (target, path) => {
+  rmSync(path, { force: true });
+  symlinkSync(target, path);
+};
+
+/**
+ * The device nodes of the archive, PATH:c:MAJOR:MINOR:MODE. Nothing has
+ * mounted devtmpfs when the kernel execs Bun as PID 1: console is init's fd
+ * 0/1/2 and JSC aborts without urandom; the rest keep /dev usable if the
+ * devtmpfs mount in init.js fails. The serial port is ttyS0 (4, 64) on
+ * x86_64 and the PL011 ttyAMA0 (204, 64) on aarch64.
+ */
+export const devices = (cfg) => [
+  "dev/console:c:5:1:0600",
+  `dev/${cfg.serialConsole}:c:${cfg.serialMajor}:64:0620`,
+  "dev/null:c:1:3:0666",
+  "dev/zero:c:1:5:0666",
+  "dev/random:c:1:8:0666",
+  "dev/urandom:c:1:9:0666",
+  "dev/tty:c:5:0:0666",
+];
+
+export const osRelease = (version) => [
+  'NAME="Buninu Linux"',
+  "ID=buninu-linux",
+  `VERSION="${version}"`,
+  `VERSION_ID=${version}`,
+  `PRETTY_NAME="Buninu Linux ${version}"`,
+  'HOME_URL="https://buninu.org"',
+  'BUG_REPORT_URL="https://github.com/jjtseng93/buninu-linux/issues"',
+  "LOGO=buninu-linux",
+  "DEFAULT_HOSTNAME=buninu",
+].map((line) => `${line}\n`).join("");
+
+export const pack = (cfg = config()) => {
+  // The directories and files made here are packed with their modes; native
+  // Termux's umask 0077 would make /usr/lib and /usr/lib/os-release private.
+  const previousUmask = process.umask(0o022);
+  try {
+    packStaging(cfg);
+  } finally {
+    process.umask(previousUmask);
+  }
+};
+
+const packStaging = (cfg) => {
+  const bun = join(cfg.nativeDir, "bin", "bun");
+  if (!existsSync(bun) || !(statSync(bun).mode & 0o111)) {
+    throw new Error(`no ${bun} yet; run the fetch stage first (node scripts/fetch.js)`);
+  }
+  const build = join(rootDir, "build");
+  mkdirSync(build, { recursive: true });
+  const staging = mkdtempSync(join(rootDir, ".initramfs."));
+  try {
+    // initramfs/ is the same for every architecture; native/<arch>/ adds bun,
+    // the musl loader, the GCC runtime and the kernel modules on top of it.
+    // A checkout fetched before native/ existed still has an x86_64 bun and
+    // its modules under initramfs/; they are dropped rather than packed.
+    copyTree(join(rootDir, "initramfs"), staging);
+    rmSync(join(staging, "bin", "bun"), { force: true });
+    rmSync(join(staging, "lib", "modules"), { recursive: true, force: true });
+    copyTree(cfg.nativeDir, staging);
+    // Only this kernel's modules: native/<arch>/ keeps every release fetched
+    // so far (an older pin, the other flavor), and none of those can load.
+    const modules = join(staging, "lib", "modules");
+    for (const release of existsSync(modules) ? readdirSync(modules) : []) {
+      if (release !== cfg.kernelRelease) rmSync(join(modules, release), { recursive: true, force: true });
+    }
+    copyFile(join(rootDir, "README.md"), join(staging, "usr/share/doc/buninu-linux/README.md"));
+    for (const name of [
+      "LICENSE",
+      "NOTICE.md",
+      "LICENSES",
+    ]) copyTree(join(rootDir, name), join(staging, "usr/share/licenses", name));
+
+    // os-release(5): the canonical file in /usr/lib, /etc/os-release a link
+    // to it; build.js embeds the same file as the UKI's .osrel section.
+    const { version } = JSON.parse(readFileSync(join(rootDir, "package.json"), "utf8"));
+    if (!version) throw new Error("no version in package.json");
+    writeFileSync(join(build, "os-release"), osRelease(version));
+    mkdirSync(join(staging, "usr/lib"), { recursive: true });
+    mkdirSync(join(staging, "etc"), { recursive: true });
+    copyFile(join(build, "os-release"), join(staging, "usr/lib/os-release"));
+    link("../usr/lib/os-release", join(staging, "etc/os-release"));
+    // LOGO names an icon-theme icon; the standard lookup paths point at the
+    // icon /buninu already ships.
+    mkdirSync(join(staging, "usr/share/icons/hicolor/512x512/apps"), { recursive: true });
+    mkdirSync(join(staging, "usr/share/pixmaps"), { recursive: true });
+    link("../../../../../../buninu/icon.png", join(staging, "usr/share/icons/hicolor/512x512/apps/buninu-linux.png"));
+    link("../../../buninu/icon.png", join(staging, "usr/share/pixmaps/buninu-linux.png"));
+
+    normalizeModes(staging);
+    const cpio = spawnSync(jsRuntime(), [
+      join(rootDir, "scripts/cpio.js"),
+      staging,
+      join(build, "initramfs.cpio.gz"),
+      ...devices(cfg),
+    ], { stdio: ["ignore", "ignore", "inherit"] });
+    if (cpio.status !== 0) throw new Error("scripts/cpio.js failed");
+  } finally {
+    rmSync(staging, { recursive: true, force: true });
+  }
+  console.log(`Built build/initramfs.cpio.gz for ${cfg.arch}`);
+};
+
+runIfMain(import.meta.url, () => pack());

package/scripts/uki.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env bun
+// Assembles a UKI without binutils: the systemd EFI stub (a PE32+ image,
+// x86_64 or aarch64) with .osrel, .cmdline, .linux and .initrd added as
+// read-only data sections. build-uki.sh runs it instead of objdump/objcopy
+// when BUNINU_JS_UKI=1. Written from the PE/COFF specification against
+// node: APIs only, so it runs under node as well as bun.
+//
+//   scripts/uki.js STUB OUTPUT .osrel=FILE .cmdline=FILE .linux=FILE .initrd=FILE
+//
+// The section addresses follow build-uki.sh: the conventional offsets from
+// the image base (.osrel +0x20000, .cmdline +0x30000, .linux +0x2000000,
+// .initrd +0x3000000), moved up when the stub or the kernel is larger. The
+// stub's own headers and sections are kept where they are; the new sections
+// are appended to the file. TimeDateStamp is SOURCE_DATE_EPOCH when set,
+// otherwise the stub's own, so the output depends only on the inputs.
+
+import { readFileSync, writeFileSync } from "node:fs";
+
+const fail = (message) => {
+  console.error(`uki.js: ${message}`);
+  process.exit(1);
+};
+
+const [stubPath, outputPath, ...pairs] = process.argv.slice(2);
+if (!stubPath || !outputPath) fail("usage: uki.js STUB OUTPUT .osrel=FILE .cmdline=FILE .linux=FILE .initrd=FILE");
+const files = new Map();
+for (const pair of pairs) {
+  const separator = pair.indexOf("=");
+  if (separator < 1) fail(`expected .section=FILE, got ${pair}`);
+  files.set(pair.slice(0, separator), pair.slice(separator + 1));
+}
+const order = [".osrel", ".cmdline", ".linux", ".initrd"];
+for (const name of order) if (!files.has(name)) fail(`missing ${name}=FILE`);
+if (files.size !== order.length) fail(`only ${order.join(", ")} are supported`);
+
+const stub = readFileSync(stubPath);
+if (stub.toString("latin1", 0, 2) !== "MZ") fail(`${stubPath} is not a PE image`);
+const pe = stub.readUInt32LE(0x3c);
+if (stub.toString("latin1", pe, pe + 4) !== "PE\0\0") fail(`${stubPath} is not a PE image`);
+const coff = pe + 4;
+const sectionCount = stub.readUInt16LE(coff + 2);
+const optionalSize = stub.readUInt16LE(coff + 16);
+const optional = coff + 20;
+if (stub.readUInt16LE(optional) !== 0x20b) fail(`${stubPath} is not PE32+`);
+if (stub.readUInt32LE(coff + 8) !== 0) fail(`${stubPath} has a COFF symbol table, which is not supported`);
+const imageBase = stub.readBigUInt64LE(optional + 24);
+const sectionAlignment = stub.readUInt32LE(optional + 32);
+const fileAlignment = stub.readUInt32LE(optional + 36);
+const stubImageSize = stub.readUInt32LE(optional + 56);
+const headersSize = stub.readUInt32LE(optional + 60);
+const directoryCount = stub.readUInt32LE(optional + 108);
+// A signature (the certificate table) covers the file up to its end;
+// appending after it would invalidate it.
+if (directoryCount > 4 && stub.readUInt32LE(optional + 112 + 4 * 8 + 4) !== 0) {
+  fail(`${stubPath} is signed; adding sections would break the signature`);
+}
+
+const table = optional + optionalSize;
+let firstData = stub.length;
+for (let index = 0; index < sectionCount; index++) {
+  const header = table + index * 40;
+  const raw = stub.readUInt32LE(header + 20);
+  if (stub.readUInt32LE(header + 16) && raw) firstData = Math.min(firstData, raw);
+}
+const tableEnd = table + (sectionCount + order.length) * 40;
+if (tableEnd > Math.min(headersSize, firstData)) {
+  fail(`no room in ${stubPath}'s headers for ${order.length} more section headers`);
+}
+
+const alignUp = (value, alignment) => Math.ceil(value / alignment) * alignment;
+const data = order.map((name) => readFileSync(files.get(name)));
+const [, , kernel] = data;
+const osrel = Math.max(0x20000, alignUp(stubImageSize, 0x10000));
+const cmdline = osrel + 0x10000;
+const linux = Math.max(0x2000000, alignUp(cmdline + 0x10000, 0x1000000));
+const initrd = Math.max(0x3000000, alignUp(linux + kernel.length, 0x1000000));
+const addresses = [osrel, cmdline, linux, initrd];
+if (data[0].length > 0x10000 || data[1].length > 0x10000) fail(".osrel and .cmdline must each fit in 64 KiB");
+
+// Section contents go after everything already in the file, each at a
+// FileAlignment boundary and padded to a multiple of it.
+let offset = alignUp(stub.length, fileAlignment);
+const pointers = data.map((bytes) => {
+  const pointer = offset;
+  offset += alignUp(bytes.length, fileAlignment);
+  return pointer;
+});
+const output = Buffer.alloc(offset);
+stub.copy(output);
+order.forEach((name, index) => {
+  const header = table + (sectionCount + index) * 40;
+  const bytes = data[index];
+  output.fill(0, header, header + 40);
+  output.write(name, header, 8, "latin1");
+  output.writeUInt32LE(bytes.length, header + 8); // VirtualSize
+  output.writeUInt32LE(addresses[index], header + 12); // VirtualAddress
+  output.writeUInt32LE(alignUp(bytes.length, fileAlignment), header + 16); // SizeOfRawData
+  output.writeUInt32LE(pointers[index], header + 20); // PointerToRawData
+  // IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ: objcopy's
+  // contents,alloc,load,readonly,data.
+  output.writeUInt32LE(0x40000040, header + 36);
+  bytes.copy(output, pointers[index]);
+});
+output.writeUInt16LE(sectionCount + order.length, coff + 2);
+// SizeOfCode, SizeOfInitializedData and SizeOfUninitializedData: the raw
+// sizes of the sections of each kind, recomputed as objcopy does.
+const sizes = [0, 0, 0];
+for (let index = 0; index < sectionCount + order.length; index++) {
+  const header = table + index * 40;
+  const characteristics = output.readUInt32LE(header + 36);
+  const rawSize = output.readUInt32LE(header + 16);
+  [0x20, 0x40, 0x80].forEach((flag, kind) => { if (characteristics & flag) sizes[kind] += rawSize; });
+}
+sizes.forEach((size, kind) => output.writeUInt32LE(size >>> 0, optional + 4 + kind * 4));
+output.writeUInt32LE(alignUp(initrd + data[3].length, sectionAlignment), optional + 56); // SizeOfImage
+if (process.env.SOURCE_DATE_EPOCH !== undefined) {
+  output.writeUInt32LE(Number(process.env.SOURCE_DATE_EPOCH) >>> 0, coff + 4);
+}
+
+// The PE checksum: 16-bit one's-complement-style sum of the file with the
+// CheckSum field itself taken as zero, plus the file length.
+output.writeUInt32LE(0, optional + 64);
+let sum = 0;
+for (let index = 0; index + 1 < output.length; index += 2) {
+  sum += output.readUInt16LE(index);
+  sum = (sum & 0xffff) + (sum >>> 16);
+}
+if (output.length & 1) {
+  sum += output[output.length - 1];
+  sum = (sum & 0xffff) + (sum >>> 16);
+}
+output.writeUInt32LE(((sum & 0xffff) + output.length) >>> 0, optional + 64);
+
+writeFileSync(outputPath, output);
+const hex = (value) => `0x${value.toString(16)}`;
+console.log(`uki.js: ${outputPath}: image base ${hex(imageBase)}, ${order.map((name, index) => `${name} +${hex(addresses[index])}`).join(", ")}`);

package/test/js-tools.test.js

@@ -0,0 +1,213 @@
+// The JS tools in initramfs/bin against the tools they stand in for, called
+// with the flags the build scripts use. Outputs must be byte for byte the
+// same, except where noted: mkfs.fat's boot code (GPL; ours only halts),
+// the random GUIDs of parted, and gzip's compressed bytes (zlib is a
+// different deflate encoder, so only its decompressed output is compared).
+// A test is skipped when the reference tool is not installed.
+//
+//   bun test test/js-tools.test.js
+
+import { afterAll, describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { closeSync, mkdtempSync, openSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { readGpt, writeGpt } from "../initramfs/lib/gpt.js";
+
+const bin = join(import.meta.dir, "../initramfs/bin");
+const work = mkdtempSync(join(tmpdir(), "buninu-js-tools-"));
+afterAll(() => rmSync(work, { recursive: true, force: true }));
+const path = (name) => join(work, name);
+
+// Same times everywhere, so mkfs.fat's volume ID and every FAT timestamp agree.
+const env = { ...process.env, SOURCE_DATE_EPOCH: "1700000000", LC_ALL: "C" };
+const have = (tool) => spawnSync("sh", ["-c", `command -v ${tool}`], { env }).status === 0;
+
+const run = (command, args, options = {}) => {
+  const result = spawnSync(command, args, { env, cwd: work, maxBuffer: 1 << 30, ...options });
+  if (result.status !== 0) throw new Error(`${command} ${args.join(" ")} exited ${result.status}: ${result.stderr}`);
+  return result.stdout;
+};
+const gnu = (tool, args, options) => run(tool, args, options);
+const js = (tool, args, options) => run(process.execPath, [join(bin, tool), ...args], options);
+const pick = (which) => (which === "gnu" ? gnu : js);
+
+/** Deterministic pseudo-random bytes (compressible enough to be realistic). */
+const bytes = (length, seed = 1) => {
+  const buffer = Buffer.alloc(length);
+  let state = seed;
+  for (let index = 0; index < length; index++) {
+    state = (state * 1103515245 + 12345) >>> 0;
+    buffer[index] = index % 7 === 0 ? 0 : state >>> 24;
+  }
+  return buffer;
+};
+
+/** mkfs.fat's boot code (bytes 90..509 of the boot sector and its backup) is not compared. */
+const maskBootCode = (image, offset = 0) => {
+  for (const sector of [0, 6]) image.fill(0, offset + sector * 512 + 90, offset + sector * 512 + 510);
+  return image;
+};
+
+const expectSameBytes = (a, b) => {
+  expect(a.length).toBe(b.length);
+  const first = a.findIndex((byte, index) => byte !== b[index]);
+  expect(first).toBe(-1);
+};
+
+describe("gzip", () => {
+  const payload = bytes(200_000);
+  test.skipIf(!have("gzip"))("gzip -dc decompresses GNU gzip -9n output, as fetch-alpine.sh does with .ko.gz", () => {
+    writeFileSync(path("payload"), payload);
+    const compressed = gnu("gzip", ["-9n", "-c", path("payload")]);
+    expectSameBytes(js("gzip", ["-dc"], { input: compressed }), gnu("gzip", ["-dc"], { input: compressed }));
+  });
+  test.skipIf(!have("gzip"))("concatenated members (an .apk) decompress as one stream", () => {
+    const members = Buffer.concat([gnu("gzip", ["-9n"], { input: payload.subarray(0, 1000) }), gnu("gzip", ["-9n"], { input: payload.subarray(1000) })]);
+    expectSameBytes(js("gzip", ["-dc"], { input: members }), gnu("gzip", ["-dc"], { input: members }));
+  });
+  test.skipIf(!have("gzip"))("gunzip -c and zcat match gzip -dc", () => {
+    const compressed = gnu("gzip", ["-9n"], { input: payload });
+    writeFileSync(path("payload.gz"), compressed);
+    expectSameBytes(js("gunzip", ["-c", path("payload.gz")]), payload);
+    expectSameBytes(js("zcat", [path("payload.gz")]), payload);
+  });
+  test.skipIf(!have("gzip"))("gzip -9n output is a valid gzip stream for GNU gzip (bytes differ: another encoder)", () => {
+    expectSameBytes(gnu("gzip", ["-dc"], { input: js("gzip", ["-9n"], { input: payload }) }), payload);
+  });
+  test("in place: FILE -> FILE.gz -> FILE", () => {
+    writeFileSync(path("inplace"), payload);
+    js("gzip", [path("inplace")]);
+    expect(() => statSync(path("inplace"))).toThrow();
+    js("gunzip", [path("inplace.gz")]);
+    expectSameBytes(readFileSync(path("inplace")), payload);
+  });
+});
+
+describe("unzip", () => {
+  test.skipIf(!have("zip") || !have("unzip"))("unzip -p MEMBER matches Info-ZIP, as fetch-bun.sh extracts bun", () => {
+    writeFileSync(path("bun"), bytes(3_000_000, 7));
+    writeFileSync(path("notes.txt"), "stored\n");
+    run("sh", ["-c", "mkdir -p zipped/dir && cp bun zipped/dir/bun && cp notes.txt zipped/ && zip -qr -X archive.zip zipped && zip -q -0 -X archive.zip notes.txt"]);
+    for (const member of ["zipped/dir/bun", "notes.txt", "zipped/notes.txt"]) {
+      expectSameBytes(js("unzip", ["-p", path("archive.zip"), member]), gnu("unzip", ["-p", path("archive.zip"), member]));
+    }
+  });
+  test.skipIf(!have("zip") || !have("unzip"))("unzip -d extracts the same tree as Info-ZIP", () => {
+    js("unzip", ["-q", "-o", path("archive.zip"), "-d", path("js-tree")]);
+    gnu("unzip", ["-q", "-o", path("archive.zip"), "-d", path("gnu-tree")]);
+    expectSameBytes(readFileSync(path("js-tree/zipped/dir/bun")), readFileSync(path("gnu-tree/zipped/dir/bun")));
+    expect(statSync(path("js-tree/zipped/dir/bun")).mode).toBe(statSync(path("gnu-tree/zipped/dir/bun")).mode);
+  });
+  const official = join(import.meta.dir, "../downloads/x86_64/bun-linux-x64-musl-baseline-1.4.2.zip");
+  test.skipIf(!have("unzip") || !(() => { try { return statSync(official).isFile(); } catch { return false; } })())(
+    "the pinned Bun release zip, as fetch-bun.sh reads it", () => {
+      const member = "bun-linux-x64-musl-baseline/bun";
+      expectSameBytes(js("unzip", ["-p", official, member]), gnu("unzip", ["-p", official, member]));
+    });
+});
+
+describe("truncate and dd", () => {
+  test.skipIf(!have("truncate"))("truncate -s SIZE creates the same sparse file as coreutils", () => {
+    const size = String(260063 * 512);
+    js("truncate", ["-s", size, path("js-t")]);
+    gnu("truncate", ["-s", size, path("gnu-t")]);
+    expect(statSync(path("js-t")).size).toBe(statSync(path("gnu-t")).size);
+    js("truncate", ["-s", "+1M", path("js-t")]);
+    gnu("truncate", ["-s", "+1M", path("gnu-t")]);
+    expectSameBytes(readFileSync(path("js-t")), readFileSync(path("gnu-t")));
+  });
+  test.skipIf(!have("dd"))("dd bs=512 seek= count= conv=notrunc,sparse status=none, as build-image.sh places the ESP", () => {
+    const source = Buffer.concat([bytes(4096, 3), Buffer.alloc(8192), bytes(1000, 4)]);
+    writeFileSync(path("esp-part"), source);
+    for (const which of ["gnu", "js"]) {
+      writeFileSync(path(`${which}-disk`), bytes(64 * 512, 9));
+      pick(which)("dd", [`if=${path("esp-part")}`, `of=${path(`${which}-disk`)}`, "bs=512", "seek=8", `count=${Math.ceil(source.length / 512)}`, "conv=notrunc,sparse", "status=none"]);
+    }
+    expectSameBytes(readFileSync(path("js-disk")), readFileSync(path("gnu-disk")));
+  });
+  test.skipIf(!have("dd"))("dd without notrunc cuts the output at the seek point", () => {
+    for (const which of ["gnu", "js"]) {
+      writeFileSync(path(`${which}-cut`), bytes(10_000, 5));
+      pick(which)("dd", [`if=${path("esp-part")}`, `of=${path(`${which}-cut`)}`, "bs=512", "seek=2", "count=3", "status=none"]);
+    }
+    expectSameBytes(readFileSync(path("js-cut")), readFileSync(path("gnu-cut")));
+  });
+});
+
+describe("FAT32: mkfs.fat, mmd, mcopy", () => {
+  const fatTools = have("mkfs.fat") && have("mmd") && have("mcopy");
+  const uki = bytes(5_000_000, 11);
+
+  test.skipIf(!fatTools)("the ESP of build-image.sh: mkfs.fat -F 32 -h 2048 -n EFIBOOT, mmd, mcopy", () => {
+    writeFileSync(path("uki.efi"), uki);
+    for (const which of ["gnu", "js"]) {
+      const tool = pick(which);
+      const image = path(`${which}-esp.img`);
+      tool("truncate", ["-s", String(260063 * 512), image]);
+      tool("mkfs.fat", ["-F", "32", "-h", "2048", "-n", "EFIBOOT", image]);
+      tool("mmd", ["-i", image, "::/EFI", "::/EFI/BOOT"]);
+      tool("mcopy", ["-i", image, path("uki.efi"), "::/EFI/BOOT/BOOTX64.EFI"]);
+    }
+    expectSameBytes(maskBootCode(readFileSync(path("js-esp.img"))), maskBootCode(readFileSync(path("gnu-esp.img"))));
+  });
+
+  test.skipIf(!fatTools)("--invariant, lower-case and long names, and a directory that outgrows its cluster", () => {
+    writeFileSync(path("small.bin"), bytes(5000, 13));
+    for (const which of ["gnu", "js"]) {
+      const tool = pick(which);
+      const image = path(`${which}-edge.img`);
+      tool("truncate", ["-s", String(100000 * 512), image]);
+      tool("mkfs.fat", ["--invariant", "-F", "32", "-n", "MYLABEL", image]);
+      tool("mmd", ["-i", image, "::/EFI", "::/EFI/BOOT", "::/Mixed Case Dir"]);
+      tool("mcopy", ["-i", image, path("small.bin"), "::/EFI/BOOT/lower.efi"]);
+      tool("mcopy", ["-i", image, path("small.bin"), "::/Mixed Case Dir/Long File Name.txt"]);
+      tool("mcopy", ["-i", image, path("small.bin"), "::/README"]);
+      for (let index = 1; index <= 40; index++) tool("mcopy", ["-i", image, path("small.bin"), `::/EFI/file${index}.dat`]);
+    }
+    expectSameBytes(maskBootCode(readFileSync(path("js-edge.img"))), maskBootCode(readFileSync(path("gnu-edge.img"))));
+  });
+
+  test.skipIf(!fatTools)("each side reads the other's image (mcopy -n -i IMAGE ::/file out)", () => {
+    gnu("mcopy", ["-n", "-i", path("js-esp.img"), "::/EFI/BOOT/BOOTX64.EFI", path("from-js.efi")]);
+    js("mcopy", ["-n", "-i", path("gnu-esp.img"), "::/EFI/BOOT/BOOTX64.EFI", path("from-gnu.efi")]);
+    expectSameBytes(readFileSync(path("from-js.efi")), uki);
+    expectSameBytes(readFileSync(path("from-gnu.efi")), uki);
+  });
+
+  test.skipIf(!have("fsck.fat") || !fatTools)("fsck.fat -n finds nothing wrong in the JS image", () => {
+    expect(gnu("fsck.fat", ["-n", path("js-edge.img")]).toString()).toContain("files,");
+  });
+});
+
+describe("GPT: parted", () => {
+  test.skipIf(!have("parted"))("parted -s IMAGE mklabel gpt / unit s mkpart ESP fat32 / set 1 esp on, as build-image.sh", () => {
+    const sectors = 262144;
+    for (const which of ["gnu", "js"]) {
+      const tool = pick(which);
+      const image = path(`${which}-gpt.img`);
+      tool("truncate", ["-s", String(sectors * 512), image]);
+      tool("parted", ["-s", image, "mklabel", "gpt"]);
+      tool("parted", ["-s", image, "unit", "s", "mkpart", "ESP", "fat32", "2048s", `${sectors - 34}s`]);
+      tool("parted", ["-s", image, "set", "1", "esp", "on"]);
+    }
+    // The GUIDs are random on both sides: give ours parted's, then compare everything.
+    const reference = openSync(path("gnu-gpt.img"), "r");
+    const gnuTable = readGpt(reference, sectors);
+    closeSync(reference);
+    const ours = openSync(path("js-gpt.img"), "r+");
+    const jsTable = readGpt(ours, sectors);
+    expect(jsTable.entries.map(({ guid, ...rest }) => rest)).toEqual(gnuTable.entries.map(({ guid, ...rest }) => rest));
+    jsTable.diskGuid = gnuTable.diskGuid;
+    jsTable.entries.forEach((entry, index) => { entry.guid = gnuTable.entries[index].guid; });
+    writeGpt(ours, sectors, jsTable);
+    closeSync(ours);
+    expectSameBytes(readFileSync(path("js-gpt.img")), readFileSync(path("gnu-gpt.img")));
+  });
+
+  test.skipIf(!have("sfdisk") || !have("parted"))("sfdisk reads the JS table", () => {
+    const dump = gnu("sfdisk", ["-d", path("js-gpt.img")]).toString();
+    expect(dump).toContain("start=        2048, size=      260063, type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B");
+    expect(dump).toContain('name="ESP"');
+  });
+});