buninu-linux 0.7.4 → 0.7.5

package/initramfs/lib/gzip.js

@@ -0,0 +1,115 @@
+// /lib/gzip.js — gzip, gunzip and zcat over node:zlib. /bin/gzip, /bin/gunzip
+// and /bin/zcat call run() with their own defaults, since a symlink would
+// reach Bun under the target's name.
+//
+// Supported: -c/--stdout, -d/--decompress, -k/--keep, -f/--force, -n/--no-name,
+// -N/--name (accepted; no name is ever stored), -q/--quiet, -t/--test,
+// -v/--verbose, -1 ... -9, --fast, --best; FILE operands or "-" for stdin.
+// Concatenated members decompress as one stream, as with GNU gzip.
+
+import { existsSync, readFileSync, rmSync, statSync, utimesSync, writeFileSync, writeSync } from "node:fs";
+import { isatty } from "node:tty";
+import { constants, gunzipSync, gzipSync } from "node:zlib";
+
+const usage = (name) => `Usage: ${name} [-cdfkntqv1-9] [FILE...]
+  -c, --stdout      write to standard output, keep the input files
+  -d, --decompress  decompress
+  -k, --keep        keep the input files
+  -f, --force       overwrite output files; compress to a terminal
+  -n, --no-name     (always the case) store no file name or time
+  -t, --test        test the compressed files
+  -q, --quiet       no warnings
+  -v, --verbose     report each file
+  -1 ... -9         fast ... best compression (default 6)
+With no FILE, or when FILE is -, read standard input.`;
+
+const writeAll = (fd, bytes) => {
+  for (let offset = 0; offset < bytes.length;) offset += writeSync(fd, bytes, offset, bytes.length - offset);
+};
+
+const readStdin = () => {
+  try {
+    return readFileSync(0);
+  } catch (error) {
+    if (error.code === "EAGAIN") return readFileSync("/dev/stdin");
+    throw error;
+  }
+};
+
+export const run = (name, argv, defaults = {}) => {
+  const options = { decompress: false, stdout: false, keep: false, force: false, test: false, quiet: false, verbose: false, level: 6, ...defaults };
+  const files = [];
+  let endOfOptions = false;
+  for (const argument of argv) {
+    if (endOfOptions || argument === "-" || !argument.startsWith("-")) { files.push(argument); continue; }
+    if (argument === "--") { endOfOptions = true; continue; }
+    const long = {
+      "--stdout": "c", "--to-stdout": "c", "--decompress": "d", "--uncompress": "d", "--keep": "k", "--force": "f",
+      "--no-name": "n", "--name": "N", "--test": "t", "--quiet": "q", "--verbose": "v", "--fast": "1", "--best": "9",
+    }[argument];
+    if (argument === "-h" || argument === "--help") { console.log(usage(name)); return 0; }
+    const letters = long ?? (argument.startsWith("--") ? null : argument.slice(1));
+    if (letters === null) { console.error(`${name}: unknown option ${argument}\n${usage(name)}`); return 1; }
+    for (const letter of letters) {
+      if (letter === "c") options.stdout = true;
+      else if (letter === "d") options.decompress = true;
+      else if (letter === "k") options.keep = true;
+      else if (letter === "f") options.force = true;
+      else if (letter === "t") options.test = options.decompress = true;
+      else if (letter === "q") options.quiet = true;
+      else if (letter === "v") options.verbose = true;
+      else if (letter === "n" || letter === "N") {}
+      else if (/[1-9]/.test(letter)) options.level = Number(letter);
+      else { console.error(`${name}: unknown option -${letter}\n${usage(name)}`); return 1; }
+    }
+  }
+  if (files.length === 0) files.push("-");
+
+  const transform = (bytes) => options.decompress
+    ? gunzipSync(bytes, { finishFlush: constants.Z_SYNC_FLUSH })
+    : gzipSync(bytes, { level: options.level });
+
+  let status = 0;
+  for (const file of files) {
+    const label = file === "-" ? "stdin" : file;
+    try {
+      if (file === "-" || options.stdout || options.test) {
+        if (!options.decompress && !options.force && isatty(1) && !options.test) {
+          console.error(`${name}: compressed data not written to a terminal. Use -f to force compression.`);
+          return 1;
+        }
+        let input;
+        if (file === "-") input = readStdin();
+        else {
+          if (statSync(file).isDirectory()) throw new Error("is a directory");
+          input = readFileSync(file);
+        }
+        const output = transform(input);
+        if (!options.test) writeAll(1, output);
+        if (options.verbose) console.error(`${label}:\tOK`);
+        continue;
+      }
+      // In place: FILE -> FILE.gz, or FILE.gz -> FILE.
+      let target;
+      if (options.decompress) {
+        const match = /^(.*?)(\.gz|-gz|\.z|_z|\.tgz)$/i.exec(file);
+        if (!match) { if (!options.quiet) console.error(`${name}: ${file}: unknown suffix -- ignored`); status = status || 2; continue; }
+        target = match[1] + (match[2].toLowerCase() === ".tgz" ? ".tar" : "");
+      } else {
+        if (/\.gz$/i.test(file) && !options.force) { if (!options.quiet) console.error(`${name}: ${file} already has .gz suffix -- unchanged`); status = status || 2; continue; }
+        target = `${file}.gz`;
+      }
+      const stat = statSync(file);
+      if (stat.isDirectory()) throw new Error("is a directory -- ignored");
+      if (existsSync(target) && !options.force) throw new Error(`${target} already exists`);
+      writeFileSync(target, transform(readFileSync(file)), { mode: stat.mode & 0o7777 });
+      utimesSync(target, stat.atime, stat.mtime);
+      if (!options.keep) rmSync(file);
+      if (options.verbose) console.error(`${file}:\t-> ${target}`);
+    } catch (error) {
+      console.error(`${name}: ${label}: ${error.message}`);
+      status = 1;
+    }
+  }
+  return status;
+};

package/initramfs/lib/mtools.js

@@ -0,0 +1,158 @@
+// /lib/mtools.js — mmd, mcopy and mdir over /lib/fat.js, with mtools'
+// "-i IMAGE" and "::/path" conventions. /bin/mmd, /bin/mcopy and /bin/mdir
+// call these; IMAGE may be "file@@offset".
+
+import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import { ATTR, FatError, now, openVolume } from "./fat.js";
+
+/** Splits "-i IMAGE" and the option letters from the operands. */
+const parse = (name, argv, letters, withValue = []) => {
+  const options = { image: null, flags: new Set(), values: {} };
+  const operands = [];
+  for (let index = 0; index < argv.length; index++) {
+    const argument = argv[index];
+    if (argument === "-i") {
+      if (index + 1 >= argv.length) throw new FatError("-i requires an image");
+      options.image = argv[++index];
+    } else if (argument.startsWith("-i") && argument.length > 2) options.image = argument.slice(2);
+    else if (withValue.includes(argument)) {
+      if (index + 1 >= argv.length) throw new FatError(`${argument} requires an argument`);
+      options.values[argument] = argv[++index];
+    } else if (argument.startsWith("-") && argument.length > 1) {
+      for (const letter of argument.slice(1)) {
+        if (!letters.includes(letter)) throw new FatError(`unknown option -${letter}`);
+        options.flags.add(letter);
+      }
+    } else operands.push(argument);
+  }
+  if (!options.image) throw new FatError(`${name} needs -i IMAGE`);
+  return { options, operands };
+};
+
+const isImagePath = (operand) => operand.startsWith("::");
+const imagePath = (operand) => {
+  if (!isImagePath(operand)) throw new FatError(`${operand}: expected ::/path inside the image`);
+  return `/${operand.slice(2).replace(/^\/+/, "")}`;
+};
+
+const guard = (name, action) => {
+  try {
+    return action();
+  } catch (error) {
+    if (!(error instanceof FatError)) throw error;
+    console.error(`${name}: ${error.message}`);
+    return 1;
+  }
+};
+
+export const mmd = (argv) => guard("mmd", () => {
+  const { options, operands } = parse("mmd", argv, "vQ", ["-D"]);
+  if (!operands.length) throw new FatError("usage: mmd -i IMAGE ::/DIR...");
+  const volume = openVolume(options.image);
+  let status = 0;
+  try {
+    for (const operand of operands) {
+      try { volume.mkdir(imagePath(operand)); }
+      catch (error) { if (!(error instanceof FatError)) throw error; console.error(`mmd: ${error.message}`); status = 1; }
+    }
+  } finally {
+    volume.close();
+  }
+  return status;
+});
+
+/**
+ * mcopy: local files into the image (TARGET ::/path) or image files out of
+ * it (SOURCES ::/path). -o / -D o overwrites in the image, -n overwrites
+ * local files without asking, -m keeps the source's modification time.
+ */
+export const mcopy = (argv) => guard("mcopy", () => {
+  const { options, operands } = parse("mcopy", argv, "onmvQpbt", ["-D"]);
+  if (operands.length < 2) throw new FatError("usage: mcopy -i IMAGE SOURCE... TARGET");
+  const target = operands.at(-1);
+  const sources = operands.slice(0, -1);
+  const overwrite = options.flags.has("o") || options.values["-D"] === "o";
+  let status = 0;
+  if (isImagePath(target)) {
+    if (sources.some(isImagePath)) throw new FatError("copying within the image is not supported");
+    const volume = openVolume(options.image);
+    try {
+      const destination = imagePath(target);
+      const existing = volume.lookup(destination);
+      const intoDirectory = (existing && existing.attributes & ATTR.DIRECTORY) || target.endsWith("/");
+      if (sources.length > 1 && !intoDirectory) throw new FatError(`${target}: not a directory`);
+      for (const source of sources) {
+        try {
+          const stat = statSync(source);
+          if (stat.isDirectory()) throw new FatError(`${source}: is a directory (-s is not supported)`);
+          const path = intoDirectory ? `${destination.replace(/\/+$/, "")}/${basename(source)}` : destination;
+          const date = options.flags.has("m") ? stat.mtime : now().date;
+          volume.writeFile(path, readFileSync(source), { date, overwrite });
+          if (options.flags.has("v")) console.error(`Copying ${basename(source)}`);
+        } catch (error) {
+          if (!(error instanceof FatError) && !error.code) throw error;
+          console.error(`mcopy: ${error.message}`);
+          status = 1;
+        }
+      }
+    } finally {
+      volume.close();
+    }
+    return status;
+  }
+  if (!sources.every(isImagePath)) throw new FatError("either TARGET or every SOURCE must be ::/path");
+  const volume = openVolume(options.image, false);
+  try {
+    const intoDirectory = existsSync(target) && statSync(target).isDirectory();
+    if (sources.length > 1 && !intoDirectory) throw new FatError(`${target}: not a directory`);
+    for (const source of sources) {
+      try {
+        const path = imagePath(source);
+        const output = target === "-" ? null : intoDirectory ? join(target, basename(path)) : target;
+        if (output && existsSync(output) && !options.flags.has("n") && !overwrite) throw new FatError(`${output}: file exists (use -n to overwrite)`);
+        const bytes = volume.readFile(path);
+        if (output === null) process.stdout.write(bytes); else writeFileSync(output, bytes);
+      } catch (error) {
+        if (!(error instanceof FatError) && !error.code) throw error;
+        console.error(`mcopy: ${error.message}`);
+        status = 1;
+      }
+    }
+  } finally {
+    volume.close();
+  }
+  return status;
+});
+
+const pad = (value) => String(value).padStart(2, "0");
+const showDate = (date, time) => `${(date >> 9) + 1980}-${pad((date >> 5) & 15)}-${pad(date & 31)} ${pad(time >> 11)}:${pad((time >> 5) & 63)}`;
+
+export const mdir = (argv) => guard("mdir", () => {
+  const { options, operands } = parse("mdir", argv, "bawf");
+  const volume = openVolume(options.image, false);
+  try {
+    for (const operand of operands.length ? operands : ["::/"]) {
+      const path = imagePath(operand);
+      const entries = volume.list(path).filter((entry) => options.flags.has("a") || !(entry.attributes & ATTR.HIDDEN));
+      if (options.flags.has("b")) {
+        for (const entry of entries) if (!(entry.attributes & ATTR.VOLUME) && entry.name !== "." && entry.name !== "..") console.log(`::${path.replace(/\/$/, "")}/${entry.name}`);
+        continue;
+      }
+      console.log(`Directory for ::${path}\n`);
+      let files = 0;
+      let bytes = 0;
+      for (const entry of entries) {
+        if (entry.attributes & ATTR.VOLUME) continue;
+        const size = entry.attributes & ATTR.DIRECTORY ? "<DIR>".padEnd(10) : String(entry.size).padStart(10);
+        console.log(`${entry.name.padEnd(24)} ${size} ${showDate(entry.date, entry.time)}`);
+        files++;
+        bytes += entry.size;
+      }
+      console.log(`${String(files).padStart(8)} file${files === 1 ? "" : "s"} ${String(bytes).padStart(16)} bytes`);
+    }
+  } finally {
+    volume.close();
+  }
+  return 0;
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buninu-linux",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "description": "A Linux distribution running Bun as PID 1 with the Buninu userspace.",
   "type": "module",
   "main": "./index.js",

package/scripts/arch.js

@@ -0,0 +1,156 @@
+// Everything that differs between the two guest architectures and the two
+// kernel flavors, as scripts/arch.sh has it: the pinned packages and their
+// SHA-256, the file names inside them, the EFI names and the serial console.
+// fetch.js, pack.js and build.js take the object config() returns.
+//
+//   config({ arch, flavor, real, mirror })   arguments override
+//   BUNINU_ARCH, LINUX_FLAVOR, REAL_MACHINE=1 and ALPINE_MIRROR
+//
+// Paths are absolute, under the checkout. Run directly, it prints the config.
+
+import { accessSync, constants } from "node:fs";
+import { delimiter, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const rootDir = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+const pins = {
+  x86_64: {
+    linuxVirtSha256: "57a522d2b6e9d1b6c9de6b9f7fc42aa4b8d33ebf9f2b42b4251dbee6ff2d9839",
+    linuxLtsSha256: "1d02a1b74a8a09c476a3c01782c0b8613ae2935988e65d4d31e6bef44dfb8b64",
+    muslSha256: "573712e2f49c15bfc20a2699f204acdfc74c772722b15e7353d768057fae0e71",
+    stubSha256: "8e64a5a3afee5f930e6e6716be726dc6d405530ac7f8fa5be6251dae68671ec9",
+    libstdcppSha256: "14c987b556f5385a5db18376e788c75f37d85321b8dc1920d926ea7daac1d6f6",
+    libgccSha256: "393dcd32629f06d7d85409c272d142d0c082772d10b87ef55ee82f47de3be637",
+    // Bun ships one x64 musl build; -baseline is an alias (NOTICE.md).
+    bunBuild: "bun-linux-x64-musl-baseline",
+    bunSha256: "76e1db84e98f22f78de0a87e309bfbbf297732847f9720db36750646c85c8c18",
+    efiStub: "linuxx64.efi.stub",
+    efiBootName: "BOOTX64.EFI",
+    // COM1 on q35 and on PCs.
+    serialConsole: "ttyS0",
+    serialMajor: 4,
+  },
+  aarch64: {
+    linuxVirtSha256: "9a4a6fa042b60b70f453dded99762810516b35793c64d776d75986b0b110b6e0",
+    linuxLtsSha256: "f945ddcc306546c7c22cf10249f637fc6e806ecc40286fb50950558dd573e7e9",
+    muslSha256: "5e9674b7f41152fe2119093b5cb4c13eaaadb19c2d5422b2d7267913e663ee6e",
+    stubSha256: "a1823d2d7082db555d528f82c1809f276c818aeb5b40f198f4565f104e055c38",
+    libstdcppSha256: "2302e766d4e4926038ec166ecb85837ee884576115236ddb565e3a5fca4a11d7",
+    libgccSha256: "369aaa6e9d099a737bad6dd3e6c2fe7bb1547ca26d22b94ee0411228f709b403",
+    bunBuild: "bun-linux-aarch64-musl",
+    bunSha256: "71760b6c8ea30623b81a4907cb815d48e2ea266f2e73e751534a44a0607950df",
+    efiStub: "linuxaa64.efi.stub",
+    efiBootName: "BOOTAA64.EFI",
+    // The PL011 UART of QEMU's virt machine.
+    serialConsole: "ttyAMA0",
+    serialMajor: 204,
+  },
+};
+
+const normalizeArch = (name) => {
+  if (["x86_64", "amd64", "x64"].includes(name)) return "x86_64";
+  if (["aarch64", "arm64"].includes(name)) return "aarch64";
+  throw new Error(`unsupported BUNINU_ARCH=${name} (use x86_64 or aarch64)`);
+};
+
+export const config = ({
+  arch = process.env.BUNINU_ARCH || "x86_64",
+  flavor = process.env.LINUX_FLAVOR || "virt",
+  real = process.env.REAL_MACHINE === "1",
+  mirror = process.env.ALPINE_MIRROR || "https://dl-cdn.alpinelinux.org/alpine",
+} = {}) => {
+  arch = normalizeArch(arch);
+  if (flavor !== "virt" && flavor !== "lts") throw new Error(`unsupported LINUX_FLAVOR=${flavor} (use virt or lts)`);
+  if (real && arch !== "x86_64") throw new Error("--real images are x86_64 only; its module set is PC hardware");
+  const pin = pins[arch];
+  // The Alpine repository keeps only the newest build of a package, so a pin
+  // stops downloading when Alpine bumps it; the hashes then fail loudly.
+  const alpineBase = `${mirror}/v3.24/main/${arch}`;
+  const kernelVersion = "6.18.54";
+  const kernelRelease = `${kernelVersion}-0-${flavor}`;
+  const bunVersion = "1.4.2";
+  const downloadsDir = join(rootDir, "downloads", arch);
+  const kernelDir = join(rootDir, "kernel", arch);
+  const nativeDir = join(rootDir, "native", arch);
+  return {
+    arch,
+    flavor,
+    real,
+    rootDir,
+    alpineBase,
+    kernelVersion,
+    kernelRelease,
+    linuxPackage: `linux-${flavor}-${kernelVersion}-r0.apk`,
+    linuxSha256: flavor === "lts" ? pin.linuxLtsSha256 : pin.linuxVirtSha256,
+    muslPackage: "musl-1.2.6-r2.apk",
+    muslSha256: pin.muslSha256,
+    stubPackage: "systemd-efistub-260.2-r0.apk",
+    stubSha256: pin.stubSha256,
+    libstdcppPackage: "libstdc++-15.2.0-r5.apk",
+    libstdcppSha256: pin.libstdcppSha256,
+    libgccPackage: "libgcc-15.2.0-r5.apk",
+    libgccSha256: pin.libgccSha256,
+    bunVersion,
+    bunBuild: pin.bunBuild,
+    bunSha256: pin.bunSha256,
+    bunZip: `${pin.bunBuild}-${bunVersion}.zip`,
+    bunUrl: `https://github.com/oven-sh/bun/releases/download/bun-v${bunVersion}/${pin.bunBuild}.zip`,
+    downloadsDir,
+    kernelDir,
+    kernelImage: join(kernelDir, `vmlinuz-${flavor}`),
+    nativeDir,
+    modulesRoot: join(nativeDir, "lib", "modules", kernelRelease),
+    muslLoader: `ld-musl-${arch}.so.1`,
+    muslLibc: `libc.musl-${arch}.so.1`,
+    efiStub: pin.efiStub,
+    efiBootName: pin.efiBootName,
+    serialConsole: pin.serialConsole,
+    serialMajor: pin.serialMajor,
+  };
+};
+
+/**
+ * The runtime for scripts/cpio.js and scripts/uki.js: bun, else node, from
+ * PATH, as the shell scripts' `command -v bun || command -v node` (bun's and
+ * node's zlib compress differently), else whatever runs this.
+ */
+export const jsRuntime = () => {
+  for (const name of ["bun", "node"]) {
+    for (const directory of (process.env.PATH ?? "").split(delimiter)) {
+      if (!directory) continue;
+      try {
+        accessSync(join(directory, name), constants.X_OK);
+        return join(directory, name);
+      } catch {}
+    }
+  }
+  return process.execPath;
+};
+
+/**
+ * Runs `action` with umask 022, so what the stages create gets the same
+ * modes everywhere: native Termux runs with 0077, PRoot and most hosts 022,
+ * and the modes end up in the initramfs.
+ */
+export const withUmask022 = async (action) => {
+  const previous = process.umask(0o022);
+  try {
+    return await action();
+  } finally {
+    process.umask(previous);
+  }
+};
+
+/** Runs `main` when `url` (a module's import.meta.url) is the script node or bun was started with. */
+export const runIfMain = (url, main) => {
+  if (!process.argv[1] || resolve(process.argv[1]) !== fileURLToPath(url)) return;
+  Promise.resolve()
+    .then(main)
+    .catch((error) => {
+      console.error(`error: ${error.message}`);
+      process.exit(1);
+    });
+};
+
+runIfMain(import.meta.url, () => console.log(JSON.stringify(config(), null, 2)));

package/scripts/arch.sh

@@ -44,7 +44,7 @@ fi
 alpine_mirror=${ALPINE_MIRROR:-https://dl-cdn.alpinelinux.org/alpine}
 alpine_base="$alpine_mirror/v3.24/main/$arch"
 
-kernel_version=6.18.53
+kernel_version=6.18.54
 kernel_release="$kernel_version-0-$linux_flavor"
 linux_package="linux-$linux_flavor-$kernel_version-r0.apk"
 musl_package=musl-1.2.6-r2.apk
@@ -63,8 +63,8 @@ musl_libc="libc.musl-$arch.so.1"
 
 case $arch in
     x86_64)
-        linux_virt_sha256=cad859cc46342e18002621fdde166bf2cd520dfec5e781d241de7d13e53970d6
-        linux_lts_sha256=8e3cfdd1d98e0e70c2e70a8c299ed3cd1e0939d60ad7bbd1da1cf241d794490b
+        linux_virt_sha256=57a522d2b6e9d1b6c9de6b9f7fc42aa4b8d33ebf9f2b42b4251dbee6ff2d9839
+        linux_lts_sha256=1d02a1b74a8a09c476a3c01782c0b8613ae2935988e65d4d31e6bef44dfb8b64
         musl_sha256=573712e2f49c15bfc20a2699f204acdfc74c772722b15e7353d768057fae0e71
         stub_sha256=8e64a5a3afee5f930e6e6716be726dc6d405530ac7f8fa5be6251dae68671ec9
         libstdcpp_sha256=14c987b556f5385a5db18376e788c75f37d85321b8dc1920d926ea7daac1d6f6
@@ -82,8 +82,8 @@ case $arch in
         serial_major=4
         ;;
     aarch64)
-        linux_virt_sha256=fea61b7fd5e72e626d771f9798df56c83db658d0e221044f06fc28aacf5a118b
-        linux_lts_sha256=46885041022ea11afa1e07c40199c74146bf72d362368a844338af0c162e365c
+        linux_virt_sha256=9a4a6fa042b60b70f453dded99762810516b35793c64d776d75986b0b110b6e0
+        linux_lts_sha256=f945ddcc306546c7c22cf10249f637fc6e806ecc40286fb50950558dd573e7e9
         musl_sha256=5e9674b7f41152fe2119093b5cb4c13eaaadb19c2d5422b2d7267913e663ee6e
         stub_sha256=a1823d2d7082db555d528f82c1809f276c818aeb5b40f198f4565f104e055c38
         libstdcpp_sha256=2302e766d4e4926038ec166ecb85837ee884576115236ddb565e3a5fca4a11d7

package/scripts/build.js

@@ -0,0 +1,145 @@
+// The build stage, as build-uki.sh and build-image.sh do it with
+// BUNINU_JS_UKI=1 and the JS FAT/GPT tools: fetch what is missing, pack the
+// initramfs, assemble the UKI with scripts/uki.js, and write vda.img, a GPT
+// disk whose one partition is a FAT32 ESP holding the UKI.
+//
+//   node scripts/build.js            BUNINU_ARCH, LINUX_FLAVOR and REAL_MACHINE
+//                                    as in arch.js; SOURCE_DATE_EPOCH fixes the
+//                                    archive's mtimes and the ESP's times
+//
+// The ESP is formatted in place inside vda.img rather than in a temporary
+// file copied in with dd; the bytes are the same.
+
+import { spawnSync } from "node:child_process";
+import {
+  closeSync,
+  existsSync,
+  ftruncateSync,
+  mkdirSync,
+  openSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { format, openVolume } from "../initramfs/lib/fat.js";
+import { TYPES, randomGuid, writeGpt } from "../initramfs/lib/gpt.js";
+import { config, jsRuntime, rootDir, runIfMain } from "./arch.js";
+import { fetchAlpine } from "./fetch.js";
+import { pack } from "./pack.js";
+
+const nonEmpty = (path) => existsSync(path) && statSync(path).size > 0;
+
+/**
+ * The kernel command line. Everything before `--` needs an `=`: the kernel
+ * appends any bare word to init's argv. Everything after `--` becomes
+ * argv[1..]: Bun is PID 1, and `-e import('/init.js')` avoids opening an
+ * entry file before /proc exists. The console listed last is the one the
+ * kernel opens as init's fd 0/1/2: the serial port, or tty0 on --real.
+ */
+export const cmdline = (cfg) => [
+  ...(cfg.real
+    ? [
+      `console=${cfg.serialConsole},115200`,
+      "console=tty0",
+      "REAL_MACHINE=1",
+    ]
+    : [
+      "console=tty0",
+      `console=${cfg.serialConsole},115200`,
+    ]),
+  "panic=0",
+  "PATH=/bin",
+  `KERNEL_RELEASE=${cfg.kernelRelease}`,
+  "rdinit=/bin/bun",
+  "--",
+  "-e",
+  "import('/init.js')",
+].join(" ");
+
+/** build-uki.sh: fetch the kernel if missing, pack, and assemble vda/EFI/BOOT/<name>. */
+export const uki = async (cfg = config()) => {
+  const missing = !nonEmpty(cfg.kernelImage)
+    || !nonEmpty(join(cfg.kernelDir, cfg.efiStub))
+    || !nonEmpty(join(cfg.modulesRoot, "modules.dep"))
+    || (cfg.real && (
+      !nonEmpty(join(cfg.modulesRoot, "kernel/drivers/hid/usbhid/usbhid.ko"))
+      || !nonEmpty(join(cfg.modulesRoot, "kernel/drivers/acpi/battery.ko"))
+    ));
+  if (missing) await fetchAlpine(cfg);
+  pack(cfg);
+
+  const build = join(rootDir, "build");
+  const boot = join(rootDir, "vda/EFI/BOOT");
+  mkdirSync(build, { recursive: true });
+  mkdirSync(boot, { recursive: true });
+  writeFileSync(join(build, "cmdline"), cmdline(cfg));
+  // Only this architecture's removable-media name may remain: firmware of the
+  // other architecture ignores it, but run-qemu.sh reads the guest from it.
+  for (const name of readdirSync(boot)) {
+    if (name.endsWith(".EFI") && name !== cfg.efiBootName) rmSync(join(boot, name), { force: true });
+  }
+  const result = spawnSync(jsRuntime(), [
+    join(rootDir, "scripts/uki.js"),
+    join(cfg.kernelDir, cfg.efiStub),
+    join(boot, cfg.efiBootName),
+    `.osrel=${join(build, "os-release")}`,
+    `.cmdline=${join(build, "cmdline")}`,
+    `.linux=${cfg.kernelImage}`,
+    `.initrd=${join(build, "initramfs.cpio.gz")}`,
+  ], { stdio: ["ignore", "ignore", "inherit"] });
+  if (result.status !== 0) throw new Error("scripts/uki.js failed");
+  console.log(`Built ${cfg.arch} UKI with Alpine linux-${cfg.flavor} at vda/EFI/BOOT/${cfg.efiBootName}`);
+};
+
+/** build-image.sh: vda.img, 128 MiB, GPT with the ESP from sector 2048 to the last usable one. */
+export const image = (cfg = config()) => {
+  const efi = join(rootDir, "vda/EFI/BOOT", cfg.efiBootName);
+  if (!nonEmpty(efi)) throw new Error(`no ${cfg.arch} EFI payload ${efi} yet; build the UKI first`);
+  const diskSectors = (128 * 1024 * 1024) / 512;
+  const espStart = 2048;
+  const espEnd = diskSectors - 34;
+  const path = join(rootDir, "vda.img");
+  rmSync(path, { force: true });
+  const fd = openSync(path, "w+");
+  try {
+    ftruncateSync(fd, diskSectors * 512);
+    writeGpt(fd, diskSectors, {
+      diskGuid: randomGuid(),
+      entries: [{
+        number: 1,
+        type: TYPES.esp,
+        guid: randomGuid(),
+        first: espStart,
+        last: espEnd,
+        name: "ESP",
+      }],
+    });
+    format(fd, {
+      offset: espStart * 512,
+      sectors: espEnd - espStart + 1,
+      label: "EFIBOOT",
+      hidden: espStart,
+    });
+  } finally {
+    closeSync(fd);
+  }
+  const volume = openVolume(`${path}@@${espStart * 512}`);
+  try {
+    volume.mkdir("/EFI");
+    volume.mkdir("/EFI/BOOT");
+    volume.writeFile(`/EFI/BOOT/${cfg.efiBootName}`, readFileSync(efi));
+  } finally {
+    volume.close();
+  }
+  console.log(`Packed vda/EFI/BOOT/${cfg.efiBootName} into vda.img`);
+};
+
+export const buildAll = async (cfg = config()) => {
+  await uki(cfg);
+  image(cfg);
+};
+
+runIfMain(import.meta.url, () => buildAll());