buninu-linux 0.7.4 → 0.7.5

package/scripts/fetch.js

@@ -0,0 +1,194 @@
+// The fetch stage, as fetch-alpine.sh, fetch-bun.sh and scripts/fetch.sh do
+// it: download the pinned Alpine packages and Bun release, verify their
+// SHA-256, and lay out kernel/<arch>/ and native/<arch>/.
+//
+//   node scripts/fetch.js            both parts; BUNINU_ARCH, LINUX_FLAVOR,
+//                                    REAL_MACHINE and ALPINE_MIRROR as in arch.js
+//
+// Unlike fetch-alpine.sh, the release's module directory is emptied first,
+// so modules from an earlier --real fetch do not stay behind; and a download
+// lands under its final name only once its hash matched.
+
+import { createHash } from "node:crypto";
+import {
+  chmodSync,
+  copyFileSync,
+  createReadStream,
+  createWriteStream,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { spawnSync } from "node:child_process";
+import { dirname, join } from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { gunzipSync } from "node:zlib";
+import { config, rootDir, runIfMain, withUmask022 } from "./arch.js";
+import { filterAliases, select, trimDependencies } from "./modules.js";
+
+const sha256File = async (path) => {
+  const hash = createHash("sha256");
+  await pipeline(createReadStream(path), hash);
+  return hash.digest("hex");
+};
+
+/**
+ * Downloads `url` to downloadsDir/name unless a file with that SHA-256 is
+ * already there. The hash is both the cache key and the integrity check.
+ */
+export const download = async (cfg, url, name, sha256) => {
+  const path = join(cfg.downloadsDir, name);
+  if (existsSync(path) && (await sha256File(path)) === sha256) {
+    console.log(`cached ${name}`);
+    return path;
+  }
+  console.log(`fetch  ${name}`);
+  mkdirSync(cfg.downloadsDir, { recursive: true });
+  const response = await fetch(url, { redirect: "follow" });
+  if (!response.ok || !response.body) throw new Error(`${url}: HTTP ${response.status}`);
+  const partial = `${path}.part`;
+  const hash = createHash("sha256");
+  const hashing = new TransformStream({ transform(chunk, controller) { hash.update(chunk); controller.enqueue(chunk); } });
+  await pipeline(Readable.fromWeb(response.body.pipeThrough(hashing)), createWriteStream(partial));
+  const actual = hash.digest("hex");
+  if (actual !== sha256) {
+    rmSync(partial, { force: true });
+    throw new Error(`${name}: SHA-256 ${actual}, expected ${sha256}`);
+  }
+  renameSync(partial, path);
+  return path;
+};
+
+/**
+ * The regular files of a tar archive (gzip members concatenated, as an .apk
+ * is), by name. pax ("x") and GNU long-name ("L") headers give names longer
+ * than the ustar fields.
+ */
+export const readTar = (path) => {
+  const data = gunzipSync(readFileSync(path));
+  const files = new Map();
+  let longName = null;
+  for (let offset = 0; offset + 512 <= data.length;) {
+    const header = data.subarray(offset, offset + 512);
+    if (header.every((byte) => byte === 0)) { offset += 512; continue; }
+    const field = (start, length) => header.toString("utf8", start, start + length).replace(/\0.*$/s, "");
+    const size = Number.parseInt(field(124, 12).trim() || "0", 8);
+    const type = String.fromCharCode(header[156] || 0x30);
+    const body = data.subarray(offset + 512, offset + 512 + size);
+    offset += 512 + Math.ceil(size / 512) * 512;
+    if (type === "x") {
+      // pax records: "LENGTH key=value\n"
+      for (const record of body.toString("utf8").split("\n")) {
+        const match = /^\d+ path=(.*)$/.exec(record);
+        if (match) longName = match[1];
+      }
+      continue;
+    }
+    if (type === "L") { longName = body.toString("utf8").replace(/\0.*$/s, ""); continue; }
+    if (type === "g") continue;
+    const prefix = field(345, 155);
+    const name = longName ?? (prefix ? `${prefix}/${field(0, 100)}` : field(0, 100));
+    longName = null;
+    if (type === "0" || type === "\0") files.set(name.replace(/^\.\//, ""), body);
+  }
+  return {
+    get(name) {
+      const bytes = files.get(name);
+      if (!bytes) throw new Error(`${path}: no ${name}`);
+      return bytes;
+    },
+  };
+};
+
+const writeTo = (path, bytes) => {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, bytes);
+};
+
+// Both run with umask 022 (see arch.js withUmask022): native/ and kernel/
+// are packed with their modes.
+
+/** fetch-alpine.sh: the kernel, its selected modules, musl's loader and the EFI stub. */
+export const fetchAlpine = (cfg = config()) => withUmask022(async () => {
+  mkdirSync(cfg.kernelDir, { recursive: true });
+  mkdirSync(join(cfg.nativeDir, "lib"), { recursive: true });
+  const linux = readTar(await download(cfg, `${cfg.alpineBase}/${cfg.linuxPackage}`, cfg.linuxPackage, cfg.linuxSha256));
+  const musl = readTar(await download(cfg, `${cfg.alpineBase}/${cfg.muslPackage}`, cfg.muslPackage, cfg.muslSha256));
+  const stub = readTar(await download(cfg, `${cfg.alpineBase}/${cfg.stubPackage}`, cfg.stubPackage, cfg.stubSha256));
+
+  // On aarch64 vmlinuz is an EFI zboot image, started by the stub like the x86_64 bzImage.
+  writeTo(cfg.kernelImage, linux.get(`boot/vmlinuz-${cfg.flavor}`));
+  writeTo(join(cfg.nativeDir, "lib", cfg.muslLoader), musl.get(`lib/${cfg.muslLoader}`));
+  writeTo(join(cfg.kernelDir, cfg.efiStub), stub.get(`usr/lib/systemd/boot/efi/${cfg.efiStub}`));
+
+  const release = `lib/modules/${cfg.kernelRelease}`;
+  const dep = linux.get(`${release}/modules.dep`).toString();
+  const builtin = linux.get(`${release}/modules.builtin`);
+  const { selected, notes } = select({ dep, builtin: builtin.toString(), packageName: cfg.linuxPackage, arch: cfg.arch, flavor: cfg.flavor, real: cfg.real });
+  for (const note of notes) console.error(note);
+  rmSync(cfg.modulesRoot, { recursive: true, force: true });
+  writeTo(join(cfg.modulesRoot, "modules.builtin"), builtin);
+  for (const path of selected) {
+    writeTo(join(cfg.modulesRoot, path.replace(/\.gz$/, "")), gunzipSync(linux.get(`${release}/${path}`)));
+  }
+  writeTo(join(cfg.modulesRoot, "modules.dep"), trimDependencies(dep, selected));
+  writeTo(join(cfg.modulesRoot, "modules.alias"), filterAliases(linux.get(`${release}/modules.alias`).toString(), selected));
+
+  chmodSync(join(cfg.nativeDir, "lib", cfg.muslLoader), 0o755);
+  console.log(`Fetched Alpine ${cfg.arch} linux-${cfg.flavor} kernel, ${selected.length} modules, musl, and the ${cfg.efiStub} UKI stub.`);
+});
+
+/** fetch-bun.sh: Bun from its release zip, and the GCC runtime it links against. */
+export const fetchBun = (cfg = config()) => withUmask022(async () => {
+  for (const directory of [
+    cfg.downloadsDir,
+    join(cfg.nativeDir, "bin"),
+    join(cfg.nativeDir, "lib"),
+    join(rootDir, "initramfs/dev"),
+    join(rootDir, "initramfs/proc"),
+    join(rootDir, "initramfs/sys"),
+    join(rootDir, "initramfs/tmp"),
+  ]) {
+    mkdirSync(directory, { recursive: true });
+  }
+  const zip = await download(cfg, cfg.bunUrl, cfg.bunZip, cfg.bunSha256);
+  const libstdcpp = readTar(await download(cfg, `${cfg.alpineBase}/${cfg.libstdcppPackage}`, cfg.libstdcppPackage, cfg.libstdcppSha256));
+  const libgcc = readTar(await download(cfg, `${cfg.alpineBase}/${cfg.libgccPackage}`, cfg.libgccPackage, cfg.libgccSha256));
+  const loader = join(cfg.nativeDir, "lib", cfg.muslLoader);
+  if (!existsSync(loader) || statSync(loader).size === 0) {
+    throw new Error("fetch stage incomplete: run fetchAlpine first (node scripts/fetch.js runs both)");
+  }
+  // initramfs/bin/unzip: the same reader the guest has.
+  const unzip = spawnSync(process.execPath, [
+    join(rootDir, "initramfs/bin/unzip"),
+    "-p",
+    zip,
+    `${cfg.bunBuild}/bun`,
+  ], { maxBuffer: 1 << 30 });
+  if (unzip.status !== 0) throw new Error(`unzip ${zip}: ${unzip.stderr}`);
+  writeTo(join(cfg.nativeDir, "bin", "bun"), unzip.stdout);
+  writeTo(join(cfg.nativeDir, "lib", "libstdc++.so.6"), libstdcpp.get("usr/lib/libstdc++.so.6.0.34"));
+  writeTo(join(cfg.nativeDir, "lib", "libgcc_s.so.1"), libgcc.get("usr/lib/libgcc_s.so.1"));
+  // libc as a distinct inode from the active dynamic loader: dlopen on the
+  // loader inode itself deadlocks, while this physical copy is FFI-safe.
+  copyFileSync(loader, join(cfg.nativeDir, "lib", cfg.muslLibc));
+  chmodSync(join(rootDir, "initramfs/init.js"), 0o755);
+  chmodSync(join(cfg.nativeDir, "bin", "bun"), 0o755);
+  for (const name of readdirSync(join(cfg.nativeDir, "lib"))) {
+    if (/\.so/.test(name)) chmodSync(join(cfg.nativeDir, "lib", name), 0o755);
+  }
+  console.log(`Fetched Bun ${cfg.bunVersion} and its ${cfg.arch} musl runtime into ${cfg.nativeDir}/.`);
+});
+
+export const fetchAll = async (cfg = config()) => {
+  await fetchAlpine(cfg);
+  await fetchBun(cfg);
+};
+
+runIfMain(import.meta.url, () => fetchAll());

package/scripts/modules.js

@@ -0,0 +1,158 @@
+// The kernel modules the initramfs ships, as fetch-alpine.sh picks them: each
+// requested by name, with what the package's modules.dep says it needs. The
+// image gets a modules.dep trimmed to the shipped set, the fs-* lines and
+// the device ids of the shipped modules from modules.alias, and the
+// package's modules.builtin; /lib/modprobe.js reads those three files.
+//
+// fetch.js uses select(), trimDependencies() and filterAliases().
+
+// Network: virtio-net for QEMU (init.js loads these at boot). virtio_pci is
+// the PCI transport for every virtio device; linux-virt builds it in,
+// linux-lts has it as a module that nothing in modules.dep pulls in.
+// Storage: what /bin/mount loads on demand. Pointing devices for
+// `bunterm --mouse`. The framebuffer for bunterm on lts. Sound for QEMU's and
+// PCs' usual devices. --real adds the USB keyboard, PC storage and ACPI
+// drivers, and the wired and USB network drivers.
+const required = (names) => names.map((name) => ({ name }));
+const optional = (names) => names.map((name) => ({ name, optional: true }));
+
+export const requests = ({ arch, flavor, real }) => [
+  ...required([
+    "failover",
+    "net_failover",
+    "virtio_net",
+  ]),
+  ...optional([
+    "virtio_pci",
+  ]),
+  ...required([
+    "virtio_blk",
+    "ext4",
+    "vfat",
+    "exfat",
+    "ntfs3",
+    "nls_utf8",
+    "nls_cp437",
+    "nls_iso8859-1",
+  ]),
+  ...optional([
+    "ext2",
+  ]),
+  ...required([
+    "evdev",
+    arch === "x86_64" ? "psmouse" : "virtio_input",
+  ]),
+  ...(flavor === "lts" ? optional([
+    "simpledrm",
+  ]) : []),
+  ...optional([
+    "snd-ens1371",
+    "snd-hda-intel",
+    "snd-hda-codec-generic",
+    "snd-hda-codec-hdmi",
+    "snd-usb-audio",
+  ]),
+  ...(real ? required([
+    // USB keyboard
+    "usb-common",
+    "usbcore",
+    "xhci-hcd",
+    "xhci-pci",
+    "xhci-pci-renesas",
+    "hid",
+    "hid-generic",
+    "usbhid",
+    // SATA/AHCI, PATA, NVMe (with Intel VMD), USB mass storage and UAS
+    "sd_mod",
+    "ahci",
+    "ata_generic",
+    "pata_acpi",
+    "nvme",
+    "vmd",
+    "usb-storage",
+    "uas",
+    // ACPI: battery, AC adapter, power button, thermal zones
+    "battery",
+    "ac",
+    "button",
+    "thermal",
+    // Wired NICs: Intel, Realtek (with its PHY), Qualcomm Atheros, Broadcom
+    "e1000",
+    "e1000e",
+    "igb",
+    "igc",
+    "r8169",
+    "realtek",
+    "alx",
+    "tg3",
+    // USB NICs and Android tethering (RNDIS, CDC ECM/NCM/EEM, subset, zaurus)
+    "r8152",
+    "ax88179_178a",
+    "cdc_ether",
+    "rndis_host",
+    "cdc_ncm",
+    "cdc_eem",
+    "cdc_subset",
+    "zaurus",
+  ]) : []),
+];
+
+/**
+ * The modules.dep paths (".ko.gz", relative to the release directory) to
+ * ship, dependencies after the module that pulled them in, and notes about
+ * optional modules the kernel neither builds in nor packages.
+ */
+export const select = ({ dep, builtin, packageName, ...target }) => {
+  const lines = dep.split("\n");
+  const builtinLines = builtin.split("\n");
+  const selected = [];
+  const seen = new Set();
+  const notes = [];
+  const find = (name) => lines.find((line) => line.includes(`/${name}.ko.gz:`));
+  const add = (name) => {
+    // An explicit stack instead of recursion; the order matches the shell's
+    // depth-first walk.
+    const stack = [name];
+    while (stack.length) {
+      const current = stack.pop();
+      const line = find(current);
+      if (!line) throw new Error(`module ${current} is not in ${packageName}`);
+      const path = line.slice(0, line.indexOf(":"));
+      if (seen.has(path)) continue;
+      seen.add(path);
+      selected.push(path);
+      const dependencies = line.slice(line.indexOf(":") + 1).trim().split(/\s+/).filter(Boolean)
+        .map((dependency) => dependency.slice(dependency.lastIndexOf("/") + 1).replace(/\.ko\.gz$/, ""));
+      stack.push(...dependencies.reverse());
+    }
+  };
+  for (const { name, optional } of requests(target)) {
+    if (!optional || find(name)) add(name);
+    else if (!builtinLines.some((line) => line.endsWith(`/${name}.ko`))) {
+      notes.push(`note: module ${name} is not in ${target.arch} ${packageName}; skipped`);
+    }
+  }
+  return { selected, notes };
+};
+
+/** modules.dep with only the shipped modules' lines, .ko.gz renamed .ko. */
+export const trimDependencies = (dep, selected) => {
+  const wanted = new Set(selected);
+  return dep.split("\n")
+    .filter((line) => line.includes(":") && wanted.has(line.slice(0, line.indexOf(":"))))
+    .map((line) => `${line.replaceAll(".ko.gz", ".ko")}\n`)
+    .join("");
+};
+
+/** modules.alias: the fs-* names, and the pci:/usb:/virtio: ids of shipped modules. */
+export const filterAliases = (alias, selected) => {
+  const shipped = new Set(selected.map((path) => path.slice(path.lastIndexOf("/") + 1).replace(/\.ko\.gz$/, "").replaceAll("-", "_")));
+  return alias.split("\n")
+    .filter((line) => {
+      const fields = line.trim().split(/\s+/);
+      if (/^fs-/.test(fields[1] ?? "")) return true;
+      return /^(pci|usb|virtio):/.test(fields[1] ?? "") && shipped.has((fields[2] ?? "").replaceAll("-", "_"));
+    })
+    .map((line) => `${line}\n`)
+    .join("");
+};

package/scripts/pack-initramfs.sh

@@ -1,5 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
+# What this script creates is packed with its modes: the same umask as
+# PRoot and most hosts, not native Termux's 0077.
+umask 022
 
 cd "$(dirname "$0")/.."
 
@@ -22,6 +25,12 @@ trap 'rm -rf "$staging"; rm -f "$archive"' EXIT
 cp -a --reflink=auto initramfs/. "$staging/"
 rm -rf "$staging/bin/bun" "$staging/lib/modules"
 cp -a --reflink=auto "$native_dir/." "$staging/"
+# Only this kernel's modules: native/<arch>/ keeps every release fetched so
+# far (an older pin, the other flavor), and none of those can load.
+for release_dir in "$staging/lib/modules"/*; do
+    [ -e "$release_dir" ] || continue
+    [ "${release_dir##*/}" = "$kernel_release" ] || rm -rf "$release_dir"
+done
 # Keep the project README canonical while making it available to
 # buninu-linux-help from the conventional installed-document path.
 cp README.md "$staging/usr/share/doc/buninu-linux/README.md"
@@ -50,6 +59,14 @@ mkdir -p "$staging/usr/share/icons/hicolor/512x512/apps" "$staging/usr/share/pix
 ln -sfn ../../../../../../buninu/icon.png "$staging/usr/share/icons/hicolor/512x512/apps/buninu-linux.png"
 ln -sfn ../../../buninu/icon.png "$staging/usr/share/pixmaps/buninu-linux.png"
 
+# The modes git would check out with umask 022: directories 755, files 755
+# when their owner may execute them and 644 otherwise (symlinks untouched).
+# A checkout made under another umask (native Termux's 0077 gives 600/700)
+# then packs the same archive.
+find "$staging" -type d -exec chmod 755 {} +
+find "$staging" -type f -perm -100 -exec chmod 755 {} +
+find "$staging" -type f ! -perm -100 -exec chmod 644 {} +
+
 # BUNINU_JS_CPIO=1 writes the archive with scripts/cpio.js (bun or node)
 # instead of fakeroot, cpio and gzip: the device nodes below exist only in
 # the archive, so nothing needs root.

package/scripts/pack.js

@@ -0,0 +1,184 @@
+// The initramfs, as scripts/pack-initramfs.sh packs it with BUNINU_JS_CPIO=1:
+// initramfs/ with native/<arch>/ laid over it, the README, licenses and
+// os-release added, written by scripts/cpio.js to build/initramfs.cpio.gz.
+//
+//   node scripts/pack.js             BUNINU_ARCH as in arch.js; SOURCE_DATE_EPOCH
+//                                    fixes every mtime, as cpio.js does
+
+import { spawnSync } from "node:child_process";
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  readlinkSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  utimesSync,
+  lutimesSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { config, jsRuntime, rootDir, runIfMain } from "./arch.js";
+
+/**
+ * `cp -a SOURCE/. TARGET/`: modes, times and symlinks kept, directories
+ * merged into ones already there (and given the source's mode, as cp -a does).
+ */
+export const copyTree = (source, target) => {
+  const stat = lstatSync(source);
+  if (stat.isSymbolicLink()) {
+    rmSync(target, { force: true });
+    symlinkSync(readlinkSync(source), target);
+    lutimesSync(target, stat.atime, stat.mtime);
+  } else if (stat.isDirectory()) {
+    mkdirSync(target, { recursive: true });
+    for (const name of readdirSync(source)) copyTree(join(source, name), join(target, name));
+    chmodSync(target, stat.mode & 0o7777);
+    utimesSync(target, stat.atime, stat.mtime);
+  } else if (stat.isFile()) {
+    rmSync(target, { force: true });
+    copyFileSync(source, target);
+    chmodSync(target, stat.mode & 0o7777);
+    utimesSync(target, stat.atime, stat.mtime);
+  } else {
+    throw new Error(`${source}: not a file, directory or symlink`);
+  }
+};
+
+/**
+ * The modes git would check out with umask 022: directories 755, files 755
+ * when their owner may execute them and 644 otherwise; symlinks untouched.
+ * A checkout made under another umask (native Termux's 0077 gives 600/700)
+ * then packs the same archive.
+ */
+export const normalizeModes = (path) => {
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink()) return;
+  if (stat.isDirectory()) {
+    chmodSync(path, 0o755);
+    for (const name of readdirSync(path)) normalizeModes(join(path, name));
+  } else if (stat.isFile()) {
+    chmodSync(path, stat.mode & 0o100 ? 0o755 : 0o644);
+  }
+};
+
+/** `cp FILE TARGET`: contents and mode, a new mtime. */
+const copyFile = (source, target) => {
+  rmSync(target, { force: true });
+  copyFileSync(source, target);
+  chmodSync(target, statSync(source).mode & 0o777 & ~process.umask());
+};
+
+/** `ln -sfn TARGET LINK` */
+const link = (target, path) => {
+  rmSync(path, { force: true });
+  symlinkSync(target, path);
+};
+
+/**
+ * The device nodes of the archive, PATH:c:MAJOR:MINOR:MODE. Nothing has
+ * mounted devtmpfs when the kernel execs Bun as PID 1: console is init's fd
+ * 0/1/2 and JSC aborts without urandom; the rest keep /dev usable if the
+ * devtmpfs mount in init.js fails. The serial port is ttyS0 (4, 64) on
+ * x86_64 and the PL011 ttyAMA0 (204, 64) on aarch64.
+ */
+export const devices = (cfg) => [
+  "dev/console:c:5:1:0600",
+  `dev/${cfg.serialConsole}:c:${cfg.serialMajor}:64:0620`,
+  "dev/null:c:1:3:0666",
+  "dev/zero:c:1:5:0666",
+  "dev/random:c:1:8:0666",
+  "dev/urandom:c:1:9:0666",
+  "dev/tty:c:5:0:0666",
+];
+
+export const osRelease = (version) => [
+  'NAME="Buninu Linux"',
+  "ID=buninu-linux",
+  `VERSION="${version}"`,
+  `VERSION_ID=${version}`,
+  `PRETTY_NAME="Buninu Linux ${version}"`,
+  'HOME_URL="https://buninu.org"',
+  'BUG_REPORT_URL="https://github.com/jjtseng93/buninu-linux/issues"',
+  "LOGO=buninu-linux",
+  "DEFAULT_HOSTNAME=buninu",
+].map((line) => `${line}\n`).join("");
+
+export const pack = (cfg = config()) => {
+  // The directories and files made here are packed with their modes; native
+  // Termux's umask 0077 would make /usr/lib and /usr/lib/os-release private.
+  const previousUmask = process.umask(0o022);
+  try {
+    packStaging(cfg);
+  } finally {
+    process.umask(previousUmask);
+  }
+};
+
+const packStaging = (cfg) => {
+  const bun = join(cfg.nativeDir, "bin", "bun");
+  if (!existsSync(bun) || !(statSync(bun).mode & 0o111)) {
+    throw new Error(`no ${bun} yet; run the fetch stage first (node scripts/fetch.js)`);
+  }
+  const build = join(rootDir, "build");
+  mkdirSync(build, { recursive: true });
+  const staging = mkdtempSync(join(rootDir, ".initramfs."));
+  try {
+    // initramfs/ is the same for every architecture; native/<arch>/ adds bun,
+    // the musl loader, the GCC runtime and the kernel modules on top of it.
+    // A checkout fetched before native/ existed still has an x86_64 bun and
+    // its modules under initramfs/; they are dropped rather than packed.
+    copyTree(join(rootDir, "initramfs"), staging);
+    rmSync(join(staging, "bin", "bun"), { force: true });
+    rmSync(join(staging, "lib", "modules"), { recursive: true, force: true });
+    copyTree(cfg.nativeDir, staging);
+    // Only this kernel's modules: native/<arch>/ keeps every release fetched
+    // so far (an older pin, the other flavor), and none of those can load.
+    const modules = join(staging, "lib", "modules");
+    for (const release of existsSync(modules) ? readdirSync(modules) : []) {
+      if (release !== cfg.kernelRelease) rmSync(join(modules, release), { recursive: true, force: true });
+    }
+    copyFile(join(rootDir, "README.md"), join(staging, "usr/share/doc/buninu-linux/README.md"));
+    for (const name of [
+      "LICENSE",
+      "NOTICE.md",
+      "LICENSES",
+    ]) copyTree(join(rootDir, name), join(staging, "usr/share/licenses", name));
+
+    // os-release(5): the canonical file in /usr/lib, /etc/os-release a link
+    // to it; build.js embeds the same file as the UKI's .osrel section.
+    const { version } = JSON.parse(readFileSync(join(rootDir, "package.json"), "utf8"));
+    if (!version) throw new Error("no version in package.json");
+    writeFileSync(join(build, "os-release"), osRelease(version));
+    mkdirSync(join(staging, "usr/lib"), { recursive: true });
+    mkdirSync(join(staging, "etc"), { recursive: true });
+    copyFile(join(build, "os-release"), join(staging, "usr/lib/os-release"));
+    link("../usr/lib/os-release", join(staging, "etc/os-release"));
+    // LOGO names an icon-theme icon; the standard lookup paths point at the
+    // icon /buninu already ships.
+    mkdirSync(join(staging, "usr/share/icons/hicolor/512x512/apps"), { recursive: true });
+    mkdirSync(join(staging, "usr/share/pixmaps"), { recursive: true });
+    link("../../../../../../buninu/icon.png", join(staging, "usr/share/icons/hicolor/512x512/apps/buninu-linux.png"));
+    link("../../../buninu/icon.png", join(staging, "usr/share/pixmaps/buninu-linux.png"));
+
+    normalizeModes(staging);
+    const cpio = spawnSync(jsRuntime(), [
+      join(rootDir, "scripts/cpio.js"),
+      staging,
+      join(build, "initramfs.cpio.gz"),
+      ...devices(cfg),
+    ], { stdio: ["ignore", "ignore", "inherit"] });
+    if (cpio.status !== 0) throw new Error("scripts/cpio.js failed");
+  } finally {
+    rmSync(staging, { recursive: true, force: true });
+  }
+  console.log(`Built build/initramfs.cpio.gz for ${cfg.arch}`);
+};
+
+runIfMain(import.meta.url, () => pack());