buninu-linux 0.7.5 → 0.8.55

package/Dockerfile

@@ -2,14 +2,17 @@
 # that do not have it natively (macOS) or would rather not install it.
 # index.js --docker builds this image on first use and runs the fetch/build
 # scripts inside it with the checkout bind-mounted at /src; macOS does that
-# by default. The image only unpacks archives and assembles files, it never
+# by default when JS tools are disabled. The image only unpacks archives and assembles files, it never
 # executes guest binaries, so its own architecture does not matter: Apple
 # Silicon runs it as linux/arm64 and still builds both guests.
 #
 # binutils-mingw-w64-x86-64  PE-aware objcopy/objdump for the x86_64 UKI
 # binutils-aarch64-linux-gnu PE-aware objcopy/objdump for the aarch64 UKI
 #                            (native binutils on an arm64 host, cross on amd64)
-FROM debian:13-slim
+FROM oven/bun:1.4.2
+USER root
+# These images run build scripts, not the base image's default Bun command.
+ENTRYPOINT []
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \

package/NOTICE.md

@@ -3,13 +3,15 @@
 Buninu Linux is licensed under the MIT License; see `LICENSE`.
 
 It redistributes the third-party components below under their own licenses.
-The full license texts are in `LICENSES/`. Every SHA-256 here was checked
+Platform license texts are in `LICENSES/`; npm application licenses and
+notices also remain inside their installed package directories, as listed
+below. Platform SHA-256 values here were checked
 byte-for-byte against the official Alpine Linux v3.24 x86_64 or aarch64
 package (or the official Bun release) it came from. The x86_64 guest is the
 default build; `--arch aarch64` builds the other one from the same versions.
 
-The sections below cover the platform: the kernel, the C library, the GCC
-runtime, the UEFI stub and Bun. The Buninu userspace under `initramfs/buninu/`
+The sections below cover the platform, fetched npm applications and graphics
+resources. The Buninu userspace under `initramfs/buninu/`
 carries its own third-party notices; see the last section.
 
 Alpine's CDN serves only the current pkgrel of each branch, so the package
@@ -103,83 +105,83 @@ the built image redistributes them.
 - License: GPL-2.0-only WITH Linux-syscall-note
 - See: `LICENSES/GPL-2.0.txt` and `LICENSES/Linux-syscall-note.txt`
 
-Linux 6.18.54 as packaged by Alpine Linux 3.24 from the `linux-lts` aport.
-The default build uses package `linux-virt`, version 6.18.54-r0.
-`--linux-lts` and `--real` use package `linux-lts`, version 6.18.54-r0.
+Linux 6.18.55 as packaged by Alpine Linux 3.24 from the `linux-lts` aport.
+The default build uses package `linux-virt`, version 6.18.55-r0.
+`--linux-lts` and `--real` use package `linux-lts`, version 6.18.55-r0.
 Each comes from the x86_64 or aarch64 repository to match `--arch`. All
 listed modules are the selected package's `.ko.gz` files decompressed without
 modification.
 
-- Upstream source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.54.tar.xz
+- Upstream source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.55.tar.xz
 - Alpine build recipe, configuration and patches (Corresponding Source),
-  pinned to the commit shipping 6.18.54-r0 (the same for both architectures):
-  https://gitlab.alpinelinux.org/alpine/aports/-/blob/f8254a6d11c37b153dae6a0fd98ba378dd0d093d/main/linux-lts/APKBUILD
+  pinned to the commit shipping 6.18.55-r0 (the same for both architectures):
+  https://gitlab.alpinelinux.org/alpine/aports/-/blob/52fae6d7d56f3958f32e5bf9121a7536524b9ef4/main/linux-lts/APKBUILD
 - Packages:
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-virt-6.18.54-r0.apk
-  SHA-256 `57a522d2b6e9d1b6c9de6b9f7fc42aa4b8d33ebf9f2b42b4251dbee6ff2d9839`
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-lts-6.18.54-r0.apk
-  SHA-256 `1d02a1b74a8a09c476a3c01782c0b8613ae2935988e65d4d31e6bef44dfb8b64`
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-virt-6.18.54-r0.apk
-  SHA-256 `9a4a6fa042b60b70f453dded99762810516b35793c64d776d75986b0b110b6e0`
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-lts-6.18.54-r0.apk
-  SHA-256 `f945ddcc306546c7c22cf10249f637fc6e806ecc40286fb50950558dd573e7e9`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-virt-6.18.55-r0.apk
+  SHA-256 `a941c15fc5db26b6692fd0140fa0970da76cb12aadf3dc8306c419f21bd39c93`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-lts-6.18.55-r0.apk
+  SHA-256 `02ba9491d4cc110707de64ed03dd7e2fa5c93fdd851979c244ceb018785a9eea`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-virt-6.18.55-r0.apk
+  SHA-256 `c7fb892408d7fe163a18671e5c7816752976d1c67fd17794dfba794aa0d6c1ac`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-lts-6.18.55-r0.apk
+  SHA-256 `31aeae56fa527b2fb4fdd4aefbd693cbec210a8cbfd4ea7597a1773b832e9f83`
 
 SHA-256 of files in the default x86_64 `linux-virt` image:
 
 ```text
-kernel/x86_64/vmlinuz-virt   c7ce829b618d4a9d2df79c58ea0fb2a392e606f6c47bb94696ea75610a568166
-failover.ko                  c02fc21655bd3a8598ddf29f1028a1029bcb19b1da8611d3cf3c8685d0412f84
-net_failover.ko              46e0c3d3f4cdfafabffbd1a57ef59aac0bcc0f1a4e22b114d992cd46ac264145
-virtio_net.ko                1163e07fd5391849820ede09277b0147ae7e48ef0f08f9e96da08bb2ff131c2a
+kernel/x86_64/vmlinuz-virt   fcee60bd42bdcc5f165278e092de0bb00d969843be326f7bd9a9602c2f52de9e
+failover.ko                  75d408861dd0ee89bf94753c9f2fff0f3831a6f76eaab8870d186910e6e2924b
+net_failover.ko              4db140c0f8e32a31e95f56f35af62e5279864104f57d30af0684c75e3505bdd5
+virtio_net.ko                f2867d641f808b7f5d7d4eb972c72398902589a83b48f6f7a174b844717da117
 ```
 
 SHA-256 of files in an x86_64 `--linux-lts` image:
 
 ```text
-kernel/x86_64/vmlinuz-lts   d3cb46d949f3d05a7e6753ba0b9a054323e6a7b6eeb231b31a1659d8f9f51a28
-failover.ko                 3c0e33c374419512c410559561e8bc5d2fac573cb449da404bbeaf94ec7641fe
-net_failover.ko             2a5db89834e5f35ecdf114da8dbe4d4db4061371d37768d9f92eb09d479d21ab
-virtio_net.ko               1fc0c4992e4a9ad83985fbad5a5674bacceb4c8ab5329b4509656ba3350478eb
-virtio_ring.ko              3c14098101a9f30f034410efe7e91e369057d1709152a0419a3a9fc4b1367915
-virtio.ko                   f47dac1696dcab539c5d313f13bd5e06945cf921bf406e0f709e1866de72803d
-virtio_pci_legacy_dev.ko    662c0f09bcb88c7c8a79fb2159d4aa0b62044d1859a46de03fc9e57fc3501931
-virtio_pci_modern_dev.ko    006e525fda5e369b6a1669ec0e8e174c784f1ecdb7dcfb6257ffc67fd5b93525
-virtio_pci.ko               94d66ebd7f2a325ce83c9f42175432a7797969b3e3c7fcc07d2b913012f1c77f
+kernel/x86_64/vmlinuz-lts   6c85e6375814c51257a3d1b21c3c4c02803231d42e42c1a3d50236bf543cbeba
+failover.ko                 b563c6734384c5c41ed1b227a221a3e7b511bca743e583dd33d6f85405a8df07
+net_failover.ko             4ee36e32ed5db502125b57d237b5db31509c7b9c9a49ca9221b704fcfcd80b1c
+virtio_net.ko               4aa2b98c0fed35be473ff22f4d3f89cb184ca13e6605dd9e8a68b5854eba7b6a
+virtio_ring.ko              ed1c704eddca74e4f68164efc62b65f8e8a8276b7ebb2eeb0185326dbd093603
+virtio.ko                   986cab65ecfce9c6291cc54598301ede8e8e2eca521a82dfbaf6dcf76ec6f8c6
+virtio_pci_legacy_dev.ko    dedd092324e5d23ac218dfa2aad3fa8bc2f0b49e54c1763423627c75a8c4e907
+virtio_pci_modern_dev.ko    855221097ff07f0981d4e9fbb4200a0628a154826f37299d1434811f21902388
+virtio_pci.ko               aee0a18cce24968d1e06c026a056e570b3039884b900385f019410a751ea8a44
 ```
 
 `--real` additionally includes the following modules from that same
 x86_64 `linux-lts` package for physical xHCI controllers and USB HID keyboards:
 
 ```text
-usb-common.ko               471bed173d18c373c80e9cce646f75b71b034b3b398e6bd04c51fa065ac92e6b
-usbcore.ko                  99b20afa2057720f2aa36224909c37740cbe1068e23ba52872ed09e6c7966c29
-xhci-hcd.ko                 b3ffac428a78858532a5114ad4f2f66de253aba32932f508d62eceb29af39313
-xhci-pci.ko                 2a924cfba63360acf3a9a688a5fb69f87c2c82a02f904e972a9f5c9cb303588f
-xhci-pci-renesas.ko         2c8fa8dac908da5a13c8f87e520cc1d4a026aeb9ee58d1ac0380d696c8ef6a72
-hid.ko                      3aa16634ee8621291abfa1f9efca287299dea052678c8ead5af86003a7e493f3
-hid-generic.ko              2879395175b39a47f09e81bb00cb1a4b565103ba4583ce99169b9ef7fd943d62
-usbhid.ko                   e80b60c6dd99a87c95bd97434679aa3f069c9bce2f67a7311f179b3066cdea59
+usb-common.ko               38a461cdee1e8dd82985fedbd050d3a496825c5b59c66dc3305c5508c93fb0e4
+usbcore.ko                  18949ea4cab0f98846f4fea192c9ebe9892c5504f6750529a4db8c1a718fdd3b
+xhci-hcd.ko                 aed7f3e8d2f1e2d722fb625fcd68adce5212a30ce1a25a934832177594670543
+xhci-pci.ko                 8959b6c1790ac1b656308278313f78cf4fde8b811456a42579b467a8196515b8
+xhci-pci-renesas.ko         3aa013b9ca71ee5bd16b30efb1f68aa2c29ac84cf15dd92caf413f7577fc36cf
+hid.ko                      e3fecc9b96b44d1c572337a937927291c3219d43a00a357049a1285ab57f5bbe
+hid-generic.ko              a3d76a35904f26d8bb8d5bff115de12a1cb966c3e428e529767dde28c24e4421
+usbhid.ko                   6b50c4a6037fa740b3f576d5bf362bdad7aa86ebc8da5e1777e69c03ed70f703
 ```
 
 SHA-256 of files in the default aarch64 `linux-virt` image:
 
 ```text
-kernel/aarch64/vmlinuz-virt  29de2da2ea7aa1d95da37c947278caca65ef3ad211dbb92ac75a6b962f96d0d2
-failover.ko                  62bfac505026e368b291e8d7e167dc90bff826c44d0db1ff4340de2201022674
-net_failover.ko              3761f107b61ae4d11a7bed402cdab1862f3d61cacc612b2e6d9bc61ad1e20d6d
-virtio_net.ko                22a95296a008f009de59e933cc1b9615396612ef5eb3922fac2b79ac672a1305
+kernel/aarch64/vmlinuz-virt  af8ad21e222dbff8c89909e1ef7b8b7607dd58188b2f3067128aac4f646d212d
+failover.ko                  aff1648d08436515b509c3c848049e44540ff0d26afc113a496db961f6871df6
+net_failover.ko              4461014c041c8cbdfc881c0d820361014a491547b694d36425d084ab9008a33f
+virtio_net.ko                7b6e3c89d666419d336990688711c4d6b0cab91e5934a7bd99e6d8dcc5caa40b
 ```
 
 SHA-256 of files in an aarch64 `--linux-lts` image:
 
 ```text
-kernel/aarch64/vmlinuz-lts  52521d144fe344f23ffd03297fd0e0da42578e54d3da18685cbb7f613244c001
-failover.ko                 73571d1192683fa4f6346d7082920b4ac1a3b2edfb2da9e08ec13269dcb71f5e
-net_failover.ko             ba1700cf056585843488a5a8e75884d16cee45b4d40d8ace2f977e697cb5557c
-virtio_net.ko               fea67b801481f1445be419541e7a352a07019d52acbf644fe01f21c51d8d1475
-virtio_pci_legacy_dev.ko    0cbfc93f3ef238c2565187eb8be94d1d0127bf2fe521f28b75245db12f4331ff
-virtio_pci_modern_dev.ko    3fba75f38825df5ab616492bf3fb3329c4aed1a8b7f9a98370706e70a14fc2a3
-virtio_pci.ko               92652ff84904b2b2dda1549d362ec97377f954da5463575f7e35a4ef5847c3ad
+kernel/aarch64/vmlinuz-lts  6c6625bc5ba59136101414d09efbeaaed000517e654a75157f42565cec15abad
+failover.ko                 1f10c1ac74c6d35f745227899372b1b6656a3197436d9c72e0bb39a19779c3a6
+net_failover.ko             5815342b859f820adfd90ffdddde689c73f0e6fcc34efbc9ada8beabb2fd37b2
+virtio_net.ko               2ef9114dea6b40bd9d2e1460c6be94859b5527af5479928cfd90a66eff843bab
+virtio_pci_legacy_dev.ko    be6654a06cfb30f2598b184f7a2b2372314c5a5325a984b73a7ef9a3c39e7eb3
+virtio_pci_modern_dev.ko    d88219ed14678c0aba06a882d6cf43b0ad9462eeae09638b6382ba5601b5a8c4
+virtio_pci.ko               6bdafb0472d289e2ca6dfc63bf2cb2e54e1258e9c4774317ca1c7df059dfb31e
 ```
 
 ### linuxx64.efi.stub and linuxaa64.efi.stub
@@ -236,6 +238,65 @@ native/x86_64/bin/bun    16b72935ffd7a503b978c186874539c92aade4e3515b70a5abf5db2
 native/aarch64/bin/bun   1101cd0aa92ea214c2aaf4bb3761ca3c76a90aae0e6f94c07efb4e8c4f18a8fc
 ```
 
+## npm applications fetched and redistributed in the image
+
+The fetch stage downloads the following exact releases directly from the
+npm registry. `scripts/npm-packages.md` is the canonical list of tarball
+URLs and SHA-256 pins. Both fetch and pack verify those hashes. Pack removes
+the leading `package/` component and installs the contents under
+`/usr/lib/node_modules/`; it does not run npm lifecycle scripts or resolve
+additional dependencies. The downloaded archives are build inputs, not
+committed source files, but their contents are redistributed in the image.
+
+| Package | Version | Package license | Project / package page | Installed license and notices (relative to `/usr/lib/node_modules/`) |
+|---|---|---|---|---|
+| `buninu-browser` | 0.2.2 | MIT for the browser's own code; bundled components retain their own terms | https://github.com/jjtseng93/buninu-browser | `buninu-browser/LICENSE`, `THIRD_PARTY_NOTICES.md`, `LICENSES/` and vendor notices within that package |
+| `@drxiaozhi/casty` | 1.3.4 | MIT | https://github.com/jjtseng93/casty | `@drxiaozhi/casty/LICENSE` |
+| `@drxiaozhi/jspulse` | 0.2.1 | LGPL-2.1-or-later, with additional component notices | https://github.com/jjtseng93/jspulse | `@drxiaozhi/jspulse/LICENSE`, `NOTICE.md`, `LICENSES/` and source-file notices within that package |
+| `@drxiaozhi/jspinyin` | 0.1.1 | MIT; hanzipinyin material under the Unlicense | https://www.npmjs.com/package/@drxiaozhi/jspinyin | `@drxiaozhi/jspinyin/LICENSE` and `@drxiaozhi/jspinyin/LICENSE-hanzipinyin.md` |
+
+The upstream links identify the projects; the pinned registry archives
+identify the exact releases used by this build. Preserve the packages'
+copyright notices, license texts, third-party notices and source material
+when redistributing or repacking the image. Buninu Linux's MIT license does
+not relicense these components.
+
+### Browser resources and LGPL media decoder
+
+Only the browser's `usr/lib/canvaskit` and `usr/share/fonts` directories are
+excluded from extraction. Its `usr/README.md`, top-level license collection,
+third-party notices and vendor source material are retained. The distribution
+launcher creates relative links to the system CanvasKit and fonts when those
+resource directories are missing; their licenses are documented under
+Graphics stack below and remain with the system copies.
+
+The browser includes `@wasmpeg/cpu` 1.0.1 and its FFmpeg code under
+LGPL-2.1-or-later. Within `/usr/lib/node_modules/buninu-browser/`, retain:
+
+- `vendor/wasmpeg/LICENSE`, `vendor/wasmpeg/NOTICE` and `LICENSES/wasmpeg.txt`;
+- `vendor/wasmpeg/source-v1.0.1.tar.gz`, the bundled source archive;
+- `vendor/wasmpeg/VENDORING.md`, with artifact hashes and rebuild instructions;
+- `patches/wasmpeg/`, documenting the package's local changes;
+- the other license texts identified in `THIRD_PARTY_NOTICES.md`, including
+  those for Emscripten and zlib.
+
+The decoder's `cpu.wasm` remains a separate, replaceable file. Do not remove
+the source archive or rebuild material merely to reduce the image size.
+
+### jspulse source and notices
+
+jspulse is shipped as JavaScript source, with its LGPL license, modification
+notices and additional notices intact. Its `NOTICE.md` describes the
+PulseAudio, Termux, ALSA and Sun G.711 material; `LICENSES/` includes LGPL-2.1
+and NCSA texts. Browser audio communicates with this separate server through
+the PulseAudio protocol. The distribution's launcher does not replace or
+remove the package's source or license files.
+
+This inventory records the shipped materials; it is not a blanket compliance
+certification. Redistributors remain responsible for applicable source,
+notice and modification/replacement requirements, particularly if changing
+the packages, their build artifacts or the source material supplied with them.
+
 ## Graphics stack
 
 These files are committed under `initramfs/lib/` and `initramfs/usr/share/`