buninu-linux 0.8.56 → 0.10.56

package/initramfs/usr/lib/bootstrap/lib/build.js

@@ -0,0 +1,155 @@
+import {
+  appendFileSync, chmodSync, copyFileSync, existsSync, mkdirSync,
+  readFileSync, readdirSync, utimesSync, writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { bootstrap, bun, download, quote, requireRootfs } from "./common.js";
+
+export const tools = "/bootstrap/toolchain/bin";
+export const toolchain = "/bootstrap/toolchain";
+export const deps = "/bootstrap/deps";
+export const sourceRoot = "/bootstrap/src";
+export const buildRoot = "/bootstrap/build";
+export const resultRoot = "/bootstrap/result";
+export function useLog(path) { log = path; }
+// Build shells preserve the explicit build PATH, without the guest entry
+// shell's preference for installed result tools.
+export const shell = tools + "/sh";
+export const make = tools + "/make";
+let log;
+
+export function stage(number, name, args) {
+  if (args.length) throw new Error(`Usage: bun ${number}.build-${name}.js`);
+  const { arch } = requireRootfs();
+  mkdirSync(buildRoot + "/logs", { recursive: true });
+  log = `${buildRoot}/logs/${number}-${name}.log`;
+  note(`\n${new Date().toISOString()} Stage ${number}: ${name} (${arch})`);
+  return { arch, triple: `${arch}-unknown-linux-musl` };
+}
+
+function note(text) {
+  console.log(text);
+  if (log) appendFileSync(log, text + "\n");
+}
+
+export function environment(extra = {}) {
+  return {
+    PATH: `${tools}:/bin:/usr/bin`, HOME: "/root", LC_ALL: "C",
+    SHELL: shell, CONFIG_SHELL: shell, CC: tools + "/cc", CC_FOR_BUILD: tools + "/cc",
+    AR: existsSync(toolchain + "/bin/ar") ? toolchain + "/bin/ar" : tools + "/bootstrap-ar",
+    LD: existsSync(toolchain + "/bin/ld") ? toolchain + "/bin/ld" : tools + "/bootstrap-ld",
+    RANLIB: existsSync(toolchain + "/bin/ranlib") ? toolchain + "/bin/ranlib" : ":",
+    NM: toolchain + "/bin/nm", MAKE: make, MAKEINFO: ":", CFLAGS: "-O2",
+    CFLAGS_FOR_TARGET: "-O2", lt_cv_sys_max_cmd_len: "32768",
+    ...extra,
+  };
+}
+
+export async function command(argv, cwd = buildRoot, extra = {}, capture = false) {
+  mkdirSync(cwd, { recursive: true });
+  note("$ " + argv.map(quote).join(" "));
+  const child = Bun.spawn(argv, {
+    cwd, env: environment(extra), stdin: "ignore", stdout: "pipe", stderr: "pipe",
+  });
+  const chunks = [];
+  async function drain(stream, output, collect) {
+    for await (const bytes of stream) {
+      const data = Buffer.from(bytes);
+      output.write(data);
+      if (log) appendFileSync(log, data);
+      if (collect) chunks.push(data);
+    }
+  }
+  const [status] = await Promise.all([
+    child.exited, drain(child.stdout, process.stdout, capture), drain(child.stderr, process.stderr, false),
+  ]);
+  if (status !== 0) throw new Error(`Command exited ${status}; see ${log}: ${argv[0]}`);
+  return capture ? Buffer.concat(chunks).toString() : "";
+}
+
+export async function source(pin, directory) {
+  // Verify on every stage invocation, including a cached archive.
+  const archive = await download(pin);
+  const target = join(sourceRoot, directory);
+  if (!existsSync(target)) {
+    mkdirSync(sourceRoot, { recursive: true });
+    const tar = new Bun.Archive(readFileSync(archive));
+    await tar.extract(sourceRoot);
+    // Preserve release-generated parsers/Makefiles: extraction time must
+    // not accidentally request autoconf, automake or bison regeneration.
+    for (const [name, file] of await tar.files()) {
+      const seconds = file.lastModified / 1000;
+      utimesSync(join(sourceRoot, name), seconds, seconds);
+    }
+  }
+  if (!existsSync(join(target, "configure"))) throw new Error(`Incomplete source tree: ${target}`);
+  return target;
+}
+
+export function patch(path, before, after) {
+  const old = readFileSync(path, "utf8");
+  if (old.includes(after)) return;
+  if (!old.includes(before)) throw new Error(`Patch context missing: ${path}`);
+  writeFileSync(path, old.replaceAll(before, after));
+}
+
+export function script(path, text) {
+  writeFileSync(path, "#!/bin/bun\n" + text, { mode: 0o755 });
+  chmodSync(path, 0o755);
+}
+
+export function installAdapters() {
+  mkdirSync(tools, { recursive: true });
+  script(shell, "await import('/buninu/apps/bunmsh/src/main.js');\n");
+  // Native Make/configure can exec these names; implementations remain JS.
+  const names = "awk basename cat chmod cmp cp cut date diff dirname echo egrep expr false fgrep grep head ln ls mkdir mktemp mv printf pwd rm rmdir sed sleep sort tail test touch tr true uname uniq wc".split(" ");
+  for (const name of names) script(`${tools}/${name}`, `
+import {executeArgv,createState,finishShell} from '/buninu/apps/bunmsh/src/shell.js';
+const state=createState({shellOptions:{posix:true}});
+const result=await executeArgv(['builtin',${JSON.stringify(name)},...process.argv.slice(2)],state);
+process.exitCode=(await finishShell(state,result.status)).status;
+`);
+  script(tools + "/bootstrap-ar", `import {existsSync} from 'node:fs';const ar='/bootstrap/toolchain/bin/ar';const p=Bun.spawn([...(existsSync(ar)?[ar]:['/bootstrap/toolchain/bin/tcc','-ar']),...Bun.argv.slice(2)],{stdin:'inherit',stdout:'inherit',stderr:'inherit'});process.exitCode=await p.exited;\n`);
+  script(tools + "/bootstrap-ld", `import {existsSync} from 'node:fs';const ld='/bootstrap/toolchain/bin/ld';const p=Bun.spawn([existsSync(ld)?ld:'/bootstrap/toolchain/bin/tcc',...Bun.argv.slice(2)],{stdin:'inherit',stdout:'inherit',stderr:'inherit'});process.exitCode=await p.exited;\n`);
+  installCc();
+}
+
+export function installCc() {
+  script(tools + "/cc", `
+import {existsSync} from 'node:fs';
+const args=Bun.argv.slice(2);
+const info=args.length===0 || args.every(a=>['-v','--version','-h','-hh','--help','-dumpversion','-dumpmachine','-print-search-dirs'].includes(a));
+const linking=!info && !args.some(a=>['-c','-E','-S','-r'].includes(a));
+const archive=process.arch==='x64'?'/bootstrap/toolchain/lib/tcc/libbootstrap-tcc-x64.a':'/bootstrap/toolchain/lib/tcc/libbootstrap-tcc-arm64.a';
+const runtime=linking&&existsSync(archive)?[archive]:[];
+const p=Bun.spawn(['/bootstrap/toolchain/bin/tcc',...args,...(info?[]:['-B/bootstrap/toolchain/lib/tcc','-nostdinc','-I/usr/include','-I/bootstrap/toolchain/lib/tcc/include','-L/usr/lib','-L/lib',...runtime,...(linking?['-lgcc_s']:[])])],{stdin:'inherit',stdout:'inherit',stderr:'inherit'});
+process.exitCode=await p.exited;
+`);
+}
+
+export async function configure(src, build, flags, extra = {}) {
+  await command([bun(), "/buninu/apps/bunmsh/index.js", src + "/configure", ...flags], build, extra);
+}
+
+export async function makeIn(build, targets = ["all"], extra = {}) {
+  const jobs = process.env.BOOTSTRAP_JOBS || "2";
+  if (!/^[1-9][0-9]*$/.test(jobs)) throw new Error("BOOTSTRAP_JOBS must be a positive integer");
+  await command([make, "SHELL=" + shell, "MAKEINFO=:", "-j" + jobs, ...targets], build, extra);
+}
+
+export function canonicalizers(src) {
+  const binutils = sourceRoot + "/binutils-2.39";
+  for (const name of ["config.sub", "config.guess"]) {
+    copyFileSync(join(binutils, name), join(src, name));
+    chmodSync(join(src, name), 0o755);
+  }
+}
+
+export function ready(number, message) {
+  note(`Stage ${number} verified: ${message}`);
+  if (number < 12) {
+    const next = readdirSync(bootstrap).find(name => name.startsWith(`${number + 1}.`) && name.endsWith(".js"));
+    if (!next) throw new Error(`Missing stage ${number + 1}`);
+    note(`Next: bun /bootstrap/${next}`);
+  }
+}

package/initramfs/usr/lib/bootstrap/lib/common.js

@@ -0,0 +1,134 @@
+import {
+  existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { createHash } from "node:crypto";
+
+export const bootstrap = resolve(import.meta.dir, "..");
+export const bun = () => Bun.which("bun") || process.argv0;
+export const quote = value => "'" + value.replaceAll("'", "'\\''") + "'";
+
+export function normalizeArch(name) {
+  if (["x", "x64", "x86_64", "x86-64"].includes(name)) return "x86_64";
+  if (["a", "aarch64", "arm64"].includes(name)) return "aarch64";
+  throw new Error(`Unsupported architecture: ${name}`);
+}
+
+export function options(args) {
+  if (args.includes("--help") || args.includes("-h")) {
+    console.log("Usage: bun SCRIPT [ARCH] [ROOTFS]");
+    console.log("ARCH: a/arm64/aarch64 or x/x64/x86_64/x86-64; default: host architecture.");
+    console.log("ROOTFS: default ./roota (arm64) or ./rootx (x64). A lone path is accepted.");
+    return null;
+  }
+  let arch = normalizeArch(process.arch);
+  const rest = [...args];
+  if (rest.length && /^(x|x64|x86_64|x86-64|a|arm64|aarch64)$/.test(rest[0])) {
+    arch = normalizeArch(rest.shift());
+  }
+  if (rest.length > 1 || rest.some(arg => arg.startsWith("-"))) {
+    throw new Error("Expected [ARCH] [ROOTFS]; use --help");
+  }
+  return { arch, rootfs: resolve(rest[0] ?? (arch === "aarch64" ? "roota" : "rootx")) };
+}
+
+// Parse data only: do not execute os-release as shell code.
+export function isBuninuLinux() {
+  let text;
+  try { text = readFileSync("/etc/os-release", "utf8"); }
+  catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    try { text = readFileSync("/usr/lib/os-release", "utf8"); }
+    catch (fallback) { if (fallback.code === "ENOENT") return false; throw fallback; }
+  }
+  return hasBuninuId(text);
+}
+
+export function hasBuninuId(text) {
+  const ids = [...text.matchAll(/^ID=(.*)\r?$/gm)];
+  const value = ids.at(-1)?.[1].trim();
+  return ["buninu-linux", '"buninu-linux"', "'buninu-linux'"].includes(value);
+}
+
+export function assertAbsent(path) {
+  try { lstatSync(path); }
+  catch (error) { if (error.code === "ENOENT") return; throw error; }
+  throw new Error(`Refusing existing destination: ${path}`);
+}
+
+export function write(path, bytes, mode = 0o644) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, bytes, { flag: "wx", mode });
+}
+
+export const sha256 = bytes => createHash("sha256").update(bytes).digest("hex");
+
+export async function download(name) {
+  const pins = Bun.YAML.parse(readFileSync(join(bootstrap, "downloads.md"), "utf8"));
+  const pin = pins[name];
+  if (!Array.isArray(pin) || !/^sha256:[a-f0-9]{64}$/.test(pin[1])) {
+    throw new Error(`Missing or invalid download pin: ${name}`);
+  }
+  const [url, hash] = pin;
+  const expected = hash.slice(7);
+  const cache = join(process.env.XDG_CACHE_HOME || join(homedir(), ".cache"), "buninu-bootstrap");
+  const path = join(cache, expected + "-" + new URL(url).pathname.split("/").at(-1));
+  if (existsSync(path)) {
+    const bytes = readFileSync(path);
+    if (sha256(bytes) !== expected) throw new Error(`Cached file hash mismatch: ${path}`);
+    console.log(`Verified cache: ${name}`);
+    return path;
+  }
+  console.log(`Fetching ${name}`);
+  const response = await fetch(url);
+  if (!response.ok) throw new Error(`${url}: HTTP ${response.status}`);
+  const bytes = Buffer.from(await response.arrayBuffer());
+  if (sha256(bytes) !== expected) throw new Error(`Download hash mismatch: ${name}`);
+  mkdirSync(cache, { recursive: true });
+  writeFileSync(path, bytes, { flag: "wx", mode: 0o644 });
+  return path;
+}
+
+export async function run(argv) {
+  console.log("$ " + argv.map(quote).join(" "));
+  const child = Bun.spawn(argv, { stdin: "inherit", stdout: "inherit", stderr: "inherit" });
+  const status = await child.exited;
+  if (status !== 0) throw new Error(`Command exited ${status}: ${argv[0]}`);
+}
+
+export async function cli(main) {
+  const mask = process.umask(0o022);
+  try { await main(Bun.argv.slice(2)); }
+  catch (error) { console.error(error.message); process.exitCode = 1; }
+  finally { process.umask(mask); }
+}
+
+export function requireRootfs() {
+  // Prevent an accidental stage 3/4 invocation from writing host /usr/include.
+  const marker = JSON.parse(readFileSync("/etc/buninu-bootstrap.json", "utf8"));
+  if (marker.format !== 1 || marker.arch !== normalizeArch(process.arch)) {
+    throw new Error("Enter the prepared rootfs for the matching architecture first");
+  }
+  if (bootstrap !== "/bootstrap") throw new Error("Run this stage inside the prepared rootfs");
+  return marker;
+}
+
+export function validateElf(name, data, arch) {
+  if (data.length < 64 || data.toString("hex", 0, 4) !== "7f454c46"
+      || data[4] !== 2 || data[5] !== 1 || data.readUInt16LE(18) !== (arch === "aarch64" ? 183 : 62)) {
+    throw new Error(`Not a ${arch} little-endian ELF64 file: ${name}`);
+  }
+}
+
+export function elfInterpreter(data) {
+  const start = Number(data.readBigUInt64LE(32)), stride = data.readUInt16LE(54), count = data.readUInt16LE(56);
+  for (let i = 0; i < count; i++) {
+    const p = start + i * stride;
+    if (!Number.isSafeInteger(p) || stride < 56 || p + 56 > data.length) throw new Error("Invalid Bun ELF program headers");
+    if (data.readUInt32LE(p) !== 3) continue;
+    const at = Number(data.readBigUInt64LE(p + 8)), size = Number(data.readBigUInt64LE(p + 32));
+    if (!Number.isSafeInteger(at) || !Number.isSafeInteger(size) || at + size > data.length) throw new Error("Invalid Bun ELF interpreter range");
+    return data.subarray(at, at + size).toString().replace(/\0.*$/s, "");
+  }
+}

package/initramfs/usr/lib/bootstrap/lib/compile-object.c

@@ -0,0 +1,14 @@
+#include "/bootstrap/src/tinycc/libtcc.c"
+
+int compile_object(const char *source, const char *output, const char *flags) {
+    TCCState *s = tcc_new();
+    if (!s) return 10;
+    tcc_set_lib_path(s, "/bootstrap/src/tinycc");
+    int result = tcc_set_options(s, flags);
+    if (!result) result = tcc_set_output_type(s, TCC_OUTPUT_OBJ);
+    if (!result) result = tcc_add_file(s, source);
+    if (!result) result = tcc_output_file(s, output);
+    tcc_delete(s);
+    return result;
+}
+#include "/bootstrap/src/tinycc/bun-x64-runtime.c"

package/initramfs/usr/lib/bootstrap/lib/musl-headers.js

@@ -0,0 +1,59 @@
+// Generate musl 1.2.6 public headers without Make, sed or a C compiler.
+import {
+  existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync,
+} from "node:fs";
+import { dirname, join } from "node:path";
+
+export function generateHeaders(arch, source, output) {
+  if (readFileSync(join(source, "VERSION"), "utf8").trim() !== "1.2.6") {
+    throw new Error("This generator follows musl 1.2.6's header rules");
+  }
+  if (existsSync(output)) throw new Error(`Refusing existing output: ${output}`);
+  const headers = new Map();
+  const copyHeaders = (directory, prefix = "") => {
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      if (entry.isFile() && entry.name.endsWith(".h")) {
+        headers.set(prefix + entry.name, readFileSync(join(directory, entry.name)));
+      }
+    }
+  };
+
+  // Makefile's include/*.h and include/*/*.h public headers.
+  copyHeaders(join(source, "include"));
+  for (const entry of readdirSync(join(source, "include"), { withFileTypes: true })) {
+    if (entry.isDirectory()) copyHeaders(join(source, "include", entry.name), entry.name + "/");
+  }
+  // Architecture-specific bits override generic fallbacks.
+  copyHeaders(join(source, "arch/generic/bits"), "bits/");
+  copyHeaders(join(source, "arch", arch, "bits"), "bits/");
+
+  // Translate tools/mkalltypes.sed's three substitutions literally. The
+  // replacement's final newline is intentional, in addition to the input's.
+  const types = readFileSync(join(source, "arch", arch, "bits/alltypes.h.in"), "utf8")
+    + readFileSync(join(source, "include/alltypes.h.in"), "utf8");
+  headers.set("bits/alltypes.h", types
+    .replace(/^TYPEDEF (.*) ([^ ]*);$/gm, (_, type, name) =>
+      `#if defined(__NEED_${name}) && !defined(__DEFINED_${name})\ntypedef ${type} ${name};\n#define __DEFINED_${name}\n#endif\n`)
+    .replace(/^STRUCT * ([^ ]*) (.*);$/gm, (_, name, body) =>
+      `#if defined(__NEED_struct_${name}) && !defined(__DEFINED_struct_${name})\nstruct ${name} ${body};\n#define __DEFINED_struct_${name}\n#endif\n`)
+    .replace(/^UNION * ([^ ]*) (.*);$/gm, (_, name, body) =>
+      `#if defined(__NEED_union_${name}) && !defined(__DEFINED_union_${name})\nunion ${name} ${body};\n#define __DEFINED_union_${name}\n#endif\n`));
+
+  // Makefile: copy the input, then append sed -n 's/__NR_/SYS_/p' output.
+  const syscalls = readFileSync(join(source, "arch", arch, "bits/syscall.h.in"), "utf8");
+  const aliases = syscalls.split("\n").filter(line => line.includes("__NR_"))
+    .map(line => line.replace("__NR_", "SYS_") + "\n").join("");
+  headers.set("bits/syscall.h", syscalls + aliases);
+
+  const previousUmask = process.umask(0o022);
+  try {
+    mkdirSync(output); // Parent must exist; refuse races with another writer.
+    for (const [name, data] of headers) {
+      const path = join(output, name);
+      mkdirSync(dirname(path), { recursive: true });
+      writeFileSync(path, data, { flag: "wx", mode: 0o644 });
+    }
+  } finally { process.umask(previousUmask); }
+  console.log(`Generated ${headers.size} ${arch} headers at ${output}`);
+}
+

package/initramfs/usr/lib/bootstrap/lib/seed.js

@@ -0,0 +1,148 @@
+import {
+  chmodSync, cpSync, mkdirSync, readFileSync, readdirSync,
+  renameSync, symlinkSync,
+} from "node:fs";
+import { join } from "node:path";
+import {
+  bootstrap, bun, download, elfInterpreter, run, sha256,
+  validateElf, write,
+} from "./common.js";
+
+const tools = [
+  "bin/tar", "bin/unzip", "usr/bin/env",
+  "lib/crc32.js", "lib/document.js", "lib/tar-strip.js", "lib/tar-exclude.js",
+  "usr/share/doc/buninu-linux/tar.md",
+];
+const shell = "buninu/apps/bunmsh/";
+
+function addTree(files, directory, prefix) {
+  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+    const path = join(directory, entry.name), target = prefix + entry.name;
+    if (entry.isDirectory()) addTree(files, path, target + "/");
+    else files.set(target, readFileSync(path)); // Resolve library/source symlinks.
+  }
+}
+
+export function localSeed(arch) {
+  const files = new Map();
+  for (const path of tools) files.set(path, readFileSync("/" + path));
+  addTree(files, "/" + shell, shell);
+  for (const name of ["libgcc_s.so.1", "libstdc++.so.6"]) {
+    let bytes;
+    try { bytes = readFileSync("/lib/" + name); }
+    catch (error) { if (error.code !== "ENOENT") throw error; bytes = readFileSync("/usr/lib/" + name); }
+    files.set("usr/lib/" + name, bytes);
+  }
+  files.set(`lib/ld-musl-${arch}.so.1`, readFileSync(`/lib/ld-musl-${arch}.so.1`));
+  files.set("bin/bun", readFileSync("/bin/bun"));
+  files.set("etc/resolv.conf", readFileSync("/etc/resolv.conf"));
+  return files;
+}
+
+export async function releaseSeed(arch, work) {
+  const tarball = await download("buninu-linux@0.9.56");
+  // Bun's archive reader works in-process; no host tar is required.
+  const entries = await new Bun.Archive(readFileSync(tarball)).files();
+  const get = async name => {
+    const file = entries.get("package/" + name);
+    if (!file) throw new Error(`Pinned buninu-linux tarball is missing ${name}`);
+    return Buffer.from(await file.arrayBuffer());
+  };
+  const files = new Map();
+  for (const path of tools) files.set(path, await get("initramfs/" + path));
+  for (const [name, file] of entries) {
+    const prefix = "package/initramfs/";
+    if (name.startsWith(prefix + shell)) files.set(name.slice(prefix.length), Buffer.from(await file.arrayBuffer()));
+  }
+  for (const name of ["libgcc_s.so.1", "libstdc++.so.6"]) {
+    files.set("usr/lib/" + name, await get(`native/${arch}/lib/${name}`));
+  }
+  const loader = `ld-musl-${arch}.so.1`;
+  files.set("lib/" + loader, await get(`native/${arch}/lib/${loader}`));
+  files.set("etc/resolv.conf", await get("initramfs/etc/resolv.conf"));
+
+  console.log("② Extracting pinned musl-bun");
+  const build = arch === "aarch64" ? "bun-linux-aarch64-musl" : "bun-linux-x64-musl-baseline";
+  const zip = await download(`${build}@1.4.2`);
+  // unzip is a CLI with top-level process.exit; invoke it separately.
+  for (const path of ["bin/unzip", "lib/crc32.js"]) write(join(work, path), files.get(path));
+  await run([bun(), join(work, "bin/unzip"), zip, `${build}/bun`, "-d", work]);
+  files.set("bin/bun", readFileSync(join(work, build, "bun")));
+  return files;
+}
+
+export function validateSeed(files, arch) {
+  const loader = `lib/ld-musl-${arch}.so.1`;
+  for (const name of ["bin/bun", loader, "usr/lib/libgcc_s.so.1", "usr/lib/libstdc++.so.6"]) {
+    validateElf(name, files.get(name), arch);
+  }
+  if (elfInterpreter(files.get("bin/bun")) !== "/" + loader) throw new Error("Bun must use the target musl loader");
+  for (const name of ["index.js", "package.json", "src/main.js"]) {
+    if (!files.has(shell + name)) throw new Error(`Missing bunmsh ${name}`);
+  }
+  for (const name of files.keys()) {
+    if (name.includes("\\") || name.includes("\0") || name.split("/").some(p => ["", ".", ".."].includes(p))) {
+      throw new Error(`Unsafe seed path: ${name}`);
+    }
+  }
+}
+
+export function writeSeed(root, arch, files, origin) {
+  mkdirSync(root);
+  for (const name of ["bin", "lib", "etc", "usr/lib", "usr/bin", "tmp", "root", "dev", "proc", "sys", "run"]) {
+    mkdirSync(join(root, name), { recursive: true });
+  }
+  for (const [name, bytes] of files) {
+    const executable = name.startsWith("bin/") || name.startsWith("usr/bin/")
+      || name === shell + "index.js" || /\.so\.[16]$/.test(name);
+    write(join(root, name), bytes, executable ? 0o755 : 0o644);
+  }
+  chmodSync(join(root, "tmp"), 0o1777);
+  write(join(root, "bin/sh"), `#!/bin/bun
+// Guest entry shell; build stages use their own shell and explicit PATH.
+const paths = [
+  "/bootstrap/result/bin",
+  "/bootstrap/toolchain/bin",
+  ...(process.env.PATH || "/bin:/usr/bin").split(":"),
+];
+process.env.PATH = [...new Set(paths)].join(":");
+await import("/buninu/apps/bunmsh/src/main.js");
+`, 0o755);
+  symlinkSync(`../../lib/ld-musl-${arch}.so.1`, join(root, "usr/lib/libc.so"));
+  symlinkSync("libgcc_s.so.1", join(root, "usr/lib/libgcc_s.so"));
+  symlinkSync("libc.so", join(root, "usr/lib/libm.so"));
+  write(join(root, "etc/buninu-bootstrap.json"), JSON.stringify({ format: 1, arch, origin }, null, 2) + "\n");
+}
+
+const sources = [
+  ["musl-1.2.6.tar.gz", "d585fd3b613c66151fc3249e8ed44f77020cb5e6c1e635a616d3f9f82460512a"],
+  ["tinycc-05f0faf-upstream.tar.gz", "300d4fd6fc4a7294403e17bfd29201954410ac2baa94f189526f6bef83524c19"],
+  ["tinycc-local-bootstrap-files.tar.gz", "59216479774f3c61b06420ca9b03ad4b8dcbdbb242d2d236d2daace135e35d59"],
+];
+
+export function sourceArchives() {
+  return sources.map(([name, hash]) => {
+    const bytes = readFileSync(join(bootstrap, "sources", name));
+    if (sha256(bytes) !== hash) throw new Error(`Bundled source hash mismatch: ${name}`);
+    return new Bun.Archive(bytes);
+  });
+}
+
+export async function installSources(root, archives) {
+  const src = join(root, "bootstrap/src");
+  mkdirSync(src, { recursive: true });
+  await archives[0].extract(src);
+  renameSync(join(src, "musl-1.2.6"), join(src, "musl"));
+  await archives[1].extract(src);
+  renameSync(join(src, "tinycc-05f0faf"), join(src, "tinycc"));
+  await archives[2].extract(root);
+  // The overlay provides the cc wrapper. It becomes usable at stage 4.
+  chmodSync(join(root, "bin/cc"), 0o755);
+  // Copy the recipes/helpers, but do not duplicate the extracted tarballs.
+  const target = join(root, "bootstrap");
+  mkdirSync(target, { recursive: true });
+  const stages = readdirSync(bootstrap).filter(name => /^(?:[1-9]|1[0-2])\..*\.js$/.test(name));
+  for (const name of [...stages, "lib", "README.md", "downloads.md", "NOTICE.md", "LICENSE", "LICENSES"]) {
+    cpSync(join(bootstrap, name), join(target, name), { recursive: true, errorOnExist: true, force: false });
+  }
+}

package/initramfs/usr/lib/bootstrap/lib/startup-check.c

@@ -0,0 +1,14 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+static int initialized;
+__attribute__((constructor)) static void init(void) { initialized = 37; }
+__attribute__((destructor)) static void fini(void) { puts("destructor OK"); }
+int main(int argc, char **argv) {
+    if (initialized != 37) return 1;
+    if (argc != 3 || strcmp(argv[1], "hello") || strcmp(argv[2], "two words")) return 2;
+    const char *value = getenv("CRT_TEST");
+    if (!value || strcmp(value,"seed-free")) return 3;
+    puts("argc/argv, environment, constructor OK");
+    return 42;
+}

package/initramfs/usr/lib/bootstrap/lib/tcc-build.js

@@ -0,0 +1,53 @@
+// Standalone TinyCC build used by stage 4 inside the target musl rootfs.
+import { chmodSync, cpSync, existsSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { bun, run } from "./common.js";
+
+export async function buildTcc() {
+  const root = "/bootstrap/src/tinycc";
+  if (!["x64", "arm64"].includes(process.arch)) throw new Error("Unsupported architecture");
+  const work = "/bootstrap/build/tinycc";
+  const runtime = "/bootstrap/toolchain/lib/tcc";
+  mkdirSync(work, { recursive: true });
+  mkdirSync(runtime, { recursive: true });
+  mkdirSync("/bootstrap/toolchain/bin", { recursive: true });
+  cpSync(join(root, "include"), join(runtime, "include"), { recursive: true });
+  const stage1 = "/bootstrap/toolchain/bin/tcc";
+  const stage2 = join(work, "tcc-stage2");
+  const flags = ["-B/bootstrap/toolchain/lib/tcc", "-nostdinc", "-I/usr/include", "-I/bootstrap/toolchain/lib/tcc/include", "-L/usr/lib", "-L/lib"];
+
+  console.log("1. Build standalone TinyCC using Bun.cc");
+  await run([bun(), join(root, "bun-bootstrap.js"), join(root, "bun-tcc-cli.c"), stage1, "0"]);
+  await run([stage1, "-v"]);
+
+  if (process.arch === "x64") {
+    console.log("2. Build x64 helpers for programs compiled by cc");
+    const objects = [];
+    for (const name of ["libtcc1", "va_list"]) {
+      const object = join(work, `${name}.o`);
+      await run([stage1, ...flags, "-c", join(root, "lib", `${name}.c`), "-o", object]);
+      objects.push(object);
+    }
+    await run([stage1, "-ar", "rcs", join(runtime, "libbootstrap-tcc-x64.a"), ...objects]);
+  }
+
+  console.log("3. Rebuild TinyCC with stage1");
+  await run([stage1, ...flags, join(root, "bun-tcc-cli.c"), "-lgcc_s", "-o", stage2]);
+  const a = await Bun.file(stage1).bytes();
+  const b = await Bun.file(stage2).bytes();
+  if (!Buffer.from(a).equals(Buffer.from(b))) throw new Error("stage1/stage2 differ");
+  console.log("stage1/stage2 byte-identical: true");
+
+  if (!existsSync("/bin/cc")) throw new Error("Extract the overlay's bin/cc first");
+  chmodSync("/bin/cc", 0o755);
+  console.log("4. Compile and run the libc smoke test through cc");
+  await run(["/bin/cc", join(root, "bun-hello-libc.c"), "-o", join(work, "hello-cc")]);
+  await run([join(work, "hello-cc")]);
+  if (process.arch === "x64") {
+    console.log("5. Check x64 conversions and variadic calls");
+    await run(["/bin/cc", join(root, "bun-runtime-check.c"), "-o", join(work, "runtime-check")]);
+    await run([join(work, "runtime-check")]);
+  }
+  console.log("Ready: /bin/cc (TinyCC stage1)");
+}
+

package/initramfs/usr/share/doc/buninu-linux/tar.md

@@ -3,6 +3,17 @@
 `/bin/tar` is a small Bun script over `Bun.Archive`. It handles uncompressed
 tar archives plus gzip and zstd without invoking another program.
 
+Alpine APK v2 archives are supported directly, including their concatenated
+gzip streams and tar sections. For example:
+
+```sh
+tar -tf musl-dev-1.2.6-r2.apk
+tar -xf musl-dev-1.2.6-r2.apk -C ./musl-dev
+```
+
+This extracts archive contents, including package metadata; it does not
+install the package or execute its package scripts.
+
 ## Synopsis
 
 ```sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buninu-linux",
-  "version": "0.8.56",
+  "version": "0.10.56",
   "description": "A Linux distribution running Bun as PID 1 with the Buninu userspace.",
   "type": "module",
   "main": "./index.js",

package/scripts/fetch.js

@@ -98,6 +98,8 @@ export const readTar = (path) => {
     if (type === "0" || type === "\0") files.set(name.replace(/^\.\//, ""), body);
   }
   return {
+    // Enumerate regular files without exposing the Map's mutation methods.
+    entries() { return files.entries(); },
     get(name) {
       const bytes = files.get(name);
       if (!bytes) throw new Error(`${path}: no ${name}`);