Replace pkgsrc and mdevd with mouse ports desktop base

scripts/audit-static-base.sh

@@ -1,6 +1,9 @@
 #!/bin/sh
 set -eu
 
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+. "$script_dir/mouse-arch.sh"
+
 if [ "$#" -ne 1 ]; then
     printf '%s\n' "usage: audit-static-base.sh ROOTFS" >&2
     exit 2
@@ -20,15 +23,19 @@ done
 for executable in \
     /bin/chgrp /bin/login /bin/sh /bin/su /bin/tcsh \
     /sbin/agetty /sbin/blkid /sbin/bridge /sbin/btrfs /sbin/dhcpcd /sbin/dmesg \
-    /sbin/depmod /sbin/insmod /sbin/kmod /sbin/lsmod /sbin/mdevd \
-    /sbin/mdevd-coldplug /sbin/mkfs.btrfs /sbin/modinfo /sbin/modprobe \
+    /sbin/depmod /sbin/insmod /sbin/kmod /sbin/lsmod \
+    /sbin/mkfs.btrfs /sbin/modinfo /sbin/modprobe \
     /sbin/mount /sbin/fdisk /sbin/ip /sbin/losetup /sbin/nft /sbin/rmmod \
     /sbin/sfdisk /sbin/ss /sbin/swapoff /sbin/swapon /sbin/sysctl /sbin/tc \
     /sbin/umount /sbin/wipefs \
-    /usr/bin/setsid /usr/sbin/mouse-bootenv \
+    /sbin/wpa_supplicant \
+    /usr/bin/gardendevctl /usr/bin/setsid /usr/libexec/mouse-auth \
+    /usr/libexec/mouse-package /usr/sbin/gardendevd \
+    /usr/sbin/mouse-bootenv \
     /usr/bin/awk /usr/bin/basename /usr/bin/cmp /usr/bin/cut \
-    /usr/bin/diff /usr/bin/dirname /usr/bin/fetch /usr/bin/groups /usr/bin/ldd \
-    /usr/bin/install /usr/bin/m4 /usr/bin/nc /usr/bin/patch \
+    /usr/bin/diff /usr/bin/dirname /usr/bin/doas /usr/bin/fetch /usr/bin/groups /usr/bin/ldd \
+    /usr/bin/autoconf /usr/bin/autom4te /usr/bin/autoreconf \
+    /usr/bin/install /usr/bin/m4 /usr/bin/nc /usr/bin/patch /usr/bin/perl \
     /usr/bin/sort /usr/bin/test /usr/bin/tr /usr/bin/whoami \
     /usr/bin/xargs \
     /usr/bin/apropos /usr/bin/bzip2 /usr/bin/crontab \
@@ -36,7 +43,8 @@ for executable in \
     /usr/bin/gzip /usr/bin/less /usr/bin/lsblk /usr/bin/man /usr/bin/mandoc \
     /usr/bin/nvi /usr/bin/openssl /usr/bin/passwd /usr/bin/pgrep \
     /usr/bin/pkill /usr/bin/readlink /usr/bin/sha256 /usr/bin/tar \
-    /usr/bin/top /usr/bin/tput /usr/bin/unzip \
+    /usr/bin/top /usr/bin/tput /usr/bin/unzip /usr/bin/wpa_cli \
+    /usr/bin/wpa_passphrase \
     /usr/bin/uptime /usr/bin/vmstat /usr/bin/watch /usr/bin/xz /usr/bin/zstd \
     /bin/ping /bin/ps /usr/bin/vi /usr/sbin/makewhatis \
     /usr/sbin/cron /usr/sbin/groupadd /usr/sbin/ntpd /usr/sbin/syslogd \
@@ -48,6 +56,17 @@ do
     fi
 done
 
+for executable in \
+    /bin/ping /bin/su /usr/bin/crontab /usr/bin/doas /usr/bin/passwd
+do
+    metadata=$(stat -c '%a %u %g' "$rootfs$executable")
+    if [ "$metadata" != "4755 0 0" ]; then
+        printf '%s\n' \
+            "setuid executable must have mode 4755 and root ownership: $executable" >&2
+        exit 1
+    fi
+done
+
 if [ ! -f "$rootfs/etc/ssl/cert.pem" ]; then
     printf '%s\n' "missing TLS trust bundle: /etc/ssl/cert.pem" >&2
     exit 1
@@ -67,13 +86,6 @@ if [ -e "$rootfs/etc/mouse-release" ]; then
     done
 fi
 
-if [ -e "$rootfs/usr/share/mouse/pkgsrc.version" ]; then
-    if [ "$(cat "$rootfs/usr/share/mouse/pkgsrc.version")" != 2026Q2 ]; then
-        printf '%s\n' "unexpected pkgsrc version" >&2
-        exit 1
-    fi
-fi
-
 if [ -e "$rootfs/usr/bin/cc" ]; then
     for tool in \
         /usr/bin/ar /usr/bin/c++ /usr/bin/clang /usr/bin/clang++ \
@@ -88,7 +100,7 @@ if [ -e "$rootfs/usr/bin/cc" ]; then
     for development_file in \
         /usr/include/stdio.h /usr/include/c++/v1/filesystem \
         /usr/include/openssl/ssl.h /usr/include/zlib.h \
-        /lib/ld-musl-x86_64.so.1 /usr/lib/libc.so \
+        "/lib/$MOUSE_MUSL_LOADER" /usr/lib/libc.so \
         /usr/lib/crt1.o /usr/lib/Scrt1.o /usr/lib/crtbegin.o \
         /usr/lib/crtbeginS.o /usr/lib/crtendS.o \
         /usr/lib/libc.a /usr/lib/libc++.a /usr/lib/libc++.so \
@@ -104,7 +116,7 @@ if [ -e "$rootfs/usr/bin/cc" ]; then
 fi
 
 if [ -e "$rootfs/usr/share/mk" ] || [ -e "$rootfs/usr/bin/bmake" ]; then
-    printf '%s\n' "base image must leave BSD make to pkgsrc under /usr/local" >&2
+    printf '%s\n' "base image must leave BSD make to mouse-ports under /usr/local" >&2
     exit 1
 fi
 if [ -e "$rootfs/usr/bin/make" ]; then

scripts/build-boot-disk.sh

@@ -3,12 +3,13 @@ set -eu
 
 script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 repo_dir=$(dirname "$script_dir")
-build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
-source_dir=${MOUSE_SOURCE_DIR:-"$build_dir/sources"}
+. "$script_dir/mouse-arch.sh"
+build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build/$MOUSE_ARCH"}
+source_dir=${MOUSE_SOURCE_DIR:-"$repo_dir/build/sources"}
 rootfs_image=${MOUSE_ROOTFS_IMAGE:-"$build_dir/mouse-rootfs.btrfs"}
 kernel_image=${MOUSE_KERNEL_IMAGE:-"$build_dir/vmlinuz-virt"}
 disk_image=${MOUSE_DISK_IMAGE_OUTPUT:-"$build_dir/mouse-disk.img"}
-limine_archive=${MOUSE_LIMINE_ARCHIVE:-"$source_dir/limine-binary-12.3.2.tar.xz"}
+limine_archive=${MOUSE_LIMINE_ARCHIVE:-"$source_dir/limine-binary-12.5.2.tar.xz"}
 limine_config=${MOUSE_LIMINE_CONFIG:-"$repo_dir/base/limine.conf"}
 
 for command in cc make mcopy mformat mmd sfdisk; do
@@ -49,20 +50,29 @@ truncate -s $((boot_sectors * sector_size)) "$boot_image"
 mformat -i "$boot_image" -F -v MOUSE_BOOT ::
 mmd -i "$boot_image" ::/EFI ::/EFI/BOOT
 mcopy -i "$boot_image" \
-    "$limine_source/BOOTX64.EFI" ::/EFI/BOOT/BOOTX64.EFI
-mcopy -i "$boot_image" \
-    "$limine_source/limine-bios.sys" ::/limine-bios.sys
-mcopy -i "$boot_image" "$limine_config" ::/limine.conf
+    "$limine_source/$MOUSE_EFI_LOADER" "::/EFI/BOOT/$MOUSE_EFI_LOADER"
+if [ "$MOUSE_ARCH" = x86_64 ]; then
+    mcopy -i "$boot_image" \
+        "$limine_source/limine-bios.sys" ::/limine-bios.sys
+fi
+sed "s/console=ttyS0/console=$MOUSE_CONSOLE/g" \
+    "$limine_config" >"$working/limine.conf"
+mcopy -i "$boot_image" "$working/limine.conf" ::/limine.conf
 mcopy -i "$boot_image" "$kernel_image" ::/vmlinuz-mouse
 
 rm -f "$disk_image"
 truncate -s $((disk_sectors * sector_size)) "$disk_image"
+if [ "$MOUSE_ARCH" = x86_64 ]; then
+    bios_partition="start=34, size=$((boot_start - 34)), type=21686148-6449-6e6f-744e-656564454649, uuid=4d4f5553-4500-4000-8000-000000000003, name=\"MOUSE_BIOS\""
+else
+    bios_partition=
+fi
 sfdisk --quiet "$disk_image" <<EOF
 label: gpt
 label-id: 4d4f5553-4500-4000-8000-000000000000
 unit: sectors
 
-start=34, size=$((boot_start - 34)), type=21686148-6449-6e6f-744e-656564454649, uuid=4d4f5553-4500-4000-8000-000000000003, name="MOUSE_BIOS"
+$bios_partition
 start=$boot_start, size=$boot_sectors, type=c12a7328-f81f-11d2-ba4b-00a0c93ec93b, uuid=4d4f5553-4500-4000-8000-000000000001, name="MOUSE_BOOT"
 start=$root_start, size=$root_sectors, type=0fc63daf-8483-4772-8e79-3d69d8477de4, uuid=4d4f5553-4500-4000-8000-000000000002, name="MOUSE_ROOT"
 EOF
@@ -70,7 +80,21 @@ EOF
 dd if="$boot_image" of="$disk_image" bs="$sector_size" \
     seek="$boot_start" conv=notrunc status=none
 dd if="$rootfs_image" of="$disk_image" bs="$sector_size" \
-    seek="$root_start" conv=notrunc status=none
-"$limine_source/limine" bios-install "$disk_image"
+    seek="$root_start" conv=notrunc,sparse status=none
 
-printf '%s\n' "built $disk_image with Limine BIOS and UEFI boot support"
+btrfs_magic_offset=$((root_start * sector_size + 65536 + 64))
+btrfs_magic=$(dd if="$disk_image" bs=1 \
+    skip="$btrfs_magic_offset" count=8 status=none)
+if [ "$btrfs_magic" != "_BHRfS_M" ]; then
+    printf '%s\n' "built disk does not contain a Btrfs root filesystem" >&2
+    exit 1
+fi
+
+if [ "$MOUSE_ARCH" = x86_64 ]; then
+    "$limine_source/limine" bios-install "$disk_image"
+    boot_support="BIOS and UEFI"
+else
+    boot_support=UEFI
+fi
+
+printf '%s\n' "built $disk_image with Limine $boot_support boot support"

scripts/build-btrfs-image-tool.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+set -eu
+
+jobs=${MOUSE_BUILD_JOBS:-8}
+source=/work/btrfs-progs-v7.1
+
+tar -C /work -xf /opt/btrfs-progs-v7.1.tar.xz
+(
+    cd "$source"
+    ./configure \
+        --prefix=/usr \
+        --disable-backtrace \
+        --disable-documentation \
+        --disable-convert \
+        --disable-lzo \
+        --disable-libudev \
+        --disable-python \
+        --disable-zoned \
+        --with-crypto=builtin
+    make -j"$jobs" mkfs.btrfs
+)
+install -m 0755 "$source/mkfs.btrfs" /opt/mkfs.btrfs

scripts/build-image-commands.sh

@@ -3,10 +3,11 @@ set -eu
 
 script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 repo_dir=$(dirname "$script_dir")
-build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
+. "$script_dir/mouse-arch.sh"
+build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build/$MOUSE_ARCH"}
 static_dir="$build_dir/static"
 base_root="$static_dir/rootfs"
-cc="$static_dir/cross-tools/bin/x86_64-mouse-linux-musl-cc"
+cc="$static_dir/cross-tools/bin/$MOUSE_CROSS_TARGET-cc"
 
 for requirement in \
     "$cc" \
@@ -18,7 +19,15 @@ do
     fi
 done
 
+install -d -m 0755 "$base_root/usr/libexec"
 install -m 0755 \
     "$repo_dir/base/support/mouse-bootenv" \
     "$base_root/usr/sbin/mouse-bootenv"
-ln -sfn ../usr/lib/libc.so "$base_root/lib/ld-musl-x86_64.so.1"
+install -m 0755 \
+    "$repo_dir/base/support/mouse-package" \
+    "$base_root/usr/libexec/mouse-package"
+"$cc" -O2 -Wall -Wextra -Werror \
+    "$repo_dir/base/support/mouse-auth.c" \
+    -lcrypt \
+    -o "$base_root/usr/libexec/mouse-auth"
+ln -sfn ../usr/lib/libc.so "$base_root/lib/$MOUSE_MUSL_LOADER"

scripts/build-image.sh

@@ -3,11 +3,13 @@ set -eu
 
 script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 repo_dir=$(dirname "$script_dir")
+. "$script_dir/mouse-arch.sh"
 cheesed_dir="$repo_dir/base/cheesed"
-build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
-target=${CHEESED_TARGET:-x86_64-unknown-linux-musl}
+build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build/$MOUSE_ARCH"}
+target=${CHEESED_TARGET:-$MOUSE_RUST_TARGET}
 test_fixtures=${MOUSE_INCLUDE_TEST_FIXTURES:-0}
 kernel_modules=${MOUSE_KERNEL_MODULES:-"$build_dir/kernel/modules"}
+device_firmware=${MOUSE_DEVICE_FIRMWARE:-"$build_dir/device-firmware"}
 staging=
 image_staging=
 
@@ -28,19 +30,18 @@ case "$test_fixtures" in
 		;;
 esac
 base_root="$build_dir/static/rootfs"
-pkgsrc_seed=${MOUSE_PKGSRC_SEED:-"$build_dir/pkgsrc-seed"}
-for input in "$base_root" "$build_dir/vmlinuz-virt"; do
+ports_seed=${MOUSE_PORTS_SEED:-"$build_dir/mouse-ports-seed"}
+for input in "$base_root" "$build_dir/vmlinuz-virt" \
+    "$device_firmware/lib/firmware"; do
     if [ ! -e "$input" ]; then
         printf '%s\n' "missing prepared image input: $input" >&2
         exit 1
     fi
 done
-for seed_directory in "$pkgsrc_seed/usr/local" "$pkgsrc_seed/var/db/pkg"; do
-    if [ ! -d "$seed_directory" ]; then
-        printf '%s\n' "missing pkgsrc seed directory: $seed_directory" >&2
-        exit 1
-    fi
-done
+if [ ! -d "$ports_seed/usr/local" ]; then
+	printf '%s\n' "missing mouse-ports seed directory: $ports_seed/usr/local" >&2
+	exit 1
+fi
 btrfs_image_tool=${MOUSE_BTRFS_IMAGE_TOOL:-"$base_root/sbin/mkfs.btrfs"}
 if [ ! -x "$btrfs_image_tool" ]; then
     printf '%s\n' "missing btrfs image tool: $btrfs_image_tool" >&2
@@ -74,8 +75,8 @@ install -d -m 0755 \
     "$staging/usr/local/etc/rc.d" \
     "$staging/usr/lib/mouse" \
     "$staging/usr/sbin" \
-    "$staging/var/cache/pkgsrc/distfiles" \
-    "$staging/var/cache/pkgsrc/packages" \
+    "$staging/var/cache/mouse/ports/distfiles" \
+    "$staging/var/cache/mouse/packages" \
     "$staging/var/db" \
     "$staging/var/lib/dhcpcd" \
     "$staging/var/empty" \
@@ -94,13 +95,13 @@ install -d -m 1777 \
 ln -s /run "$staging/var/run"
 
 cp -R "$base_root/." "$staging/"
-cp -R "$pkgsrc_seed/usr/local/." "$staging/usr/local/"
-cp -R "$pkgsrc_seed/var/db/pkg" "$staging/var/db/"
+cp -R "$ports_seed/usr/local/." "$staging/usr/local/"
 if [ ! -d "$kernel_modules/lib/modules" ]; then
     printf '%s\n' "missing kernel module tree: $kernel_modules/lib/modules" >&2
     exit 1
 fi
 cp -R "$kernel_modules/lib/." "$staging/lib/"
+cp -R "$device_firmware/lib/firmware" "$staging/lib/"
 if [ "$test_fixtures" -eq 1 ] && [ -d "$kernel_modules/usr/local" ]; then
     cp -R "$kernel_modules/usr/local/." "$staging/usr/local/"
 fi
@@ -110,29 +111,40 @@ for command in service shutdown poweroff reboot; do
 done
 
 cp -R "$repo_dir/base/rootfs/." "$staging/"
+install -d -m 0700 -o 1000 -g 1000 "$staging/home/mouse"
+sed "s/@MOUSE_ARCH@/$MOUSE_ARCH/g" \
+    "$staging/etc/mouse-release" >"$staging/etc/mouse-release.new"
+mv "$staging/etc/mouse-release.new" "$staging/etc/mouse-release"
+sed "s/@MOUSE_ARCH@/$MOUSE_ARCH/g" \
+    "$staging/etc/motd" >"$staging/etc/motd.new"
+mv "$staging/etc/motd.new" "$staging/etc/motd"
+for console_file in \
+    "$staging/etc/rc.d/console_login" \
+    "$staging/etc/securetty"
+do
+    sed "s/@MOUSE_CONSOLE@/$MOUSE_CONSOLE/g" \
+        "$console_file" >"$console_file.new"
+    mv "$console_file.new" "$console_file"
+done
 if [ "$test_fixtures" -eq 1 ]; then
 	cp -R "$repo_dir/tests/fixtures/mouse-echo/rootfs/." "$staging/"
 	install -m 0755 \
 		"${MOUSE_MOUSE_ECHO_BINARY:?missing test mouse-echo binary}" \
 		"$staging/usr/libexec/mouse-echo"
 	printf '%s\n' "enable_mouse_echo=YES" >>"$staging/etc/rc.conf"
+	test_password_hash='$6$mouse$LofYSsSObtmx/zmS97A.TFONKSQSATXE4bD6dY1H7JSBSayuyAuc4Qwpm7JdfW9lUnri9DrQfUKGiLTNKA3v81'
+	awk -F: -v OFS=: -v password_hash="$test_password_hash" '
+		$1 == "root" || $1 == "toor" { $2 = password_hash }
+		{ print }
+	' "$staging/etc/shadow" >"$staging/etc/shadow.test"
+	mv "$staging/etc/shadow.test" "$staging/etc/shadow"
 fi
 install -d -m 0755 "$staging/usr/share/mouse"
-if [ "$test_fixtures" -eq 1 ]; then
-    install -d -m 0755 "$staging/usr/share/mouse/pkgsrc-fixture"
-    cp -R "$repo_dir/tests/fixtures/pkgsrc/local" \
-        "$staging/usr/share/mouse/pkgsrc-fixture/"
-fi
-printf '%s\n' 2026Q2 >"$staging/usr/share/mouse/pkgsrc.version"
-rc_subr_source="$staging/usr/local/src/pkgsrc/pkgtools/rc.subr/files/rc.subr"
-[ -f "$rc_subr_source" ] || {
-    printf '%s\n' "pkgsrc seed lacks rc.subr source" >&2
-    exit 1
-}
-sed 's|@SYSCONFBASE@|/usr/local/etc|g' "$rc_subr_source" \
-    >"$staging/etc/rc.subr"
+install -m 0444 \
+	"${MOUSE_PORTS_REVISION_FILE:-/work/mouse-ports-revision}" \
+	"$staging/usr/share/mouse/ports.revision"
 patch "$staging/etc/rc.subr" \
-    <"$repo_dir/base/patches/pkgsrc-rc.subr-cgroup.patch"
+    <"$repo_dir/base/patches/rc.subr-cgroup.patch"
 chmod 0444 "$staging/etc/rc.subr"
 ln -s mouse-release "$staging/etc/os-release"
 chmod 0755 \
@@ -142,24 +154,56 @@ chmod 0755 \
     "$staging/etc/rc.d/login" \
     "$staging/etc/rc.d/loopback" \
     "$staging/etc/rc.d/machine_identity" \
-    "$staging/etc/rc.d/mdevd" \
+	"$staging/etc/rc.d/gardendevd" \
     "$staging/etc/rc.d/network" \
     "$staging/etc/rc.d/ntpd" \
     "$staging/etc/rc.d/servers" \
     "$staging/etc/rc.d/syslogd" \
-    "$staging/usr/libexec/mouse-dhcpcd-hook"
+    "$staging/etc/rc.d/wpa_supplicant" \
+    "$staging/usr/libexec/mouse-dhcpcd-hook" \
+    "$staging/usr/libexec/mouse-wpa-supplicant"
 if [ "$test_fixtures" -eq 1 ]; then
 	chmod 0755 "$staging/etc/rc.d/mouse_echo"
 fi
+chown 0:0 \
+    "$staging/bin/ping" \
+    "$staging/bin/su" \
+    "$staging/usr/bin/crontab" \
+    "$staging/usr/bin/doas" \
+    "$staging/usr/bin/passwd"
+chmod 4755 \
+    "$staging/bin/ping" \
+    "$staging/bin/su" \
+    "$staging/usr/bin/crontab" \
+    "$staging/usr/bin/doas" \
+    "$staging/usr/bin/passwd"
 chmod 0600 "$staging/etc/shadow"
-
-chmod 0444 "$staging/usr/share/mouse/pkgsrc.version"
+chmod 0600 "$staging/etc/wpa_supplicant/wpa_supplicant.conf"
 
 "$script_dir/audit-static-base.sh" "$staging"
 
+for desktop_input in \
+	/usr/local/bin/bmake \
+	/usr/local/bin/dwl \
+	/usr/local/bin/havoc \
+	/usr/local/bin/mouse-dwl-session \
+	/usr/local/bin/seatd \
+	/usr/local/bin/tuigreet \
+	/usr/local/lib/libudev.so \
+	/usr/local/lib/libwlroots-0.19.so \
+	/usr/local/sbin/greetd \
+	/usr/local/etc/rc.d/greetd \
+	/usr/local/etc/rc.d/seatd
+do
+	[ -e "$staging$desktop_input" ] || {
+		printf '%s\n' "missing mouse-ports seed input: $desktop_input" >&2
+		exit 1
+	}
+done
+
 mkdir -p "$build_dir"
 btrfs_image="$build_dir/mouse-rootfs.btrfs"
-rootfs_size=${MOUSE_ROOTFS_SIZE:-4G}
+rootfs_size=${MOUSE_ROOTFS_SIZE:-8G}
 install -d -m 0755 \
     "$image_staging/ROOT/default" \
     "$image_staging/ROOT/alternate" \
@@ -168,8 +212,8 @@ install -d -m 0755 \
     "$image_staging/home" \
     "$image_staging/srv"
 
-cp -R "$staging/." "$image_staging/ROOT/default/"
-cp -R "$staging/." "$image_staging/ROOT/alternate/"
+cp -a "$staging/." "$image_staging/ROOT/default/"
+cp -a "$staging/." "$image_staging/ROOT/alternate/"
 printf '%s\n' default \
     >"$image_staging/ROOT/default/etc/mouse-boot-environment"
 printf '%s\n' alternate \
@@ -183,7 +227,7 @@ for persistent in \
 do
     root_path=${persistent%%:*}
     subvolume=${persistent#*:}
-    cp -R "$staging/$root_path/." "$image_staging/$subvolume/"
+    cp -a "$staging/$root_path/." "$image_staging/$subvolume/"
     for environment in default alternate; do
         rm -rf "$image_staging/ROOT/$environment/$root_path"
         install -d -m 0755 \
@@ -191,6 +235,21 @@ do
     done
 done
 
+for environment in default alternate; do
+    metadata=$(stat -c '%a %u %g' \
+        "$image_staging/ROOT/$environment/usr/bin/doas")
+    if [ "$metadata" != "4755 0 0" ]; then
+        printf '%s\n' \
+            "image staging lost doas setuid metadata in $environment" >&2
+        exit 1
+    fi
+done
+metadata=$(stat -c '%a %u %g' "$image_staging/home/mouse")
+if [ "$metadata" != "700 1000 1000" ]; then
+    printf '%s\n' "image staging lost mouse home ownership" >&2
+    exit 1
+fi
+
 rm -f "$btrfs_image"
 truncate -s "$rootfs_size" "$btrfs_image"
 "$btrfs_image_tool" \
@@ -207,5 +266,5 @@ truncate -s "$rootfs_size" "$btrfs_image"
     "$btrfs_image"
 
 printf '%s\n' "built $build_dir/vmlinuz-virt"
-printf '%s\n' "built $btrfs_image"
 sh "$script_dir/build-boot-disk.sh"
+rm -f "$btrfs_image"

scripts/build-in-container.sh

@@ -3,7 +3,9 @@ set -eu
 
 script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 repo_dir=$(dirname "$script_dir")
-output_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
+. "$script_dir/mouse-arch.sh"
+output_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build/$MOUSE_ARCH"}
+source_dir=${MOUSE_SOURCE_DIR:-"$repo_dir/build/sources"}
 test_fixtures=${MOUSE_INCLUDE_TEST_FIXTURES:-0}
 builder_cpus=${MOUSE_BUILDER_CPUS:-8}
 builder_memory=${MOUSE_BUILDER_MEMORY:-8G}
@@ -76,9 +78,13 @@ fi
 container_frontend=$(basename "$container_cli")
 case "$container_frontend" in
 	container)
+		dockerfile_bytes=$(wc -c <"$repo_dir/Containerfile" | tr -d ' ')
+		if [ "$dockerfile_bytes" -gt 14700 ]; then
+			die "Containerfile is $dockerfile_bytes bytes; Apple Container 1.0 closes Dockerfile streams above roughly 14960 bytes. Move inline build logic into a helper script."
+		fi
 		"$container_cli" system start >/dev/null
 		builder_resources=$("$container_cli" builder status 2>/dev/null |
-			awk 'NR == 2 { print $5, $6 }')
+			awk 'NR == 2 { print $(NF - 2), $(NF - 1) }')
 		if [ -n "$builder_resources" ]; then
 			set -- $builder_resources
 			actual_cpus=$1
@@ -95,7 +101,7 @@ case "$container_frontend" in
 esac
 
 "$repo_dir/scripts/check-source-locks.sh"
-"$repo_dir/scripts/fetch-sources.sh"
+MOUSE_SOURCE_DIR="$source_dir" "$repo_dir/scripts/fetch-sources.sh"
 
 mkdir -p "$output_dir"
 build_context=$(mktemp -d "$output_dir/.container-context.XXXXXX")
@@ -119,14 +125,28 @@ trap cleanup EXIT HUP INT TERM
 		--exclude='mouse-src/.containerignore' \
 		--exclude='mouse-src/scripts/build-in-container.sh' \
 		--exclude='mouse-src/base/cheesed/target/*' \
-		mouse-src
+		--exclude='mouse-ports/.git/*' \
+		mouse-src mouse-ports
 ) | tar -xf - -C "$build_context"
 
 cp "$repo_dir/Containerfile" "$build_context/Dockerfile"
 cp "$repo_dir/.containerignore" "$build_context/.dockerignore"
 
-source_dir=${MOUSE_SOURCE_DIR:-"$output_dir/sources"}
-for domain in toolchain kernel firmware facilities storage pkgsrc software; do
+ports_revision=$(git -C "$repo_dir/../mouse-ports" rev-parse --short=12 HEAD)
+if [ -n "$(git -C "$repo_dir/../mouse-ports" status --porcelain)" ]; then
+	ports_revision=$ports_revision-dirty
+fi
+printf '%s\n' "$ports_revision" >"$build_context/mouse-ports-revision"
+
+mkdir -p "$build_context/mouse-cargo"
+(
+	cd "$source_dir/cargo"
+	tar -cf - .
+) | tar -xf - -C "$build_context/mouse-cargo"
+
+for domain in \
+	toolchain kernel firmware device-firmware wireless autotools facilities storage software
+do
 	domain_dir="$build_context/mouse-sources/$domain"
 	mkdir -p "$domain_dir"
 	while read -r checksum url filename extra; do
@@ -154,6 +174,8 @@ done
 	set -- "$@" \
 		--platform "$builder_platform" \
 		--target artifacts \
+		--build-arg "MOUSE_ARCH=$MOUSE_ARCH" \
+		--build-arg "MOUSE_TARGET_CONTAINER_PLATFORM=$MOUSE_TARGET_CONTAINER_PLATFORM" \
 		--build-arg "MOUSE_BUILD_JOBS=$build_jobs" \
 		--build-arg "MOUSE_ROOTFS_STAGE=$rootfs_stage" \
 		--output "type=local,dest=$export_dir" \
@@ -167,7 +189,7 @@ if [ ! -f "$artifacts_dir/vmlinuz-virt" ]; then
 	artifacts_dir="$export_dir/out.tar/$platform_dir"
 fi
 
-for artifact in vmlinuz-virt ovmf-code.fd; do
+for artifact in vmlinuz-virt uefi-code.fd; do
 	[ -f "$artifacts_dir/$artifact" ] || \
 		die "container build did not export $artifact"
 	install -m 0644 "$artifacts_dir/$artifact" "$output_dir/$artifact"
@@ -176,15 +198,37 @@ done
 artifact=mouse-disk.img
 [ -f "$artifacts_dir/$artifact.gz" ] || \
 	die "container build did not export $artifact.gz"
+
+# Apple Container keeps discarded BuildKit blocks allocated in its sparse
+# volume until the guest filesystem is trimmed.  Return those blocks before
+# expanding the raw disk on the host, when both copies briefly coexist.
+if [ "$container_frontend" = container ]; then
+	"$container_cli" exec buildkit fstrim / >/dev/null
+fi
+
 artifact_temp="$output_dir/.$artifact.tmp"
-gzip -dc "$artifacts_dir/$artifact.gz" >"$artifact_temp"
+compressed_artifact="$artifacts_dir/$artifact.gz"
+gzip_magic=$(LC_ALL=C od -An -tx1 -N2 "$compressed_artifact" | tr -d ' \n')
+[ "$gzip_magic" = 1f8b ] || die "container build exported invalid $artifact.gz"
+gzip -dc "$compressed_artifact" >"$artifact_temp"
+
+gpt_signature=$(dd if="$artifact_temp" bs=1 skip=512 count=8 2>/dev/null)
+[ "$gpt_signature" = "EFI PART" ] || \
+	die "exported disk does not contain a GPT header"
+root_start=$((2048 + 262144))
+btrfs_magic_offset=$((root_start * 512 + 65536 + 64))
+btrfs_magic=$(dd if="$artifact_temp" bs=1 \
+	skip="$btrfs_magic_offset" count=8 2>/dev/null)
+[ "$btrfs_magic" = "_BHRfS_M" ] || \
+	die "exported disk does not contain a Btrfs root filesystem"
+
 chmod 0644 "$artifact_temp"
 mv -f "$artifact_temp" "$output_dir/$artifact"
 artifact_temp=
 
 for artifact in \
 	vmlinuz-virt \
-	ovmf-code.fd \
+	uefi-code.fd \
 	mouse-disk.img
 do
 	printf '%s\n' "exported $output_dir/$artifact"

scripts/build-kernel-test-module.sh

@@ -3,9 +3,10 @@ set -eu
 
 script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 repo_dir=$(dirname "$script_dir")
-build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
+. "$script_dir/mouse-arch.sh"
+build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build/$MOUSE_ARCH"}
 kernel_version=$(cat "$build_dir/kernel/release")
-kernel_source="$build_dir/kernel/linux-6.18.35"
+kernel_source="$build_dir/kernel/linux-7.1.6"
 kernel_output="$build_dir/kernel/output"
 module_output="$build_dir/kernel/module-test"
 module_root="$build_dir/kernel/test-modules"
@@ -17,7 +18,7 @@ cp "$repo_dir/tests/fixtures/kernel-module/mouse_test.c" \
     "$module_output/"
 make -s -C "$kernel_source" \
     O="$kernel_output" \
-    ARCH=x86_64 \
+    ARCH="$MOUSE_KERNEL_ARCH" \
     LLVM=1 \
     M="$module_output" \
     modules

scripts/build-kernel.sh

@@ -3,13 +3,14 @@ set -eu
 
 script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 repo_dir=$(dirname "$script_dir")
-build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
-source_dir=${MOUSE_SOURCE_DIR:-"$build_dir/sources"}
-kernel_version=6.18.35
+. "$script_dir/mouse-arch.sh"
+build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build/$MOUSE_ARCH"}
+source_dir=${MOUSE_SOURCE_DIR:-"$repo_dir/build/sources"}
+kernel_version=7.1.6
 kernel_archive="$source_dir/linux-$kernel_version.tar.xz"
 kernel_source="$build_dir/kernel/linux-$kernel_version"
 kernel_output="$build_dir/kernel/output"
-kernel_config="$repo_dir/base/kernel/x86_64.config"
+kernel_config="$repo_dir/base/kernel/$MOUSE_ARCH.config"
 jobs=${MOUSE_BUILD_JOBS:-$(getconf _NPROCESSORS_ONLN 2>/dev/null || printf '1\n')}
 
 if [ ! -f "$kernel_archive" ]; then
@@ -28,7 +29,7 @@ mkdir -p "$kernel_output"
 
 make -C "$kernel_source" \
     O="$kernel_output" \
-    ARCH=x86_64 \
+    ARCH="$MOUSE_KERNEL_ARCH" \
     LLVM=1 \
     KCONFIG_ALLCONFIG="$kernel_config" \
     allnoconfig
@@ -45,25 +46,31 @@ while IFS= read -r requested || [ -n "$requested" ]; do
     fi
 done <"$kernel_config"
 
+if grep -Fqx 'CONFIG_LEGACY_TIOCSTI=y' "$kernel_output/.config"; then
+    printf '%s\n' \
+        "kernel enables legacy TIOCSTI, which is unsafe across privilege boundaries" >&2
+    exit 1
+fi
+
 make -C "$kernel_source" \
     O="$kernel_output" \
-    ARCH=x86_64 \
+    ARCH="$MOUSE_KERNEL_ARCH" \
     LLVM=1 \
     KBUILD_BUILD_USER=mouse \
     KBUILD_BUILD_HOST=mouse \
     -j"$jobs" \
-    bzImage modules
+    "$MOUSE_KERNEL_TARGET" modules
 
 kernel_release=$(make -s -C "$kernel_source" \
     O="$kernel_output" \
-    ARCH=x86_64 \
+    ARCH="$MOUSE_KERNEL_ARCH" \
     LLVM=1 \
     kernelrelease)
 module_root="$build_dir/kernel/modules"
 rm -rf "$module_root"
 make -s -C "$kernel_source" \
     O="$kernel_output" \
-    ARCH=x86_64 \
+    ARCH="$MOUSE_KERNEL_ARCH" \
     LLVM=1 \
     INSTALL_MOD_PATH="$module_root" \
     modules_install
@@ -74,7 +81,7 @@ install -m 0644 "$kernel_output/.config" \
 install -m 0644 "$kernel_output/Module.symvers" \
     "$module_root/lib/modules/$kernel_release/Module.symvers"
 install -m 0644 \
-    "$kernel_output/arch/x86/boot/bzImage" \
+    "$kernel_output/$MOUSE_KERNEL_BUILD_PATH" \
     "$build_dir/vmlinuz-virt"
 printf '%s\n' \
     "built Linux $kernel_release with built-in btrfs and loadable-module support"

scripts/build-mouse-ports-seed.sh

@@ -0,0 +1,85 @@
+#!/bin/sh
+set -eu
+
+ports_dir=${MOUSE_PORTS_DIR:-/usr/local/src/mouse-ports}
+seed=${MOUSE_PORTS_SEED:-/opt/mouse-ports-seed}
+distdir=${MOUSE_PORTS_DISTDIR:-/var/cache/mouse/ports/distfiles}
+workbase=${MOUSE_PORTS_WORKDIR:-/var/tmp/mouse-ports}
+bmake=${BMAKE:-/usr/bin/bmake}
+
+fail()
+{
+	printf '%s\n' "build-mouse-ports-seed: $*" >&2
+	exit 1
+}
+
+[ -x "$bmake" ] || fail "missing BSD make: $bmake"
+[ -f "$ports_dir/ports/Mk/mouse.port.mk" ] || fail "missing ports tree"
+rm -rf "$seed" "$workbase"
+mkdir -p "$seed/usr/local" "$distdir" "$workbase"
+
+for origin in \
+	devel/bmake \
+	devel/gmake \
+	devel/libudev-garden \
+	sysutils/seatd \
+	x11/tuigreet \
+	sysutils/greetd \
+	devel/libffi \
+	textproc/expat \
+	graphics/wayland-protocols \
+	graphics/wayland \
+	graphics/libdrm \
+	misc/hwdata \
+	graphics/libdisplay-info \
+	x11/libevdev \
+	x11/mtdev \
+	x11/libinput \
+	x11/xkeyboard-config \
+	x11/libxkbcommon \
+	graphics/pixman \
+	x11/wlroots \
+	x11/havoc \
+	x11/dwl
+do
+	name=${origin##*/}
+	stage=$workbase/$name-stage
+	PATH="/usr/local/bin:$PATH" \
+	PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/local/share/pkgconfig \
+	"$bmake" -C "$ports_dir/ports/$origin" stage \
+		BUILD_DEPENDS= RUN_DEPENDS= \
+		DISTDIR="$distdir" \
+		WRKDIR="$workbase/$name-work" \
+		STAGEDIR="$stage" \
+		MOUSE_FETCH=/usr/bin/curl \
+		MOUSE_SHA256=/usr/bin/sha256sum \
+		EXTRACT_CMD=/bin/tar \
+		MESON=/usr/bin/meson \
+		NINJA=/usr/bin/ninja \
+		GMAKE="${GMAKE:-/usr/bin/make}"
+	rust_binary=
+	case "$origin" in
+		x11/tuigreet) rust_binary="$stage/usr/local/bin/tuigreet" ;;
+		sysutils/greetd) rust_binary="$stage/usr/local/sbin/greetd" ;;
+	esac
+	if [ -n "$rust_binary" ]; then
+		[ -x "$rust_binary" ] || fail "missing Rust executable: $rust_binary"
+		if /usr/bin/readelf -d "$rust_binary" 2>/dev/null | grep -q '(NEEDED)'; then
+			fail "Rust executable is dynamically linked: $rust_binary"
+		fi
+	fi
+	cp -R "$stage/usr/local/." /usr/local/
+	cp -R "$stage/usr/local/." "$seed/usr/local/"
+	if [ "$origin" = devel/bmake ]; then
+		bmake=/usr/local/bin/bmake
+		[ -x "$bmake" ] || fail "staged BSD make is not executable: $bmake"
+	fi
+	if [ "$origin" = devel/gmake ]; then
+		GMAKE=/usr/local/bin/gmake
+		[ -x "$GMAKE" ] || fail "staged GNU make is not executable: $GMAKE"
+	fi
+done
+
+install -d -m 0755 "$seed/usr/local/src"
+cp -R "$ports_dir" "$seed/usr/local/src/mouse-ports"
+printf '%s\n' "built mouse-ports desktop seed"

scripts/build-pkgsrc-seed.sh

@@ -1,89 +0,0 @@
-#!/bin/sh
-set -eu
-
-archive=${MOUSE_PKGSRC_ARCHIVE:-/usr/share/mouse/pkgsrc-2026Q2.tar.gz}
-patch_file=${MOUSE_PKGSRC_PATCH:-/usr/share/mouse/pkgsrc-bootstrap-mouse.patch}
-source_parent=/usr/local/src
-pkgsrc=$source_parent/pkgsrc
-mk_conf=/usr/local/etc/mk.conf
-build_busybox=/usr/libexec/mouse-build-busybox
-
-fail() {
-    printf '%s\n' "build-pkgsrc-seed: $*" >&2
-    exit 1
-}
-
-[ "$(id -u)" -eq 0 ] || fail "must run as root"
-[ -f "$archive" ] || fail "missing pinned pkgsrc archive: $archive"
-[ -f "$patch_file" ] || fail "missing MOUSE pkgsrc bootstrap patch: $patch_file"
-[ -x "$build_busybox" ] || fail "missing build-only copy helper"
-[ ! -e /usr/local/bin/bmake ] || fail "pkgsrc seed root is not empty"
-[ ! -e /var/db/pkg ] || fail "pkgsrc package database already exists"
-
-mkdir -p \
-    "$source_parent" \
-    /usr/local/etc/rc.d \
-    /tmp \
-    /var/cache/pkgsrc/distfiles \
-    /var/cache/pkgsrc/packages
-chmod 1777 /tmp
-tar -xzf "$archive" -C "$source_parent"
-[ -x "$pkgsrc/bootstrap/bootstrap" ] || fail "archive did not produce a pkgsrc tree"
-[ -f "$pkgsrc/mk/init/bsd.init.mk" ] || fail "pkgsrc tree lacks init-system support"
-patch -d "$pkgsrc" -p1 <"$patch_file"
-grep -Fq 'bootstrap_awk=/usr/bin/awk' "$pkgsrc/bootstrap/bootstrap" ||
-    fail "pkgsrc tree lacks the MOUSE World awk policy"
-
-# Apple Rosetta reports ENOSYS for the copy operation used by MOUSE's static
-# cp. Use an amd64 build-only applet while pkgsrc populates its work directory;
-# only /usr/local and /var/db/pkg leave this stage.
-mv /bin/cp /bin/cp.mouse
-ln -s "$build_busybox" /bin/cp
-
-(
-    cd "$pkgsrc/bootstrap"
-    env \
-        AWK=/usr/bin/awk \
-        CC=/usr/bin/cc \
-        CXX=/usr/bin/c++ \
-        SH=/bin/sh \
-        ./bootstrap \
-        --compiler clang \
-        --make-jobs "${MOUSE_BUILD_JOBS:-1}" \
-        --pkgdbdir /var/db/pkg \
-        --prefer-pkgsrc yes \
-        --prefix /usr/local \
-        --sysconfbase /usr/local/etc \
-        --sysconfdir /usr/local/etc \
-        --varbase /var
-)
-
-rm /bin/cp
-mv /bin/cp.mouse /bin/cp
-rm "$build_busybox"
-
-cat >>"$mk_conf" <<'EOF'
-
-# MOUSE pkgsrc policy
-PKGSRC_COMPILER=	clang
-LOCALBASE=		/usr/local
-PKG_SYSCONFBASE=	/usr/local/etc
-PKG_DBDIR=		/var/db/pkg
-VARBASE=		/var
-DISTDIR=		/var/cache/pkgsrc/distfiles
-PACKAGES=		/var/cache/pkgsrc/packages
-INIT_SYSTEM=		rc.d
-RCD_SCRIPTS_DIR=	/usr/local/etc/rc.d
-PKG_RCD_SCRIPTS=	YES
-PREFER_PKGSRC=		yes
-EOF
-
-ln -s /etc/rc.subr /usr/local/etc/rc.subr
-rm -rf "$pkgsrc/bootstrap/work"
-
-[ -x /usr/local/bin/bmake ] || fail "bootstrap did not install bmake"
-[ -x /usr/local/sbin/pkg_info ] || fail "bootstrap did not install pkg_info"
-[ -d /var/db/pkg ] || fail "bootstrap did not create the package database"
-grep -Eq '^TOOLS_PLATFORM\.awk\?=[[:space:]]*/usr/bin/awk$' "$mk_conf" ||
-    fail "bootstrap did not preserve the World awk policy"
-printf '%s\n' "built pkgsrc 2026Q2 seed"

scripts/build-world-autotools.sh

@@ -0,0 +1,136 @@
+#!/bin/sh
+set -eu
+
+source_dir=${MOUSE_SOURCE_DIR:-/opt/mouse-sources}
+static_dir=${MOUSE_STATIC_DIR:-/work/mouse-src/build/static}
+destination=${MOUSE_AUTOTOOLS_ROOT:-/opt/mouse-autotools}
+jobs=${MOUSE_BUILD_JOBS:-1}
+
+case "$destination" in
+	/opt/mouse-autotools) ;;
+	*)
+		printf '%s\n' "refusing unexpected autotools destination: $destination" >&2
+		exit 1
+		;;
+esac
+
+build_root=$(mktemp -d /tmp/mouse-autotools.XXXXXX)
+cleanup()
+{
+	rm -rf "$build_root"
+}
+trap cleanup EXIT HUP INT TERM
+
+install -d -m 0755 "$destination" "$build_root/bin"
+extract()
+{
+	archive=$1
+	[ -f "$source_dir/$archive" ] || {
+		printf '%s\n' "missing World source: $archive" >&2
+		exit 1
+	}
+	tar -xf "$source_dir/$archive" -C "$build_root"
+}
+
+extract m4-1.4.21.tar.xz
+extract perl-5.44.0.tar.xz
+extract autoconf-2.72.tar.xz
+extract automake-1.16.3.tar.xz
+
+cc=$(find "$static_dir/cross-tools/bin" -name '*-cc' -type l -print | head -1)
+ar=$(find "$static_dir/cross-tools/bin" -name '*-ar' -type l -print | head -1)
+ranlib=$(find "$static_dir/cross-tools/bin" -name '*-ranlib' -type l -print | head -1)
+for tool in "$cc" "$ar" "$ranlib"; do
+	[ -x "$tool" ] || {
+		printf '%s\n' "missing MOUSE cross-build tool: $tool" >&2
+		exit 1
+	}
+done
+ln -s "$(command -v llvm-nm)" "$build_root/bin/nm"
+PATH="$build_root/bin:$PATH"
+export PATH
+
+(
+	cd "$build_root/m4-1.4.21"
+	CC="$cc" AR="$ar" RANLIB="$ranlib" \
+		CFLAGS=-O2 LDFLAGS=-static \
+		./configure \
+		--prefix=/usr \
+		--disable-dependency-tracking \
+		--disable-nls
+	make -s -j"$jobs"
+	make -s DESTDIR="$destination" install
+)
+
+(
+	cd "$build_root/perl-5.44.0"
+	sh Configure -des \
+		-Dprefix=/usr \
+		-Dvendorprefix=/usr \
+		-Dsiteprefix=/usr/local \
+		-Dman1dir=/usr/share/man/man1 \
+		-Dman3dir=/usr/share/man/man3 \
+		-Dcc="$cc" \
+		-Dld="$cc" \
+		-Dar="$ar" \
+		-Dnm=nm \
+		-Dranlib="$ranlib" \
+		-Dccflags=-O2 \
+		-Dldflags=-static \
+		-Doptimize=-O2 \
+		-Duseithreads \
+		-Uusedl \
+		-Uuseshrplib
+	make -s -j"$jobs"
+	make -s install DESTDIR="$destination"
+)
+
+# Autoconf is architecture-independent, but configure must record the paths
+# that exist in the finished MOUSE image rather than the staging prefix.
+install -m 0755 "$destination/usr/bin/m4" /usr/bin/m4
+(
+	cd "$build_root/autoconf-2.72"
+	PERL=/usr/bin/perl M4=/usr/bin/m4 \
+		./configure \
+		--prefix=/usr
+	make -s -j"$jobs"
+	make -s DESTDIR="$destination" install
+)
+
+# Automake's build needs the Autoconf we just staged.  Its installed scripts
+# record the final /usr paths, so mirror those files into this disposable
+# builder rather than teaching the finished image about a staging prefix.
+for tool in autoconf autoheader autom4te autoreconf autoscan autoupdate ifnames; do
+	install -m 0755 "$destination/usr/bin/$tool" "/usr/bin/$tool"
+done
+cp -R "$destination/usr/share/autoconf" /usr/share/autoconf
+
+(
+	cd "$build_root/automake-1.16.3"
+	PERL=/usr/bin/perl ./configure --prefix=/usr
+	make -s -j"$jobs"
+	make -s DESTDIR="$destination" install
+)
+
+for executable in "$destination/usr/bin/m4" "$destination/usr/bin/perl"; do
+	readelf -l "$executable" | grep -q INTERP && {
+		printf '%s\n' "World executable is dynamically linked: $executable" >&2
+		exit 1
+	}
+	readelf -d "$executable" 2>/dev/null | grep -q NEEDED && {
+		printf '%s\n' "World executable has a dynamic dependency: $executable" >&2
+		exit 1
+	}
+done
+
+"$destination/usr/bin/m4" --version | grep -Fq 'm4 (GNU M4) 1.4.21'
+PERL5LIB="$destination/usr/share/automake-1.16" \
+	"$destination/usr/bin/automake-1.16" --version |
+	grep -Fq 'automake (GNU automake) 1.16.3'
+perl_config=$(find "$destination/usr/lib/perl5/5.44.0" -name Config.pm -type f -print | head -1)
+[ -n "$perl_config" ] || {
+	printf '%s\n' 'World Perl installation is missing Config.pm' >&2
+	exit 1
+}
+PERL5LIB="$destination/usr/lib/perl5/5.44.0:$(dirname "$perl_config")" \
+	"$destination/usr/bin/perl" -e 'use Config; die if $Config{usedl} eq "define"'

scripts/check-source-locks.sh

@@ -16,15 +16,20 @@ MOUSE_VALIDATE_ONLY=1 "$script_dir/fetch-sources.sh"
 awk 'NF && $1 !~ /^#/ { print $3 }' \
     "$lock_dir/toolchain.lock" \
     "$lock_dir/kernel.lock" \
+    "$lock_dir/wireless.lock" \
+    "$lock_dir/autotools.lock" \
     "$lock_dir/facilities.lock" \
     "$lock_dir/storage.lock" \
     "$lock_dir/software.lock" |
     LC_ALL=C sort -u >"$temporary/locked"
 
-awk '$1 == "extract" { print $2 }' "$script_dir/static-base"/*.sh |
+awk '$1 == "extract" { print $2 }' \
+    "$script_dir/static-base"/*.sh \
+    "$script_dir/build-world-autotools.sh" |
     LC_ALL=C sort -u >"$temporary/referenced-archives"
 sed -n 's/.*"$source_dir\/\([^"$]*\)".*/\1/p' \
     "$script_dir/static-base"/*.sh \
+    "$script_dir/build-world-autotools.sh" \
     "$script_dir/build-boot-disk.sh" |
     LC_ALL=C sort -u >"$temporary/referenced-files"
 cat "$temporary/referenced-archives" "$temporary/referenced-files" |
@@ -53,22 +58,40 @@ then
     printf '%s\n' "kernel.lock must contain exactly the Linux source" >&2
     exit 1
 fi
-pkgsrc_count=$(awk 'NF && $1 !~ /^#/ { count++ } END { print count + 0 }' \
-    "$lock_dir/pkgsrc.lock")
-if [ "$pkgsrc_count" -ne 1 ] || \
-    ! awk 'NF && $1 !~ /^#/ { print $3 }' "$lock_dir/pkgsrc.lock" |
-        grep -Eq '^pkgsrc-[0-9]{4}Q[1-4]\.tar\.gz$'
-then
-    printf '%s\n' "pkgsrc.lock must contain exactly one stable pkgsrc archive" >&2
-    exit 1
-fi
 firmware_count=$(awk 'NF && $1 !~ /^#/ { count++ } END { print count + 0 }' \
     "$lock_dir/firmware.lock")
-if [ "$firmware_count" -ne 1 ] || \
-    ! awk 'NF && $1 !~ /^#/ { print $3 }' "$lock_dir/firmware.lock" |
-        grep -Eq '^ovmf-[^/]+\.apk$'
+firmware_names=$(awk 'NF && $1 !~ /^#/ { print $3 }' \
+    "$lock_dir/firmware.lock")
+if [ "$firmware_count" -ne 2 ] || \
+    [ "$(printf '%s\n' "$firmware_names" | grep -Ec '^aavmf-[^/]+\.apk$')" -ne 1 ] || \
+    [ "$(printf '%s\n' "$firmware_names" | grep -Ec '^ovmf-[^/]+\.apk$')" -ne 1 ]
 then
-    printf '%s\n' "firmware.lock must contain exactly one OVMF package" >&2
+    printf '%s\n' \
+        "firmware.lock must contain exactly one AAVMF and one OVMF package" >&2
+    exit 1
+fi
+device_firmware_count=$(awk 'NF && $1 !~ /^#/ { count++ } END { print count + 0 }' \
+    "$lock_dir/device-firmware.lock")
+if [ "$device_firmware_count" -ne 1 ] || \
+    ! awk 'NF && $1 !~ /^#/ { print $3 }' "$lock_dir/device-firmware.lock" |
+        grep -Eq '^linux-firmware-[0-9]{8}\.tar\.xz$'
+then
+    printf '%s\n' \
+        "device-firmware.lock must contain exactly one linux-firmware archive" >&2
+    exit 1
+fi
+autotools_count=$(awk 'NF && $1 !~ /^#/ { count++ } END { print count + 0 }' \
+    "$lock_dir/autotools.lock")
+autotools_names=$(awk 'NF && $1 !~ /^#/ { print $3 }' \
+    "$lock_dir/autotools.lock")
+if [ "$autotools_count" -ne 4 ] || \
+    [ "$(printf '%s\n' "$autotools_names" | grep -Ec '^m4-[^/]+\.tar\.xz$')" -ne 1 ] || \
+    [ "$(printf '%s\n' "$autotools_names" | grep -Ec '^perl-[^/]+\.tar\.xz$')" -ne 1 ] || \
+    [ "$(printf '%s\n' "$autotools_names" | grep -Ec '^autoconf-[^/]+\.tar\.xz$')" -ne 1 ] || \
+    [ "$(printf '%s\n' "$autotools_names" | grep -Ec '^automake-1\.16\.[^/]+\.tar\.xz$')" -ne 1 ]
+then
+    printf '%s\n' \
+        "autotools.lock must contain GNU m4, Perl, Autoconf, and Automake 1.16" >&2
     exit 1
 fi
 storage_count=$(awk 'NF && $1 !~ /^#/ { count++ } END { print count + 0 }' \
@@ -81,11 +104,20 @@ then
     exit 1
 fi
 if awk 'NF && $1 !~ /^#/ { print $3 }' "$lock_dir/software.lock" |
-    grep -Eq '^(llvm-project|linux|btrfs-progs|less|mandoc|iproute2|nftables)-'
+    grep -Eq '^(llvm-project|linux|btrfs-progs|m4|perl|autoconf|automake|less|mandoc|iproute2|nftables)-'
 then
     printf '%s\n' "software.lock contains a source owned by another cache domain" >&2
     exit 1
 fi
+if [ "$(awk 'NF && $1 !~ /^#/ && $3 ~ /^gardendevd-/ { count++ } END { print count + 0 }' \
+    "$lock_dir/software.lock")" -ne 1 ] || \
+    ! grep -Fq \
+        'gardendevd-611350ed44a116cffe6a53bbe8cfb13c721718f1.tar' \
+        "$lock_dir/software.lock"
+then
+    printf '%s\n' "software.lock must pin the audited gardendevd commit" >&2
+    exit 1
+fi
 if awk 'NF && $1 !~ /^#/ { print $3 }' "$lock_dir/facilities.lock" |
     grep -Eq '^(llvm-project|linux|btrfs-progs)-'
 then
@@ -131,6 +163,7 @@ for stage_script in \
     static-base-bootstrap:bootstrap.sh \
     static-base-libraries:libraries-and-accounts.sh \
     static-base-system:system-services.sh \
+    static-base-wireless:wireless.sh \
     static-base-facilities:facilities.sh \
     static-base-toolchain:native-toolchain.sh \
     static-base-storage:storage.sh \

scripts/configure-cross-toolchain.sh

@@ -9,6 +9,7 @@ fi
 
 script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 repo_dir=$(dirname "$script_dir")
+. "$script_dir/mouse-arch.sh"
 destination=$1
 sysroot=$2
 clang=$3
@@ -18,7 +19,7 @@ builtins=$6
 rust_eh_personality=$7
 llvm_ar=$8
 llvm_strip=$9
-target=x86_64-mouse-linux-musl
+target=$MOUSE_CROSS_TARGET
 
 for requirement in \
     "$clang" "$clangxx" "$lld" "$builtins" "$rust_eh_personality" "$llvm_ar" "$llvm_strip"
@@ -41,6 +42,7 @@ printf '%s\n' \
     "$lld" \
     "$builtins" \
     "$rust_eh_personality" \
+    "$MOUSE_RUST_TARGET" \
     >"$destination/compiler.conf"
 
 ln -sf compiler-driver "$destination/bin/$target-cc"

scripts/extract-build-firmware.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+set -eu
+
+case "${MOUSE_ARCH:-}" in
+    x86_64)
+        firmware_apk=ovmf-0.0.202605-r0.apk
+        firmware_path=usr/share/OVMF/OVMF_CODE.fd
+        ;;
+    aarch64)
+        firmware_apk=aavmf-0.0.202605-r0.apk
+        firmware_path=usr/share/AAVMF/AAVMF_CODE.fd
+        ;;
+    *)
+        printf '%s\n' "unsupported MOUSE architecture: ${MOUSE_ARCH:-unset}" >&2
+        exit 2
+        ;;
+esac
+
+install -d -m 0755 /opt/firmware
+tar -xf "/opt/mouse-sources/$firmware_apk" \
+    -C /opt/firmware \
+    "$firmware_path"
+install -m 0644 "/opt/firmware/$firmware_path" /uefi-code.fd

scripts/fetch-sources.sh

@@ -3,8 +3,8 @@ set -eu
 
 script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 repo_dir=$(dirname "$script_dir")
-build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
-source_dir=${MOUSE_SOURCE_DIR:-"$build_dir/sources"}
+. "$script_dir/mouse-arch.sh"
+source_dir=${MOUSE_SOURCE_DIR:-"$repo_dir/build/sources"}
 lock_dir="$repo_dir/release"
 
 if [ "$#" -eq 0 ]; then
@@ -12,15 +12,19 @@ if [ "$#" -eq 0 ]; then
         "$lock_dir/toolchain.lock" \
         "$lock_dir/kernel.lock" \
         "$lock_dir/firmware.lock" \
+        "$lock_dir/device-firmware.lock" \
+        "$lock_dir/wireless.lock" \
+        "$lock_dir/autotools.lock" \
         "$lock_dir/facilities.lock" \
-        "$lock_dir/pkgsrc.lock" \
         "$lock_dir/storage.lock" \
         "$lock_dir/software.lock"
 fi
 
 seen=$(mktemp "${TMPDIR:-/tmp}/mouse-source-locks.XXXXXX")
+repository=
 cleanup() {
     rm -f "$seen"
+    [ -z "$repository" ] || rm -rf "$repository"
 }
 trap cleanup EXIT HUP INT TERM
 
@@ -75,6 +79,7 @@ if [ "${MOUSE_VALIDATE_ONLY:-0}" = 1 ]; then
 fi
 
 mkdir -p "$source_dir"
+source_dir=$(CDPATH= cd -- "$source_dir" && pwd)
 
 for lock_file in "$@"; do
     while read -r expected url filename extra; do
@@ -86,16 +91,47 @@ for lock_file in "$@"; do
         if [ ! -f "$destination" ]; then
             temporary="$destination.part"
             printf '%s\n' "fetching $filename"
-            curl \
-                --fail \
-                --location \
-                --proto '=https' \
-                --tlsv1.2 \
-                --connect-timeout 20 \
-                --retry 4 \
-                --retry-all-errors \
-                "$url" \
-                -o "$temporary"
+            case "$url" in
+                *.git)
+                    project=${url##*/}
+                    project=${project%.git}
+                    revision=${filename#"$project-"}
+                    revision=${revision%.tar}
+                    case "$revision" in
+                        ????????????????????????????????????????) ;;
+                        *) printf '%s\n' "invalid Git archive revision: $filename" >&2; exit 1 ;;
+                    esac
+                    case "$revision" in
+                        *[!0-9a-f]*) printf '%s\n' "invalid Git revision: $revision" >&2; exit 1 ;;
+                    esac
+                    repository=$(mktemp -d "${TMPDIR:-/tmp}/mouse-git-source.XXXXXX")
+                    if git clone --quiet --no-checkout \
+                        "$url" "$repository" &&
+                        git -C "$repository" cat-file -e "$revision^{commit}" &&
+                        git -C "$repository" archive --format=tar \
+                            --prefix="$project/" -o "$temporary" "$revision"
+                    then
+                        :
+                    else
+                        rm -rf "$repository" "$temporary"
+                        exit 1
+                    fi
+                    rm -rf "$repository"
+                    repository=
+                    ;;
+                *)
+                    curl \
+                        --fail \
+                        --location \
+                        --proto '=https' \
+                        --tlsv1.2 \
+                        --connect-timeout 20 \
+                        --retry 4 \
+                        --retry-all-errors \
+                        "$url" \
+                        -o "$temporary"
+                    ;;
+            esac
             mv "$temporary" "$destination"
         fi
 
@@ -112,3 +148,23 @@ for lock_file in "$@"; do
         fi
     done <"$lock_file"
 done
+
+command -v cargo >/dev/null 2>&1 || {
+    printf '%s\n' "cargo is required to prefetch cheesed dependencies" >&2
+    exit 1
+}
+cargo_home="$source_dir/cargo"
+mkdir -p "$cargo_home"
+if ! CARGO_HOME="$cargo_home" cargo fetch \
+    --locked \
+    --offline \
+    --target "$MOUSE_RUST_TARGET" \
+    --manifest-path "$repo_dir/base/cheesed/Cargo.toml" \
+    2>/dev/null
+then
+    printf '%s\n' "fetching locked cheesed dependencies"
+    CARGO_HOME="$cargo_home" cargo fetch \
+        --locked \
+        --target "$MOUSE_RUST_TARGET" \
+        --manifest-path "$repo_dir/base/cheesed/Cargo.toml"
+fi

scripts/mouse-arch.sh

@@ -0,0 +1,94 @@
+#!/bin/sh
+
+# MOUSE_ARCH describes the guest system. It is deliberately independent of
+# MOUSE_BUILDER_PLATFORM, which describes the container host used to build it.
+if [ -n "${MOUSE_ARCH:-}" ]; then
+    mouse_arch=$MOUSE_ARCH
+elif [ -n "${MOUSE_BUILDER_PLATFORM:-}" ]; then
+    case "$MOUSE_BUILDER_PLATFORM" in
+        linux/amd64|linux/x86_64) mouse_arch=x86_64 ;;
+        linux/arm64|linux/arm64/v8|linux/aarch64) mouse_arch=aarch64 ;;
+        *)
+            printf '%s\n' \
+                "cannot derive MOUSE_ARCH from MOUSE_BUILDER_PLATFORM: $MOUSE_BUILDER_PLATFORM" >&2
+            return 2 2>/dev/null || exit 2
+            ;;
+    esac
+else
+    mouse_arch=$(uname -m)
+fi
+case "$mouse_arch" in
+    x86_64|amd64) MOUSE_ARCH=x86_64 ;;
+    aarch64|arm64) MOUSE_ARCH=aarch64 ;;
+    *)
+        printf '%s\n' "unsupported MOUSE architecture: $mouse_arch" >&2
+        return 2 2>/dev/null || exit 2
+        ;;
+esac
+
+case "$MOUSE_ARCH" in
+    x86_64)
+        MOUSE_RUST_TARGET=x86_64-unknown-linux-musl
+        MOUSE_GNU_TARGET=x86_64-linux-musl
+        MOUSE_CROSS_TARGET=x86_64-mouse-linux-musl
+        MOUSE_MUSL_TARGET=x86_64
+        MOUSE_KERNEL_ARCH=x86
+        MOUSE_KERNEL_BUILD_PATH=arch/x86/boot/bzImage
+        MOUSE_KERNEL_TARGET=bzImage
+        MOUSE_LLVM_TARGET=X86
+        MOUSE_CMAKE_PROCESSOR=x86_64
+        MOUSE_COMPILER_RT_ARCH=x86_64
+        MOUSE_OPENSSL_TARGET=linux-x86_64
+        MOUSE_MUSL_LOADER=ld-musl-x86_64.so.1
+        MOUSE_EFI_LOADER=BOOTX64.EFI
+        MOUSE_FIRMWARE_APK=ovmf-0.0.202605-r0.apk
+        MOUSE_FIRMWARE_PATH=usr/share/OVMF/OVMF_CODE.fd
+        MOUSE_TARGET_CONTAINER_PLATFORM=linux/amd64
+        MOUSE_QEMU_SYSTEM=qemu-system-x86_64
+        MOUSE_QEMU_MACHINE=q35
+        MOUSE_CONSOLE=ttyS0
+        ;;
+    aarch64)
+        MOUSE_RUST_TARGET=aarch64-unknown-linux-musl
+        MOUSE_GNU_TARGET=aarch64-linux-musl
+        MOUSE_CROSS_TARGET=aarch64-mouse-linux-musl
+        MOUSE_MUSL_TARGET=aarch64
+        MOUSE_KERNEL_ARCH=arm64
+        MOUSE_KERNEL_BUILD_PATH=arch/arm64/boot/Image
+        MOUSE_KERNEL_TARGET=Image
+        MOUSE_LLVM_TARGET=AArch64
+        MOUSE_CMAKE_PROCESSOR=aarch64
+        MOUSE_COMPILER_RT_ARCH=aarch64
+        MOUSE_OPENSSL_TARGET=linux-aarch64
+        MOUSE_MUSL_LOADER=ld-musl-aarch64.so.1
+        MOUSE_EFI_LOADER=BOOTAA64.EFI
+        MOUSE_FIRMWARE_APK=aavmf-0.0.202605-r0.apk
+        MOUSE_FIRMWARE_PATH=usr/share/AAVMF/AAVMF_CODE.fd
+        MOUSE_TARGET_CONTAINER_PLATFORM=linux/arm64
+        MOUSE_QEMU_SYSTEM=qemu-system-aarch64
+        MOUSE_QEMU_MACHINE=virt
+        MOUSE_CONSOLE=ttyAMA0
+        ;;
+esac
+
+export \
+    MOUSE_ARCH \
+    MOUSE_RUST_TARGET \
+    MOUSE_GNU_TARGET \
+    MOUSE_CROSS_TARGET \
+    MOUSE_MUSL_TARGET \
+    MOUSE_KERNEL_ARCH \
+    MOUSE_KERNEL_BUILD_PATH \
+    MOUSE_KERNEL_TARGET \
+    MOUSE_LLVM_TARGET \
+    MOUSE_CMAKE_PROCESSOR \
+    MOUSE_COMPILER_RT_ARCH \
+    MOUSE_OPENSSL_TARGET \
+    MOUSE_MUSL_LOADER \
+    MOUSE_EFI_LOADER \
+    MOUSE_FIRMWARE_APK \
+    MOUSE_FIRMWARE_PATH \
+    MOUSE_TARGET_CONTAINER_PLATFORM \
+    MOUSE_QEMU_SYSTEM \
+    MOUSE_QEMU_MACHINE \
+    MOUSE_CONSOLE

scripts/run-qemu.sh

@@ -3,22 +3,33 @@ set -eu
 
 script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 repo_dir=$(dirname "$script_dir")
-build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
+. "$script_dir/mouse-arch.sh"
+build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build/$MOUSE_ARCH"}
 boot_mode=${MOUSE_BOOT_MODE:-firmware}
 kernel_args=${MOUSE_KERNEL_ARGS:-}
 disk_image=${MOUSE_DISK_IMAGE:-"$build_dir/mouse-disk.img"}
 disk_bus=${MOUSE_DISK_BUS:-virtio}
-firmware=${MOUSE_FIRMWARE:-bios}
-uefi_code=${MOUSE_UEFI_CODE:-"$build_dir/ovmf-code.fd"}
+if [ "$MOUSE_ARCH" = x86_64 ]; then
+    default_firmware=bios
+else
+    default_firmware=uefi
+fi
+firmware=${MOUSE_FIRMWARE:-$default_firmware}
+uefi_code=${MOUSE_UEFI_CODE:-"$build_dir/uefi-code.fd"}
 network=${MOUSE_NETWORK:-0}
 network_backend=${MOUSE_NETWORK_BACKEND:-user}
 network_device=${MOUSE_NETWORK_DEVICE:-virtio}
 memory=${MOUSE_MEMORY:-512M}
+graphical=${MOUSE_GRAPHICAL:-0}
 
-if [ -n "${QEMU_SYSTEM_X86_64:-}" ]; then
+if [ -n "${MOUSE_QEMU:-}" ]; then
+    qemu=$MOUSE_QEMU
+elif [ "$MOUSE_ARCH" = x86_64 ] && [ -n "${QEMU_SYSTEM_X86_64:-}" ]; then
     qemu=$QEMU_SYSTEM_X86_64
+elif [ "$MOUSE_ARCH" = aarch64 ] && [ -n "${QEMU_SYSTEM_AARCH64:-}" ]; then
+    qemu=$QEMU_SYSTEM_AARCH64
 else
-    qemu=qemu-system-x86_64
+    qemu=$MOUSE_QEMU_SYSTEM
 fi
 
 case "$qemu" in
@@ -30,7 +41,7 @@ case "$qemu" in
         ;;
     *)
         if ! command -v "$qemu" >/dev/null 2>&1; then
-            printf '%s\n' "qemu-system-x86_64 is required to boot the image" >&2
+            printf '%s\n' "$MOUSE_QEMU_SYSTEM is required to boot the image" >&2
             exit 1
         fi
         ;;
@@ -48,7 +59,7 @@ case "$disk_bus" in
         disk_device="virtio-blk-pci,drive=mouse-root,disable-legacy=on"
         ;;
     sata)
-        disk_controller="ich9-ahci,id=mouse-ahci"
+        disk_controller="ahci,id=mouse-ahci"
         disk_device="ide-hd,drive=mouse-root,bus=mouse-ahci.0"
         ;;
     nvme)
@@ -61,16 +72,39 @@ case "$disk_bus" in
 esac
 
 set -- "$qemu" \
-    -machine q35,accel=tcg \
+    -machine "$MOUSE_QEMU_MACHINE,accel=tcg" \
     -cpu max \
     -m "$memory" \
     -no-reboot \
-    -display none \
-    -nographic \
     -nic none
 
+case "$graphical" in
+    0)
+        if [ "$MOUSE_ARCH" = aarch64 ]; then
+            set -- "$@" -device virtio-gpu-pci
+        fi
+        set -- "$@" -display none -nographic
+        ;;
+    1)
+        set -- "$@" \
+            -device virtio-gpu-pci \
+            -device virtio-keyboard-pci \
+            -device virtio-tablet-pci \
+            -serial stdio
+        ;;
+    *)
+        printf '%s\n' "invalid MOUSE_GRAPHICAL: $graphical" >&2
+        exit 2
+        ;;
+esac
+
 case "$firmware" in
-    bios) ;;
+    bios)
+        if [ "$MOUSE_ARCH" != x86_64 ]; then
+            printf '%s\n' "BIOS boot is only supported for MOUSE_ARCH=x86_64" >&2
+            exit 2
+        fi
+        ;;
     uefi)
         if [ ! -f "$uefi_code" ]; then
             printf '%s\n' "missing pinned UEFI firmware: $uefi_code" >&2
@@ -102,7 +136,7 @@ case "$boot_mode" in
             printf '%s\n' "missing root disk: $disk_image" >&2
             exit 1
         fi
-        kernel_args=${kernel_args:-"console=ttyS0 root=PARTUUID=4d4f5553-4500-4000-8000-000000000002 rootfstype=btrfs rw rootwait init=/sbin/cheesed panic=-1"}
+        kernel_args=${kernel_args:-"console=$MOUSE_CONSOLE root=PARTUUID=4d4f5553-4500-4000-8000-000000000002 rootfstype=btrfs rw rootwait init=/sbin/cheesed panic=-1"}
         set -- "$@" \
             -kernel "$build_dir/vmlinuz-virt" \
             -drive "$disk_drive"
@@ -120,7 +154,7 @@ esac
 case "$network" in
     0) ;;
     1)
-        if ! "$qemu" -netdev help 2>&1 |
+        if ! "$qemu" -machine "$MOUSE_QEMU_MACHINE" -netdev help 2>&1 |
             grep -Fxq "$network_backend"; then
             printf '%s\n' \
                 "QEMU does not provide the requested network backend: $network_backend" \

scripts/static-base/bootstrap.sh

@@ -24,78 +24,91 @@ extract() {
     tar -xf "$source_dir/$1" -C "$source_build_dir"
 }
 
-extract meson-1.9.1.tar.gz
-extract ninja-1.13.1.tar.gz
-extract pkgconf-2.5.1.tar.gz
-extract linux-6.18.35.tar.xz
+extract meson-1.11.2.tar.gz
+extract ninja-1.13.2.tar.gz
+extract pkgconf-3.0.5.tar.gz
+extract linux-7.1.6.tar.xz
 extract musl-1.2.6.tar.gz
 extract zlib-1.3.2.tar.gz
-extract libarchive-3.8.7.tar.xz
-extract llvm-project-22.1.3.src.tar.xz
+extract libarchive-3.8.9.tar.xz
+extract llvm-project-22.1.8.src.tar.xz
 extract netbsd-curses-0.3.2.tar.gz
-extract attr-2.5.2.tar.gz
-extract acl-2.3.2.tar.gz
+extract attr-2.6.0.tar.gz
+extract acl-2.4.0.tar.gz
 extract libxo-1.7.5.tar.gz
 extract tcsh-6.24.16.tar.gz
 extract chimerautils-15.0.3.tar.gz
-extract openssl-3.5.7.tar.gz
+extract openssl-4.0.1.tar.gz
 extract util-linux-2.42.2.tar.xz
 extract libxcrypt-4.5.2.tar.xz
-extract shadow-4.19.4.tar.xz
-extract dhcpcd-8b312918d8f1885d7fe8fcc03a7e06ae8a0314b4.tar.gz
+extract shadow-4.20.0.tar.xz
+extract opendoas-6.8.2.tar.xz
+extract dhcpcd-e3363cf477aa53d4ed74d00ce5d3d4c7e5b7f2c3.tar.gz
 extract make-4.4.1.tar.gz
 extract cronie-1.7.2.tar.gz
 extract openntpd-7.9p1.tar.gz
-extract procps-ng-4.0.5.tar.xz
+extract procps-ng-4.0.6.tar.xz
 extract iputils-20250605.tar.gz
 extract kmod-34.2.tar.xz
-extract skalibs-2.15.1.0.tar.gz
-extract mdevd-0.1.8.2.tar.gz
+extract gardendevd-611350ed44a116cffe6a53bbe8cfb13c721718f1.tar
 extract sysklogd-2.7.2.tar.gz
 
 (
-    cd "$source_build_dir/ninja-1.13.1"
+    cd "$source_build_dir/ninja-1.13.2"
     python3 configure.py --bootstrap
     install -m 0755 ninja "$tools_dir/bin/ninja"
 )
 
-meson_source="$source_build_dir/meson-1.9.1/meson.py"
+meson_source="$source_build_dir/meson-1.11.2/meson.py"
 PATH="$tools_dir/bin:$PATH"
 export PATH
 
 python3 "$meson_source" setup \
-    "$source_build_dir/pkgconf-pkgconf-2.5.1/build" \
-    "$source_build_dir/pkgconf-pkgconf-2.5.1" \
+    "$source_build_dir/pkgconf-pkgconf-3.0.5/build" \
+    "$source_build_dir/pkgconf-pkgconf-3.0.5" \
     --prefix="$tools_dir" \
     --buildtype=release \
     --default-library=static
-python3 "$meson_source" compile -C "$source_build_dir/pkgconf-pkgconf-2.5.1/build"
-python3 "$meson_source" install -C "$source_build_dir/pkgconf-pkgconf-2.5.1/build"
+python3 "$meson_source" compile -C "$source_build_dir/pkgconf-pkgconf-3.0.5/build"
+python3 "$meson_source" install -C "$source_build_dir/pkgconf-pkgconf-3.0.5/build"
 
-musl_cc="$clang --target=x86_64-unknown-linux-musl --ld-path=$lld"
-musl_mulxc3="$static_dir/musl-mulxc3.o"
+musl_cc="$clang --target=$MOUSE_RUST_TARGET --ld-path=$lld"
+rust_eh_personality="$static_dir/rust-eh-personality.o"
 "$clang" \
-    --target=x86_64-unknown-linux-musl \
+    --target="$MOUSE_RUST_TARGET" \
     --sysroot="$sysroot" \
-    -fPIC \
-    -I"$source_build_dir/llvm-project-22.1.3.src/compiler-rt/lib/builtins" \
-    -c "$source_build_dir/llvm-project-22.1.3.src/compiler-rt/lib/builtins/mulxc3.c" \
-    -o "$musl_mulxc3"
+    -c "$repo_dir/base/support/rust-eh-personality.c" \
+    -o "$rust_eh_personality"
+musl_libcc="$builtins $rust_eh_personality"
+if [ "$MOUSE_ARCH" = x86_64 ]; then
+    # Rust's x86_64 musl builtins omit the 80-bit long-double complex helper
+    # required by musl. AArch64 uses 128-bit long double and its target archive
+    # already provides the corresponding helper.
+    musl_mulxc3="$static_dir/musl-mulxc3.o"
+    "$clang" \
+        --target="$MOUSE_RUST_TARGET" \
+        --sysroot="$sysroot" \
+        -fPIC \
+        -I"$source_build_dir/llvm-project-22.1.8.src/compiler-rt/lib/builtins" \
+        -c "$source_build_dir/llvm-project-22.1.8.src/compiler-rt/lib/builtins/mulxc3.c" \
+        -o "$musl_mulxc3"
+    musl_libcc="$musl_libcc $musl_mulxc3"
+fi
 (
     cd "$source_build_dir/musl-1.2.6"
     CC="$musl_cc" \
         AR="$llvm_ar" \
         RANLIB="$llvm_ranlib" \
         ./configure \
-        --target=x86_64 \
+        --target="$MOUSE_MUSL_TARGET" \
         --prefix=/usr \
         --syslibdir=/lib
-    make -s -j"$jobs" LIBCC="$builtins $musl_mulxc3"
-    make -s DESTDIR="$sysroot" LIBCC="$builtins $musl_mulxc3" install
+    make -s -j"$jobs" LIBCC="$musl_libcc"
+    make -s DESTDIR="$sysroot" LIBCC="$musl_libcc" install
 )
 
-make -s -C "$source_build_dir/linux-6.18.35" \
-    ARCH=x86 \
+make -s -C "$source_build_dir/linux-7.1.6" \
+    ARCH="$MOUSE_KERNEL_ARCH" \
     headers_install \
     INSTALL_HDR_PATH="$sysroot/usr"
 
@@ -105,13 +118,6 @@ install -m 0644 "$source_dir/queue.h" "$sysroot/usr/include/sys/queue.h"
 install -m 0644 "$source_dir/tree.h" "$sysroot/usr/include/sys/tree.h"
 install -m 0644 "$source_dir/error.h" "$sysroot/usr/include/error.h"
 
-rust_eh_personality="$static_dir/rust-eh-personality.o"
-"$clang" \
-    --target=x86_64-unknown-linux-musl \
-    --sysroot="$sysroot" \
-    -c "$repo_dir/base/support/rust-eh-personality.c" \
-    -o "$rust_eh_personality"
-
 "$script_dir/configure-cross-toolchain.sh" \
     "$cross_tools_dir" \
     "$sysroot" \
@@ -123,7 +129,7 @@ rust_eh_personality="$static_dir/rust-eh-personality.o"
     "$llvm_ar" \
     "$llvm_strip"
 
-target=x86_64-mouse-linux-musl
+target=$MOUSE_CROSS_TARGET
 cc="$cross_tools_dir/bin/$target-cc"
 cxx="$cross_tools_dir/bin/$target-c++"
 bootstrap_cxx="$cross_tools_dir/bin/$target-bootstrap-c++"
@@ -134,17 +140,18 @@ strip="$cross_tools_dir/bin/$target-strip"
 llvm_runtimes_build="$source_build_dir/llvm-runtimes-build"
 cmake \
     -G Ninja \
-    -S "$source_build_dir/llvm-project-22.1.3.src/runtimes" \
+    -S "$source_build_dir/llvm-project-22.1.8.src/runtimes" \
     -B "$llvm_runtimes_build" \
     -DCMAKE_BUILD_TYPE=Release \
     -DCMAKE_INSTALL_PREFIX=/usr \
     -DCMAKE_C_COMPILER="$cc" \
-    -DCMAKE_C_COMPILER_TARGET=x86_64-unknown-linux-musl \
+    -DCMAKE_C_COMPILER_TARGET="$MOUSE_RUST_TARGET" \
     -DCMAKE_CXX_COMPILER="$bootstrap_cxx" \
-    -DCMAKE_CXX_COMPILER_TARGET=x86_64-unknown-linux-musl \
+    -DCMAKE_CXX_COMPILER_TARGET="$MOUSE_RUST_TARGET" \
     -DCMAKE_AR="$ar" \
     -DCMAKE_RANLIB="$ranlib" \
     -DCMAKE_SYSTEM_NAME=Linux \
+    -DCMAKE_SYSTEM_PROCESSOR="$MOUSE_CMAKE_PROCESSOR" \
     -DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY \
     -DLLVM_ENABLE_RUNTIMES="compiler-rt;libcxx;libcxxabi;libunwind" \
     -DLLVM_ENABLE_PER_TARGET_RUNTIME_DIR=OFF \
@@ -176,26 +183,40 @@ cmake \
 cmake --build "$llvm_runtimes_build" -j "$jobs"
 DESTDIR="$sysroot" cmake --install "$llvm_runtimes_build"
 
-clang_runtime_dir="$sysroot/usr/lib/clang/22/lib/x86_64-unknown-linux-musl"
+clang_runtime_dir=$compiler_rt_dir
 install -d -m 0755 "$clang_runtime_dir"
 install -m 0644 \
-    "$sysroot/usr/lib/linux/libclang_rt.builtins-x86_64.a" \
+    "$sysroot/usr/lib/linux/libclang_rt.builtins-$MOUSE_COMPILER_RT_ARCH.a" \
     "$clang_runtime_dir/libclang_rt.builtins.a"
 for runtime_object in \
-    clang_rt.crtbegin-x86_64.o \
-    clang_rt.crtend-x86_64.o
+    "clang_rt.crtbegin-$MOUSE_COMPILER_RT_ARCH.o" \
+    "clang_rt.crtend-$MOUSE_COMPILER_RT_ARCH.o"
 do
     install -m 0644 \
         "$sysroot/usr/lib/linux/$runtime_object" \
         "$clang_runtime_dir/$runtime_object"
 done
 install -m 0644 \
-    "$sysroot/usr/lib/linux/clang_rt.crtbegin-x86_64.o" \
+    "$sysroot/usr/lib/linux/clang_rt.crtbegin-$MOUSE_COMPILER_RT_ARCH.o" \
     "$sysroot/usr/lib/crtbeginT.o"
 install -m 0644 \
-    "$sysroot/usr/lib/linux/clang_rt.crtend-x86_64.o" \
+    "$sysroot/usr/lib/linux/clang_rt.crtend-$MOUSE_COMPILER_RT_ARCH.o" \
     "$sysroot/usr/lib/crtend.o"
 
+# Rust's target builtins are only the seed needed to build compiler-rt. Use
+# MOUSE's complete target runtime for every later base-system link; AArch64 in
+# particular needs its instruction-cache helper when linking LLVM Support.
+"$script_dir/configure-cross-toolchain.sh" \
+    "$cross_tools_dir" \
+    "$sysroot" \
+    "$clang" \
+    "$clangxx" \
+    "$lld" \
+    "$compiler_rt" \
+    "$rust_eh_personality" \
+    "$llvm_ar" \
+    "$llvm_strip"
+
 {
     printf '%s\n' \
         '[binaries]' \
@@ -207,8 +228,8 @@ install -m 0644 \
         '' \
         '[host_machine]' \
         "system = 'linux'" \
-        "cpu_family = 'x86_64'" \
-        "cpu = 'x86_64'" \
+        "cpu_family = '$MOUSE_CMAKE_PROCESSOR'" \
+        "cpu = '$MOUSE_CMAKE_PROCESSOR'" \
         "endian = 'little'" \
         '' \
         '[built-in options]' \

scripts/static-base/common.sh

@@ -3,8 +3,9 @@
 component_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 script_dir=$(dirname "$component_dir")
 repo_dir=$(dirname "$script_dir")
-build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build"}
-source_dir=${MOUSE_SOURCE_DIR:-"$build_dir/sources"}
+. "$script_dir/mouse-arch.sh"
+build_dir=${MOUSE_BUILD_DIR:-"$repo_dir/build/$MOUSE_ARCH"}
+source_dir=${MOUSE_SOURCE_DIR:-"$repo_dir/build/sources"}
 static_dir="$build_dir/static"
 source_build_dir="$static_dir/src"
 sysroot="$static_dir/sysroot"
@@ -14,14 +15,14 @@ cross_tools_dir="$static_dir/cross-tools"
 jobs=${MOUSE_BUILD_JOBS:-$(getconf _NPROCESSORS_ONLN 2>/dev/null || printf '2')}
 
 case "$static_dir" in
-    "$repo_dir"/build/static) ;;
+    "$repo_dir"/build/static|"$repo_dir"/build/"$MOUSE_ARCH"/static) ;;
     *)
         printf '%s\n' "refusing to clear unexpected static build path: $static_dir" >&2
         exit 1
         ;;
 esac
 
-target_libdir=$(rustc --print target-libdir --target x86_64-unknown-linux-musl)
+target_libdir=$(rustc --print target-libdir --target "$MOUSE_RUST_TARGET")
 builtins=$(find "$target_libdir" -maxdepth 1 -name 'libcompiler_builtins-*.rlib' -print | head -1)
 
 clang=$(command -v clang)
@@ -42,10 +43,10 @@ do
 done
 
 llvm_ranlib="$tools_dir/bin/llvm-ranlib"
-meson_source="$source_build_dir/meson-1.9.1/meson.py"
+meson_source="$source_build_dir/meson-1.11.2/meson.py"
 PATH="$tools_dir/bin:$PATH"
 export PATH
-target=x86_64-mouse-linux-musl
+target=$MOUSE_CROSS_TARGET
 cc="$cross_tools_dir/bin/$target-cc"
 cxx="$cross_tools_dir/bin/$target-c++"
 bootstrap_cxx="$cross_tools_dir/bin/$target-bootstrap-c++"
@@ -53,3 +54,5 @@ ar="$cross_tools_dir/bin/$target-ar"
 ranlib="$cross_tools_dir/bin/$target-ranlib"
 strip="$cross_tools_dir/bin/$target-strip"
 cross_file="$static_dir/chimerautils.cross"
+compiler_rt_dir="$sysroot/usr/lib/clang/22/lib/$MOUSE_RUST_TARGET"
+compiler_rt="$compiler_rt_dir/libclang_rt.builtins.a"

scripts/static-base/dynamic-runtime.sh

@@ -5,7 +5,7 @@ component_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 . "$component_dir/common.sh"
 
 for runtime_file in \
-    /lib/ld-musl-x86_64.so.1 \
+    "/lib/$MOUSE_MUSL_LOADER" \
     /usr/lib/libc.so \
     /usr/lib/crt1.o \
     /usr/lib/Scrt1.o \
@@ -59,9 +59,9 @@ EOF
     chmod 0755 "$wrapper"
 }
 
-dynamic_cc="$cross_tools_dir/bin/x86_64-mouse-linux-musl-dynamic-cc"
-dynamic_cxx="$cross_tools_dir/bin/x86_64-mouse-linux-musl-dynamic-c++"
-dynamic_builtins="$sysroot/usr/lib/clang/22/lib/x86_64-unknown-linux-musl/libclang_rt.builtins.a"
+dynamic_cc="$cross_tools_dir/bin/$MOUSE_CROSS_TARGET-dynamic-cc"
+dynamic_cxx="$cross_tools_dir/bin/$MOUSE_CROSS_TARGET-dynamic-c++"
+dynamic_builtins=$compiler_rt
 if [ ! -f "$dynamic_builtins" ]; then
     printf '%s\n' "missing compiler-rt builtins: $dynamic_builtins" >&2
     exit 1
@@ -69,20 +69,27 @@ fi
 make_dynamic_compiler "$dynamic_cc" "$cc"
 make_dynamic_compiler "$dynamic_cxx" "$bootstrap_cxx"
 
+llvm_source_dir="$source_build_dir/llvm-project-22.1.8.src"
+if [ ! -d "$llvm_source_dir/runtimes" ]; then
+    tar -C "$source_build_dir" \
+        -xf "$source_dir/llvm-project-22.1.8.src.tar.xz"
+fi
+
 shared_runtimes_build="$source_build_dir/llvm-shared-runtimes-build"
 cmake \
     -G Ninja \
-    -S "$source_build_dir/llvm-project-22.1.3.src/runtimes" \
+    -S "$llvm_source_dir/runtimes" \
     -B "$shared_runtimes_build" \
     -DCMAKE_BUILD_TYPE=MinSizeRel \
     -DCMAKE_INSTALL_PREFIX=/usr \
     -DCMAKE_C_COMPILER="$dynamic_cc" \
-    -DCMAKE_C_COMPILER_TARGET=x86_64-unknown-linux-musl \
+    -DCMAKE_C_COMPILER_TARGET="$MOUSE_RUST_TARGET" \
     -DCMAKE_CXX_COMPILER="$dynamic_cxx" \
-    -DCMAKE_CXX_COMPILER_TARGET=x86_64-unknown-linux-musl \
+    -DCMAKE_CXX_COMPILER_TARGET="$MOUSE_RUST_TARGET" \
     -DCMAKE_AR="$ar" \
     -DCMAKE_RANLIB="$ranlib" \
     -DCMAKE_SYSTEM_NAME=Linux \
+    -DCMAKE_SYSTEM_PROCESSOR="$MOUSE_CMAKE_PROCESSOR" \
     -DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY \
     -DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi;libunwind" \
     -DLLVM_ENABLE_PER_TARGET_RUNTIME_DIR=OFF \
@@ -107,15 +114,17 @@ cmake --build "$shared_runtimes_build" -j "$jobs"
 DESTDIR="$sysroot" cmake --install "$shared_runtimes_build"
 cp -R "$sysroot/usr/lib/." "$base_root/usr/lib/"
 
-cat >"$base_root/usr/bin/clang.cfg" <<'EOF'
---target=x86_64-unknown-linux-musl
+rm -rf "$shared_runtimes_build" "$llvm_source_dir"
+
+cat >"$base_root/usr/bin/clang.cfg" <<EOF
+--target=$MOUSE_RUST_TARGET
 --sysroot=/
 --ld-path=/usr/bin/ld.lld
 --rtlib=compiler-rt
 --unwindlib=libunwind
 EOF
-cat >"$base_root/usr/bin/clang++.cfg" <<'EOF'
---target=x86_64-unknown-linux-musl
+cat >"$base_root/usr/bin/clang++.cfg" <<EOF
+--target=$MOUSE_RUST_TARGET
 --sysroot=/
 --ld-path=/usr/bin/ld.lld
 -stdlib=libc++

scripts/static-base/facilities.sh

@@ -10,7 +10,7 @@ extract() {
 
 extract less-704.tar.gz
 extract mandoc-1.14.6.tar.gz
-extract file-5.47.tar.gz
+extract file-5.48.tar.gz
 extract gzip-1.14.tar.xz
 extract bzip2-1.0.8.tar.gz
 extract xz-5.8.3.tar.bz2
@@ -46,7 +46,7 @@ install_command_man_page() {
         LIBS="-lcurses -lterminfo" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --sysconfdir=/etc \
         --with-regex=posix
@@ -83,7 +83,7 @@ done
         RANLIB="$ranlib" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --disable-shared \
         --enable-static \
@@ -112,7 +112,7 @@ done
         gl_cv_func_getcwd_path_max=yes \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --disable-nls
     make -s -j"$jobs"
@@ -125,8 +125,23 @@ for page in gzip.1 gunzip.1 zcat.1 zcmp.1 zdiff.1 zgrep.1 zless.1 zmore.1; do
     install_man_page "$source_build_dir/gzip-1.14/$page"
 done
 
+file_native_build="$source_build_dir/file-5.48-native"
+install -d -m 0755 "$file_native_build"
 (
-    cd "$source_build_dir/file-5.47"
+    cd "$file_native_build"
+    CC="$native_cc" \
+        "$source_build_dir/file-5.48/configure" \
+        --disable-shared \
+        --enable-static \
+        --disable-zstdlib \
+        --disable-lzlib \
+        --disable-libseccomp
+    make -s -C src magic.h
+    make -s -j"$jobs" -C src file
+)
+
+(
+    cd "$source_build_dir/file-5.48"
     CC="$cc" \
         AR="$ar" \
         RANLIB="$ranlib" \
@@ -135,7 +150,7 @@ done
         PKG_CONFIG_SYSROOT_DIR="$sysroot" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --disable-shared \
         --enable-static \
@@ -144,17 +159,19 @@ done
         --disable-libseccomp
     make -s -C src magic.h
     make -s -j"$jobs" -C src file
-    make -s -C magic magic.mgc
+    make -s -C magic \
+        FILE_COMPILE="$file_native_build/src/file" \
+        magic.mgc
     install -m 0755 src/file "$base_root/usr/bin/file"
     install -d -m 0755 "$base_root/usr/share/misc"
     install -m 0644 magic/magic.mgc "$base_root/usr/share/misc/magic.mgc"
 )
-install_man_page "$source_build_dir/file-5.47/doc/file.man" file.1
-install_man_page "$source_build_dir/file-5.47/doc/magic.man" magic.5
+install_man_page "$source_build_dir/file-5.48/doc/file.man" file.1
+install_man_page "$source_build_dir/file-5.48/doc/magic.man" magic.5
 
 unzip_source="$source_build_dir/libarchive-unzip-3.8.7"
 install -d -m 0755 "$unzip_source"
-tar -xf "$source_dir/libarchive-3.8.7.tar.xz" \
+tar -xf "$source_dir/libarchive-3.8.9.tar.xz" \
     -C "$unzip_source" \
     --strip-components=1
 (
@@ -167,7 +184,7 @@ tar -xf "$source_dir/libarchive-3.8.7.tar.xz" \
         PKG_CONFIG_SYSROOT_DIR="$sysroot" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --disable-shared \
         --enable-static \
@@ -220,7 +237,7 @@ iproute_source="$source_build_dir/iproute2-7.1.0"
     cd "$iproute_source"
     CC="$cc" \
         AR="$ar" \
-        YACC=byacc \
+        YACC="bison -y" \
         PKG_CONFIG="$tools_dir/bin/pkgconf" \
         PKG_CONFIG_LIBDIR="$pkgconfig_path" \
         PKG_CONFIG_SYSROOT_DIR="$sysroot" \
@@ -231,14 +248,14 @@ iproute_source="$source_build_dir/iproute2-7.1.0"
     make -s -j"$jobs" \
         CC="$cc" \
         AR="$ar" \
-        YACC=byacc \
+        YACC="bison -y" \
         SHARED_LIBS=n \
         LDFLAGS="-static" \
         SUBDIRS=lib
     make -s -j"$jobs" \
         CC="$cc" \
         AR="$ar" \
-        YACC=byacc \
+        YACC="bison -y" \
         SHARED_LIBS=n \
         LDFLAGS="-static" \
         SUBDIRS="ip tc bridge misc"
@@ -254,7 +271,7 @@ done
     cd "$source_build_dir/libmnl-1.0.5"
     CC="$cc" AR="$ar" RANLIB="$ranlib" ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --disable-shared \
         --enable-static
@@ -271,7 +288,7 @@ done
         PKG_CONFIG_SYSROOT_DIR="$sysroot" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --disable-shared \
         --enable-static
@@ -288,13 +305,13 @@ rm -f "$sysroot/usr/lib/libmnl.la" "$sysroot/usr/lib/libnftnl.la"
     CC="$cc" \
         AR="$ar" \
         RANLIB="$ranlib" \
-        YACC=byacc \
+        YACC="bison -y" \
         PKG_CONFIG="$tools_dir/bin/pkgconf" \
         PKG_CONFIG_LIBDIR="$pkgconfig_path" \
         PKG_CONFIG_SYSROOT_DIR="$sysroot" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --sbindir=/sbin \
         --disable-shared \
@@ -316,7 +333,7 @@ do
     install_command_man_page "$source_build_dir/util-linux-2.42.2" "$command"
 done
 for command in free pgrep pkill ps sysctl top uptime vmstat watch; do
-    install_command_man_page "$source_build_dir/procps-ng-4.0.5" "$command"
+    install_command_man_page "$source_build_dir/procps-ng-4.0.6" "$command"
 done
 install_command_man_page "$source_build_dir/iputils-20250605" ping
 

scripts/static-base/libraries-and-accounts.sh

@@ -4,6 +4,9 @@ set -eu
 component_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 . "$component_dir/common.sh"
 
+patch -d "$source_build_dir/shadow-4.20.0" -p1 \
+    <"$repo_dir/base/patches/shadow-4.20.0-stdint.patch"
+
 (
     cd "$source_build_dir/zlib-1.3.2"
     CC="$cc" \
@@ -17,7 +20,7 @@ component_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 )
 
 (
-    cd "$source_build_dir/libarchive-3.8.7"
+    cd "$source_build_dir/libarchive-3.8.9"
     CC="$cc" \
         AR="$ar" \
         RANLIB="$ranlib" \
@@ -28,7 +31,7 @@ component_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
         PKG_CONFIG_SYSROOT_DIR="$sysroot" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --disable-shared \
         --enable-static \
@@ -53,12 +56,12 @@ component_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 )
 
 (
-    cd "$source_build_dir/openssl-3.5.7"
+    cd "$source_build_dir/openssl-4.0.1"
     CC="$cc" \
         AR="$ar" \
         RANLIB="$ranlib" \
         ./Configure \
-        linux-x86_64 \
+        "$MOUSE_OPENSSL_TARGET" \
         --prefix=/usr \
         --libdir=lib \
         --openssldir=/etc/ssl \
@@ -86,7 +89,7 @@ install -m 0644 \
         RANLIB="$ranlib" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --disable-shared \
         --enable-static \
@@ -98,7 +101,7 @@ install -m 0644 \
 )
 
 (
-    cd "$source_build_dir/shadow-4.19.4"
+    cd "$source_build_dir/shadow-4.20.0"
     CC="$cc" \
         AR="$ar" \
         RANLIB="$ranlib" \
@@ -107,7 +110,7 @@ install -m 0644 \
         PKG_CONFIG_SYSROOT_DIR="$sysroot" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --disable-shared \
         --enable-static \
@@ -149,13 +152,36 @@ install -m 0644 \
 )
 
 (
-    cd "$source_build_dir/dhcpcd-8b312918d8f1885d7fe8fcc03a7e06ae8a0314b4"
+    cd "$source_build_dir/opendoas-6.8.2"
+    CC="$cc" \
+        CFLAGS="-O2 -I$sysroot/usr/include" \
+        LDFLAGS="-L$sysroot/usr/lib -static" \
+        ./configure \
+        --target="$MOUSE_RUST_TARGET" \
+        --prefix=/usr \
+        --bindir=/usr/bin \
+        --mandir=/usr/share/man \
+        --enable-static \
+        --without-pam \
+        --with-shadow \
+        --without-timestamp
+    make -s -j"$jobs"
+    install -m 4755 doas "$base_root/usr/bin/doas"
+    install -d -m 0755 \
+        "$base_root/usr/share/man/man1" \
+        "$base_root/usr/share/man/man5"
+    install -m 0644 doas.1 "$base_root/usr/share/man/man1/doas.1"
+    install -m 0644 doas.conf.5 "$base_root/usr/share/man/man5/doas.conf.5"
+)
+
+(
+    cd "$source_build_dir/dhcpcd-e3363cf477aa53d4ed74d00ce5d3d4c7e5b7f2c3"
     CC="$cc" \
         AR="$ar" \
         RANLIB="$ranlib" \
         ./configure \
         --os=linux \
-        --target=x86_64-linux-musl \
+        --target="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --sbindir=/usr/bin \
         --sysconfdir=/etc \
@@ -216,7 +242,7 @@ build_autoconf_library() {
             PKG_CONFIG_SYSROOT_DIR="$sysroot" \
             ./configure \
             --build="$build_triplet" \
-            --host=x86_64-linux-musl \
+            --host="$MOUSE_GNU_TARGET" \
             --prefix=/usr \
             --disable-shared \
             --enable-static \
@@ -229,8 +255,8 @@ build_autoconf_library() {
     )
 }
 
-build_autoconf_library attr-2.5.2 libattr.la
-build_autoconf_library acl-2.3.2 libacl.la
+build_autoconf_library attr-2.6.0 libattr.la
+build_autoconf_library acl-2.4.0 libacl.la
 
 # The projects' install-time EXPORT substitution uses a GNU sed word-boundary
 # extension which macOS sed accepts but does not apply. Normalize the installed
@@ -248,7 +274,7 @@ find "$sysroot/usr/include/attr" "$sysroot/usr/include/acl" \
         ac_cv_func_realloc_0_nonnull=yes \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --disable-shared \
         --enable-static \

scripts/static-base/native-toolchain.sh

@@ -8,13 +8,13 @@ build_llvm() {
 llvm_host_build="$source_build_dir/llvm-host-tools-build"
 cmake \
     -G Ninja \
-    -S "$source_build_dir/llvm-project-22.1.3.src/llvm" \
+    -S "$source_build_dir/llvm-project-22.1.8.src/llvm" \
     -B "$llvm_host_build" \
     -DCMAKE_BUILD_TYPE=Release \
     -DCMAKE_C_COMPILER="$native_cc" \
     -DCMAKE_CXX_COMPILER=c++ \
     -DLLVM_ENABLE_PROJECTS=clang \
-    -DLLVM_TARGETS_TO_BUILD=X86 \
+    -DLLVM_TARGETS_TO_BUILD="$MOUSE_LLVM_TARGET" \
     -DLLVM_INCLUDE_BENCHMARKS=OFF \
     -DLLVM_INCLUDE_EXAMPLES=OFF \
     -DLLVM_INCLUDE_TESTS=OFF \
@@ -26,7 +26,7 @@ llvm_target_build="$source_build_dir/llvm-target-build"
 llvm_target_install="$static_dir/llvm-target-install"
 cmake \
     -G Ninja \
-    -S "$source_build_dir/llvm-project-22.1.3.src/llvm" \
+    -S "$source_build_dir/llvm-project-22.1.8.src/llvm" \
     -B "$llvm_target_build" \
     -DCMAKE_BUILD_TYPE=MinSizeRel \
     -DCMAKE_INSTALL_PREFIX=/usr \
@@ -35,14 +35,14 @@ cmake \
     -DCMAKE_AR="$ar" \
     -DCMAKE_RANLIB="$ranlib" \
     -DCMAKE_SYSTEM_NAME=Linux \
-    -DCMAKE_SYSTEM_PROCESSOR=x86_64 \
+    -DCMAKE_SYSTEM_PROCESSOR="$MOUSE_CMAKE_PROCESSOR" \
     -DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY \
     -DLLVM_TABLEGEN="$llvm_host_build/bin/llvm-tblgen" \
     -DCLANG_TABLEGEN="$llvm_host_build/bin/clang-tblgen" \
     -DLLVM_ENABLE_PROJECTS="clang;lld" \
-    -DLLVM_TARGETS_TO_BUILD=X86 \
-    -DLLVM_DEFAULT_TARGET_TRIPLE=x86_64-unknown-linux-musl \
-    -DLLVM_HOST_TRIPLE=x86_64-unknown-linux-musl \
+    -DLLVM_TARGETS_TO_BUILD="$MOUSE_LLVM_TARGET" \
+    -DLLVM_DEFAULT_TARGET_TRIPLE="$MOUSE_RUST_TARGET" \
+    -DLLVM_HOST_TRIPLE="$MOUSE_RUST_TARGET" \
     -DLLVM_ENABLE_BINDINGS=OFF \
     -DLLVM_ENABLE_FFI=OFF \
     -DLLVM_ENABLE_LIBEDIT=OFF \
@@ -63,17 +63,23 @@ DESTDIR="$llvm_target_install" \
     cmake --build "$llvm_target_build" -j "$jobs" \
         --target install-distribution
 
+rm -rf "$llvm_host_build" "$llvm_target_build"
+
 cp -R "$sysroot/usr/include" "$base_root/usr/"
 cp -R "$sysroot/usr/lib/." "$base_root/usr/lib/"
 cp -R "$sysroot/lib" "$base_root/"
 cp -R "$llvm_target_install/usr/." "$base_root/usr/"
+
+rm -rf \
+    "$llvm_target_install" \
+    "$source_build_dir/llvm-project-22.1.8.src"
 }
 
 build_package_tools() {
-pkgconf_target_build="$source_build_dir/pkgconf-pkgconf-2.5.1/build-target"
+pkgconf_target_build="$source_build_dir/pkgconf-pkgconf-3.0.5/build-target"
 python3 "$meson_source" setup \
     "$pkgconf_target_build" \
-    "$source_build_dir/pkgconf-pkgconf-2.5.1" \
+    "$source_build_dir/pkgconf-pkgconf-3.0.5" \
     --cross-file="$cross_file" \
     --prefix=/usr \
     --buildtype=release \
@@ -90,7 +96,7 @@ ln -s pkgconf "$base_root/usr/bin/pkg-config"
         RANLIB="$ranlib" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --disable-load \
         --disable-nls \
@@ -123,18 +129,18 @@ exec /usr/bin/llvm-ranlib "$@"
 EOF
 chmod 0755 "$base_root/usr/bin/ranlib"
 ln -s llvm-strip "$base_root/usr/bin/strip"
-ln -s ../../lib/ld-musl-x86_64.so.1 "$base_root/usr/bin/ldd"
+ln -s "../../lib/$MOUSE_MUSL_LOADER" "$base_root/usr/bin/ldd"
 
-cat >"$base_root/usr/bin/clang.cfg" <<'EOF'
---target=x86_64-unknown-linux-musl
+cat >"$base_root/usr/bin/clang.cfg" <<EOF
+--target=$MOUSE_RUST_TARGET
 --sysroot=/
 --ld-path=/usr/bin/ld.lld
 --rtlib=compiler-rt
 --unwindlib=libunwind
 -static
 EOF
-cat >"$base_root/usr/bin/clang++.cfg" <<'EOF'
---target=x86_64-unknown-linux-musl
+cat >"$base_root/usr/bin/clang++.cfg" <<EOF
+--target=$MOUSE_RUST_TARGET
 --sysroot=/
 --ld-path=/usr/bin/ld.lld
 -stdlib=libc++

scripts/static-base/storage.sh

@@ -8,7 +8,7 @@ extract() {
     tar -xf "$source_dir/$1" -C "$source_build_dir"
 }
 
-extract btrfs-progs-v7.0.tar.xz
+extract btrfs-progs-v7.1.tar.xz
 extract zstd-1.5.7.tar.gz
 
 install -d -m 0755 \
@@ -54,7 +54,7 @@ install -m 0644 \
         RANLIB="$ranlib" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --disable-all-programs \
         --enable-libblkid \
@@ -65,9 +65,8 @@ install -m 0644 \
     make -s DESTDIR="$sysroot" install
 )
 
-btrfs_source="$source_build_dir/btrfs-progs-v7.0"
+btrfs_source="$source_build_dir/btrfs-progs-v7.1"
 pkgconfig_path="$sysroot/usr/lib/pkgconfig:$sysroot/usr/share/pkgconfig"
-compiler_rt="$sysroot/usr/lib/clang/22/lib/x86_64-unknown-linux-musl/libclang_rt.builtins.a"
 (
     cd "$btrfs_source"
     CC="$cc" \
@@ -83,7 +82,7 @@ compiler_rt="$sysroot/usr/lib/clang/22/lib/x86_64-unknown-linux-musl/libclang_rt
         PKG_CONFIG_SYSROOT_DIR="$sysroot" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --disable-backtrace \
         --disable-documentation \

scripts/static-base/system-services.sh

@@ -17,7 +17,7 @@ patch -d "$source_build_dir/chimerautils-15.0.3" -p1 \
         LIBS="-lcurses -lterminfo" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --bindir=/bin \
         --disable-nls-catalogs
@@ -39,7 +39,7 @@ install -d -m 0755 "$util_linux_build"
         PKG_CONFIG_SYSROOT_DIR="$sysroot" \
         "$source_build_dir/util-linux-2.42.2/configure" \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --disable-shared \
         --enable-static \
@@ -52,7 +52,6 @@ install -d -m 0755 "$util_linux_build"
         --enable-libfdisk \
         --enable-agetty \
         --enable-nologin \
-        --enable-setsid \
         --enable-mount \
         --enable-blkid \
         --enable-fdisks \
@@ -60,13 +59,23 @@ install -d -m 0755 "$util_linux_build"
         --enable-wipefs \
         --enable-swapon \
         --enable-lsblk \
-        --enable-findmnt \
-        --enable-flock \
         --enable-dmesg \
         --enable-static-programs=blkid,fdisk,losetup,mount,sfdisk,umount
     make -s -j"$jobs" \
-        agetty nologin setsid mount umount blkid fdisk sfdisk losetup \
-        wipefs swapon swapoff lsblk findmnt flock dmesg
+        agetty nologin mount umount blkid fdisk sfdisk losetup \
+        wipefs swapon swapoff lsblk dmesg
+    # util-linux 2.42.2 does not expose configure switches for these programs,
+    # so --disable-all-programs leaves their conditional Automake variables
+    # empty. Supply the exact source objects and link inputs while retaining
+    # the narrow program set.
+    make -s -j"$jobs" \
+        'am_findmnt_OBJECTS=misc-utils/findmnt-findmnt.o misc-utils/findmnt-findmnt-verify.o' \
+        'findmnt_CFLAGS=$(AM_CFLAGS) -I$(ul_libmount_incdir) -I$(ul_libsmartcols_incdir) -I$(ul_libblkid_incdir)' \
+        'findmnt_LDADD=$(LDADD) libmount.la libcommon.la libsmartcols.la libblkid.la' \
+        'am_flock_OBJECTS=sys-utils/flock.o lib/monotonic.o lib/timer.o' \
+        'flock_LDADD=$(LDADD) libcommon.la $(REALTIME_LIBS)' \
+        am_setsid_OBJECTS=sys-utils/setsid.o \
+        findmnt flock setsid
 )
 install_util_linux() {
     command=$1
@@ -118,7 +127,7 @@ commands="
 awk basename cat chmod chown chroot cksum cmp col colrm column comm
 cp csplit cut date dd df diff diff3 dirname du echo env expand expr false
 ed fetch find fmt fold gencat getopt grep head hexdump hostname id join kill
-ln logger logname ls m4 md5 mesg mkdir mkfifo mknod mktemp mv nc nice nl nohup
+ln logger logname ls md5 mesg mkdir mkfifo mknod mktemp mv nc nice nl nohup
 nproc paste patch pathchk pr printenv printf pwd realpath renice rev rm rmdir script
 sdiff sed seq sh sleep sort split stat stty sync tail tee time timeout touch tr true
 truncate tsort tty ul uname unexpand uniq users vis wc whereis which who xargs yes
@@ -171,7 +180,6 @@ src.freebsd/coreutils/ln/ln
 src.freebsd/miscutils/logger/logger
 src.freebsd/coreutils/logname/logname
 src.freebsd/coreutils/ls/ls
-src.freebsd/m4/m4
 src.freebsd/coreutils/md5/md5
 src.freebsd/miscutils/mesg/mesg
 src.freebsd/coreutils/mkdir/mkdir
@@ -258,19 +266,21 @@ ln -s vi "$base_root/usr/bin/nvi"
 ln -s vi "$base_root/usr/bin/view"
 
 (
-    cd "$source_build_dir/procps-ng-4.0.5"
+    cd "$source_build_dir/procps-ng-4.0.6"
     CC="$cc" \
         AR="$ar" \
         RANLIB="$ranlib" \
         ac_cv_func_malloc_0_nonnull=yes \
         ac_cv_func_realloc_0_nonnull=yes \
+        ac_cv_func_error=yes \
+        ac_cv_func_error_at_line=yes \
         LDFLAGS="-static" \
         PKG_CONFIG="$tools_dir/bin/pkgconf" \
         PKG_CONFIG_LIBDIR="$sysroot/usr/lib/pkgconfig" \
         PKG_CONFIG_SYSROOT_DIR="$sysroot" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --disable-shared \
         --enable-static \
@@ -332,7 +342,7 @@ install -m 4755 "$iputils_build/ping/ping" "$base_root/bin/ping"
         LDFLAGS="-static" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --sysconfdir=/etc \
         --localstatedir=/var \
@@ -355,7 +365,7 @@ install -m 4755 "$iputils_build/ping/ping" "$base_root/bin/ping"
         LDFLAGS="-static" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --sysconfdir=/etc \
         --localstatedir=/var \
@@ -379,7 +389,7 @@ install -m 4755 "$iputils_build/ping/ping" "$base_root/bin/ping"
         PKG_CONFIG="$tools_dir/bin/pkgconf" \
         ./configure \
         --build="$build_triplet" \
-        --host=x86_64-linux-musl \
+        --host="$MOUSE_GNU_TARGET" \
         --prefix=/usr \
         --sysconfdir=/etc \
         --runstatedir=/run \
@@ -391,38 +401,23 @@ install -m 4755 "$iputils_build/ping/ping" "$base_root/bin/ping"
     install -m 0755 src/syslogd "$base_root/usr/sbin/syslogd"
 )
 
-(
-    cd "$source_build_dir/skalibs-2.15.1.0"
-    CC="$cc" AR="$ar" RANLIB="$ranlib" ./configure \
-        --prefix=/usr \
-        --build="$build_triplet" \
-        --target=x86_64-linux-musl \
-        --with-include="$sysroot/usr/include" \
-        --with-lib="$sysroot/usr/lib" \
-        --with-sysdep-devurandom=yes \
-        --with-sysdep-posixspawnearlyreturn=no \
-        --with-sysdep-procselfexe=/proc/self/exe \
-        --with-sysdep-selectinfinite=yes \
-        --disable-shared
-    make -s -j"$jobs" CC="$cc" AR="$ar" RANLIB="$ranlib"
-    make -s DESTDIR="$sysroot" install
-)
-
-(
-    cd "$source_build_dir/mdevd-0.1.8.2"
-    CC="$cc" AR="$ar" RANLIB="$ranlib" ./configure \
-        --prefix=/usr \
-        --build="$build_triplet" \
-        --target=x86_64-linux-musl \
-        --with-sysdeps="$sysroot/usr/lib/skalibs/sysdeps" \
-        --with-include="$sysroot/usr/include" \
-        --with-lib="$sysroot/usr/lib" \
-        --enable-static-libc \
-        --disable-shared
-    make -s -j"$jobs" CC="$cc" AR="$ar" RANLIB="$ranlib"
-    install -m 0755 mdevd "$base_root/sbin/mdevd"
-    install -m 0755 mdevd-coldplug "$base_root/sbin/mdevd-coldplug"
-)
+gardendevd_build="$source_build_dir/gardendevd/build"
+PKG_CONFIG_LIBDIR="$sysroot/usr/lib/pkgconfig:$sysroot/usr/share/pkgconfig" \
+PKG_CONFIG_SYSROOT_DIR="$sysroot" \
+    python3 "$meson_source" setup \
+    "$gardendevd_build" \
+    "$source_build_dir/gardendevd" \
+    --cross-file="$cross_file" \
+    --prefix=/usr \
+    --buildtype=release \
+    --default-library=static \
+    -Duaccess=disabled \
+    -Dmdevd=disabled \
+    -Ddracut=disabled \
+    -Dpkgconf=false
+python3 "$meson_source" compile -C "$gardendevd_build"
+DESTDIR="$base_root" \
+python3 "$meson_source" install -C "$gardendevd_build"
 
 kmod_build="$source_build_dir/kmod-34.2/build"
 PKG_CONFIG_LIBDIR="$sysroot/usr/lib/pkgconfig:$sysroot/usr/share/pkgconfig" \
@@ -448,13 +443,13 @@ for command in depmod insmod lsmod modinfo modprobe rmmod; do
 done
 
 (
-    cd "$source_build_dir/openssl-3.5.7"
+    cd "$source_build_dir/openssl-4.0.1"
     make -s distclean
     CC="$cc" \
         AR="$ar" \
         RANLIB="$ranlib" \
         ./Configure \
-        linux-x86_64 \
+        "$MOUSE_OPENSSL_TARGET" \
         --prefix=/usr \
         --libdir=lib \
         --openssldir=/etc/ssl \

scripts/static-base/wireless.sh

@@ -0,0 +1,65 @@
+#!/bin/sh
+set -eu
+
+component_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+. "$component_dir/common.sh"
+
+tar -xf "$source_dir/libnl-3.12.0.tar.gz" -C "$source_build_dir"
+tar -xf "$source_dir/wpa_supplicant-2.11.tar.gz" -C "$source_build_dir"
+patch -d "$source_build_dir/wpa_supplicant-2.11" -p1 \
+    <"$repo_dir/base/patches/wpa-supplicant-2.11-openssl-4.patch"
+
+(
+    cd "$source_build_dir/libnl-3.12.0"
+    CC="$cc" \
+        AR="$ar" \
+        RANLIB="$ranlib" \
+        CFLAGS="-O2" \
+        LDFLAGS="-static" \
+        ./configure \
+        --build="$build_triplet" \
+        --host="$MOUSE_GNU_TARGET" \
+        --prefix=/usr \
+        --libdir=/usr/lib \
+        --disable-shared \
+        --enable-static \
+        --disable-pthreads
+    make -s -j"$jobs"
+    make -s DESTDIR="$sysroot" install
+)
+
+wpa_build="$source_build_dir/wpa_supplicant-2.11/wpa_supplicant"
+cat >"$wpa_build/.config" <<'EOF'
+CONFIG_DRIVER_NL80211=y
+CONFIG_LIBNL32=y
+CONFIG_CTRL_IFACE=y
+CONFIG_BACKEND=file
+CONFIG_TLS=openssl
+CONFIG_IEEE8021X_EAPOL=y
+CONFIG_EAP_MD5=y
+CONFIG_EAP_MSCHAPV2=y
+CONFIG_EAP_TLS=y
+CONFIG_EAP_PEAP=y
+CONFIG_EAP_TTLS=y
+CONFIG_EAP_GTC=y
+CONFIG_WPS=y
+CONFIG_SAE=y
+CONFIG_OWE=y
+CONFIG_BGSCAN_SIMPLE=y
+CONFIG_NO_CONFIG_BLOBS=y
+EOF
+
+(
+    cd "$wpa_build"
+    CC="$cc" \
+        PKG_CONFIG="$tools_dir/bin/pkgconf" \
+        PKG_CONFIG_LIBDIR="$sysroot/usr/lib/pkgconfig" \
+        PKG_CONFIG_SYSROOT_DIR="$sysroot" \
+        CFLAGS="-O2 -I$sysroot/usr/include" \
+        LDFLAGS="-static" \
+        make -s -j"$jobs" wpa_supplicant wpa_cli wpa_passphrase
+)
+
+install -m 0755 "$wpa_build/wpa_supplicant" "$base_root/sbin/wpa_supplicant"
+install -m 0755 "$wpa_build/wpa_cli" "$base_root/usr/bin/wpa_cli"
+install -m 0755 "$wpa_build/wpa_passphrase" "$base_root/usr/bin/wpa_passphrase"