Merge branch '2024.03.x'

MAINTAINERS

@@ -18,6 +18,15 @@ Fediverse = @anton@mastodon.online
 Keyoxide = https://keyoxide.org/DC4B7D1F52E0BA4D
 Website = https://antonlivaja.com/
 
+[people.ryanheywood]
+Name = "Ryan Heywood"
+Location = Florida, USA
+Email = me@ryansquared.pub
+Matrix = @ryansquared:beeper.com
+Fediverse = @ryan@tilde.zone
+Keyoxide = https://keyoxide.org/8E401478A3FBEF72
+Website = https://ryansquared.pub
+
 [keys]
 
 [keys.lancevick.personal]
@@ -38,6 +47,15 @@ OfflineCA = Yes
 Backup = Yes
 Interaction = Yes
 
+[keys.ryanheywood.personal]
+ID = 88823A75ECAA786B0FF38B148E401478A3FBEF72
+Algorithm = RSA4096
+Servers = openpgp.org
+Devices = Yubikey 4c Nano, Yubikey 5 NFC
+OfflineCA = No
+Backup = Yes
+Interaction = Yes
+
 [machines]
 
 [machines.lancevick.local1]
@@ -75,3 +93,15 @@ Ghz = 2.0
 Cores = 32
 OS = Debian
 Runtime = Docker
+
+[machines.ryanheywood.remote]
+Owner = Hetzner Online GmbH
+Location = Falkstein, Germany
+Type = metal
+Arch = x86_64
+Brand = AMD
+Model = Ryzen Threadripper 2950X
+Ghz = 3.5
+Cores = 16
+OS = Debian
+Runtime = Docker

Makefile

@@ -61,4 +61,3 @@ gen-make: out/sxctl/index.json $(shell find packages/*/Containerfile | tr '\n' '
 		--volume .:/src \
 		--user $(shell id -u):$(shell id -g) \
 		stagex/sxctl -baseDir=/src gen make
-	touch $@

PULL_REQUEST_TEMPLATE.yaml

@@ -0,0 +1,31 @@
+name: "Pull Request"
+about: "Submit a pull request"
+ref: "main"
+body:
+- type: textarea
+  id: description
+  attributes:
+    label: What changes does this PR introduce?
+  validation:
+    required: false
+- type: textarea
+  id: what-modifies
+  attributes:
+    label: What package does this PR add or modify, if any?
+  validations:
+    required: false
+- type: textarea
+  id: digests
+  attributes:
+    label: Package digests
+    description: Please copy and paste the digests 
+    placeholder: "$ make digests | xclip -sel c"
+    render: shell
+- type: checkboxes
+  id: reproduce
+  attributes:
+    label: If modifying packages, have the packages been reproduced locally?
+    description: This is optional, but helps reduce maintenance burden.
+    options:
+    - label: I have built this package twice and confirmed it reproduces.
+      required: false

digests.txt

@@ -6,6 +6,7 @@ e170a8f562f0e61030560b30cec824e4e1f4e16e158d2e6ed05ccdcc2f3ce6e2 bc
 3af41227e1fe6a8f9b3df9916ef4876840f33eaa172168e1db1d8f457ba011d5 binutils
 c8dccb8b6a9bfa5b7894dd3b428df47135fb17f64cc66e0e6a419331e5a2e773 bison
 0978421e294499c7342cd696a766082d6bb1fe3e3a06fc5c0e9daa39e35418ec busybox
+d312cc5d80ecda841fb1edcd927d3df904d9e201240eafa1634f86780eba2c48 bzip2
 6746d2d203be3455bfc5ffd5a051c8edb73ecfd7be77c3da5a2973003a30794f ca-certificates
 07da999e6ed9025c266365271c23afda50e21d863f084fc190924d59d02cfb0f clang
 f3454a3eacf08b130cfea25af54dbe8e9b6d9ca99c0c3ac909135baff054ff96 cmake
@@ -15,9 +16,9 @@ cf4032ca6b5f912a8b9d572d527d388401b68a0c9224cc086173e46bc4e1eabe coreutils
 6cacfe2f563837f690e3b8dc46d4bc7c9e82d624ace6845d8e59f622e1199610 diffutils
 327a0c7671ebc2c88c98f72f23cd552af04a5fba6ce98b8aa4a228e2d424f6eb dosfstools
 378aeecca74b62216a5c544c8101e51f372c5834f1d2af9df12df8898b0888c4 ed
-6f3fed0aeaf9f9eebb43a370a5495fab92fcb21119fc23e261f0f24e1174009c eif_build
+82a8b6a8db81fa69b7d10979676cc0f1fd59676dd764bd0c36f5b5593f69cb20 eif_build
 fa3eec703c85cb8d42bddbe7e16ad8ce5dfda2ac75d7d1033a2cae058870a0ef elfutils
-6f464e185546b89c23bdd39607f43602139b7f3d14c77843ad313232203d2d22 eudev
+d4d17629eb1d909d7003df337bb7b0d274bc1d93cfc7ef84a83b9fb4c1a63fd0 eudev
 7fd68d1e7d5e1d3b1e52433bb6709f28d3e362ea89c9e13586b852ca0412f640 file
 42c8353db508ac79599df38c684502e50167352de2cddc5aea9b89486e7f8498 filesystem
 475ea3488840297454f0f20b58e1b8292bf9b3944f901e3fce432fa4afeaa4cd findutils
@@ -27,27 +28,31 @@ cec18f18e3313e3872c7d0415ac7014c320f0047ef89f8063beb8affaef97409 gawk
 a51c840a1c82dbc00c0a813964195d4f4bcb20463701083999320f826ffa49bf gen_initramfs
 f58589b526c6c287a9308f47c1a5d88c66a04a62d32f1d19c7ecf46ff819cc2e gettext
 2c11f2daf9b8c1738cbd966b6de5dd0bcfaf81b675c2d268d30f972ddab9d9df git
-5d22bf80f84a8b9814ee924328f46573cb6c0401721895cc6ab8a39f287574f8 gmp
+68a7404c3bcbab1f607a154ae21638e6a171da2dd3b2d248cdb6bddc1d4fca1d gmp
 0a5c5bbf4d9b1f0009f477dc8151aebcccb6f5bdd0d5d033e47a1b90aad295b1 go
-e9bbc175fc8f00479d1dcd54e71bc1476865880caa04b320b1fe0f2eb3c2b61a gperf
+a31f96dc172077fbc45842720e6c2f6aee26d4f8a500b3d6c167aadaca0a3be6 gperf
 3db58a40e833751bcd80a11e050eefc951024e4e639e6695cdc4bc9bb7cfe012 gpg
 589465adc0125128c21534eb560299c335a41935e0ce182a632f4b739bf25c60 grep
 1e74bcfb0763d6eb12cc0075638f0eabc227d25ae2501676fa880cf6139f5a61 grub
 f93802c4e51982fc447f6a1dc36bd8e21967907bcd6d8e2bb4483b1f58239b0a gzip
-32a98e967abc27d707026f1a521d60877ec3513b3afe5f1070a4dcad3a1a978c keyfork
+b9a00267cf1a979ab7f4358533c6d7342b3098540b02a1c1ee42dfeaf056665d icu
+bb8ba33774740628beb68891b294fd6a92290ea85d68cfada1e8fdf972f3ac24 iputils
+ce788259ce861e144f266cf5f2d3f880c7e0eddb4df6e9624e01c5619c42d839 keyfork
 17a7f84f2f279134fa51b7b5b3343ec6483cc0878229e611fb8021690c4b015c libassuan
-201b63783b638471595e0ae0c087a508c3de4087cd6158d5b2ef741a62a3d279 libcap
-be9ae50baf0306bde9b6cb5a2ba4e80ccf478812d89686ff46c21985a192b406 libgcrypt
-7eeb32f44f446988993f6818789e2a89f229129bef66289bd84a00a6a6a8b52d libgpg-error
+7777bc5c7be81313c808893913331faf0574a87d045e1a2c843812347f55b6de libcap
+4d81b26ce02728e161a800fe7a15dcb78e67f1543b1b1cbc5d16922501e9b5bc libgcrypt
+3526c11978dabc5fbfc522cebbd965932434866b3b0e8cff2c6042e34a4da646 libgpg-error
 4d73d01cb6078adb04309907f4557642fa3a593d9db93c9beb1a9999fbd61af7 libksba
+967d91a52043798e168a030de10d350c415ac66f833e50c66eeec338814dd346 libqrencode
 6ffaa6bb7678bbab9ba4d78a658cba1da7f9b7817f51cd3750dd170ba71cb3bf libtool
 e74819e47c79f68a008302927ef02a5aa39cf12e859a8dfeccf9d1b4769b4833 libunwind
 d43434b5447392db78219321683724567bbee50651f618d1bdcca2efb315baa1 libxml2
+ed8d43c961a5b81cf6c8742118fb212f71225347684e5aecc33bf281ca217d31 libxslt
 488f414425de6f0b60a1362cd05407e56220548612d96edff45795b1bcd5d346 libzstd
-051016158bdf79eaeeb318d94c40922b56ba45fa7a2a179cb37c80c89c876ad0 linux-airgap
-f59b263921691ff9155dbe5877c8acd7b01a2023f399eb133a185579bb6c9093 linux-generic
+92a5e37dffc1e6110576fd5276da439a1b5805de913bbf836cfc496bc1cbcfb1 linux-airgap
+f9c58f1774e880e0295f723fb48520dc427e31e9b68e607db5c41242ee15f529 linux-generic
 4d505f84bd03e75d10c65704934007cf42bbc24ad6e459202690322f412fc254 linux-headers
-073c4603686e3bdc0ed6755fee3203f6f6f1512e0ded09eaea8866b002b04264 linux-nitro
+f2443ee0da902c5c8cc2a4aa29fb4e84368e6241f4997328f89fec1d3ef10ad2 linux-nitro
 ee422bb296c38f941dff8e05936c7f07ca72dac719653882e9c673ea2e19cf2d lld
 97d0f3d32f58dca648cd70b0d58364d9bea5170bb99054c0a0b19ef57a7da7b1 llvm13
 8e361f1da92e956d947e37b6fc0a3951fcc1130863e2d3a9b4fca40ab4fd07f6 llvm
@@ -59,7 +64,7 @@ a71ad6dbc9747a3b9ed6792bc1f482066abc1fb2cf2705d6b2deda475fe9416e make
 73c3c4647010f7151c711ed5005ef946c7c1a19c6e8921e057b5dbc15ef9559a musl-fts
 7db05e6817058a512a66ea82f3b99163069424c281363c2e9a48091d0d1d3bd9 musl
 4b6737815460908f666fa7a8e91138610d0a0909c408165a575ffb42bf21cd66 musl-obstack
-0eedc4e98e564be570ff00c6e18668e6bd59bced80f87a08bf159fe96404381f nettle
+4bc7d82ac757e5c16f25499d190de4fb7ecd295249383c4ff70fb294843a62dc nettle
 4ca7232eb6fb77b4a3a3c8b56b57014080c22cac2a6b2291d42d7b2a15da7ae3 ninja
 5b9dfaa2683e024fdaf88291f01c4186e7d98935975c59ecf52389bcf9845cbc npth
 1a2f656ced34d1ade99279c5663fcf0ec4f6526bcc50142079ef8adc080be3a9 openssl
@@ -67,8 +72,8 @@ e720e1795706c7c8c1db14bf730b10521e3ff42e4bed90addc590f7446aac8af pcsc-lite
 2fe4740ed9a9193dfd312eac523c3ca2b8de9e4b4283c7f180ffb6e4bbd1a21b perl
 31ce4eddaf4e777ddb51f01923089f3321ec5272ca0aa834d475f644279209b8 pkgconf
 4613d37bb6cb380d557a035e10ae4468291ce73a1b5de1ddfa10d7b5d404bf8f py-setuptools
-5523e4da0d547eff77bb3d452b53dc68f230496eccbd4a52bcb89de53a792216 python
-fe22a0fcdb569cb70b8147378463fb6ff800e642be9d50542f8e25a38d90ec7f rust
+144586afcb8558d031b087401ee5febfd1ddacc2c6199ef2e5d2c8cc33357810 python
+17f0ae21e93b7a9efdca56970eabd9f5493c96b21f7928c94b2e90bca991b318 rust
 277d8afd5b06aa5da315516c63289612284cde0a091078bf1ec9ab5be4a82017 sed
 929abbe8d89368b9d037fc5f3f80edd7832c7952e82ad6c78d8983c228bf2fec sops
 287accc6d2b9874a18ef81b2e76c118cfa163c6d0a28cab213edc992895b7411 stage0
@@ -76,7 +81,7 @@ fab1b8b14d6e26f78ed85fb6b30b42a79538b6cd2f38cb01f54f7433e37dbc09 stage1
 bdb7f62e9b883d163b9c814325625cb2deebe45622b0efc4a71405d12bc880db stage2
 2e277387d263f3c846e33a0e2c08a8b77fa924514c206716a1683ce29a03bbd9 stage3
 ae012a214bf7c03145568c4fb35b1f059cc9a3e407306b5a6857948c18b1c282 strace
-86ea3240142f7d3ec3ca5202a3c2d71c769b1874fe79cbe78568d57dacbfbbe9 sxctl
+4912bf9c8fb15b185e723b6beb83a5d965ce868e63f94ad60a5271635adda800 sxctl
 95d5d9f8d51c7be634ebbbfabd48c54cc6ee9971c15491e527649904001ff288 syslinux
 73d7fcfe87099258bd711603a2cdf8f51273631dabb1e48a252c18cee52631cb tar
 a07cbc7deee1be0387a66e3b75ec2044611b10563d62d4a2a61486e715cebcf1 texinfo

packages/bzip2/Containerfile

@@ -0,0 +1,32 @@
+FROM scratch as base
+ARG ARCH=x86_64
+ENV VERSION=1.0.8
+ENV SRC_HASH=ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269
+ENV SRC_FILE=bzip2-${VERSION}.tar.gz
+ENV SRC_SITE=https://sourceware.org/pub/bzip2/${SRC_FILE}
+
+FROM base as fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch as build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR bzip2-${VERSION}
+RUN --network=none <<-EOF
+	set -ex
+    make -f Makefile-libbz2_so all
+    make all
+EOF
+
+FROM build as install
+RUN --network=none <<-EOF
+    make PREFIX="/rootfs/usr" install
+    find /rootfs -exec touch -hcd "@0" "{}" +
+EOF
+
+FROM stagex/filesystem as package
+COPY --from=install /rootfs/. /

packages/eudev/Containerfile

@@ -29,5 +29,5 @@ FROM build AS install
 RUN --network=none DESTDIR=/rootfs make install
 RUN --network=none find /rootfs -exec touch -hcd "@0" "{}" +
 
-FROM scratch AS package
+FROM stagex/filesystem AS package
 COPY --from=install /rootfs/. /

packages/gmp/Containerfile

@@ -33,5 +33,5 @@ FROM build AS install
 RUN --network=none DESTDIR=/rootfs make install
 RUN --network=none find /rootfs -exec touch -hcd "@0" "{}" +
 
-FROM scratch AS package
+FROM stagex/filesystem AS package
 COPY --from=install /rootfs/. /

packages/gperf/Containerfile

@@ -27,5 +27,5 @@ FROM build AS install
 RUN --network=none DESTDIR=/rootfs make install
 RUN --network=none find /rootfs -exec touch -hcd "@0" "{}" +
 
-FROM scratch AS package
+FROM stagex/filesystem AS package
 COPY --from=install /rootfs/. /

packages/icu/Containerfile

@@ -0,0 +1,49 @@
+FROM scratch as base
+ARG ARCH=x86_64
+ENV VERSION=74.2
+ENV SRC_HASH=68db082212a96d6f53e35d60f47d38b962e9f9d207a74cfac78029ae8ff5e08c
+ENV SRC_DATA_HASH=c28c3ca5f4ba3384781797138a294ca360988d4322674ad4d51e52f5d9b0a2b6
+ENV SRC_DATA_BIN_B_HASH=42a12ebfb1a82f80bb0005d9b6e018382ccaa2462f0d086a8c69ae736fdded3e
+ENV SRC_DATA_BIN_L_HASH=2acdb1b982228040963d183b2dd9d321252c613e0f4db213d4bbc10417cde569
+ENV SRC_FILE=icu4c-74_2-src.tgz
+ENV SRC_SITE=https://github.com/unicode-org/icu/releases/download/release-74-2
+
+FROM base as fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE}/${SRC_FILE} .
+ADD --checksum=sha256:${SRC_DATA_HASH} ${SRC_SITE}/icu4c-74_2-data.zip .
+ADD --checksum=sha256:${SRC_DATA_BIN_B_HASH} ${SRC_SITE}/icu4c-74_2-data-bin-b.zip .
+ADD --checksum=sha256:${SRC_DATA_BIN_L_HASH} ${SRC_SITE}/icu4c-74_2-data-bin-l.zip .
+
+FROM fetch as build
+COPY --from=stagex/bash . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/make . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+RUN tar -xzf ${SRC_FILE}
+WORKDIR icu/source
+RUN --network=none <<-EOF
+    ./configure \
+        --build=${ARCH}-linux-musl \
+        --host=${ARCH}-linux-musl \
+        --prefix=/usr \
+        --sysconfdir=/etc \
+        --mandir=/usr/share/man
+        --with-data-packaging=archive \
+        --disable-samples \
+        --enable-static
+    make
+EOF
+
+FROM build as install
+RUN --network=none <<-EOF
+    make DESTDIR=/rootfs install
+    install -D -m644 /icu4c-74_2-data.zip /rootfs/usr/share/icu/74.2/
+    install -D -m644 /icu4c-74_2-data-bin-b.zip /rootfs/usr/share/icu/74.2/
+    install -D -m644 /icu4c-74_2-data-bin-l.zip /rootfs/usr/share/icu/74.2/
+EOF
+RUN find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM stagex/filesystem as package
+COPY --from=install /rootfs /

packages/iputils/Containerfile

@@ -0,0 +1,104 @@
+FROM scratch AS base
+ENV VERSION=20240117
+ENV SRC_HASH=a5d66e2997945b2541b8f780a7f5a5ec895d53a517ae1dc4f3ab762573edea9a
+ENV SRC_FILE=${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/iputils/iputils/archive/refs/tags/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/libcap . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/meson . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/python . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/libxslt . /
+COPY --from=stagex/linux-headers . /
+COPY --from=stagex/ninja . /
+RUN tar -xzf ${SRC_FILE}
+WORKDIR iputils-${VERSION}
+RUN --network=none <<-EOF
+    set -eux;
+    ./configure
+    meson env2mfile \
+        --native \
+        --system=linux \
+        --cpu-family=x86_64 \
+        --cpu=x86_64 \
+        --endian=little \
+        -o meson.cross
+    meson setup \
+        --prefix=/usr \
+        --libdir=/usr/lib \
+        --libexecdir=/usr/libexec \
+        --bindir=/usr/bin \
+        --sbindir=/usr/sbin \
+        --includedir=/usr/include \
+        --datadir=/usr/share \
+        --mandir=/usr/share/man \
+        --infodir=/usr/share/info \
+        --localedir=/usr/share/locale \
+        --sysconfdir=/etc \
+        --localstatedir=/var \
+        --sharedstatedir=/var/lib \
+        --buildtype=plain \
+        --auto-features=auto \
+        --wrap-mode=nodownload \
+        --default-library=both \
+        --cross-file=meson.cross \
+        -Db_lto=false \
+        -DNO_SETCAP_OR_SUID=true \
+        -DBUILD_MANS=false \
+        -DUSE_IDN=false \
+        -DUSE_GETTEXT=false \
+        . output
+    meson compile -C output
+EOF
+
+FROM build AS install
+RUN <<-EOF
+    set -eux
+    DESTDIR=/rootfs meson install --no-rebuild -C output
+    find /rootfs -exec touch -hcd "@0" "{}" +
+EOF
+
+FROM base AS test
+COPY --from=install /rootfs /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/meson . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+RUN <<-EOF
+    set -eux
+    ARPING_VERSION=$(arping -V)
+    CLOCKDIFF_VERSION=$(clockdiff -V)
+    PING_VERSION=$(ping -V)
+    TRACEPATH_VERSION=$(tracepath -V)
+
+    if [ "${ARPING_VERION}" != "arping from iputils ${VERSION}"]; then
+        echo "Expected arping version ${VERSION} but got ${ARPING_VERSION}"
+        exit 1
+    fi
+
+    if [ "${CLOCKDIFF_VERION}" != "arping from iputils ${VERSION}"]; then
+        echo "Expected arping version ${VERSION} but got ${CLOCKDIFF_VERSION}"
+        exit 1
+    fi
+
+    if [ "${PING_VERION}" != "arping from iputils ${VERSION}"]; then
+        echo "Expected arping version ${VERSION} but got ${PING_VERSION}"
+        exit 1
+    fi
+
+    if [ "${TRACEPATH_VERION}" != "arping from iputils ${VERSION}"]; then
+        echo "Expected arping version ${VERSION} but got ${TRACEPATH_VERSION}"
+        exit 1
+    fi
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs /

packages/keyfork/Containerfile

@@ -1,93 +1,54 @@
-ARG RUST_VERSION=1.76.0
-
 FROM scratch AS base
-ENV VERSION=0.1.0
-# https://git.distrust.co/public/keyfork/archive/keyfork-v0.1.0.tar.gz
-ENV SRC_HASH=f6104056538f846a9575e8e407a1e5bb938eac47b3852de4c7359a6972abdcda
-ENV SRC_FILE=keyfork-v${VERSION}.tar.gz
+ENV VERSION=37f63fd63ac58ba338719395977054d9d3202325
+ENV SRC_HASH=ba59a3090f0ad9fe051197f1f4b77d70dcb92eceaa3dff80133887e46b271cf8
+ENV SRC_FILE=${VERSION}.tar.gz
 ENV SRC_SITE=https://git.distrust.co/public/keyfork/archive/${SRC_FILE}
 
 FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
-
-FROM stagex/rust:${RUST_VERSION} AS rust
-FROM fetch AS rust-fetch
-
+COPY --from=stagex/rust . /
 COPY --from=stagex/busybox . /
 COPY --from=stagex/musl . /
-COPY --from=rust . /
-
 COPY --from=stagex/gcc . /
 COPY --from=stagex/llvm . /
 COPY --from=stagex/libunwind . /
 COPY --from=stagex/openssl . /
 COPY --from=stagex/zlib . /
-
-# NOTE: Necessary for `cargo fetch`, but CA trust is not relied upon
 COPY --from=stagex/ca-certificates . /
-
-RUN --network=none <<EOF
-set -eux
-mkdir keyfork
-tar xf ${SRC_FILE}
-EOF
-
+RUN tar xf ${SRC_FILE}
 WORKDIR keyfork
+ADD <<-EOF /.cargo/config.toml
+	[registries.distrust]
+	index = "https://git.distrust.co/public/_cargo-index.git"
+	EOF
+RUN cargo fetch
 
-ADD <<EOF /.cargo/config.toml
-[registries.distrust]
-index = "https://git.distrust.co/public/_cargo-index.git"
-EOF
-
-RUN cargo fetch 
-
-FROM rust-fetch AS build
-
-# Rust build deps
-
-COPY --from=stagex/binutils . /
-COPY --from=stagex/gcc . /
-COPY --from=stagex/llvm . /
-COPY --from=stagex/make . /
-COPY --from=stagex/musl . /
-
-# Keyfork build deps
-
+FROM fetch AS build
 COPY --from=stagex/clang . /
 COPY --from=stagex/linux-headers . /
 COPY --from=stagex/gmp . /
 COPY --from=stagex/nettle . /
 COPY --from=stagex/pcsc-lite . /
 COPY --from=stagex/pkgconf . /
-
+COPY --from=stagex/binutils . /
 ENV RUST_BACKTRACE=1
-ENV RUSTFLAGS='-C target-feature=-crt-static -C codegen-units=1'
-ENV GIT_REVISION=d338ed98cbb7dd1e9de9340ae9486880dfcb389a
+ENV NETTLE_STATIC=yes
+ENV PCSC_LIB_NAME=static=pcsclite
+ENV RUSTFLAGS='-C codegen-units=1 -C target-feature=+crt-static'
+RUN --network=none \
+    cargo build \
+        --frozen \
+        --release \
+        --target x86_64-unknown-linux-musl \
+        --bin keyfork
 
-RUN --network=none cargo build --frozen --release --bin keyfork
-
-FROM scratch AS install
-
-COPY --from=stagex/busybox . /
-
-COPY --from=stagex/busybox . /rootfs
-COPY --from=stagex/libunwind . /rootfs
-COPY --from=stagex/gcc . /rootfs
-COPY --from=stagex/musl . /rootfs
-
-# HACK: gcc puts things in /usr/lib64 
-COPY --from=stagex/gcc /usr/lib64/* /rootfs/usr/lib/
-
-COPY --from=stagex/gmp . /rootfs
-COPY --from=stagex/nettle . /rootfs
-COPY --from=stagex/pcsc-lite . /rootfs
-
-COPY --from=build keyfork/target/release/keyfork /rootfs/usr/bin/keyfork
-RUN --network=none find /rootfs -exec touch -hcd "@0" "{}" +
-
-FROM scratch AS package
+FROM build AS install
+RUN <<-EOF
+    set -eux
+    mkdir -p /rootfs/usr/bin
+    cp target/x86_64-unknown-linux-musl/release/keyfork /rootfs/usr/bin/keyfork
+    find /rootfs -exec touch -hcd "@0" "{}" +
+EOF
 
+FROM stagex/filesystem AS package
 COPY --from=install /rootfs/. /
-
-ENTRYPOINT ["/usr/bin/keyfork"]
-CMD ["--version"]

packages/libcap/Containerfile

@@ -16,14 +16,12 @@ COPY --from=stagex/make . /
 COPY --from=stagex/musl . /
 COPY --from=stagex/perl . /
 COPY --from=stagex/gcc . /
-# HACK: figure out why gcc package puts these in the wrong path at install time
-COPY --from=stagex/gcc /usr/lib64/* /usr/lib/
 RUN tar -xzf ${SRC_FILE}
 WORKDIR libcap-${VERSION}
-RUN --network=none ARCH=x86_64 make 
+RUN --network=none make lib=lib prefix=/usr GOLANG=no DESTDIR=/rootfs
 
 FROM build as install
-RUN --network=none make DESTDIR=/rootfs install
+RUN --network=none make lib=lib prefix=/usr GOLANG=no DESTDIR=/rootfs install
 RUN find /rootfs -exec touch -hcd "@0" "{}" +
 
 FROM scratch as test
@@ -36,5 +34,5 @@ RUN --network=none <<-EOF
 	capsh --license | grep License || true
 EOF
 
-FROM scratch as package
+FROM stagex/filesystem as package
 COPY --from=install /rootfs /

packages/libgcrypt/Containerfile

@@ -16,6 +16,7 @@ COPY --from=stagex/make . /
 COPY --from=stagex/libgpg-error . /
 RUN tar -xvf $SRC_FILE
 WORKDIR libgcrypt-${VERSION}
+ENV SOURCE_DATE_EPOCH=1
 RUN --network=none <<-EOF
 	set -eux
 	./configure \

packages/libgpg-error/Containerfile

@@ -16,6 +16,7 @@ COPY --from=stagex/make . /
 COPY --from=stagex/npth . /
 RUN tar -xvf $SRC_FILE
 WORKDIR libgpg-error-${VERSION}
+ENV SOURCE_DATE_EPOCH=1
 RUN --network=none <<-EOF
 	set -eux
 	./configure \

packages/libqrencode/Containerfile

@@ -0,0 +1,39 @@
+FROM scratch as base
+ARG ARCH=x86_64
+ENV VERSION=4.1.1
+ENV SRC_HASH=da448ed4f52aba6bcb0cd48cac0dd51b8692bccc4cd127431402fca6f8171e8e
+ENV SRC_FILE=qrencode-${VERSION}.tar.gz
+ENV SRC_SITE=https://fukuchi.org/works/qrencode/${SRC_FILE}
+
+FROM base as fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch as build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/linux-headers . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+RUN tar -xzf ${SRC_FILE}
+WORKDIR qrencode-${VERSION}
+RUN --network=none <<-EOF
+	set -eux
+	./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info \
+		--localstatedir=/var \
+		--with-tests
+	make -j "$(nproc)"
+EOF
+
+FROM build as install
+RUN --network=none make DESTDIR="/rootfs" install
+RUN find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM stagex/filesystem as package
+COPY --from=install /rootfs/. /

packages/libxslt/Containerfile

@@ -0,0 +1,43 @@
+FROM scratch as base
+ENV VERSION=1.1.39
+ENV SRC_HASH=2a20ad621148339b0759c4d4e96719362dee64c9a096dbba625ba053846349f0
+ENV SRC_FILE=libxslt-${VERSION}.tar.xz
+ENV SRC_SITE=https://download.gnome.org/sources/libxslt/1.1/${SRC_FILE}
+
+FROM base as fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch as build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/libtool . /
+COPY --from=stagex/libxml2 . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/m4 . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR libxslt-${VERSION}
+RUN --network=none <<-EOF
+    set -eux
+    ./configure \
+        --build=x86_64-unknown-linux-musl \
+        --host=x86_64-unknown-linux-musl \
+        --prefix=/usr \
+        --with-python=no \
+        --enable-static
+    make
+EOF
+
+FROM build as install
+RUN --network=none <<-EOF
+    set -eux
+    make DESTDIR=/rootfs install
+    find /rootfs -exec touch -hcd "@0" "{}" +
+EOF
+
+FROM stagex/filesystem as package
+COPY --from=install /rootfs/. /

packages/nettle/Containerfile

@@ -35,5 +35,5 @@ FROM build AS install
 RUN --network=none DESTDIR=/rootfs make install
 RUN --network=none find /rootfs -exec touch -hcd "@0" "{}" +
 
-FROM scratch AS package
+FROM stagex/filesystem AS package
 COPY --from=install /rootfs/. /

packages/python/Containerfile

@@ -15,6 +15,7 @@ COPY --from=stagex/make . /
 COPY --from=stagex/musl . /
 COPY --from=stagex/openssl . /
 COPY --from=stagex/zlib . /
+COPY --from=stagex/bzip2 . /
 RUN tar -xf ${SRC_FILE}
 WORKDIR Python-${VERSION}
 ENV SOURCE_DATE_EPOCH=1

packages/rust/Containerfile

@@ -106,12 +106,16 @@ COPY <<-'EOF' build.sh
 	VERSION=${1}
 	BUILD_VERSION=${2}
 	TOOLS=${3:-cargo}
+	PATCHES=${4:-}
 	PREFIX=/rust-${VERSION}/usr
 	BUILD_PREFIX=/rust-${BUILD_VERSION}/usr
 	#HACK because rust build seemindly ignores LD_LIBRARY_PATH
 	cp ${BUILD_PREFIX}/lib/rustlib/x86_64-unknown-linux-musl/lib/*.so /usr/lib
 	tar -xzf rustc-${VERSION}-src.tar.gz
 	cd rustc-${VERSION}-src
+	[[ -z "$PATCHES" ]] || for name in ${PATCHES//,/ }; do
+		patch -p1 < ../${name}.patch
+	done
 	./configure \
 		--build="x86_64-unknown-linux-musl" \
 		--host="x86_64-unknown-linux-musl" \
@@ -184,7 +188,9 @@ RUN sh build.sh 1.74.0 1.73.0
 # HACK: Required by Rust 1.75.0
 RUN mkdir -p $HOME/.cargo/registry/src/index.crates.io-6f17d22bba15001f/
 RUN sh build.sh 1.75.0 1.74.0
-RUN sh build.sh 1.76.0 1.75.0 cargo,clippy,rustdoc,rustfmt,rust-demangler
+
+ADD no-default-static.patch .
+RUN sh build.sh 1.76.0 1.75.0 cargo,clippy,rustdoc,rustfmt,rust-demangler no-default-static
 
 FROM build as install
 RUN <<-EOF

packages/rust/no-default-static.patch

@@ -0,0 +1,58 @@
+From: Jakub Jirutka <jakub@jirutka.cz>
+Date: Sat, 08 Aug 2016 15:06:00 +0200
+Subject: [PATCH] Fix linux_musl_base for native musl host
+
+See https://github.com/rust-lang/rust/pull/40113
+
+--- a/compiler/rustc_target/src/spec/base/linux_musl.rs
++++ b/compiler/rustc_target/src/spec/base/linux_musl.rs
+@@ -1,16 +1,12 @@
+-use crate::spec::crt_objects;
+-use crate::spec::{base, LinkSelfContainedDefault, TargetOptions};
++use crate::spec::{base, TargetOptions};
+ 
+ pub fn opts() -> TargetOptions {
+     let mut base = base::linux::opts();
+ 
+     base.env = "musl".into();
+-    base.pre_link_objects_self_contained = crt_objects::pre_musl_self_contained();
+-    base.post_link_objects_self_contained = crt_objects::post_musl_self_contained();
+-    base.link_self_contained = LinkSelfContainedDefault::InferredForMusl;
+ 
+     // These targets statically link libc by default
+-    base.crt_static_default = true;
++    base.crt_static_default = false;
+ 
+     base
+ }
+--- a/compiler/rustc_target/src/spec/crt_objects.rs
++++ b/compiler/rustc_target/src/spec/crt_objects.rs
+@@ -58,28 +61,6 @@
+         (LinkOutputKind::StaticPicExe, &[obj]),
+         (LinkOutputKind::DynamicDylib, &[obj]),
+         (LinkOutputKind::StaticDylib, &[obj]),
+-    ])
+-}
+-
+-pub(super) fn pre_musl_self_contained() -> CrtObjects {
+-    new(&[
+-        (LinkOutputKind::DynamicNoPicExe, &["crt1.o", "crti.o", "crtbegin.o"]),
+-        (LinkOutputKind::DynamicPicExe, &["Scrt1.o", "crti.o", "crtbeginS.o"]),
+-        (LinkOutputKind::StaticNoPicExe, &["crt1.o", "crti.o", "crtbegin.o"]),
+-        (LinkOutputKind::StaticPicExe, &["rcrt1.o", "crti.o", "crtbeginS.o"]),
+-        (LinkOutputKind::DynamicDylib, &["crti.o", "crtbeginS.o"]),
+-        (LinkOutputKind::StaticDylib, &["crti.o", "crtbeginS.o"]),
+-    ])
+-}
+-
+-pub(super) fn post_musl_self_contained() -> CrtObjects {
+-    new(&[
+-        (LinkOutputKind::DynamicNoPicExe, &["crtend.o", "crtn.o"]),
+-        (LinkOutputKind::DynamicPicExe, &["crtendS.o", "crtn.o"]),
+-        (LinkOutputKind::StaticNoPicExe, &["crtend.o", "crtn.o"]),
+-        (LinkOutputKind::StaticPicExe, &["crtendS.o", "crtn.o"]),
+-        (LinkOutputKind::DynamicDylib, &["crtendS.o", "crtn.o"]),
+-        (LinkOutputKind::StaticDylib, &["crtendS.o", "crtn.o"]),
+     ])
+ }
+ 

packages/sxctl/Containerfile

@@ -1,8 +1,8 @@
 FROM scratch as base
-ENV VERSION=0.0.4
+ENV VERSION=0.0.5
 ENV SRC_FILE=v${VERSION}.tar.gz
 ENV SRC_SITE=https://codeberg.org/stagex/sxctl/archive/${SRC_FILE}
-ENV SRC_HASH=ea911883d193688cbb32d7106fb20f159536f9f98350e67d73a9e24df795b8c8
+ENV SRC_HASH=26f0dd95e72b632036c598d055ef6b78cec88c497dd67ede30d1498bb8229412
 
 FROM base as fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .