Merge branch 'staging'

This fixes an issue when docker is run as a different user, which results in the tar file being owned by that user

.forgejo/workflows/merge-main-check.yml

@@ -0,0 +1,21 @@
+name: merge-main-check
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - reopened
+      - synchronize
+
+defaults:
+  run:
+    shell: 'sh -e {0}'
+
+jobs:
+  check:
+    name: Check if non-staging -> main
+    runs-on: shell
+    if: github.base_ref == 'main' && !startsWith(github.ref, 'refs/heads/release/') && github.head_ref != 'staging'
+    steps:
+      - name: Check if non-staging -> main
+        run: echo 'Cannot merge non-staging branch to main'; exit 1

.taplo.toml

@@ -0,0 +1 @@
+include = ["MAINTAINERS", ".taplo.toml"]

AUTHORS

@@ -1,10 +0,0 @@
-# This is the list of the significant contributors to this repository
-#
-# This does not necessarily list everyone who has contributed code,
-# especially since many employees of one corporation may be contributing.
-# To see the full list of contributors, see the revision history in
-# source control.
-
-Distrust, LLC
-Lance Vick
-Turnkey Global, Inc.

CODE_OF_CONDUCT.md

@@ -0,0 +1,134 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official email address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+[#stagex:matrix.org][stagex-matrix] or by directly messaging any of the Matrix
+room administrators.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
+[https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations
+[stagex-matrix]: https://matrix.to/#/#stagex:matrix.org

CONTRIBUTING.md

@@ -0,0 +1,169 @@
+![[Stage<sup>x</sup>]](https://codeberg.org/repo-avatars/02eca12ad01b1b867ca7708117645b4d9791a7f7a30abd6d8e1dc20900f7b0d7)
+# Contributing to Stagex 
+
+We'd be happy to have you join the community! 
+Below are the steps and processes that we follow.
+
+## Topics
+
+* [Reporting Issues](#reporting-issues)
+* [Working On Issues](#working-on-issues)
+* [Contributing to Stagex as package maintainer](#contributing-to-stagex-as-package-maintainer)
+* [Helpful one liners](#helpful-one-liners)
+* [Submitting Pull Requests](#submitting-pull-requests)
+* [Communications](#communications)
+
+## Reporting Issues
+
+Before reporting an issue, check our backlog of
+[open issues](https://codeberg.org/stagex/stagex/issues)
+to see if someone else has already reported it. If so, feel free to add
+your scenario, or additional information, to the discussion or simply
+"subscribe" to it to be notified when it is updated.
+If you find a new issue with the project we'd love to hear about it! 
+The most important aspect of a bug report is that it includes enough information for
+us to reproduce it. 
+Please don't include any private/sensitive information in your issue!
+
+## Working On Issues
+
+Once you have decided to contribute to Stagex by working on an issue, check our
+backlog of [open issues](https://codeberg.org/stagex/stagex/issues) looking
+for any that do not have an "In Progress" label attached to it.  Often issues
+will be assigned to someone, to be worked on at a later time.
+
+## Contributing to Stagex as package maintainer 
+
+This section describes how to start a contribution to Stagex. 
+These instructions are geared towards using a Linux development machine,
+preferably Debian, which is required for setting up your development tools.
+
+### Fork and clone Stagex 
+
+First you need to fork this project on Codeberg.
+Then clone your fork locally:
+```shell
+$ git clone git@codeberg.com:<you>/stagex 
+$ cd  stagex
+```
+
+### Prepare your environment
+```
+$ sh ./src/setup-debian-12.sh
+```
+
+### Deal with make
+
+Stagex uses a Makefile to build everything.
+
+Populate your local registry by building from scratch
+```shell
+$ make all
+```
+|
+OR
+|
+Prepopulate your docker local registry
+```shell
+$ make preseed 
+$ rm -rf ./out/sxctl
+$ make sxctl
+```
+
+Find if there is a relevant package that you can use as a boilerplate for the 
+new addition.
+```sh
+cp -R packages/python packages/cython
+vim packages/cython/Containerfile
+# fix SRC_FILE, SRC_HASH, SRC_URL etc manually
+# incorporate anything relevant from Alpine's build(){ block }  for {package} 
+# https://git.alpinelinux.org/aports/tree/main/cython/APKBUILD
+make gen-make
+make cython
+make digests.txt 
+```
+
+Then you can commit {signed} and push your package and open a PR.
+IMPORTANT: the PR should be just the `Containerfile`, and the added block for
+the package you are contributing in `packages.mk`
+
+## Helpful one liners
+<--author: Lance R. Vick -->
+
+- see contents of a package:
+```sh
+package=somepackage tar -tvf $(find out/${package} -type f -printf '%s %p\n' | sort -nr | head -n1 | awk '{ print $2 }') | less
+```
+
+- test package for reproducibility:
+```sh
+mkdir out2;
+package=somepackage; rm -rf out{,2}/${package}; make NOCACHE=1 ${package}; mv out/${package} out2/${package}; make NOCACHE=1 ${package}; diffoscope $(find out*/${package} -type f -printf '%s %p\n' | sort -nr | head -n2 | awk '{ print $2 }' | tr '\n' ' ')
+```
+
+- make svg graph of dependency tree for a single package
+```sh
+package=somepackage; make -Bnd ${package} | make2graph | dot -Tsvg -o ${package}-graph.svg
+```
+<--author: Lance R. Vick -->
+
+## Submitting Pull Requests
+
+No Pull Request (PR) is too small! Typos, additional comments in the code,
+new test cases, bug fixes, new features, more documentation, ... all kinds
+of contribution are welcome.
+
+While bug fixes can first be identified via an "issue", that is not required.
+It's ok to just open up a PR with the fix, but make sure you include the same
+information you would have included in an issue - like how to reproduce it.
+
+PRs for new features should include some background on what use cases the
+new code is trying to address. When possible and when it makes sense, try to break-up
+larger PRs into smaller ones - it's easier to review smaller
+code changes. But only if those smaller ones make sense as stand-alone PRs.
+
+Regardless of the type of PR, all PRs should include:
+* well documented code changes.
+
+PRs that fix issues should include a reference like `Closes #XXXX` in the
+commit message so that Codeberg will automatically close the referenced issue
+when the PR is merged.
+
+PRs will be approved by a [maintainer] listed in [`MAINTAINERS`](MAINTAINERS).
+
+In case you're only changing docs, make sure to prefix the PR title with
+"[CI:DOCS]". 
+
+### Describe your Changes in Commit Messages
+
+Describe your problem. Whether your patch is a one-line bug fix or 5000 lines
+of a new feature, there must be an underlying problem that motivated you to do
+this work. Convince the reviewer that there is a problem worth fixing and that
+it makes sense for them to read past the first paragraph.
+
+Describe user-visible impact. Straight up crashes and lockups are pretty
+convincing, but not all bugs are that blatant. Even if the problem was spotted
+during code review, describe the impact you think it can have on users. Keep in
+mind that the majority of users run packages provided by distributions, so
+include anything that could help route your change downstream.
+
+### Sign your commits
+
+Your signature certifies that you wrote the patch or otherwise have the right to pass
+it on as an open-source patch.
+
+If you set your `user.name` and `user.email` git configs, you can sign your
+commit automatically with `git commit -s`.
+
+
+## Communications
+
+For general questions and discussion, please use the
+[matrix://#stagex:matrix.org](https://matrix.to/#/#stagex:matrix.org) | [ircs://irc.oftc.net:6697#stagex](https://webchat.oftc.net/?channels=stagex&uio=MT11bmRlZmluZWQmMTE9MTk14d)
+
+For discussions around issues/bugs and features, you can use Codeberg 
+[issues](https://codeberg.org/stagex/stagex/issues)
+and
+[PRs](https://codeberg.org/stagex/stagex/pulls)
+tracking system.
+

MAINTAINERS

@@ -0,0 +1,160 @@
+[people]
+
+[people.lancevick]
+name = "Lance Vick"
+location = "Silicon Valley, USA"
+email = "stagex@lance.vick.house"
+matrix = "@lance:matrix.org"
+fediverse = "@lrvick@mastodon.social"
+keyoxide = "https://keyoxide.org/E90A401336C8AAA9"
+website = "https://lance.dev"
+
+[people.antonlivaja]
+name = "Anton Livaja"
+location = "Toronto, Canada"
+email = "stagex@livaja.me"
+matrix = "@antonleviathan:matrix.org"
+fediverse = "@anton@mastodon.online"
+keyoxide = "https://keyoxide.org/DC4B7D1F52E0BA4D"
+website = "https://antonlivaja.com/"
+
+[people.ryanheywood]
+name = "Ryan Heywood"
+location = "Florida, USA"
+email = "me@ryansquared.pub"
+matrix = "@ryansquared:beeper.com"
+fediverse = "@ryan@tilde.zone"
+keyoxide = "https://keyoxide.org/8E401478A3FBEF72"
+website = "https://ryansquared.pub"
+
+[people.dannygrove]
+name = "Danny Grove"
+location = "California, USA"
+email = "stagex@dannygrove.com"
+matrix = "@dgrove:matrix.org"
+keyoxide = "https://keyoxide.org/C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD"
+website = "https://dannygrove.com"
+
+[keys]
+
+[keys.lancevick.personal]
+id = "6B61ECD76088748C70590D55E90A401336C8AAA9"
+algorithm = "RSA4096"
+servers = "openpgp.org"
+devices = "Yubikey 4 Nano, Yubikey 5c, FST-01"
+offline-ca = true
+backup = true
+interaction = true
+
+[keys.antonlivaja.personal]
+id = "F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D"
+algorithm = "RSA4096"
+servers = "openpgp.org"
+devices = "Yubikey 5c"
+offline-ca = true
+backup = true
+interaction = true
+
+[keys.ryanheywood.personal]
+id = "88823A75ECAA786B0FF38B148E401478A3FBEF72"
+algorithm = "RSA4096"
+servers = "openpgp.org"
+devices = "Yubikey 4c Nano, Yubikey 5 NFC"
+offline-ca = false
+backup = true
+interaction = true
+
+[keys.dannygrove.personal]
+id = "C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD"
+algorithm = "RSA4096"
+servers = "openpgp.org"
+devices = "Yubikey 5 NFC, Yubikey 5C"
+offline-ca = true
+backup = true
+interaction = true
+
+[machines]
+
+[machines.lancevick.local1]
+owner = "Lance Vick"
+location = "Silicon Valley, USA"
+type = "metal"
+arch = "x86_64"
+brand = "AMD"
+model = "Ryzen Threadripper 2990WX"
+ghz = 3
+cores = 32
+os = "QubesOS / Debian"
+runtime = "Docker"
+
+[machines.antonlivaja.local1]
+owner = "Anton Livaja"
+location = "Toronto, Canada"
+type = "metal"
+arch = "x86_64"
+brand = "AMD"
+model = "Ryzen Threadripper 2970X"
+ghz = 3
+cores = 24
+os = "QubesOS / Debian"
+runtime = "Docker"
+
+[machines.lancevick.remote1]
+owner = "Hetzner Online GmbH"
+location = "Finland, Europe"
+type = "metal"
+arch = "x86_64"
+brand = "AMD"
+model = "EPYC 7502P"
+ghz = 2.2
+cores = 32
+os = "Debian"
+runtime = "Docker"
+
+[machines.antonlivaja.remote1]
+owner = "Hetzner Online GmbH"
+location = "Hillsboro, OR, USA"
+type = "vm"
+arch = "x86_64"
+brand = "AMD"
+model = "EPYC Milan"
+ghz = 2.0
+cores = 32
+os = "Debian"
+runtime = "Docker"
+
+[machines.ryanheywood.remote]
+owner = "Hetzner Online GmbH"
+location = "Falkstein, Germany"
+type = "metal"
+arch = "x86_64"
+brand = "AMD"
+model = "Ryzen Threadripper 2950X"
+ghz = 3.5
+cores = 16
+os = "Debian"
+runtime = "Docker"
+
+[machines.dannygrove.local1]
+owner = "Danny Grove"
+location = "California, USA"
+type = "metal"
+arch = "x86_64"
+brand = "Intel"
+model = "Intel(R) Core(TM) i7-6700K CPU @ 4.00GHz"
+ghz = 4.2
+cores = 4
+os = "arch Linux"
+runtime = "Docker"
+
+[machines.dannygrove.local2]
+owner = "Danny Grove"
+location = "California, USA"
+type = "metal"
+arch = "x86_64"
+brand = "AMD"
+model = "AMD Ryzen 7 7840U"
+ghz = 3.3
+cores = 8
+os = "arch Linux"
+runtime = "Docker"

MAINTENANCE.md

@@ -0,0 +1,35 @@
+## Pull Requests
+
+Pull requests for every change should follow the given flow:
+`pull-request-branch -> staging -> current-release-branch -> staging -> main`.
+Making a commit short-cut the staging or the release branch removes the ability
+to track who approves contributions and when those contributions has been
+approved. If a patch is necessary for a release, it should flow from a PR, to
+staging, to the release branch. The release branch should not contain any
+changes (ignoring `digests.txt` and signatures) that do not exist in `staging`.
+
+Pull requests should be merged using a signed merge commit. To configure your
+Git porcelain to always use merge commits, run `git config merge.ff false`. To
+configure your Git porcelain to always sign commits, run `git config
+commit.gpgsign true`.
+
+## Release Branches
+
+Release branches take the format `YYYY.MM.release`. A release should include a
+PR to staging to introduce a bump to `digests.txt`, creating the release
+branch. Once the branch is created, other maintainers should begin reproducing.
+The release engineer should run `make sign` to ensure a signature exists for
+every package included in the release.
+
+In the Git forge UI, the release pull request should target the `main` branch,
+to provide a summary of all changes since the latest release.
+
+Any commits required once the branch is created, but before the release is
+published, should flow from a PR (if push access to the release branch is not
+given) to staging, where the release branch can then rebase on staging.
+
+Once a release is published, the release branch should perform a signed merge
+commit into staging, followed by a signed merge commit from staging to main.
+Any further pull requests to the branch after the series of releases is done
+(which may be published after release, if strictly necessary) can target the
+release branch, and the release branch will live on its own.

Makefile

@@ -1,60 +1,24 @@
-export PLATFORM := linux/amd64
-export BUILDER := $(shell which docker)
-export REGISTRY_LOCAL := stagex-local
-export REGISTRY_REMOTE := stagex
-export NOCACHE ?= 0
-export MIRRORS := \
-	git.distrust.co \
-	hub.docker.com
-ifeq ($(NOCACHE), 1)
-NOCACHE_FLAG=--no-cache
-else
-NOCACHE_FLAG=
-endif
-export NOCACHE_FLAG
-clean_logs := $(shell rm *.log 2>&1 >/dev/null || :)
+include src/global.mk
 
-DEFAULT_GOAL := default
-.PHONY: default
-default: all
+all: $(all_packages)
 
-include src/macros.mk
-include src/packages.mk
-include src/groups.mk
+check:
+	@$(MAKE) CHECK=1 all
 
-.PHONY: all
-all: \
-	compat \
-	$(shell find packages/* -type d -exec sh -c 'basename {} | tr "\n" " "' \; ) \
-	digests.txt
+verify:
+	@$(call verify)
 
-.PHONY: compat
-compat:
-	./src/compat.sh
-
-.PHONY: digests
 digests:
-	@for each in $$(find out -iname "index.json"| sort); do \
-		printf \
-			"%s %s\n"  \
-			$$(cat $$each | jq -r '.manifests[].digest | sub ("sha256:";"")') \
-			"$$(basename $$(dirname $$each))";  \
-	done
+	@$(call digests)
 
-digests.txt: all
-	mv $@ .$@.old
-	$(MAKE) digests > $@
-	diff $@.old $@
+release: all
+	@$(call digests) > digests.txt
 
-out/graph.svg: Makefile
-	$(MAKE) -Bnd | make2graph | dot -Tsvg -o graph.svg
+sign: release
+	@$(call sign)
 
-src/packages.mk: out/sxctl/index.json $(shell find packages/*/Containerfile | tr '\n' ' ')
-	env -C out/sxctl tar -cf - . | docker load
-	docker run \
-		--rm \
-		--volume .:/src \
-		--user $(shell id -u):$(shell id -g) \
-		stagex/sxctl -baseDir=/src gen make
-	touch $@
+compat:
+	@./src/compat.sh
 
+preseed:
+	@./src/preseed.sh

PULL_REQUEST_TEMPLATE.yaml

@@ -0,0 +1,31 @@
+name: "Pull Request"
+about: "Submit a pull request"
+ref: "main"
+body:
+- type: textarea
+  id: description
+  attributes:
+    label: What changes does this PR introduce?
+  validation:
+    required: false
+- type: textarea
+  id: what-modifies
+  attributes:
+    label: What package does this PR add or modify, if any?
+  validations:
+    required: false
+- type: textarea
+  id: digests
+  attributes:
+    label: Package digests
+    description: Please copy and paste the digests 
+    placeholder: "$ make digests | xclip -sel c"
+    render: shell
+- type: checkboxes
+  id: reproduce
+  attributes:
+    label: If modifying packages, have the packages been reproduced locally?
+    description: This is optional, but helps reduce maintenance burden.
+    options:
+    - label: I have built this package twice and confirmed it reproduces.
+      required: false

README.md

@@ -5,7 +5,7 @@
 ---
 
 Minimalism and security first repository of reproducible and multi-signed OCI
-images of common open source software toolchains full-source bootsrapped from
+images of common open source software toolchains full-source bootstrapped from
 Stage 0 all the way up.
 
 If you want to build or deploy software on a foundation of minimalism and
@@ -18,34 +18,53 @@ You can do anything with these images you would with most any other musl based
 containerized linux distro, only with high supply chain integrity and
 determinism.
 
-For a full list of images see the "src" directory.
+For a full list of images see the "packages" directory.
 
 ### Examples
 
 Get a shell in our x86_64 Stage3 bootstrap image:
 
-```
+```sh
 docker run -it stagex/stage3
 ```
 
 Run a Python hello world:
-```
+```sh
 docker run -i stagex/python -c "print('hello world')"
 ```
 
 Make a hello world OCI container image with Rust:
-```
-FROM stagex/busybox as build
+<--author: panekj -->
+
+```dockerfile
+FROM stagex/filesystem AS build
+COPY --from=stagex/busybox . /
 COPY --from=stagex/rust . /
 COPY --from=stagex/gcc . /
 COPY --from=stagex/binutils . /
 COPY --from=stagex/libunwind . /
-RUN printf 'fn main(){ println!("Hello World!"); }' > hello.rs
-RUN rustc hello.rs
+COPY --from=stagex/musl . /
+COPY --from=stagex/llvm . /
+COPY --from=stagex/zlib . /
+
+ENV TMPDIR=/tmp
+WORKDIR /home/user
+ENV RUSTFLAGS="-C panic=abort -C target-feature=+crt-static"
+
+RUN /usr/bin/rustc - -o ./hello <<EOF
+fn main(){
+  println!("Hello World!");
+}
+EOF
+
 FROM scratch
-COPY --from=build /home/user/hello .
-CMD ["./hello"]
+COPY --from=build /home/user/hello /hello
+COPY --from=stagex/musl . /
+COPY --from=stagex/libunwind . /
+COPY --from=stagex/gcc . /
+ENTRYPOINT ["/hello"]
 ```
+<--author: panekj -->
 
 ### Package Management
 
@@ -86,6 +105,8 @@ for the future.
 * Anyone can reproduce the entire tree with tools from their current distro
 * Hosted CI servers auto-sign confirmed deterministic builds
     * Like NixOS
+* Multiple maintainers reproduce the entire build and ensure that everything
+matches down to the last bit
 * Maintainers sign all package additions/changes
     * Like Gentoo, Debian, Fedora, Guix
 * Reviewers/Reproducers locally build and counter-sign all new binary packages
@@ -107,64 +128,70 @@ for the future.
 
 ## Background
 
-We have learned a lot of lessons about supply chain integrity over the years,
-and the greatest of them may be that any system that is complex to review and
-assigns trust of significant components to single human points of failure, is
-doomed to have failure.
+We have learned a lot of lessons about supply chain integrity over the years, 
+and the greatest of them may be that any system that is complex to review 
+and assigns trust of significant components to single individuals, which creates 
+significant points of failure, will lead to eventual compromise.
 
-Most Linux distributions rely on complex package management systems for which
-only a single implementation exists. They assign package signing privileges to
-individual maintainers at best. Modern popular distros often fail to even do
-this, having a central machine somewhere blindly signing all unsigned
-contributions from the public.
+Distros (Linux distributions) rely on complex package management systems for 
+which only a single implementation exists. They typically generate a lot of 
+custom tooling, which in turn rapidly grows in complexity to meet demands 
+ranging from hobby desktops to production servers. This complexity demands a 
+lot of effort to maintain, and in practice results in a tendency to reduce 
+security overhead in order to lower the barrier to entry to attract more 
+maintainers. As a result, projects rarely mandate cryptographic signing or 
+reproducible builds, let alone multiple signed reproduction proofs. In fact, 
+some popular distros use a server to blindly sign all contributions from the 
+public, which can give a false sense of security to the unassuming user.
 
-We will cover an exhaustive comparison of the supply chain strategies of other
-package management solutions elsewhere, but suffice to say while many are
-pursuing reproducible builds, minimalism, or signing... any one solution
-delivering on all of these does not seem in the cards any time soon.
+We will cover an exhaustive comparison of the supply chain strategies of other 
+package management solutions elsewhere, but while many are pursuing reproducible 
+builds, minimalism, or signing, there isn't currently another solution which delivers 
+on all of these basic tenets of supply chain security. `stagex` is an attempt to fix 
+this, in order to satisfy the criteria of reasonably secure supply chain strategy, 
+which requires more than one individual to deterministically build and sign software.
 
-This is generally a human problem. Most solutions end up generating a lot of
-custom tooling for package management, which in turn rapidly grows in
-complexity to meet demands ranging from hobby desktop systems production
-servers.
+Ask yourself the following: do I have a way of verifying that this binary was 
+produced based on this source code?
 
-This complexity demands a lot of cycles to maintain, and this means in practice
-lowering the barrier to entry to allow any hobbyist to contribute and maintain
-packages with minimal friction and rarely a requirement of signing keys or
-mandatory reproducible builds, let alone multiple signed reproduction proofs.
+While software is often reviewed for security flaws, and sometimes provides signed 
+releases, what is missing is the ability to prove that the resulting binary is the 
+direct result of that code and nothing has been modified along the way. To achieve 
+this, we have to make the software always build the exact same thing, down to the 
+last bit - this is what determinism or reproducibility is. You may be reading this 
+and thinking "of course it should always build to the same exact binary", but this 
+is usually not the case - it's highly unlikely that any of the software you have ever 
+built is deterministic. By forcing software to always produce the same binary, we 
+can use hashes to easily verify nothing has been modified and no new code has been 
+introduced to the software during compilation. This is a significant security 
+improvement, but it's not enough for only one individual to build something deterministically
+as they could be compromised - the real guarantee comes from multiple individuals 
+compiling the software using different setups and still getting the same hashes. This 
+gives us multiple points of reference, which we can use to figure out if the integrity 
+of the software is truly in tact.
 
-Suffice to say, we feel every current Linux package management solution and
-container supply chain has single points of human failure, or review
-complexity, that makes it undesirable for threat models that assume any single
-human can be hacked or coerced.
+To develop a further intuition about the distinction between trusting source code
+and trusting what the compiler translates that source code to, you may refer to the
+seminal paper by Ken Thomson, [Reflections on Trusting Trust](https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf)
 
 ## Comparison
 
 A comparison of `stagex` to other distros in some of the areas we care about:
 
-| Distro | Single-Sig | Multi-Sig |Diver.| Musl | Stage0 | Repro. | Rust Deps |
-|--------|------------|-----------|------|------|--------|--------|-----------|
-| Stagex | x          | p         | p    | x    | x      | x      | 4         |
-| Guix   | x          |           |      |      | x      | x      | 4         |
-| Nix    |            |           |      |      |        | p      | 4         |
-| Debian | x          |           |      |      |        | p      | 232       |
-| Arch   | x          |           |      |      |        | p      | 262       |
-| Fedora | x          |           |      |      |        |        | 166       |
-| Alpine |            |           |      |      | x      |        | 32        |
+| Distro | Containerized | Signatures | Libc  | Bootstrapped | Reproducible | Rust Deps |
+|--------|---------------|------------|-------|--------------|--------------|-----------|
+| Stagex | Native        | 2+ Human   | Musl  | Yes          | Yes          | 4         |
+| Guix   | No            | 1 Human    | Glibc | Yes          | Yes          | 4         |
+| Nix    | No            | 1 Bot      | Glibc | Partial      | Mostly       | 4         |
+| Debian | Adapted       | 1 Human    | Glibc | No           | Partial      | 232       |
+| Arch   | Adapted       | 1 Human    | Glibc | No           | Partial      | 262       |
+| Fedora | Adapted       | 1 Bot      | Glibc | No           | No           | 166       |
+| Alpine | Adapted       | None       | Musl  | No           | No           | 32        |
 
-### Legend
+### Notes
 
-- x = true
-- p = planned
-- “Single-sig”: one person, typically the maintainer, signed a given package
-    - Some distros blindly sign all packages with a shared accees server
-    - We see this as mostly security theater and do not include it here
-- “Multi-sig”: more than one human verified/signed every package artifact
-    - And ideally also signed the source
-- “Diver.”: Can the entire distro be built with a diversity of toolchains
-- “Musl”: entire distro and resulting artifacts are built against musl libc
-- “Stage0”: Can the entire distro be full-source-bootstrapped from Stage0
-- “Repro.”: Is the entire distro reproducible bit-for-bit identically
+- “Bootstrapped”: Can the entire distro be full-source-bootstrapped from Stage0
+- “Reproducible”: Is the entire distro reproducible bit-for-bit identically
 - “Rust Deps”: the number of total dependencies installed to use rustc
     - Rust is a worst case example for compiler deps and build complexity
         - It is kind of a nightmare most distros skip
@@ -186,7 +213,6 @@ A comparison of `stagex` to other distros in some of the areas we care about:
 * As a policy, we expect all published signers to:
     * Maintain their PGP private keys offline and/or on personal HSMs
         * E.g. Nitrokey, Yubikey, Leger, Trezor, etc.
-    * Maintain a public key in the "keys" folder of this repository
     * Maintain a [keyoxide](https://keyoxide.org) profile self-certifying keys
     * Maintain a [Hagrid](https://keys.openpgp.org) profile with verified UIDs
     * Make best efforts to meet in person and sign each others keys
@@ -196,7 +222,7 @@ A comparison of `stagex` to other distros in some of the areas we care about:
 ### Reproducibility
 
 The only way to produce trustworthy packages is to make sure no single system
-or human is every trusted in the process of compiling them. Everything we
+or human is ever trusted in the process of compiling them. Everything we
 release must be built deterministically. Further to avoid trusting any specific
 distro or platform, we must be able to reproduce even from wildly different
 toolchains, architectures, kernels, etc.
@@ -208,8 +234,8 @@ our packages to (ideally) be built with totally different OCI toolchains such
 as Docker, Podman, Kaniko, or Buildah.
 
 This is only part of the story though, because being able to build
-deterministically means the compilers that compiler our code themselves must
-be bootstapped all the way from source code in a deterministic way.
+deterministically means the compilers that compile our code themselves must
+be [bootstrapped](https://en.wikipedia.org/wiki/Bootstrapping_(compilers)) all the way from source code in a deterministic way.
 
 * Final distributable packages are always OCI container images
     * OCI allows reproduction by totally different toolchains
@@ -217,12 +243,12 @@ be bootstapped all the way from source code in a deterministic way.
     * OCI allows unlimited signatures on builds as part of the spec
       * E.g: each party that chooses to reproduce adds their own signature
 * We always "Full Source Bootstrap" everything from 0
-    * [Stage0](src/bootstrap/stage0/Dockerfile): 387 bytes of x86 assembly built by 3 distros with the same hash
+    * [Stage0](packages/stage0/Containerfile): 387 bytes of x86 assembly built by 3 distros with the same hash
         * Also the same hash many others get from wildly different toolchains
         * Relevant: [Guix: Building From Source All The Way Down](https://guix.gnu.org/en/blog/2023/the-full-source-bootstrap-building-from-source-all-the-way-down/)
-    * [Stage1](src/bootstrap/stage1/Dockerfile): A full x86 toolchain built from stage0 via [live-bootstrap](https://github.com/fosslinux/live-bootstrap/blob/master/parts.rst)
-    * [Stage2](src/bootstrap/stage2/Dockerfile): Cross toolchain bridging us to modern 64 bit architectures
-    * [Stage3](src/bootstrap/stage3/Dockerfile): Native toolchain in native 64 bit architecture
+    * [Stage1](packages/stage1/Containerfile): A full x86 toolchain built from stage0 via [live-bootstrap](https://github.com/fosslinux/live-bootstrap/blob/master/parts.rst)
+    * [Stage2](packages/stage2/Containerfile): Cross toolchain bridging us to modern 64 bit architectures
+    * [Stage3](packages/stage3/Containerfile): Native toolchain in native 64 bit architecture
     * [Stage(x)](.): Later stages build the distributed packages in this repo
 
 For further reading see the [Bootstrappable Builds](https://bootstrappable.org/) Project.
@@ -232,32 +258,34 @@ For further reading see the [Bootstrappable Builds](https://bootstrappable.org/)
 ### Requirements
 
 * An OCI building runtime
-    * Currently Docker supported, but will support buildah and podman
+    * Currently Docker supported (v25+)
+    * Support for buildah and podman coming soon
+	
 * Gnu Make
 
 ### Examples
 
 #### Reproduce entire tree
 
-```
+```sh
 make
 ```
 
 #### Compile specific package
 
-```
+```sh
 make rust
 ```
 
 #### Compile specific package without cache
 
-```
+```sh
 make NOCACHE=1
 ```
 
 #### Sign all locally built packages (WIP)
 
-```
+```sh
 make sign
 ```
 

digests.txt

@@ -0,0 +1,281 @@
+2b302a926971b9da62c6d898779971b4229d73a8c4e341d7de2ea79de70f920e abseil-cpp
+865af5a01d66da86b87cfde51b5546449f70daeaf797cc809b254f90c9445db1 acl
+2e9b2850e47a7411567fd22a3dcdfe78029e77671a78f17102da943f64a17bda acpica
+a41b481187f76c1e9ed4e237977f4892c1507a3b8f8f6736ff3fdd5144bd2afb alsa-lib
+beaa89490c3d05b590aabf399d2058748472d20deebe1c8c9dd2519da5e2e652 apr
+090e0082e7a3f2c3519bad7377d1d5e9b4d4c2fd1255982c060f5871694acc73 apr-util
+d2954e08c80097c1bef1e9511bbc502c54086cbd81c8f84adb2b732f0958ab53 argon2
+633608a6ce39c89f3fbfa086c44dd97e988fe996d7dafa02728298a443a02052 argp-standalone
+29fd68f838832fcb691d17104c641c1ffa1f517ce29292b9b4e69dd3ca1b7d85 aspell
+19403c6a4623181bc7a62d6070907fcf27072c1ffc5430c17166e0ecb32c3386 attr
+95cea86440484bdf336548905b6904ee42feb1379881dcf09b3e6febdeff9af8 autoconf
+73a6f1d7889e7779d2080a490ceaed0b8936676721d9946d5d062b969355f00a autoconf-archive
+59b2c8e5ad336108685337d011ff38acc08e83b2c77e8aafea7c5722841f5ef2 automake
+5f4d5df5ef40538c01ebdeeab849045b0feee7af5d217b1c5296455a00db0e2b aws-cli
+cb58f55d268fbe7ef629cda86e3a8af893066e4af7f26ef54748b6ad47bdaa66 bash
+039cc5ac357a17d6374445fe4eed1dac15cc72f615bd9657c17e2c3904d42b62 bc
+30a1bd110273894fe91c3a4a2103894f53eaac43cf12a035008a6982cb0e6908 binutils
+a96fc6e2c246bdc29a263bbff117a8830704ac725fa524d7ac779f0566916c8b bison
+92337882b03339de5b2f19866e5ae0997681cdd33247a50b8f13771ea5599166 brotli
+20ab5b4597caededfd404cdb8dbc8e4e8b5f2faf52f735be04aed3d063d9dfb3 buf
+291a933db0ef0ada1ca79740f7ae8c1309c7e3706cf2b44f42c5a443724763a6 buildkit
+d34bfa56566aa72d605d6cbdc154de8330cf426cfea1bc4ba8013abcac594395 busybox
+02aaf7444cf39b11cc70467eac4a315def3d8e8083b05a94e96b5f1309219645 bzip2
+33787f1feb634be4232a6dfe77578c1a9b890ad82a2cf18c11dd44507b358803 ca-certificates
+ac089ee6aa28d6784ad8b339fe8547a9e781bab6913d87f5b53390f96eb51212 c-ares
+3225dc4a6a1af5f828854157a6b16eb09a0b0f7ebe9d9ee34030afe3966afad1 ccid
+818ec25333017eae9bf9aed7a7bf96d116ab0356cb975008bc97bf6b7df03514 clang
+4d3fd5923cadecf82cd45a992094a0af564612732b4183cfa217f2a98459695b clang16
+9f6c0f7ad7a6fba1d4ffb91c06dd0ec5d838477f539233ed8d19aa6b8d035f21 cmake
+3c996e9b94fa685c7407b6250880dfe38d02ab8818c8947d61c63908c8cfd594 containerd
+fe7463445ec4b2326f04887a0b04e226459c45888cd3312f70ef891cd734ce33 coreutils
+abccb58edb5f1f31b3b9c8b61cffa10cd56de3307e337335927b8df4d9112d24 cpio
+8e5705a77a76c92d058e016184dabd0c4fa2f6117021cc5ff55df35f654cb158 curl
+831b045250df81b9f82a36796e86d7e1cd998d70afe5845c5ccf387e5dcbf9b9 cython
+b743e783c8ddc8adf2d58214b51a70f8d1912208b7a0e2b0b2e4f99753a9be5b dhcpcd
+f20f1db9118bb421652a7f6b0c48d7647f795c66e20b0f57322f61ec0c78483b diffoscope
+c0e9461da7f952e3491542891c0e3d31b736c159b819a2af0a64078a502100a4 diffutils
+5d3814394626bd1f49f33fbf213a99b3e6e39fa7cd55c483bf8b644790374be8 docbook-xml
+64fb0e456664f0f39060419d735dc98d15042e812d0a7d2a13049ace690411a4 docbook-xsl
+0ac5313971b65059dea71d7aacfebf88f35c9bc9ba02aaaa36efc8095b032e91 docker
+7181c986e61a684976ce68eb9a9854f227f824f5e624af75fb99a97c80000fa4 docker-cli-buildx
+e6a454f008d7c08ec255fcdad2058b40687ae16ef267b47452efe37f11614c60 dosfstools
+31467bf1f5ffd6fe4c2f7b457671f5db1063ee0bf52c03f190deb7f1a13249cd doxygen
+57f8aaa94059c43081b32fccb473ebd2c0cf16878dcf0e24e0e56c910467e93a dtc
+9a8221b9114246560b0eaada99c35534c7c3bd5e8aa3b7551cea140ec3d0b2a4 e2fsprogs
+8ab90aa69877571d31ca43aaafecf835c09343ed48cdad14cde93267cb721ac0 ed
+fde31559023631cc275d85f29fabf1c1b841fda05cc4f6f77e414862161b0767 edk2
+291653f1ca528af48fd05858749c443300f6b24d2ffefa7f5a3a06c27c774566 eif_build
+6e90f2408aa3eaeeb18c6d63b399ce73bcd3ef693f53ef232d0803cb42803d71 elfutils
+7da7aed7ea7eb73bda86e206e765bdc8e6367c2c2ae535ccd68c7c1b0a936611 eudev
+046aa479ac28e5ed0d246e85afb8efc5bcc02015cd07735b2ea031b50cbcb48a expat
+11b57e23e265ba7f2b56e31901be8f188f870038d1b970900e70bcb70a3ba6d1 expect
+b43a7f0bd50419a39d91d77a316bb888ed87c94aeb6f9eb11f12efd275ca4ab8 file
+d03195563f548c3ac8f34acf777b7e86f0d0d049a9430d715e5774eb7cc93302 filesystem
+d92494daaf08999aac0a277327d240a0149494716707fbce93381df058f693e2 findutils
+4e61cc6f0af9aa6116bb93f048c20d00026d75c27dc52b7e8604f0e340c55b80 flashtools
+fb22f60262c39dffd878f5243e13cc357ea45a088c60f077359ed48af7476fd2 flex
+ccd1c7329ec0019bbf6c3cd1b81db218bb4fcedde9e074e25153eef7c6c8d6cf fmt
+663b5710e2874646842f964abf3c67fc084e251c2b2bdb2f355517279ce1e0b4 freetds
+cd05a7cbfeed90118680c52da7d90e6f31ffb2fc3967ea760167592204af2310 fuse3
+abe83e0c4e2297814d14c623ebec8321fff56c5c0fc88c3f25dc03f781920be1 fuse-overlayfs
+03f2726e66ce5051867aeed9dedc2a6b93d7faf5fee265e6eef56ef9c768d439 gawk
+439bf36289ef036a934129d69dd6b4c196427e4f8e28bc1a3de5b9aab6e062f0 gcc
+c526f2367cb63a294f13d2ec93c9dc03625ed90a5fb6f93a0ce488731f60f327 gdbm
+f5b9271cca6003e952cbbb9ef041ffa92ba328894f563d1d77942e6b5cdeac1a gen_initramfs
+ad263b1192b4f07c3b2db85464380fe10fe33b3162825890bcc18ad192186c6f gettext
+29a02c423a4b55fa72cf2fce89f3bbabd1defea86d251bb2aea84c056340ab22 git
+d280c18f8b52ce21a26924b0cb1bfb69ea6508b57db73efe22401572e71dbe84 glib
+6d0f8c6472f72e35e2d0a2fbcab077407c22e8d2b921ede2d8c57bde60011c71 gmp
+56f511d92dcc6c1910115d8b19dd984b6cd682d1d3e9b72456e3b95f7b141fee go
+80badaa5176879f83dd04df14a940c24d79cd3092dee6d556e9f284297319a47 go-md2man
+7585458a0786a21de5414662d09dc897961a3beb3641a565c540367ab8d74c54 gperf
+f63555b39740db63b34c06894a4a9d5e125d04f5d51e799909d06c490e8ecd42 gpg
+576288125a7ecda969285e5edfaedef479c4bc18cba8230c0502000fdf2586c1 grep
+fa0a8627fea5db3ffffa42990925bee75adc7e9042388903bef12fa8bef25513 groff
+4fa877d54258b01d5f825f10f41bad6275c010c5a7bf80b54368a188caaaddf8 grpcurl
+a14c60f152c759185e5702e910053cb5c0d9eee11f43d8d5d40a84123aece9fd grub
+d1bbdbfae6d773c2b69f2a03105f604f782ab68b42fcb5c5addf0b29698b5f6a gzip
+0e80b5408f0f92eb0882a818f13b1160942743fa5b6e3b0db3f436a23810dc1c helm
+f29278cbdf1da7ba6c716d5c7ce9e2c2292b94514dd6d00f8c3b517a9486f345 hunspell
+33db338624ed3a3720d84278de9488270b8a4eeccff32110551f8a01d149098c icu
+393eb58ff8b385565ffd84a0f39895db548e50fa04d0474a89a55d880691dc68 iproute2
+2a0e24536ab3ac83877afc9cfc46f0a14144d34bf1e9d5d85c5deb890047fc9d iptables
+d75098bd3832414bfcd226417e4d2b7bad8a6699372ae9466860df74122ed96c iputils
+5791d9b42c7e9099a0180c4fe6cc4b8e9afc9e6b9ec392099c65c53b71db7908 ipxe
+3e8b44aa54481bdd46406e9d3a63862f4216f81530a1898b3c144e1c38847a82 jq
+342f1083fd61285468f02979862e7cf7a89a43b8dc09fe7293ebcfa456c6a234 json-c
+cbde1c424f21647a26d82d0f93a32f11e031c2108ddcf75bdb39f9ad9141feeb json-glib
+5723eece85ab72f6b147763b7c6f13da3f0fc05c5d77e1c8da40c64ee9bd42b9 k9s
+2288c1d769a0c3c535835019ad4919cc45b094492b5aa959a0eaf1e883a96214 keyfork
+32df62d780c41f132e070b27142bd90000866b0e16b2c778a3e484d1cbbb455b krb5
+eb0a337b36a333127461134956d91c554b660c8cf0f213994c3f6ea4f47be7ce ksops-dry-run
+66bd112f8f59fdecff47d0bac70a7c008af114553bc2c2cee1fa94f8ee128735 kubeconform
+56043e069e820e3d85e0df3144a7e908d749bf89bd46c6d5fad9fc5011abaa48 kubectl
+c6dc0a4ae61d8ca5bec08fb06a019942c1a3040549490c239794738712b6bb0e kustomize
+d1dacca57eb925c5f131b29af67fabda34ece1b54f78137fd4a812b5d91082d4 kustomize-sops
+c8d6dd6f3e6fbda73ac0620b2bc4b4cfe6fa504bf7a17eee3bb56e286c394b8b libaio
+7c9799fe18add3ca0954f784c3342c6b053a2edb6326710837b7f30d66c5fa6a libarchive
+1f31e888ab3f02634009d1a38acca9f25deb827432eb91392e21fd75128a44aa libassuan
+857c52470ad99c1a0df183c752544036e0c0cd2ab892b306f7f012fb709d2709 libcap
+c2a975aba9ddf31110f174535e8f0f5b1b343c504c36dd9b1887af4e93a80c62 libcap-ng
+aee02149b82cd6e19eeaf8897d17930a6fcf1f1a91823c3d60bbda23c1ace9de libedit
+ebc11feadbd980e7284ad62b79f60821c6032b52b7b45c93bf174c8f9069d277 libev
+da563b0079c155e323b82b6c5cf556f413488c2237269cc6b8f0e99ffa0c6939 libevent
+ab647ebf8464e00cde623f86f716e7f50ce82c30eafde813b7977d917ff7143a libffi
+49c84a586969ff625b3304dcf8905a98db0da36fb8704e3d7a0771d271509b68 libgcrypt
+11c17c1ac41f36c85e538bd34a0095a9f17e116f61c38d560350c02a6929e55a libgpg-error
+22ed564f7590448228483f6aa63c333b928ab369cc80d5a279bd6fe7fc87418b libical
+d0db9f9caa610d8844a9c4254e93631239807a3a3b8ac6424901e08897b3e20b libiconv
+2913b382fdb76f02f9d78ee162066e04953ba782b8f722145111617a842f40a3 libksba
+7504619b44f08a347e9ead2a20058e402973e99e63538b5471158429f0f6dd85 libmnl
+683a7fdbb19ef91be4c13ecdd8371fd8e9c9880688fc59bea1328291811be8a8 libnftnl
+deabccb7c8bdfc3f9589084bb95f234c6de63b7d13bd3600821bae1c9d690ddc libnghttp2
+8c0f523bdf8d315e7b67cadd584e23d22a316dd1973232d49603e127717e4d1a libqrencode
+f48d783989da9d509cc6b4c12ec34e14074ffc1ab7a4f2d1e322c417d967e12f libseccomp
+9dfb87e4a0adba80b862ce6b96112d96f509ffbca25bb71c60ba5bb5693b481d libslirp
+19dd278eed7fc724a80f74e7359cf1b6b2ddd2821806ca0e20c4b38be91da4be libsodium
+c77e4d4f05b06305c32028da55f85d400b81e394341b38fbf2344950a05291b5 libtasn1
+a6cdb816fbf80fe54d20bb40ad77fbb82e9d8defa6456f922975145dec98a85e libtool
+d909a55137d0bf4a76331c2bf0358ee192d6c93ad77a5099af09ce1bcca2a6cd libtpms
+97ee6068a8e8c9f1c74409f80681069c8051abb31f9559dedf0d0d562d3bfc82 libunwind
+6c0dcf2b9519b1a41066ad71d3b597e9dae84fb73e5d031a3bdd2eb40f78ef94 libusb
+6bf8afcec5c1830f19a6199fa8386582328a2a0d413deb8675091f597a6cee2a libverto
+1a1f30b6e9e9a781c70c1c6ee0746eac37846d64fb7bbfa4fe8f398e7fce6562 libxml2
+2498bd21d131fff2930ee921550dfc5253861e5ee1a905e0b80a10c56e96ce92 libxslt
+a055f8cd6e11b0b8836b2e5e1d755f672edbd344a4f4b5aba94919a6511be4c3 libzstd
+efb98b59ab37a7e33db423eda7a49bb7273b087838fda8098ce6736a0860fc73 linux-airgap
+cfdb0a67d5980b7079e2fb8fbc688d4025c9fde5159c872339edf40924f7f8b1 linux-generic
+81213dcbe6f551a3c01304c034df677ae02537a7c6f00897001bfe74fa807304 linux-guest
+934b27a4431db4b351683e60eab81255613d22a9d0386f9f4763d907d16bd222 linux-headers
+e6c8a861f9b18edfad56b1aa130feb822a25987c71e2b2932b020750dd7325bc linux-nitro
+b21d2632cdb6064c1dc5d5e6e72726cff03d3792be85be032802e87da5b27437 linux-pam
+569eb52b68618f2d24d8b0a6f051ccbaa6a35f769ef101821ac5bcb27bdd96cc lld
+30517a41af648305afe6398af5b8c527d25545037df9d977018c657ba1b1708f llvm
+aa60e2883ecf2070c7591fc29622a578c8ea24a14a2b7fcce95d3e5d9c00b101 llvm13
+e10e58d871b6f0352907254b9be018700b9b41d16a5350b7371ed2779f6b3dee llvm16
+928521fbbf8ae938ca5a9cfeaa507bcd8cfa4e03afdab933ef0679eba4657ebc lmdb
+417ecae03adf1e045cef0601b87675450294ba43c458cd0d3c44170bc9e72079 lua
+83cbc856ad93736931774c83815e4319c567c71f6cdfdc63c6a0f34a84f578c2 lzip
+09c60840e3e3e5835ec027c21283febc9f8cf53ab887576fbe9c38dbdbdfd571 lzo
+975895c0b02ebc11d6a02d180466c538afd2ccfa6dddc5594dea14a73791b22a m4
+df43f0cf3ac1ad91bf91baefb539e8df42c11b0954a6e2498322a5467deb81e3 make
+c442686851151054330453f3c15ed1e746543fe03e78651d05a92d83cee6b275 mdbook
+0fda6a7adea23fe4e691c61d94a7bdb11d63c943b96a1f1f4298e85a703941d9 meson
+a487b724a1137c100ec54e63c3d71d4732e02ba0583db416aadb4608affec7a3 mockgen
+c83f7aebce9076903dbf1082aac981d3c0950d9e8952a900e5e072e2a811cda7 mtools
+ad351b875f26294562d21740a3ee51c23609f15e6f9f0310e0994179c4231e1d musl
+bd99100b7b6e58a5f47006e865a53bb34a251ada33ee9af2b1ccc416215b282f musl-fts
+be242a20d00323ab65477f5d41cdd7d2195631c409b734a161066ac9ac055fe1 musl-obstack
+705c6ed79775674b19fc599380a8889c25a7724335bebdb5a7cadeb4a5296f3c nasm
+3c73ff7f6856656fef77fccc1cd987098cc9142d97f6d21184e2f7092b15b3dc ncurses
+d2a45d2073a011d95743023cc2a3cde54090b5840fe686d235bcc9efd2df23a7 nettle
+545e2a64dd3ad558500b54b2472b463acd2eaeb8ca905bf02b52f98675e5b882 ninja
+a603f2f53de95867c96691315bea11a480a26cdb1ac54ec655bf3f3a723b76ab nodejs
+21d50ec1421fe75af4bea240d76022ddb8c114fd2805bfeb06fb938e5a58fc0d npth
+39e667b966a443f42e1c7a8c944203945bd1808ce759df1706bb3b93b0b674c2 numactl
+22ed564f7590448228483f6aa63c333b928ab369cc80d5a279bd6fe7fc87418b nuspell
+3aa3aa065d64328ec72c624620cc74a46d95b4eedccfe6cd6ed85bb7f124f446 ocaml
+1105d9215fffb7331669e3ad32f27c8c7871a2ea1fdc7975c2cf59a8caaf0739 ocismack
+29f44438f370f097f687d436457bd42d3f15b31173141277d95b298fc40987e4 openldap
+56d4696d111b309e536f1b70980db7098cd7823005432e4130432cb2f625cf9f openpgp-card-tools
+5117a9d39d3b77655b29bf661d9e04eea2001a5b033b2fd6b4297048330ff6e7 opensc
+0845e70bce3e1686ac95b73ab8fefd49dc3706fdc0e01416b194a921228b04f2 openssh
+2c1a9d8fcc6f52cb11a206f380b17d74c1079f04cbb08071a4176648b4df52c1 openssl
+e9e376dce882b401cadfd6af14af291c0f6cf4bba60cfa75d0fc04f167e81589 osv-scanner
+910570f3b60a1dc73f962d2f269e58d995587a7d05a28beaf886fd7a5a0bc4f5 pcre2
+4fe37671197ac768637e95f7395ae1a18412b3f42359d0c0aa9f4e7f684aef4e pcsc-lite
+05046ca5d41a09163eda26785563fd98f0cb1179030c3f4ee3243997a907bb96 pcsc-tools
+7fd8ea695fb1e0baf0c5f2587844dfcec15b8ae5c64c952afbd64333ede3c857 perl
+583fab9316675e64af1ac6b7138d5eedda067ca9d0d4419dfa18ccfd5bfa5f38 perl-dbi
+ac16b4bec746c9b776ef7992e906c4994228f97ab81c229c3406e179e5b5571d perl-module-build
+7f58db3ea315623cb3dc2e5321bf982384baeda81d0e1d925469d1030b75eb43 perl-pod-parser
+0559f09342a72cd3b2692efcc5657169659080b1df783c5b896e4b50478ff16d perl-yaml-syck
+7f92a3cde1e158d23351c1945dee8fb6bd9d04021dc393fa784634b2402c983d php
+ba7fce4108b721e8bf1a0d993a5f9be9b65eceda8ba073fe7e8ebca2a31b1494 pkgconf
+d6ffd46e0d0bc4cc514bd0027d7c7d113c32ba4109180c429d1f00eb23488126 po4a
+b48d84b0e823907c4a3f37a943b5740e6edf2344a263aea9243048b28ef86bab postgresql
+0466e00d7ef04352f3205e51d2fa7d6f258221dba23ed87f752c6c6a6b784e20 protobuf
+56cc694ea27d1a0a370026851f00857dd1b7b088bafc0d31a59591515f35b99c protoc-gen-go
+3676253214746660730725634bebb4dd8e09833de846049f5067f35cd602a4e8 protoc-gen-go-grpc
+ac85c55c97090f4f525209591adf1b5d18af206bfaf9b12ea4eca6f71c29e3ec protoc-gen-grpc-gateway
+ed16a4b7e4719389673a4f4bf9ba2a1009691b7f4da3b251fd757aec082c1cd9 protoc-gen-openapiv2
+396f827c543646fd7a4ad774dee6a6baab7696de9ac78ee352a610e31cf714ad protoc-go-inject-tag
+c2cc3c1ab3ffcdce49b9b5624747ac17a49fbe1efdca55166a1ff84ac4ae2476 py-alabaster
+f2766e2e15300c5fbe6f52ff9580932927c72ab60e9edefd2985da7cd9717d95 py-awscrt
+5dd9f62b2fe378a2d9e1ab9a124fa6459b95f45c4a1f009642639c173dfc6fe1 py-babel
+8973b0d6d15d3fdbc8a43ff9fc91f20e2881d2ac2d5bdad77e48f51c17978cdf py-botocore
+ebc91781e06aa75bc16d9e96ad91c9eb98f0f6cfe78377de4aaac0d414f10fd4 py-build
+9289a71e233bc653c3b5f2502576a68df3fa86eed589ae50f82e296d78a9844e py-certifi
+e4bd81d2b0ef3ff6fe31e5eeec8911ff8befd5f4cefa880ce140509dd5dcfce8 py-cffi
+1b338f1b7a174651893fa74cd1b1ebd5e01e56ae7417e19249e0291b806e1dc6 py-colorama
+8f34c0ac1a5a4d6b3be36e4397aac238ba10dc16e04cd3749260df8b3360a6b9 py-cparser
+11f5e71c04289ec970a3422491381efcf182362d7f3e9e02ad5422f40e922bd7 py-cryptography
+5c49a16c021c20ba03e41625bde5ea198f9befb0f8584c994059695d191ec2de py-dateutil
+acdfdb894bb3c2741d517df3a65c9c4cc5ead6a1f24f4a030e4cb2b411fbf8b5 py-distro
+d07dc886337e357ce98047efff01fa75fa001738a13b16beb019aa6b0478fa2c py-docutils
+e3f39632458cf1a4f7b8af027972969b1148a2f19996afc34c8597aa0ebe56f9 py-flit
+9647d066355b6c57de057bb19c624257ff8c83d00bacc5acbc6cff14443a87c0 py-gpep517
+ed5b97c4a659b675202791bd4ed03bef5b5d09d7b1b5f5d66252461ba623c9dc py-hatchling
+af7d960b69ad1150a354b17429c88d6a3e9e785e7d8deabbcb628df522156bf6 py-idna
+8cd48f3ffdb5cd1b48901af284539b20e1f85f58db88ba2cc10d4e3bbf234747 py-imagesize
+aeeebbb0ebc0a2f1e6f8b053105c551cea73e0999835f2ca3cdb371c9d893ffd py-installer
+770f43b73679ab21495cc70935dd4af9b83bd12a294ac09d1811eed655570f75 py-jinja2
+9c54ca1d2fe48d39c07fa576478258eabecab7d7a9565449aeb6c73e807910b5 py-jmespath
+97b357d0e9ea2448b6045e7a2120557545d68707579f359761aedf826e71462b py-libarchive
+d48429a1606a0d401f698f957fa29023525871265af68a90b58314f237a46cf4 py-magic
+d13916c6e1d0dd0d67f4ca9f2c8b64ba6e96e812f044077b15c28ff6e3a16c38 py-markupsafe
+be896fd1527c8525b39fcac325a5a98cf1dcbebaf476721b2bb22427bfbf8c09 py-packaging
+b80b5d5759cc609a3b98c41f9f8e86a8b998d64ec3b796caaa0d7e727b37d6c0 py-pathspec
+9db1b69277f8bf37367fd3fa49f167b68f3b8ae525e3c1719bdf313f3d23da40 py-pep517
+1394502e9ca18011e5a62050119215275be0cdb465f2e49641b4f2206e851bca py-pluggy
+ac46f2fe5c6ffddaabd7fc7f2c831cda70a2837654b218d6ae496f86a3245588 py-prompt_toolkit
+f992d6abef69d80fd002cfc061d2574b4d7c02c4fc37bfaa5ac7ecb7bc091719 py-pygments
+0723b6368aab67ba93dc5f6ab04582653139744a14958d5be5cbf7838cf7d64c py-requests
+4b5112cce67478f1014f951b7bf5d6f3335e8eb7a34f0b3e29580389fc9fbfcc py-ruamel.yaml
+a58095b77d7eb345788f6b490046f397a5dfefeb377460cd0aeb4f33406bbb2b py-semantic-version
+28182587b8e4bc98245195df5ffc38268c8e19fa053f3e888841dcb06c8aaf6d py-setuptools
+0866a0d84510e436b33677bcca77fe17ea3daf105e394357619107a96dff8d17 py-setuptools-rust
+2300420c3f37000732a36f36199ad64a112e6009a605905de09bad722539952a py-setuptools-scm
+ef535177f40323664740fff47a51af175bb75eaf3bab1c72b8dbd6fc96afef4e py-six
+a6354d25cc20a7ec9b7c69749dae21b53d7577cb14d60dbb35710fa620c3645d py-snowballstemmer
+e00f2df8329f2f4abf251c9417253995888467c011a4e0ddeed16c84e1338d06 py-sphinx
+d062b9f654c780422109b22fb0e03bd98b3c7ce802f33837165cc865584d7afa py-sphinxcontrib-applehelp
+8235fff1615ce4ad547f399d3e1f112c0cf59b076b12a80469e6fe20fa626947 py-sphinxcontrib-devhelp
+356e647a5f84e4f279a8ab4ba8507dea2b760e7fec7577458640d7756b67dd61 py-sphinxcontrib-htmlhelp
+2d538c55d6ad1733d1db0f5aa9b20e46f4d32ae8200145285c26fe8d0983c4eb py-sphinxcontrib-jquery
+56de3471aa2e4fc24d9ca3881e0c7eebe47669516fb291e64a739b08c43885d6 py-sphinxcontrib-qthelp
+a492a650dcb6c71984f0be2bfee451bc5ae3f7fe8921abfbb8db071b05802a2c py-sphinxcontrib-serializinghtml
+1e0774ebf2edc3b5204705c4924eced13444638fada7a4d651d4ec2dd331ebe8 py-sphinx_rtd_theme
+a4b55e2fd4c20aec1535181e5bc0172c66a14e8b19d13bd17870b96dea32fb2e python
+8a7e46278b20802b3ddc59ecc6b0965988e83233efe6046e3b2486245a4cfa13 py-toml
+a4446c1c37c7210bdf2ecff14ef52837677a7aa600f2b99610169401d74b8fcd py-trove-classifiers
+42de926d4b9df59e5a0850954e346d80433011141d7d92f8114c97e161ae9544 py-typing-extensions
+c23bba7365de90f5e014bde0084e15f933ca6355a14cb3629490801e21c433a3 py-urllib3
+4f0010fb21fd83109323ffe93493d56e4439240cc3b2cb55ace30e159d36b93d py-wcwidth
+8824ef25a336b486766196942116caac63e88e1cf3ada0168f3cbaaf401fac8e py-wheel
+c9b099bc7d810a581e0e0f68061dd525d7efdb5334d119b4253249a459bd907e qemu
+edf3120349573dfd729ca476a3ad827fc11c2cc45b1ebea0ad010850bde44faf re2c
+9cb4614f2ba94f164e5a0963417dcdfaf05cc75be03b8f6f2907a68e5fd501f9 readline
+ed39f5753718cb65266c2b2e25fafdc206d8d95b032a3a9fa8d1df4a00351d16 redis
+e2b7b5944c5e6c4ab5fcc1fecbf9b46b28385b3988658fb90571971814226b91 rhash
+611897abd100d927a11e5165eec70a06b5a1f73b52424f4061d2c6e6cb9e1a8f runc
+b7c834268a81bfcc473246995c55b47fe18414cc553e3293b6294fde4e579163 rust
+f2ca315ca297da72f53c253839618b4b5da88c79b7dcbacfda2b5349e530a148 samurai
+3b145cb81233fa948f24cd78e6337580cec8901e304a86d7c95db8718a10f456 scdoc
+02fd93964f89a68f26d041654ac9f7f6ddde4844543e33ea4e0f1c328b67a652 sdtool
+f4e535fb1bfc2c7ae1756cdaa2404b1572f6ad195ceabba90d87ed0599fd97d7 seabios
+a3ed66311e4637400fbaacad513479b7828e0097f08c03921afc5542c39e0523 sed
+cc4b9804ecf50422902d6f92d8a64aa6e322e6ec927a0c052680cbfc8675da76 skalibs
+073e28399a142bd4ce28c8bf4ffc12fdf745a605c60fae121b7076223383007d socat
+c742fb1f0c5a4f9d9bc9afc37ba686b247d2b17d55d179409d33736b43c9aaa5 sops
+a24a92d71c1e3312ca67a109dcbb68b567d07336056c62364d3513b55138a771 sqlite3
+3774171893fc3cefc92533d7db181a460133f4d877a72d864071127070b589a4 stage0
+7db449f93c92de52ecd5ae57a610f1e4ad1abc50a7e6aea174bd27348c3c0e7a stage1
+e8accb544dd51697e9f049a01272fc3a8bbbb068a5130d6af15ad46c6099c63e stage2
+3bfd4db6e70eb0882402f4f92be44f4ac11c8170cafb9a7fa098108b6d2b71f2 stage3
+5907293a83fab7bf4e042bdf53fcd3081dc9e36399d59d825ed0982271b73475 strace
+c47fb2c4d8690936b4adef832a3f354231bb5a04206bf2fb565218034ce27792 swtpm
+a8902ec83460e293c74555b243fe77d49b0527cdd009572f8b660288d251d443 sxctl
+a41388558d7f6d9a29847ee2ff5507ab3100bfe9032ef3b99a3d783ad60ed390 syslinux
+dcc2e36e19de4d0d071aa312a21d98a90b2d48de016fa1232abcf9a4c07a09f9 talosctl
+42a897f8e633ea092e35de18cebc4c404731b6e7db984a0d19b4bc3cfde7504c tar
+90c0cb04094193e497d4a629c1371442be372c84573501139cd16bf11b6a95b4 tcl
+5e0636ae97d64a13ea165beb8e8a02b4b0b5cec8baf1c8a98c5509012069628e texinfo
+154ca805e1662e6b7138f87f7f684d5206dd52156064668219f75b7be2720d76 tflint
+1d9f849bf8d6b333a0379d0b69a12bcc83b01653aeef12a73530ee5728090454 tini
+4ad268685c0eeedf55f70e504d18f76d5403010570b7f99330a945503c6aa22a tofu
+c2fc693ec68a9d097151e5b3dd5b923f0dcc35fd4e0624b91ade3bf21367162c tpm2-tools
+a8bf8c0973e1b5ba62ce5034a6230684ebe5a142da275d09e81fa2f2f9c87411 tpm2-tss
+5b63cd277d70574ddef1fea3262bb985a48033192c9cb5aba16cd51d83660c7c unixodbc
+7e3f3c1e748f5c216503e69b9f8f2e9f8084ec675fb29b23f3a6f0ed3b20c54a util-linux
+04766fca467f9c945a398d5054c0388ba36ba09c0d5affdae553f321b519995a util-macros
+53349df7ec84bc47eef9bebdd9917e7eafc3b2f397fd8f43ca10162cc835d0ee utmps
+52b6a8271487f1933bccced48f0d68cdaca86ca9a1456515579559a8cdd063e2 xmlto
+2205a8f53d4fc569880c311061daa085f40c62b2fd94d556e72bd31b4df9e63a xorriso
+b57c5e6144117bc0124855e9538e60c302cc7bf53fafb53e2eef3434015366f1 xz
+53d8c2948dddd72ced3fa061c48c9d49e97d23a431e15dc80071e5cac2580688 yarn
+bd6882f0f3ea664e9de6cf732cef2fa2781fc2852f5e6502a6aea1e63eb9708b yq
+eb8e38b2285d5f6e88f8730c6c2550ca62b3fd1cc050ac87da0119f92c907dda zig
+7595e72b261f750ecefbc47954d135237e91f10086e27e29aacb19c134d4e77d zip
+96b4100550760026065dac57148d99e20a03d17e5ee20d6b32cbacd61125dbb6 zlib

packages/abseil-cpp/Containerfile

@@ -0,0 +1,45 @@
+FROM scratch AS base
+ENV VERSION=20240116.2
+ENV SRC_HASH=733726b8c3a6d39a4120d7e45ea8b41a434cdacde401cba500f14236c49b39dc
+ENV SRC_FILE=${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/abseil/abseil-cpp/archive/refs/tags/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/linux-headers . /
+COPY --from=stagex/cmake . /
+COPY --from=stagex/ninja . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/zlib . /
+
+RUN tar -xf ${SRC_FILE}
+WORKDIR /abseil-cpp-${VERSION}
+RUN <<-EOF
+	set -eux
+	cmake \
+		-B build \
+		-G Ninja \
+		-WMAKE_CXX_STANDARD=17 \
+        -DCMAKE_BUILD_TYPE=MinSizeRel \
+		-DCMAKE_INSTALL_PREFIX=/usr \
+		-DCMAKE_INSTALL_LIBDIR=lib \
+		-DBUILD_SHARED_LIBS=ON \
+		-DBUILD_TESTING=ON \
+        -DABSL_USE_EXTERNAL_GOOGLETEST=ON \
+        -DABSL_PROPAGATE_CXX_STD=ON \
+        -DABSL_FIND_GOOGLETEST=ON
+	cmake --build build
+EOF
+
+FROM build AS install
+RUN --network=none DESTDIR="/rootfs" cmake --install build
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/acl/Containerfile

@@ -0,0 +1,36 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=2.3.2
+ENV SRC_HASH=5f2bdbad629707aa7d85c623f994aa8a1d2dec55a73de5205bac0bf6058a2f7c
+ENV SRC_FILE=acl-${VERSION}.tar.gz
+ENV SRC_SITE=https://download.savannah.nongnu.org/releases/acl/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/attr . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /acl-${VERSION}
+RUN --network=none <<-EOF
+	set -eux
+    ./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+		--prefix=/usr \
+		--libdir=/usr/lib \
+		--libexecdir=/usr/libexec
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN make DESTDIR=/rootfs install
+RUN find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/acpica/Containerfile

@@ -0,0 +1,29 @@
+FROM scratch AS base
+ENV VERSION=20230628
+ENV SRC_HASH=86876a745e3d224dcfd222ed3de465b47559e85811df2db9820ef09a9dff5cce
+ENV SRC_FILE=acpica-unix-${VERSION}.tar.gz
+ENV SRC_SITE=https://downloadmirror.intel.com/783549/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/bison . /
+COPY --from=stagex/flex . /
+COPY --from=stagex/m4 . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /acpica-unix-${VERSION}
+ENV SOURCE_DATE_EPOCH=1
+ENV LDFLAGS="-Wl,-z,pack-relative-relocs"
+RUN --network=none make NOWERROR=TRUE -j "$(nproc)"
+
+FROM build AS install
+RUN --network=none DESTDIR=/rootfs make install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/alsa-lib/Containerfile

@@ -0,0 +1,41 @@
+FROM scratch AS base
+ENV VERSION=1.2.12
+ENV SRC_HASH=4868cd908627279da5a634f468701625be8cc251d84262c7e5b6a218391ad0d2
+ENV SRC_FILE=alsa-lib-${VERSION}.tar.bz2
+ENV SRC_SITE=https://alsa-project.org/files/pub/lib/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/linux-headers . /
+COPY --from=stagex/make . /
+COPY --from=stagex/musl . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /alsa-lib-${VERSION}
+RUN --network=none <<-EOF
+	set -eux; \
+	./configure \
+        --build=x86_64-linux-musl \
+        --host=x86_64-linux-musl \
+		--prefix=/usr \
+		--libdir=/usr/lib \
+        --disable-python \
+        --disable-static \
+        --disable-resmgr \
+        --enable-rawmidi \
+        --enable-seq \
+        --enable-aload \
+        --disable-dependency-tracking \
+        --without-versioned
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none make DESTDIR=/rootfs install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/apr-util/Containerfile

@@ -0,0 +1,53 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=1.6.3
+ENV SRC_HASH=a41076e3710746326c3945042994ad9a4fcac0ce0277dd8fea076fec3c9772b5
+ENV SRC_FILE=apr-util-${VERSION}.tar.bz2
+ENV SRC_SITE=https://www.apache.org/dist/apr/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/expat . /
+COPY --from=stagex/gdbm . /
+COPY --from=stagex/openldap . /
+COPY --from=stagex/sqlite3 . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/postgresql . /
+COPY --from=stagex/apr . /
+COPY --from=stagex/libtool . /
+COPY --from=stagex/util-linux . /
+
+RUN tar -xf ${SRC_FILE}
+WORKDIR /apr-util-${VERSION}
+COPY *.patch .
+RUN --network=none <<-EOF
+	set -eux
+	patch -p1 < musl-fix-testsuite.patch
+	./configure \
+		--prefix=/usr \
+		--with-apr=/usr \
+		--with-ldap \
+		--with-pgsql \
+		--with-mysql \
+		--with-sqlite3 \
+		--with-crypto \
+		--with-openssl \
+		--without-sqlite2 \
+		--with-dbm=ndbm \
+		--with-ndbm
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN make DESTDIR=/rootfs install
+RUN find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/apr-util/musl-fix-testsuite.patch

@@ -0,0 +1,19 @@
+diff --git a/test/testxlate.c b/test/testxlate.c
+index 6981eff..de00fa4 100644
+--- a/test/testxlate.c
++++ b/test/testxlate.c
+@@ -116,8 +116,12 @@ static void test_transformation(abts_case *tc, void *data)
+     }
+
+     /* 4. Transformation using charset aliases */
+-    one_test(tc, "UTF-8", "UTF-7", test_utf8, test_utf7, p);
+-    one_test(tc, "UTF-7", "UTF-8", test_utf7, test_utf8, p);
++    if (is_transform_supported(tc, "UTF-8", "UTF-7", p)) {
++        one_test(tc, "UTF-8", "UTF-7", test_utf8, test_utf7, p);
++    }
++    if (is_transform_supported(tc, "UTF-7", "UTF-8", p)) {
++        one_test(tc, "UTF-7", "UTF-8", test_utf7, test_utf8, p);
++    }
+ }
+
+ #endif /* APR_HAS_XLATE */

packages/apr/Containerfile

@@ -0,0 +1,38 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=1.7.5
+ENV SRC_HASH=cd0f5d52b9ab1704c72160c5ee3ed5d3d4ca2df4a7f8ab564e3cb352b67232f2
+ENV SRC_FILE=apr-${VERSION}.tar.bz2
+ENV SRC_SITE=https://www.apache.org/dist/apr/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/util-linux . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /apr-${VERSION}
+COPY *.patch .
+RUN --network=none <<-EOF
+	set -eux \
+	patch -p1 apr-1.6.2-dont-test-dlclose.patch
+	patch -p1 semtimedop-s390x.patch
+	./configure \
+		--prefix=/usr \
+		--datadir=/usr/share \
+		--enable-nonportable-atomics=no \
+		--with-devrandom=/dev/urandom
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN make DESTDIR=/rootfs install
+RUN find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/apr/apr-1.6.2-dont-test-dlclose.patch

@@ -0,0 +1,22 @@
+dlclose is a no-op on musl.  Test will always fail.
+
+--- apr-1.6.2/test/testdso.c.old	2010-01-03 19:35:07.000000000 -0600
++++ apr-1.6.2/test/testdso.c	2017-09-10 18:43:43.374983090 -0500
+@@ -244,7 +244,7 @@
+     abts_run_test(suite, test_load_module, NULL);
+     abts_run_test(suite, test_dso_sym, NULL);
+     abts_run_test(suite, test_dso_sym_return_value, NULL);
+-    abts_run_test(suite, test_unload_module, NULL);
++    /* abts_run_test(suite, test_unload_module, NULL); */
+
+ #ifdef LIB_NAME
+     apr_filepath_merge(&libname, NULL, LIB_NAME, 0, p);
+@@ -252,7 +252,7 @@
+     abts_run_test(suite, test_load_library, NULL);
+     abts_run_test(suite, test_dso_sym_library, NULL);
+     abts_run_test(suite, test_dso_sym_return_value_library, NULL);
+-    abts_run_test(suite, test_unload_library, NULL);
++    /* abts_run_test(suite, test_unload_library, NULL); */
+ #endif
+
+     abts_run_test(suite, test_load_notthere, NULL);

packages/apr/semtimedop-s390x.patch

@@ -0,0 +1,16 @@
+the testsuite hangs on s390x when testing locking mechanism sysvsem. Work
+around by avoid use semtimedop for s390x.
+
+diff --git a/locks/unix/proc_mutex.c b/locks/unix/proc_mutex.c
+index 8e2187f..cad6c4a 100644
+--- a/locks/unix/proc_mutex.c
++++ b/locks/unix/proc_mutex.c
+@@ -449,7 +449,7 @@ static const apr_proc_mutex_unix_lock_methods_t mutex_sysv_methods =
+     proc_mutex_sysv_create,
+     proc_mutex_sysv_acquire,
+     proc_mutex_sysv_tryacquire,
+-#if defined(HAVE_SEMTIMEDOP)
++#if defined(HAVE_SEMTIMEDOP) && !defined(__s390x__)
+     proc_mutex_sysv_timedacquire,
+ #else
+     proc_mutex_spinsleep_timedacquire,

packages/argon2/Containerfile

@@ -0,0 +1,29 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=20190702
+ENV SRC_HASH=daf972a89577f8772602bf2eb38b6a3dd3d922bf5724d45e7f9589b5e830442c
+ENV SRC_FILE=${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/P-H-C/phc-winner-argon2/archive/refs/tags/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+RUN tar -xf $SRC_FILE
+WORKDIR /phc-winner-argon2-${VERSION}
+RUN --network=none <<-EOF
+	set -eux
+	make -j "$(nproc)" OPTTARGET=none ARGON2_VERSION=${VERSION}
+EOF
+
+FROM build AS install
+RUN make OPTTARGET=none LIBRARY_REL=lib DESTDIR=/rootfs install
+RUN find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/argp-standalone/Containerfile

@@ -1,25 +1,25 @@
-FROM scratch as base
+FROM scratch AS base
 ENV VERSION=1.5.0
 ENV SRC_FILE=${VERSION}.tar.gz
 ENV SRC_SITE=https://github.com/argp-standalone/argp-standalone/archive/refs/tags/${SRC_FILE}
 ENV SRC_HASH=c29eae929dfebd575c38174f2c8c315766092cec99a8f987569d0cad3c6d64f6
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=busybox . /
-COPY --from=gcc . /
-COPY --from=binutils . /
-COPY --from=make . /
-COPY --from=musl . /
-COPY --from=perl . /
-COPY --from=autoconf . /
-COPY --from=automake . /
-COPY --from=m4 . /
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/autoconf . /
+COPY --from=stagex/automake . /
+COPY --from=stagex/m4 . /
 RUN tar -xf ${SRC_FILE}
-WORKDIR argp-standalone-${VERSION}
-RUN <<-EOF
+WORKDIR /argp-standalone-${VERSION}
+RUN --network=none <<-EOF
 	set -eux
 	/usr/bin/autoreconf -vif
 	CFLAGS="-fPIC" \
@@ -29,17 +29,15 @@ RUN <<-EOF
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info \
 		--localstatedir=/var
-	make
+	make -j "$(nproc)"
 EOF
 
-FROM build as install
-USER 0:0
+FROM build AS install
 RUN <<-EOF
 	set -eux
 	install -D -m644 argp.h /rootfs/usr/include/argp.h
 	install -D -m755 libargp.a /rootfs/usr/lib/libargp.a
 EOF
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/aspell/Containerfile

@@ -0,0 +1,38 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=0.60.8.1
+ENV SRC_HASH=d6da12b34d42d457fa604e435ad484a74b2effcd120ff40acd6bb3fb2887d21b
+ENV SRC_FILE=aspell-${VERSION}.tar.gz
+ENV SRC_SITE=https://ftp.gnu.org/gnu/aspell/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /aspell-${VERSION}
+ENV SOURCE_DATE_EPOCH=1
+RUN --network=none <<-EOF
+	set -ex
+	./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--enable-dict-dir=/usr/share/aspell \
+		--enable-pkgdatadir=/usr/share/aspell
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none make DESTDIR="/rootfs" install
+RUN find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/attr/Containerfile

@@ -0,0 +1,43 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=2.5.2
+ENV SRC_HASH=39bf67452fa41d0948c2197601053f48b3d78a029389734332a6309a680c6c87
+ENV SRC_FILE=attr-${VERSION}.tar.gz
+ENV SRC_SITE=https://download.savannah.nongnu.org/releases/attr/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/perl . /
+
+RUN tar -xf ${SRC_FILE}
+WORKDIR /attr-${VERSION}
+RUN --network=none <<-EOF
+	set -eux
+    ./configure \
+		--prefix=/usr \
+		--exec-prefix=/ \
+		--sbindir=/bin \
+		--bindir=/usr/bin \
+		--libdir=/usr/lib \
+		--libexecdir=/usr/lib \
+		--includedir=/usr/include \
+		--mandir=/usr/share/man \
+		--docdir=/usr/share/doc/attr \
+		--datadir=/usr/share \
+		--disable-nls
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN make DESTDIR=/rootfs install
+RUN find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/autoconf-archive/Containerfile

@@ -0,0 +1,34 @@
+FROM scratch AS base
+ENV VERSION=2023.02.20
+ENV SRC_HASH=71d4048479ae28f1f5794619c3d72df9c01df49b1c628ef85fde37596dc31a33
+ENV SRC_FILE=autoconf-archive-${VERSION}.tar.xz
+ENV SRC_SITE=https://ftp.gnu.org/gnu/autoconf-archive/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+#COPY --from=stagex/gcc . /
+#COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/musl . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /autoconf-archive-${VERSION}
+RUN --network=none <<-EOF
+	set -eux
+	./configure \
+        --build=x86_64-linux-musl \
+        --host=x86_64-linux-musl \
+		--sysconfdir=/etc \
+		--localstatedir=/etc \
+		--mandir=/usr/share/man \
+		--prefix=/usr
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none make DESTDIR=/rootfs install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/autoconf/Containerfile

@@ -1,33 +1,32 @@
-FROM scratch as base
+FROM scratch AS base
 ENV VERSION=2.71
 ENV SRC_HASH=f14c83cfebcc9427f2c3cea7258bd90df972d92eb26752da4ddad81c87a0faa4
 ENV SRC_FILE=autoconf-${VERSION}.tar.xz
 ENV SRC_SITE=https://ftp.gnu.org/gnu/autoconf/${SRC_FILE}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=busybox . /
-COPY --from=gcc . /
-COPY --from=binutils . /
-COPY --from=make . /
-COPY --from=musl . /
-COPY --from=m4 . /
-COPY --from=perl . /
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/m4 . /
+COPY --from=stagex/perl . /
 RUN tar -xf ${SRC_FILE}
-WORKDIR autoconf-${VERSION}
+WORKDIR /autoconf-${VERSION}
 ENV M4=/usr/bin/m4
 RUN --network=none <<-EOF
 	set -eux
 	./configure \
 		--prefix=/usr
-	make
+	make -j "$(nproc)"
 EOF
 
-from build as install
+FROM build AS install
 RUN --network=none make DESTDIR=/rootfs install
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/automake/Containerfile

@@ -1,32 +1,32 @@
-FROM scratch as base
+FROM scratch AS base
 ENV VERSION=1.16.5
 ENV SRC_HASH=f01d58cd6d9d77fbdca9eb4bbd5ead1988228fdb73d6f7a201f5f8d6b118b469
 ENV SRC_FILE=automake-${VERSION}.tar.xz
 ENV SRC_SITE=https://ftp.gnu.org/gnu/automake/${SRC_FILE}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=busybox . /
-COPY --from=gcc . /
-COPY --from=binutils . /
-COPY --from=make . /
-COPY --from=musl . /
-COPY --from=perl . /
-COPY --from=m4 . /
-COPY --from=autoconf . /
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/m4 . /
+COPY --from=stagex/autoconf . /
 RUN tar -xf automake-${VERSION}.tar.xz
-WORKDIR automake-${VERSION}
+WORKDIR /automake-${VERSION}
+ENV SOURCE_DATE_EPOCH=1
 RUN --network=none <<-EOF
 	set -eux
 	./configure --prefix=/usr
-	make
+	make -j "$(nproc)"
 EOF
 
-FROM build as install
-RUN make DESTDIR=/rootfs install
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
+FROM build AS install
+RUN --network=none make DESTDIR=/rootfs install
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/aws-cli/Containerfile

@@ -0,0 +1,54 @@
+FROM scratch AS base
+ENV VERSION=2.15.31
+ENV SRC_HASH=6507f894a30036ad002b54e12f49959c592c8507765405c52cf7b4ba4dc2509d
+ENV SRC_FILE=${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/aws/aws-cli/archive/refs/tags/${VERSION}/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/sqlite3 . /
+COPY --from=stagex/python . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/libunwind . /
+COPY --from=stagex/libffi . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/py-flit . /
+COPY --from=stagex/py-gpep517 . /
+COPY --from=stagex/py-installer . /
+COPY --from=stagex/py-distro . /
+COPY --from=stagex/py-jmespath . /
+COPY --from=stagex/py-dateutil . /
+COPY --from=stagex/py-urllib3 . /
+COPY --from=stagex/py-cffi . /
+COPY --from=stagex/py-six . /
+COPY --from=stagex/py-botocore . /
+COPY --from=stagex/py-awscrt . /
+COPY --from=stagex/py-certifi . /
+COPY --from=stagex/py-cryptography . /
+COPY --from=stagex/py-colorama . /
+COPY --from=stagex/py-docutils . /
+COPY --from=stagex/py-wcwidth . /
+COPY --from=stagex/py-prompt_toolkit . /
+COPY --from=stagex/py-ruamel.yaml . /
+RUN tar -xzf ${SRC_FILE}
+WORKDIR /aws-cli-${VERSION}
+RUN --network=none \
+    gpep517 build-wheel \
+		--wheel-dir .dist \
+		--output-fd 3 3>&1 >&2
+
+FROM build AS install
+RUN --network=none <<-EOF
+    set -eu
+    python -m installer -d /rootfs .dist/*.whl
+    find /rootfs | grep -E "(/__pycache__$|\.pyc$|\.pyo$)" | xargs rm -rf
+    rm /rootfs/usr/lib/python*/site-packages/awscli-*.dist-info/RECORD
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/bash/Containerfile

@@ -1,39 +1,38 @@
-FROM scratch as base
+FROM scratch AS base
 ENV VERSION=5.2.21
 ENV SRC_HASH=c8e31bdc59b69aaffc5b36509905ba3e5cbb12747091d27b4b977f078560d5b8
 ENV SRC_FILE=bash-${VERSION}.tar.gz
 ENV SRC_SITE=https://ftp.gnu.org/gnu/bash/${SRC_FILE}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=busybox . /
-COPY --from=musl . /
-COPY --from=gcc . /
-COPY --from=binutils . /
-COPY --from=make . /
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
 RUN tar -xzf ${SRC_FILE}
-WORKDIR bash-${VERSION}
+WORKDIR /bash-${VERSION}
 RUN --network=none <<-EOF
 	set -eux
 	./configure \
 		--build=x86_64-unknown-linux-musl \
 		--host=x86_64-unknown-linux-musl \
 		--prefix=/usr \
-		--bindir=/bin \
+		--bindir=/usr/bin \
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info \
 		--disable-nls \
 		--enable-readline \
 		--without-curses \
 		--without-bash-malloc
-	make
+	make -j "$(nproc)"
 EOF
 
-FROM build as install
-RUN make DESTDIR=/rootfs install
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
+FROM build AS install
+RUN --network=none make DESTDIR=/rootfs install
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/bc/Containerfile

@@ -0,0 +1,49 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=1.07.1
+ENV SRC_HASH=62adfca89b0a1c0164c2cdca59ca210c1d44c3ffc46daf9931cf4942664cb02a
+ENV SRC_FILE=bc-${VERSION}.tar.gz
+ENV SRC_SITE=https://ftp.gnu.org/gnu/bc/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/binutils . /
+COPY --from=stagex/coreutils . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/bash . /
+COPY --from=stagex/bash /bin/bash /bin/sh
+COPY --from=stagex/tar . /
+COPY --from=stagex/ed . /
+COPY --from=stagex/grep . /
+COPY --from=stagex/gzip . /
+COPY --from=stagex/bison . /
+COPY --from=stagex/flex . /
+COPY --from=stagex/gawk . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/texinfo . /
+COPY --from=stagex/findutils . /
+COPY --from=stagex/sed . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /bc-${VERSION}
+RUN --network=none <<-EOF
+	set -ex
+	./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+		--prefix=/usr \
+        --sysconfdir=/etc \
+		--mandir=/usr/share/man \
+        --infodir=/usr/share/info
+	make -j1
+EOF
+
+FROM build AS install
+RUN --network=none make DESTDIR="/rootfs" install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/binutils/Containerfile

@@ -1,17 +1,17 @@
-FROM scratch as base
+FROM scratch AS base
 ARG ARCH=x86_64
-ENV VERSION=2.35
-ENV SRC_HASH=1b11659fb49e20e18db460d44485f09442c8c56d5df165de9461eb09c8302f85
+ENV VERSION=2.43.1
+ENV SRC_HASH=13f74202a3c4c51118b797a39ea4200d3f6cfbe224da6d1d95bb938480132dfd
 ENV SRC_FILE=binutils-${VERSION}.tar.xz
 ENV SRC_SITE=https://ftp.gnu.org/gnu/binutils/${SRC_FILE}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=stage3 . /
+FROM fetch AS build
+COPY --from=stagex/stage3 . /
 RUN tar -xf binutils-${VERSION}.tar.xz
-WORKDIR binutils-${VERSION}
+WORKDIR /binutils-${VERSION}
 RUN --network=none <<-EOF
 	set -ex
 	CFLAGS='-Os -Wformat -Werror=format-security -O2' \
@@ -49,9 +49,8 @@ RUN --network=none <<-EOF
 	make -j "$(nproc)"
 EOF
 
-FROM build as install
+FROM build AS install
 RUN --network=none make DESTDIR="/rootfs" install
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/bison/Containerfile

@@ -1,24 +1,24 @@
-FROM scratch as base
+FROM scratch AS base
 ENV VERSION=3.4.2
 ENV SRC_HASH=27d05534699735dc69e86add5b808d6cb35900ad3fd63fa82e3eb644336abfa0
 ENV SRC_FILE=bison-${VERSION}.tar.xz
 ENV SRC_SITE=http://mirrors.kernel.org/gnu/bison/${SRC_FILE}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=musl . /
-COPY --from=busybox . /
-COPY --from=gcc . /
-COPY --from=binutils . /
-COPY --from=perl . /
-COPY --from=autoconf . /
-COPY --from=automake . /
-COPY --from=make . /
-COPY --from=m4 . /
+FROM fetch AS build
+COPY --from=stagex/musl . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/autoconf . /
+COPY --from=stagex/automake . /
+COPY --from=stagex/make . /
+COPY --from=stagex/m4 . /
 RUN tar -xf ${SRC_FILE}
-WORKDIR bison-${VERSION}
+WORKDIR /bison-${VERSION}
 ENV M4=/usr/bin/m4
 RUN --network=none <<-EOF
 	set -eux
@@ -28,9 +28,8 @@ RUN --network=none <<-EOF
 	make -j1 MAKEINFO=false
 EOF
 
-from build as install
+FROM build AS install
 RUN --network=none make DESTDIR=/rootfs install
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/brotli/Containerfile

@@ -0,0 +1,48 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=1.1.0
+ENV SRC_HASH=e720a6ca29428b803f4ad165371771f5398faba397edf6778837a18599ea13ff
+ENV SRC_FILE=v${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/google/brotli/archive/refs/tags/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/samurai . /
+COPY --from=stagex/cmake . /
+COPY --from=stagex/openssl . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /brotli-${VERSION}
+RUN --network=none <<-EOF
+	set -eux
+    cmake -B build -G Ninja \
+		-DCMAKE_BUILD_TYPE=None \
+		-DCMAKE_INSTALL_PREFIX=/usr \
+		-DBUILD_SHARED_LIBS=OFF
+	cmake --build build
+
+	cmake -B build -G Ninja \
+		-DCMAKE_BUILD_TYPE=None \
+		-DCMAKE_INSTALL_PREFIX=/usr \
+		-DBUILD_SHARED_LIBS=ON
+	cmake --build build
+EOF
+
+FROM build AS install
+RUN <<-EOF
+    set -eux
+    DESTDIR=/rootfs cmake --install build
+    for file in common dec enc; do
+		install -D -m 755 build/libbrotli$file.a /rootfs/usr/lib64
+	done
+    mv /rootfs/usr/lib64 /rootfs/usr/lib
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/buf/Containerfile

@@ -0,0 +1,36 @@
+FROM scratch AS base
+ENV VERSION=1.30.1
+ENV SRC_HASH=56da0c31b11bd15b99049af8b364c7bf4e11106152ab27d5ccb98d28123ab785
+ENV SRC_FILE=v${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/bufbuild/buf/archive/refs/tags/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/go . /
+COPY --from=stagex/ca-certificates . /
+RUN tar -xvf v${VERSION}.tar.gz
+WORKDIR /buf-${VERSION}
+ENV PWD=/home/user/buf-${VERSION}
+ENV GOPATH=${PWD}/cache/go
+ENV GOCACHE=${PWD}/cache/
+ENV GOWORK=off
+ENV GOPROXY=https://proxy.golang.org,direct
+ENV GOSUMDB=sum.golang.org
+ENV CGO_ENABLED=0
+ENV GOHOSTOS=linux
+ENV GOHOSTARCH=amd64
+ENV GOFLAGS=-trimpath
+RUN mkdir -p ${GOPATH}
+RUN go build -o bin/buf ./cmd/buf
+
+FROM build AS install
+RUN <<-EOF
+    mkdir -p /rootfs/usr/bin/
+    cp bin/buf /rootfs/usr/bin/
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/./ /

packages/buildkit/Containerfile

@@ -0,0 +1,48 @@
+FROM scratch AS base
+ENV VERSION=0.15.0
+ENV SRC_FILE=v${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/moby/buildkit/archive/${SRC_FILE}
+ENV SRC_HASH=ebf4b82f7379818d8fcfe5c54034e7f93c062c95f663bfd3c2a622583f62a8a4
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/musl . /
+COPY --from=stagex/bash . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/go . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/pkgconf . /
+RUN tar -xf ${SRC_FILE}
+ENV GOPROXY=https://proxy.golang.org,direct
+ENV GOSUMDB=sum.golang.org
+ENV GOPATH=/cache/go
+ENV GOBIN=${GOPATH}/bin
+ENV PATH=${GOBIN}:${PATH}
+WORKDIR /buildkit-${VERSION}
+RUN <<-EOF
+    set -eux
+    mkdir -p out
+    go build -v \
+        --ldflags=" \
+        -w -s -buildid= \
+		-X github.com/moby/buildkit/version.Version=${VERSION} \
+		-X github.com/moby/buildkit/version.Revision=stagex \
+        " \
+        -o out/ \
+        ./cmd/...
+    rm -r docs/reference
+EOF
+
+FROM build AS install
+RUN <<-EOF
+    set -eux
+    mkdir -p /rootfs
+    install -Dm755 ./out/* -t /rootfs/usr/bin/
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/busybox/Containerfile

@@ -1,16 +1,16 @@
-FROM scratch as base
+FROM scratch AS base
 ENV VERSION=1.36.1
 ENV SRC_HASH=b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314
 ENV SRC_FILE=busybox-${VERSION}.tar.bz2
 ENV SRC_SITE=https://busybox.net/downloads/${SRC_FILE}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=stage3 . /
+FROM fetch AS build
+COPY --from=stagex/stage3 . /
 RUN tar -xjf ${SRC_FILE}
-WORKDIR busybox-${VERSION}
+WORKDIR /busybox-${VERSION}
 ENV KCONFIG_NOTIMESTAMP=1
 RUN --network=none <<-EOF
     set -eux
@@ -51,29 +51,16 @@ RUN --network=none <<-EOF
     make
 EOF
 
-FROM build as install
+FROM build AS install
 RUN --network=none <<-EOF
     set -eux
-    mkdir -p /rootfs/bin
-    cp busybox /rootfs/bin
-    cp busybox /bin
+    mkdir -p /rootfs/usr/bin
+    cp busybox /rootfs/usr/bin
+    cp busybox /usr/bin
     cd /rootfs
-    mkdir -p home/user var/tmp etc tmp lib bin
-    /bin/busybox --install -s bin
-    echo "user:x:1000:" > etc/group
-    echo "user:x:1000:1000::/home/user:/bin/sh" > etc/passwd
-    ln -sT /lib lib64
-    chown -R 1000:1000 /rootfs/home/user /rootfs/tmp /rootfs/var/tmp
+    /usr/bin/busybox --install -s usr/bin
 EOF
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
 
-FROM scratch as package
-COPY --from=install /rootfs /
-WORKDIR /home/user
-USER 1000:1000
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /
 ENTRYPOINT ["/bin/sh"]
-ENV TZ=UTC
-ENV LANG=C.UTF-8
-ENV SOURCE_DATE_EPOCH=1
-ENV KCONFIG_NOTIMESTAMP=1
-ENV PS1="stage4 $ "

packages/bzip2/Containerfile

@@ -0,0 +1,29 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=1.0.8
+ENV SRC_HASH=ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269
+ENV SRC_FILE=bzip2-${VERSION}.tar.gz
+ENV SRC_SITE=https://sourceware.org/pub/bzip2/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /bzip2-${VERSION}
+RUN --network=none <<-EOF
+	set -ex
+    make -j "$(nproc)" -f Makefile-libbz2_so all
+    make -j "$(nproc)" all
+EOF
+
+FROM build AS install
+RUN --network=none make PREFIX="/rootfs/usr" install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/c-ares/Containerfile

@@ -0,0 +1,35 @@
+FROM scratch AS base
+ENV VERSION=1.33.1
+ENV SRC_HASH=06869824094745872fa26efd4c48e622b9bd82a89ef0ce693dc682a23604f415
+ENV SRC_FILE=c-ares-${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/c-ares/c-ares/releases/download/v${VERSION}/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+
+RUN --network=none tar -xf ${SRC_FILE}
+WORKDIR /c-ares-${VERSION}
+RUN --network=none <<EOF
+	set -eux
+	./configure \
+        --build=x86_64-linux-musl \
+        --host=x86_64-linux-musl \
+        --prefix=/usr \
+        --mandir=/usr/share/man \
+        --infodir=/usr/share/info \
+        --enable-shared
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none make DESTDIR=/rootfs install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/ca-certificates/Containerfile

@@ -1,9 +1,41 @@
-FROM busybox as base
+FROM scratch AS base
 
-FROM base as install
-USER 0:0
-COPY cacert.pem /rootfs/etc/ssl/certs/ca-certificates.crt
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
+ENV SRC_1_VERSION=NSS_3_100_RTM
+ENV SRC_1_HASH=4d96bd539f4719e9ace493757afbe4a23ee8579de1c97fbebc50bba3c12e8c1e
+ENV SRC_1_FILE=certdata.txt
+ENV SRC_1_SITE=https://hg.mozilla.org/projects/nss/raw-file/${SRC_1_VERSION}/lib/ckfw/builtins/${SRC_1_FILE}
 
-FROM scratch as package
-COPY --from=install /rootfs /
+ENV SRC_2_VERSION=20240315
+ENV SRC_2_HASH=0a6f1ac76c722353492a44c365afb74638971beb4de4349cee0c881db1b8f6df
+ENV SRC_2_FILE=ca-certificates-${SRC_2_VERSION}.tar.gz
+ENV SRC_2_SITE=https://gitlab.alpinelinux.org/alpine/ca-certificates/-/archive/${SRC_2_VERSION}/${SRC_2_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_1_HASH} ${SRC_1_SITE} /
+ADD --checksum=sha256:${SRC_2_HASH} ${SRC_2_SITE} /
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/perl . /
+RUN tar -xf ca-certificates-${SRC_2_VERSION}.tar.gz
+WORKDIR /ca-certificates-${SRC_2_VERSION}
+ADD *.patch .
+RUN --network=none <<-EOF
+	set -eux
+	patch -p1 < remove-timestamp.patch
+	rm -f ./certdata.txt
+	mv ../certdata.txt ./certdata.txt
+	make
+EOF
+
+FROM build AS install
+RUN --network=none make install DESTDIR=/rootfs
+RUN --network=none mv cert.pem /rootfs/etc/ssl/certs/ca-certificates.crt
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/ca-certificates/remove-timestamp.patch

@@ -0,0 +1,13 @@
+diff --git a/mk-ca-bundle.pl b/mk-ca-bundle.pl
+index 926478f..51db464 100644
+--- a/mk-ca-bundle.pl
++++ b/mk-ca-bundle.pl
+@@ -407,8 +407,6 @@ print CRT <<EOT;
+ ##
+ ## Bundle of CA Root Certificates
+ ##
+-## Certificate data from Mozilla ${datesrc}: ${currentdate} GMT
+-##
+ ## This is a bundle of X.509 certificates of public Certificate Authorities
+ ## (CA). These were automatically extracted from Mozilla's root certificates
+ ## file (certdata.txt).  This file can be found in the mozilla source tree:

packages/ccid/Containerfile

@@ -0,0 +1,41 @@
+FROM scratch AS base
+ENV VERSION=1.5.5
+ENV SRC_HASH=194708f75fe369d45dd7c15e8b3e8a7db8b49cfc5557574ca2a2e76ef12ca0ca
+ENV SRC_FILE=ccid-${VERSION}.tar.bz2
+ENV SRC_SITE=https://ccid.apdu.fr/files/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/m4 . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/pcsc-lite . /
+COPY --from=stagex/flex . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/libusb . /
+COPY --from=stagex/zlib . /
+RUN tar -xvf $SRC_FILE
+WORKDIR /ccid-${VERSION}
+RUN --network=none <<-EOF
+	set -eux
+	./configure \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info \
+		--localstatedir=/var \
+        --enable-twinserial
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none make DESTDIR=/rootfs install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/clang/Containerfile

@@ -0,0 +1,56 @@
+FROM scratch AS base
+ENV VERSION=18.1.8
+ENV SRC_HASH=0b58557a6d32ceee97c8d533a59b9212d87e0fc4d2833924eb6c611247db2f2a
+ENV SRC_FILE=llvm-project-${VERSION}.src.tar.xz
+ENV SRC_SITE=https://github.com/llvm/llvm-project/releases/download/llvmorg-${VERSION}/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/linux-headers . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/cmake . /
+COPY --from=stagex/ninja . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/python . /
+COPY --from=stagex/py-setuptools . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/git . /
+COPY --from=stagex/llvm . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/ninja . /
+COPY --from=stagex/libxml2 . /
+COPY --from=stagex/samurai . /
+
+RUN tar -xf ${SRC_FILE}
+WORKDIR /llvm-project-${VERSION}.src
+RUN --network=none <<-EOF
+    set -eux
+    cmake \
+    	-S clang \
+	-B build \
+	-G Ninja \
+	-Wno-dev \
+	-DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_INSTALL_PREFIX=/usr/ \
+        -DCLANG_BUILT_STANDALONE=ON \
+        -DCLANG_CONFIG_FILE_SYSTEM_DIR=/etc/clang18 \
+        -DCLANG_ENABLE_ARCMT=ON \
+        -DCMAKE_INSTALL_RPATH=/usr/ \
+        -DCLANG_LINK_CLANG_DYLIB=ON \
+        -DCLANG_PLUGIN_SUPPORT=ON \
+        -DCLANG_VENDOR=stagex \
+        -DENABLE_LINKER_BUILD_ID=ON \
+        -DLIBCLANG_BUILD_STATIC=ON
+    ninja -C build clang-tblgen
+    ninja -C build
+EOF
+
+FROM build AS install
+RUN --network=none DESTDIR="/rootfs" cmake --install build
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/clang16/Containerfile

@@ -0,0 +1,48 @@
+FROM scratch AS base
+ENV VERSION=16.0.6
+ENV SRC_HASH=ce5e71081d17ce9e86d7cbcfa28c4b04b9300f8fb7e78422b1feb6bc52c3028e
+ENV SRC_FILE=llvm-project-${VERSION}.src.tar.xz
+ENV SRC_SITE=https://github.com/llvm/llvm-project/releases/download/llvm-org-${VERSION}/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/cmake . /
+COPY --from=stagex/ninja . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/python . /
+COPY --from=stagex/py-setuptools . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/llvm16 . /
+COPY --from=stagex/zlib . /
+
+RUN tar -xf ${SRC_FILE}
+WORKDIR /llvm-project-${VERSION}.src
+RUN --network=none <<-EOF
+    set -eux
+    cmake \
+        -S clang \
+        -B build \
+        -G Ninja \
+        -Wno-dev \
+		-DCMAKE_BUILD_TYPE=Release \
+		-DCMAKE_INSTALL_PREFIX=/usr/ \
+		-DCMAKE_INSTALL_RPATH=/usr/ \
+		-DCLANG_BUILT_STANDALONE=ON \
+		-DCLANG_LINK_CLANG_DYLIB=ON \
+		-DCLANG_PLUGIN_SUPPORT=ON \
+		-DCLANG_VENDOR=stagex \
+		-DLIBCLANG_BUILD_STATIC=ON
+	cmake --build build
+EOF
+
+FROM build AS install
+RUN --network=none DESTDIR="/rootfs" cmake --install build
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/cmake/Containerfile

@@ -1,26 +1,24 @@
-FROM scratch as base
+FROM scratch AS base
 ENV VERSION=3.27.8
 ENV SRC_HASH=fece24563f697870fbb982ea8bf17482c9d5f855d8c9bf0b82463d76c9e8d0cc
 ENV SRC_FILE=cmake-${VERSION}.tar.gz
 ENV SRC_SITE=https://cmake.org/files/v3.27/${SRC_FILE}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=busybox . /
-COPY --from=binutils . /
-COPY --from=ninja . /
-COPY --from=musl . /
-COPY --from=make . /
-COPY --from=linux-headers . /
-COPY --from=gcc . /
-COPY --from=zlib . /
-COPY --from=openssl . /
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/ninja . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/linux-headers . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/openssl . /
 RUN tar -xf ${SRC_FILE}
-WORKDIR cmake-${VERSION}
-# HACK: figure out why gcc package puts these in the wrong path at install time
-COPY --from=gcc /usr/lib64/* /usr/lib/
+WORKDIR /cmake-${VERSION}
 RUN --network=none <<-EOF
 	set -eux
 	./bootstrap \
@@ -35,9 +33,8 @@ RUN --network=none <<-EOF
 	ninja
 EOF
 
-FROM build as install
+FROM build AS install
 RUN --network=none DESTDIR=/rootfs bin/cmake -P cmake_install.cmake
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/containerd/Containerfile

@@ -0,0 +1,55 @@
+FROM scratch AS base
+ENV VERSION=1.7.20
+ENV COMMIT=8fc6bcff51318944179630522a095cc9dbf9f353
+ENV SRC_FILE=v${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/containerd/containerd/archive/${SRC_FILE}
+ENV SRC_HASH=c4268561e514a2e8322bc8cdd39113d5e164fb31c2cef76f479d683395ea9bd6
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/musl . /
+COPY --from=stagex/bash . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/go . /
+COPY --from=stagex/go-md2man . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/linux-headers . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/libseccomp . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /containerd-${VERSION}
+ENV GO11MODULE=on
+RUN <<-EOF
+    set -eux
+    make \
+        SHIM_CGO_ENABLED=1 \
+        VERSION=${VERSION} \
+        REVISION=${COMMIT} \
+        BUILDMODE=pie \
+        EXTRA_LDFLAGS="-s -w -buildid=" \
+        -j "$(nproc)"
+    make man
+EOF
+
+FROM build AS install
+RUN <<-EOF
+    set -eux
+    rm ./bin/gen-manpages
+    install -d /rootfs/usr/bin/
+    install -Dsm755 ./bin/* /rootfs/usr/bin/
+    install -d /rootfs/usr/share/man/man5/
+    install -Dm644 ./man/*.5 /rootfs/usr/share/man/man5/
+    install -d /rootfs/usr/share/man/man8/
+    install -Dm644 ./man/*.8 /rootfs/usr/share/man/man8/
+    install -d /rootfs/etc/containerd/
+    /rootfs/usr/bin/containerd config default \
+        | sed "s|/opt/cni/bin|/usr/libexec/cni|g" \
+        > /rootfs/etc/containerd/config.toml
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/coreutils/Containerfile

@@ -0,0 +1,45 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=9.4
+ENV SRC_HASH=ea613a4cf44612326e917201bbbcdfbd301de21ffc3b59b6e5c07e040b275e52
+ENV SRC_FILE=coreutils-${VERSION}.tar.xz
+ENV SRC_SITE=https://ftp.gnu.org/gnu/coreutils/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+RUN tar -xf coreutils-${VERSION}.tar.xz
+WORKDIR /coreutils-${VERSION}
+ENV FORCE_UNSAFE_CONFIGURE=1
+RUN --network=none <<-EOF
+	set -ex
+	./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+		--target=${ARCH}-linux-musl \
+		--with-build-sysroot= \
+		--with-sysroot=/ \
+		--prefix=/usr \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info \
+        --disable-nls \
+        --with-openssl \
+        --enable-single-binary=symlinks \
+		--enable-single-binary-exceptions=env \
+        gl_cv_func_getcwd_path_max="no, but it is partly working" \
+        gl_cv_prog_perl="no"
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none make DESTDIR="/rootfs" install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/cpio/Containerfile

@@ -1,38 +1,35 @@
-FROM scratch as base
+FROM scratch AS base
 ENV VERSION=2.15
 ENV SRC_HASH=efa50ef983137eefc0a02fdb51509d624b5e3295c980aa127ceee4183455499e
 ENV SRC_FILE=cpio-${VERSION}.tar.gz
 ENV SRC_SITE=https://ftp.gnu.org/gnu/cpio/${SRC_FILE}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=busybox . /
-COPY --from=gcc . /
-COPY --from=binutils . /
-COPY --from=make . /
-COPY --from=musl . /
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/musl . /
 RUN tar -xzf ${SRC_FILE}
-WORKDIR cpio-${VERSION}
+WORKDIR /cpio-${VERSION}
 RUN --network=none <<-EOF
     set -eux
     ./configure \
         --build=x86_64-unknown-linux-musl \
         --host=x86_64-unknown-linux-musl \
         --prefix=/usr \
-        --bindir=/bin \
+        --bindir=/usr/bin \
         --mandir=/usr/share/man \
-        --infodir=/usr/share/info
-    make
+        --infodir=/usr/share/info \
+        gl_cv_func_getcwd_path_max="no, but it is partly working"
+    make -j "$(nproc)"
 EOF
 
-FROM build as install
-RUN <<-EOF
-    set -eux
-    make DESTDIR=/rootfs install
-EOF
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
+FROM build AS install
+RUN --network=none make DESTDIR=/rootfs install
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/curl/Containerfile

@@ -1,21 +1,24 @@
-FROM scratch as base
-ENV VERSION=8.4.0
-ENV SRC_HASH=16c62a9c4af0f703d28bda6d7bbf37ba47055ad3414d70dec63e2e6336f2a82d
+FROM scratch AS base
+ENV VERSION=8.9.1
+ENV SRC_HASH=f292f6cc051d5bbabf725ef85d432dfeacc8711dd717ea97612ae590643801e5
 ENV SRC_FILE=curl-${VERSION}.tar.xz
 ENV SRC_SITE=https://curl.se/download/${SRC_FILE}
+ENV SOURCE_DATE_EPOCH=1
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=busybox . /
-COPY --from=binutils . /
-COPY --from=make . /
-COPY --from=musl . /
-COPY --from=gcc . /
-COPY --from=openssl . /
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/ca-certificates . /
 RUN tar -xf curl-${VERSION}.tar.xz
-WORKDIR curl-${VERSION}
+WORKDIR /curl-${VERSION}
 RUN --network=none <<-EOF
     set -eux
     ./configure \
@@ -28,12 +31,11 @@ RUN --network=none <<-EOF
         --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt \
         --with-openssl \
         --enable-static-link
-    make
+    make -j "$(nproc)"
 EOF
 
-FROM build as install
-RUN make install DESTDIR=/rootfs
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
+FROM build AS install
+RUN --network=none make install DESTDIR=/rootfs
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/cython/Containerfile

@@ -0,0 +1,42 @@
+FROM scratch AS base
+ENV VERSION=3.0.10
+ENV SRC_HASH=00f97476cef9fcd9a89f9d2a49be3b518e1a74b91f377fe08c97fcb44bc0f7d7
+ENV SRC_FILE=${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/cython/cython/archive/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/python . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/cmake . /
+COPY --from=stagex/libffi . /
+COPY --from=stagex/py-setuptools . /
+COPY --from=stagex/py-installer . /
+COPY --from=stagex/py-flit . /
+COPY --from=stagex/py-gpep517 . /
+COPY --from=stagex/py-wheel . /
+COPY --from=stagex/py-distro . /
+COPY --from=stagex/py-dateutil . /
+COPY --from=stagex/py-urllib3 . /
+COPY --from=stagex/py-cffi . /
+RUN tar -xzf ${SRC_FILE}
+WORKDIR /cython-${VERSION}
+RUN gpep517 build-wheel --wheel-dir .dist --output-fd 3 3>&1 >&2
+#
+FROM build AS install
+RUN --network=none <<-EOF
+    set -eux
+    python -m installer -d /rootfs .dist/*.whl
+    find /rootfs | grep -E "(/__pycache__$|\.pyc$|\.pyo$)" | xargs rm -rf
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/dhcpcd/Containerfile

@@ -0,0 +1,49 @@
+FROM scratch AS base
+ENV VERSION=10.0.10
+ENV SRC_FILE=dhcpcd-${VERSION}.tar.xz
+ENV SRC_SITE=https://github.com/NetworkConfiguration/dhcpcd/releases/download/v${VERSION}/${SRC_FILE}
+ENV SRC_HASH=d582012992efddd2442bb1213c518a37d90febbcf8b11f8e76448c710dacad27
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/m4 . /
+COPY --from=stagex/libmnl . /
+COPY --from=stagex/linux-headers . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /dhcpcd-${VERSION}
+RUN --network=none <<-EOF
+	set -eux
+	./configure \
+        --build=x86_64-linux-musl \
+        --host=x86_64-linux-musl \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+        --localstatedir=/var \
+        --libexecdir=/usr/lib/dhcpcd \
+        --dbdir=/var/lib/dhcpcd \
+        --rundir=/run/dhcpcd \
+        --enable-ipv6 \
+        --enable-privsep \
+        --enable-seccomp \
+        --without-dev \
+        --without-udev
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN <<-EOF
+	set -eux
+    make DESTDIR=/rootfs install
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/diffoscope/Containerfile

@@ -0,0 +1,46 @@
+FROM scratch AS base
+ENV VERSION=274
+ENV SRC_HASH=c5398be0f26cb13344f4e27cf5a53df2b7a246a7b08944d114eee140989e5bb5
+ENV SRC_FILE=${VERSION}.tar.gz
+ENV SRC_SITE=https://salsa.debian.org/reproducible-builds/diffoscope/-/archive/${VERSION}/diffoscope-${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/python . /
+COPY --from=stagex/file . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/cmake . /
+COPY --from=stagex/libffi . /
+COPY --from=stagex/py-setuptools . /
+COPY --from=stagex/py-installer . /
+COPY --from=stagex/py-flit . /
+COPY --from=stagex/py-gpep517 . /
+COPY --from=stagex/py-wheel . /
+COPY --from=stagex/py-distro . /
+COPY --from=stagex/py-dateutil . /
+COPY --from=stagex/py-urllib3 . /
+COPY --from=stagex/py-cffi . /
+COPY --from=stagex/py-magic . /
+COPY --from=stagex/py-libarchive . /
+RUN tar -xzf diffoscope-${SRC_FILE}
+WORKDIR /diffoscope-${VERSION}
+RUN gpep517 build-wheel --wheel-dir .dist --output-fd 3 3>&1 >&2
+#
+FROM build AS install
+RUN --network=none <<-EOF
+    set -eu
+    python -m installer -d /rootfs .dist/*.whl
+    find /rootfs | grep -E "(/__pycache__$|\.pyc$|\.pyo$)" | xargs rm -rf
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /
+

packages/diffutils/Containerfile

@@ -0,0 +1,35 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=3.10
+ENV SRC_HASH=90e5e93cc724e4ebe12ede80df1634063c7a855692685919bfe60b556c9bd09e
+ENV SRC_FILE=diffutils-${VERSION}.tar.xz
+ENV SRC_SITE=https://ftp.gnu.org/gnu/diffutils/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /diffutils-${VERSION}
+RUN --network=none <<-EOF
+	set -ex
+	./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+		--prefix=/usr \
+		--mandir=/usr/share/man \
+        --infodir=/usr/share/info \
+        --disable-nls
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none make DESTDIR="/rootfs" install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/docbook-xml/Containerfile

@@ -0,0 +1,285 @@
+FROM scratch AS base
+ENV VERSION=4.5
+ENV SRC_HASH_4_5=4e4e037a2b83c98c6c94818390d4bdd3f6e10f6ec62dd79188594e26190dc7b4
+ENV SRC_HASH_4_4=02f159eb88c4254d95e831c51c144b1863b216d909b5ff45743a1ce6f5273090
+ENV SRC_HASH_4_3=23068a94ea6fd484b004c5a73ec36a66aa47ea8f0d6b62cc1695931f5c143464
+ENV SRC_HASH_4_2=acc4601e4f97a196076b7e64b368d9248b07c7abf26b34a02cca40eeebe60fa2
+ENV SRC_HASH_4_1_2=30f0644064e0ea71751438251940b1431f46acada814a062870f486c772e7772
+ENV SRC_SITE=https://docbook.org/xml
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH_4_5} ${SRC_SITE}/4.5/docbook-xml-4.5.zip .
+ADD --checksum=sha256:${SRC_HASH_4_4} ${SRC_SITE}/4.4/docbook-xml-4.4.zip .
+ADD --checksum=sha256:${SRC_HASH_4_3} ${SRC_SITE}/4.3/docbook-xml-4.3.zip .
+ADD --checksum=sha256:${SRC_HASH_4_2} ${SRC_SITE}/4.2/docbook-xml-4.2.zip .
+ADD --checksum=sha256:${SRC_HASH_4_1_2} ${SRC_SITE}/4.1.2/docbkx412.zip .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/libtool . /
+COPY --from=stagex/libxml2 . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/m4 . /
+RUN --network=none <<-EOF
+    set -eux
+    mkdir -p out
+	for version in 4.1.2 4.2 4.3 4.4 4.5; do
+		case $version in
+			4.1.2) filename=docbkx412.zip;;
+			*) filename=docbook-xml-$version.zip;;
+		esac
+		mkdir -p docbook-xml-$version
+		cd docbook-xml-$version
+		unzip ../$filename
+        mkdir -p "../out/usr/share/xml/docbook/xml-dtd-$version"
+        cp -af docbook.cat *.dtd ent/ *.mod ../out/usr/share/xml/docbook/xml-dtd-$version/
+        cd ..
+	done
+    chmod 755 out/usr/share/xml/docbook/xml-dtd-*/ent
+    mkdir -p out/etc/xml
+	export XML_CATALOG_FILES=""
+	xmlcatalog --noout --create out/etc/xml/docbook-xml
+	xmlcatalog --noout --add \
+		"public" \
+		"-//OASIS//DTD DocBook XML V4.1.2//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" \
+		out/etc/xml/docbook-xml
+
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//DTD DocBook XML CALS Table Model V4.1.2//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.1.2/calstblx.dtd" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//DTD DocBook XML CALS Table Model V4.1.2//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.1.2/calstblx.dtd" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//DTD XML Exchange Table Model 19990315//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.1.2/soextblx.dtd" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ELEMENTS DocBook XML Information Pool V4.1.2//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.1.2/dbpoolx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ELEMENTS DocBook XML Document Hierarchy V4.1.2//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.1.2/dbhierx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ENTITIES DocBook XML Additional General Entities V4.1.2//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.1.2/dbgenent.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ENTITIES DocBook XML Notations V4.1.2//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.1.2/dbnotnx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ENTITIES DocBook XML Character Entities V4.1.2//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.1.2/dbcentx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "rewriteSystem" \
+		"http://www.oasis-open.org/docbook/xml/4.1.2" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.1.2" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "rewriteURI" \
+		"http://www.oasis-open.org/docbook/xml/4.1.2" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.1.2" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//DTD DocBook XML V4.2//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//DTD DocBook CALS Table Model V4.2//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.2/calstblx.dtd" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//DTD XML Exchange Table Model 19990315//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.2/soextblx.dtd" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ELEMENTS DocBook Information Pool V4.2//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.2/dbpoolx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ELEMENTS DocBook Document Hierarchy V4.2//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.2/dbhierx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ENTITIES DocBook Additional General Entities V4.2//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.2/dbgenent.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ENTITIES DocBook Notations V4.2//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.2/dbnotnx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ENTITIES DocBook Character Entities V4.2//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.2/dbcentx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "rewriteSystem" \
+		"http://www.oasis-open.org/docbook/xml/4.2" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.2" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "rewriteURI" \
+		"http://www.oasis-open.org/docbook/xml/4.2" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.2" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//DTD DocBook XML V4.3//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//DTD DocBook CALS Table Model V4.3//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.3/calstblx.dtd" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//DTD XML Exchange Table Model 19990315//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.3/soextblx.dtd" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ELEMENTS DocBook Information Pool V4.3//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.3/dbpoolx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ELEMENTS DocBook Document Hierarchy V4.3//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.3/dbhierx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ENTITIES DocBook Additional General Entities V4.3//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.3/dbgenent.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ENTITIES DocBook Notations V4.3//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.3/dbnotnx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ENTITIES DocBook Character Entities V4.3//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.3/dbcentx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "rewriteSystem" \
+		"http://www.oasis-open.org/docbook/xml/4.3" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.3" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "rewriteURI" \
+		"http://www.oasis-open.org/docbook/xml/4.3" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.3" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//DTD DocBook XML V4.4//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//DTD DocBook CALS Table Model V4.4//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.4/calstblx.dtd" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ELEMENTS DocBook XML HTML Tables V4.4//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.4/htmltblx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//DTD XML Exchange Table Model 19990315//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.4/soextblx.dtd" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ELEMENTS DocBook Information Pool V4.4//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.4/dbpoolx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ELEMENTS DocBook Document Hierarchy V4.4//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.4/dbhierx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ENTITIES DocBook Additional General Entities V4.4//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.4/dbgenent.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ENTITIES DocBook Notations V4.4//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.4/dbnotnx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ENTITIES DocBook Character Entities V4.4//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.4/dbcentx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "rewriteSystem" \
+		"http://www.oasis-open.org/docbook/xml/4.4" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.4" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "rewriteURI" \
+		"http://www.oasis-open.org/docbook/xml/4.4" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.4" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//DTD DocBook XML V4.5//EN" \
+		"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//DTD DocBook XML CALS Table Model V4.5//EN" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.5/calstblx.dtd" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//DTD XML Exchange Table Model 19990315//EN" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.5/soextblx.dtd" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ELEMENTS DocBook XML Information Pool V4.5//EN" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.5/dbpoolx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ELEMENTS DocBook XML Document Hierarchy V4.5//EN" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.5/dbhierx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ELEMENTS DocBook XML HTML Tables V4.5//EN" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.5/htmltblx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ENTITIES DocBook XML Notations V4.5//EN" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.5/dbnotnx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ENTITIES DocBook XML Character Entities V4.5//EN" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.5/dbcentx.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "public" \
+		"-//OASIS//ENTITIES DocBook XML Additional General Entities V4.5//EN" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.5/dbgenent.mod" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "rewriteSystem" \
+		"http://www.oasis-open.org/docbook/xml/4.5" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.5" \
+		out/etc/xml/docbook-xml
+	xmlcatalog --noout --add "rewriteURI" \
+		"http://www.oasis-open.org/docbook/xml/4.5" \
+		"file:///usr/share/xml/docbook/xml-dtd-4.5" \
+		out/etc/xml/docbook-xml
+    xmlcatalog --noout --create out/etc/xml/catalog
+    xmlcatalog --noout --add "delegatePublic" \
+        "-//OASIS//ENTITIES DocBook XML" \
+        "file:///etc/xml/docbook-xml" \
+        out/etc/xml/catalog
+    xmlcatalog --noout --add "delegatePublic" \
+        "-//OASIS//DTD DocBook XML" \
+        "file:///etc/xml/docbook-xml" \
+        out/etc/xml/catalog
+    xmlcatalog --noout --add "delegateSystem" \
+        "http://www.oasis-open.org/docbook/" \
+        "file:///etc/xml/docbook-xml" \
+        out/etc/xml/catalog
+    xmlcatalog --noout --add "delegateURI" \
+        "http://www.oasis-open.org/docbook/" \
+        "file:///etc/xml/docbook-xml" \
+        out/etc/xml/catalog
+EOF
+
+FROM build AS install
+RUN --network=none mv out/ /rootfs
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/docbook-xsl/Containerfile

@@ -0,0 +1,58 @@
+FROM scratch AS base
+ENV VERSION=1.79.2
+ENV SRC_HASH=966188d7c05fc76eaca115a55893e643dd01a3486f6368733c9ad974fcee7a26
+ENV SRC_FILE=docbook-xsl-${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/docbook/xslt10-stylesheets/releases/download/release%2F${VERSION}/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/docbook-xml . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/libxml2 . /
+COPY --from=stagex/musl . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /docbook-xsl-${VERSION}
+RUN --network=none <<-EOF
+    set -eux
+    dest=out/usr/share/xml/docbook/xsl-stylesheets-${VERSION}
+    mkdir -p $dest
+    install -dm755 out
+    install -m644 VERSION VERSION.xsl "$dest"/
+    ln -s xsl-stylesheets-${VERSION} out/usr/share/xml/docbook/xsl-stylesheets-current
+	for dir in assembly common eclipse epub epub3 fo highlighting html \
+		htmlhelp javahelp lib manpages params profiling roundtrip template \
+        website xhtml xhtml-1_1 xhtml5; do
+		install -dm755 $dest/$dir
+		for f in $dir/*.xml $dir/*.xsl $dir/*.dtd $dir/*.ent; do
+			[ -e "$f" ] || continue
+			install -m644 $f $dest/$dir
+		done
+	done
+	install -dm755 out/etc/xml
+	install -m644 -D COPYING out/usr/share/licenses/docbook-xsl/COPYING
+    docbookdir=/usr/share/xml/docbook
+    urls="
+    	http://cdn.docbook.org/release/xsl-nons
+    	http://docbook.sourceforge.net/release/xsl
+    "
+    cp /etc/xml/catalog out/etc/xml/catalog
+    for url in $urls; do
+    	for rewrite in rewriteSystem rewriteURI; do
+    		for version in ${VERSION} current; do
+    			xmlcatalog --noout --add "$rewrite" \
+    				"$url/$version" \
+    				"file://$docbookdir/xsl-stylesheets-$version" \
+    				out/etc/xml/catalog
+    		done
+    	done
+    done
+EOF
+
+FROM build AS install
+RUN --network=none mv out /rootfs && ls -Rlah /rootfs
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/docker-cli-buildx/Containerfile

@@ -0,0 +1,46 @@
+FROM scratch AS base
+ENV VERSION=0.16.2
+ENV SRC_FILE=v${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/docker/buildx/archive/${SRC_FILE}
+ENV SRC_HASH=f314635765f3dc5efe089244280cd24a577e83d339fec1970fed16977bf28382
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/musl . /
+COPY --from=stagex/bash . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/go . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/pkgconf . /
+RUN tar -xf ${SRC_FILE}
+ENV GOPROXY=https://proxy.golang.org,direct
+ENV GOSUMDB=sum.golang.org
+ENV GOPATH=/cache/go
+ENV GOBIN=${GOPATH}/bin
+ENV PATH=${GOBIN}:${PATH}
+WORKDIR /buildx-${VERSION}
+RUN <<-EOF
+    set -eux
+    mkdir -p out
+    go build \
+        -v \
+        -modcacherw \
+        --ldflags=" \
+            -w -s -buildid= \
+		    -X github.com/moby/buildkit/version.Version=${VERSION} \
+		    -X github.com/moby/buildkit/version.Revision=stagex \
+		    -X github.com/moby/buildkit/version.PKG=github.com/docker/buildx \
+        " \
+        -o docker-buildx \
+        ./cmd/buildx
+EOF
+
+FROM build AS install
+RUN install -Dm755 docker-buildx -t /rootfs/usr/libexec/docker/cli-plugins/
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/docker/Containerfile

@@ -0,0 +1,88 @@
+FROM scratch AS base
+ENV VERSION=27.1.2
+ENV MOBY_COMMIT=f9522e5e96c3ab5a6b8a643d15a92700ca864da6
+ENV CLI_COMMIT=d01f264bccd8bed2e3c038054a04b99533478ab8
+ENV SRC_FILE=v${VERSION}.tar.gz
+ENV SRC_SITE_CLI=https://github.com/docker/cli/archive/${SRC_FILE}
+ENV SRC_HASH_CLI=e60fddb2bd2b4e19790d26b786c930e70fa935168373ef08055f74bbc450bce8
+ENV SRC_SITE_MOBY=https://github.com/moby/moby/archive/${SRC_FILE}
+ENV SRC_HASH_MOBY=8c9b5fa44f0272726484c925d4d05f0aa189053ed8be9b27447bc116df1e99c9
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH_MOBY} ${SRC_SITE_MOBY} moby-${SRC_FILE}
+ADD --checksum=sha256:${SRC_HASH_CLI} ${SRC_SITE_CLI} cli-${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/musl . /
+COPY --from=stagex/bash . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/go . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/linux-headers . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/libseccomp . /
+COPY --from=stagex/ca-certificates . /
+RUN tar -xf moby-${SRC_FILE}
+RUN tar -xf cli-${SRC_FILE}
+ENV GO11MODULE=off
+ENV CGO_ENABLED=1
+ENV AUTO_GOPATH=1
+ENV GITCOMMIT=${CLI_COMMIT}
+ENV DOCKER_GITCOMMIT=${MOBY_COMMIT}
+ENV DOCKER_BUILDTAGS=seccomp
+ENV DISABLE_WARN_OUTSIDE_CONTAINER=1
+ENV GOPROXY=https://proxy.golang.org,direct
+ENV GOSUMDB=sum.golang.org
+ENV GOPATH=/cache/go
+ENV GOBIN=${GOPATH}/bin
+ENV PATH=${GOBIN}:${PATH}
+ENV SOURCE_DATE_EPOCH=1
+ENV LDFLAGS="-w -s -buildid="
+ENV GO_LDFLAGS=${LDFLAGS}
+WORKDIR /moby-${VERSION}
+RUN <<-EOF
+    set -eux
+    sed -i '98iLDFLAGS=${GO_LDFLAGS}' hack/make.sh
+    hack/make.sh dynbinary
+EOF
+WORKDIR /cli-${VERSION}
+RUN <<-EOF
+    set -eux
+    mkdir -p "$GOPATH"/src/github.com/docker/
+    ln -sf /cli-${VERSION} "$GOPATH"/src/github.com/docker/cli
+    make -j "$(nproc)" VERSION=${VERSION} dynbinary
+    make manpages
+EOF
+
+FROM build AS install
+WORKDIR /
+RUN <<-EOF
+    set -eux
+	install -Dm644 cli-${VERSION}/contrib/completion/fish/docker.fish \
+		/rootfs/usr/share/fish/vendor_completions.d/docker.fish
+
+	install -Dm644 cli-${VERSION}/contrib/completion/zsh/_docker \
+		/rootfs/usr/share/zsh/site-functions/_docker
+
+	install -Dm644 cli-${VERSION}/contrib/completion/bash/docker \
+		/rootfs/usr/share/bash-completion/completions/docker
+
+	install -Dm644 cli-${VERSION}/man/man1/* \
+		-t /rootfs/usr/share/man/man1/
+
+	# 'build/docker' is a symlink to 'docker-linux-$arch' e.g. 'docker-linux-amd64'
+	install -Dm755 cli-${VERSION}/build/docker \
+		/rootfs/usr/bin/docker
+
+	install -Dm755 -t /rootfs/usr/bin \
+		moby-${VERSION}/bundles/dynbinary-daemon/dockerd \
+		moby-${VERSION}/bundles/dynbinary-daemon/docker-proxy
+
+	# symlink externally provided tini-static binary
+	ln -sf /sbin/tini-static /rootfs/usr/bin/docker-init
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/dosfstools/Containerfile

@@ -0,0 +1,41 @@
+FROM scratch AS base
+ENV VERSION=4.2
+ENV SRC_HASH=64926eebf90092dca21b14259a5301b7b98e7b1943e8a201c7d726084809b527
+ENV SRC_FILE=dosfstools-${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/dosfstools/dosfstools/releases/download/v${VERSION}/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/m4 . /
+COPY --from=stagex/libtool . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/autoconf . /
+COPY --from=stagex/automake . /
+COPY --from=stagex/musl . /
+RUN tar -xzf ${SRC_FILE}
+WORKDIR /dosfstools-${VERSION}
+RUN --network=none <<-EOF
+	set -eux
+	./autogen.sh
+	./configure \
+		--build=x86_64-unknown-linux-musl \
+		--host=x86_64-unknown-linux-musl \
+		--prefix=/usr \
+		--sbindir=/usr/sbin \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--localstatedir=/var \
+        --enable-compat-symlinks
+EOF
+
+FROM build AS install
+RUN --network=none make DESTDIR=/rootfs install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/doxygen/Containerfile

@@ -0,0 +1,48 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=1.10.0
+ENV SRC_HASH=dd7c556b4d96ca5e682534bc1f1a78a5cfabce0c425b14c1b8549802686a4442
+ENV SRC_FILE=doxygen-${VERSION}.src.tar.gz
+ENV SRC_SITE=https://doxygen.nl/files/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/flex . /
+COPY --from=stagex/bison . /
+COPY --from=stagex/coreutils . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/python . /
+COPY --from=stagex/cmake . /
+COPY --from=stagex/samurai . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/libxml2 . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/m4 . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /doxygen-${VERSION}
+COPY *.patch .
+RUN --network=none <<-EOF
+	set -eux \
+	patch -p1 remove-usage-of-fstat64.patch
+	cmake -B build -G Ninja \
+		-DGIT_EXECUTABLE=/bin/false \
+		-DCMAKE_INSTALL_PREFIX=/usr \
+		-DCMAKE_BUILD_TYPE=MinSizeRel \
+		-Dbuild_xmlparser=ON
+	cmake --build build
+EOF
+
+FROM build AS install
+RUN DESTDIR=/rootfs cmake --install build
+RUN find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/doxygen/remove-usage-of-fstat64.patch

@@ -0,0 +1,23 @@
+--- a/deps/spdlog/include/spdlog/details/os-inl.h
++++ b/deps/spdlog/include/spdlog/details/os-inl.h
+@@ -236,20 +236,11 @@
+ #    else
+     int fd = ::fileno(f);
+ #    endif
+-// 64 bits(but not in osx or cygwin, where fstat64 is deprecated)
+-#    if (defined(__linux__) || defined(__sun) || defined(_AIX)) && (defined(__LP64__) || defined(_LP64))
+-    struct stat64 st;
+-    if (::fstat64(fd, &st) == 0)
+-    {
+-        return static_cast<size_t>(st.st_size);
+-    }
+-#    else // other unix or linux 32 bits or cygwin
+     struct stat st;
+     if (::fstat(fd, &st) == 0)
+     {
+         return static_cast<size_t>(st.st_size);
+     }
+-#    endif
+ #endif
+     throw_spdlog_ex("Failed getting file size from fd", errno);
+     return 0; // will not be reached.

packages/dtc/Containerfile

@@ -0,0 +1,44 @@
+FROM scratch AS base
+ENV VERSION=1.7.0
+ENV SRC_HASH=29edce3d302a15563d8663198bbc398c5a0554765c83830d0d4c0409d21a16c4
+ENV SRC_FILE=dtc-${VERSION}.tar.xz
+ENV SRC_SITE=https://kernel.org/pub/software/utils/dtc/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/linux-headers . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/m4 . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/bison . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/libzstd . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/flex . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/coreutils . /
+COPY --from=stagex/python . /
+COPY --from=stagex/py-setuptools . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /dtc-${VERSION}
+RUN --network=none <<-EOF
+	set -eux
+    sed -i s:-Werror::g Makefile
+	sed -i "s|@VERSION@|${VERSION}|" setup.py
+    make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN <<-EOF
+	set -eux
+    make DESTDIR=/rootfs PREFIX=/usr install
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/e2fsprogs/Containerfile

@@ -0,0 +1,43 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=1.47.0
+ENV SRC_HASH=74c8ea97c73294edc6c11dc5e7fbb4324f86c28efd66ad0ba50be4eec8a48be2
+ENV SRC_FILE=v${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/tytso/e2fsprogs/archive/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/bash . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/make . /
+COPY --from=stagex/linux-headers . /
+COPY --from=stagex/util-linux . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+RUN tar -xzf ${SRC_FILE}
+WORKDIR /e2fsprogs-${VERSION}
+RUN --network=none <<-EOF
+    ./configure \
+        --build=${ARCH}-linux-musl \
+        --host=${ARCH}-linux-musl \
+        --prefix=/usr \
+        --mandir=/usr/share/man \
+        --enable-elf-shlibs \
+        --enable-symlink-install \
+        --disable-fsck \
+        --disable-uuidd \
+        --disable-libuuid \
+        --disable-libblkid \
+        --disable-nls
+    make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN make DESTDIR=/rootfs install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/ed/Containerfile

@@ -0,0 +1,37 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=1.20
+ENV SRC_HASH=c6030defe6ae172f1687906d7354054c75a6a9130af319d4e73c50a91959c5a6
+ENV SRC_FILE=ed-${VERSION}.tar.lz
+ENV SRC_SITE=https://ftp.gnu.org/gnu/ed/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/tar . /
+COPY --from=stagex/lzip . /
+COPY --from=stagex/gcc . /
+RUN tar --lzip -xf ${SRC_FILE}
+WORKDIR /ed-${VERSION}
+RUN --network=none <<-EOF
+	set -ex
+	./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+		--target=${ARCH}-linux-musl \
+		--prefix=/usr \
+		--bindir=/usr/bin \
+		--mandir=/usr/share/man
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN make DESTDIR="/rootfs" install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/edk2/Containerfile

@@ -0,0 +1,112 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=202408
+ENV VERSION_OPENSSL=3.0.9
+ENV VERSION_SOFTFLOAT=3e
+ENV VERSION_MIPISYST=370b5944c046bab043dd8b133727b2135af7747a
+ENV VERSION_MBEDTLS=8c89224991adff88d53cd380f42a2baa36f91454
+ENV VERSION_LIBSPDM=50924a4c8145fc721e17208f55814d2b38766fe6
+ENV SRC_HASH=63c99b6f9f7aa94e8d76c432bea05d0d4dd6600af78d6fd59a1aec5ce9cea8ce
+ENV SRC_HASH_MIPISYST=9fda3b9a78343ab2be6f06ce6396536e7e065abac29b47c8eb2e42cbb4c4f00b
+ENV SRC_HASH_SOFTFLOAT=21130ce885d35c1fe73fc1e1bf2244178167e05c6747cad5f450cc991714c746
+ENV SRC_HASH_OPENSSL=eb1ab04781474360f77c318ab89d8c5a03abc38e63d65a603cabbf1b00a1dc90
+ENV SRC_HASH_MBEDTLS=b5c7e7c54e013c168f4aae036e59912785f11b4aeebd57f6165a14e879b9a82c
+ENV SRC_HASH_LIBSPDM=962aefeeddb130deeb68c6c60c4848ddedd09d7715ed1ba8a8dadabd032d6232
+ENV SRC_FILE=edk2-stable${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/tianocore/edk2/archive/refs/tags/${SRC_FILE}
+ENV SRC_FILE_MIPISYST=${VERSION_MIPISYST}.tar.gz
+ENV SRC_SITE_MIPISYST=https://github.com/MIPI-Alliance/public-mipi-sys-t/archive/${SRC_FILE_MIPISYST}
+ENV SRC_FILE_SOFTFLOAT=SoftFloat-${VERSION_SOFTFLOAT}.zip
+ENV SRC_SITE_SOFTFLOAT=https://www.jhauser.us/arithmetic/${SRC_FILE_SOFTFLOAT}
+ENV SRC_FILE_OPENSSL=openssl-${VERSION_OPENSSL}.tar.gz
+ENV SRC_SITE_OPENSSL=https://www.openssl.org/source/${SRC_FILE_OPENSSL}
+ENV SRC_FILE_MBEDTLS=${VERSION_MBEDTLS}.tar.gz
+ENV SRC_SITE_MBEDTLS=https://github.com/Mbed-TLS/mbedtls/archive/${SRC_FILE_MBEDTLS}
+ENV SRC_FILE_LIBSPDM=${VERSION_LIBSPDM}.tar.gz
+ENV SRC_SITE_LIBSPDM=https://github.com/DMTF/libspdm/archive/${SRC_FILE_LIBSPDM}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+ADD --checksum=sha256:${SRC_HASH_OPENSSL} ${SRC_SITE_OPENSSL} .
+ADD --checksum=sha256:${SRC_HASH_SOFTFLOAT} ${SRC_SITE_SOFTFLOAT} .
+ADD --checksum=sha256:${SRC_HASH_MIPISYST} ${SRC_SITE_MIPISYST} .
+ADD --checksum=sha256:${SRC_HASH_MBEDTLS} ${SRC_SITE_MBEDTLS} .
+ADD --checksum=sha256:${SRC_HASH_LIBSPDM} ${SRC_SITE_LIBSPDM} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/git . /
+COPY --from=stagex/python . /
+COPY --from=stagex/nasm . /
+COPY --from=stagex/acpica . /
+COPY --from=stagex/bash . /
+COPY --from=stagex/util-linux . /
+COPY --from=stagex/zlib . /
+RUN tar -xf ${SRC_FILE}
+RUN tar -xf ${SRC_FILE_OPENSSL}
+RUN tar -xf ${SRC_FILE_MIPISYST}
+RUN tar -xf ${SRC_FILE_MBEDTLS}
+RUN tar -xf ${SRC_FILE_LIBSPDM}
+RUN unzip ${SRC_FILE_SOFTFLOAT}
+WORKDIR /edk2-edk2-stable${VERSION}
+ENV WORKDIR=/edk2-edk2-stable${VERSION}
+ENV PACKAGES_PATH=$WORKDIR
+ENV WORKSPACE=$WORKDIR
+ENV EDK_TOOLS_PATH=${WORKDIR}/BaseTools
+ENV PATH=${EDK_TOOLS_PATH}/BinWrappers/PosixLike/:$PATH
+ENV PYTHON_COMMAND=python3
+ENV PLATFORMS="ShellPkg/ShellPkg.dsc OvmfPkg/OvmfPkgX64.dsc OvmfPkg/OvmfXen.dsc"
+ENV TOOLCHAIN="GCC5"
+ENV RELEASE="RELEASE"
+ENV TARGET_ARCH=X64
+RUN --network=none <<-EOF
+    set -ex
+    rm -rf CryptoPkg/Library/OpensslLib/openssl
+    ln -s /openssl-${VERSION_OPENSSL} CryptoPkg/Library/OpensslLib/openssl
+    rm -rf CryptoPkg/Library/MbedTlsLib/mbedtls
+    ln -s /mbedtls-${VERSION_MBEDTLS} CryptoPkg/Library/MbedTlsLib/mbedtls
+    rm -rf SecurityPkg/DeviceSecurity/SpdmLib/libspdm
+    ln -s /libspdm-${VERSION_LIBSPDM} SecurityPkg/DeviceSecurity/SpdmLib/libspdm
+    rm -rf ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3
+    ln -s /SoftFloat-${VERSION_SOFTFLOAT} \
+        ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3
+    rm -rf MdePkg/Library/MipiSysTLib/mipisyst
+    ln -s /public-mipi-sys-t-${VERSION_MIPISYST} \
+        MdePkg/Library/MipiSysTLib/mipisyst
+    sed -e '/BrotliCompress/d' -i BaseTools/Source/C/GNUmakefile
+    sed -e '/BrotliCustomDecompressLib/d' -i MdeModulePkg/MdeModulePkg.dec
+    sed -e 's/\r$//' -i BaseTools/Source/C/VfrCompile/VfrUtilityLib.cpp \
+        BaseTools/Source/C/VolInfo/VolInfo.c
+    bash -c ". edksetup.sh"
+    make -C BaseTools
+    for platform in $PLATFORMS; do
+        echo "Building Plaform Files: $platform"
+        command build -b $RELEASE \
+            -a $TARGET_ARCH  \
+            -t $TOOLCHAIN \
+            -p $platform \
+            -n "$(nproc)" \
+            -DSECURE_BOOT_ENABLE=TRUE \
+            -DTPM2_ENABLE=TRUE
+    done
+EOF
+
+FROM build AS install
+RUN <<-EOF
+    mkdir -p /rootfs/usr/bin \
+    /rootfs/usr/share/edk2/Conf \
+    /rootfs/usr/share/edk2/Scripts
+    install BaseTools/Source/C/bin/* BaseTools/BinWrappers/PosixLike/LzmaF86Compress \
+        /rootfs/usr/bin
+    install BaseTools/BuildEnv /rootfs/usr/share/edk2/
+    install BaseTools/Conf/*.template /rootfs/usr/share/edk2/Conf
+    install BaseTools/Scripts/GccBase.lds /rootfs/usr/share/edk2/Scripts
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/eif_build/Cargo.lock

@@ -1,721 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "android_system_properties"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi",
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
-
-[[package]]
-name = "aws-nitro-enclaves-cose"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0705f682b7df79a5841e815364181f35efe0ef953a1363cf8e773d5bd23846a5"
-dependencies = [
- "openssl",
- "serde",
- "serde_bytes",
- "serde_cbor",
- "serde_repr",
- "serde_with",
-]
-
-[[package]]
-name = "aws-nitro-enclaves-image-format"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c24e2101441ce8f8dd0799ce7e36c68571ecf5e3731190b277c63765aaed8c1c"
-dependencies = [
- "aws-nitro-enclaves-cose",
- "byteorder",
- "chrono",
- "clap",
- "crc",
- "hex",
- "num-derive",
- "num-traits",
- "openssl",
- "serde",
- "serde_cbor",
- "serde_json",
- "sha2",
-]
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "block-buffer"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "build_const"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ae4235e6dac0694637c763029ecea1a2ec9e4e06ec2729bd21ba4d9c863eb7"
-
-[[package]]
-name = "bumpalo"
-version = "3.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "572f695136211188308f16ad2ca5c851a712c464060ae6974944458eb83880ba"
-
-[[package]]
-name = "byteorder"
-version = "1.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
-
-[[package]]
-name = "cc"
-version = "1.0.74"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "581f5dba903aac52ea3feb5ec4810848460ee833876f1f9b0fdeab1f19091574"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "chrono"
-version = "0.4.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfd4d1b31faaa3a89d7934dbded3111da0d2ef28e3ebccdb4f0179f5929d1ef1"
-dependencies = [
- "iana-time-zone",
- "num-integer",
- "num-traits",
- "winapi",
-]
-
-[[package]]
-name = "clap"
-version = "3.2.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71655c45cb9845d3270c9d6df84ebe72b4dad3c2ba3f7023ad47c144e4e473a5"
-dependencies = [
- "atty",
- "bitflags",
- "clap_lex",
- "indexmap",
- "strsim",
- "termcolor",
- "textwrap",
-]
-
-[[package]]
-name = "clap_lex"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
-dependencies = [
- "os_str_bytes",
-]
-
-[[package]]
-name = "codespan-reporting"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3538270d33cc669650c4b093848450d380def10c331d38c768e34cac80576e6e"
-dependencies = [
- "termcolor",
- "unicode-width",
-]
-
-[[package]]
-name = "core-foundation-sys"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5827cebf4670468b8772dd191856768aedcb1b0278a04f989f7766351917b9dc"
-
-[[package]]
-name = "cpufeatures"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d997bd5e24a5928dd43e46dc529867e207907fe0b239c3477d924f7f2ca320"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crc"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d663548de7f5cca343f1e0a48d14dcfb0e9eb4e079ec58883b7251539fa10aeb"
-dependencies = [
- "build_const",
-]
-
-[[package]]
-name = "cxx"
-version = "1.0.80"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b7d4e43b25d3c994662706a1d4fcfc32aaa6afd287502c111b237093bb23f3a"
-dependencies = [
- "cc",
- "cxxbridge-flags",
- "cxxbridge-macro",
- "link-cplusplus",
-]
-
-[[package]]
-name = "cxx-build"
-version = "1.0.80"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84f8829ddc213e2c1368e51a2564c552b65a8cb6a28f31e576270ac81d5e5827"
-dependencies = [
- "cc",
- "codespan-reporting",
- "once_cell",
- "proc-macro2",
- "quote",
- "scratch",
- "syn",
-]
-
-[[package]]
-name = "cxxbridge-flags"
-version = "1.0.80"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e72537424b474af1460806647c41d4b6d35d09ef7fe031c5c2fa5766047cc56a"
-
-[[package]]
-name = "cxxbridge-macro"
-version = "1.0.80"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "309e4fb93eed90e1e14bea0da16b209f81813ba9fc7830c20ed151dd7bc0a4d7"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "digest"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "eif_build"
-version = "0.1.0"
-dependencies = [
- "aws-nitro-enclaves-cose",
- "aws-nitro-enclaves-image-format",
- "clap",
- "serde_json",
- "sha2",
-]
-
-[[package]]
-name = "foreign-types"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
-dependencies = [
- "foreign-types-shared",
-]
-
-[[package]]
-name = "foreign-types-shared"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
-
-[[package]]
-name = "generic-array"
-version = "0.14.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bff49e947297f3312447abdca79f45f4738097cc82b06e72054d2223f601f1b9"
-dependencies = [
- "typenum",
- "version_check",
-]
-
-[[package]]
-name = "half"
-version = "1.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eabb4a44450da02c90444cf74558da904edde8fb4e9035a9a6a4e15445af0bd7"
-
-[[package]]
-name = "hashbrown"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-
-[[package]]
-name = "hermit-abi"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "hex"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
-
-[[package]]
-name = "iana-time-zone"
-version = "0.1.53"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64c122667b287044802d6ce17ee2ddf13207ed924c712de9a66a5814d5b64765"
-dependencies = [
- "android_system_properties",
- "core-foundation-sys",
- "iana-time-zone-haiku",
- "js-sys",
- "wasm-bindgen",
- "winapi",
-]
-
-[[package]]
-name = "iana-time-zone-haiku"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0703ae284fc167426161c2e3f1da3ea71d94b21bedbcc9494e92b28e334e3dca"
-dependencies = [
- "cxx",
- "cxx-build",
-]
-
-[[package]]
-name = "indexmap"
-version = "1.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10a35a97730320ffe8e2d410b5d3b69279b98d2c14bdb8b70ea89ecf7888d41e"
-dependencies = [
- "autocfg",
- "hashbrown",
-]
-
-[[package]]
-name = "itoa"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4217ad341ebadf8d8e724e264f13e593e0648f5b3e94b3896a5df283be015ecc"
-
-[[package]]
-name = "js-sys"
-version = "0.3.60"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49409df3e3bf0856b916e2ceaca09ee28e6871cf7d9ce97a692cacfdb2a25a47"
-dependencies = [
- "wasm-bindgen",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.137"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc7fcc620a3bff7cdd7a365be3376c97191aeaccc2a603e600951e452615bf89"
-
-[[package]]
-name = "link-cplusplus"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9272ab7b96c9046fbc5bc56c06c117cb639fe2d509df0c421cad82d2915cf369"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "log"
-version = "0.4.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "num-derive"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "876a53fff98e03a936a674b29568b0e605f06b29372c2489ff4de23f1949743d"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "num-integer"
-version = "0.1.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
-dependencies = [
- "autocfg",
- "num-traits",
-]
-
-[[package]]
-name = "num-traits"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86f0b0d4bf799edbc74508c1e8bf170ff5f41238e5f8225603ca7caaae2b7860"
-
-[[package]]
-name = "opaque-debug"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
-
-[[package]]
-name = "openssl"
-version = "0.10.42"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12fc0523e3bd51a692c8850d075d74dc062ccf251c0110668cbd921917118a13"
-dependencies = [
- "bitflags",
- "cfg-if",
- "foreign-types",
- "libc",
- "once_cell",
- "openssl-macros",
- "openssl-sys",
-]
-
-[[package]]
-name = "openssl-macros"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b501e44f11665960c7e7fcf062c7d96a14ade4aa98116c004b2e37b5be7d736c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "openssl-sys"
-version = "0.9.77"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b03b84c3b2d099b81f0953422b4d4ad58761589d0229b5506356afca05a3670a"
-dependencies = [
- "autocfg",
- "cc",
- "libc",
- "pkg-config",
- "vcpkg",
-]
-
-[[package]]
-name = "os_str_bytes"
-version = "6.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3baf96e39c5359d2eb0dd6ccb42c62b91d9678aa68160d261b9e0ccbf9e9dea9"
-
-[[package]]
-name = "pkg-config"
-version = "0.3.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ac9a59f73473f1b8d852421e59e64809f025994837ef743615c6d0c5b305160"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.47"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ea3d908b0e36316caf9e9e2c4625cdde190a7e6f440d794667ed17a1855e725"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "ryu"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4501abdff3ae82a1c1b477a17252eb69cee9e66eb915c1abaa4f44d873df9f09"
-
-[[package]]
-name = "scratch"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8132065adcfd6e02db789d9285a0deb2f3fcb04002865ab67d5fb103533898"
-
-[[package]]
-name = "serde"
-version = "1.0.147"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d193d69bae983fc11a79df82342761dfbf28a99fc8d203dca4c3c1b590948965"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_bytes"
-version = "0.11.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfc50e8183eeeb6178dcb167ae34a8051d63535023ae38b5d8d12beae193d37b"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "serde_cbor"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bef2ebfde456fb76bbcf9f59315333decc4fda0b2b44b420243c11e0f5ec1f5"
-dependencies = [
- "half",
- "serde",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.147"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f1d362ca8fc9c3e3a7484440752472d68a6caa98f1ab81d99b5dfe517cec852"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "serde_json"
-version = "1.0.87"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce777b7b150d76b9cf60d28b55f5847135a003f7d7350c6be7a773508ce7d45"
-dependencies = [
- "itoa",
- "ryu",
- "serde",
-]
-
-[[package]]
-name = "serde_repr"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fe39d9fbb0ebf5eb2c7cb7e2a47e4f462fad1379f1166b8ae49ad9eae89a7ca"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "serde_with"
-version = "1.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "678b5a069e50bf00ecd22d0cd8ddf7c236f68581b03db652061ed5eb13a312ff"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "sha2"
-version = "0.9.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800"
-dependencies = [
- "block-buffer",
- "cfg-if",
- "cpufeatures",
- "digest",
- "opaque-debug",
-]
-
-[[package]]
-name = "strsim"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
-
-[[package]]
-name = "syn"
-version = "1.0.103"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a864042229133ada95abf3b54fdc62ef5ccabe9515b64717bcb9a1919e59445d"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "termcolor"
-version = "1.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "textwrap"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
-
-[[package]]
-name = "typenum"
-version = "1.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcf81ac59edc17cc8697ff311e8f5ef2d99fcbd9817b34cec66f90b6c3dfd987"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ceab39d59e4c9499d4e5a8ee0e2735b891bb7308ac83dfb4e80cad195c9f6f3"
-
-[[package]]
-name = "unicode-width"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0edd1e5b14653f783770bce4a4dabb4a5108a5370a5f5d8cfe8710c361f6c8b"
-
-[[package]]
-name = "vcpkg"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
-
-[[package]]
-name = "version_check"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
-
-[[package]]
-name = "wasm-bindgen"
-version = "0.2.83"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eaf9f5aceeec8be17c128b2e93e031fb8a4d469bb9c4ae2d7dc1888b26887268"
-dependencies = [
- "cfg-if",
- "wasm-bindgen-macro",
-]
-
-[[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.83"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c8ffb332579b0557b52d268b91feab8df3615f265d5270fec2a8c95b17c1142"
-dependencies = [
- "bumpalo",
- "log",
- "once_cell",
- "proc-macro2",
- "quote",
- "syn",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-macro"
-version = "0.2.83"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "052be0f94026e6cbc75cdefc9bae13fd6052cdcaf532fa6c45e7ae33a1e6c810"
-dependencies = [
- "quote",
- "wasm-bindgen-macro-support",
-]
-
-[[package]]
-name = "wasm-bindgen-macro-support"
-version = "0.2.83"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07bc0c051dc5f23e307b13285f9d75df86bfdf816c5721e573dec1f9b8aa193c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "wasm-bindgen-backend",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-shared"
-version = "0.2.83"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c38c045535d93ec4f0b4defec448e4291638ee608530863b1e2ba115d4fff7f"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

packages/eif_build/Cargo.toml

@@ -1,15 +0,0 @@
-[package]
-name = "eif_build"
-version = "0.1.0"
-publish = false
-
-[dependencies]
-sha2 = "0.9.5"
-serde_json = "1.0"
-clap = "3"
-aws-nitro-enclaves-cose = "0.5"
-aws-nitro-enclaves-image-format = "0.2.0"
-
-[[bin]]
-name = "eif_build"
-path = "eif_build.rs"

packages/eif_build/Containerfile

@@ -1,35 +1,39 @@
-FROM scratch as base
-ENV VERSION=2.15
-ENV SRC_HASH=d0d224b8b626db5fcc2d7b685bdd229991bbf0a7
-ENV SRC_FILE=aws-nitro-eif.tar.gz
-ENV SRC_SITE=https://codeload.github.com/aws/aws-nitro-enclaves-image-format/legacy.tar.gz/${VERSION}
+FROM scratch AS base
+ENV VERSION=0.2.2
+ENV SRC_HASH=525514cd5b28a315564e2c4b4425189b567b71bf13584804cf266ba6dee71a0e
+ENV SRC_FILE=eif_build.tgz
+ENV SRC_SITE=https://codeload.github.com/tkhq/eif_build/legacy.tar.gz/${VERSION}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
-
-FROM fetch as build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/libunwind . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/ca-certificates . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/llvm . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/git . /
+COPY --from=stagex/rust . /
 RUN tar -xzf ${SRC_FILE}
-RUN mv aws-aws-nitro-enclave-image-format-* aws-nitro-eif
-WORKDIR build
-COPY --from=busybox . /
-COPY --from=rust . /
-COPY --from=musl . /
-COPY --from=libunwind . /
-ADD Cargo.* .
-RUN --network=none <<-EOF
-    set -eux
-    cp ../aws-nitro-eif/examples/eif_build.rs .
-    cargo build \
-        --no-default-features \
-        --locked \
-        --release \
-        --target x86_64-unknown-linux-musl
-EOF
+RUN mv tkhq-eif_build-* eif_build
+WORKDIR /eif_build
+RUN cargo fetch --locked
 
-FROM build as install
-WORKDIR /rootfs
-RUN cp /build/target/x86_64-unknown-lniux-musl/release/eif_build .
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
+FROM fetch AS build
+RUN --network=none \
+	cargo build \
+		--no-default-features \
+		--locked \
+		--release \
+		--target x86_64-unknown-linux-musl
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM build AS install
+WORKDIR //rootfs/usr/bin
+RUN cp /eif_build/target/x86_64-unknown-linux-musl/release/eif_build .
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/elfutils/Containerfile

@@ -1,35 +1,35 @@
-FROM scratch as base
+FROM scratch AS base
 ENV VERSION=0.190
 ENV SRC_HASH=8e00a3a9b5f04bc1dc273ae86281d2d26ed412020b391ffcc23198f10231d692
 ENV SRC_FILE=elfutils-${VERSION}.tar.bz2
 ENV SRC_SITE=https://sourceware.org/elfutils/ftp/${VERSION}/${SRC_FILE}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=busybox . /
-COPY --from=gcc . /
-COPY --from=binutils . /
-COPY --from=make . /
-COPY --from=bison . /
-COPY --from=libtool . /
-COPY --from=zlib . /
-COPY --from=libzstd . /
-COPY --from=flex . /
-COPY --from=perl . /
-COPY --from=autoconf . /
-COPY --from=automake . /
-COPY --from=pkgconf . /
-COPY --from=gettext . /
-COPY --from=m4 . /
-COPY --from=argp-standalone . /
-COPY --from=musl . /
-COPY --from=musl-fts . /
-COPY --from=musl-obstack . /
-COPY --from=linux-headers . /
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/bison . /
+COPY --from=stagex/libtool . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/libzstd . /
+COPY --from=stagex/flex . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/autoconf . /
+COPY --from=stagex/automake . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/gettext . /
+COPY --from=stagex/m4 . /
+COPY --from=stagex/argp-standalone . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/musl-fts . /
+COPY --from=stagex/musl-obstack . /
+COPY --from=stagex/linux-headers . /
 RUN tar -xjf ${SRC_FILE}
-WORKDIR elfutils-${VERSION}
+WORKDIR /elfutils-${VERSION}
 ADD *.patch .
 RUN --network=none <<-EOF
 	set -eux
@@ -51,12 +51,11 @@ RUN --network=none <<-EOF
 		--disable-libdebuginfod \
 		--disable-debuginfod \
 		--with-zstd
-	make
+	make -j "$(nproc)"
 EOF
 
-FROM build as install
+FROM build AS install
 RUN --network=none make DESTDIR=/rootfs install
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/eudev/Containerfile

@@ -0,0 +1,31 @@
+FROM scratch AS base
+ENV VERSION=3.2.14
+ENV SRC_HASH=8da4319102f24abbf7fff5ce9c416af848df163b29590e666d334cc1927f006f
+ENV SRC_FILE=eudev-${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/eudev-project/eudev/releases/download/v${VERSION}/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/linux-headers . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/gperf . /
+
+RUN --network=none tar -xf ${SRC_FILE}
+WORKDIR /eudev-${VERSION}
+RUN --network=none <<EOF
+	set -eux
+	./configure
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none DESTDIR=/rootfs make install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/expat/Containerfile

@@ -0,0 +1,36 @@
+
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=2.6.2
+ENV SRC_HASH=d4cf38d26e21a56654ffe4acd9cd5481164619626802328506a2869afab29ab3
+ENV SRC_FILE=expat-${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/libexpat/libexpat/releases/download/R_2_6_2/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+RUN tar -xf $SRC_FILE
+WORKDIR /expat-${VERSION}
+RUN --network=none <<-EOF
+	set -eux
+	./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+		--prefix=/usr \
+		--mandir=/usr/share/man \
+		--enable-static
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN make DESTDIR=/rootfs install
+RUN find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/expect/Containerfile

@@ -0,0 +1,48 @@
+FROM scratch AS base
+ENV VERSION=5.45.4
+ENV SRC_HASH=49a7da83b0bdd9f46d04a04deec19c7767bb9a323e40c4781f89caf760b92c34
+ENV SRC_FILE=expect${VERSION}.tar.gz
+ENV SRC_SITE=https://downloads.sourceforge.net/project/expect/Expect/${VERSION}/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/automake . /
+COPY --from=stagex/autoconf . /
+COPY --from=stagex/m4 . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/tcl . /
+RUN tar -xvf $SRC_FILE
+WORKDIR /expect${VERSION}
+ADD *.patch .
+RUN --network=none <<-EOF
+    set -eux
+    patch -Np0 -i expect-5.45-format-security.patch
+    patch -Np1 -i expect-c99.patch
+    patch -Np1 -i expect-configure-c99.patch
+    autoreconf -vif
+    ./configure \
+        --build=x86_64-unknown-linux-musl \
+        --host=x86_64-unknown-linux-musl \
+        --prefix=/usr/ \
+        --sysconfdir=/etc \
+        --localstatedir=/var \
+        --mandir=/usr/share/man \
+        --with-tcl=/usr/lib \
+        --with-tclinclude=/usr/include \
+        --disable-rpath
+        make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none make DESTDIR=/rootfs install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/expect/expect-5.45-format-security.patch

@@ -0,0 +1,13 @@
+--- exp_clib.c.orig	2017-03-24 10:34:37.269183513 -0400
++++ exp_clib.c	2017-03-24 10:34:41.171117943 -0400
+@@ -1938,8 +1938,8 @@
+      char *str;
+ {
+   if (exp_is_debugging) {
+-    fprintf(stderr,str);
+-    if (exp_logfile) fprintf(exp_logfile,str);
++    fprintf(stderr, "%s", str);
++    if (exp_logfile) fprintf(exp_logfile, "%s", str);
+   }
+ }
+ 

packages/expect/expect-c99.patch

@@ -0,0 +1,24 @@
+Adjustments for compatibility with the currrent (Tcl 8.4.0+) channel
+implementation.
+
+diff --git a/exp_chan.c b/exp_chan.c
+index c92e26b6fbd02305..944200a63b102672 100644
+--- a/exp_chan.c
++++ b/exp_chan.c
+@@ -60,7 +60,7 @@ void			exp_background_channelhandler _ANSI_ARGS_((ClientData,
+ 
+ Tcl_ChannelType expChannelType = {
+     "exp",				/* Type name. */
+-    ExpBlockModeProc,			/* Set blocking/nonblocking mode.*/
++    TCL_CHANNEL_VERSION_2,
+     ExpCloseProc,			/* Close proc. */
+     ExpInputProc,			/* Input proc. */
+     ExpOutputProc,			/* Output proc. */
+@@ -70,6 +70,7 @@ Tcl_ChannelType expChannelType = {
+     ExpWatchProc,			/* Initialize notifier. */
+     ExpGetHandleProc,			/* Get OS handles out of channel. */
+     NULL,				/* Close2 proc */
++    ExpBlockModeProc,			/* Set blocking/nonblocking mode.*/
+ };
+ 
+ typedef struct ThreadSpecificData {

packages/expect/expect-configure-c99.patch

@@ -0,0 +1,200 @@
+Avoid calling exit without declaring the function.
+
+Add missing <string.h> include for memcpy.
+
+Use AC_TYPE_SIGNAL to fix REARM_SIG check.  Add missing includes.
+
+Fix various implicit int return types of main.
+
+Submitted upstream here: <https://sourceforge.net/p/expect/patches/24/#6759>
+
+diff --git a/configure.in b/configure.in
+index 51558fa14d2bcf7e..055c88fbd8797eaa 100755
+--- a/configure.in
++++ b/configure.in
+@@ -452,7 +452,11 @@ AC_CHECK_FUNC(siglongjmp, AC_DEFINE(HAVE_SIGLONGJMP))
+ # because Unixware 2.0 handles it specially and refuses to compile
+ # autoconf's automatic test that is a call with no arguments
+ AC_MSG_CHECKING([for memcpy])
+-AC_TRY_LINK(,[
++AC_TRY_LINK([
++#ifdef HAVE_STRING_H
++#include <string.h>
++#endif
++],[
+ char *s1, *s2;
+ memcpy(s1,s2,0);
+ ],
+@@ -469,6 +473,7 @@ memcpy(s1,s2,0);
+ AC_MSG_CHECKING([if WNOHANG requires _POSIX_SOURCE])
+ AC_TRY_RUN([
+ #include <sys/wait.h>
++int
+ main() {
+ #ifndef WNOHANG
+ 	return 0;
+@@ -489,6 +494,7 @@ rm -rf wnohang
+ AC_TRY_RUN([
+ #include <stdio.h>
+ #include <sys/wait.h>
++int
+ main() {
+ #ifdef WNOHANG
+ 	FILE *fp = fopen("wnohang","w");
+@@ -527,16 +533,21 @@ else
+   AC_DEFINE(SELECT_MASK_TYPE, fd_set)
+ fi
+ 
+-dnl # Check for the data type of the function used in signal(). This
+-dnl # must be before the test for rearming.
+-dnl # echo checking return type of signal handlers
+-dnl AC_HEADER_EGREP([(void|sighandler_t).*signal], signal.h, retsigtype=void,AC_DEFINE(RETSIGTYPE, int) retsigtype=int)
++AC_TYPE_SIGNAL
+ 
+ # FIXME: check if alarm exists
+ AC_MSG_CHECKING([if signals need to be re-armed])
+ AC_TRY_RUN([
+ #include <signal.h>
+-#define RETSIGTYPE $retsigtype
++#ifdef HAVE_STDLIB_H
++# include <stdlib.h>
++#endif
++#ifdef HAVE_UNISTD_H
++# include <unistd.h>
++#endif
++#ifndef NO_SYS_WAIT_H
++# include <sys/wait.h>
++#endif
+ 
+ int signal_rearms = 0;
+ 
+@@ -553,6 +564,7 @@ int n;
+ signal_rearms++;
+ }
+ 
++int
+ main()
+ {
+ 	signal(SIGINT,parent_sigint_handler);
+@@ -714,10 +726,11 @@ fi
+ AC_MSG_CHECKING([for struct sgttyb])
+ AC_TRY_RUN([
+ #include <sgtty.h>
++int
+ main()
+ {
+   struct sgttyb tmp;
+-  exit(0);
++  return 0;
+ }],
+         AC_MSG_RESULT(yes)
+         AC_DEFINE(HAVE_SGTTYB)
+@@ -738,10 +751,11 @@ if test $mach -eq 0 ; then
+   # pty_termios.c is set up to handle pty_termio.
+   AC_MSG_CHECKING([for struct termio])
+   AC_TRY_RUN([#include <termio.h>
++  int
+   main()
+   {
+     struct termio tmp;
+-    exit(0);
++    return 0;
+   }],
+         AC_DEFINE(HAVE_TERMIO)
+         PTY_TYPE=termios
+@@ -760,10 +774,11 @@ if test $mach -eq 0 ; then
+ #  include <inttypes.h>
+ #  endif
+ #  include <termios.h>
++  int
+   main()
+   {
+     struct termios tmp;
+-    exit(0);
++    return 0;
+   }],
+         AC_DEFINE(HAVE_TERMIOS)
+         PTY_TYPE=termios
+@@ -782,6 +797,7 @@ AC_TRY_RUN([
+ #include <inttypes.h>
+ #endif
+ #include <termios.h>
++int
+ main() {
+ #if defined(TCGETS) || defined(TCGETA)
+ 	return 0;
+@@ -804,6 +820,7 @@ AC_TRY_RUN([
+ #include <inttypes.h>
+ #endif
+ #include <termios.h>
++int
+ main() {
+ #ifdef TIOCGWINSZ
+ 	return 0;
+@@ -823,6 +840,7 @@ main() {
+ AC_MSG_CHECKING([for Cray-style ptys])
+ SETUID=":"
+ AC_TRY_RUN([
++int
+ main(){
+ #ifdef CRAY
+ 	return 0;
+@@ -878,12 +896,13 @@ AC_MSG_CHECKING([for SV-style timezone])
+ AC_TRY_RUN([
+ extern char *tzname[2];
+ extern int daylight;
++int
+ main()
+ {
+   int *x = &daylight;
+   char **y = tzname;
+ 
+-  exit(0);
++  return 0;
+ }],
+ 	AC_DEFINE(HAVE_SV_TIMEZONE)
+ 	AC_MSG_RESULT(yes),
+diff --git a/tclconfig/tcl.m4 b/tclconfig/tcl.m4
+index 0689cab3da994068..ebe839e5553ba520 100644
+--- a/tclconfig/tcl.m4
++++ b/tclconfig/tcl.m4
+@@ -2400,7 +2400,7 @@ AC_DEFUN([TEA_TIME_HANDLER], [
+ 	AC_TRY_COMPILE([#include <time.h>],
+ 	    [extern long timezone;
+ 	    timezone += 1;
+-	    exit (0);],
++	    return 0;],
+ 	    tcl_cv_timezone_long=yes, tcl_cv_timezone_long=no)])
+     if test $tcl_cv_timezone_long = yes ; then
+ 	AC_DEFINE(HAVE_TIMEZONE_VAR, 1, [Should we use the global timezone variable?])
+@@ -2412,7 +2412,7 @@ AC_DEFUN([TEA_TIME_HANDLER], [
+ 	    AC_TRY_COMPILE([#include <time.h>],
+ 		[extern time_t timezone;
+ 		timezone += 1;
+-		exit (0);],
++		return 0;],
+ 		tcl_cv_timezone_time=yes, tcl_cv_timezone_time=no)])
+ 	if test $tcl_cv_timezone_time = yes ; then
+ 	    AC_DEFINE(HAVE_TIMEZONE_VAR, 1, [Should we use the global timezone variable?])
+@@ -2452,17 +2452,17 @@ AC_DEFUN([TEA_BUGGY_STRTOD], [
+ 		    double value;
+ 		    value = strtod(infString, &term);
+ 		    if ((term != infString) && (term[-1] == 0)) {
+-			exit(1);
++			return 1;
+ 		    }
+ 		    value = strtod(nanString, &term);
+ 		    if ((term != nanString) && (term[-1] == 0)) {
+-			exit(1);
++			return 1;
+ 		    }
+ 		    value = strtod(spaceString, &term);
+ 		    if (term == (spaceString+1)) {
+-			exit(1);
++			return 1;
+ 		    }
+-		    exit(0);
++		    return 0;
+ 		}], tcl_cv_strtod_buggy=ok, tcl_cv_strtod_buggy=buggy,
+ 		    tcl_cv_strtod_buggy=buggy)])
+ 	if test "$tcl_cv_strtod_buggy" = buggy; then

packages/file/Containerfile

@@ -0,0 +1,39 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=5.45
+ENV SRC_HASH=28c01a5ef1a127ef71758222ca019ba6c6bfa4a8fe20c2b525ce75943ee9da3c
+ENV SRC_FILE=FILE5_45.tar.gz
+ENV SRC_SITE=https://github.com/file/file/archive/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/autoconf . /
+COPY --from=stagex/automake . /
+COPY --from=stagex/libtool . /
+COPY --from=stagex/m4 . /
+COPY --from=stagex/gcc . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /file-FILE5_45/
+RUN --network=none <<-EOF
+	set -eux
+    autoreconf -fvi
+	./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+        --prefix=/usr \
+		--datadir=/usr/share
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none make DESTDIR="/rootfs" install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/filesystem/Containerfile

@@ -0,0 +1,117 @@
+FROM scratch AS build
+COPY --from=stagex/stage3 . /
+WORKDIR /rootfs
+RUN <<-EOF
+	install -d -m0750 root
+	install -d -m0755 etc
+	install -d -m0755 usr
+	install -d -m1777 tmp
+	install -d -m1777 var/tmp
+	install -d -m1777 var/spool/mail
+	install -o 1000 -g 1000 -d -m0755 home/user
+	ln -sT usr/lib lib64
+	ln -sT usr/lib lib
+	ln -sT usr/bin bin
+	ln -sT usr/sbin sbin
+	ln -sT lib usr/lib64
+	ln -sT ../run var/run
+	ln -sT ../run/lock var/lock
+EOF
+COPY --chmod=644 <<-EOF etc/passwd
+	root:x:0:0:root:/root:/bin/sh
+	bin:x:1:1:bin:/bin:/sbin/nologin
+	daemon:x:2:2:daemon:/sbin:/sbin/nologin
+	adm:x:3:4:adm:/var/adm:/sbin/nologin
+	lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
+	sync:x:5:0:sync:/sbin:/bin/sync
+	shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
+	halt:x:7:0:halt:/sbin:/sbin/halt
+	mail:x:8:12:mail:/var/mail:/sbin/nologin
+	news:x:9:13:news:/usr/lib/news:/sbin/nologin
+	uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
+	operator:x:11:0:operator:/root:/sbin/nologin
+	man:x:13:15:man:/usr/man:/sbin/nologin
+	postmaster:x:14:12:postmaster:/var/mail:/sbin/nologin
+	cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
+	ftp:x:21:21::/var/lib/ftp:/sbin/nologin
+	sshd:x:22:22:sshd:/dev/null:/sbin/nologin
+	at:x:25:25:at:/var/spool/cron/atjobs:/sbin/nologin
+	squid:x:31:31:Squid:/var/cache/squid:/sbin/nologin
+	xfs:x:33:33:X Font Server:/etc/X11/fs:/sbin/nologin
+	games:x:35:35:games:/usr/games:/sbin/nologin
+	cyrus:x:85:12::/usr/cyrus:/sbin/nologin
+	vpopmail:x:89:89::/var/vpopmail:/sbin/nologin
+	ntp:x:123:123:NTP:/var/empty:/sbin/nologin
+	smmsp:x:209:209:smmsp:/var/spool/mqueue:/sbin/nologin
+	guest:x:405:100:guest:/dev/null:/sbin/nologin
+	user:x:1000:1000::/home/user:/bin/sh
+	nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
+EOF
+COPY --chmod=644 <<-EOF etc/group
+	root:x:0:
+	daemon:x:1:
+	bin:x:2:
+	sys:x:3:
+	adm:x:4:
+	tty:x:5:
+	disk:x:6:
+	lp:x:7:lp
+	mem:x:8:
+	kmem:x:9:
+	wheel:x:10:root
+	floppy:x:11:root
+	mail:x:12:mail
+	news:x:13:news
+	uucp:x:14:uucp
+	man:x:15:man
+	cron:x:16:cron
+	console:x:17:
+	audio:x:18:
+	cdrom:x:19:
+	dialout:x:20:root
+	ftp:x:21:
+	sshd:x:22:
+	input:x:23:
+	at:x:25:at
+	tape:x:26:root
+	video:x:27:root
+	netdev:x:28:
+	readproc:x:30:
+	squid:x:31:squid
+	xfs:x:33:xfs
+	kvm:x:34:kvm
+	games:x:35:
+	shadow:x:42:
+	cdrw:x:80:
+	www-data:x:82:
+	usb:x:85:
+	vpopmail:x:89:
+	users:x:100:games
+	ntp:x:123:
+	nofiles:x:200:
+	smmsp:x:209:smmsp
+	locate:x:245:
+	abuild:x:300:
+	utmp:x:406:
+	ping:x:999:
+	user:x:1000:
+EOF
+COPY --chmod=644 <<-EOF etc/os-release
+	NAME="[Stageˣ]"
+	ID=stagex
+	HOME_URL="https://stagex.tools"
+	SUPPORT_URL="https://codeberg.org/stagex/stagex/src/branch/main/README.md"
+	BUG_REPORT_URL="https://codeberg.org/stagex/stagex/issues"
+EOF
+
+FROM scratch AS package
+COPY --from=build /rootfs/. /
+USER 1000:1000
+ENTRYPOINT ["/bin/sh"]
+ENV PS1="[Stageˣ] $ "
+ENV TZ=UTC
+ENV LANG=C.UTF-8
+ENV LC_ALL=C
+ENV USER=user
+ENV HOME=/home/user
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

packages/findutils/Containerfile

@@ -0,0 +1,37 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=4.9.0
+ENV SRC_HASH=a2bfb8c09d436770edc59f50fa483e785b161a3b7b9d547573cb08065fd462fe
+ENV SRC_FILE=findutils-${VERSION}.tar.xz
+ENV SRC_SITE=https://ftp.gnu.org/gnu/findutils/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /findutils-${VERSION}
+RUN --network=none <<-EOF
+	set -ex
+	./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--localstatedir=/var \
+		--mandir=/usr/share/man \
+        --infodir=/usr/share/info \
+        gl_cv_func_getcwd_path_max="no, but it is partly working"
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none make DESTDIR="/rootfs" install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/flashtools/Containerfile

@@ -0,0 +1,31 @@
+FROM scratch AS base
+ENV VERSION=d1e6f12568cb23387144a4b7a6535fe1bc1e79b1
+ENV SRC_HASH=a68cdb4a2e312f96862119a6d829ac900b53d0cbc80caa5632efd43b5b7eed6c
+ENV SRC_FILE=${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/osresearch/flashtools/archive/${SRC_FILE}
+
+FROM base AS fetch
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/gcc . /
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+RUN tar -xvf ${SRC_FILE}
+WORKDIR /flashtools-${VERSION}
+
+FROM fetch AS build
+RUN --network=none make all
+
+FROM build AS install
+RUN <<-EOF
+    mkdir -p /rootfs/usr/bin/
+    install -D -m 0755 flashtool /rootfs/usr/bin/
+    install -D -m 0755 peek /rootfs/usr/bin/
+    install -D -m 0755 poke /rootfs/usr/bin/
+    install -D -m 0755 cbfs /rootfs/usr/bin/
+    install -D -m 0755 uefi /rootfs/usr/bin/
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/./ /

packages/flex/Containerfile

@@ -1,27 +1,27 @@
-FROM scratch as base
+FROM scratch AS base
 ENV VERSION=2.6.4
 ENV SRC_HASH=e87aae032bf07c26f85ac0ed3250998c37621d95f8bd748b31f15b33c45ee995
 ENV SRC_FILE=flex-${VERSION}.tar.gz
 ENV SRC_SITE=https://github.com/westes/flex/releases/download/v${VERSION}/${SRC_FILE}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=busybox . /
-COPY --from=perl . /
-COPY --from=gcc . /
-COPY --from=binutils . /
-COPY --from=make . /
-COPY --from=m4 . /
-COPY --from=libtool . /
-COPY --from=autoconf . /
-COPY --from=automake . /
-COPY --from=bison . /
-COPY --from=gettext . /
-COPY --from=musl . /
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/m4 . /
+COPY --from=stagex/libtool . /
+COPY --from=stagex/autoconf . /
+COPY --from=stagex/automake . /
+COPY --from=stagex/bison . /
+COPY --from=stagex/gettext . /
+COPY --from=stagex/musl . /
 RUN tar -xzf ${SRC_FILE}
-WORKDIR flex-${VERSION}
+WORKDIR /flex-${VERSION}
 RUN --network=none <<-EOF
 	set -eux
 	./autogen.sh
@@ -29,15 +29,14 @@ RUN --network=none <<-EOF
 		--build=x86_64-unknown-linux-musl \
 		--host=x86_64-unknown-linux-musl \
 		--prefix=/usr \
-		--bindir=/bin \
+		--bindir=/usr/bin \
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info
-	make LDFLAGS=-static
+	make -j "$(nproc)" LDFLAGS=-static
 EOF
 
-FROM build as install
+FROM build AS install
 RUN --network=none make DESTDIR=/rootfs install
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/fmt/Containerfile

@@ -0,0 +1,45 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=10.2.1
+ENV SRC_HASH=1250e4cc58bf06ee631567523f48848dc4596133e163f02615c97f78bab6c811
+ENV SRC_FILE=${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/fmtlib/fmt/archive/refs/tags/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/postgresql . /
+COPY --from=stagex/cmake . /
+COPY --from=stagex/samurai . /
+COPY --from=stagex/python . /
+COPY --from=stagex/doxygen . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /fmt-${VERSION}
+COPY *.patch .
+RUN --network=none <<-EOF
+	set -eux
+	patch -p1 fix-handling-of-static-separator.patch
+	# Build in-tree so the prebuilt docs get installed correctly.
+	# See https://github.com/fmtlib/fmt/issues/2837
+	cmake -B . -G Ninja \
+		-DCMAKE_INSTALL_PREFIX=/usr \
+		-DCMAKE_INSTALL_LIBDIR=lib \
+		-DBUILD_SHARED_LIBS=True \
+		-DCMAKE_BUILD_TYPE=None \
+		CMAKE_CROSSOPTS="-DCMAKE_SYSTEM_NAME=Linux -DCMAKE_HOST_SYSTEM_NAME=Linux"
+	cmake --build .
+EOF
+
+FROM build AS install
+RUN DESTDIR=/rootfs cmake --install .
+RUN find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/fmt/fix-handling-of-static-separator.patch

@@ -0,0 +1,31 @@
+From 44c3fe1ebb466ab5c296e1a1a6991c7c7b51b72e Mon Sep 17 00:00:00 2001
+From: Victor Zverovich <viz@meta.com>
+Date: Fri, 9 Feb 2024 15:58:56 -0800
+Subject: [PATCH] Fix handling of static separator
+
+---
+ include/fmt/format-inl.h | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/include/fmt/format-inl.h
++++ b/include/fmt/format-inl.h
+@@ -114,7 +114,11 @@ template <typename Char> FMT_FUNC Char d
+
+ FMT_FUNC auto write_loc(appender out, loc_value value,
+                         const format_specs<>& specs, locale_ref loc) -> bool {
+-#ifndef FMT_STATIC_THOUSANDS_SEPARATOR
++#ifdef FMT_STATIC_THOUSANDS_SEPARATOR
++  value.visit(loc_writer<>{
++      out, specs, std::string(1, FMT_STATIC_THOUSANDS_SEPARATOR), "\3", "."});
++  return true;
++#else
+   auto locale = loc.get<std::locale>();
+   // We cannot use the num_put<char> facet because it may produce output in
+   // a wrong encoding.
+@@ -123,7 +127,6 @@ FMT_FUNC auto write_loc(appender out, lo
+     return std::use_facet<facet>(locale).put(out, value, specs);
+   return facet(locale).put(out, value, specs);
+ #endif
+-  return false;
+ }
+ }  // namespace detail

packages/freetds/Containerfile

@@ -0,0 +1,48 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=1.4.22
+ENV SRC_HASH=a9a7f24f0a7a871617e76e8cc6e6556ae788042f1c006195665505499b2334b1
+ENV SRC_FILE=freetds-${VERSION}.tar.bz2
+ENV SRC_SITE=https://www.freetds.org/files/stable/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/libtool . /
+COPY --from=stagex/linux-headers . /
+COPY --from=stagex/readline . /
+COPY --from=stagex/unixodbc . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/perl . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /freetds-${VERSION}
+RUN --network=none <<-EOF
+	set -ex
+	./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info \
+		--enable-msdblib \
+		--with-openssl=/usr \
+		--enable-odbc \
+		--with-unixodbc=/usr
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none <<-EOF
+	set -eu
+	make DESTDIR="/rootfs" install
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/fuse-overlayfs/Containerfile

@@ -0,0 +1,43 @@
+FROM scratch AS base
+ENV VERSION=1.13
+ENV SRC_FILE=fuse-overlayfs-${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/containers/fuse-overlayfs/archive/v${VERSION}/${SRC_FILE}
+ENV SRC_HASH=96d10344921d5796bcba7a38580ae14a53c4e60399bb90b238ac5a10b3bb65b2
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/autoconf . /
+COPY --from=stagex/automake . /
+COPY --from=stagex/m4 . /
+COPY --from=stagex/fuse3 . /
+COPY --from=stagex/linux-headers . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /fuse-overlayfs-${VERSION}
+RUN --network=none <<-EOF
+	set -eux
+	/usr/bin/autoreconf -fis
+	./configure \
+        --build=x86_64-linux-musl \
+        --host=x86_64-linux-musl \
+		--prefix=/usr \
+		--mandir=/usr/share/man
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN <<-EOF
+	set -eux
+    make DESTDIR=/rootfs install
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/fuse3/Containerfile

@@ -0,0 +1,58 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=3.16.2
+ENV SRC_HASH=f797055d9296b275e981f5f62d4e32e089614fc253d1ef2985851025b8a0ce87
+ENV SRC_FILE=fuse-${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/libfuse/libfuse/releases/download/fuse-${VERSION}/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/python . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/bzip2 . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/linux-headers . /
+COPY --from=stagex/ncurses . /
+COPY --from=stagex/meson . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/cmake . /
+COPY --from=stagex/pcre2 . /
+COPY --from=stagex/python . /
+COPY --from=stagex/bison . /
+COPY --from=stagex/flex . /
+COPY --from=stagex/py-packaging . /
+COPY --from=stagex/libxslt . /
+COPY --from=stagex/libffi . /
+COPY --from=stagex/xz . /
+COPY --from=stagex/expat . /
+COPY --from=stagex/rhash . /
+COPY --from=stagex/libxml2 . /
+COPY --from=stagex/util-linux . /
+COPY --from=stagex/libxslt . /
+COPY --from=stagex/gettext . /
+COPY --from=stagex/ninja . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /fuse-${VERSION}
+COPY *.patch .
+RUN --network=none <<-EOF
+	set -eux
+    meson setup \
+		--default-library=shared \
+		--prefix=/usr \
+		-Dinitscriptdir="" \
+		. output
+	meson compile -C output
+EOF
+
+FROM build AS install
+RUN DESTDIR=/rootfs meson install --no-rebuild -C output
+RUN find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/gawk/Containerfile

@@ -0,0 +1,37 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=5.3.0
+ENV SRC_HASH=ca9c16d3d11d0ff8c69d79dc0b47267e1329a69b39b799895604ed447d3ca90b
+ENV SRC_FILE=gawk-${VERSION}.tar.xz
+ENV SRC_SITE=https://ftp.gnu.org/gnu/gawk/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /gawk-${VERSION}
+RUN --network=none <<-EOF
+	set -ex
+	./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+		--target=${ARCH}-linux-musl \
+		--prefix=/usr \
+		--mandir=/usr/share/man \
+        --infodir=/usr/share/info \
+        --disable-nls \
+        --disable-pma
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none make DESTDIR="/rootfs" install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/gcc/Containerfile

@@ -1,29 +1,29 @@
-FROM scratch as base
-ENV VERSION 12.2.0
-ENV SRC_FILE gcc-$VERSION.tar.xz
-ENV SRC_SITE https://mirrors.kernel.org/gnu/gcc/gcc-${VERSION}/${SRC_FILE}
-ENV SRC_HASH e549cf9cf3594a00e27b6589d4322d70e0720cdd213f39beb4181e06926230ff
-ENV DEP_SITE https://gcc.gnu.org/pub/gcc/infrastructure/
-ENV GMP_FILE gmp-6.2.1.tar.bz2
-ENV GMP_HASH eae9326beb4158c386e39a356818031bd28f3124cf915f8c5b1dc4c7a36b4d7c
-ENV MPFR_FILE mpfr-4.1.0.tar.bz2
-ENV MPFR_HASH feced2d430dd5a97805fa289fed3fc8ff2b094c02d05287fd6133e7f1f0ec926
-ENV MPC_FILE mpc-1.2.1.tar.gz
-ENV MPC_HASH 17503d2c395dfcf106b622dc142683c1199431d095367c6aacba6eec30340459
-ENV ISL_FILE isl-0.24.tar.bz2
-ENV ISL_HASH fcf78dd9656c10eb8cf9fbd5f59a0b6b01386205fe1934b3b287a0a1898145c0
+FROM scratch AS base
+ENV VERSION=13.1.0
+ENV SRC_FILE=gcc-$VERSION.tar.xz
+ENV SRC_SITE=https://mirrors.kernel.org/gnu/gcc/gcc-${VERSION}/${SRC_FILE}
+ENV SRC_HASH=61d684f0aa5e76ac6585ad8898a2427aade8979ed5e7f85492286c4dfc13ee86
+ENV DEP_SITE=https://gcc.gnu.org/pub/gcc/infrastructure/
+ENV GMP_FILE=gmp-6.2.1.tar.bz2
+ENV GMP_HASH=eae9326beb4158c386e39a356818031bd28f3124cf915f8c5b1dc4c7a36b4d7c
+ENV MPFR_FILE=mpfr-4.1.0.tar.bz2
+ENV MPFR_HASH=feced2d430dd5a97805fa289fed3fc8ff2b094c02d05287fd6133e7f1f0ec926
+ENV MPC_FILE=mpc-1.2.1.tar.gz
+ENV MPC_HASH=17503d2c395dfcf106b622dc142683c1199431d095367c6aacba6eec30340459
+ENV ISL_FILE=isl-0.24.tar.bz2
+ENV ISL_HASH=fcf78dd9656c10eb8cf9fbd5f59a0b6b01386205fe1934b3b287a0a1898145c0
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 ADD --checksum=sha256:${GMP_HASH} ${DEP_SITE}/${GMP_FILE} .
 ADD --checksum=sha256:${MPFR_HASH} ${DEP_SITE}/${MPFR_FILE} .
 ADD --checksum=sha256:${MPC_HASH} ${DEP_SITE}/${MPC_FILE} .
 ADD --checksum=sha256:${ISL_HASH} ${DEP_SITE}/${ISL_FILE} .
 
-FROM fetch as build
-COPY --from=stage3 . /
+FROM fetch AS build
+COPY --from=stagex/stage3 . /
 RUN tar -xf ${SRC_FILE}
-WORKDIR gcc-${VERSION}
+WORKDIR /gcc-${VERSION}
 RUN --network=none <<-EOF
 	set -eux
 	mv ../*.tar.* .
@@ -49,21 +49,23 @@ RUN --network=none <<-EOF
 		--enable-languages=c,c++ \
 		--enable-link-serialization=2 \
 		--enable-linker-build-id
-	make
+	make -j "$(nproc)"
 EOF
 
-FROM build as install
+FROM build AS install
 RUN --network=none <<-EOF
 	set -eux
 	make DESTDIR=/rootfs install-strip
 	ln -s gcc /rootfs/usr/bin/cc
+	mv /rootfs/usr/lib64/* /rootfs/usr/lib/
+	rm -rf /rootfs/usr/lib64
 EOF
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
 
-FROM busybox as test
-COPY --from=install /rootfs /
-COPY --from=binutils . /
-COPY --from=musl . /
+FROM scratch AS test
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+COPY --from=install /rootfs/. /
 COPY <<-EOF test.c
 #include <stdio.h>
 int main() { printf("Success\n"); return 0; }
@@ -74,5 +76,5 @@ RUN <<-EOF
 	./main | grep "Success"
 EOF
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/gdbm/Containerfile

@@ -0,0 +1,40 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=1.23
+ENV SRC_HASH=74b1081d21fff13ae4bd7c16e5d6e504a4c26f7cde1dca0d963a484174bbcacd
+ENV SRC_FILE=gdbm-${VERSION}.tar.gz
+ENV SRC_SITE=https://ftp.gnu.org/gnu/gdbm/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/bash . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/openssl . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /gdbm-${VERSION}
+ENV SOURCE_DATE_EPOCH=1
+RUN --network=none <<-EOF
+	set -eux
+	./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+		--prefix=/usr \
+		--enable-libgdbm-compat \
+		--disable-largefile \
+		--disable-dependency-tracking \
+		--enable-fast-install
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN make DESTDIR=/rootfs install
+RUN find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/gen_initramfs/Containerfile

@@ -1,30 +1,31 @@
-FROM busybox as base
-ENV VERSION=6.6
-ENV SRC_HASH=d926a06c63dd8ac7df3f86ee1ffc2ce2a3b81a2d168484e76b5b389aba8e56d0
+FROM scratch AS base
+ENV VERSION=6.8
+ENV SRC_HASH=c969dea4e8bb6be991bbf7c010ba0e0a5643a3a8d8fb0a2aaa053406f1e965f3
 ENV SRC_FILE=linux-${VERSION}.tar.xz
 ENV SRC_SITE=http://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/${SRC_FILE}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=busybox . /
-COPY --from=gcc . /
-COPY --from=binutils . /
-COPY --from=musl . /
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
 RUN tar -xf ${SRC_FILE}
-WORKDIR linux-${VERSION}
+WORKDIR /linux-${VERSION}
 RUN --network=none gcc usr/gen_init_cpio.c -o usr/gen_init_cpio
 
-FROM build as install
+FROM build AS install
 RUN --network=none <<-EOF
     set -eux
     mkdir -p /rootfs/usr/bin
-    cp -a usr/gen_initramfs.sh /rootfs/usr/bin/gen_initramfs
+    cat usr/gen_initramfs.sh \
+        | sed 's:usr/gen_init_cpio:gen_init_cpio:g' \
+        > /rootfs/usr/bin/gen_initramfs
+    chmod +x /rootfs/usr/bin/gen_initramfs
     cp -a usr/gen_init_cpio /rootfs/usr/bin
-    find /rootfs -exec touch -hcd "@0" "{}" +
 EOF
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/gettext/Containerfile

@@ -1,21 +1,21 @@
-FROM scratch as base
+FROM scratch AS base
 ENV VERSION=0.21
 ENV SRC_HASH=d20fcbb537e02dcf1383197ba05bd0734ef7bf5db06bdb241eb69b7d16b73192
 ENV SRC_FILE=gettext-${VERSION}.tar.xz
 ENV SRC_SITE=https://mirrors.kernel.org/gnu/gettext/${SRC_FILE}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=busybox . /
-COPY --from=gcc . /
-COPY --from=binutils . /
-COPY --from=libxml2 . /
-COPY --from=make . /
-COPY --from=musl . /
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/libxml2 . /
+COPY --from=stagex/make . /
+COPY --from=stagex/musl . /
 RUN tar -xf ${SRC_FILE}
-WORKDIR gettext-${VERSION}
+WORKDIR /gettext-${VERSION}
 RUN <<-EOF
 	set -eux
 	./configure \
@@ -24,12 +24,11 @@ RUN <<-EOF
         --disable-java \
         --enable-static \
         --with-included-libxml=no
-	make
+	make -j "$(nproc)"
 EOF
 
-from build as install
-RUN make DESTDIR=/rootfs install
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
+FROM build AS install
+RUN --network=none make DESTDIR=/rootfs install
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/git/Containerfile

@@ -1,30 +1,33 @@
-FROM scratch as base
+FROM scratch AS base
 ENV VERSION=2.9.5
 ENV SRC_HASH=a4bea37ecb9a3fb5c0c8ef18c2f7eeaf8ccbcfec91f72f3bccfc6bf72a3e3902
 ENV SRC_FILE=git-${VERSION}.tar.xz
 ENV SRC_SITE=http://mirrors.edge.kernel.org/pub/software/scm/git/${SRC_FILE}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=busybox . /
-COPY --from=musl . /
-COPY --from=gcc . /
-COPY --from=binutils . /
-COPY --from=make . /
-COPY --from=zlib . /
-COPY --from=perl . /
-COPY --from=gettext . / 
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/curl . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/gettext . /
 RUN tar -xvf $SRC_FILE
-WORKDIR git-${VERSION}
+WORKDIR /git-${VERSION}
+ENV SOURCE_DATE_EPOCH=1
 RUN --network=none <<-EOF
 	set -eux
 	./configure \
 		--build=x86_64-unknown-linux-musl \
 		--host=x86_64-unknown-linux-musl \
 		--prefix=/usr \
-		--bindir=/bin \
+		--bindir=/usr/bin \
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info \
 		--disable-nls \
@@ -32,17 +35,17 @@ RUN --network=none <<-EOF
 		--without-curses \
 		--without-bash-malloc \
 		--without-tcltk
-	make
+	make -j "$(nproc)"
 EOF
 
-FROM build as install
+FROM build AS install
 RUN make DESTDIR=/rootfs install
 
-FROM base as test
-COPY --from=install /rootfs /
-COPY --from=zlib . /
-COPY --from=musl . /
-COPY --from=busybox . /
+FROM base AS test
+COPY --from=install /rootfs/. /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/busybox . /
 RUN /bin/sh <<-EOF
 	set -eux
 	EXPECTED_GIT_VERSION="git version ${VERSION}"
@@ -53,5 +56,5 @@ RUN /bin/sh <<-EOF
 	fi
 EOF
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/glib/Containerfile

@@ -0,0 +1,66 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=2.80.0
+ENV SRC_HASH=8228a92f92a412160b139ae68b6345bd28f24434a7b5af150ebe21ff587a561d
+ENV SRC_FILE=glib-${VERSION}.tar.xz
+ENV SRC_SITE=https://download.gnome.org/sources/glib/2.80/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/python . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/bzip2 . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/linux-headers . /
+COPY --from=stagex/ncurses . /
+COPY --from=stagex/meson . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/cmake . /
+COPY --from=stagex/pcre2 . /
+COPY --from=stagex/python . /
+COPY --from=stagex/bison . /
+COPY --from=stagex/flex . /
+COPY --from=stagex/py-packaging . /
+COPY --from=stagex/libxslt . /
+COPY --from=stagex/libffi . /
+COPY --from=stagex/xz . /
+COPY --from=stagex/expat . /
+COPY --from=stagex/rhash . /
+COPY --from=stagex/libxml2 . /
+COPY --from=stagex/util-linux . /
+COPY --from=stagex/libxslt . /
+COPY --from=stagex/gettext . /
+COPY --from=stagex/ninja . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /glib-${VERSION}
+COPY *.patch .
+RUN --network=none <<-EOF
+	set -eux
+    export CFLAGS="-ffat-lto-objects -O2"
+    export CXXFLAGS="-O2"
+    export CPPFLAGS="-O2"
+    meson setup \
+		--default-library=shared \
+		--prefix=/usr \
+		-Dman-pages=disabled \
+		-Dlibmount=disabled \
+		-Dtests=false \
+		-Dintrospection=disabled \
+		-Dnls=disabled \
+		. output
+	meson compile -C output
+	meson install --no-rebuild -C output
+EOF
+
+FROM build AS install
+RUN DESTDIR=/rootfs meson install --no-rebuild -C output
+RUN find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/gmp/Containerfile

@@ -0,0 +1,36 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=6.3.0
+ENV SRC_HASH=a3c2b80201b89e68616f4ad30bc66aee4927c3ce50e33929ca819d5c43538898
+ENV SRC_FILE=gmp-${VERSION}.tar.xz
+ENV SRC_SITE=https://gmplib.org/download/gmp/${SRC_FILE}
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/autoconf . /
+COPY --from=stagex/automake . /
+COPY --from=stagex/libtool . /
+COPY --from=stagex/m4 . /
+COPY --from=stagex/gcc . /
+
+RUN --network=none tar -xf ${SRC_FILE}
+WORKDIR /gmp-${VERSION}
+RUN --network=none <<EOF
+    set -eux
+    ./configure \
+        --prefix=/usr \
+        --build=${ARCH}-linux-musl
+    make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none DESTDIR=/rootfs make install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/go-md2man/Containerfile

@@ -0,0 +1,35 @@
+FROM scratch AS base
+ENV VERSION=2.0.3
+ENV SRC_HASH=7ca3a04bb4ab83387538235decc42a535097a05d2fb9f2266d0c47b33119501f
+ENV SRC_FILE=v${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/cpuguy83/go-md2man/archive/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/go . /
+COPY --from=stagex/ca-certificates . /
+RUN tar -xvf ${SRC_FILE}
+WORKDIR /go-md2man-${VERSION}
+ENV PWD=/home/user/go-md2man-${VERSION}
+ENV GOPATH=${PWD}/cache/go
+ENV GOCACHE=${PWD}/cache/
+ENV GOWORK=off
+ENV GOPROXY=https://proxy.golang.org,direct
+ENV GOSUMDB=sum.golang.org
+ENV CGO_ENABLED=0
+ENV GOHOSTOS=linux
+ENV GOHOSTARCH=amd64
+RUN mkdir -p ${GOPATH}
+RUN go build -o bin/go-md2man 
+
+FROM build AS install
+RUN <<-EOF
+    mkdir -p /rootfs/usr/bin/
+    cp bin/go-md2man /rootfs/usr/bin/
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/./ /

packages/go/Containerfile

@@ -1,8 +1,12 @@
-FROM scratch as base
-ENV VERSION=1.21.4
-ENV SRC_HASH=47b26a83d2b65a3c1c1bcace273b69bee49a7a7b5168a7604ded3d26a37bd787
+FROM scratch AS base
+ENV VERSION=1.23.1
+ENV SRC_HASH=6ee44e298379d146a5e5aa6b1c5b5d5f5d0a3365eabdd70741e6e21340ec3b0d
 ENV SRC_FILE=go${VERSION}.src.tar.gz
 ENV SRC_SITE=https://storage.googleapis.com/golang/${SRC_FILE}
+ENV VERSION_BOOTSTRAP_3=1.20.6
+ENV SRC_HASH_BOOTSTRAP_3=62ee5bc6fb55b8bae8f705e0cb8df86d6453626b4ecf93279e2867092e0b7f70
+ENV SRC_FILE_BOOTSTRAP_3=go${VERSION_BOOTSTRAP_3}.src.tar.gz
+ENV SRC_SITE_BOOTSTRAP_3=https://storage.googleapis.com/golang/${SRC_FILE_BOOTSTRAP_3}
 ENV VERSION_BOOTSTRAP_2=1.19.11
 ENV SRC_HASH_BOOTSTRAP_2=e25c9ab72d811142b7f41ff6da5165fec2d1be5feec3ef2c66bc0bdecb431489
 ENV SRC_FILE_BOOTSTRAP_2=go${VERSION_BOOTSTRAP_2}.src.tar.gz
@@ -12,27 +16,30 @@ ENV SRC_HASH_BOOTSTRAP_1=f4ff5b5eb3a3cae1c993723f3eab519c5bae18866b5e5f96fe1102f
 ENV SRC_FILE_BOOTSTRAP_1=go${VERSION_BOOTSTRAP_1}.tar.gz
 ENV SRC_SITE_BOOTSTRAP_1=https://dl.google.com/go/${SRC_FILE_BOOTSTRAP_1}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH_BOOTSTRAP_1} ${SRC_SITE_BOOTSTRAP_1} .
 ADD --checksum=sha256:${SRC_HASH_BOOTSTRAP_2} ${SRC_SITE_BOOTSTRAP_2} .
+ADD --checksum=sha256:${SRC_HASH_BOOTSTRAP_3} ${SRC_SITE_BOOTSTRAP_3} .
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
 
-FROM fetch as build
-COPY --from=busybox . /
-COPY --from=gcc . /
-COPY --from=bash . /
-COPY --from=musl . /
-COPY --from=binutils . /
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/bash . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/binutils . /
 RUN <<-EOF
 	set -eux
 	tar -xzf go${VERSION_BOOTSTRAP_1}.tar.gz
 	mv go go-bootstrap-1-src
 	tar -xzf go${VERSION_BOOTSTRAP_2}.src.tar.gz
 	mv go go-bootstrap-2-src
+	tar -xzf go${VERSION_BOOTSTRAP_3}.src.tar.gz
+	mv go go-bootstrap-3-src
 	tar -xzf go${VERSION}.src.tar.gz; \
 	mv go go-src
 EOF
-WORKDIR go-bootstrap-1-src
+WORKDIR /go-bootstrap-1-src
 ENV GOOS=linux
 ENV CGO_ENABLED=0
 ENV GOROOT_FINAL=/go-bootstrap-1
@@ -47,7 +54,7 @@ RUN --network=none <<-EOF
 	mkdir -p ${DEST}
 	cp -R bin lib pkg src ${DEST}
 EOF
-WORKDIR ../go-bootstrap-2-src
+WORKDIR /go-bootstrap-2-src
 ENV GO11MODULE=off
 ENV GOROOT_BOOTSTRAP=/go-bootstrap-1
 ENV GOROOT_FINAL=/go-bootstrap-2
@@ -62,31 +69,46 @@ RUN --network=none <<-EOF
 	mkdir -p ${DEST}
 	cp -R bin lib pkg src ${DEST}
 EOF
-WORKDIR ../go-src
+WORKDIR /go-bootstrap-3-src
+ENV GO11MODULE=off
+ENV GOROOT_BOOTSTRAP=/go-bootstrap-2
+ENV GOROOT_FINAL=/go-bootstrap-3
+ENV GOROOT=${GOROOT_FINAL}
+ENV DEST=${GOROOT_FINAL}
+ENV GOBIN=${GOROOT_FINAL}/bin
+RUN --network=none <<-EOF
+	set -eux
+	cd src
+	bash make.bash
+	cd ..
+	mkdir -p ${DEST}
+	cp -R bin lib pkg src ${DEST}
+EOF
+WORKDIR /go-src
 ENV GOPROXY=off
 ENV GOTOOLCHAIN=local
 ENV GOFLAGS=-mod=vendor
 ENV GO11MODULE=on
-ENV GOROOT_BOOTSTRAP=/go-bootstrap-2
+ENV GOROOT_BOOTSTRAP=/go-bootstrap-3
 ENV GOROOT_FINAL="/lib/go"
 ENV GOBIN=${GOROOT_FINAL}/bin
-ENV GOROOT=/go-bootstrap-2
+ENV GOROOT=/go-bootstrap-3
 RUN --network=none <<-EOF
 	set -eux
 	cd src
 	bash make.bash
 EOF
 
-FROM build as install
+FROM build AS install
 RUN <<-EOF
 	set -eux
-	mkdir -p /rootfs
-	cp -R bin lib pkg src /rootfs
+	mkdir -p /rootfs/usr
+	cp -R pkg src /rootfs
+    cp -R bin lib /rootfs/usr
 EOF
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
 
-FROM base as test
-COPY --from=install /rootfs /
+FROM base AS test
+COPY --from=install /rootfs/. /
 COPY <<-EOF test.go
 	package main
 	import "fmt"
@@ -98,5 +120,5 @@ RUN <<-EOF
 	./test | grep "Success"
 EOF
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/gperf/Containerfile

@@ -0,0 +1,30 @@
+FROM scratch AS base
+ENV VERSION=3.1
+ENV SRC_HASH=588546b945bba4b70b6a3a616e80b4ab466e3f33024a352fc2198112cdbb3ae2
+ENV SRC_FILE=gperf-${VERSION}.tar.gz
+ENV SRC_SITE=http://ftp.gnu.org/pub/gnu/gperf/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+
+RUN --network=none tar -xf ${SRC_FILE}
+WORKDIR /gperf-${VERSION}
+RUN --network=none <<EOF
+set -eux
+./configure
+make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none DESTDIR=/rootfs make install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/gpg/Containerfile

@@ -1,50 +1,50 @@
-FROM scratch as base
+FROM scratch AS base
 ENV VERSION=2.4.4
 ENV SRC_HASH=67ebe016ca90fa7688ce67a387ebd82c6261e95897db7b23df24ff335be85bc6
 ENV SRC_FILE=gnupg-${VERSION}.tar.bz2
 ENV SRC_SITE=https://gnupg.org/ftp/gcrypt/gnupg/${SRC_FILE}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
 
-FROM fetch as build
-COPY --from=busybox . /
-COPY --from=musl . /
-COPY --from=gcc . /
-COPY --from=binutils . /
-COPY --from=make . /
-COPY --from=npth . /
-COPY --from=libksba . /
-COPY --from=libgpg-error . /
-COPY --from=libassuan . /
-COPY --from=libgcrypt . /
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/npth . /
+COPY --from=stagex/libksba . /
+COPY --from=stagex/libgpg-error . /
+COPY --from=stagex/libassuan . /
+COPY --from=stagex/libgcrypt . /
 RUN tar -xvf $SRC_FILE
-WORKDIR gnupg-${VERSION}
+WORKDIR /gnupg-${VERSION}
 RUN --network=none <<-EOF
 	set -eux
 	./configure \
 		--build=x86_64-unknown-linux-musl \
 		--host=x86_64-unknown-linux-musl \
 		--prefix=/usr \
-		--bindir=/bin \
+		--bindir=/usr/bin \
 		--mandir=/usr/share/man \
-		--infodir=/usr/share/info \
-	make
+		--infodir=/usr/share/info
+	make -j "$(nproc)"
 EOF
 
-FROM build as install
+FROM build AS install
 RUN make DESTDIR=/rootfs install
 
-FROM base as test
-COPY --from=install /rootfs /
-COPY --from=zlib . /
-COPY --from=musl . /
-COPY --from=busybox . /
-COPY --from=npth . /
-COPY --from=libksba . /
-COPY --from=libgpg-error . /
-COPY --from=libassuan . /
-COPY --from=libgcrypt . /
+FROM base AS test
+COPY --from=install /rootfs/. /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/npth . /
+COPY --from=stagex/libksba . /
+COPY --from=stagex/libgpg-error . /
+COPY --from=stagex/libassuan . /
+COPY --from=stagex/libgcrypt . /
 
 RUN /bin/sh <<-EOF
 	set -eux
@@ -56,5 +56,5 @@ RUN /bin/sh <<-EOF
 	fi
 EOF
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/grep/Containerfile

@@ -0,0 +1,37 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=3.11
+ENV SRC_HASH=1db2aedde89d0dea42b16d9528f894c8d15dae4e190b59aecc78f5a951276eab
+ENV SRC_FILE=grep-${VERSION}.tar.xz
+ENV SRC_SITE=https://mirrors.kernel.org/gnu/grep/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gcc . /
+RUN tar -xf ${SRC_FILE}
+WORKDIR /grep-${VERSION}
+RUN --network=none <<-EOF
+	set -ex
+	./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+		--target=${ARCH}-linux-musl \
+		--prefix=/usr \
+        --sysconfdir=/etc \
+		--mandir=/usr/share/man \
+        --infodir=/usr/share/info \
+        --disable-nls
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN --network=none make DESTDIR="/rootfs" install
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/groff/Containerfile

@@ -0,0 +1,38 @@
+FROM scratch AS base
+ARG ARCH=x86_64
+ENV VERSION=1.23.0
+ENV SRC_HASH=6b9757f592b7518b4902eb6af7e54570bdccba37a871fddb2d30ae3863511c13
+ENV SRC_FILE=groff-${VERSION}.tar.gz
+ENV SRC_SITE=https://ftp.gnu.org/gnu/groff/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
+
+FROM fetch AS build
+COPY --from=stagex/perl . /
+COPY --from=stagex/m4 . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+RUN tar -xf $SRC_FILE
+WORKDIR /groff-${VERSION}
+ENV SOURCE_DATE_EPOCH=1
+RUN --network=none <<-EOF
+	set -eux
+	./configure \
+		--build=${ARCH}-linux-musl \
+		--host=${ARCH}-linux-musl \
+		--prefix=/usr \
+		--without-x \
+		--disable-rpath
+	make -j "$(nproc)"
+EOF
+
+FROM build AS install
+RUN make DESTDIR=/rootfs install
+RUN find /rootfs -exec touch -hcd "@0" "{}" +
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /

packages/grpcurl/Containerfile

@@ -0,0 +1,36 @@
+FROM scratch AS base
+ENV VERSION=1.8.9
+ENV SRC_HASH=962fe7d3da7653519d2975e130244af9286db32041b0745613aebf89949a9009
+ENV SRC_FILE=v${VERSION}.tar.gz
+ENV SRC_SITE=https://github.com/fullstorydev/grpcurl/archive/refs/tags/${SRC_FILE}
+ENV GOCACHE=/cache/
+ENV GOWORK=off
+ENV GOPROXY=https://proxy.golang.org,direct
+ENV GOSUMDB=sum.golang.org
+ENV CGO_ENABLED=0
+ENV GOHOSTOS=linux
+ENV GOHOSTARCH=amd64
+ENV GOLDFLAGS="-w -extldflags \"-static\" -X \"main.version=${VERSION}\""
+
+FROM base AS fetch
+COPY --from=stagex/busybox . /
+COPY --from=stagex/go . /
+COPY --from=stagex/ca-certificates . /
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+RUN tar -xvf ${SRC_FILE}
+WORKDIR /grpcurl-${VERSION}
+ENV GOPATH="/grpcurl-${VERSION}"
+RUN go get ./...
+
+FROM fetch AS build
+RUN --network=none go build -trimpath -v ./cmd/grpcurl
+
+FROM build AS install
+RUN <<-EOF
+    set -eu
+    mkdir -p /rootfs/usr/bin/
+    cp grpcurl /rootfs/usr/bin/
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/./ /

packages/grub/Containerfile

@@ -1,50 +1,77 @@
-FROM scratch as base
-ENV VERSION=2.06
-ENV SRC_HASH=23b64b4c741569f9426ed2e3d0e6780796fca081bee4c99f62aa3f53ae803f5f
+FROM scratch AS base
+ENV VERSION=2.12
+ENV SRC_HASH=b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91
 ENV SRC_FILE=grub-${VERSION}.tar.gz
 ENV SRC_SITE=https://mirrors.kernel.org/gnu/grub/${SRC_FILE}
 
-FROM base as fetch
+FROM base AS fetch
 ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} ${SRC_FILE}
 
-FROM fetch as build
-COPY --from=busybox . /
-COPY --from=bison . /
-COPY --from=flex . /
-COPY --from=gcc . /
-COPY --from=binutils . /
-COPY --from=make . /
-COPY --from=musl . /
-COPY --from=python . /
-COPY --from=m4 . /
-COPY --from=linux-headers . / 
+FROM fetch AS build
+COPY --from=stagex/busybox . /
+COPY --from=stagex/bison . /
+COPY --from=stagex/flex . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/binutils . /
+COPY --from=stagex/make . /
+COPY --from=stagex/gawk . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/python . /
+COPY --from=stagex/m4 . /
+COPY --from=stagex/perl . /
+COPY --from=stagex/pkgconf . /
+COPY --from=stagex/automake . /
+COPY --from=stagex/autoconf . /
+COPY --from=stagex/gettext . /
+COPY --from=stagex/xz . /
+COPY --from=stagex/linux-headers . /
 RUN tar -xf ${SRC_FILE}
-WORKDIR grub-${VERSION}
+WORKDIR /grub-${VERSION}
 RUN --network=none <<-EOF
 	set -eux
-	./configure \
-        --prefix=/usr
-    make CFLAGS="-Wno-error"
+    sh autogen.sh
+    touch grub-core/extra_deps.lst
+    mkdir build-pc
+    cd build-pc
+	CLFLAGS="-fno-plt" \
+    ../configure \
+        --prefix=/usr \
+        --sysconfdir=/etc \
+        --mandir=/usr/share/man \
+        --localstatedir=/var \
+        --build=x86_64 \
+        --target=x86_64 \
+        --host=x86_64 \
+        --disable-nls \
+        --disable-werror \
+        --with-platform=pc
+    make
+    cd ..
+    mkdir build-efi
+    cd build-efi
+	../configure \
+        --prefix=/usr \
+        --sysconfdir=/etc \
+        --mandir=/usr/share/man \
+        --localstatedir=/var \
+        --build=x86_64 \
+        --target=x86_64 \
+        --host=x86_64 \
+        --disable-nls \
+        --disable-werror \
+        --with-platform=efi \
+        --disable-efiemu
+    make
 EOF
 
-FROM build as install
-RUN make DESTDIR=/rootfs install
-RUN find /rootfs -exec touch -hcd "@0" "{}" +
-RUN ls -la .
-
-FROM base as test
-COPY --from=install /rootfs /
-COPY --from=musl . /
-COPY --from=busybox . /
-RUN grub-install --version
-RUN /bin/sh <<-EOF
-	set -eux
-    GRUB_VERSION=\$(echo | grub-install --version) 
-	if [ "grub-install (GRUB) ${VERSION}" != "\$GRUB_VERSION" ]; then
-	    echo "Expected grub version is \$VERSION, but got \$GRUB_VERSION"
-	    exit 1
-	fi
+FROM build AS install
+RUN <<-EOF
+    cd build-pc
+    make DESTDIR=/rootfs install-strip
+    cd ..
+    cd build-efi
+    make DESTDIR=/rootfs install-strip
 EOF
 
-FROM scratch as package
-COPY --from=install /rootfs /
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /