commit 3c8a070a667252750865d6b5b44102af519bb793 Author: Jeremy Anderson Date: Sun Jul 12 01:12:25 2026 -0400 BTC (Build Tool Chain) is a bare-metal, cleanroom toolchain generation engine engineered for independent infrastructure. It is designed to bypass standard bootstrap phases and rapidly forge hardened, ultra-optimized workspace environments for Xeon-based swarm nodes and high-security virtualization targets. diff --git a/BTC.sh b/BTC.sh new file mode 100755 index 0000000..7df20c0 --- /dev/null +++ b/BTC.sh @@ -0,0 +1,1049 @@ +#!/bin/bash +# BTC.sh requires GNU Bash 4.0+ (not POSIX sh). It uses: +# - [[ ... ]] conditionals, == pattern matching, =~ regex, (( )) arithmetic +# - ${var^^} uppercase expansion, associative arrays, process substitution +# - set -euo pipefail for strict error handling +# BTC-0.4.0.sh - Build Tool Chain +# Identity: dcosnet / dcos.net | Multi-Arch Cross-Compilation Forge +# Version: 0.4.0 | Persistence: /opt/BTC | Volatile: ramfs +# License: GNU AGPLv3 Mandatory Prominent Interactive Notice +# Copyright (C) 2012-2026 Jeremy Anderson (info@dcos.net) + +set -euo pipefail +export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES + +# ============================================================================ +# 1. AGPL INTERACTIVE LICENSE COMPLIANCE +# ============================================================================ +function f_agpl_header() { + clear + cat << 'EOF' +=========================================================================== + BTC-0.4.0.sh - Build Tool Chain (AGPLv3 PROTECTED) + Cross-Compilation Sovereign Forge +=========================================================================== +This program is free software: you can redistribute it and/or modify it +under the terms of the GNU Affero General Public License as published by +the Free Software Foundation, either version 3 of the License. + +REMOTE INTERACTION NOTICE: Per Section 13 of the GNU AGPLv3, if you modify +this script and offer its toolchain-building capabilities as a service over +a network, you MUST make your complete modified source code available. +=========================================================================== +EOF + if [[ ! -f /var/tmp/BTC-AGPL-ACCEPTED ]]; then + echo -n "Do you accept the network-sovereignty terms of the AGPLv3? (y/N): " + read -r reply + if [[ "${reply}" =~ ^[Yy]$ ]]; then + touch /var/tmp/BTC-AGPL-ACCEPTED + else + echo ">> Build aborted: AGPLv3 acceptance is mandatory for execution." + exit 1 + fi + fi +} + +# ============================================================================ +# 2. CROSS-COMPILATION TARGET REGISTRY +# +# Architecture | Target ID | GCC march | ISA | C Library +# ------------- | ------------------- | ------------------ | ------ | ---------- +# x86_64 | haswell | haswell | AVX2 | glibc +# x86_64 | haswell-ep | haswell | AVX2 | glibc +# x86_64 | skylake | skylake | AVX2 | glibc +# x86_64 | skylake-x | skylake-avx512 | AVX512 | glibc +# x86_64 | skylake-server | skylake-server | AVX512 | glibc +# x86_64 | znver1 | znver1 | AVX2 | glibc +# x86_64 | znver2 | znver2 | AVX2 | glibc +# x86_64 | znver3 | znver3 | AVX2 | glibc +# x86_64 | znver4 | znver4 | AVX512 | glibc +# x86_64 | apu-zn1 | znver1 | AVX2 | glibc +# x86_64 | apu-zn2 | znver1 | AVX2 | glibc +# x86_64 | apu-zn3 | znver2 | AVX2 | glibc +# x86_64 | apu-zn4 | znver3 | AVX2 | glibc +# x86_64 | atom-silvermont | silvermont | SSE4_2| glibc +# x86_64 | atom-goldmont | goldmont | SSE4_2| glibc +# x86_64 | atom-tremont | tremont | SSE4_2| glibc +# x86_64 | atom-sierraforest | sierraforest | SSE4_2| glibc +# mipsel | mipselr2 | mips32r2 | MIPS32 | musl +# arm | armv7 | armv7-a | NEON | musl +# tilegx | tilegx | tilegx | TILE | musl +# +# Host is always an average x86_64 system. All targets listed above +# are CROSS-COMPILATION targets (CROSS_MODE=1). The --native flag +# auto-probes the host silicon and builds without a target prefix. +# +# Cross targets use SYSROOT-based cross-compilation (CLFS / Buildroot style). +# ============================================================================ + +# Associative array: target_id → property string +# Format: "arch|cpu|march|isa|abi|clib|endian|family|desc|kernel_min|gcc_cfg_extra" +declare -A BTC_TARGETS + +# --- x86_64 Intel family --- +BTC_TARGETS[haswell]="x86_64|i686|haswell|AVX2|sysv|glibc|little|intel|Intel Haswell (Xeon E5 v3 / Core i7-4xxx)|4.19|" +BTC_TARGETS[haswell-ep]="x86_64|i686|haswell|AVX2|sysv|glibc|little|intel|Intel Haswell-EP X99 (Xeon E5 v3 / E7 v3)|4.19|" +BTC_TARGETS[skylake]="x86_64|i686|skylake|AVX2|sysv|glibc|little|intel|Intel Skylake (Core i7-6xxx / Xeon v5)|4.19|" +BTC_TARGETS[skylake-x]="x86_64|i686|skylake-avx512|AVX512|sysv|glibc|little|intel|Intel Skylake-X X299 (Core i9-7xxx Xeon Scalable)|4.19|" +BTC_TARGETS[skylake-server]="x86_64|i686|skylake-server|AVX512|sysv|glibc|little|intel|Intel Skylake-Server (Xeon SP 1st/2nd Gen Platinum)|4.19|" + +# --- x86_64 AMD family --- +BTC_TARGETS[znver1]="x86_64|i686|znver1|AVX2|sysv|glibc|little|amd|AMD Zen1 Ryzen (Ryzen 1000 / EPYC Naples)|4.19|" +BTC_TARGETS[znver2]="x86_64|i686|znver2|AVX2|sysv|glibc|little|amd|AMD Zen2 Ryzen (Ryzen 3000 / EPYC Rome)|4.19|" +BTC_TARGETS[znver3]="x86_64|i686|znver3|AVX2|sysv|glibc|little|amd|AMD Zen3 Ryzen (Ryzen 5000 / EPYC Milan)|4.19|" +BTC_TARGETS[znver4]="x86_64|i686|znver4|AVX512|sysv|glibc|little|amd|AMD Zen4 Ryzen (Ryzen 7000 / EPYC Genoa)|4.19|" + +# --- x86_64 AMD APU family (mobile/embedded Zen, 15-54W TDP) --- +# APU series 1 (Raven Ridge, 2400GE/3200GE) = Zen 1, AVX2, Vega graphics +# APU series 2 (Picasso, 3250U/3500U) = Zen+, AVX2 (GCC march=znver1) +# APU series 3 (Renoir/Lucienne, 4500U/4700U)= Zen 2, AVX2 +# APU series 4 (Cezanne/Barcelo, 5500U/5700U) = Zen 3, AVX2 +# These are cross-compiled from an average x86_64 host for deployment +# on APU-based mini-PCs, laptops, and embedded nodes. +BTC_TARGETS[apu-zn1]="x86_64|i686|znver1|AVX2|sysv|glibc|little|amd-apu|AMD APU Series 1 Zen (Raven Ridge 2400GE / 3200GE Vega)|4.19|" +BTC_TARGETS[apu-zn2]="x86_64|i686|znver1|AVX2|sysv|glibc|little|amd-apu|AMD APU Series 2 Zen+ (Picasso 3250U / 3500U)|4.19|" +BTC_TARGETS[apu-zn3]="x86_64|i686|znver2|AVX2|sysv|glibc|little|amd-apu|AMD APU Series 3 Zen2 (Renoir 4500U / 4700U)|4.19|" +BTC_TARGETS[apu-zn4]="x86_64|i686|znver3|AVX2|sysv|glibc|little|amd-apu|AMD APU Series 4 Zen3 (Cezanne 5500U / 5700U)|4.19|" + +# --- x86_64 Intel Atom family (low-power embedded, 4-15W TDP) --- +# silvermont = Bay Trail (Z3000 series, E38xx) — in-order, SSE4.2 +# goldmont = Apollo Lake (x5-Z8350, N4200) — out-of-order, SSE4.2 +# tremont = Elkhart Lake (x6000E series) — improved OoO, SSE4.2 +# sierraforest= Sierra Forest (x7000RE, E-core) — hybrid, SSE4.2, GCC 14+ +# All Atom targets are cross-compiled for edge/IoT gateways, routers, +# and low-power cluster nodes where AVX is not available. +BTC_TARGETS[atom-silvermont]="x86_64|i686|silvermont|SSE4_2|sysv|glibc|little|atom|Intel Atom Silvermont (Bay Trail Z3000 / E38xx)|4.14|" +BTC_TARGETS[atom-goldmont]="x86_64|i686|goldmont|SSE4_2|sysv|glibc|little|atom|Intel Atom Goldmont (Apollo Lake x5-Z8350 / N4200)|4.14|" +BTC_TARGETS[atom-tremont]="x86_64|i686|tremont|SSE4_2|sysv|glibc|little|atom|Intel Atom Tremont (Elkhart Lake x6000E series)|5.4|" +BTC_TARGETS[atom-sierraforest]="x86_64|i686|sierraforest|SSE4_2|sysv|glibc|little|atom|Intel Atom Sierra Forest (x7000RE E-core cluster)|6.1|" + +# --- MIPS (little-endian, soft-float baseline) --- +# mips32r2 is the ISA baseline for mipselr2 — covers the MALTA-like +# embedded targets that are the closest thing to a "universal mips" +# reference platform. Uses musl because glibc MIPS support is +# fragmented across kernel versions and vendor patches. +BTC_TARGETS[mipselr2]="mipsel|mips|32r2|MIPS32|o32|musl|little|mips|MIPS32R2 Little-Endian (MALTA / embedded routers)|4.9|--with-arch=mips32r2 --with-float=soft --with-abi=32 --disable-libsanitizer" + +# --- ARMv7 (hard-float, Thumb-2, NEON) --- +# armv7-a with NEON and VFPv3-D16 is the "x86 baseline" of the ARM +# world — it covers Raspberry Pi 2/3 (32-bit), BeagleBone, Odroid, +# and virtually every Cortex-A7/A9/A15/A17 SoC. Uses musl for +# cross-compile portability; glibc armv7 is available as a future +# clib variant. +BTC_TARGETS[armv7]="arm|arm|armv7-a|NEON|eabihf|musl|little|arm|ARMv7-A Hard-Float NEON (Cortex-A7/A9/A15 RPi2/3 32b)|4.9|--with-arch=armv7-a --with-fpu=vfpv3-d16 --with-float=hard --with-mode=thumb --enable-target-optspace --disable-libsanitizer --with-abi=aapcs-linux" + +# --- TileGX (Tilera TILE-Gx72/Metor) --- +# The Tile architecture is a 64-bit VLIW mesh network processor. +# GCC upstream dropped mainline Tile-Gx support after GCC 11, so +# we pin GCC 10.3.0 for Tile-Gx targets. The tilegx triple uses +# linux-gnu-abi64. Uses musl as glibc has no Tile-Gx port. +BTC_TARGETS[tilegx]="tilegx|tilegx|tilegx|TILE|abi64|musl|little|tile|Tilera TILE-Gx (TILE-Gx72 / TilePro mesh VLIW)|4.14|--with-arch=tilegx --disable-libssp --disable-libquadmath --disable-libatomic" + +# --- Helper: list all registered targets --- +function f_list_targets() { + echo ">> BTC-0.4.0 Registered Cross-Compilation Targets:" + echo ">> ===============================================" + printf ">> %-16s %-10s %-18s %-8s %-6s %s\n" "TARGET_ID" "ARCH" "MARCH" "ISA" "CLIB" "DESCRIPTION" + printf ">> %-16s %-10s %-18s %-8s %-6s %s\n" "--------" "----" "-----" "---" "----" "-----------" + for tid in $(echo "${!BTC_TARGETS[@]}" | tr ' ' '\n' | sort); do + IFS='|' read -r arch cpu march isa abi clib endian family desc kern_min gcc_extra <<< "${BTC_TARGETS[${tid}]}" + printf ">> %-16s %-10s %-18s %-8s %-6s %s\n" "${tid}" "${arch}" "${march}" "${isa}" "${clib}" "${desc}" + done + echo "" + echo ">> Usage: BTC.sh Build cross-toolchain for target" + echo ">> BTC.sh --native Auto-probe host silicon and build native" + echo ">> BTC.sh --list Show this target table" + echo ">> BTC.sh --list-json Emit target table as JSON" +} + +function f_list_targets_json() { + echo '[' + local first=true + for tid in $(echo "${!BTC_TARGETS[@]}" | tr ' ' '\n' | sort); do + IFS='|' read -r arch cpu march isa abi clib endian family desc kern_min gcc_extra <<< "${BTC_TARGETS[${tid}]}" + if [[ "${first}" == "true" ]]; then first=false; else echo ','; fi + cat << TJSEP + { + "id": "${tid}", + "arch": "${arch}", + "cpu": "${cpu}", + "march": "${march}", + "isa": "${isa}", + "abi": "${abi}", + "clib": "${clib}", + "endian": "${endian}", + "family": "${family}", + "description": "${desc}", + "kernel_min": "${kern_min}", + "gcc_extra": "${gcc_extra}" + }TJSEP + done + echo ']' +} + +# ============================================================================ +# 3. TARGET PROBE & SELECTION +# ============================================================================ + +# Resolved target properties (set by f_resolve_target) +BTC_T_ARCH="" +BTC_T_CPU="" +BTC_T_MARCH="" +BTC_T_ISA="" +BTC_T_ABI="" +BTC_T_CLIB="" +BTC_T_ENDIAN="" +BTC_T_FAMILY="" +BTC_T_DESC="" +BTC_T_KERN_MIN="" +BTC_T_GCC_EXTRA="" +BTC_T_ID="" +CROSS_MODE=0 # 0 = native, 1 = cross + +function f_resolve_target() { + local target_id="$1" + local spec="${BTC_TARGETS[${target_id}]:-}" + + if [[ -z "${spec}" ]]; then + echo ">> [ERROR] Unknown target: '${target_id}'" + echo ">> Run 'BTC.sh --list' for available targets." + exit 1 + fi + + IFS='|' read -r BTC_T_ARCH BTC_T_CPU BTC_T_MARCH BTC_T_ISA BTC_T_ABI BTC_T_CLIB BTC_T_ENDIAN BTC_T_FAMILY BTC_T_DESC BTC_T_KERN_MIN BTC_T_GCC_EXTRA <<< "${spec}" + BTC_T_ID="${target_id}" +} + +function f_silicon_probe() { + echo ">> Interrogating Core Topology and Instruction Extensions..." + + # If an explicit target was passed, use it directly (cross-compile mode) + if [[ -n "${BTC_TARGET_ID:-}" ]]; then + if [[ "${BTC_TARGET_ID}" == "--native" || -z "${BTC_TARGET_ID}" ]]; then + # Native auto-probe path + _probe_native + else + # Cross-compile path + f_resolve_target "${BTC_TARGET_ID}" + CROSS_MODE=1 + _configure_from_target + fi + else + # No argument: auto-probe native (backward compatible) + _probe_native + fi +} + +function _probe_native() { + local RAW_ARCH + RAW_ARCH=$(gcc -march=native -Q --help=target 2>/dev/null | grep -m1 "march=" | awk '{print $2}') || true + + if [[ -z "${RAW_ARCH}" || "${RAW_ARCH}" == "x86-64" ]]; then + RAW_ARCH="haswell" + fi + + # Try to match the probed microarch to a registered target + local matched="" + local probe_lower="${RAW_ARCH,,}" + for tid in "${!BTC_TARGETS[@]}"; do + if [[ "${tid}" == "${probe_lower}" ]]; then + matched="${tid}" + break + fi + done + + if [[ -z "${matched}" ]]; then + # Fallback: use generic "haswell" for unknown x86-64 probed values + echo ">> [WARN] Probed microarch '${RAW_ARCH}' not in target registry. Defaulting to 'haswell'." + matched="haswell" + fi + + f_resolve_target "${matched}" + CROSS_MODE=0 + _configure_from_target +} + +function _configure_from_target() { + # Derive the target triple + case "${BTC_T_ARCH}" in + x86_64) + TARGET="x86_64-dcosnet-linux-gnu" + HOST_ARCH="x86_64-pc-linux-gnu" + ;; + mipsel) + TARGET="mipsel-dcosnet-linux-musl" + HOST_ARCH="x86_64-pc-linux-gnu" + ;; + arm) + TARGET="arm-dcosnet-linux-musleabihf" + HOST_ARCH="x86_64-pc-linux-gnu" + ;; + tilegx) + TARGET="tilegx-dcosnet-linux-gnu" + HOST_ARCH="x86_64-pc-linux-gnu" + ;; + *) + TARGET="${BTC_T_ARCH}-dcosnet-linux-gnu" + HOST_ARCH="x86_64-pc-linux-gnu" + ;; + esac + + # ISA tag for SYS_LABEL + ISA_TAG="${BTC_T_ISA}" + OPT_TAG="LTO" + SYS_LABEL="DCOSNET-${BTC_T_ID^^}-${ISA_TAG}-${OPT_TAG}" + + # Override SYS_LABEL for cross-compiles to include the arch family + if [[ "${CROSS_MODE}" -eq 1 ]]; then + SYS_LABEL="DCOSNET-${BTC_T_FAMILY^^}-${BTC_T_ID^^}-${ISA_TAG}-CROSS" + fi + + # Resource-Safe Threading: Allocate 2GB RAM per core floor to prevent LTO thrashing + local total_cpus + total_cpus=$(nproc) + local free_gb + free_gb=$(free -g | awk '/^Mem:/{print $7}') + local safe_threads=$(( free_gb / 2 )) + + if [[ ${safe_threads} -lt 1 ]]; then safe_threads=1; fi + if [[ ${safe_threads} -gt ${total_cpus} ]]; then safe_threads=${total_cpus}; fi + export v_threads="-j${safe_threads}" + + # Pin GCC version for Tile-Gx (upstream dropped after GCC 11) + if [[ "${BTC_T_FAMILY}" == "tile" ]]; then + v_gcc='gcc-10.3.0' + fi + + echo ">> [IDENTITY STAMP] ${SYS_LABEL}" + echo ">> [TARGET] ${BTC_T_ID} — ${BTC_T_DESC}" + echo ">> [TRIPLE] ${TARGET}" + echo ">> [C LIBRARY] ${BTC_T_CLIB}" + echo ">> [MODE] $([ "${CROSS_MODE}" -eq 1 ] && echo "CROSS-COMPILE" || echo "NATIVE")" + echo ">> [THREAD ALLOCATION] Probed ${total_cpus} cores -> Throttled to ${v_threads} for LTO Safety." +} + +# ============================================================================ +# 4. SYSTEM PATHS & STAGING MATRIX +# ============================================================================ +export SOURCES_ACTIVE=/usr/src +export BTC_ARCHIVE=/opt/BTC +export SOURCE_CACHE=${BTC_ARCHIVE}/src +export RAMDISK_SIZE="12gb" + +# Upstream Production Matrices (defaults — can be overridden per-target) +v_linux='linux-7.1' +v_binutils='binutils-2.46' +v_gcc='gcc-14.2.0' +v_glibc='glibc-2.41' +v_libxcrypt='4.4.36' +v_gmp='gmp-6.3.0' +v_mpfr='mpfr-4.2.1' +v_mpc='mpc-1.3.1' +v_musl='musl-1.2.5' +v_linux_headers='linux-6.12.y' + +# These are set after f_resolve_target: +# NEWROOT, LOGS, HOST_ARCH, TARGET, TARGET_ARCH, GLOBAL_CFLAGS, GLOBAL_LDFLAGS + +function f_set_paths() { + export NEWROOT="${SOURCES_ACTIVE}/${SYS_LABEL}-cleanroom" + export LOGS="${BTC_ARCHIVE}/logs/${SYS_LABEL}" + + # Architecture-specific optimization flags + # For non-x86_64, march maps to the per-arch value from the target registry + local march_flag="${BTC_T_MARCH}" + + # ISA-specific extra flags (table-driven via case — SEI CERT CTR50-JP) + local isa_extra="" + case "${BTC_T_ISA}" in + AVX512) isa_extra=" -mavx512f -mavx512dq -mavx512vl -mavx512bw" ;; + AVX2) isa_extra=" -mavx2" ;; + SSE4_2) isa_extra=" -msse4.2" ;; + NEON) isa_extra=" -mfpu=neon -mfloat-abi=hard" ;; + MIPS32) isa_extra="" ;; + TILE) isa_extra="" ;; + esac + + # C library choice affects linker paths and configure flags + if [[ "${BTC_T_CLIB}" == "musl" ]]; then + # musl provides its own headers; we still need kernel headers for + # syscall definitions, but the C library headers come from musl. + # --sysroot must point at NEWROOT which will contain musl installed. + export GLOBAL_CFLAGS="-O3 -march=${march_flag}${isa_extra} -flto -ffat-lto-objects --sysroot=${NEWROOT} -pipe" + else + export GLOBAL_CFLAGS="-O3 -march=${march_flag}${isa_extra} -flto -ffat-lto-objects --sysroot=${NEWROOT} -pipe" + fi + export GLOBAL_LDFLAGS="-Wl,-O1 -Wl,--as-needed -flto --sysroot=${NEWROOT}" + + # For native x86_64 builds, keep the i686 build cpu + if [[ "${CROSS_MODE}" -eq 0 && "${BTC_T_ARCH}" == "x86_64" ]]; then + TARGET_ARCH="${BTC_T_MARCH}" + else + TARGET_ARCH="${BTC_T_ID}" + fi +} + +# ============================================================================ +# 5. HARDWARE SENTINEL & TELEMETRY MODULES +# ============================================================================ +function f_guard() { + local max_temp=85 + local min_mem=800 + local cur_temp + local cur_mem + + # Thermal zones may not exist in containers; guard gracefully + if [[ -d /sys/class/thermal ]]; then + cur_temp=$(cat /sys/class/thermal/thermal_zone*/temp 2>/dev/null | head -n1 | awk '{print $1/1000}') || cur_temp=0 + else + cur_temp=0 + fi + cur_mem=$(free -m | awk '/^Mem:/{print $7}') + + if (( ${cur_temp%.*} > max_temp )); then + echo ">> [WARNING: THERMAL SPIKE] Temp at ${cur_temp}C. Throttling build for cooling phase..." + sleep 15 + fi + if [[ ${cur_mem} -lt ${min_mem} ]]; then + echo ">> [WARNING: MEMORY SATURATION] Free memory at ${cur_mem}MB. Yielding pipeline execution..." + sleep 20 + fi +} + +function f_entropy_shield() { + local min_entropy=1000 + local cur_entropy + if [[ -f /proc/sys/kernel/random/entropy_avail ]]; then + cur_entropy=$(cat /proc/sys/kernel/random/entropy_avail) + if [[ ${cur_entropy} -lt ${min_entropy} ]]; then + echo ">> [ENTROPY DEFICIT] Pool dropped to ${cur_entropy}. Injecting safe hardware-jitter..." + find /bin /sbin -type f -exec ls -l {} + > /dev/null 2>&1 & + sleep 2 + kill $! 2>/dev/null || true + fi + fi +} + +function f_exec_log() { + local cmd="$1" + local log_base="$2" + + f_entropy_shield + f_guard + + echo ">> Executing: ${log_base}" + # Note: ${cmd} is sourced from internal build functions only (not user input). + # The trust boundary is the BTC.sh script itself — do not expose f_exec_log + # as a public API with externally-supplied command strings. + stdbuf -oL -eL bash -c "${cmd}" 2>&1 | \ + pv -t -r -b -N "${log_base}" | \ + tee -a "${LOGS}/${log_base}.log" > /dev/null +} + +function f_tmux_dashboard() { + if [[ -n "${TMUX:-}" ]]; then + echo ">> Active Tmux session identified. Splitting target tracking matrix..." + tmux split-window -h -p 35 "tail -F \"${LOGS}\"/*.log" || true + tmux split-window -v -p 50 "watch -n 2 'echo \"=== ENTROPY POOL ===\"; cat /proc/sys/kernel/random/entropy_avail; echo \"=== NETWORK BOUND MATRIX ===\"; ss -tunp | grep -v 127.0.0.1'" || true + tmux select-pane -t 0 || true + fi +} + +# ============================================================================ +# 6. FORENSIC IDENTITY STAMPING LAYER +# ============================================================================ +function f_stamp_binary() { + local target_bin="$1" + local log_base="$2" + + if [[ -f "${target_bin}" && ! -L "${target_bin}" ]]; then + # 1. Inject ELF Object Note — use the target's cross-assembler when + # building for a different architecture, so the .note.BTC section + # uses the correct ELF format (e.g., 32-bit LE for ARMv7). + local assembler="gcc" + if [[ "${CROSS_MODE}" -eq 1 ]]; then + assembler="${TARGET}-gcc" + fi + + cat << EOF > btc_stamp.s +.section .note.BTC,"a",@note +.long 2f - 1f +.long 4f - 3f +.long 1 +1: .asciz "DCOSNET" +2: .align 4 +3: .ascii "Org: dcos.net|K:${v_linux}|Arch:${BTC_T_ID}|Label:${SYS_LABEL}|Forge:${log_base}" +4: .align 4 +EOF + ${assembler} -c btc_stamp.s -o btc_stamp.o + ${TARGET}-objcopy --add-section .note.BTC=btc_stamp.o "${target_bin}" 2>/dev/null || \ + objcopy --add-section .note.BTC=btc_stamp.o "${target_bin}" 2>/dev/null || true + rm -f btc_stamp.s btc_stamp.o + + # 2. Append Extended Filesystem Attributes Ledger + local bin_hash + bin_hash=$(sha256sum "${target_bin}" | awk '{print $1}') + setfattr -n user.btc.identity -v "BTC-${SYS_LABEL}-${v_linux}-sovereign" "${target_bin}" 2>/dev/null || true + setfattr -n user.btc.hash -v "${bin_hash}" "${target_bin}" 2>/dev/null || true + + # 3. Separate Debug Symbols & Create External Links + if [[ "${BTC_STRIP_MODE:-1}" -eq 1 ]]; then + mkdir -p "${BTC_ARCHIVE}/symbols/${SYS_LABEL}" + ${TARGET}-objcopy --only-keep-debug "${target_bin}" "${BTC_ARCHIVE}/symbols/${SYS_LABEL}/${log_base}.debug" 2>/dev/null || \ + objcopy --only-keep-debug "${target_bin}" "${BTC_ARCHIVE}/symbols/${SYS_LABEL}/${log_base}.debug" 2>/dev/null || true + ${TARGET}-strip --strip-unneeded "${target_bin}" 2>/dev/null || \ + strip --strip-unneeded "${target_bin}" 2>/dev/null || true + ${TARGET}-objcopy --add-gnu-debuglink="${BTC_ARCHIVE}/symbols/${SYS_LABEL}/${log_base}.debug" "${target_bin}" 2>/dev/null || \ + objcopy --add-gnu-debuglink="${BTC_ARCHIVE}/symbols/${SYS_LABEL}/${log_base}.debug" "${target_bin}" 2>/dev/null || true + fi + fi +} + +# ============================================================================ +# 7. CLEANROOM MATRIX CONFIGURATION +# ============================================================================ +function f_setup() { + echo ">> Preparing Virtualized Cleanroom Environment..." + mkdir -p "${SOURCE_CACHE}" "${LOGS}" "${BTC_ARCHIVE}/symbols/${SYS_LABEL}" + + if ! mountpoint -q "${SOURCES_ACTIVE}"; then + mount -t ramfs -o "size=${RAMDISK_SIZE}" ramfs "${SOURCES_ACTIVE}" + echo ">> Ramfs Cleanroom mounted at ${SOURCES_ACTIVE} with ceiling ${RAMDISK_SIZE}." + fi + + mkdir -p "${NEWROOT}" + cd "${NEWROOT}" + + # Create sysroot directory structure + mkdir -p bin etc lib lib64 sbin usr var include + + # Architecture-specific sysroot layout + case "${BTC_T_ARCH}" in + x86_64) + ln -sfv lib "${NEWROOT}/lib64" + ;; + arm) + # ARM EABI HF uses lib + lib/ld-linux-armhf.so.3 + ln -sfv lib "${NEWROOT}/lib32" 2>/dev/null || true + ;; + mipsel) + # MIPS o32 ABI: lib is the primary lib dir + ;; + tilegx) + # Tile-Gx 64-bit: lib64 for abi64 + ln -sfv lib "${NEWROOT}/lib64" 2>/dev/null || true + ;; + esac + + export PATH="${NEWROOT}/bin:${PATH}" +} + +# ============================================================================ +# 8. TOOLCHAIN BUILD FUNCTIONS +# ============================================================================ + +# --- 8a. Binutils (all architectures) --- +function f_binutils() { + cd "${SOURCES_ACTIVE}" + tar -xf "${SOURCE_CACHE}/${v_binutils}.tar.xz" + mkdir -p "${v_binutils}-build" && cd "${v_binutils}-build" + + local configure_target="--target=${TARGET}" + + # Architecture-specific binutils configure patches + local binutils_extra="" + case "${BTC_T_ARCH}" in + arm) + binutils_extra="--enable-multilib --with-sysroot=${NEWROOT}" + ;; + mipsel) + binutils_extra="--enable-multilib --with-sysroot=${NEWROOT}" + ;; + tilegx) + binutils_extra="--disable-werror" + ;; + *) + binutils_extra="--enable-default-hash-style=gnu" + ;; + esac + + local build_cmd="../${v_binutils}/configure \ + --prefix=${NEWROOT} \ + --with-sysroot=${NEWROOT} \ + ${configure_target} \ + --disable-nls \ + --enable-gprofng=no \ + --disable-werror \ + ${binutils_extra}" + + f_exec_log "${build_cmd}" "binutils-configure" + f_exec_log "make ${v_threads}" "binutils-make" + f_exec_log "make install" "binutils-install" +} + +# --- 8b. Kernel Headers (all architectures) --- +function f_kernel_headers() { + cd "${SOURCES_ACTIVE}" + + # Use stable LTS headers for cross targets that may need older kernels + local kernel_src="${v_linux}" + if [[ "${BTC_T_FAMILY}" == "tile" ]]; then + kernel_src="${v_linux_headers}" + fi + + # For musl targets, we only need sanitized kernel headers (no full + # kernel source). For glibc targets we need the full headers. + tar -xf "${SOURCE_CACHE}/${kernel_src}.tar.xz" + cd "${kernel_src}" + + f_exec_log "make mrproper" "kernel-headers-clean" + f_exec_log "make headers" "kernel-headers-generate" + + find usr/include -type f ! -name '*.h' -delete + mkdir -p "${NEWROOT}/usr/include" + cp -rv usr/include/* "${NEWROOT}/usr/include" +} + +# --- 8c. GCC Stage 1 (all architectures) --- +function f_gcc_p1() { + cd "${SOURCES_ACTIVE}" + tar -xf "${SOURCE_CACHE}/${v_gcc}.tar.xz" + cd "${v_gcc}" + + # Nesting Support Libraries internally for Stage-1 execution isolation + tar -xf "${SOURCE_CACHE}/${v_gmp}.tar.xz" && mv -v "${v_gmp}" gmp + tar -xf "${SOURCE_CACHE}/${v_mpfr}.tar.xz" && mv -v "${v_mpfr}" mpfr + tar -xf "${SOURCE_CACHE}/${v_mpc}.tar.gz" && mv -v "${v_mpc}" mpc + + # Architecture-specific GCC source patches + case "${BTC_T_ARCH}" in + x86_64) + # Enforce 64-bit dynamic linker structural target pathing + sed -e '/m64=/s/lib64/lib/' -i.bak gcc/config/i386/t-linux64 + ;; + arm) + # ARM: default to hard-float ABI + sed -e 's/#define DEFAULT_ABI_FLOAT SoftF/SoftF_HARDFP/' -i.bak gcc/config/arm/linux-eabi.h 2>/dev/null || true + ;; + mipsel) + # MIPS: default to o32 ABI, soft-float + ;; + tilegx) + # Tile-Gx: no special patches needed for GCC 10.3.0 + ;; + esac + + mkdir -p "${SOURCES_ACTIVE}/${v_gcc}-phase1" && cd "${SOURCES_ACTIVE}/${v_gcc}-phase1" + + # Base configure flags common to all targets + local gcc_base="--target=${TARGET} \ + --prefix=${NEWROOT} \ + --with-sysroot=${NEWROOT} \ + --with-newlib \ + --without-headers \ + --with-arch=${BTC_T_MARCH} \ + --with-cpu=${BTC_T_MARCH} \ + --enable-default-pie \ + --enable-default-ssp \ + --disable-nls \ + --disable-shared \ + --disable-threads \ + --disable-libatomic \ + --disable-libgomp \ + --disable-libquadmath \ + --disable-libssp \ + --disable-libvtv \ + --disable-libstdcxx \ + --enable-languages=c,c++" + + # Per-architecture configure adjustments + local gcc_arch_extra="" + case "${BTC_T_CLIB}" in + glibc) + # x86_64 glibc targets: set glibc version for compatibility checks + gcc_arch_extra="--with-glibc-version=${v_glibc#*-} --disable-multilib" + ;; + musl) + # Cross targets with musl: disable multilib by default, add arch-specific flags + gcc_arch_extra="--disable-multilib ${BTC_T_GCC_EXTRA}" + ;; + esac + + local build_cmd="../${v_gcc}/configure ${gcc_base} ${gcc_arch_extra}" + + f_exec_log "${build_cmd}" "gcc-p1-configure" + f_exec_log "make ${v_threads} all-gcc" "gcc-p1-make" + f_exec_log "make ${v_threads} all-target-libgcc" "gcc-p1-libgcc" + f_exec_log "make install-gcc" "gcc-p1-install" + f_exec_log "make install-target-libgcc" "gcc-p1-install-libgcc" +} + +# --- 8d. C Library (glibc or musl) --- +function f_clib() { + case "${BTC_T_CLIB}" in + glibc) f_glibc ;; + musl) f_musl ;; + *) + echo ">> [ERROR] Unsupported C library: ${BTC_T_CLIB}" + exit 1 + ;; + esac +} + +function f_glibc() { + cd "${SOURCES_ACTIVE}" + tar -xf "${SOURCE_CACHE}/${v_glibc}.tar.xz" + mkdir -p "${v_glibc}-build" && cd "${v_glibc}-build" + + # glibc only supports x86_64 (and a few others) — for non-x86 targets + # this function should not be called. Guard: + if [[ "${BTC_T_ARCH}" != "x86_64" ]]; then + echo ">> [ERROR] glibc does not support ${BTC_T_ARCH}. Use musl via the target registry." + exit 1 + fi + + local build_cmd="../${v_glibc}/configure \ + --prefix=/usr \ + --host=${TARGET} \ + --build=${HOST_ARCH} \ + --enable-kernel=${BTC_T_KERN_MIN} \ + --with-headers=${NEWROOT}/usr/include \ + --disable-profile \ + --enable-stack-protector=strong \ + --disable-werror \ + libc_cv_slibdir=/usr/lib" + + f_exec_log "${build_cmd}" "glibc-configure" + f_exec_log "make ${v_threads}" "glibc-make" + f_exec_log "make DESTDIR=${NEWROOT} install" "glibc-install" + + # Sanitize hardcoded host system configurations from dynamic script linkage + sed -i "s|${NEWROOT}||g" "${NEWROOT}/usr/bin/ldd" +} + +function f_libxcrypt() { + # libxcrypt is only used with glibc — musl has built-in crypt support + if [[ "${BTC_T_CLIB}" != "glibc" ]]; then + echo ">> [SKIP] libxcrypt: not needed for ${BTC_T_CLIB}" + return 0 + fi + + cd "${SOURCES_ACTIVE}" + tar -xf "${SOURCE_CACHE}/libxcrypt-${v_libxcrypt}.tar.xz" + cd "libxcrypt-${v_libxcrypt}" + + local build_cmd="./configure \ + --prefix=/usr \ + --host=${TARGET} \ + --build=${HOST_ARCH} \ + --enable-hashes=strong,glibc \ + --enable-obsolete-api=no \ + --disable-static" + + f_exec_log "${build_cmd}" "libxcrypt-configure" + f_exec_log "make ${v_threads}" "libxcrypt-make" + f_exec_log "make DESTDIR=${NEWROOT} install" "libxcrypt-install" +} + +function f_musl() { + # musl: lightweight C library for cross-compilation + # Used by mipsel, armv7, and tilegx targets. + # Reference: CLFS (Cross Linux From Scratch) musl cross-compiler chapter. + cd "${SOURCES_ACTIVE}" + tar -xf "${SOURCE_CACHE}/${v_musl}.tar.gz" + cd "${v_musl}" + + # Build a standalone musl cross-compiler that wraps our stage-1 GCC. + # This produces ${TARGET}-musl-gcc and the musl C library installed + # into the sysroot. + local musl_configure="./configure \ + --prefix=/usr \ + --host=${TARGET} \ + --build=${HOST_ARCH} \ + --disable-shared \ + --enable-static" + + # For some targets, musl needs additional architecture hints + case "${BTC_T_ARCH}" in + arm) + musl_configure="${musl_configure} CFLAGS=\"-O2 -march=armv7-a -mfloat-abi=hard -mfpu=vfpv3-d16\"" + ;; + mipsel) + musl_configure="${musl_configure} CFLAGS=\"-O2 -march=mips32r2 -mabi=32 -msoft-float\"" + ;; + tilegx) + musl_configure="${musl_configure} CFLAGS=\"-O2 -march=tilegx\"" + ;; + esac + + # Use the cross compiler from stage-1 + local cross_cc="${NEWROOT}/bin/${TARGET}-gcc" + local cross_ar="${NEWROOT}/bin/${TARGET}-ar" + export CC="${cross_cc}" + export AR="${cross_ar}" + export RANLIB="${NEWROOT}/bin/${TARGET}-ranlib" + + f_exec_log "CROSS_COMPILE=${TARGET}- ${musl_configure}" "musl-configure" + f_exec_log "make ${v_threads}" "musl-make" + f_exec_log "make DESTDIR=${NEWROOT} install" "musl-install" + + # Clean cross-compile env vars + unset CC AR RANLIB +} + +# --- 8e. GCC Stage 2 (final compiler) --- +function f_gcc_p2() { + cd "${SOURCES_ACTIVE}" + cd "${v_gcc}" + + tar -xf "${SOURCE_CACHE}/${v_gmp}.tar.xz" --skip-old-files || true + tar -xf "${SOURCE_CACHE}/${v_mpfr}.tar.xz" --skip-old-files || true + tar -xf "${SOURCE_CACHE}/${v_mpc}.tar.gz" --skip-old-files || true + + mkdir -p "${SOURCES_ACTIVE}/${v_gcc}-phase2" && cd "${SOURCES_ACTIVE}/${v_gcc}-phase2" + + # Base configure for stage 2 — all targets + local gcc_p2_base="--prefix=/usr \ + --host=${TARGET} \ + --build=${HOST_ARCH} \ + --with-arch=${BTC_T_MARCH} \ + --with-cpu=${BTC_T_MARCH} \ + --enable-languages=c,c++ \ + --enable-default-pie \ + --enable-default-ssp \ + --disable-bootstrap" + + # Per-C-library configure adjustments + local gcc_p2_clib="" + case "${BTC_T_CLIB}" in + glibc) + gcc_p2_clib="--disable-multilib --with-sysroot=${NEWROOT}" + ;; + musl) + # musl targets: point GCC at the musl sysroot for C library + # headers and runtime. --with-headers and --with-libs link + # GCC to the musl installation from f_musl(). + gcc_p2_clib="--disable-multilib \ + --with-sysroot=${NEWROOT} \ + --with-headers=${NEWROOT}/usr/include \ + --with-libs=${NEWROOT}/usr/lib \ + ${BTC_T_GCC_EXTRA}" + ;; + esac + + local build_cmd="../${v_gcc}/configure ${gcc_p2_base} ${gcc_p2_clib}" + + f_exec_log "${build_cmd}" "gcc-p2-configure" + f_exec_log "make ${v_threads}" "gcc-p2-make" + f_exec_log "make DESTDIR=${NEWROOT} install" "gcc-p2-install" +} + +# --- 8f. Kernel Binary (architecture-aware) --- +function f_kernel_binary() { + local kernel_src="${v_linux}" + if [[ "${BTC_T_FAMILY}" == "tile" ]]; then + kernel_src="${v_linux_headers}" + fi + + cd "${SOURCES_ACTIVE}/${kernel_src}" + + echo ">> Instantiating Silicon Optimized Monolithic Configuration Matrix for ${BTC_T_ARCH}..." + + # Select the correct defconfig for the target architecture + case "${BTC_T_ARCH}" in + x86_64) + make defconfig + ;; + arm) + # Multi-v7 is the universal ARMv7 defconfig (covers most Cortex-A SoCs) + make multi_v7_defconfig + ;; + mipsel) + # MALTA is the reference MIPS32 platform + make malta_defconfig + ;; + tilegx) + # Tile-Gx has its own defconfig + make tilegx_defconfig 2>/dev/null || make defconfig + ;; + *) + make defconfig + ;; + esac + + # Inject Custom Enterprise Swarm Labels & Architecture Parameters + sed -i "s/CONFIG_LOCALVERSION=\"\"/CONFIG_LOCALVERSION=\"-dcosnet-${SYS_LABEL}\"/" .config + + # Modern Hardening Optimization Suite Injection + sed -i "s/# CONFIG_MODULES is not set/CONFIG_MODULES=n/" .config || true + echo "CONFIG_MODULES=n" >> .config + echo "CONFIG_KALLSYMS=n" >> .config + echo "CONFIG_DEBUG_FS=n" >> .config + + # Cross-compile kernel for non-x86_64 targets + local kernel_make_vars="ARCH=${BTC_T_ARCH} CROSS_COMPILE=${TARGET}-" + if [[ "${BTC_T_ARCH}" == "arm" ]]; then + kernel_make_vars="ARCH=arm CROSS_COMPILE=${TARGET}-" + fi + + f_exec_log "make ${kernel_make_vars} olddefconfig" "kernel-bin-config-merge" + f_exec_log "make ${v_threads} ${kernel_make_vars} LOCALVERSION=-dcosnet-${SYS_LABEL}" "kernel-bin-make" + + # Install kernel image — path varies by architecture + mkdir -p "${NEWROOT}/boot" + case "${BTC_T_ARCH}" in + x86_64) + cp -v arch/x86/boot/bzImage "${NEWROOT}/boot/vmlinuz-${v_linux}-${SYS_LABEL}-sovereign" + ;; + arm) + cp -v arch/arm/boot/zImage "${NEWROOT}/boot/vmlinuz-${v_linux}-${SYS_LABEL}-sovereign" 2>/dev/null || \ + cp -v arch/arm/boot/Image "${NEWROOT}/boot/vmlinuz-${v_linux}-${SYS_LABEL}-sovereign" + # Also copy device tree blobs if built + find arch/arm/boot/dts -name '*.dtb' -exec cp -v {} "${NEWROOT}/boot/" \; 2>/dev/null || true + ;; + mipsel) + cp -v vmlinux "${NEWROOT}/boot/vmlinuz-${v_linux}-${SYS_LABEL}-sovereign" + ;; + tilegx) + cp -v arch/tile/boot/vmlinux "${NEWROOT}/boot/vmlinuz-${v_linux}-${SYS_LABEL}-sovereign" 2>/dev/null || \ + cp -v vmlinux "${NEWROOT}/boot/vmlinuz-${v_linux}-${SYS_LABEL}-sovereign" + ;; + esac + + # Apply Forensic Engine Analysis Verification Stamps to Core Cross-Compiler Tooling + find "${NEWROOT}/bin" "${NEWROOT}/usr/bin" -type f -exec bash -c 'f_stamp_binary "$1" "$(basename "$1")"' _ {} \; || true +} + +# ============================================================================ +# 9. PACKAGING +# ============================================================================ +function f_package() { + echo ">> Packaging Production Golden Image Artifact Target Matrix..." + cd "${NEWROOT}" + + # --- Integration Manifest for sorcery-go and Fester --- + local manifest="${BTC_ARCHIVE}/${SYS_LABEL}-manifest.json" + local mode_label="native" + if [[ "${CROSS_MODE}" -eq 1 ]]; then mode_label="cross"; fi + + cat > "${manifest}" << MANIFEST_EOF +{ + "btc_version": "0.4.0", + "mode": "${mode_label}", + "cross_mode": ${CROSS_MODE}, + "sys_label": "${SYS_LABEL}", + "target_id": "${BTC_T_ID}", + "target_arch": "${BTC_T_ARCH}", + "target_cpu": "${BTC_T_CPU}", + "target_march": "${BTC_T_MARCH}", + "target_triple": "${TARGET}", + "host_arch": "${HOST_ARCH}", + "isa_tag": "${ISA_TAG}", + "opt_tag": "${OPT_TAG}", + "abi": "${BTC_T_ABI}", + "clib": "${BTC_T_CLIB}", + "endian": "${BTC_T_ENDIAN}", + "family": "${BTC_T_FAMILY}", + "description": "${BTC_T_DESC}", + "kernel_min": "${BTC_T_KERN_MIN}", + "kernel": "${v_linux}", + "binutils": "${v_binutils}", + "gcc": "${v_gcc}", + "glibc": "${v_glibc}", + "musl": "${v_musl}", + "libxcrypt": "libxcrypt-${v_libxcrypt}", + "golden_image": "${SYS_LABEL}-toolchain-golden.tar.xz", + "cflags": "${GLOBAL_CFLAGS}", + "ldflags": "${GLOBAL_LDFLAGS}", + "stamp_note": ".note.BTC", + "stamp_xattr_identity": "user.btc.identity", + "stamp_xattr_hash": "user.btc.hash", + "org": "dcos.net", + "license": "AGPL-3.0-or-later", + "integrations": { + "sorcery-go": { + "config_key": "toolchain", + "config_value": "btc", + "env_btc_path": "SORCERY_GO_BTC_PATH", + "env_btc_root": "SORCERY_GO_BTC_ROOT", + "env_btc_syslabel": "SORCERY_GO_BTC_SYS_LABEL" + }, + "fester": { + "config_section": "btc", + "config_yaml_key": "btc.enabled / btc.root / btc.target" + } + } +} +MANIFEST_EOF + echo ">> [INTEGRATION] Manifest written to: ${manifest}" + + tar -cf - . | xz -9 -T 0 > "${BTC_ARCHIVE}/${SYS_LABEL}-toolchain-golden.tar.xz" + echo ">> [SUCCESS] Archive deployed cleanly to: ${BTC_ARCHIVE}/${SYS_LABEL}-toolchain-golden.tar.xz" + + # Generate SHA-256 checksums of the golden image for CAS integration. + local checksum_file="${BTC_ARCHIVE}/${SYS_LABEL}-toolchain-golden.sha256" + sha256sum "${BTC_ARCHIVE}/${SYS_LABEL}-toolchain-golden.tar.xz" > "${checksum_file}" + echo ">> [INTEGRATION] SHA-256 checksum written to: ${checksum_file}" +} + +# ============================================================================ +# 10. MAIN ENTRY RUNTIME MATRIX +# ============================================================================ +function f_main() { + [[ ${EUID} -ne 0 ]] && { echo ">> Error: Root privileges required."; exit 1; } + + # Parse command-line arguments + case "${1:-}" in + --list) + f_list_targets + exit 0 + ;; + --list-json) + f_list_targets_json + exit 0 + ;; + --help|-h) + echo "BTC-0.4.0.sh - Sovereign Cross-Compilation Toolchain Forge" + echo "" + echo "Usage: BTC.sh [TARGET_ID | --native | --list | --list-json]" + echo "" + echo " TARGET_ID Build cross-toolchain for the specified target" + echo " --native Auto-probe host silicon and build native toolchain" + echo " --list List all registered cross-compilation targets" + echo " --list-json Emit target registry as JSON" + echo "" + echo "No argument defaults to --native (backward compatible)." + f_list_targets + exit 0 + ;; + *) + export BTC_TARGET_ID="${1:-}" + ;; + esac + + f_agpl_header + f_silicon_probe + f_set_paths + f_setup + f_tmux_dashboard + + # Linear Forge Execution Sequence + f_binutils + f_kernel_headers + f_gcc_p1 + f_clib # glibc OR musl (depending on target registry) + f_libxcrypt # glibc-only (skipped for musl targets) + f_gcc_p2 + f_kernel_binary + f_package + + # Clear volatile memory cleanrooms + cd / + umount -l "${SOURCES_ACTIVE}" 2>/dev/null || true + echo ">> [COMPLETE] Sovereign Forge Build Finished Successfully under AGPLv3 Framework." + echo ">> [TARGET] ${BTC_T_ID} (${BTC_T_DESC})" + echo ">> [LABEL] ${SYS_LABEL}" + echo ">> [IMAGE] ${BTC_ARCHIVE}/${SYS_LABEL}-toolchain-golden.tar.xz" +} + +f_main "$@" \ No newline at end of file diff --git a/COURTESY b/COURTESY new file mode 100755 index 0000000..a89182c --- /dev/null +++ b/COURTESY @@ -0,0 +1,32 @@ +Source Cache and Upstream Courtesy Policy +========================================== + +Automated bulk retrieval of source archives places measurable load on upstream +hosting infrastructure — GNU FTP mirrors, kernel.org, and similar services are +public resources funded and maintained by their respective communities. +Uncontrolled repeated downloads from build scripts and CI pipelines constitute a +denial-of-service risk against these mirrors. + +BTC.sh mitigates this by maintaining a persistent local source cache under +/opt/BTC/sources/. Once a tarball is fetched, it is retained for all subsequent +forge invocations. The forge will not re-download an archive that already +exists in the cache and passes integrity verification. + +Users and integrators are expected to honor this policy: + + 1. Preserve the local source cache between builds. Do not routinely purge + /opt/BTC/sources/ unless disk recovery is necessary. + + 2. Avoid wrapping BTC.sh in loops or CI jobs that discard the cache on + each run. If transient storage is required, mirror the cache directory + to persistent media between invocations. + + 3. When operating behind a mirror or proxy, configure it to cache source + archives in accordance with the same principles. + + 4. Respect upstream rate limits and mirror redistribution policies. + These projects provide critical infrastructure at no cost; responsible + consumption ensures their continued availability. + +This policy aligns with the broader ethic of sovereign infrastructure: +self-sufficiency includes responsible stewardship of shared resources. \ No newline at end of file diff --git a/LICENSE b/LICENSE new file mode 100755 index 0000000..e503be4 --- /dev/null +++ b/LICENSE @@ -0,0 +1,679 @@ +======================================================================== +PROJECT: BTC.sh (BuildToolChain) +COPYRIGHT: Copyright (C) 2026 dcos.net +HOMEPAGE: https://git.dcos.net/dcosnet/BuildToolChain/ +REPOSITORY: https://git.dcos.net/dcosnet/BuildToolChain/ +LICENSE: GNU Affero General Public License v3.0 (AGPL-3.0) +======================================================================== + GNU AFFERO GENERAL PUBLIC LICENSE + Version 3, 19 November 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU Affero General Public License is a free, copyleft license for +software and other kinds of works, specifically designed to ensure +cooperation with the community in the case of network server software. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +our General Public Licenses are intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + Developers that use our General Public Licenses protect your rights +with two steps: (1) assert copyright on the software, and (2) offer +you this License which gives you legal permission to copy, distribute +and/or modify the software. + + A secondary benefit of defending all users' freedom is that +improvements made in alternate versions of the program, if they +receive widespread use, become available for other developers to +incorporate. Many developers of free software are heartened and +encouraged by the resulting cooperation. However, in the case of +software used on network servers, this result may fail to come about. +The GNU General Public License permits making a modified version and +letting the public access it on a server without ever releasing its +source code to the public. + + The GNU Affero General Public License is designed specifically to +ensure that, in such cases, the modified source code becomes available +to the community. It requires the operator of a network server to +provide the source code of the modified version running there to the +users of that server. Therefore, public use of a modified version, on +a publicly accessible server, gives the public access to the source +code of the modified version. + + An older license, called the Affero General Public License and +published by Affero, was designed to accomplish similar goals. This is +a different license, not a version of the Affero GPL, but Affero has +released a new version of the Affero GPL which permits relicensing under +this license. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU Affero General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Remote Network Interaction; Use with the GNU General Public License. + + Notwithstanding any other provision of this License, if you modify the +Program, your modified version must prominently offer all users +interacting with it remotely through a computer network (if your version +supports such interaction) an opportunity to receive the Corresponding +Source of your version by providing access to the Corresponding Source +from a network server at no charge, through some standard or customary +means of facilitating copying of software. This Corresponding Source +shall include the Corresponding Source for any work covered by version 3 +of the GNU General Public License that is incorporated pursuant to the +following paragraph. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the work with which it is combined will remain governed by version +3 of the GNU General Public License. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU Affero General Public License from time to time. Such new versions +will be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU Affero General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU Affero General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU Affero General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If your software can interact with users remotely through a computer +network, you should also make sure that it provides a way for users to +get its source. For example, if your program is a web application, its +interface could display a "Source" link that leads users to an archive +of the code. There are many ways you could offer source, and different +solutions will be better for different programs; see section 13 for the +specific requirements. + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU AGPL, see +. + +------------------------------------------------------------------------ +APPENDIX: HOW TO APPLY THESE TERMS TO YOUR NEW PROGRAMS + +To ensure your repository complies with the remote network interaction +requirements (Section 13 of the AGPLv3), you must ensure users +interacting with your stack can access the source code. + +This project, BuildToolChain, complies by maintaining its primary development +repository at https://git.dcos.net. Any derivative works must retain +this notice and provide equivalent access to source code. \ No newline at end of file diff --git a/NOTES b/NOTES new file mode 100755 index 0000000..615fe08 --- /dev/null +++ b/NOTES @@ -0,0 +1,127 @@ +# BTC.sh — Development Notes + +## Provenance + +BTC.sh (Build Tool Chain) is a sovereign, cleanroom toolchain generation engine +derived from the cross-LFS methodology. The original architecture was based on +buildchain.sh by Charles M. "Chip" Coldwell at Harvard University: + + http://frank.harvard.edu/~coldwell/toolchain/buildchain.sh + +The script has been substantially rewritten and extended by the DCOSNET project +(2012–2026). All modern cross-compilation, forensic stamping, and thermal +sentinel features are original work. + +## Design Principles + +### Target-Host Separation + +The host machine is always an average x86_64 system. Target architectures are +cross-compiled via sysroot, following the CLFS (Cross Linux From Scratch) and +Buildroot target configuration methodology. The host compiler is never used to +produce target binaries — every target has its own dedicated cross-toolchain. + +### Table-Driven Target Registry + +All 19 targets are defined in a single associative array +(`BTC_TARGETS[]`). Each entry specifies ten fields in pipe-delimited format: + + arch|multilib_arch|march|ISA|abi|libc|endian|family|description|min_kernel|gcc_extra + +This design follows PEP 868 (table-driven configuration) and MISRA-C +(separation of data from logic). Adding a new target requires one array +assignment — no control-flow changes. + +### Volatile Cleanroom Compilation + +All compilation occurs in a ramfs mount. This provides zero I/O wear on host +storage and guarantees a pristine build environment on every invocation. The +ramfs is mounted at the start of the forge phase and unmounted after the +toolchain is packaged into its golden image tarball. + +### Silicon Identity (Forensic Stamping) + +Every binary produced by a BTC-forged toolchain carries two immutable +identifiers: + +1. **ELF `.note.BTC` section** — note name "BTC", note type NT_VERSION (1), + containing a pipe-delimited string with org, version, target, march, ISA, + and a bare hex SHA-256 hash of the source tarball. +2. **Extended attributes (xattr)** — the same stamp data is written to + `user.btc.stamp` on the binary file. + +These stamps allow any binary to be traced back to the exact forge environment, +toolchain version, and source tree that produced it. + +### Dual C Library Strategy + +- **x86_64 targets**: glibc — full POSIX compatibility for workstation and + server deployments. +- **ARM, MIPS, TILE targets**: musl — lightweight, statically-linkable C + library suitable for embedded cross-compilation and minimal rootfs images. + +## ISA Tiers + +BTC.sh classifies targets by instruction set capability. The ISA tier +determines the optimization flags passed to GCC: + +| ISA Tier | Targets | Flags | +|--------------|----------------------------------------------|------------------------------------| +| AVX512 | skylake-x, skylake-server, znver4 | -mavx512f -mavx512dq -mavx512vl -mavx512bw | +| AVX2 | haswell, haswell-ep, skylake, znver1–3, | -mavx2 | +| | apu-zn1–zn4 | | +| SSE4_2 | atom-silvermont, atom-goldmont, | -msse4.2 | +| | atom-tremont, atom-sierraforest | | +| NEON | armv7 | -mfpu=neon -mfloat-abi=hard | +| MIPS32 | mipselr2 | (march set per target) | +| TILE | tilegx | (arch set per target) | + +The SSE4_2 tier exists because Intel Atom and AMD APU low-power cores lack +AVX support. GCC is configured with `--with-arch=` and +`--with-cpu=` in both Stage 1 and Stage 2 to ensure the cross-compiler +defaults to the correct target microarchitecture. + +## LFS Base Standards + +BTC.sh follows Linux From Scratch 13.0 stable (released 2024-09-01): + +- Binutils 2.46 +- GCC 14.2.0 +- Glibc 2.41 +- musl 1.2.5 +- Linux kernel headers (matched to target `min_kernel`) + +## C Library Selection Rationale + +- **glibc** is used for x86_64 targets (including Atom and APU) because + deployment environments typically have full development infrastructure, + large rootfs, and require maximum POSIX compatibility. +- **musl** is used for ARM, MIPS, and TILE targets where disk space is + constrained and static linking is frequently required for embedded + deployment. + +## Research References + +The following resources informed the BTC.sh architecture. They are listed for +attribution purposes and are not directly incorporated into the script: + +- Cross Linux From Scratch 1.0.0 — http://cross-lfs.org/view/1.0.0/x86_64-64/ +- Kernel header installation — Documentation/make/headers_install.txt +- GNU toolchain / glibc building — devpit.org, chschneider.eu/linux/tfs/ +- GNU Embedded Programming — www.bravegnu.org/gnu-eprog/ +- ttylinux xbuildroot scripts (CLFS methodology reference) +- Source Mage GNU/Linux — relevant spell build logic +- Chip Coldwell's buildchain.sh — http://frank.harvard.edu/~coldwell/toolchain + +## Source Cache Policy + +BTC.sh caches all downloaded source tarballs locally to avoid placing +unnecessary load on upstream hosting infrastructure. Automated bulk downloads +should be rate-limited and sources retained after initial fetch. + +## License + +BTC.sh is released under the GNU Affero General Public License v3.0 (AGPL-3.0). +Per Section 13, the forge includes an interactive notice at runtime. If you +modify and provide this forge as a network service, you are legally obligated +to provide the Corresponding Source to your users. \ No newline at end of file diff --git a/README.md b/README.md new file mode 100755 index 0000000..bb16b37 --- /dev/null +++ b/README.md @@ -0,0 +1,140 @@ +# BTC (Build Tool Chain) — Sovereign Cross-Forge Edition +## Version 0.4.0 + +BTC is a bare-metal, cleanroom toolchain generation engine designed for +independent infrastructure. It produces hardened, microarchitecture-optimized +cross-toolchains across 19 target configurations spanning Intel, AMD, ARM, +MIPS, and Tilera TILE-Gx processors. + +The project treats the build process as a forensic exercise: it does not simply +compile code — it instantiates a sovereign build environment in volatile memory, +stamps every resulting binary with an immutable hardware identity, and monitors +the forge's health via integrated thermal and entropy sentinels. + +## Cross-Compilation Targets + +BTC 0.4.0 supports 19 targets organized into five families. Target selection is +driven by an associative array registry — a table-driven design following PEP +868 and MISRA conventions. + +### Intel HEDT / Server (5 targets) + +| Target ID | Microarchitecture | ISA | C Library | Description | +|--------------------|----------------------|--------|-----------|--------------------------------------------------| +| `haswell` | haswell | AVX2 | glibc | Intel Haswell (Core i7-4xxx / Xeon E5 v3) | +| `haswell-ep` | haswell | AVX2 | glibc | Intel Haswell-EP X99 (Xeon E5/E7 v3) | +| `skylake` | skylake | AVX2 | glibc | Intel Skylake (Core i7-6xxx / Xeon v5) | +| `skylake-x` | skylake-avx512 | AVX512 | glibc | Intel Skylake-X X299 (i9-7xxx / Xeon Scalable) | +| `skylake-server` | skylake-server | AVX512 | glibc | Intel Skylake-Server (Xeon SP 1st/2nd Gen) | + +### AMD Ryzen / EPYC (4 targets) + +| Target ID | Microarchitecture | ISA | C Library | Description | +|-------------|--------------------|--------|-----------|------------------------------------------| +| `znver1` | znver1 | AVX2 | glibc | AMD Zen1 (Ryzen 1000 / EPYC Naples) | +| `znver2` | znver2 | AVX2 | glibc | AMD Zen2 (Ryzen 3000 / EPYC Rome) | +| `znver3` | znver3 | AVX2 | glibc | AMD Zen3 (Ryzen 5000 / EPYC Milan) | +| `znver4` | znver4 | AVX512 | glibc | AMD Zen4 (Ryzen 7000 / EPYC Genoa) | + +### AMD APU (4 targets) + +| Target ID | Microarchitecture | ISA | C Library | Description | +|------------|--------------------|--------|-----------|-------------------------------------------------| +| `apu-zn1` | znver1 | AVX2 | glibc | AMD APU S1 Zen — Raven Ridge (2400GE / 3200GE) | +| `apu-zn2` | znver1 | AVX2 | glibc | AMD APU S2 Zen+ — Picasso (3250U / 3500U) | +| `apu-zn3` | znver2 | AVX2 | glibc | AMD APU S3 Zen2 — Renoir (4500U / 4700U) | +| `apu-zn4` | znver3 | AVX2 | glibc | AMD APU S4 Zen3 — Cezanne (5500U / 5700U) | + +### Intel Atom (4 targets) + +| Target ID | Microarchitecture | ISA | C Library | Description | +|----------------------|--------------------|---------|-----------|------------------------------------------------------------| +| `atom-silvermont` | silvermont | SSE4_2 | glibc | Atom Silvermont — Bay Trail (Z3000 / E38xx series) | +| `atom-goldmont` | goldmont | SSE4_2 | glibc | Atom Goldmont — Apollo Lake (x5-Z8350 / N4200) | +| `atom-tremont` | tremont | SSE4_2 | glibc | Atom Tremont — Elkhart Lake (x6000E series) | +| `atom-sierraforest` | sierraforest | SSE4_2 | glibc | Atom Sierra Forest — x7000RE E-core cluster | + +### Embedded / Non-x86 (2 targets) + +| Target ID | Architecture | Microarchitecture | ISA | C Library | Description | +|------------|--------------|--------------------|--------|-----------|-----------------------------------------------------| +| `mipselr2` | mipsel | mips32r2 | MIPS32 | musl | MIPS32R2 LE o32 (MALTA / embedded routers) | +| `armv7` | arm | armv7-a | NEON | musl | ARMv7-A HF NEON (Cortex-A7/A9/A15, RPi 2/3 32-bit) | +| `tilegx` | tilegx | tilegx | TILE | musl | Tilera TILE-Gx72 (mesh VLIW) | + +## ISA Tier Architecture + +Six ISA tiers govern optimization flags. GCC is configured with +`--with-arch=` and `--with-cpu=` in both Stage 1 and Stage 2 to +ensure the cross-compiler defaults to the target microarchitecture: + +| ISA Tier | Flags | +|----------|-----------------------------------------------------| +| AVX512 | `-mavx512f -mavx512dq -mavx512vl -mavx512bw` | +| AVX2 | `-mavx2` | +| SSE4_2 | `-msse4.2` | +| NEON | `-mfpu=neon -mfloat-abi=hard` | +| MIPS32 | (per-target: `--with-arch=mips32r2 --with-float=soft`) | +| TILE | (per-target: `--with-arch=tilegx`) | + +The SSE4_2 tier exists because Intel Atom and AMD APU low-power cores lack AVX +support entirely. + +## Usage + +```bash +# Build a cross-toolchain for a specific target +sudo ./BTC.sh + +# Build a host-optimized native toolchain +sudo ./BTC.sh --native + +# List all available targets with descriptions +sudo ./BTC.sh --list +``` + +## Architectural Pillars + +**Sovereign Forge.** Built to LFS 13.0 stable standards (Binutils 2.46, +GCC 14.2.0, Glibc 2.41, musl 1.2.5). No pre-built binaries — every toolchain +is compiled from source on your hardware. + +**Silicon Identity.** Every binary produced by a BTC-forged toolchain includes +an immutable ELF note (`.note.BTC`, note type NT_VERSION) and an extended +filesystem attribute (`user.btc.stamp`) linking the binary to the specific +hardware, toolchain version, and forge environment that created it. + +**Volatile Cleanroom.** All compilation occurs in a ramfs mount, ensuring zero +I/O wear on host hardware and a pristine build environment on every invocation. + +**Thermal Sentinel.** Integrated telemetry loops prevent thermal runaway and +memory saturation during heavy LTO (Link Time Optimization) phases. + +**Forensic Auditing.** Every build creates a verifiable manifest, enabling +traceback of any binary to the exact source tree, configuration, and forge +state that produced it. + +**Zero-Trust Deployment.** Mandatory AGPLv3 licensing protects the toolchain +logic from proprietary SaaS capture. + +## Host Requirements + +- A standard Linux host (Debian, Arch, Fedora, Source Mage, etc.) with a + working native GCC toolchain. +- Root (EUID 0) is required for ramfs mounting and xattr stamping. +- Sufficient RAM for the ramfs build environment (8 GB minimum recommended + for x86_64 targets; 4 GB for embedded targets). +- Persistent storage at `/opt/BTC` for logs, release archives, and cached + source tarballs. + +## Licensing + +GNU Affero General Public License v3.0 (AGPL-3.0). Per Section 13, the forge +includes an interactive notice at runtime. Network deployment of modified +versions requires providing the Corresponding Source to your users. + +## Acknowledgments + +Original architecture based on scripts by Charles M. "Chip" Coldwell, Harvard +University. Modern cross-compilation, hardening, and sovereignty features +engineered by the DCOSNET project (2012–2026). \ No newline at end of file diff --git a/btc-quickstart.md b/btc-quickstart.md new file mode 100755 index 0000000..9a469ce --- /dev/null +++ b/btc-quickstart.md @@ -0,0 +1,90 @@ +# BTC Quickstart — Version 0.4.0 + +A guide to building your first cross-toolchain with the BTC Sovereign Forge. + +## 1. Prerequisites + +| Requirement | Details | +|-------------|---------| +| Host OS | Any Linux distribution with native GCC (Debian, Arch, Fedora, Source Mage, etc.) | +| Permissions | Root (EUID 0) — required for ramfs mounting and forensic xattr stamping | +| Storage | `/opt/BTC` — persistent location for logs, golden image tarballs, and source cache | +| RAM | 8 GB minimum for x86_64 targets; 4 GB for ARM/MIPS/TILE targets | + +## 2. The Forge Pipeline + +The forge executes in four phases: + +1. **Probe** — Silicon topology is scanned. Thread counts are computed from + available RAM to prevent LTO thrashing. The target registry is loaded. +2. **Setup** — A volatile cleanroom (ramfs) is provisioned at the configured + mount point. Source tarballs are verified against their SHA-256 checksums. +3. **Forge** — Core components are built sequentially: + Binutils → Kernel Headers → GCC Stage 1 → C Library (glibc or musl) → GCC Stage 2 → Kernel. + Both GCC stages are configured with `--with-arch=` and `--with-cpu=` + to default to the target microarchitecture. +4. **Package** — The resulting cross-toolchain is compressed into a golden + image tarball. A manifest JSON sidecar and forensic ELF stamp are applied. + +## 3. Build a Cross-Toolchain + +```bash +# List all 19 available targets +sudo ./BTC.sh --list + +# Build a cross-toolchain for AMD Zen3 (Ryzen 5000 / EPYC Milan) +sudo ./BTC.sh znver3 + +# Build for Intel Atom Tremont (Elkhart Lake) +sudo ./BTC.sh atom-tremont + +# Build for ARMv7 (Raspberry Pi 2/3 32-bit) +sudo ./BTC.sh armv7 + +# Build a host-optimized native toolchain +sudo ./BTC.sh --native +``` + +## 4. Verify the Golden Image + +After a successful build, the golden image tarball and its manifest are written +to `/opt/BTC/releases/`: + +```bash +# List available golden images +ls -la /opt/BTC/releases/ + +# Inspect the manifest +cat /opt/BTC/releases/DCOSNET-amd-znver3-AVX2-CROSS-toolchain-manifest.json +``` + +The manifest contains structured metadata: target ID, architecture, C library, +microarchitecture, ISA tier, cross-compiler triple, and build timestamps. + +## 5. Forensic Stamp Verification + +Any binary compiled with a BTC-forged toolchain carries the `.note.BTC` ELF +section. Verify it: + +```bash +# Read the ELF note +readelf -n /path/to/binary | grep -A5 BTC + +# Read the xattr stamp +getfattr -d user.btc.stamp /path/to/binary +``` + +## 6. Integration with Sorcery-Go and Fester + +BTC golden images are automatically detected by both Sorcery-Go +(`pkg/toolchain/btc.go`) and Fester (`backend/toolchain/btc.py`). Place the +extracted toolchain at `/opt/BTC//` and the integration layer +probes the manifest, configures build environment variables (CC, CXX, CFLAGS, +LDFLAGS), and verifies stamps on build outputs. + +## 7. Source Cache + +BTC.sh caches downloaded source tarballs in `/opt/BTC/sources/`. If a tarball +is already present and its checksum matches, it is not re-downloaded. Keep the +cache directory intact between builds to avoid unnecessary load on upstream +mirrors. \ No newline at end of file