# HG changeset patch
# User Richard Westhaver <ellis@rwest.io>
# Date 1714518888 14400
# Node ID a7129c8e52d1388a1f67d92d0109459908c5a665
# Parent  91cb7ffc5945e9557898289465ac501c3b18bdae
profiles, host.sxp

diff -r 91cb7ffc5945 -r a7129c8e52d1 .hgignore
--- a/.hgignore	Mon Apr 29 22:26:53 2024 -0400
+++ b/.hgignore	Tue Apr 30 19:14:48 2024 -0400
@@ -1,3 +1,4 @@
 .*[.](fasl|lock|elc|eln|scratch|tar)$
 .*(target|dist|node_modules|target-trunk|build)/.*
-linux/linux-[0-9]+[.].*/.*
\ No newline at end of file
+linux/linux-[0-9]+[.].*/.*
+host.sxp
\ No newline at end of file
diff -r 91cb7ffc5945 -r a7129c8e52d1 Containerfile.mail
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/Containerfile.mail	Tue Apr 30 19:14:48 2024 -0400
@@ -0,0 +1,1 @@
+FROM stalwartlabs/mail-server:latest
\ No newline at end of file
diff -r 91cb7ffc5945 -r a7129c8e52d1 bootstrap.lisp
--- a/bootstrap.lisp	Mon Apr 29 22:26:53 2024 -0400
+++ b/bootstrap.lisp	Tue Apr 30 19:14:48 2024 -0400
@@ -12,9 +12,10 @@
         :cli/shell :std/hash-table :std/alien))
 (in-package :infra/bootstrap)
 (in-readtable :shell)
+
 (eval-when (:compile-toplevel)
   (defstruct host name cpus mem os kernel core)
-  (defparameter *config-file* #P"config.sxp")
+  (defparameter *config-file* (or (pathname (sb-posix:getenv "BUILD_PROFILE")) #P"default.sxp"))
   (defparameter *build-config* (read-sxp-file *config-file*))
   (defparameter *host-config* (make-host :name (sb-unix:unix-gethostname) :cpus (num-cpus) :mem #+nil (mem-total) 15815828
                                    :os "archlinux" :kernel "linux" :core sb-ext:*core-pathname*))
diff -r 91cb7ffc5945 -r a7129c8e52d1 bootstrap.sh
--- a/bootstrap.sh	Mon Apr 29 22:26:53 2024 -0400
+++ b/bootstrap.sh	Tue Apr 30 19:14:48 2024 -0400
@@ -1,1 +1,1 @@
-#!/bin/sh
+#!/usr/bin/env sh
diff -r 91cb7ffc5945 -r a7129c8e52d1 check.sh
--- a/check.sh	Mon Apr 29 22:26:53 2024 -0400
+++ b/check.sh	Tue Apr 30 19:14:48 2024 -0400
@@ -1,1 +1,396 @@
-#!/bin/sh
+#!/usr/bin/env sh
+set -eu
+main() {
+  need_cmd uname
+  need_cmd mktemp
+  need_cmd chmod
+  need_cmd mkdir
+  need_cmd rm
+  need_cmd rmdir
+  need_cmd tar
+  need_cmd zstd
+  need_cmd hg
+  need_cmd git
+  need_cmd clang
+  need_cmd grep
+  need_cmd awk
+  need_cmd head
+  need_cmd tail
+  host_config_file=host.sxp
+  rm $host_config_file
+  check_mem
+  check_disk
+  check_mod kvm
+  get_architecture || return 1
+  local _arch="$RETVAL"
+  assert_nz "$_arch" "arch"
+  _write ";; -*- mode:skel -*-"
+  _write ":arch \"$_arch\""
+  kernel_version
+  local _kernel_version="$RETVAL"
+  _write ":kernel \"$_kernel_version\""
+  check_cpus
+  local _num_cpus="$RETVAL"
+  _write ":cpus $_num_cpus"
+  case "$_arch" in
+    *windows*)
+      _write ":ext \"exe\""
+      ;;
+    *)
+      _write ":ext nil"
+  esac
+}
+
+say() {
+  printf '%s\n' "$1"
+}
+
+_write() {
+  say "$1" >> $host_config_file
+}
+
+err() {
+  say "$1" >&2
+  exit 1
+}
+
+assert_nz() {
+  if [ -z "$1" ]; then err "assert_nz $2"; fi
+}
+
+check_cmd() {
+  command -v "$1" > /dev/null 2>&1
+}
+
+need_cmd() {
+  if ! check_cmd "$1"; then
+    err "need '$1' (command not found)"
+  fi
+}
+
+ensure() {
+  if ! "$@"; then err "command failed: $*"; fi
+}
+
+check_proc() {
+  # Check for /proc by looking for the /proc/self/exe link
+  # This is only run on Linux
+  if ! test -L /proc/self/exe ; then
+    err "fatal: Unable to find /proc/self/exe.  Is /proc mounted?  Installation cannot proceed without /proc."
+  fi
+}
+
+get_bitness() {
+  # Architecture detection without dependencies beyond coreutils.
+  # ELF files start out "\x7fELF", and the following byte is
+  #   0x01 for 32-bit and
+  #   0x02 for 64-bit.
+  # The printf builtin on some shells like dash only supports octal
+  # escape sequences, so we use those.
+  local _current_exe_head
+  _current_exe_head=$(head -c 5 /proc/self/exe )
+  if [ "$_current_exe_head" = "$(printf '\177ELF\001')" ]; then
+    echo 32
+  elif [ "$_current_exe_head" = "$(printf '\177ELF\002')" ]; then
+    echo 64
+  else
+    err "unknown platform bitness"
+  fi
+}
+
+is_host_amd64_elf() {
+  # ELF e_machine detection without dependencies beyond coreutils.
+  # Two-byte field at offset 0x12 indicates the CPU,
+  # but we're interested in it being 0x3E to indicate amd64, or not that.
+  local _current_exe_machine
+  _current_exe_machine=$(head -c 19 /proc/self/exe | tail -c 1)
+  [ "$_current_exe_machine" = "$(printf '\076')" ]
+}
+
+get_endianness() {
+  local cputype=$1
+  local suffix_eb=$2
+  local suffix_el=$3
+
+  # detect endianness without od/hexdump, like get_bitness() does.
+  local _current_exe_endianness
+  _current_exe_endianness="$(head -c 6 /proc/self/exe | tail -c 1)"
+  if [ "$_current_exe_endianness" = "$(printf '\001')" ]; then
+    echo "${cputype}${suffix_el}"
+  elif [ "$_current_exe_endianness" = "$(printf '\002')" ]; then
+    echo "${cputype}${suffix_eb}"
+  else
+    err "unknown platform endianness"
+  fi
+}
+
+get_architecture() {
+  local _ostype _cputype _bitness _arch _clibtype
+  _ostype="$(uname -s)"
+  _cputype="$(uname -m)"
+  _clibtype="gnu"
+
+  if [ "$_ostype" = Linux ]; then
+    if [ "$(uname -o)" = Android ]; then
+      _ostype=Android
+    fi
+    if ldd --version 2>&1 | grep -q 'musl'; then
+      _clibtype="musl"
+    fi
+  fi
+
+  if [ "$_ostype" = Darwin ] && [ "$_cputype" = i386 ]; then
+    # Darwin `uname -m` lies
+    if sysctl hw.optional.x86_64 | grep -q ': 1'; then
+      _cputype=x86_64
+    fi
+  fi
+
+  if [ "$_ostype" = SunOS ]; then
+    # Both Solaris and illumos presently announce as "SunOS" in "uname -s"
+    # so use "uname -o" to disambiguate.  We use the full path to the
+    # system uname in case the user has coreutils uname first in PATH,
+    # which has historically sometimes printed the wrong value here.
+    if [ "$(/usr/bin/uname -o)" = illumos ]; then
+      _ostype=illumos
+    fi
+
+    # illumos systems have multi-arch userlands, and "uname -m" reports the
+    # machine hardware name; e.g., "i86pc" on both 32- and 64-bit x86
+    # systems.  Check for the native (widest) instruction set on the
+    # running kernel:
+    if [ "$_cputype" = i86pc ]; then
+      _cputype="$(isainfo -n)"
+    fi
+  fi
+
+  case "$_ostype" in
+
+    Android)
+      _ostype=linux-android
+      ;;
+
+    Linux)
+      check_proc
+      _ostype=unknown-linux-$_clibtype
+      _bitness=$(get_bitness)
+      ;;
+
+    FreeBSD)
+      _ostype=unknown-freebsd
+      ;;
+
+    NetBSD)
+      _ostype=unknown-netbsd
+      ;;
+
+    DragonFly)
+      _ostype=unknown-dragonfly
+      ;;
+
+    Darwin)
+      _ostype=apple-darwin
+      ;;
+
+    illumos)
+      _ostype=unknown-illumos
+      ;;
+
+    MINGW* | MSYS* | CYGWIN* | Windows_NT)
+      _ostype=pc-windows-gnu
+      ;;
+
+    *)
+      err "unrecognized OS type: $_ostype"
+      ;;
+
+  esac
+
+  case "$_cputype" in
+
+    i386 | i486 | i686 | i786 | x86)
+      _cputype=i686
+      ;;
+
+    xscale | arm)
+      _cputype=arm
+      if [ "$_ostype" = "linux-android" ]; then
+        _ostype=linux-androideabi
+      fi
+      ;;
+
+    armv6l)
+      _cputype=arm
+      if [ "$_ostype" = "linux-android" ]; then
+        _ostype=linux-androideabi
+      else
+        _ostype="${_ostype}eabihf"
+      fi
+      ;;
+
+    armv7l | armv8l)
+      _cputype=armv7
+      if [ "$_ostype" = "linux-android" ]; then
+        _ostype=linux-androideabi
+      else
+        _ostype="${_ostype}eabihf"
+      fi
+      ;;
+
+    aarch64 | arm64)
+      _cputype=aarch64
+      ;;
+
+    x86_64 | x86-64 | x64 | amd64)
+      _cputype=x86_64
+      ;;
+
+    mips)
+      _cputype=$(get_endianness mips '' el)
+      ;;
+
+    mips64)
+      if [ "$_bitness" -eq 64 ]; then
+        # only n64 ABI is supported for now
+        _ostype="${_ostype}abi64"
+        _cputype=$(get_endianness mips64 '' el)
+      fi
+      ;;
+
+    ppc)
+      _cputype=powerpc
+      ;;
+
+    ppc64)
+      _cputype=powerpc64
+      ;;
+
+    ppc64le)
+      _cputype=powerpc64le
+      ;;
+
+    s390x)
+      _cputype=s390x
+      ;;
+    riscv64)
+      _cputype=riscv64gc
+      ;;
+    loongarch64)
+      _cputype=loongarch64
+      ;;
+    *)
+      err "unknown CPU type: $_cputype"
+
+  esac
+
+  # Detect 64-bit linux with 32-bit userland
+  if [ "${_ostype}" = unknown-linux-gnu ] && [ "${_bitness}" -eq 32 ]; then
+    case $_cputype in
+      x86_64)
+        if [ -n "${CPUTYPE:-}" ]; then
+          _cputype="$CPUTYPE"
+        else {
+          # 32-bit executable for amd64 = x32
+          if is_host_amd64_elf; then {
+            echo "This host is running an x32 userland; as it stands, x32 support is poor," 1>&2
+            echo "and there isn't a native toolchain -- you will have to install" 1>&2
+            echo "multiarch compatibility with i686 and/or amd64, then select one" 1>&2
+            echo "by re-running this script with the CPUTYPE environment variable" 1>&2
+            echo "set to i686 or x86_64, respectively." 1>&2
+            exit 1
+          }; else
+            _cputype=i686
+          fi
+        }; fi
+        ;;
+      mips64)
+        _cputype=$(get_endianness mips '' el)
+        ;;
+      powerpc64)
+        _cputype=powerpc
+        ;;
+      aarch64)
+        _cputype=armv7
+        if [ "$_ostype" = "linux-android" ]; then
+          _ostype=linux-androideabi
+        else
+          _ostype="${_ostype}eabihf"
+        fi
+        ;;
+      riscv64gc)
+        err "riscv64 with 32-bit userland unsupported"
+        ;;
+    esac
+  fi
+
+  if [ "$_ostype" = "unknown-linux-gnueabihf" ] && [ "$_cputype" = armv7 ]; then
+    if ensure grep '^Features' /proc/cpuinfo | grep -q -v neon; then
+      # At least one processor does not have NEON.
+      _cputype=arm
+    fi
+  fi
+
+  _arch="${_cputype}-${_ostype}"
+
+  RETVAL="$_arch"
+}
+
+mem_total () {
+  local _mem_total
+  _mem_total=$(awk '/MemTotal/ {print $2}' /proc/meminfo)
+  RETVAL="$_mem_total"
+}
+
+check_mem () {
+  mem_total
+  local _mem_total="$RETVAL"
+  local _mem_min=8388608 # 8Gb in kB
+  if [ "$_mem_total" -lt "$_mem_min" ]; then
+    err "not enough memory: $_mem_total < $_mem_min";
+  fi
+}
+
+disk_free () {
+  local _disk_free
+  _disk_free=$(df -kh . | tail -n1 | awk '{print $4}')
+  RETVAL="${_disk_free%?}"
+}
+
+check_disk () {
+  disk_free
+  local _disk_free="$RETVAL"
+  local _disk_min=32 # in Gigabytes
+  if [ "$_disk_free" -lt "$_disk_min" ]; then
+    err "not enough disk space: $_disk_free < $_disk_min"
+  fi
+}
+
+kernel_version () {
+  local _kernel_version
+  _kernel_version=$(uname -r)
+  RETVAL="$_kernel_version"
+}
+
+check_mod () {
+  if ! lsmod | grep -wq "$1"; then
+    err "kernel module $1 isn't loaded"
+  fi
+}
+
+num_cpus () {
+  local _num_cpus
+  _num_cpus=$(grep -c '^processor' /proc/cpuinfo 2>/dev/null)
+  RETVAL="$_num_cpus"
+  # sysctl -n hw.ncpu # nproc --all
+}
+
+check_cpus () {
+  num_cpus
+  local _num_cpus="$RETVAL"
+  local _min_cpus=8
+  if [ "$_num_cpus" -lt "$_min_cpus" ]; then
+    err "not enough cpu threads ($_num_cpus < $_min_cpus)"
+  fi
+}
+
+main "$@" || exit 1
diff -r 91cb7ffc5945 -r a7129c8e52d1 config.sh
--- a/config.sh	Mon Apr 29 22:26:53 2024 -0400
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,1 +0,0 @@
-#!/bin/sh
diff -r 91cb7ffc5945 -r a7129c8e52d1 config.sxp
--- a/config.sxp	Mon Apr 29 22:26:53 2024 -0400
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,13 +0,0 @@
-;; -*- mode:skel -*-
-:sbcl-version "2.4.4"
-:stash ".stash"
-:dist nil
-:install-root "/usr/local"
-:log-level :debug
-:features (:sbcl
-           :sbcl-docs
-           :rust :cargo-tools
-           :tree-sitter :tree-sitter-langs
-           :skel :packy
-           :emacs-mini)
-
diff -r 91cb7ffc5945 -r a7129c8e52d1 default.sxp
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/default.sxp	Tue Apr 30 19:14:48 2024 -0400
@@ -0,0 +1,13 @@
+;; -*- mode:skel -*-
+:sbcl-version "2.4.4"
+:stash ".stash"
+:dist nil
+:install-root "/usr/local"
+:log-level :debug
+:features
+(:sbcl
+ :sbcl-docs
+ :rust :cargo-tools
+ :tree-sitter :tree-sitter-langs
+ :skel :packy
+ :emacs-mini)
diff -r 91cb7ffc5945 -r a7129c8e52d1 install.sh
--- a/install.sh	Mon Apr 29 22:26:53 2024 -0400
+++ b/install.sh	Tue Apr 30 19:14:48 2024 -0400
@@ -1,1 +1,577 @@
 #!/bin/sh
+set -eu
+main() {
+  downloader --check
+  need_cmd uname
+  need_cmd mktemp
+  need_cmd chmod
+  need_cmd mkdir
+  need_cmd rm
+  need_cmd rmdir
+  get_architecture || return 1
+  local _arch="$RETVAL"
+  assert_nz "$_arch" "arch"
+  local _ext=""
+  case "$_arch" in
+    *windows*)
+      _ext=".exe"
+      ;;
+  esac
+  local _url="https://packy.compiler.company/dist/${_arch}/cc-install${_ext}"
+  local _dir
+  if ! _dir="$(ensure mktemp -d)"; then
+    # Because the previous command ran in a subshell, we must manually
+    # propagate exit status.
+    exit 1
+  fi
+  local _file="${_dir}/cc-install${_ext}"
+  printf '%s\n' 'info: installing artifacts...' 1>&2
+  ensure mkdir -p "$_dir"
+  ensure downloader "$_url" "$_file" "$_arch"
+  ensure chmod u+x "$_file"
+  if [ ! -x "$_file" ]; then
+    printf '%s\n' "Cannot execute $_file (likely because of mounting /tmp as noexec)." 1>&2
+    printf '%s\n' "Please copy the file to a location where you can execute binaries and run ./cc-install${_ext}." 1>&2
+    exit 1
+  fi
+  "$_file" "$@"
+  local _retval=$?
+  rm "$_file"
+  rmdir "$_dir"
+  return "$_retval"
+}
+
+say() {
+  printf 'compiler.company: %s\n' "$1"
+}
+
+err() {
+  say "$1" >&2
+  exit 1
+}
+
+assert_nz() {
+  if [ -z "$1" ]; then err "assert_nz $2"; fi
+}
+
+check_cmd() {
+  command -v "$1" > /dev/null 2>&1
+}
+
+need_cmd() {
+  if ! check_cmd "$1"; then
+    err "need '$1' (command not found)"
+  fi
+}
+
+# Run a command that should never fail. If the command fails execution
+# will immediately terminate with an error showing the failing
+# command.
+ensure() {
+  if ! "$@"; then err "command failed: $*"; fi
+}
+
+# Check if curl supports the --retry flag, then pass it to the curl invocation.
+check_curl_for_retry_support() {
+  local _retry_supported=""
+  # "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc.
+  if check_help_for "notspecified" "curl" "--retry"; then
+    _retry_supported="--retry 3"
+    if check_help_for "notspecified" "curl" "--continue-at"; then
+      # "-C -" tells curl to automatically find where to resume the download when retrying.
+      _retry_supported="--retry 3 -C -"
+    fi
+  fi
+
+  RETVAL="$_retry_supported"
+}
+
+# Return cipher suite string specified by user, otherwise return strong TLS 1.2-1.3 cipher suites
+# if support by local tools is detected. Detection currently supports these curl backends:
+# GnuTLS and OpenSSL (possibly also LibreSSL and BoringSSL). Return value can be empty.
+get_ciphersuites_for_curl() {
+  if [ -n "${TLS_CIPHERSUITES-}" ]; then
+    # user specified custom cipher suites, assume they know what they're doing
+    RETVAL="$TLS_CIPHERSUITES"
+    return
+  fi
+
+  local _openssl_syntax="no"
+  local _gnutls_syntax="no"
+  local _backend_supported="yes"
+  if curl -V | grep -q ' OpenSSL/'; then
+    _openssl_syntax="yes"
+  elif curl -V | grep -iq ' LibreSSL/'; then
+    _openssl_syntax="yes"
+  elif curl -V | grep -iq ' BoringSSL/'; then
+    _openssl_syntax="yes"
+  elif curl -V | grep -iq ' GnuTLS/'; then
+    _gnutls_syntax="yes"
+  else
+    _backend_supported="no"
+  fi
+
+  local _args_supported="no"
+  if [ "$_backend_supported" = "yes" ]; then
+    # "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc.
+    if check_help_for "notspecified" "curl" "--tlsv1.2" "--ciphers" "--proto"; then
+      _args_supported="yes"
+    fi
+  fi
+
+  local _cs=""
+  if [ "$_args_supported" = "yes" ]; then
+    if [ "$_openssl_syntax" = "yes" ]; then
+      _cs=$(get_strong_ciphersuites_for "openssl")
+    elif [ "$_gnutls_syntax" = "yes" ]; then
+      _cs=$(get_strong_ciphersuites_for "gnutls")
+    fi
+  fi
+
+  RETVAL="$_cs"
+}
+
+# Return cipher suite string specified by user, otherwise return strong TLS 1.2-1.3 cipher suites
+# if support by local tools is detected. Detection currently supports these wget backends:
+# GnuTLS and OpenSSL (possibly also LibreSSL and BoringSSL). Return value can be empty.
+get_ciphersuites_for_wget() {
+  if [ -n "${TLS_CIPHERSUITES-}" ]; then
+    # user specified custom cipher suites, assume they know what they're doing
+    RETVAL="$TLS_CIPHERSUITES"
+    return
+  fi
+
+  local _cs=""
+  if wget -V | grep -q '\-DHAVE_LIBSSL'; then
+    # "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc.
+    if check_help_for "notspecified" "wget" "TLSv1_2" "--ciphers" "--https-only" "--secure-protocol"; then
+      _cs=$(get_strong_ciphersuites_for "openssl")
+    fi
+  elif wget -V | grep -q '\-DHAVE_LIBGNUTLS'; then
+    # "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc.
+    if check_help_for "notspecified" "wget" "TLSv1_2" "--ciphers" "--https-only" "--secure-protocol"; then
+      _cs=$(get_strong_ciphersuites_for "gnutls")
+    fi
+  fi
+
+  RETVAL="$_cs"
+}
+
+check_help_for() {
+    local _arch
+    local _cmd
+    local _arg
+    _arch="$1"
+    shift
+    _cmd="$1"
+    shift
+
+    local _category
+    if "$_cmd" --help | grep -q 'For all options use the manual or "--help all".'; then
+      _category="all"
+    else
+      _category=""
+    fi
+
+    case "$_arch" in
+
+        *darwin*)
+        if check_cmd sw_vers; then
+            case $(sw_vers -productVersion) in
+                10.*)
+                    # If we're running on macOS, older than 10.13, then we always
+                    # fail to find these options to force fallback
+                    if [ "$(sw_vers -productVersion | cut -d. -f2)" -lt 13 ]; then
+                        # Older than 10.13
+                        echo "Warning: Detected macOS platform older than 10.13"
+                        return 1
+                    fi
+                    ;;
+                11.*)
+                    # We assume Big Sur will be OK for now
+                    ;;
+                *)
+                    # Unknown product version, warn and continue
+                    echo "Warning: Detected unknown macOS major version: $(sw_vers -productVersion)"
+                    echo "Warning TLS capabilities detection may fail"
+                    ;;
+            esac
+        fi
+        ;;
+
+    esac
+
+    for _arg in "$@"; do
+        if ! "$_cmd" --help "$_category" | grep -q -- "$_arg"; then
+            return 1
+        fi
+    done
+
+    true # not strictly needed
+}
+
+# Return strong TLS 1.2-1.3 cipher suites in OpenSSL or GnuTLS syntax. TLS 1.2
+# excludes non-ECDHE and non-AEAD cipher suites. DHE is excluded due to bad
+# DH params often found on servers (see RFC 7919). Sequence matches or is
+# similar to Firefox 68 ESR with weak cipher suites disabled via about:config.
+# $1 must be openssl or gnutls.
+get_strong_ciphersuites_for() {
+  if [ "$1" = "openssl" ]; then
+    # OpenSSL is forgiving of unknown values, no problems with TLS 1.3 values on versions that don't support it yet.
+    echo "TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384"
+  elif [ "$1" = "gnutls" ]; then
+    # GnuTLS isn't forgiving of unknown values, so this may require a GnuTLS version that supports TLS 1.3 even if wget doesn't.
+    # Begin with SECURE128 (and higher) then remove/add to build cipher suites. Produces same 9 cipher suites as OpenSSL but in slightly different order.
+    echo "SECURE128:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS-ALL:-CIPHER-ALL:-MAC-ALL:-KX-ALL:+AEAD:+ECDHE-ECDSA:+ECDHE-RSA:+AES-128-GCM:+CHACHA20-POLY1305:+AES-256-GCM"
+  fi
+}
+
+check_proc() {
+  # Check for /proc by looking for the /proc/self/exe link
+  # This is only run on Linux
+  if ! test -L /proc/self/exe ; then
+    err "fatal: Unable to find /proc/self/exe.  Is /proc mounted?  Installation cannot proceed without /proc."
+  fi
+}
+
+get_bitness() {
+  need_cmd head
+  # Architecture detection without dependencies beyond coreutils.
+  # ELF files start out "\x7fELF", and the following byte is
+  #   0x01 for 32-bit and
+  #   0x02 for 64-bit.
+  # The printf builtin on some shells like dash only supports octal
+  # escape sequences, so we use those.
+  local _current_exe_head
+  _current_exe_head=$(head -c 5 /proc/self/exe )
+  if [ "$_current_exe_head" = "$(printf '\177ELF\001')" ]; then
+    echo 32
+  elif [ "$_current_exe_head" = "$(printf '\177ELF\002')" ]; then
+    echo 64
+  else
+    err "unknown platform bitness"
+  fi
+}
+
+is_host_amd64_elf() {
+  need_cmd head
+  need_cmd tail
+  # ELF e_machine detection without dependencies beyond coreutils.
+  # Two-byte field at offset 0x12 indicates the CPU,
+  # but we're interested in it being 0x3E to indicate amd64, or not that.
+  local _current_exe_machine
+  _current_exe_machine=$(head -c 19 /proc/self/exe | tail -c 1)
+  [ "$_current_exe_machine" = "$(printf '\076')" ]
+}
+
+get_endianness() {
+  local cputype=$1
+  local suffix_eb=$2
+  local suffix_el=$3
+
+  # detect endianness without od/hexdump, like get_bitness() does.
+  need_cmd head
+  need_cmd tail
+
+  local _current_exe_endianness
+  _current_exe_endianness="$(head -c 6 /proc/self/exe | tail -c 1)"
+  if [ "$_current_exe_endianness" = "$(printf '\001')" ]; then
+    echo "${cputype}${suffix_el}"
+  elif [ "$_current_exe_endianness" = "$(printf '\002')" ]; then
+    echo "${cputype}${suffix_eb}"
+  else
+    err "unknown platform endianness"
+  fi
+}
+
+get_architecture() {
+  local _ostype _cputype _bitness _arch _clibtype
+  _ostype="$(uname -s)"
+  _cputype="$(uname -m)"
+  _clibtype="gnu"
+
+  if [ "$_ostype" = Linux ]; then
+    if [ "$(uname -o)" = Android ]; then
+      _ostype=Android
+    fi
+    if ldd --version 2>&1 | grep -q 'musl'; then
+      _clibtype="musl"
+    fi
+  fi
+
+  if [ "$_ostype" = Darwin ] && [ "$_cputype" = i386 ]; then
+    # Darwin `uname -m` lies
+    if sysctl hw.optional.x86_64 | grep -q ': 1'; then
+      _cputype=x86_64
+    fi
+  fi
+
+  if [ "$_ostype" = SunOS ]; then
+    # Both Solaris and illumos presently announce as "SunOS" in "uname -s"
+    # so use "uname -o" to disambiguate.  We use the full path to the
+    # system uname in case the user has coreutils uname first in PATH,
+    # which has historically sometimes printed the wrong value here.
+    if [ "$(/usr/bin/uname -o)" = illumos ]; then
+      _ostype=illumos
+    fi
+
+    # illumos systems have multi-arch userlands, and "uname -m" reports the
+    # machine hardware name; e.g., "i86pc" on both 32- and 64-bit x86
+    # systems.  Check for the native (widest) instruction set on the
+    # running kernel:
+    if [ "$_cputype" = i86pc ]; then
+      _cputype="$(isainfo -n)"
+    fi
+  fi
+
+  case "$_ostype" in
+
+    Android)
+      _ostype=linux-android
+      ;;
+
+    Linux)
+      check_proc
+      _ostype=unknown-linux-$_clibtype
+      _bitness=$(get_bitness)
+      ;;
+
+    FreeBSD)
+      _ostype=unknown-freebsd
+      ;;
+
+    NetBSD)
+      _ostype=unknown-netbsd
+      ;;
+
+    DragonFly)
+      _ostype=unknown-dragonfly
+      ;;
+
+    Darwin)
+      _ostype=apple-darwin
+      ;;
+
+    illumos)
+      _ostype=unknown-illumos
+      ;;
+
+    MINGW* | MSYS* | CYGWIN* | Windows_NT)
+      _ostype=pc-windows-gnu
+      ;;
+
+    *)
+      err "unrecognized OS type: $_ostype"
+      ;;
+
+  esac
+
+  case "$_cputype" in
+
+    i386 | i486 | i686 | i786 | x86)
+      _cputype=i686
+      ;;
+
+    xscale | arm)
+      _cputype=arm
+      if [ "$_ostype" = "linux-android" ]; then
+        _ostype=linux-androideabi
+      fi
+      ;;
+
+    armv6l)
+      _cputype=arm
+      if [ "$_ostype" = "linux-android" ]; then
+        _ostype=linux-androideabi
+      else
+        _ostype="${_ostype}eabihf"
+      fi
+      ;;
+
+    armv7l | armv8l)
+      _cputype=armv7
+      if [ "$_ostype" = "linux-android" ]; then
+        _ostype=linux-androideabi
+      else
+        _ostype="${_ostype}eabihf"
+      fi
+      ;;
+
+    aarch64 | arm64)
+      _cputype=aarch64
+      ;;
+
+    x86_64 | x86-64 | x64 | amd64)
+      _cputype=x86_64
+      ;;
+
+    mips)
+      _cputype=$(get_endianness mips '' el)
+      ;;
+
+    mips64)
+      if [ "$_bitness" -eq 64 ]; then
+        # only n64 ABI is supported for now
+        _ostype="${_ostype}abi64"
+        _cputype=$(get_endianness mips64 '' el)
+      fi
+      ;;
+
+    ppc)
+      _cputype=powerpc
+      ;;
+
+    ppc64)
+      _cputype=powerpc64
+      ;;
+
+    ppc64le)
+      _cputype=powerpc64le
+      ;;
+
+    s390x)
+      _cputype=s390x
+      ;;
+    riscv64)
+      _cputype=riscv64gc
+      ;;
+    loongarch64)
+      _cputype=loongarch64
+      ;;
+    *)
+      err "unknown CPU type: $_cputype"
+
+  esac
+
+  # Detect 64-bit linux with 32-bit userland
+  if [ "${_ostype}" = unknown-linux-gnu ] && [ "${_bitness}" -eq 32 ]; then
+    case $_cputype in
+      x86_64)
+        if [ -n "${CPUTYPE:-}" ]; then
+          _cputype="$CPUTYPE"
+        else {
+          # 32-bit executable for amd64 = x32
+          if is_host_amd64_elf; then {
+            echo "This host is running an x32 userland; as it stands, x32 support is poor," 1>&2
+            echo "and there isn't a native toolchain -- you will have to install" 1>&2
+            echo "multiarch compatibility with i686 and/or amd64, then select one" 1>&2
+            echo "by re-running this script with the CPUTYPE environment variable" 1>&2
+            echo "set to i686 or x86_64, respectively." 1>&2
+            exit 1
+          }; else
+            _cputype=i686
+          fi
+        }; fi
+        ;;
+      mips64)
+        _cputype=$(get_endianness mips '' el)
+        ;;
+      powerpc64)
+        _cputype=powerpc
+        ;;
+      aarch64)
+        _cputype=armv7
+        if [ "$_ostype" = "linux-android" ]; then
+          _ostype=linux-androideabi
+        else
+          _ostype="${_ostype}eabihf"
+        fi
+        ;;
+      riscv64gc)
+        err "riscv64 with 32-bit userland unsupported"
+        ;;
+    esac
+  fi
+
+  if [ "$_ostype" = "unknown-linux-gnueabihf" ] && [ "$_cputype" = armv7 ]; then
+    if ensure grep '^Features' /proc/cpuinfo | grep -q -v neon; then
+      # At least one processor does not have NEON.
+      _cputype=arm
+    fi
+  fi
+
+  _arch="${_cputype}-${_ostype}"
+
+  RETVAL="$_arch"
+}
+
+# This wraps curl or wget. Try curl first, if not installed,
+# use wget instead.
+downloader() {
+  local _dld
+  local _ciphersuites
+  local _err
+  local _status
+  local _retry
+  if check_cmd curl; then
+    _dld=curl
+  elif check_cmd wget; then
+    _dld=wget
+  else
+    _dld='curl or wget' # to be used in error message of need_cmd
+  fi
+
+  if [ "$1" = --check ]; then
+    need_cmd "$_dld"
+  elif [ "$_dld" = curl ]; then
+    check_curl_for_retry_support
+    _retry="$RETVAL"
+    get_ciphersuites_for_curl
+    _ciphersuites="$RETVAL"
+    if [ -n "$_ciphersuites" ]; then
+      _err=$(curl $_retry --proto '=https' --tlsv1.2 --ciphers "$_ciphersuites" --silent --show-error --fail --location "$1" --output "$2" 2>&1)
+      _status=$?
+    else
+      echo "Warning: Not enforcing strong cipher suites for TLS, this is potentially less secure"
+      if ! check_help_for "$3" curl --proto --tlsv1.2; then
+        echo "Warning: Not enforcing TLS v1.2, this is potentially less secure"
+        _err=$(curl $_retry --silent --show-error --fail --location "$1" --output "$2" 2>&1)
+        _status=$?
+      else
+        _err=$(curl $_retry --proto '=https' --tlsv1.2 --silent --show-error --fail --location "$1" --output "$2" 2>&1)
+        _status=$?
+      fi
+    fi
+    if [ -n "$_err" ]; then
+      echo "$_err" >&2
+      if echo "$_err" | grep -q 404$; then
+        err "installer for platform '$3' not found, this may be unsupported"
+      fi
+    fi
+    return $_status
+  elif [ "$_dld" = wget ]; then
+    if [ "$(wget -V 2>&1|head -2|tail -1|cut -f1 -d" ")" = "BusyBox" ]; then
+      echo "Warning: using the BusyBox version of wget.  Not enforcing strong cipher suites for TLS or TLS v1.2, this is potentially less secure"
+      _err=$(wget "$1" -O "$2" 2>&1)
+      _status=$?
+    else
+      get_ciphersuites_for_wget
+      _ciphersuites="$RETVAL"
+      if [ -n "$_ciphersuites" ]; then
+        _err=$(wget --https-only --secure-protocol=TLSv1_2 --ciphers "$_ciphersuites" "$1" -O "$2" 2>&1)
+        _status=$?
+      else
+        echo "Warning: Not enforcing strong cipher suites for TLS, this is potentially less secure"
+        if ! check_help_for "$3" wget --https-only --secure-protocol; then
+          echo "Warning: Not enforcing TLS v1.2, this is potentially less secure"
+          _err=$(wget "$1" -O "$2" 2>&1)
+          _status=$?
+        else
+          _err=$(wget --https-only --secure-protocol=TLSv1_2 "$1" -O "$2" 2>&1)
+          _status=$?
+        fi
+      fi
+    fi
+    if [ -n "$_err" ]; then
+      echo "$_err" >&2
+      if echo "$_err" | grep -q ' 404 Not Found$'; then
+        err "installer for platform '$3' not found, this may be unsupported"
+      fi
+    fi
+    return $_status
+  else
+    err "Unknown downloader"   # should not reach here
+  fi
+}
+
+main "$@" || exit 1
diff -r 91cb7ffc5945 -r a7129c8e52d1 profile.sh
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/profile.sh	Tue Apr 30 19:14:48 2024 -0400
@@ -0,0 +1,1 @@
+#!/bin/sh