#!/bin/bash
# Internal entry point, mounted inside an already-created bubblewrap user namespace.
set -euo pipefail
host=/tmp/fds-build-host
native() {
    "$host/usr/lib/ld-linux-x86-64.so.2" --library-path "$host/usr/lib" "$host/usr/bin/$1" "${@:2}"
}
native mkdir /tmp/fds-binfmt
native mount -t binfmt_misc binfmt_misc /tmp/fds-binfmt
# Match ELF64 little-endian AArch64 EXEC/DYN. This registry belongs only to the
# new user namespace. F opens the static interpreter while it is mounted here.
printf '%s\n' ':fds-aarch64:M::\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7\x00:\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfe\xff\xff\xff:/tmp/fds-build-host/usr/bin/qemu-aarch64:F' >/tmp/fds-binfmt/register
export PATH=/usr/bin:/bin HOME=/root LANG=C LC_ALL=C XBPS_ARCH=aarch64
# Package hooks need no mount privilege after the private handler is installed.
exec "$host/usr/lib/ld-linux-x86-64.so.2" --library-path "$host/usr/lib" \
    "$host/usr/bin/setpriv" --bounding-set=-sys_admin,-setpcap \
    --inh-caps=-sys_admin,-setpcap --ambient-caps=-sys_admin,-setpcap "$@"