gentoo-build-kernel.docker

#! /usr/bin/env bash
# shellcheck disable=SC2207

declare trace="${TRACE:-}"
# shellcheck disable=SC2034
declare debug="${DEBUG:-}"

set -eu
set -o pipefail

[ -n "${trace:-}" ] && set -o xtrace

cd "$( dirname "$( readlink -e "${0}" )" )" || exit 1

# Set by common/vars.sh, sourced below...
#
#declare build_name=''
#declare _command='docker'
#declare use_essential_gcc=''

# shellcheck disable=SC1091
[ ! -s common/vars.sh ] || . common/vars.sh
# shellcheck disable=SC2034 # Set from common/vars.sh
[[ -n "${__COMMON_VARS_INCLUDED:-}" ]] || {
	echo >&2 'FATAL: Inclusion of common defaults failed'
	exit 1
}

# shellcheck disable=SC2154
declare IMAGE="${build_name}:latest"
# shellcheck disable=SC1091
[ -s common/run.sh ] && . common/run.sh

declare -ir PARALLEL_MEMORY_MIN=4

declare -ir build_space_reqiured=750
declare -ir temp_space_required=2800
declare -ir graph_space_required=8500

declare package_default='sys-kernel/gentoo-sources'
if grep -q -- 'Model.*Raspberry Pi' /proc/cpuinfo; then
	package_default='sys-kernel/raspberrypi-sources'
fi
readonly package_default

declare binutils_min_ver='2.25.0'
declare gcc_min_ver='5.1.0'  # 12.0.0 on PA-RISC
declare llvm_min_ver='13.0.1'  # 11.0.0 before 6.9.0, 15.0.0 on S390, 18.0.0 on loongarch

declare firmware=''
declare microcode=''
declare microcode_blob=''
if grep 'vendor_id' /proc/cpuinfo |
		awk '{ print $3 }' |
		grep -iqm 1 'intel'
then
	microcode='sys-firmware/intel-microcode'
	microcode_blob='intel'
elif grep 'vendor_id' /proc/cpuinfo |
		awk '{ print $3 }' |
		grep -iqm 1 'amd'
then
	firmware='sys-kernel/linux-firmware'
	case "$( # <- Syntax
				grep -Fm 1 'cpu family' /proc/cpuinfo |
					cut -d':' -f 2- |
					awk '{ print $1 }'
			)" in
		16|17|18|20)
			microcode_blob='amd-ucode/microcode_amd.bin'
			;;
		21)
			microcode_blob='amd-ucode/microcode_amd_fam15h.bin'
			;;
		22)
			microcode_blob='amd-ucode/microcode_amd_fam16h.bin'
			;;
		23)
			microcode_blob='amd-ucode/microcode_amd_fam17h.bin amd/amd_sev_fam17h_model0xh.sbin amd/amd_sev_fam17h_model3xh.sbin'
			;;
		25)
			microcode_blob='amd-ucode/microcode_amd_fam19h.bin amd/amd_sev_fam19h_model0xh.sbin'
			;;
	esac
fi
readonly microcode microcode_blob

pkgslot() {
	local pkg="${1:-}"
	local ver="${2:-}"
	local usemax="${3:-}"
	local -i maxver=0
	local -i rc=0

	[[ -n "${pkg:-}" ]] || return 1

	if [[ -z "${ver:-}" ]]; then
		if [[ -n "${usemax:-}" ]]; then
			warn "pkgslot(${*}): Third argument of pkgslot() is" \
				"ignored when no version is specified"
		fi
		printf '%s\n' "${pkg}"
		return 1
	fi

	if [[ "${ver:0:1}" == ':' ]]; then
		if [[ -n "${usemax:-}" ]]; then
			warn "pkgslot(${*}): Third argument of pkgslot() is" \
				"ignored when a SLOT is specified"
			(( rc = 1 ))
		fi
		printf '%s:%s\n' "${pkg}" "${ver:1}"
	else
		[[ "${ver:0:1}" == '-' ]] || ver="-${ver}"
		if [[ -n "${usemax:-}" ]]; then
			case "${usemax}" in
				'1'|'=')
					: ;;
				*)
					warn "pkgslot(${*}): Third argument" \
						"is ambiguous (expected '1'" \
						"or '=')"
					(( rc = 1 ))
					;;
			esac
			(( maxver = $( cut -d'.' -f 1 <<<"${ver:1}" ) + 1 ))
			if (( maxver )); then
				printf '>=%s%s <%s-%s\n' "${pkg}" "${ver}" \
					"${pkg}" "${maxver}"
			else
				warn "pkgslot(${*}): Unable to determine" \
					"maximum version for arguments"
				printf '>=%s%s\n' "${pkg}" "${ver}"
				(( rc = 1 ))
			fi
		else
			printf '>=%s%s\n' "${pkg}" "${ver}"
		fi
	fi

	return $(( rc ))
}  # pkgslot

_docker_setup

if echo " ${*:-} " | grep -Eq -- ' -(h|-help) '; then
	declare usage='' options=''
	usage="Usage: $( basename "${0}" ) "
	# shellcheck disable=SC2116 # echo used for line-splitting
	options="$( echo \
		'[--config-from=<file> [--force]]|[--defconfig=<target>]' \
		'[--no-keep-build|--keep-build[=<dir>]]' \
		'[--no-patch|--patch=<path|url> [<path|url> ...]]' \
		'[--menuconfig|--nconfig]' \
		'[--package=<atom>] [--no-firmware|--firmware] [--clean]' \
		'[--clang [--clean-lto] [--llvm-unwind] [--rust]] [-O3]' \
		'[--debug] [--force-llvm=<version>]'
	)"
	output "${usage}${options}" | fold -sw ${COLUMNS:-"80"} - | head -n 1 >&2
	output "${options}" | fold -sw $(( ${COLUMNS:-"80"} - ${#usage} )) - | sed "s|^|${usage//?/ }|" | tail -n +2 >&2
	output >&2
	output >&2 'Options:'
	output >&2 '       --config-from <file>     Use specified file as kernel base configuration'
	output >&2 '                               (specify config.gz or /proc/config.gz to'
	output >&2 '                                auto-extract the active kernel configuration)'
	output >&2 '                                N.B. To keep the resultant configuration, use'
	output >&2 "                                     the '--keep-build' option to save the"
	output >&2 '                                     build output'
	output >&2 "       --defconfig <target>     preconfigure with specified 'make' target"
	# Turns out this was never implemented!?
	#output >&2 "       --target <target>        configure with specified 'make' target"
	output >&2 '       --keep-build [dir]       Cache the kernel build artefacts for re-use'
	output >&2 '                               (optionally in the specified directory)'
	output >&2 '       --force                  Overwrite build-cache configuration with'
	output >&2 '                                the specified file'
	output >&2 '       --patch <url>            Apply patch (-p1) from specified file or URL'
	output >&2 '       --clear-linux            Apply Intel "Clear Linux" patches'
	output >&2 '       --menuconfig             Interactively reconfigure the kernel via ncurses'
	output >&2 '       --nconfig                Interactively reconfigure the kernel via nconfig'
	output >&2 '       --package <package>      Specify kernel package to build'
	output >&2 "                               (default: '${package_default}')"
	output >&2 '       --with <package>         Specify additional packages requiring kernel src'
	output >&2 "                               (e.g. 'net-firewall/xtables-addons', etc.)"
	output >&2 "       --firmware               Include 'sys-kernel/linux-firmware'"
	output >&2 "       -O3                      Add 'KCFLAGS=-O3' (and others - see [1])"
	output >&2 '       --clang                  Compile kernel with llvm'
	output >&2 '         --llvm-unwind          Install LLVM edition of libunwind'
	output >&2 "         --rust                 Pull-in rust dependencies"
	#output >&2 '         --force-rust <version> Force a specified rust slot'
	output >&2 '         --force-llvm <version> Force a specified LLVM version'
	output >&2 '         --clean-lto            Remove exisitng *.lto.o objects'
	output >&2
	output >&2 "       --clean                  Run 'make distclean' before build"
	output >&2
	output >&2 '       --debug                  Allocate more memory to build-container'
	output >&2
	output >&2 "       --no-install             Don't install build-products to /boot"
	output >&2 '       --bundle                 Generate tar output in /usr/src rather than'
	output >&2 '                                installing the new kernel (implies --no-install)'
	output >&2
	output >&2 "Running on architecture '${arch:-"${ARCH:-}"}'"
	output >&2
	output >&2 '[1]: https://github.com/clearlinux-pkgs/linux/blob/main/0133-novector.patch'
	output >&2
	exit 0
fi

if (( EUID )); then
	die "Please re-run '$( basename "${0}" )' as user 'root'"
fi

declare -i keep_build=1
declare -i bundle=0
declare -i clean=0
declare -i clean_lto=0
declare -i force=0
declare -i install=1
declare -i llvm_slot=0
declare -i llvm_slot_override=0
declare -i opt_o3=0
declare -i intel_patch=0
declare -i raise_mem=0
declare -i rust=0
declare build_dir=''
declare bundle_dir=''
declare compiler='gcc'
declare config_file=''
declare defconfig=''
declare llvm_sub_slot_override=''
declare menuconfig=''
declare nconfig=''
declare package_override=''
declare extra_packages=''
declare patch=''
declare rust_llvm_use=''
declare unwind=''

if [[ -n "${kbuild_opt:-}" ]]; then
	declare arg=''
	for arg in "${@:-}"; do
		shift
		if [[ -n "${arg:-}" ]] &&
				! [[ " ${*} ${kbuild_opt} " == *" ${arg} "* ]]
		then
			set -- ${@+"${@}"} "${arg}"
		else
			print "Skipping duplicate argument '${arg:-}'"
		fi
	done
	unset arg
	set -- "${*:-}" "${kbuild_opt}"
	print "After processing environment variables, arguments are '${*:-}'"
fi
unset kbuild_opt

# Process --menuconfig and --nconfig first, as --config-from refers to them...
#
if echo " ${*:-} " | grep -Fq -- ' --menuconfig '; then
	menuconfig='menuconfig'  # Just has to be set...
	nconfig=''
fi

if echo " ${*:-} " | grep -Fq -- ' --nconfig '; then
	menuconfig=''
	nconfig='nconfig'  # Just has to be set...
fi

# Process options in --help output order where possible...
#
if echo " ${*:-} " | grep -Eq -- ' --config(-from)?[= ]'; then
	if echo " ${*:-} " | grep -Eq -- ' --config(-from)?=[^ ]+ '; then
		config_file="$( # <- Syntax
			echo " ${*} " |
				grep -Eo -- '--config(-from)?=[^ ]+ ' |
				cut -d'=' -f 2- |
				sed 's/ $//'
		)"
	elif echo " ${*:-} " | grep -Eq -- ' --config(-from)? [^ -][^ ]* '; then
		config_file="$( # <- Syntax
			echo " ${*} " |
				grep -Eo -- '--config(-from)? [^ ]+ ' |
				cut -d' ' -f 2- |
				sed 's/ $//'
		)"
	else
		warn "Invalid config option '$( # <- Syntax
			echo " ${*:-} " |
				grep -Eo -- '--config(-from)?[^ ]*[= ][^ ]+ ' |
				sed 's/ $//'
		)'"
	fi
	if echo " ${*:-} " | grep -Fq -- ' --force '; then
		force=1
	fi
else
	if echo " ${*:-} " | grep -Fq -- ' --force '; then
		warn "'--force' is not a valid option without '--config-from'"
	fi
	# Use bash syntax to avoid shellcheck SC2166
	if [[ -n "${menuconfig:-}" || -n "${nconfig:-}" ]] &&
			! grep -Fq -- ' --keep-build ' <<<" ${*:-} "
	then
		warn 'Changes made to configuration will not be saved externally'
	fi
fi

if echo " ${*:-} " | grep -q -- ' --defconfig[= ]'; then
	if echo " ${*:-} " | grep -Eq -- ' --defconfig=[^ ]+ '; then
		defconfig="$( # <- Syntax
			echo " ${*} " |
				grep -Eo -- '--defconfig=[^ ]+ ' |
					cut -d'=' -f 2- |
					sed 's/ $//'
		)"
	elif echo " ${*:-} " | grep -q -- ' --defconfig [^ -][^ ]* '; then
		defconfig="$( # <- Syntax
			echo " ${*} " |
				grep -Eo -- '--defconfig [^ ]+ ' |
				cut -d' ' -f 2- |
				sed 's/ $//'
		)"
	else
		warn "Invalid defconfig option '$( # <- Syntax
			echo " ${*:-} " |
				grep -Eo -- '--defconfig[^ ]*[= ][^ ]+ ' |
				sed 's/ $//'
		)'"
	fi
fi

if echo " ${*:-} " | grep -Fq -- ' --keep-build'; then
	if echo " ${*:-} " | grep -Eq -- ' --keep-build=[^ ]+ '; then
		build_dir="$( # <- Syntax
			echo " ${*} " |
				grep -Eo -- '--keep-build=[^ ]+ ' |
				cut -d'=' -f 2- |
				sed 's/ $//'
		)"
	elif echo " ${*:-} " | grep -q -- ' --keep-build [^ -][^ ]* '; then
		build_dir="$( # <- Syntax
			echo " ${*} " |
				grep -Eo -- '--keep-build [^ ]+ ' |
				cut -d' ' -f 2- |
				sed 's/ $//'
		)"
	elif echo " ${*:-} " | grep -Fq -- ' --keep-build '; then
		:
	else
		warn "Invalid build option '$( # <- Syntax
			echo " ${*:-} " |
				grep -Eo -- '--keep-build[^ ]+ ' |
				sed 's/ $//'
		)'"
		keep_build=0
	fi
elif echo " ${*:-} " | grep -Fq -- ' --no-keep-build '; then
	keep_build=0
fi

# --force: see above

# --patch: see below

if echo " ${*:-} " | grep -Fq -- ' --clear-linux '; then
	if type -pf curl >/dev/null 2>&1; then
		intel_patch=1
	else
		warn "Disabling '--clear-linux' since net-misc/curl is not installed"
	fi
fi

# --menuconfig: see above

# --nconfig: see above

if echo " ${*:-} " | grep -Fq -- ' --package'; then
	if echo " ${*:-} " | grep -Eq -- ' --package=[^ ]+ '; then
		package_override="$( # <- Syntax
			echo " ${*} " |
				grep -Eo -- '--package=[^ ]+ ' |
				cut -d'=' -f 2- |
				sed 's/ $//'
		)"
	elif echo " ${*:-} " | grep -q -- ' --package [^ -][^ ]* '; then
		package_override="$( # <- Syntax
			echo " ${*} " |
				grep -Eo -- '--package [^ ]+ ' |
				cut -d' ' -f 2- |
				sed 's/ $//'
		)"
	else
		warn "Invalid package version '$( # <- Syntax
			echo " ${*:-} " |
				grep -Eo -- ' --package[^ ]+ ' |
				sed 's/ $//'
		)'"
	fi
fi

if echo " ${*:-} " | grep -Fq -- ' --with'; then
	if echo " ${*:-} " | grep -Eq -- ' --with=[^ ]+ '; then
		extra_packages="$( # <- Syntax
			echo " ${*} " |
				grep -Eo -- '--with=[^ ]+' |
				while read -r pkg; do
					echo "${pkg}" |
					cut -d'=' -f 2- |
					sed 's/ $//'
				done
		)"
	elif echo " ${*:-} " | grep -q -- ' --with [^ -][^ ]* '; then
		extra_packages="$( # <- Syntax
			echo " ${*} " |
				grep -Eo -- '--with [^ ]+' |
				while read -r pkg; do
					echo "${pkg}" |
					cut -d' ' -f 2- |
					sed 's/ $//'
				done
		)"
	else
		warn "Invalid package version '$( # <- Syntax
			echo " ${*:-} " |
				grep -Eo -- ' --with[^ ]+ ' |
				sed 's/ $//'
		)'"
	fi
fi

# --firmware: see below

if echo " ${*:-} " | grep -Fq -- ' -O3 '; then
	opt_o3=1
else
	if (( intel_patch )); then
		warn "Intel Clear Linux '-O3' patches are excluded due to specifying" \
			"'-march=westmere': invoke with '-O3' to restore other tunings"
	fi
fi

if echo " ${*:-} " | grep -Eq -- ' --(clang|llvm) '; then
	compiler='clang'
	if echo " ${*:-} " | grep -Fq -- ' --clean-lto '; then
		clean_lto=1
	fi
	if echo " ${*:-} " | grep -Eq -- ' --(llvm-)?(lib)?unwind '; then
		unwind='llvm'
	fi
	if echo " ${*:-} " | grep -Fq -- ' --rust '; then
		rust=1
	fi
	if echo " ${*:-} " | grep -Fq -- ' --force-llvm'; then
		if echo " ${*:-} " | grep -Eq -- ' --force-llvm=[^ ]+ '; then
			llvm_sub_slot_override="$( # <- Syntax
				echo " ${*} " |
					grep -Eo -- '--force-llvm=[^ ]+ ' |
					cut -d'=' -f 2- |
					sed 's/-r.*$// ; s/ $//' |
					sort -V |
					tail -n 1
			)"
		elif echo " ${*:-} " | grep -q -- ' --force-llvm [^ -][^ ]* '; then
			llvm_sub_slot_override="$( # <- Syntax
				echo " ${*} " |
					grep -Eo -- '--force-llvm [^ ]+ ' |
					cut -d' ' -f 2- |
					sed 's/-r.*$// ; s/ $//' |
					sort -V |
					tail -n 1
			)"
		else
			warn "Invalid LLVM version '$( # <- Syntax
				echo " ${*:-} " |
					grep -Eo -- ' --force-llvm[^ ]+ ' |
					sed 's/ $//'
			)'"
		fi

		if [[ -n "${llvm_sub_slot_override:-}" ]]; then
			print "Override llvm_sub_slot is '${llvm_sub_slot_override}'" \
				"from '${*}'"
			(( llvm_slot_override = $( # <- Syntax
				cut -d'.' -f 1 <<<"${llvm_sub_slot_override}"
			) ))
			rust_llvm_use='-system-llvm'
		fi
	fi
else
	if echo " ${*:-} " | grep -Fq -- ' --clean-lto '; then
		warn "'--clean-lto' is not a valid option without '--clang'"
	fi
	if echo " ${*:-} " | grep -Eq -- ' --(llvm-)?(lib)?unwind '; then
		warn "'--llvm-unwind' is not a valid option without '--clang'"
	fi
	if echo " ${*:-} " | grep -Fq -- ' --rust '; then
		warn "'--rust' is not a valid option without '--clang'"
	fi
	if echo " ${*:-} " | grep -q -- ' --force-llvm[ =]'; then
		warn "'--force-llvm' is not a valid option without '--clang'"
	fi
fi

if echo " ${*:-} " | grep -Fq -- ' --clean '; then
	clean=1
fi

if echo " ${*:-} " | grep -Fq -- ' --debug '; then
	raise_mem=1
fi

# --(no-)install: see below
if echo " ${*:-} " | grep -Eq -- ' --bundle[= ]'; then
	if echo " ${*:-} " | grep -Eq -- ' --bundle=[^ ]+ '; then
		bundle_dir="$( # <- Syntax
			echo " ${*} " |
				grep -Eo -- '--bundle=[^ ]+ ' |
				cut -d'=' -f 2- | sed 's/ $//'
		)"
	elif echo " ${*:-} " | grep -Eq -- ' --bundle [^ -][^ ]* '; then
		bundle_dir="$( # <- Syntax
			echo " ${*} " |
				grep -Eo -- '--bundle [^ ]+ ' |
				cut -d' ' -f 2- |
				sed 's/ $//'
		)"
	else
		bundle_dir='/usr/src'
	fi
	bundle=1
	install=0
fi

if echo " ${*:-} " | grep -Fq -- ' --no-install '; then
	install=0
elif echo " ${*:-} " | grep -Fq -- ' --install '; then
	install=1
fi

if [[ -n "${config_file:-}" && -n "${defconfig:-}" ]]; then
	warn "'--defconfig' (${defconfig}) overrides '--config-from'" \
		"(${config_file}) - using former value"
fi

declare package=''
declare package_version=''
declare container_name=''
declare distro=''
if ! echo "${package_override:-"${package_default}"}" | grep -Fq -- '/'; then
	package_override="$( # <- Syntax
		sed -r 's|^([^a-zA-Z])*([a-zA-Z].*)$|\1sys-kernel/\2|' \
			<<<"${package_override:-"${package_default}"}"
	)"
	print "Searching for package name '${package_override}' ..."
fi
_docker_resolve "${package_override:-"${package_default}"}"
if ! echo "${package}" | grep -Fq -- '/'; then
	error "Resolved package '${package}' with version '${package_version}'" \
		"lacks a category"
	die "Essential package data not found - aborting"
fi
print "Using package '=${package}' ..."
# shellcheck disable=SC2001 # POSIX sh compatibility
container_name="$( echo "${package}" | sed 's|/|.|' )"
export container_name
case "${package}" in
	*gentoo*)
		distro='-gentoo'
		;;
esac

# --patch
#
# Unless noted, the patches below are for the highest supported GCC version...
declare kpatch=''

if ! echo " ${*:-} " | grep -q -- ' --no-patch'; then
	declare kpatchprefix='https://raw.githubusercontent.com/graysky2/kernel_compiler_patch/refs/heads/master'
	# The first gcc release was gcc-2.95 (preceeded by egcs-1.1.2), since
	# gcc-4.0.0 there have been no gcc-{x}.0 releases...
	declare gcc_ver=''
	case "${package_version}" in
		3.[2-9].*|3.1[0-4].*)
			if type -pf gcc >/dev/null 2>&1; then
				gcc_ver="$( gcc --version | awk '( NR == 1 ) {print $NF}' | cut -d'.' -f 1-2 )"
				case "${gcc_ver:-}" in
					[23].*|4.[01])
						warn "gcc${gcc_ver:+" ${gcc_ver}"} is too old to apply microarchitectures patch to kernel ${package_version}" ;;
					4.[2-8])
						kpatch="${kpatchprefix}/outdated_versions/linux-3.2%2B/gcc-4.2%2B/enable_additional_cpu_optimizations_for_gcc.patch" ;;
					*)
						kpatch="${kpatchprefix}/outdated_versions/linux-3.2%2B/gcc-4.9%2B/enable_additional_cpu_optimizations_for_gcc_v4.9%2B.patch" ;;
				esac
			else
				warn "Could not determine gcc location or version, not applying microarchitectures patch to kernel ${package_version}"
			fi ;;
		3.1[5-9].*|4.[0-9].*|4.1[0-2].*)
			if type -pf gcc >/dev/null 2>&1; then
				gcc_ver="$( gcc --version | awk '( NR == 1 ) {print $NF}' | cut -d'.' -f 1-2 )"
				case "${gcc_ver:-}" in
					[23].*|4.[01])
						warn "gcc${gcc_ver:+" ${gcc_ver}"} is too old to apply microarchitectures patch to kernel ${package_version}" ;;
					4.[2-8])
						kpatch="${kpatchprefix}/outdated_versions/linux-3.15%2B/gcc-4.2%2B/enable_additional_cpu_optimizations_for_gcc_kernel_v3.15%2B.patch" ;;
					*)
						kpatch="${kpatchprefix}/outdated_versions/enable_additional_cpu_optimizations_for_gcc_v4.9%2B_kernel_v3.15%2B.patch" ;;
				esac
			else
				warn "Could not determine gcc location or version, not applying microarchitectures patch to kernel ${package_version}"
			fi ;;
		4.1[3-8].*)
			if type -pf gcc >/dev/null 2>&1; then
				gcc_ver="$( gcc --version | awk '( NR == 1 ) {print $NF}' | cut -d'.' -f 1-2 )"
				case "${gcc_ver:-}" in
					[23].*|4.[0-8])
						warn "gcc${gcc_ver:+" ${gcc_ver}"} is too old to apply microarchitectures patch to kernel ${package_version}" ;;
					4.9|[5-7].*)
						kpatch="${kpatchprefix}/outdated_versions/enable_additional_cpu_optimizations_for_gcc_v4.9+_kernel_v4.13+.patch" ;;
					*)
						kpatch="${kpatchprefix}/outdated_versions/enable_additional_cpu_optimizations_for_gcc_v8.1%2B_kernel_v4.13%2B.patch" ;;
				esac
			else
				warn "Could not determine gcc location or version, not applying microarchitectures patch to kernel ${package_version}"
			fi ;;
		4.19.*|5.[0-4].*)
			kpatch="${kpatchprefix}/more-ISA-levels-and-uarches-for-kernel-4.19-5.4.patch" ;;
		5.[56].*)
			if type -pf gcc >/dev/null 2>&1; then
				gcc_ver="$( gcc --version | awk '( NR == 1 ) {print $NF}' | cut -d'.' -f 1-2 )"
				case "${gcc_ver:-}" in
					[2-8].*)
						warn "gcc${gcc_ver:+" ${gcc_ver}"} is too old to apply microarchitectures patch to kernel ${package_version}" ;;
					9.*)
						kpatch="${kpatchprefix}/outdated_versions/enable_additional_cpu_optimizations_for_gcc_v9.1%2B_kernel_v5.5%2B.patch" ;;
					*)
						kpatch="${kpatchprefix}/outdated_versions/enable_additional_cpu_optimizations_for_gcc_v10.1%2B_kernel_v5.5-v5.6.patch" ;;
				esac
			else
				warn "Could not determine gcc location or version, not applying microarchitectures patch to kernel ${package_version}"
			fi ;;
		5.7.*)
			if type -pf gcc >/dev/null 2>&1; then
				gcc_ver="$( gcc --version | awk '( NR == 1 ) {print $NF}' | cut -d'.' -f 1-2 )"
				case "${gcc_ver:-}" in
					[2-8].*)
						warn "gcc${gcc_ver:+" ${gcc_ver}"} is too old to apply microarchitectures patch to kernel ${package_version}" ;;
					9.*)
						kpatch="${kpatchprefix}/outdated_versions/enable_additional_cpu_optimizations_for_gcc_v9.1%2B_kernel_v5.7%2B.patch" ;;
					*)
						kpatch="${kpatchprefix}/outdated_versions/enable_additional_cpu_optimizations_for_gcc_v10.1%2B_kernel_v5.7.patch" ;;
				esac
			else
				warn "Could not determine gcc location or version, not applying microarchitectures patch to kernel ${package_version}"
			fi ;;
		5.[89].*|5.1[0-4].*)
			kpatch="${kpatchprefix}/more-ISA-levels-and-uarches-for-kernel-5.8-5.14.patch"
			case "${package_version}" in
				5.11.*)
					kpatch+=" https://lore.kernel.org/linux-btrfs/206d121e2e2b609ffe31217e6d90bfabe1c4e121.1616066404.git.fdmanana@suse.com/raw" ;;
			esac
			;;
		5.15.*|5.16.*)
			kpatch="${kpatchprefix}/more-ISA-levels-and-uarches-for-kernel-5.15-5.16.patch" ;;
		5.1[7-9].*|6.0.*|6.1.[0-6][0-9]*|6.1.7[0-8]*)
			kpatch="${kpatchprefix}/more-ISA-levels-and-uarches-for-kernel-5.17-6.1.78.patch"
			case "${package_version}" in
				5.19.*)
					kpatch+=" https://lore.kernel.org/all/20220630090100.2769490-1-yi.zhang@huawei.com/raw"
			esac
			;;
		#6.1.79*|6.1.[89][0-9]*|6.1.[1-9][0-9][0-9]*|6.[2-7].*)
		#	kpatch="${kpatchprefix}/more-ISA-levels-and-uarches-for-kernel-6.1.79%2B.patch" ;;
		#6.[89].*|6.1[0-9].*)
		#	kpatch="${kpatchprefix}/lite-more-x86-64-ISA-levels-for-kernel-6.8-rc4%2B.patch" ;;
		6.1.79*|6.1.[89][0-9]*|6.1.[1-9][0-9][0-9]|6.[2-9].*|6.[1-9][0-9].*)
			kpatch="${kpatchprefix}/more-ISA-levels-and-uarches-for-kernel-6.1.79%2B.patch" ;;
		'')
			: ;;
		*)
			warn "No known patch for kernel ${package_version} from https://github.com/graysky2/kernel_compiler_patch"
			;;
	esac
	unset gcc_ver kpatchprefix
fi
case "${arch:-"${ARCH:-}"}" in
	arm64)
		# This patch is specific to the Raspberry Pi 4/BCM2711/Cortex-A72;
		# the RPi5/BCM2712 uses a Cortex-A76
		# FIXME: This patch could itself be trivially patched to account for
		#        this...
		if [[ "$( # <- Syntax
				emerge --info 2>/dev/null |
					grep '^USE=' |
					cut -d'"' -f 2
				)" =~ pi4 ]]
		then
			kpatch="${kpatch:+"${kpatch} "}https://raw.githubusercontent.com/graysky2/kernel_compiler_patch/refs/heads/master/other/build-with-mcpu-for-cortex-a72.patch"
		fi
		;;
esac

print "Kernel patch(es) are: '${kpatch:-}'"
# Allow '--no-patch --patch=...' to exclude default kernel patches...
if echo " ${*:-} " | grep -q -- ' --no-patch'; then
	kpatch=''
fi

if echo " ${*:-} " | grep -q -- ' --patch'; then
	if echo " ${*:-} " | grep -q -- ' --patch=[^ ]\+ '; then
		patch="$( # <- Syntax
			echo " ${*} " |
				grep -o -- '--patch=[^ ]\+ ' |
				cut -d'=' -f 2- |
				sed 's/ $// ; s/,/ /g'
		)"
	elif echo " ${*:-} " | grep -q -- ' --patch [^ -][^ ]* '; then
		patch="$( # <- Syntax
			echo " ${*} " |
				grep -o -- '--patch [^ ]\+ ' |
				cut -d' ' -f 2- |
				sed 's/ $// ; s/,/ /g'
		)"
	else
		warn "Invalid patch option '$( # <- Syntax
			echo " ${*:-} " |
				grep -o -- ' --patch[^ ]\+ ' |
				sed 's/ $//'
		)'"
	fi
fi
if (( intel_patch )); then
	declare clear_commit='' clear_patch=''
	clear_commit="$( # <- Syntax
		curl -fLSs 'https://api.github.com/repos/clearlinux-pkgs/linux/tags' |
			jq -r "map_values(select(.name | startswith(\"${package_version%-r*}\")))[].commit.sha" |
			head -n 1
	)"
	if [[ -z "${clear_commit:-}" ]]; then
		error "Intel Clear Linux has no patches for kernel" \
			"${package_version%-r*}"
		intel_patch=0
	else
		info >&2 "Clear Linux patches for kernel ${package_version%-r*} are" \
			"commit '${clear_commit}'"
		while read -r clear_patch; do
			patch="${patch:+"${patch} "}https://raw.githubusercontent.com/clearlinux-pkgs/linux/${clear_commit}/${clear_patch}"
		done < <( # <- Syntax
			# We replace '0133-novector.patch' with a more specific patch of
			# our own, but several of Intel's patches targeted at specific
			# releases are outdated and simply won't apply :(
			# We don't want to filter those here, though, as they may update
			# them for future releases: the only harm is noise when we warn
			# that a bad patch didn't apply cleanly.
			#
			curl -fLSs "https://raw.githubusercontent.com/clearlinux-pkgs/linux/${clear_commit}/linux.spec" |
				grep -- '^Patch[0-9]' |
				awk '{print $2}' |
				grep -v '0133-novector.patch'
		)
	fi
	unset clear_patch clear_commit
fi
if [[ -n "${kpatch:-}" ]]; then
	patch="${kpatch}${patch:+" ${patch}"}"
fi
print "All patch(es) are: '${patch:-}'"
unset kpatch

# --firmware
#
if echo " ${*:-} " | grep -q -- ' --firmware'; then
	firmware='sys-kernel/linux-firmware'
elif echo " ${*:-} " | grep -q -- ' --no-firmware'; then
	firmware=''
fi

# End of argument handling

# scripts/min-tool-version.sh first appeared in Linux v5.12
case "${package_version}" in
	[01234].*|5.[0123456789].*|5.1[01].*)
		die "Minimum supported kernel version is 5.12.0, found" \
			"'${package_version}'"
		;;
	5.12.*)
		binutils_min_ver='2.23.0'
		case "${arch:-"${ARCH:-}"}" in
			arm64)
				gcc_min_ver='5.1.0'
				;;
			*)
				gcc_min_ver='4.9.0'
				;;
		esac
		llvm_min_ver='10.0.1'
		;;
	5.13.*)
		binutils_min_ver='2.23.0'
		case "${arch:-"${ARCH:-}"}" in
			arm64)
				gcc_min_ver='5.1.0'
				;;
			*)
				gcc_min_ver='4.9.0'
				;;
		esac
		case "${arch:-"${ARCH:-}"}" in
			s390)
				llvm_min_ver='13.0.0'
				;;
			*)
				llvm_min_ver='10.0.1'
				;;
		esac
		;;
	5.1[45].*)
		binutils_min_ver='2.23.0'
		gcc_min_ver='5.1.0'
		case "${arch:-"${ARCH:-}"}" in
			s390)
				llvm_min_ver='13.0.0'
				;;
			*)
				llvm_min_ver='10.0.1'
				;;
		esac
		;;
	5.1[67].*)
		binutils_min_ver='2.23.0'
		gcc_min_ver='5.1.0'
		case "${arch:-"${ARCH:-}"}" in
			s390)
				llvm_min_ver='13.0.0'
				;;
			*)
				llvm_min_ver='11.0.0'
				;;
		esac
		;;
	5.1[89].*|6.0.*)
		binutils_min_ver='2.23.0'
		gcc_min_ver='5.1.0'
		case "${arch:-"${ARCH:-}"}" in
			s390)
				llvm_min_ver='14.0.0'
				;;
			*)
				llvm_min_ver='11.0.0'
				;;
		esac
		;;
	6.[123].*)
		binutils_min_ver='2.25.0'
		gcc_min_ver='5.1.0'
		case "${arch:-"${ARCH:-}"}" in
			s390)
				llvm_min_ver='15.0.0'
				;;
			*)
				llvm_min_ver='11.0.0'
				;;
		esac
		;;
	6.[456].*)
		binutils_min_ver='2.25.0'
		case "${arch:-"${ARCH:-}"}" in
			hppa)
				gcc_min_ver='12.0.0'
				;;
			*)
				gcc_min_ver='5.1.0'
				;;
		esac
		case "${arch:-"${ARCH:-}"}" in
			s390)
				llvm_min_ver='15.0.0'
				;;
			*)
				llvm_min_ver='11.0.0'
				;;
		esac
		;;
	6.7.*)
		binutils_min_ver='2.25.0'
		case "${arch:-"${ARCH:-}"}" in
			hppa)
				gcc_min_ver='12.0.0'
				;;
			*)
				gcc_min_ver='5.1.0'
				;;
		esac
		case "${arch:-"${ARCH:-}"}" in
			loong)
				llvm_min_ver='18.0.0'
				;;
			s390)
				llvm_min_ver='15.0.0'
				;;
			*)
				llvm_min_ver='11.0.0'
				;;
		esac
		;;
	#6.8.*)
	*)
		binutils_min_ver='2.25.0'
		case "${arch:-"${ARCH:-}"}" in
			hppa)
				gcc_min_ver='12.0.0'
				;;
			*)
				gcc_min_ver='5.1.0'
				;;
		esac
		case "${arch:-"${ARCH:-}"}" in
			loong)
				llvm_min_ver='18.0.0'
				;;
			s390)
				llvm_min_ver='15.0.0'
				;;
			*)
				llvm_min_ver='13.0.1'
				;;
		esac
		;;
esac

if [[ "${compiler}" == 'clang' ]]; then
	declare rust_slot=''
	# https://github.com/rust-lang/rust-bindgen/issues/2312
	declare bindgen_ver='0.56.0'
	declare -i llvm_min_slot=0
	declare -i llvm_default_slot=0
	declare llvm_sub_slot=''

	(( llvm_min_slot = $( cut -d'.' -f 1 <<<"${llvm_min_ver}" ) ))
	(( llvm_default_slot = llvm_min_slot ))

	case "${package_version}" in
		[12345].*|6.0.*)
			if (( rust )); then
				warn 'Disabling dev-lang/rust support prior to kernel 6.1.x'
				rust=0
			fi
			;;
		6.[1234].*)
			#rust_slot='1.62.0'
			(( llvm_default_slot = 14 ))
			;;
		6.5.*)
			#rust_slot='1.68.2'
			(( llvm_default_slot = 15 ))
			;;
		6.6.*)
			rust_slot='1.71.1'
			bindgen_ver='0.65.1'
			(( llvm_default_slot = 16 ))
			;;
		6.7.*)
			rust_slot='1.73.0'
			bindgen_ver='0.65.1'
			(( llvm_default_slot = 17 ))
			;;
		6.8.*)
			rust_slot='1.74.1'
			bindgen_ver='0.65.1'
			(( llvm_default_slot = 17 ))
			;;
		6.9.*)
			rust_slot='1.76.0'
			bindgen_ver='0.65.1'
			(( llvm_default_slot = 17 ))
			;;
		6.1[0-9].*)
			# Gentoo skipped rust-1.78.0 and jumped straight from rust-1.77.1
			# to rust-1.79.0 ...
			#rust_slot='1.78.0'
			rust_slot='1.79.0'
			bindgen_ver='0.65.1'
			(( llvm_default_slot = 17 ))
			;;
		*)
			if (( rust )); then
				warn "Disabling dev-lang/rust support for unknown kernel" \
					"${package_version}"
				rust=0
			fi
			;;
	esac

	if ! (( llvm_slot_override )); then
		# No command-line override...
		(( llvm_slot = llvm_default_slot ))
		unset llvm_default_slot llvm_sub_slot_override llvm_slot_override
	else
		# Overrides in llvm_sub_slot_override & llvm_slot_override...
		declare last_bad_llvm_ver=''
		for last_bad_llvm_ver in \
			"$(( llvm_default_slot - 1 )).999.999" \
			"$(( llvm_min_slot - 1 )).999.999"
		do
			if [[ "$( # <- Syntax
					printf '%s\n%s\n' \
							"${llvm_sub_slot_override}" \
							"${last_bad_llvm_ver}" |
						sort -V |
						tail -n 1
					)" == "${last_bad_llvm_ver}" ]]
			then
				die "Specified LLVM version '${llvm_sub_slot_override}' is" \
					"below minimum required version '${llvm_default_slot}'"
			fi
		done
		unset last_bad_llvm_ver
		if [[ "${llvm_sub_slot_override}" == *.* ]]; then
			llvm_sub_slot="${llvm_sub_slot_override}"
			llvm_slot="${llvm_sub_slot%%.*}"
		fi
	fi
	unset llvm_sub_slot_override llvm_slot_override

	if [[ -z "${llvm_sub_slot:-}" ]]; then
		case ${llvm_slot} in
			0)
				die "'llvm_slot' is required for clang builds" ;;
			[1-9]|10) : ;;
			11|12|13)
				llvm_sub_slot="${llvm_slot}.0.1" ;;
			15)
				llvm_sub_slot="${llvm_slot}.0.7" ;;
			*)
				llvm_sub_slot="${llvm_slot}.0.6" ;;
		esac
	fi

	print "Building with LLVM ${llvm_slot} (${llvm_sub_slot}) ..."
fi # [[ "${compiler}" == 'clang' ]]

# shellcheck disable=SC2154
$_command image list "${IMAGE%":"*}" |
		grep -Eq -- "^(localhost/)?${IMAGE%":"*}" ||
	die "docker image '${IMAGE%":"*}' not found"

if mount | grep ' on /boot ' | grep -Eq '(\(ro,|,ro,|,ro\))'; then
	output >&2
	output >&2 '*****'
	output >&2 '*'
	output >&2 '* WARNING: Your /boot partition is mounted read-only'
	output >&2 '*'
	output >&2 '*          Please remount read/write and retry'
	output >&2 '*'
	output >&2 '*****'
	output >&2
	sleep 5
fi

declare build_version=''
build_version="$( echo "${package_version}" | cut -d'.' -f 1-2 )"
if [[ -z "${build_dir:-}" ]]; then
	# Even if '--keep-build' hasn't been specified, we still set build_dir
	# here, we just won't mount it from the host later...
	#
	declare name="${package_override:-"${package_default}"}"
	name="${name#*"/"}"
	name="${name%"-sources"*}"
	build_dir="/usr/src/linux-${name}-build-${compiler}${unwind:+"-unwind"}-${build_version}.x"
	unset name
fi
unset build_version
if [[ "${keep_build:-}" = '1' ]]; then
	info >&2 "Using build directory '${build_dir}' ..."
	mkdir -p "${build_dir}" || die "mkdir() on '${build_dir}' failed: ${?}"
fi

if [[ -n "${config_file:-}" ]]; then
	if
		[[ "${keep_build:-}" = '1' ]] &&
		[[ -s "${build_dir}"/.config ]] &&
		[[ "${force:-}" != '1' ]]
	then
		warn "Not replacing existing '${build_dir}/.config' file without" \
			"'--force'"
		config_file="${build_dir}/.config"
	else
		# We've already changed to the script directory, so if there ever were
		# a file in the same location named 'config.gz', it's unlikely to be
		# one we'd actually want to use!
		#
		if
			[[ "${config_file}" = 'config.gz' ]] ||
			[[ "${config_file}" = '/proc/config.gz' ]]
		then
			note >&2 'Attempting to use current kernel configuration ...'
			if ! lsmod | grep -qw -- '^configs'; then
				warn "Attempting to load 'configs' module..."
				modprobe configs || :
			fi
			if ! [[ -r /proc/config.gz ]]; then
				die "Cannot read current kernel configuration '/proc/config.gz'"
			fi
			if [[ "${keep_build:-}" = '1' ]]; then
				config_file="${build_dir}/.config"
				note >&2 "Extracting /proc/config.gz to '${config_file}' ..."
				zcat /proc/config.gz > "${config_file}" ||
					die "zcat failed: ${?}"
			else
				config_file="${TMPDIR:-"/tmp"}/linux-${package_version%"-r"[0-9]}.config"
				if [[ -e "${config_file}" ]]; then
					die "configuration file '${config_file}' already exists"
				fi
				note >&2 "Extracting /proc/config.gz to '${config_file}' ..."
				zcat /proc/config.gz > "${config_file}" ||
					die "zcat failed: ${?}"
			fi
		else
			if [[ "${keep_build:-}" = '1' ]]; then
				if ! file "${config_file}" >/dev/null 2>&1; then
					die "configuration file '${config_file}' is unreadable" \
						"or missing"
				elif file "${config_file}" 2>&1 |
						grep -Fq -- 'gzip compressed data'
				then
					die "configuration file '${config_file}' is compressed"
				else
					cp "${config_file}" "${build_dir}"/.config ||
						die "file copy from '${config_file}' to" \
							"'${build_dir}/.config' failed: ${?}"
					config_file="${build_dir}/.config"
				fi
			fi
		fi
		note >&2 "Resolving kernel configuration '${config_file}' ..."
		config_file="$( readlink -e "${config_file}" )"
		note >&2 "Kernel configuration resolved to '${config_file}'"
		if ! [[ -s "${config_file}" ]]; then
			die "Cannot read kernel configuration file '${config_file}'"
		fi
		if ! [[ -w "${config_file}" ]]; then
			die "Cannot write to kernel configuration file '${config_file}'"
		fi
		if ! [[ "${keep_build:-}" = '1' ]]; then
			#info >&2 "Using '${config_file}' as kernel configuration -" \
			#	"changes WILL BE saved to this file..."
			info >&2 "Using '${config_file}' as kernel configuration"
		fi
	fi
fi

[ -d log ] || mkdir log

declare openmp='openmp'
declare pre_remove=''
declare pre_pkgs=''
declare pre_use=''
declare post_use=''
declare -a compiler_pkgs=()
declare compiler_USE="${rust_llvm_use:-}"
declare container_CC='gcc'
declare container_CXX='g++'
declare container_LLVM=''
declare container_KCFLAGS=''
if (( opt_o3 )); then
	case "${arch:-"${ARCH:-}"}" in
		amd64)	declare add_flags='-O3 -mno-avx2 -fno-tree-vectorize' ;;
		*)		declare add_flags='-O3 -fno-tree-vectorize' ;;
	esac
	if [[ -e /proc/cpuinfo && -r /proc/cpuinfo ]]; then
		# FIXME: Only valid when the build-host is of similar architecture to
		#        the target host...
		#
		if grep -Fq -e ' sse4_2' -e ' popcnt' /proc/cpuinfo; then
			add_flags+=' -mpopcnt'
		fi
	fi
	case "${compiler}" in
		clang|llvm)
			(( llvm_slot )) || die "'llvm_slot' is required for clang builds"

			if (( 14 == llvm_slot )); then
				add_flags+=' --rtlib=compiler-rt'
				add_flags+=' --unwindlib=libunwind'
				add_flags+=' --stdlib=libc++'
				add_flags+=' -fuse-ld=lld'

				# I don't recall whether these are only needed for clang:14, or
				# whether the intent was to apply these to >=clang:14 but this
				# was lost...
				#
				# gcc is now built with 'default-stack-clash-protection';
				# At least CONFIG_CC_STACKPROTECTOR_STRONG should control
				# -fstack-protector-strong, as opposed to hard-coding here;
				# CONFIG_X86_PIE appears to have been proposed for x86_64 in
				# 2017/2018, and was then renewed in 2023, but still doesn't
				# appear to have been merged
				#
				# ... therefore I'm calling schenanigans on these!
				#
				#add_flags+=' -fstack-clash-protection'
				#add_flags+=' -fstack-protector-strong'
				#add_flags+=' -fPIE'
			fi
			;;
		gcc)
			# TODO: Intel adds '-fivopts' with [1], but this should be enabled
			#       at -O1 and above by default (but also reports this as a
			#       patch for >=gcc-12 only)?
			#
			# [1] https://github.com/clearlinux-pkgs/linux/blob/main/0133-novector.patch
			#
			add_flags+=' -fivopts -fmodulo-sched'
			;;
	esac
	container_KCFLAGS="KCFLAGS=\"${add_flags}\""
	unset add_flags
fi

# Unconditionally add sys-devel/gcc USE flags, in case we need to rebuild it
# even when we are primarily using clang/LLVM...
#
# shellcheck disable=SC2154
compiler_USE+="-fortran -lib-only ${use_essential_gcc}"
case "${compiler}" in
	gcc)
		compiler_pkgs=(
			$( pkgslot sys-devel/binutils "${binutils_min_ver:-}" )
			$( pkgslot sys-devel/gcc "${gcc_min_ver:-}" )
		)
		;;
	clang|llvm)
		(( llvm_slot )) || die "'llvm_slot' is required for clang builds"

		# pkgslot() outputs a '>=' specifier if no slot is requested
		#
		# N.B. LLVM package SLOT values are not consistent across
		#      versions, so for example sys-libs/compiler-rt-14.0.6 has
		#      slot '14.0.6', whereas sys-libs/compiler-rt-16.0.6 has
		#      slot '16'.
		#
		compiler='clang'
		inconsistent_slot="${llvm_sub_slot}"
		if (( llvm_slot > 15 )); then
			inconsistent_slot="${llvm_slot}"
		fi

		case "${bindgen_ver:-}" in
			'0.56.0'*)
				declare limit='='
				;;
		esac
		# shellcheck disable=SC2086
		compiler_pkgs=(
			$( pkgslot sys-devel/binutils "${binutils_min_ver:-}" )
			sys-devel/binutils-config

			$( pkgslot sys-libs/compiler-rt ":${inconsistent_slot}" ) # SLOT=14.0.6, 16
			$( pkgslot sys-libs/compiler-rt-sanitizers ":${inconsistent_slot}" ) # SLOT=14.0.6, 16

			$( pkgslot sys-libs/libcxx ${llvm_slot} ${limit:-} ) # SLOT=0
			$( pkgslot sys-libs/libcxxabi ${llvm_slot} ${limit:-} ) # SLOT=0

			$( pkgslot sys-libs/libomp ${llvm_slot} ${limit:-} ) # SLOT=0, 0/16

			$( pkgslot sys-devel/lld ":${llvm_slot}" ) # SLOT=14/14, 16/16
			$( pkgslot sys-devel/lld-toolchain-symlinks ":${llvm_slot}" ) # SLOT=14, 16
			# As-of 5.10.1: "gold linker 'ld.gold' not supported"...
			#$( pkgslot sys-devel/llvmgold ${llvm_slot} ) # SLOT=0

			$( pkgslot sys-devel/llvm-common ${llvm_slot} ${limit:-} ) # SLOT=0
			$( pkgslot sys-devel/llvm ":${llvm_slot}" ) # SLOT=14, 16/16
			$( pkgslot sys-devel/llvm-toolchain-symlinks ":${llvm_slot}" ) # SLOT=14, 16

			$( pkgslot sys-devel/clang-common ${llvm_slot} ${limit:-} ) # SLOT=0
			$( pkgslot sys-devel/clang-runtime ":${inconsistent_slot}" ) # SLOT=14.0.6, 16
			$( pkgslot sys-devel/clang ":${llvm_slot}" ) # SLOT=14, 16/16
			$( pkgslot sys-devel/clang-toolchain-symlinks ":${llvm_slot}" ) # SLOT=14, 16
		)
		if [[ "${unwind:-}" == 'llvm' ]]; then
			# shellcheck disable=SC2086
			compiler_pkgs=(
				$( pkgslot sys-libs/llvm-libunwind ${llvm_slot} ${limit:-} ) # SLOT=0
			)
		else
			compiler_pkgs=(
				sys-libs/libunwind
			)
		fi
		unset limit
		unset inconsistent_slot
		compiler_USE+=' clang default-compiler-rt default-libcxx default-lld' # gold

		declare -i force_python=0
		case "${bindgen_ver:-}" in
			'0.56.0'*)
				# https://github.com/rust-lang/rust-bindgen/issues/2312
				#
				# LLVM/clang 14 works with the kernel bindgen, but requires
				# python3_10, so patching the older bindgen source seems to
				# make more sense...
				#
				USE+='  python_single_target_python3_10  python_targets_python3_10'
				USE+=' -python_single_target_python3_11 -python_targets_python3_11'
				USE+=' -python_single_target_python3_12 -python_targets_python3_12'
				force_python=1
				;;
			*)
				if [[ "${unwind:-}" == 'llvm' ]]; then
					# sys-libs/llvm-libunwind-14* also depends on python3_10
					#
					case $(( llvm_slot )) in
						'14')
							force_python=1
							;;
					esac
				fi
				;;
		esac
		if (( force_python )); then
			if [[ -f "${SYSROOT:-}/etc/portage/profile/use.mask" ]]; then
				if grep -q -- '^\s*python_targets_python3_10' \
						"${SYSROOT:-}/etc/portage/profile/use.mask"
				then
					die "python3_10 support is required for bindgen-0.56.0," \
						"sys-devel/llvm:14, and in-kernel dev-lang/rust" \
						"support prior to linx-6.5.0 - but is currently" \
						"disabled by" \
						"'${SYSROOT:-}/etc/portage/profile/use.mask'"
				fi
			fi
			compiler_USE+='  python_single_target_python3_10  python_targets_python3_10'
			compiler_USE+=' -python_single_target_python3_11 -python_targets_python3_11'
			compiler_USE+=' -python_single_target_python3_12 -python_targets_python3_12'
		fi
		unset force_python

		container_CC='clang'
		container_CXX='clang++'
		#container_LD='ld.bfd'
		container_LD='ld.lld' # lld required for LTO
		container_LLVM='1'
		#LLVM_TARGETS='-* BPF X86' - moved to ${base_dir}/etc/portage/package.use.build/00_package.use
		;;
	*)
		die "Unknown compiler '${compiler}'"
		;;
esac
case "${unwind:-}" in
	llvm)
		compiler_pkgs+=(
			$( pkgslot sys-libs/llvm-libunwind "${llvm_slot}" '=' ) # SLOT=0
		)
		compiler_USE="$( replace_flags 'llvm-libunwind' -- "${compiler_USE}" )"
		#pre_remove='sys-libs/libunwind'
		#pre_use="$( replace_flags '-default-compiler-rt' '-default-libcxx' \
		#	'-default-lld' '-llvm-libunwind' -- "${pre_use:-}" )"
		#pre_pkgs="$( pkgslot sys-libs/llvm-libunwind "${llvm_slot}" )"
		;;
esac

# FIXME: shellcheck seems to want:
#
#          docker_extra_mounts+=( $( add_mount ... ) )
#
#        ... to be expressed in the form of:
#
#          readarray -O "${#docker_extra_mounts[@]}" -t docker_extra_mounts < <(
#            add_mount ...
#          )
#
# shellcheck disable=SC2207
{
	# FIXME: Standardise on host or container configuration files
	#
	declare -a docker_extra_mounts=()
	docker_extra_mounts+=( $( add_mount --dir --print \
			'/etc/portage/package.accept_keywords'
		) ) || :
	docker_extra_mounts+=( $( add_mount --print \
			'/etc/portage/package.license'
		) ) || :

	if ! [[ -d /etc/portage/package.mask ]]; then
		docker_extra_mounts+=( $( add_mount --print \
				'/etc/portage/package.mask'
			) ) || :
	else
		docker_extra_mounts+=( $( add_mount --print \
				'/etc/portage/package.mask/package.mask' \
				'/etc/portage/package.mask/host.mask'
			) ) || :
		declare extra_mask='' file=''
		while read -r extra_mask; do
			file="$( basename "${extra_mask}" )"
			docker_extra_mounts+=( $( add_mount --print \
					"/etc/portage/package.mask/${file}"
				) ) || :
		done < <( # <- Syntax
			find /etc/portage/package.mask/ \
					-mindepth 1 \
					-maxdepth 1 \
					-type f \
					-not -name 'package.mask' \
					-print0 |
				grep -vz -- '^repo-.*-mask'
		)
		unset file extra_mask
	fi
	if ! [[ -d "${base_dir:+"${base_dir}/"}etc/portage/package.mask" ]]; then
		docker_extra_mounts+=( $( add_mount --print \
				'%base%/etc/portage/package.mask' \
				'.../base.mask'
			) ) || :
	else
		docker_extra_mounts+=( $( add_mount --print \
				'%base%/etc/portage/package.mask/package.mask' \
				'/etc/portage/package.mask/base.mask'
			) ) || :
	fi

	if ! [[ -d /etc/portage/package.unmask ]]; then
		docker_extra_mounts+=( $( add_mount --print \
				'/etc/portage/package.unmask' \
				'.../host.unmask'
			) ) || :
	else
		docker_extra_mounts+=( $( add_mount --print \
				'/etc/portage/package.unmask/package.unmask' \
				'.../host.unmask'
			) ) || :
		declare extra_unmask='' file=''
		while read -r extra_unmask; do
			file="$( basename "${extra_unmask}" )"
			docker_extra_mounts+=( $( add_mount --print \
					"/etc/portage/package.unmask/${file}"
				) ) || :
		done < <( # <- Syntax
			find /etc/portage/package.unmask/ \
					-mindepth 1 \
					-maxdepth 1 \
					-type f \
					-not -name 'package.unmask' \
					-print
		)
		unset file extra_unmask
	fi

	docker_extra_mounts+=( $( add_mount --print \
			'%base%/etc/portage/package.mask.kernel-sources' \
			'/etc/portage/package.mask/kernel-sources.mask'
	) ) || :

	if ! [[ -d /etc/portage/package.use ]]; then
		docker_extra_mounts+=( $( add_mount --print \
				'/etc/portage/package.use' \
				'.../package.use'
		) ) || :
	else
		docker_extra_mounts+=( # <- Syntax
			$( add_mount --print '/etc/portage/package.use/00_package.use' )
			$( add_mount --print '/etc/portage/package.use/01_package.use.local' )
			#$( add_mount --print '/etc/portage/package.use/05_host.use' )
			$( add_mount --print '/etc/portage/package.use/20_python_targets' )
		) || :
	fi

	# Initially package.use.mask was deployed from the host filesystem and
	# use.mask was not made available.  The options to deploy both are:
	#
	#  - Copy use.mask from %base% (requiring an ARCH-specific overrides in
	#    git), copy package.use.mask from the host (keeping this consistent);
	#  - Copy use.mask and package.use.mask from %base% (requiring an
	#    ARCH-specific override and using a different source of truth for
	#    package.use.mask);
	#  - Copy use.mask and package.use.mask from the host (maintaining
	#    consistency and no longer requiring an override, so long as the host
	#    file has been customised)
	#
	# N.B. An override is still required for service builds, which do not use
	#      host files.  However, sync-portage.sh will now deploy an override
	#      file (if one exists) to the host filesystem, so it isn't too much of
	#      an issue to use both.
	#
	docker_extra_mounts+=(
		$( add_mount --print '/etc/portage/profile/package.use.force' )
		$( add_mount --print '/etc/portage/profile/package.use.mask' )
		$( add_mount --print '/etc/portage/profile/use.mask' )
	) || :

	declare patch_file='' patch_dir=''
	declare new_patch=''
	declare -i patch_updated=0
	print "Patch list is '${patch:-}'"
	# FIXME: This will break if a custom patch with spaces in the name is
	#        specified...
	for patch_file in ${patch:-}; do
		print "... processing patch '${patch_file}'"
		case "${patch_file:-}" in
			http*)
				new_patch="${new_patch:+"${new_patch} "}${patch_file}"
				;;
			'')
				:
				;;
			*)
				if [[ -e "${patch_file}" ]] &&
					[[ -f "${patch_file}" ]] &&
					[[ -s "${patch_file}" ]]
				then
					patch_dir="$( dirname "${patch_file}" )"
					patch_file="$( basename "${patch_file}" )"
					if docker_extra_mounts+=( $( add_mount --print \
							"${patch_dir}/${patch_file}" \
							"/usr/src/patch/${patch_file}"
					) )
					then
						patch_file="/usr/src/patch/${patch_file}"
						new_patch="${new_patch:+"${new_patch} "}${patch_file}"
						patch_updated=1
					fi
				else
					warn "Patch '${patch_file}' not found"
				fi
				;;
		esac
	done
	if (( patch_updated )); then
		print "Patch list updated from '${patch}' to '${new_patch}'"
		patch="${new_patch}"
	fi
	unset patch_updated new_patch patch_file

	declare rustext=''
	if (( rust )); then
		rustext='rustc'
	fi
	declare image_name_and_version=''
	case $(( llvm_slot )) in
		0)
			declare image_name_and_version="${container_name}.${compiler}${rustext:+"-${rustext}"}"
			;;
		*)
			declare image_name_and_version="${container_name}.${compiler}-${llvm_slot}${rustext:+"-${rustext}"}"
			;;
	esac
	declare -r image_name="${container_name%"-${package_version}"}.${image_name_and_version#"${container_name}."}"
	declare -r log_name="${image_name_and_version}"
	declare -x name="${image_name_and_version}"
	# 'image' consumed in common/run.sh ...
	declare -x image="${IMAGE}"
	unset image_name_and_version

	# shellcheck disable=SC2154
	if [[ "$( # <- Syntax
				$_command image list "${image_name}:${package_version}" |
					wc -l
			)" != '2' ]]
	then
		(
			ACCEPT_LICENSE='linux-fw-redistributable no-source-code'
			declare -a use=()
			if [[ -n "${firmware:-}" ]]; then
				use=( 'firmware' )
			else
				use=( '-firmware' )
			fi
			# shellcheck disable=SC2206
			use+=( # <- Syntax
				'extra-filters'
				${rustext:+"http2"}
				'lzma'
				${openmp:+"openmp"}
				${rustext:+"rust-src"}
				'symlink'
				'threads'
				'zlib'
				${compiler_USE}
			)
			USE="${use[*]}"
			unset use
			export ACCEPT_LICENSE USE

			if [[ -n "${openmp:-}" ]]; then
				pre_pkgs="${pre_pkgs:+"${pre_pkgs} "}sys-devel/gcc app-crypt/libb2"
				pre_use="$( replace_flags '-lib-only' '-lto' '-pgo' -- "${pre_use:-}" )"
				post_use="${post_use:+"${post_use} "}-lib-only"
			fi
			if [[ -n "${rustext:-}" ]]; then
				post_use="${post_use:+"${post_use} "}http2"
			fi

			# shellcheck disable=SC2206
			declare -a pkgs=( # <- Syntax
				${compiler_pkgs[@]:-}
				app-admin/kernel-hardening-checker
				app-arch/bzip2
				app-arch/cpio
				app-arch/lz4
				app-arch/lzma
				app-arch/xz-utils
				app-arch/zstd
				app-crypt/libb2
				dev-util/pahole
				dev-libs/libyaml
				sys-apps/coreutils
				sys-apps/kmod
				sys-process/time
				${microcode:-}
				${firmware:-}

				# N.B. virtual/rust is now deprecated
				#${rustext:+"${rust_ver:+">="}virtual/rust${rust_ver:+"-${rust_ver}"}"}

				# This is crazy - virtual/rust allowed either dev-lang/rust or
				# dev-lang/rust-bin to be pulled-in, but the now-separate
				# slotted packages both use this flexibility, and the ability
				# to specify a minimum version, as it's not possible to specify
				# '>=cat-pkg:slot' :(
				#
				#${rustext:+"${rust_ver:+">="}dev-lang/rust${rust_ver:+":${rust_ver}"}"}
				${rustext:+"dev-lang/rust${rust_slot:+":${rust_slot}"}"}

				${rustext:+"${bindgen_ver:+">="}dev-util/bindgen${bindgen_ver:+"-${bindgen_ver}"}"}
				virtual/os-headers
				virtual/linux-sources
			)
			declare -a _docker_run_arguments=( # <- Syntax
				--with-use="$( replace_flags '-lib-only' -- "${USE:-}" )"

				# N.B. virtual/rust is now deprecated
				#${rustext:+"--with-pkg-mask=>virtual/rust${rust_ver:+"-${rust_ver}"}"}
				#${rustext:+"--with-pkg-mask=>dev-lang/rust${rust_ver:+"-${rust_ver}"}"}

				${rustext:+"--with-pkg-mask=>dev-util/bindgen${bindgen_ver:+"-${bindgen_ver}"}"}
				$( # <- Syntax
					if [[ "${compiler}" == 'clang' ]]; then
						(( llvm_slot )) ||
							die "'llvm_slot' is required for clang builds"
						declare -i last_digit=0
						(( last_digit = ${llvm_sub_slot##*.} + 1 ))
						declare llvm_next="${llvm_sub_slot%.*}.${last_digit}"
						unset last_digit
						declare -i llvm_next_slot=0
						(( llvm_next_slot = llvm_slot + 1 ))

						cat <<-EOF
							--with-pkg-mask=>=sys-devel/clang-${llvm_next}
							--with-pkg-mask=>=sys-devel/clang-common-${llvm_next}
							--with-pkg-mask=>=sys-devel/clang-runtime-${llvm_next}
							--with-pkg-mask=>=sys-devel/clang-toolchain-symlinks-${llvm_next_slot}
							--with-pkg-mask=>=sys-devel/lld-${llvm_next}
							--with-pkg-mask=>=sys-devel/lld-toolchain-symlinks-${llvm_next_slot}
							--with-pkg-mask=>=sys-devel/llvm-${llvm_next}
							--with-pkg-mask=>=sys-devel/llvm-common-${llvm_next}
							--with-pkg-mask=>=sys-devel/llvmgold-${llvm_next_slot}
							--with-pkg-mask=>=sys-devel/llvm-toolchain-symlinks-${llvm_next_slot}
							--with-pkg-mask=>=sys-libs/compiler-rt-${llvm_next}
							--with-pkg-mask=>=sys-libs/compiler-rt-sanitizers-${llvm_next}
							--with-pkg-mask=>=sys-libs/libcxx-${llvm_next}
							--with-pkg-mask=>=sys-libs/libcxxabi-${llvm_next}
							--with-pkg-mask=>=sys-libs/libomp-${llvm_next}
							--with-pkg-mask=>=sys-libs/llvm-libunwind-${llvm_next}
						EOF
						unset llvm_next_slot llvm_next
					fi
				)
				--with-pkg-mask=">${package}"
				--changed-use
				--update
				--usepkg=y
				# FIXME: add_arg() seems to be inserting unexpected newlines,
				# possibly only for ${post_use}?
				#
				#$( add_arg pre_remove '--pre-remove=##' )
				#$( add_arg pre_pkgs '--pre-pkgs=##' )
				#$( add_arg pre_use '--pre-use=##' )
				#$( add_arg openmp '--post-pkgs=sys-devel/gcc' )
				#$( add_arg post_use '--post-use=##' )
				${pre_remove:+"--pre-remove=${pre_remove}"}
				${pre_pkgs:+"--pre-pkgs=${pre_pkgs}"}
				${pre_use:+"--pre-use=${pre_use}"}
				$( add_arg openmp '--post-pkgs=sys-devel/gcc' )
				${post_use:+"--post-use=${post_use}"}
			)

			# This only applies to the _docker_run() call below, and doesn't
			# extend outside of this sub-shell.
			#
			# shellcheck disable=SC2030
			export DOCKER_EXTRA_MOUNTS="${docker_extra_mounts[*]:-}"
			print "Build 'DOCKER_EXTRA_MOUNTS' is '${DOCKER_EXTRA_MOUNTS}'"

			# shellcheck disable=SC2086,SC2154
			time {
				_docker_run \
						"${_docker_run_arguments[@]:-}" \
						"=${package}" \
						"${pkgs[@]:-}" \
					2>&1 | tee "log/docker.${log_name}.log"
				output " -> ${?}"
			}

			unset DOCKER_EXTRA_MOUNTS

			# It would be nice if we could squash the image layers here to
			# produce a unified image in response to 'commit', but without an
			# additional 'container build' operation (which may be viable, as
			# building a kernel on a pre-existing image requires the definition
			# of many less environment-variables than when invoking 'emerge' to
			# build packages) - but even this way, we end up with the
			# base-layer, ultimate build layer, and above kernel layer - which
			# should result in kernel source images being the only things
			# depending on stale build-images...
			#
			# Update: While 'podman build' can't squash image layers when
			#         committing containers, it appears that 'buildah commit'
			#         can!
			# Update: podman has also gained this ability...
			#
			rc=0
			time {
				trap '' INT
				{
					if ! command -v buildah >/dev/null 2>&1; then
						# shellcheck disable=SC2046
						$_command $( # <- Syntax
							add_arg IMAGE_ROOT --storage-opt= --root "${IMAGE_ROOT:-}"
						) \
								container commit --squash \
									"${name}" \
									"${image_name}:${package_version}" 2>&1 ||
						$_command $( # <- Syntax
							add_arg IMAGE_ROOT --storage-opt= --root "${IMAGE_ROOT:-}"
						) \
								container commit \
									"${name}" \
									"${image_name}:${package_version}" 2>&1
						rc=${?}
					else
						# shellcheck disable=SC2046
						buildah $( # <- Syntax
							add_arg IMAGE_ROOT --storage-opt= --root "${IMAGE_ROOT:-}"
						) \
								commit \
										--squash \
									"${name}" \
									"${image_name}:${package_version}" 2>&1
						rc=${?}
					fi
				} | tee -a "log/docker.${log_name}.log"
				output " -> ${rc}"
				$_command container rm --volumes "${name}" 2>&1 |
					tee -a "log/docker.${log_name}.log"
				trap - INT
			}
		)
	fi

	DOCKER_ENTRYPOINT='/bin/sh'
	DOCKER_INTERACTIVE=1
	deforoldconfig="${defconfig:-"defconfig"}"
	if [[ "${keep_build:-}" = '1' ]]; then
		docker_extra_mounts+=( $( add_mount --dir --no-ro --print \
			"${build_dir}/" \
			'/usr/src/build'
		) ) || :
		if ! [[ -d "${build_dir}" ]]; then
			warn "Build cache directory '${build_dir}' doesn't exist -" \
				'creating ...'
			mkdir -p "${build_dir}" ||
				die "mkdir() on '${build_dir}' failed: ${?}"
		fi
		if [[ -e "${build_dir}"/.config ]]; then
			deforoldconfig='oldconfig'
		fi
	fi
	if (( bundle )); then
		docker_extra_mounts+=( $( add_mount --dir --no-ro --print \
			"${bundle_dir}/" \
			'/host/bundle'
		) ) || :
		if ! [[ -d "${bundle_dir}" ]]; then
			warn "Bundle output directory '${bundle_dir}' doesn't exist -" \
				'creating ...'
			mkdir -p "${bundle_dir}" ||
				die "mkdir() on '${bundle_dir}' failed: ${?}"
		fi
	else
		docker_extra_mounts+=( # <- Syntax
			$( add_mount --dir --no-ro --print '/lib/modules/' '/host/...' )
			$( add_mount --dir --no-ro --print '/boot' '/host/...' )
		) || :
		case "${arch:-"${ARCH:-}"}" in
			arm64)
				mkdir -p /boot/overlays
				docker_extra_mounts+=( $( add_mount --dir --no-ro --print \
					'/boot/overlays/' \
					'/host/boot/dtbs'
				) ) || :
		esac
	fi

	declare -i rc=0
	if [[ -s /etc/containers/storage.conf ]] &&
			graphroot="$( # <- Syntax
				sed 's/#.*$//' /etc/containers/storage.conf |
					grep -m 1 -- '^graphroot' |
					cut -d'"' -f 2
			)" && [[ -d "${graphroot:-}" ]]
	then
		if (( $( # <- Syntax
					df -BM --output=avail "${graphroot}" |
						tail -n +2 |
						sed 's/M$//'
				) < graph_space_required ))
		then
			warn "Filesystem containing '${graphroot}' has only $( # <- Syntax
				df -h --output=avail "${graphroot}" |
					tail -n +2
			) space available, need ${graph_space_required}M"
			rc=1
		fi
	else
		error 'Cannot determine graph root directory from' \
			"'/etc/containers/storage.conf'" || :
	fi
	if [[ -n "${TMPDIR:-}" ]]; then
		if ! [[ -d "${TMPDIR}" ]]; then
			die "Temporary directory '${TMPDIR}' (from variable 'TMPDIR')" \
				"doesn't exist"
		fi
		warn "Temporary directory override 'TMPDIR' (${TMPDIR}) set, but" \
			'container tools may ignore this variable'
		export TMPDIR
	fi
	if (( $( # <- Syntax
				df -BM --output=avail "${TMPDIR:-"/var/tmp/"}" |
					tail -n +2 |
					sed 's/M$//'
			) < temp_space_required ))
	then
		warn "Filesystem containing '${TMPDIR:-"/var/tmp"}' has only" \
			"$( # <- Syntax
				df -h --output=avail /var/tmp/ |
				tail -n +2
			) space available, need ${temp_space_required}M"
		rc=1
	fi
	if (( $( # <- Syntax
				df -BM --output=avail "${build_dir}"/.. |
					tail -n +2 |
					sed 's/M$//'
			) + $( # <- Syntax
				df -BM --output=used "${build_dir}" |
				tail -n +2 |
				sed 's/M$//'
			) < build_space_reqiured ))
	then
		warn "Filesystem containing '${build_dir}' has only $( # <- Syntax
			df -h --output=avail "${build_dir}" |
				tail -n +2
		) space available, need ${build_space_reqiured}M"
		rc=1
	fi
	if (( rc )); then
		die 'Insufficient space - please free up space and try again'
	fi

	# Specifying a configuration file takes precedence over having a build
	# directory cache...
	#
	if [[ -n "${config_file:-}" ]]; then
		deforoldconfig='oldconfig'
		if
			[[ "${keep_build:-}" != '1' ]] ||
			[[ "${config_file}" != "${build_dir}/.config" ]]
		then
			if [[ -w "${config_file}" ]]; then
				# This used to work, but now (due to a podman upgrade?)
				# the kernel build process terminates saying it can't
				# write to the mounted file.
				DOCKER_VOLUMES="--volume ${config_file}:/usr/src/build/.config"
			else
				die "Cannot write to configuration file '${config_file}'"
			fi
		fi
	fi

	kernel_debug=''
	#kernel_debug='V=2 W=123'

	[[ -n "${COLUMNS:-}" ]] ||
		warn "'COLUMNS' not set - please export this variable"
	[[ -n "${LINES:-}" ]] ||
		warn "'LINES' not set - please export this variable"

	: ${COLUMNS:="80"}
	: ${LINES:="24"}

	declare -a kernel_make_opts=()
	declare modargs=''
	# shellcheck disable=SC2206
	kernel_make_opts+=(
		${container_CC:+"CC=${container_CC}"}
		${container_CXX:+"CXX=${container_CXX}"}
		${container_LD:+"LD=${container_LD}"}
		${container_LLVM:+"LLVM=1 LLVM_IAS=1"}
		${container_KCFLAGS:-}
		${kernel_debug:+"${kernel_debug}"}
		# Set as-needed below...
		#O=../build
	)
	modargs="${container_LLVM:+"LLVM=1 LLVM_IAS=1"}"
	RUST_VERBOSE=''
	RUSTFLAGS="$( # <- Syntax
		emerge --info 2>&1 | grep -- '^RUSTFLAGS=' | cut -d'"' -f 2
	)"
	_LLVM_RUSTC_LTO="$( # <- Syntax
		emerge --info 2>&1 | grep -- '^_LLVM_RUSTC_LTO=' | cut -d'"' -f 2
	)"

	# 'bindgen's output being incorrectly processed was fixed in (at least)
	# linux-6.1.53 & linux-6.5.4 - but as-of early 2024 the oldest in-tree
	# kernel with rust support is now linux-6.1.67, and the earliest kernel
	# after 6.1.x is linux-6.6.10, so this patch is no longer needed.
	#
	#case "${package_version}" in
	#	6.[1234].*|6.5.[123])
	#		RUST_VERBOSE='-v'
	#		# Unpatched:
	#		#  /usr/src/linux-6.1.4-gentoo/scripts/rust_is_available_bindgen_libclang.h:2:9: warning: clang version 15.0.6  [-W#pragma-messages]
	#		# ... gives a result of '6.1.4' rather than '15.0.6' :(
	#		RUST_PATCH="$( cat <<-'EOF'
	#			--- scripts/rust_is_available.sh
	#			+++ scripts/rust_is_available.sh
	#			@@ -104,7 +104,7 @@
	#				LC_ALL=C "$BINDGEN" $(dirname $0)/rust_is_available_bindgen_libclang.h 2>&1 >/dev/null \
	#					| grep -F 'clang version ' \
	#					| grep -oE '[0-9]+\.[0-9]+\.[0-9]+' \
	#			-		| head -n 1 \
	#			+		| tail -n 1 \
	#			 )
	#			 bindgen_libclang_min_version=$($min_tool_version llvm)
	#			 bindgen_libclang_cversion=$(get_canonical_version $bindgen_libclang_version)
	#		EOF
	#		)"
	#		RUST_PATCH_B64="$( echo "${RUST_PATCH}" | base64 -w 0 )"
	#		;;
	#esac

	# Confirm line-endings, highlight:
	#   ^.*\()\|\s\(;\|;;\|\$( # <- Syntax\|then\|else\|do\|in\|&&\||\|||\|{\|\\\|\$(\|\\\$(\)\)$
	#
	DOCKER_SCRIPT="$( cat <<-EOF
		set -eu ;
		if ! [ -e /usr/src/linux ]; then
			echo >&2 "FATAL: '/usr/src/linux' does not exist in container" ;
			exit 1 ;
		fi ;
		if ! [ -d /usr/src/build ]; then
			echo >&2 "WARN: Build directory '/usr/src/build' does not exist" ;
		else
			if ! [ -e /usr/src/build/.config ] || ! [ -f /usr/src/build/.config ] || ! [ -s /usr/src/build/.config ]; then
				echo >&2 "WARN: No existing configuration found in '/usr/src/build/.config'" ;
			else
				echo "INFO: \$(
					head -n 4 /usr/src/build/.config |
							grep -- 'Configuration' ||
						echo 'No kernel version declaration found' ;
				)" ;
				echo "INFO: Existing configuration file contains \$(
					grep -c '^CONFIG_' -- /usr/src/build/.config ;
				) configuration directives" ;
			fi ;
		fi ;
		echo "INFO:  Detected terminal size: \$( stty size )" ;
		export TERM LINES COLUMNS ;
		echo "INFO:  Setting terminal to \${COLUMNS}x\${LINES}..." ;
		stty cols "\${COLUMNS}" rows "\${LINES}" ;
		echo "INFO:  Detected terminal size: \$( stty size )" ;
		if [ -e /bin/awk ] && [ ! -e /usr/bin/awk ]; then
			ln -s ../../bin/awk /usr/bin/ ;
		fi ;
		hostname >/dev/null || exit 1 ;
		if ! grep -Fq -- 'lzma' /var/db/pkg/sys-apps/kmod-*/USE; then
			echo >&2 "FATAL: kmod lacks 'lzma' capability" ;
			exit 1 ;
		elif ! grep -Fq -- 'zlib' /var/db/pkg/sys-apps/kmod-*/USE; then
			echo >&2 "FATAL: kmod lacks 'zlib' capability" ;
			exit 1 ;
		fi ;
		env-update ;
		test -s /etc/profile && . /etc/profile ;
		ldconfig ;
		if portageq has_version / sys-libs/llvm-libunwind; then
			LDFLAGS_MODULE='-unwindlib=libunwind' ;
			HOSTLDFLAGS='-unwindlib=libunwind' ;
			export LDFLAGS_MODULE HOSTLDFLAGS ;
		fi ;
		if [ $(( $( # <- Syntax
				head /proc/meminfo |
				grep -m 1 '^MemAvailable:' |
				awk '{ print $2 }' ;
			) / ( 1024 * 1024 ) )) -lt ${PARALLEL_MEMORY_MIN} ] ;
		then
			echo >&2 "WARN: Instructing 'ld' to use less memory ..." ;
			LDFLAGS_MODULE="\${LDFLAGS_MODULE:+"\${LDFLAGS_MODULE} "}-Wl,--no-keep-memory" ;
			HOSTLDFLAGS="\${HOSTLDFLAGS:+"\${HOSTLDFLAGS} "}-Wl,--no-keep-memory" ;
			if [ '${compiler}' = 'clang' ]; then
				LDFLAGS_MODULE="\${LDFLAGS_MODULE} -Wl,--no-mmap-output-file" ;
				HOSTLDFLAGS="\${HOSTLDFLAGS} -Wl,--no-mmap-output-file" ;
			fi ;
			export LDFLAGS_MODULE HOSTLDFLAGS ;
		fi ;
		if [ '${compiler}' = 'clang' ]; then
			: Correct as-of GCC 13/LLVM 18.1.8-r1 - see https://clang.llvm.org/docs/CommandGuide/clang.html ;
			good_flags='' ;
			bad_flags='' ;
			gcc_CFLAGS="\${CFLAGS:-}" ;
			gcc_CXXFLAGS="\${CXXFLAGS:-}" ;
			gcc_LDFLAGS="\${LDFLAGS:-}" ;
			for flag in \${CFLAGS:-}; do
				case "\${flag}" in
					-fallow-store-data-races)				bad_flags="\${bad_flags} \${flag}" ;;
					-fdevirtualize-at-ltrans)				bad_flags="\${bad_flags} \${flag}" ;;
					-fdevirtualize-speculatively)			bad_flags="\${bad_flags} \${flag}" ;;
					-fgcse-las)								bad_flags="\${bad_flags} \${flag}" ;;
					-fgcse-sm)								bad_flags="\${bad_flags} \${flag}" ;;
					-fgraphite-identity)					bad_flags="\${bad_flags} \${flag}" ;;
					-fipa-pta)								bad_flags="\${bad_flags} \${flag}" ;;
					-fisolate-erroneous-paths-attribute)	bad_flags="\${bad_flags} \${flag}" ;;
					-fivopts)								bad_flags="\${bad_flags} \${flag}" ;;
					-flive-range-shrinkage)					bad_flags="\${bad_flags} \${flag}" ;;
					-floop-nest-optimize)					bad_flags="\${bad_flags} \${flag}" ;;
					-flto)									good_flags="\${good_flags} ${_LLVM_LTO:-"-flto=thin"}" ;;
					-fmodulo-sched)							bad_flags="\${bad_flags} \${flag}" ;;
					-fmodulo-sched-allow-regmoves)			bad_flags="\${bad_flags} \${flag}" ;;
					-fsched-pressure)						bad_flags="\${bad_flags} \${flag}" ;;
					-fstdarg-opt)							bad_flags="\${bad_flags} \${flag}" ;;
					-ftree-loop-im)							bad_flags="\${bad_flags} \${flag}" ;;
					-ftree-loop-ivcanon)					bad_flags="\${bad_flags} \${flag}" ;;
					-fuse-linker-plugin)					bad_flags="\${bad_flags} \${flag}" ;;
					-march=*)								good_flags="\${good_flags} \${flag}" ;;
					-mcpu=*)								good_flags="\${good_flags} \${flag}" ;;
					-mtune=*)								good_flags="\${good_flags} \${flag}" ;;
					-m*)									bad_flags="\${bad_flags} \${flag}" ;;
					-Ofast)									good_flags="\${good_flags} -O3 -ffast-math" ;;
					-Werror=lto-type-mismatch)				bad_flags="\${bad_flags} \${flag}" ;;
					-Wl,*)									bad_flags="\${bad_flags} \${flag}" ;;
					*)										good_flags="\${good_flags} \${flag}" ;;
				esac ;
			done ;
			if [ -n "\${bad_flags:-}" ]; then
				bad_flags="\$( echo "\${bad_flags}" | xargs -rn 1 | sort | uniq | xargs -r )" ;
				echo "NOTE:  Filtering GNU CFLAGS ('\${CFLAGS}') for ${compiler}: Removing '\${bad_flags}'" ;
			fi ;
			good_flags="\$( echo "\${good_flags:-} ${_LLVM_W:-}" | xargs -rn 1 | sort | uniq | xargs -r )" ;
			: LLVM 20+? ;
			: echo " \${good_flags:-} " | grep -Fq ' -ffp-contract=fast ' &&
				: echo " \${good_flags} " | grep -Fq ' -ffast-math ' &&
				: good_flags="\$( echo "\${good_flags}" | sed 's/-ffp-contract=fast/-ffp-contract=aggressive/g' )" ;
			case '${arch:-"${ARCH:-}"}' in
				'arm'*)
					LDFLAGS="\$( echo "\${_LLVM_LD:-"\${LDFLAGS:-}"} \${_LD_LTO:-} \${_LD_EXTRA:-}" | xargs -rn 1 | sed '/-Wl,-O1/s/-O1/-O2/' | sort | uniq | xargs -r )" ;
					mcpu="\$( echo "\${good_flags:-}" | xargs -rn 1 | grep '^-mcpu=' || : )" ;
					good_flags="\$( { echo "\${good_flags:-}" | xargs -rn 1 | grep -v -- '^-m' ; echo "\${mcpu:-"-mcpu=native"}" ; } | sort -V | xargs -r )" ;
					unset mcpu ;
					;;
				*)
					case '${arch:-"${ARCH:-}"}' in
						x86|arm64|ppc64)
							LDFLAGS="\$( echo "\${_LLVM_LD:-"\${LDFLAGS:-}"} \${_LD_X86PPC:-} \${_LD_LTO:-} \${_LD_EXTRA:-}" | xargs -rn 1 | sed '/-Wl,-O1/s/-O1/-O2/' | sort | uniq | xargs -r )" ;
							;;
						*)
							LDFLAGS="\$( echo "\${_LLVM_LD:-"\${LDFLAGS:-}"} \${_LD_LTO:-} \${_LD_EXTRA:-}" | xargs -rn 1 | sed '/-Wl,-O1/s/-O1/-O2/' | sort | uniq | xargs -r )" ;
							;;
					esac ;
					: march="\$( echo "\${good_flags:-}" | xargs -rn 1 | grep '^-march=' || : )" ;
					good_flags="\$( { echo "\${good_flags:-}" | xargs -rn 1 | grep -v -- '^-m' ; echo "\${march:-"-march=native"}" ; } | sort -V | xargs -r )" ;
					unset march ;
					;;
			esac ;
			CFLAGS="\${good_flags:-}" ;
			CXXFLAGS="\${CFLAGS}" ;
			export CFLAGS CXXFLAGS LDFLAGS ;
			CPP='clang-cpp' ;
			AS='clang -c' ;
			CC='clang' ;
			CXX='clang++' ;
			LD='ld.lld' ;
			AR='llvm-ar' ;
			NM='llvm-nm' ;
			OBJCOPY="llvm-objcopy" ;
			OBJDUMP="llvm-objdump" ;
			READELF="llvm-readelf" ;
			STRIP="llvm-strip" ;
			RANLIB='llvm-ranlib' ;
			cc_var='' ;
			for cc_var in CPP AS CC CXX LD AR NM OBJCOPY OBJDUMP READELF STRIP RANLIB; do
				export \${cc_var} ;
				export KERNEL_\${cc_var}="\$( eval "echo \\$\${cc_var}" )" ;
				export UTILS_\${cc_var}="\$( eval "echo \\$\${cc_var}" )" ;
			done ;
			unset cc_var ;
			echo "NOTE:  ${compiler} CFLAGS are '\${CFLAGS}'" ;
			echo "NOTE:  ${compiler} LDFLAGS are '\${LDFLAGS}'" ;
		fi ;
		kernel='bzImage' ;
		dir='x86' ;
		dtb='' ;
		extract=0 ;
		case '${arch:-"${ARCH:-}"}' in
			'x86'|'amd64')
				extract=1 ;
				;;
			'arm64')
				kernel='Image.gz' ;
				dir='arm64' ;
				echo "NOTE:  Will build devicetree files for ARM64 platforms ..." ;
				dtb='1' ;
				;;
			'arm'*)
				kernel='Image.gz' ;
				dir='arm' ;
				echo "NOTE:  Will build devicetree files for ARM platforms ..." ;
				dtb='1' ;
				;;
		esac ;
		${container_CC} --version ;
		set -x ;
		cd /usr/src/linux ;
		make ${kernel_make_opts[@]} mrproper ;
		set +x ;
		if [ -n '${patch:-}' ]; then
			for p in ${patch}; do
				echo "INFO:  Processing patch '\$( basename "\${p}" )' ..." ;
				case "\${p}" in
					http*)
						if ! wget "\${p}" -qO patch.diff || ! [ -s patch.diff ]; then
							echo >&2 "ERROR: patch '\${p}' failed to download" ;
						else
							if cat patch.diff | patch -p1 --dry-run --force --quiet >/dev/null 2>&1 ; then
								cat patch.diff | patch -p1 --quiet ;
							else
								echo >&2 "WARN:  patch '\$( basename "\${p}" )' failed to apply" ;
							fi ;
							rm patch.diff ;
						fi ;
						;;
					'')
						: ;
						;;
					*)
						if [ -e "\${p}" ] && [ -f "\${p}" ] && [ -s "\${p}" ]; then
							if cat "\${p}" | patch -p1 --dry-run --force --quiet >/dev/null 2>&1 ; then
								cat "\${p}" | patch -p1 --quiet ;
							else
								echo >&2 "WARN:  patch '\$( basename "\${p}" )' failed to apply" ;
							fi ;
						else
							echo >&2 "WARN: patch '\${p}' could not be found" ;
						fi ;
						;;
				esac ;
			done ;
		fi ;
		mkdir -p ../build ;
		[ '${clean_lto}' = '1' ] && find ../build/ -name '*.lto.o' -delete ;
		if [ -n '${microcode_blob:-}' ]; then
			echo ;
			echo "NOTE:  Required microcode update files${microcode:+" from '\$( portageq best_version / \"${microcode}\" )'"}:" ;
			echo ;
			if [ '${microcode_blob}' = 'intel' ]; then
				iucode_tool -S -l /lib/firmware/intel-ucode/* ;
			else
				echo '${microcode_blob}' ;
				found=0 ;
				for blob in ${microcode_blob}; do
					if ! [ -e "/lib/firmware/\${blob}" ]; then
						echo >&2 "ERROR: microcode firmware blob '\${blob}' not found" ;
						found=1 ;
					fi ;
				done ;
				if [ \$(( found )) -ne 0 ]; then
					echo >&2 'FATAL: missing firmware' ;
					exit 1 ;
				fi ;
			fi ;
			echo ;
			[ -f ../build/.config ] && [ -s ../build/.config ] && grep -Fm 1 'CONFIG_EXTRA_FIRMWARE' ../build/.config 2>/dev/null && echo ;
		fi ;
		if [ $(( clean )) -eq 0 ]; then
			make ${kernel_make_opts[@]} O=../build -C tools/objtool clean ;
		else
			config="\$( cat ../build/.config )" ;
			make ${kernel_make_opts[@]} O=../build distclean ;
			if [ ! -f ../build/.config ] || [ ! -s ../build/.config ]; then
				echo "\${config}" > ../build/.config ;
			fi ;
			unset config ;
		fi ;
		if [ $(( rust )) -ne 0 ]; then
			clang --version ;
			echo ;
			rustc --version ;
			echo ;
			export RUST_BACKTRACE=1 ;
			[ -n '${RUST_PATCH_B64:-}' ] &&
				echo '${RUST_PATCH_B64:-}' | base64 -d | patch -p0 ;
			[ -n '${RUST_VERBOSE:-}' ] &&
				sed -ri Makefile -e '/scripts\/rust_is_available.sh/s|(scripts/rust_is_available.sh)|\\1 ${RUST_VERBOSE}|' ;
			make --debug=print ${kernel_make_opts[@]} O=../build rustavailable || {
				echo >&2 "ERROR: rust_is_available.sh returns \${?}" ;
				exit 1 ;
			} ;
			if [ '${compiler}' = 'clang' ]; then
				[ -n '${_LLVM_RUSTC_LTO:-}' ] &&
					RUSTFLAGS="${RUSTFLAGS:+"${RUSTFLAGS} "}${_LLVM_RUSTC_LTO}" ;
				echo " \${RUSTFLAGS} " | grep -Fq -- ' -Clinker=clang ' ||
					RUSTFLAGS="\${RUSTFLAGS:+"\${RUSTFLAGS} "}-Clinker=clang" ;
				echo " \${RUSTFLAGS} " | grep -Fq -- ' -Clinker-plugin-lto ' ||
					RUSTFLAGS="\${RUSTFLAGS:+"\${RUSTFLAGS} "}-Clinker-plugin-lto" ;
				echo " \${RUSTFLAGS} " | grep -Fq -- ' -Clink-arg=-fuse-ld=lld ' ||
					RUSTFLAGS="\${RUSTFLAGS:+"\${RUSTFLAGS} "}-Clink-arg=-fuse-ld=lld" ;
				export RUSTFLAGS ;
			fi ;
		fi ;
		localversion='' ;
		if echo '${package_version}' | grep -Fq -- '_'; then
			localversion="LOCALVERSION=_\$( echo '${package_version#*_}' | cut -d'_' -f 2- )" ;
			if [ -f ../build/.config ]; then
				if ! grep -qm 1 -- '^CONFIG_LOCALVERSION=""$' ../build/.config; then
					echo "WARN:  \$(
						grep -qm 1 -- '^CONFIG_LOCALVERSION=' ../build/.config ;
					) is already set, package version '\${localversion}' will be appended to this text" ;
				fi ;
			fi ;
		fi ;
		modules_dir='${package_version}${distro:-}' ;
		if echo '${package_version}' | grep -q -- '-r[0-9]\+$'; then
			modules_dir="$( echo '${package_version}' | grep -o -- '-r[0-9]\+$' )" ;
			modules_dir="${package_version}${distro:-}\${modules_dir}" ;
		fi ;
		if [ -e .config ]; then
			echo "INFO:  Configuration changes from '.config':" ;
			make ${kernel_make_opts[@]} O=../build \${localversion} listnewconfig 2>/dev/null | grep '^CONFIG' || echo '<none>' ;
		fi ;
		success=0 ;
		set -x ;
		time make ${kernel_make_opts[@]} O=../build \${localversion} ${deforoldconfig} \
				prepare \
				${menuconfig:+"menuconfig"} \
				${nconfig:+"nconfig"} \
				vmlinux \
				modules \
				\${dtb:+"dtbs"} \
				\${kernel} &&
			rm -rf "/lib/modules/\${modules_dir}" &&
				make ${kernel_make_opts[@]} O=../build \${localversion} INSTALL_MOD_STRIP=1 modules_install &&
					success=1 ;
		set +x ;
		if [ "\${success}" = '1' ] && [ "\{extract}" = '1' ]; then
			set -x ;
			sh scripts/extract-vmlinux ../build/arch/\${dir}/boot/\${kernel} > vmlinux &&
				[ -f vmlinux ] && mv vmlinux ../build/ || success=0 ;
			set +x ;
		fi ;
		if [ "\${success}" = '0' ]; then
			exit 1 ;
		fi ;
		if [ -s /host/boot/boot.config ]; then
			cp /host/boot/boot.config /boot/boot.config ;
		fi ;
		if [ -s /boot/boot.config -o -s /proc/bootconfig ] && [ -e /boot/initramfs.img ]; then
			if make ${kernel_make_opts[@]} O=../build -C tools/bootconfig; then
				make ${kernel_make_opts[@]} O=../build bindir='/usr/local/sbin' -C tools/bootconfig install ;
				if [ -s /boot/boot.config ]; then
					/usr/local/sbin/bootconfig -a /boot/boot.config /boot/initramfs.img ;
				else
					/usr/local/sbin/bootconfig -a /proc/bootconfig /boot/initramfs.img ;
				fi ;
			else
				echo >&2 "WARN:  'make -C tools/bootconfig' failed: \${?}" ;
			fi ;
		fi ;
		if [ "\${dtb}" = '1' ]; then
			make ${kernel_make_opts[@]} O=../build \${localversion} dtbs_install ;
		fi ;
		unset localversion ;
		if command -v kernel-hardening-checker >/dev/null 2>&1; then
			kernel-hardening-checker -m show_fail -c ../build/.config ;
		fi ;
		if [ -f ../build/vmlinux ]; then
			mkdir -pv "/lib/modules/\${modules_dir}" &&
				cp -v ../build/vmlinux "/lib/modules/\${modules_dir}/vmlinux-\${modules_dir}" ;
		fi ;
		if ! [ '${bundle}' = '1' ]; then
			cp -v ../build/.config "/boot/config-\${modules_dir}" ;
			cp -v ../build/System.map "/boot/System.map-\${modules_dir}" ;
			cp -v ../build/arch/\${dir}/boot/\${kernel} "/boot/kernel-\${modules_dir}" ;
		else
			mkdir -pv "/boot/\${modules_dir}" ;
			cp -v ../build/.config "/boot/\${modules_dir}/config" ;
			cp -v ../build/System.map "/boot/\${modules_dir}/System.map" ;
			cp -v ../build/arch/\${dir}/boot/\${kernel} "/boot/\${modules_dir}/kernel8.img" ;
			if [ -d "/boot/dtbs/\${modules_dir}/broadcom" ]; then
				mv -v "/boot/dtbs/\${modules_dir}/broadcom"/*.dtb "/boot/\${modules_dir}/" ;
				if ! rmdir -v "/boot/dtbs/\${modules_dir}/broadcom" ; then
					echo >&2 "ERROR: Failed to remove "/boot/dtbs/\${modules_dir}/broadcom": \${?}" ;
					: echo >&2 "       Directory content:" ;
					: ls -1AR "/boot/dtbs/\${modules_dir}/broadcom" ;
					echo >&2 "       Is CONFIG_LOCALVERSION correctly set?" ;
					exit 1 ;
				fi ;
			fi ;
			if [ -d "/boot/dtbs/\${modules_dir}/overlays" ]; then
				mv -v "/boot/dtbs/\${modules_dir}/overlays" "/boot/\${modules_dir}/" ;
				touch "/boot/\${modules_dir}/overlays/README" ;
			fi ;
			if [ -d /boot/dtbs ]; then
				if ! rmdir -v "/boot/dtbs/\${modules_dir}" /boot/dtbs ; then
					echo >&2 "ERROR: Failed to remove "/boot/dtbs/\${modules_dir}" or "/boot/dtbs": \${?}" ;
					: echo >&2 "       Directory content:" ;
					: ls -1AR "/boot/dtbs/" ;
					echo >&2 "       Is CONFIG_LOCALVERSION correctly set?" ;
					exit 1 ;
				fi ;
			fi ;
			echo >&2 "NOTE:  Remember to set 'os_prefix = \${modules_dir}' in config.txt" ;
			if ! [ -d /host/bundle ]; then
				echo >&2 "ERROR: Directory '${bundle_dir}' does not exist - cannot save bundle 'linux-\${modules_dir}.tar.xz'" ;
			else
				if ! tar -C / -cJpf "/host/bundle/linux-\${modules_dir}.tar.xz" boot/ lib/modules/ ; then
					echo >&2 "ERROR: Failed creating bundle '${bundle_dir}/linux-\${modules_dir}.tar.xz': ${?}" ;
				else
					echo "INFO:  Bundle 'linux-\${modules_dir}.tar.xz' successfully deployed to '${bundle_dir}'" ;
				fi ;
			fi ;
		fi ;
		if [ '${install}' = '1' ]; then
			if ! tar -C / -cpf - /boot/ /lib/modules/ | tar -C /host/ -xpf - ; then
				echo >&2 "ERROR: Build artefact extraction failed: \${?}" ;
				exit 1 ;
			else
				echo "INFO:  Linux kernel-\${modules_dir} successfully installed - please update your bootloader" ;
			fi ;
		elif [ '${bundle}' = '0' ]; then
			echo >&2 "WARN:  Linux kernel-\${modules_dir} successfully built (but not installed due to '--no-install' argument)" ;
		fi ;
		if [ -n '${extra_packages:-}' ]; then
			if ! [[ '${compiler}' == 'clang' ]]; then
				export CFLAGS="\${gcc_CFLAGS:-}" ;
				export CXXFLAGS="\${gcc_CXXFLAGS:-}" ;
				export LDFLAGS="\${gcc_LDFLAGS:-}" ;
			fi ;
			export USE='modules modules-compress${EXTRA_USE:+" ${EXTRA_USE}"}' ;
			export XTABLES_ADDONS='${XTABLES_ADDONS:-"asn geoip"}' ;
			: The build includes a placeholder Makefile pointing back to the \
			: source directory, so must must exclude that... ;
			[ -n '${modargs:-}' ] &&
				export modargs='${modargs}' BUILD_FIXES='${modargs}' ;
			tar -C /usr/src/build/ -cpf - --exclude Makefile . |
					tar -C /usr/src/linux/ -xvpf - &&
				emerge -kv --buildpkg=y ${extra_packages} ;
		fi ;
	EOF
	)"
		#echo 'Detected packages:' ;
		#ls -1d /var/db/pkg/*/* | cut -d '/' -f 5- ;
		#[ -e /etc/python-exec/emerge.conf ] &&
		#	rm /etc/python-exec/emerge.conf ;
		#
		#	KBUILD_OUTPUT='/usr/src/build' \
		#	CC="${container_CC}" \
		#	CXX="${container_CXX}" \
		#	LD="${container_LD}" \
		#emerge --with-bdeps=n --buildpkg=y -kv \
		#	'>=net-firewall/xtables-addons-3.18' ;

	nl="$( printf '\n' )"
	DOCKER_SCRIPT="$( echo "${DOCKER_SCRIPT}" | tr "${nl}" ' ' )"
	unset nl

	export DOCKER_ENTRYPOINT DOCKER_INTERACTIVE DOCKER_VOLUMES DOCKER_SCRIPT
	# shellcheck disable=SC2031
	export DOCKER_EXTRA_MOUNTS="${docker_extra_mounts[*]:-}"
	unset docker_extra_mounts
	print "Final 'DOCKER_EXTRA_MOUNTS' is '${DOCKER_EXTRA_MOUNTS}'"
}


if (( raise_mem )); then
	# DEBUG-enabled 'LD vmlinux.o' step fails with OOM with 2G
	# reservation :(
	#
	export PODMAN_MEMORY_RESERVATION='8g'
	export PODMAN_MEMORY_LIMIT='12g'
	export PODMAN_SWAP_LIMIT="${PODMAN_MEMORY_LIMIT}"
#else
#	export PODMAN_MEMORY_RESERVATION='2g'
#	export PODMAN_MEMORY_LIMIT='8g'
#	export PODMAN_SWAP_LIMIT="${PODMAN_MEMORY_LIMIT}"
fi

time {
	#set -x
		#DOCKER_DEVICES='--device=/dev/tty --device=/dev/tty0' \
		TERM="${TERM:-}" \
		DOCKER_HOSTNAME="$( hostname )-build" \
		image="${image_name}:${package_version}" \
		_common_run_show_command=0 \
	_docker_run \
			-c "${DOCKER_SCRIPT}" \
		2>&1 | tee -a "log/docker.${log_name}.log"
	rc=${?}
	#set +x
	output " -> ${rc}"
}

if [[ -d /boot/dtbs ]] &&
		[[ "$( find /boot/dtbs -maxdepth 0 -empty )" == '/boot/dtbs' ]]
then
	rmdir /boot/dtbs
fi

#set +o xtrace

exit ${rc}

# vi: set noet nowrap sw=4 ts=4: