1 files changed, 67 insertions, 0 deletions
diff --git a/core/musl/MAKEPKG b/core/musl/MAKEPKG
new file mode 100644
index 0000000..f5b9a7f
--- /dev/null
+++ b/core/musl/MAKEPKG
@@ -0,0 +1,67 @@
+#!/bin/mkpkg
+# description: musl C library
+# url: https://musl.libc.org/
+
+name=musl
+version=1.2.6
+release=2
+source=(https://musl.libc.org/releases/$name-$version.tar.gz
+        getconf.c
+        getent.c
+        iconv.c
+        ldd
+        CVE-2026-6042.patch
+        CVE-2026-40200.patch)
+
+sha256sums=(
+    "d585fd3b613c66151fc3249e8ed44f77020cb5e6c1e635a616d3f9f82460512a"
+    "d87d0cbb3690ae2c5d8cc218349fd8278b93855dd625deaf7ae50e320aad247c"
+    "b25f32d306d542246e9358ef65cd67c12b3e3a77656bc467853d3b0c76b5fbbd"
+    "f79a2930a2e5bb0624321589edf8b889d1e9b603e01e6b7ae214616605b3fdd7"
+    "2218e5f493a08cc981ef0888fb03d3b8f840d61e3025d9cc767d3963d3a55508"
+    "444fa70e52ca158fb7d4bad560637790bbf8f72e80b82fff840dd66fa83091e3"
+    "1ee29f64f9ca8e8ad7c349779d661ff6b52126a27575d3586981357a52c406fb"
+)
+
+patch() {
+    cd $name-$version
+
+    # CVE-2026-6042: gb18030 iconv decoder DoS + incorrect mappings
+    patch -p1 -i $SRC/CVE-2026-6042.patch
+
+    # CVE-2026-40200: qsort heap corruption (root cause + hardening + UB fix)
+    # The mbox contains 3 commits; GNU patch applies them all in one pass.
+    patch -p1 -i $SRC/CVE-2026-40200.patch
+}
+
+build() {
+    cd $name-$version
+
+    ./configure \
+        --prefix=/ \
+        --includedir=/include \
+        --libdir=/lib \
+        --syslibdir=/lib \
+        --disable-wrapper
+
+    make
+    make install DESTDIR=$PKG
+
+    # Build utilities
+    mkdir -p $PKG/bin
+    cc -Os -I$PKG/include -L$PKG/lib $SRC/getconf.c -o $PKG/bin/getconf
+    cc -Os -I$PKG/include -L$PKG/lib $SRC/getent.c -o $PKG/bin/getent
+    cc -Os -I$PKG/include -L$PKG/lib $SRC/iconv.c -o $PKG/bin/iconv
+    install -m755 $SRC/ldd $PKG/bin/ldd
+
+    # Strip
+    strip --strip-unneeded $PKG/bin/* 2>/dev/null || true
+}
+
+signify() {
+    untrusted comment: public key
+    RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
+}
+
+# vim: filetype=sh
+