all: use filepath

This makes package check portable, and removes nonportable behaviour from package pkg, pipewire, and system. All other packages remain nonportable due to their nature. No latency increase was observed due to this change on amd64 and arm64 linux.

Signed-off-by: Ophestra <cat@gensokyo.uk>

26 files changed, 94 insertions, 95 deletions

diff --git a/check/absolute.go b/check/absolute.go
index d17d5e1a..bf6ed813 100644
--- a/check/absolute.go
+++ b/check/absolute.go
@@ -5,7 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"path"
+	"path/filepath"
 	"slices"
 	"strings"
 	"syscall"
@@ -61,7 +61,7 @@ func (a *Absolute) Is(v *Absolute) bool {
 
 // NewAbs checks pathname and returns a new [Absolute] if pathname is absolute.
 func NewAbs(pathname string) (*Absolute, error) {
-	if !path.IsAbs(pathname) {
+	if !filepath.IsAbs(pathname) {
 		return nil, AbsoluteError(pathname)
 	}
 	return unsafeAbs(pathname), nil
@@ -76,13 +76,13 @@ func MustAbs(pathname string) *Absolute {
 	}
 }
 
-// Append calls [path.Join] with [Absolute] as the first element.
+// Append calls [filepath.Join] with [Absolute] as the first element.
 func (a *Absolute) Append(elem ...string) *Absolute {
-	return unsafeAbs(path.Join(append([]string{a.String()}, elem...)...))
+	return unsafeAbs(filepath.Join(append([]string{a.String()}, elem...)...))
 }
 
-// Dir calls [path.Dir] with [Absolute] as its argument.
-func (a *Absolute) Dir() *Absolute { return unsafeAbs(path.Dir(a.String())) }
+// Dir calls [filepath.Dir] with [Absolute] as its argument.
+func (a *Absolute) Dir() *Absolute { return unsafeAbs(filepath.Dir(a.String())) }
 
 // GobEncode returns the checked pathname.
 func (a *Absolute) GobEncode() ([]byte, error) {
@@ -92,7 +92,7 @@ func (a *Absolute) GobEncode() ([]byte, error) {
 // GobDecode stores data if it represents an absolute pathname.
 func (a *Absolute) GobDecode(data []byte) error {
 	pathname := string(data)
-	if !path.IsAbs(pathname) {
+	if !filepath.IsAbs(pathname) {
 		return AbsoluteError(pathname)
 	}
 	a.pathname = unique.Make(pathname)
@@ -110,7 +110,7 @@ func (a *Absolute) UnmarshalJSON(data []byte) error {
 	if err := json.Unmarshal(data, &pathname); err != nil {
 		return err
 	}
-	if !path.IsAbs(pathname) {
+	if !filepath.IsAbs(pathname) {
 		return AbsoluteError(pathname)
 	}
 	a.pathname = unique.Make(pathname)
diff --git a/cmd/hsu/main.go b/cmd/hsu/main.go
index 497279b8..2acc8d4c 100644
--- a/cmd/hsu/main.go
+++ b/cmd/hsu/main.go
@@ -58,7 +58,7 @@ import (
 	"fmt"
 	"log"
 	"os"
-	"path"
+	"path/filepath"
 	"runtime"
 	"slices"
 	"strconv"
@@ -102,13 +102,13 @@ func main() {
 		log.Fatal("this program must not be started by root")
 	}
 
-	if !path.IsAbs(hakureiPath) {
+	if !filepath.IsAbs(hakureiPath) {
 		log.Fatal("this program is compiled incorrectly")
 		return
 	}
 
 	var toolPath string
-	pexe := path.Join("/proc", strconv.Itoa(os.Getppid()), "exe")
+	pexe := filepath.Join("/proc", strconv.Itoa(os.Getppid()), "exe")
 	if p, err := os.Readlink(pexe); err != nil {
 		log.Fatalf("cannot read parent executable path: %v", err)
 	} else if strings.HasSuffix(p, " (deleted)") {
diff --git a/cmd/sharefs/fuse.go b/cmd/sharefs/fuse.go
index f14cc998..1dc34e21 100644
--- a/cmd/sharefs/fuse.go
+++ b/cmd/sharefs/fuse.go
@@ -24,7 +24,7 @@ import (
 	"os"
 	"os/exec"
 	"os/signal"
-	"path"
+	"path/filepath"
 	"runtime"
 	"runtime/cgo"
 	"strconv"
@@ -145,9 +145,9 @@ func sharefs_destroy(private_data unsafe.Pointer) {
 func showHelp(args *fuseArgs) {
 	executableName := sharefsName
 	if args.argc > 0 {
-		executableName = path.Base(C.GoString(*args.argv))
+		executableName = filepath.Base(C.GoString(*args.argv))
 	} else if name, err := os.Executable(); err == nil {
-		executableName = path.Base(name)
+		executableName = filepath.Base(name)
 	}
 
 	fmt.Printf("usage: %s [options] <mountpoint>\n\n", executableName)
diff --git a/container/init.go b/container/init.go
index 7a561733..e8e95a7a 100644
--- a/container/init.go
+++ b/container/init.go
@@ -8,7 +8,7 @@ import (
 	"os"
 	"os/exec"
 	"os/signal"
-	"path"
+	"path/filepath"
 	"slices"
 	"strconv"
 	"sync"
@@ -569,7 +569,7 @@ func TryArgv0(msg message.Msg) {
 		msg = message.New(log.Default())
 	}
 
-	if len(os.Args) > 0 && path.Base(os.Args[0]) == initName {
+	if len(os.Args) > 0 && filepath.Base(os.Args[0]) == initName {
 		Init(msg)
 		msg.BeforeExit()
 		os.Exit(0)
diff --git a/container/initdev.go b/container/initdev.go
index 38cb6e18..0847f587 100644
--- a/container/initdev.go
+++ b/container/initdev.go
@@ -3,7 +3,7 @@ package container
 import (
 	"encoding/gob"
 	"fmt"
-	"path"
+	"path/filepath"
 	. "syscall"
 
 	"hakurei.app/check"
@@ -46,7 +46,7 @@ func (d *MountDevOp) apply(state *setupState, k syscallDispatcher) error {
 	}
 
 	for _, name := range []string{"null", "zero", "full", "random", "urandom", "tty"} {
-		targetPath := path.Join(target, name)
+		targetPath := filepath.Join(target, name)
 		if err := k.ensureFile(targetPath, 0444, state.ParentPerm); err != nil {
 			return err
 		}
@@ -62,7 +62,7 @@ func (d *MountDevOp) apply(state *setupState, k syscallDispatcher) error {
 	for i, name := range []string{"stdin", "stdout", "stderr"} {
 		if err := k.symlink(
 			fhs.Proc+"self/fd/"+string(rune(i+'0')),
-			path.Join(target, name),
+			filepath.Join(target, name),
 		); err != nil {
 			return err
 		}
@@ -72,13 +72,13 @@ func (d *MountDevOp) apply(state *setupState, k syscallDispatcher) error {
 		{fhs.Proc + "kcore", "core"},
 		{"pts/ptmx", "ptmx"},
 	} {
-		if err := k.symlink(pair[0], path.Join(target, pair[1])); err != nil {
+		if err := k.symlink(pair[0], filepath.Join(target, pair[1])); err != nil {
 			return err
 		}
 	}
 
-	devShmPath := path.Join(target, "shm")
-	devPtsPath := path.Join(target, "pts")
+	devShmPath := filepath.Join(target, "shm")
+	devPtsPath := filepath.Join(target, "pts")
 	for _, name := range []string{devShmPath, devPtsPath} {
 		if err := k.mkdir(name, state.ParentPerm); err != nil {
 			return err
@@ -92,7 +92,7 @@ func (d *MountDevOp) apply(state *setupState, k syscallDispatcher) error {
 
 	if state.RetainSession {
 		if k.isatty(Stdout) {
-			consolePath := path.Join(target, "console")
+			consolePath := filepath.Join(target, "console")
 			if err := k.ensureFile(consolePath, 0444, state.ParentPerm); err != nil {
 				return err
 			}
@@ -110,7 +110,7 @@ func (d *MountDevOp) apply(state *setupState, k syscallDispatcher) error {
 	}
 
 	if d.Mqueue {
-		mqueueTarget := path.Join(target, "mqueue")
+		mqueueTarget := filepath.Join(target, "mqueue")
 		if err := k.mkdir(mqueueTarget, state.ParentPerm); err != nil {
 			return err
 		}
diff --git a/container/initsymlink.go b/container/initsymlink.go
index f4f608a6..e72e5ef4 100644
--- a/container/initsymlink.go
+++ b/container/initsymlink.go
@@ -3,7 +3,7 @@ package container
 import (
 	"encoding/gob"
 	"fmt"
-	"path"
+	"path/filepath"
 
 	"hakurei.app/check"
 )
@@ -30,7 +30,7 @@ func (l *SymlinkOp) Valid() bool { return l != nil && l.Target != nil && l.LinkN
 
 func (l *SymlinkOp) early(_ *setupState, k syscallDispatcher) error {
 	if l.Dereference {
-		if !path.IsAbs(l.LinkName) {
+		if !filepath.IsAbs(l.LinkName) {
 			return check.AbsoluteError(l.LinkName)
 		}
 		if name, err := k.readlink(l.LinkName); err != nil {
@@ -44,7 +44,7 @@ func (l *SymlinkOp) early(_ *setupState, k syscallDispatcher) error {
 
 func (l *SymlinkOp) apply(state *setupState, k syscallDispatcher) error {
 	target := toSysroot(l.Target.String())
-	if err := k.mkdirAll(path.Dir(target), state.ParentPerm); err != nil {
+	if err := k.mkdirAll(filepath.Dir(target), state.ParentPerm); err != nil {
 		return err
 	}
 	return k.symlink(l.LinkName, target)
diff --git a/container/path.go b/container/path.go
index 5170fceb..5ae52dee 100644
--- a/container/path.go
+++ b/container/path.go
@@ -4,7 +4,7 @@ import (
 	"errors"
 	"io/fs"
 	"os"
-	"path"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"syscall"
@@ -29,16 +29,16 @@ const (
 
 func toSysroot(name string) string {
 	name = strings.TrimLeftFunc(name, func(r rune) bool { return r == '/' })
-	return path.Join(sysrootPath, name)
+	return filepath.Join(sysrootPath, name)
 }
 
 func toHost(name string) string {
 	name = strings.TrimLeftFunc(name, func(r rune) bool { return r == '/' })
-	return path.Join(hostPath, name)
+	return filepath.Join(hostPath, name)
 }
 
 func createFile(name string, perm, pperm os.FileMode, content []byte) error {
-	if err := os.MkdirAll(path.Dir(name), pperm); err != nil {
+	if err := os.MkdirAll(filepath.Dir(name), pperm); err != nil {
 		return err
 	}
 	f, err := os.OpenFile(name, syscall.O_CREAT|syscall.O_EXCL|syscall.O_WRONLY, perm)
diff --git a/container/path_test.go b/container/path_test.go
index 7f28b5f4..03406fb0 100644
--- a/container/path_test.go
+++ b/container/path_test.go
@@ -4,7 +4,7 @@ import (
 	"io"
 	"math"
 	"os"
-	"path"
+	"path/filepath"
 	"reflect"
 	"syscall"
 	"testing"
@@ -61,7 +61,7 @@ func TestCreateFile(t *testing.T) {
 				Path: "/proc/nonexistent",
 				Err:  syscall.ENOENT,
 			}
-			if err := createFile(path.Join(Nonexistent, ":3"), 0644, 0755, nil); !reflect.DeepEqual(err, wantErr) {
+			if err := createFile(filepath.Join(Nonexistent, ":3"), 0644, 0755, nil); !reflect.DeepEqual(err, wantErr) {
 				t.Errorf("createFile: error = %#v, want %#v", err, wantErr)
 			}
 		})
@@ -72,7 +72,7 @@ func TestCreateFile(t *testing.T) {
 				Path: "/proc/nonexistent",
 				Err:  syscall.ENOENT,
 			}
-			if err := createFile(path.Join(Nonexistent), 0644, 0755, nil); !reflect.DeepEqual(err, wantErr) {
+			if err := createFile(filepath.Join(Nonexistent), 0644, 0755, nil); !reflect.DeepEqual(err, wantErr) {
 				t.Errorf("createFile: error = %#v, want %#v", err, wantErr)
 			}
 		})
@@ -80,7 +80,7 @@ func TestCreateFile(t *testing.T) {
 
 	t.Run("touch", func(t *testing.T) {
 		tempDir := t.TempDir()
-		pathname := path.Join(tempDir, "empty")
+		pathname := filepath.Join(tempDir, "empty")
 		if err := createFile(pathname, 0644, 0755, nil); err != nil {
 			t.Fatalf("createFile: error = %v", err)
 		}
@@ -93,7 +93,7 @@ func TestCreateFile(t *testing.T) {
 
 	t.Run("write", func(t *testing.T) {
 		tempDir := t.TempDir()
-		pathname := path.Join(tempDir, "zero")
+		pathname := filepath.Join(tempDir, "zero")
 		if err := createFile(pathname, 0644, 0755, []byte{0}); err != nil {
 			t.Fatalf("createFile: error = %v", err)
 		}
@@ -107,7 +107,7 @@ func TestCreateFile(t *testing.T) {
 
 func TestEnsureFile(t *testing.T) {
 	t.Run("create", func(t *testing.T) {
-		if err := ensureFile(path.Join(t.TempDir(), "ensure"), 0644, 0755); err != nil {
+		if err := ensureFile(filepath.Join(t.TempDir(), "ensure"), 0644, 0755); err != nil {
 			t.Errorf("ensureFile: error = %v", err)
 		}
 	})
@@ -115,7 +115,7 @@ func TestEnsureFile(t *testing.T) {
 	t.Run("stat", func(t *testing.T) {
 		t.Run("inaccessible", func(t *testing.T) {
 			tempDir := t.TempDir()
-			pathname := path.Join(tempDir, "inaccessible")
+			pathname := filepath.Join(tempDir, "inaccessible")
 			if f, err := os.Create(pathname); err != nil {
 				t.Fatalf("Create: error = %v", err)
 			} else {
@@ -150,7 +150,7 @@ func TestEnsureFile(t *testing.T) {
 
 		t.Run("ensure", func(t *testing.T) {
 			tempDir := t.TempDir()
-			pathname := path.Join(tempDir, "ensure")
+			pathname := filepath.Join(tempDir, "ensure")
 			if f, err := os.Create(pathname); err != nil {
 				t.Fatalf("Create: error = %v", err)
 			} else {
@@ -195,12 +195,12 @@ func TestProcPaths(t *testing.T) {
 
 		t.Run("sample", func(t *testing.T) {
 			tempDir := t.TempDir()
-			if err := os.MkdirAll(path.Join(tempDir, "proc/self"), 0755); err != nil {
+			if err := os.MkdirAll(filepath.Join(tempDir, "proc/self"), 0755); err != nil {
 				t.Fatalf("MkdirAll: error = %v", err)
 			}
 
 			t.Run("clean", func(t *testing.T) {
-				if err := os.WriteFile(path.Join(tempDir, "proc/self/mountinfo"), []byte(`15 20 0:3 / /proc rw,relatime - proc /proc rw
+				if err := os.WriteFile(filepath.Join(tempDir, "proc/self/mountinfo"), []byte(`15 20 0:3 / /proc rw,relatime - proc /proc rw
 16 20 0:15 / /sys rw,relatime - sysfs /sys rw
 17 20 0:5 / /dev rw,relatime - devtmpfs udev rw,size=1983516k,nr_inodes=495879,mode=755`), 0644); err != nil {
 					t.Fatalf("WriteFile: error = %v", err)
@@ -243,8 +243,8 @@ func TestProcPaths(t *testing.T) {
 			})
 
 			t.Run("malformed", func(t *testing.T) {
-				path.Join(tempDir, "proc/self/mountinfo")
-				if err := os.WriteFile(path.Join(tempDir, "proc/self/mountinfo"), []byte{0}, 0644); err != nil {
+				filepath.Join(tempDir, "proc/self/mountinfo")
+				if err := os.WriteFile(filepath.Join(tempDir, "proc/self/mountinfo"), []byte{0}, 0644); err != nil {
 					t.Fatalf("WriteFile: error = %v", err)
 				}
 
diff --git a/hst/fslink.go b/hst/fslink.go
index 77351258..c07749bb 100644
--- a/hst/fslink.go
+++ b/hst/fslink.go
@@ -2,7 +2,7 @@ package hst
 
 import (
 	"encoding/gob"
-	"path"
+	"path/filepath"
 
 	"hakurei.app/check"
 )
@@ -28,7 +28,7 @@ func (l *FSLink) Valid() bool {
 	if l == nil || l.Target == nil || l.Linkname == "" {
 		return false
 	}
-	return !l.Dereference || path.IsAbs(l.Linkname)
+	return !l.Dereference || filepath.IsAbs(l.Linkname)
 }
 
 func (l *FSLink) Path() *check.Absolute {
diff --git a/internal/acl/acl_test.go b/internal/acl/acl_test.go
index 19ce45ac..5f5447ba 100644
--- a/internal/acl/acl_test.go
+++ b/internal/acl/acl_test.go
@@ -8,7 +8,7 @@ import (
 	"io"
 	"os"
 	"os/exec"
-	"path"
+	"path/filepath"
 	"reflect"
 	"strconv"
 	"testing"
@@ -28,7 +28,7 @@ func TestUpdate(t *testing.T) {
 		t.Skip("acl test skipped")
 	}
 
-	testFilePath := path.Join(t.TempDir(), testFileName)
+	testFilePath := filepath.Join(t.TempDir(), testFileName)
 
 	if f, err := os.Create(testFilePath); err != nil {
 		t.Fatalf("Create: error = %v", err)
diff --git a/internal/outcome/spcontainer.go b/internal/outcome/spcontainer.go
index ba529955..0ad1de50 100644
--- a/internal/outcome/spcontainer.go
+++ b/internal/outcome/spcontainer.go
@@ -5,7 +5,7 @@ import (
 	"errors"
 	"io/fs"
 	"os"
-	"path"
+	"path/filepath"
 	"slices"
 	"strconv"
 	"syscall"
@@ -165,9 +165,9 @@ func (s *spFilesystemOp) toSystem(state *outcomeStateSys) error {
 			}
 			for _, pair := range entry.Values {
 				if pair[0] == "path" {
-					if path.IsAbs(pair[1]) {
+					if filepath.IsAbs(pair[1]) {
 						// get parent dir of socket
-						dir := path.Dir(pair[1])
+						dir := filepath.Dir(pair[1])
 						if dir == "." || dir == fhs.Root {
 							state.msg.Verbosef("dbus socket %q is in an unusual location", pair[1])
 						}
diff --git a/internal/pipewire/pipewire.go b/internal/pipewire/pipewire.go
index 0538863a..3b909336 100644
--- a/internal/pipewire/pipewire.go
+++ b/internal/pipewire/pipewire.go
@@ -20,7 +20,7 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"path"
+	"path/filepath"
 	"runtime"
 	"slices"
 	"strconv"
@@ -973,23 +973,23 @@ func connectName(name string, manager bool) (conn Conn, err error) {
 		return connectName(name+"-manager", false)
 	}
 
-	if path.IsAbs(name) || (len(name) > 0 && name[0] == '@') {
+	if filepath.IsAbs(name) || (len(name) > 0 && name[0] == '@') {
 		return Dial(name)
 	} else {
 		runtimeDir, ok := os.LookupEnv("PIPEWIRE_RUNTIME_DIR")
-		if !ok || !path.IsAbs(runtimeDir) {
+		if !ok || !filepath.IsAbs(runtimeDir) {
 			runtimeDir, ok = os.LookupEnv("XDG_RUNTIME_DIR")
 		}
-		if !ok || !path.IsAbs(runtimeDir) {
+		if !ok || !filepath.IsAbs(runtimeDir) {
 			// this is cargo culted from windows stuff and has no effect normally;
 			// keeping it to maintain compatibility in case someone sets this
 			runtimeDir, ok = os.LookupEnv("USERPROFILE")
 		}
 
-		if !ok || !path.IsAbs(runtimeDir) {
+		if !ok || !filepath.IsAbs(runtimeDir) {
 			runtimeDir = DEFAULT_SYSTEM_RUNTIME_DIR
 		}
-		return Dial(path.Join(runtimeDir, name))
+		return Dial(filepath.Join(runtimeDir, name))
 	}
 }
 
diff --git a/internal/pkg/exec.go b/internal/pkg/exec.go
index f1385529..a78dab84 100644
--- a/internal/pkg/exec.go
+++ b/internal/pkg/exec.go
@@ -8,7 +8,7 @@ import (
 	"io"
 	"os"
 	"os/exec"
-	"path"
+	"path/filepath"
 	"slices"
 	"strconv"
 	"syscall"
@@ -189,7 +189,7 @@ func NewExec(
 	paths ...ExecPath,
 ) Artifact {
 	if name == "" {
-		name = "exec-" + path.Base(pathname.String())
+		name = "exec-" + filepath.Base(pathname.String())
 	}
 	if timeout <= 0 {
 		timeout = ExecTimeoutDefault
diff --git a/internal/pkg/pkg.go b/internal/pkg/pkg.go
index a8fb91ba..ea7ac815 100644
--- a/internal/pkg/pkg.go
+++ b/internal/pkg/pkg.go
@@ -16,7 +16,6 @@ import (
 	"iter"
 	"maps"
 	"os"
-	"path"
 	"path/filepath"
 	"runtime"
 	"slices"
@@ -894,7 +893,7 @@ func (c *Cache) Scrub(checks int) error {
 					se.DanglingIdentifiers = append(se.DanglingIdentifiers, *want)
 					seMu.Unlock()
 					return false
-				} else if err = Decode(got, path.Base(linkname)); err != nil {
+				} else if err = Decode(got, filepath.Base(linkname)); err != nil {
 					seMu.Lock()
 					lnp := dir.Append(linkname)
 					se.Errs[lnp.Handle()] = append(se.Errs[lnp.Handle()], err)
@@ -1488,7 +1487,7 @@ func (c *Cache) cure(a Artifact, curesExempt bool) (
 			return
 		}
 		buf := c.getIdentBuf()
-		err = Decode((*Checksum)(buf[:]), path.Base(name))
+		err = Decode((*Checksum)(buf[:]), filepath.Base(name))
 		if err == nil {
 			checksum = unique.Make(Checksum(buf[:]))
 		}
diff --git a/internal/pkg/tar.go b/internal/pkg/tar.go
index 39f55010..32b4b362 100644
--- a/internal/pkg/tar.go
+++ b/internal/pkg/tar.go
@@ -10,7 +10,7 @@ import (
 	"io/fs"
 	"net/http"
 	"os"
-	"path"
+	"path/filepath"
 )
 
 const (
@@ -169,7 +169,7 @@ func (a *tarArtifact) Cure(t *TContext) (err error) {
 		}
 
 		if typeflag >= '0' && typeflag <= '9' && typeflag != tar.TypeDir {
-			if err = root.MkdirAll(path.Dir(header.Name), 0700); err != nil {
+			if err = root.MkdirAll(filepath.Dir(header.Name), 0700); err != nil {
 				return
 			}
 		}
diff --git a/internal/pkg/testdata/main.go b/internal/pkg/testdata/main.go
index bbe26d69..c969474d 100644
--- a/internal/pkg/testdata/main.go
+++ b/internal/pkg/testdata/main.go
@@ -7,7 +7,7 @@ import (
 	"log"
 	"net"
 	"os"
-	"path"
+	"path/filepath"
 	"reflect"
 	"slices"
 	"strings"
@@ -68,7 +68,7 @@ func main() {
 	if got, err := os.Executable(); err != nil {
 		log.Fatalf("Executable: error = %v", err)
 	} else {
-		iftPath = path.Join(path.Dir(path.Dir(got)), "ift")
+		iftPath = filepath.Join(filepath.Dir(filepath.Dir(got)), "ift")
 
 		if got != wantExec {
 			switch got {
@@ -161,7 +161,7 @@ func main() {
 			}
 		}
 		if !layers {
-			if path.Base(lowerdir) != checksumEmptyDir {
+			if filepath.Base(lowerdir) != checksumEmptyDir {
 				log.Fatal("unexpected artifact checksum")
 			}
 		} else {
@@ -187,8 +187,8 @@ func main() {
 			}
 
 			if len(lowerdirs) != 2 ||
-				path.Base(lowerdirs[0]) != "MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU" ||
-				path.Base(lowerdirs[1]) != "nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK" {
+				filepath.Base(lowerdirs[0]) != "MGWmEfjut2QE2xPJwTsmUzpff4BN_FEnQ7T0j7gvUCCiugJQNwqt9m151fm9D1yU" ||
+				filepath.Base(lowerdirs[1]) != "nY_CUdiaUM1OL4cPr5TS92FCJ3rCRV7Hm5oVTzAvMXwC03_QnTRfQ5PPs7mOU9fK" {
 				log.Fatalf("unexpected lowerdirs %s", strings.Join(lowerdirs, ", "))
 			}
 		}
@@ -202,12 +202,12 @@ func main() {
 		}
 
 		next()
-		if path.Base(m.Root) != "OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb" {
+		if filepath.Base(m.Root) != "OLBgp1GsljhM2TJ-sbHjaiH9txEUvgdDTAzHv2P24donTt6_529l-9Ua0vFImLlb" {
 			log.Fatal("unexpected file artifact checksum")
 		}
 
 		next()
-		if path.Base(m.Root) != checksumEmptyDir {
+		if filepath.Base(m.Root) != checksumEmptyDir {
 			log.Fatal("unexpected artifact checksum")
 		}
 	}
@@ -226,13 +226,13 @@ func main() {
 			log.Fatal("unexpected work mount entry")
 		}
 	} else {
-		if path.Base(m.Root) != ident || m.Target != "/work" {
+		if filepath.Base(m.Root) != ident || m.Target != "/work" {
 			log.Fatal("unexpected work mount entry")
 		}
 	}
 
 	next()
-	if path.Base(m.Root) != ident || m.Target != "/tmp" {
+	if filepath.Base(m.Root) != ident || m.Target != "/tmp" {
 		log.Fatal("unexpected temp mount entry")
 	}
 
diff --git a/internal/rosa/cmake.go b/internal/rosa/cmake.go
index e7abffde..f6f29d3e 100644
--- a/internal/rosa/cmake.go
+++ b/internal/rosa/cmake.go
@@ -1,7 +1,7 @@
 package rosa
 
 import (
-	"path"
+	"path/filepath"
 	"slices"
 	"strings"
 
@@ -200,7 +200,7 @@ cmake -G ` + generate + ` \
 		}
 	}), " \\\n\t") + ` \
 	-DCMAKE_INSTALL_PREFIX=/system \
-	'/usr/src/` + name + `/` + path.Join(attr.Append...) + `'
+	'/usr/src/` + name + `/` + filepath.Join(attr.Append...) + `'
 cmake --build .` + jobs + `
 cmake --install . --prefix=/work/system
 ` + attr.Script
diff --git a/internal/rosa/report_test.go b/internal/rosa/report_test.go
index ca29cf36..f394e915 100644
--- a/internal/rosa/report_test.go
+++ b/internal/rosa/report_test.go
@@ -3,7 +3,7 @@ package rosa_test
 import (
 	"errors"
 	"os"
-	"path"
+	"path/filepath"
 	"syscall"
 	"testing"
 	"unique"
@@ -13,7 +13,7 @@ import (
 )
 
 func TestReportZeroLength(t *testing.T) {
-	report := path.Join(t.TempDir(), "report")
+	report := filepath.Join(t.TempDir(), "report")
 	if err := os.WriteFile(report, nil, 0400); err != nil {
 		t.Fatal(err)
 	}
@@ -24,7 +24,7 @@ func TestReportZeroLength(t *testing.T) {
 }
 
 func TestReportSIGSEGV(t *testing.T) {
-	report := path.Join(t.TempDir(), "report")
+	report := filepath.Join(t.TempDir(), "report")
 	if err := os.WriteFile(report, make([]byte, 64), 0400); err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/system/pipewire_test.go b/internal/system/pipewire_test.go
index d1bf5781..f0ca0b34 100644
--- a/internal/system/pipewire_test.go
+++ b/internal/system/pipewire_test.go
@@ -3,7 +3,7 @@ package system
 import (
 	"fmt"
 	"os"
-	"path"
+	"path/filepath"
 	"syscall"
 	"testing"
 	"time"
@@ -18,7 +18,7 @@ func TestPipeWireOp(t *testing.T) {
 
 	checkOpBehaviour(t, checkNoParallel, []opBehaviourTestCase{
 		{"success", 0xbeef, 0xff, &pipewireOp{nil,
-			m(path.Join(t.TempDir(), "pipewire")),
+			m(filepath.Join(t.TempDir(), "pipewire")),
 			"org.chromium.Chromium",
 			"ebf083d1b175911782d413369b64ce7c",
 		}, []stub.Call{
diff --git a/internal/wayland/conn_test.go b/internal/wayland/conn_test.go
index a884c182..30c66cb2 100644
--- a/internal/wayland/conn_test.go
+++ b/internal/wayland/conn_test.go
@@ -3,7 +3,7 @@ package wayland
 import (
 	"errors"
 	"os"
-	"path"
+	"path/filepath"
 	"reflect"
 	"syscall"
 	"testing"
@@ -19,7 +19,7 @@ func TestSecurityContextClose(t *testing.T) {
 	}
 
 	var ctx SecurityContext
-	if f, err := os.Create(path.Join(t.TempDir(), "remove")); err != nil {
+	if f, err := os.Create(filepath.Join(t.TempDir(), "remove")); err != nil {
 		t.Fatal(err)
 	} else {
 		ctx.bindPath = check.MustAbs(f.Name())
diff --git a/test/internal/sandbox/assert.go b/test/internal/sandbox/assert.go
index 82c928b0..343c1586 100644
--- a/test/internal/sandbox/assert.go
+++ b/test/internal/sandbox/assert.go
@@ -17,7 +17,7 @@ import (
 	"log"
 	"net"
 	"os"
-	"path"
+	"path/filepath"
 	"syscall"
 )
 
@@ -54,7 +54,7 @@ func (t *T) MustCheckFile(wantFilePath string) {
 }
 
 func mustAbs(s string) string {
-	if !path.IsAbs(s) {
+	if !filepath.IsAbs(s) {
 		fatalf("[FAIL] %q is not absolute", s)
 		panic("unreachable")
 	}
@@ -68,7 +68,7 @@ func (t *T) MustCheck(want *TestCase) {
 		os.Getenv("XDG_RUNTIME_DIR"),
 	}
 	for _, a := range checkWritableDirPaths {
-		pathname := path.Join(mustAbs(a), ".hakurei-check")
+		pathname := filepath.Join(mustAbs(a), ".hakurei-check")
 		if err := os.WriteFile(pathname, make([]byte, 1<<8), 0600); err != nil {
 			fatalf("[FAIL] %s", err)
 		} else if err = os.Remove(pathname); err != nil {
diff --git a/test/internal/sandbox/assert_test.go b/test/internal/sandbox/assert_test.go
index efeb7cb3..012ae23d 100644
--- a/test/internal/sandbox/assert_test.go
+++ b/test/internal/sandbox/assert_test.go
@@ -5,7 +5,7 @@ package sandbox
 import (
 	"encoding/json"
 	"os"
-	"path"
+	"path/filepath"
 	"testing"
 )
 
@@ -15,7 +15,7 @@ func SwapPrint(f F) (old F) { old = printfFunc; printfFunc = f; return }
 func SwapFatal(f F) (old F) { old = fatalfFunc; fatalfFunc = f; return }
 
 func MustWantFile(t *testing.T, v any) (wantFile string) {
-	wantFile = path.Join(t.TempDir(), "want.json")
+	wantFile = filepath.Join(t.TempDir(), "want.json")
 	if f, err := os.OpenFile(wantFile, os.O_CREATE|os.O_WRONLY, 0400); err != nil {
 		t.Fatalf("cannot create %q: %v", wantFile, err)
 	} else if err = json.NewEncoder(f).Encode(v); err != nil {
diff --git a/test/internal/sandbox/fs.go b/test/internal/sandbox/fs.go
index 36d6c6d3..b37d30b9 100644
--- a/test/internal/sandbox/fs.go
+++ b/test/internal/sandbox/fs.go
@@ -6,7 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"io/fs"
-	"path"
+	"path/filepath"
 	"strings"
 )
 
@@ -68,7 +68,7 @@ func (s *FS) Compare(prefix string, e fs.FS) error {
 			printDir(prefix, dir)
 			return ErrFSInvalidEnt
 		} else {
-			name = path.Join(prefix, name)
+			name = filepath.Join(prefix, name)
 
 			if fi, err := got.Info(); err != nil {
 				return err
diff --git a/test/internal/sandbox/mount_test.go b/test/internal/sandbox/mount_test.go
index 65bcec43..a565b0a0 100644
--- a/test/internal/sandbox/mount_test.go
+++ b/test/internal/sandbox/mount_test.go
@@ -4,7 +4,7 @@ package sandbox_test
 
 import (
 	"os"
-	"path"
+	"path/filepath"
 	"testing"
 
 	"hakurei.app/test/internal/sandbox"
@@ -87,7 +87,7 @@ func TestMountinfo(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
-		name := path.Join(t.TempDir(), "sample")
+		name := filepath.Join(t.TempDir(), "sample")
 		if err := os.WriteFile(name, []byte(tc.sample), 0400); err != nil {
 			t.Fatalf("cannot write sample: %v", err)
 		}
diff --git a/vfs/mountinfo_test.go b/vfs/mountinfo_test.go
index 2b6254c4..e54890b2 100644
--- a/vfs/mountinfo_test.go
+++ b/vfs/mountinfo_test.go
@@ -5,7 +5,7 @@ import (
 	"errors"
 	"iter"
 	"os"
-	"path"
+	"path/filepath"
 	"reflect"
 	"slices"
 	"strconv"
@@ -394,7 +394,7 @@ func mn(
 		},
 		FirstChild:  firstChild,
 		NextSibling: nextSibling,
-		Clean:       path.Clean(target),
+		Clean:       filepath.Clean(target),
 		Covered:     covered,
 	}
 }
diff --git a/vfs/unfold.go b/vfs/unfold.go
index 37c4cef3..57236ca4 100644
--- a/vfs/unfold.go
+++ b/vfs/unfold.go
@@ -2,7 +2,7 @@ package vfs
 
 import (
 	"iter"
-	"path"
+	"path/filepath"
 	"strings"
 )
 
@@ -43,7 +43,7 @@ func (n *MountInfoNode) visit(yield func(*MountInfoNode) bool) bool {
 
 // Unfold unfolds the mount hierarchy and resolves covered paths.
 func (d *MountInfoDecoder) Unfold(target string) (*MountInfoNode, error) {
-	targetClean := path.Clean(target)
+	targetClean := filepath.Clean(target)
 
 	var mountinfoSize int
 	for range d.Entries() {
@@ -61,7 +61,7 @@ func (d *MountInfoDecoder) Unfold(target string) (*MountInfoNode, error) {
 	{
 		i := 0
 		for ent := range d.Entries() {
-			mountinfo[i] = &MountInfoNode{Clean: path.Clean(ent.Target), MountInfoEntry: ent}
+			mountinfo[i] = &MountInfoNode{Clean: filepath.Clean(ent.Target), MountInfoEntry: ent}
 			idIndex[ent.ID] = i
 			if mountinfo[i].Clean == targetClean {
 				targetIndex = i