@@ -46,9 +46,13 @@ nfpms:
       deb:
         dependencies:
           - qemu-system-x86
+        recommends:
+          - qemu-system-arm
       rpm:
         dependencies:
           - qemu-system-x86-core
+        recommends:
+          - qemu-system-aarch64-core
   - id: arm64
     ids: [arm64]
     package_name: miso
@@ -66,9 +70,13 @@ nfpms:
       deb:
         dependencies:
           - qemu-system-arm
+        recommends:
+          - qemu-system-x86
       rpm:
         dependencies:
           - qemu-system-aarch64-core
+        recommends:
+          - qemu-system-x86-core
 
 checksum:
   name_template: checksums.txt
 
@@ -452,6 +452,20 @@ dependenciesRules:
         - os/exec
         - net
         - syscall
+  # the emulator takes miso's pinned qemu-user package apart into what runs
+  # the programs of an image of another architecture. It has the download
+  # fetch the package, and never starts a process, opens a connection or
+  # touches the kernel
+  - package: '**.internal.emulator$'
+    shouldOnlyDependsOn:
+      internal:
+        - '**.internal.deb$'
+        - '**.internal.download$'
+    shouldNotDependsOn:
+      standard:
+        - os/exec
+        - net
+        - syscall
   # the builder kernel takes miso's pinned Debian package apart into the
   # kernel the builder VM boots and the modules its agent loads. It has the
   # download fetch the package, and never starts a process, opens a
 
@@ -1,12 +1,16 @@
 package main_test
 
 import (
+	"context"
+	"errors"
+	"net/http"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	main "github.com/The127/miso/cmd/miso"
+	"github.com/The127/miso/internal/download"
 )
 
 func TestAHostMisoDoesNotBuildOnIsRefusedNamingItAndWhereMisoBuilds(t *testing.T) {
@@ -18,3 +22,25 @@ func TestAHostMisoDoesNotBuildOnIsRefusedNamingItAndWhereMisoBuilds(t *testing.T
 	assert.ErrorContains(t, err, "riscv64")
 	assert.ErrorContains(t, err, "amd64 and arm64")
 }
+
+func TestABuildForTheBuildersOwnArchitectureFetchesNoEmulator(t *testing.T) {
+	// arrange
+	offline := &http.Client{Transport: roundTrip(func(*http.Request) (*http.Response, error) {
+		return nil, errors.New("offline")
+	})}
+	store := download.Open(t.TempDir(), offline)
+
+	// act
+	emulators, err := main.EmulatorsFor(context.Background(), store, main.BuilderArch)
+
+	// assert
+	require.NoError(t, err)
+	assert.Empty(t, emulators)
+}
+
+// roundTrip is an HTTP transport that is a function.
+type roundTrip func(*http.Request) (*http.Response, error)
+
+func (f roundTrip) RoundTrip(request *http.Request) (*http.Response, error) {
+	return f(request)
+}
@@ -2,7 +2,6 @@ package main
 
 import (
 	"context"
-	"fmt"
 	"io"
 	"os"
 
@@ -22,14 +21,14 @@ var buildCommand = &cli.Command{
 	Flags: []cli.Flag{
 		fileFlag(),
 		outputFlag(),
-		&cli.StringFlag{Name: "arch", Usage: "the architecture the image is built for", Value: builderArch},
+		archFlag(),
 	},
 	Action: runBuild,
 }
 
 func runBuild(ctx context.Context, command *cli.Command) error {
-	if arch := command.String("arch"); arch != builderArch {
-		return fmt.Errorf("--arch %q is not an architecture miso builds for, only %s", arch, builderArch)
+	if err := archRefusal(command); err != nil {
+		return err
 	}
 
 	return withBuilder(ctx, command, build.Requests, func(have prepared, boot booter) error {
@@ -49,7 +48,7 @@ func runBuild(ctx context.Context, command *cli.Command) error {
 
 		defer func() { _ = os.RemoveAll(scratch) }()
 
-		outputs, err := outputsOf(command, checker(ctx, have.blobs, string(have.dir), console), scratch)
+		outputs, err := outputsOf(command, checker(ctx, have.blobs, string(have.dir), console, targetArch(command)), scratch)
 		if err != nil {
 			return err
 		}
 
@@ -25,16 +25,16 @@ func cacheDir() (string, error) {
 	return filepath.Join(dir, "miso"), nil
 }
 
-// baseImages are the base images miso keeps in its cache for the builder's
+// baseImages are the base images miso keeps in its cache for an
 // architecture, and the store their bytes live in.
-func baseImages(cache string) (*download.Store, *baseimage.Cache, error) {
+func baseImages(cache, arch string) (*download.Store, *baseimage.Cache, error) {
 	if err := hostRefusal(builderArch); err != nil {
 		return nil, nil, err
 	}
 
 	blobs := download.Open(filepath.Join(cache, "bases"), http.DefaultClient)
 
-	return blobs, baseimage.OpenFor(filepath.Join(cache, "bases"), builderArch, blobs), nil
+	return blobs, baseimage.OpenFor(filepath.Join(cache, "bases"), arch, blobs), nil
 }
 
 // cacheDiskSize is how large the cache disk may grow. The file is sparse,
 
@@ -24,8 +24,9 @@ const bootPatience = 5 * time.Minute
 
 // checker boots each checked output on a vsock of its own and runs its checks:
 // a rootfs with its kernel and initrd, any other output under UEFI. The boots
-// write their scratch into dir and their console to console.
-func checker(ctx context.Context, blobs *download.Store, dir string, console io.Writer) builder.Check {
+// write their scratch into dir and their console to console. The outputs are
+// of arch.
+func checker(ctx context.Context, blobs *download.Store, dir string, console io.Writer, arch string) builder.Check {
 	return func(disk string, request build.Request) error {
 		namespace, err := vsockns.Open()
 		if errors.Is(err, vsockns.ErrNotPrivate) {
@@ -52,7 +53,7 @@ func checker(ctx context.Context, blobs *download.Store, dir string, console io.
 			Dir:      scratch,
 			Console:  console,
 			Patience: bootPatience,
-			Arch:     builderArch,
+			Arch:     arch,
 		}
 
 		if err := bootsFrom(ctx, blobs, disk, request, &boot); err != nil {
@@ -78,7 +79,7 @@ func checker(ctx context.Context, blobs *download.Store, dir string, console io.
 // a rootfs, the firmware for any other output.
 func bootsFrom(ctx context.Context, blobs *download.Store, disk string, request build.Request, boot *check.Boot) error {
 	if request.Boot == nil {
-		found, err := firmware.Ready(ctx, blobs, builderArch)
+		found, err := firmware.Ready(ctx, blobs, boot.Arch)
 		if err != nil {
 			return err
 		}
 
@@ -5,3 +5,18 @@ var CachedKeys = cachedKeys
 
 // HostRefusal is hostRefusal for the tests.
 var HostRefusal = hostRefusal
+
+// EmulatorsFor is emulatorsFor for the tests.
+var EmulatorsFor = emulatorsFor
+
+// BuilderArch is builderArch for the tests.
+const BuilderArch = builderArch
+
+// WithShellHint is withShellHint for the tests.
+var WithShellHint = withShellHint
+
+// FileFlag is fileFlag for the tests.
+var FileFlag = fileFlag
+
+// ArchFlag is archFlag for the tests.
+var ArchFlag = archFlag
@@ -2,8 +2,11 @@ package main
 
 import (
 	"context"
+	"fmt"
 	"os"
 	"path/filepath"
+	"slices"
+	"strings"
 
 	"github.com/urfave/cli/v3"
 
@@ -19,17 +22,22 @@ var planCommand = &cli.Command{
 	ArgsUsage: "[context]",
 	Flags: []cli.Flag{
 		fileFlag(),
+		archFlag(),
 	},
 	Action: listPlan,
 }
 
 func listPlan(ctx context.Context, command *cli.Command) error {
+	if err := archRefusal(command); err != nil {
+		return err
+	}
+
 	cache, err := cacheDir()
 	if err != nil {
 		return err
 	}
 
-	blobs, bases, err := baseImages(cache)
+	blobs, bases, err := baseImages(cache, targetArch(command))
 	if err != nil {
 		return err
 	}
@@ -65,14 +73,35 @@ func planOf(command *cli.Command, files *buildcontext.Dir, bases plan.Bases) (pl
 		return plan.Plan{}, err
 	}
 
-	planned, err := plan.New(stages, agentName(), builderArch, files, bases)
+	planned, err := plan.New(stages, agentName(), targetArch(command), files, bases)
 	if err != nil {
 		return plan.Plan{}, imagefile.InFile(file, err)
 	}
 
 	return planned, nil
 }
 
+// archFlag names the architecture a command builds for. Each command gets
+// its own, since a flag keeps what was parsed into it.
+func archFlag() *cli.StringFlag {
+	return &cli.StringFlag{Name: "arch", Usage: "the architecture the image is built for", Value: builderArch}
+}
+
+// archRefusal is why miso cannot build for the architecture the command
+// names, or nil when it can.
+func archRefusal(command *cli.Command) error {
+	if arch := command.String("arch"); !slices.Contains(arches, arch) {
+		return fmt.Errorf("--arch %q is not an architecture miso builds for, only %s", arch, strings.Join(arches, " and "))
+	}
+
+	return nil
+}
+
+// targetArch is the architecture the command builds for.
+func targetArch(command *cli.Command) string {
+	return command.String("arch")
+}
+
 // fileFlagName is the flag that names the build file.
 const fileFlagName = "file"
 
 
@@ -41,7 +41,7 @@ func runPrune(ctx context.Context, command *cli.Command) error {
 		return err
 	}
 
-	blobs, _, err := baseImages(cache)
+	blobs, _, err := baseImages(cache, builderArch)
 	if err != nil {
 		return err
 	}
@@ -77,7 +77,7 @@ func pruneLayers(ctx context.Context, command *cli.Command, dir cachedisk.Dir, b
 // askBuilder has the builder VM answer one request that reaches nothing
 // outside the VM, from the cache disk in dir, which the caller holds.
 func askBuilder(ctx context.Context, command *cli.Command, dir cachedisk.Dir, blobs *download.Store, request protocol.Message, out io.Writer) error {
-	boot, err := bootFiles(ctx, blobs)
+	boot, err := bootFiles(ctx, blobs, builderArch)
 	if err != nil {
 		return err
 	}
 
@@ -22,12 +22,17 @@ var shellCommand = &cli.Command{
 	Metadata:  map[string]any{takesWords: true},
 	Flags: []cli.Flag{
 		fileFlag(),
+		archFlag(),
 		&cli.IntFlag{Name: "before", Usage: "the line of the build file whose step the shell stands before, the end of the build if not given"},
 	},
 	Action: runShell,
 }
 
 func runShell(ctx context.Context, command *cli.Command) error {
+	if err := archRefusal(command); err != nil {
+		return err
+	}
+
 	shellOn := func(planned plan.Plan, network protocol.Network) ([]build.Request, error) {
 		if !command.IsSet("before") {
 			return build.After(planned, network)
Original file line number	Diff line number	Diff line change
`@@ -25,16 +25,16 @@ func cacheDir() (string, error) {`
`25`	`25`	`return filepath.Join(dir, "miso"), nil`
`26`	`26`	`}`
`27`	`27`
`28`		`-// baseImages are the base images miso keeps in its cache for the builder's`
	`28`	`+// baseImages are the base images miso keeps in its cache for an`
`29`	`29`	`// architecture, and the store their bytes live in.`
`30`		`-func baseImages(cache string) (download.Store, baseimage.Cache, error) {`
	`30`	`+func baseImages(cache, arch string) (download.Store, baseimage.Cache, error) {`
`31`	`31`	`if err := hostRefusal(builderArch); err != nil {`
`32`	`32`	`return nil, nil, err`
`33`	`33`	`}`
`34`	`34`
`35`	`35`	`blobs := download.Open(filepath.Join(cache, "bases"), http.DefaultClient)`
`36`	`36`
`37`		`- return blobs, baseimage.OpenFor(filepath.Join(cache, "bases"), builderArch, blobs), nil`
	`37`	`+ return blobs, baseimage.OpenFor(filepath.Join(cache, "bases"), arch, blobs), nil`
`38`	`38`	`}`
`39`	`39`
`40`	`40`	`// cacheDiskSize is how large the cache disk may grow. The file is sparse,`
Original file line number	Diff line number	Diff line change
`@@ -41,7 +41,7 @@ func runPrune(ctx context.Context, command *cli.Command) error {`
`41`	`41`	`return err`
`42`	`42`	`}`
`43`	`43`
`44`		`- blobs, _, err := baseImages(cache)`
	`44`	`+ blobs, _, err := baseImages(cache, builderArch)`
`45`	`45`	`if err != nil {`
`46`	`46`	`return err`
`47`	`47`	`}`
`@@ -77,7 +77,7 @@ func pruneLayers(ctx context.Context, command *cli.Command, dir cachedisk.Dir, b`
`77`	`77`	`// askBuilder has the builder VM answer one request that reaches nothing`
`78`	`78`	`// outside the VM, from the cache disk in dir, which the caller holds.`
`79`	`79`	`func askBuilder(ctx context.Context, command cli.Command, dir cachedisk.Dir, blobs download.Store, request protocol.Message, out io.Writer) error {`
`80`		`- boot, err := bootFiles(ctx, blobs)`
	`80`	`+ boot, err := bootFiles(ctx, blobs, builderArch)`
`81`	`81`	`if err != nil {`
`82`	`82`	`return err`
`83`	`83`	`}`