Packages

LFS ch7, inside the chroot. Needed as a build-time dependency for many later packages (autoconf, etc). Superseded by chapter 8's full perl build.

BLFS general/perl-modules (XML::Parser). Required by Intltool. Links against expat (already built in chapter 8/BLFS). Skips the optional make test.

The pgAdmin 4 desktop window -- a hand-written PySide6 + QtWebEngine shell that replaces pgAdmin's own Electron runtime (user's explicit preference: PySide6, not a 150MB bundled-Chromium Electron blob). It's a thin app: picks a free port + a UUID key, launches /opt/pgadmin4/venv/bin/python -s /opt/pgadmin4/web/pgAdmin4.py in desktop mode (PGADMIN_SERVER_MODE=OFF, PGADMIN_INT_PORT, PGADMIN_INT_KEY, PGADMIN_DATA_DIR=~/.pgadmin), polls http://127.0.0.1:<port>/misc/ping?key=<uuid> until 'PING', then loads http://127.0.0.1:<port>/?key=<uuid> in a QWebEngineView. Kills the server subprocess on close. This mirrors exactly what pgAdmin itself did in its pre-Electron Qt/QtWebEngine era. Depends on packages/pgadmin4-server (the Flask app + venv), packages/pyside6, packages/qtwebengine (its libQt6WebEngine*.so live in /opt/qt6-full/lib, on the ld path via /etc/ld.so.conf.d/qt6-full.conf). QTWEBENGINE_DISABLE_SANDBOX=1 is set because the custom /opt/qt6-full prefix has no setuid sandbox helper. The .png icon is pgAdmin's own runtime/assets/pgAdmin4.png (hence source = the pgadmin4 tarball); imagemagick on .101 fans it out to hicolor sizes. The window shell itself is written in build.sh as a heredoc (same pattern as scripts/lfs_*_setup.sh's embedded GTK apps). ship_in_iso=false.

pgAdmin 4 9.17 -- the Flask web application, built FROM SOURCE against LinuxDoors' own Python 3.14 (user's explicit choice over the Debian .deb's bundled Python 3.13 venv, and over Electron). Installs to /opt/pgadmin4/{venv,web}. The venv is created with `python3 -m venv` at the real /opt/pgadmin4/venv path during the build (so pip writes correct absolute shebangs) then copied into $PKG_DESTDIR for capture -- same 'write to real / during build' pattern packages/postgresql and packages/cups/openssh already use for useradd. requirements.txt is installed verbatim EXCEPT `gssapi` (Kerberos/GSSAPI auth to PG servers -- needs krb5 headers LinuxDoors doesn't have; everything else works without it). cryptography and bcrypt compile their Rust extensions via /opt/rustc (packages/rustc). psycopg[c] compiles against libpq via /usr/bin/pg_config (packages/postgresql). The ONE non-source piece: web/pgadmin/static/js/generated/ (the webpack bundle) is lifted from the matching pgadmin4-server_9.17 .deb -- it is architecture-independent compiled JS/CSS, a build artifact of the same 9.17 source, and building it here would require a full Node/yarn/webpack front-end build. Compiled .mo translations are taken from the same .deb (source ships .po only). Desktop GUI is a separate package (pgadmin4-desktop, a PySide6+QtWebEngine shell -- NOT Electron). Web/server deployment is packages/pgadmin4-web. ship_in_iso=false.

pgAdmin 4 server-mode deployment (multi-user, login required) for LinuxDoors. Small package: a hand-written gunicorn-backed systemd service (pgadmin4-web.service) that runs packages/pgadmin4-server's Flask app in SERVER_MODE on 127.0.0.1:5050 as the `pgadmin` user, plus `pgadmin4-web-setup` (wraps web/setup.py to create the first admin account) and a drop-in nginx reverse-proxy snippet at /etc/nginx/conf.d/pgadmin4.conf.example (LinuxDoors ships no nginx by default -- the file is an example to copy if nginx is added later; the systemd service alone is enough for localhost/LAN use). gunicorn + gevent are pip-installed into pgadmin4-server's existing venv during this build. depends pgadmin4-server. ship_in_iso=false. NOT needed by pgadmin4-desktop (that runs its own private in-process server).

PipeWire -- a genuinely new subsystem for this project, added 2026-09-18 specifically because mutter 51.0's remote_desktop feature (org.gnome.Mutter.ScreenCast / org.gnome.Mutter.RemoteDesktop, which gnome-remote-desktop wraps into RDP) hard-requires libpipewire-0.3 for the actual frame-capture pipeline. Deliberately built to the SHARED /usr prefix, NOT the isolated /opt/gnome51 -- unlike gnome-shell/mutter/gnome-session/etc., nothing about PipeWire collides with anything already on this system (this project never had a PipeWire install before at all, in any prefix), and keeping it shared means any FUTURE package that wants real screen-capture/audio-routing doesn't need its own private copy. Scoped narrowly: this project's existing audio stack (ALSA direct, no PulseAudio) is left completely alone -- pipewire-alsa/pipewire-jack/bluez5/jack backends are all disabled, since the only thing actually needed is the core library + daemon for Mutter's screen-cast producer role. Real, hand-picked minimal option set (not yet build-verified as of this note -- real errors get fixed against the actual build.sh as they surface, same discipline as every other package here): docs/man/examples/tests/installed_tests all off, gstreamer/gstreamer-device-provider off (no GStreamer in this project), bluez5 (+ all its backend/codec suboptions) off, pipewire-alsa/pipewire-jack/jack off, libsystemd/logind on (systemd is this project's init), systemd-system-service/systemd-user-service on (so `systemctl --user start pipewire` works the normal way), spa-plugins on (needed for the core video/control SPA plugins the screen-cast path uses).

BLFS. Needed by cairo. Skips the optional test suite.

LFS ch8. Uses a temporarily-extracted meson (not the real system-wide 'meson' package, built much later in the real order) to avoid a circular dependency, per the book. Skips the optional ninja test.

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work. || 6.7.4 -> 6.7.5 (2026-09-14 real upstream-currency bump, real sha256 computed -- no published checksum from KDE's release-service, only a detached .asc signature, so archive integrity was verified with `xz -t` first, same approach as kdenlive/mesa). 2026-10-10: rebuilt as 6.7.5-1 against Qt 6.12.0 (links Qt private API, which is only guaranteed within one Qt minor release).

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work. || 6.7.4 -> 6.7.5 (2026-09-14 real upstream-currency bump, real sha256 computed -- no published checksum from KDE's release-service, only a detached .asc signature, so archive integrity was verified with `xz -t` first, same approach as kdenlive/mesa).

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work. || 6.7.4 -> 6.7.5 (2026-09-14 real upstream-currency bump, real sha256 computed -- no published checksum from KDE's release-service, only a detached .asc signature, so archive integrity was verified with `xz -t` first, same approach as kdenlive/mesa).

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work. || 6.7.4 -> 6.7.5 (2026-09-14 real upstream-currency bump, real sha256 computed -- no published checksum from KDE's release-service, only a detached .asc signature, so archive integrity was verified with `xz -t` first, same approach as kdenlive/mesa). 2026-10-10: rebuilt as 6.7.5-1 against Qt 6.12.0 (links Qt private API, which is only guaranteed within one Qt minor release).

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work. || 6.7.4 -> 6.7.5 (2026-09-14 real upstream-currency bump, real sha256 computed -- no published checksum from KDE's release-service, only a detached .asc signature, so archive integrity was verified with `xz -t` first, same approach as kdenlive/mesa). || 2026-09-28, REAL BUG FOUND AND FIXED -- this package's own real `KDEPlasmaPlatformTheme6.so` (the actual Qt platform-theme plugin that makes `QGenericUnixTheme::createUnixTheme("kde")` -- called by every Qt6 app in this KDE stack, KWin included -- return a real, working KDE-flavored theme instead of falling through to an incomplete fallback) was installing to `/usr/lib/plugins/platformthemes/` instead of `/opt/qt6-full/plugins/platformthemes/`, the only path this project's actual Qt6 install ever searches. ECM's `KDE_INSTALL_QTPLUGINDIR` silently falls back to a plain `${CMAKE_INSTALL_PREFIX}`-relative path whenever it can't auto-detect Qt's real plugin directory, which it never could here since Qt6 lives at a nonstandard `/opt/qt6-full` prefix rather than `/usr`. This was invisible for a long time because nothing crashed loudly at build or install time -- it just meant the plugin was never found at runtime, which surfaced as a 100%-reproducible `kwin_wayland` crash inside Qt's own `QStyleHintsPrivate::update()` (see packages/kwin's own notes for the full diagnostic story and the real, screenshot-verified fix confirmation). Fixed with an explicit `-DKDE_INSTALL_QTPLUGINDIR=/opt/qt6-full/plugins` on the cmake invocation -- confirmed the rebuilt zip installs the plugin to the correct path. Worth checking whether any OTHER already-built Qt-plugin-installing package in this stack (icon engines, styles, kirigami platform plugins, etc.) has the same latent gap -- not audited beyond this one package, since fixing the one that was actually blocking a real, verified bug was the immediate priority.

KDE's own extra Wayland protocol definitions (used by KWin/kwayland). ECM+CMake, XML only. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work. || 6.7.4 -> 6.7.5 (2026-09-14 real upstream-currency bump, real sha256 computed -- no published checksum from KDE's release-service, only a detached .asc signature, so archive integrity was verified with `xz -t` first, same approach as kdenlive/mesa). || 2026-09-29: real bug found and fixed, user-reported ('extremely slow Plasma Wayland, even login takes several seconds'). Root cause, confirmed via systemd's own resource accounting on a real session: plasma-kwin_wayland.service consumed 22min 37s of CPU time over just 1min of wall clock (~22 cores pegged simultaneously) -- kwin_wayland was busy-looping retrying its failed OpenGL compositor negotiation instead of cleanly settling on software rendering, on hardware where real GPU acceleration never actually works (nouveau on this project's real NVIDIA GPU host, .101 -- see the build-host-101 project memory for the full mesa/nouveau saga this sits downstream of). Fixed with KWin's own documented KWIN_COMPOSE=Q env var (skips the OpenGL attempt entirely, straight to QPainter/CPU compositing -- verified directly: a controlled standalone kwin_wayland run used 0.07s CPU over an 8s window with this set, vs 22+ CPU-minutes/session without it), shipped via a new /etc/xdg/plasma-workspace/env/99-kwin-force-qpainter.sh -- KDE Plasma's own official env.d mechanism (startplasma-wayland/startplasma-x11 source every *.sh here system-wide, same convention the existing 10-linuxdoors-paths.sh already used), so every user gets it automatically with no binary patched and no config to hand-edit. Confirmed live on .101 (a real logged-in session went from unusable to fast), then baked into this package for real -- both build.sh (for a future from-scratch rebuild) and the already-built plasma-workspace-6.7.5.zip (patched directly, same technique as this project's other small post-build fixes -- unzip, add the one file to the inner tar with correct root ownership, re-tar, re-zip -- rather than a lengthy full KDE rebuild for a one-file config addition). 2026-10-10: rebuilt as 6.7.5-1 against Qt 6.12.0 (links Qt private API, which is only guaranteed within one Qt minor release).

Not in BLFS -- MATE's text editor (a fork of gedit 2.30), real upstream release tarball from github.com/mate-desktop/pluma (ships a pre-generated `configure`, no autogen.sh/git-submodules needed, verified by extracting and checking for the file directly). Chosen by the user specifically as a real end-to-end verification case for the new LinuxDoors package-manager/source-build feature (install via precompiled zip, uninstall, install via the source-build path, uninstall, reinstall). Real dependency chain confirmed via configure.ac -- gtk+-3.0/gtksourceview-4/glib2/libxml2/gio2 already present, but two hard requirements were genuinely missing from this project's stack until now: mate-desktop-2.0 (see packages/mate-desktop, itself needing packages/dconf) and libpeas-1.0/libpeas-gtk-1.0 (see packages/libpeas, pluma's plugin engine). Plain autotools build, mostly no special flags needed -- introspection/python are auto-detected optional features in pluma's own configure.ac. Real build bug: enchant (spell-check) is the one exception -- its PKG_CHECK_MODULES is conditional, but configure then hard-errors ('Enchant library not found or too old') unless `--disable-spell` is explicitly passed; this project has never built enchant. Fixed with `--disable-spell`. Second real build bug, two-layered: pluma's plugin-engine glue code (`pluma-plugins-engine.c`) unconditionally `#include <girepository.h>` regardless of pluma's own `--enable-introspection` flag (tried `--enable-introspection=no` first -- still failed, since libpeas's own `.pc` file doesn't propagate `girepository.h`'s include path into its CFLAGS even though libpeas's C API needs it; disabling introspection just meant pluma's build stopped adding gobject-introspection's CFLAGS itself, but the source still needed the header). Real fix: leave pluma's introspection auto-detected (default) and instead fix the actual root cause -- `packages/gtksourceview4` was built with `gir=false` (predating gobject-introspection existing in this project, the same silent-skip class already hit for gdk-pixbuf/harfbuzz/at-spi2-core), so `GtkSource-4.gir` never existed for pluma's own .gir generation to include. Rebuilt gtksourceview4 with `gir=true` instead.

Real, user-reported bug fix: XFCE's logout dialog and lightdm's greeter both greyed out Restart/Shutdown. Root cause confirmed directly on a live installed system, not guessed: `busctl call org.freedesktop.login1 ... CanReboot` returned 'Access denied' -- systemd-logind (confirmed via `strings` on the built systemd-logind binary: bus_verify_polkit_async_full/logind-polkit.c are compiled in) tries to consult polkit for every privileged action, but polkitd was never built anywhere in this project's history. The action policy systemd itself ships (/usr/share/polkit-1/actions/org.freedesktop.login1.policy) already defaults org.freedesktop.login1.power-off/reboot/etc to <allow_active>yes</allow_active> -- an active local session should be auto-granted, no password needed -- but with no polkitd running to read and enforce that policy, logind has nothing to ask and fails closed. User explicitly chose 'build real polkit' over the lighter alternative (rebuilding systemd with -Dpolkit=disabled, which would fall back to logind's own simpler built-in active-session heuristic) since real polkit is the standard mechanism and will be needed for other future desktop permission checks too. No LFS/BLFS book page exists for this (neither project covers it) -- built directly from polkit's own real upstream source (github.com/polkit-org/polkit tag 127, the current freedesktop.org/GitLab project's own GitHub mirror, GitLab itself blocks automated fetches via its Anubis anti-bot check), version confirmed as the actual latest release, real sha256 computed directly, not a placeholder. Depends on packages/duktape (modern polkit >=~121 dropped mozjs entirely in favor of duktape >=2.2.0 for its .rules JS engine, confirmed directly from polkit's own meson.build dependency() call) and linux-pam (authfw=pam). Configured with -Dos_type=lfs (a REAL supported choice in polkit's own meson_options.txt, not guessed) -- with os_type=lfs, polkit's default pam_include resolution correctly references system-auth/system-account/system-password/system-session, which this project's existing BLFS PAM chapter work already installs (confirmed live: /etc/pam.d/system-auth etc. already exist and are used by /etc/pam.d/login the same way), so no new PAM indirection file needed. -Dprivileged_group=root overrides the meson default fallback of 'wheel' (a group this project doesn't have) -- harmless for this fix specifically (shutdown/reboot authorization uses the allow_active path, which needs no group membership at all), but avoids leaving a dangling group reference for any future auth_admin-requiring action. -Dpolkitd_user=polkitd needs a new system user (created in build.sh, same guarded useradd -r pattern as sshd/messagebus/lp elsewhere in this project). Enablement needs no systemctl enable at all -- confirmed directly from polkit's own data/org.freedesktop.PolicyKit1.service.in: it's a real D-Bus system-bus-activated service (SystemdService=polkit.service), so systemd starts polkit.service on demand the first time anything calls org.freedesktop.PolicyKit1, exactly matching the socket/device-activation pattern this project's own cups.socket already uses.

polkit-qt6-1 -- Qt6 bindings for PolicyKit. Needed by kauth's polkit backend, kde-cli-tools (kdesu), powerdevil, systemsettings kcms. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

BLFS general/poppler.html (PDF rendering library). Required by GIMP 3.2.4 directly (for opening/importing PDFs). ENABLE_QT5=OFF per the book, plus a second real fix beyond the book: this poppler release also has a separate ENABLE_QT6 (default ON, poppler added Qt6 bindings alongside/instead of Qt5) that ENABLE_QT5=OFF alone doesn't cover -- caught by a second real 'Could not find Qt6Core' CMake failure after the first fix, fixed with ENABLE_QT6=OFF too (this project has no Qt at all, 5 or 6). Every 'recommended' dependency the book lists (Cairo, lcms2, libjpeg-turbo, libpng, tiff) is already built in this project and gets auto-detected by cmake, so no extra flags are needed to enable them. Real build failure hit and fixed: gpgmepp (GPG-signature verification for signed PDFs) is gated behind ENABLE_GPGME, which defaults ON and hard-fails configure via CMake's own find_soft_mandatory_package() if gpgmepp isn't present -- added ENABLE_GPGME=OFF since PDF signature verification isn't needed for GIMP's plain import/render use case. nss and OpenJPEG remain skipped (genuinely optional -- auto-detected if present, not required). Boost turned out to be a third real hard-fail (ENABLE_BOOST defaults ON, only for optional Splash-backend performance per its own CMake option description) -- fixed with ENABLE_BOOST=OFF after a third real 'Could NOT find Boost' failure.

BLFS general/poppler-data.html -- CJK/Cyrillic encoding tables for poppler. Data-only package (no compilation, just `make install`), ships its own poppler-data.pc so GIMP's meson.build can pkg-config-check for it (dependency('poppler-data')) -- a real, non-optional check even though the data itself is functionally optional for plain Latin-text PDFs. Caught by a real 'Dependency poppler-data not found' failure.

PostgreSQL 18.6 built from the official source tarball (BLFS server/postgresql.html recipe, adapted for destdir + LinuxDoors), NOT the Debian/PGDG .deb -- user's explicit choice, since a source build links LinuxDoors' own openssl 4.x / icu 78 / readline 8.3 / zlib / lz4 / zstd / libxml2 and carries none of Debian's postgresql-common/pg_wrapper/debconf machinery. ship_in_iso=false. Data dir convention: PGDATA=/var/lib/postgresql/data (version-agnostic; not BLFS's /srv/pgsql/data and not Debian's per-cluster /var/lib/postgresql/<ver>/main). Creates the `postgres` user/group (uid/gid 41) directly in build.sh, guarded idempotently -- same pattern as packages/cups (lp) and packages/openssh (sshd). Hand-written postgresql.service (no verified blfs-systemd-units source) with an ExecStartPre that runs `initdb` on first start if $PGDATA/PG_VERSION is absent -- same first-run-init idea as openssh's sshd.service ssh-keygen -A. --with-perl/--with-python/--with-tcl included for PL/PerlU / PL/Python3U / PL/Tcl; if any fails at configure (LFS perl/python shared-lib layout), drop that one flag and rebuild. --with-llvm (JIT) deliberately omitted for the first build -- LinuxDoors' LLVM is 22 and PG JIT is finicky across LLVM majors; can be added later. --with-liburing (PG18 async I/O) omitted -- no liburing package.

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work. || 6.7.4 -> 6.7.5 (2026-09-14 real upstream-currency bump, real sha256 computed -- no published checksum from KDE's release-service, only a detached .asc signature, so archive integrity was verified with `xz -t` first, same approach as kdenlive/mesa). 2026-10-10: rebuilt as 6.7.5-1 against Qt 6.12.0 (links Qt private API, which is only guaranteed within one Qt minor release).

Not in BLFS -- user explicitly asked for real 'preloading libraries' to speed up app launch time, so this is the actual open-source adaptive readahead daemon named 'preload' (the same one Ubuntu/Debian have historically shipped as an optional package), not a hand-rolled equivalent. The original upstream (Behdad Esfahbod's preload.sf.net, last released 0.6.4 in ~2008) uses autotools + popt and is old enough it would likely hit the same strict-warnings-as-errors friction this project already saw with NetSurf's ancient C code under GCC 14. Used arunanshub/preload instead -- a straight functional clone (same proc.c/prophet.c/spy.c/readahead.c architecture, i.e. genuinely the same real algorithm: watches /proc for exec events, builds a Markov-chain usage model per binary+its mapped libraries, and issues readahead() calls to prefetch files it predicts will be launched soon) but rebuilt with meson instead of autotools, and its ONLY dependency is glib-2.0 (already built in this project) -- no popt needed at all. Real GitHub tag 0.1.5, verified the tarball URL resolves and pinned its real sha256 (not a placeholder). Ships its own systemd unit is NOT bundled upstream (labeled WIP, no packaging files) -- hand-written here (Type=simple, ExecStart uses --foreground per its own real --help output, matching the pattern already used for scx.service) and enabled by default via the multi-user.target.wants symlink (same pattern as openssh's sshd.service), since the whole point is for it to actually run, not sit dormant like scx.service was left. Default preload.conf tunables (cycle=1s scan interval, minsize=2MB, autosave=3600s, maxprocs=30) are meson's own hardcoded upstream defaults, left unchanged -- reasonable for a general desktop workload and not worth second-guessing without real usage data.

KDE Frameworks 6 (6.29.0) module for the KDE Plasma chain. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.