Packages

The real, from-source Chromium-pinned Rust toolchain -- explicit user choice ('build a matching Chromium-pinned Rust toolchain') after discovering Chromium 151's own //base has MANDATORY (not optional) Rust code (JSON parsing via serde_json_lenient, logging via rust_logger) that a plain enable_rust=false can't route around. The exact commit is confirmed directly from packages/ungoogled-chromium's own real Chromium source tree (DEPS file, 'src/third_party/rust-toolchain' gcs entry): rustc commit b998449636a48e2c4a362809085b600a0174e1f2, built against the exact same LLVM commit as packages/clang-chromium (llvmorg-23-init-19482-g53d18800) -- confirmed via WebFetch against chromium.googlesource.com's own mirror that this is a real, plain, UNMODIFIED upstream rust-lang/rust commit (a real bors auto-merge, not a Google/Chromium fork), so building it from the real upstream repo is equivalent to what Chromium's own prebuilt package contains. The 'source' entry here is a placeholder -- this can't be a plain tarball download (GitHub's archive endpoint doesn't include git submodules, and this rust-lang/rust checkout needs several: library/backtrace, src/tools/cargo, src/doc/*, src/gcc, src/llvm-project, src/tools/enzyme, src/tools/rustc-perf), so the real source was produced via `git clone` + `git checkout <commit>` + `git submodule update --init --recursive --depth 1` on the dev VM's own outer Debian root (git installed there via apt specifically for this, matching this project's existing precedent for host build tools), then tarred (excluding .git dirs, which aren't needed for the actual build) and fed in as this package's pinned source, real sha256 computed from that real tarball. Bootstraps using this project's OWN already-built rustc (packages/rustc, 1.97.1) as the stage0 compiler -- confirmed viable directly from the real source tree's own src/version file (1.98.0) and Rust's own well-documented N-1-bootstraps-N policy, avoiding any external stage0 download (neither Google's nor even rust-lang.org's official one) for a fully self-hosted build. Points bootstrap.toml's llvm-config at /opt/clang-chromium/bin/llvm-config (our own already-built matching-commit LLVM) instead of letting rustc build or download its own vendored LLVM copy -- avoids a THIRD from-scratch LLVM build (already built once for clang-chromium, no reason to build it again here). Installs to /opt/rustc-chromium, separate from both the system's real /opt/rustc-1.97.1 and /opt/clang-chromium -- packages/ungoogled-chromium's build.sh installs this into its own source tree's third_party/rust-toolchain/ (the fixed relative path Chromium's own build expects, confirmed via build/config/rust.gni), not by adding it to any system PATH.

sassc -- CLI Sass compiler (uses libsass). libadwaita compiles its GTK stylesheet with it at build time. ship_in_iso=false, built on .101.

Not a BLFS book package -- verified against the real sched-ext/scx GitHub repo (README, Cargo.toml files) before writing this, including confirming the real current release tag (v1.1.2, originally) after an initial fetch looked stale. Builds only scx_bpfland and scx_lavd (via `cargo build --release -p scx_bpfland -p scx_lavd`), not the full workspace -- confirmed neither needs protobuf-compiler/libseccomp-dev (those are only pulled in by unrelated workspace tools like scxtop). The BPF side compiles automatically as part of the normal cargo build (scx_utils vendors a portable vmlinux.h, and each scheduler's build.rs drives clang-with-BPF-target via the scx_cargo crate) -- no manual vmlinux.h/bpftool step needed, so bpftool was never built as a separate package. libbpf-rs (a crates.io Rust binding, pinned by scx's own Cargo.toml, not vendored) needs real network access during `cargo build` -- works since the chroot's DHCP fix. Part of the sched_ext (BPF-pluggable CPU scheduler) chain, per explicit user request following the squashfs zstd kernel optimization work -- kernel rebuilt separately (see packages/linux) with CONFIG_SCHED_CLASS_EXT + the BPF_SYSCALL/BPF_JIT/DEBUG_INFO_BTF it depends on, using the new `dwarves`/`pahole` package for BTF generation. Bumped 1.1.2 -> 1.1.3 (real upstream release, verified via the GitHub releases API, sha256 computed directly from the downloaded tarball) after the linux kernel 7.1.7 -> 7.2 bump broke sched_ext: `scx_bpfland`/`scx_lavd` both failed with `Error: Failed to load BPF program / Invalid argument (os error 22)` at the top-level `bpf_object__load()` step, with no per-program verifier message anywhere in a full `RUST_LOG=debug` capture -- the signature of a struct_ops layout mismatch (the kernel's own `struct sched_ext_ops` shape, matched via BTF at load time, not a plain CO-RE field-offset issue that would otherwise self-heal across kernel versions) rather than a Kconfig fix. v1.1.3's own real changelog (PR #3743, `htejun`, the scx maintainer) is titled exactly "Update vmlinux.h and sync include files with kernel sched_ext/for-7.3" -- a direct re-sync of scx_utils' vendored vmlinux.h/struct_ops layout against the current kernel sched_ext branch, which is exactly the fix this failure needed.

BLFS general/sdl2.html -- SDL 2. Runtime-required by Shotcut (audio preview) and used by MLT's sdl2/sdl2_audio consumers for A/V preview in Shotcut and Kdenlive. ship_in_iso=false (video-editing feature = packages only). CMake build, --libdir=lib; PulseAudio/wayland/pipewire deliberately off (ALSA + X11 only, matching this project's audio stack). No Vulkan (Qt6 here has no vulkan either).

LFS ch8, final native build. Skips make html (docs) and the optional test suite.

LFS ch8. Python package built as a wheel and pip-installed offline. Bumped 83.0.0 -> 84.0.0 to track LFS 13.1's package set (sha256 from a real downloaded tarball).

LFS ch8, rebuilt for BLFS PAM support (see linux-pam). configure autodetects libpam (now present) and links it -- no new configure flag needed, same flags as before. Adds BLFS's postlfs/shadow PAM section: login.defs field comments-out and the full /etc/pam.d/{login,passwd,su,chpasswd,newusers,chage,chfn,chgpasswd,chsh,groupadd,groupdel,groupmems,groupmod,useradd,userdel,usermod} set. Skips the book's /etc/login.access + /etc/limits renames (destdir-relative, and neither file exists in a fresh install -- not applicable). Original chapter-8 gap already resolved by lfs_system_config.sh (pwconv/grpconv/root password/useradd -D all run there); only the PAM pieces are new here. IMPORTANT: strips etc/passwd*|shadow*|group*|gshadow* from its own destdir before capture -- a fresh make install would otherwise recreate default account-database templates and the engine's rsync capture would clobber the live ones (root's password, the linux user). depends stays libxcrypt (not linux-pam) to avoid a manifest cycle through the pre-existing blfs-desktop chain-of-convenience ordering (systemd->dbus->...->gtk3); the real build order (linux-pam, then this, then systemd) is enforced by calling `cli build` on each name separately, in that sequence, not by a depends edge. Bumped 4.20.0 -> 4.20.2 to track LFS 13.1's package set (sha256 from a real downloaded tarball).

BLFS. Needed by gdk-pixbuf -- a real dependency that surfaced as a build failure. build-spec=false since we didn't build xmlto.

Shotcut 26.8.1 -- a full non-linear video editor on the MLT engine with a Qt6 GUI and ZERO KDE Frameworks (the reason it was chosen over kdenlive as the first video editor to ship). Not in BLFS. ship_in_iso=false: video-editing feature = packages only, kept out of linuxdoors.iso per user direction. CMake+Ninja. Qt6 6.4+ (Charts, Multimedia, Network, OpenGL(+Widgets), QuickControls2, QuickWidgets, Sql, WebSockets, Widgets, Xml, DBus, GuiPrivate) from the deployed /opt/qt6-full; mlt++-7 >= 7.36.0 from packages/mlt on /usr. Qt6 plugin/qml discovery is automatic (prefix-relative to /opt/qt6-full/lib), so no launcher-wrapper env is needed. Its .desktop + metainfo come from packaging/linux/. Verified on the .101 fast computer via Xvfb.

Not in BLFS's own X/gnome dependency list as a standalone build for us -- VTE's meson.build hard-requires simdutf and tries to auto-fetch it as a wrap subproject via git, which we don't have; building it directly here avoids needing a git toolchain just for this. Skips the optional ninja test.

KDE Frameworks 6 (6.29.0) / Kdenlive dependency. Not in BLFS as its own page. ship_in_iso=false -- the whole Kdenlive stack is packages-only, kept out of linuxdoors.iso. ECM+CMake+Ninja, Qt6 from the deployed /opt/qt6-full, --libdir=lib for LinuxDoors' non-multiarch layout.

KDE Frameworks 6 (6.29.0) / Kdenlive dependency. Not in BLFS as its own page. ship_in_iso=false -- the whole Kdenlive stack is packages-only, kept out of linuxdoors.iso. ECM+CMake+Ninja, Qt6 from the deployed /opt/qt6-full, --libdir=lib for LinuxDoors' non-multiarch layout.

Not in BLFS -- header-only package defining the SPICE wire protocol (structs/constants), real upstream from gitlab.freedesktop.org/spice/spice-protocol, tag v0.14.5 (satisfies spice-vdagent's own configure.ac requirement of >= 0.14.3). Added specifically as a build-time dependency for packages/spice-vdagent -- see that package's notes for why (host<->guest clipboard sharing was completely missing for the LinuxDoors test VM, a real, user-reported gap: 'the copy and paste doesn't work from host to vm guest'). Plain meson build, no other dependencies.

Not in BLFS -- user-reported real gap: 'the copy and paste doesn't work from host to vm guest'. The libvirt domain's QEMU side already had the required SPICE virtio-serial channel configured (confirmed via `virsh dumpxml`: a <channel type='spicevmc'> targeting com.redhat.spice.0), but the GUEST had no spice-vdagent installed at all -- clipboard sync, auto display-resize, and file-transfer between a SPICE client (virt-viewer/remote-viewer) and the guest all require this daemon on the guest side; the host-side channel alone does nothing without it. Real upstream from gitlab.freedesktop.org/spice/linux/vd_agent, tag spice-vdagent-0.23.0, autotools build. Every real dependency in its configure.ac (gtk+-3.0, gio-unix-2.0, xfixes/xrandr/xinerama/x11, alsa, dbus-1, libdrm, glib-2.0 -- confirmed via `pkg-config --exists` against the real $LFS) was already satisfied by this project's existing X11/XFCE stack, except spice-protocol (header-only, see packages/spice-protocol), which was added alongside this package. --with-session-info=systemd forces the systemd/logind session-detection path explicitly (configure.ac's 'auto' default tries ConsoleKit too, a legacy session manager this project has never built and never will, since it uses systemd-logind throughout). Two components: `spice-vdagentd` (root, the actual virtio-serial-port daemon) and `spice-vdagent` (per-X-session clipboard/resize agent). Enablement needs NO systemctl enable at all -- confirmed by reading data/70-spice-vdagentd.rules and the shipped .service/.socket files (neither has an [Install] section): the udev rule matches on the com.redhat.spice.0 virtio-serial device node appearing and sets SYSTEMD_WANTS=spice-vdagentd.socket, so socket-activation happens automatically and device-triggered whenever that channel exists, exactly the existing QEMU channel this project's LinuxDoors test domain already has. The per-session spice-vdagent (clipboard agent) autostarts via data/spice-vdagent.desktop, which Makefile.am installs straight into $(sysconfdir)/xdg/autostart -- i.e. /etc/xdg/autostart/spice-vdagent.desktop with --sysconfdir=/etc -- applying to every user automatically, no per-account autostart copy needed (unlike this project's own hand-written wallpaper/icon-style script, which predates knowing this convention existed). Real build bug hit and fixed: `src/vdagent/device-info.c`'s `parse_pci_address_from_sysfs_path()` does `char *pos = strstr(addr, "/pci");` where `addr` is `const char*` -- GCC 14 infers const through its strstr() builtin from the const argument and flags the assignment to non-const `char *pos` as `-Werror=discarded-qualifiers`, the exact same warnings-as-errors-on-old-code failure class already hit repeatedly in this project's NetSurf chain. Fixed with a targeted `perl -pi` patch adding an explicit `(char *)` cast (the standard idiomatic fix for this specific ISO-C strstr quirk), applied to the one real occurrence in the whole source tree (confirmed via grep -- not a blanket fix). Second real bug: the first successful build produced `spice-vdagent`/`spice-vdagentd` binaries and the XDG autostart .desktop, but silently skipped the systemd .service/.socket units, the udev rule, AND the tmpfiles.d config entirely -- `--with-session-info=systemd` only controls session detection; the actual unit/udev-rule installation is gated by a completely separate `--with-init-script=systemd` flag (confirmed via Makefile.am: all four are installed inside one `if INIT_SCRIPT_SYSTEMD` block). Fixed by adding `--with-init-script=systemd` explicitly.

LFS ch8. Skips the optional docs copy (sqlite-doc zip).

sshpass 1.10 -- a tiny non-interactive ssh-password helper (single main.c, plain autotools). Not in LFS/BLFS. Needed by packages/flashscp: FlashScp hands a machine's password to ssh via sshpass through the SSHPASS environment variable (never a command line), for hosts that want a password or key+password. The FlashScp AppImage carries its own copy; the installable package uses this system one. ship_in_iso=false -- pulled in only when flashscp (or another consumer) is installed.

BLFS. Provides libstartup-notification-1.so, used to give cursor feedback while apps launch. Recommended dep for libxfce4ui in the XFCE core chain.

Hand-authored, NOT upstream (Todd Miller) sudo -- a deliberately minimal LinuxDoors-specific reimplementation, user-requested ('a linuxdoors version of sudo that's simple as possible'). No sudoers file, no per-command policy, no auth-timestamp cache, no -u <user> (always root). Every real security decision is delegated to PAM: authorization is pam_wheel.so use_uid (only the wheel group can proceed), authentication is pam_unix.so checking the CALLING user's own password via getuid() (the actual difference from su, which asks for the target's password). Source is a single hand-written sudo.c, tarred locally (no real upstream URL -- source.url is a placeholder label, resolve_source never contacts it since the file is pre-placed in download/ and its sha256 already matches) -- same 'local, hand-authored asset treated as a pinned source' pattern already used for LinuxUltraOffice's branding-assets tarball. Installs setuid-root (mode 4755, owner root:root) to /usr/bin/sudo -- deliberately /usr/bin, not /usr/local/bin, matching universal sudo muscle memory and sidestepping the same 'not on PATH for every su invocation style' issue hit and fixed for the pkg CLI. Requires a new 'wheel' group to exist and /etc/pam.d/sudo to be written (both done in scripts/lfs_system_config.sh, not here -- this package only builds and installs the binary itself). Scope explicitly confirmed with the user: standalone tool for terminal use (pkg update/upgrade etc.) -- does NOT replace how the installer/Package Manager/Manage SSH LinuxDoors currently prompt for root's password directly; that stays a separate, larger follow-up if ever wanted.

SWIG 4.3.1 -- interface compiler that generates the Python bindings (_openshot.so + openshot.py) for libopenshot, which OpenShot's Qt GUI imports. Not in BLFS's own index but a standard build (pre-bootstrapped SourceForge tarball, plain ./configure). Only real dep is pcre2 (already built). ship_in_iso=false: part of the OpenShot video-editing feature, packages-only, kept out of linuxdoors.iso.

KDE Frameworks 6 (6.29.0) module for the KDE Plasma chain. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

LFS ch8, the init system this whole distro is built around. Skips the optional test suite (needs /etc/os-release + unshare -m, awkward inside our automated non-interactive build). KNOWN GAP: skips `systemd-machine-id-setup` and `systemctl preset-all` -- both need a live running system (a real PID 1, real /etc), not available mid-build inside a chroot -- these run in lfs_system_config.sh instead. Rebuilt for BLFS PAM support (pam=enabled, pamconfdir=/etc/pam.d) -- this is what actually provides pam_systemd.so and systemd-logind session registration, needed for lightdm to hand off a real desktop session. IMPORTANT: strips etc/os-release|hostname|machine-id|hosts from its own destdir before capture -- ninja install can recreate these as defaults in a fresh DESTDIR, and rsync capture would otherwise overwrite lfs_system_config.sh's branding/hostname/machine-id on every rebuild. depends stays jinja2 (its original ch8 anchor); changing it to shadow would create a manifest cycle through the blfs-desktop chain (systemd->dbus->...->gtk3->linux-pam->shadow->systemd). The real rebuild order (linux-pam, then shadow, then this) is enforced by calling `cli build` on each name separately, in that sequence. Bumped 261.2 -> 261.3 (real sha256 computed from the downloaded GitHub source tarball, replacing a long-standing PLACEHOLDER that was never actually verified even at 261.2). The LFS book itself (systemd/chapter08/systemd.html) still tracks 261.2 as of this bump -- confirmed no systemd-man-pages-261.3.tar.xz exists on LFS's own mirror (404), so the man-pages extra_source stays pinned at the 261.2 tarball (also fixed from a PLACEHOLDER sha256 to a real one, computed here for the first time) -- man pages don't meaningfully change for a single point release, and LFS's own convention is one man-pages tarball per systemd feature series, not per patch release. Bumped 261.3 -> 262 (2026-10-10, LFS r13.1-21, md5s match the book). Now built with --libdir=lib: 261.3 on .101 had installed into the Debian multiarch dir, where pam_systemd.so was never loaded by PAM (/usr/lib/security).

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work. || 6.7.4 -> 6.7.5 (2026-09-14 real upstream-currency bump, real sha256 computed -- no published checksum from KDE's release-service, only a detached .asc signature, so archive integrity was verified with `xz -t` first, same approach as kdenlive/mesa). 2026-10-10: rebuilt as 6.7.5-1 against Qt 6.12.0 (links Qt private API, which is only guaranteed within one Qt minor release).

LFS ch8, final native build. FORCE_UNSAFE_CONFIGURE=1 needed since we always build as root. Skips the optional test suite.