Packages

Fast math expression parser. Needed by lxqt-panel (sensors/expr) and lxqt-runner. LXQt 2.4 minimal-but-real desktop stack, ship_in_iso=false (Packages-page / Package Manager install only, like KDE Plasma). Built on .101 against /opt/qt6-full + KF6 6.29. cmake/meson --libdir=lib for LinuxDoors' non-multiarch layout.

Mutter -- GNOME Shell's Wayland compositor + window manager. Built without screencast/remote-desktop (no pipewire) and without colord. ship_in_iso=false -- GNOME Shell is a Packages-page / Package Manager install, kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing rustc/llvm/p11-kit/librsvg/gi/glib2/pango/cairo stack; only the GNOME-specific libraries are new packages. || 48.5 -> 48.8 (2026-09-14 real upstream-currency bump, real sha256 computed from the downloaded tarball, archive integrity verified before trusting it). || Bumped 48.8 -> 51.0 (2026-09-18, part of the GNOME 51 push). Real sha256 verified against GNOME's own published sha256sum file.

BLFS general/mypaint-brushes.html -- the default brush-preset data files GIMP's brush engine (libmypaint) ships with. Required by GIMP 3.2.4 directly. Pure data package (installs to /usr/share/mypaint-data), no test suite.

BLFS general/nasm.html. Recommended by Firefox for its bundled dav1d/libvpx/libaom codec assembly routines.

LFS ch8, final native build. Simplified from the book's DESTDIR=$PWD/dest + cp -av dest/* / two-step dance -- our engine's own $PKG_DESTDIR + rsync capture already does the equivalent merge, so the curses.h sed fix applies directly to $PKG_DESTDIR. Skips optional docs copy.

LFS ch6 temporary tools stage. Also directly installs a host-native `tic` binary into $LFS/tools/bin (bootstrap-only, not captured/zipped) before cross-compiling the real library.

Cinnamon file manager + desktop-icon handler (fork of Nautilus). 6.6.x. Linux Mint upstream, branch 6.6-maintenance @ commit 8d23a398a2fd (GitHub branch snapshot -- Mint doesn't publish release tarballs; SHA recorded for reproducibility). Cinnamon 6.4 line pairs with this project's mozjs 128 via cjs 128.1. ship_in_iso=false (Packages page / Package Manager only, like KDE Plasma & LXQt). Built on .101, meson --libdir=lib for the non-multiarch layout.

NetSurf project (not BLFS/LFS) -- user-requested lightweight browser, chosen specifically because it avoids Rust (no WebKitGTK, no Firefox/Chromium) while still being a real, actively-maintained browser. TARGET=gtk NETSURF_GTK_MAJOR=3 (the frontend directory is literally 'gtk', not 'gtk3' -- GTK2 vs GTK3 is a NETSURF_GTK_MAJOR switch within it, confirmed from the real frontends/ directory listing). SVG rendering uses the bundled libsvgtiny (already built) instead of librsvg -- NETSURF_USE_RSVG defaults to AUTO and librsvg isn't present, so it's skipped automatically, no explicit disable needed. JS engine is duktape, vendored directly in netsurf's own source tree (content/handlers/javascript/duktape/), no separate build. Depends on nsgenbind (a build-time code generator, needs to be on PATH) plus the whole NetSurf library chain (libwapcaplet through libdom) and curl/GTK3 from earlier in the manifest.

BLFS postlfs/nettle.html (low-level crypto library). Part of the real GnuTLS chain -- see packages/libunistring/metadata.json for why this chain exists. GnuTLS's own required dependency. Skips the test suite and PDF/HTML doc install.

Extra (BLFS basicnet page), user-requested classic net tools alongside iproute2. Followed the book's install step verbatim, which deletes {nis,yp}domainname/hostname/dnsdomainname/domainname (already provided by inetutils) AND ifconfig itself + its man page (BLFS considers it superseded by iproute2's `ip`) -- so the shipped binaries are netstat/route/arp/plipconfig/mii-tool/iptunnel/ipmaddr/slattach, not ifconfig. Confirmed via a direct re-fetch of the live BLFS page since this seemed surprising at first.

LFS ch8. Python bootstrap script, not autotools. Skips the optional NINJAJOBS sed patch.

BLFS general/nodejs.html. Required by Firefox's build system. Book also recommends --shared-brotli/--shared-cares/--shared-libuv/--shared-nghttp2, but those 4 libraries weren't built separately for this project (scope call to avoid ballooning the already-large Rust/Firefox chain further) -- node vendors/builds its own bundled copies of those 4 instead, which is the documented fallback when the flag is simply omitted. --shared-openssl/--shared-zlib/--shared-simdutf and --with-intl=system-icu ARE used since those 4 are already built. 2026-10-10: rebuilt as 24.21.0-1 against simdutf 9.2.1 (libsimdutf.so.34 -> .so.36).

Not BLFS/LFS -- NetSurf isn't in either book, this whole dependency chain (through 'netsurf' itself) is hand-verified against the project's own release tarballs and README docs. Shared Makefile infrastructure every other NetSurf-project library/nsgenbind/netsurf itself builds against, installed to $PREFIX/share/netsurf-buildsystem (confirmed from its own Makefile, supports DESTDIR natively). All sibling packages reference it via NSSHARED=/usr/share/netsurf-buildsystem rather than relying on PREFIX matching (the more fragile of the two documented options).

NetSurf project (not BLFS/LFS). Build-time code generator (turns WebIDL-ish DSL bindings into C) needed by netsurf's own build for the duktape JS bindings. Uses flex/bison, both already built.

BLFS general/nspr.html. Required by NSS, which is recommended by Firefox. Tarball actually expands to 'nspr-4.40/nspr/' (a versioned top-level dir containing the real 'nspr' source dir), not a bare top-level 'nspr' -- an earlier draft of this build.sh assumed the latter and failed with 'cd: nspr: No such file or directory'; fixed to 'cd nspr-*/nspr'.

BLFS postlfs/nss.html. Recommended by Firefox (system NSS instead of Firefox vendoring/building its own copy in-tree). Own hand-rolled make-based build (not autotools/cmake) -- installs straight from dist/Linux*/... via `install`, not `make install`, so build.sh stages those installs into $PKG_DESTDIR manually rather than using a DESTDIR make var. Tarball expands to 'nss-3.126/nss/' (same versioned-parent-dir pattern as nspr) -- an earlier draft applied the patch from $SRC_DIR directly (missing the initial 'cd nss-*/'), so '../nss-standalone-1.patch' pointed outside $SRC_DIR entirely and failed with 'No such file or directory'. || 3.126 -> 3.129 (2026-09-14): real, forced bump -- Firefox 155.0.1's configure hard-requires 'nss >= 3.127' and refused to build against 3.126.0. Went straight to 3.129 (the newest release, and what BLFS's own live postlfs/nss.html page already documents) rather than the bare minimum 3.127, for headroom against the next Firefox bump too. NSS 3.129's own release notes state it needs NSPR >= 4.39; this project's nspr is already 4.40, so no nspr bump was needed. Both the source tarball and the nss-standalone-1.patch (unchanged filename/URL, refetched and its real sha256 filled in for the first time -- both were PLACEHOLDER before this) verified against BLFS's current live book page before use. build.sh needed zero changes (globs nss-*.tar.gz / cd nss-*/).

nxagent -- the X2Go Agent X server (a forked, headless X.Org that speaks the NX compression protocol). This is the one piece of the x2go server stack NOT built from source here: nx-libs is a large forked-X-server C codebase (essentially a mini-Xorg, multi-hour build) and the user's explicit choice was a hybrid -- build x2goserver from source, capture nx-libs from Debian. So build.sh just fetches the real Debian trixie nx-libs binary .debs (nxagent + libNX_X11 + libXcomp + libXcompshad + nx-x11-common data), extracts each package's data.tar.* straight into $PKG_DESTDIR, and adds the /usr/lib/x86_64-linux-gnu/nx/bin/ symlink farm that Debian's separate x2goserver-x2goagent package normally provides (packages/x2goserver builds x2goserver-x2goagent from source and expects nxagent to already be findable under that nx/ prefix). Same best-effort caveat as engine/debian_fetch.py: LinuxDoors has its own glibc baseline, but this exact nxagent 3.5.99.27-2 binary was confirmed running on a real LinuxDoors install (70.20.232.101) via the deb bridge before this package existed. ship_in_iso=false -- only pulled in when someone installs packages/x2goserver. libxcompext3 is deliberately NOT fetched: nxagent's ldd on the real install links only libXcomp.so.3 / libXcompshad.so.3 / libNX_X11.so.6, not libXcompext.

nxproxy -- the CLIENT-side half of the NX protocol (nxagent, captured by packages/nx-libs, is the SERVER-side half). x2goclient spawns a local nxproxy process for every session type -- confirmed the hard way: ONMainWindow::runCommand() (which leads into SlotRunCommand(), the callback that actually starts the chosen desktop session on the server) is only ever called from slotProxyStderr(), a slot watching the LOCAL nxproxy QProcess's stderr for a specific 'session established' marker string. Without nxproxy on the client machine, that QProcess never produces the marker, slotProxyStderr() never fires, runCommand() never runs, and the session sits at 'Status: connecting' forever -- for EVERY session type, not just LinuxDoors' own new GNOME 51 (VNC) one (real bug found and confirmed live on a real connection attempt from packages/x2goclient-gnome51vnc, 2026-09-19). Same Debian-binary-capture pattern as packages/nx-libs (same exact upstream version, 3.5.99.27-2, confirmed present in the same deb.debian.org/debian/pool/main/n/nx-libs/ directory) -- build.sh just extracts the .deb's data.tar.* into $PKG_DESTDIR. Only real dependency is libXcomp.so.3, already provided by packages/nx-libs (confirmed via ldd -- libjpeg/libpng16/libz/libstdc++/libm/libgcc_s are all otherwise-already-present standard libs). depends on nx-libs so the engine builds/deploys that first.

Qt6 Openbox configuration tool (theme, mouse, desktops, dock). LXQt 2.4 minimal-but-real desktop stack, ship_in_iso=false (Packages-page / Package Manager install only, like KDE Plasma). Built on .101 against /opt/qt6-full + KF6 6.29. cmake/meson --libdir=lib for LinuxDoors' non-multiarch layout.

The default LXQt window manager. Last upstream release (2015); plain X11, no XI2/compositing -- a good x2go fit, unlike Mutter/Muffin. LXQt 2.4 minimal-but-real desktop stack, ship_in_iso=false (Packages-page / Package Manager install only, like KDE Plasma). Built on .101 against /opt/qt6-full + KF6 6.29. cmake/meson --libdir=lib for LinuxDoors' non-multiarch layout.

BLFS general/openjpeg2.html (JPEG 2000 codec). Added as a fourth real hard-required poppler dependency -- BLFS lists it as merely 'Recommended' for poppler, but a real 'Could NOT find openjpeg2' CMake configure failure showed poppler's own CMakeLists.txt has no disable flag for it (unlike Qt5/Qt6/GPGME/Boost, which each had a real ENABLE_* option). Simplest fix was to just build it -- it's small and standalone with no heavy sub-dependencies.

OpenShot 4.0.0 (openshot-qt) -- the Qt6/PySide6 video-editor GUI on top of libopenshot 1.0.0. Released 2026-08-30. Pure-Python app: `python3 setup.py install` lays down the openshot_qt module, the /usr/bin/openshot-qt launcher, xdg .desktop/appdata/icons/mime. Runtime Python deps: PySide6 (already built), openshot (the SWIG module from libopenshot), requests+certifi (already in $LFS), plus pyzmq / markdown / defusedxml / Pillow pip-installed into the destdir at build time (manylinux wheels -- pyzmq's bundles its own libzmq). 4.0.0 has a redesigned NATIVE Qt timeline, so no QtWebEngine is needed. AI Object-Mask/Detection features are absent (libopenshot built without OpenCV). ship_in_iso=false: video-editing feature, packages-only, kept out of linuxdoors.iso per user direction.

Extra (BLFS), not core LFS. OpenSSH's single portable tarball builds BOTH the client (ssh/scp) and server (sshd) together via one `make install` -- there's no separate 'openssh-server' upstream, that split is a Debian/Ubuntu packaging convention. Ships and enables a hand-written sshd.service (the book's own BLFS instructions referenced a nonexistent `make install-sshd` target -- that command was dropped after failing against the real Makefile). The unit runs `ssh-keygen -A` before every start, which only generates host keys that don't already exist, so real unique host keys appear automatically on first real boot rather than being baked into the build. The sshd system user/group is created live in the chroot's real /etc/passwd (already exists from ch7 prep; not portable through $PKG_DESTDIR since it's a real live-system mutation, same category as shadow/systemd's known gaps). sshd_config is left at its shipped default (root login not disabled) since no password/user account exists yet to log in with otherwise -- revisit once real credentials exist. 2026-10-10 10.6p1-1: helpers in versioned /usr/libexec/openssh-<ver>/ so `pkg upgrade` cannot break a running sshd; sshd_config shipped as sshd_config.ldpkg-default; no boot-enable link in the package.