Packages

LFS ch8. Skips the optional docs tarball/install and the optional test suite.

tecla -- small GNOME library for displaying keyboard shortcuts (used by gnome-control-center's keyboard panel, which is a required 'dependent panel', not optional). Added because gnome-control-center 48.7's meson build failed with 'Run-time dependency tecla found: NO' and no git available to fetch its wrap. Not in BLFS -- real upstream source from download.gnome.org, version 48.0.2 matching this project's GNOME 48 track. Plain meson, no non-obvious build steps. || Bumped 48.0.2 -> 51.0 (2026-09-18, part of the GNOME 51 push). Real sha256 verified against GNOME's own published sha256sum file.

LFS ch8, final native build (ch7's texinfo-tmp was a bootstrap version). Skips the optional test suite and the optional TeX install.

LFS ch7, inside the chroot. Superseded by chapter 8's full texinfo build.

KDE Frameworks 6 (6.29.0) / Kdenlive dependency. Not in BLFS as its own page. ship_in_iso=false -- the whole Kdenlive stack is packages-only, kept out of linuxdoors.iso. ECM+CMake+Ninja, Qt6 from the deployed /opt/qt6-full, --libdir=lib for LinuxDoors' non-multiarch layout.

BLFS XFCE. The file manager. libgudev/Gvfs/libexif/tumbler optional deps skipped (no remote/automount/thumbnail support, still a real functioning local file manager). No test suite.

BLFS general/tiff.html. Second package in the GIMP dependency chain (GIMP 3.2.4 requires libtiff directly). CMake+Ninja build per the book's own current instructions (this package switched off autotools upstream). Skips the test suite and the book's own `mv /usr/share/doc/tiff{,-4.7.2}` versioned-doc-dir rename (cosmetic, not done for any other package in this project either).

TPM2 Software Stack (tpm2-tss) -- another genuinely new package, needed because gnome-remote-desktop 51.0's meson.build calls dependency('tss2-esys') unconditionally (used for hardware-TPM-backed secure storage of the VNC/RDP session's own credentials/keys), same as krb5. Built into the SHARED /usr prefix, not isolated -- nothing else in this project uses tpm2-tss, so no collision risk, and a shared install means any future package wanting real TPM support can reuse it. Real deps (openssl/json-c/libcap/autoconf-archive/curl) all already present in this project. Only a detached GPG signature published on the GitHub release, no plain checksum file -- archive integrity verified with gzip -t before trusting the computed sha256, same fallback approach already used elsewhere in this project (Mesa, Kdenlive, krb5).

Extra, not in LFS or BLFS -- Ubuntu's iptables frontend, built from its own upstream (launchpad) release via `python3 setup.py install --root=`, which maps directly onto our $PKG_DESTDIR convention. KNOWN GAP: not integrated into boot (README suggests /lib/ufw/ufw-init start via an init script or systemd unit) -- ufw is installed but not enabled/started automatically; that's a future system-configuration task.

Real, ungoogled Chromium build -- explicit user preference over stock Chromium/Chrome ('a version without all the telemetry and analytics'), built with our own from-source Clang (packages/clang-chromium) instead of Google's prebuilt binary ('i prefer not to use google's binary at this time'). Follows ungoogled-chromium's own real, documented GENERIC build path (docs/building.md inside the ungoogled-chromium source tarball itself, verified directly -- not guessed): the ungoogled-chromium repo is the cross-platform core (patches/, flags.gn, downloads.ini, pruning.list, domain_substitution.list, and the utils/ scripts), NOT a platform-specific overlay like ungoogled-chromium-linux/-debian -- this project intentionally uses the generic path since it's not Debian/Arch/etc. downloads.ini has exactly ONE real entry (the official chromium-151.0.7922.137-lite.tar.xz from Google's own commondatastorage.googleapis.com, real sha256 confirmed against Google's own published .hashes file) which is fetched as extra_sources here rather than via utils/downloads.py's own network retrieve step, since we already have it pinned and verified. Six real build stages, all straight from ungoogled-chromium's own docs/building.md: unpack chromium source (stripping the leading dir, equivalent to downloads.py's own unpack step) -> utils/prune_binaries.py -> utils/patches.py apply -> utils/domain_substitution.py apply -> bootstrap GN (tools/gn/bootstrap/bootstrap.py, built with the system's plain GCC since GN itself is a small standalone tool, not part of the browser binary that needs to match Chromium's own toolchain) -> gn gen + ninja. GN args = flags.gn (ungoogled's own real defaults: disables Safe Browsing/telemetry/PGO/Widevine-reporting/field-trial-testing-config, blanks Google API keys) plus this project's own additions for a from-scratch, no-depot_tools, no-bundled-sysroot Linux build: clang_base_path=/opt/clang-chromium (points at our own compiler, the real documented mechanism per Chromium's own docs/clang.md), use_lld=true (uses the lld we specifically built alongside clang for this exact RAM-constrained-VM reason), use_sysroot=false (no bundled sysroot download available/wanted -- use this project's own already-built system libraries), is_component_build=true + symbol_level=0 + blink_symbol_level=0 (real, standard RAM/link-time mitigations for a build machine at Chromium's documented minimum RAM, on top of the 15GB swap already configured), ozone_platform=x11 + ozone_platform_x11=true + ozone_platform_wayland=false (this project has no Wayland compositor, X11/Xorg only), enable_nacl=false, is_official_build=false (skips the much heavier LTO+PGO pipeline, which chrome_pgo_phase=0 in flags.gn already partly disables anyway). `gn gen --fail-on-unused-args` is used exactly as ungoogled-chromium's own docs specify -- a real safety net: any wrong/misspelled GN flag added here fails fast and clearly rather than silently being ignored. Given the sheer scale of a real Chromium build, this is expected to need iterative real-failure-driven fixes (same discipline as every other package in this project), not a guaranteed single-shot success. Bumped 151.0.7922.137-1 -> 151.0.7922.169-1 as a real, user-requested security rebase: Google's own Chromium 151.0.7922.169 fixes two Critical sandbox-escape RCEs (CVE-2026-76034, a WebGL heap buffer overflow; CVE-2026-76036, a Dawn/WebGPU buffer overflow) plus a High CORS issue (CVE-2026-76033) and ~12 more unnamed fixes, but ungoogled-chromium upstream's own newest tag was still 137-1 at the time -- Google embargoes the actual fix commits/diffs for sandbox-escape RCEs until adoption is high (standard responsible-disclosure practice), so a surgical single-CVE patch wasn't possible; only the full 169 source tree (which has the fixes compiled in) is public. This is a real, hand-verified rebase, not a blind version bump: the extra_sources chromium-lite tarball is the only thing that changed to 169 -- the ungoogled-chromium

upower 1.90.9 (meson, from the GitLab tag archive) -- power/battery daemon. gnome-settings-daemon's power plugin needs it. ship_in_iso=false, built on .101.

LFS ch8, final build (ch7's util-linux-tmp was a minimal bootstrap version). Skips the optional test suite (also needs /etc/fstab and a non-root tester user).

LFS ch7, inside the chroot, last package before chapter 8 starts. Minimal build (many features disabled since their dependencies aren't available yet). Superseded by chapter 8's full util-linux build.

BLFS, first X11 core package. Sets XORG_PREFIX=/usr and XORG_CONFIG per BLFS's Xorg-7 intro page -- every subsequent X11 package's build.sh re-exports these two vars itself since each build.sh runs in a fresh environment.

Vala compiler (valac) -- 0.56 LTS. Bootstraps from the pre-generated C shipped in the release tarball, so it builds with just a C compiler + glib (no existing valac needed). ship_in_iso=false -- prerequisite for Budgie Desktop (which is ~80% Vala), a Packages-page / Package Manager install kept off linuxdoors.iso. Built on .101 against the existing glib2/gobject-introspection stack.

LFS ch8. Skips the optional test suite (which also needs a non-root 'tester' user we don't set up for this). Bumped 9.2.0858 -> 9.2.1025 to track LFS 13.1's package set (sha256 from a real downloaded tarball).

BLFS. Terminal-emulator widget library required by xfce4-terminal. gtk4=false (GTK4 not built), gnutls/vapi off, icu=false (legacy-charset support, avoids needing to build all of ICU just for this). simdutf and fmt built as standalone packages since VTE's meson tries to git-clone them as wrap subprojects otherwise and we have no git. Removes the /etc/profile.d/vte.sh the book flags as leftover. 2026-10-10: rebuilt as 0.84.1-1 against simdutf 9.2.1 (libsimdutf.so.34 -> .so.36).

Vulkan-Headers -- Khronos Vulkan API headers. KWin 6.7 requires them to build its Vulkan backend (runtime falls back to GL without a driver). ship_in_iso=false.

Vulkan-Loader -- provides libvulkan.so.1. KWin links it (Vulkan_LIBRARY). ship_in_iso=false.

libwayland + wayland-scanner. Needed by KWin, plasma-workspace, layer-shell-qt, kwayland even for an X11 Plasma session (KWin 6's codebase is unified). ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work. || Bumped 1.24.0 -> 1.26.0 (2026-09-18) -- mutter 51.0 (built for the parallel GNOME 51/RDP stack) hard-requires wayland-server >= 1.26. Kept in the SHARED /usr prefix, not isolated -- wayland-server maintains strict ABI compatibility across the whole libwayland-server.so.0 series (upstream policy), confirmed the soname itself is version-computed (0.MINOR.PATCH) so this bump is safe for KDE Plasma/kwayland/layer-shell-qt, all of which already share this same package. Real sha256 verified against the real release tarball, not a git archive.

The standard Wayland protocol XML definitions. Trivial build (installs .xml + a pc file). ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

LFS ch8. Python package built as a wheel and pip-installed offline. Bumped 0.47.0 -> 0.48.0 to track LFS 13.1's package set (sha256 from a real downloaded tarball).

BLFS general/which.html. Required by Node.js's own configure/build tooling, first package in the Firefox chain (user's 'reopen Rust for real Firefox' direction).