Packages

BLFS general/nasm.html. Recommended by Firefox for its bundled dav1d/libvpx/libaom codec assembly routines.

LFS ch8, final native build. Simplified from the book's DESTDIR=$PWD/dest + cp -av dest/* / two-step dance -- our engine's own $PKG_DESTDIR + rsync capture already does the equivalent merge, so the curses.h sed fix applies directly to $PKG_DESTDIR. Skips optional docs copy.

LFS ch6 temporary tools stage. Also directly installs a host-native `tic` binary into $LFS/tools/bin (bootstrap-only, not captured/zipped) before cross-compiling the real library.

Cinnamon file manager + desktop-icon handler (fork of Nautilus). 6.6.x. Linux Mint upstream, branch 6.6-maintenance @ commit 8d23a398a2fd (GitHub branch snapshot -- Mint doesn't publish release tarballs; SHA recorded for reproducibility). Cinnamon 6.4 line pairs with this project's mozjs 128 via cjs 128.1. ship_in_iso=false (Packages page / Package Manager only, like KDE Plasma & LXQt). Built on .101, meson --libdir=lib for the non-multiarch layout.

NetSurf project (not BLFS/LFS) -- user-requested lightweight browser, chosen specifically because it avoids Rust (no WebKitGTK, no Firefox/Chromium) while still being a real, actively-maintained browser. TARGET=gtk NETSURF_GTK_MAJOR=3 (the frontend directory is literally 'gtk', not 'gtk3' -- GTK2 vs GTK3 is a NETSURF_GTK_MAJOR switch within it, confirmed from the real frontends/ directory listing). SVG rendering uses the bundled libsvgtiny (already built) instead of librsvg -- NETSURF_USE_RSVG defaults to AUTO and librsvg isn't present, so it's skipped automatically, no explicit disable needed. JS engine is duktape, vendored directly in netsurf's own source tree (content/handlers/javascript/duktape/), no separate build. Depends on nsgenbind (a build-time code generator, needs to be on PATH) plus the whole NetSurf library chain (libwapcaplet through libdom) and curl/GTK3 from earlier in the manifest.

BLFS postlfs/nettle.html (low-level crypto library). Part of the real GnuTLS chain -- see packages/libunistring/metadata.json for why this chain exists. GnuTLS's own required dependency. Skips the test suite and PDF/HTML doc install.

Extra (BLFS basicnet page), user-requested classic net tools alongside iproute2. Followed the book's install step verbatim, which deletes {nis,yp}domainname/hostname/dnsdomainname/domainname (already provided by inetutils) AND ifconfig itself + its man page (BLFS considers it superseded by iproute2's `ip`) -- so the shipped binaries are netstat/route/arp/plipconfig/mii-tool/iptunnel/ipmaddr/slattach, not ifconfig. Confirmed via a direct re-fetch of the live BLFS page since this seemed surprising at first.

LFS ch8. Python bootstrap script, not autotools. Skips the optional NINJAJOBS sed patch.

BLFS general/nodejs.html. Required by Firefox's build system. Book also recommends --shared-brotli/--shared-cares/--shared-libuv/--shared-nghttp2, but those 4 libraries weren't built separately for this project (scope call to avoid ballooning the already-large Rust/Firefox chain further) -- node vendors/builds its own bundled copies of those 4 instead, which is the documented fallback when the flag is simply omitted. --shared-openssl/--shared-zlib/--shared-simdutf and --with-intl=system-icu ARE used since those 4 are already built.

Not BLFS/LFS -- NetSurf isn't in either book, this whole dependency chain (through 'netsurf' itself) is hand-verified against the project's own release tarballs and README docs. Shared Makefile infrastructure every other NetSurf-project library/nsgenbind/netsurf itself builds against, installed to $PREFIX/share/netsurf-buildsystem (confirmed from its own Makefile, supports DESTDIR natively). All sibling packages reference it via NSSHARED=/usr/share/netsurf-buildsystem rather than relying on PREFIX matching (the more fragile of the two documented options).

NetSurf project (not BLFS/LFS). Build-time code generator (turns WebIDL-ish DSL bindings into C) needed by netsurf's own build for the duktape JS bindings. Uses flex/bison, both already built.

BLFS general/nspr.html. Required by NSS, which is recommended by Firefox. Tarball actually expands to 'nspr-4.40/nspr/' (a versioned top-level dir containing the real 'nspr' source dir), not a bare top-level 'nspr' -- an earlier draft of this build.sh assumed the latter and failed with 'cd: nspr: No such file or directory'; fixed to 'cd nspr-*/nspr'.

BLFS postlfs/nss.html. Recommended by Firefox (system NSS instead of Firefox vendoring/building its own copy in-tree). Own hand-rolled make-based build (not autotools/cmake) -- installs straight from dist/Linux*/... via `install`, not `make install`, so build.sh stages those installs into $PKG_DESTDIR manually rather than using a DESTDIR make var. Tarball expands to 'nss-3.126/nss/' (same versioned-parent-dir pattern as nspr) -- an earlier draft applied the patch from $SRC_DIR directly (missing the initial 'cd nss-*/'), so '../nss-standalone-1.patch' pointed outside $SRC_DIR entirely and failed with 'No such file or directory'.

nxagent -- the X2Go Agent X server (a forked, headless X.Org that speaks the NX compression protocol). This is the one piece of the x2go server stack NOT built from source here: nx-libs is a large forked-X-server C codebase (essentially a mini-Xorg, multi-hour build) and the user's explicit choice was a hybrid -- build x2goserver from source, capture nx-libs from Debian. So build.sh just fetches the real Debian trixie nx-libs binary .debs (nxagent + libNX_X11 + libXcomp + libXcompshad + nx-x11-common data), extracts each package's data.tar.* straight into $PKG_DESTDIR, and adds the /usr/lib/x86_64-linux-gnu/nx/bin/ symlink farm that Debian's separate x2goserver-x2goagent package normally provides (packages/x2goserver builds x2goserver-x2goagent from source and expects nxagent to already be findable under that nx/ prefix). Same best-effort caveat as engine/debian_fetch.py: LinuxDoors has its own glibc baseline, but this exact nxagent 3.5.99.27-2 binary was confirmed running on a real LinuxDoors install (70.20.232.101) via the deb bridge before this package existed. ship_in_iso=false -- only pulled in when someone installs packages/x2goserver. libxcompext3 is deliberately NOT fetched: nxagent's ldd on the real install links only libXcomp.so.3 / libXcompshad.so.3 / libNX_X11.so.6, not libXcompext.

Qt6 Openbox configuration tool (theme, mouse, desktops, dock). LXQt 2.4 minimal-but-real desktop stack, ship_in_iso=false (Packages-page / Package Manager install only, like KDE Plasma). Built on .101 against /opt/qt6-full + KF6 6.29. cmake/meson --libdir=lib for LinuxDoors' non-multiarch layout.

The default LXQt window manager. Last upstream release (2015); plain X11, no XI2/compositing -- a good x2go fit, unlike Mutter/Muffin. LXQt 2.4 minimal-but-real desktop stack, ship_in_iso=false (Packages-page / Package Manager install only, like KDE Plasma). Built on .101 against /opt/qt6-full + KF6 6.29. cmake/meson --libdir=lib for LinuxDoors' non-multiarch layout.

BLFS general/openjpeg2.html (JPEG 2000 codec). Added as a fourth real hard-required poppler dependency -- BLFS lists it as merely 'Recommended' for poppler, but a real 'Could NOT find openjpeg2' CMake configure failure showed poppler's own CMakeLists.txt has no disable flag for it (unlike Qt5/Qt6/GPGME/Boost, which each had a real ENABLE_* option). Simplest fix was to just build it -- it's small and standalone with no heavy sub-dependencies.

OpenShot 4.0.0 (openshot-qt) -- the Qt6/PySide6 video-editor GUI on top of libopenshot 1.0.0. Released 2026-08-30. Pure-Python app: `python3 setup.py install` lays down the openshot_qt module, the /usr/bin/openshot-qt launcher, xdg .desktop/appdata/icons/mime. Runtime Python deps: PySide6 (already built), openshot (the SWIG module from libopenshot), requests+certifi (already in $LFS), plus pyzmq / markdown / defusedxml / Pillow pip-installed into the destdir at build time (manylinux wheels -- pyzmq's bundles its own libzmq). 4.0.0 has a redesigned NATIVE Qt timeline, so no QtWebEngine is needed. AI Object-Mask/Detection features are absent (libopenshot built without OpenCV). ship_in_iso=false: video-editing feature, packages-only, kept out of linuxdoors.iso per user direction.

Extra (BLFS), not core LFS. OpenSSH's single portable tarball builds BOTH the client (ssh/scp) and server (sshd) together via one `make install` -- there's no separate 'openssh-server' upstream, that split is a Debian/Ubuntu packaging convention. Ships and enables a hand-written sshd.service (the book's own BLFS instructions referenced a nonexistent `make install-sshd` target -- that command was dropped after failing against the real Makefile). The unit runs `ssh-keygen -A` before every start, which only generates host keys that don't already exist, so real unique host keys appear automatically on first real boot rather than being baked into the build. The sshd system user/group is created live in the chroot's real /etc/passwd (already exists from ch7 prep; not portable through $PKG_DESTDIR since it's a real live-system mutation, same category as shadow/systemd's known gaps). sshd_config is left at its shipped default (root login not disabled) since no password/user account exists yet to log in with otherwise -- revisit once real credentials exist.

LFS ch8. Uses `./config` (not `./configure`). Skips the optional test suite (book notes one specific test, 30-test_afalg.t, can fail harmlessly without certain kernel crypto options) and the optional extra docs copy.

OpenTimelineIO 0.18.1 (C++ core only) -- required by Kdenlive 26.08 (find_package(OpenTimelineIO REQUIRED)) for OTIO timeline import/export. Not in BLFS. ship_in_iso=false (Kdenlive stack = packages only). CMake, C++ install only (OTIO_PYTHON_INSTALL=OFF, OTIO_CXX_INSTALL=ON, OTIO_FIND_IMATH=ON to use the system imath), --libdir=lib. Bundled rapidjson/any/optional-lite headers are used as-is.

BLFS multimedia/opus.html -- Opus audio codec, needed by ffmpeg (--enable-libopus) and used widely for web video. ship_in_iso=false (video-editing feature = packages only). Plain autotools.

BLFS postlfs/p11-kit.html (PKCS#11 module loader, used by GnuTLS for its trust store). Part of the real GnuTLS chain -- see packages/libunistring/metadata.json. Skips the book's own trust-extract-compat/update-ca-certificates hookup, which wires into make-ca -- this project has deliberately never built make-ca's own PKCS#11 trust-store machinery (already noted elsewhere in this project: curl uses --with-ca-bundle instead specifically to avoid that rabbit hole), and GIMP/glib-networking only need p11-kit's basic module-loading functionality to exist, not a populated system trust store.