Packages

pgAdmin 4 server-mode deployment (multi-user, login required) for LinuxDoors. Small package: a hand-written gunicorn-backed systemd service (pgadmin4-web.service) that runs packages/pgadmin4-server's Flask app in SERVER_MODE on 127.0.0.1:5050 as the `pgadmin` user, plus `pgadmin4-web-setup` (wraps web/setup.py to create the first admin account) and a drop-in nginx reverse-proxy snippet at /etc/nginx/conf.d/pgadmin4.conf.example (LinuxDoors ships no nginx by default -- the file is an example to copy if nginx is added later; the systemd service alone is enough for localhost/LAN use). gunicorn + gevent are pip-installed into pgadmin4-server's existing venv during this build. depends pgadmin4-server. ship_in_iso=false. NOT needed by pgadmin4-desktop (that runs its own private in-process server).

BLFS. Needed by cairo. Skips the optional test suite.

LFS ch8. Uses a temporarily-extracted meson (not the real system-wide 'meson' package, built much later in the real order) to avoid a circular dependency, per the book. Skips the optional ninja test.

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

KDE's own extra Wayland protocol definitions (used by KWin/kwayland). ECM+CMake, XML only. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

Not in BLFS -- MATE's text editor (a fork of gedit 2.30), real upstream release tarball from github.com/mate-desktop/pluma (ships a pre-generated `configure`, no autogen.sh/git-submodules needed, verified by extracting and checking for the file directly). Chosen by the user specifically as a real end-to-end verification case for the new LinuxDoors package-manager/source-build feature (install via precompiled zip, uninstall, install via the source-build path, uninstall, reinstall). Real dependency chain confirmed via configure.ac -- gtk+-3.0/gtksourceview-4/glib2/libxml2/gio2 already present, but two hard requirements were genuinely missing from this project's stack until now: mate-desktop-2.0 (see packages/mate-desktop, itself needing packages/dconf) and libpeas-1.0/libpeas-gtk-1.0 (see packages/libpeas, pluma's plugin engine). Plain autotools build, mostly no special flags needed -- introspection/python are auto-detected optional features in pluma's own configure.ac. Real build bug: enchant (spell-check) is the one exception -- its PKG_CHECK_MODULES is conditional, but configure then hard-errors ('Enchant library not found or too old') unless `--disable-spell` is explicitly passed; this project has never built enchant. Fixed with `--disable-spell`. Second real build bug, two-layered: pluma's plugin-engine glue code (`pluma-plugins-engine.c`) unconditionally `#include <girepository.h>` regardless of pluma's own `--enable-introspection` flag (tried `--enable-introspection=no` first -- still failed, since libpeas's own `.pc` file doesn't propagate `girepository.h`'s include path into its CFLAGS even though libpeas's C API needs it; disabling introspection just meant pluma's build stopped adding gobject-introspection's CFLAGS itself, but the source still needed the header). Real fix: leave pluma's introspection auto-detected (default) and instead fix the actual root cause -- `packages/gtksourceview4` was built with `gir=false` (predating gobject-introspection existing in this project, the same silent-skip class already hit for gdk-pixbuf/harfbuzz/at-spi2-core), so `GtkSource-4.gir` never existed for pluma's own .gir generation to include. Rebuilt gtksourceview4 with `gir=true` instead.

Real, user-reported bug fix: XFCE's logout dialog and lightdm's greeter both greyed out Restart/Shutdown. Root cause confirmed directly on a live installed system, not guessed: `busctl call org.freedesktop.login1 ... CanReboot` returned 'Access denied' -- systemd-logind (confirmed via `strings` on the built systemd-logind binary: bus_verify_polkit_async_full/logind-polkit.c are compiled in) tries to consult polkit for every privileged action, but polkitd was never built anywhere in this project's history. The action policy systemd itself ships (/usr/share/polkit-1/actions/org.freedesktop.login1.policy) already defaults org.freedesktop.login1.power-off/reboot/etc to <allow_active>yes</allow_active> -- an active local session should be auto-granted, no password needed -- but with no polkitd running to read and enforce that policy, logind has nothing to ask and fails closed. User explicitly chose 'build real polkit' over the lighter alternative (rebuilding systemd with -Dpolkit=disabled, which would fall back to logind's own simpler built-in active-session heuristic) since real polkit is the standard mechanism and will be needed for other future desktop permission checks too. No LFS/BLFS book page exists for this (neither project covers it) -- built directly from polkit's own real upstream source (github.com/polkit-org/polkit tag 127, the current freedesktop.org/GitLab project's own GitHub mirror, GitLab itself blocks automated fetches via its Anubis anti-bot check), version confirmed as the actual latest release, real sha256 computed directly, not a placeholder. Depends on packages/duktape (modern polkit >=~121 dropped mozjs entirely in favor of duktape >=2.2.0 for its .rules JS engine, confirmed directly from polkit's own meson.build dependency() call) and linux-pam (authfw=pam). Configured with -Dos_type=lfs (a REAL supported choice in polkit's own meson_options.txt, not guessed) -- with os_type=lfs, polkit's default pam_include resolution correctly references system-auth/system-account/system-password/system-session, which this project's existing BLFS PAM chapter work already installs (confirmed live: /etc/pam.d/system-auth etc. already exist and are used by /etc/pam.d/login the same way), so no new PAM indirection file needed. -Dprivileged_group=root overrides the meson default fallback of 'wheel' (a group this project doesn't have) -- harmless for this fix specifically (shutdown/reboot authorization uses the allow_active path, which needs no group membership at all), but avoids leaving a dangling group reference for any future auth_admin-requiring action. -Dpolkitd_user=polkitd needs a new system user (created in build.sh, same guarded useradd -r pattern as sshd/messagebus/lp elsewhere in this project). Enablement needs no systemctl enable at all -- confirmed directly from polkit's own data/org.freedesktop.PolicyKit1.service.in: it's a real D-Bus system-bus-activated service (SystemdService=polkit.service), so systemd starts polkit.service on demand the first time anything calls org.freedesktop.PolicyKit1, exactly matching the socket/device-activation pattern this project's own cups.socket already uses.

polkit-qt6-1 -- Qt6 bindings for PolicyKit. Needed by kauth's polkit backend, kde-cli-tools (kdesu), powerdevil, systemsettings kcms. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

BLFS general/poppler.html (PDF rendering library). Required by GIMP 3.2.4 directly (for opening/importing PDFs). ENABLE_QT5=OFF per the book, plus a second real fix beyond the book: this poppler release also has a separate ENABLE_QT6 (default ON, poppler added Qt6 bindings alongside/instead of Qt5) that ENABLE_QT5=OFF alone doesn't cover -- caught by a second real 'Could not find Qt6Core' CMake failure after the first fix, fixed with ENABLE_QT6=OFF too (this project has no Qt at all, 5 or 6). Every 'recommended' dependency the book lists (Cairo, lcms2, libjpeg-turbo, libpng, tiff) is already built in this project and gets auto-detected by cmake, so no extra flags are needed to enable them. Real build failure hit and fixed: gpgmepp (GPG-signature verification for signed PDFs) is gated behind ENABLE_GPGME, which defaults ON and hard-fails configure via CMake's own find_soft_mandatory_package() if gpgmepp isn't present -- added ENABLE_GPGME=OFF since PDF signature verification isn't needed for GIMP's plain import/render use case. nss and OpenJPEG remain skipped (genuinely optional -- auto-detected if present, not required). Boost turned out to be a third real hard-fail (ENABLE_BOOST defaults ON, only for optional Splash-backend performance per its own CMake option description) -- fixed with ENABLE_BOOST=OFF after a third real 'Could NOT find Boost' failure.

BLFS general/poppler-data.html -- CJK/Cyrillic encoding tables for poppler. Data-only package (no compilation, just `make install`), ships its own poppler-data.pc so GIMP's meson.build can pkg-config-check for it (dependency('poppler-data')) -- a real, non-optional check even though the data itself is functionally optional for plain Latin-text PDFs. Caught by a real 'Dependency poppler-data not found' failure.

PostgreSQL 18.6 built from the official source tarball (BLFS server/postgresql.html recipe, adapted for destdir + LinuxDoors), NOT the Debian/PGDG .deb -- user's explicit choice, since a source build links LinuxDoors' own openssl 4.x / icu 78 / readline 8.3 / zlib / lz4 / zstd / libxml2 and carries none of Debian's postgresql-common/pg_wrapper/debconf machinery. ship_in_iso=false. Data dir convention: PGDATA=/var/lib/postgresql/data (version-agnostic; not BLFS's /srv/pgsql/data and not Debian's per-cluster /var/lib/postgresql/<ver>/main). Creates the `postgres` user/group (uid/gid 41) directly in build.sh, guarded idempotently -- same pattern as packages/cups (lp) and packages/openssh (sshd). Hand-written postgresql.service (no verified blfs-systemd-units source) with an ExecStartPre that runs `initdb` on first start if $PGDATA/PG_VERSION is absent -- same first-run-init idea as openssh's sshd.service ssh-keygen -A. --with-perl/--with-python/--with-tcl included for PL/PerlU / PL/Python3U / PL/Tcl; if any fails at configure (LFS perl/python shared-lib layout), drop that one flag and rebuild. --with-llvm (JIT) deliberately omitted for the first build -- LinuxDoors' LLVM is 22 and PG JIT is finicky across LLVM majors; can be added later. --with-liburing (PG18 async I/O) omitted -- no liburing package.

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

Not in BLFS -- user explicitly asked for real 'preloading libraries' to speed up app launch time, so this is the actual open-source adaptive readahead daemon named 'preload' (the same one Ubuntu/Debian have historically shipped as an optional package), not a hand-rolled equivalent. The original upstream (Behdad Esfahbod's preload.sf.net, last released 0.6.4 in ~2008) uses autotools + popt and is old enough it would likely hit the same strict-warnings-as-errors friction this project already saw with NetSurf's ancient C code under GCC 14. Used arunanshub/preload instead -- a straight functional clone (same proc.c/prophet.c/spy.c/readahead.c architecture, i.e. genuinely the same real algorithm: watches /proc for exec events, builds a Markov-chain usage model per binary+its mapped libraries, and issues readahead() calls to prefetch files it predicts will be launched soon) but rebuilt with meson instead of autotools, and its ONLY dependency is glib-2.0 (already built in this project) -- no popt needed at all. Real GitHub tag 0.1.5, verified the tarball URL resolves and pinned its real sha256 (not a placeholder). Ships its own systemd unit is NOT bundled upstream (labeled WIP, no packaging files) -- hand-written here (Type=simple, ExecStart uses --foreground per its own real --help output, matching the pattern already used for scx.service) and enabled by default via the multi-user.target.wants symlink (same pattern as openssh's sshd.service), since the whole point is for it to actually run, not sit dormant like scx.service was left. Default preload.conf tunables (cycle=1s scan interval, minsize=2MB, autosave=3600s, maxprocs=30) are meson's own hardcoded upstream defaults, left unchanged -- reasonable for a general desktop workload and not worth second-guessing without real usage data.

KDE Frameworks 6 (6.29.0) module for the KDE Plasma chain. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

LFS ch8. Skips the optional test suite. Bumped 4.0.6 -> 4.0.7 to track LFS 13.1's package set (sha256 from a real downloaded tarball).

LFS ch8. Skips the optional make check.

PulseAudio 17.0 -- built almost entirely for its CLIENT libraries (libpulse, libpulse-mainloop-glib, libpulse-simple), which gnome-shell's bundled gvc volume widget hard-requires. Daemon modules mostly disabled; ALSA sink kept so it can actually play if used. This distro is otherwise ALSA-only. ship_in_iso=false, built on .101.

KDE Frameworks 6 (6.29.0) / Kdenlive dependency. Not in BLFS as its own page. ship_in_iso=false -- the whole Kdenlive stack is packages-only, kept out of linuxdoors.iso. ECM+CMake+Ninja, Qt6 from the deployed /opt/qt6-full, --libdir=lib for LinuxDoors' non-multiarch layout.

BLFS general/python-modules.html. Recommended dependency of PyGObject3, part of the Phase 1.5 GTK3+PyGObject installer prerequisite chain.