Packages

KDE Frameworks 6 (6.29.0) / Kdenlive dependency. Not in BLFS as its own page. ship_in_iso=false -- the whole Kdenlive stack is packages-only, kept out of linuxdoors.iso. ECM+CMake+Ninja, Qt6 from the deployed /opt/qt6-full, --libdir=lib for LinuxDoors' non-multiarch layout.

BLFS XFCE. The file manager. libgudev/Gvfs/libexif/tumbler optional deps skipped (no remote/automount/thumbnail support, still a real functioning local file manager). No test suite.

BLFS general/tiff.html. Second package in the GIMP dependency chain (GIMP 3.2.4 requires libtiff directly). CMake+Ninja build per the book's own current instructions (this package switched off autotools upstream). Skips the test suite and the book's own `mv /usr/share/doc/tiff{,-4.7.2}` versioned-doc-dir rename (cosmetic, not done for any other package in this project either).

Extra, not in LFS or BLFS -- Ubuntu's iptables frontend, built from its own upstream (launchpad) release via `python3 setup.py install --root=`, which maps directly onto our $PKG_DESTDIR convention. KNOWN GAP: not integrated into boot (README suggests /lib/ufw/ufw-init start via an init script or systemd unit) -- ufw is installed but not enabled/started automatically; that's a future system-configuration task.

Real, ungoogled Chromium build -- explicit user preference over stock Chromium/Chrome ('a version without all the telemetry and analytics'), built with our own from-source Clang (packages/clang-chromium) instead of Google's prebuilt binary ('i prefer not to use google's binary at this time'). Follows ungoogled-chromium's own real, documented GENERIC build path (docs/building.md inside the ungoogled-chromium source tarball itself, verified directly -- not guessed): the ungoogled-chromium repo is the cross-platform core (patches/, flags.gn, downloads.ini, pruning.list, domain_substitution.list, and the utils/ scripts), NOT a platform-specific overlay like ungoogled-chromium-linux/-debian -- this project intentionally uses the generic path since it's not Debian/Arch/etc. downloads.ini has exactly ONE real entry (the official chromium-151.0.7922.137-lite.tar.xz from Google's own commondatastorage.googleapis.com, real sha256 confirmed against Google's own published .hashes file) which is fetched as extra_sources here rather than via utils/downloads.py's own network retrieve step, since we already have it pinned and verified. Six real build stages, all straight from ungoogled-chromium's own docs/building.md: unpack chromium source (stripping the leading dir, equivalent to downloads.py's own unpack step) -> utils/prune_binaries.py -> utils/patches.py apply -> utils/domain_substitution.py apply -> bootstrap GN (tools/gn/bootstrap/bootstrap.py, built with the system's plain GCC since GN itself is a small standalone tool, not part of the browser binary that needs to match Chromium's own toolchain) -> gn gen + ninja. GN args = flags.gn (ungoogled's own real defaults: disables Safe Browsing/telemetry/PGO/Widevine-reporting/field-trial-testing-config, blanks Google API keys) plus this project's own additions for a from-scratch, no-depot_tools, no-bundled-sysroot Linux build: clang_base_path=/opt/clang-chromium (points at our own compiler, the real documented mechanism per Chromium's own docs/clang.md), use_lld=true (uses the lld we specifically built alongside clang for this exact RAM-constrained-VM reason), use_sysroot=false (no bundled sysroot download available/wanted -- use this project's own already-built system libraries), is_component_build=true + symbol_level=0 + blink_symbol_level=0 (real, standard RAM/link-time mitigations for a build machine at Chromium's documented minimum RAM, on top of the 15GB swap already configured), ozone_platform=x11 + ozone_platform_x11=true + ozone_platform_wayland=false (this project has no Wayland compositor, X11/Xorg only), enable_nacl=false, is_official_build=false (skips the much heavier LTO+PGO pipeline, which chrome_pgo_phase=0 in flags.gn already partly disables anyway). `gn gen --fail-on-unused-args` is used exactly as ungoogled-chromium's own docs specify -- a real safety net: any wrong/misspelled GN flag added here fails fast and clearly rather than silently being ignored. Given the sheer scale of a real Chromium build, this is expected to need iterative real-failure-driven fixes (same discipline as every other package in this project), not a guaranteed single-shot success. Bumped 151.0.7922.137-1 -> 151.0.7922.169-1 as a real, user-requested security rebase: Google's own Chromium 151.0.7922.169 fixes two Critical sandbox-escape RCEs (CVE-2026-76034, a WebGL heap buffer overflow; CVE-2026-76036, a Dawn/WebGPU buffer overflow) plus a High CORS issue (CVE-2026-76033) and ~12 more unnamed fixes, but ungoogled-chromium upstream's own newest tag was still 137-1 at the time -- Google embargoes the actual fix commits/diffs for sandbox-escape RCEs until adoption is high (standard responsible-disclosure practice), so a surgical single-CVE patch wasn't possible; only the full 169 source tree (which has the fixes compiled in) is public. This is a real, hand-verified rebase, not a blind version bump: the extra_sources chromium-lite tarball is the only thing that changed to 169 -- the ungoogled-chromium

upower 1.90.9 (meson, from the GitLab tag archive) -- power/battery daemon. gnome-settings-daemon's power plugin needs it. ship_in_iso=false, built on .101.

LFS ch8, final build (ch7's util-linux-tmp was a minimal bootstrap version). Skips the optional test suite (also needs /etc/fstab and a non-root tester user).

LFS ch7, inside the chroot, last package before chapter 8 starts. Minimal build (many features disabled since their dependencies aren't available yet). Superseded by chapter 8's full util-linux build.

BLFS, first X11 core package. Sets XORG_PREFIX=/usr and XORG_CONFIG per BLFS's Xorg-7 intro page -- every subsequent X11 package's build.sh re-exports these two vars itself since each build.sh runs in a fresh environment.

Vala compiler (valac) -- 0.56 LTS. Bootstraps from the pre-generated C shipped in the release tarball, so it builds with just a C compiler + glib (no existing valac needed). ship_in_iso=false -- prerequisite for Budgie Desktop (which is ~80% Vala), a Packages-page / Package Manager install kept off linuxdoors.iso. Built on .101 against the existing glib2/gobject-introspection stack.

LFS ch8. Skips the optional test suite (which also needs a non-root 'tester' user we don't set up for this). Bumped 9.2.0858 -> 9.2.1025 to track LFS 13.1's package set (sha256 from a real downloaded tarball).

BLFS. Terminal-emulator widget library required by xfce4-terminal. gtk4=false (GTK4 not built), gnutls/vapi off, icu=false (legacy-charset support, avoids needing to build all of ICU just for this). simdutf and fmt built as standalone packages since VTE's meson tries to git-clone them as wrap subprojects otherwise and we have no git. Removes the /etc/profile.d/vte.sh the book flags as leftover.

Vulkan-Headers -- Khronos Vulkan API headers. KWin 6.7 requires them to build its Vulkan backend (runtime falls back to GL without a driver). ship_in_iso=false.

Vulkan-Loader -- provides libvulkan.so.1. KWin links it (Vulkan_LIBRARY). ship_in_iso=false.

libwayland + wayland-scanner. Needed by KWin, plasma-workspace, layer-shell-qt, kwayland even for an X11 Plasma session (KWin 6's codebase is unified). ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

The standard Wayland protocol XML definitions. Trivial build (installs .xml + a pc file). ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

LFS ch8. Python package built as a wheel and pip-installed offline. Bumped 0.47.0 -> 0.48.0 to track LFS 13.1's package set (sha256 from a real downloaded tarball).

BLFS general/which.html. Required by Node.js's own configure/build tooling, first package in the Firefox chain (user's 'reopen Rust for real Firefox' direction).

BLFS multimedia/x264.html -- H.264 encoder, needed by ffmpeg (--enable-libx264) for the Shotcut/Kdenlive video stack. ship_in_iso=false: this whole video-editing feature is installable-as-packages only, kept out of linuxdoors.iso per user direction. x264 upstream ships no numbered release tarballs; the 'stable' branch snapshot is what BLFS itself uses. Plain ./configure --enable-shared --disable-cli.

BLFS multimedia/x265.html -- H.265/HEVC encoder, needed by ffmpeg (--enable-libx265). ship_in_iso=false (video-editing feature = packages only). CMake build from the source/ subdir; --libdir=lib for LinuxDoors' non-multiarch layout.

X2Go Client GUI -- the desktop app that connects TO an x2goserver (this is the client side of packages/x2goserver). Upstream x2goclient 4.1.2.3 is a Qt5 app with NO Qt6 port; this package carries a ~3900-line LinuxDoors Qt6 port patch (source_packages_versions/x2goclient-qt6/x2goclient-qt6.patch) built against the existing packages/qt6-full. The port: a new src/qt6compat.{h,cpp} shim for the two Qt6-removed subsystems x2goclient leaned on -- QX11Info::display() (x11extras is gone -> QNativeInterface::QX11Application) and QDesktopWidget / QApplication::desktop() (removed -> a QScreen-wrapping X2GoDesktopCompat class) -- plus ~30 mechanical API renames across ~50 files (QString::null->QString(), Qt::WindowFlags f=0 -> ={}, QFontMetrics::width->horizontalAdvance, qSort->std::sort, qrand->QRandomGenerator, toTime_t->toSecsSinceEpoch, QLayout::setMargin->setContentsMargins, QFont::setWeight(int)->enum, QLabel::pixmap() by-value, QString::sprintf->asprintf, QTime::elapsed/restart->QElapsedTimer, QSslSocket::addDefaultCaCertificates->QSslConfiguration, setTabStopWidth->setTabStopDistance). QRegExp is kept via the Qt6Core5Compat module (one QString::remove(QRegExp) -> .trimmed()). LDAP support is disabled (USELDAP off) -- it needs openldap, which LinuxDoors does not have, and it is only used for the niche LDAP-session-broker feature. Translations are disabled in this first cut (English only). New dependency packages built for this: libssh 0.11.5 (its own SSH transport; NOT libssh2), brotli 1.1.0 (Qt6Network links libbrotlidec). ship_in_iso=false. **Build note**: like packages/qtwebengine and packages/pyside6, this needs qt6-full's captured destdir manually rsync'd onto the build VM's live $LFS (/opt/qt6-full) before `engine.cli build x2goclient`, then removed after -- qt6-full is itself ship_in_iso=false so the engine never stages it automatically. Compile+link+GUI verified against Qt 6.11.2: on the LinuxDoors test domain the Session-preferences dialog and main window render natively (screenshot). /usr/bin/x2goclient is a wrapper (sets LD_LIBRARY_PATH=/opt/qt6-full/lib) around /usr/lib/x2goclient/x2goclient, with a qt.conf ([Paths] Prefix=/opt/qt6-full) beside the real binary for the plugin/platform paths -- so it runs with no env setup. Remaining: real translations (English-only now); a GUI click-through of an actual server connection.

X2Go Server -- remote-desktop server (an SSH-tunnelled, NX-compressed X11 remote desktop; connect with x2goclient / PyHoca). Built from the real upstream tarball (code.x2go.org), version-matched to what was hand-installed and debugged on 70.20.232.101. ship_in_iso=false: optional install only (via linuxdoors.com / linuxdoors-pkg-manager / `pkg install x2goserver`), NOT in the base image -- it also needs sshd, which conflicts with LinuxDoors' SSH-off-by-default posture (see the shipped /usr/share/doc/x2goserver/CLIENT-TUNING.md). BUILDS from source: x2goserver-common, x2goserver, libx2go-server-db-perl (compiles the setgid sqlite3 privsep wrapper), x2goserver-x2goagent (the nxagent wrapper/symlinks -- expects packages/nx-libs to have placed nxagent under /usr/lib/x86_64-linux-gnu/nx/), x2goserver-xsession, x2goserver-extensions. Deliberately SKIPS x2goserver-x2gokdrive / -printing / -fmbindings / -desktopsharing (optional subprojects with their own dep chains, not needed for a basic XFCE session). nx-libs (nxagent) is a separate package, captured from Debian (user's hybrid choice -- nx-libs is a mini-Xorg-scale C build). The Perl runtime deps LinuxDoors' base perl lacks are 5.44-site/vendor packages: File::BaseDir/DesktopEntry/MimeInfo/Which/ReadBackwards + DBI + DBD::SQLite (all their own packages/perl-* entries). The small pure-Perl leaves (Capture::Tiny, Config::Simple, Switch, Try::Tiny, URI, Encode::Locale, MIME::Base32) are cpanm'd straight into this package's destdir -- single-consumer boilerplate, promote to their own packages if anything else ever needs them. FIX-UPS baked in (each found debugging the real .101 install, 2026-08-27): 1. /etc/x2go/Xsession upstream only knows Debian/RedHat/SUSE/Gentoo/Slackware -- on anything else it aborts 'Unknown operating system'. build.sh sed's the RedHat elif to also fire on any /etc/os-release, so LinuxDoors takes the RedHat-style `exec -l $SHELL -c $STARTUP` path (needs no /etc/x2go/Xsession.d). Original symptom before the x2goserver-xsession piece existed at all: connect succeeds, session reaches 'Session started', then 'Terminating session' ~1s later before the desktop runs. 2. Ships /etc/xdg/xfce4/xfconf/.../xfwm4.xml with use_compositing=false -- xfwm4's software compositor's window drop-shadows are pure lag over a remote link (and the guest has no GPU driver, so it's llvmpipe). 3. Ships /etc/systemd/user/xfce4-notifyd.service -> /dev/null -- that stray user unit auto-starts without a DISPLAY and lands in `systemctl --user --failed`; xfce4-session launches notifyd itself and dbus-activation still works via the .service Exec= fallback. 4. sysusers.d + tmpfiles.d files create the x2gouser group and /var/lib/x2go (2770 root:x2gouser) at first boot -- the systemd-native replacement for the Debian maintainer scripts, which engine/debian_fetch.py-style installs never run. 5. Enables x2goserver.service (the x2gocleansessions reaper daemon) via a multi-user.target.wants symlink in the payload. The Perl-module gap on .101 first surfaced as 'Connection failed. Can't locate File/BaseDir.pm in @INC ... at /usr/bin/x2goumount-session line 25' and, from the same root cause, an nxagent 'PANIC! Failure negotiating the session in stage 11'. See memory x2goserver-linuxdoors-setup for the full debugging record.

BLFS 'x7app' page -- 33 small Xorg client utilities (xauth, xrandr, xset, xhost, xkbcomp, xcursorgen, etc.) bundled into one LinuxDoors package, same pattern as x7lib. Added because xcursor-themes hard-requires xcursorgen at configure time (BLFS lists 'Xorg Applications' as its required dependency) -- while planning originally treated X11 core as just libs+server, a real minimal desktop also needs at least xauth (session auth) and xrandr (display config), so the whole small/fast meta-page is built rather than cherry-picking.

BLFS x7driver page (minimal input-driver subset: libevdev+xf86-input-evdev, libinput+xf86-input-libinput -- video driver is the built-in mesa 'modesetting'/'virgl' path, no separate xf86-video-* package needed for QEMU virtio-gpu/std VGA). Bundled the same way x7lib bundles its libraries: meson packages (libevdev, libinput) build first and apply live, autotools driver packages (xf86-input-evdev, xf86-input-libinput) build against them via $XORG_CONFIG.