Packages

LFS ch8. Python package built as a wheel and pip-installed offline. Bumped 83.0.0 -> 84.0.0 to track LFS 13.1's package set (sha256 from a real downloaded tarball). || 84.0.0 -> 84.2.0 (2026-10-21 update). || 84.2.0 -> 84.2.1 (2026-10-23, v1.55); sha256 matches PyPI.

LFS ch8, rebuilt for BLFS PAM support (see linux-pam). configure autodetects libpam (now present) and links it -- no new configure flag needed, same flags as before. Adds BLFS's postlfs/shadow PAM section: login.defs field comments-out and the full /etc/pam.d/{login,passwd,su,chpasswd,newusers,chage,chfn,chgpasswd,chsh,groupadd,groupdel,groupmems,groupmod,useradd,userdel,usermod} set. Skips the book's /etc/login.access + /etc/limits renames (destdir-relative, and neither file exists in a fresh install -- not applicable). Original chapter-8 gap already resolved by lfs_system_config.sh (pwconv/grpconv/root password/useradd -D all run there); only the PAM pieces are new here. IMPORTANT: strips etc/passwd*|shadow*|group*|gshadow* from its own destdir before capture -- a fresh make install would otherwise recreate default account-database templates and the engine's rsync capture would clobber the live ones (root's password, the linux user). depends stays libxcrypt (not linux-pam) to avoid a manifest cycle through the pre-existing blfs-desktop chain-of-convenience ordering (systemd->dbus->...->gtk3); the real build order (linux-pam, then this, then systemd) is enforced by calling `cli build` on each name separately, in that sequence, not by a depends edge. Bumped 4.20.0 -> 4.20.2 to track LFS 13.1's package set (sha256 from a real downloaded tarball).

BLFS. Needed by gdk-pixbuf -- a real dependency that surfaced as a build failure. build-spec=false since we didn't build xmlto.

Shotcut 26.8.1 -- a full non-linear video editor on the MLT engine with a Qt6 GUI and ZERO KDE Frameworks (the reason it was chosen over kdenlive as the first video editor to ship). Not in BLFS. ship_in_iso=false: video-editing feature = packages only, kept out of linuxdoors.iso per user direction. CMake+Ninja. Qt6 6.4+ (Charts, Multimedia, Network, OpenGL(+Widgets), QuickControls2, QuickWidgets, Sql, WebSockets, Widgets, Xml, DBus, GuiPrivate) from the deployed /opt/qt6-full; mlt++-7 >= 7.36.0 from packages/mlt on /usr. Qt6 plugin/qml discovery is automatic (prefix-relative to /opt/qt6-full/lib), so no launcher-wrapper env is needed. Its .desktop + metainfo come from packaging/linux/. Verified on the .101 fast computer via Xvfb.

Not in BLFS's own X/gnome dependency list as a standalone build for us -- VTE's meson.build hard-requires simdutf and tries to auto-fetch it as a wrap subproject via git, which we don't have; building it directly here avoids needing a git toolchain just for this. Skips the optional ninja test. || 9.2.1 -> 9.3.2 (2026-10-19, v1.49 update; sha256 archive-test only).

KDE Frameworks 6 (6.29.0) / Kdenlive dependency. Not in BLFS as its own page. ship_in_iso=false -- the whole Kdenlive stack is packages-only, kept out of linuxdoors.iso. ECM+CMake+Ninja, Qt6 from the deployed /opt/qt6-full, --libdir=lib for LinuxDoors' non-multiarch layout.

KDE Frameworks 6 (6.29.0) / Kdenlive dependency. Not in BLFS as its own page. ship_in_iso=false -- the whole Kdenlive stack is packages-only, kept out of linuxdoors.iso. ECM+CMake+Ninja, Qt6 from the deployed /opt/qt6-full, --libdir=lib for LinuxDoors' non-multiarch layout.

Not in BLFS -- header-only package defining the SPICE wire protocol (structs/constants), real upstream from gitlab.freedesktop.org/spice/spice-protocol, tag v0.14.5 (satisfies spice-vdagent's own configure.ac requirement of >= 0.14.3). Added specifically as a build-time dependency for packages/spice-vdagent -- see that package's notes for why (host<->guest clipboard sharing was completely missing for the LinuxDoors test VM, a real, user-reported gap: 'the copy and paste doesn't work from host to vm guest'). Plain meson build, no other dependencies.

Not in BLFS -- user-reported real gap: 'the copy and paste doesn't work from host to vm guest'. The libvirt domain's QEMU side already had the required SPICE virtio-serial channel configured (confirmed via `virsh dumpxml`: a <channel type='spicevmc'> targeting com.redhat.spice.0), but the GUEST had no spice-vdagent installed at all -- clipboard sync, auto display-resize, and file-transfer between a SPICE client (virt-viewer/remote-viewer) and the guest all require this daemon on the guest side; the host-side channel alone does nothing without it. Real upstream from gitlab.freedesktop.org/spice/linux/vd_agent, tag spice-vdagent-0.23.0, autotools build. Every real dependency in its configure.ac (gtk+-3.0, gio-unix-2.0, xfixes/xrandr/xinerama/x11, alsa, dbus-1, libdrm, glib-2.0 -- confirmed via `pkg-config --exists` against the real $LFS) was already satisfied by this project's existing X11/XFCE stack, except spice-protocol (header-only, see packages/spice-protocol), which was added alongside this package. --with-session-info=systemd forces the systemd/logind session-detection path explicitly (configure.ac's 'auto' default tries ConsoleKit too, a legacy session manager this project has never built and never will, since it uses systemd-logind throughout). Two components: `spice-vdagentd` (root, the actual virtio-serial-port daemon) and `spice-vdagent` (per-X-session clipboard/resize agent). Enablement needs NO systemctl enable at all -- confirmed by reading data/70-spice-vdagentd.rules and the shipped .service/.socket files (neither has an [Install] section): the udev rule matches on the com.redhat.spice.0 virtio-serial device node appearing and sets SYSTEMD_WANTS=spice-vdagentd.socket, so socket-activation happens automatically and device-triggered whenever that channel exists, exactly the existing QEMU channel this project's LinuxDoors test domain already has. The per-session spice-vdagent (clipboard agent) autostarts via data/spice-vdagent.desktop, which Makefile.am installs straight into $(sysconfdir)/xdg/autostart -- i.e. /etc/xdg/autostart/spice-vdagent.desktop with --sysconfdir=/etc -- applying to every user automatically, no per-account autostart copy needed (unlike this project's own hand-written wallpaper/icon-style script, which predates knowing this convention existed). Real build bug hit and fixed: `src/vdagent/device-info.c`'s `parse_pci_address_from_sysfs_path()` does `char *pos = strstr(addr, "/pci");` where `addr` is `const char*` -- GCC 14 infers const through its strstr() builtin from the const argument and flags the assignment to non-const `char *pos` as `-Werror=discarded-qualifiers`, the exact same warnings-as-errors-on-old-code failure class already hit repeatedly in this project's NetSurf chain. Fixed with a targeted `perl -pi` patch adding an explicit `(char *)` cast (the standard idiomatic fix for this specific ISO-C strstr quirk), applied to the one real occurrence in the whole source tree (confirmed via grep -- not a blanket fix). Second real bug: the first successful build produced `spice-vdagent`/`spice-vdagentd` binaries and the XDG autostart .desktop, but silently skipped the systemd .service/.socket units, the udev rule, AND the tmpfiles.d config entirely -- `--with-session-info=systemd` only controls session detection; the actual unit/udev-rule installation is gated by a completely separate `--with-init-script=systemd` flag (confirmed via Makefile.am: all four are installed inside one `if INIT_SCRIPT_SYSTEMD` block). Fixed by adding `--with-init-script=systemd` explicitly.

LFS ch8. Skips the optional docs copy (sqlite-doc zip). || 3.54.0 -> 3.54.1 (2026-10-17, v1.47 update; sha256 archive-test only).

sshpass 1.10 -- a tiny non-interactive ssh-password helper (single main.c, plain autotools). Not in LFS/BLFS. Needed by packages/flashscp: FlashScp hands a machine's password to ssh via sshpass through the SSHPASS environment variable (never a command line), for hosts that want a password or key+password. The FlashScp AppImage carries its own copy; the installable package uses this system one. ship_in_iso=false -- pulled in only when flashscp (or another consumer) is installed.

BLFS. Provides libstartup-notification-1.so, used to give cursor feedback while apps launch. Recommended dep for libxfce4ui in the XFCE core chain.

Hand-authored, NOT upstream (Todd Miller) sudo -- a deliberately minimal LinuxDoors-specific reimplementation, user-requested ('a linuxdoors version of sudo that's simple as possible'). No sudoers file, no per-command policy, no auth-timestamp cache, no -u <user> (always root). Every real security decision is delegated to PAM: authorization is pam_wheel.so use_uid (only the wheel group can proceed), authentication is pam_unix.so checking the CALLING user's own password via getuid() (the actual difference from su, which asks for the target's password). Source is a single hand-written sudo.c, tarred locally (no real upstream URL -- source.url is a placeholder label, resolve_source never contacts it since the file is pre-placed in download/ and its sha256 already matches) -- same 'local, hand-authored asset treated as a pinned source' pattern already used for LinuxUltraOffice's branding-assets tarball. Installs setuid-root (mode 4755, owner root:root) to /usr/bin/sudo -- deliberately /usr/bin, not /usr/local/bin, matching universal sudo muscle memory and sidestepping the same 'not on PATH for every su invocation style' issue hit and fixed for the pkg CLI. Requires a new 'wheel' group to exist and /etc/pam.d/sudo to be written (both done in scripts/lfs_system_config.sh, not here -- this package only builds and installs the binary itself). Scope explicitly confirmed with the user: standalone tool for terminal use (pkg update/upgrade etc.) -- does NOT replace how the installer/Package Manager/Manage SSH LinuxDoors currently prompt for root's password directly; that stays a separate, larger follow-up if ever wanted.

SWIG 4.3.1 -- interface compiler that generates the Python bindings (_openshot.so + openshot.py) for libopenshot, which OpenShot's Qt GUI imports. Not in BLFS's own index but a standard build (pre-bootstrapped SourceForge tarball, plain ./configure). Only real dep is pcre2 (already built). ship_in_iso=false: part of the OpenShot video-editing feature, packages-only, kept out of linuxdoors.iso.

KDE Frameworks 6 (6.29.0) module for the KDE Plasma chain. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

LFS ch8, the init system this whole distro is built around. Skips the optional test suite (needs /etc/os-release + unshare -m, awkward inside our automated non-interactive build). KNOWN GAP: skips `systemd-machine-id-setup` and `systemctl preset-all` -- both need a live running system (a real PID 1, real /etc), not available mid-build inside a chroot -- these run in lfs_system_config.sh instead. Rebuilt for BLFS PAM support (pam=enabled, pamconfdir=/etc/pam.d) -- this is what actually provides pam_systemd.so and systemd-logind session registration, needed for lightdm to hand off a real desktop session. IMPORTANT: strips etc/os-release|hostname|machine-id|hosts from its own destdir before capture -- ninja install can recreate these as defaults in a fresh DESTDIR, and rsync capture would otherwise overwrite lfs_system_config.sh's branding/hostname/machine-id on every rebuild. depends stays jinja2 (its original ch8 anchor); changing it to shadow would create a manifest cycle through the blfs-desktop chain (systemd->dbus->...->gtk3->linux-pam->shadow->systemd). The real rebuild order (linux-pam, then shadow, then this) is enforced by calling `cli build` on each name separately, in that sequence. Bumped 261.2 -> 261.3 (real sha256 computed from the downloaded GitHub source tarball, replacing a long-standing PLACEHOLDER that was never actually verified even at 261.2). The LFS book itself (systemd/chapter08/systemd.html) still tracks 261.2 as of this bump -- confirmed no systemd-man-pages-261.3.tar.xz exists on LFS's own mirror (404), so the man-pages extra_source stays pinned at the 261.2 tarball (also fixed from a PLACEHOLDER sha256 to a real one, computed here for the first time) -- man pages don't meaningfully change for a single point release, and LFS's own convention is one man-pages tarball per systemd feature series, not per patch release. Bumped 261.3 -> 262 (2026-10-10, LFS r13.1-21, md5s match the book). Now built with --libdir=lib: 261.3 on .101 had installed into the Debian multiarch dir, where pam_systemd.so was never loaded by PAM (/usr/lib/security). || 262 -> 262.1 (2026-10-17, v1.47 update; sha256 archive-test only).

KDE Plasma 6.7.4 component for the LinuxDoors KDE desktop. ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work. || 6.7.4 -> 6.7.5 (2026-09-14 real upstream-currency bump, real sha256 computed -- no published checksum from KDE's release-service, only a detached .asc signature, so archive integrity was verified with `xz -t` first, same approach as kdenlive/mesa). 2026-10-10: rebuilt as 6.7.5-1 against Qt 6.12.0 (links Qt private API, which is only guaranteed within one Qt minor release).

LFS ch8, final native build. FORCE_UNSAFE_CONFIGURE=1 needed since we always build as root. Skips the optional test suite.

LFS ch8. Skips the optional docs tarball/install and the optional test suite.

tecla -- small GNOME library for displaying keyboard shortcuts (used by gnome-control-center's keyboard panel, which is a required 'dependent panel', not optional). Added because gnome-control-center 48.7's meson build failed with 'Run-time dependency tecla found: NO' and no git available to fetch its wrap. Not in BLFS -- real upstream source from download.gnome.org, version 48.0.2 matching this project's GNOME 48 track. Plain meson, no non-obvious build steps. || Bumped 48.0.2 -> 51.0 (2026-09-18, part of the GNOME 51 push). Real sha256 verified against GNOME's own published sha256sum file.

LFS ch8, final native build (ch7's texinfo-tmp was a bootstrap version). Skips the optional test suite and the optional TeX install.

LFS ch7, inside the chroot. Superseded by chapter 8's full texinfo build.

KDE Frameworks 6 (6.29.0) / Kdenlive dependency. Not in BLFS as its own page. ship_in_iso=false -- the whole Kdenlive stack is packages-only, kept out of linuxdoors.iso. ECM+CMake+Ninja, Qt6 from the deployed /opt/qt6-full, --libdir=lib for LinuxDoors' non-multiarch layout.