Packages

BLFS XFCE. The file manager. libgudev/Gvfs/libexif/tumbler optional deps skipped (no remote/automount/thumbnail support, still a real functioning local file manager). No test suite.

BLFS general/tiff.html. Second package in the GIMP dependency chain (GIMP 3.2.4 requires libtiff directly). CMake+Ninja build per the book's own current instructions (this package switched off autotools upstream). Skips the test suite and the book's own `mv /usr/share/doc/tiff{,-4.7.2}` versioned-doc-dir rename (cosmetic, not done for any other package in this project either).

TPM2 Software Stack (tpm2-tss) -- another genuinely new package, needed because gnome-remote-desktop 51.0's meson.build calls dependency('tss2-esys') unconditionally (used for hardware-TPM-backed secure storage of the VNC/RDP session's own credentials/keys), same as krb5. Built into the SHARED /usr prefix, not isolated -- nothing else in this project uses tpm2-tss, so no collision risk, and a shared install means any future package wanting real TPM support can reuse it. Real deps (openssl/json-c/libcap/autoconf-archive/curl) all already present in this project. Only a detached GPG signature published on the GitHub release, no plain checksum file -- archive integrity verified with gzip -t before trusting the computed sha256, same fallback approach already used elsewhere in this project (Mesa, Kdenlive, krb5).

Extra, not in LFS or BLFS -- Ubuntu's iptables frontend, built from its own upstream (launchpad) release via `python3 setup.py install --root=`, which maps directly onto our $PKG_DESTDIR convention. KNOWN GAP: not integrated into boot (README suggests /lib/ufw/ufw-init start via an init script or systemd unit) -- ufw is installed but not enabled/started automatically; that's a future system-configuration task.

Real, ungoogled Chromium build -- explicit user preference over stock Chromium/Chrome ('a version without all the telemetry and analytics'), built with our own from-source Clang (packages/clang-chromium) instead of Google's prebuilt binary ('i prefer not to use google's binary at this time'). Follows ungoogled-chromium's own real, documented GENERIC build path (docs/building.md inside the ungoogled-chromium source tarball itself, verified directly -- not guessed): the ungoogled-chromium repo is the cross-platform core (patches/, flags.gn, downloads.ini, pruning.list, domain_substitution.list, and the utils/ scripts), NOT a platform-specific overlay like ungoogled-chromium-linux/-debian -- this project intentionally uses the generic path since it's not Debian/Arch/etc. downloads.ini has exactly ONE real entry (the official chromium-151.0.7922.137-lite.tar.xz from Google's own commondatastorage.googleapis.com, real sha256 confirmed against Google's own published .hashes file) which is fetched as extra_sources here rather than via utils/downloads.py's own network retrieve step, since we already have it pinned and verified. Six real build stages, all straight from ungoogled-chromium's own docs/building.md: unpack chromium source (stripping the leading dir, equivalent to downloads.py's own unpack step) -> utils/prune_binaries.py -> utils/patches.py apply -> utils/domain_substitution.py apply -> bootstrap GN (tools/gn/bootstrap/bootstrap.py, built with the system's plain GCC since GN itself is a small standalone tool, not part of the browser binary that needs to match Chromium's own toolchain) -> gn gen + ninja. GN args = flags.gn (ungoogled's own real defaults: disables Safe Browsing/telemetry/PGO/Widevine-reporting/field-trial-testing-config, blanks Google API keys) plus this project's own additions for a from-scratch, no-depot_tools, no-bundled-sysroot Linux build: clang_base_path=/opt/clang-chromium (points at our own compiler, the real documented mechanism per Chromium's own docs/clang.md), use_lld=true (uses the lld we specifically built alongside clang for this exact RAM-constrained-VM reason), use_sysroot=false (no bundled sysroot download available/wanted -- use this project's own already-built system libraries), is_component_build=true + symbol_level=0 + blink_symbol_level=0 (real, standard RAM/link-time mitigations for a build machine at Chromium's documented minimum RAM, on top of the 15GB swap already configured), ozone_platform=x11 + ozone_platform_x11=true + ozone_platform_wayland=false (this project has no Wayland compositor, X11/Xorg only), enable_nacl=false, is_official_build=false (skips the much heavier LTO+PGO pipeline, which chrome_pgo_phase=0 in flags.gn already partly disables anyway). `gn gen --fail-on-unused-args` is used exactly as ungoogled-chromium's own docs specify -- a real safety net: any wrong/misspelled GN flag added here fails fast and clearly rather than silently being ignored. Given the sheer scale of a real Chromium build, this is expected to need iterative real-failure-driven fixes (same discipline as every other package in this project), not a guaranteed single-shot success. Bumped 151.0.7922.137-1 -> 151.0.7922.169-1 as a real, user-requested security rebase: Google's own Chromium 151.0.7922.169 fixes two Critical sandbox-escape RCEs (CVE-2026-76034, a WebGL heap buffer overflow; CVE-2026-76036, a Dawn/WebGPU buffer overflow) plus a High CORS issue (CVE-2026-76033) and ~12 more unnamed fixes, but ungoogled-chromium upstream's own newest tag was still 137-1 at the time -- Google embargoes the actual fix commits/diffs for sandbox-escape RCEs until adoption is high (standard responsible-disclosure practice), so a surgical single-CVE patch wasn't possible; only the full 169 source tree (which has the fixes compiled in) is public. This is a real, hand-verified rebase, not a blind version bump: the extra_sources chromium-lite tarball is the only thing that changed to 169 -- the ungoogled-chromium

upower 1.90.9 (meson, from the GitLab tag archive) -- power/battery daemon. gnome-settings-daemon's power plugin needs it. ship_in_iso=false, built on .101.

LFS ch8, final build (ch7's util-linux-tmp was a minimal bootstrap version). Skips the optional test suite (also needs /etc/fstab and a non-root tester user).

LFS ch7, inside the chroot, last package before chapter 8 starts. Minimal build (many features disabled since their dependencies aren't available yet). Superseded by chapter 8's full util-linux build.

BLFS, first X11 core package. Sets XORG_PREFIX=/usr and XORG_CONFIG per BLFS's Xorg-7 intro page -- every subsequent X11 package's build.sh re-exports these two vars itself since each build.sh runs in a fresh environment.

Vala compiler (valac) -- 0.56 LTS. Bootstraps from the pre-generated C shipped in the release tarball, so it builds with just a C compiler + glib (no existing valac needed). ship_in_iso=false -- prerequisite for Budgie Desktop (which is ~80% Vala), a Packages-page / Package Manager install kept off linuxdoors.iso. Built on .101 against the existing glib2/gobject-introspection stack.

LFS ch8. Skips the optional test suite (which also needs a non-root 'tester' user we don't set up for this). Bumped 9.2.0858 -> 9.2.1025 to track LFS 13.1's package set (sha256 from a real downloaded tarball). || 9.2.1178 -> 9.2.1202 (2026-10-16, v1.46 update; sha256 archive-test only). || 9.2.1202 -> 9.2.1209 (2026-10-21 update). || 9.2.1209 -> 9.2.1225 (2026-10-23, v1.55); GitHub archive, gzip -t.

BLFS. Terminal-emulator widget library required by xfce4-terminal. gtk4=false (GTK4 not built), gnutls/vapi off, icu=false (legacy-charset support, avoids needing to build all of ICU just for this). simdutf and fmt built as standalone packages since VTE's meson tries to git-clone them as wrap subprojects otherwise and we have no git. Removes the /etc/profile.d/vte.sh the book flags as leftover. 2026-10-10: rebuilt as 0.84.1-1 against simdutf 9.2.1 (libsimdutf.so.34 -> .so.36). || 0.84.1-2: rebuilt against simdutf 9.3.2 (soname 36->37) (2026-10-19, v1.49).

Vulkan-Headers -- Khronos Vulkan API headers. KWin 6.7 requires them to build its Vulkan backend (runtime falls back to GL without a driver). ship_in_iso=false.

Vulkan-Loader -- provides libvulkan.so.1. KWin links it (Vulkan_LIBRARY). ship_in_iso=false.

libwayland + wayland-scanner. Needed by KWin, plasma-workspace, layer-shell-qt, kwayland even for an X11 Plasma session (KWin 6's codebase is unified). ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work. || Bumped 1.24.0 -> 1.26.0 (2026-09-18) -- mutter 51.0 (built for the parallel GNOME 51/RDP stack) hard-requires wayland-server >= 1.26. Kept in the SHARED /usr prefix, not isolated -- wayland-server maintains strict ABI compatibility across the whole libwayland-server.so.0 series (upstream policy), confirmed the soname itself is version-computed (0.MINOR.PATCH) so this bump is safe for KDE Plasma/kwayland/layer-shell-qt, all of which already share this same package. Real sha256 verified against the real release tarball, not a git archive.

The standard Wayland protocol XML definitions. Trivial build (installs .xml + a pc file). ship_in_iso=false -- KDE Plasma is a Packages-page / Package Manager install, deliberately kept off linuxdoors.iso (XFCE + MATE are the shipped desktops). Built on .101 against the existing KF6 6.29 + Qt6 (/opt/qt6-full) stack from the Kdenlive work.

LFS ch8. Python package built as a wheel and pip-installed offline. Bumped 0.47.0 -> 0.48.0 to track LFS 13.1's package set (sha256 from a real downloaded tarball).

BLFS general/which.html. Required by Node.js's own configure/build tooling, first package in the Firefox chain (user's 'reopen Rust for real Firefox' direction).

WirePlumber 0.5.18 (PipeWire session manager), added 2026-10-16. Needed by both headless VNC desktops (GNOME 51 and Plasma 6.8) to link the screencast stream; previously only on .101 via the Debian bridge (0.5.8). Bundled Lua 5.5 wrap, pre-fetched (sha256 = the wrap file hashes). Enabled per user via /usr/lib/systemd/user/pipewire.service.wants. ship_in_iso=false, like pipewire: the v1.45 ISO carried Debian's wireplumber 0.5.8 binary (squashed in from .101) but no PipeWire daemon, so it could never start; dropping it from the ISO changes nothing on a live boot.

2026-09-28: new package, the real Wayland compositor library labwc (and therefore Budgie 10.10's own Wayland session) is built on. Version pinned to the exact 0.20.x series labwc's own real meson.build requires (wlroots-0.20, >=0.20.1 <0.21.0 -- verified directly against labwc's source, not guessed). Downloaded via the real release archive endpoint on gitlab.freedesktop.org (the plain /-/raw/ file viewer is behind an Anubis anti-bot JS challenge and returns an HTML challenge page instead of file content -- the /-/archive/ tarball endpoint is NOT behind it and returns the real file directly; worth remembering for any future freedesktop.org gitlab source fetch in this project). Real, genuinely good news found via a full dependency audit before writing this build.sh: every single one of wlroots' own dependency() calls across its whole source tree (wayland-server/client/egl, wayland-protocols, xkbcommon, pixman-1, libdrm, egl, glesv2, gbm, cairo, lcms2, libudev, libinput >=1.19, vulkan, and the full xcb/xcb-composite/xcb-ewmh/xcb-icccm/xcb-render/xcb-res/xcb-xfixes/xcb-errors/xwayland set) was ALREADY present on .101 before this package existed -- confirmed via a real .pc-file sweep, not assumed. `-Drenderers=gles2` (skip the vulkan renderer -- keeps this build on the same GLES2/EGL path every other Mesa-backed compositor in this project already uses, e.g. kwin_wayland/mutter's own DRM backends), `-Dbackends=drm,libinput,x11` (drm+libinput for real hardware, x11 kept for a nested/windowed test backend, matching this project's other Wayland compositors' own testing patterns), `-Dallocators=gbm` (udmabuf not needed), `-Dexamples=false` (skip wlroots' own demo apps), `-Dlibliftoff=disabled` (direct-scanout optimization, not built in this project, and genuinely optional).

wmctrl 1.07 -- a real, standard, well-known EWMH/NetWM command-line tool (list/activate/close/move windows, set window state incl. _NET_WM_STATE_ABOVE) via a real X client (main.c), targeting glib2's own AM_PATH_GLIB_2_0 pkg-config-based detection (not the old glib-1.x AM_PATH_GLIB macro, despite the superficially similar name -- confirmed via configure.in and main.c's real function usage, e.g. g_locale_to_utf8/g_ascii_strup, both glib2 APIs). Upstream (tomas.styblo.name) is long dead; sourced from Debian's own mirrored orig tarball, real sha256 computed directly. Added as a dependency of the LinuxDoors PowerToys 'Always on Top' module -- rather than hand-roll fragile raw ctypes/Xlib EWMH ClientMessage code, this small, real, 20-year-stable tool does exactly that job reliably. ship_in_iso:false -- a PowerToys dependency, not part of the base image.

BLFS multimedia/x264.html -- H.264 encoder, needed by ffmpeg (--enable-libx264) for the Shotcut/Kdenlive video stack. ship_in_iso=false: this whole video-editing feature is installable-as-packages only, kept out of linuxdoors.iso per user direction. x264 upstream ships no numbered release tarballs; the 'stable' branch snapshot is what BLFS itself uses. Plain ./configure --enable-shared --disable-cli.

BLFS multimedia/x265.html -- H.265/HEVC encoder, needed by ffmpeg (--enable-libx265). ship_in_iso=false (video-editing feature = packages only). CMake build from the source/ subdir; --libdir=lib for LinuxDoors' non-multiarch layout.

X2Go Client GUI -- the desktop app that connects TO an x2goserver (this is the client side of packages/x2goserver). Upstream x2goclient 4.1.2.3 is a Qt5 app with NO Qt6 port; this package carries a ~3900-line LinuxDoors Qt6 port patch (source_packages_versions/x2goclient-qt6/x2goclient-qt6.patch) built against the existing packages/qt6-full. The port: a new src/qt6compat.{h,cpp} shim for the two Qt6-removed subsystems x2goclient leaned on -- QX11Info::display() (x11extras is gone -> QNativeInterface::QX11Application) and QDesktopWidget / QApplication::desktop() (removed -> a QScreen-wrapping X2GoDesktopCompat class) -- plus ~30 mechanical API renames across ~50 files (QString::null->QString(), Qt::WindowFlags f=0 -> ={}, QFontMetrics::width->horizontalAdvance, qSort->std::sort, qrand->QRandomGenerator, toTime_t->toSecsSinceEpoch, QLayout::setMargin->setContentsMargins, QFont::setWeight(int)->enum, QLabel::pixmap() by-value, QString::sprintf->asprintf, QTime::elapsed/restart->QElapsedTimer, QSslSocket::addDefaultCaCertificates->QSslConfiguration, setTabStopWidth->setTabStopDistance). QRegExp is kept via the Qt6Core5Compat module (one QString::remove(QRegExp) -> .trimmed()). LDAP support is disabled (USELDAP off) -- it needs openldap, which LinuxDoors does not have, and it is only used for the niche LDAP-session-broker feature. Translations are disabled in this first cut (English only). New dependency packages built for this: libssh 0.11.5 (its own SSH transport; NOT libssh2), brotli 1.1.0 (Qt6Network links libbrotlidec). ship_in_iso=false. **Build note**: like packages/qtwebengine and packages/pyside6, this needs qt6-full's captured destdir manually rsync'd onto the build VM's live $LFS (/opt/qt6-full) before `engine.cli build x2goclient`, then removed after -- qt6-full is itself ship_in_iso=false so the engine never stages it automatically. Compile+link+GUI verified against Qt 6.11.2: on the LinuxDoors test domain the Session-preferences dialog and main window render natively (screenshot). /usr/bin/x2goclient is a wrapper (sets LD_LIBRARY_PATH=/opt/qt6-full/lib) around /usr/lib/x2goclient/x2goclient, with a qt.conf ([Paths] Prefix=/opt/qt6-full) beside the real binary for the plugin/platform paths -- so it runs with no env setup. Remaining: real translations (English-only now); a GUI click-through of an actual server connection.