harkaq: declarar deps medidas por el kernel (cosecha automática)

Cosecha desatendida de la campaña harkaq. Cada dep de acá la denunció el audit de
Landlock en un build real: el kernel vio al build usarla sin declararla, y el
store del hub confirma qué artefacto la provee (deuda DECLARABLE, §4.5).

Recetas:gettext-tiny giflib git gnupg gperf gzip htop iproute2 jq kbd libassuan libcap libevent libffi libgcrypt libgpg-error libksba libnl libpng libsass libsodium libssh2 libudev-zero libusb libwebp libxml2 libyaml linux-generic linux-headers linux-metal linux-pam linux lz4 mandoc mtools musl nano npth openssh openssl parted pciutils pcre2 pigz procps-ng python3 readline rsync samurai ca-certificates curl doas dosfstools e2fsprogs fontconfig freetype

No se tocó ninguna receta con deuda IRREDUCIBLE: declarar algo que el store no
provee rompería el build en vez de arreglarlo. Esas van a tandas/needs-review-harkaq.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

recipes/ca-certificates.toml

@@ -20,7 +20,7 @@ flags    = []
 # (`-lcrypto`). El resto del build (mk-ca-bundle.pl → cert.pem → split-ca-bundle.sh) usa
 # el perl + coreutils del rootfs; no requiere el CLI de openssl.
 [deps]
-build = ["openssl"]
+build = ["openssl", "perl"]
 
 [build.phases]
 # de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):

recipes/curl.toml

@@ -29,4 +29,4 @@ compile = 'make'
 install = 'make DESTDIR=/out install'
 
 [deps]
-build = ["openssl", "zlib"]
+build = ["openssl", "zlib", "perl"]

recipes/doas.toml

@@ -42,4 +42,4 @@ _abuild_phase
 '''
 
 [deps]
-build = ["bison"]
+build = ["bison", "make"]

recipes/dosfstools.toml

@@ -43,4 +43,4 @@ _abuild_phase
 '''
 
 [deps]
-build = ["linux-headers"]
+build = ["linux-headers", "busybox", "make"]

recipes/e2fsprogs.toml

@@ -59,4 +59,4 @@ _abuild_phase
 '''
 
 [deps]
-build = ["linux-headers"]
+build = ["linux-headers", "busybox", "pkgconf"]

recipes/fontconfig.toml

@@ -15,4 +15,4 @@ install   = "make install DESTDIR=/out"
 # libpng+zlib: freetype se compila --with-png, así que freetype2.pc trae `Requires: libpng`
 # (y libpng.pc → zlib); sin ellos pkg-config no resuelve freetype2 y ./configure aborta.
 [deps]
-build = ["freetype", "expat", "pkgconf", "gperf", "python3", "libpng", "zlib"]
+build = ["freetype", "expat", "pkgconf", "gperf", "python3", "libpng", "zlib", "busybox", "make"]

recipes/freetype.toml

@@ -20,4 +20,4 @@ install   = 'make DESTDIR=/out install'
 
 
 [deps]
-build = ["zlib","libpng"]
+build = ["zlib", "libpng", "make"]

recipes/gettext-tiny.toml

@@ -19,4 +19,4 @@ compile   = "make -j4 LIBINTL=MUSL CC='zig cc'"
 install   = "make install LIBINTL=MUSL prefix=/usr DESTDIR=/out"
 
 [deps]
-build = []
+build = ["make"]

recipes/giflib.toml

@@ -35,4 +35,4 @@ _abuild_phase
 
 # xmlto era dep espuria del import (solo docs, ya desactivadas por dont-build-html-pages-images.patch).
 [deps]
-build = []
+build = ["make"]

recipes/git.toml

@@ -45,4 +45,4 @@ make prefix=/usr DESTDIR="/out" CC="${CC:-cc}" \
 # depends de runtime de Alpine (NO build-deps): perl
 
 [deps]
-build = ["zlib", "openssl", "curl", "pcre2", "linux-headers"]
+build = ["zlib", "openssl", "curl", "pcre2", "linux-headers", "perl"]

recipes/gnupg.toml

@@ -57,4 +57,4 @@ rm -f usr/bin/gpgscm
 '''
 
 [deps]
-build = ["libgpg-error", "libgcrypt", "libassuan", "libksba", "npth", "zlib", "linux-headers", "pkgconf"]
+build = ["libgpg-error", "libgcrypt", "libassuan", "libksba", "npth", "zlib", "linux-headers", "pkgconf", "make"]

recipes/gperf.toml

@@ -8,6 +8,9 @@ sha256  = "588546b945bba4b70b6a3a616e80b4ab466e3f33024a352fc2198112cdbb3ae2"
 compiler = "zig-cc"
 target   = "x86_64-linux-musl"
 link     = "static"
+[deps]
+build = ["busybox", "make"]
+
 [build.phases]
 configure = "CXXFLAGS=\"$CXXFLAGS -std=c++14\" ./configure --prefix=/usr"
 compile   = "make"

recipes/gzip.toml

@@ -16,6 +16,9 @@ target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
 
+[deps]
+build = ["make"]
+
 [build.phases]
 # de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
 compile = '''

recipes/htop.toml

@@ -29,4 +29,4 @@ compile   = "make -j\"$(nproc)\""
 install   = "make DESTDIR=/out install"
 
 [deps]
-build = ["ncurses", "linux-headers"]
+build = ["ncurses", "linux-headers", "make"]

recipes/iproute2.toml

@@ -39,4 +39,4 @@ _abuild_phase
 '''
 
 [deps]
-build = ["linux-headers", "bison", "flex"]
+build = ["linux-headers", "bison", "flex", "make", "pkgconf"]

recipes/jq.toml

@@ -41,4 +41,4 @@ compile   = "make LDFLAGS=-all-static -j\"$(nproc)\""
 install   = "make DESTDIR=/out prefix=/usr LDFLAGS=-all-static install"
 
 [deps]
-build = ["oniguruma"]
+build = ["oniguruma", "busybox", "make"]

recipes/kbd.toml

@@ -59,4 +59,4 @@ ln -s openvt "/out"/usr/bin/open
 # deps de Alpine remapeadas al catálogo canónico. AUSENTES quitadas: ckbcomp/perl,
 # linux-pam, xkeyboard-config. flex compila el parser de keymaps (analyze.l).
 [deps]
-build = ["flex", "linux-headers"]
+build = ["flex", "linux-headers", "make", "pkgconf"]

recipes/libassuan.toml

@@ -19,4 +19,4 @@ compile   = 'make'
 install   = 'make DESTDIR=/out install'
 
 [deps]
-build = ["libgpg-error", "linux-headers", "pkgconf"]
+build = ["libgpg-error", "linux-headers", "pkgconf", "make"]

recipes/libcap.toml

@@ -28,6 +28,9 @@ compiler = "zig-cc"
 target   = "x86_64-linux-musl"
 link     = "static"
 
+[deps]
+build = ["make"]
+
 [build.phases]
 # El árbol de libcap detecta como BuildSys::Make ⇒ el compile/install por defecto no pasa los
 # overrides de toolchain ni las flags GOLANG/PAM. Override explícito de ambas fases.

recipes/libevent.toml

@@ -12,6 +12,9 @@ target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
 
+[deps]
+build = ["make"]
+
 [build.phases]
 configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-shared --enable-static --disable-samples --disable-libevent-regress --disable-openssl'
 compile   = 'make'

recipes/libffi.toml

@@ -13,6 +13,9 @@ compiler = "gcc"
 target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
+[deps]
+build = ["make"]
+
 [build.phases]
 configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-shared --enable-static --with-pic --disable-exec-static-tramp'
 compile   = 'make'

recipes/libgcrypt.toml

@@ -19,4 +19,4 @@ install   = 'make DESTDIR=/out install'
 
 
 [deps]
-build = ["libgpg-error"]
+build = ["libgpg-error", "make"]

recipes/libgpg-error.toml

@@ -12,6 +12,9 @@ target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
 
+[deps]
+build = ["make"]
+
 [build.phases]
 configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-shared --enable-static --disable-doc --disable-tests --enable-install-gpg-error-config'
 compile   = 'make'

recipes/libksba.toml

@@ -18,4 +18,4 @@ compile   = 'make'
 install   = 'make DESTDIR=/out install'
 
 [deps]
-build = ["libgpg-error", "linux-headers", "pkgconf"]
+build = ["libgpg-error", "linux-headers", "pkgconf", "make"]

recipes/libnl.toml

@@ -23,7 +23,7 @@ link     = "static"
 
 [deps]
 # libnl 3.11 regenera sus parsers netlink ⇒ flex (lexer) + bison (parser) + m4 (bison lo invoca).
-build = ["flex", "bison", "m4"]
+build = ["flex", "bison", "m4", "busybox", "make"]
 
 [build.phases]
 configure = "./configure --build=$CBUILD --host=$CHOST --prefix=/usr --libdir=/usr/lib --disable-shared --enable-static --disable-cli"

recipes/libpng.toml

@@ -15,4 +15,4 @@ configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-s
 compile   = 'make'
 install   = 'make DESTDIR=/out install'
 [deps]
-build = ["zlib"]
+build = ["zlib", "make"]

recipes/libsass.toml

@@ -18,4 +18,4 @@ compile   = "make -j4 BUILD=static CC='zig cc' CXX='zig c++' lib/libsass.a"
 install   = "mkdir -p /out/usr/lib /out/usr/include && cp lib/libsass.a /out/usr/lib/ && cp -r include/* /out/usr/include/"
 
 [deps]
-build = []
+build = ["make"]

recipes/libsodium.toml

@@ -10,6 +10,9 @@ compiler = "gcc"
 target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
+[deps]
+build = ["make"]
+
 [build.phases]
 configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-shared --enable-static'
 compile   = 'make'

recipes/libssh2.toml

@@ -15,4 +15,4 @@ configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-s
 compile   = 'make'
 install   = 'make DESTDIR=/out install'
 [deps]
-build = ["openssl", "zlib"]
+build = ["openssl", "zlib", "perl"]

recipes/libudev-zero.toml

@@ -20,4 +20,4 @@ compile = 'make PREFIX=/usr'
 install = 'make PREFIX=/usr DESTDIR=/out install install-pkgconfig'
 
 [deps]
-build = ["pkgconf"]
+build = ["pkgconf", "make"]

recipes/libusb.toml

@@ -38,4 +38,4 @@ make DESTDIR="/out" install
 '''
 
 [deps]
-build = ["linux-headers"]
+build = ["linux-headers", "busybox", "make"]

recipes/libwebp.toml

@@ -44,4 +44,4 @@ _abuild_phase
 '''
 
 [deps]
-build = ["giflib", "libjpeg-turbo", "libpng"]
+build = ["giflib", "libjpeg-turbo", "libpng", "make"]

recipes/libxml2.toml

@@ -21,6 +21,9 @@ flags    = []
 
 # configure EXPLÍCITO: si se deja vacío, la heurística del lab inyecta su propio ./configure
 # minimal (defaults → exige python-3.12) que corre antes y aborta. Definirlo lo desactiva.
+[deps]
+build = ["make"]
+
 [build.phases]
 configure = '''
 ./configure \

recipes/libyaml.toml

@@ -10,6 +10,9 @@ compiler = "gcc"
 target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
+[deps]
+build = ["make"]
+
 [build.phases]
 configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-shared --enable-static'
 compile   = 'make'

recipes/linux-generic.toml

@@ -31,7 +31,7 @@ target   = "x86_64-linux-musl"
 link     = "dynamic"
 
 [deps]
-build = ["flex", "bison", "m4", "openssl", "elfutils"]
+build = ["flex", "bison", "m4", "openssl", "elfutils", "busybox", "make"]
 
 [build.phases]
 configure = """

recipes/linux-headers.toml

@@ -45,6 +45,9 @@ compiler = "zig-cc"
 target   = "x86_64-linux-musl"
 link     = "static"
 
+[deps]
+build = ["make"]
+
 [build.phases]
 # El árbol del kernel detecta como BuildSys::Make ⇒ el default de compile sería `make -j$(nproc)`,
 # que construiría el kernel ENTERO. No queremos eso: los headers no necesitan compilarse ni config.

recipes/linux-metal.toml

@@ -55,7 +55,7 @@ target   = "x86_64-linux-musl"
 link     = "dynamic"
 
 [deps]
-build = ["flex", "bison", "m4", "openssl", "elfutils"]
+build = ["flex", "bison", "m4", "openssl", "elfutils", "busybox", "make"]
 
 [build.phases]
 configure = """

recipes/linux-pam.toml

@@ -21,4 +21,4 @@ compile   = 'make'
 install   = 'make DESTDIR=/out install'
 
 [deps]
-build = ["flex", "pkgconf"]
+build = ["flex", "pkgconf", "make"]

recipes/linux.toml

@@ -70,7 +70,7 @@ link     = "dynamic"
 # openssl + elfutils de-Alpinizan los build-deps que antes venían de `apk add openssl-dev elfutils-dev`.
 # elfutils.toml construye SÓLO libelf (lo que objtool enlaza) con shims musl (argp/error/libintl/fts/
 # obstack/rawmemchr); ver su cabecera. Todo el camino del kernel es ahora hammer-from-source.
-build = ["flex", "bison", "m4", "openssl", "elfutils"]
+build = ["flex", "bison", "m4", "openssl", "elfutils", "busybox", "make"]
 
 [build.phases]
 configure = """

recipes/lz4.toml

@@ -8,6 +8,9 @@ sha256  = "537512904744b35e232912055ccf8ec66d768639ff3abe5788d90d792ec5f48b"
 compiler = "zig-cc"
 target   = "x86_64-linux-musl"
 link     = "static"
+[deps]
+build = ["make"]
+
 [build.phases]
 compile = "make BUILD_SHARED=no BUILD_STATIC=yes -C lib"
 install = "make -C lib install BUILD_SHARED=no PREFIX=/usr DESTDIR=/out"

recipes/mandoc.toml

@@ -48,4 +48,4 @@ _abuild_phase
 '''
 
 [deps]
-build = ["zlib"]
+build = ["zlib", "make"]

recipes/mtools.toml

@@ -26,6 +26,9 @@ target      = "x86_64-linux-musl"
 link        = "static"
 zig_version = "0.13.0"
 
+[deps]
+build = ["busybox"]
+
 [build.phases]
 configure = "./configure --prefix=/usr --without-x CC='zig cc -mcpu=baseline -target x86_64-linux-musl' LDFLAGS=-static"
 compile   = "make -j\"$(nproc)\""

recipes/musl.toml

@@ -16,6 +16,9 @@ compiler = "zig-cc"
 target   = "x86_64-linux-musl"
 link     = "static"
 
+[deps]
+build = ["make"]
+
 [build.phases]
 # El sandbox exporta CC="zig cc", DESTDIR=/out y PREFIX=/usr. musl trae su propio `configure`.
 # Sólo estático: los componentes Rust se compilan crt-static + no-PIE (autocontenidos, ET_EXEC sin

recipes/nano.toml

@@ -28,4 +28,4 @@ compile   = "make -j\"$(nproc)\""
 install   = "make DESTDIR=/out install"
 
 [deps]
-build = ["ncurses", "linux-headers"]
+build = ["ncurses", "linux-headers", "make"]

recipes/npth.toml

@@ -16,6 +16,9 @@ target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
 
+[deps]
+build = ["busybox", "make"]
+
 [build.phases]
 configure = '''
 ./configure \

recipes/openssh.toml

@@ -47,7 +47,7 @@ link        = "static"
 zig_version = "0.13.0"
 
 [deps]
-build = ["zlib", "openssl"]
+build = ["zlib", "openssl", "perl"]
 
 [build.phases]
 # --sysconfdir=/etc/ssh: sshd_config/ssh_config viven en /etc/ssh. --with-ssl-dir/--with-zlib=/usr:

recipes/openssl.toml

@@ -30,6 +30,9 @@ link        = "static"
 # que el assembler integrado de zig cc (clang) maneja. Con el zig bueno por-receta gcc no hace falta.
 zig_version = "0.13.0"
 
+[deps]
+build = ["perl"]
+
 [build.phases]
 configure = "./Configure linux-x86_64 --prefix=/usr --libdir=lib no-shared no-docs no-tests no-apps"
 compile   = "make -j\"$(nproc)\" build_libs"

recipes/parted.toml

@@ -52,4 +52,4 @@ make DESTDIR="/out" install
 # lvm2 (device-mapper) ausente y opcional → --disable-device-mapper. libuuid real vía util-linux
 # (dep de build); pkgconf resuelve uuid.pc. bash/ncurses/readline innecesarios al binario estático.
 [deps]
-build = ["util-linux", "linux-headers", "pkgconf"]
+build = ["util-linux", "linux-headers", "pkgconf", "busybox", "make"]

recipes/pciutils.toml

@@ -45,4 +45,4 @@ _abuild_phase
 # depends de runtime de Alpine (NO build-deps): hwdata-pci
 
 [deps]
-build = ["linux-headers"]
+build = ["linux-headers", "make"]

recipes/pcre2.toml

@@ -31,4 +31,4 @@ make
 install = 'make DESTDIR=/out install'
 
 [deps]
-build = ["zlib"]
+build = ["zlib", "make"]

recipes/pigz.toml

@@ -14,4 +14,4 @@ compile = 'make pigz CC=gcc CFLAGS="-O2 -I/usr/include" LDFLAGS="-static -no-pie
 install = 'mkdir -p /out/usr/bin && cp pigz /out/usr/bin/pigz && ln -sf pigz /out/usr/bin/unpigz'
 
 [deps]
-build = ["zlib"]
+build = ["zlib", "make"]

recipes/procps-ng.toml

@@ -63,4 +63,4 @@ ln -sf pgrep "/out"/bin/pkill 2>/dev/null || true
 '''
 
 [deps]
-build = ["ncurses", "linux-headers", "pkgconf"]
+build = ["ncurses", "linux-headers", "pkgconf", "make"]

recipes/python3.toml

@@ -36,7 +36,7 @@ link        = "dynamic"
 zig_version = "0.13.0"
 
 [deps]
-build = ["zlib"]
+build = ["zlib", "busybox", "pkgconf"]
 
 [build.phases]
 configure = "./configure --prefix=/usr --without-ensurepip --disable-test-modules --with-ensurepip=no CFLAGS=\"-Wno-error=date-time\""

recipes/readline.toml

@@ -13,4 +13,4 @@ configure = "./configure --prefix=/usr --disable-shared --enable-static --with-c
 compile   = "make"
 install   = "make install DESTDIR=/out"
 [deps]
-build = ["ncurses"]
+build = ["ncurses", "busybox", "make"]

recipes/rsync.toml

@@ -54,4 +54,4 @@ make DESTDIR="/out" install
 # depends de runtime de Alpine (NO build-deps): python3
 
 [deps]
-build = ["zlib", "linux-headers"]
+build = ["zlib", "linux-headers", "busybox"]

recipes/samurai.toml

@@ -15,6 +15,9 @@ target      = "x86_64-linux-musl"
 link        = "static"
 zig_version = "0.13.0"
 
+[deps]
+build = ["make"]
+
 [build.phases]
 compile = 'make CFLAGS="-O2"'
 install = '''

scripts/farm/harvest-harkaq.sh

@@ -74,6 +74,21 @@ for v in "$VERD"/*.verdicts; do
     fi
 done
 
+# Recoger también las recetas editadas por un ciclo ANTERIOR que no llegó a commitear (el proceso
+# murió, SIGPIPE, la máquina se apagó). Sin esto quedan huérfanas para siempre: al re-correr,
+# add-deps dice "ya estaban declaradas", `tocadas` sale vacío y nadie las commitea nunca. Pasó en
+# el primer ciclo real: 13 recetas editadas y sin committear. Se filtra por `recipes/*.toml` y por
+# que el diff SÓLO toque la línea `build = [...]`, para no arrastrar trabajo de otro agente.
+for f in $(git diff --name-only -- 'recipes/*.toml' 2>/dev/null); do
+    case " $tocadas " in *" $f "*) continue ;; esac
+    if git diff -U0 -- "$f" | grep -E '^[-+]' | grep -vE '^(---|\+\+\+)' | grep -qvE '^[-+]\s*(build\s*=|\[deps\])'; then
+        echo "   ·· $f — modificado con algo que no es `[deps].build`: NO lo toco (¿otro agente?)"
+    else
+        tocadas="$tocadas $f"
+        echo "   ↻ $f — pendiente de un ciclo anterior, se commitea ahora"
+    fi
+done
+
 if [ -n "$tocadas" ]; then
     # `git add` EXPLÍCITO por rutas: el repo lo comparte otro agente (cola gráfica/Go).
     # shellcheck disable=SC2086