Etapa G: fuel-4 — buffer de cola para el VPS tras recuperar conexión

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-25 10:52:14 -04:00
parent 75cb4d5132
commit 7d36e12edf
20 changed files with 743 additions and 0 deletions
@@ -0,0 +1,39 @@
+From 91360acc9f2cd3295fbeff03b448fab912426325 Mon Sep 17 00:00:00 2001
+From: TristanInSec <tristan.mtn@gmail.com>
+Date: Wed, 15 Apr 2026 14:51:08 -0400
+Subject: [PATCH] packet: check `_libssh2_get_string()` return in `EXT_INFO`
+ handler
+
+The `SSH_MSG_EXT_INFO` handler discards the return values from
+`_libssh2_get_string()` when parsing extension name/value pairs. When
+the buffer is exhausted before all claimed extensions are parsed,
+the loop continues with no-op iterations until `nr_extensions` reaches
+zero.
+
+The `nr_extensions >= 1024` cap limits the worst case, but the loop
+should still break on parse failure for correctness and consistency
+with other parsers in this file (e.g. `SSH_MSG_CHANNEL_OPEN`,
+`SSH_MSG_KEXINIT`) that check `_libssh2_get_string()` return values.
+
+Closes #1864
+---
+ src/packet.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index 6da14e9f..ebaddae5 100644
+--- a/src/packet.c
+++ b/src/packet.c
+@@ -868,8 +868,10 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+ 
+                     nr_extensions -= 1;
+ 
+-                    _libssh2_get_string(&buf, &name, &name_len);
+-                    _libssh2_get_string(&buf, &value, &value_len);
+                    if(_libssh2_get_string(&buf, &name, &name_len))
+                        break;
+                    if(_libssh2_get_string(&buf, &value, &value_len))
+                        break;
+ 
+                     if(name && value) {
+                         _libssh2_debug((session,
@@ -0,0 +1,34 @@
+From 63e27b6855f2d8484379ad4b128680561b84e957 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Fri, 12 Jun 2026 15:57:44 -0700
+Subject: [PATCH] transport.c: Additional boundary checks for packet length
+ (#2052)
+
+Add additional bounds checking on packet length to prevent OOB write.
+
+Credit: [TristanInSec](https://github.com/TristanInSec)
+
+Cherry-picked from 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8.
+Co-authored-by: LN Liberda <lauren@selfisekai.rocks>
+---
+ src/transport.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/transport.c b/src/transport.c
+index e1120656..d147505b 100644
+--- a/src/transport.c
+++ b/src/transport.c
+@@ -639,8 +639,12 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session)
+                 total_num = 4;
+ 
+                 p->packet_length = _libssh2_ntohu32(block);
+-                if(p->packet_length < 1)
+                if(p->packet_length < 1) {
+                     return LIBSSH2_ERROR_DECRYPT;
+                }
+                else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) {
+                    return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
+                }
+ 
+                 /* total_num may include size field, however due to existing
+                  * logic it needs to be removed after the entire packet is read
@@ -0,0 +1,52 @@
+From 256d04b60d80bf1190e96b0ad1e91b2174d744b1 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Mon, 13 Apr 2026 11:18:25 -0700
+Subject: [PATCH] userauth.c: username_len bounds checking (#1858)
+
+Return errors when username_len will exceed bounds, fix existing bounds
+check.
+
+Credit:
+[dapickle](https://github.com/dapickle)
+---
+ src/userauth.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/src/userauth.c b/src/userauth.c
+index f8e02651c4..43d9ab9b9d 100644
+--- a/src/userauth.c
+++ b/src/userauth.c
+@@ -80,6 +80,12 @@ static char *userauth_list(LIBSSH2_SESSION *session, const char *username,
+         memset(&session->userauth_list_packet_requirev_state, 0,
+                sizeof(session->userauth_list_packet_requirev_state));
+ 
+        if(username_len > UINT32_MAX - 27) {
+            _libssh2_error(session, LIBSSH2_ERROR_PROTO,
+                           "username_len out of bounds");
+            return NULL;
+        }
+
+         session->userauth_list_data_len = username_len + 27;
+ 
+         if(session->userauth_list_data) {
+@@ -316,6 +322,11 @@ userauth_password(LIBSSH2_SESSION *session,
+          * 40 = packet_type(1) + username_len(4) + service_len(4) +
+          * service(14)"ssh-connection" + method_len(4) + method(8)"password" +
+          * chgpwdbool(1) + password_len(4) */
+        if(username_len > UINT32_MAX - 40) {
+            return _libssh2_error(session, LIBSSH2_ERROR_PROTO,
+                                  "username_len out of bounds");
+        }
+
+         session->userauth_pswd_data_len = username_len + 40;
+ 
+         session->userauth_pswd_data0 =
+@@ -456,7 +467,7 @@ userauth_password(LIBSSH2_SESSION *session,
+                         }
+ 
+                         /* basic data_len + newpw_len(4) */
+-                        if(username_len + password_len + 44 <= UINT_MAX) {
+                        if(username_len <= UINT32_MAX - password_len - 44) {
+                             session->userauth_pswd_data_len =
+                                 username_len + password_len + 44;
+                             s = session->userauth_pswd_data =
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "bob"
+version = "4.1.7"
+
+[source]
+repo   = "https://github.com/MordechaiHadad/bob"
+commit = "4b385e5016bb59847dbf0111a1ac6be802101c5b"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = ["--bin", "bob"]
+
+[build.phases]
+install = "mkdir -p /out/usr/bin && cp target/release/bob /out/usr/bin/bob"
@@ -0,0 +1,175 @@
+Ripped from Mandrake.
+
+http://bugs.gentoo.org/show_bug.cgi?id=82192
+
+--- bzip2-1.0.2.org/bzip2.1
+++ bzip2-1.0.2/bzip2.1
+@@ -235,6 +235,10 @@
+ Suppress non-essential warning messages.  Messages pertaining to
+ I/O errors and other critical events will not be suppressed.
+ .TP
+.B \-p --show-progress
+Show percentage of input-file done and while compressing show the percentage
+of the original file the new file is.
+.TP
+ .B \-v --verbose
+ Verbose mode -- show the compression ratio for each file processed.
+ Further \-v's increase the verbosity level, spewing out lots of
+--- bzip2-1.0.2.org/bzip2.c
+++ bzip2-1.0.2/bzip2.c
+@@ -145,6 +145,7 @@
+ #include <signal.h>
+ #include <math.h>
+ #include <errno.h>
+#include <time.h>
+ #include <ctype.h>
+ #include "bzlib.h"
+ 
+@@ -301,6 +302,7 @@
+ Char    progNameReally[FILE_NAME_LEN];
+ FILE    *outputHandleJustInCase;
+ Int32   workFactor;
+Char	showProgress;
+ 
+ static void    panic                 ( Char* )   NORETURN;
+ static void    ioError               ( void )    NORETURN;
+@@ -425,6 +427,12 @@
+    UInt32  nbytes_in_lo32, nbytes_in_hi32;
+    UInt32  nbytes_out_lo32, nbytes_out_hi32;
+    Int32   bzerr, bzerr_dummy, ret;
+   double  fileSize = 0; /* initialized to make the compiler stop crying */
+                         /* double because big files might otherwhise give
+                          * overflows. not long long since not all compilers
+                          * support that one
+                          */
+   time_t  startTime, currentTime;
+ 
+    SET_BINARY_MODE(stream);
+    SET_BINARY_MODE(zStream);
+@@ -432,12 +440,21 @@
+    if (ferror(stream)) goto errhandler_io;
+    if (ferror(zStream)) goto errhandler_io;
+ 
+   if ((srcMode == SM_F2F || srcMode == SM_F2O) && showProgress == True) {
+      (void)fseek(stream, 0, SEEK_END);
+      fileSize = (double)ftell(stream);
+      rewind(stream);
+      if (verbosity >= 1)
+         fprintf(stderr, "Input-file size: %ld\n", (long)fileSize);
+   }
+
+    bzf = BZ2_bzWriteOpen ( &bzerr, zStream, 
+                            blockSize100k, verbosity, workFactor );   
+    if (bzerr != BZ_OK) goto errhandler;
+ 
+    if (verbosity >= 2) fprintf ( stderr, "\n" );
+ 
+   time(&startTime);
+    while (True) {
+ 
+       if (myfeof(stream)) break;
+@@ -446,13 +463,32 @@
+       if (nIbuf > 0) BZ2_bzWrite ( &bzerr, bzf, (void*)ibuf, nIbuf );
+       if (bzerr != BZ_OK) goto errhandler;
+ 
+      if ((srcMode == SM_F2F || srcMode == SM_F2O) && showProgress == True)
+      {
+         time(&currentTime);
+
+         if ((currentTime - startTime) > 1) { /* show progress every 2 seconds */
+            double curInPos = (double)ftell(stream);
+            double curOutPos = (double)ftell(zStream);
+
+            startTime = currentTime;
+
+            fprintf(stderr, "%.2f%% done", (curInPos * 100.0) / fileSize);
+            if (srcMode == SM_F2F)
+            {
+               fprintf(stderr, ", new size: %.2f%%", (curOutPos * 100.0) / curInPos);
+            }
+
+            fprintf(stderr, "    \r");
+         }
+      }
+    }
+ 
+    BZ2_bzWriteClose64 ( &bzerr, bzf, 0, 
+                         &nbytes_in_lo32, &nbytes_in_hi32,
+                         &nbytes_out_lo32, &nbytes_out_hi32 );
+    if (bzerr != BZ_OK) goto errhandler;
+-
+   
+    if (ferror(zStream)) goto errhandler_io;
+    ret = fflush ( zStream );
+    if (ret == EOF) goto errhandler_io;
+@@ -526,6 +562,8 @@
+    UChar   unused[BZ_MAX_UNUSED];
+    Int32   nUnused;
+    UChar*  unusedTmp;
+   double  fileSize = 0; /* initialized to make the compiler stop crying */
+   time_t  startTime, currentTime;
+ 
+    nUnused = 0;
+    streamNo = 0;
+@@ -533,9 +571,19 @@
+    SET_BINARY_MODE(stream);
+    SET_BINARY_MODE(zStream);
+ 
+   if ((srcMode == SM_F2F || srcMode == SM_F2O) && showProgress == True) {
+      long dummy = ftell(zStream);
+      (void)fseek(zStream, 0, SEEK_END);
+      fileSize = (double)ftell(zStream);
+      (void)fseek(zStream, dummy, SEEK_SET);
+      if (verbosity >= 1)
+         fprintf(stderr, "Input-file size: %ld\n", (long)fileSize);
+   }
+
+    if (ferror(stream)) goto errhandler_io;
+    if (ferror(zStream)) goto errhandler_io;
+ 
+   time(&startTime);
+    while (True) {
+ 
+       bzf = BZ2_bzReadOpen ( 
+@@ -551,6 +599,17 @@
+          if ((bzerr == BZ_OK || bzerr == BZ_STREAM_END) && nread > 0)
+             fwrite ( obuf, sizeof(UChar), nread, stream );
+          if (ferror(stream)) goto errhandler_io;
+
+         if ((srcMode == SM_F2F || srcMode == SM_F2O) && showProgress == True) {
+            time(&currentTime);
+            if ((currentTime - startTime) >= 2)
+            {
+               double curInPos = (double)ftell(zStream);
+               startTime = currentTime;
+
+               fprintf(stderr, "%.2f%% done\r", (curInPos * 100.0) / fileSize);
+            }
+         }
+       }
+       if (bzerr != BZ_STREAM_END) goto errhandler;
+ 
+@@ -1872,6 +1931,7 @@
+    deleteOutputOnInterrupt = False;
+    exitValue               = 0;
+    i = j = 0; /* avoid bogus warning from egcs-1.1.X */
+   showProgress            = False;
+ 
+    /*-- Set up signal handlers for mem access errors --*/
+    signal (SIGSEGV, mySIGSEGVorSIGBUScatcher);
+@@ -1949,6 +2009,7 @@
+                case 'k': keepInputFiles   = True; break;
+                case 's': smallMode        = True; break;
+                case 'q': noisy            = False; break;
+               case 'p': showProgress     = True; break;
+                case '1': blockSize100k    = 1; break;
+                case '2': blockSize100k    = 2; break;
+                case '3': blockSize100k    = 3; break;
+@@ -1985,6 +2046,7 @@
+       if (ISFLAG("--keep"))              keepInputFiles   = True;    else
+       if (ISFLAG("--small"))             smallMode        = True;    else
+       if (ISFLAG("--quiet"))             noisy            = False;   else
+      if (ISFLAG("--show-progress"))     showProgress     = True;    else
+       if (ISFLAG("--version"))           license();                  else
+       if (ISFLAG("--license"))           license();                  else
+       if (ISFLAG("--exponential"))       workFactor = 1;             else 
@@ -0,0 +1,9 @@
+--- ./Makefile
+++ ./Makefile
+@@ -23,5 +23,5 @@
+       bzlib.o
+ 
+-all: libbz2.a bzip2 bzip2recover test
+all: libbz2.a bzip2 bzip2recover
+ 
+ bzip2: libbz2.a bzip2.o
@@ -0,0 +1,25 @@
+--- ./Makefile
+++ ./Makefile
+@@ -18,10 +18,9 @@
+ CC=gcc
+ AR=ar
+ RANLIB=ranlib
+-LDFLAGS=
+ 
+ BIGFILES=-D_FILE_OFFSET_BITS=64
+-CFLAGS=-Wall -Winline -O2 -g $(BIGFILES)
+CFLAGS+=-Wall -Winline $(BIGFILES) $(CPPFLAGS) -O2
+ 
+ # Where you want it installed when you do 'make install'
+ PREFIX=/usr/local
+--- ./Makefile-libbz2_so
+++ ./Makefile-libbz2_so
+@@ -24,7 +24,7 @@
+ SHELL=/bin/sh
+ CC=gcc
+ BIGFILES=-D_FILE_OFFSET_BITS=64
+-CFLAGS=-fpic -fPIC -Wall -Winline -O2 -g $(BIGFILES)
+CFLAGS+=-fpic -fPIC -Wall -Winline $(BIGFILES) $(CPPFLAGS) -O2
+ 
+ OBJS= blocksort.o  \
+       huffman.o    \
@@ -0,0 +1,12 @@
+http://bugs.gentoo.org/172986
+
+--- bzip2-1.0.4/Makefile
+++ bzip2-1.0.4/Makefile
+@@ -85,4 +85,7 @@
+ 	cp -f bzip2.1 $(PREFIX)/share/man/man1
+ 	chmod a+r $(PREFIX)/share/man/man1/bzip2.1
+	ln -s bzip2.1 $(PREFIX)/share/man/man1/bunzip2.1
+	ln -s bzip2.1 $(PREFIX)/share/man/man1/bzcat.1
+	ln -s bzip2.1 $(PREFIX)/share/man/man1/bzip2recover.1
+ 	cp -f bzlib.h $(PREFIX)/include
+ 	chmod a+r $(PREFIX)/include/bzlib.h
@@ -0,0 +1,22 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "dotter"
+version = "0.13.4"
+
+[source]
+repo   = "https://github.com/SuperCuber/dotter"
+commit = "1829da92a0630b2b8e246f37598877b1c3ee1f89"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = ["--bin", "dotter"]
+
+[build.phases]
+install = "mkdir -p /out/usr/bin && cp target/release/dotter /out/usr/bin/dotter"
+
+# buildInputs de nix (NO deps de hammer — cargo vendorea; backend Rust por
+# defecto). Si algún sys-crate C falla, adaptá per-paquete (patch/feature): which
@@ -0,0 +1,16 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "apache-felix"
+version = "7.0.5"
+
+[source]
+tarball = "https://dlcdn.apache.org/felix/org.apache.felix.main.distribution-7.0.5.tar.gz"
+sha256  = "37d99b908ccc90c57644b38dbf5e448a8b09c4c53d88426fc0f5846ae3c811ef"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
@@ -0,0 +1,80 @@
+From 5805151cffccc087942b9dd8d7ac10ca5f4f80a8 Mon Sep 17 00:00:00 2001
+From: lapla <me@lapla.dev>
+Date: Tue, 20 Jan 2026 18:47:13 +0900
+Subject: [PATCH] fix: Resolve weak undefined symbols to zero in read-only
+ sections (#1474)
+
+#1472
+
+When a weak undefined symbol is referenced from a read-only section via
+an absolute relocation, the resolved value should be 0, not the PLT
+entry address.
+---
+ libwild/src/elf_writer.rs               |  6 ++++++
+ wild/tests/integration_tests.rs         |  3 ++-
+ wild/tests/sources/undefined-weak-sym.c | 25 +++++++++++++++++++++++++
+ 3 files changed, 33 insertions(+), 1 deletion(-)
+ create mode 100644 wild/tests/sources/undefined-weak-sym.c
+
+diff --git a/libwild/src/elf_writer.rs b/libwild/src/elf_writer.rs
+index 2923bc9e9..026636f0d 100644
+--- a/libwild/src/elf_writer.rs
+++ b/libwild/src/elf_writer.rs
+@@ -2574,6 +2574,12 @@ fn write_absolute_relocation<A: Arch>(
+             &layout.merged_strings,
+             &layout.merged_string_start_addresses,
+         )
+    } else if resolution.flags.is_dynamic()
+        && resolution.flags.is_absolute()
+        && !section_info.is_writable
+    {
+        // Weak undefined symbol referenced from a read-only section. Fill in as zero.
+        Ok(0)
+     } else if resolution.flags.is_interposable() && section_info.is_writable {
+         table_writer.write_dynamic_symbol_relocation::<A>(
+             place,
+diff --git a/wild/tests/integration_tests.rs b/wild/tests/integration_tests.rs
+index bc4730412..9dd611ba7 100644
+--- a/wild/tests/integration_tests.rs
+++ b/wild/tests/integration_tests.rs
+@@ -3320,7 +3320,8 @@ fn integration_test(
+         "wrap-real-only.c",
+         "ifunc-alias.c",
+         "ifunc-address-equality.c",
+-        "stack-size.c"
+        "stack-size.c",
+        "undefined-weak-sym.c"
+     )]
+     program_name: &'static str,
+     #[allow(unused_variables)] setup_symlink: (),
+diff --git a/wild/tests/sources/undefined-weak-sym.c b/wild/tests/sources/undefined-weak-sym.c
+new file mode 100644
+index 000000000..b029ca7e2
+--- /dev/null
+++ b/wild/tests/sources/undefined-weak-sym.c
+@@ -0,0 +1,25 @@
+// A test for #1472.
+
+//#Object:runtime.c
+//#CompArgs:-fno-PIC
+//#Mode:dynamic
+//#Shared:force-dynamic-linking.c
+//#DiffIgnore:section.got
+//#DiffIgnore:.dynamic.DT_NEEDED
+//#DiffIgnore:.dynamic.DT_RELA
+//#DiffIgnore:.dynamic.DT_RELAENT
+//#DiffIgnore:rel.undefined-weak.dynamic.R_X86_64_GLOB_DAT
+
+#include "runtime.h"
+
+#define WEAK __attribute__((weak))
+
+int WEAK foo(void);
+
+void _start(void) {
+  runtime_init();
+  if (foo) {
+    exit_syscall(foo());
+  }
+  exit_syscall(42);
+}
@@ -0,0 +1,39 @@
+diff --git a/configure.ac b/configure.ac
+index 7b6d5b9..d02e16d 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -357,17 +357,21 @@ AC_ARG_ENABLE([arm-neon],
+    [case "$enableval" in
+       no|off)
+          # disable the default enabling on __ARM_NEON__ systems:
+         AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support])
+          AC_DEFINE([PNG_ARM_NEON_OPT], [0],
+                    [Disable ARM Neon optimizations])
+          # Prevent inclusion of the assembler files below:
+          enable_arm_neon=no ;;
+       check)
+         AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support])
+          AC_DEFINE([PNG_ARM_NEON_CHECK_SUPPORTED], [],
+                    [Check for ARM Neon support at run-time]);;
+       api)
+         AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support])
+          AC_DEFINE([PNG_ARM_NEON_API_SUPPORTED], [],
+                    [Turn on ARM Neon optimizations at run-time]);;
+       yes|on)
+         AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support])
+          AC_DEFINE([PNG_ARM_NEON_OPT], [2],
+                    [Enable ARM Neon optimizations])
+          AC_MSG_WARN([--enable-arm-neon: please specify 'check' or 'api', if]
+diff --git a/pngpriv.h b/pngpriv.h
+index 2e426cf..fb521cf 100644
+--- a/pngpriv.h
+++ b/pngpriv.h
+@@ -127,7 +127,7 @@
+     * associated assembler code, pass --enable-arm-neon=no to configure
+     * or put -DPNG_ARM_NEON_OPT=0 in CPPFLAGS.
+     */
+-#  if (defined(__ARM_NEON__) || defined(__ARM_NEON)) && \
+#  if defined(PNG_ARM_NEON) && (defined(__ARM_NEON__) || defined(__ARM_NEON)) && \
+    defined(PNG_ALIGNED_MEMORY_SUPPORTED)
+ #     define PNG_ARM_NEON_OPT 2
+ #  else
@@ -0,0 +1,49 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "rbw"
+version = "1.15.0"
+
+[source]
+tarball = "https://git.tozt.net/rbw/snapshot/rbw-1.15.0.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "8ec109c62ced929db36aca8b828d01c1fe46ca5b6a7970fdf9c1e4566fa8c7873c076fc8e0500ba3afbe6d1fd91d0e84177eac452a7fb9ec86451b8b2e08d2d6"
+sha256  = "660cfa4c727711665bef060046c28dd3924ca1e490fdc058d90d35372b2d2cf6"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+# p521 fails with stack overflow unless stack size is increased
+	export RUST_MIN_STACK=$((16 * 1024 * 1024))
+	cargo auditable build --frozen --release
+
+	target/release/rbw gen-completions bash > rbw.bash
+	target/release/rbw gen-completions fish > rbw.fish
+	target/release/rbw gen-completions zsh > _rbw
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -Dm755 target/release/rbw "/out"/usr/bin/rbw
+	install -Dm755 target/release/rbw-agent "/out"/usr/bin/rbw-agent
+
+	install -Dm644 rbw.bash \
+		"/out"/usr/share/bash-completion/completions/rbw
+	install -Dm644 rbw.fish \
+		"/out"/usr/share/fish/vendor_completions.d/rbw.fish
+	install -Dm644 _rbw \
+		"/out"/usr/share/zsh/site-functions/_rbw
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): pinentry
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "rust-script"
+version = "0.36.0"
+
+[source]
+repo   = "https://github.com/fornwall/rust-script"
+commit = "99d2c790b303c1d75de5cd90499800283e4b9681"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = ["--bin", "rust-script"]
+
+[build.phases]
+install = "mkdir -p /out/usr/bin && cp target/release/rust-script /out/usr/bin/rust-script"
@@ -0,0 +1,23 @@
+diff --git a/Makefile-libbz2_so b/Makefile-libbz2_so
+index fb0f230..2c95a3a 100644
+--- a/Makefile-libbz2_so
+++ b/Makefile-libbz2_so
+@@ -35,13 +35,13 @@ OBJS= blocksort.o  \
+       bzlib.o
+ 
+ all: $(OBJS)
+-	$(CC) -shared -Wl,-soname -Wl,libbz2.so.1.0 -o libbz2.so.1.0.8 $(OBJS)
+	$(CC) -shared -Wl,-soname -Wl,libbz2.so.1 -o libbz2.so.1.0.8 $(OBJS)
+ 	$(CC) $(CFLAGS) -o bzip2-shared bzip2.c libbz2.so.1.0.8
+-	rm -f libbz2.so.1.0
+-	ln -s libbz2.so.1.0.8 libbz2.so.1.0
+	rm -f libbz2.so.1
+	ln -s libbz2.so.1.0.8 libbz2.so.1
+ 
+ clean: 
+-	rm -f $(OBJS) bzip2.o libbz2.so.1.0.8 libbz2.so.1.0 bzip2-shared
+	rm -f $(OBJS) bzip2.o libbz2.so.1.0.8 libbz2.so.1 bzip2-shared
+ 
+ blocksort.o: blocksort.c
+ 	$(CC) $(CFLAGS) -c blocksort.c
+
@@ -0,0 +1,22 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "speedtest-rs"
+version = "0.2.0"
+
+[source]
+repo   = "https://github.com/nelsonjchen/speedtest-rs"
+commit = "3e0c5dbf8613b0a6de196753f2b35f4dae4bd0fb"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = ["--bin", "speedtest-rs"]
+
+[build.phases]
+install = "mkdir -p /out/usr/bin && cp target/release/speedtest-rs /out/usr/bin/speedtest-rs"
+
+# buildInputs de nix (NO deps de hammer — cargo vendorea; backend Rust por
+# defecto). Si algún sys-crate C falla, adaptá per-paquete (patch/feature): openssl
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "toolong"
+version = "1.5.0"
+
+[source]
+repo   = "https://github.com/Textualize/toolong"
+commit = "5aa22ee878026f46d4d265905c4e1df4d37842ae"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["python3", "poetry-core"]
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "tuckr"
+version = "0.13.1"
+
+[source]
+repo   = "https://github.com/RaphGL/Tuckr"
+commit = "352627208663ee01c04c37a4cb23cbc4127506f6"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = ["--bin", "tuckr"]
+
+[build.phases]
+install = "mkdir -p /out/usr/bin && cp target/release/tuckr /out/usr/bin/tuckr"
@@ -0,0 +1,39 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "wild"
+version = "0.8.0"
+
+[source]
+tarball = "https://github.com/davidlattimore/wild/archive/refs/tags/0.8.0.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "dc88b41cdfbbdbff69c4dedf121e30dc5f3543bfab0eb53ebcc35590a200582d2157f752effd0750d9862addd92252dc1e61e60b545a5bb9dcff4a59adcd9217"
+sha256  = "3828028f41c668caf02aa9ffc4dc3bd1a33b4957eb66a7aa015f7c92e4f064ce"
+patches = ["fix-riscv64-test.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+# https://github.com/davidlattimore/wild/blob/main/PACKAGING.md
+	cargo auditable build --frozen --features mimalloc --profile dist
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -Dm 755 target/dist/wild "/out"/usr/bin/wild
+
+	install -Dm 644 LICENSE-APACHE LICENSE-MIT -t "/out"/usr/share/licenses/"wild"/
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): clang
@@ -0,0 +1,31 @@
+# fuel-4 — buffer para el VPS (2026-06-25). Candidatos frescos.
+ffsend
+rbw
+tuckr
+dotter
+rotz
+comtrya
+bob-nvim
+wild
+rust-script
+rmesg
+djin
+punktf
+speedtest-rs
+gptui
+mdcat
+zr
+hgrep
+ast-grep
+gitui
+dua-cli
+silver
+felix
+nu-shell
+zoxide
+choose
+cargo-update
+cargo-deny
+cargo-watch
+cargo-llvm-cov
+toolong