Etapa G: abre la cola C — tmux (corpus 278→279), valida libs base

tmux 3.6b linkea libevent + ncurses hammer-built, estático (-static -lncursesw
-levent_core). Primer consumidor de la cola C que valida el unlock de las 20
libs base. + import c-cola-1 (14 clásicos C: tig/wget/rsync/git/mc/gnupg/…).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

recipes/incoming/0001-include-unistd.patch

@@ -0,0 +1,12 @@
+diff --git a/scd/app.c b/scd/app.c
+index 21230bd..5999c37 100644
+--- a/scd/app.c
++++ b/scd/app.c
+@@ -23,6 +23,7 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <npth.h>
++#include <unistd.h>
+ 
+ #ifndef HAVE_W32_SYSTEM
+ #include <fcntl.h>		/* F_SETFD F_GETFL F_SETFL O_NONBLOCK fcntl(2) */

recipes/incoming/0010-avoid-beta-warning.patch

@@ -0,0 +1,46 @@
+From: Debian GnuPG Maintainers <pkg-gnupg-maint@lists.alioth.debian.org>
+Date: Tue, 14 Apr 2015 10:02:31 -0400
+Subject: avoid-beta-warning
+
+avoid self-describing as a beta
+
+Using autoreconf against the source as distributed in tarball form
+invariably results in a package that thinks it's a "beta" package,
+which produces the "THIS IS A DEVELOPMENT VERSION" warning string.
+
+since we use dh_autoreconf, i need this patch to avoid producing
+builds that announce themselves as DEVELOPMENT VERSIONs.
+
+See discussion at:
+
+ http://lists.gnupg.org/pipermail/gnupg-devel/2014-November/029065.html
+---
+ autogen.sh | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/debian-packaging/avoid-beta-warning.patch
+
+diff --git a/autogen.sh b/autogen.sh
+index b238550..9b86d3f 100755
+--- a/autogen.sh
++++ b/autogen.sh
+@@ -229,7 +229,7 @@ if [ "$myhost" = "find-version" ]; then
+     esac
+ 
+     beta=no
+-    if [ -e .git ]; then
++    if false; then
+       ingit=yes
+       tmp=$(git describe --match "${matchstr1}" --long 2>/dev/null)
+       tmp=$(echo "$tmp" | sed s/^"$package"//)
+@@ -245,8 +245,8 @@ if [ "$myhost" = "find-version" ]; then
+       rvd=$((0x$(echo ${rev} | dd bs=1 count=4 2>/dev/null)))
+     else
+       ingit=no
+-      beta=yes
+-      tmp="-unknown"
++      beta=no
++      tmp=""
+       rev="0000000"
+       rvd="0"
+     fi

recipes/incoming/0020-avoid-regenerating-defsincdate-use-shipped-file.patch

@@ -0,0 +1,41 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Mon, 29 Aug 2016 12:34:42 -0400
+Subject: avoid regenerating defsincdate (use shipped file)
+
+upstream ships doc/defsincdate in its tarballs.  but doc/Makefile.am
+tries to rewrite doc/defsincdate if it notices that any of the files
+have been modified more recently, and it does so assuming that we're
+running from a git repo.
+
+However, we'd rather ship the documents cleanly without regenerating
+defsincdate -- we don't have a git repo available (debian builds from
+upstream tarballs) and any changes to the texinfo files (e.g. from
+debian/patches/) might result in different dates on the files than we
+expect after they're applied by dpkg or quilt or whatever, which makes
+the datestamp unreproducible.
+---
+ doc/Makefile.am | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/debian-packaging/avoid-regenerating-defsincdate-use-shipped-file.patch
+
+diff --git a/doc/Makefile.am b/doc/Makefile.am
+index 2b882c3..6be571b 100644
+--- a/doc/Makefile.am
++++ b/doc/Makefile.am
+@@ -178,15 +178,6 @@ $(myman_pages) gnupg.7 : yat2m-stamp defs.inc
+ 
+ dist-hook: defsincdate
+ 
+-defsincdate: $(gnupg_TEXINFOS)
+-	: >defsincdate ; \
+-	if test -e $(top_srcdir)/.git; then \
+-	  (cd $(srcdir) && git log -1 --format='%ct' \
+-               -- $(gnupg_TEXINFOS) 2>/dev/null) >>defsincdate; \
+-        elif test x"$$SOURCE_DATE_EPOCH" != x; then   \
+-	   echo "$$SOURCE_DATE_EPOCH" >>defsincdate ; \
+-	fi
+-
+ defs.inc : defsincdate Makefile mkdefsinc
+ 	incd="`test -f defsincdate || echo '$(srcdir)/'`defsincdate"; \
+ 	./mkdefsinc -C $(srcdir) --date "`cat $$incd 2>/dev/null`" \

recipes/incoming/0110-avoid-simple-memory-dumps-via-ptrace.patch

@@ -0,0 +1,91 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Tue, 11 Aug 2015 20:28:26 -0400
+Subject: Avoid simple memory dumps via ptrace
+
+This avoids needing to setgid gpg-agent.  It probably doesn't defend
+against all possible attacks, but it defends against one specific (and
+easy) one.  If there are other protections we should do them too.
+
+This will make it slightly harder to debug the agent because the
+normal user won't be able to attach gdb to it directly while it runs.
+
+The remaining options for debugging are:
+
+ * launch the agent from gdb directly
+ * connect gdb to a running agent as the superuser
+
+Upstream bug: https://dev.gnupg.org/T1211
+---
+ agent/gpg-agent.c | 8 ++++++++
+ configure.ac      | 2 +-
+ scd/scdaemon.c    | 9 +++++++++
+ 3 files changed, 18 insertions(+), 1 deletion(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/block-ptrace-on-secret-daemons/Avoid-simple-memory-dumps-via-ptrace.patch
+
+diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
+index 412eb43..1de989b 100644
+--- a/agent/gpg-agent.c
++++ b/agent/gpg-agent.c
+@@ -48,6 +48,9 @@
+ # include <signal.h>
+ #endif
+ #include <npth.h>
++#ifdef HAVE_PRCTL
++# include <sys/prctl.h>
++#endif
+ 
+ #define INCLUDED_BY_MAIN_MODULE 1
+ #define GNUPG_COMMON_NEED_AFLOCAL
+@@ -1095,6 +1098,11 @@ main (int argc, char **argv)
+ 
+   early_system_init ();
+ 
++#if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
++  /* Disable ptrace on Linux without sgid bit */
++  prctl(PR_SET_DUMPABLE, 0);
++#endif
++
+   /* Before we do anything else we save the list of currently open
+      file descriptors and the signal mask.  This info is required to
+      do the exec call properly.  We don't need it on Windows.  */
+diff --git a/configure.ac b/configure.ac
+index 099c6a8..4c9fcee 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1419,7 +1419,7 @@ AC_CHECK_FUNCS([atexit canonicalize_file_name clock_gettime ctermid  \
+                 ftruncate funlockfile getaddrinfo getenv getpagesize \
+                 getpwnam getpwuid getrlimit getrusage gettimeofday   \
+                 gmtime_r inet_ntop inet_pton isascii lstat memicmp   \
+-                memmove memrchr mmap nl_langinfo pipe raise rand     \
++                memmove memrchr mmap nl_langinfo pipe prctl raise rand \
+                 setenv setlocale setrlimit sigaction sigprocmask     \
+                 stat stpcpy strcasecmp strerror strftime stricmp     \
+                 strlwr strncasecmp strpbrk strsep strtol strtoul     \
+diff --git a/scd/scdaemon.c b/scd/scdaemon.c
+index e43769f..2066543 100644
+--- a/scd/scdaemon.c
++++ b/scd/scdaemon.c
+@@ -37,6 +37,9 @@
+ #include <unistd.h>
+ #include <signal.h>
+ #include <npth.h>
++#ifdef HAVE_PRCTL
++# include <sys/prctl.h>
++#endif
+ 
+ #define INCLUDED_BY_MAIN_MODULE 1
+ #define GNUPG_COMMON_NEED_AFLOCAL
+@@ -462,6 +465,12 @@ main (int argc, char **argv )
+   const char *application_priority = NULL;
+ 
+   early_system_init ();
++
++#if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
++  /* Disable ptrace on Linux without sgid bit */
++  prctl(PR_SET_DUMPABLE, 0);
++#endif
++
+   gpgrt_set_strusage (my_strusage);
+   gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
+   /* Please note that we may running SUID(ROOT), so be very CAREFUL

recipes/incoming/0210-dirmngr-hkp-avoid-potential-race-condition-when-some-host-die.patch

@@ -0,0 +1,284 @@
+note: combination of previous 0210+0220
+--
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Sat, 29 Oct 2016 01:25:05 -0400
+Subject: dirmngr: hkp: Avoid potential race condition when some hosts die.
+
+* dirmngr/ks-engine-hkp.c (select_random_host): Use atomic pass
+through the host table instead of risking out-of-bounds write.
+
+--
+
+Multiple threads may write to hosttable[x]->dead while
+select_random_host() is running.  For example, a housekeeping thread
+might clear the ->dead bit on some entries, or another connection to
+dirmngr might manually mark a host as alive.
+
+If one or more hosts are resurrected between the two loops over a
+given table in select_random_host(), then the allocation of tbl might
+not be large enough, resulting in a write past the end of tbl on the
+second loop.
+
+This change collapses the two loops into a single loop to avoid this
+discrepancy: each host's "dead" bit is now only checked once.
+
+As Werner points out, this isn't currently strictly necessary, since
+npth will not switch threads unless a blocking system call is made,
+and no blocking system call is made in these two loops.
+
+However, in a subsequent change in this series, we will call a
+function in this loop, and that function may sometimes write(2), or
+call other functions, which may themselves block.  Keeping this as a
+single-pass loop avoids the need to keep track of what might block and
+what might not.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ dirmngr/ks-engine-hkp.c | 23 ++++++++++-------------
+ 1 file changed, 10 insertions(+), 13 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/dirmngr-idling/dirmngr-hkp-Avoid-potential-race-condition-when-some.patch
+
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Sat, 29 Oct 2016 02:00:50 -0400
+Subject: dirmngr: Avoid need for hkp housekeeping.
+
+* dirmngr/ks-engine-hkp.c (host_is_alive): New function.  Test whether
+host is alive and resurrects it if it has been dead long enough.
+(select_random_host, map_host, ks_hkp_mark_host): Use host_is_alive
+instead of testing hostinfo_t->dead directly.
+(ks_hkp_housekeeping): Remove function, no longer needed.
+* dirmngr/dirmngr.c (housekeeping_thread): Remove call to
+ks_hkp_housekeeping.
+
+--
+
+Rather than resurrecting hosts upon scheduled resurrection times, test
+whether hosts should be resurrected as they're inspected for being
+dead.  This removes the need for explicit housekeeping, and makes host
+resurrections happen "just in time", rather than being clustered on
+HOUSEKEEPING_INTERVAL seconds.
+
+According to 392e068e9f143d41f6350345619543cbcd47380f,
+dns_stuff_housekeeping only works on Windows, so it also isn't
+necessary in debian, but it remains in place for now.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ dirmngr/dirmngr.c       |  3 ---
+ dirmngr/dirmngr.h       |  1 -
+ dirmngr/ks-engine-hkp.c | 72 ++++++++++++++++++++++++-------------------------
+ 3 files changed, 35 insertions(+), 41 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/dirmngr-idling/dirmngr-Avoid-need-for-hkp-housekeeping.patch
+
+diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
+index 977e7dd..5017c3f 100644
+--- a/dirmngr/dirmngr.c
++++ b/dirmngr/dirmngr.c
+@@ -2085,7 +2085,6 @@ housekeeping_thread (void *arg)
+   dirmngr_init_default_ctrl (&ctrlbuf);
+ 
+   dns_stuff_housekeeping ();
+-  ks_hkp_housekeeping (curtime);
+   if (network_activity_seen)
+     {
+       network_activity_seen = 0;
+diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
+index 5292da8..690b37d 100644
+--- a/dirmngr/ks-engine-hkp.c
++++ b/dirmngr/ks-engine-hkp.c
+@@ -221,6 +221,24 @@ host_in_pool_p (hostinfo_t hi, int tblidx)
+   return 0;
+ }
+ 
++static int
++host_is_alive (hostinfo_t hi, time_t curtime)
++{
++  if (!hi)
++    return 0;
++  if (!hi->dead)
++    return 1;
++  if (!hi->died_at)
++    return 0; /* manually marked dead */
++  if (hi->died_at + RESURRECT_INTERVAL <= curtime
++      || hi->died_at > curtime)
++    {
++      hi->dead = 0;
++      log_info ("resurrected host '%s'", hi->name);
++      return 1;
++    }
++  return 0;
++}
+ 
+ /* Select a random host.  Consult HI->pool which indices into the global
+    hosttable.  Returns index into HI->pool or -1 if no host could be
+@@ -228,32 +246,32 @@ host_in_pool_p (hostinfo_t hi, int tblidx)
+ static int
+ select_random_host (hostinfo_t hi)
+ {
+-  int *tbl;
+-  size_t tblsize;
++  int *tbl = NULL;
++  size_t tblsize = 0;
+   int pidx, idx;
++  time_t curtime;
++
++  curtime = gnupg_get_time ();
+ 
+   /* CHECKTHIS();  See */
+   /*                 https://sources.debian.org/patches/gnupg2/2.2.20-1/dirmngr-idling/dirmngr-hkp-Avoid-potential-race-condition-when-some.patch/ */
+ 
+   /* We create a new table so that we randomly select only from
+      currently alive hosts.  */
+-  for (idx = 0, tblsize = 0;
++  for (idx = 0;
+        idx < hi->pool_len && (pidx = hi->pool[idx]) != -1;
+        idx++)
+-    if (hosttable[pidx] && !hosttable[pidx]->dead)
+-      tblsize++;
++    if (hosttable[pidx] && host_is_alive (hosttable[pidx], curtime))
++      {
++        tblsize++;
++        tbl = xtryrealloc(tbl, tblsize * sizeof *tbl);
++        if (!tbl)
++          return -1; /* memory allocation failed! */
++        tbl[tblsize-1] = pidx;
++      }
+   if (!tblsize)
+     return -1; /* No hosts.  */
+ 
+-  tbl = xtrymalloc (tblsize * sizeof *tbl);
+-  if (!tbl)
+-    return -1;
+-  for (idx = 0, tblsize = 0;
+-       idx < hi->pool_len && (pidx = hi->pool[idx]) != -1;
+-       idx++)
+-    if (hosttable[pidx] && !hosttable[pidx]->dead)
+-      tbl[tblsize++] = pidx;
+-
+   if (tblsize == 1)  /* Save a get_uint_nonce.  */
+     pidx = tbl[0];
+   else
+@@ -471,6 +489,7 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
+   int is_pool;
+   int new_hosts = 0;
+   char *cname;
++  time_t curtime;
+ 
+   *r_host = NULL;
+   if (r_httpflags)
+@@ -510,6 +529,7 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
+     }
+   else
+     hi = hosttable[idx];
++  curtime = gnupg_get_time ();
+ 
+   is_pool = hi->pool != NULL;
+ 
+@@ -616,7 +636,7 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
+       if (force_reselect)
+         hi->poolidx = -1;
+       else if (hi->poolidx >= 0 && hi->poolidx < hosttable_size
+-               && hosttable[hi->poolidx] && hosttable[hi->poolidx]->dead)
++               && hosttable[hi->poolidx] && !host_is_alive (hosttable[hi->poolidx], curtime))
+         hi->poolidx = -1;
+ 
+       /* Select a host if needed.  */
+@@ -675,7 +695,7 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
+         return gpg_error_from_syserror ();
+     }
+ 
+-  if (hi->dead)
++  if (!host_is_alive (hi, curtime))
+     {
+       log_error ("host '%s' marked as dead\n", hi->name);
+       if (r_httphost)
+@@ -781,7 +801,8 @@ ks_hkp_mark_host (ctrl_t ctrl, const char *name, int alive)
+ {
+   gpg_error_t err = 0;
+   hostinfo_t hi, hi2;
+-  int idx, idx2, idx3, n;
++  int idx, idx2, idx3, n, is_alive;
++  time_t curtime;
+ 
+   if (!name || !*name || !strcmp (name, "localhost"))
+     return 0;
+@@ -796,13 +817,15 @@ ks_hkp_mark_host (ctrl_t ctrl, const char *name, int alive)
+       goto leave;
+     }
+ 
++  curtime = gnupg_get_time ();
+   hi = hosttable[idx];
+-  if (alive && hi->dead)
++  is_alive = host_is_alive (hi, curtime);
++  if (alive && !is_alive)
+     {
+       hi->dead = 0;
+       err = ks_printf_help (ctrl, "marking '%s' as alive", name);
+     }
+-  else if (!alive && !hi->dead)
++  else if (!alive && is_alive)
+     {
+       hi->dead = 1;
+       hi->died_at = 0; /* Manually set dead.  */
+@@ -836,14 +859,15 @@ ks_hkp_mark_host (ctrl_t ctrl, const char *name, int alive)
+ 
+           hi2 = hosttable[n];
+           if (!hi2)
+-            ;
+-          else if (alive && hi2->dead)
++            continue;
++          is_alive = host_is_alive (hi2, curtime);
++          if (alive && !is_alive)
+             {
+               hi2->dead = 0;
+               err = ks_printf_help (ctrl, "marking '%s' as alive",
+                                     hi2->name);
+             }
+-          else if (!alive && !hi2->dead)
++          else if (!alive && is_alive)
+             {
+               hi2->dead = 1;
+               hi2->died_at = 0; /* Manually set dead. */
+@@ -1149,40 +1173,6 @@ ks_hkp_resolve (ctrl_t ctrl, parsed_uri_t uri)
+ }
+ 
+ 
+-/* Housekeeping function called from the housekeeping thread.  It is
+-   used to mark dead hosts alive so that they may be tried again after
+-   some time.  */
+-void
+-ks_hkp_housekeeping (time_t curtime)
+-{
+-  int idx;
+-  hostinfo_t hi;
+-
+-  if (npth_mutex_lock (&hosttable_lock))
+-    log_fatal ("failed to acquire mutex\n");
+-
+-  for (idx=0; idx < hosttable_size; idx++)
+-    {
+-      hi = hosttable[idx];
+-      if (!hi)
+-        continue;
+-      if (!hi->dead)
+-        continue;
+-      if (!hi->died_at)
+-        continue; /* Do not resurrect manually shot hosts.  */
+-      if (hi->died_at + RESURRECT_INTERVAL <= curtime
+-          || hi->died_at > curtime)
+-        {
+-          hi->dead = 0;
+-          log_info ("resurrected host '%s'", hi->name);
+-        }
+-    }
+-
+-  if (npth_mutex_unlock (&hosttable_lock))
+-    log_fatal ("failed to release mutex\n");
+-}
+-
+-
+ /* Reload (SIGHUP) action for this module.  We mark all host alive
+  * even those which have been manually shot.  */
+ void

recipes/incoming/0230-dirmngr-avoid-automatically-checking-upstream-swdb.patch

@@ -0,0 +1,51 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+From: Jakub Jirutka <jakub@jirutka.cz>
+Date: Sun, 20 Nov 2016 23:09:24 -0500
+Date: Wed, 18 Aug 2021 21:08:20 +0200
+Subject: dirmngr: Avoid automatically checking upstream swdb.
+
+* dirmngr/dirmngr.c (housekeeping_thread): Avoid automatically
+checking upstream's software database.  In Debian, software updates
+should be handled by the distro mechanism, and additional upstream
+checks only confuse the user.
+* doc/dirmngr.texi: document that --allow-version-check does nothing.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ dirmngr/dirmngr.c | 2 --
+ doc/dirmngr.texi  | 7 ++++---
+ 2 files changed, 4 insertions(+), 5 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/dirmngr-idling/dirmngr-Avoid-automatically-checking-upstream-swdb.patch
+
+diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
+index 89eea4e..f26ed63 100644
+--- a/dirmngr/dirmngr.c
++++ b/dirmngr/dirmngr.c
+@@ -1955,8 +1955,6 @@ housekeeping_thread (void *arg)
+   if (network_activity_seen)
+     {
+       network_activity_seen = 0;
+-      if (opt.allow_version_check)
+-        dirmngr_load_swdb (&ctrlbuf, 0);
+       workqueue_run_global_tasks (&ctrlbuf, 1);
+     }
+   else
+diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
+index 843fdbf..84a8d28 100644
+--- a/doc/dirmngr.texi
++++ b/doc/dirmngr.texi
+@@ -291,9 +291,10 @@ Set the size of the queue for pending connections.  The default is 64.
+ @item --allow-version-check
+ @opindex allow-version-check
+ Allow Dirmngr to connect to @code{https://versions.gnupg.org} to get
+-the list of current software versions.  If this option is enabled
+-the list is retrieved in case the local
+-copy does not exist or is older than 5 to 7 days.  See the option
++the list of current software versions.
++On Alpine-packaged versions, this option does nothing since software
++updates should be handled by the distribution.
++See the option
+ @option{--query-swdb} of the command @command{gpgconf} for more
+ details.  Note, that regardless of this option a version check can
+ always be triggered using this command:

recipes/incoming/0330-gpg-default-to-sha512-for-all-signature-types-on-rsa-keys.patch

@@ -0,0 +1,66 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Thu, 7 Sep 2017 18:49:35 -0400
+Subject: gpg: Default to SHA-512 for all signature types on RSA keys.
+
+* g10/main.h (DEFAULT_DIGEST_ALGO): Use SHA512 instead of SHA256 in
+--gnupg mode (leave strict RFC and PGP modes alone).
+* configure.ac: Do not allow disabling sha512.
+* g10/misc.c (map_md_openpgp_to_gcry): Always support SHA512.
+
+--
+
+SHA512 is more performant on most 64-bit platforms than SHA256, and
+offers a better security margin.  It is also widely implemented.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ configure.ac | 2 +-
+ g10/main.h   | 2 +-
+ g10/misc.c   | 5 +----
+ 3 files changed, 3 insertions(+), 6 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/update-defaults/gpg-Default-to-SHA-512-for-all-signature-types-on-RS.patch
+
+diff --git a/configure.ac b/configure.ac
+index c31ae02..f7788b3 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -339,7 +339,7 @@ GNUPG_GPG_DISABLE_ALGO([rmd160],[RIPE-MD160 hash])
+ GNUPG_GPG_DISABLE_ALGO([sha224],[SHA-224 hash])
+ # SHA256 is a MUST algorithm for GnuPG.
+ GNUPG_GPG_DISABLE_ALGO([sha384],[SHA-384 hash])
+-GNUPG_GPG_DISABLE_ALGO([sha512],[SHA-512 hash])
++# SHA512 is a MUST algorithm for GnuPG.
+ 
+ 
+ # Allow disabling of zip support.
+diff --git a/g10/main.h b/g10/main.h
+index b29e23e..0a64a21 100644
+--- a/g10/main.h
++++ b/g10/main.h
+@@ -41,7 +41,7 @@
+ # define DEFAULT_CIPHER_ALGO     CIPHER_ALGO_3DES
+ #endif
+ 
+-#define DEFAULT_DIGEST_ALGO     ((GNUPG)? DIGEST_ALGO_SHA256:DIGEST_ALGO_SHA1)
++#define DEFAULT_DIGEST_ALGO     ((GNUPG)? DIGEST_ALGO_SHA512:DIGEST_ALGO_SHA1)
+ #define DEFAULT_S2K_DIGEST_ALGO  DEFAULT_DIGEST_ALGO
+ #ifdef HAVE_ZIP
+ # define DEFAULT_COMPRESS_ALGO   COMPRESS_ALGO_ZIP
+diff --git a/g10/misc.c b/g10/misc.c
+index 2f4b452..0e6d9d5 100644
+--- a/g10/misc.c
++++ b/g10/misc.c
+@@ -862,11 +862,8 @@ map_md_openpgp_to_gcry (digest_algo_t algo)
+     case DIGEST_ALGO_SHA384: return 0;
+ #endif
+ 
+-#ifdef GPG_USE_SHA512
+     case DIGEST_ALGO_SHA512: return GCRY_MD_SHA512;
+-#else
+-    case DIGEST_ALGO_SHA512: return 0;
+-#endif
++
+     default: return 0;
+     }
+ }

recipes/incoming/0340-gpg-prefer-sha512-and-sha384-in-personal-digest.patch

@@ -0,0 +1,48 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Wed, 3 Jan 2018 12:34:26 -0500
+Subject: gpg: Prefer SHA-512 and SHA-384 in personal-digest-preferences.
+
+* g10/keygen.c (keygen_set_std_prefs): prefer SHA-512
+and SHA-384 by default.
+
+--
+
+In 8ede3ae29a39641a2f98ad9a4cf61ea99085a892, upstream changed the
+defaults for --default-preference-list to advertise a preference for
+SHA-512, without touching --personal-digest-preferences.  This makes
+the same change for --personal-digest-preferences, since every modern
+OpenPGP library supports them all.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ g10/keygen.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/update-defaults/gpg-Prefer-SHA-512-and-SHA-384-in-personal-digest.patch
+
+diff --git a/g10/keygen.c b/g10/keygen.c
+index 79d4579..cb92468 100644
+--- a/g10/keygen.c
++++ b/g10/keygen.c
+@@ -391,16 +391,16 @@ keygen_set_std_prefs (const char *string,int personal)
+             if (personal)
+               {
+                 /* The default internal hash algo order is:
+-                 *  SHA-256, SHA-384, SHA-512, SHA-224, SHA-1.
++                 *  SHA-512, SHA-384, SHA-256, SHA-224, SHA-1.
+                  */
+-                if (!openpgp_md_test_algo (DIGEST_ALGO_SHA256))
+-                  strcat (dummy_string, "H8 ");
++                if (!openpgp_md_test_algo (DIGEST_ALGO_SHA512))
++                  strcat (dummy_string, "H10 ");
+ 
+                 if (!openpgp_md_test_algo (DIGEST_ALGO_SHA384))
+                   strcat (dummy_string, "H9 ");
+ 
+-                if (!openpgp_md_test_algo (DIGEST_ALGO_SHA512))
+-                  strcat (dummy_string, "H10 ");
++                if (!openpgp_md_test_algo (DIGEST_ALGO_SHA256))
++                  strcat (dummy_string, "H8 ");
+               }
+             else
+               {

recipes/incoming/0420-gpg-drop-import-clean-from-default-keyserver-import-options.patch

@@ -0,0 +1,51 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Mon, 15 Jul 2019 16:24:35 -0400
+Subject: gpg: drop import-clean from default keyserver import options
+
+* g10/gpg.c (main): drop IMPORT_CLEAN from the
+default opt.keyserver_options.import_options
+* doc/gpg.texi: reflect this change in the documentation
+
+Given that SELF_SIGS_ONLY is already set, it's not clear what
+additional benefit IMPORT_CLEAN provides.  Furthermore, IMPORT_CLEAN
+means that receiving an OpenPGP certificate from a keyserver will
+potentially delete data that is otherwise held in the local keyring,
+which is surprising to users who expect retrieval from the keyservers
+to be purely additive.
+
+GnuPG-Bug-Id: 4628
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ doc/gpg.texi | 2 +-
+ g10/gpg.c    | 3 +--
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/gpg-drop-import-clean-from-default-keyserver-import-optio.patch
+
+diff --git a/doc/gpg.texi b/doc/gpg.texi
+index 804ecf9..b238278 100644
+--- a/doc/gpg.texi
++++ b/doc/gpg.texi
+@@ -2047,7 +2047,7 @@ are available for all keyserver types, some common options are:
+ 
+ @end table
+ 
+-The default list of options is: "self-sigs-only, import-clean,
++The default list of options is: "self-sigs-only,
+ repair-keys, repair-pks-subkey-bug, export-attributes". However, if
+ the actual used source is an LDAP server "no-self-sigs-only" is
+ assumed unless "self-sigs-only" has been explicitly configured.
+diff --git a/g10/gpg.c b/g10/gpg.c
+index 68c0454..205de60 100644
+--- a/g10/gpg.c
++++ b/g10/gpg.c
+@@ -2441,8 +2441,7 @@ main (int argc, char **argv)
+ 					    | IMPORT_REPAIR_PKS_SUBKEY_BUG
+                                             | IMPORT_SELF_SIGS_ONLY
+                                             | IMPORT_COLLAPSE_UIDS
+-                                            | IMPORT_COLLAPSE_SUBKEYS
+-                                            | IMPORT_CLEAN);
++                                            | IMPORT_COLLAPSE_SUBKEYS);
+     opt.keyserver_options.export_options = EXPORT_ATTRIBUTES;
+     opt.keyserver_options.options = 0;
+     opt.verify_options = (LIST_SHOW_UID_VALIDITY

recipes/incoming/HACK-revert-rfc4880bis-default.patch

@@ -0,0 +1,207 @@
+see:
+https://lore.kernel.org/distributions/F30D6590-3E0C-4865-A944-7DE118A619CF@gentoo.org/
+
+this reverts to the pre-2.4 default of key generation. the new one is
+(apparently) not compatible with a potential future specification, and
+generates incompatible keys by default.
+
+once this is figured out, find a better solution than this
+--
+From 8b3e9127ea02eae8ec3470149e22804a572df5b8 Mon Sep 17 00:00:00 2001
+From: psykose <alice@ayaya.dev>
+Date: Tue, 7 Feb 2023 10:14:34 +0100
+Subject: [PATCH] Revert "gpg: Merge --rfc4880bis features into --gnupg"
+
+This reverts commit 4583f4fe2e11b3dd070066628c3f16776cc74f72.
+---
+ g10/gpg.c    | 35 ++++++++++++++++++++++++++++++++---
+ g10/keygen.c | 30 ++++++++++++++++++------------
+ 2 files changed, 50 insertions(+), 15 deletions(-)
+
+diff --git a/g10/gpg.c b/g10/gpg.c
+index b759cc1..5a04163 100644
+--- a/g10/gpg.c
++++ b/g10/gpg.c
+@@ -247,6 +247,7 @@ enum cmd_and_opt_values
+     oGnuPG,
+     oRFC2440,
+     oRFC4880,
++    oRFC4880bis,
+     oOpenPGP,
+     oPGP7,
+     oPGP8,
+@@ -635,6 +636,7 @@ static gpgrt_opt_t opts[] = {
+   ARGPARSE_s_n (oGnuPG, "no-pgp8", "@"),
+   ARGPARSE_s_n (oRFC2440, "rfc2440", "@"),
+   ARGPARSE_s_n (oRFC4880, "rfc4880", "@"),
++  ARGPARSE_s_n (oRFC4880bis, "rfc4880bis", "@"),
+   ARGPARSE_s_n (oOpenPGP, "openpgp", N_("use strict OpenPGP behavior")),
+   ARGPARSE_s_n (oPGP7, "pgp6", "@"),
+   ARGPARSE_s_n (oPGP7, "pgp7", "@"),
+@@ -976,7 +978,6 @@ static gpgrt_opt_t opts[] = {
+   ARGPARSE_s_n (oNoop, "no-allow-multiple-messages", "@"),
+   ARGPARSE_s_s (oNoop, "aead-algo", "@"),
+   ARGPARSE_s_s (oNoop, "personal-aead-preferences","@"),
+-  ARGPARSE_s_n (oNoop, "rfc4880bis", "@"),
+   ARGPARSE_s_n (oNoop, "override-compliance-check", "@"),
+ 
+ 
+@@ -2225,7 +2226,7 @@ static struct gnupg_compliance_option compliance_options[] =
+   {
+     { "gnupg",      oGnuPG },
+     { "openpgp",    oOpenPGP },
+-    { "rfc4880bis", oGnuPG },
++    { "rfc4880bis", oRFC4880bis },
+     { "rfc4880",    oRFC4880 },
+     { "rfc2440",    oRFC2440 },
+     { "pgp6",       oPGP7 },
+@@ -2241,8 +2242,28 @@ static struct gnupg_compliance_option compliance_options[] =
+ static void
+ set_compliance_option (enum cmd_and_opt_values option)
+ {
++  opt.flags.rfc4880bis = 0;  /* Clear because it is initially set.  */
++
+   switch (option)
+     {
++    case oRFC4880bis:
++      opt.flags.rfc4880bis = 1;
++      opt.compliance = CO_RFC4880;
++      opt.flags.dsa2 = 1;
++      opt.flags.require_cross_cert = 1;
++      opt.rfc2440_text = 0;
++      opt.allow_non_selfsigned_uid = 1;
++      opt.allow_freeform_uid = 1;
++      opt.escape_from = 1;
++      opt.not_dash_escaped = 0;
++      opt.def_cipher_algo = 0;
++      opt.def_digest_algo = 0;
++      opt.cert_digest_algo = 0;
++      opt.compress_algo = -1;
++      opt.s2k_mode = 3; /* iterated+salted */
++      opt.s2k_digest_algo = DIGEST_ALGO_SHA256;
++      opt.s2k_cipher_algo = CIPHER_ALGO_AES256;
++      break;
+     case oOpenPGP:
+     case oRFC4880:
+       /* This is effectively the same as RFC2440, but with
+@@ -2286,6 +2307,7 @@ set_compliance_option (enum cmd_and_opt_values option)
+     case oPGP8:  opt.compliance = CO_PGP8;  break;
+     case oGnuPG:
+       opt.compliance = CO_GNUPG;
++      opt.flags.rfc4880bis = 1;
+       break;
+ 
+     case oDE_VS:
+@@ -2488,6 +2510,7 @@ main (int argc, char **argv)
+     opt.emit_version = 0;
+     opt.weak_digests = NULL;
+     opt.compliance = CO_GNUPG;
++    opt.flags.rfc4880bis = 1;
+ 
+     /* Check special options given on the command line.  */
+     orig_argc = argc;
+@@ -3030,6 +3053,7 @@ main (int argc, char **argv)
+           case oOpenPGP:
+           case oRFC2440:
+           case oRFC4880:
++          case oRFC4880bis:
+           case oPGP7:
+           case oPGP8:
+           case oGnuPG:
+@@ -3858,6 +3882,11 @@ main (int argc, char **argv)
+     if( may_coredump && !opt.quiet )
+ 	log_info(_("WARNING: program may create a core file!\n"));
+ 
++    if (!opt.flags.rfc4880bis)
++      {
++        opt.mimemode = 0; /* This will use text mode instead.  */
++      }
++
+     if (eyes_only) {
+       if (opt.set_filename)
+ 	  log_info(_("WARNING: %s overrides %s\n"),
+@@ -4074,7 +4103,7 @@ main (int argc, char **argv)
+     /* Check our chosen algorithms against the list of legal
+        algorithms. */
+ 
+-    if(!GNUPG)
++    if(!GNUPG && !opt.flags.rfc4880bis)
+       {
+ 	const char *badalg=NULL;
+ 	preftype_t badtype=PREFTYPE_NONE;
+diff --git a/g10/keygen.c b/g10/keygen.c
+index 7f54f7d..83fc3f3 100644
+--- a/g10/keygen.c
++++ b/g10/keygen.c
+@@ -404,7 +404,7 @@ keygen_set_std_prefs (const char *string,int personal)
+ 	      strcat(dummy_string,"S7 ");
+ 	    strcat(dummy_string,"S2 "); /* 3DES */
+ 
+-            if (!openpgp_aead_test_algo (AEAD_ALGO_OCB))
++            if (opt.flags.rfc4880bis && !openpgp_aead_test_algo (AEAD_ALGO_OCB))
+ 	      strcat(dummy_string,"A2 ");
+ 
+             if (personal)
+@@ -889,7 +889,7 @@ keygen_upd_std_prefs (PKT_signature *sig, void *opaque)
+   /* Make sure that the MDC feature flag is set if needed.  */
+   add_feature_mdc (sig,mdc_available);
+   add_feature_aead (sig, aead_available);
+-  add_feature_v5 (sig, 1);
++  add_feature_v5 (sig, opt.flags.rfc4880bis);
+   add_keyserver_modify (sig,ks_modify);
+   keygen_add_keyserver_url(sig,NULL);
+ 
+@@ -3382,7 +3382,10 @@ parse_key_parameter_part (ctrl_t ctrl,
+                 }
+             }
+           else if (!ascii_strcasecmp (s, "v5"))
+-            keyversion = 5;
++            {
++              if (opt.flags.rfc4880bis)
++                keyversion = 5;
++            }
+           else if (!ascii_strcasecmp (s, "v4"))
+             keyversion = 4;
+           else
+@@ -3641,7 +3644,7 @@ parse_key_parameter_part (ctrl_t ctrl,
+  *   ecdsa := Use algorithm ECDSA.
+  *   eddsa := Use algorithm EdDSA.
+  *   ecdh  := Use algorithm ECDH.
+- *   v5    := Create version 5 key
++ *   v5    := Create version 5 key (requires option --rfc4880bis)
+  *
+  * There are several defaults and fallbacks depending on the
+  * algorithm.  PART can be used to select which part of STRING is
+@@ -4513,9 +4516,9 @@ read_parameter_file (ctrl_t ctrl, const char *fname )
+ 	    }
+ 	}
+ 
+-        if ((keywords[i].key == pVERSION
+-             || keywords[i].key == pSUBVERSION))
+-          ; /* Ignore version.  */
++        if (!opt.flags.rfc4880bis && (keywords[i].key == pVERSION
++                                      || keywords[i].key == pSUBVERSION))
++          ; /* Ignore version unless --rfc4880bis is active.  */
+         else
+           {
+             r = xmalloc_clear( sizeof *r + strlen( value ) );
+@@ -4610,11 +4613,14 @@ quickgen_set_para (struct para_data_s *para, int for_subkey,
+       para = r;
+     }
+ 
+-  r = xmalloc_clear (sizeof *r + 20);
+-  r->key = for_subkey? pSUBVERSION : pVERSION;
+-  snprintf (r->u.value, 20, "%d", version);
+-  r->next = para;
+-  para = r;
++  if (opt.flags.rfc4880bis)
++    {
++      r = xmalloc_clear (sizeof *r + 20);
++      r->key = for_subkey? pSUBVERSION : pVERSION;
++      snprintf (r->u.value, 20, "%d", version);
++      r->next = para;
++      para = r;
++    }
+ 
+   if (keytime)
+     {

recipes/incoming/alpine_syntax.patch

@@ -0,0 +1,12 @@
+--- a/misc/syntax/Syntax.in
++++ b/misc/syntax/Syntax.in
+@@ -250,6 +250,9 @@
+ file .\*\\.strace$ Strace\sdebug\soutput
+ include strace.syntax
+ 
++file APKBUILD$ Alpine\spackage\sbuild\sscript
++include PKGBUILD.syntax
++
+ file PKGBUILD$ Arch\spackage\sbuild\sscript
+ include PKGBUILD.syntax
+ 

recipes/incoming/cmake-version.patch

@@ -0,0 +1,21 @@
+From 42864e12b0d7af01b1cf989d6da9e9a4477775a1 Mon Sep 17 00:00:00 2001
+From: Rudi Heitbaum <rudi@heitbaum.com>
+Date: Fri, 28 Mar 2025 23:14:48 +1100
+Subject: [PATCH] Allow build with cmake 4.0.0
+
+Update the min version to match parent CMakeLists.txt 3.9...3.12
+---
+ apps/CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/apps/CMakeLists.txt b/apps/CMakeLists.txt
+index f7c9dec633..ef2271d131 100644
+--- a/apps/CMakeLists.txt
++++ b/apps/CMakeLists.txt
+@@ -1,5 +1,5 @@
+ 
+-cmake_minimum_required(VERSION 2.8)  # see ../CMakeLists.txt for why 2.8
++cmake_minimum_required(VERSION 3.9...3.12)
+ 
+ if(POLICY CMP0075)
+     cmake_policy(SET CMP0075 NEW)

recipes/incoming/dont-use-nobody.patch

@@ -0,0 +1,15 @@
+rootbld makes all the supplementary groups nobody(65534);
+this patch avoids using them in tests
+
+diff --git a/getgroups.c b/getgroups.c
+index 8a37ed0..01adfca 100644
+--- a/getgroups.c
++++ b/getgroups.c
+@@ -48,6 +48,7 @@
+ #endif
+ 
+ 	for (i = 0; i < n; i++)  {
++		if (list[i] == 65534) continue;
+ 		printf("%lu ", (unsigned long)list[i]);
+ 		if (list[i] == gid)
+ 			gid_in_list = 1;

recipes/incoming/fix-i18n.patch

@@ -0,0 +1,12 @@
+--- gnupg-2.1.7/common/i18n.c.orig	2015-08-31 20:40:18.752742866 +0300
++++ gnupg-2.1.7/common/i18n.c	2015-08-31 20:40:41.806336224 +0300
+@@ -85,8 +85,8 @@
+   bindtextdomain (PACKAGE_GT, gnupg_localedir ());
+   textdomain (PACKAGE_GT);
+ #else
+-# ifdef ENABLE_NLS
+   setlocale (LC_ALL, "" );
++# ifdef ENABLE_NLS
+   bindtextdomain (PACKAGE_GT, gnupg_localedir ());
+   textdomain (PACKAGE_GT);
+ # endif

recipes/incoming/fix-t4219-with-sticky-bit.patch

@@ -0,0 +1,48 @@
+The last test of t4129 creates a directory and expects its setgid bit
+(g+s) to be off. But this makes the test fail when the parent directory
+has the bit set, as setgid's state is inherited by newly created
+subdirectories. Make the test more robust by accepting the presence of
+the setgid bit on the created directory. We only allow 'S' (setgid on
+but no executable permission) and not 's' (setgid on with executable
+permission) because the previous 'umask 0077' shouldn't allow the second
+scenario to happen.
+
+Note that only subdirectories inherit this bit, so we don't have to make
+the same change for the regular file that is also created by this test.
+But checking the permissions using grep instead of test_cmp makes the
+test a little simpler, so let's use it for the regular file as well.
+
+Also note that the sticky bit (+t) and the setuid bit (u+s) are not
+inherited, so we don't have to worry about those.
+
+Reported-by: Kevin Daudt <me@ikke.info>
+Signed-off-by: Matheus Tavares <matheus.bernardino@usp.br>
+---
+ t/t4129-apply-samemode.sh | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/t/t4129-apply-samemode.sh b/t/t4129-apply-samemode.sh
+index 41818d8315..3818398ca9 100755
+--- a/t/t4129-apply-samemode.sh
++++ b/t/t4129-apply-samemode.sh
+@@ -90,12 +90,10 @@ test_expect_success POSIXPERM 'do not use core.sharedRepository for working tree
+ 		rm -rf d f1 &&
+ 		git apply patch-f1-and-f2.txt &&
+ 
+-		echo "-rw-------" >f1_mode.expected &&
+-		echo "drwx------" >d_mode.expected &&
+-		test_modebits f1 >f1_mode.actual &&
+-		test_modebits d >d_mode.actual &&
+-		test_cmp f1_mode.expected f1_mode.actual &&
+-		test_cmp d_mode.expected d_mode.actual
++		test_modebits f1 >f1_mode &&
++		test_modebits d >d_mode &&
++		grep "^-rw-------$" f1_mode &&
++		grep "^drwx--[-S]---$" d_mode
+ 	)
+ '
+ 
+-- 
+2.29.2
+
+

recipes/incoming/fix-test-musl.patch

@@ -0,0 +1,13 @@
+diff --git a/test/test-thread-priority.c b/test/test-thread-priority.c
+index acc3385..a083f00 100644
+--- a/test/test-thread-priority.c
++++ b/test/test-thread-priority.c
+@@ -100,7 +100,7 @@ TEST_IMPL(thread_priority) {
+   uv_sem_destroy(&sem);
+ 
+   /* Now that the thread no longer exists, verify that the relevant error is returned */
+-#if !defined(__ANDROID__)
++#if defined(__GLIBC__)
+   ASSERT_EQ(UV_ESRCH, uv_thread_getpriority(task_id, &priority));
+   ASSERT_EQ(UV_ESRCH, uv_thread_setpriority(task_id, UV_THREAD_PRIORITY_LOWEST));
+ #endif

recipes/incoming/git.toml

@@ -0,0 +1,54 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "git"
+version = "2.54.0"
+
+[source]
+tarball = "https://www.kernel.org/pub/software/scm/git/git-2.54.0.tar.xz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "cb363917124edc245c9f6745e6e0c4093990275b4d57f9d2213c655b304ac81b05ece8d88546122727495ebc48a5ae19ab166a3ee43b6b8c68da488ac0270064"
+sha256  = "f689162364c10de79ef89aa8dbf48731eb057e34edbbd20aca510ce0154681a3"
+patches = ["fix-t4219-with-sticky-bit.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+make prefix=/usr \
+		DESTDIR="/out" \
+		perllibdir="$(_perl_config vendorlib)" \
+		all
+
+	make -C contrib/subtree prefix=/usr DESTDIR="/out"
+	make -C contrib/diff-highlight prefix=/usr DESTDIR="/out"
+
+	if [ -n "$_full_build" ]; then
+		# generate manpages outside of package()
+		make prefix=/usr man
+
+		make prefix=/usr -C contrib/credential/libsecret
+	fi
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make -C t prefix=/usr DESTDIR="/out" \
+		perlibdir="$(_perl_config vendorlib)" \
+		all
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): perl
+
+[deps]
+build = ["asciidoc", "python3", "tcl", "tk", "libsecret", "glib"]

recipes/incoming/gnupg.toml

@@ -0,0 +1,64 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "gnupg"
+version = "2.4.9"
+
+[source]
+tarball = "https://gnupg.org/ftp/gcrypt/gnupg/gnupg-${pkgver/_beta/-beta}.tar.bz2"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "4638016b390a0024fa0cbe14181c43a81991e4275043855397ef099b927985d175d32452fc15b06485623b9292662dd6da464b2e5def8b77b2e4e48a072ab521"
+sha256  = "FIXME-sha256"
+patches = ["0001-include-unistd.patch", "0010-avoid-beta-warning.patch", "0020-avoid-regenerating-defsincdate-use-shipped-file.patch", "0110-avoid-simple-memory-dumps-via-ptrace.patch", "0210-dirmngr-hkp-avoid-potential-race-condition-when-some-host-die.patch", "0230-dirmngr-avoid-automatically-checking-upstream-swdb.patch", "0330-gpg-default-to-sha512-for-all-signature-types-on-rsa-keys.patch", "0340-gpg-prefer-sha512-and-sha384-in-personal-digest.patch", "0420-gpg-drop-import-clean-from-default-keyserver-import-options.patch", "fix-i18n.patch", "HACK-revert-rfc4880bis-default.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info \
+		--localstatedir=/var \
+		--disable-nls \
+		--enable-bzip2 \
+		--enable-tofu \
+		--enable-scdaemon \
+		--enable-ccid-driver
+	make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install
+
+	install -Dm644 -t "/out"/usr/lib/udev/rules.d/ "$srcdir"/60-scdaemon.rules
+
+	cd "/out"
+
+	# install compat symlink
+	ln -s gpg  usr/bin/gpg2
+	ln -s gpgv usr/bin/gpgv2
+
+	# Remove docs for systemd-user
+	rm -rf usr/share/doc/gnupg/examples/systemd-user
+
+	# Remove gpg scheme interpreter - an internal tool used in gpg tests
+	rm -rf usr/bin/gpgscm
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["autoconf", "automake", "bzip2", "gettext", "gnutls", "libassuan", "libgcrypt", "libgpg-error", "libksba", "libtool", "libusb", "npth", "openldap", "pinentry", "sqlite", "texinfo", "xz", "zlib"]

recipes/incoming/irssi.toml

@@ -0,0 +1,45 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "irssi"
+version = "1.4.5"
+
+[source]
+tarball = "https://github.com/irssi/irssi/releases/download/1.4.5/irssi-1.4.5.tar.xz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "5d80107ad625feb6d2b3ac807f517c5cfeae58986d3fbfe53ea82f2dee70396f5092abdc6ef137c5651e4515e081591079b37f0e428f69990db493cfe14e4f36"
+sha256  = "72a951cb0ad622785a8962801f005a3a412736c7e7e3ce152f176287c52fe062"
+patches = ["irssi-1.4.5-perl-again.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+abuild-muon \
+		-Db_lto=true \
+		-Dwith-perl=yes \
+		-Dwith-perl-lib=vendor \
+		-Dwith-proxy=yes \
+		-Dwith-otr=yes \
+		-Denable-true-color=yes \
+		output .
+	ninja -C output
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+DESTDIR="/out" muon -C output install
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["glib", "libotr", "muon", "ncurses", "openssl", "perl", "utf8proc"]

recipes/incoming/lynx.toml

@@ -0,0 +1,55 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "lynx"
+version = "2.9.3"
+
+[source]
+tarball = "https://invisible-mirror.net/archives/lynx/tarballs/lynx${pkgver/_p/rel.}.tar.bz2"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "96fe5d8b427c0ceeaaa1778d88dae21f4fde79781243428f0c47e2ffb6f32c4ca918d608a60c55975fb101d5aae710d3aa3a8d6af3316599307bf810c0c87144"
+sha256  = "FIXME-sha256"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info \
+		--localstatedir=/var \
+		--enable-ipv6 \
+		--with-ssl \
+		--enable-default-colors \
+		--with-screen=ncursesw \
+		--with-zlib \
+		--disable-full-paths \
+		--enable-externs \
+		--enable-nls
+	make helpdir=/usr/share/doc/lynx/help \
+		docdir=/usr/share/doc/lynx
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install install-help install-doc \
+		helpdir=/usr/share/doc/lynx/help \
+		docdir=/usr/share/doc/lynx
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["openssl-dev>3", "gettext", "zlib", "glib", "perl", "ncurses"]

recipes/incoming/mc.toml

@@ -0,0 +1,54 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "mc"
+version = "4.8.33"
+
+[source]
+tarball = "https://ftp.osuosl.org/pub/midnightcommander/mc-4.8.33.tar.xz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "3eb857af2fa689e9458aeef6d3b236fb92684e05c0e3e78e7e5a5fa5dba6431cae39bec51bc84598b0bb60579cb0a0679dcdc6e9f7d88ca85dc37ace251c8632"
+sha256  = "cae149d42f844e5185d8c81d7db3913a8fa214c65f852200a9d896b468af164c"
+patches = ["alpine_syntax.patch", "ticket_4642_parse_ls_vga_fix.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--libexecdir=/usr/lib \
+		--mandir=/usr/share/man \
+		--sysconfdir=/etc \
+		--enable-background \
+		--enable-charset \
+		--enable-largefile \
+		--enable-vfs-sftp \
+		--with-internal-edit \
+		--with-screen=slang \
+		--with-subshell \
+		--with-gpm-mouse \
+		--without-x
+	make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install
+	rm -fr "/out"/usr/share/man/??
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["e2fsprogs", "glib", "libssh2", "slang", "perl", "gpm"]

recipes/incoming/musl-fts-support.patch

@@ -0,0 +1,13 @@
+diff --git a/Makefile b/Makefile
+index 7e2d7be..c3fd556 100644
+--- a/Makefile
++++ b/Makefile
+@@ -133,7 +133,7 @@ CFLAGS += -std=c11 -Wall -Wextra -Wshadow
+ CFLAGS += $(CFLAGS_OPTIMIZATION)
+ CFLAGS += $(CFLAGS_CURSES)
+ 
+-LDLIBS += $(LDLIBS_CURSES) -lpthread
++LDLIBS += $(LDLIBS_CURSES) -lpthread -lfts
+ 
+ # static compilation needs libgpm development package
+ ifeq ($(strip $(O_STATIC)),1)

recipes/incoming/mutt.toml

@@ -0,0 +1,67 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "mutt"
+version = "2.4.0"
+
+[source]
+tarball = "http://ftp.mutt.org/pub/mutt/mutt-2.4.0.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "c0c849136be8eb8dcc4b45c5a602e17e3f4405cb1d9bb82f18ca01d7fd2e0bef176b67676528e340e430ae00632925d255b5a4cd195cb4addaa2341a71e2b23d"
+sha256  = "8f6ca2ef42f8f07cdc8ec391e8aa41a702490eae55ac72016b0b94ddf44ae292"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+ISPELL=/usr/bin/hunspell \
+	./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info \
+		--enable-imap \
+		--enable-pop \
+		--enable-smtp \
+		--enable-hcache \
+		--enable-gpgme \
+		--enable-sidebar \
+		--with-curses \
+		--with-mailpath=/var/mail \
+		--with-docdir=/usr/share/doc/mutt \
+		--without-included-gettext \
+		--with-ssl \
+		--with-gsasl \
+		--with-idn2
+	make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install
+
+	rm -f "/out"/etc/*.dist \
+		"/out"/etc/mime.types
+
+	# Don't tamper with the global configuration file.
+	# Many options set in the global config cannot be
+	# overwritten in the users configuration file.
+	# Example: Resetting colors isn't possible.
+	install -Dm644 contrib/gpg.rc \
+		"/out"/etc/Muttrc.gpg.dist
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["elinks", "docbook-xml", "docbook-xsl", "gdbm", "gettext", "gpgme", "libidn2", "libgsasl", "ncurses", "openssl-dev>3", "perl"]

recipes/incoming/nnn.toml

@@ -0,0 +1,46 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "nnn"
+version = "5.2"
+
+[source]
+tarball = "https://github.com/jarun/nnn/archive/v5.2/nnn-5.2.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "343744b3bcb73e9d11a96eefe89c6d073029653e91d340b04d655504bedbadd3761d74c62652d7afa40a41ade87c4d7df5b878e35ed773f4c2db4617c883e372"
+sha256  = "f166eda5093ac8dcf8cbbc6224123a32c53cf37b82c5c1cb48e2e23352754030"
+patches = ["musl-fts-support.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make install DESTDIR="/out" PREFIX=/usr
+
+	install -D -m 644 misc/auto-completion/bash/nnn-completion.bash \
+		"/out"/usr/share/bash-completion/completions/nnn
+
+	install -D -m 644 misc/auto-completion/fish/nnn.fish \
+		"/out"/usr/share/fish/vendor_completions.d/nnn.fish
+
+	install -D -m 644 misc/auto-completion/zsh/_nnn \
+		"/out"/usr/share/zsh/site-functions/_nnn
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["musl-fts", "ncurses", "readline"]

recipes/incoming/pcf-family-names.patch

@@ -0,0 +1,13 @@
+diff --git a/include/freetype/config/ftoption.h b/include/freetype/config/ftoption.h
+index 9e03e17..1411db6 100644
+--- a/include/freetype/config/ftoption.h
++++ b/include/freetype/config/ftoption.h
+@@ -913,7 +913,7 @@ FT_BEGIN_HEADER
+    * If this option is activated, it can be controlled with the
+    * `no-long-family-names` property of the 'pcf' driver module.
+    */
+-/* #define PCF_CONFIG_OPTION_LONG_FAMILY_NAMES */
++#define PCF_CONFIG_OPTION_LONG_FAMILY_NAMES
+ 
+ 
+   /*************************************************************************/

recipes/incoming/pigz.toml

@@ -0,0 +1,38 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "pigz"
+version = "2.8"
+
+[source]
+tarball = "https://zlib.net/pigz/pigz-2.8.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "ae3d9d593e1645d65f9ab77aa828600c9af4bb30d0a073da7ae3dd805e65b87efaf6a0efb980f2d0168e475ae506eba194547d6479956dabb9d88293a9078a7f"
+sha256  = "eb872b4f0e1f0ebe59c9f7bd8c506c4204893ba6a8492de31df416f0d5170fd0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+make LDFLAGS="$LDFLAGS" CFLAGS="$CFLAGS -O3 -flto=auto" pigz
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -Dm755 pigz -t "/out"/usr/bin
+	ln -s pigz "/out"/usr/bin/unpigz
+	install -Dm644 pigz.1 -t "/out"/usr/share/man/man1
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["zlib"]

recipes/incoming/rsync.toml

@@ -0,0 +1,62 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "rsync"
+version = "3.4.4"
+
+[source]
+tarball = "https://download.samba.org/pub/rsync/rsync-3.4.4.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "cf9a838b1f019b70fd67fa2c293f267be3f24e579c2ea33177ec7afc502c97ce0b613ff0854088c0eb28acd14ee0a75706ae8445115cef4669bd586c505d8453"
+sha256  = "bd88cf82fa653da32314fb229136407c5c90f80d1758d8f4b091767877d8fa96"
+patches = ["dont-use-nobody.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+cp  rrsync.1 support/rrsync.1
+	CFLAGS="$CFLAGS -flto=auto" \
+	./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--localstatedir=/var \
+		--enable-acl-support \
+		--enable-xattr-support \
+		--enable-xxhash \
+		--with-rrsync \
+		--without-included-popt \
+		--without-included-zlib \
+		--disable-md2man \
+		--disable-openssl
+		# openssl is disabled since xxh checksums are faster anyway
+	make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install
+
+	install -Dm755 "$srcdir"/rsyncd.initd "/out"/etc/init.d/rsyncd
+	install -Dm644 "$srcdir"/rsyncd.conf "/out"/etc/rsyncd.conf
+	install -Dm644 "$srcdir"/rsyncd.confd "/out"/etc/conf.d/rsyncd
+	install -Dm644 "$srcdir"/rsyncd.logrotate "/out"/etc/logrotate.d/rsyncd
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): python3
+
+[deps]
+build = ["acl", "attr", "linux-headers", "lz4", "perl", "popt", "xxhash", "zlib", "zstd"]

recipes/incoming/screen.toml

@@ -0,0 +1,54 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "screen"
+version = "5.0.1"
+
+[source]
+tarball = "https://git.savannah.gnu.org/gitweb/?p=screen.git;a=snapshot;h=v.5.0.1;sf=tgz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "1e11374c74c9b4acb49e51baf9af6a151bda333f57392918ebd2167274454eb80b8ac8a17f6aa38d921f7f6d919e4b43f10a35da652a4a36b374ce8b97b8610a"
+sha256  = "FIXME-sha256"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+CFLAGS="$CFLAGS -flto=auto" \
+	./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--with-system_screenrc=/etc/screenrc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info \
+		--localstatedir=/var \
+		--enable-telnet
+	make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make -j1 DESTDIR="/out" install
+
+	# remove suid root
+	find "/out" -type f -perm -u+s -print0 \
+		| xargs -0 chmod -c -s
+
+	install -Dm644 etc/etcscreenrc "/out"/etc/screenrc
+	install -Dm644 etc/screenrc "/out"/etc/skel/.screenrc
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["autoconf", "automake", "linux-pam", "ncurses"]

recipes/incoming/socat.toml

@@ -0,0 +1,50 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "socat"
+version = "1.8.1.2"
+
+[source]
+tarball = "http://www.dest-unreach.org/socat/download/socat-1.8.1.2.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "2037ad9153ea2c39db075ee44c9199467f86458838dbd829866bf8298d48a2361231591c5b81fcb6d1030a6528e783d45bca948cdf6179a3cc1e5496ca9e420e"
+sha256  = "daeb9eed37a99424cd14877208706e93745c91cb86fb917a355635f4df5c8499"
+patches = ["use-linux-headers.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+CFLAGS="$CFLAGS -Wno-int-conversion" \
+	./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--localstatedir=/var
+	make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install
+
+	install -Dm644 EXAMPLES doc/*.html doc/*.css \
+		-t "/out"/usr/share/doc/socat/
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): bash
+
+[deps]
+build = ["openssl", "readline", "linux-headers"]

recipes/incoming/subpixel.patch

@@ -0,0 +1,12 @@
+diff -Naur a/include/freetype/config/ftoption.h b/include/freetype/config/ftoption.h
+--- a/include/freetype/config/ftoption.h	2019-02-23 09:09:06.000000000 +0000
++++ b/include/freetype/config/ftoption.h	2019-03-17 11:42:04.315011932 +0000
+@@ -126,7 +126,7 @@
+    * macro is not defined, FreeType offers alternative LCD rendering
+    * technology that produces excellent output without LCD filtering.
+    */
+-/* #define FT_CONFIG_OPTION_SUBPIXEL_RENDERING */
++#define FT_CONFIG_OPTION_SUBPIXEL_RENDERING
+ 
+ 
+   /**************************************************************************

recipes/incoming/table-validation-modules.patch

@@ -0,0 +1,21 @@
+diff -Naur a/modules.cfg b/modules.cfg
+--- a/modules.cfg	2019-02-23 09:06:07.000000000 +0000
++++ b/modules.cfg	2019-03-15 17:13:56.465952994 +0000
+@@ -111,7 +111,7 @@
+ 
+ # TrueType GX/AAT table validation.  Needs `ftgxval.c' below.
+ #
+-# AUX_MODULES += gxvalid
++AUX_MODULES += gxvalid
+ 
+ # Support for streams compressed with gzip (files with suffix .gz).
+ #
+@@ -130,7 +130,7 @@
+ 
+ # OpenType table validation.  Needs `ftotval.c' below.
+ #
+-# AUX_MODULES += otvalid
++AUX_MODULES += otvalid
+ 
+ # Auxiliary PostScript driver component to share common code.
+ #

recipes/incoming/ticket_4642_parse_ls_vga_fix.patch

@@ -0,0 +1,24 @@
+diff --git a/lib/vfs/parse_ls_vga.c b/lib/vfs/parse_ls_vga.c
+index dd91b881b..a1666e0ae 100644
+--- a/lib/vfs/parse_ls_vga.c
++++ b/lib/vfs/parse_ls_vga.c
+@@ -855,13 +855,12 @@ vfs_parse_ls_lga (const char *p, struct stat *s, char **filename, char **linknam
+ 
+     if (t != NULL)
+     {
+-        size_t p2;
++        size_t p2 = strlen (t);
+ 
+-        p2 = strlen (t);
+-        if (--p2 > 0 && (t[p2] == '\r' || t[p2] == '\n'))
+-            t[p2] = '\0';
+-        if (--p2 > 0 && (t[p2] == '\r' || t[p2] == '\n'))
+-            t[p2] = '\0';
++        if (p2 > 0 && (t[p2 - 1] == '\r' || t[p2 - 1] == '\n'))
++            t[--p2] = '\0';
++        if (p2 > 0 && (t[p2 - 1] == '\r' || t[p2 - 1] == '\n'))
++            t[--p2] = '\0';
+     }
+ 
+     g_free (p_copy);
+

recipes/incoming/tig.toml

@@ -0,0 +1,47 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "tig"
+version = "2.6.1"
+
+[source]
+tarball = "https://github.com/jonas/tig/releases/download/tig-2.6.1/tig-2.6.1.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "685fe0a5b6db87c3bab7914e47b43ad1c677f84ca1e86a0f9c9e6a86b5b338a9195901d2e07d9031f7cd6da241a238b000447e5e864d816a228847db63534c3e"
+sha256  = "5adeabdcd93aa0423d618da8b878b53482bef6e0e9e1fe224acc0f18031fe91e"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+CFLAGS="${CFLAGS//-Os/-O2} -flto=auto" \
+	CXXFLAGS="${CXXFLAGS//-Os/-O2} -flto=auto" \
+	./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--localstatedir=/var
+	make all
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install install-doc-man
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): git
+
+[deps]
+build = ["ncurses", "pcre2"]

recipes/incoming/use-linux-headers.patch

@@ -0,0 +1,11 @@
+--- a/sysincludes.h
++++ b/sysincludes.h
+@@ -145,7 +145,7 @@
+ #include <linux/if_packet.h>
+ #endif
+ #if HAVE_NETINET_IF_ETHER_H
+-#include <netinet/if_ether.h>
++#include <linux/if_ether.h>
+ #endif
+ #if HAVE_LINUX_IF_TUN_H
+ #include <linux/if_tun.h>

recipes/incoming/wget.toml

@@ -0,0 +1,47 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "wget"
+version = "1.25.0"
+
+[source]
+tarball = "https://ftp.gnu.org/gnu/wget/wget-1.25.0.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "a7ce33c07a1a206a8574b6e9ea7cc5292315df0914edbcf05a014d35ae9e3d24699a46818b409b884ada57428cf30502f4bbb3767cae2c6934e4e7fb2d0c5036"
+sha256  = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+CFLAGS="$CFLAGS -flto=auto" \
+	./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info \
+		--with-libidn \
+		--with-ssl=openssl \
+		--disable-nls
+	make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["libidn2", "openssl", "pcre2", "perl", "zlib"]

recipes/tmux.toml

@@ -0,0 +1,18 @@
+# tmux 3.6b — multiplexor de terminal (C). PRIMER consumidor de la cola C que valida las libs base:
+# linkea libevent + ncurses (ambas hammer-built). De-Alpinizada: compiler=gcc, configure-split, estático.
+name    = "tmux"
+version = "3.6b"
+[source]
+tarball = "https://github.com/tmux/tmux/releases/download/3.6b/tmux-3.6b.tar.gz"
+sha256  = "390759d25fdba016887ec982b808927e637070fd7d03a8021f8ef3102b9ae3c7"
+[build]
+compiler = "gcc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+[build.phases]
+configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --sysconfdir=/etc'
+compile   = 'make'
+install   = 'make DESTDIR=/out install'
+[deps]
+build = ["libevent", "ncurses", "bison"]

tandas/c-cola-1.txt

@@ -0,0 +1,16 @@
+# c-cola-1 — clásicos C que las libs base ya habilitan (2026-06-25)
+tmux
+tig
+wget
+rsync
+socat
+nnn
+pigz
+lynx
+mc
+mutt
+irssi
+gnupg
+screen
+the_silver_searcher=the-silver-searcher
+git