diff --git a/recipes/incoming-clib/lsof.toml b/recipes/incoming-clib/lsof.toml
new file mode 100644
index 00000000..70321391
--- /dev/null
+++ b/recipes/incoming-clib/lsof.toml
@@ -0,0 +1,42 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "lsof"
+version = "4.99.7"
+
+[source]
+tarball = "https://github.com/lsof-org/lsof/archive/4.99.7/lsof-4.99.7.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "02888ffd9984aeffeec8868956cb49f9553e5e6c6b907b29c885282432efc05631c44e76be19598c3cdf3ebffac38d284c6e9c1594c0459058dea14ca7d00699"
+sha256  = "bac1b0acbc50aede42fc97dffaa0b0475e97973e36a6351de5f349c6155afc68"
+patches = ["hassecurity.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+./Configure -n linux
+	# El script Configure genera su propia línea de link (${CC} -o lsof ... ${CFGL})
+	# e ignora los LDFLAGS estáticos de hammer; forzamos -static por CC. link=static.
+	make CC="cc -static"
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -Dm0755 lsof -t "/out"/usr/bin/
+	install -Dm0644 Lsof.8 "/out"/usr/share/man/man8/lsof.8
+	install -Dm0644 COPYING -t "/out"/usr/share/licenses/lsof/
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["linux-headers"]