sergio/takana

Los huecos reales para una distro completa (el sistema ya está: bootstrap/
self-host/kernel/init/EFI/paquetería). Cola aislada en incoming-clib:
git rsync bash ca-certificates sudo doas util-linux sed tzdata e2fsprogs
dosfstools parted iproute2 iputils dhcpcd vim dbus foot. Import 18/18
(17 alpine + 1 nix), deps ya-canónicas podadas. Patches musl viajan.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

diff --git a/recipes/incoming-clib/0001-Use-getopt_long-for-opt-parsing-in-ping.patch b/recipes/incoming-clib/0001-Use-getopt_long-for-opt-parsing-in-ping.patch
new file mode 100644
index 00000000..cd499f71
--- /dev/null
+++ b/recipes/incoming-clib/0001-Use-getopt_long-for-opt-parsing-in-ping.patch
@@ -0,0 +1,34 @@
+From a8591bcd8b5585e3de774a715802be3434f8cfe7 Mon Sep 17 00:00:00 2001
+From: Jens Reidel <adrian@travitia.xyz>
+Date: Fri, 5 Dec 2025 16:18:03 +0100
+Subject: [PATCH] Use getopt_long for opt parsing in ping
+
+Signed-off-by: Jens Reidel <adrian@travitia.xyz>
+---
+ ping/ping.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/ping/ping.c b/ping/ping.c
+index 1e976a9..1993fc7 100644
+--- a/ping/ping.c
++++ b/ping/ping.c
+@@ -54,6 +54,7 @@
+ #include "ping.h"
+ 
+ #include <assert.h>
++#include <getopt.h>
+ #include <netinet/ip.h>
+ #include <netinet/ip_icmp.h>
+ #include <ifaddrs.h>
+@@ -390,7 +391,7 @@ main(int argc, char **argv)
+ 	}
+ 
+ 	/* Parse command line options */
+-	while ((ch = getopt(argc, argv, "h?" "4bRT:" "6F:N:" "3aABc:CdDe:fHi:I:l:Lm:M:nOp:qQ:rs:S:t:UvVw:W:")) != EOF) {
++	while ((ch = getopt_long(argc, argv, "h?" "4bRT:" "6F:N:" "3aABc:CdDe:fHi:I:l:Lm:M:nOp:qQ:rs:S:t:UvVw:W:", NULL, NULL)) != EOF) {
+ 		switch(ch) {
+ 		/* IPv4 specific options */
+ 		case '4':
+-- 
+2.52.0
+
diff --git a/recipes/incoming-clib/0001-posixtz-ensure-the-file-offset-we-pass-to-lseek-is-o.patch b/recipes/incoming-clib/0001-posixtz-ensure-the-file-offset-we-pass-to-lseek-is-o.patch
new file mode 100644
index 00000000..c4ae70b0
--- /dev/null
+++ b/recipes/incoming-clib/0001-posixtz-ensure-the-file-offset-we-pass-to-lseek-is-o.patch
@@ -0,0 +1,27 @@
+From e6765bd363d2dd1dcaeeae5117cc25aae53fb944 Mon Sep 17 00:00:00 2001
+From: William Pitcock <nenolod@dereferenced.org>
+Date: Thu, 28 Apr 2011 02:56:42 -0500
+Subject: [PATCH 1/2] posixtz: ensure the file offset we pass to lseek is off_t
+
+on 32-bit systems, sizeof(off_t) is 4, on 64-bit sizeof(off_t) is 8
+causing a word masking issue.
+---
+ posixtz.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/posixtz.c b/posixtz.c
+index cddcb3e..972ca31 100644
+--- a/posixtz-0.5/posixtz.c
++++ b/posixtz-0.5/posixtz.c
+@@ -36,7 +36,7 @@ char *posix_tz(const char *filename)
+ 	if (r != TZ_BUFLEN
+ 	    || strncmp(buf, "TZif", 4) != 0
+ 	    || (unsigned char)buf[4] < 2
+-	    || lseek(fd, -TZ_BUFLEN, SEEK_END) < 0
++	    || lseek(fd, (off_t) -TZ_BUFLEN, SEEK_END) < 0
+ 	   )
+ 		goto ERROR;
+ 
+-- 
+2.16.2
+
diff --git a/recipes/incoming-clib/0002-fix-implicit-declaration-warnings-by-including-strin.patch b/recipes/incoming-clib/0002-fix-implicit-declaration-warnings-by-including-strin.patch
new file mode 100644
index 00000000..6f61b25b
--- /dev/null
+++ b/recipes/incoming-clib/0002-fix-implicit-declaration-warnings-by-including-strin.patch
@@ -0,0 +1,28 @@
+From 89d4aece7ba679703060393ac95086fd514c7fc7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?S=C3=B6ren=20Tempel?= <soeren+git@soeren-tempel.net>
+Date: Tue, 27 Mar 2018 19:09:44 +0200
+Subject: [PATCH 2/2] fix implicit declaration warnings by including string.h
+ and unistd.h
+
+string.h is needed for strncmp(3) and unistd.h is needed for read(3),
+close(3) and lseek(3).
+---
+ posixtz.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/posixtz.c b/posixtz.c
+index 972ca31..4a36e10 100644
+--- a/posixtz-0.5/posixtz.c
++++ b/posixtz-0.5/posixtz.c
+@@ -14,6 +14,8 @@
+ #include <fcntl.h>
+ #include <limits.h>
+ #include <stdio.h>
++#include <string.h>
++#include <unistd.h>
+ 
+ #include "posixtz.h"
+ 
+-- 
+2.16.2
+
diff --git a/recipes/incoming-clib/adwaita-hello.toml b/recipes/incoming-clib/adwaita-hello.toml
deleted file mode 100644
index 10376968..00000000
--- a/recipes/incoming-clib/adwaita-hello.toml
+++ /dev/null
@@ -1,47 +0,0 @@
-# adwaita-hello — app Adwaita mínima de VALIDACIÓN: prueba que libadwaita-1.a es linkeable de verdad.
-# AdwApplication + AdwApplicationWindow + AdwToolbarView. Link 100% estático vía pkg-config --static
-# libadwaita-1 + las privadas de gdk/gsk/appstream que el .pc no declara. Mismo patrón que gtk4-hello.
-name    = "adwaita-hello"
-version = "1.7.6"
-
-[source]
-tarball = "https://download.gnome.org/sources/libadwaita/1.7/libadwaita-1.7.6.tar.xz"
-sha256  = "5eacc5550f0bdbba6a1568aebf25a3d88f5ee07d6b558becc6fd9487579c9a29"
-
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-
-[build.phases]
-configure = "true"
-compile = '''
-cat > adw_hello.c <<'CEOF'
-#include <adwaita.h>
-static void activate(GtkApplication *app, gpointer user_data) {
-  GtkWidget *win = adw_application_window_new(app);
-  gtk_window_set_title(GTK_WINDOW(win), "Adwaita en hammer");
-  gtk_window_set_default_size(GTK_WINDOW(win), 400, 260);
-  GtkWidget *toolbar = adw_toolbar_view_new();
-  adw_toolbar_view_add_top_bar(ADW_TOOLBAR_VIEW(toolbar), adw_header_bar_new());
-  GtkWidget *status = adw_status_page_new();
-  adw_status_page_set_title(ADW_STATUS_PAGE(status), "libadwaita static-musl ✓");
-  adw_toolbar_view_set_content(ADW_TOOLBAR_VIEW(toolbar), status);
-  adw_application_window_set_content(ADW_APPLICATION_WINDOW(win), toolbar);
-  gtk_window_present(GTK_WINDOW(win));
-}
-int main(int argc, char **argv) {
-  AdwApplication *app = adw_application_new("org.hammer.adw", G_APPLICATION_DEFAULT_FLAGS);
-  g_signal_connect(app, "activate", G_CALLBACK(activate), NULL);
-  int status = g_application_run(G_APPLICATION(app), argc, argv);
-  g_object_unref(app);
-  return status;
-}
-CEOF
-export PKG_CONFIG_PATH=/usr/lib/pkgconfig
-zig cc -mcpu=baseline -static adw_hello.c -o adwaita-hello $(pkg-config --cflags --libs --static libadwaita-1 harfbuzz-subset epoxy xkbcommon wayland-client wayland-egl libtiff-4 libjpeg cairo-script-interpreter)
-'''
-install = "mkdir -p /out/usr/bin && cp adwaita-hello /out/usr/bin/adwaita-hello"
-
-[deps]
-build = ["pkgconf", "libadwaita", "appstream", "libyaml", "curl", "openssl", "libxmlb", "libxml2", "zstd", "gtk4", "pango", "gdk-pixbuf", "cairo", "graphene", "glib", "harfbuzz", "fribidi", "fontconfig", "freetype", "pixman", "libpng", "expat", "libjpeg-turbo", "libtiff", "libepoxy", "wayland", "libxkbcommon", "libdrm", "pcre2", "libffi", "zlib", "mesa"]
diff --git a/recipes/incoming-clib/bash.toml b/recipes/incoming-clib/bash.toml
new file mode 100644
index 00000000..08681cee
--- /dev/null
+++ b/recipes/incoming-clib/bash.toml
@@ -0,0 +1,50 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "bash"
+version = "5.3.9"
+
+[source]
+tarball = "https://ftp.gnu.org/gnu/bash/bash-$_myver-patches/bash$_patchbase-$_pad$_i"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "426702c8b0fb9e0c9956259973ce5b657890fd47f4f807a64febf20077bb48d0b91474ed6e843d2ef277186b46c5fffa79b808da9b48d4ec027d5e2de1b28ed8"
+sha256  = "FIXME-sha256"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--bindir=/bin \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info \
+		--with-curses \
+		--disable-nls \
+		--enable-readline \
+		--without-bash-malloc \
+		--with-installed-readline
+	# parallel build workarounds
+	make y.tab.c && make builtins/libbuiltins.a && make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+mkdir -p "/out"/etc/bash
+	make DESTDIR="/out" install
+	install -Dm644  "$srcdir"/bashrc "/out"/etc/bash/bashrc
+	install -Dm644  "$srcdir"/profile-bashrc.sh "/out"/etc/profile.d/00-bashrc.sh
+	rm -rf "/out"/usr/share/locale
+}
+_abuild_phase
+'''
diff --git a/recipes/incoming-clib/busybox-logger.patch b/recipes/incoming-clib/busybox-logger.patch
new file mode 100644
index 00000000..220b914b
--- /dev/null
+++ b/recipes/incoming-clib/busybox-logger.patch
@@ -0,0 +1,13 @@
+diff --git a/hooks/dhcpcd-run-hooks.in b/hooks/dhcpcd-run-hooks.in
+index 91df64b..c6fb8c6 100644
+--- a/hooks/dhcpcd-run-hooks.in
++++ b/hooks/dhcpcd-run-hooks.in
+@@ -179,7 +179,7 @@ syslog()
+ 	*)		echo "$interface: $*";;
+ 	esac
+ 	if command -v logger >/dev/null 2>&1; then
+-		logger -i -p daemon."$lvl" -t dhcpcd-run-hooks "$interface: $*"
++		logger -p daemon."$lvl" -t dhcpcd-run-hooks "$interface: $*"
+ 	fi
+ }
+ 
diff --git a/recipes/incoming-clib/ca-certificates.toml b/recipes/incoming-clib/ca-certificates.toml
new file mode 100644
index 00000000..9d135300
--- /dev/null
+++ b/recipes/incoming-clib/ca-certificates.toml
@@ -0,0 +1,60 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "ca-certificates"
+version = "20260611"
+
+[source]
+tarball = "https://gitlab.alpinelinux.org/alpine/ca-certificates/-/archive/20260611/ca-certificates-20260611.tar.bz2"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "f473a1111eb508ef5d1096489479dba07db6b0d76ef2b900b3473933d57419429061d83e9c1e881ab61c4b0f17c64859ec74d670da6fc1d83d9b0fa73e1b7d8d"
+sha256  = "32ca73f2e81e2b88dc614f12e1ee04a82b1ec5a8e29d9f359ddf8905a0afcbb0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make install DESTDIR="/out"
+
+	(
+		echo "# Automatically generated by ca-certificates-20260611-r$pkgrel"
+		echo "# $(date -ud@$SOURCE_DATE_EPOCH)"
+		echo "#"
+		cd "/out"/usr/share/ca-certificates
+		find . -name '*.crt' | sort | cut -b3-
+	) > "/out"/etc/ca-certificates.conf
+
+	# generate the bundle in similar way as update-ca-certificates would do
+	find -- *.crt | sort | while read -r i; do
+		cat "$i"
+		printf "\n"
+	done > "/out"/etc/ssl/certs/ca-certificates.crt
+
+	mkdir -p "/out"/etc/apk/protected_paths.d
+	cat > "/out"/etc/apk/protected_paths.d/ca-certificates.list <<-EOF
+		-etc/ssl/certs/ca-certificates.crt
+		-etc/ssl/certs/ca-cert-*.pem
+		-etc/ssl/certs/[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f].[r0-9]*
+	EOF
+
+	cat > "/out"/etc/ca-certificates/update.d/certhash <<-EOF
+		#!/bin/sh
+		exec /usr/bin/c_rehash /etc/ssl/certs
+	EOF
+	chmod +x "/out"/etc/ca-certificates/update.d/certhash
+}
+_abuild_phase
+'''
diff --git a/recipes/incoming-clib/change-PATH.patch b/recipes/incoming-clib/change-PATH.patch
new file mode 100644
index 00000000..c0fb7a51
--- /dev/null
+++ b/recipes/incoming-clib/change-PATH.patch
@@ -0,0 +1,19 @@
+From: Jakub Jirutka <jakub@jirutka.cz>
+Date: Tue, 28 Jun 2022 22:36:16 +0200
+Subject: [PATCH] Change default PATH to the Alpine's default
+
+Use the same PATH as in openssh, sudo and our /etc/profile.
+
+--- a/doas.c
++++ b/doas.c
+@@ -238,8 +238,8 @@
+ int
+ main(int argc, char **argv)
+ {
+-	const char *safepath = "/bin:/sbin:/usr/bin:/usr/sbin:"
+-	    "/usr/local/bin:/usr/local/sbin";
++	const char *safepath = "/usr/local/sbin:/usr/local/bin:"
++	    "/usr/sbin:/usr/bin:/sbin:/bin";
+ 	const char *confpath = NULL;
+ 	char *shargv[] = { NULL, NULL };
+ 	char *sh;
diff --git a/recipes/incoming-clib/configuration-directory.patch b/recipes/incoming-clib/configuration-directory.patch
new file mode 100644
index 00000000..1ab9b968
--- /dev/null
+++ b/recipes/incoming-clib/configuration-directory.patch
@@ -0,0 +1,447 @@
+Patch-Source: https://github.com/Duncaen/OpenDoas/pull/71 (rebased + one extra commit)
+--
+From a6aa77d9f4b9ad4556e478d6779dbebd4143a98a Mon Sep 17 00:00:00 2001
+From: Ariadne Conill <ariadne@dereferenced.org>
+Date: Wed, 4 Aug 2021 04:47:04 -0600
+Subject: [PATCH] add --with-confdir feature
+
+This adds support for an /etc/doas.d configuration directory as discussed in #61. It is disabled by default.
+
+diff --git a/GNUmakefile b/GNUmakefile
+index 9470202..22be971 100644
+--- a/GNUmakefile
++++ b/GNUmakefile
+@@ -27,6 +27,7 @@ install: ${PROG} ${PAM_DOAS} ${MAN}
+ 	[ -n "${PAM_DOAS}" ] && chmod 0644 ${DESTDIR}${PAMDIR}/doas || true
+ 	cp -f doas.1 ${DESTDIR}${MANDIR}/man1
+ 	cp -f doas.conf.5 ${DESTDIR}${MANDIR}/man5
++	cp -f doas.d.5 ${DESTDIR}${MANDIR}/man5
+ 
+ uninstall:
+ 	rm -f ${DESTDIR}${BINDIR}/${PROG}
+diff --git a/README.md b/README.md
+index 20ef9f2..92acded 100644
+--- a/README.md
++++ b/README.md
+@@ -43,3 +43,12 @@ similar to sudo.
+ 
+ See the comment block in `timestamp.c` for an in-depth description on how
+ timestamps are created and checked to be as safe as possible.
++
++### `--with-doas-confdir`
++
++An optional feature can be enabled which will result in `doas` reading configuration
++snippets from `/etc/doas.d`.  These configuration snippets have the same requirements
++as `/etc/doas.conf` (owned by root, not world-writable).
++
++If this feature is enabled, only the `/etc/doas.d` directory is read, and the historical
++`/etc/doas.conf` file is ignored.
+\ No newline at end of file
+diff --git a/configure b/configure
+index 1c5d989..22a078e 100755
+--- a/configure
++++ b/configure
+@@ -28,6 +28,7 @@ usage: configure [options]
+   --without-shadow       disable shadow support
+ 
+   --with-timestamp       enable timestamp support
++  --with-doas-confdir    enable configuration directory support
+ 
+   --uid-max=NUM          set UID_MAX (default 65535)
+   --gid-max=NUM          set GID_MAX (default 65535)
+@@ -39,6 +40,7 @@ EOF
+ 
+ # defaults
+ WITHOUT_TIMESTAMP=yes
++WITHOUT_CONFDIR=yes
+ UID_MAX=65535
+ GID_MAX=65535
+ 
+@@ -58,6 +60,8 @@ for x; do
+ 	--target) TARGET=$var ;;
+ 	--enable-debug) DEBUG=yes ;;
+ 	--enable-static) BUILD_STATIC=yes ;;
++	--with-doas-confdir) WITHOUT_CONFDIR= ;;
++	--without-doas-confdir) WITHOUT_CONFDIR=yes ;;
+ 	--with-pam) WITHOUT_PAM=; WITHOUT_SHADOW=yes ;;
+ 	--with-shadow) WITHOUT_SHADOW=; WITHOUT_PAM=yes ;;
+ 	--without-pam) WITHOUT_PAM=yes ;;
+@@ -565,4 +569,8 @@ fi
+ 
+ printf '#define DOAS_CONF "%s/doas.conf"\n' "${SYSCONFDIR}" >>$CONFIG_H
+ 
++if [ -z "$WITHOUT_CONFDIR" ]; then
++	printf '#define DOAS_CONFDIR "%s/doas.d"\n' "${SYSCONFDIR}" >>$CONFIG_H
++fi
++
+ printf '\n#endif /* CONFIG_H */\n' >>$CONFIG_H
+diff --git a/doas.c b/doas.c
+index ac3a42a..d77186b 100644
+--- a/doas.c
++++ b/doas.c
+@@ -35,6 +35,7 @@
+ #include <syslog.h>
+ #include <errno.h>
+ #include <fcntl.h>
++#include <dirent.h>
+ 
+ #include "openbsd.h"
+ #include "doas.h"
+@@ -155,6 +156,7 @@ permit(uid_t uid, gid_t *groups, int ngroups, const struct rule **lastr,
+ static void
+ parseconfig(const char *filename, int checkperms)
+ {
++	extern const char *yyfn;
+ 	extern FILE *yyfp;
+ 	extern int yyparse(void);
+ 	struct stat sb;
+@@ -164,6 +166,8 @@ parseconfig(const char *filename, int checkperms)
+ 		err(1, checkperms ? "doas is not enabled, %s" :
+ 		    "could not open config file %s", filename);
+ 
++	yyfn = filename;
++
+ 	if (checkperms) {
+ 		if (fstat(fileno(yyfp), &sb) != 0)
+ 			err(1, "fstat(\"%s\")", filename);
+@@ -174,11 +178,82 @@ parseconfig(const char *filename, int checkperms)
+ 	}
+ 
+ 	yyparse();
++	yyfn = NULL;
++
+ 	fclose(yyfp);
+ 	if (parse_errors)
+ 		exit(1);
+ }
+ 
++#ifdef DOAS_CONFDIR
++static int
++isconfdir(const char *dirpath)
++{
++	struct stat sb;
++
++	if (lstat(dirpath, &sb) != 0) {
++		if (errno != ENOENT)
++			err(1, "lstat(\"%s\")", dirpath);
++
++		errno = ENOTDIR;
++		return 0;
++	}
++
++	if ((sb.st_mode & (S_IFMT)) == S_IFDIR)
++		return 1;
++
++	errno = ENOTDIR;
++	return 0;
++}
++
++static void
++parseconfdir(const char *dirpath, int checkperms)
++{
++	struct dirent **dirent_table;
++	int i, m, dirent_count;
++	char pathbuf[PATH_MAX];
++
++	if (!isconfdir(dirpath))
++		err(1, checkperms ? "doas is not enabled, %s" :
++		    "could not open config directory %s", dirpath);
++
++	dirent_count = scandir(dirpath, &dirent_table, NULL, alphasort);
++	if (dirent_count < 0)
++		err(1, checkperms ? "doas is not enabled, %s" :
++		    "could not open config directory %s", dirpath);
++
++	for (i = 0, m = 0; i < dirent_count; i++)
++	{
++		struct stat sb;
++		size_t pathlen;
++
++		pathlen = snprintf(pathbuf, sizeof pathbuf, "%s/%s", dirpath, dirent_table[i]->d_name);
++		free(dirent_table[i]);
++
++		/* make sure path ends in .conf */
++		if (pathlen < 6)
++			continue;
++
++		if (strcmp(pathbuf + (pathlen - 5), ".conf"))
++			continue;
++
++		if (stat(pathbuf, &sb) != 0)
++			err(1, "stat(\"%s\")", pathbuf);
++
++		if ((sb.st_mode & (S_IFMT)) != S_IFREG)
++			continue;
++
++		parseconfig(pathbuf, checkperms);
++		m++;
++	}
++
++	free(dirent_table);
++
++	if (!m)
++		errx(1, "doas is not enabled, %s: no matching configuration files found\n", dirpath);
++}
++#endif
++
+ static void __dead
+ checkconfig(const char *confpath, int argc, char **argv,
+     uid_t uid, gid_t *groups, int ngroups, uid_t target)
+@@ -188,6 +263,11 @@ checkconfig(const char *confpath, int argc, char **argv,
+ 	if (setresuid(uid, uid, uid) != 0)
+ 		err(1, "setresuid");
+ 
++#ifdef DOAS_CONFDIR
++	if (isconfdir(confpath))
++		parseconfdir(confpath, 0);
++	else
++#endif
+ 	parseconfig(confpath, 0);
+ 	if (!argc)
+ 		exit(0);
+@@ -330,6 +410,11 @@ main(int argc, char **argv)
+ 	if (geteuid())
+ 		errx(1, "not installed setuid");
+ 
++#ifdef DOAS_CONFDIR
++	if (isconfdir(DOAS_CONFDIR))
++		parseconfdir(DOAS_CONFDIR, 1);
++	else
++#endif
+ 	parseconfig(DOAS_CONF, 1);
+ 
+ 	/* cmdline is used only for logging, no need to abort on truncate */
+diff --git a/doas.conf.5 b/doas.conf.5
+index e98bfbe..e90d512 100644
+--- a/doas.conf.5
++++ b/doas.conf.5
+@@ -143,6 +143,7 @@ permit nopass keepenv setenv { PATH } root as root
+ .Ed
+ .Sh SEE ALSO
+ .Xr doas 1 ,
++.Xr doas.d 5 ,
+ .Xr syslogd 8
+ .Sh HISTORY
+ The
+diff --git a/doas.d.5 b/doas.d.5
+new file mode 100644
+index 0000000..c5eaa72
+--- /dev/null
++++ b/doas.d.5
+@@ -0,0 +1,50 @@
++.\"Copyright (c) 2021 Ariadne Conill <ariadne@dereferenced.org>
++.\"
++.\"Permission to use, copy, modify, and distribute this software for any
++.\"purpose with or without fee is hereby granted, provided that the above
++.\"copyright notice and this permission notice appear in all copies.
++.\"
++.\"THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++.\"WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++.\"MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++.\"ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++.\"WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++.\"ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
++.\"OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++.Dd $Mdocdate: October 9 2020 $
++.Dt DOAS.D 5
++.Os
++.Sh NAME
++.Nm doas.d
++.Nd doas configuration directory
++.Sh DESCRIPTION
++The
++.Xr doas 1
++utility executes commands as other users according to the rules
++configured in either the configuration file or, optionally, the
++configuration directory.  The preference to use the configuration
++file or configuration directory is determined at compile time,
++.Xr doas 1
++will only consult one or the other.
++.Pp
++Configuration snippets stored in the configuration directory
++follow the same rules as the classic
++.Xr doas 1
++configuration file, documented in
++.Xr doas.conf 5 .
++They must end with the .conf extension, or they will be ignored.
++.Pp
++These snippets are read in alphabetical order and thus can be
++ordered in the same way as other configuration directories.
++.Sh FILES
++.Bl -tag -width /etc/doas.d -compact
++.It Pa /etc/doas.d
++.Xr doas 1
++configuration directory.
++.Sh SEE ALSO
++.Xr doas 1 ,
++.Xr doas.conf 5
++.Sh HISTORY
++The
++.Nm
++configuration directory first appeared in OpenDoas.
+diff --git a/parse.y b/parse.y
+index 388c2a5..c6d7ebf 100644
+--- a/parse.y
++++ b/parse.y
+@@ -49,6 +49,7 @@ typedef struct {
+ } yystype;
+ #define YYSTYPE yystype
+ 
++const char *yyfn;
+ FILE *yyfp;
+ 
+ struct rule **rules;
+@@ -203,7 +204,7 @@ yyerror(const char *fmt, ...)
+ 	va_start(va, fmt);
+ 	vfprintf(stderr, fmt, va);
+ 	va_end(va);
+-	fprintf(stderr, " at line %d\n", yylval.lineno + 1);
++	fprintf(stderr, " at %s, line %d\n", yyfn, yylval.lineno + 1);
+ 	parse_errors++;
+ }
+ 
+--
+From c871cf723cc4cc1045ffc7de380f5271b4c29acf Mon Sep 17 00:00:00 2001
+From: Jakub Jirutka <jakub@jirutka.cz>
+Date: Sat, 13 May 2023 22:38:23 +0200
+Subject: [PATCH 9/9] read both /etc/doas.conf and /etc/doas.d/*.conf if
+ confdir is enabled
+
+The current behaviour of the configuration directory was required by the
+upstream, but it doesn't conform to established conventions used by
+virtually all programs on Linux that support modular configuration, and
+what the users naturally expect. Also, when someone used to vanilla
+OpenDoas or doas on BSD comes to Alpine, the way they're used to
+configuring it (via /etc/doas.conf) will no work without notice! It
+has already caused some problems and confusion.
+
+The current behaviour is: if /etc/doas.d exists, there must be at least one
+*.conf file and /etc/doas.conf is *ignored*.
+
+Since it doesn't look like the upstream will ever merge this, better to
+fix this patch to work as it should from the beginning...
+
+This new behaviour: /etc/doas.conf must always exist (as in unpatched
+OpenDoas) and will be read first; if /etc/doas.d exists and there are any
+*.conf files, they will be loaded as well.
+---
+ README.md |  7 +++----
+ doas.c    | 22 +++++-----------------
+ doas.d.5  | 14 +++++---------
+ 3 files changed, 13 insertions(+), 30 deletions(-)
+
+diff --git a/README.md b/README.md
+index 92acded..d5b2e72 100644
+--- a/README.md
++++ b/README.md
+@@ -48,7 +48,6 @@ timestamps are created and checked to be as safe as possible.
+ 
+ An optional feature can be enabled which will result in `doas` reading configuration
+ snippets from `/etc/doas.d`.  These configuration snippets have the same requirements
+-as `/etc/doas.conf` (owned by root, not world-writable).
+-
+-If this feature is enabled, only the `/etc/doas.d` directory is read, and the historical
+-`/etc/doas.conf` file is ignored.
+\ No newline at end of file
++as `/etc/doas.conf` (owned by root, not world-writable).  The main configuration file
++`/etc/doas.conf` is still required to exist and it is read before `/etc/doas.d`.  It is
++not an error if `/etc/doas.d` does not exist or no matching files are found there.
+diff --git a/doas.c b/doas.c
+index d77186b..affbe39 100644
+--- a/doas.c
++++ b/doas.c
+@@ -210,19 +210,14 @@ static void
+ parseconfdir(const char *dirpath, int checkperms)
+ {
+ 	struct dirent **dirent_table;
+-	int i, m, dirent_count;
++	int i, dirent_count;
+ 	char pathbuf[PATH_MAX];
+ 
+-	if (!isconfdir(dirpath))
+-		err(1, checkperms ? "doas is not enabled, %s" :
+-		    "could not open config directory %s", dirpath);
+-
+ 	dirent_count = scandir(dirpath, &dirent_table, NULL, alphasort);
+ 	if (dirent_count < 0)
+-		err(1, checkperms ? "doas is not enabled, %s" :
+-		    "could not open config directory %s", dirpath);
++		return;
+ 
+-	for (i = 0, m = 0; i < dirent_count; i++)
++	for (i = 0; i < dirent_count; i++)
+ 	{
+ 		struct stat sb;
+ 		size_t pathlen;
+@@ -244,13 +239,9 @@ parseconfdir(const char *dirpath, int checkperms)
+ 			continue;
+ 
+ 		parseconfig(pathbuf, checkperms);
+-		m++;
+ 	}
+ 
+ 	free(dirent_table);
+-
+-	if (!m)
+-		errx(1, "doas is not enabled, %s: no matching configuration files found\n", dirpath);
+ }
+ #endif
+ 
+@@ -263,12 +254,11 @@ checkconfig(const char *confpath, int argc, char **argv,
+ 	if (setresuid(uid, uid, uid) != 0)
+ 		err(1, "setresuid");
+ 
++	parseconfig(confpath, 0);
+ #ifdef DOAS_CONFDIR
+ 	if (isconfdir(confpath))
+ 		parseconfdir(confpath, 0);
+-	else
+ #endif
+-	parseconfig(confpath, 0);
+ 	if (!argc)
+ 		exit(0);
+ 
+@@ -410,13 +400,11 @@ main(int argc, char **argv)
+ 	if (geteuid())
+ 		errx(1, "not installed setuid");
+ 
++	parseconfig(DOAS_CONF, 1);
+ #ifdef DOAS_CONFDIR
+ 	if (isconfdir(DOAS_CONFDIR))
+ 		parseconfdir(DOAS_CONFDIR, 1);
+-	else
+ #endif
+-	parseconfig(DOAS_CONF, 1);
+-
+ 	/* cmdline is used only for logging, no need to abort on truncate */
+ 	(void)strlcpy(cmdline, argv[0], sizeof(cmdline));
+ 	for (i = 1; i < argc; i++) {
+diff --git a/doas.d.5 b/doas.d.5
+index c5eaa72..5911a12 100644
+--- a/doas.d.5
++++ b/doas.d.5
+@@ -21,14 +21,9 @@
+ The
+ .Xr doas 1
+ utility executes commands as other users according to the rules
+-configured in either the configuration file or, optionally, the
+-configuration directory.  The preference to use the configuration
+-file or configuration directory is determined at compile time,
+-.Xr doas 1
+-will only consult one or the other.
+-.Pp
+-Configuration snippets stored in the configuration directory
+-follow the same rules as the classic
++configured in the configuration file and, optionally, the
++configuration directory.  Configuration snippets stored in the
++configuration directory follow the same rules as the classic
+ .Xr doas 1
+ configuration file, documented in
+ .Xr doas.conf 5 .
+@@ -47,4 +42,5 @@ configuration directory.
+ .Sh HISTORY
+ The
+ .Nm
+-configuration directory first appeared in OpenDoas.
++configuration directory first appeared as a patch for doas on
++Alpine Linux and it is not supported in upstream OpenDoas.
diff --git a/recipes/incoming-clib/curl.toml b/recipes/incoming-clib/curl.toml
deleted file mode 100644
index 54b50a06..00000000
--- a/recipes/incoming-clib/curl.toml
+++ /dev/null
@@ -1,21 +0,0 @@
-# curl 8.11.1 — solo para satisfacer el link de appstream (libadwaita no descarga nada). Build MÍNIMO:
-# sin TLS/ldap/psl/nghttp2/brotli/zstd/idn — libcurl.a presente basta. autotools static.
-name    = "curl"
-version = "8.11.1"
-
-[source]
-tarball = "https://curl.se/download/curl-8.11.1.tar.xz"
-sha256  = "c7ca7db48b0909743eaef34250da02c19bc61d4f1dcedd6603f109409536ab56"
-
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-
-[build.phases]
-configure = "./configure --prefix=/usr --build=$CBUILD --host=$CHOST --disable-shared --enable-static --without-ssl --without-libpsl --without-nghttp2 --without-brotli --without-zstd --without-libidn2 --disable-ldap --disable-ldaps --disable-docs --disable-manual --with-zlib"
-compile   = "make -j4"
-install   = "make install DESTDIR=/out"
-
-[deps]
-build = ["zlib"]
diff --git a/recipes/incoming-clib/dbus.toml b/recipes/incoming-clib/dbus.toml
new file mode 100644
index 00000000..3b97bab2
--- /dev/null
+++ b/recipes/incoming-clib/dbus.toml
@@ -0,0 +1,48 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "dbus"
+version = "1.16.2"
+
+[source]
+tarball = "https://dbus.freedesktop.org/releases/dbus/dbus-1.16.2.tar.xz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "5c26f52d85984bb9ae1dde8d7e73921eacbdf020a61ff15f00a4c240cb38a121553ee04bd66e62b28425ff9bc50f4f5e15135166573ac0888332a01a0db1faa2"
+sha256  = "0ba2a1a4b16afe7bceb2c07e9ce99a8c2c3508e5dec290dbb643384bd6beb7e2"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+abuild-meson \
+		-Dsystem_pid_file=/run/dbus/dbus.pid \
+		output .
+	meson compile -C output
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+DESTDIR="/out" meson install --no-rebuild -C output
+	install -Dm644 "$srcdir"/README.alpine -t "/out"/usr/share/doc/dbus
+
+	install -Dm755 "$srcdir"/dbus.initd "/out"/etc/init.d/dbus
+	install -Dm644 "$srcdir"/dbus.confd "/out"/etc/conf.d/dbus
+	install -Dm755 "$srcdir"/dbus-user.initd "/out"/etc/user/init.d/dbus
+	install -Dm644 "$srcdir"/dbus-user.confd "/out"/etc/user/conf.d/dbus
+
+	# can't install tmpfs
+	rm -r "/out"/run
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["expat", "glib", "libsm", "libx11", "xmlto"]
diff --git a/recipes/incoming-clib/dhcpcd.toml b/recipes/incoming-clib/dhcpcd.toml
new file mode 100644
index 00000000..a9a8a2e4
--- /dev/null
+++ b/recipes/incoming-clib/dhcpcd.toml
@@ -0,0 +1,54 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "dhcpcd"
+version = "10.3.2"
+
+[source]
+tarball = "https://github.com/NetworkConfiguration/dhcpcd/releases/download/v10.3.2/dhcpcd-10.3.2.tar.xz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "5944fa141bd40c8aabb2c3c46748d736f69f6fd0a773386508cbff868d8f69d88305a0fd97dff4da21c5662918016b36d8327498e5b0509804dbec80603f6d6d"
+sha256  = "b6aa46932074906a9badef1bfe142b8aff9d041c2689e1ef8b74c12e9fd942bd"
+patches = ["busybox-logger.patch", "fix-chrony-conf-location.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--localstatedir=/var \
+		--libexecdir=/usr/lib/dhcpcd \
+		--dbdir=/var/lib/dhcpcd \
+		--rundir=/run/dhcpcd \
+		--runstatedir=/run/dhcpcd \
+		--enable-ipv6 \
+		--enable-privsep \
+		--enable-seccomp \
+		--without-dev \
+		--without-udev
+	make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install
+	install -Dm755 "$srcdir"/dhcpcd.initd \
+		"/out"/etc/init.d/dhcpcd
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["linux-headers", "bsd-compat-headers"]
diff --git a/recipes/incoming-clib/doas.toml b/recipes/incoming-clib/doas.toml
new file mode 100644
index 00000000..2794e041
--- /dev/null
+++ b/recipes/incoming-clib/doas.toml
@@ -0,0 +1,47 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "doas"
+version = "6.8.2"
+
+[source]
+tarball = "https://github.com/Duncaen/OpenDoas/archive/v6.8.2.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "4a93ff477413c859ba2702e688fa4f83248fff85e61e12336838a1e9aa1a8d9963a9782e4bc5e58e8d04b86c2c8ceb6b235ae9d3b32b3e548a2514a43653137d"
+sha256  = "6da058a0e70b7543bc60624389b0b00b686189ec933828c522bf8b2600495a67"
+patches = ["configuration-directory.patch", "manpage-example-path.patch", "change-PATH.patch", "rowhammer.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+./configure \
+		--prefix=/usr \
+		--without-pam \
+		--with-timestamp \
+		--with-doas-confdir
+	make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make install DESTDIR="/out"
+
+	install -d -m 750 "/out"/etc/doas.d
+	install -m 640 "$srcdir"/doas.conf -t "/out"/etc/
+
+	install -D -m 644 "$srcdir"/doas.conf "/out"/usr/share/doc/doas/doas.conf.example
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["bison"]
diff --git a/recipes/incoming-clib/dont-use-nobody.patch b/recipes/incoming-clib/dont-use-nobody.patch
new file mode 100644
index 00000000..180c18d5
--- /dev/null
+++ b/recipes/incoming-clib/dont-use-nobody.patch
@@ -0,0 +1,15 @@
+rootbld makes all the supplementary groups nobody(65534);
+this patch avoids using them in tests
+
+diff --git a/getgroups.c b/getgroups.c
+index 8a37ed0..01adfca 100644
+--- a/getgroups.c
++++ b/getgroups.c
+@@ -48,6 +48,7 @@
+ #endif
+ 
+ 	for (i = 0; i < n; i++)  {
++		if (list[i] == 65534) continue;
+ 		printf("%lu ", (unsigned long)list[i]);
+ 		if (list[i] == gid)
+ 			gid_in_list = 1;
diff --git a/recipes/incoming-clib/libffi.toml b/recipes/incoming-clib/dosfstools.toml
similarity index 60%
rename from recipes/incoming-clib/libffi.toml
rename to recipes/incoming-clib/dosfstools.toml
index 6fbcd3f6..341f793e 100644
--- a/recipes/incoming-clib/libffi.toml
+++ b/recipes/incoming-clib/dosfstools.toml
@@ -1,15 +1,14 @@
 # Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
 # YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
 # sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
-name    = "libffi"
-version = "3.5.2"
+name    = "dosfstools"
+version = "4.2"
 
 [source]
-tarball = "https://github.com/libffi/libffi/releases/download/v3.5.2/libffi-3.5.2.tar.gz"
+tarball = "https://github.com/dosfstools/dosfstools/releases/download/v4.2/dosfstools-4.2.tar.gz"
 # FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
-# sha512 = "76974a84e3aee6bbd646a6da2e641825ae0b791ca6efdc479b2d4cbcd3ad607df59cffcf5031ad5bd30822961a8c6de164ac8ae379d1804acd388b1975cdbf4d"
-sha256  = "f3a3082a23b37c293a4fcd1053147b371f2ff91fa7ea1b2a52e335676bac82dc"
-patches = ["fix-tests-fortify.patch"]
+# sha512 = "3cc0808edb4432428df8a67da4bb314fd1f27adc4a05754c1a492091741a7b6875ebd9f6a509cc4c5ad85643fc40395b6e0cadee548b25cc439cc9b725980156"
+sha256  = "64926eebf90092dca21b14259a5301b7b98e7b1943e8a201c7d726084809b527"
 
 [build]
 compiler = "zig-cc"
@@ -22,13 +21,15 @@ flags    = []
 compile = '''
 _abuild_phase() {
 ./configure \
-		--disable-shared --enable-static \
 		--build=$CBUILD \
 		--host=$CHOST \
 		--prefix=/usr \
-		--enable-pax_emutramp \
-		--enable-portable-binary \
-		--disable-exec-static-tramp
+		--sbindir=/sbin \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--localstatedir=/var \
+		--disable-nls \
+		--enable-compat-symlinks
 	make
 }
 _abuild_phase
@@ -40,3 +41,6 @@ make DESTDIR="/out" install
 }
 _abuild_phase
 '''
+
+[deps]
+build = ["linux-headers", "autoconf", "automake", "libtool"]
diff --git a/recipes/incoming-clib/e2fsprogs.toml b/recipes/incoming-clib/e2fsprogs.toml
new file mode 100644
index 00000000..56a89645
--- /dev/null
+++ b/recipes/incoming-clib/e2fsprogs.toml
@@ -0,0 +1,61 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "e2fsprogs"
+version = "1.47.4"
+
+[source]
+tarball = "https://github.com/tytso/e2fsprogs/archive/v1.47.4.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "923c1ba52cf48557e190ee936be47ff3e43e4798950499e3c663f0f077470caefbb69ee845ebe1f969b3e7c1bb0c22e507188f1daca24649c54c5843c835b2f9"
+sha256  = "9f82eaa7002673291629077b80ee005cadfcd49854907a22007fed70b0ef596e"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--localstatedir=/var \
+		--with-udev-rules-dir=no \
+		--enable-elf-shlibs \
+		--enable-symlink-install \
+		--disable-fsck \
+		--disable-uuidd \
+		--disable-libuuid \
+		--disable-libblkid \
+		--disable-nls \
+		--enable-lto
+	make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make -j1 DESTDIR="/out" install install-libs
+	mkdir -p "/out"/sbin/
+	local i; for i in e2fsck mke2fs mkfs.* fsck.*; do
+		mv "/out"/usr/sbin/$i "/out"/sbin/
+	done
+	# overwrite busybox symlinks
+	mkdir -p "/out"/bin/
+	for i in chattr lsattr; do
+		mv "/out"/usr/bin/$i "/out"/bin/
+	done
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["linux-headers", "fuse3"]
diff --git a/recipes/incoming-clib/expat.toml b/recipes/incoming-clib/expat.toml
deleted file mode 100644
index 2860780b..00000000
--- a/recipes/incoming-clib/expat.toml
+++ /dev/null
@@ -1,14 +0,0 @@
-# expat 2.8.2 — parser XML (lo usa fontconfig). autotools static, leaf.
-name    = "expat"
-version = "2.8.2"
-[source]
-tarball = "https://github.com/libexpat/libexpat/releases/download/R_2_8_2/expat-2.8.2.tar.xz"
-sha256  = "3ad89b8588e6644bd4e49981480d48b21289eebbcd4f0a1a4afb1c29f99b6ab4"
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-[build.phases]
-configure = "./configure --prefix=/usr --disable-shared --enable-static --without-docbook --without-examples --without-tests"
-compile   = "make"
-install   = "make install DESTDIR=/out"
diff --git a/recipes/incoming-clib/fix-chrony-conf-location.patch b/recipes/incoming-clib/fix-chrony-conf-location.patch
new file mode 100644
index 00000000..b75df9f3
--- /dev/null
+++ b/recipes/incoming-clib/fix-chrony-conf-location.patch
@@ -0,0 +1,11 @@
+--- a/hooks/50-ntp.conf
++++ b/hooks/50-ntp.conf
+@@ -17,7 +17,7 @@
+ # above examples.
+ 
+ : ${ntp_confs:=ntp.conf ntpd.conf chrony.conf}
+-: ${ntp_conf_dirs=/etc /usr/pkg/etc /usr/local/etc}
++: ${ntp_conf_dirs=/etc /etc/chrony /usr/pkg/etc /usr/local/etc}
+ ntp_conf_dir="$state_dir/ntp.conf"
+ 
+ # If NTP_CONF is not set, work out a good default
diff --git a/recipes/incoming-clib/fix-includes.patch b/recipes/incoming-clib/fix-includes.patch
new file mode 100644
index 00000000..c6eff0eb
--- /dev/null
+++ b/recipes/incoming-clib/fix-includes.patch
@@ -0,0 +1,10 @@
+--- parted-3.1.orig/libparted/fs/xfs/platform_defs.h
++++ parted-3.1/libparted/fs/xfs/platform_defs.h
+@@ -35,6 +35,7 @@
+ #define __XFS_PLATFORM_DEFS_H__
+ 
+ #include <stdio.h>
++#include <fcntl.h>
+ #include <stdarg.h>
+ #include <assert.h>
+ #include <endian.h>
diff --git a/recipes/incoming-clib/fix-libintl-header-s390x.patch b/recipes/incoming-clib/fix-libintl-header-s390x.patch
new file mode 100644
index 00000000..68ae7d27
--- /dev/null
+++ b/recipes/incoming-clib/fix-libintl-header-s390x.patch
@@ -0,0 +1,58 @@
+From 4b2a566a3e007184d3ee9ce5b399a63eebbdadc3 Mon Sep 17 00:00:00 2001
+From: "Tuan M. Hoang" <tmhoang@flatglobe.org>
+Date: Thu, 23 Feb 2017 07:53:02 +0000
+Subject: [PATCH] main/parted: disable nls on s390x
+
+Because we build with --disable-nls by default, we need to remove libintl.h in 
+these files on s390x. This is specific for DASD devices only on s390x.
+---
+ libparted/labels/dasd.c  | 2 +-
+ libparted/labels/fdasd.c | 2 +-
+ libparted/labels/vtoc.c  | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/libparted/labels/dasd.c b/libparted/labels/dasd.c
+index fa9414f..5acf844 100644
+--- a/libparted/labels/dasd.c
++++ b/libparted/labels/dasd.c
+@@ -40,8 +40,8 @@
+ #include <parted/fdasd.h>
+ #include <arch/linux.h>
+ 
+-#include <libintl.h>
+ #if ENABLE_NLS
++#  include <libintl.h>
+ #  define _(String) dgettext (PACKAGE, String)
+ #else
+ #  define _(String) (String)
+diff --git a/libparted/labels/fdasd.c b/libparted/labels/fdasd.c
+index 1f87937..e6a9086 100644
+--- a/libparted/labels/fdasd.c
++++ b/libparted/labels/fdasd.c
+@@ -24,8 +24,8 @@
+ 
+ #include <parted/parted.h>
+ 
+-#include <libintl.h>
+ #if ENABLE_NLS
++#  include <libintl.h>
+ #  define _(String) dgettext (PACKAGE, String)
+ #else
+ #  define _(String) (String)
+diff --git a/libparted/labels/vtoc.c b/libparted/labels/vtoc.c
+index fdfa94f..64ba149 100644
+--- a/libparted/labels/vtoc.c
++++ b/libparted/labels/vtoc.c
+@@ -12,8 +12,8 @@
+ 
+ #include <parted/parted.h>
+ 
+-#include <libintl.h>
+ #if ENABLE_NLS
++#  include <libintl.h>
+ #  define _(String) dgettext (PACKAGE, String)
+ #else
+ #  define _(String) (String)
+-- 
+2.11.1
+
diff --git a/recipes/incoming-clib/fix-t4219-with-sticky-bit.patch b/recipes/incoming-clib/fix-t4219-with-sticky-bit.patch
new file mode 100644
index 00000000..54ac184f
--- /dev/null
+++ b/recipes/incoming-clib/fix-t4219-with-sticky-bit.patch
@@ -0,0 +1,48 @@
+The last test of t4129 creates a directory and expects its setgid bit
+(g+s) to be off. But this makes the test fail when the parent directory
+has the bit set, as setgid's state is inherited by newly created
+subdirectories. Make the test more robust by accepting the presence of
+the setgid bit on the created directory. We only allow 'S' (setgid on
+but no executable permission) and not 's' (setgid on with executable
+permission) because the previous 'umask 0077' shouldn't allow the second
+scenario to happen.
+
+Note that only subdirectories inherit this bit, so we don't have to make
+the same change for the regular file that is also created by this test.
+But checking the permissions using grep instead of test_cmp makes the
+test a little simpler, so let's use it for the regular file as well.
+
+Also note that the sticky bit (+t) and the setuid bit (u+s) are not
+inherited, so we don't have to worry about those.
+
+Reported-by: Kevin Daudt <me@ikke.info>
+Signed-off-by: Matheus Tavares <matheus.bernardino@usp.br>
+---
+ t/t4129-apply-samemode.sh | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/t/t4129-apply-samemode.sh b/t/t4129-apply-samemode.sh
+index 41818d8315..3818398ca9 100755
+--- a/t/t4129-apply-samemode.sh
++++ b/t/t4129-apply-samemode.sh
+@@ -90,12 +90,10 @@ test_expect_success POSIXPERM 'do not use core.sharedRepository for working tree
+ 		rm -rf d f1 &&
+ 		git apply patch-f1-and-f2.txt &&
+ 
+-		echo "-rw-------" >f1_mode.expected &&
+-		echo "drwx------" >d_mode.expected &&
+-		test_modebits f1 >f1_mode.actual &&
+-		test_modebits d >d_mode.actual &&
+-		test_cmp f1_mode.expected f1_mode.actual &&
+-		test_cmp d_mode.expected d_mode.actual
++		test_modebits f1 >f1_mode &&
++		test_modebits d >d_mode &&
++		grep "^-rw-------$" f1_mode &&
++		grep "^drwx--[-S]---$" d_mode
+ 	)
+ '
+ 
+-- 
+2.29.2
+
+
diff --git a/recipes/incoming-clib/fix-truncate-tests.patch b/recipes/incoming-clib/fix-truncate-tests.patch
new file mode 100644
index 00000000..c7c6667f
--- /dev/null
+++ b/recipes/incoming-clib/fix-truncate-tests.patch
@@ -0,0 +1,48 @@
+Fixes for BusyBox's truncate
+--- a/tests/t0290-gpt-name.sh
++++ b/tests/t0290-gpt-name_.sh
+@@ -21,7 +21,7 @@
+ 
+ dev=loop-file
+ 
+-truncate --size 50MiB "$dev" || fail=1
++truncate -s 50M "$dev" || fail=1
+ 
+ # create partition with empty name
+ parted --script "$dev" mklabel gpt mkpart '""' ext4 1MiB 49MiB > out 2>&1 || fail=1
+
+--- a/tests/t0215-gpt-attrs.sh
++++ b/tests/t0215-gpt-attrs.sh
+@@ -23,7 +23,7 @@
+ dev=loop-file
+ 
+ # create device
+-truncate --size 50MiB "$dev" || fail=1
++truncate -s 50M "$dev" || fail=1
+ 
+ # create gpt label and one partitions
+ parted --script "$dev" mklabel gpt > out 2>&1 || fail=1
+
+--- a/tests/t0801-json-msdos.sh
++++ b/tests/t0801-json-msdos.sh
+@@ -23,7 +23,7 @@
+ dev=loop-file
+ 
+ # create device
+-truncate --size 50MiB "$dev" || fail=1
++truncate -s 50M "$dev" || fail=1
+ 
+ # create msdos label and some partitions
+ parted --script "$dev" mklabel msdos > out 2>&1 || fail=1
+
+--- a/tests/t0800-json-gpt.sh
++++ b/tests/t0800-json-gpt.sh
+@@ -23,7 +23,7 @@
+ dev=loop-file
+ 
+ # create device
+-truncate --size 50MiB "$dev" || fail=1
++truncate -s 50M "$dev" || fail=1
+ 
+ # create gpt label and some partitions
+ parted --script "$dev" mklabel gpt > out 2>&1 || fail=1
diff --git a/recipes/incoming-clib/foot.toml b/recipes/incoming-clib/foot.toml
new file mode 100644
index 00000000..e64cc749
--- /dev/null
+++ b/recipes/incoming-clib/foot.toml
@@ -0,0 +1,60 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "foot"
+version = "1.27.0"
+
+[source]
+tarball = "https://codeberg.org/dnkl/foot/archive/1.27.0.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "cb4635c2afc18799c3c5b30715e575e0fa7e1621a1b6dab27bebdb9a530fd999a7d551986404ad17aaa8a8986e7250541a33324ef4acc5a6ff8058537545400b"
+sha256  = "FIXME-sha256"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+export CFLAGS="$CFLAGS -O3" # -O3 as the package is intended to use it
+	export CXXFLAGS="$CXXFLAGS -O3"
+	export CPPFLAGS="$CPPFLAGS -O3"
+
+	abuild-meson \
+		-Db_pgo=generate \
+		-Db_lto=true \
+		-Dterminfo-base-name=foot-extra \
+		-Dutmp-backend=none \
+		. output
+	meson compile -C output
+
+	ninja -C output test
+
+	# segfault on loongarch64
+	if [ "$CARCH" != "loongarch64" ]; then
+		./pgo/full-headless-cage.sh . output
+	fi
+
+	meson configure -Db_pgo=use output
+	meson compile -C output
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+DESTDIR="/out" meson install --no-rebuild -C output
+
+	install -Dm755 "$srcdir"/foot.initd "/out"/etc/user/init.d/foot
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): ncurses-terminfo
+
+[deps]
+build = ["cage", "font-dejavu", "fcft", "fontconfig", "freetype", "libxkbcommon", "ncurses", "pixman", "scdoc", "tllist", "utf8proc", "wayland", "wayland-protocols"]
diff --git a/recipes/incoming-clib/freetype.toml b/recipes/incoming-clib/freetype.toml
deleted file mode 100644
index 3bb0c88c..00000000
--- a/recipes/incoming-clib/freetype.toml
+++ /dev/null
@@ -1,22 +0,0 @@
-# freetype 2.14.3 — ladrillo base de GUI (rasterizado de fuentes). Reescrita LIMPIA del import Alpine
-# (abuild-meson + ft2demos como fuente aparte) a meson static mínimo del lab. Sin png/harfbuzz/brotli
-# (deps opcionales) ⇒ leaf; zlib es la única dep real.
-name    = "freetype"
-version = "2.14.3"
-
-[source]
-tarball = "https://download.savannah.gnu.org/releases/freetype/freetype-2.14.3.tar.xz"
-sha256  = "36bc4f1cc413335368ee656c42afca65c5a3987e8768cc28cf11ba775e785a5f"
-
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-
-[build.phases]
-configure = "PYTHONPATH=/usr/lib/python3.12/site-packages meson setup output --prefix=/usr --buildtype=release -Ddefault_library=static -Dharfbuzz=disabled -Dpng=disabled -Dbrotli=disabled -Dtests=disabled"
-compile   = "PYTHONPATH=/usr/lib/python3.12/site-packages ninja -C output"
-install   = "PYTHONPATH=/usr/lib/python3.12/site-packages DESTDIR=/out meson install -C output --no-rebuild"
-
-[deps]
-build = ["meson", "samurai", "python3", "pkgconf", "zlib"]
diff --git a/recipes/incoming-clib/git.toml b/recipes/incoming-clib/git.toml
new file mode 100644
index 00000000..461fc18f
--- /dev/null
+++ b/recipes/incoming-clib/git.toml
@@ -0,0 +1,54 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "git"
+version = "2.54.0"
+
+[source]
+tarball = "https://www.kernel.org/pub/software/scm/git/git-2.54.0.tar.xz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "cb363917124edc245c9f6745e6e0c4093990275b4d57f9d2213c655b304ac81b05ece8d88546122727495ebc48a5ae19ab166a3ee43b6b8c68da488ac0270064"
+sha256  = "f689162364c10de79ef89aa8dbf48731eb057e34edbbd20aca510ce0154681a3"
+patches = ["fix-t4219-with-sticky-bit.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+make prefix=/usr \
+		DESTDIR="/out" \
+		perllibdir="$(_perl_config vendorlib)" \
+		all
+
+	make -C contrib/subtree prefix=/usr DESTDIR="/out"
+	make -C contrib/diff-highlight prefix=/usr DESTDIR="/out"
+
+	if [ -n "$_full_build" ]; then
+		# generate manpages outside of package()
+		make prefix=/usr man
+
+		make prefix=/usr -C contrib/credential/libsecret
+	fi
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make -C t prefix=/usr DESTDIR="/out" \
+		perlibdir="$(_perl_config vendorlib)" \
+		all
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): perl
+
+[deps]
+build = ["asciidoc", "python3", "tcl", "tk", "libsecret", "glib"]
diff --git a/recipes/incoming-clib/gtk4-hello.toml b/recipes/incoming-clib/gtk4-hello.toml
deleted file mode 100644
index 017e29a5..00000000
--- a/recipes/incoming-clib/gtk4-hello.toml
+++ /dev/null
@@ -1,47 +0,0 @@
-# gtk4-hello — app GTK4 mínima de VALIDACIÓN: prueba que libgtk-4.a (static) es linkeable de verdad.
-# Reutiliza el tarball de GTK4 solo como acarreo de [source] (lo ignora); escribe su propio hello.c y
-# lo linkea ESTÁTICO contra todo el cierre GTK4 vía `pkg-config --static gtk4`. Si sella, el toolkit
-# de GUI del lab es usable por apps, no solo "compila". deps = cierre .pc completo + gtk4.
-name    = "gtk4-hello"
-version = "4.18.6"
-
-[source]
-tarball = "https://download.gnome.org/sources/gtk/4.18/gtk-4.18.6.tar.xz"
-sha256  = "e1817c650ddc3261f9a8345b3b22a26a5d80af154630dedc03cc7becefffd0fa"
-
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-
-[build.phases]
-# no-op: el tarball trae meson.build y el lab inyectaría `meson setup` por defecto si omito configure.
-configure = "true"
-compile = '''
-cat > hammer_hello.c <<'CEOF'
-#include <gtk/gtk.h>
-static void activate(GtkApplication *app, gpointer user_data) {
-  GtkWidget *win = gtk_application_window_new(app);
-  gtk_window_set_title(GTK_WINDOW(win), "Hola desde hammer");
-  gtk_window_set_default_size(GTK_WINDOW(win), 360, 220);
-  GtkWidget *label = gtk_label_new("GTK4 static-musl ✓ (zig cc)");
-  gtk_window_set_child(GTK_WINDOW(win), label);
-  gtk_window_present(GTK_WINDOW(win));
-}
-int main(int argc, char **argv) {
-  GtkApplication *app = gtk_application_new("org.hammer.hola", G_APPLICATION_DEFAULT_FLAGS);
-  g_signal_connect(app, "activate", G_CALLBACK(activate), NULL);
-  int status = g_application_run(G_APPLICATION(app), argc, argv);
-  g_object_unref(app);
-  return status;
-}
-CEOF
-# gtk4.pc NO declara Libs.private (asume link dinámico contra libgtk-4.so); para ESTÁTICO hay que sumar
-# las privadas que gdk/gsk linkean directo (harfbuzz-subset, epoxy, wayland, xkbcommon, tiff, jpeg).
-export PKG_CONFIG_PATH=/usr/lib/pkgconfig
-zig cc -mcpu=baseline -static hammer_hello.c -o gtk4-hello $(pkg-config --cflags --libs --static gtk4 harfbuzz-subset epoxy xkbcommon wayland-client wayland-egl libtiff-4 libjpeg cairo-script-interpreter)
-'''
-install = "mkdir -p /out/usr/bin && cp gtk4-hello /out/usr/bin/gtk4-hello"
-
-[deps]
-build = ["pkgconf", "gtk4", "pango", "gdk-pixbuf", "cairo", "graphene", "glib", "harfbuzz", "fribidi", "fontconfig", "freetype", "pixman", "libpng", "expat", "libjpeg-turbo", "libtiff", "libepoxy", "wayland", "libxkbcommon", "libdrm", "pcre2", "libffi", "zlib", "mesa"]
diff --git a/recipes/incoming-clib/gtk4.toml b/recipes/incoming-clib/gtk4.toml
deleted file mode 100644
index e4b78d85..00000000
--- a/recipes/incoming-clib/gtk4.toml
+++ /dev/null
@@ -1,39 +0,0 @@
-# gtk4 4.18.6 — el toolkit de GUI. meson static, backend SOLO wayland (sin X11/broadway/win/mac),
-# renderer GL vía libepoxy (vulkan disabled), todo lo opcional off (demos/tests/docs/cups/gstreamer/
-# introspection). Corona el stack gráfico C del lab: con esto el corpus puede producir apps GTK reales.
-# Deps = cierre transitivo .pc completo (pkg-config estático resuelve Requires.private).
-name    = "gtk4"
-version = "4.18.6"
-
-[source]
-tarball = "https://download.gnome.org/sources/gtk/4.18/gtk-4.18.6.tar.xz"
-sha256  = "e1817c650ddc3261f9a8345b3b22a26a5d80af154630dedc03cc7becefffd0fa"
-
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-
-[build.phases]
-# GTK4 construye libgtk.a (static_library 'gtk') Y libgtk-4.so; las tools linkean la .so con libgtk_dep,
-# imposible en el lab static-musl. Parche: que las tools usen libgtk_static_dep (la .a). El sed es seguro:
-# "libgtk_dep" NO es substring de "libgtk_static_dep" ⇒ no toca las que ya usan el estático.
-configure = "sed -i 's/libgtk_dep/libgtk_static_dep/g' tools/meson.build && PKG_CONFIG_PATH=/usr/lib/pkgconfig PYTHONPATH=/usr/lib/python3.12/site-packages meson setup output --prefix=/usr --buildtype=release --wrap-mode=nodownload --prefer-static -Ddefault_library=static -Dwayland-backend=true -Dx11-backend=false -Dbroadway-backend=false -Dwin32-backend=false -Dmacos-backend=false -Dvulkan=disabled -Dintrospection=disabled -Dbuild-demos=false -Dbuild-testsuite=false -Dbuild-tests=false -Dbuild-examples=false -Dmedia-gstreamer=disabled -Dprint-cups=disabled -Dprint-cpdb=disabled -Dcloudproviders=disabled -Dsysprof=disabled -Dtracker=disabled -Dcolord=disabled -Df16c=disabled -Ddocumentation=false -Dman-pages=false -Dc_args=-Wno-error=date-time"
-compile   = "PYTHONPATH=/usr/lib/python3.12/site-packages ninja -C output"
-# meson instala solo libgtk-4.so y genera convenience-libs THIN (gtk/gdk/gsk por separado, referencian
-# los .o por ruta → inútiles fuera del build dir). Fusiono los tres en UN archive GORDO libgtk-4.a (embebe
-# todos los .o) para que `-lgtk-4` + `-static` linkee de verdad en el lab static-musl.
-install = '''
-PYTHONPATH=/usr/lib/python3.12/site-packages DESTDIR=/out meson install -C output --no-rebuild
-rm -f /out/usr/lib/libgtk-4.a
-cd output
-objs=""
-for a in $(find . -name '*.a'); do
-  d=$(dirname "$a"); b=$(basename "$a")
-  for o in $(cd "$d" && zig ar t "$b"); do objs="$objs $d/$o"; done
-done
-zig ar rcs /out/usr/lib/libgtk-4.a $objs
-'''
-
-[deps]
-build = ["meson", "samurai", "python3", "pkgconf", "glib", "cairo", "pango", "gdk-pixbuf", "graphene", "libepoxy", "wayland", "wayland-protocols", "libxkbcommon", "libdrm", "fontconfig", "harfbuzz", "fribidi", "libpng", "pixman", "freetype", "expat", "libffi", "pcre2", "zlib", "libjpeg-turbo", "libtiff", "mesa"]
diff --git a/recipes/incoming-clib/gtksourceview.toml b/recipes/incoming-clib/gtksourceview.toml
deleted file mode 100644
index 0d8159d9..00000000
--- a/recipes/incoming-clib/gtksourceview.toml
+++ /dev/null
@@ -1,23 +0,0 @@
-# gtksourceview 5.16.0 — widget de edición de código (resaltado, números de línea…) sobre GTK4.
-# Base de editores/IDEs (gnome-text-editor lo usa). meson static. introspection/vapi/docs/tests off.
-name    = "gtksourceview"
-version = "5.16.0"
-
-[source]
-tarball = "https://download.gnome.org/sources/gtksourceview/5.16/gtksourceview-5.16.0.tar.xz"
-sha256  = "ab35d420102f3e8b055dd3b8642d3a48209f888189e6254d0ffb4b6a7e8c3566"
-
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-
-[build.phases]
-# gtksourceview 5.16 no tiene opción tests; los ejecutables de tests/testsuite linkean gtk4 estático y
-# fallan por las privadas (tiff/epoxy/cairo-script). La LIB sí construye → elimino esos subdirs con sed.
-configure = "sed -i \"/subdir('tests')/d;/subdir('testsuite')/d\" meson.build && PKG_CONFIG_PATH=/usr/lib/pkgconfig PYTHONPATH=/usr/lib/python3.12/site-packages meson setup output --prefix=/usr --buildtype=release --wrap-mode=nodownload --prefer-static -Ddefault_library=static -Dintrospection=disabled -Dvapi=false -Ddocumentation=false -Dsysprof=false -Dc_args=-Wno-error=date-time"
-compile   = "PYTHONPATH=/usr/lib/python3.12/site-packages ninja -C output"
-install   = "PYTHONPATH=/usr/lib/python3.12/site-packages DESTDIR=/out meson install -C output --no-rebuild"
-
-[deps]
-build = ["meson", "samurai", "python3", "pkgconf", "gettext-tiny", "gtk4", "pango", "gdk-pixbuf", "cairo", "graphene", "glib", "harfbuzz", "fribidi", "fontconfig", "freetype", "pixman", "libpng", "expat", "libxml2", "libjpeg-turbo", "libtiff", "libepoxy", "wayland", "wayland-protocols", "libxkbcommon", "libdrm", "pcre2", "libffi", "zlib", "mesa"]
diff --git a/recipes/incoming-clib/hammer-edit.toml b/recipes/incoming-clib/hammer-edit.toml
deleted file mode 100644
index 175956d1..00000000
--- a/recipes/incoming-clib/hammer-edit.toml
+++ /dev/null
@@ -1,138 +0,0 @@
-# hammer-edit — editor de código REAL para el distro: Adwaita + GtkSourceView, abrir/guardar/guardar-como
-# (GtkFileDialog), resaltado por extensión, números de línea, apertura de archivos desde la CLI. Link 100%
-# estático (gtk4+libadwaita+gtksourceview). No es una demo: es una app instalable y usable.
-name    = "hammer-edit"
-version = "1.0.0"
-
-[source]
-tarball = "https://download.gnome.org/sources/gtksourceview/5.16/gtksourceview-5.16.0.tar.xz"
-sha256  = "ab35d420102f3e8b055dd3b8642d3a48209f888189e6254d0ffb4b6a7e8c3566"
-
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-
-[build.phases]
-configure = "true"
-compile = '''
-cat > hammer_edit.c <<'CEOF'
-#include <adwaita.h>
-#include <gtksourceview/gtksource.h>
-#include <string.h>
-
-typedef struct { GtkWindow *win; GtkSourceBuffer *buf; GFile *file; } App;
-
-static void set_title(App *a) {
-  char *name = a->file ? g_file_get_basename(a->file) : g_strdup("Sin título");
-  char *full = g_strdup_printf("%s — hammer-edit", name);
-  gtk_window_set_title(a->win, full);
-  g_free(name); g_free(full);
-}
-
-static void load_file(App *a, GFile *file) {
-  char *contents; gsize len;
-  if (!g_file_load_contents(file, NULL, &contents, &len, NULL, NULL)) return;
-  gtk_text_buffer_set_text(GTK_TEXT_BUFFER(a->buf), contents, len);
-  g_free(contents);
-  g_set_object(&a->file, file);
-  GtkSourceLanguageManager *lm = gtk_source_language_manager_get_default();
-  char *base = g_file_get_basename(file);
-  GtkSourceLanguage *lang = gtk_source_language_manager_guess_language(lm, base, NULL);
-  gtk_source_buffer_set_language(a->buf, lang);
-  g_free(base);
-  set_title(a);
-}
-
-static void open_cb(GObject *src, GAsyncResult *res, gpointer ud) {
-  App *a = ud;
-  GFile *file = gtk_file_dialog_open_finish(GTK_FILE_DIALOG(src), res, NULL);
-  if (file) { load_file(a, file); g_object_unref(file); }
-}
-static void on_open(GtkButton *b, gpointer ud) {
-  App *a = ud;
-  GtkFileDialog *d = gtk_file_dialog_new();
-  gtk_file_dialog_open(d, a->win, NULL, open_cb, a);
-  g_object_unref(d);
-}
-
-static void save_to(App *a, GFile *file) {
-  GtkTextIter s, e;
-  gtk_text_buffer_get_bounds(GTK_TEXT_BUFFER(a->buf), &s, &e);
-  char *text = gtk_text_buffer_get_text(GTK_TEXT_BUFFER(a->buf), &s, &e, FALSE);
-  g_file_replace_contents(file, text, strlen(text), NULL, FALSE,
-                          G_FILE_CREATE_NONE, NULL, NULL, NULL);
-  g_free(text);
-  g_set_object(&a->file, file);
-  set_title(a);
-}
-static void save_cb(GObject *src, GAsyncResult *res, gpointer ud) {
-  App *a = ud;
-  GFile *file = gtk_file_dialog_save_finish(GTK_FILE_DIALOG(src), res, NULL);
-  if (file) { save_to(a, file); g_object_unref(file); }
-}
-static void on_save(GtkButton *b, gpointer ud) {
-  App *a = ud;
-  if (a->file) { save_to(a, a->file); return; }
-  GtkFileDialog *d = gtk_file_dialog_new();
-  gtk_file_dialog_save(d, a->win, NULL, save_cb, a);
-  g_object_unref(d);
-}
-
-static App *build_window(GtkApplication *app) {
-  App *a = g_new0(App, 1);
-  GtkWidget *win = adw_application_window_new(app);
-  a->win = GTK_WINDOW(win);
-  gtk_window_set_default_size(a->win, 820, 580);
-  GtkWidget *tv = adw_toolbar_view_new();
-  GtkWidget *hb = adw_header_bar_new();
-  GtkWidget *ob = gtk_button_new_from_icon_name("document-open-symbolic");
-  GtkWidget *sb = gtk_button_new_from_icon_name("document-save-symbolic");
-  gtk_widget_set_tooltip_text(ob, "Abrir");
-  gtk_widget_set_tooltip_text(sb, "Guardar");
-  g_signal_connect(ob, "clicked", G_CALLBACK(on_open), a);
-  g_signal_connect(sb, "clicked", G_CALLBACK(on_save), a);
-  adw_header_bar_pack_start(ADW_HEADER_BAR(hb), ob);
-  adw_header_bar_pack_end(ADW_HEADER_BAR(hb), sb);
-  adw_toolbar_view_add_top_bar(ADW_TOOLBAR_VIEW(tv), hb);
-  a->buf = gtk_source_buffer_new(NULL);
-  gtk_source_buffer_set_highlight_syntax(a->buf, TRUE);
-  GtkWidget *view = gtk_source_view_new_with_buffer(a->buf);
-  gtk_source_view_set_show_line_numbers(GTK_SOURCE_VIEW(view), TRUE);
-  gtk_source_view_set_highlight_current_line(GTK_SOURCE_VIEW(view), TRUE);
-  gtk_source_view_set_auto_indent(GTK_SOURCE_VIEW(view), TRUE);
-  gtk_widget_add_css_class(view, "monospace");
-  GtkWidget *sc = gtk_scrolled_window_new();
-  gtk_scrolled_window_set_child(GTK_SCROLLED_WINDOW(sc), view);
-  adw_toolbar_view_set_content(ADW_TOOLBAR_VIEW(tv), sc);
-  adw_application_window_set_content(ADW_APPLICATION_WINDOW(win), tv);
-  set_title(a);
-  return a;
-}
-
-static void activate(GApplication *app, gpointer ud) {
-  App *a = build_window(GTK_APPLICATION(app));
-  gtk_window_present(a->win);
-}
-static void open_files(GApplication *app, GFile **files, gint n, const char *hint, gpointer ud) {
-  App *a = build_window(GTK_APPLICATION(app));
-  if (n > 0) load_file(a, files[0]);
-  gtk_window_present(a->win);
-}
-
-int main(int argc, char **argv) {
-  AdwApplication *app = adw_application_new("org.hammer.edit", G_APPLICATION_HANDLES_OPEN);
-  g_signal_connect(app, "activate", G_CALLBACK(activate), NULL);
-  g_signal_connect(app, "open", G_CALLBACK(open_files), NULL);
-  int status = g_application_run(G_APPLICATION(app), argc, argv);
-  g_object_unref(app);
-  return status;
-}
-CEOF
-export PKG_CONFIG_PATH=/usr/lib/pkgconfig
-zig cc -mcpu=baseline -static hammer_edit.c -o hammer-edit $(pkg-config --cflags --libs --static gtksourceview-5 libadwaita-1 harfbuzz-subset epoxy xkbcommon wayland-client wayland-egl libtiff-4 libjpeg cairo-script-interpreter)
-'''
-install = "mkdir -p /out/usr/bin && cp hammer-edit /out/usr/bin/hammer-edit"
-
-[deps]
-build = ["pkgconf", "gtksourceview", "libadwaita", "appstream", "libyaml", "curl", "openssl", "libxmlb", "libxml2", "zstd", "gtk4", "pango", "gdk-pixbuf", "cairo", "graphene", "glib", "harfbuzz", "fribidi", "fontconfig", "freetype", "pixman", "libpng", "expat", "libjpeg-turbo", "libtiff", "libepoxy", "wayland", "libxkbcommon", "libdrm", "pcre2", "libffi", "zlib", "mesa"]
diff --git a/recipes/incoming-clib/zlib.toml b/recipes/incoming-clib/iproute2.toml
similarity index 54%
rename from recipes/incoming-clib/zlib.toml
rename to recipes/incoming-clib/iproute2.toml
index c6efa026..13ebb0aa 100644
--- a/recipes/incoming-clib/zlib.toml
+++ b/recipes/incoming-clib/iproute2.toml
@@ -1,14 +1,14 @@
 # Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
 # YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
 # sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
-name    = "zlib"
-version = "1.3.2"
+name    = "iproute2"
+version = "7.1.0"
 
 [source]
-tarball = "https://zlib.net/fossils/zlib-1.3.2.tar.gz"
+tarball = "https://kernel.org/pub/linux/utils/net/iproute2/iproute2-7.1.0.tar.xz"
 # FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
-# sha512 = "70963771ea5d763614278a69b474f09b7d237ef8f53b675a10fe31d9923aeef601504b35d7ebd1b1e7f347e9ebb048e6b3b47fffdf137e7bdc7e8d5eb4ec4692"
-sha256  = "bb329a0a2cd0274d05519d61c667c062e06990d72e125ee2dfa8de64f0119d16"
+# sha512 = "17052405c4d220da7a93a52b9c9ea01c9fa4a8889b5d4758cae86c8c97c78ed4011d74ea3153ea44c0dd632215961e6cd6e5f9e369acb19bec0a822d2eb844b8"
+sha256  = "fd9fa1b95809417157ca83dd72957e3261bdbce896353cb936f80af0b33a4b5c"
 
 [build]
 compiler = "zig-cc"
@@ -20,21 +20,21 @@ flags    = []
 # de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
 compile = '''
 _abuild_phase() {
-# we trade size for a little more speed.
-	export CFLAGS="$CFLAGS -O2"
-	# lab static-musl: sin --shared (evita el test examplesh que linkea la .so con -static y zig rechaza).
-	CHOST="$CHOST" ./configure \
-		--prefix=/usr \
-		--static \
-		--disable-crcvx
-	make libz.a
+export CFLAGS="$CFLAGS -flto=auto"
+	make V=1
 }
 _abuild_phase
 '''
 # de package() de Alpine (traducido $pkgdir→/out):
 install = '''
 _abuild_phase() {
-make install DESTDIR="/out"
+make DESTDIR="/out" install
+
+	install -D -m644 include/libnetlink.h "/out"/usr/include/libnetlink.h
+	install -D -m644 lib/libnetlink.a "/out"/usr/lib/libnetlink.a
 }
 _abuild_phase
 '''
+
+[deps]
+build = ["bash", "bison", "elfutils", "flex", "iptables", "libcap", "libmnl"]
diff --git a/recipes/incoming-clib/iputils.toml b/recipes/incoming-clib/iputils.toml
new file mode 100644
index 00000000..e48ae620
--- /dev/null
+++ b/recipes/incoming-clib/iputils.toml
@@ -0,0 +1,59 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "iputils"
+version = "20250605"
+
+[source]
+tarball = "https://github.com/iputils/iputils/releases/download/20250605/iputils-20250605.tar.xz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "1f3df2a4ea0a3f95bb9657d9ee36ed929fa841c9442dfd04e5d7f55ef533b0cac3182c2172b627c7ad7f366afdc1d232f2618d701bd1c601feadbfc754059cae"
+sha256  = "6f213700dbf96b5cc4499ca70cb15ecd69c09f405b06785bb4a1a10b572b6276"
+patches = ["0001-Use-getopt_long-for-opt-parsing-in-ping.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+abuild-meson \
+		-Db_lto=true \
+		-DNO_SETCAP_OR_SUID=true \
+		-DBUILD_MANS=true \
+		-DUSE_IDN=false \
+		-DUSE_GETTEXT=false \
+		. output
+	meson compile -C output
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+depends="
+		iputils-arping=20250605-r$pkgrel
+		iputils-clockdiff=20250605-r$pkgrel
+		iputils-ping=20250605-r$pkgrel
+		iputils-tracepath=20250605-r$pkgrel
+		"
+
+	install -Dm4755 output/ping/ping "/out"/bin/ping
+
+	for name in arping clockdiff tracepath; do
+		install -Dm755 output/$name "/out"/usr/sbin/$name
+	done
+
+	ln -s tracepath "/out"/usr/sbin/tracepath6
+	ln -s ping "/out"/bin/ping6
+	install -D -m 644 -t "/out"/usr/share/man/man8 doc/*.8
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["docbook-xsl", "libcap"]
diff --git a/recipes/incoming-clib/libadwaita.toml b/recipes/incoming-clib/libadwaita.toml
deleted file mode 100644
index e00a4a95..00000000
--- a/recipes/incoming-clib/libadwaita.toml
+++ /dev/null
@@ -1,22 +0,0 @@
-# libadwaita 1.7.6 — los widgets modernos de GNOME sobre GTK4 (Adwaita). meson static.
-# Compila sus estilos SCSS con sassc en build. examples/tests/vapi/introspection/docs off.
-# deps = gtk4 + su cierre .pc completo + sassc.
-name    = "libadwaita"
-version = "1.7.6"
-
-[source]
-tarball = "https://download.gnome.org/sources/libadwaita/1.7/libadwaita-1.7.6.tar.xz"
-sha256  = "5eacc5550f0bdbba6a1568aebf25a3d88f5ee07d6b558becc6fd9487579c9a29"
-
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-
-[build.phases]
-configure = "PKG_CONFIG_PATH=/usr/lib/pkgconfig PYTHONPATH=/usr/lib/python3.12/site-packages meson setup output --prefix=/usr --buildtype=release --wrap-mode=nodownload --prefer-static -Ddefault_library=static -Dexamples=false -Dtests=false -Dvapi=false -Dintrospection=disabled -Dgtk_doc=false -Dc_args=-Wno-error=date-time"
-compile   = "PYTHONPATH=/usr/lib/python3.12/site-packages ninja -C output"
-install   = "PYTHONPATH=/usr/lib/python3.12/site-packages DESTDIR=/out meson install -C output --no-rebuild"
-
-[deps]
-build = ["meson", "samurai", "python3", "pkgconf", "sassc", "appstream", "libyaml", "curl", "openssl", "libxmlb", "libxml2", "zstd", "gtk4", "pango", "gdk-pixbuf", "cairo", "graphene", "glib", "harfbuzz", "fribidi", "fontconfig", "freetype", "pixman", "libpng", "expat", "libjpeg-turbo", "libtiff", "libepoxy", "wayland", "wayland-protocols", "libxkbcommon", "libdrm", "pcre2", "libffi", "zlib", "mesa"]
diff --git a/recipes/incoming-clib/libpng.toml b/recipes/incoming-clib/libpng.toml
deleted file mode 100644
index f25ed130..00000000
--- a/recipes/incoming-clib/libpng.toml
+++ /dev/null
@@ -1,16 +0,0 @@
-# libpng 1.6.58 — imágenes PNG (lo usan cairo/gdk-pixbuf). autotools static, dep zlib.
-name    = "libpng"
-version = "1.6.58"
-[source]
-tarball = "https://downloads.sourceforge.net/libpng/libpng-1.6.58.tar.gz"
-sha256  = "8c9b05b675ca7301a458df2c2e46f26e1d41ff36b8863f8c33530bc58c2e6225"
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-[build.phases]
-configure = "./configure --prefix=/usr --disable-shared --enable-static"
-compile   = "make"
-install   = "make install DESTDIR=/out"
-[deps]
-build = ["zlib"]
diff --git a/recipes/incoming-clib/libxkbcommon.toml b/recipes/incoming-clib/libxkbcommon.toml
deleted file mode 100644
index 6255143c..00000000
--- a/recipes/incoming-clib/libxkbcommon.toml
+++ /dev/null
@@ -1,16 +0,0 @@
-# libxkbcommon 1.7.0 — manejo de teclados XKB (GTK/wayland). meson static, sin X11/docs.
-name    = "libxkbcommon"
-version = "1.7.0"
-[source]
-tarball = "https://xkbcommon.org/download/libxkbcommon-1.7.0.tar.xz"
-sha256  = "65782f0a10a4b455af9c6baab7040e2f537520caa2ec2092805cdfd36863b247"
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-[build.phases]
-configure = "PKG_CONFIG_PATH=/usr/lib/pkgconfig PYTHONPATH=/usr/lib/python3.12/site-packages meson setup output --prefix=/usr --buildtype=release --wrap-mode=nodownload --prefer-static -Ddefault_library=static -Denable-x11=false -Denable-docs=false -Denable-wayland=false -Denable-xkbregistry=false"
-compile   = "PYTHONPATH=/usr/lib/python3.12/site-packages ninja -C output"
-install   = "PYTHONPATH=/usr/lib/python3.12/site-packages DESTDIR=/out meson install -C output --no-rebuild"
-[deps]
-build = ["meson", "samurai", "python3", "pkgconf", "bison", "flex"]
diff --git a/recipes/incoming-clib/libxml2.toml b/recipes/incoming-clib/libxml2.toml
deleted file mode 100644
index c1a98c8f..00000000
--- a/recipes/incoming-clib/libxml2.toml
+++ /dev/null
@@ -1,16 +0,0 @@
-# libxml2 2.13.9 — parser XML (lo usa fontconfig opcional, otros). autotools static.
-name    = "libxml2"
-version = "2.13.9"
-[source]
-tarball = "https://download.gnome.org/sources/libxml2/2.13/libxml2-2.13.9.tar.xz"
-sha256  = "a2c9ae7b770da34860050c309f903221c67830c86e4a7e760692b803df95143a"
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-[build.phases]
-configure = "./configure --prefix=/usr --disable-shared --enable-static --without-python --without-lzma"
-compile   = "make"
-install   = "make install DESTDIR=/out"
-[deps]
-build = ["zlib"]
diff --git a/recipes/incoming-clib/libyaml.toml b/recipes/incoming-clib/libyaml.toml
deleted file mode 100644
index 05b4e0b1..00000000
--- a/recipes/incoming-clib/libyaml.toml
+++ /dev/null
@@ -1,20 +0,0 @@
-# libyaml 0.2.5 — parser YAML (lo usa appstream). autotools static mínimo, leaf.
-name    = "libyaml"
-version = "0.2.5"
-
-[source]
-tarball = "https://github.com/yaml/libyaml/releases/download/0.2.5/yaml-0.2.5.tar.gz"
-sha256  = "c642ae9b75fee120b2d96c712538bd2cf283228d2337df2cf2988e3c02678ef4"
-
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-
-[build.phases]
-configure = "./configure --prefix=/usr --build=$CBUILD --host=$CHOST --disable-shared --enable-static"
-compile   = "make -j4"
-install   = "make install DESTDIR=/out"
-
-[deps]
-build = []
diff --git a/recipes/incoming-clib/make-tests.patch b/recipes/incoming-clib/make-tests.patch
new file mode 100644
index 00000000..7a8eab06
--- /dev/null
+++ b/recipes/incoming-clib/make-tests.patch
@@ -0,0 +1,50 @@
+--- a/tests/Makefile.in	2026-05-10 12:42:57.029507661 +0000
++++ b/tests/Makefile.in	2026-05-10 12:44:14.885350155 +0000
+@@ -2044,16 +2044,12 @@
+ SH_LOG_COMPILER = $(SHELL)
+ TESTS = \
+   help-version.sh \
+-  t0000-basic.sh \
+-  t0001-tiny.sh \
+   t0010-script-no-ctrl-chars.sh \
+   t0100-print.sh \
+   t0101-print-empty.sh \
+   t0200-gpt.sh \
+   t0201-gpt.sh \
+   t0202-gpt-pmbr.sh \
+-  t0203-gpt-tiny-device-abort.sh \
+-  t0203-gpt-shortened-device-primary-valid.sh \
+   t0203-gpt-create-on-min-sized-device.sh \
+   t0205-gpt-list-clobbers-pmbr.sh \
+   t0206-gpt-print-with-corrupt-primary-clobbers-pmbr.sh \
+@@ -2064,18 +2060,12 @@
+   t0211-gpt-rewrite-header.sh \
+   t0212-gpt-many-partitions.sh \
+   t0213-mkpart-start-negative.sh \
+-  t0215-gpt-attrs.sh \
+   t0220-gpt-msftres.sh \
+   t0250-gpt.sh \
+-  t0251-gpt-unicode.sh \
+   t0280-gpt-corrupt.sh \
+-  t0281-gpt-grow.sh \
+-  t0282-gpt-move-backup.sh \
+-  t0283-overlap-partitions.sh \
+   t0290-gpt-name.sh \
+   t0300-dos-on-gpt.sh \
+   t0301-overwrite-gpt-pmbr.sh \
+-  t0350-mac-PT-increases-sector-size.sh \
+   t0400-loop-clobber-infloop.sh \
+   t0500-dup-clobber.sh \
+   t0501-duplicate.sh \
+@@ -2105,11 +2095,8 @@
+   t3200-type-change.sh \
+   t3210-gpt-type-change.sh \
+   t3300-palo-prep.sh \
+-  t3310-flags.sh \
+-  t3400-whole-disk-FAT-partition.sh \
+   t4000-sun-raid-type.sh \
+   t4001-sun-vtoc.sh \
+-  t4002-sun-badlabel.sh \
+   t4100-msdos-partition-limits.sh \
+   t4100-dvh-partition-limits.sh \
+   t4100-msdos-starting-sector.sh \
diff --git a/recipes/incoming-clib/manpage-example-path.patch b/recipes/incoming-clib/manpage-example-path.patch
new file mode 100644
index 00000000..31048c70
--- /dev/null
+++ b/recipes/incoming-clib/manpage-example-path.patch
@@ -0,0 +1,16 @@
+--- OpenDoas-6.8.1.orig/doas.conf.5
++++ OpenDoas-6.8.1/doas.conf.5
+@@ -114,11 +114,11 @@
+ it is not considered a keyword.
+ .El
+ .Sh FILES
+-.Bl -tag -width /etc/examples/doas.conf -compact
++.Bl -tag -width /usr/share/doc/doas/doas.conf.example -compact
+ .It Pa /etc/doas.conf
+ .Xr doas 1
+ configuration file.
+-.It Pa /etc/examples/doas.conf
++.It Pa /usr/share/doc/doas/doas.conf.example
+ Example configuration file.
+ .El
+ .Sh EXAMPLES
diff --git a/recipes/incoming-clib/pango.toml b/recipes/incoming-clib/pango.toml
deleted file mode 100644
index 2fab4f94..00000000
--- a/recipes/incoming-clib/pango.toml
+++ /dev/null
@@ -1,16 +0,0 @@
-# pango 1.57.1 — layout/render de texto i18n (base de GTK). meson static.
-name    = "pango"
-version = "1.57.1"
-[source]
-tarball = "https://download.gnome.org/sources/pango/1.57/pango-1.57.1.tar.xz"
-sha256  = "e65d6d117080dc3aeeb7d8b4b3b518f7383aa2e6cfce23117c623cd624764c2f"
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-[build.phases]
-configure = "PKG_CONFIG_PATH=/usr/lib/pkgconfig PYTHONPATH=/usr/lib/python3.12/site-packages meson setup output --prefix=/usr --buildtype=release --wrap-mode=nodownload --prefer-static -Ddefault_library=static -Dc_args=-Wno-error=date-time -Dintrospection=disabled -Dgtk_doc=false -Dbuild-testsuite=false -Dbuild-examples=false"
-compile   = "PYTHONPATH=/usr/lib/python3.12/site-packages ninja -C output"
-install   = "PYTHONPATH=/usr/lib/python3.12/site-packages DESTDIR=/out meson install -C output --no-rebuild"
-[deps]
-build = ["meson", "samurai", "python3", "pkgconf", "cairo", "harfbuzz", "fribidi", "glib", "freetype", "fontconfig", "pixman", "libpng", "expat", "libffi", "pcre2", "zlib"]
diff --git a/recipes/incoming-clib/parted-include-sysmacros.patch b/recipes/incoming-clib/parted-include-sysmacros.patch
new file mode 100644
index 00000000..52ec588c
--- /dev/null
+++ b/recipes/incoming-clib/parted-include-sysmacros.patch
@@ -0,0 +1,10 @@
+--- a/libparted/arch/linux.c
++++ b/libparted/arch/linux.c
+@@ -38,6 +38,7 @@
+ #include <sys/ioctl.h>
+ #include <sys/stat.h>
+ #include <sys/types.h>
++#include <sys/sysmacros.h>
+ #include <sys/utsname.h>        /* for uname() */
+ #include <scsi/scsi.h>
+ #include <assert.h>
diff --git a/recipes/incoming-clib/parted.toml b/recipes/incoming-clib/parted.toml
new file mode 100644
index 00000000..93d2d904
--- /dev/null
+++ b/recipes/incoming-clib/parted.toml
@@ -0,0 +1,45 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "parted"
+version = "3.7"
+
+[source]
+tarball = "https://ftp.gnu.org/gnu/parted/parted-3.7.tar.xz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "941afeb68edb45c33fb797f4c320ed1aa1de2e8b35defa5d742aa6894618e6729a1440e3ee0824e8710bc58eb42b85d77f28ba083d92d4ea3f3f65f37c8307b0"
+sha256  = "008de57561a4f3c25a0648e66ed11e7b30be493889b64334a6d70f2c1951ef7b"
+patches = ["fix-includes.patch", "fix-libintl-header-s390x.patch", "parted-include-sysmacros.patch", "fix-truncate-tests.patch", "make-tests.patch", "skip-duplicate-bsd-test-on-s390x.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--enable-debug \
+		--disable-nls \
+		--disable-static \
+		--enable-shared
+	make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["bash", "lvm2", "ncurses", "readline", "util-linux"]
diff --git a/recipes/incoming-clib/pcre2.toml b/recipes/incoming-clib/pcre2.toml
deleted file mode 100644
index 9bd50e8c..00000000
--- a/recipes/incoming-clib/pcre2.toml
+++ /dev/null
@@ -1,14 +0,0 @@
-# pcre2 10.47 — regex (lo usa glib). autotools static, limpio.
-name    = "pcre2"
-version = "10.47"
-[source]
-tarball = "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-10.47/pcre2-10.47.tar.bz2"
-sha256  = "47fe8c99461250d42f89e6e8fdaeba9da057855d06eb7fc08d9ca03fd08d7bc7"
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-[build.phases]
-configure = "./configure --prefix=/usr --disable-shared --enable-static --enable-pcre2-16 --enable-pcre2-32 --enable-jit"
-compile   = "make"
-install   = "make install DESTDIR=/out"
diff --git a/recipes/incoming-clib/pixman.toml b/recipes/incoming-clib/pixman.toml
deleted file mode 100644
index bce02dbf..00000000
--- a/recipes/incoming-clib/pixman.toml
+++ /dev/null
@@ -1,21 +0,0 @@
-# pixman 0.46.4 — ladrillo base de GUI (rasterizado 2D; lo usa cairo). meson static mínimo, leaf
-# (sin libpng/demos/tests/gtk).
-name    = "pixman"
-version = "0.46.4"
-
-[source]
-tarball = "https://xorg.freedesktop.org/releases/individual/lib/pixman-0.46.4.tar.xz"
-sha256  = "a098c33924754ad43f981b740f6d576c70f9ed1006e12221b1845431ebce1239"
-
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-
-[build.phases]
-configure = "PYTHONPATH=/usr/lib/python3.12/site-packages meson setup output --prefix=/usr --buildtype=release -Ddefault_library=static -Dlibpng=disabled -Ddemos=disabled -Dtests=disabled -Dgtk=disabled"
-compile   = "PYTHONPATH=/usr/lib/python3.12/site-packages ninja -C output"
-install   = "PYTHONPATH=/usr/lib/python3.12/site-packages DESTDIR=/out meson install -C output --no-rebuild"
-
-[deps]
-build = ["meson", "samurai", "python3", "pkgconf"]
diff --git a/recipes/incoming-clib/rowhammer.patch b/recipes/incoming-clib/rowhammer.patch
new file mode 100644
index 00000000..761ffb42
--- /dev/null
+++ b/recipes/incoming-clib/rowhammer.patch
@@ -0,0 +1,73 @@
+This patch has been taken from OpenBSD upstream, it changes permit bits to make
+them more rowhammer-resistent. A similar patch has also been committed to sudo.
+
+The patch has not made its way into OpenDoas yet, but at the time of writting
+OpenDoas upstream is rather stale (last commit was done 2 years ago).
+
+See:
+
+* https://github.com/openbsd/src/commit/38599afa1d1d1f14a897b01350e8ce94486e1788
+* https://github.com/sudo-project/sudo/commit/7873f8334c8d31031f8cfa83bd97ac6029309e4f
+
+diff --git a/doas.c b/doas.c
+index ac3a42a..93f0836 100644
+--- a/doas.c
++++ b/doas.c
+@@ -148,8 +148,10 @@ permit(uid_t uid, gid_t *groups, int ngroups, const struct rule **lastr,
+ 			*lastr = rules[i];
+ 	}
+ 	if (!*lastr)
++		return -1;
++	if ((*lastr)->action == PERMIT)
+ 		return 0;
+-	return (*lastr)->action == PERMIT;
++	return -1;
+ }
+ 
+ static void
+@@ -184,6 +186,7 @@ checkconfig(const char *confpath, int argc, char **argv,
+     uid_t uid, gid_t *groups, int ngroups, uid_t target)
+ {
+ 	const struct rule *rule;
++	int rv;
+ 
+ 	if (setresuid(uid, uid, uid) != 0)
+ 		err(1, "setresuid");
+@@ -191,9 +194,9 @@ checkconfig(const char *confpath, int argc, char **argv,
+ 	parseconfig(confpath, 0);
+ 	if (!argc)
+ 		exit(0);
+-
+-	if (permit(uid, groups, ngroups, &rule, target, argv[0],
+-	    (const char **)argv + 1)) {
++	rv = permit(uid, groups, ngroups, &rule, target, argv[0],
++ 	    (const char **)argv + 1);
++	if (rv == 0) {
+ 		printf("permit%s\n", (rule->options & NOPASS) ? " nopass" : "");
+ 		exit(0);
+ 	} else {
+@@ -342,8 +345,9 @@ main(int argc, char **argv)
+ 	}
+ 
+ 	cmd = argv[0];
+-	if (!permit(uid, groups, ngroups, &rule, target, cmd,
+-	    (const char **)argv + 1)) {
++	rv = permit(uid, groups, ngroups, &rule, target, cmd,
++	    (const char **)argv + 1);
++	if (rv != 0) {
+ 		syslog(LOG_AUTHPRIV | LOG_NOTICE,
+ 		    "command not permitted for %s: %s", mypw->pw_name, cmdline);
+ 		errc(1, EPERM, NULL);
+diff --git a/doas.h b/doas.h
+index a8aa41b..591816f 100644
+--- a/doas.h
++++ b/doas.h
+@@ -36,7 +36,7 @@ struct passwd;
+ char **prepenv(const struct rule *, const struct passwd *,
+     const struct passwd *);
+ 
+-#define PERMIT	1
++#define PERMIT	-1
+ #define DENY	2
+ 
+ #define NOPASS		0x1
diff --git a/recipes/incoming-clib/rsync.toml b/recipes/incoming-clib/rsync.toml
new file mode 100644
index 00000000..a6407cac
--- /dev/null
+++ b/recipes/incoming-clib/rsync.toml
@@ -0,0 +1,62 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "rsync"
+version = "3.4.4"
+
+[source]
+tarball = "https://download.samba.org/pub/rsync/rsync-3.4.4.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "cf9a838b1f019b70fd67fa2c293f267be3f24e579c2ea33177ec7afc502c97ce0b613ff0854088c0eb28acd14ee0a75706ae8445115cef4669bd586c505d8453"
+sha256  = "bd88cf82fa653da32314fb229136407c5c90f80d1758d8f4b091767877d8fa96"
+patches = ["dont-use-nobody.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+cp  rrsync.1 support/rrsync.1
+	CFLAGS="$CFLAGS -flto=auto" \
+	./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--localstatedir=/var \
+		--enable-acl-support \
+		--enable-xattr-support \
+		--enable-xxhash \
+		--with-rrsync \
+		--without-included-popt \
+		--without-included-zlib \
+		--disable-md2man \
+		--disable-openssl
+		# openssl is disabled since xxh checksums are faster anyway
+	make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install
+
+	install -Dm755 "$srcdir"/rsyncd.initd "/out"/etc/init.d/rsyncd
+	install -Dm644 "$srcdir"/rsyncd.conf "/out"/etc/rsyncd.conf
+	install -Dm644 "$srcdir"/rsyncd.confd "/out"/etc/conf.d/rsyncd
+	install -Dm644 "$srcdir"/rsyncd.logrotate "/out"/etc/logrotate.d/rsyncd
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): python3
+
+[deps]
+build = ["acl", "attr", "linux-headers", "lz4", "perl", "popt", "xxhash", "zlib", "zstd"]
diff --git a/recipes/incoming-clib/xz.toml b/recipes/incoming-clib/sed.toml
similarity index 56%
rename from recipes/incoming-clib/xz.toml
rename to recipes/incoming-clib/sed.toml
index 139a6bd4..961b8a0e 100644
--- a/recipes/incoming-clib/xz.toml
+++ b/recipes/incoming-clib/sed.toml
@@ -1,13 +1,15 @@
 # Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
 # YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
 # sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
-name    = "xz"
-version = "5.8.3"
+name    = "sed"
+version = "4.10"
 
 [source]
-# tarball de RELEASE (trae ./configure pre-generado); el archive del tag NO ⇒ pedía autoconf/automake.
-tarball = "https://github.com/tukaani-project/xz/releases/download/v5.8.3/xz-5.8.3.tar.gz"
-sha256  = "3d3a1b973af218114f4f889bbaa2f4c037deaae0c8e815eec381c3d546b974a0"
+tarball = "https://ftp.gnu.org/pub/gnu/sed/sed-4.10.tar.xz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "20224df834b363ca1357024234bb93df3929c252c40c7ef3d23e78fc05177c7986e3145a5049d63db746a4dc2c97befb0324a87ea081507292ff6cd5383ee9db"
+sha256  = "b8e72182b2ec96a3574e2998c47b7aaa64cc20ce000d8e9ac313cc07cecf28c7"
+patches = ["skip-test-memset_explicit-on-arm.patch"]
 
 [build]
 compiler = "zig-cc"
@@ -19,24 +21,16 @@ flags    = []
 # de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
 compile = '''
 _abuild_phase() {
-# compression utility
-	CFLAGS="$CFLAGS -O3" \
+CFLAGS="$CFLAGS -flto=auto" \
 	./configure \
 		--build=$CBUILD \
 		--host=$CHOST \
 		--prefix=/usr \
-		--sysconfdir=/etc \
+		--bindir=/bin \
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info \
-		--localstatedir=/var \
-		--disable-rpath \
-		--disable-werror \
-		--disable-doc
-
-	sed -i \
-		-e 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' \
-		-e 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' \
-		libtool
+		--disable-i18n \
+		--disable-nls
 	make
 }
 _abuild_phase
@@ -45,9 +39,12 @@ _abuild_phase
 install = '''
 _abuild_phase() {
 make DESTDIR="/out" install
+
+	rm -rf "/out"/usr/lib/charset.alias || true
+	rmdir -p "/out"/usr/lib 2>/dev/null || true
 }
 _abuild_phase
 '''
 
 [deps]
-build = ["gettext-tiny"]
+build = ["perl", "linux-headers"]
diff --git a/recipes/incoming-clib/skip-duplicate-bsd-test-on-s390x.patch b/recipes/incoming-clib/skip-duplicate-bsd-test-on-s390x.patch
new file mode 100644
index 00000000..f938e5b8
--- /dev/null
+++ b/recipes/incoming-clib/skip-duplicate-bsd-test-on-s390x.patch
@@ -0,0 +1,16 @@
+--- a/tests/t0501-duplicate.sh
++++ b/tests/t0501-duplicate.sh
+@@ -18,9 +18,13 @@
+ 
+ . "${srcdir=.}/init.sh"; path_prepend_ ../parted .
+ 
++arch=$(uname -m)
+ for t in msdos gpt bsd sun atari mac pc98; do
+     case $t in
+       atari) [ $ss -ne 512 ] && continue
++          ;;
++      bsd) [ "$arch" = "s390x" ] && continue
++      	  duplicate $t || fail=1
+           ;;
+       *) duplicate $t || fail=1
+           ;;
diff --git a/recipes/incoming-clib/skip-test-memset_explicit-on-arm.patch b/recipes/incoming-clib/skip-test-memset_explicit-on-arm.patch
new file mode 100644
index 00000000..df9d0c93
--- /dev/null
+++ b/recipes/incoming-clib/skip-test-memset_explicit-on-arm.patch
@@ -0,0 +1,17 @@
+--- a/gnulib-tests/test-memset_explicit.c
++++ b/gnulib-tests/test-memset_explicit.c
+@@ -183,6 +183,14 @@
+ {
+ }
+ 
++#elif defined __arm__ && !defined __aarch64__
++
++static void
++test_stack (void)
++{
++  fputs ("test_stack: skipped on 32-bit ARM\n", stdout);
++}
++
+ #else
+ 
+ /* There are two passes:
diff --git a/recipes/incoming-clib/sourceview-hello.toml b/recipes/incoming-clib/sourceview-hello.toml
deleted file mode 100644
index c7426972..00000000
--- a/recipes/incoming-clib/sourceview-hello.toml
+++ /dev/null
@@ -1,57 +0,0 @@
-# sourceview-hello — VALIDACIÓN del editor: ventana Adwaita con un GtkSourceView (resaltado C, números
-# de línea) editable. Junta libadwaita + gtksourceview + gtk4, link 100% estático. Es, de hecho, el
-# esqueleto de un editor de código real para el distro.
-name    = "sourceview-hello"
-version = "5.16.0"
-
-[source]
-tarball = "https://download.gnome.org/sources/gtksourceview/5.16/gtksourceview-5.16.0.tar.xz"
-sha256  = "ab35d420102f3e8b055dd3b8642d3a48209f888189e6254d0ffb4b6a7e8c3566"
-
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-
-[build.phases]
-configure = "true"
-compile = '''
-cat > sv_hello.c <<'CEOF'
-#include <adwaita.h>
-#include <gtksourceview/gtksource.h>
-static void activate(GtkApplication *app, gpointer user_data) {
-  GtkWidget *win = adw_application_window_new(app);
-  gtk_window_set_title(GTK_WINDOW(win), "Editor hammer");
-  gtk_window_set_default_size(GTK_WINDOW(win), 640, 420);
-  GtkWidget *toolbar = adw_toolbar_view_new();
-  adw_toolbar_view_add_top_bar(ADW_TOOLBAR_VIEW(toolbar), adw_header_bar_new());
-  GtkSourceBuffer *buf = gtk_source_buffer_new(NULL);
-  GtkSourceLanguageManager *lm = gtk_source_language_manager_get_default();
-  GtkSourceLanguage *lang = gtk_source_language_manager_get_language(lm, "c");
-  if (lang) gtk_source_buffer_set_language(buf, lang);
-  gtk_text_buffer_set_text(GTK_TEXT_BUFFER(buf),
-    "#include <stdio.h>\nint main(void){\n  printf(\"hola hammer\\n\");\n  return 0;\n}\n", -1);
-  GtkWidget *view = gtk_source_view_new_with_buffer(buf);
-  gtk_source_view_set_show_line_numbers(GTK_SOURCE_VIEW(view), TRUE);
-  gtk_widget_add_css_class(view, "monospace");
-  GtkWidget *scroll = gtk_scrolled_window_new();
-  gtk_scrolled_window_set_child(GTK_SCROLLED_WINDOW(scroll), view);
-  adw_toolbar_view_set_content(ADW_TOOLBAR_VIEW(toolbar), scroll);
-  adw_application_window_set_content(ADW_APPLICATION_WINDOW(win), toolbar);
-  gtk_window_present(GTK_WINDOW(win));
-}
-int main(int argc, char **argv) {
-  AdwApplication *app = adw_application_new("org.hammer.editor", G_APPLICATION_DEFAULT_FLAGS);
-  g_signal_connect(app, "activate", G_CALLBACK(activate), NULL);
-  int status = g_application_run(G_APPLICATION(app), argc, argv);
-  g_object_unref(app);
-  return status;
-}
-CEOF
-export PKG_CONFIG_PATH=/usr/lib/pkgconfig
-zig cc -mcpu=baseline -static sv_hello.c -o sourceview-hello $(pkg-config --cflags --libs --static gtksourceview-5 libadwaita-1 harfbuzz-subset epoxy xkbcommon wayland-client wayland-egl libtiff-4 libjpeg cairo-script-interpreter)
-'''
-install = "mkdir -p /out/usr/bin && cp sourceview-hello /out/usr/bin/sourceview-hello"
-
-[deps]
-build = ["pkgconf", "gtksourceview", "libadwaita", "appstream", "libyaml", "curl", "openssl", "libxmlb", "libxml2", "zstd", "gtk4", "pango", "gdk-pixbuf", "cairo", "graphene", "glib", "harfbuzz", "fribidi", "fontconfig", "freetype", "pixman", "libpng", "expat", "libjpeg-turbo", "libtiff", "libepoxy", "wayland", "libxkbcommon", "libdrm", "pcre2", "libffi", "zlib", "mesa"]
diff --git a/recipes/incoming-clib/sudo.toml b/recipes/incoming-clib/sudo.toml
new file mode 100644
index 00000000..e195798c
--- /dev/null
+++ b/recipes/incoming-clib/sudo.toml
@@ -0,0 +1,62 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "sudo"
+version = "1.9.17_p2"
+
+[source]
+tarball = "https://www.sudo.ws/dist/sudo-${pkgver/_/}.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "c8abd6ca56e54a081c9ef1e9f6579d1db5b93ff857e60d1f58d1f425d7dc23c31c58d40b7819780688f66dfdf87a1f3bbe0a78387b007e2beb1b0e546203ea93"
+sha256  = "FIXME-sha256"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+CFLAGS="$CFLAGS -flto=auto" \
+	./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--libexecdir=/usr/lib \
+		--mandir=/usr/share/man \
+		--with-rundir=/run/sudo \
+		--with-vardir=/var/lib/sudo \
+		--with-tzdir=/usr/share/zoneinfo \
+		--with-logdir=/var/log \
+		--with-iologdir=/var/log/sudo-io \
+		--with-logpath=/var/log/sudo.log \
+		--with-relaydir=/var/log/sudo_logsrvd \
+		--disable-nls \
+		--enable-pie \
+		--with-env-editor \
+		--with-mdoc \
+		--without-pam \
+		--without-skey \
+		--with-sendmail=/usr/sbin/sendmail \
+		--with-passprompt="[sudo] password for %p: "
+
+	make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+# the sudo's mkinstalldir script miscreates the leading
+	# path components with bad permissions. fix this.
+	install -dm0755 "/out"/var "/out"/var/db
+	make -j1 DESTDIR="/out" install
+
+	# Exactly the same as /etc/sudoers
+	rm -v "/out"/etc/sudoers.dist
+}
+_abuild_phase
+'''
diff --git a/recipes/incoming-clib/tzdata.toml b/recipes/incoming-clib/tzdata.toml
new file mode 100644
index 00000000..b3e875b4
--- /dev/null
+++ b/recipes/incoming-clib/tzdata.toml
@@ -0,0 +1,51 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "tzdata"
+version = "2026b"
+
+[source]
+tarball = "https://www.iana.org/time-zones/repository/releases/tzcode2026b.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "55b44d52a83c9db151be32c3d78376ea7f9d4311ef15ed6fe34b855b08fc546531e51309d178d9c175a6d5d7d0b058440e45a55d200ca8925e3798dac9bc739f"
+sha256  = "37e9ed8427f5d3521c22fc58e293cbfb043d70eedf1003870b33f363f61ca344"
+patches = ["0001-posixtz-ensure-the-file-offset-we-pass-to-lseek-is-o.patch", "0002-fix-implicit-declaration-warnings-by-including-strin.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+make cc="${CC:-gcc}" CFLAGS="$CFLAGS -DHAVE_STDINT_H=1" \
+		TZDIR="/usr/share/zoneinfo"
+
+	make -C "$builddir"/posixtz-$_ptzver posixtz
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+./zic -b fat -y ./yearistype -d "/out"/usr/share/zoneinfo $_timezones
+	./zic -b fat -y ./yearistype -d "/out"/usr/share/zoneinfo/right -L leapseconds $_timezones
+	#./zic -b fat -y ./yearistype -d "/out"/usr/share/zoneinfo/posix $_timezones
+
+	./zic -b fat -y ./yearistype -d "/out"/usr/share/zoneinfo -p America/New_York
+	install -m444 -t "/out"/usr/share/zoneinfo iso3166.tab zone1970.tab zone.tab
+
+	install -Dm755 -t "/out"/usr/sbin zic zdump
+
+	install -Dm644 -t "/out"/usr/share/man/man8 zic.8 zdump.8
+
+	rm -f "/out"/usr/share/zoneinfo/localtime
+	install -Dm755 -t "/out"/usr/bin "$srcdir"/posixtz-$_ptzver/posixtz
+
+	install -Dm644 -t "/out"/usr/share/zoneinfo "$srcdir"/leap-seconds.list
+}
+_abuild_phase
+'''
diff --git a/recipes/incoming-clib/util-linux.toml b/recipes/incoming-clib/util-linux.toml
new file mode 100644
index 00000000..93a96b7a
--- /dev/null
+++ b/recipes/incoming-clib/util-linux.toml
@@ -0,0 +1,22 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "util-linux"
+version = "2.42.2"
+
+[source]
+tarball = "https://www.kernel.org/pub/linux/utils/util-linux/v2.42/util-linux-2.42.2.tar.xz"
+sha256  = "03a05d3adf9602ef128f2da05b84b3205ce60c351e5737c0370f74000679ce8a"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+configure = "./configure --prefix=/usr --localstatedir=/var --sysconfdir=/etc --disable-use-tty-group --enable-fs-paths-default=/run/wrappers/bin:/run/current-system/sw/bin:/sbin --disable-makeinstall-setuid --disable-makeinstall-chown --disable-su --enable-write --enable-nls --without-cryptsetup --with-ncursesw --with-systemd --with-systemdsystemunitdir=/04f3da1kmbr67m3gzxikmsl4vjz5zf777sv6m14ahv22r65aac9m/lib/systemd/system/ --with-tmpfilesdir=/1rz4g4znpzjwh1xymhjpm42vipw92pr73vdgl6xs1hycac8kf2n9/lib/tmpfiles.d --with-sysusersdir=/1rz4g4znpzjwh1xymhjpm42vipw92pr73vdgl6xs1hycac8kf2n9/lib/sysusers.d --enable-poman SYSCONFSTATICDIR=/0sra2y18lr3h6j58qjm0w46yv36h1wjmilb09n8aimdpivdymscx/lib"
+
+[deps]
+build = ["autoconf", "automake", "po4a", "zlib", "libxcrypt", "sqlite", "linux-pam", "libcap-ng", "ncurses", "systemd-minimal-libs"]
diff --git a/recipes/incoming-clib/vim.toml b/recipes/incoming-clib/vim.toml
new file mode 100644
index 00000000..8e571b81
--- /dev/null
+++ b/recipes/incoming-clib/vim.toml
@@ -0,0 +1,64 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "vim"
+version = "9.2.0747"
+
+[source]
+tarball = "https://github.com/vim/vim/archive/refs/tags/v9.2.0747/vim-9.2.0747.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "9dba40e94e09879eed41555be1275b993cac9b85b1105635f3c1dd2f5c3171f41db09c18b75313d1c6e4c2e5562b8542c4c8861929128a541c77f7e351eb425c"
+sha256  = "91535a380a445989b39dfd88c6afe8efa08668a17120ffbb33a237eab31952f3"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+vi_cv_version_plain_lua=$_luaver \
+	./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix=/usr \
+		--enable-luainterp=dynamic \
+		--enable-perlinterp=dynamic \
+		--enable-python3interp=dynamic \
+		--enable-rubyinterp=dynamic \
+		--enable-tclinterp=dynamic \
+		--disable-nls \
+		--enable-acl \
+		--enable-multibyte \
+		--with-lua-prefix=/usr/lua$_luaver \
+		--with-compiledby="Alpine Linux" \
+		"$@"
+	make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+depends="vim-common=9.2.0747-r$pkgrel xxd=9.2.0747-r$pkgrel"
+	provider_priority=10
+	replaces="gvim"
+
+	make -j1 DESTDIR="/out" install
+
+	install -Dm644 runtime/doc/uganda.txt \
+		"/out/usr/share/licenses/vim/LICENSE"
+	install -Dm644 "$srcdir"/vimrc "/out"/etc/vim/vimrc
+
+	# only relevant to gvim
+	rm -r "/out"/usr/share/icons/
+	rm -r "/out"/usr/share/applications/
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["gtk+3.0", "libx11", "libxt"]
diff --git a/recipes/incoming-clib/zstd.toml b/recipes/incoming-clib/zstd.toml
deleted file mode 100644
index 75f29d3e..00000000
--- a/recipes/incoming-clib/zstd.toml
+++ /dev/null
@@ -1,13 +0,0 @@
-# zstd 1.5.7 — compresión. Makefile (lib static), ZSTD_NO_ASM=1 (zig no digiere huf_decompress_amd64.S).
-name    = "zstd"
-version = "1.5.7"
-[source]
-tarball = "https://github.com/facebook/zstd/releases/download/v1.5.7/zstd-1.5.7.tar.gz"
-sha256  = "eb33e51f49a15e023950cd7825ca74a4a2b43db8354825ac24fc1b7ee09e6fa3"
-[build]
-compiler = "zig-cc"
-target   = "x86_64-linux-musl"
-link     = "static"
-[build.phases]
-compile = "make -C lib libzstd.a ZSTD_NO_ASM=1"
-install = "make -C lib install-static install-includes install-pc PREFIX=/usr DESTDIR=/out ZSTD_NO_ASM=1"
diff --git a/tandas/base-system-1.txt b/tandas/base-system-1.txt
new file mode 100644
index 00000000..0548ac1e
--- /dev/null
+++ b/tandas/base-system-1.txt
@@ -0,0 +1,37 @@
+# base-system-1 — tanda 2026-07-10: los HUECOS reales para una distro completa.
+# El sistema (bootstrap/self-host/kernel/init/EFI/paquetería) ya está; falta userland foundational.
+# C mayormente ⇒ PREFER=alpine (trae los parches musl). Cola aislada: recipes/incoming-clib.
+
+# --- VCS / sync (crítico: no hay git) ---
+git
+rsync
+
+# --- shell real (sólo tenemos busybox sh) ---
+bash
+
+# --- confianza TLS (curl/wget HTTPS no valida sin esto) ---
+ca-certificates
+
+# --- privilegios ---
+sudo
+doas
+
+# --- utilidades base de sistema (mount/lsblk/fdisk/blkid/lscpu…) ---
+util-linux
+sed
+tzdata
+
+# --- herramientas de disco / instalador ---
+e2fsprogs
+dosfstools
+parted
+
+# --- red (ip / ping / dhcp) ---
+iproute2
+iputils
+dhcpcd
+
+# --- editor + IPC de escritorio + terminal wayland (pareja del stack mesa/wayland) ---
+vim
+dbus
+foot