Etapa G: abre la cola C — tmux (corpus 278→279), valida libs base
tmux 3.6b linkea libevent + ncurses hammer-built, estático (-static -lncursesw -levent_core). Primer consumidor de la cola C que valida el unlock de las 20 libs base. + import c-cola-1 (14 clásicos C: tig/wget/rsync/git/mc/gnupg/…). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Delta semántico
Ninguna definición cambió: el cambio es de texto, documentación o datos.
37 archivos · +1829 −0
- recipes/incoming/0001-include-unistd.patch +12 −0
- recipes/incoming/0010-avoid-beta-warning.patch +46 −0
- recipes/incoming/0020-avoid-regenerating-defsincdate-use-shipped-file.patch +41 −0
- recipes/incoming/0110-avoid-simple-memory-dumps-via-ptrace.patch +91 −0
- recipes/incoming/0210-dirmngr-hkp-avoid-potential-race-condition-when-some-host-die.patch +284 −0
- recipes/incoming/0230-dirmngr-avoid-automatically-checking-upstream-swdb.patch +51 −0
- recipes/incoming/0330-gpg-default-to-sha512-for-all-signature-types-on-rsa-keys.patch +66 −0
- recipes/incoming/0340-gpg-prefer-sha512-and-sha384-in-personal-digest.patch +48 −0
- recipes/incoming/0420-gpg-drop-import-clean-from-default-keyserver-import-options.patch +51 −0
- recipes/incoming/HACK-revert-rfc4880bis-default.patch +207 −0
- recipes/incoming/alpine_syntax.patch +12 −0
- recipes/incoming/cmake-version.patch +21 −0
- recipes/incoming/dont-use-nobody.patch +15 −0
- recipes/incoming/fix-i18n.patch +12 −0
- recipes/incoming/fix-t4219-with-sticky-bit.patch +48 −0
- recipes/incoming/fix-test-musl.patch +13 −0
- recipes/incoming/git.toml +54 −0
- recipes/incoming/gnupg.toml +64 −0
- recipes/incoming/irssi.toml +45 −0
- recipes/incoming/lynx.toml +55 −0
- recipes/incoming/mc.toml +54 −0
- recipes/incoming/musl-fts-support.patch +13 −0
- recipes/incoming/mutt.toml +67 −0
- recipes/incoming/nnn.toml +46 −0
- recipes/incoming/pcf-family-names.patch +13 −0
- recipes/incoming/pigz.toml +38 −0
- recipes/incoming/rsync.toml +62 −0
- recipes/incoming/screen.toml +54 −0
- recipes/incoming/socat.toml +50 −0
- recipes/incoming/subpixel.patch +12 −0
- recipes/incoming/table-validation-modules.patch +21 −0
- recipes/incoming/ticket_4642_parse_ls_vga_fix.patch +24 −0
- recipes/incoming/tig.toml +47 −0
- recipes/incoming/use-linux-headers.patch +11 −0
- recipes/incoming/wget.toml +47 −0
- recipes/tmux.toml +18 −0
- tandas/c-cola-1.txt +16 −0
diff --git a/recipes/incoming/0001-include-unistd.patch b/recipes/incoming/0001-include-unistd.patch
new file mode 100644
index 00000000..532e43e7
--- /dev/null
+++ b/recipes/incoming/0001-include-unistd.patch
@@ -0,0 +1,12 @@
+diff --git a/scd/app.c b/scd/app.c
+index 21230bd..5999c37 100644
+--- a/scd/app.c
++++ b/scd/app.c
+@@ -23,6 +23,7 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <npth.h>
++#include <unistd.h>
+
+ #ifndef HAVE_W32_SYSTEM
+ #include <fcntl.h> /* F_SETFD F_GETFL F_SETFL O_NONBLOCK fcntl(2) */
diff --git a/recipes/incoming/0010-avoid-beta-warning.patch b/recipes/incoming/0010-avoid-beta-warning.patch
new file mode 100644
index 00000000..2c3c873f
--- /dev/null
+++ b/recipes/incoming/0010-avoid-beta-warning.patch
@@ -0,0 +1,46 @@
+From: Debian GnuPG Maintainers <pkg-gnupg-maint@lists.alioth.debian.org>
+Date: Tue, 14 Apr 2015 10:02:31 -0400
+Subject: avoid-beta-warning
+
+avoid self-describing as a beta
+
+Using autoreconf against the source as distributed in tarball form
+invariably results in a package that thinks it's a "beta" package,
+which produces the "THIS IS A DEVELOPMENT VERSION" warning string.
+
+since we use dh_autoreconf, i need this patch to avoid producing
+builds that announce themselves as DEVELOPMENT VERSIONs.
+
+See discussion at:
+
+ http://lists.gnupg.org/pipermail/gnupg-devel/2014-November/029065.html
+---
+ autogen.sh | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/debian-packaging/avoid-beta-warning.patch
+
+diff --git a/autogen.sh b/autogen.sh
+index b238550..9b86d3f 100755
+--- a/autogen.sh
++++ b/autogen.sh
+@@ -229,7 +229,7 @@ if [ "$myhost" = "find-version" ]; then
+ esac
+
+ beta=no
+- if [ -e .git ]; then
++ if false; then
+ ingit=yes
+ tmp=$(git describe --match "${matchstr1}" --long 2>/dev/null)
+ tmp=$(echo "$tmp" | sed s/^"$package"//)
+@@ -245,8 +245,8 @@ if [ "$myhost" = "find-version" ]; then
+ rvd=$((0x$(echo ${rev} | dd bs=1 count=4 2>/dev/null)))
+ else
+ ingit=no
+- beta=yes
+- tmp="-unknown"
++ beta=no
++ tmp=""
+ rev="0000000"
+ rvd="0"
+ fi
diff --git a/recipes/incoming/0020-avoid-regenerating-defsincdate-use-shipped-file.patch b/recipes/incoming/0020-avoid-regenerating-defsincdate-use-shipped-file.patch
new file mode 100644
index 00000000..2ce171a4
--- /dev/null
+++ b/recipes/incoming/0020-avoid-regenerating-defsincdate-use-shipped-file.patch
@@ -0,0 +1,41 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Mon, 29 Aug 2016 12:34:42 -0400
+Subject: avoid regenerating defsincdate (use shipped file)
+
+upstream ships doc/defsincdate in its tarballs. but doc/Makefile.am
+tries to rewrite doc/defsincdate if it notices that any of the files
+have been modified more recently, and it does so assuming that we're
+running from a git repo.
+
+However, we'd rather ship the documents cleanly without regenerating
+defsincdate -- we don't have a git repo available (debian builds from
+upstream tarballs) and any changes to the texinfo files (e.g. from
+debian/patches/) might result in different dates on the files than we
+expect after they're applied by dpkg or quilt or whatever, which makes
+the datestamp unreproducible.
+---
+ doc/Makefile.am | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/debian-packaging/avoid-regenerating-defsincdate-use-shipped-file.patch
+
+diff --git a/doc/Makefile.am b/doc/Makefile.am
+index 2b882c3..6be571b 100644
+--- a/doc/Makefile.am
++++ b/doc/Makefile.am
+@@ -178,15 +178,6 @@ $(myman_pages) gnupg.7 : yat2m-stamp defs.inc
+
+ dist-hook: defsincdate
+
+-defsincdate: $(gnupg_TEXINFOS)
+- : >defsincdate ; \
+- if test -e $(top_srcdir)/.git; then \
+- (cd $(srcdir) && git log -1 --format='%ct' \
+- -- $(gnupg_TEXINFOS) 2>/dev/null) >>defsincdate; \
+- elif test x"$$SOURCE_DATE_EPOCH" != x; then \
+- echo "$$SOURCE_DATE_EPOCH" >>defsincdate ; \
+- fi
+-
+ defs.inc : defsincdate Makefile mkdefsinc
+ incd="`test -f defsincdate || echo '$(srcdir)/'`defsincdate"; \
+ ./mkdefsinc -C $(srcdir) --date "`cat $$incd 2>/dev/null`" \
diff --git a/recipes/incoming/0110-avoid-simple-memory-dumps-via-ptrace.patch b/recipes/incoming/0110-avoid-simple-memory-dumps-via-ptrace.patch
new file mode 100644
index 00000000..35ab352c
--- /dev/null
+++ b/recipes/incoming/0110-avoid-simple-memory-dumps-via-ptrace.patch
@@ -0,0 +1,91 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Tue, 11 Aug 2015 20:28:26 -0400
+Subject: Avoid simple memory dumps via ptrace
+
+This avoids needing to setgid gpg-agent. It probably doesn't defend
+against all possible attacks, but it defends against one specific (and
+easy) one. If there are other protections we should do them too.
+
+This will make it slightly harder to debug the agent because the
+normal user won't be able to attach gdb to it directly while it runs.
+
+The remaining options for debugging are:
+
+ * launch the agent from gdb directly
+ * connect gdb to a running agent as the superuser
+
+Upstream bug: https://dev.gnupg.org/T1211
+---
+ agent/gpg-agent.c | 8 ++++++++
+ configure.ac | 2 +-
+ scd/scdaemon.c | 9 +++++++++
+ 3 files changed, 18 insertions(+), 1 deletion(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/block-ptrace-on-secret-daemons/Avoid-simple-memory-dumps-via-ptrace.patch
+
+diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
+index 412eb43..1de989b 100644
+--- a/agent/gpg-agent.c
++++ b/agent/gpg-agent.c
+@@ -48,6 +48,9 @@
+ # include <signal.h>
+ #endif
+ #include <npth.h>
++#ifdef HAVE_PRCTL
++# include <sys/prctl.h>
++#endif
+
+ #define INCLUDED_BY_MAIN_MODULE 1
+ #define GNUPG_COMMON_NEED_AFLOCAL
+@@ -1095,6 +1098,11 @@ main (int argc, char **argv)
+
+ early_system_init ();
+
++#if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
++ /* Disable ptrace on Linux without sgid bit */
++ prctl(PR_SET_DUMPABLE, 0);
++#endif
++
+ /* Before we do anything else we save the list of currently open
+ file descriptors and the signal mask. This info is required to
+ do the exec call properly. We don't need it on Windows. */
+diff --git a/configure.ac b/configure.ac
+index 099c6a8..4c9fcee 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1419,7 +1419,7 @@ AC_CHECK_FUNCS([atexit canonicalize_file_name clock_gettime ctermid \
+ ftruncate funlockfile getaddrinfo getenv getpagesize \
+ getpwnam getpwuid getrlimit getrusage gettimeofday \
+ gmtime_r inet_ntop inet_pton isascii lstat memicmp \
+- memmove memrchr mmap nl_langinfo pipe raise rand \
++ memmove memrchr mmap nl_langinfo pipe prctl raise rand \
+ setenv setlocale setrlimit sigaction sigprocmask \
+ stat stpcpy strcasecmp strerror strftime stricmp \
+ strlwr strncasecmp strpbrk strsep strtol strtoul \
+diff --git a/scd/scdaemon.c b/scd/scdaemon.c
+index e43769f..2066543 100644
+--- a/scd/scdaemon.c
++++ b/scd/scdaemon.c
+@@ -37,6 +37,9 @@
+ #include <unistd.h>
+ #include <signal.h>
+ #include <npth.h>
++#ifdef HAVE_PRCTL
++# include <sys/prctl.h>
++#endif
+
+ #define INCLUDED_BY_MAIN_MODULE 1
+ #define GNUPG_COMMON_NEED_AFLOCAL
+@@ -462,6 +465,12 @@ main (int argc, char **argv )
+ const char *application_priority = NULL;
+
+ early_system_init ();
++
++#if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
++ /* Disable ptrace on Linux without sgid bit */
++ prctl(PR_SET_DUMPABLE, 0);
++#endif
++
+ gpgrt_set_strusage (my_strusage);
+ gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
+ /* Please note that we may running SUID(ROOT), so be very CAREFUL
diff --git a/recipes/incoming/0210-dirmngr-hkp-avoid-potential-race-condition-when-some-host-die.patch b/recipes/incoming/0210-dirmngr-hkp-avoid-potential-race-condition-when-some-host-die.patch
new file mode 100644
index 00000000..32942e6f
--- /dev/null
+++ b/recipes/incoming/0210-dirmngr-hkp-avoid-potential-race-condition-when-some-host-die.patch
@@ -0,0 +1,284 @@
+note: combination of previous 0210+0220
+--
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Sat, 29 Oct 2016 01:25:05 -0400
+Subject: dirmngr: hkp: Avoid potential race condition when some hosts die.
+
+* dirmngr/ks-engine-hkp.c (select_random_host): Use atomic pass
+through the host table instead of risking out-of-bounds write.
+
+--
+
+Multiple threads may write to hosttable[x]->dead while
+select_random_host() is running. For example, a housekeeping thread
+might clear the ->dead bit on some entries, or another connection to
+dirmngr might manually mark a host as alive.
+
+If one or more hosts are resurrected between the two loops over a
+given table in select_random_host(), then the allocation of tbl might
+not be large enough, resulting in a write past the end of tbl on the
+second loop.
+
+This change collapses the two loops into a single loop to avoid this
+discrepancy: each host's "dead" bit is now only checked once.
+
+As Werner points out, this isn't currently strictly necessary, since
+npth will not switch threads unless a blocking system call is made,
+and no blocking system call is made in these two loops.
+
+However, in a subsequent change in this series, we will call a
+function in this loop, and that function may sometimes write(2), or
+call other functions, which may themselves block. Keeping this as a
+single-pass loop avoids the need to keep track of what might block and
+what might not.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ dirmngr/ks-engine-hkp.c | 23 ++++++++++-------------
+ 1 file changed, 10 insertions(+), 13 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/dirmngr-idling/dirmngr-hkp-Avoid-potential-race-condition-when-some.patch
+
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Sat, 29 Oct 2016 02:00:50 -0400
+Subject: dirmngr: Avoid need for hkp housekeeping.
+
+* dirmngr/ks-engine-hkp.c (host_is_alive): New function. Test whether
+host is alive and resurrects it if it has been dead long enough.
+(select_random_host, map_host, ks_hkp_mark_host): Use host_is_alive
+instead of testing hostinfo_t->dead directly.
+(ks_hkp_housekeeping): Remove function, no longer needed.
+* dirmngr/dirmngr.c (housekeeping_thread): Remove call to
+ks_hkp_housekeeping.
+
+--
+
+Rather than resurrecting hosts upon scheduled resurrection times, test
+whether hosts should be resurrected as they're inspected for being
+dead. This removes the need for explicit housekeeping, and makes host
+resurrections happen "just in time", rather than being clustered on
+HOUSEKEEPING_INTERVAL seconds.
+
+According to 392e068e9f143d41f6350345619543cbcd47380f,
+dns_stuff_housekeeping only works on Windows, so it also isn't
+necessary in debian, but it remains in place for now.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ dirmngr/dirmngr.c | 3 ---
+ dirmngr/dirmngr.h | 1 -
+ dirmngr/ks-engine-hkp.c | 72 ++++++++++++++++++++++++-------------------------
+ 3 files changed, 35 insertions(+), 41 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/dirmngr-idling/dirmngr-Avoid-need-for-hkp-housekeeping.patch
+
+diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
+index 977e7dd..5017c3f 100644
+--- a/dirmngr/dirmngr.c
++++ b/dirmngr/dirmngr.c
+@@ -2085,7 +2085,6 @@ housekeeping_thread (void *arg)
+ dirmngr_init_default_ctrl (&ctrlbuf);
+
+ dns_stuff_housekeeping ();
+- ks_hkp_housekeeping (curtime);
+ if (network_activity_seen)
+ {
+ network_activity_seen = 0;
+diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
+index 5292da8..690b37d 100644
+--- a/dirmngr/ks-engine-hkp.c
++++ b/dirmngr/ks-engine-hkp.c
+@@ -221,6 +221,24 @@ host_in_pool_p (hostinfo_t hi, int tblidx)
+ return 0;
+ }
+
++static int
++host_is_alive (hostinfo_t hi, time_t curtime)
++{
++ if (!hi)
++ return 0;
++ if (!hi->dead)
++ return 1;
++ if (!hi->died_at)
++ return 0; /* manually marked dead */
++ if (hi->died_at + RESURRECT_INTERVAL <= curtime
++ || hi->died_at > curtime)
++ {
++ hi->dead = 0;
++ log_info ("resurrected host '%s'", hi->name);
++ return 1;
++ }
++ return 0;
++}
+
+ /* Select a random host. Consult HI->pool which indices into the global
+ hosttable. Returns index into HI->pool or -1 if no host could be
+@@ -228,32 +246,32 @@ host_in_pool_p (hostinfo_t hi, int tblidx)
+ static int
+ select_random_host (hostinfo_t hi)
+ {
+- int *tbl;
+- size_t tblsize;
++ int *tbl = NULL;
++ size_t tblsize = 0;
+ int pidx, idx;
++ time_t curtime;
++
++ curtime = gnupg_get_time ();
+
+ /* CHECKTHIS(); See */
+ /* https://sources.debian.org/patches/gnupg2/2.2.20-1/dirmngr-idling/dirmngr-hkp-Avoid-potential-race-condition-when-some.patch/ */
+
+ /* We create a new table so that we randomly select only from
+ currently alive hosts. */
+- for (idx = 0, tblsize = 0;
++ for (idx = 0;
+ idx < hi->pool_len && (pidx = hi->pool[idx]) != -1;
+ idx++)
+- if (hosttable[pidx] && !hosttable[pidx]->dead)
+- tblsize++;
++ if (hosttable[pidx] && host_is_alive (hosttable[pidx], curtime))
++ {
++ tblsize++;
++ tbl = xtryrealloc(tbl, tblsize * sizeof *tbl);
++ if (!tbl)
++ return -1; /* memory allocation failed! */
++ tbl[tblsize-1] = pidx;
++ }
+ if (!tblsize)
+ return -1; /* No hosts. */
+
+- tbl = xtrymalloc (tblsize * sizeof *tbl);
+- if (!tbl)
+- return -1;
+- for (idx = 0, tblsize = 0;
+- idx < hi->pool_len && (pidx = hi->pool[idx]) != -1;
+- idx++)
+- if (hosttable[pidx] && !hosttable[pidx]->dead)
+- tbl[tblsize++] = pidx;
+-
+ if (tblsize == 1) /* Save a get_uint_nonce. */
+ pidx = tbl[0];
+ else
+@@ -471,6 +489,7 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
+ int is_pool;
+ int new_hosts = 0;
+ char *cname;
++ time_t curtime;
+
+ *r_host = NULL;
+ if (r_httpflags)
+@@ -510,6 +529,7 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
+ }
+ else
+ hi = hosttable[idx];
++ curtime = gnupg_get_time ();
+
+ is_pool = hi->pool != NULL;
+
+@@ -616,7 +636,7 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
+ if (force_reselect)
+ hi->poolidx = -1;
+ else if (hi->poolidx >= 0 && hi->poolidx < hosttable_size
+- && hosttable[hi->poolidx] && hosttable[hi->poolidx]->dead)
++ && hosttable[hi->poolidx] && !host_is_alive (hosttable[hi->poolidx], curtime))
+ hi->poolidx = -1;
+
+ /* Select a host if needed. */
+@@ -675,7 +695,7 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
+ return gpg_error_from_syserror ();
+ }
+
+- if (hi->dead)
++ if (!host_is_alive (hi, curtime))
+ {
+ log_error ("host '%s' marked as dead\n", hi->name);
+ if (r_httphost)
+@@ -781,7 +801,8 @@ ks_hkp_mark_host (ctrl_t ctrl, const char *name, int alive)
+ {
+ gpg_error_t err = 0;
+ hostinfo_t hi, hi2;
+- int idx, idx2, idx3, n;
++ int idx, idx2, idx3, n, is_alive;
++ time_t curtime;
+
+ if (!name || !*name || !strcmp (name, "localhost"))
+ return 0;
+@@ -796,13 +817,15 @@ ks_hkp_mark_host (ctrl_t ctrl, const char *name, int alive)
+ goto leave;
+ }
+
++ curtime = gnupg_get_time ();
+ hi = hosttable[idx];
+- if (alive && hi->dead)
++ is_alive = host_is_alive (hi, curtime);
++ if (alive && !is_alive)
+ {
+ hi->dead = 0;
+ err = ks_printf_help (ctrl, "marking '%s' as alive", name);
+ }
+- else if (!alive && !hi->dead)
++ else if (!alive && is_alive)
+ {
+ hi->dead = 1;
+ hi->died_at = 0; /* Manually set dead. */
+@@ -836,14 +859,15 @@ ks_hkp_mark_host (ctrl_t ctrl, const char *name, int alive)
+
+ hi2 = hosttable[n];
+ if (!hi2)
+- ;
+- else if (alive && hi2->dead)
++ continue;
++ is_alive = host_is_alive (hi2, curtime);
++ if (alive && !is_alive)
+ {
+ hi2->dead = 0;
+ err = ks_printf_help (ctrl, "marking '%s' as alive",
+ hi2->name);
+ }
+- else if (!alive && !hi2->dead)
++ else if (!alive && is_alive)
+ {
+ hi2->dead = 1;
+ hi2->died_at = 0; /* Manually set dead. */
+@@ -1149,40 +1173,6 @@ ks_hkp_resolve (ctrl_t ctrl, parsed_uri_t uri)
+ }
+
+
+-/* Housekeeping function called from the housekeeping thread. It is
+- used to mark dead hosts alive so that they may be tried again after
+- some time. */
+-void
+-ks_hkp_housekeeping (time_t curtime)
+-{
+- int idx;
+- hostinfo_t hi;
+-
+- if (npth_mutex_lock (&hosttable_lock))
+- log_fatal ("failed to acquire mutex\n");
+-
+- for (idx=0; idx < hosttable_size; idx++)
+- {
+- hi = hosttable[idx];
+- if (!hi)
+- continue;
+- if (!hi->dead)
+- continue;
+- if (!hi->died_at)
+- continue; /* Do not resurrect manually shot hosts. */
+- if (hi->died_at + RESURRECT_INTERVAL <= curtime
+- || hi->died_at > curtime)
+- {
+- hi->dead = 0;
+- log_info ("resurrected host '%s'", hi->name);
+- }
+- }
+-
+- if (npth_mutex_unlock (&hosttable_lock))
+- log_fatal ("failed to release mutex\n");
+-}
+-
+-
+ /* Reload (SIGHUP) action for this module. We mark all host alive
+ * even those which have been manually shot. */
+ void
diff --git a/recipes/incoming/0230-dirmngr-avoid-automatically-checking-upstream-swdb.patch b/recipes/incoming/0230-dirmngr-avoid-automatically-checking-upstream-swdb.patch
new file mode 100644
index 00000000..8ffd8973
--- /dev/null
+++ b/recipes/incoming/0230-dirmngr-avoid-automatically-checking-upstream-swdb.patch
@@ -0,0 +1,51 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+From: Jakub Jirutka <jakub@jirutka.cz>
+Date: Sun, 20 Nov 2016 23:09:24 -0500
+Date: Wed, 18 Aug 2021 21:08:20 +0200
+Subject: dirmngr: Avoid automatically checking upstream swdb.
+
+* dirmngr/dirmngr.c (housekeeping_thread): Avoid automatically
+checking upstream's software database. In Debian, software updates
+should be handled by the distro mechanism, and additional upstream
+checks only confuse the user.
+* doc/dirmngr.texi: document that --allow-version-check does nothing.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ dirmngr/dirmngr.c | 2 --
+ doc/dirmngr.texi | 7 ++++---
+ 2 files changed, 4 insertions(+), 5 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/dirmngr-idling/dirmngr-Avoid-automatically-checking-upstream-swdb.patch
+
+diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
+index 89eea4e..f26ed63 100644
+--- a/dirmngr/dirmngr.c
++++ b/dirmngr/dirmngr.c
+@@ -1955,8 +1955,6 @@ housekeeping_thread (void *arg)
+ if (network_activity_seen)
+ {
+ network_activity_seen = 0;
+- if (opt.allow_version_check)
+- dirmngr_load_swdb (&ctrlbuf, 0);
+ workqueue_run_global_tasks (&ctrlbuf, 1);
+ }
+ else
+diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
+index 843fdbf..84a8d28 100644
+--- a/doc/dirmngr.texi
++++ b/doc/dirmngr.texi
+@@ -291,9 +291,10 @@ Set the size of the queue for pending connections. The default is 64.
+ @item --allow-version-check
+ @opindex allow-version-check
+ Allow Dirmngr to connect to @code{https://versions.gnupg.org} to get
+-the list of current software versions. If this option is enabled
+-the list is retrieved in case the local
+-copy does not exist or is older than 5 to 7 days. See the option
++the list of current software versions.
++On Alpine-packaged versions, this option does nothing since software
++updates should be handled by the distribution.
++See the option
+ @option{--query-swdb} of the command @command{gpgconf} for more
+ details. Note, that regardless of this option a version check can
+ always be triggered using this command:
diff --git a/recipes/incoming/0330-gpg-default-to-sha512-for-all-signature-types-on-rsa-keys.patch b/recipes/incoming/0330-gpg-default-to-sha512-for-all-signature-types-on-rsa-keys.patch
new file mode 100644
index 00000000..3b4e146a
--- /dev/null
+++ b/recipes/incoming/0330-gpg-default-to-sha512-for-all-signature-types-on-rsa-keys.patch
@@ -0,0 +1,66 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Thu, 7 Sep 2017 18:49:35 -0400
+Subject: gpg: Default to SHA-512 for all signature types on RSA keys.
+
+* g10/main.h (DEFAULT_DIGEST_ALGO): Use SHA512 instead of SHA256 in
+--gnupg mode (leave strict RFC and PGP modes alone).
+* configure.ac: Do not allow disabling sha512.
+* g10/misc.c (map_md_openpgp_to_gcry): Always support SHA512.
+
+--
+
+SHA512 is more performant on most 64-bit platforms than SHA256, and
+offers a better security margin. It is also widely implemented.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ configure.ac | 2 +-
+ g10/main.h | 2 +-
+ g10/misc.c | 5 +----
+ 3 files changed, 3 insertions(+), 6 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/update-defaults/gpg-Default-to-SHA-512-for-all-signature-types-on-RS.patch
+
+diff --git a/configure.ac b/configure.ac
+index c31ae02..f7788b3 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -339,7 +339,7 @@ GNUPG_GPG_DISABLE_ALGO([rmd160],[RIPE-MD160 hash])
+ GNUPG_GPG_DISABLE_ALGO([sha224],[SHA-224 hash])
+ # SHA256 is a MUST algorithm for GnuPG.
+ GNUPG_GPG_DISABLE_ALGO([sha384],[SHA-384 hash])
+-GNUPG_GPG_DISABLE_ALGO([sha512],[SHA-512 hash])
++# SHA512 is a MUST algorithm for GnuPG.
+
+
+ # Allow disabling of zip support.
+diff --git a/g10/main.h b/g10/main.h
+index b29e23e..0a64a21 100644
+--- a/g10/main.h
++++ b/g10/main.h
+@@ -41,7 +41,7 @@
+ # define DEFAULT_CIPHER_ALGO CIPHER_ALGO_3DES
+ #endif
+
+-#define DEFAULT_DIGEST_ALGO ((GNUPG)? DIGEST_ALGO_SHA256:DIGEST_ALGO_SHA1)
++#define DEFAULT_DIGEST_ALGO ((GNUPG)? DIGEST_ALGO_SHA512:DIGEST_ALGO_SHA1)
+ #define DEFAULT_S2K_DIGEST_ALGO DEFAULT_DIGEST_ALGO
+ #ifdef HAVE_ZIP
+ # define DEFAULT_COMPRESS_ALGO COMPRESS_ALGO_ZIP
+diff --git a/g10/misc.c b/g10/misc.c
+index 2f4b452..0e6d9d5 100644
+--- a/g10/misc.c
++++ b/g10/misc.c
+@@ -862,11 +862,8 @@ map_md_openpgp_to_gcry (digest_algo_t algo)
+ case DIGEST_ALGO_SHA384: return 0;
+ #endif
+
+-#ifdef GPG_USE_SHA512
+ case DIGEST_ALGO_SHA512: return GCRY_MD_SHA512;
+-#else
+- case DIGEST_ALGO_SHA512: return 0;
+-#endif
++
+ default: return 0;
+ }
+ }
diff --git a/recipes/incoming/0340-gpg-prefer-sha512-and-sha384-in-personal-digest.patch b/recipes/incoming/0340-gpg-prefer-sha512-and-sha384-in-personal-digest.patch
new file mode 100644
index 00000000..bac31b3f
--- /dev/null
+++ b/recipes/incoming/0340-gpg-prefer-sha512-and-sha384-in-personal-digest.patch
@@ -0,0 +1,48 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Wed, 3 Jan 2018 12:34:26 -0500
+Subject: gpg: Prefer SHA-512 and SHA-384 in personal-digest-preferences.
+
+* g10/keygen.c (keygen_set_std_prefs): prefer SHA-512
+and SHA-384 by default.
+
+--
+
+In 8ede3ae29a39641a2f98ad9a4cf61ea99085a892, upstream changed the
+defaults for --default-preference-list to advertise a preference for
+SHA-512, without touching --personal-digest-preferences. This makes
+the same change for --personal-digest-preferences, since every modern
+OpenPGP library supports them all.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ g10/keygen.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/update-defaults/gpg-Prefer-SHA-512-and-SHA-384-in-personal-digest.patch
+
+diff --git a/g10/keygen.c b/g10/keygen.c
+index 79d4579..cb92468 100644
+--- a/g10/keygen.c
++++ b/g10/keygen.c
+@@ -391,16 +391,16 @@ keygen_set_std_prefs (const char *string,int personal)
+ if (personal)
+ {
+ /* The default internal hash algo order is:
+- * SHA-256, SHA-384, SHA-512, SHA-224, SHA-1.
++ * SHA-512, SHA-384, SHA-256, SHA-224, SHA-1.
+ */
+- if (!openpgp_md_test_algo (DIGEST_ALGO_SHA256))
+- strcat (dummy_string, "H8 ");
++ if (!openpgp_md_test_algo (DIGEST_ALGO_SHA512))
++ strcat (dummy_string, "H10 ");
+
+ if (!openpgp_md_test_algo (DIGEST_ALGO_SHA384))
+ strcat (dummy_string, "H9 ");
+
+- if (!openpgp_md_test_algo (DIGEST_ALGO_SHA512))
+- strcat (dummy_string, "H10 ");
++ if (!openpgp_md_test_algo (DIGEST_ALGO_SHA256))
++ strcat (dummy_string, "H8 ");
+ }
+ else
+ {
diff --git a/recipes/incoming/0420-gpg-drop-import-clean-from-default-keyserver-import-options.patch b/recipes/incoming/0420-gpg-drop-import-clean-from-default-keyserver-import-options.patch
new file mode 100644
index 00000000..26098e79
--- /dev/null
+++ b/recipes/incoming/0420-gpg-drop-import-clean-from-default-keyserver-import-options.patch
@@ -0,0 +1,51 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Mon, 15 Jul 2019 16:24:35 -0400
+Subject: gpg: drop import-clean from default keyserver import options
+
+* g10/gpg.c (main): drop IMPORT_CLEAN from the
+default opt.keyserver_options.import_options
+* doc/gpg.texi: reflect this change in the documentation
+
+Given that SELF_SIGS_ONLY is already set, it's not clear what
+additional benefit IMPORT_CLEAN provides. Furthermore, IMPORT_CLEAN
+means that receiving an OpenPGP certificate from a keyserver will
+potentially delete data that is otherwise held in the local keyring,
+which is surprising to users who expect retrieval from the keyservers
+to be purely additive.
+
+GnuPG-Bug-Id: 4628
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ doc/gpg.texi | 2 +-
+ g10/gpg.c | 3 +--
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/gpg-drop-import-clean-from-default-keyserver-import-optio.patch
+
+diff --git a/doc/gpg.texi b/doc/gpg.texi
+index 804ecf9..b238278 100644
+--- a/doc/gpg.texi
++++ b/doc/gpg.texi
+@@ -2047,7 +2047,7 @@ are available for all keyserver types, some common options are:
+
+ @end table
+
+-The default list of options is: "self-sigs-only, import-clean,
++The default list of options is: "self-sigs-only,
+ repair-keys, repair-pks-subkey-bug, export-attributes". However, if
+ the actual used source is an LDAP server "no-self-sigs-only" is
+ assumed unless "self-sigs-only" has been explicitly configured.
+diff --git a/g10/gpg.c b/g10/gpg.c
+index 68c0454..205de60 100644
+--- a/g10/gpg.c
++++ b/g10/gpg.c
+@@ -2441,8 +2441,7 @@ main (int argc, char **argv)
+ | IMPORT_REPAIR_PKS_SUBKEY_BUG
+ | IMPORT_SELF_SIGS_ONLY
+ | IMPORT_COLLAPSE_UIDS
+- | IMPORT_COLLAPSE_SUBKEYS
+- | IMPORT_CLEAN);
++ | IMPORT_COLLAPSE_SUBKEYS);
+ opt.keyserver_options.export_options = EXPORT_ATTRIBUTES;
+ opt.keyserver_options.options = 0;
+ opt.verify_options = (LIST_SHOW_UID_VALIDITY
diff --git a/recipes/incoming/HACK-revert-rfc4880bis-default.patch b/recipes/incoming/HACK-revert-rfc4880bis-default.patch
new file mode 100644
index 00000000..cd2c1dc3
--- /dev/null
+++ b/recipes/incoming/HACK-revert-rfc4880bis-default.patch
@@ -0,0 +1,207 @@
+see:
+https://lore.kernel.org/distributions/F30D6590-3E0C-4865-A944-7DE118A619CF@gentoo.org/
+
+this reverts to the pre-2.4 default of key generation. the new one is
+(apparently) not compatible with a potential future specification, and
+generates incompatible keys by default.
+
+once this is figured out, find a better solution than this
+--
+From 8b3e9127ea02eae8ec3470149e22804a572df5b8 Mon Sep 17 00:00:00 2001
+From: psykose <alice@ayaya.dev>
+Date: Tue, 7 Feb 2023 10:14:34 +0100
+Subject: [PATCH] Revert "gpg: Merge --rfc4880bis features into --gnupg"
+
+This reverts commit 4583f4fe2e11b3dd070066628c3f16776cc74f72.
+---
+ g10/gpg.c | 35 ++++++++++++++++++++++++++++++++---
+ g10/keygen.c | 30 ++++++++++++++++++------------
+ 2 files changed, 50 insertions(+), 15 deletions(-)
+
+diff --git a/g10/gpg.c b/g10/gpg.c
+index b759cc1..5a04163 100644
+--- a/g10/gpg.c
++++ b/g10/gpg.c
+@@ -247,6 +247,7 @@ enum cmd_and_opt_values
+ oGnuPG,
+ oRFC2440,
+ oRFC4880,
++ oRFC4880bis,
+ oOpenPGP,
+ oPGP7,
+ oPGP8,
+@@ -635,6 +636,7 @@ static gpgrt_opt_t opts[] = {
+ ARGPARSE_s_n (oGnuPG, "no-pgp8", "@"),
+ ARGPARSE_s_n (oRFC2440, "rfc2440", "@"),
+ ARGPARSE_s_n (oRFC4880, "rfc4880", "@"),
++ ARGPARSE_s_n (oRFC4880bis, "rfc4880bis", "@"),
+ ARGPARSE_s_n (oOpenPGP, "openpgp", N_("use strict OpenPGP behavior")),
+ ARGPARSE_s_n (oPGP7, "pgp6", "@"),
+ ARGPARSE_s_n (oPGP7, "pgp7", "@"),
+@@ -976,7 +978,6 @@ static gpgrt_opt_t opts[] = {
+ ARGPARSE_s_n (oNoop, "no-allow-multiple-messages", "@"),
+ ARGPARSE_s_s (oNoop, "aead-algo", "@"),
+ ARGPARSE_s_s (oNoop, "personal-aead-preferences","@"),
+- ARGPARSE_s_n (oNoop, "rfc4880bis", "@"),
+ ARGPARSE_s_n (oNoop, "override-compliance-check", "@"),
+
+
+@@ -2225,7 +2226,7 @@ static struct gnupg_compliance_option compliance_options[] =
+ {
+ { "gnupg", oGnuPG },
+ { "openpgp", oOpenPGP },
+- { "rfc4880bis", oGnuPG },
++ { "rfc4880bis", oRFC4880bis },
+ { "rfc4880", oRFC4880 },
+ { "rfc2440", oRFC2440 },
+ { "pgp6", oPGP7 },
+@@ -2241,8 +2242,28 @@ static struct gnupg_compliance_option compliance_options[] =
+ static void
+ set_compliance_option (enum cmd_and_opt_values option)
+ {
++ opt.flags.rfc4880bis = 0; /* Clear because it is initially set. */
++
+ switch (option)
+ {
++ case oRFC4880bis:
++ opt.flags.rfc4880bis = 1;
++ opt.compliance = CO_RFC4880;
++ opt.flags.dsa2 = 1;
++ opt.flags.require_cross_cert = 1;
++ opt.rfc2440_text = 0;
++ opt.allow_non_selfsigned_uid = 1;
++ opt.allow_freeform_uid = 1;
++ opt.escape_from = 1;
++ opt.not_dash_escaped = 0;
++ opt.def_cipher_algo = 0;
++ opt.def_digest_algo = 0;
++ opt.cert_digest_algo = 0;
++ opt.compress_algo = -1;
++ opt.s2k_mode = 3; /* iterated+salted */
++ opt.s2k_digest_algo = DIGEST_ALGO_SHA256;
++ opt.s2k_cipher_algo = CIPHER_ALGO_AES256;
++ break;
+ case oOpenPGP:
+ case oRFC4880:
+ /* This is effectively the same as RFC2440, but with
+@@ -2286,6 +2307,7 @@ set_compliance_option (enum cmd_and_opt_values option)
+ case oPGP8: opt.compliance = CO_PGP8; break;
+ case oGnuPG:
+ opt.compliance = CO_GNUPG;
++ opt.flags.rfc4880bis = 1;
+ break;
+
+ case oDE_VS:
+@@ -2488,6 +2510,7 @@ main (int argc, char **argv)
+ opt.emit_version = 0;
+ opt.weak_digests = NULL;
+ opt.compliance = CO_GNUPG;
++ opt.flags.rfc4880bis = 1;
+
+ /* Check special options given on the command line. */
+ orig_argc = argc;
+@@ -3030,6 +3053,7 @@ main (int argc, char **argv)
+ case oOpenPGP:
+ case oRFC2440:
+ case oRFC4880:
++ case oRFC4880bis:
+ case oPGP7:
+ case oPGP8:
+ case oGnuPG:
+@@ -3858,6 +3882,11 @@ main (int argc, char **argv)
+ if( may_coredump && !opt.quiet )
+ log_info(_("WARNING: program may create a core file!\n"));
+
++ if (!opt.flags.rfc4880bis)
++ {
++ opt.mimemode = 0; /* This will use text mode instead. */
++ }
++
+ if (eyes_only) {
+ if (opt.set_filename)
+ log_info(_("WARNING: %s overrides %s\n"),
+@@ -4074,7 +4103,7 @@ main (int argc, char **argv)
+ /* Check our chosen algorithms against the list of legal
+ algorithms. */
+
+- if(!GNUPG)
++ if(!GNUPG && !opt.flags.rfc4880bis)
+ {
+ const char *badalg=NULL;
+ preftype_t badtype=PREFTYPE_NONE;
+diff --git a/g10/keygen.c b/g10/keygen.c
+index 7f54f7d..83fc3f3 100644
+--- a/g10/keygen.c
++++ b/g10/keygen.c
+@@ -404,7 +404,7 @@ keygen_set_std_prefs (const char *string,int personal)
+ strcat(dummy_string,"S7 ");
+ strcat(dummy_string,"S2 "); /* 3DES */
+
+- if (!openpgp_aead_test_algo (AEAD_ALGO_OCB))
++ if (opt.flags.rfc4880bis && !openpgp_aead_test_algo (AEAD_ALGO_OCB))
+ strcat(dummy_string,"A2 ");
+
+ if (personal)
+@@ -889,7 +889,7 @@ keygen_upd_std_prefs (PKT_signature *sig, void *opaque)
+ /* Make sure that the MDC feature flag is set if needed. */
+ add_feature_mdc (sig,mdc_available);
+ add_feature_aead (sig, aead_available);
+- add_feature_v5 (sig, 1);
++ add_feature_v5 (sig, opt.flags.rfc4880bis);
+ add_keyserver_modify (sig,ks_modify);
+ keygen_add_keyserver_url(sig,NULL);
+
+@@ -3382,7 +3382,10 @@ parse_key_parameter_part (ctrl_t ctrl,
+ }
+ }
+ else if (!ascii_strcasecmp (s, "v5"))
+- keyversion = 5;
++ {
++ if (opt.flags.rfc4880bis)
++ keyversion = 5;
++ }
+ else if (!ascii_strcasecmp (s, "v4"))
+ keyversion = 4;
+ else
+@@ -3641,7 +3644,7 @@ parse_key_parameter_part (ctrl_t ctrl,
+ * ecdsa := Use algorithm ECDSA.
+ * eddsa := Use algorithm EdDSA.
+ * ecdh := Use algorithm ECDH.
+- * v5 := Create version 5 key
++ * v5 := Create version 5 key (requires option --rfc4880bis)
+ *
+ * There are several defaults and fallbacks depending on the
+ * algorithm. PART can be used to select which part of STRING is
+@@ -4513,9 +4516,9 @@ read_parameter_file (ctrl_t ctrl, const char *fname )
+ }
+ }
+
+- if ((keywords[i].key == pVERSION
+- || keywords[i].key == pSUBVERSION))
+- ; /* Ignore version. */
++ if (!opt.flags.rfc4880bis && (keywords[i].key == pVERSION
++ || keywords[i].key == pSUBVERSION))
++ ; /* Ignore version unless --rfc4880bis is active. */
+ else
+ {
+ r = xmalloc_clear( sizeof *r + strlen( value ) );
+@@ -4610,11 +4613,14 @@ quickgen_set_para (struct para_data_s *para, int for_subkey,
+ para = r;
+ }
+
+- r = xmalloc_clear (sizeof *r + 20);
+- r->key = for_subkey? pSUBVERSION : pVERSION;
+- snprintf (r->u.value, 20, "%d", version);
+- r->next = para;
+- para = r;
++ if (opt.flags.rfc4880bis)
++ {
++ r = xmalloc_clear (sizeof *r + 20);
++ r->key = for_subkey? pSUBVERSION : pVERSION;
++ snprintf (r->u.value, 20, "%d", version);
++ r->next = para;
++ para = r;
++ }
+
+ if (keytime)
+ {
diff --git a/recipes/incoming/alpine_syntax.patch b/recipes/incoming/alpine_syntax.patch
new file mode 100644
index 00000000..b556f7c4
--- /dev/null
+++ b/recipes/incoming/alpine_syntax.patch
@@ -0,0 +1,12 @@
+--- a/misc/syntax/Syntax.in
++++ b/misc/syntax/Syntax.in
+@@ -250,6 +250,9 @@
+ file .\*\\.strace$ Strace\sdebug\soutput
+ include strace.syntax
+
++file APKBUILD$ Alpine\spackage\sbuild\sscript
++include PKGBUILD.syntax
++
+ file PKGBUILD$ Arch\spackage\sbuild\sscript
+ include PKGBUILD.syntax
+
diff --git a/recipes/incoming/cmake-version.patch b/recipes/incoming/cmake-version.patch
new file mode 100644
index 00000000..b9c96ade
--- /dev/null
+++ b/recipes/incoming/cmake-version.patch
@@ -0,0 +1,21 @@
+From 42864e12b0d7af01b1cf989d6da9e9a4477775a1 Mon Sep 17 00:00:00 2001
+From: Rudi Heitbaum <rudi@heitbaum.com>
+Date: Fri, 28 Mar 2025 23:14:48 +1100
+Subject: [PATCH] Allow build with cmake 4.0.0
+
+Update the min version to match parent CMakeLists.txt 3.9...3.12
+---
+ apps/CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/apps/CMakeLists.txt b/apps/CMakeLists.txt
+index f7c9dec633..ef2271d131 100644
+--- a/apps/CMakeLists.txt
++++ b/apps/CMakeLists.txt
+@@ -1,5 +1,5 @@
+
+-cmake_minimum_required(VERSION 2.8) # see ../CMakeLists.txt for why 2.8
++cmake_minimum_required(VERSION 3.9...3.12)
+
+ if(POLICY CMP0075)
+ cmake_policy(SET CMP0075 NEW)
diff --git a/recipes/incoming/dont-use-nobody.patch b/recipes/incoming/dont-use-nobody.patch
new file mode 100644
index 00000000..180c18d5
--- /dev/null
+++ b/recipes/incoming/dont-use-nobody.patch
@@ -0,0 +1,15 @@
+rootbld makes all the supplementary groups nobody(65534);
+this patch avoids using them in tests
+
+diff --git a/getgroups.c b/getgroups.c
+index 8a37ed0..01adfca 100644
+--- a/getgroups.c
++++ b/getgroups.c
+@@ -48,6 +48,7 @@
+ #endif
+
+ for (i = 0; i < n; i++) {
++ if (list[i] == 65534) continue;
+ printf("%lu ", (unsigned long)list[i]);
+ if (list[i] == gid)
+ gid_in_list = 1;
diff --git a/recipes/incoming/fix-i18n.patch b/recipes/incoming/fix-i18n.patch
new file mode 100644
index 00000000..90fc0338
--- /dev/null
+++ b/recipes/incoming/fix-i18n.patch
@@ -0,0 +1,12 @@
+--- gnupg-2.1.7/common/i18n.c.orig 2015-08-31 20:40:18.752742866 +0300
++++ gnupg-2.1.7/common/i18n.c 2015-08-31 20:40:41.806336224 +0300
+@@ -85,8 +85,8 @@
+ bindtextdomain (PACKAGE_GT, gnupg_localedir ());
+ textdomain (PACKAGE_GT);
+ #else
+-# ifdef ENABLE_NLS
+ setlocale (LC_ALL, "" );
++# ifdef ENABLE_NLS
+ bindtextdomain (PACKAGE_GT, gnupg_localedir ());
+ textdomain (PACKAGE_GT);
+ # endif
diff --git a/recipes/incoming/fix-t4219-with-sticky-bit.patch b/recipes/incoming/fix-t4219-with-sticky-bit.patch
new file mode 100644
index 00000000..54ac184f
--- /dev/null
+++ b/recipes/incoming/fix-t4219-with-sticky-bit.patch
@@ -0,0 +1,48 @@
+The last test of t4129 creates a directory and expects its setgid bit
+(g+s) to be off. But this makes the test fail when the parent directory
+has the bit set, as setgid's state is inherited by newly created
+subdirectories. Make the test more robust by accepting the presence of
+the setgid bit on the created directory. We only allow 'S' (setgid on
+but no executable permission) and not 's' (setgid on with executable
+permission) because the previous 'umask 0077' shouldn't allow the second
+scenario to happen.
+
+Note that only subdirectories inherit this bit, so we don't have to make
+the same change for the regular file that is also created by this test.
+But checking the permissions using grep instead of test_cmp makes the
+test a little simpler, so let's use it for the regular file as well.
+
+Also note that the sticky bit (+t) and the setuid bit (u+s) are not
+inherited, so we don't have to worry about those.
+
+Reported-by: Kevin Daudt <me@ikke.info>
+Signed-off-by: Matheus Tavares <matheus.bernardino@usp.br>
+---
+ t/t4129-apply-samemode.sh | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/t/t4129-apply-samemode.sh b/t/t4129-apply-samemode.sh
+index 41818d8315..3818398ca9 100755
+--- a/t/t4129-apply-samemode.sh
++++ b/t/t4129-apply-samemode.sh
+@@ -90,12 +90,10 @@ test_expect_success POSIXPERM 'do not use core.sharedRepository for working tree
+ rm -rf d f1 &&
+ git apply patch-f1-and-f2.txt &&
+
+- echo "-rw-------" >f1_mode.expected &&
+- echo "drwx------" >d_mode.expected &&
+- test_modebits f1 >f1_mode.actual &&
+- test_modebits d >d_mode.actual &&
+- test_cmp f1_mode.expected f1_mode.actual &&
+- test_cmp d_mode.expected d_mode.actual
++ test_modebits f1 >f1_mode &&
++ test_modebits d >d_mode &&
++ grep "^-rw-------$" f1_mode &&
++ grep "^drwx--[-S]---$" d_mode
+ )
+ '
+
+--
+2.29.2
+
+
diff --git a/recipes/incoming/fix-test-musl.patch b/recipes/incoming/fix-test-musl.patch
new file mode 100644
index 00000000..32a768a7
--- /dev/null
+++ b/recipes/incoming/fix-test-musl.patch
@@ -0,0 +1,13 @@
+diff --git a/test/test-thread-priority.c b/test/test-thread-priority.c
+index acc3385..a083f00 100644
+--- a/test/test-thread-priority.c
++++ b/test/test-thread-priority.c
+@@ -100,7 +100,7 @@ TEST_IMPL(thread_priority) {
+ uv_sem_destroy(&sem);
+
+ /* Now that the thread no longer exists, verify that the relevant error is returned */
+-#if !defined(__ANDROID__)
++#if defined(__GLIBC__)
+ ASSERT_EQ(UV_ESRCH, uv_thread_getpriority(task_id, &priority));
+ ASSERT_EQ(UV_ESRCH, uv_thread_setpriority(task_id, UV_THREAD_PRIORITY_LOWEST));
+ #endif
diff --git a/recipes/incoming/git.toml b/recipes/incoming/git.toml
new file mode 100644
index 00000000..461fc18f
--- /dev/null
+++ b/recipes/incoming/git.toml
@@ -0,0 +1,54 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name = "git"
+version = "2.54.0"
+
+[source]
+tarball = "https://www.kernel.org/pub/software/scm/git/git-2.54.0.tar.xz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "cb363917124edc245c9f6745e6e0c4093990275b4d57f9d2213c655b304ac81b05ece8d88546122727495ebc48a5ae19ab166a3ee43b6b8c68da488ac0270064"
+sha256 = "f689162364c10de79ef89aa8dbf48731eb057e34edbbd20aca510ce0154681a3"
+patches = ["fix-t4219-with-sticky-bit.patch"]
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+make prefix=/usr \
+ DESTDIR="/out" \
+ perllibdir="$(_perl_config vendorlib)" \
+ all
+
+ make -C contrib/subtree prefix=/usr DESTDIR="/out"
+ make -C contrib/diff-highlight prefix=/usr DESTDIR="/out"
+
+ if [ -n "$_full_build" ]; then
+ # generate manpages outside of package()
+ make prefix=/usr man
+
+ make prefix=/usr -C contrib/credential/libsecret
+ fi
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make -C t prefix=/usr DESTDIR="/out" \
+ perlibdir="$(_perl_config vendorlib)" \
+ all
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): perl
+
+[deps]
+build = ["asciidoc", "python3", "tcl", "tk", "libsecret", "glib"]
diff --git a/recipes/incoming/gnupg.toml b/recipes/incoming/gnupg.toml
new file mode 100644
index 00000000..c42b9f92
--- /dev/null
+++ b/recipes/incoming/gnupg.toml
@@ -0,0 +1,64 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name = "gnupg"
+version = "2.4.9"
+
+[source]
+tarball = "https://gnupg.org/ftp/gcrypt/gnupg/gnupg-${pkgver/_beta/-beta}.tar.bz2"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "4638016b390a0024fa0cbe14181c43a81991e4275043855397ef099b927985d175d32452fc15b06485623b9292662dd6da464b2e5def8b77b2e4e48a072ab521"
+sha256 = "FIXME-sha256"
+patches = ["0001-include-unistd.patch", "0010-avoid-beta-warning.patch", "0020-avoid-regenerating-defsincdate-use-shipped-file.patch", "0110-avoid-simple-memory-dumps-via-ptrace.patch", "0210-dirmngr-hkp-avoid-potential-race-condition-when-some-host-die.patch", "0230-dirmngr-avoid-automatically-checking-upstream-swdb.patch", "0330-gpg-default-to-sha512-for-all-signature-types-on-rsa-keys.patch", "0340-gpg-prefer-sha512-and-sha384-in-personal-digest.patch", "0420-gpg-drop-import-clean-from-default-keyserver-import-options.patch", "fix-i18n.patch", "HACK-revert-rfc4880bis-default.patch"]
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+./configure \
+ --build=$CBUILD \
+ --host=$CHOST \
+ --prefix=/usr \
+ --sysconfdir=/etc \
+ --mandir=/usr/share/man \
+ --infodir=/usr/share/info \
+ --localstatedir=/var \
+ --disable-nls \
+ --enable-bzip2 \
+ --enable-tofu \
+ --enable-scdaemon \
+ --enable-ccid-driver
+ make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install
+
+ install -Dm644 -t "/out"/usr/lib/udev/rules.d/ "$srcdir"/60-scdaemon.rules
+
+ cd "/out"
+
+ # install compat symlink
+ ln -s gpg usr/bin/gpg2
+ ln -s gpgv usr/bin/gpgv2
+
+ # Remove docs for systemd-user
+ rm -rf usr/share/doc/gnupg/examples/systemd-user
+
+ # Remove gpg scheme interpreter - an internal tool used in gpg tests
+ rm -rf usr/bin/gpgscm
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["autoconf", "automake", "bzip2", "gettext", "gnutls", "libassuan", "libgcrypt", "libgpg-error", "libksba", "libtool", "libusb", "npth", "openldap", "pinentry", "sqlite", "texinfo", "xz", "zlib"]
diff --git a/recipes/incoming/irssi.toml b/recipes/incoming/irssi.toml
new file mode 100644
index 00000000..3ae0b441
--- /dev/null
+++ b/recipes/incoming/irssi.toml
@@ -0,0 +1,45 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name = "irssi"
+version = "1.4.5"
+
+[source]
+tarball = "https://github.com/irssi/irssi/releases/download/1.4.5/irssi-1.4.5.tar.xz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "5d80107ad625feb6d2b3ac807f517c5cfeae58986d3fbfe53ea82f2dee70396f5092abdc6ef137c5651e4515e081591079b37f0e428f69990db493cfe14e4f36"
+sha256 = "72a951cb0ad622785a8962801f005a3a412736c7e7e3ce152f176287c52fe062"
+patches = ["irssi-1.4.5-perl-again.patch"]
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+abuild-muon \
+ -Db_lto=true \
+ -Dwith-perl=yes \
+ -Dwith-perl-lib=vendor \
+ -Dwith-proxy=yes \
+ -Dwith-otr=yes \
+ -Denable-true-color=yes \
+ output .
+ ninja -C output
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+DESTDIR="/out" muon -C output install
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["glib", "libotr", "muon", "ncurses", "openssl", "perl", "utf8proc"]
diff --git a/recipes/incoming/lynx.toml b/recipes/incoming/lynx.toml
new file mode 100644
index 00000000..feabe08f
--- /dev/null
+++ b/recipes/incoming/lynx.toml
@@ -0,0 +1,55 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name = "lynx"
+version = "2.9.3"
+
+[source]
+tarball = "https://invisible-mirror.net/archives/lynx/tarballs/lynx${pkgver/_p/rel.}.tar.bz2"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "96fe5d8b427c0ceeaaa1778d88dae21f4fde79781243428f0c47e2ffb6f32c4ca918d608a60c55975fb101d5aae710d3aa3a8d6af3316599307bf810c0c87144"
+sha256 = "FIXME-sha256"
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+./configure \
+ --build=$CBUILD \
+ --host=$CHOST \
+ --prefix=/usr \
+ --sysconfdir=/etc \
+ --mandir=/usr/share/man \
+ --infodir=/usr/share/info \
+ --localstatedir=/var \
+ --enable-ipv6 \
+ --with-ssl \
+ --enable-default-colors \
+ --with-screen=ncursesw \
+ --with-zlib \
+ --disable-full-paths \
+ --enable-externs \
+ --enable-nls
+ make helpdir=/usr/share/doc/lynx/help \
+ docdir=/usr/share/doc/lynx
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install install-help install-doc \
+ helpdir=/usr/share/doc/lynx/help \
+ docdir=/usr/share/doc/lynx
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["openssl-dev>3", "gettext", "zlib", "glib", "perl", "ncurses"]
diff --git a/recipes/incoming/mc.toml b/recipes/incoming/mc.toml
new file mode 100644
index 00000000..60d9a63d
--- /dev/null
+++ b/recipes/incoming/mc.toml
@@ -0,0 +1,54 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name = "mc"
+version = "4.8.33"
+
+[source]
+tarball = "https://ftp.osuosl.org/pub/midnightcommander/mc-4.8.33.tar.xz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "3eb857af2fa689e9458aeef6d3b236fb92684e05c0e3e78e7e5a5fa5dba6431cae39bec51bc84598b0bb60579cb0a0679dcdc6e9f7d88ca85dc37ace251c8632"
+sha256 = "cae149d42f844e5185d8c81d7db3913a8fa214c65f852200a9d896b468af164c"
+patches = ["alpine_syntax.patch", "ticket_4642_parse_ls_vga_fix.patch"]
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+./configure \
+ --build=$CBUILD \
+ --host=$CHOST \
+ --prefix=/usr \
+ --libexecdir=/usr/lib \
+ --mandir=/usr/share/man \
+ --sysconfdir=/etc \
+ --enable-background \
+ --enable-charset \
+ --enable-largefile \
+ --enable-vfs-sftp \
+ --with-internal-edit \
+ --with-screen=slang \
+ --with-subshell \
+ --with-gpm-mouse \
+ --without-x
+ make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install
+ rm -fr "/out"/usr/share/man/??
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["e2fsprogs", "glib", "libssh2", "slang", "perl", "gpm"]
diff --git a/recipes/incoming/musl-fts-support.patch b/recipes/incoming/musl-fts-support.patch
new file mode 100644
index 00000000..ddfd3d8e
--- /dev/null
+++ b/recipes/incoming/musl-fts-support.patch
@@ -0,0 +1,13 @@
+diff --git a/Makefile b/Makefile
+index 7e2d7be..c3fd556 100644
+--- a/Makefile
++++ b/Makefile
+@@ -133,7 +133,7 @@ CFLAGS += -std=c11 -Wall -Wextra -Wshadow
+ CFLAGS += $(CFLAGS_OPTIMIZATION)
+ CFLAGS += $(CFLAGS_CURSES)
+
+-LDLIBS += $(LDLIBS_CURSES) -lpthread
++LDLIBS += $(LDLIBS_CURSES) -lpthread -lfts
+
+ # static compilation needs libgpm development package
+ ifeq ($(strip $(O_STATIC)),1)
diff --git a/recipes/incoming/mutt.toml b/recipes/incoming/mutt.toml
new file mode 100644
index 00000000..48d5dc46
--- /dev/null
+++ b/recipes/incoming/mutt.toml
@@ -0,0 +1,67 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name = "mutt"
+version = "2.4.0"
+
+[source]
+tarball = "http://ftp.mutt.org/pub/mutt/mutt-2.4.0.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "c0c849136be8eb8dcc4b45c5a602e17e3f4405cb1d9bb82f18ca01d7fd2e0bef176b67676528e340e430ae00632925d255b5a4cd195cb4addaa2341a71e2b23d"
+sha256 = "8f6ca2ef42f8f07cdc8ec391e8aa41a702490eae55ac72016b0b94ddf44ae292"
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+ISPELL=/usr/bin/hunspell \
+ ./configure \
+ --build=$CBUILD \
+ --host=$CHOST \
+ --prefix=/usr \
+ --sysconfdir=/etc \
+ --mandir=/usr/share/man \
+ --infodir=/usr/share/info \
+ --enable-imap \
+ --enable-pop \
+ --enable-smtp \
+ --enable-hcache \
+ --enable-gpgme \
+ --enable-sidebar \
+ --with-curses \
+ --with-mailpath=/var/mail \
+ --with-docdir=/usr/share/doc/mutt \
+ --without-included-gettext \
+ --with-ssl \
+ --with-gsasl \
+ --with-idn2
+ make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install
+
+ rm -f "/out"/etc/*.dist \
+ "/out"/etc/mime.types
+
+ # Don't tamper with the global configuration file.
+ # Many options set in the global config cannot be
+ # overwritten in the users configuration file.
+ # Example: Resetting colors isn't possible.
+ install -Dm644 contrib/gpg.rc \
+ "/out"/etc/Muttrc.gpg.dist
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["elinks", "docbook-xml", "docbook-xsl", "gdbm", "gettext", "gpgme", "libidn2", "libgsasl", "ncurses", "openssl-dev>3", "perl"]
diff --git a/recipes/incoming/nnn.toml b/recipes/incoming/nnn.toml
new file mode 100644
index 00000000..ca08899a
--- /dev/null
+++ b/recipes/incoming/nnn.toml
@@ -0,0 +1,46 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name = "nnn"
+version = "5.2"
+
+[source]
+tarball = "https://github.com/jarun/nnn/archive/v5.2/nnn-5.2.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "343744b3bcb73e9d11a96eefe89c6d073029653e91d340b04d655504bedbadd3761d74c62652d7afa40a41ade87c4d7df5b878e35ed773f4c2db4617c883e372"
+sha256 = "f166eda5093ac8dcf8cbbc6224123a32c53cf37b82c5c1cb48e2e23352754030"
+patches = ["musl-fts-support.patch"]
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make install DESTDIR="/out" PREFIX=/usr
+
+ install -D -m 644 misc/auto-completion/bash/nnn-completion.bash \
+ "/out"/usr/share/bash-completion/completions/nnn
+
+ install -D -m 644 misc/auto-completion/fish/nnn.fish \
+ "/out"/usr/share/fish/vendor_completions.d/nnn.fish
+
+ install -D -m 644 misc/auto-completion/zsh/_nnn \
+ "/out"/usr/share/zsh/site-functions/_nnn
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["musl-fts", "ncurses", "readline"]
diff --git a/recipes/incoming/pcf-family-names.patch b/recipes/incoming/pcf-family-names.patch
new file mode 100644
index 00000000..773f1a44
--- /dev/null
+++ b/recipes/incoming/pcf-family-names.patch
@@ -0,0 +1,13 @@
+diff --git a/include/freetype/config/ftoption.h b/include/freetype/config/ftoption.h
+index 9e03e17..1411db6 100644
+--- a/include/freetype/config/ftoption.h
++++ b/include/freetype/config/ftoption.h
+@@ -913,7 +913,7 @@ FT_BEGIN_HEADER
+ * If this option is activated, it can be controlled with the
+ * `no-long-family-names` property of the 'pcf' driver module.
+ */
+-/* #define PCF_CONFIG_OPTION_LONG_FAMILY_NAMES */
++#define PCF_CONFIG_OPTION_LONG_FAMILY_NAMES
+
+
+ /*************************************************************************/
diff --git a/recipes/incoming/pigz.toml b/recipes/incoming/pigz.toml
new file mode 100644
index 00000000..7416db73
--- /dev/null
+++ b/recipes/incoming/pigz.toml
@@ -0,0 +1,38 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name = "pigz"
+version = "2.8"
+
+[source]
+tarball = "https://zlib.net/pigz/pigz-2.8.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "ae3d9d593e1645d65f9ab77aa828600c9af4bb30d0a073da7ae3dd805e65b87efaf6a0efb980f2d0168e475ae506eba194547d6479956dabb9d88293a9078a7f"
+sha256 = "eb872b4f0e1f0ebe59c9f7bd8c506c4204893ba6a8492de31df416f0d5170fd0"
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+make LDFLAGS="$LDFLAGS" CFLAGS="$CFLAGS -O3 -flto=auto" pigz
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -Dm755 pigz -t "/out"/usr/bin
+ ln -s pigz "/out"/usr/bin/unpigz
+ install -Dm644 pigz.1 -t "/out"/usr/share/man/man1
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["zlib"]
diff --git a/recipes/incoming/rsync.toml b/recipes/incoming/rsync.toml
new file mode 100644
index 00000000..a6407cac
--- /dev/null
+++ b/recipes/incoming/rsync.toml
@@ -0,0 +1,62 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name = "rsync"
+version = "3.4.4"
+
+[source]
+tarball = "https://download.samba.org/pub/rsync/rsync-3.4.4.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "cf9a838b1f019b70fd67fa2c293f267be3f24e579c2ea33177ec7afc502c97ce0b613ff0854088c0eb28acd14ee0a75706ae8445115cef4669bd586c505d8453"
+sha256 = "bd88cf82fa653da32314fb229136407c5c90f80d1758d8f4b091767877d8fa96"
+patches = ["dont-use-nobody.patch"]
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+cp rrsync.1 support/rrsync.1
+ CFLAGS="$CFLAGS -flto=auto" \
+ ./configure \
+ --build=$CBUILD \
+ --host=$CHOST \
+ --prefix=/usr \
+ --sysconfdir=/etc \
+ --mandir=/usr/share/man \
+ --localstatedir=/var \
+ --enable-acl-support \
+ --enable-xattr-support \
+ --enable-xxhash \
+ --with-rrsync \
+ --without-included-popt \
+ --without-included-zlib \
+ --disable-md2man \
+ --disable-openssl
+ # openssl is disabled since xxh checksums are faster anyway
+ make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install
+
+ install -Dm755 "$srcdir"/rsyncd.initd "/out"/etc/init.d/rsyncd
+ install -Dm644 "$srcdir"/rsyncd.conf "/out"/etc/rsyncd.conf
+ install -Dm644 "$srcdir"/rsyncd.confd "/out"/etc/conf.d/rsyncd
+ install -Dm644 "$srcdir"/rsyncd.logrotate "/out"/etc/logrotate.d/rsyncd
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): python3
+
+[deps]
+build = ["acl", "attr", "linux-headers", "lz4", "perl", "popt", "xxhash", "zlib", "zstd"]
diff --git a/recipes/incoming/screen.toml b/recipes/incoming/screen.toml
new file mode 100644
index 00000000..e4bcbc6f
--- /dev/null
+++ b/recipes/incoming/screen.toml
@@ -0,0 +1,54 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name = "screen"
+version = "5.0.1"
+
+[source]
+tarball = "https://git.savannah.gnu.org/gitweb/?p=screen.git;a=snapshot;h=v.5.0.1;sf=tgz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "1e11374c74c9b4acb49e51baf9af6a151bda333f57392918ebd2167274454eb80b8ac8a17f6aa38d921f7f6d919e4b43f10a35da652a4a36b374ce8b97b8610a"
+sha256 = "FIXME-sha256"
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+CFLAGS="$CFLAGS -flto=auto" \
+ ./configure \
+ --build=$CBUILD \
+ --host=$CHOST \
+ --prefix=/usr \
+ --sysconfdir=/etc \
+ --with-system_screenrc=/etc/screenrc \
+ --mandir=/usr/share/man \
+ --infodir=/usr/share/info \
+ --localstatedir=/var \
+ --enable-telnet
+ make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make -j1 DESTDIR="/out" install
+
+ # remove suid root
+ find "/out" -type f -perm -u+s -print0 \
+ | xargs -0 chmod -c -s
+
+ install -Dm644 etc/etcscreenrc "/out"/etc/screenrc
+ install -Dm644 etc/screenrc "/out"/etc/skel/.screenrc
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["autoconf", "automake", "linux-pam", "ncurses"]
diff --git a/recipes/incoming/socat.toml b/recipes/incoming/socat.toml
new file mode 100644
index 00000000..e0388fc1
--- /dev/null
+++ b/recipes/incoming/socat.toml
@@ -0,0 +1,50 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name = "socat"
+version = "1.8.1.2"
+
+[source]
+tarball = "http://www.dest-unreach.org/socat/download/socat-1.8.1.2.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "2037ad9153ea2c39db075ee44c9199467f86458838dbd829866bf8298d48a2361231591c5b81fcb6d1030a6528e783d45bca948cdf6179a3cc1e5496ca9e420e"
+sha256 = "daeb9eed37a99424cd14877208706e93745c91cb86fb917a355635f4df5c8499"
+patches = ["use-linux-headers.patch"]
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+CFLAGS="$CFLAGS -Wno-int-conversion" \
+ ./configure \
+ --build=$CBUILD \
+ --host=$CHOST \
+ --prefix=/usr \
+ --sysconfdir=/etc \
+ --mandir=/usr/share/man \
+ --localstatedir=/var
+ make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install
+
+ install -Dm644 EXAMPLES doc/*.html doc/*.css \
+ -t "/out"/usr/share/doc/socat/
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): bash
+
+[deps]
+build = ["openssl", "readline", "linux-headers"]
diff --git a/recipes/incoming/subpixel.patch b/recipes/incoming/subpixel.patch
new file mode 100644
index 00000000..e5da0d74
--- /dev/null
+++ b/recipes/incoming/subpixel.patch
@@ -0,0 +1,12 @@
+diff -Naur a/include/freetype/config/ftoption.h b/include/freetype/config/ftoption.h
+--- a/include/freetype/config/ftoption.h 2019-02-23 09:09:06.000000000 +0000
++++ b/include/freetype/config/ftoption.h 2019-03-17 11:42:04.315011932 +0000
+@@ -126,7 +126,7 @@
+ * macro is not defined, FreeType offers alternative LCD rendering
+ * technology that produces excellent output without LCD filtering.
+ */
+-/* #define FT_CONFIG_OPTION_SUBPIXEL_RENDERING */
++#define FT_CONFIG_OPTION_SUBPIXEL_RENDERING
+
+
+ /**************************************************************************
diff --git a/recipes/incoming/table-validation-modules.patch b/recipes/incoming/table-validation-modules.patch
new file mode 100644
index 00000000..968475e3
--- /dev/null
+++ b/recipes/incoming/table-validation-modules.patch
@@ -0,0 +1,21 @@
+diff -Naur a/modules.cfg b/modules.cfg
+--- a/modules.cfg 2019-02-23 09:06:07.000000000 +0000
++++ b/modules.cfg 2019-03-15 17:13:56.465952994 +0000
+@@ -111,7 +111,7 @@
+
+ # TrueType GX/AAT table validation. Needs `ftgxval.c' below.
+ #
+-# AUX_MODULES += gxvalid
++AUX_MODULES += gxvalid
+
+ # Support for streams compressed with gzip (files with suffix .gz).
+ #
+@@ -130,7 +130,7 @@
+
+ # OpenType table validation. Needs `ftotval.c' below.
+ #
+-# AUX_MODULES += otvalid
++AUX_MODULES += otvalid
+
+ # Auxiliary PostScript driver component to share common code.
+ #
diff --git a/recipes/incoming/ticket_4642_parse_ls_vga_fix.patch b/recipes/incoming/ticket_4642_parse_ls_vga_fix.patch
new file mode 100644
index 00000000..d6930070
--- /dev/null
+++ b/recipes/incoming/ticket_4642_parse_ls_vga_fix.patch
@@ -0,0 +1,24 @@
+diff --git a/lib/vfs/parse_ls_vga.c b/lib/vfs/parse_ls_vga.c
+index dd91b881b..a1666e0ae 100644
+--- a/lib/vfs/parse_ls_vga.c
++++ b/lib/vfs/parse_ls_vga.c
+@@ -855,13 +855,12 @@ vfs_parse_ls_lga (const char *p, struct stat *s, char **filename, char **linknam
+
+ if (t != NULL)
+ {
+- size_t p2;
++ size_t p2 = strlen (t);
+
+- p2 = strlen (t);
+- if (--p2 > 0 && (t[p2] == '\r' || t[p2] == '\n'))
+- t[p2] = '\0';
+- if (--p2 > 0 && (t[p2] == '\r' || t[p2] == '\n'))
+- t[p2] = '\0';
++ if (p2 > 0 && (t[p2 - 1] == '\r' || t[p2 - 1] == '\n'))
++ t[--p2] = '\0';
++ if (p2 > 0 && (t[p2 - 1] == '\r' || t[p2 - 1] == '\n'))
++ t[--p2] = '\0';
+ }
+
+ g_free (p_copy);
+
diff --git a/recipes/incoming/tig.toml b/recipes/incoming/tig.toml
new file mode 100644
index 00000000..c412b783
--- /dev/null
+++ b/recipes/incoming/tig.toml
@@ -0,0 +1,47 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name = "tig"
+version = "2.6.1"
+
+[source]
+tarball = "https://github.com/jonas/tig/releases/download/tig-2.6.1/tig-2.6.1.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "685fe0a5b6db87c3bab7914e47b43ad1c677f84ca1e86a0f9c9e6a86b5b338a9195901d2e07d9031f7cd6da241a238b000447e5e864d816a228847db63534c3e"
+sha256 = "5adeabdcd93aa0423d618da8b878b53482bef6e0e9e1fe224acc0f18031fe91e"
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+CFLAGS="${CFLAGS//-Os/-O2} -flto=auto" \
+ CXXFLAGS="${CXXFLAGS//-Os/-O2} -flto=auto" \
+ ./configure \
+ --build=$CBUILD \
+ --host=$CHOST \
+ --prefix=/usr \
+ --sysconfdir=/etc \
+ --mandir=/usr/share/man \
+ --localstatedir=/var
+ make all
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install install-doc-man
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): git
+
+[deps]
+build = ["ncurses", "pcre2"]
diff --git a/recipes/incoming/use-linux-headers.patch b/recipes/incoming/use-linux-headers.patch
new file mode 100644
index 00000000..b17eae6f
--- /dev/null
+++ b/recipes/incoming/use-linux-headers.patch
@@ -0,0 +1,11 @@
+--- a/sysincludes.h
++++ b/sysincludes.h
+@@ -145,7 +145,7 @@
+ #include <linux/if_packet.h>
+ #endif
+ #if HAVE_NETINET_IF_ETHER_H
+-#include <netinet/if_ether.h>
++#include <linux/if_ether.h>
+ #endif
+ #if HAVE_LINUX_IF_TUN_H
+ #include <linux/if_tun.h>
diff --git a/recipes/incoming/wget.toml b/recipes/incoming/wget.toml
new file mode 100644
index 00000000..460bf5d5
--- /dev/null
+++ b/recipes/incoming/wget.toml
@@ -0,0 +1,47 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name = "wget"
+version = "1.25.0"
+
+[source]
+tarball = "https://ftp.gnu.org/gnu/wget/wget-1.25.0.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "a7ce33c07a1a206a8574b6e9ea7cc5292315df0914edbcf05a014d35ae9e3d24699a46818b409b884ada57428cf30502f4bbb3767cae2c6934e4e7fb2d0c5036"
+sha256 = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784"
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+CFLAGS="$CFLAGS -flto=auto" \
+ ./configure \
+ --build=$CBUILD \
+ --host=$CHOST \
+ --prefix=/usr \
+ --sysconfdir=/etc \
+ --mandir=/usr/share/man \
+ --infodir=/usr/share/info \
+ --with-libidn \
+ --with-ssl=openssl \
+ --disable-nls
+ make
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+make DESTDIR="/out" install
+}
+_abuild_phase
+'''
+
+[deps]
+build = ["libidn2", "openssl", "pcre2", "perl", "zlib"]
diff --git a/recipes/tmux.toml b/recipes/tmux.toml
new file mode 100644
index 00000000..5dd78e11
--- /dev/null
+++ b/recipes/tmux.toml
@@ -0,0 +1,18 @@
+# tmux 3.6b — multiplexor de terminal (C). PRIMER consumidor de la cola C que valida las libs base:
+# linkea libevent + ncurses (ambas hammer-built). De-Alpinizada: compiler=gcc, configure-split, estático.
+name = "tmux"
+version = "3.6b"
+[source]
+tarball = "https://github.com/tmux/tmux/releases/download/3.6b/tmux-3.6b.tar.gz"
+sha256 = "390759d25fdba016887ec982b808927e637070fd7d03a8021f8ef3102b9ae3c7"
+[build]
+compiler = "gcc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+[build.phases]
+configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --sysconfdir=/etc'
+compile = 'make'
+install = 'make DESTDIR=/out install'
+[deps]
+build = ["libevent", "ncurses", "bison"]
diff --git a/tandas/c-cola-1.txt b/tandas/c-cola-1.txt
new file mode 100644
index 00000000..f0a7229c
--- /dev/null
+++ b/tandas/c-cola-1.txt
@@ -0,0 +1,16 @@
+# c-cola-1 — clásicos C que las libs base ya habilitan (2026-06-25)
+tmux
+tig
+wget
+rsync
+socat
+nnn
+pigz
+lynx
+mc
+mutt
+irssi
+gnupg
+screen
+the_silver_searcher=the-silver-searcher
+git