XLibre Phase 1a Dependency Manifest

Authoritative version/dependency manifest for the Phase-1a XLibre X11 desktop
port set (XLibre Xvfb server + Openbox) on Hammerhead, built via Coral from
the zports tree. This is Task 0 output — every later per-port task consumes
this file as its source of truth.

Generated 2026-07-22. Sources mined (priority order): X11Libre's own
packaging (X11Libre/ports-gentoo, X11Libre/pkgbuilds-arch-based),
XLibre xserver repo meson_options.txt/meson.build, and
freedesktop.org / GNU / GitHub upstream release pages for the client
libs and render/font stack.

Checksum policy: sha256 recorded where an upstream/publisher hash was
found; otherwise compute-on-fetch — the per-port task must sha256sum
the actual downloaded distfile and fill it in. No hash in this table was
fabricated.

XLibre Xvfb-only meson configuration (Task 7 blocker — READ THIS)

Confirmed by reading X11Libre/xserver meson_options.txt directly
(fetched from https://raw.githubusercontent.com/X11Libre/xserver/master/meson_options.txt)
and cross-checked against the Gentoo ebuild's src_configure() in
X11Libre/ports-gentoo (x11-base/xlibre-server/xlibre-server-25.1.8.ebuild,
which maps Gentoo USE flags to these exact meson option names 1:1 via
meson_use).

Relevant option definitions (verbatim names/types/defaults from
meson_options.txt):

• xvfb — boolean, default true — "Enable Xvfb X server"
• xorg — combo(true/false/auto), default auto — "Enable Xorg X Server"
• xephyr — boolean, default false
• xnest — combo, default auto
• xfbdev — boolean, default false
• xwin — combo, default auto
• xquartz — combo, default auto
• glamor — combo, default auto
• glx — boolean, default true
• glx_dri — combo, default auto
• dri1 / dri2 / dri3 — combo, default auto each
• gbm — combo, default auto
• drm — boolean, default true
• udev / udev_kms — combo, default auto
• hal — combo, default false
• systemd_logind / systemd_notify — combo, default false
• seatd_libseat — combo, default auto
• suid_wrapper — boolean, default false
• xcsecurity — boolean, default false
• xselinux — combo, default auto
• pciaccess — boolean, default true
• agp — combo, default auto
• int10 — combo(stub/x86emu/vm86/auto/false), default auto
• vgahw — combo, default auto
• xf86bigfont — boolean, default false
• tests — boolean, default true
• xf86-input-inputtest / xf86-input-null — boolean, default true each
• docs / devel-docs / docs-pdf — combo, default auto
• dtrace — boolean, default false
• linux_acpi / linux_apm — boolean, default true each (Linux-only code paths anyway)
• sha1 — combo, choices libc|CommonCrypto|CryptoAPI|libmd|libsha1|libnettle|libgcrypt|libcrypto|auto, default auto
• xkb_output_dir — string

Recommended Xvfb-only meson invocation for Hammerhead

meson setup build \
  -Dxvfb=true \
  -Dxorg=false \
  -Dxephyr=false \
  -Dxnest=false \
  -Dxfbdev=false \
  -Dxwin=false \
  -Dxquartz=false \
  -Dglamor=false \
  -Dglx=false \
  -Dglx_dri=false \
  -Ddri1=false \
  -Ddri2=false \
  -Ddri3=false \
  -Dgbm=false \
  -Ddrm=false \
  -Dudev=false \
  -Dudev_kms=false \
  -Dhal=false \
  -Dsystemd_logind=false \
  -Dsystemd_notify=false \
  -Dseatd_libseat=false \
  -Dsuid_wrapper=false \
  -Dxcsecurity=false \
  -Dxselinux=false \
  -Dpciaccess=false \
  -Dagp=false \
  -Dint10=false \
  -Dvgahw=false \
  -Dxf86bigfont=false \
  -Dtests=false \
  -Ddocs=false \
  -Ddevel-docs=false \
  -Ddocs-pdf=false \
  -Dxf86-input-inputtest=false \
  -Dxf86-input-null=false \
  -Ddtrace=false \
  -Dlinux_acpi=false \
  -Dlinux_apm=false \
  -Dsha1=libcrypto \
  -Dxkb_output_dir=/var/lib/xkb

Notes:

• -Dsha1=libcrypto matches the Gentoo ebuild's choice and Hammerhead
  already ships OpenSSL 3.5 in base — reuse it rather than pulling in
  libgcrypt/libnettle/libmd as a new dep.
• linux_acpi/linux_apm gate Linux-specific code paths; harmless to
  leave false on illumos regardless of the option's stated default.
• ipv6 and input_thread left at their auto defaults; no Xvfb-specific
  reason to force them.
• The ebuild's REQUIRED_USE shows glx-dri? ( glx ) — since we disable
  both here that constraint is moot.
• Gentoo's CDEPEND still lists libdrm, libpciaccess, libglvnd etc.
  unconditionally because Gentoo's meson.build has hard dependency()
  calls gated by those same options — Task 7 must verify at meson-configure
  time on Hammerhead whether the build still probes for libdrm/mesa
  even with -Ddrm=false (illumos has no libdrm/mesa in this port set).
  If meson.build hard-requires them regardless of the option, that is a
  patch Task 7 will need, not a manifest problem.

Port table

PRESENT — do not re-port (per brief)

Ports whose version/deps could NOT be fully pinned from primary sources

• libpthread-stubs — version 0.5 confirmed present on xorg.freedesktop.org, but whether illumos/Hammerhead (which has a native, non-stub pthread implementation) needs this at all is unresolved from packaging alone; flag for the per-port task to check whether libxcb's meson build even requests it on a non-Linux, non-BSD host.
• libjpeg-turbo — included because cairo/gdk-pixbuf-style stacks commonly want it, but nothing in the strict Xvfb+Openbox+st dependency chain in this table hard-requires it (cairo's PNG backend uses libpng directly, not libjpeg). Kept in the table per the brief's explicit port list; the per-port task should confirm it's actually linked by something before spending build effort on it.
• xorgproto exact API-numbered subset — recorded only the tarball version (2025.1); did not enumerate which of the ~20 sub-protocol headers (bigreqsproto, xproto, randrproto, etc.) are consumed by which client lib — that level of granularity is a Task 2/3 build-time concern, not a manifest concern.
• dejavu-fonts build system — the upstream distribution is a pre-built TTF zip (no compile), which doesn't map cleanly onto the build_system column enum (autotools|meson|cmake|make|python); recorded as make (fontforge-based build; or use pre-built ttf archive directly, no compile needed) — flag for whoever writes the Coral package.toml since it may just be a copy-files package with no real build step.

Notable surprises

1. XLibre's ebuild dependency chain is more informative than freedesktop.org alone — the Gentoo ebuild's CDEPEND/DEPEND block is the only place that states the exact minimum-version constraints XLibre's own server actually enforces (e.g. >=x11-libs/libxkbfile-1.0.4, >=x11-base/xorg-proto-2024.1, >=x11-apps/xauth-1.0.3) — freedesktop.org release pages don't carry that information at all.
2. meson_use 1:1-maps Gentoo USE flags to meson option names — this made verifying the exact Xvfb-only flag set far more reliable than guessing from meson_options.txt alone: the ebuild's src_configure() is effectively a working, tested reference invocation, just with xorg/xephyr/etc. flipped the other way for Xvfb-only.
3. GNOME's cache.json release-index endpoints are not reliable for "latest stable" — pango's cache.json listed a 1.90.0 version with no matching git tag anywhere in GNOME's GitLab; always cross-check via the GitLab tags API (gitlab.gnome.org/api/v4/projects/GNOME%2F<pkg>/repository/tags) before trusting a cache.json max.
4. harfbuzz's own git tag list is polluted with non-release marker tags (pango-start, hb-rename, etc. — likely leftover from a historical monorepo merge) — the GitHub Releases API tag_name field is the trustworthy source, not a raw git tag scrape.
5. libxcvt is NOT required for an Xvfb-only build — it's gated behind XLibre's xorg USE flag (real Xorg mode-line generation) and never touched when xvfb-only is enabled. Listed in the brief's client-libs set, but Task 2/3 can deprioritize it unless/until Phase 1b adds real Xorg/DDX support.
6. xkeyboard-config and dejavu-fonts are NOT under the same freedesktop.org path prefix as the other xorg libs/apps — xkeyboard-config lives at .../releases/individual/data/xkeyboard-config/, and dejavu-fonts is SourceForge-hosted, not freedesktop.org at all. Both 404'd on first-guess URLs before the correct path was found by search, consistent with the brief's warning not to guess.

Added mid-implementation (not in the original mining)