# XLibre Phase 1a Dependency Manifest

Authoritative version/dependency manifest for the Phase-1a XLibre X11 desktop
port set (XLibre Xvfb server + Openbox) on Hammerhead, built via Coral from
the zports tree. This is Task 0 output — every later per-port task consumes
this file as its source of truth.

Generated 2026-07-22. Sources mined (priority order): X11Libre's own
packaging (`X11Libre/ports-gentoo`, `X11Libre/pkgbuilds-arch-based`),
XLibre `xserver` repo `meson_options.txt`/`meson.build`, and
freedesktop.org / GNU / GitHub upstream release pages for the client
libs and render/font stack.

**Checksum policy**: sha256 recorded where an upstream/publisher hash was
found; otherwise `compute-on-fetch` — the per-port task must `sha256sum`
the actual downloaded distfile and fill it in. No hash in this table was
fabricated.

## XLibre Xvfb-only meson configuration (Task 7 blocker — READ THIS)

Confirmed by reading `X11Libre/xserver` `meson_options.txt` directly
(fetched from `https://raw.githubusercontent.com/X11Libre/xserver/master/meson_options.txt`)
and cross-checked against the Gentoo ebuild's `src_configure()` in
`X11Libre/ports-gentoo` (`x11-base/xlibre-server/xlibre-server-25.1.8.ebuild`,
which maps Gentoo USE flags to these exact meson option names 1:1 via
`meson_use`).

Relevant option definitions (verbatim names/types/defaults from
`meson_options.txt`):

- `xvfb` — boolean, **default `true`** — "Enable Xvfb X server"
- `xorg` — combo(true/false/auto), default `auto` — "Enable Xorg X Server"
- `xephyr` — boolean, default `false`
- `xnest` — combo, default `auto`
- `xfbdev` — boolean, default `false`
- `xwin` — combo, default `auto`
- `xquartz` — combo, default `auto`
- `glamor` — combo, default `auto`
- `glx` — boolean, default `true`
- `glx_dri` — combo, default `auto`
- `dri1` / `dri2` / `dri3` — combo, default `auto` each
- `gbm` — combo, default `auto`
- `drm` — boolean, default `true`
- `udev` / `udev_kms` — combo, default `auto`
- `hal` — combo, default `false`
- `systemd_logind` / `systemd_notify` — combo, default `false`
- `seatd_libseat` — combo, default `auto`
- `suid_wrapper` — boolean, default `false`
- `xcsecurity` — boolean, default `false`
- `xselinux` — combo, default `auto`
- `pciaccess` — boolean, default `true`
- `agp` — combo, default `auto`
- `int10` — combo(stub/x86emu/vm86/auto/false), default `auto`
- `vgahw` — combo, default `auto`
- `xf86bigfont` — boolean, default `false`
- `tests` — boolean, default `true`
- `xf86-input-inputtest` / `xf86-input-null` — boolean, default `true` each
- `docs` / `devel-docs` / `docs-pdf` — combo, default `auto`
- `dtrace` — boolean, default `false`
- `linux_acpi` / `linux_apm` — boolean, default `true` each (Linux-only code paths anyway)
- `sha1` — combo, choices `libc|CommonCrypto|CryptoAPI|libmd|libsha1|libnettle|libgcrypt|libcrypto|auto`, default `auto`
- `xkb_output_dir` — string

### Recommended Xvfb-only meson invocation for Hammerhead

```
meson setup build \
  -Dxvfb=true \
  -Dxorg=false \
  -Dxephyr=false \
  -Dxnest=false \
  -Dxfbdev=false \
  -Dxwin=false \
  -Dxquartz=false \
  -Dglamor=false \
  -Dglx=false \
  -Dglx_dri=false \
  -Ddri1=false \
  -Ddri2=false \
  -Ddri3=false \
  -Dgbm=false \
  -Ddrm=false \
  -Dudev=false \
  -Dudev_kms=false \
  -Dhal=false \
  -Dsystemd_logind=false \
  -Dsystemd_notify=false \
  -Dseatd_libseat=false \
  -Dsuid_wrapper=false \
  -Dxcsecurity=false \
  -Dxselinux=false \
  -Dpciaccess=false \
  -Dagp=false \
  -Dint10=false \
  -Dvgahw=false \
  -Dxf86bigfont=false \
  -Dtests=false \
  -Ddocs=false \
  -Ddevel-docs=false \
  -Ddocs-pdf=false \
  -Dxf86-input-inputtest=false \
  -Dxf86-input-null=false \
  -Ddtrace=false \
  -Dlinux_acpi=false \
  -Dlinux_apm=false \
  -Dsha1=libcrypto \
  -Dxkb_output_dir=/var/lib/xkb
```

Notes:
- `-Dsha1=libcrypto` matches the Gentoo ebuild's choice and Hammerhead
  already ships OpenSSL 3.5 in base — reuse it rather than pulling in
  libgcrypt/libnettle/libmd as a new dep.
- `linux_acpi`/`linux_apm` gate Linux-specific code paths; harmless to
  leave `false` on illumos regardless of the option's stated default.
- `ipv6` and `input_thread` left at their `auto` defaults; no Xvfb-specific
  reason to force them.
- The ebuild's `REQUIRED_USE` shows `glx-dri? ( glx )` — since we disable
  both here that constraint is moot.
- Gentoo's CDEPEND still lists `libdrm`, `libpciaccess`, `libglvnd` etc.
  unconditionally because Gentoo's meson.build has hard `dependency()`
  calls gated by those same options — Task 7 must verify at meson-configure
  time on Hammerhead whether the build **still probes for** libdrm/mesa
  even with `-Ddrm=false` (illumos has no libdrm/mesa in this port set).
  If meson.build hard-requires them regardless of the option, that is a
  patch Task 7 will need, not a manifest problem.

## Port table

| category | name | version | source_url | sha256 | build_system | runtime_deps | build_deps | special_flags/notes |
|---|---|---|---|---|---|---|---|---|
| devel | meson | 1.11.2 | https://github.com/mesonbuild/meson/releases/download/1.11.2/meson-1.11.2.tar.gz | compute-on-fetch | python | python3 | ninja | Python package; verify ninja already in zports/base. |
| devel | nasm | 2.16.03 | https://www.nasm.us/pub/nasm/releasebuilds/2.16.03/nasm-2.16.03.tar.xz | compute-on-fetch | autotools | — | — | Only needed if any dep (libjpeg-turbo SIMD) wants it; libjpeg-turbo build can also use `-DWITH_SIMD=0` to avoid nasm entirely if bootstrap is easier. |
| devel | gettext | 0.26 | https://ftp.gnu.org/gnu/gettext/gettext-0.26.tar.gz | compute-on-fetch | autotools | — | — | Extra build tool per brief's ask; needed by fontconfig/glib/pango i18n build steps if not already in zports. |
| devel | gperf | 3.3 | https://ftp.gnu.org/gnu/gperf/gperf-3.3.tar.gz | compute-on-fetch | autotools | — | — | Extra build tool per brief's ask; used by some xkbcomp/libX11 codegen paths. Verify actual need at Task 2/3 (may already be satisfied by base gcc toolchain's bundled gperf, if any). |
| protocol/glue | util-macros | 1.20.2 | https://xorg.freedesktop.org/releases/individual/util/util-macros-1.20.2.tar.xz | compute-on-fetch | autotools | — | — | Autoconf macros only, no library; required by nearly every other autotools xorg port. |
| protocol/glue | xorgproto | 2025.1 | https://xorg.freedesktop.org/releases/individual/proto/xorgproto-2025.1.tar.xz | compute-on-fetch | meson (also has autotools) | — | util-macros | Header-only. XLibre ebuild pins `>=x11-base/xorg-proto-2024.1`; 2025.1 satisfies that. |
| protocol/glue | xtrans | 1.6.0 | https://xorg.freedesktop.org/releases/individual/lib/xtrans-1.6.0.tar.xz | compute-on-fetch | autotools | — | util-macros | Header-only transport library. |
| protocol/glue | xcb-proto | 1.17.0 | https://xorg.freedesktop.org/releases/individual/xcb/xcb-proto-1.17.0.tar.xz | compute-on-fetch | autotools/meson | python3 (xcbgen) | — | Needs Python3 at build time for the XML->C codegen. |
| client libs | libpthread-stubs | 0.5 | https://xorg.freedesktop.org/releases/individual/lib/libpthread-stubs-0.5.tar.xz | compute-on-fetch | meson | — | — | Trivial stub lib for platforms without native pthread symbols; verify if actually needed on illumos (native libpthread present) — may be a no-op/skip candidate. |
| client libs | libXau | 1.0.12 | https://xorg.freedesktop.org/releases/individual/lib/libXau-1.0.12.tar.xz | compute-on-fetch | autotools/meson | — | xorgproto, util-macros | |
| client libs | libXdmcp | 1.1.5 | https://xorg.freedesktop.org/releases/individual/lib/libXdmcp-1.1.5.tar.xz | compute-on-fetch | autotools/meson | — | xorgproto, util-macros | |
| client libs | libxcb | 1.17.0 | https://xorg.freedesktop.org/releases/individual/xcb/libxcb-1.17.0.tar.xz | compute-on-fetch | autotools | libXau, libXdmcp | xcb-proto, python3 | |
| client libs | libX11 | 1.8.13 | https://xorg.freedesktop.org/releases/individual/lib/libX11-1.8.13.tar.xz | compute-on-fetch | autotools/meson | libxcb, libXau, libXdmcp | xtrans, xorgproto, xcb-proto, util-macros | |
| client libs | libXext | 1.3.7 | https://xorg.freedesktop.org/releases/individual/lib/libXext-1.3.7.tar.xz | compute-on-fetch | autotools/meson | libX11 | xorgproto, xtrans, util-macros | |
| client libs | libXrender | 0.9.12 | https://xorg.freedesktop.org/releases/individual/lib/libXrender-0.9.12.tar.xz | compute-on-fetch | autotools/meson | libX11 | xorgproto, util-macros | |
| client libs | libXfixes | 6.0.2 | https://xorg.freedesktop.org/releases/individual/lib/libXfixes-6.0.2.tar.xz | compute-on-fetch | autotools/meson | libX11 | xorgproto, util-macros | |
| client libs | libXdamage | 1.1.7 | https://xorg.freedesktop.org/releases/individual/lib/libXdamage-1.1.7.tar.xz | compute-on-fetch | autotools/meson | libX11, libXfixes | xorgproto, util-macros | |
| client libs | libXrandr | 1.5.5 | https://xorg.freedesktop.org/releases/individual/lib/libXrandr-1.5.5.tar.xz | compute-on-fetch | autotools/meson | libX11, libXext, libXrender | xorgproto, util-macros | Not needed by Xvfb itself (no real RandR outputs) but Openbox/toolkits probe it; keep for desktop layer. |
| client libs | libXi | 1.8.3 | https://xorg.freedesktop.org/releases/individual/lib/libXi-1.8.3.tar.xz | compute-on-fetch | autotools/meson | libX11, libXext, libXfixes | xorgproto, util-macros | |
| client libs | libXtst | 1.2.5 | https://xorg.freedesktop.org/releases/individual/lib/libXtst-1.2.5.tar.xz | compute-on-fetch | autotools/meson | libX11, libXext, libXi | xorgproto, util-macros | x11vnc uses XTest to inject input. |
| client libs | libXcursor | 1.2.3 | https://xorg.freedesktop.org/releases/individual/lib/libXcursor-1.2.3.tar.xz | compute-on-fetch | autotools/meson | libX11, libXrender, libXfixes | xorgproto, util-macros | Openbox dep. |
| client libs | libXinerama | 1.1.6 | https://xorg.freedesktop.org/releases/individual/lib/libXinerama-1.1.6.tar.xz | compute-on-fetch | autotools/meson | libX11, libXext | xorgproto, util-macros | |
| client libs | libXcomposite | 0.4.7 | https://xorg.freedesktop.org/releases/individual/lib/libXcomposite-0.4.7.tar.xz | compute-on-fetch | autotools/meson | libX11, libXfixes | xorgproto, util-macros | |
| client libs | libICE | 1.1.2 | https://xorg.freedesktop.org/releases/individual/lib/libICE-1.1.2.tar.xz | compute-on-fetch | autotools/meson | — | xorgproto, util-macros | |
| client libs | libSM | 1.2.6 | https://xorg.freedesktop.org/releases/individual/lib/libSM-1.2.6.tar.xz | compute-on-fetch | autotools/meson | libICE | xorgproto, util-macros | |
| client libs | libXt | 1.3.1 | https://xorg.freedesktop.org/releases/individual/lib/libXt-1.3.1.tar.xz | compute-on-fetch | autotools/meson | libX11, libSM, libICE | xorgproto, util-macros | |
| client libs | libXmu | 1.3.1 | https://xorg.freedesktop.org/releases/individual/lib/libXmu-1.3.1.tar.xz | compute-on-fetch | autotools/meson | libXt, libX11, libXext | xorgproto, util-macros | Needed by st (suckless terminal) and some Openbox tools. |
| client libs | libXpm | 3.5.19 | https://xorg.freedesktop.org/releases/individual/lib/libXpm-3.5.19.tar.xz | compute-on-fetch | autotools/meson | libX11, libXt, libXext | xorgproto, util-macros | Openbox theme/icon support. |
| client libs | pixman | 0.46.4 | https://www.cairographics.org/releases/pixman-0.46.4.tar.gz | compute-on-fetch | meson | — | — | Also mirrored at xorg.freedesktop.org/archive/individual/lib; cairo and the Xvfb software rasterizer both need it. |
| client libs | libxkbfile | 1.2.0 | https://xorg.freedesktop.org/releases/individual/lib/libxkbfile-1.2.0.tar.xz | compute-on-fetch | autotools/meson | libX11 | xorgproto, util-macros | Direct xlibre-server CDEPEND (`>=x11-libs/libxkbfile-1.0.4`). |
| client libs | libxcvt | 0.1.3 | https://xorg.freedesktop.org/releases/individual/lib/libxcvt-0.1.3.tar.xz | compute-on-fetch | meson | — | — | Only pulled in by xlibre-server ebuild when `xorg` USE is enabled (CVT mode-line gen for real Xorg). **Not required for Xvfb-only build** — include only if Task 7 later adds Xorg/DDX support. |
| render/font | libpng | 1.6.58 | https://downloads.sourceforge.net/project/libpng/libpng16/1.6.58/libpng-1.6.58.tar.xz | compute-on-fetch | autotools/cmake | zlib | — | zlib is PRESENT (base) — do not port. |
| render/font | libjpeg-turbo | 3.2.0 | https://github.com/libjpeg-turbo/libjpeg-turbo/archive/refs/tags/3.2.0.tar.gz | compute-on-fetch | cmake | — | nasm (SIMD, optional) | Cairo image-surface/PNG loaders and some toolkits want it; verify actually needed for Xvfb+Openbox minimal set before porting (may be pulled in only transitively via cairo/gdk-pixbuf, which are out of scope here). |
| render/font | brotli | 1.2.0 | https://github.com/google/brotli/archive/refs/tags/v1.2.0.tar.gz | compute-on-fetch | cmake | — | — | freetype2/HarfBuzz woff2 support dependency (brotli-dec/brotli-enc). |
| render/font | freetype | 2.14.3 | https://download.savannah.gnu.org/releases/freetype/freetype-2.14.3.tar.xz | compute-on-fetch | autotools/meson | libpng, brotli | — | Also needs harfbuzz for full autohint-improve mode, but freetype/harfbuzz have a circular dep — build freetype WITHOUT harfbuzz first, then harfbuzz, then optionally rebuild freetype WITH harfbuzz (standard bootstrap sequence upstream documents). |
| render/font | fontconfig | 2.16.0 | https://www.freedesktop.org/software/fontconfig/release/fontconfig-2.16.0.tar.xz | 6a33dc555cc9ba8b10caf7695878ef134eeb36d0af366041f639b1da9b6ed220 | meson/autotools | freetype, libxml2, gperf(build) | pkgconf, gperf | libxml2: PRESENT (base) — **verify on alpha9; port only if absent** per brief. |
| render/font | libfontenc | 1.1.9 | https://xorg.freedesktop.org/releases/individual/lib/libfontenc-1.1.9.tar.xz | compute-on-fetch | autotools/meson | zlib | xorgproto, util-macros | zlib PRESENT (base). |
| render/font | libXfont2 | 2.0.8 | https://xorg.freedesktop.org/releases/individual/lib/libXfont2-2.0.8.tar.xz | compute-on-fetch | autotools/meson | freetype, libfontenc, xtrans, fontconfig | xorgproto, util-macros | Direct xlibre-server CDEPEND (`>=x11-libs/libXfont2-2.0.1`). |
| render/font | libXft | 2.3.9 | https://xorg.freedesktop.org/releases/individual/lib/libXft-2.3.9.tar.xz | compute-on-fetch | autotools/meson | libX11, libXrender, freetype, fontconfig | xorgproto, util-macros | Openbox/toolkit font rendering. |
| render/font | font-util | 1.4.2 | https://xorg.freedesktop.org/releases/individual/font/font-util-1.4.2.tar.xz | compute-on-fetch | autotools/meson | — | util-macros | Direct xlibre-server DEPEND (`media-fonts/font-util`). |
| render/font | dejavu-fonts | 2.37 | https://downloads.sourceforge.net/project/dejavu/dejavu/2.37/dejavu-fonts-ttf-2.37.zip | compute-on-fetch | make (fontforge-based build; or use pre-built ttf archive directly, no compile needed) | fontconfig (runtime) | — | Brief offers dejavu-fonts OR liberation-fonts; recommend dejavu — no compile step needed if using the pre-built `-ttf-` distribution (just install + fc-cache), simplest for a first desktop bring-up. |
| render/font | pcre2 | 10.47 | https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.47/pcre2-10.47.tar.bz2 | compute-on-fetch | autotools/cmake | — | — | glib2 build dependency. |
| render/font | glib2 | 2.89.2 | https://download.gnome.org/sources/glib/2.89/glib-2.89.2.tar.xz | 894fd527e305041f7723071297d79a78af4719dbd0d8fb77f6b1a85c9f5475b9 | meson | pcre2, libffi | python3 (meson), gettext | 2.89.x is GNOME's current stable-numbering release per `gitlab.gnome.org` tags (post-even/odd-minor convention change); libffi is PRESENT (base) — do not re-port. Verify glib2 not already in zports (Python/Mercurial zports work may have pulled it transitively). |
| render/font | fribidi | 1.0.16 | https://github.com/fribidi/fribidi/releases/download/v1.0.16/fribidi-1.0.16.tar.xz | compute-on-fetch | meson | — | — | pango dependency (bidi text). |
| render/font | harfbuzz | 14.2.1 | https://github.com/harfbuzz/harfbuzz/releases/download/14.2.1/harfbuzz-14.2.1.tar.xz | compute-on-fetch | meson | freetype, glib2 | gettext | Circular with freetype — see freetype note above for build order. Version confirmed via GitHub Releases API `tag_name`; note the harfbuzz repo's own git tag list is polluted with unrelated `pango-*`/`hb-*` marker tags so trust the Releases API, not `git tag -l`. |
| render/font | cairo | 1.18.4 | https://www.cairographics.org/releases/cairo-1.18.4.tar.xz | compute-on-fetch | meson/autotools | pixman, libpng, freetype, fontconfig, libX11, libXext, libXrender | — | |
| render/font | pango | 1.58.0 | https://download.gnome.org/sources/pango/1.58/pango-1.58.0.tar.xz | bc5bad6213ad4886a47d1e80292fd850b64159b50db67917a43d9ea80ee2298a | meson | glib2, cairo, harfbuzz, fribidi, fontconfig, freetype | gettext | glib.gnome.org `cache.json` briefly listed a `1.90.0` entry that does NOT correspond to any real git tag (checked GNOME GitLab tag list directly — highest real tag is 1.58.0); treat the cache.json max-version heuristic as unreliable for pango and always cross-check against GitLab tags. |
| server+runtime | xlibre-xserver | 25.1.8 | https://github.com/X11Libre/xserver/archive/refs/tags/25.1.8.tar.gz | compute-on-fetch | meson | libxcb, libX11, libXau, libXdmcp, libXfont2, libxkbfile, pixman, xkeyboard-config, openssl(sha1=libcrypto) | xorgproto (>=2024.1), font-util, xtrans, flex/lex (BDEPEND `app-alternatives/lex`) | **Xvfb-only build**: see meson flags section above. openssl, ncurses PRESENT (base). Gentoo ebuild pins `SLOT=0/${PV}`, latest stable tag `25.1.8` (also `25.1.7`, and legacy `25.0.0.23`/`.24`); `9999` is the live/git ebuild — do not use. |
| server+runtime | xkbcomp | 1.5.0 | https://xorg.freedesktop.org/releases/individual/app/xkbcomp-1.5.0.tar.xz | compute-on-fetch | autotools/meson | libX11, libxkbfile | xorgproto, util-macros | Direct xlibre-server CDEPEND (`x11-apps/xkbcomp`, unconditional). |
| server+runtime | xkeyboard-config | 2.48 | https://xorg.freedesktop.org/releases/individual/data/xkeyboard-config/xkeyboard-config-2.48.tar.xz | compute-on-fetch | meson/autotools | — | util-macros, gettext, python3 (some intltool-style steps) | Direct xlibre-server CDEPEND (`>=x11-misc/xkeyboard-config-2.4.1-r3`). Not under xorg.freedesktop.org/releases/individual/{lib,app}; lives under `/data/xkeyboard-config/`. |
| server+runtime | xauth | 1.1.5 | https://xorg.freedesktop.org/releases/individual/app/xauth-1.1.5.tar.xz | compute-on-fetch | autotools/meson | libX11, libXau, libXext, libXmu | xorgproto, util-macros | Direct xlibre-server CDEPEND (`>=x11-apps/xauth-1.0.3`). |
| server+runtime | xinit | 1.4.4 | https://xorg.freedesktop.org/releases/individual/app/xinit-1.4.4.tar.xz | compute-on-fetch | autotools/meson | libX11 | xorgproto, util-macros | Only an xlibre-server RDEPEND when USE=xorg; for Xvfb-only we still want it as the standard "start X + run client" launcher wrapper for Task 7/8 smoke tests. |
| server+runtime | x11vnc | 0.9.17 | https://github.com/LibVNC/x11vnc/releases/download/0.9.17/x11vnc-0.9.17.tar.gz | compute-on-fetch | autotools | libX11, libXext, libXtst, libXrandr, libXdamage, libXfixes, libXinerama, zlib, libjpeg-turbo | pkgconf | zlib PRESENT (base). This is the actual remote-display path for an Xvfb-based headless desktop (brief's "Xvfb->VNC first" plan per graphics-baseline memory). |
| desktop | openbox | 3.6.1 | http://openbox.org/dist/openbox/openbox-3.6.1.tar.gz | compute-on-fetch | autotools | libX11, libXext, libSM, libICE, libXrandr, libXcursor, libXinerama, libxml2, pango, glib2 | pkgconf, util-macros | Upstream project is effectively unmaintained since ~2016; 3.6.1 is the last real release — confirmed the tarball is live at `openbox.org/dist` (HTTP 200, GitHub-Pages-fronted). libxml2: verify on alpha9 per brief; port only if absent from base. |
| desktop | st | 0.9.3 | https://dl.suckless.org/st/st-0.9.3.tar.gz | compute-on-fetch | make | libX11, libXft, fontconfig, freetype | — | suckless has no configure step; Makefile hardcodes `/usr/local` prefix and X11 include/lib paths — expect a Makefile-config patch for Hammerhead's simplified `/usr/lib` paths (per project's Goal #2). |

## PRESENT — do not re-port (per brief)

| name | status | notes |
|---|---|---|
| zlib | PRESENT (base) | consumed by libpng, libfontenc, x11vnc |
| libffi | PRESENT (base) | consumed by glib2 |
| expat | PRESENT (base) | not directly required by this port set, but commonly linked by fontconfig-adjacent tooling; no action needed |
| openssl | PRESENT (base) | OpenSSL 3.5 per memory; xlibre-server's `-Dsha1=libcrypto` uses it directly |
| ncurses | PRESENT (base) | not a direct dep of this port set but listed per brief; no action needed |
| libxml2 | verify on alpha9; port only if absent | consumed by fontconfig and openbox in this table — if it turns out absent, add it as a port (last known upstream 2.13.x, gitlab.gnome.org/GNOME/libxml2) before Task on fontconfig/openbox proceeds |

## Ports whose version/deps could NOT be fully pinned from primary sources

- **libpthread-stubs** — version 0.5 confirmed present on xorg.freedesktop.org, but whether illumos/Hammerhead (which has a native, non-stub pthread implementation) needs this at all is unresolved from packaging alone; flag for the per-port task to check whether libxcb's meson build even requests it on a non-Linux, non-BSD host.
- **libjpeg-turbo** — included because cairo/gdk-pixbuf-style stacks commonly want it, but nothing in the strict Xvfb+Openbox+st dependency chain in this table hard-requires it (cairo's PNG backend uses libpng directly, not libjpeg). Kept in the table per the brief's explicit port list; the per-port task should confirm it's actually linked by something before spending build effort on it.
- **xorgproto exact API-numbered subset** — recorded only the tarball version (2025.1); did not enumerate which of the ~20 sub-protocol headers (`bigreqsproto`, `xproto`, `randrproto`, etc.) are consumed by which client lib — that level of granularity is a Task 2/3 build-time concern, not a manifest concern.
- **dejavu-fonts build system** — the upstream distribution is a pre-built TTF zip (no compile), which doesn't map cleanly onto the `build_system` column enum (`autotools|meson|cmake|make|python`); recorded as `make (fontforge-based build; or use pre-built ttf archive directly, no compile needed)` — flag for whoever writes the Coral `package.toml` since it may just be a copy-files package with no real build step.

## Notable surprises

1. **XLibre's ebuild dependency chain is more informative than freedesktop.org alone** — the Gentoo ebuild's `CDEPEND`/`DEPEND` block is the only place that states the *exact* minimum-version constraints XLibre's own server actually enforces (e.g. `>=x11-libs/libxkbfile-1.0.4`, `>=x11-base/xorg-proto-2024.1`, `>=x11-apps/xauth-1.0.3`) — freedesktop.org release pages don't carry that information at all.
2. **`meson_use` 1:1-maps Gentoo USE flags to meson option names** — this made verifying the exact Xvfb-only flag set far more reliable than guessing from `meson_options.txt` alone: the ebuild's `src_configure()` is effectively a working, tested reference invocation, just with `xorg`/`xephyr`/etc. flipped the other way for Xvfb-only.
3. **GNOME's `cache.json` release-index endpoints are not reliable for "latest stable"** — pango's `cache.json` listed a `1.90.0` version with no matching git tag anywhere in GNOME's GitLab; always cross-check via the GitLab tags API (`gitlab.gnome.org/api/v4/projects/GNOME%2F<pkg>/repository/tags`) before trusting a cache.json max.
4. **harfbuzz's own git tag list is polluted with non-release marker tags** (`pango-start`, `hb-rename`, etc. — likely leftover from a historical monorepo merge) — the GitHub Releases API `tag_name` field is the trustworthy source, not a raw `git tag` scrape.
5. **`libxcvt` is NOT required for an Xvfb-only build** — it's gated behind XLibre's `xorg` USE flag (real Xorg mode-line generation) and never touched when `xvfb`-only is enabled. Listed in the brief's client-libs set, but Task 2/3 can deprioritize it unless/until Phase 1b adds real Xorg/DDX support.
6. **`xkeyboard-config` and `dejavu-fonts` are NOT under the same freedesktop.org path prefix** as the other xorg libs/apps — xkeyboard-config lives at `.../releases/individual/data/xkeyboard-config/`, and dejavu-fonts is SourceForge-hosted, not freedesktop.org at all. Both 404'd on first-guess URLs before the correct path was found by search, consistent with the brief's warning not to guess.

## Added mid-implementation (not in the original mining)
| category | name | version | build_system | why | task |
|---|---|---|---|---|---|
| devel | gettext-not-needed | — | — | glib `-Dnls=disabled`; no gettext dep hit | Task 5/6 |
| devel | gperf | 3.3 | autotools | fontconfig build tool | Task 5 |
| devel | unzip | 6.0 | make | coral shells out to unzip for .zip sources | Task 5 |
| base | libvncserver | 0.9.15 | autotools | x11vnc hard dep since its 2016 codebase split (not in upstream x11vnc tarball) | Task 7a |