First task for the next session

The machine boots, su works, the desktop runs and the application accounts are in daily use. Everything below is configuration on the machine, not a build. The tools are at 1.14.320.

0. Repair what the lease took (do this first)

/usr/bin/su and six /usr/sbin/iptables* links are owned by p_webkitgtk, and the links are recorded in its pkg.lst — so update webkitgtk --clean would delete them. 1.14.310 shuts the doors; the machine still has to be put back:

packagemanager disown --all            # what it would hand back
packagemanager disown --all --run      # hand it back, and clean the records
lfs-helper setid --run                 # put the setuid bits back
su -                                   # check

Then the same rebuild that broke it is safe to repeat.

0a. The stacks are reorganised (1.14.320)

make install
ls /etc/pkgusr/stacks/*.stack.new     # should print nothing

wayland.stack is new (the base sway.stack used to carry), sway.stack includes it, and zathura/imv moved to apps.stack, jq to tools.stack. Nothing needs rebuilding; packagemanager stack sway still means the whole desktop. See HANDOFF 1.14.320.

0b. The shared hub and yt-dlp

Shared data moved to /home/Shared by hand (commands from the 1.14.315 session), then:

packagemanager stack services --only app-users --run   # links + 0700 homes
packagemanager stack media --only yt-dlp --run

Log in again for the SHARED_* variables to name /home/Shared.

1. The locale (one command, then log in again)

Nothing sets $LANG. lfs-helper wrote /etc/profile.d/i18n.sh with the export commented out, and there is no /etc/locale.conf — so every program runs in the C locale and foot says so at every start. Both are fixed in the tools (1.14.296–1.14.298); the machine still has to run the step:

lfs config locale de_DE.UTF-8       # if it is not that already
packagemanager stack services --only shell-env --run
# log in again, or right now:  . /etc/profile.d/i18n.sh

It writes /etc/locale.conf, replaces that i18n.sh (backed up), and adds one line to /etc/bashrc so a new terminal picks it up without a login.

2. The launchers written before 1.14.295

A .desktop entry does nothing if its launcher does not give su a pty, and a launcher these tools did not write is left alone — so the old ones survive. ~/bin/claude is the last hand-made one:

rm ~/bin/claude
packagemanager stack services --only app-users --run

Then click a menu entry. If one still does nothing, run the same name in a terminal first: that path prints what su says.

3. Wireless — the only piece of networking still missing

Wired works and starts itself (enp2s0f0, enp5s0). The wireless interface is wlan0 on this kernel.

packagemanager stack network --only net-wifi --run

It prints both files to write: /etc/sysconfig/ifconfig.wlan0 and a per-SSID /etc/sysconfig/wpa_supplicant/wpa_supplicant-wlan0.conf (chmod 600). Nothing writes the second one for you — it holds the key.

4. make-ca's weekly job

The systemd book enables a timer, which the shim skips. fcron is installed:

cat > /etc/cron.weekly/update-pki.sh << "EOF"
#!/bin/bash
/usr/sbin/make-ca -g
EOF
chmod 754 /etc/cron.weekly/update-pki.sh

5. Try the new commands once

So their first use is not in an emergency:

packagemanager service                 # list; then: service sshd start
packagemanager stack dev --run         # gdb

6. Run the test suite once, on the machine

make check

It has not been able to report a verdict for some time (1.14.303): lfs would not load on Python < 3.12, and the cleanup trap fired in every subshell and removed the counters, so the final line printed blank. Both are fixed. Here it reads 761 PASS / 84 FAIL / 1 SKIP (1.14.320), and those 84 are all "this is not a package-user system" -- the wrappers, the book and the chroot blocks have nothing to test against. On the machine they should mostly turn into passes; whatever is left is a real list worth reading.

Known and NOT fixed: --only N / --from N can cut a here-document in half and lose helpers an earlier block defined, so a selection can report failures a full run does not. Trust the full run.

Still open, none blocking

• services.stack is misnamed: it holds bash-completion, shell-env,

linux-pam, shadow-pam, app-users, power and mytools as well as the boot services. system.stack would say what it is. Not renamed yet: the machine's progress file (services.done), NEXT-TASK, BUILD.md and ~20 test references use the name. Decide, then do it in one release.

• the scdoc, grim, slurp and swayidle entries have not been built yet --

first real run is on the machine (sr.ht / freedesktop are unreachable from the sandbox).

• a plan does not put an update of an installed-but-too-old dependency in

front of the package that needs it (vcs_versioning wanted packaging >= 26.2; HANDOFF 1.14.314).

• poppler: re-apply the reverted cd rule (the patches only "did not fire"

because of the stale index cache, fixed in 1.14.262); diff every generated script before and after. Do NOT --regenerate poppler first.

• shadow's login.defs block overwrites .orig on a second run.
• MIT-Kerberos configure transcript blocks (not in any stack).
• dbus was built before [dbus] systemd = disabled went into

machine.conf — rebuild or accept.

• A stray .service from at-spi2-core in /usr/lib/systemd/user.
• /etc/bashrc has a mangled line (# End /etc/bashrcCK=$(tput setaf 0))

from an append without a leading newline. Harmless: BLACK is unset and nothing uses it.

Settled since this list was last written

• "cfg entries are stack-cached, so a repair script is skipped once it has

run." Answered by convention rather than by changing the cache: every cfg entry that must stay true now carries expect=, which is re-checked on every run — shadow-pam, app-users, shell-env, bootscripts.