sergio/takana

Cosecha desatendida de la campaña harkaq. Cada dep de acá la denunció el audit de
Landlock en un build real: el kernel vio al build usarla sin declararla, y el
store del hub confirma qué artefacto la provee (deuda DECLARABLE, §4.5).

Recetas:gettext-tiny giflib git gnupg gperf gzip htop iproute2 jq kbd libassuan libcap libevent libffi libgcrypt libgpg-error libksba libnl libpng libsass libsodium libssh2 libudev-zero libusb libwebp libxml2 libyaml linux-generic linux-headers linux-metal linux-pam linux lz4 mandoc mtools musl nano npth openssh openssl parted pciutils pcre2 pigz procps-ng python3 readline rsync samurai ca-certificates curl doas dosfstools e2fsprogs fontconfig freetype

No se tocó ninguna receta con deuda IRREDUCIBLE: declarar algo que el store no
provee rompería el build en vez de arreglarlo. Esas van a tandas/needs-review-harkaq.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

diff --git a/recipes/ca-certificates.toml b/recipes/ca-certificates.toml
index edf28d4f..8517d91a 100644
--- a/recipes/ca-certificates.toml
+++ b/recipes/ca-certificates.toml
@@ -20,7 +20,7 @@ flags    = []
 # (`-lcrypto`). El resto del build (mk-ca-bundle.pl → cert.pem → split-ca-bundle.sh) usa
 # el perl + coreutils del rootfs; no requiere el CLI de openssl.
 [deps]
-build = ["openssl"]
+build = ["openssl", "perl"]
 
 [build.phases]
 # de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
diff --git a/recipes/curl.toml b/recipes/curl.toml
index f062bd05..8e97e661 100644
--- a/recipes/curl.toml
+++ b/recipes/curl.toml
@@ -29,4 +29,4 @@ compile = 'make'
 install = 'make DESTDIR=/out install'
 
 [deps]
-build = ["openssl", "zlib"]
+build = ["openssl", "zlib", "perl"]
diff --git a/recipes/doas.toml b/recipes/doas.toml
index 1ca39193..6a5deee7 100644
--- a/recipes/doas.toml
+++ b/recipes/doas.toml
@@ -42,4 +42,4 @@ _abuild_phase
 '''
 
 [deps]
-build = ["bison"]
+build = ["bison", "make"]
diff --git a/recipes/dosfstools.toml b/recipes/dosfstools.toml
index e8532c87..296ab225 100644
--- a/recipes/dosfstools.toml
+++ b/recipes/dosfstools.toml
@@ -43,4 +43,4 @@ _abuild_phase
 '''
 
 [deps]
-build = ["linux-headers"]
+build = ["linux-headers", "busybox", "make"]
diff --git a/recipes/e2fsprogs.toml b/recipes/e2fsprogs.toml
index e3c553b2..942cfa68 100644
--- a/recipes/e2fsprogs.toml
+++ b/recipes/e2fsprogs.toml
@@ -59,4 +59,4 @@ _abuild_phase
 '''
 
 [deps]
-build = ["linux-headers"]
+build = ["linux-headers", "busybox", "pkgconf"]
diff --git a/recipes/fontconfig.toml b/recipes/fontconfig.toml
index da6f607b..17195d7c 100644
--- a/recipes/fontconfig.toml
+++ b/recipes/fontconfig.toml
@@ -15,4 +15,4 @@ install   = "make install DESTDIR=/out"
 # libpng+zlib: freetype se compila --with-png, así que freetype2.pc trae `Requires: libpng`
 # (y libpng.pc → zlib); sin ellos pkg-config no resuelve freetype2 y ./configure aborta.
 [deps]
-build = ["freetype", "expat", "pkgconf", "gperf", "python3", "libpng", "zlib"]
+build = ["freetype", "expat", "pkgconf", "gperf", "python3", "libpng", "zlib", "busybox", "make"]
diff --git a/recipes/freetype.toml b/recipes/freetype.toml
index e72d21c5..344addcc 100644
--- a/recipes/freetype.toml
+++ b/recipes/freetype.toml
@@ -20,4 +20,4 @@ install   = 'make DESTDIR=/out install'
 
 
 [deps]
-build = ["zlib","libpng"]
+build = ["zlib", "libpng", "make"]
diff --git a/recipes/gettext-tiny.toml b/recipes/gettext-tiny.toml
index 4f40fe02..02e5b103 100644
--- a/recipes/gettext-tiny.toml
+++ b/recipes/gettext-tiny.toml
@@ -19,4 +19,4 @@ compile   = "make -j4 LIBINTL=MUSL CC='zig cc'"
 install   = "make install LIBINTL=MUSL prefix=/usr DESTDIR=/out"
 
 [deps]
-build = []
+build = ["make"]
diff --git a/recipes/giflib.toml b/recipes/giflib.toml
index 24cec2d6..ad213ab9 100644
--- a/recipes/giflib.toml
+++ b/recipes/giflib.toml
@@ -35,4 +35,4 @@ _abuild_phase
 
 # xmlto era dep espuria del import (solo docs, ya desactivadas por dont-build-html-pages-images.patch).
 [deps]
-build = []
+build = ["make"]
diff --git a/recipes/git.toml b/recipes/git.toml
index e64ce18d..0ee50b06 100644
--- a/recipes/git.toml
+++ b/recipes/git.toml
@@ -45,4 +45,4 @@ make prefix=/usr DESTDIR="/out" CC="${CC:-cc}" \
 # depends de runtime de Alpine (NO build-deps): perl
 
 [deps]
-build = ["zlib", "openssl", "curl", "pcre2", "linux-headers"]
+build = ["zlib", "openssl", "curl", "pcre2", "linux-headers", "perl"]
diff --git a/recipes/gnupg.toml b/recipes/gnupg.toml
index af53f77f..04c0d32d 100644
--- a/recipes/gnupg.toml
+++ b/recipes/gnupg.toml
@@ -57,4 +57,4 @@ rm -f usr/bin/gpgscm
 '''
 
 [deps]
-build = ["libgpg-error", "libgcrypt", "libassuan", "libksba", "npth", "zlib", "linux-headers", "pkgconf"]
+build = ["libgpg-error", "libgcrypt", "libassuan", "libksba", "npth", "zlib", "linux-headers", "pkgconf", "make"]
diff --git a/recipes/gperf.toml b/recipes/gperf.toml
index 8f3809a6..d29952ab 100644
--- a/recipes/gperf.toml
+++ b/recipes/gperf.toml
@@ -8,6 +8,9 @@ sha256  = "588546b945bba4b70b6a3a616e80b4ab466e3f33024a352fc2198112cdbb3ae2"
 compiler = "zig-cc"
 target   = "x86_64-linux-musl"
 link     = "static"
+[deps]
+build = ["busybox", "make"]
+
 [build.phases]
 configure = "CXXFLAGS=\"$CXXFLAGS -std=c++14\" ./configure --prefix=/usr"
 compile   = "make"
diff --git a/recipes/gzip.toml b/recipes/gzip.toml
index ad76df79..83496c16 100644
--- a/recipes/gzip.toml
+++ b/recipes/gzip.toml
@@ -16,6 +16,9 @@ target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
 
+[deps]
+build = ["make"]
+
 [build.phases]
 # de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
 compile = '''
diff --git a/recipes/htop.toml b/recipes/htop.toml
index 038a5757..1471fbb5 100644
--- a/recipes/htop.toml
+++ b/recipes/htop.toml
@@ -29,4 +29,4 @@ compile   = "make -j\"$(nproc)\""
 install   = "make DESTDIR=/out install"
 
 [deps]
-build = ["ncurses", "linux-headers"]
+build = ["ncurses", "linux-headers", "make"]
diff --git a/recipes/iproute2.toml b/recipes/iproute2.toml
index 08d144de..02cad4fe 100644
--- a/recipes/iproute2.toml
+++ b/recipes/iproute2.toml
@@ -39,4 +39,4 @@ _abuild_phase
 '''
 
 [deps]
-build = ["linux-headers", "bison", "flex"]
+build = ["linux-headers", "bison", "flex", "make", "pkgconf"]
diff --git a/recipes/jq.toml b/recipes/jq.toml
index 260fcf4e..1b068c0d 100644
--- a/recipes/jq.toml
+++ b/recipes/jq.toml
@@ -41,4 +41,4 @@ compile   = "make LDFLAGS=-all-static -j\"$(nproc)\""
 install   = "make DESTDIR=/out prefix=/usr LDFLAGS=-all-static install"
 
 [deps]
-build = ["oniguruma"]
+build = ["oniguruma", "busybox", "make"]
diff --git a/recipes/kbd.toml b/recipes/kbd.toml
index edacf242..e4f54b7c 100644
--- a/recipes/kbd.toml
+++ b/recipes/kbd.toml
@@ -59,4 +59,4 @@ ln -s openvt "/out"/usr/bin/open
 # deps de Alpine remapeadas al catálogo canónico. AUSENTES quitadas: ckbcomp/perl,
 # linux-pam, xkeyboard-config. flex compila el parser de keymaps (analyze.l).
 [deps]
-build = ["flex", "linux-headers"]
+build = ["flex", "linux-headers", "make", "pkgconf"]
diff --git a/recipes/libassuan.toml b/recipes/libassuan.toml
index 9cdd054c..5d29059f 100644
--- a/recipes/libassuan.toml
+++ b/recipes/libassuan.toml
@@ -19,4 +19,4 @@ compile   = 'make'
 install   = 'make DESTDIR=/out install'
 
 [deps]
-build = ["libgpg-error", "linux-headers", "pkgconf"]
+build = ["libgpg-error", "linux-headers", "pkgconf", "make"]
diff --git a/recipes/libcap.toml b/recipes/libcap.toml
index 16c1d020..174ace58 100644
--- a/recipes/libcap.toml
+++ b/recipes/libcap.toml
@@ -28,6 +28,9 @@ compiler = "zig-cc"
 target   = "x86_64-linux-musl"
 link     = "static"
 
+[deps]
+build = ["make"]
+
 [build.phases]
 # El árbol de libcap detecta como BuildSys::Make ⇒ el compile/install por defecto no pasa los
 # overrides de toolchain ni las flags GOLANG/PAM. Override explícito de ambas fases.
diff --git a/recipes/libevent.toml b/recipes/libevent.toml
index 93166c10..c4bdb605 100644
--- a/recipes/libevent.toml
+++ b/recipes/libevent.toml
@@ -12,6 +12,9 @@ target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
 
+[deps]
+build = ["make"]
+
 [build.phases]
 configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-shared --enable-static --disable-samples --disable-libevent-regress --disable-openssl'
 compile   = 'make'
diff --git a/recipes/libffi.toml b/recipes/libffi.toml
index e8b759bf..116f2e9f 100644
--- a/recipes/libffi.toml
+++ b/recipes/libffi.toml
@@ -13,6 +13,9 @@ compiler = "gcc"
 target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
+[deps]
+build = ["make"]
+
 [build.phases]
 configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-shared --enable-static --with-pic --disable-exec-static-tramp'
 compile   = 'make'
diff --git a/recipes/libgcrypt.toml b/recipes/libgcrypt.toml
index 3c86a46e..1c89be0c 100644
--- a/recipes/libgcrypt.toml
+++ b/recipes/libgcrypt.toml
@@ -19,4 +19,4 @@ install   = 'make DESTDIR=/out install'
 
 
 [deps]
-build = ["libgpg-error"]
+build = ["libgpg-error", "make"]
diff --git a/recipes/libgpg-error.toml b/recipes/libgpg-error.toml
index a5385122..28528c51 100644
--- a/recipes/libgpg-error.toml
+++ b/recipes/libgpg-error.toml
@@ -12,6 +12,9 @@ target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
 
+[deps]
+build = ["make"]
+
 [build.phases]
 configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-shared --enable-static --disable-doc --disable-tests --enable-install-gpg-error-config'
 compile   = 'make'
diff --git a/recipes/libksba.toml b/recipes/libksba.toml
index 08846123..a4f51cac 100644
--- a/recipes/libksba.toml
+++ b/recipes/libksba.toml
@@ -18,4 +18,4 @@ compile   = 'make'
 install   = 'make DESTDIR=/out install'
 
 [deps]
-build = ["libgpg-error", "linux-headers", "pkgconf"]
+build = ["libgpg-error", "linux-headers", "pkgconf", "make"]
diff --git a/recipes/libnl.toml b/recipes/libnl.toml
index 36299adf..d3a4e2e6 100644
--- a/recipes/libnl.toml
+++ b/recipes/libnl.toml
@@ -23,7 +23,7 @@ link     = "static"
 
 [deps]
 # libnl 3.11 regenera sus parsers netlink ⇒ flex (lexer) + bison (parser) + m4 (bison lo invoca).
-build = ["flex", "bison", "m4"]
+build = ["flex", "bison", "m4", "busybox", "make"]
 
 [build.phases]
 configure = "./configure --build=$CBUILD --host=$CHOST --prefix=/usr --libdir=/usr/lib --disable-shared --enable-static --disable-cli"
diff --git a/recipes/libpng.toml b/recipes/libpng.toml
index c265a20c..facdaa6a 100644
--- a/recipes/libpng.toml
+++ b/recipes/libpng.toml
@@ -15,4 +15,4 @@ configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-s
 compile   = 'make'
 install   = 'make DESTDIR=/out install'
 [deps]
-build = ["zlib"]
+build = ["zlib", "make"]
diff --git a/recipes/libsass.toml b/recipes/libsass.toml
index 6c72cfc3..48f41309 100644
--- a/recipes/libsass.toml
+++ b/recipes/libsass.toml
@@ -18,4 +18,4 @@ compile   = "make -j4 BUILD=static CC='zig cc' CXX='zig c++' lib/libsass.a"
 install   = "mkdir -p /out/usr/lib /out/usr/include && cp lib/libsass.a /out/usr/lib/ && cp -r include/* /out/usr/include/"
 
 [deps]
-build = []
+build = ["make"]
diff --git a/recipes/libsodium.toml b/recipes/libsodium.toml
index 823e688e..1301ff9d 100644
--- a/recipes/libsodium.toml
+++ b/recipes/libsodium.toml
@@ -10,6 +10,9 @@ compiler = "gcc"
 target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
+[deps]
+build = ["make"]
+
 [build.phases]
 configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-shared --enable-static'
 compile   = 'make'
diff --git a/recipes/libssh2.toml b/recipes/libssh2.toml
index 23f89da7..795b3163 100644
--- a/recipes/libssh2.toml
+++ b/recipes/libssh2.toml
@@ -15,4 +15,4 @@ configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-s
 compile   = 'make'
 install   = 'make DESTDIR=/out install'
 [deps]
-build = ["openssl", "zlib"]
+build = ["openssl", "zlib", "perl"]
diff --git a/recipes/libudev-zero.toml b/recipes/libudev-zero.toml
index 224ff84f..2f48be36 100644
--- a/recipes/libudev-zero.toml
+++ b/recipes/libudev-zero.toml
@@ -20,4 +20,4 @@ compile = 'make PREFIX=/usr'
 install = 'make PREFIX=/usr DESTDIR=/out install install-pkgconfig'
 
 [deps]
-build = ["pkgconf"]
+build = ["pkgconf", "make"]
diff --git a/recipes/libusb.toml b/recipes/libusb.toml
index 645d5e8a..746e969d 100644
--- a/recipes/libusb.toml
+++ b/recipes/libusb.toml
@@ -38,4 +38,4 @@ make DESTDIR="/out" install
 '''
 
 [deps]
-build = ["linux-headers"]
+build = ["linux-headers", "busybox", "make"]
diff --git a/recipes/libwebp.toml b/recipes/libwebp.toml
index 79dbaef3..0dea0f25 100644
--- a/recipes/libwebp.toml
+++ b/recipes/libwebp.toml
@@ -44,4 +44,4 @@ _abuild_phase
 '''
 
 [deps]
-build = ["giflib", "libjpeg-turbo", "libpng"]
+build = ["giflib", "libjpeg-turbo", "libpng", "make"]
diff --git a/recipes/libxml2.toml b/recipes/libxml2.toml
index 6f8f5a86..11af3a6d 100644
--- a/recipes/libxml2.toml
+++ b/recipes/libxml2.toml
@@ -21,6 +21,9 @@ flags    = []
 
 # configure EXPLÍCITO: si se deja vacío, la heurística del lab inyecta su propio ./configure
 # minimal (defaults → exige python-3.12) que corre antes y aborta. Definirlo lo desactiva.
+[deps]
+build = ["make"]
+
 [build.phases]
 configure = '''
 ./configure \
diff --git a/recipes/libyaml.toml b/recipes/libyaml.toml
index 0376d5f8..be6fb09b 100644
--- a/recipes/libyaml.toml
+++ b/recipes/libyaml.toml
@@ -10,6 +10,9 @@ compiler = "gcc"
 target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
+[deps]
+build = ["make"]
+
 [build.phases]
 configure = './configure --build=$CBUILD --host=$CHOST --prefix=/usr --disable-shared --enable-static'
 compile   = 'make'
diff --git a/recipes/linux-generic.toml b/recipes/linux-generic.toml
index 837dd42a..610aa961 100644
--- a/recipes/linux-generic.toml
+++ b/recipes/linux-generic.toml
@@ -31,7 +31,7 @@ target   = "x86_64-linux-musl"
 link     = "dynamic"
 
 [deps]
-build = ["flex", "bison", "m4", "openssl", "elfutils"]
+build = ["flex", "bison", "m4", "openssl", "elfutils", "busybox", "make"]
 
 [build.phases]
 configure = """
diff --git a/recipes/linux-headers.toml b/recipes/linux-headers.toml
index aaab2aa3..433d87c4 100644
--- a/recipes/linux-headers.toml
+++ b/recipes/linux-headers.toml
@@ -45,6 +45,9 @@ compiler = "zig-cc"
 target   = "x86_64-linux-musl"
 link     = "static"
 
+[deps]
+build = ["make"]
+
 [build.phases]
 # El árbol del kernel detecta como BuildSys::Make ⇒ el default de compile sería `make -j$(nproc)`,
 # que construiría el kernel ENTERO. No queremos eso: los headers no necesitan compilarse ni config.
diff --git a/recipes/linux-metal.toml b/recipes/linux-metal.toml
index 23ac96c0..711d3986 100644
--- a/recipes/linux-metal.toml
+++ b/recipes/linux-metal.toml
@@ -55,7 +55,7 @@ target   = "x86_64-linux-musl"
 link     = "dynamic"
 
 [deps]
-build = ["flex", "bison", "m4", "openssl", "elfutils"]
+build = ["flex", "bison", "m4", "openssl", "elfutils", "busybox", "make"]
 
 [build.phases]
 configure = """
diff --git a/recipes/linux-pam.toml b/recipes/linux-pam.toml
index 84c7e456..84dde187 100644
--- a/recipes/linux-pam.toml
+++ b/recipes/linux-pam.toml
@@ -21,4 +21,4 @@ compile   = 'make'
 install   = 'make DESTDIR=/out install'
 
 [deps]
-build = ["flex", "pkgconf"]
+build = ["flex", "pkgconf", "make"]
diff --git a/recipes/linux.toml b/recipes/linux.toml
index 71617c8b..e6a41a87 100644
--- a/recipes/linux.toml
+++ b/recipes/linux.toml
@@ -70,7 +70,7 @@ link     = "dynamic"
 # openssl + elfutils de-Alpinizan los build-deps que antes venían de `apk add openssl-dev elfutils-dev`.
 # elfutils.toml construye SÓLO libelf (lo que objtool enlaza) con shims musl (argp/error/libintl/fts/
 # obstack/rawmemchr); ver su cabecera. Todo el camino del kernel es ahora hammer-from-source.
-build = ["flex", "bison", "m4", "openssl", "elfutils"]
+build = ["flex", "bison", "m4", "openssl", "elfutils", "busybox", "make"]
 
 [build.phases]
 configure = """
diff --git a/recipes/lz4.toml b/recipes/lz4.toml
index 9bf928a7..0e334aa1 100644
--- a/recipes/lz4.toml
+++ b/recipes/lz4.toml
@@ -8,6 +8,9 @@ sha256  = "537512904744b35e232912055ccf8ec66d768639ff3abe5788d90d792ec5f48b"
 compiler = "zig-cc"
 target   = "x86_64-linux-musl"
 link     = "static"
+[deps]
+build = ["make"]
+
 [build.phases]
 compile = "make BUILD_SHARED=no BUILD_STATIC=yes -C lib"
 install = "make -C lib install BUILD_SHARED=no PREFIX=/usr DESTDIR=/out"
diff --git a/recipes/mandoc.toml b/recipes/mandoc.toml
index 59a6a58a..86aca941 100644
--- a/recipes/mandoc.toml
+++ b/recipes/mandoc.toml
@@ -48,4 +48,4 @@ _abuild_phase
 '''
 
 [deps]
-build = ["zlib"]
+build = ["zlib", "make"]
diff --git a/recipes/mtools.toml b/recipes/mtools.toml
index 55a78516..6660e0d9 100644
--- a/recipes/mtools.toml
+++ b/recipes/mtools.toml
@@ -26,6 +26,9 @@ target      = "x86_64-linux-musl"
 link        = "static"
 zig_version = "0.13.0"
 
+[deps]
+build = ["busybox"]
+
 [build.phases]
 configure = "./configure --prefix=/usr --without-x CC='zig cc -mcpu=baseline -target x86_64-linux-musl' LDFLAGS=-static"
 compile   = "make -j\"$(nproc)\""
diff --git a/recipes/musl.toml b/recipes/musl.toml
index e46ef5a3..36a2e6af 100644
--- a/recipes/musl.toml
+++ b/recipes/musl.toml
@@ -16,6 +16,9 @@ compiler = "zig-cc"
 target   = "x86_64-linux-musl"
 link     = "static"
 
+[deps]
+build = ["make"]
+
 [build.phases]
 # El sandbox exporta CC="zig cc", DESTDIR=/out y PREFIX=/usr. musl trae su propio `configure`.
 # Sólo estático: los componentes Rust se compilan crt-static + no-PIE (autocontenidos, ET_EXEC sin
diff --git a/recipes/nano.toml b/recipes/nano.toml
index 1ff44286..733066ef 100644
--- a/recipes/nano.toml
+++ b/recipes/nano.toml
@@ -28,4 +28,4 @@ compile   = "make -j\"$(nproc)\""
 install   = "make DESTDIR=/out install"
 
 [deps]
-build = ["ncurses", "linux-headers"]
+build = ["ncurses", "linux-headers", "make"]
diff --git a/recipes/npth.toml b/recipes/npth.toml
index 932dc79e..5eaa2da1 100644
--- a/recipes/npth.toml
+++ b/recipes/npth.toml
@@ -16,6 +16,9 @@ target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
 
+[deps]
+build = ["busybox", "make"]
+
 [build.phases]
 configure = '''
 ./configure \
diff --git a/recipes/openssh.toml b/recipes/openssh.toml
index 91faacb9..f3b196a1 100644
--- a/recipes/openssh.toml
+++ b/recipes/openssh.toml
@@ -47,7 +47,7 @@ link        = "static"
 zig_version = "0.13.0"
 
 [deps]
-build = ["zlib", "openssl"]
+build = ["zlib", "openssl", "perl"]
 
 [build.phases]
 # --sysconfdir=/etc/ssh: sshd_config/ssh_config viven en /etc/ssh. --with-ssl-dir/--with-zlib=/usr:
diff --git a/recipes/openssl.toml b/recipes/openssl.toml
index f6a6c8a7..edada6ed 100644
--- a/recipes/openssl.toml
+++ b/recipes/openssl.toml
@@ -30,6 +30,9 @@ link        = "static"
 # que el assembler integrado de zig cc (clang) maneja. Con el zig bueno por-receta gcc no hace falta.
 zig_version = "0.13.0"
 
+[deps]
+build = ["perl"]
+
 [build.phases]
 configure = "./Configure linux-x86_64 --prefix=/usr --libdir=lib no-shared no-docs no-tests no-apps"
 compile   = "make -j\"$(nproc)\" build_libs"
diff --git a/recipes/parted.toml b/recipes/parted.toml
index 1e3aa2c7..16a62427 100644
--- a/recipes/parted.toml
+++ b/recipes/parted.toml
@@ -52,4 +52,4 @@ make DESTDIR="/out" install
 # lvm2 (device-mapper) ausente y opcional → --disable-device-mapper. libuuid real vía util-linux
 # (dep de build); pkgconf resuelve uuid.pc. bash/ncurses/readline innecesarios al binario estático.
 [deps]
-build = ["util-linux", "linux-headers", "pkgconf"]
+build = ["util-linux", "linux-headers", "pkgconf", "busybox", "make"]
diff --git a/recipes/pciutils.toml b/recipes/pciutils.toml
index de7b11dc..e04a3bf6 100644
--- a/recipes/pciutils.toml
+++ b/recipes/pciutils.toml
@@ -45,4 +45,4 @@ _abuild_phase
 # depends de runtime de Alpine (NO build-deps): hwdata-pci
 
 [deps]
-build = ["linux-headers"]
+build = ["linux-headers", "make"]
diff --git a/recipes/pcre2.toml b/recipes/pcre2.toml
index 1082c844..3e7625b3 100644
--- a/recipes/pcre2.toml
+++ b/recipes/pcre2.toml
@@ -31,4 +31,4 @@ make
 install = 'make DESTDIR=/out install'
 
 [deps]
-build = ["zlib"]
+build = ["zlib", "make"]
diff --git a/recipes/pigz.toml b/recipes/pigz.toml
index d54d0157..f5bcdffc 100644
--- a/recipes/pigz.toml
+++ b/recipes/pigz.toml
@@ -14,4 +14,4 @@ compile = 'make pigz CC=gcc CFLAGS="-O2 -I/usr/include" LDFLAGS="-static -no-pie
 install = 'mkdir -p /out/usr/bin && cp pigz /out/usr/bin/pigz && ln -sf pigz /out/usr/bin/unpigz'
 
 [deps]
-build = ["zlib"]
+build = ["zlib", "make"]
diff --git a/recipes/procps-ng.toml b/recipes/procps-ng.toml
index 13e012e6..e92ff750 100644
--- a/recipes/procps-ng.toml
+++ b/recipes/procps-ng.toml
@@ -63,4 +63,4 @@ ln -sf pgrep "/out"/bin/pkill 2>/dev/null || true
 '''
 
 [deps]
-build = ["ncurses", "linux-headers", "pkgconf"]
+build = ["ncurses", "linux-headers", "pkgconf", "make"]
diff --git a/recipes/python3.toml b/recipes/python3.toml
index b99a0f6a..d34e3e20 100644
--- a/recipes/python3.toml
+++ b/recipes/python3.toml
@@ -36,7 +36,7 @@ link        = "dynamic"
 zig_version = "0.13.0"
 
 [deps]
-build = ["zlib"]
+build = ["zlib", "busybox", "pkgconf"]
 
 [build.phases]
 configure = "./configure --prefix=/usr --without-ensurepip --disable-test-modules --with-ensurepip=no CFLAGS=\"-Wno-error=date-time\""
diff --git a/recipes/readline.toml b/recipes/readline.toml
index 144b34bd..1b895652 100644
--- a/recipes/readline.toml
+++ b/recipes/readline.toml
@@ -13,4 +13,4 @@ configure = "./configure --prefix=/usr --disable-shared --enable-static --with-c
 compile   = "make"
 install   = "make install DESTDIR=/out"
 [deps]
-build = ["ncurses"]
+build = ["ncurses", "busybox", "make"]
diff --git a/recipes/rsync.toml b/recipes/rsync.toml
index cf989e34..ed94ab11 100644
--- a/recipes/rsync.toml
+++ b/recipes/rsync.toml
@@ -54,4 +54,4 @@ make DESTDIR="/out" install
 # depends de runtime de Alpine (NO build-deps): python3
 
 [deps]
-build = ["zlib", "linux-headers"]
+build = ["zlib", "linux-headers", "busybox"]
diff --git a/recipes/samurai.toml b/recipes/samurai.toml
index affb5d72..66d8aeec 100644
--- a/recipes/samurai.toml
+++ b/recipes/samurai.toml
@@ -15,6 +15,9 @@ target      = "x86_64-linux-musl"
 link        = "static"
 zig_version = "0.13.0"
 
+[deps]
+build = ["make"]
+
 [build.phases]
 compile = 'make CFLAGS="-O2"'
 install = '''
diff --git a/scripts/farm/harvest-harkaq.sh b/scripts/farm/harvest-harkaq.sh
index 1e25b7ff..fa6f6a64 100755
--- a/scripts/farm/harvest-harkaq.sh
+++ b/scripts/farm/harvest-harkaq.sh
@@ -74,6 +74,21 @@ for v in "$VERD"/*.verdicts; do
     fi
 done
 
+# Recoger también las recetas editadas por un ciclo ANTERIOR que no llegó a commitear (el proceso
+# murió, SIGPIPE, la máquina se apagó). Sin esto quedan huérfanas para siempre: al re-correr,
+# add-deps dice "ya estaban declaradas", `tocadas` sale vacío y nadie las commitea nunca. Pasó en
+# el primer ciclo real: 13 recetas editadas y sin committear. Se filtra por `recipes/*.toml` y por
+# que el diff SÓLO toque la línea `build = [...]`, para no arrastrar trabajo de otro agente.
+for f in $(git diff --name-only -- 'recipes/*.toml' 2>/dev/null); do
+    case " $tocadas " in *" $f "*) continue ;; esac
+    if git diff -U0 -- "$f" | grep -E '^[-+]' | grep -vE '^(---|\+\+\+)' | grep -qvE '^[-+]\s*(build\s*=|\[deps\])'; then
+        echo "   ·· $f — modificado con algo que no es `[deps].build`: NO lo toco (¿otro agente?)"
+    else
+        tocadas="$tocadas $f"
+        echo "   ↻ $f — pendiente de un ciclo anterior, se commitea ahora"
+    fi
+done
+
 if [ -n "$tocadas" ]; then
     # `git add` EXPLÍCITO por rutas: el repo lo comparte otro agente (cola gráfica/Go).
     # shellcheck disable=SC2086