Etapa G: fuel-4 — buffer de cola para el VPS tras recuperar conexión
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Semántico sayk'uy
Mana ima sutichaypas t'ikrakurqanchu: qillqalla, yachachiylla utaq willaylla t'ikrakurqan.
20 qillqakuna · +743 −0
- recipes/incoming/CVE-2026-55199.patch +39 −0
- recipes/incoming/CVE-2026-55200.patch +34 −0
- recipes/incoming/CVE-2026-7598.patch +52 −0
- recipes/incoming/bob-nvim.toml +19 −0
- recipes/incoming/bzip2-1.0.2-progress.patch +175 −0
- recipes/incoming/bzip2-1.0.3-no-test.patch +9 −0
- recipes/incoming/bzip2-1.0.4-makefile-CFLAGS.patch +25 −0
- recipes/incoming/bzip2-1.0.4-man-links.patch +12 −0
- recipes/incoming/dotter.toml +22 −0
- recipes/incoming/felix.toml +16 −0
- recipes/incoming/fix-riscv64-test.patch +80 −0
- recipes/incoming/libpng-fix-arm-neon.patch +39 −0
- recipes/incoming/rbw.toml +49 −0
- recipes/incoming/rust-script.toml +19 −0
- recipes/incoming/saneso.patch +23 −0
- recipes/incoming/speedtest-rs.toml +22 −0
- recipes/incoming/toolong.toml +19 −0
- recipes/incoming/tuckr.toml +19 −0
- recipes/incoming/wild.toml +39 −0
- tandas/fuel-4.txt +31 −0
diff --git a/recipes/incoming/CVE-2026-55199.patch b/recipes/incoming/CVE-2026-55199.patch
new file mode 100644
index 00000000..0ac1594b
--- /dev/null
+++ b/recipes/incoming/CVE-2026-55199.patch
@@ -0,0 +1,39 @@
+From 91360acc9f2cd3295fbeff03b448fab912426325 Mon Sep 17 00:00:00 2001
+From: TristanInSec <tristan.mtn@gmail.com>
+Date: Wed, 15 Apr 2026 14:51:08 -0400
+Subject: [PATCH] packet: check `_libssh2_get_string()` return in `EXT_INFO`
+ handler
+
+The `SSH_MSG_EXT_INFO` handler discards the return values from
+`_libssh2_get_string()` when parsing extension name/value pairs. When
+the buffer is exhausted before all claimed extensions are parsed,
+the loop continues with no-op iterations until `nr_extensions` reaches
+zero.
+
+The `nr_extensions >= 1024` cap limits the worst case, but the loop
+should still break on parse failure for correctness and consistency
+with other parsers in this file (e.g. `SSH_MSG_CHANNEL_OPEN`,
+`SSH_MSG_KEXINIT`) that check `_libssh2_get_string()` return values.
+
+Closes #1864
+---
+ src/packet.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index 6da14e9f..ebaddae5 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -868,8 +868,10 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+
+ nr_extensions -= 1;
+
+- _libssh2_get_string(&buf, &name, &name_len);
+- _libssh2_get_string(&buf, &value, &value_len);
++ if(_libssh2_get_string(&buf, &name, &name_len))
++ break;
++ if(_libssh2_get_string(&buf, &value, &value_len))
++ break;
+
+ if(name && value) {
+ _libssh2_debug((session,
diff --git a/recipes/incoming/CVE-2026-55200.patch b/recipes/incoming/CVE-2026-55200.patch
new file mode 100644
index 00000000..e3fb8975
--- /dev/null
+++ b/recipes/incoming/CVE-2026-55200.patch
@@ -0,0 +1,34 @@
+From 63e27b6855f2d8484379ad4b128680561b84e957 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Fri, 12 Jun 2026 15:57:44 -0700
+Subject: [PATCH] transport.c: Additional boundary checks for packet length
+ (#2052)
+
+Add additional bounds checking on packet length to prevent OOB write.
+
+Credit: [TristanInSec](https://github.com/TristanInSec)
+
+Cherry-picked from 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8.
+Co-authored-by: LN Liberda <lauren@selfisekai.rocks>
+---
+ src/transport.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/transport.c b/src/transport.c
+index e1120656..d147505b 100644
+--- a/src/transport.c
++++ b/src/transport.c
+@@ -639,8 +639,12 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session)
+ total_num = 4;
+
+ p->packet_length = _libssh2_ntohu32(block);
+- if(p->packet_length < 1)
++ if(p->packet_length < 1) {
+ return LIBSSH2_ERROR_DECRYPT;
++ }
++ else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) {
++ return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
++ }
+
+ /* total_num may include size field, however due to existing
+ * logic it needs to be removed after the entire packet is read
diff --git a/recipes/incoming/CVE-2026-7598.patch b/recipes/incoming/CVE-2026-7598.patch
new file mode 100644
index 00000000..1b85be25
--- /dev/null
+++ b/recipes/incoming/CVE-2026-7598.patch
@@ -0,0 +1,52 @@
+From 256d04b60d80bf1190e96b0ad1e91b2174d744b1 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Mon, 13 Apr 2026 11:18:25 -0700
+Subject: [PATCH] userauth.c: username_len bounds checking (#1858)
+
+Return errors when username_len will exceed bounds, fix existing bounds
+check.
+
+Credit:
+[dapickle](https://github.com/dapickle)
+---
+ src/userauth.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/src/userauth.c b/src/userauth.c
+index f8e02651c4..43d9ab9b9d 100644
+--- a/src/userauth.c
++++ b/src/userauth.c
+@@ -80,6 +80,12 @@ static char *userauth_list(LIBSSH2_SESSION *session, const char *username,
+ memset(&session->userauth_list_packet_requirev_state, 0,
+ sizeof(session->userauth_list_packet_requirev_state));
+
++ if(username_len > UINT32_MAX - 27) {
++ _libssh2_error(session, LIBSSH2_ERROR_PROTO,
++ "username_len out of bounds");
++ return NULL;
++ }
++
+ session->userauth_list_data_len = username_len + 27;
+
+ if(session->userauth_list_data) {
+@@ -316,6 +322,11 @@ userauth_password(LIBSSH2_SESSION *session,
+ * 40 = packet_type(1) + username_len(4) + service_len(4) +
+ * service(14)"ssh-connection" + method_len(4) + method(8)"password" +
+ * chgpwdbool(1) + password_len(4) */
++ if(username_len > UINT32_MAX - 40) {
++ return _libssh2_error(session, LIBSSH2_ERROR_PROTO,
++ "username_len out of bounds");
++ }
++
+ session->userauth_pswd_data_len = username_len + 40;
+
+ session->userauth_pswd_data0 =
+@@ -456,7 +467,7 @@ userauth_password(LIBSSH2_SESSION *session,
+ }
+
+ /* basic data_len + newpw_len(4) */
+- if(username_len + password_len + 44 <= UINT_MAX) {
++ if(username_len <= UINT32_MAX - password_len - 44) {
+ session->userauth_pswd_data_len =
+ username_len + password_len + 44;
+ s = session->userauth_pswd_data =
diff --git a/recipes/incoming/bob-nvim.toml b/recipes/incoming/bob-nvim.toml
new file mode 100644
index 00000000..c4a0fd0e
--- /dev/null
+++ b/recipes/incoming/bob-nvim.toml
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+# compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name = "bob"
+version = "4.1.7"
+
+[source]
+repo = "https://github.com/MordechaiHadad/bob"
+commit = "4b385e5016bb59847dbf0111a1ac6be802101c5b"
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = ["--bin", "bob"]
+
+[build.phases]
+install = "mkdir -p /out/usr/bin && cp target/release/bob /out/usr/bin/bob"
diff --git a/recipes/incoming/bzip2-1.0.2-progress.patch b/recipes/incoming/bzip2-1.0.2-progress.patch
new file mode 100644
index 00000000..2f389cfa
--- /dev/null
+++ b/recipes/incoming/bzip2-1.0.2-progress.patch
@@ -0,0 +1,175 @@
+Ripped from Mandrake.
+
+http://bugs.gentoo.org/show_bug.cgi?id=82192
+
+--- bzip2-1.0.2.org/bzip2.1
++++ bzip2-1.0.2/bzip2.1
+@@ -235,6 +235,10 @@
+ Suppress non-essential warning messages. Messages pertaining to
+ I/O errors and other critical events will not be suppressed.
+ .TP
++.B \-p --show-progress
++Show percentage of input-file done and while compressing show the percentage
++of the original file the new file is.
++.TP
+ .B \-v --verbose
+ Verbose mode -- show the compression ratio for each file processed.
+ Further \-v's increase the verbosity level, spewing out lots of
+--- bzip2-1.0.2.org/bzip2.c
++++ bzip2-1.0.2/bzip2.c
+@@ -145,6 +145,7 @@
+ #include <signal.h>
+ #include <math.h>
+ #include <errno.h>
++#include <time.h>
+ #include <ctype.h>
+ #include "bzlib.h"
+
+@@ -301,6 +302,7 @@
+ Char progNameReally[FILE_NAME_LEN];
+ FILE *outputHandleJustInCase;
+ Int32 workFactor;
++Char showProgress;
+
+ static void panic ( Char* ) NORETURN;
+ static void ioError ( void ) NORETURN;
+@@ -425,6 +427,12 @@
+ UInt32 nbytes_in_lo32, nbytes_in_hi32;
+ UInt32 nbytes_out_lo32, nbytes_out_hi32;
+ Int32 bzerr, bzerr_dummy, ret;
++ double fileSize = 0; /* initialized to make the compiler stop crying */
++ /* double because big files might otherwhise give
++ * overflows. not long long since not all compilers
++ * support that one
++ */
++ time_t startTime, currentTime;
+
+ SET_BINARY_MODE(stream);
+ SET_BINARY_MODE(zStream);
+@@ -432,12 +440,21 @@
+ if (ferror(stream)) goto errhandler_io;
+ if (ferror(zStream)) goto errhandler_io;
+
++ if ((srcMode == SM_F2F || srcMode == SM_F2O) && showProgress == True) {
++ (void)fseek(stream, 0, SEEK_END);
++ fileSize = (double)ftell(stream);
++ rewind(stream);
++ if (verbosity >= 1)
++ fprintf(stderr, "Input-file size: %ld\n", (long)fileSize);
++ }
++
+ bzf = BZ2_bzWriteOpen ( &bzerr, zStream,
+ blockSize100k, verbosity, workFactor );
+ if (bzerr != BZ_OK) goto errhandler;
+
+ if (verbosity >= 2) fprintf ( stderr, "\n" );
+
++ time(&startTime);
+ while (True) {
+
+ if (myfeof(stream)) break;
+@@ -446,13 +463,32 @@
+ if (nIbuf > 0) BZ2_bzWrite ( &bzerr, bzf, (void*)ibuf, nIbuf );
+ if (bzerr != BZ_OK) goto errhandler;
+
++ if ((srcMode == SM_F2F || srcMode == SM_F2O) && showProgress == True)
++ {
++ time(¤tTime);
++
++ if ((currentTime - startTime) > 1) { /* show progress every 2 seconds */
++ double curInPos = (double)ftell(stream);
++ double curOutPos = (double)ftell(zStream);
++
++ startTime = currentTime;
++
++ fprintf(stderr, "%.2f%% done", (curInPos * 100.0) / fileSize);
++ if (srcMode == SM_F2F)
++ {
++ fprintf(stderr, ", new size: %.2f%%", (curOutPos * 100.0) / curInPos);
++ }
++
++ fprintf(stderr, " \r");
++ }
++ }
+ }
+
+ BZ2_bzWriteClose64 ( &bzerr, bzf, 0,
+ &nbytes_in_lo32, &nbytes_in_hi32,
+ &nbytes_out_lo32, &nbytes_out_hi32 );
+ if (bzerr != BZ_OK) goto errhandler;
+-
++
+ if (ferror(zStream)) goto errhandler_io;
+ ret = fflush ( zStream );
+ if (ret == EOF) goto errhandler_io;
+@@ -526,6 +562,8 @@
+ UChar unused[BZ_MAX_UNUSED];
+ Int32 nUnused;
+ UChar* unusedTmp;
++ double fileSize = 0; /* initialized to make the compiler stop crying */
++ time_t startTime, currentTime;
+
+ nUnused = 0;
+ streamNo = 0;
+@@ -533,9 +571,19 @@
+ SET_BINARY_MODE(stream);
+ SET_BINARY_MODE(zStream);
+
++ if ((srcMode == SM_F2F || srcMode == SM_F2O) && showProgress == True) {
++ long dummy = ftell(zStream);
++ (void)fseek(zStream, 0, SEEK_END);
++ fileSize = (double)ftell(zStream);
++ (void)fseek(zStream, dummy, SEEK_SET);
++ if (verbosity >= 1)
++ fprintf(stderr, "Input-file size: %ld\n", (long)fileSize);
++ }
++
+ if (ferror(stream)) goto errhandler_io;
+ if (ferror(zStream)) goto errhandler_io;
+
++ time(&startTime);
+ while (True) {
+
+ bzf = BZ2_bzReadOpen (
+@@ -551,6 +599,17 @@
+ if ((bzerr == BZ_OK || bzerr == BZ_STREAM_END) && nread > 0)
+ fwrite ( obuf, sizeof(UChar), nread, stream );
+ if (ferror(stream)) goto errhandler_io;
++
++ if ((srcMode == SM_F2F || srcMode == SM_F2O) && showProgress == True) {
++ time(¤tTime);
++ if ((currentTime - startTime) >= 2)
++ {
++ double curInPos = (double)ftell(zStream);
++ startTime = currentTime;
++
++ fprintf(stderr, "%.2f%% done\r", (curInPos * 100.0) / fileSize);
++ }
++ }
+ }
+ if (bzerr != BZ_STREAM_END) goto errhandler;
+
+@@ -1872,6 +1931,7 @@
+ deleteOutputOnInterrupt = False;
+ exitValue = 0;
+ i = j = 0; /* avoid bogus warning from egcs-1.1.X */
++ showProgress = False;
+
+ /*-- Set up signal handlers for mem access errors --*/
+ signal (SIGSEGV, mySIGSEGVorSIGBUScatcher);
+@@ -1949,6 +2009,7 @@
+ case 'k': keepInputFiles = True; break;
+ case 's': smallMode = True; break;
+ case 'q': noisy = False; break;
++ case 'p': showProgress = True; break;
+ case '1': blockSize100k = 1; break;
+ case '2': blockSize100k = 2; break;
+ case '3': blockSize100k = 3; break;
+@@ -1985,6 +2046,7 @@
+ if (ISFLAG("--keep")) keepInputFiles = True; else
+ if (ISFLAG("--small")) smallMode = True; else
+ if (ISFLAG("--quiet")) noisy = False; else
++ if (ISFLAG("--show-progress")) showProgress = True; else
+ if (ISFLAG("--version")) license(); else
+ if (ISFLAG("--license")) license(); else
+ if (ISFLAG("--exponential")) workFactor = 1; else
diff --git a/recipes/incoming/bzip2-1.0.3-no-test.patch b/recipes/incoming/bzip2-1.0.3-no-test.patch
new file mode 100644
index 00000000..fc876d50
--- /dev/null
+++ b/recipes/incoming/bzip2-1.0.3-no-test.patch
@@ -0,0 +1,9 @@
+--- ./Makefile
++++ ./Makefile
+@@ -23,5 +23,5 @@
+ bzlib.o
+
+-all: libbz2.a bzip2 bzip2recover test
++all: libbz2.a bzip2 bzip2recover
+
+ bzip2: libbz2.a bzip2.o
diff --git a/recipes/incoming/bzip2-1.0.4-makefile-CFLAGS.patch b/recipes/incoming/bzip2-1.0.4-makefile-CFLAGS.patch
new file mode 100644
index 00000000..6acdc28a
--- /dev/null
+++ b/recipes/incoming/bzip2-1.0.4-makefile-CFLAGS.patch
@@ -0,0 +1,25 @@
+--- ./Makefile
++++ ./Makefile
+@@ -18,10 +18,9 @@
+ CC=gcc
+ AR=ar
+ RANLIB=ranlib
+-LDFLAGS=
+
+ BIGFILES=-D_FILE_OFFSET_BITS=64
+-CFLAGS=-Wall -Winline -O2 -g $(BIGFILES)
++CFLAGS+=-Wall -Winline $(BIGFILES) $(CPPFLAGS) -O2
+
+ # Where you want it installed when you do 'make install'
+ PREFIX=/usr/local
+--- ./Makefile-libbz2_so
++++ ./Makefile-libbz2_so
+@@ -24,7 +24,7 @@
+ SHELL=/bin/sh
+ CC=gcc
+ BIGFILES=-D_FILE_OFFSET_BITS=64
+-CFLAGS=-fpic -fPIC -Wall -Winline -O2 -g $(BIGFILES)
++CFLAGS+=-fpic -fPIC -Wall -Winline $(BIGFILES) $(CPPFLAGS) -O2
+
+ OBJS= blocksort.o \
+ huffman.o \
diff --git a/recipes/incoming/bzip2-1.0.4-man-links.patch b/recipes/incoming/bzip2-1.0.4-man-links.patch
new file mode 100644
index 00000000..2427d6a7
--- /dev/null
+++ b/recipes/incoming/bzip2-1.0.4-man-links.patch
@@ -0,0 +1,12 @@
+http://bugs.gentoo.org/172986
+
+--- bzip2-1.0.4/Makefile
++++ bzip2-1.0.4/Makefile
+@@ -85,4 +85,7 @@
+ cp -f bzip2.1 $(PREFIX)/share/man/man1
+ chmod a+r $(PREFIX)/share/man/man1/bzip2.1
++ ln -s bzip2.1 $(PREFIX)/share/man/man1/bunzip2.1
++ ln -s bzip2.1 $(PREFIX)/share/man/man1/bzcat.1
++ ln -s bzip2.1 $(PREFIX)/share/man/man1/bzip2recover.1
+ cp -f bzlib.h $(PREFIX)/include
+ chmod a+r $(PREFIX)/include/bzlib.h
diff --git a/recipes/incoming/dotter.toml b/recipes/incoming/dotter.toml
new file mode 100644
index 00000000..b6e1272c
--- /dev/null
+++ b/recipes/incoming/dotter.toml
@@ -0,0 +1,22 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+# compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name = "dotter"
+version = "0.13.4"
+
+[source]
+repo = "https://github.com/SuperCuber/dotter"
+commit = "1829da92a0630b2b8e246f37598877b1c3ee1f89"
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = ["--bin", "dotter"]
+
+[build.phases]
+install = "mkdir -p /out/usr/bin && cp target/release/dotter /out/usr/bin/dotter"
+
+# buildInputs de nix (NO deps de hammer — cargo vendorea; backend Rust por
+# defecto). Si algún sys-crate C falla, adaptá per-paquete (patch/feature): which
diff --git a/recipes/incoming/felix.toml b/recipes/incoming/felix.toml
new file mode 100644
index 00000000..0049cc7f
--- /dev/null
+++ b/recipes/incoming/felix.toml
@@ -0,0 +1,16 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+# compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name = "apache-felix"
+version = "7.0.5"
+
+[source]
+tarball = "https://dlcdn.apache.org/felix/org.apache.felix.main.distribution-7.0.5.tar.gz"
+sha256 = "37d99b908ccc90c57644b38dbf5e448a8b09c4c53d88426fc0f5846ae3c811ef"
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
diff --git a/recipes/incoming/fix-riscv64-test.patch b/recipes/incoming/fix-riscv64-test.patch
new file mode 100644
index 00000000..18ba4809
--- /dev/null
+++ b/recipes/incoming/fix-riscv64-test.patch
@@ -0,0 +1,80 @@
+From 5805151cffccc087942b9dd8d7ac10ca5f4f80a8 Mon Sep 17 00:00:00 2001
+From: lapla <me@lapla.dev>
+Date: Tue, 20 Jan 2026 18:47:13 +0900
+Subject: [PATCH] fix: Resolve weak undefined symbols to zero in read-only
+ sections (#1474)
+
+#1472
+
+When a weak undefined symbol is referenced from a read-only section via
+an absolute relocation, the resolved value should be 0, not the PLT
+entry address.
+---
+ libwild/src/elf_writer.rs | 6 ++++++
+ wild/tests/integration_tests.rs | 3 ++-
+ wild/tests/sources/undefined-weak-sym.c | 25 +++++++++++++++++++++++++
+ 3 files changed, 33 insertions(+), 1 deletion(-)
+ create mode 100644 wild/tests/sources/undefined-weak-sym.c
+
+diff --git a/libwild/src/elf_writer.rs b/libwild/src/elf_writer.rs
+index 2923bc9e9..026636f0d 100644
+--- a/libwild/src/elf_writer.rs
++++ b/libwild/src/elf_writer.rs
+@@ -2574,6 +2574,12 @@ fn write_absolute_relocation<A: Arch>(
+ &layout.merged_strings,
+ &layout.merged_string_start_addresses,
+ )
++ } else if resolution.flags.is_dynamic()
++ && resolution.flags.is_absolute()
++ && !section_info.is_writable
++ {
++ // Weak undefined symbol referenced from a read-only section. Fill in as zero.
++ Ok(0)
+ } else if resolution.flags.is_interposable() && section_info.is_writable {
+ table_writer.write_dynamic_symbol_relocation::<A>(
+ place,
+diff --git a/wild/tests/integration_tests.rs b/wild/tests/integration_tests.rs
+index bc4730412..9dd611ba7 100644
+--- a/wild/tests/integration_tests.rs
++++ b/wild/tests/integration_tests.rs
+@@ -3320,7 +3320,8 @@ fn integration_test(
+ "wrap-real-only.c",
+ "ifunc-alias.c",
+ "ifunc-address-equality.c",
+- "stack-size.c"
++ "stack-size.c",
++ "undefined-weak-sym.c"
+ )]
+ program_name: &'static str,
+ #[allow(unused_variables)] setup_symlink: (),
+diff --git a/wild/tests/sources/undefined-weak-sym.c b/wild/tests/sources/undefined-weak-sym.c
+new file mode 100644
+index 000000000..b029ca7e2
+--- /dev/null
++++ b/wild/tests/sources/undefined-weak-sym.c
+@@ -0,0 +1,25 @@
++// A test for #1472.
++
++//#Object:runtime.c
++//#CompArgs:-fno-PIC
++//#Mode:dynamic
++//#Shared:force-dynamic-linking.c
++//#DiffIgnore:section.got
++//#DiffIgnore:.dynamic.DT_NEEDED
++//#DiffIgnore:.dynamic.DT_RELA
++//#DiffIgnore:.dynamic.DT_RELAENT
++//#DiffIgnore:rel.undefined-weak.dynamic.R_X86_64_GLOB_DAT
++
++#include "runtime.h"
++
++#define WEAK __attribute__((weak))
++
++int WEAK foo(void);
++
++void _start(void) {
++ runtime_init();
++ if (foo) {
++ exit_syscall(foo());
++ }
++ exit_syscall(42);
++}
diff --git a/recipes/incoming/libpng-fix-arm-neon.patch b/recipes/incoming/libpng-fix-arm-neon.patch
new file mode 100644
index 00000000..099083fd
--- /dev/null
+++ b/recipes/incoming/libpng-fix-arm-neon.patch
@@ -0,0 +1,39 @@
+diff --git a/configure.ac b/configure.ac
+index 7b6d5b9..d02e16d 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -357,17 +357,21 @@ AC_ARG_ENABLE([arm-neon],
+ [case "$enableval" in
+ no|off)
+ # disable the default enabling on __ARM_NEON__ systems:
++ AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support])
+ AC_DEFINE([PNG_ARM_NEON_OPT], [0],
+ [Disable ARM Neon optimizations])
+ # Prevent inclusion of the assembler files below:
+ enable_arm_neon=no ;;
+ check)
++ AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support])
+ AC_DEFINE([PNG_ARM_NEON_CHECK_SUPPORTED], [],
+ [Check for ARM Neon support at run-time]);;
+ api)
++ AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support])
+ AC_DEFINE([PNG_ARM_NEON_API_SUPPORTED], [],
+ [Turn on ARM Neon optimizations at run-time]);;
+ yes|on)
++ AC_DEFINE([PNG_ARM_NEON], [], [ARM NEON support])
+ AC_DEFINE([PNG_ARM_NEON_OPT], [2],
+ [Enable ARM Neon optimizations])
+ AC_MSG_WARN([--enable-arm-neon: please specify 'check' or 'api', if]
+diff --git a/pngpriv.h b/pngpriv.h
+index 2e426cf..fb521cf 100644
+--- a/pngpriv.h
++++ b/pngpriv.h
+@@ -127,7 +127,7 @@
+ * associated assembler code, pass --enable-arm-neon=no to configure
+ * or put -DPNG_ARM_NEON_OPT=0 in CPPFLAGS.
+ */
+-# if (defined(__ARM_NEON__) || defined(__ARM_NEON)) && \
++# if defined(PNG_ARM_NEON) && (defined(__ARM_NEON__) || defined(__ARM_NEON)) && \
+ defined(PNG_ALIGNED_MEMORY_SUPPORTED)
+ # define PNG_ARM_NEON_OPT 2
+ # else
diff --git a/recipes/incoming/rbw.toml b/recipes/incoming/rbw.toml
new file mode 100644
index 00000000..88b1b83c
--- /dev/null
+++ b/recipes/incoming/rbw.toml
@@ -0,0 +1,49 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name = "rbw"
+version = "1.15.0"
+
+[source]
+tarball = "https://git.tozt.net/rbw/snapshot/rbw-1.15.0.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "8ec109c62ced929db36aca8b828d01c1fe46ca5b6a7970fdf9c1e4566fa8c7873c076fc8e0500ba3afbe6d1fd91d0e84177eac452a7fb9ec86451b8b2e08d2d6"
+sha256 = "660cfa4c727711665bef060046c28dd3924ca1e490fdc058d90d35372b2d2cf6"
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+# p521 fails with stack overflow unless stack size is increased
+ export RUST_MIN_STACK=$((16 * 1024 * 1024))
+ cargo auditable build --frozen --release
+
+ target/release/rbw gen-completions bash > rbw.bash
+ target/release/rbw gen-completions fish > rbw.fish
+ target/release/rbw gen-completions zsh > _rbw
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -Dm755 target/release/rbw "/out"/usr/bin/rbw
+ install -Dm755 target/release/rbw-agent "/out"/usr/bin/rbw-agent
+
+ install -Dm644 rbw.bash \
+ "/out"/usr/share/bash-completion/completions/rbw
+ install -Dm644 rbw.fish \
+ "/out"/usr/share/fish/vendor_completions.d/rbw.fish
+ install -Dm644 _rbw \
+ "/out"/usr/share/zsh/site-functions/_rbw
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): pinentry
diff --git a/recipes/incoming/rust-script.toml b/recipes/incoming/rust-script.toml
new file mode 100644
index 00000000..daf60e16
--- /dev/null
+++ b/recipes/incoming/rust-script.toml
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+# compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name = "rust-script"
+version = "0.36.0"
+
+[source]
+repo = "https://github.com/fornwall/rust-script"
+commit = "99d2c790b303c1d75de5cd90499800283e4b9681"
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = ["--bin", "rust-script"]
+
+[build.phases]
+install = "mkdir -p /out/usr/bin && cp target/release/rust-script /out/usr/bin/rust-script"
diff --git a/recipes/incoming/saneso.patch b/recipes/incoming/saneso.patch
new file mode 100644
index 00000000..529a0c20
--- /dev/null
+++ b/recipes/incoming/saneso.patch
@@ -0,0 +1,23 @@
+diff --git a/Makefile-libbz2_so b/Makefile-libbz2_so
+index fb0f230..2c95a3a 100644
+--- a/Makefile-libbz2_so
++++ b/Makefile-libbz2_so
+@@ -35,13 +35,13 @@ OBJS= blocksort.o \
+ bzlib.o
+
+ all: $(OBJS)
+- $(CC) -shared -Wl,-soname -Wl,libbz2.so.1.0 -o libbz2.so.1.0.8 $(OBJS)
++ $(CC) -shared -Wl,-soname -Wl,libbz2.so.1 -o libbz2.so.1.0.8 $(OBJS)
+ $(CC) $(CFLAGS) -o bzip2-shared bzip2.c libbz2.so.1.0.8
+- rm -f libbz2.so.1.0
+- ln -s libbz2.so.1.0.8 libbz2.so.1.0
++ rm -f libbz2.so.1
++ ln -s libbz2.so.1.0.8 libbz2.so.1
+
+ clean:
+- rm -f $(OBJS) bzip2.o libbz2.so.1.0.8 libbz2.so.1.0 bzip2-shared
++ rm -f $(OBJS) bzip2.o libbz2.so.1.0.8 libbz2.so.1 bzip2-shared
+
+ blocksort.o: blocksort.c
+ $(CC) $(CFLAGS) -c blocksort.c
+
diff --git a/recipes/incoming/speedtest-rs.toml b/recipes/incoming/speedtest-rs.toml
new file mode 100644
index 00000000..0489d75e
--- /dev/null
+++ b/recipes/incoming/speedtest-rs.toml
@@ -0,0 +1,22 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+# compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name = "speedtest-rs"
+version = "0.2.0"
+
+[source]
+repo = "https://github.com/nelsonjchen/speedtest-rs"
+commit = "3e0c5dbf8613b0a6de196753f2b35f4dae4bd0fb"
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = ["--bin", "speedtest-rs"]
+
+[build.phases]
+install = "mkdir -p /out/usr/bin && cp target/release/speedtest-rs /out/usr/bin/speedtest-rs"
+
+# buildInputs de nix (NO deps de hammer — cargo vendorea; backend Rust por
+# defecto). Si algún sys-crate C falla, adaptá per-paquete (patch/feature): openssl
diff --git a/recipes/incoming/toolong.toml b/recipes/incoming/toolong.toml
new file mode 100644
index 00000000..79ae34c8
--- /dev/null
+++ b/recipes/incoming/toolong.toml
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+# compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name = "toolong"
+version = "1.5.0"
+
+[source]
+repo = "https://github.com/Textualize/toolong"
+commit = "5aa22ee878026f46d4d265905c4e1df4d37842ae"
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[deps]
+build = ["python3", "poetry-core"]
diff --git a/recipes/incoming/tuckr.toml b/recipes/incoming/tuckr.toml
new file mode 100644
index 00000000..6539c01a
--- /dev/null
+++ b/recipes/incoming/tuckr.toml
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+# compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name = "tuckr"
+version = "0.13.1"
+
+[source]
+repo = "https://github.com/RaphGL/Tuckr"
+commit = "352627208663ee01c04c37a4cb23cbc4127506f6"
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = ["--bin", "tuckr"]
+
+[build.phases]
+install = "mkdir -p /out/usr/bin && cp target/release/tuckr /out/usr/bin/tuckr"
diff --git a/recipes/incoming/wild.toml b/recipes/incoming/wild.toml
new file mode 100644
index 00000000..d0206a65
--- /dev/null
+++ b/recipes/incoming/wild.toml
@@ -0,0 +1,39 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name = "wild"
+version = "0.8.0"
+
+[source]
+tarball = "https://github.com/davidlattimore/wild/archive/refs/tags/0.8.0.tar.gz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "dc88b41cdfbbdbff69c4dedf121e30dc5f3543bfab0eb53ebcc35590a200582d2157f752effd0750d9862addd92252dc1e61e60b545a5bb9dcff4a59adcd9217"
+sha256 = "3828028f41c668caf02aa9ffc4dc3bd1a33b4957eb66a7aa015f7c92e4f064ce"
+patches = ["fix-riscv64-test.patch"]
+
+[build]
+compiler = "zig-cc"
+target = "x86_64-linux-musl"
+link = "static"
+flags = []
+
+[build.phases]
+# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
+compile = '''
+_abuild_phase() {
+# https://github.com/davidlattimore/wild/blob/main/PACKAGING.md
+ cargo auditable build --frozen --features mimalloc --profile dist
+}
+_abuild_phase
+'''
+# de package() de Alpine (traducido $pkgdir→/out):
+install = '''
+_abuild_phase() {
+install -Dm 755 target/dist/wild "/out"/usr/bin/wild
+
+ install -Dm 644 LICENSE-APACHE LICENSE-MIT -t "/out"/usr/share/licenses/"wild"/
+}
+_abuild_phase
+'''
+
+# depends de runtime de Alpine (NO build-deps): clang
diff --git a/tandas/fuel-4.txt b/tandas/fuel-4.txt
new file mode 100644
index 00000000..5c943009
--- /dev/null
+++ b/tandas/fuel-4.txt
@@ -0,0 +1,31 @@
+# fuel-4 — buffer para el VPS (2026-06-25). Candidatos frescos.
+ffsend
+rbw
+tuckr
+dotter
+rotz
+comtrya
+bob-nvim
+wild
+rust-script
+rmesg
+djin
+punktf
+speedtest-rs
+gptui
+mdcat
+zr
+hgrep
+ast-grep
+gitui
+dua-cli
+silver
+felix
+nu-shell
+zoxide
+choose
+cargo-update
+cargo-deny
+cargo-watch
+cargo-llvm-cov
+toolong