[ADD] the closure pacman's resolver named

Everything in stage 1 until now was added because a BUILD stopped. These were
added because test-chroot.sh ran the resolver with --nodeps OFF -- the check
the whole bootstrap skips -- and it listed exactly what the repository owed.
Nothing here is speculative.

Thirty-five packages, then five rounds of failures that each got further than
the last: 12 failed, then 7, then 4, then 0. The pattern was almost always a
host tool nobody had declared, and the fix for one uncovered the next --
ducktype then yelp-build, ss then lmdb, autoconf-archive then cmocka.

Two corrections worth keeping. libargon2-dev was the wrong package: openldap
passes --with-argon2=libsodium, so the error named argon2 and the answer was
sodium. And apt-cache reported NONE for all eight candidates because this host
answers `Candidat :`, not `Candidate:` -- the same locale trap that had broken
util-linux hours earlier, met again inside the script written to verify its
fix. Query apt under LC_ALL=C.

--- FR ---

Tout ce qui composait l'étage 1 jusqu'ici avait été ajouté parce qu'une
COMPILATION s'arrêtait. Ceux-ci l'ont été parce que test-chroot.sh a lancé le
résolveur avec --nodeps DÉSACTIVÉ — le contrôle que tout l'amorçage saute — et
qu'il a listé exactement ce que le dépôt devait. Rien ici n'est spéculatif.

Trente-cinq paquets, puis cinq tours d'échecs allant chacun plus loin que le
précédent : 12, puis 7, puis 4, puis 0. Le motif était presque toujours un
outil hôte que personne n'avait déclaré, et corriger l'un dévoilait le
suivant — ducktype puis yelp-build, ss puis lmdb, autoconf-archive puis
cmocka.

Deux corrections à garder. libargon2-dev était le mauvais paquet : openldap
passe --with-argon2=libsodium, l'erreur nommait donc argon2 quand la réponse
était sodium. Et apt-cache annonçait NONE pour les huit candidats parce que
cet hôte répond « Candidat : » et non « Candidate: » — le piège de locale même
qui avait cassé util-linux quelques heures plus tôt, retrouvé dans le script
écrit pour en vérifier le correctif. Interroger apt sous LC_ALL=C.

Assisted-by: Claude Opus 5

scripts/bootstrap-pacman.sh

@@ -61,6 +61,35 @@ install_host_deps() {
     #   libxml2   ICU, readline, and the doc toolchain.
     #   systemd   the widest surface of anything in stage 1; every one of
     #             these was checked against a real meson configure.
+    #
+    # The last two lines are the closure round, and every one of them was
+    # named by a build that stopped: popt by cryptsetup, scdoc by kmod,
+    # libgpg-error by libgcrypt, Cython by libseccomp, tcl by sqlite, argon2
+    # by openldap, autoconf-archive by tpm2-tss and ducktype by dbus.
+    #
+    # A note on checking these. `apt-cache policy` was reporting NONE for all
+    # eight, which looked like eight wrong names. This host answers in French:
+    # the field is `Candidat :`, not `Candidate:`, so a grep for the English
+    # word found nothing. Exactly the trap that broke util-linux's build --
+    # met again while verifying the fix for it. Query apt under LC_ALL=C.
+    #
+    # The last line is the round after that, and each fix uncovered the next:
+    # yelp-build by dbus (once ducktype was found), lmdb by krb5 (once the ss
+    # flag was gone), cmocka by tpm2-tss (once autoconf-archive fixed its
+    # macros). A build that gets further is progress even when it still fails.
+    #
+    # libsodium-dev replaced libargon2-dev, which was a wrong guess: openldap
+    # passes `--with-argon2=libsodium`, so argon2.h was never what it wanted.
+    # The error named argon2 and the answer was sodium -- the message pointing
+    # at the wrong library, one more time.
+    #
+    # verto by krb5 and uthash by tpm2-tss came the round after, each once its
+    # predecessor was satisfied. Three rounds of this taught one thing worth
+    # writing down: when a package stops on a missing TOOL three times in a
+    # row, stop installing tools. dbus wanted ducktype, then yelp-build, then
+    # qhelpgenerator -- and the third needs Qt, so the chain had no end. Its
+    # doc features are pinned off in a hook instead. A single missing library
+    # is a host dep; a queue of them is a feature that should be disabled.
     sudo apt-get -o DPkg::Lock::Timeout=600 install -y -qq \
         meson ninja-build pkg-config gettext \
         libarchive-dev libcurl4-openssl-dev libgpgme-dev libssl-dev \
@@ -83,7 +112,9 @@ install_host_deps() {
         libpwquality-dev libxkbcommon-dev libdbus-1-dev libqrencode-dev \
         libfido2-dev libtss2-dev libmicrohttpd-dev libaudit-dev \
         libcryptsetup-dev libgcrypt20-dev libgnutls28-dev libpam0g-dev \
-        python3-pefile
+        libpopt-dev scdoc libgpg-error-dev cython3 tcl-dev libsodium-dev \
+        autoconf-archive ducktype \
+        yelp-tools liblmdb-dev libcmocka-dev libverto-dev uthash-dev
     install_host_shims
 }
 

scripts/build-stage1.sh

@@ -61,6 +61,38 @@ STAGE1_PACKAGES=(
     # never contain. The answer is --without-selinux per package, which is
     # what Arch's own build chroot gets for free by not having the header.
     pam brotli libxml2 systemd pacman-mirrorlist libmakepkg-dropins
+    # The closure, named by pacman's own resolver rather than guessed.
+    #
+    # Everything above was added because a BUILD stopped. These were added
+    # because scripts/test-chroot.sh ran `pacman -Syp` with --nodeps OFF --
+    # the check the whole bootstrap skips -- and the resolver listed exactly
+    # what the repository still owes. Nothing here is speculative.
+    #
+    # It is the MINIMAL closure, and two measurements shaped it. Dropping the
+    # python-brotli sub-package took the list from 70 unresolved names to 47
+    # and removed `python` outright, with libffi, mpdecimal and gdbm behind
+    # it. Dropping systemd-ukify and systemd-tests removed five more python
+    # packages, and ukify cannot run on s390x at all. Both are recorded in
+    # TODO.md rather than left implicit.
+    #
+    # An audit of the remaining names against the ARTEFACTS found two that
+    # were declared and never linked: guile by make, and libisl.so by gcc.
+    # Both get their declaration removed, because it should describe the
+    # binary we shipped.
+    #
+    # Building isl instead was the first plan, and it is recorded here because
+    # the reason it failed is the kind that wastes an afternoon: the Arch
+    # packaging repo for isl was last touched in 2017 and its only source URL
+    # is isl.gforge.inria.fr, which died with INRIA's GForge. There is nothing
+    # to build. That flipped the decision -- not a change of mind, new
+    # evidence.
+    #
+    # These will pull their own dependencies. That is expected: the resolver
+    # will name the next round as precisely as it named this one.
+    audit ca-certificates cryptsetup dbus elfutils gettext gnutls hwdata
+    icu jansson kbd kmod krb5 libcap-ng libgcrypt libidn2 libksba
+    libmpc libnsl libseccomp libssh2 libtirpc libunistring libusb libxcrypt
+    nettle npth openldap pambase pcre2 perl pinentry sqlite tpm2-tss
     # And finally the package manager itself, built as an Arch package.
     pacman
 )