Cross-compiled on a Mac, installed with apt

The rootless bootstrap on these devices is Procursus, which is itself a macOS-hosted cross-compile system that already ships a full X11 stack prebuilt for iphoneos-arm64. The approach is to stand on that rather than rebuild it: use the toolchain, and spend the effort on the parts Procursus does not provide, starting with the native display server.

Most upstream changes are kept as quilt-style patch series next to the port that needs them, applied by the recipe, so a rebuild reproduces them. It is not universal: the KDE and Qt tracks are still moving fast enough that some of their changes live in build scripts instead of in a series, and converting those is on hold until that work settles.

The pipeline runs in Docker, but "runs in Docker" is not the same as one button. There is no top-level orchestrator: each build driver is invoked by hand with the docker run spelled out in its header, several assume a warm named volume left by an earlier driver, and a few stages are not in Docker at all. ANGLE is built on the Mac side, and the GNOME introspection typelibs are generated on the iPad, which makes the device a build stage rather than just a test target.

A cross-compiled binary is not runnable on iOS until it is fakesigned with ldid, and what it is allowed to do depends on the entitlements attached at that moment. Talking to the GPU, importing an IOSurface from another process and inspecting other processes are all separate capabilities, so packages are re-signed at publish time by classifying each Mach-O into a profile instead of giving every binary the same set.

There is a sharp edge here: the Homebrew build of ldid emits DER entitlements and the one inside the container does not, and modern iOS wants DER for exactly the IOKit and IOSurface capabilities this stack needs. The publish step refuses a binary whose entitlement slot is missing, so nothing ships that would have failed at launch.

Separately, every deb gets a MinimumOSVersion stamped from its real dependency closure, which is why the flavors advertise different iOS floors. That pass has to run last, after the package set stops changing.

Packages are published to a self-contained apt repo, the same kind every jailbreak uses: a signed index, generated depictions, and the payloads themselves offloaded to blob storage. There are two of them. A staging repo takes everything first; production is promoted by hand, so the published set can sit behind the tree.

The gate between them exists because of a specific accident. A package that shadowed the bootstrap's OpenSSL with a newer one took out sshd and apt on the device at once, which is a bad day when the device is also a build stage. Publishing now refuses any deb that replaces a Procursus package unless it is a genuine drop-in superset, with per-package waivers that have to be written down. The browser's newer TLS ended up vendored into a private directory for exactly this reason.

Everything is built for the rootless layout and bakes /var/jb into paths, launchers and entitlements. A rootful target is designed and the first pieces are in the tree: build targets come from a descriptor file instead of a hardcoded prefix, and a handful of packages render their payload from templates. Nothing rootful is built or published yet, and the two binary packages that were converted refuse to produce a rootful deb until a rootful server has been built and smoke-tested on hardware.