diff --git a/Makefile b/Makefile
index 860403189..86b31efaf 100644
--- a/Makefile
+++ b/Makefile
@@ -457,6 +457,19 @@ define define_module =
     # XXX: "git clean -dffx" is a hack for coreboot during commit switching, need
 	#      module-specific cleanup action to get rid of it.
     $(build)/$($1_base_dir)/.canary: FORCE
+	if [ -e "$$@" ] && [ -e "$(build)/$($1_base_dir)/.patched" ]; then \
+		if [ -f patches/$($1_patch_name).patch ] && [ patches/$($1_patch_name).patch -nt "$$@" ]; then \
+			echo "INFO: Patch file modified, invalidating .canary to trigger full rebuild" && \
+			echo "INVALIDATED: patches modified" > "$$@" && \
+			rm -f "$(build)/$($1_base_dir)/.patched" && \
+			rm -rf "$(build)/$($1_base_dir)/$(BOARD)" "$(board_build)"; \
+		elif [ -d patches/$($1_patch_name) ] && [ -n "$$(find patches/$($1_patch_name)/ -name '*.patch' -newer '$$@' -print -quit)" ]; then \
+			echo "INFO: Patch files modified, invalidating .canary to trigger full rebuild" && \
+			echo "INVALIDATED: patches modified" > "$$@" && \
+			rm -f "$(build)/$($1_base_dir)/.patched" && \
+			rm -rf "$(build)/$($1_base_dir)/$(BOARD)" "$(board_build)"; \
+		fi; \
+	fi
 	if [ ! -e "$$@" ] && [ ! -d "$(build)/$($1_base_dir)" ]; then \
 		echo "INFO: .canary file and directory not found. Cloning repository $($1_repo) into $(build)/$($1_base_dir)" && \
 		git clone $($1_repo) "$(build)/$($1_base_dir)" && \
@@ -473,7 +486,7 @@ define define_module =
 		git -C "$(build)/$($1_base_dir)" reset --hard $($1_commit_hash) && \
 		echo "INFO: Cleaning repository directory (including payloads and util/cbmem)" && \
 		git -C "$(build)/$($1_base_dir)" clean -df && \
-		git -C "$(build)/$($1_base_dir)" clean -dffx payloads util/cbmem && \
+		git -C "$(build)/$($1_base_dir)" clean -dffx $(BOARD) payloads util/cbmem && \
 		echo "INFO: Synchronizing submodules" && \
 		git -C "$(build)/$($1_base_dir)" submodule sync && \
 		echo "INFO: Updating submodules (init and checkout)" && \
@@ -682,21 +695,21 @@ endef
 define initrd_bin_add =
 $(initrd_bin_dir)/$(notdir $1): $1
 	$(call do,INSTALL-BIN,$$(<:$(pwd)/%=%),cp -a --remove-destination "$$<" "$$@")
-	@$(CROSS)strip --preserve-dates "$$@" 2>&-; true
+	@$(CROSS)strip --preserve-dates --strip-all "$$@" 2>&-; true
 initrd_bins += $(initrd_bin_dir)/$(notdir $1)
 endef
 
 define initrd_lib_add =
 $(initrd_lib_dir)/$(notdir $1): $1
 	$(call do,INSTALL-LIB,$(1:$(pwd)/%=%),\
-		$(CROSS)strip --preserve-dates -o "$$@" "$$<")
+		$(CROSS)strip --preserve-dates --strip-all -o "$$@" "$$<")
 initrd_libs += $(initrd_lib_dir)/$(notdir $1)
 endef
 
 # Only some modules have binaries that we install
 # Shouldn't this be specified in the module file?
 #bin_modules-$(CONFIG_MUSL) += musl-cross-make
-bin_modules-$(CONFIG_KEXEC) += kexec
+bin_modules-$(CONFIG_KEXEC) += kexec-tools
 bin_modules-$(CONFIG_TPMTOTP) += tpmtotp
 bin_modules-$(CONFIG_PCIUTILS) += pciutils
 bin_modules-$(CONFIG_FLASHROM) += flashrom
@@ -758,9 +771,22 @@ $(COREBOOT_UTIL_DIR)/inteltool/inteltool \
 : $(build)/$(coreboot_base_dir)/.canary musl-cross-make
 	+$(call do,MAKE,$(notdir $@),\
 		$(MAKE) -C "$(dir $@)" $(CROSS_TOOLS) \
+			CC="$(heads_cc) -Wno-unterminated-string-initialization" \
 	)
 
 # superio depends on zlib and pciutils
+
+# TODO_GCC_15_COREBOOT_CBMEM: GCC 15.1.0 compatibility fix for coreboot cbmem utility
+# The coreboot cbmem utility uses -Werror and GCC 15.1.0 generates new warnings 
+# about string initialization that weren't present in earlier versions.
+# Added -Wno-unterminated-string-initialization to suppress these warnings.
+# This should be moved to a proper coreboot module configuration when 
+# modules/coreboot is refactored to use standard module variables like other modules.
+# See: error "initializer-string for array of 'char' truncates NUL terminator"
+# Related modules: modules/coreboot (needs _configure and _target variables)
+# Alternative: Move this to use heads_cc extension or per-module CC override pattern
+#
+
 $(COREBOOT_UTIL_DIR)/superiotool/superiotool: \
 	$(build)/$(zlib_dir)/.build \
 	$(build)/$(pciutils_dir)/.build \
diff --git a/build_OFLAG_inventory.csv b/build_OFLAG_inventory.csv
new file mode 100644
index 000000000..bf64bf0a6
--- /dev/null
+++ b/build_OFLAG_inventory.csv
@@ -0,0 +1,66 @@
+module,arch,classification,sample_compile_line,log_path
+cryptsetup2,ppc64,fixed - pre-configure sed applied; validated V=1 (x86 & ppc64); commit fac65ebc7e,"... -Oz -pthread -MT lib/crypto_backend/argon2/libargon2_la-argon2.lo ...","build/ppc64/log/cryptsetup2.log"
+zlib,x86,fixed - CFLAGS=-Oz applied (verified x86 & ppc64; legacy -O tokens remain in non-built files; TODO: verify arm64,riscv),"... -Oz -D_LARGEFILE64_SOURCE=1 -DHAVE_HIDDEN  -c -o adler32.o adler32.c","build/x86/log/zlib.log"
+zlib,ppc64,fixed - CFLAGS=-Oz applied (verified x86 & ppc64; legacy -O tokens remain in non-built files; TODO: verify arm64,riscv),"... -Oz -D_LARGEFILE64_SOURCE=1 -DHAVE_HIDDEN  -c -o adler32.o adler32.c","build/ppc64/log/zlib.log"
+tpmtotp,x86,fixed - pre-configure sed applied; validated V=1 (x86 & ppc64),"... -Oz -ggdb -Wp,-MMD,./.nv.o.d -Wp,-MT,nv.o -W -Wall -Wextra -std=c99 ... -o nv.o -c nv.c","build/x86/log/tpmtotp.log"
+tpmtotp,ppc64,fixed - pre-configure sed applied; validated V=1 (x86 & ppc64),"... -Oz -ggdb -Wp,-MMD,./.nv.o.d -Wp,-MT,nv.o -W -Wall -Wextra -std=c99 ... -o nv.o -c nv.c","build/ppc64/log/tpmtotp.log"
+npth,x86,fixed - pre-configure sed applied; validated V=1 (x86),"... -g -Oz -MT npth.lo -MD -MP -MF .deps/npth.Tpo -c -o npth.lo npth.c","build/x86/log/npth.log"
+pciutils,x86,mixed - O2:49 / Os:2 / Oz:4 (needs re-check; packaging-time sed applied for some files),"... -Oz -Wall -W -Wno-parentheses -Wstrict-prototypes -Wmissing-prototypes   -c -o lspci.o lspci.c","build/x86/log/pciutils.log"
+kbd,x86,mixed - O2:17 / Oz:87 (total 104); needs follow-up to normalize to -Oz,"... -O2 -D_FORTIFY_SOURCE=2 -Oz -Waggregate-return ... -c -o getfd.o getfd.c","build/x86/log/kbd.log"
+kexec-tools,x86,mixed - Os:40 / O2:10 / Oz:131 (scan totals); needs inspection,"... -Os ... -O2  -mcmodel=large ... -c -o purgatory/sha256.o util_lib/sha256.c","build/x86/log/kexec-tools.log"
+libaio,x86,fixed - pre-configure sed applied; validated V=1 (x86 & ppc64) - compile/link lines show -Oz,"... -g -fomit-frame-pointer -Oz -Wall -I. -fPIC -c struct_offsets.c","build/x86/log/libaio.log"
+libaio,ppc64,fixed - pre-configure sed applied; validated V=1 (x86 & ppc64) - compile/link lines show -Oz,"... -shared -g -fomit-frame-pointer -Oz -Wall -I. -fPIC -o libaio.so.1.0.2 ...","build/ppc64/log/libaio.log"
+tpm2-tss,x86,fixed - packaging-time sed applied; validated V=1 (no -O2 occurrences; -Oz:589),"... -Oz -std=c99 -Wall -Wextra -fstack-protector-all -fpic -fPIC ... -c src/tss2-tcti/tctildr.c","build/x86/log/tpm2-tss.log"
+ musl-cross-make,N/A,AS-IS - buildsystem-related (8550 -O2 occurrences); deferred - not fixing now,"... -O2 ...","build/x86/log/musl-cross-make.log"
+slang,x86,fixed (pre-configure substitution applied),"... -g -Oz -c -o slang.o slang.c","build/x86/log/slang.log"
+slang,ppc64,fixed (pre-configure substitution applied),"... -g -Oz -c -o slang.o slang.c","build/ppc64/log/slang.log"
+popt,ppc64,fixed - pre-configure sed applied; validated V=1 (x86 & ppc64),"... -Oz -g -c -o popt.o popt.c","build/ppc64/log/popt.log"
+linux/coreboot,ppc64,non -Oz flags in subcomponents (O2:808 occurrences in coreboot-talos_2) - HIGH PRIORITY; consider per-board objdir invalidation & targeted pre-configure normalization,"... -O2 ... -c ...","build/ppc64/log/coreboot-talos_2.log"
+newt,x86,OK - no -O2/-O3,,"build/x86/log/newt.log"
+ncurses,x86,OK - no -O2/-O3,,"build/x86/log/ncurses.log"
+bash,,OK - CFLAGS=-Oz applied; Oz occurrences: 844,"... -Oz ...","build/x86/log/bash.log"
+busybox,,OK - no -O2/-O3, ,build/x86/log/busybox.log
+cairo,,OK - no -O2/-O3, ,build/x86/log/cairo.log
+coreboot,,UNKNOWN - no logs,,
+coreboot-blobs,,N/A - placeholder, ,
+cryptsetup,,UNKNOWN,,
+dropbear,x86,fixed - packaging-time sed normalizes -O/Os -> -Oz only; validated V=1 (x86); size regression observed (dropbear: 184,832 -> 241,248; ssh: 176,416 -> 233,048, ≈+56 KiB) — likely due to compiler/toolchain (GCC 15.1.0 vs GCC 9.4.0) or upstream version changes; follow-ups: rebuild with GCC 9.4, symbol/section diffs, or linker-level mitigations,"... -Oz -W -Wall ...","build/x86/dropbear-2025.88/config.log"
+ e2fsprogs,,OK - CFLAGS=-Oz applied; Oz occurrences: 450,"... -Oz ...","build/x86/log/e2fsprogs.log"
+ exfatprogs,,OK - CFLAGS=-Oz applied; Oz occurrences: 68,"... -Oz ...","build/x86/log/exfatprogs.log"
+fbwhiptail,,OK - no -O2/-O3, ,build/x86/log/fbwhiptail.log
+flashprog,,OK - no -O2/-O3, ,build/x86/log/flashprog.log
+flashrom,,UNKNOWN - no logs, ,
+flashtools,,OK - no -O2/-O3, ,build/x86/log/flashtools.log
+frotz,,UNKNOWN - no logs, ,
+gpg,,OK - no -O2/-O3, ,build/x86/log/gpg.log
+gpg2,,OK - CFLAGS=-Oz applied; Oz occurrences: 668 (x86 & ppc64),"... -Oz ...","build/x86/log/gpg2.log"
+hidapi,,OK - no -O2/-O3, ,build/x86/log/hidapi.log
+hotp-verification,,OK - no -O2/-O3, ,build/x86/log/hotp-verification.log
+io386,,OK - no -O2/-O3, ,build/x86/log/io386.log
+ioport,,UNKNOWN - no logs, ,
+json-c,,OK - no -O2/-O3, ,build/x86/log/json-c.log
+libassuan,,OK - no -O2/-O3, ,build/x86/log/libassuan.log
+libgcrypt,,OK - CFLAGS=-Oz applied; Oz occurrences: 1079 (scan across x86/ppc64),"... -Oz ...","build/x86/log/libgcrypt.log"
+libgpg-error,,OK - no -O2/-O3, ,build/x86/log/libgpg-error.log
+libhidapi-libusb,,UNKNOWN - no logs, ,
+libksba,,OK - no -O2/-O3, ,build/x86/log/libksba.log
+libnitrokey,,UNKNOWN - no logs, ,
+libpng,,OK - CFLAGS=-Oz applied; Oz occurrences: 88,"... -Oz ...","build/x86/log/libpng.log"
+libusb,,OK - no -O2/-O3, ,build/x86/log/libusb.log
+libusb-compat,,UNKNOWN - no logs, ,
+linux,,non -Oz flags in subcomponents, ,build/ppc64/log/linux.log
+linuxboot,,UNKNOWN - no logs, ,
+lvm2,,OK - no -O2/-O3, ,build/x86/log/lvm2.log
+mbedtls,,OK - no -O2/-O3, ,build/x86/log/mbedtls.log
+msrtools,,OK - no -O2/-O3, ,build/x86/log/msrtools.log
+nkstorecli,,UNKNOWN - no logs, ,
+openssl,,OK - CFLAGS=-Oz applied; Oz occurrences: 1481,"... -Oz ...","build/x86/log/openssl.log"
+pinentry,,OK - no -O2/-O3, ,build/x86/log/pinentry.log
+pixman,,OK - no -O2/-O3, ,build/x86/log/pixman.log
+powerpc-utils,,OK - no -O2/-O3, ,build/ppc64/log/powerpc-utils.log
+purism-blobs,,N/A - binary blobs, ,
+qrencode,,OK - explicitly set -Oz, ,build/x86/log/qrencode.log
+tpm2-tools,,CONFIRMED - hardcoded -O2 (3 occurrences across logs), ,build/x86/log/tpm2-tools.log
+u-root,,UNKNOWN - no logs, ,
+util-linux,,OK - no -O2/-O3, ,build/x86/log/util-linux.log
+zstd,,OK - no -O2/-O3, ,build/x86/log/zstd.log
diff --git a/build_oflags_summary.csv b/build_oflags_summary.csv
new file mode 100644
index 000000000..89945932b
--- /dev/null
+++ b/build_oflags_summary.csv
@@ -0,0 +1,78 @@
+module,O,Os,O2,O3,Oz,total,examples
+musl-cross-make,0,0,8865,0,0,8865,build/ppc64/log/musl-cross-make.log;build/ppc64/musl-cross-make-e5147dde912478dd32ad42a25003e82d4f5733aa/build/local/powerpc64le-linux-musl/obj_binutils/config.log;build/ppc64/musl-cross-make-e5147dde912478dd32ad42a25003e82d4f5733aa/build/local/powerpc64le-linux-musl/obj_binutils/gas/config.log
+openssl,0,0,0,0,1481,1481,build/x86/log/openssl.log
+libgcrypt,4,0,0,0,1079,1083,build/ppc64/libgcrypt-1.10.1/config.log;build/ppc64/log/libgcrypt.log;build/x86/libgcrypt-1.10.1/config.log
+util-linux,0,0,10,0,845,855,build/ppc64/log/util-linux.log;build/ppc64/util-linux-2.39/config.log;build/x86/util-linux-2.39/config.log
+bash,0,0,0,0,844,844,build/ppc64/log/bash.log;build/ppc64/bash-5.1.16/config.log;build/x86/log/bash.log
+e2fsprogs,0,0,0,0,670,670,build/ppc64/log/e2fsprogs.log;build/ppc64/e2fsprogs-1.47.0/config.log;build/x86/e2fsprogs-1.47.0/config.log
+gpg2,0,0,0,0,668,668,build/ppc64/log/gpg2.log;build/x86/log/gpg2.log
+slang,0,0,0,0,524,524,build/ppc64/slang-2.3.3/config.log;build/ppc64/log/slang.log;build/x86/slang-2.3.3/config.log
+gnupg,0,0,0,0,408,408,build/ppc64/gnupg-2.4.0/config.log;build/x86/gnupg-2.4.0/config.log
+libgpg-error,0,0,0,0,392,392,build/ppc64/log/libgpg-error.log;build/ppc64/libgpg-error-1.46/config.log;build/x86/log/libgpg-error.log
+dropbear,0,0,0,0,327,327,build/ppc64/dropbear-2025.88/config.log;build/ppc64/log/dropbear.log;build/x86/dropbear-2025.88/config.log
+ncurses,0,0,0,0,296,296,build/ppc64/ncurses-6.5/config.log;build/x86/ncurses-6.5/config.log
+libassuan,0,0,0,0,252,252,build/ppc64/libassuan-2.5.5/config.log;build/ppc64/log/libassuan.log;build/x86/libassuan-2.5.5/config.log
+libksba,0,0,0,0,244,244,build/ppc64/log/libksba.log;build/ppc64/libksba-1.6.3/config.log;build/x86/log/libksba.log
+zlib,0,0,0,0,230,230,build/ppc64/log/zlib.log;build/ppc64/zlib-1.2.11/configure.log;build/x86/log/zlib.log
+cryptsetup,0,0,10,0,196,206,build/ppc64/cryptsetup-2.6.1/config.log;build/x86/cryptsetup-2.6.1/config.log
+lvm2,0,0,0,0,202,202,build/ppc64/log/lvm2.log
+kexec-tools,0,40,10,0,131,181,build/ppc64/log/kexec-tools.log;build/ppc64/kexec-tools-e18a71faae081d075c8d3ec559aa68a59295c739/config.log;build/x86/log/kexec-tools.log
+cairo,0,0,4,0,167,171,build/x86/cairo-1.14.12/config.log;build/x86/log/cairo.log
+popt,0,0,0,0,166,166,build/ppc64/log/popt.log;build/ppc64/popt-1.19/config.log;build/x86/log/popt.log
+npth,0,0,0,0,140,140,build/ppc64/log/npth.log;build/ppc64/npth-1.6/config.log;build/x86/log/npth.log
+libpng,0,0,0,0,130,130,build/x86/libpng-1.6.34/config.log;build/x86/log/libpng.log
+libusb,0,0,8,0,102,110,build/ppc64/libusb-1.0.21/config.log;build/ppc64/log/libusb.log;build/x86/libusb-1.0.21/config.log
+newt,0,0,0,0,108,108,build/ppc64/log/newt.log;build/ppc64/newt-0.52.24/config.log;build/x86/newt-0.52.24/config.log
+kbd,0,0,17,0,87,104,build/x86/kbd-2.6.1/config.log
+exfatprogs,0,0,0,0,91,91,build/ppc64/exfatprogs-1.2.1/config.log;build/ppc64/log/exfatprogs.log;build/x86/exfatprogs-1.2.1/config.log
+pixman,0,0,0,0,86,86,build/x86/pixman-0.34.0/config.log
+coreboot-talos_2,0,0,85,0,0,85,build/ppc64/coreboot-talos_2/UNTESTED_talos-2/util/sb-signing-utils/config.log;build/ppc64/coreboot-talos_2/UNTESTED_talos-2/util/ffs/config.log
+pinentry,0,0,2,0,78,80,build/ppc64/log/pinentry.log;build/ppc64/pinentry-1.1.0/config.log;build/x86/log/pinentry.log
+powerpc-utils,0,0,0,0,71,71,build/ppc64/log/powerpc-utils.log;build/ppc64/powerpc-utils-1.3.5/config.log
+qrencode,0,0,0,0,66,66,build/ppc64/qrencode-3.4.4/config.log;build/x86/qrencode-3.4.4/config.log
+pciutils,2,2,49,0,4,57,build/ppc64/log/pciutils.log;build/x86/log/pciutils.log
+tpm2-tss,0,0,0,0,15,15,build/x86/tpm2-tss-3.2.2/config.log;build/x86/log/tpm2-tss.log
+linux,1,0,12,0,0,13,build/ppc64/log/linux.log
+npth.configure,6,0,0,0,6,12,build/ppc64/log/npth.configure.log;build/x86/log/npth.configure.log
+lvm2.2.03.23,0,0,4,0,8,12,build/ppc64/lvm2.2.03.23/config.log;build/x86/lvm2.2.03.23/config.log
+dropbear.configure,2,2,0,0,8,12,build/ppc64/log/dropbear.configure.log;build/x86/log/dropbear.configure.log
+tpm2-tss.configure,2,2,0,0,5,9,build/x86/log/tpm2-tss.configure.log
+libaio.configure,2,2,0,0,4,8,build/ppc64/log/libaio.configure.log;build/x86/log/libaio.configure.log
+slang.configure,0,0,3,0,4,7,build/ppc64/log/slang.configure.log
+util-linux.configure,0,0,0,0,4,4,build/ppc64/log/util-linux.configure.log;build/x86/log/util-linux.configure.log
+tpmtotp.configure,2,0,0,0,2,4,build/ppc64/log/tpmtotp.configure.log;build/x86/log/tpmtotp.configure.log
+qrencode.configure,0,0,0,0,4,4,build/ppc64/log/qrencode.configure.log;build/x86/log/qrencode.configure.log
+popt.configure,2,0,0,0,2,4,build/ppc64/log/popt.configure.log;build/x86/log/popt.configure.log
+lvm2.configure,0,0,0,0,4,4,build/ppc64/log/lvm2.configure.log;build/x86/log/lvm2.configure.log
+libgcrypt.configure,2,0,0,0,2,4,build/ppc64/log/libgcrypt.configure.log;build/x86/log/libgcrypt.configure.log
+libaio,0,0,0,0,4,4,build/ppc64/log/libaio.log;build/x86/log/libaio.log
+cryptsetup2.configure,0,0,0,2,2,4,build/ppc64/log/cryptsetup2.configure.log;build/x86/log/cryptsetup2.configure.log
+tpm2-tools,0,0,3,0,0,3,build/x86/tpm2-tools-5.6/config.log
+kbd.configure,0,0,1,0,2,3,build/x86/log/kbd.configure.log
+zstd,0,0,0,0,2,2,build/ppc64/log/zstd.log;build/x86/log/zstd.log
+zlib.configure,0,0,0,0,2,2,build/ppc64/log/zlib.configure.log;build/x86/log/zlib.configure.log
+tpmtotp,0,0,0,0,2,2,build/ppc64/log/tpmtotp.log;build/x86/log/tpmtotp.log
+pinentry.configure,0,0,0,0,2,2,build/ppc64/log/pinentry.configure.log;build/x86/log/pinentry.configure.log
+mbedtls,0,0,0,0,2,2,build/ppc64/log/mbedtls.log;build/x86/log/mbedtls.log
+libusb.configure,0,0,0,0,2,2,build/ppc64/log/libusb.configure.log;build/x86/log/libusb.configure.log
+libksba.configure,0,0,0,0,2,2,build/ppc64/log/libksba.configure.log;build/x86/log/libksba.configure.log
+libgpg-error.configure,0,0,0,0,2,2,build/ppc64/log/libgpg-error.configure.log;build/x86/log/libgpg-error.configure.log
+libassuan.configure,0,0,0,0,2,2,build/ppc64/log/libassuan.configure.log;build/x86/log/libassuan.configure.log
+kexec-tools.configure,0,0,0,0,2,2,build/ppc64/log/kexec-tools.configure.log;build/x86/log/kexec-tools.configure.log
+gpg2.configure,0,0,0,0,2,2,build/ppc64/log/gpg2.configure.log;build/x86/log/gpg2.configure.log
+flashtools,0,0,0,0,2,2,build/ppc64/log/flashtools.log;build/x86/log/flashtools.log
+flashprog,0,0,0,0,2,2,build/ppc64/log/flashprog.log;build/x86/log/flashprog.log
+exfatprogs.configure,0,0,0,0,2,2,build/ppc64/log/exfatprogs.configure.log;build/x86/log/exfatprogs.configure.log
+e2fsprogs.configure,0,0,0,0,2,2,build/ppc64/log/e2fsprogs.configure.log;build/x86/log/e2fsprogs.configure.log
+busybox,0,0,0,0,2,2,build/ppc64/log/busybox.log
+bash.configure,0,0,0,0,2,2,build/ppc64/log/bash.configure.log;build/x86/log/bash.configure.log
+tpm2-tools.configure,0,0,1,0,0,1,build/x86/log/tpm2-tools.configure.log
+powerpc-utils.configure,0,0,0,0,1,1,build/ppc64/log/powerpc-utils.configure.log
+pixman.configure,0,0,0,0,1,1,build/x86/log/pixman.configure.log
+openssl.configure,0,0,0,0,1,1,build/x86/log/openssl.configure.log
+newt.configure,0,0,0,0,1,1,build/ppc64/log/newt.configure.log
+ncurses.configure,0,0,0,0,1,1,build/ppc64/log/ncurses.configure.log
+libpng.configure,0,0,0,0,1,1,build/x86/log/libpng.configure.log
+io386,0,0,0,0,1,1,build/x86/log/io386.log
+fbwhiptail,0,0,0,0,1,1,build/x86/log/fbwhiptail.log
+cairo.configure,0,0,0,0,1,1,build/x86/log/cairo.configure.log
diff --git a/config/linux-c216.config b/config/linux-c216.config
index 63ac0b751..d3df59886 100644
--- a/config/linux-c216.config
+++ b/config/linux-c216.config
@@ -2,17 +2,19 @@
 # Automatically generated file; DO NOT EDIT.
 # Linux/x86 6.1.8 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 8.3.0"
+CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 15.1.0"
 CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=80300
+CONFIG_GCC_VERSION=150100
 CONFIG_CLANG_VERSION=0
 CONFIG_AS_IS_GNU=y
-CONFIG_AS_VERSION=23200
+CONFIG_AS_VERSION=24400
 CONFIG_LD_IS_BFD=y
-CONFIG_LD_VERSION=23200
+CONFIG_LD_VERSION=24400
 CONFIG_LLD_VERSION=0
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
+CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
+CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
 CONFIG_CC_HAS_ASM_INLINE=y
 CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
 CONFIG_PAHOLE_VERSION=0
@@ -373,12 +375,14 @@ CONFIG_LEGACY_VSYSCALL_NONE=y
 CONFIG_HAVE_LIVEPATCH=y
 # end of Processor type and features
 
+CONFIG_CC_HAS_SLS=y
 CONFIG_CC_HAS_RETURN_THUNK=y
 CONFIG_SPECULATION_MITIGATIONS=y
 CONFIG_PAGE_TABLE_ISOLATION=y
 CONFIG_RETPOLINE=y
 CONFIG_RETHUNK=y
 CONFIG_CPU_IBRS_ENTRY=y
+# CONFIG_SLS is not set
 CONFIG_ARCH_HAS_ADD_PAGES=y
 CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
 
@@ -2192,6 +2196,7 @@ CONFIG_RTC_DRV_CMOS=y
 # DMABUF options
 #
 CONFIG_SYNC_FILE=y
+# CONFIG_UDMABUF is not set
 # CONFIG_DMABUF_MOVE_NOTIFY is not set
 # CONFIG_DMABUF_DEBUG is not set
 # CONFIG_DMABUF_SELFTESTS is not set
@@ -2523,9 +2528,13 @@ CONFIG_PROC_SYSCTL=y
 CONFIG_PROC_PID_ARCH_STATUS=y
 CONFIG_KERNFS=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_TMPFS_XATTR is not set
+# CONFIG_TMPFS_INODE64 is not set
 # CONFIG_HUGETLBFS is not set
 CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
+CONFIG_MEMFD_CREATE=y
 CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
 # CONFIG_CONFIGFS_FS is not set
 # CONFIG_EFIVAR_FS is not set
@@ -2614,13 +2623,17 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf"
 #
 # Memory initialization
 #
+CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y
 CONFIG_INIT_STACK_NONE=y
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_USER is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set
+# CONFIG_INIT_STACK_ALL_PATTERN is not set
+# CONFIG_INIT_STACK_ALL_ZERO is not set
 # CONFIG_GCC_PLUGIN_STACKLEAK is not set
 # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
 # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
+CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
+# CONFIG_ZERO_CALL_USED_REGS is not set
 # end of Memory initialization
 
 CONFIG_RANDSTRUCT_NONE=y
@@ -2982,6 +2995,8 @@ CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y
 # CONFIG_UBSAN is not set
 CONFIG_HAVE_ARCH_KCSAN=y
+CONFIG_HAVE_KCSAN_COMPILER=y
+# CONFIG_KCSAN is not set
 # end of Generic Kernel Debugging Instruments
 
 #
@@ -3022,6 +3037,7 @@ CONFIG_ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP=y
 CONFIG_HAVE_ARCH_KASAN=y
 CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
 CONFIG_CC_HAS_KASAN_GENERIC=y
+CONFIG_CC_HAS_KASAN_SW_TAGS=y
 CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
 # CONFIG_KASAN is not set
 CONFIG_HAVE_ARCH_KFENCE=y
diff --git a/config/linux-kgpe-d16_server-whiptail.config b/config/linux-kgpe-d16_server-whiptail.config
index e3f763aaa..963e4b9d4 100644
--- a/config/linux-kgpe-d16_server-whiptail.config
+++ b/config/linux-kgpe-d16_server-whiptail.config
@@ -2763,7 +2763,8 @@ CONFIG_PROC_SYSCTL=y
 CONFIG_PROC_PID_ARCH_STATUS=y
 CONFIG_KERNFS=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+CONFIG_MEMFD_CREATE=y
 # CONFIG_HUGETLBFS is not set
 CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
 CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
diff --git a/config/linux-kgpe-d16_server.config b/config/linux-kgpe-d16_server.config
index e3f763aaa..636c21ebe 100644
--- a/config/linux-kgpe-d16_server.config
+++ b/config/linux-kgpe-d16_server.config
@@ -2,17 +2,19 @@
 # Automatically generated file; DO NOT EDIT.
 # Linux/x86 6.1.8 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 8.3.0"
+CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 15.1.0"
 CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=80300
+CONFIG_GCC_VERSION=150100
 CONFIG_CLANG_VERSION=0
 CONFIG_AS_IS_GNU=y
-CONFIG_AS_VERSION=23200
+CONFIG_AS_VERSION=24400
 CONFIG_LD_IS_BFD=y
-CONFIG_LD_VERSION=23200
+CONFIG_LD_VERSION=24400
 CONFIG_LLD_VERSION=0
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
+CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
+CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
 CONFIG_CC_HAS_ASM_INLINE=y
 CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
 CONFIG_PAHOLE_VERSION=0
@@ -371,6 +373,7 @@ CONFIG_LEGACY_VSYSCALL_XONLY=y
 CONFIG_HAVE_LIVEPATCH=y
 # end of Processor type and features
 
+CONFIG_CC_HAS_SLS=y
 CONFIG_CC_HAS_RETURN_THUNK=y
 CONFIG_SPECULATION_MITIGATIONS=y
 CONFIG_PAGE_TABLE_ISOLATION=y
@@ -378,6 +381,7 @@ CONFIG_RETPOLINE=y
 CONFIG_RETHUNK=y
 CONFIG_CPU_UNRET_ENTRY=y
 CONFIG_CPU_IBPB_ENTRY=y
+# CONFIG_SLS is not set
 CONFIG_ARCH_HAS_ADD_PAGES=y
 CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
 
@@ -2422,6 +2426,7 @@ CONFIG_RTC_DRV_CMOS=y
 #
 CONFIG_SYNC_FILE=y
 # CONFIG_SW_SYNC is not set
+# CONFIG_UDMABUF is not set
 # CONFIG_DMABUF_MOVE_NOTIFY is not set
 # CONFIG_DMABUF_DEBUG is not set
 # CONFIG_DMABUF_SELFTESTS is not set
@@ -2763,9 +2768,13 @@ CONFIG_PROC_SYSCTL=y
 CONFIG_PROC_PID_ARCH_STATUS=y
 CONFIG_KERNFS=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_TMPFS_XATTR is not set
+# CONFIG_TMPFS_INODE64 is not set
 # CONFIG_HUGETLBFS is not set
 CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
+CONFIG_MEMFD_CREATE=y
 CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
 # CONFIG_CONFIGFS_FS is not set
 # end of Pseudo filesystems
@@ -2851,13 +2860,17 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf"
 #
 # Memory initialization
 #
+CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y
 CONFIG_INIT_STACK_NONE=y
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_USER is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set
+# CONFIG_INIT_STACK_ALL_PATTERN is not set
+# CONFIG_INIT_STACK_ALL_ZERO is not set
 # CONFIG_GCC_PLUGIN_STACKLEAK is not set
 # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
 # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
+CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
+# CONFIG_ZERO_CALL_USED_REGS is not set
 # end of Memory initialization
 
 CONFIG_RANDSTRUCT_NONE=y
@@ -3232,6 +3245,8 @@ CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y
 # CONFIG_UBSAN is not set
 CONFIG_HAVE_ARCH_KCSAN=y
+CONFIG_HAVE_KCSAN_COMPILER=y
+# CONFIG_KCSAN is not set
 # end of Generic Kernel Debugging Instruments
 
 #
@@ -3275,6 +3290,7 @@ CONFIG_ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP=y
 CONFIG_HAVE_ARCH_KASAN=y
 CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
 CONFIG_CC_HAS_KASAN_GENERIC=y
+CONFIG_CC_HAS_KASAN_SW_TAGS=y
 CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
 # CONFIG_KASAN is not set
 CONFIG_HAVE_ARCH_KFENCE=y
diff --git a/config/linux-kgpe-d16_workstation.config b/config/linux-kgpe-d16_workstation.config
index 8b8ae60b0..391e159b2 100644
--- a/config/linux-kgpe-d16_workstation.config
+++ b/config/linux-kgpe-d16_workstation.config
@@ -2987,7 +2987,8 @@ CONFIG_PROC_SYSCTL=y
 CONFIG_PROC_PID_ARCH_STATUS=y
 CONFIG_KERNFS=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+CONFIG_MEMFD_CREATE=y
 # CONFIG_HUGETLBFS is not set
 CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
 CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
diff --git a/config/linux-librem_common-6.1.8.config b/config/linux-librem_common-6.1.8.config
index b7b2d58ce..69238717b 100644
--- a/config/linux-librem_common-6.1.8.config
+++ b/config/linux-librem_common-6.1.8.config
@@ -2,17 +2,19 @@
 # Automatically generated file; DO NOT EDIT.
 # Linux/x86 6.1.8 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 8.3.0"
+CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 15.1.0"
 CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=80300
+CONFIG_GCC_VERSION=150100
 CONFIG_CLANG_VERSION=0
 CONFIG_AS_IS_GNU=y
-CONFIG_AS_VERSION=23200
+CONFIG_AS_VERSION=24400
 CONFIG_LD_IS_BFD=y
-CONFIG_LD_VERSION=23200
+CONFIG_LD_VERSION=24400
 CONFIG_LLD_VERSION=0
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
+CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
+CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
 CONFIG_CC_HAS_ASM_INLINE=y
 CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
 CONFIG_PAHOLE_VERSION=0
@@ -373,11 +375,13 @@ CONFIG_LEGACY_VSYSCALL_NONE=y
 CONFIG_HAVE_LIVEPATCH=y
 # end of Processor type and features
 
+CONFIG_CC_HAS_SLS=y
 CONFIG_CC_HAS_RETURN_THUNK=y
 CONFIG_SPECULATION_MITIGATIONS=y
 CONFIG_PAGE_TABLE_ISOLATION=y
 # CONFIG_RETPOLINE is not set
 CONFIG_CPU_IBRS_ENTRY=y
+# CONFIG_SLS is not set
 CONFIG_ARCH_HAS_ADD_PAGES=y
 CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
 
@@ -2145,6 +2149,7 @@ CONFIG_RTC_DRV_CMOS=y
 # DMABUF options
 #
 CONFIG_SYNC_FILE=y
+# CONFIG_UDMABUF is not set
 # CONFIG_DMABUF_MOVE_NOTIFY is not set
 # CONFIG_DMABUF_DEBUG is not set
 # CONFIG_DMABUF_SELFTESTS is not set
@@ -2476,9 +2481,13 @@ CONFIG_PROC_SYSCTL=y
 CONFIG_PROC_PID_ARCH_STATUS=y
 CONFIG_KERNFS=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_TMPFS_XATTR is not set
+# CONFIG_TMPFS_INODE64 is not set
 # CONFIG_HUGETLBFS is not set
 CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
+CONFIG_MEMFD_CREATE=y
 CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
 # CONFIG_CONFIGFS_FS is not set
 # CONFIG_EFIVAR_FS is not set
@@ -2567,13 +2576,17 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf"
 #
 # Memory initialization
 #
+CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y
 CONFIG_INIT_STACK_NONE=y
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_USER is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set
+# CONFIG_INIT_STACK_ALL_PATTERN is not set
+# CONFIG_INIT_STACK_ALL_ZERO is not set
 # CONFIG_GCC_PLUGIN_STACKLEAK is not set
 # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
 # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
+CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
+# CONFIG_ZERO_CALL_USED_REGS is not set
 # end of Memory initialization
 
 CONFIG_RANDSTRUCT_NONE=y
@@ -2935,6 +2948,8 @@ CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y
 # CONFIG_UBSAN is not set
 CONFIG_HAVE_ARCH_KCSAN=y
+CONFIG_HAVE_KCSAN_COMPILER=y
+# CONFIG_KCSAN is not set
 # end of Generic Kernel Debugging Instruments
 
 #
@@ -2975,6 +2990,7 @@ CONFIG_ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP=y
 CONFIG_HAVE_ARCH_KASAN=y
 CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
 CONFIG_CC_HAS_KASAN_GENERIC=y
+CONFIG_CC_HAS_KASAN_SW_TAGS=y
 CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
 # CONFIG_KASAN is not set
 CONFIG_HAVE_ARCH_KFENCE=y
diff --git a/config/linux-linuxboot.config b/config/linux-linuxboot.config
index 66e78f978..191ec0510 100644
--- a/config/linux-linuxboot.config
+++ b/config/linux-linuxboot.config
@@ -268,7 +268,8 @@ CONFIG_MSDOS_FS=y
 CONFIG_VFAT_FS=y
 CONFIG_PROC_SYSCTL=y
 # CONFIG_PROC_PAGE_MONITOR is not set
-CONFIG_TMPFS=n
+CONFIG_TMPFS=y
+CONFIG_MEMFD_CREATE=y
 CONFIG_HUGETLBFS=y
 CONFIG_EFIVAR_FS=y
 # CONFIG_MISC_FILESYSTEMS is not set
diff --git a/config/linux-novacustom-common.config b/config/linux-novacustom-common.config
index 01bc65f65..b308210e6 100644
--- a/config/linux-novacustom-common.config
+++ b/config/linux-novacustom-common.config
@@ -2,17 +2,19 @@
 # Automatically generated file; DO NOT EDIT.
 # Linux/x86 6.1.8 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 9.4.0"
+CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 15.1.0"
 CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=90400
+CONFIG_GCC_VERSION=150100
 CONFIG_CLANG_VERSION=0
 CONFIG_AS_IS_GNU=y
-CONFIG_AS_VERSION=23301
+CONFIG_AS_VERSION=24400
 CONFIG_LD_IS_BFD=y
-CONFIG_LD_VERSION=23301
+CONFIG_LD_VERSION=24400
 CONFIG_LLD_VERSION=0
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
+CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
+CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
 CONFIG_CC_HAS_ASM_INLINE=y
 CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
 CONFIG_PAHOLE_VERSION=0
@@ -377,12 +379,14 @@ CONFIG_LEGACY_VSYSCALL_NONE=y
 CONFIG_HAVE_LIVEPATCH=y
 # end of Processor type and features
 
+CONFIG_CC_HAS_SLS=y
 CONFIG_CC_HAS_RETURN_THUNK=y
 CONFIG_SPECULATION_MITIGATIONS=y
 CONFIG_PAGE_TABLE_ISOLATION=y
 CONFIG_RETPOLINE=y
 CONFIG_RETHUNK=y
 CONFIG_CPU_IBRS_ENTRY=y
+# CONFIG_SLS is not set
 CONFIG_ARCH_HAS_ADD_PAGES=y
 CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
 
@@ -2408,6 +2412,7 @@ CONFIG_RTC_DRV_CMOS=y
 # DMABUF options
 #
 CONFIG_SYNC_FILE=y
+# CONFIG_UDMABUF is not set
 # CONFIG_DMABUF_MOVE_NOTIFY is not set
 # CONFIG_DMABUF_DEBUG is not set
 # CONFIG_DMABUF_SELFTESTS is not set
@@ -2748,9 +2753,13 @@ CONFIG_PROC_SYSCTL=y
 CONFIG_PROC_PID_ARCH_STATUS=y
 CONFIG_KERNFS=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_TMPFS_XATTR is not set
+# CONFIG_TMPFS_INODE64 is not set
 # CONFIG_HUGETLBFS is not set
 CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
+CONFIG_MEMFD_CREATE=y
 CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
 # CONFIG_CONFIGFS_FS is not set
 # CONFIG_EFIVAR_FS is not set
@@ -2839,13 +2848,17 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf"
 #
 # Memory initialization
 #
+CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y
 CONFIG_INIT_STACK_NONE=y
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_USER is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set
+# CONFIG_INIT_STACK_ALL_PATTERN is not set
+# CONFIG_INIT_STACK_ALL_ZERO is not set
 # CONFIG_GCC_PLUGIN_STACKLEAK is not set
 # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
 # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
+CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
+# CONFIG_ZERO_CALL_USED_REGS is not set
 # end of Memory initialization
 
 CONFIG_RANDSTRUCT_NONE=y
@@ -3215,6 +3228,8 @@ CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y
 # CONFIG_UBSAN is not set
 CONFIG_HAVE_ARCH_KCSAN=y
+CONFIG_HAVE_KCSAN_COMPILER=y
+# CONFIG_KCSAN is not set
 # end of Generic Kernel Debugging Instruments
 
 #
@@ -3255,6 +3270,7 @@ CONFIG_ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP=y
 CONFIG_HAVE_ARCH_KASAN=y
 CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
 CONFIG_CC_HAS_KASAN_GENERIC=y
+CONFIG_CC_HAS_KASAN_SW_TAGS=y
 CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
 # CONFIG_KASAN is not set
 CONFIG_HAVE_ARCH_KFENCE=y
diff --git a/config/linux-qemu.config b/config/linux-qemu.config
index a660b1639..d602c39ac 100644
--- a/config/linux-qemu.config
+++ b/config/linux-qemu.config
@@ -2,17 +2,19 @@
 # Automatically generated file; DO NOT EDIT.
 # Linux/x86 6.1.8 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 8.3.0"
+CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 15.1.0"
 CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=80300
+CONFIG_GCC_VERSION=150100
 CONFIG_CLANG_VERSION=0
 CONFIG_AS_IS_GNU=y
-CONFIG_AS_VERSION=23200
+CONFIG_AS_VERSION=24400
 CONFIG_LD_IS_BFD=y
-CONFIG_LD_VERSION=23200
+CONFIG_LD_VERSION=24400
 CONFIG_LLD_VERSION=0
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
+CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
+CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
 CONFIG_CC_HAS_ASM_INLINE=y
 CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
 CONFIG_PAHOLE_VERSION=0
@@ -414,6 +416,7 @@ CONFIG_LEGACY_VSYSCALL_NONE=y
 CONFIG_HAVE_LIVEPATCH=y
 # end of Processor type and features
 
+CONFIG_CC_HAS_SLS=y
 CONFIG_CC_HAS_RETURN_THUNK=y
 CONFIG_SPECULATION_MITIGATIONS=y
 CONFIG_PAGE_TABLE_ISOLATION=y
@@ -422,6 +425,7 @@ CONFIG_RETHUNK=y
 CONFIG_CPU_UNRET_ENTRY=y
 CONFIG_CPU_IBPB_ENTRY=y
 CONFIG_CPU_IBRS_ENTRY=y
+# CONFIG_SLS is not set
 CONFIG_ARCH_HAS_ADD_PAGES=y
 CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
 
@@ -2409,6 +2413,7 @@ CONFIG_RTC_DRV_CMOS=y
 #
 CONFIG_SYNC_FILE=y
 # CONFIG_SW_SYNC is not set
+# CONFIG_UDMABUF is not set
 # CONFIG_DMABUF_MOVE_NOTIFY is not set
 # CONFIG_DMABUF_DEBUG is not set
 # CONFIG_DMABUF_SELFTESTS is not set
@@ -2772,9 +2777,13 @@ CONFIG_PROC_SYSCTL=y
 CONFIG_PROC_PID_ARCH_STATUS=y
 CONFIG_KERNFS=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_TMPFS_XATTR is not set
+# CONFIG_TMPFS_INODE64 is not set
 # CONFIG_HUGETLBFS is not set
 CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
+CONFIG_MEMFD_CREATE=y
 CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
 CONFIG_CONFIGFS_FS=y
 CONFIG_EFIVAR_FS=m
@@ -2864,13 +2873,17 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf"
 #
 # Memory initialization
 #
+CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y
 CONFIG_INIT_STACK_NONE=y
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_USER is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set
+# CONFIG_INIT_STACK_ALL_PATTERN is not set
+# CONFIG_INIT_STACK_ALL_ZERO is not set
 # CONFIG_GCC_PLUGIN_STACKLEAK is not set
 # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
 # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
+CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
+# CONFIG_ZERO_CALL_USED_REGS is not set
 # end of Memory initialization
 
 CONFIG_RANDSTRUCT_NONE=y
@@ -3242,6 +3255,8 @@ CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y
 # CONFIG_UBSAN is not set
 CONFIG_HAVE_ARCH_KCSAN=y
+CONFIG_HAVE_KCSAN_COMPILER=y
+# CONFIG_KCSAN is not set
 # end of Generic Kernel Debugging Instruments
 
 #
@@ -3284,6 +3299,7 @@ CONFIG_ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP=y
 CONFIG_HAVE_ARCH_KASAN=y
 CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
 CONFIG_CC_HAS_KASAN_GENERIC=y
+CONFIG_CC_HAS_KASAN_SW_TAGS=y
 CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
 # CONFIG_KASAN is not set
 CONFIG_HAVE_ARCH_KFENCE=y
diff --git a/config/linux-t440p.config b/config/linux-t440p.config
index 3f5cc9cb0..54f822ec2 100644
--- a/config/linux-t440p.config
+++ b/config/linux-t440p.config
@@ -2,17 +2,19 @@
 # Automatically generated file; DO NOT EDIT.
 # Linux/x86 6.1.8 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 8.3.0"
+CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 15.1.0"
 CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=80300
+CONFIG_GCC_VERSION=150100
 CONFIG_CLANG_VERSION=0
 CONFIG_AS_IS_GNU=y
-CONFIG_AS_VERSION=23200
+CONFIG_AS_VERSION=24400
 CONFIG_LD_IS_BFD=y
-CONFIG_LD_VERSION=23200
+CONFIG_LD_VERSION=24400
 CONFIG_LLD_VERSION=0
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
+CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
+CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
 CONFIG_CC_HAS_ASM_INLINE=y
 CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
 CONFIG_PAHOLE_VERSION=0
@@ -373,12 +375,14 @@ CONFIG_LEGACY_VSYSCALL_NONE=y
 CONFIG_HAVE_LIVEPATCH=y
 # end of Processor type and features
 
+CONFIG_CC_HAS_SLS=y
 CONFIG_CC_HAS_RETURN_THUNK=y
 CONFIG_SPECULATION_MITIGATIONS=y
 CONFIG_PAGE_TABLE_ISOLATION=y
 CONFIG_RETPOLINE=y
 CONFIG_RETHUNK=y
 CONFIG_CPU_IBRS_ENTRY=y
+# CONFIG_SLS is not set
 CONFIG_ARCH_HAS_ADD_PAGES=y
 CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
 
@@ -2394,6 +2398,7 @@ CONFIG_RTC_DRV_CMOS=y
 # DMABUF options
 #
 CONFIG_SYNC_FILE=y
+# CONFIG_UDMABUF is not set
 # CONFIG_DMABUF_MOVE_NOTIFY is not set
 # CONFIG_DMABUF_DEBUG is not set
 # CONFIG_DMABUF_SELFTESTS is not set
@@ -2734,9 +2739,13 @@ CONFIG_PROC_SYSCTL=y
 CONFIG_PROC_PID_ARCH_STATUS=y
 CONFIG_KERNFS=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_TMPFS_XATTR is not set
+# CONFIG_TMPFS_INODE64 is not set
 # CONFIG_HUGETLBFS is not set
 CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
+CONFIG_MEMFD_CREATE=y
 CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
 # CONFIG_CONFIGFS_FS is not set
 # CONFIG_EFIVAR_FS is not set
@@ -2825,13 +2834,17 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf"
 #
 # Memory initialization
 #
+CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y
 CONFIG_INIT_STACK_NONE=y
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_USER is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set
+# CONFIG_INIT_STACK_ALL_PATTERN is not set
+# CONFIG_INIT_STACK_ALL_ZERO is not set
 # CONFIG_GCC_PLUGIN_STACKLEAK is not set
 # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
 # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
+CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
+# CONFIG_ZERO_CALL_USED_REGS is not set
 # end of Memory initialization
 
 CONFIG_RANDSTRUCT_NONE=y
@@ -3193,6 +3206,8 @@ CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y
 # CONFIG_UBSAN is not set
 CONFIG_HAVE_ARCH_KCSAN=y
+CONFIG_HAVE_KCSAN_COMPILER=y
+# CONFIG_KCSAN is not set
 # end of Generic Kernel Debugging Instruments
 
 #
@@ -3233,6 +3248,7 @@ CONFIG_ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP=y
 CONFIG_HAVE_ARCH_KASAN=y
 CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
 CONFIG_CC_HAS_KASAN_GENERIC=y
+CONFIG_CC_HAS_KASAN_SW_TAGS=y
 CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
 # CONFIG_KASAN is not set
 CONFIG_HAVE_ARCH_KFENCE=y
diff --git a/config/linux-t480.config b/config/linux-t480.config
index f9c0c35b4..00e00cc35 100644
--- a/config/linux-t480.config
+++ b/config/linux-t480.config
@@ -2,17 +2,19 @@
 # Automatically generated file; DO NOT EDIT.
 # Linux/x86 6.1.8 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 8.3.0"
+CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 15.1.0"
 CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=80300
+CONFIG_GCC_VERSION=150100
 CONFIG_CLANG_VERSION=0
 CONFIG_AS_IS_GNU=y
-CONFIG_AS_VERSION=23200
+CONFIG_AS_VERSION=24400
 CONFIG_LD_IS_BFD=y
-CONFIG_LD_VERSION=23200
+CONFIG_LD_VERSION=24400
 CONFIG_LLD_VERSION=0
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
+CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
+CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
 CONFIG_CC_HAS_ASM_INLINE=y
 CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
 CONFIG_PAHOLE_VERSION=0
@@ -373,12 +375,14 @@ CONFIG_LEGACY_VSYSCALL_NONE=y
 CONFIG_HAVE_LIVEPATCH=y
 # end of Processor type and features
 
+CONFIG_CC_HAS_SLS=y
 CONFIG_CC_HAS_RETURN_THUNK=y
 CONFIG_SPECULATION_MITIGATIONS=y
 CONFIG_PAGE_TABLE_ISOLATION=y
 CONFIG_RETPOLINE=y
 CONFIG_RETHUNK=y
 CONFIG_CPU_IBRS_ENTRY=y
+# CONFIG_SLS is not set
 CONFIG_ARCH_HAS_ADD_PAGES=y
 CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
 
@@ -1981,9 +1985,6 @@ CONFIG_USB_EHCI_HCD_PLATFORM=m
 # CONFIG_USB_OXU210HP_HCD is not set
 # CONFIG_USB_ISP116X_HCD is not set
 # CONFIG_USB_FOTG210_HCD is not set
-CONFIG_USB_OHCI_HCD=m
-CONFIG_USB_OHCI_HCD_PCI=m
-# CONFIG_USB_OHCI_HCD_PLATFORM is not set
 # CONFIG_USB_OHCI_HCD is not set
 # CONFIG_USB_UHCI_HCD is not set
 # CONFIG_USB_SL811_HCD is not set
@@ -2149,6 +2150,7 @@ CONFIG_RTC_DRV_CMOS=y
 # DMABUF options
 #
 CONFIG_SYNC_FILE=y
+# CONFIG_UDMABUF is not set
 # CONFIG_DMABUF_MOVE_NOTIFY is not set
 # CONFIG_DMABUF_DEBUG is not set
 # CONFIG_DMABUF_SELFTESTS is not set
@@ -2480,9 +2482,13 @@ CONFIG_PROC_SYSCTL=y
 CONFIG_PROC_PID_ARCH_STATUS=y
 CONFIG_KERNFS=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_TMPFS_XATTR is not set
+# CONFIG_TMPFS_INODE64 is not set
 # CONFIG_HUGETLBFS is not set
 CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
+CONFIG_MEMFD_CREATE=y
 CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
 # CONFIG_CONFIGFS_FS is not set
 # CONFIG_EFIVAR_FS is not set
@@ -2571,13 +2577,17 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf"
 #
 # Memory initialization
 #
+CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y
 CONFIG_INIT_STACK_NONE=y
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_USER is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set
+# CONFIG_INIT_STACK_ALL_PATTERN is not set
+# CONFIG_INIT_STACK_ALL_ZERO is not set
 # CONFIG_GCC_PLUGIN_STACKLEAK is not set
 # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
 # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
+CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
+# CONFIG_ZERO_CALL_USED_REGS is not set
 # end of Memory initialization
 
 CONFIG_RANDSTRUCT_NONE=y
@@ -2939,6 +2949,8 @@ CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y
 # CONFIG_UBSAN is not set
 CONFIG_HAVE_ARCH_KCSAN=y
+CONFIG_HAVE_KCSAN_COMPILER=y
+# CONFIG_KCSAN is not set
 # end of Generic Kernel Debugging Instruments
 
 #
@@ -2979,6 +2991,7 @@ CONFIG_ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP=y
 CONFIG_HAVE_ARCH_KASAN=y
 CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
 CONFIG_CC_HAS_KASAN_GENERIC=y
+CONFIG_CC_HAS_KASAN_SW_TAGS=y
 CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
 # CONFIG_KASAN is not set
 CONFIG_HAVE_ARCH_KFENCE=y
diff --git a/config/linux-talos-2.config b/config/linux-talos-2.config
index 556307163..065851a8d 100644
--- a/config/linux-talos-2.config
+++ b/config/linux-talos-2.config
@@ -2,17 +2,20 @@
 # Automatically generated file; DO NOT EDIT.
 # Linux/powerpc 6.6.16-openpower1 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="powerpc64le-linux-musl-gcc (GCC) 8.3.0"
+CONFIG_CC_VERSION_TEXT="powerpc64le-linux-musl-gcc (GCC) 15.1.0"
 CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=80300
+CONFIG_GCC_VERSION=150100
 CONFIG_CLANG_VERSION=0
 CONFIG_AS_IS_GNU=y
-CONFIG_AS_VERSION=23200
+CONFIG_AS_VERSION=24400
 CONFIG_LD_IS_BFD=y
-CONFIG_LD_VERSION=23200
+CONFIG_LD_VERSION=24400
 CONFIG_LLD_VERSION=0
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
+CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
+CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
+CONFIG_TOOLS_SUPPORT_RELR=y
 CONFIG_CC_HAS_ASM_INLINE=y
 CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
 CONFIG_PAHOLE_VERSION=0
@@ -141,6 +144,7 @@ CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y
 CONFIG_CC_HAS_INT128=y
 CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
 CONFIG_GCC11_NO_ARRAY_BOUNDS=y
+CONFIG_CC_NO_ARRAY_BOUNDS=y
 # CONFIG_CGROUPS is not set
 # CONFIG_NAMESPACES is not set
 # CONFIG_CHECKPOINT_RESTORE is not set
@@ -263,6 +267,8 @@ CONFIG_CPU_LITTLE_ENDIAN=y
 CONFIG_PPC64_ELF_ABI_V2=y
 CONFIG_PPC64_BOOT_WRAPPER=y
 CONFIG_CC_HAS_ELFV2=y
+CONFIG_CC_HAS_PREFIXED=y
+CONFIG_CC_HAS_PCREL=y
 CONFIG_64BIT=y
 CONFIG_MMU=y
 CONFIG_ARCH_MMAP_RND_BITS_MAX=29
@@ -734,7 +740,7 @@ CONFIG_VM_EVENT_COUNTERS=y
 # CONFIG_GUP_TEST is not set
 # CONFIG_DMAPOOL_TEST is not set
 CONFIG_ARCH_HAS_PTE_SPECIAL=y
-# CONFIG_MEMFD_CREATE is not set
+CONFIG_MEMFD_CREATE=y
 # CONFIG_ANON_VMA_NAME is not set
 # CONFIG_USERFAULTFD is not set
 # CONFIG_LRU_GEN is not set
@@ -2699,6 +2705,7 @@ CONFIG_RTC_DRV_OPAL=y
 #
 CONFIG_SYNC_FILE=y
 # CONFIG_SW_SYNC is not set
+# CONFIG_UDMABUF is not set
 # CONFIG_DMABUF_MOVE_NOTIFY is not set
 # CONFIG_DMABUF_DEBUG is not set
 # CONFIG_DMABUF_SELFTESTS is not set
@@ -2951,6 +2958,7 @@ CONFIG_XFS_SUPPORT_ASCII_CI=y
 CONFIG_XFS_QUOTA=y
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
+# CONFIG_XFS_ONLINE_SCRUB is not set
 CONFIG_XFS_DEBUG=y
 CONFIG_XFS_ASSERT_FATAL=y
 # CONFIG_GFS2_FS is not set
@@ -3033,7 +3041,11 @@ CONFIG_PROC_PAGE_MONITOR=y
 # CONFIG_PROC_CHILDREN is not set
 CONFIG_KERNFS=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_TMPFS_XATTR is not set
+# CONFIG_TMPFS_INODE64 is not set
+# CONFIG_TMPFS_QUOTA is not set
 CONFIG_ARCH_SUPPORTS_HUGETLBFS=y
 # CONFIG_HUGETLBFS is not set
 CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
@@ -3222,12 +3234,16 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity"
 #
 # Memory initialization
 #
+CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y
 CONFIG_INIT_STACK_NONE=y
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_USER is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set
+# CONFIG_INIT_STACK_ALL_PATTERN is not set
+# CONFIG_INIT_STACK_ALL_ZERO is not set
 # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
 # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
+CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
+# CONFIG_ZERO_CALL_USED_REGS is not set
 # end of Memory initialization
 
 #
@@ -3617,6 +3633,8 @@ CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y
 # CONFIG_UBSAN is not set
 CONFIG_HAVE_ARCH_KCSAN=y
+CONFIG_HAVE_KCSAN_COMPILER=y
+# CONFIG_KCSAN is not set
 # end of Generic Kernel Debugging Instruments
 
 #
diff --git a/config/linux-w541.config b/config/linux-w541.config
index 3f5cc9cb0..54f822ec2 100644
--- a/config/linux-w541.config
+++ b/config/linux-w541.config
@@ -2,17 +2,19 @@
 # Automatically generated file; DO NOT EDIT.
 # Linux/x86 6.1.8 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 8.3.0"
+CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 15.1.0"
 CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=80300
+CONFIG_GCC_VERSION=150100
 CONFIG_CLANG_VERSION=0
 CONFIG_AS_IS_GNU=y
-CONFIG_AS_VERSION=23200
+CONFIG_AS_VERSION=24400
 CONFIG_LD_IS_BFD=y
-CONFIG_LD_VERSION=23200
+CONFIG_LD_VERSION=24400
 CONFIG_LLD_VERSION=0
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
+CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
+CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
 CONFIG_CC_HAS_ASM_INLINE=y
 CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
 CONFIG_PAHOLE_VERSION=0
@@ -373,12 +375,14 @@ CONFIG_LEGACY_VSYSCALL_NONE=y
 CONFIG_HAVE_LIVEPATCH=y
 # end of Processor type and features
 
+CONFIG_CC_HAS_SLS=y
 CONFIG_CC_HAS_RETURN_THUNK=y
 CONFIG_SPECULATION_MITIGATIONS=y
 CONFIG_PAGE_TABLE_ISOLATION=y
 CONFIG_RETPOLINE=y
 CONFIG_RETHUNK=y
 CONFIG_CPU_IBRS_ENTRY=y
+# CONFIG_SLS is not set
 CONFIG_ARCH_HAS_ADD_PAGES=y
 CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
 
@@ -2394,6 +2398,7 @@ CONFIG_RTC_DRV_CMOS=y
 # DMABUF options
 #
 CONFIG_SYNC_FILE=y
+# CONFIG_UDMABUF is not set
 # CONFIG_DMABUF_MOVE_NOTIFY is not set
 # CONFIG_DMABUF_DEBUG is not set
 # CONFIG_DMABUF_SELFTESTS is not set
@@ -2734,9 +2739,13 @@ CONFIG_PROC_SYSCTL=y
 CONFIG_PROC_PID_ARCH_STATUS=y
 CONFIG_KERNFS=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_TMPFS_XATTR is not set
+# CONFIG_TMPFS_INODE64 is not set
 # CONFIG_HUGETLBFS is not set
 CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
+CONFIG_MEMFD_CREATE=y
 CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
 # CONFIG_CONFIGFS_FS is not set
 # CONFIG_EFIVAR_FS is not set
@@ -2825,13 +2834,17 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf"
 #
 # Memory initialization
 #
+CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y
 CONFIG_INIT_STACK_NONE=y
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_USER is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set
+# CONFIG_INIT_STACK_ALL_PATTERN is not set
+# CONFIG_INIT_STACK_ALL_ZERO is not set
 # CONFIG_GCC_PLUGIN_STACKLEAK is not set
 # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
 # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
+CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
+# CONFIG_ZERO_CALL_USED_REGS is not set
 # end of Memory initialization
 
 CONFIG_RANDSTRUCT_NONE=y
@@ -3193,6 +3206,8 @@ CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y
 # CONFIG_UBSAN is not set
 CONFIG_HAVE_ARCH_KCSAN=y
+CONFIG_HAVE_KCSAN_COMPILER=y
+# CONFIG_KCSAN is not set
 # end of Generic Kernel Debugging Instruments
 
 #
@@ -3233,6 +3248,7 @@ CONFIG_ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP=y
 CONFIG_HAVE_ARCH_KASAN=y
 CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
 CONFIG_CC_HAS_KASAN_GENERIC=y
+CONFIG_CC_HAS_KASAN_SW_TAGS=y
 CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
 # CONFIG_KASAN is not set
 CONFIG_HAVE_ARCH_KFENCE=y
diff --git a/config/linux-x230-flash.config b/config/linux-x230-flash.config
index 4c1085643..9e886b256 100644
--- a/config/linux-x230-flash.config
+++ b/config/linux-x230-flash.config
@@ -2111,7 +2111,8 @@ CONFIG_PROC_SYSCTL=y
 CONFIG_PROC_PID_ARCH_STATUS=y
 CONFIG_KERNFS=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+CONFIG_MEMFD_CREATE=y
 # CONFIG_HUGETLBFS is not set
 CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
 CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
diff --git a/config/linux-x230-legacy.config b/config/linux-x230-legacy.config
index 4a5052205..d4d0db44c 100644
--- a/config/linux-x230-legacy.config
+++ b/config/linux-x230-legacy.config
@@ -2290,7 +2290,8 @@ CONFIG_PROC_SYSCTL=y
 CONFIG_PROC_PID_ARCH_STATUS=y
 CONFIG_KERNFS=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+CONFIG_MEMFD_CREATE=y
 # CONFIG_HUGETLBFS is not set
 CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
 CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
diff --git a/config/linux-x230-maximized.config b/config/linux-x230-maximized.config
index 57c8271ba..3e6f80458 100644
--- a/config/linux-x230-maximized.config
+++ b/config/linux-x230-maximized.config
@@ -2,17 +2,19 @@
 # Automatically generated file; DO NOT EDIT.
 # Linux/x86 6.1.8 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 8.3.0"
+CONFIG_CC_VERSION_TEXT="x86_64-linux-musl-gcc (GCC) 15.1.0"
 CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=80300
+CONFIG_GCC_VERSION=150100
 CONFIG_CLANG_VERSION=0
 CONFIG_AS_IS_GNU=y
-CONFIG_AS_VERSION=23200
+CONFIG_AS_VERSION=24400
 CONFIG_LD_IS_BFD=y
-CONFIG_LD_VERSION=23200
+CONFIG_LD_VERSION=24400
 CONFIG_LLD_VERSION=0
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
+CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
+CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
 CONFIG_CC_HAS_ASM_INLINE=y
 CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
 CONFIG_PAHOLE_VERSION=0
@@ -373,12 +375,14 @@ CONFIG_LEGACY_VSYSCALL_NONE=y
 CONFIG_HAVE_LIVEPATCH=y
 # end of Processor type and features
 
+CONFIG_CC_HAS_SLS=y
 CONFIG_CC_HAS_RETURN_THUNK=y
 CONFIG_SPECULATION_MITIGATIONS=y
 CONFIG_PAGE_TABLE_ISOLATION=y
 CONFIG_RETPOLINE=y
 CONFIG_RETHUNK=y
 CONFIG_CPU_IBRS_ENTRY=y
+# CONFIG_SLS is not set
 CONFIG_ARCH_HAS_ADD_PAGES=y
 CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
 
@@ -2192,6 +2196,7 @@ CONFIG_RTC_DRV_CMOS=y
 # DMABUF options
 #
 CONFIG_SYNC_FILE=y
+# CONFIG_UDMABUF is not set
 # CONFIG_DMABUF_MOVE_NOTIFY is not set
 # CONFIG_DMABUF_DEBUG is not set
 # CONFIG_DMABUF_SELFTESTS is not set
@@ -2523,9 +2528,13 @@ CONFIG_PROC_SYSCTL=y
 CONFIG_PROC_PID_ARCH_STATUS=y
 CONFIG_KERNFS=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_TMPFS_XATTR is not set
+# CONFIG_TMPFS_INODE64 is not set
 # CONFIG_HUGETLBFS is not set
 CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
+CONFIG_MEMFD_CREATE=y
 CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
 # CONFIG_CONFIGFS_FS is not set
 # CONFIG_EFIVAR_FS is not set
@@ -2614,13 +2623,17 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf"
 #
 # Memory initialization
 #
+CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y
+CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y
 CONFIG_INIT_STACK_NONE=y
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_USER is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF is not set
-# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set
+# CONFIG_INIT_STACK_ALL_PATTERN is not set
+# CONFIG_INIT_STACK_ALL_ZERO is not set
 # CONFIG_GCC_PLUGIN_STACKLEAK is not set
 # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
 # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
+CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
+# CONFIG_ZERO_CALL_USED_REGS is not set
 # end of Memory initialization
 
 CONFIG_RANDSTRUCT_NONE=y
@@ -2982,6 +2995,8 @@ CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y
 # CONFIG_UBSAN is not set
 CONFIG_HAVE_ARCH_KCSAN=y
+CONFIG_HAVE_KCSAN_COMPILER=y
+# CONFIG_KCSAN is not set
 # end of Generic Kernel Debugging Instruments
 
 #
@@ -3022,6 +3037,7 @@ CONFIG_ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP=y
 CONFIG_HAVE_ARCH_KASAN=y
 CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
 CONFIG_CC_HAS_KASAN_GENERIC=y
+CONFIG_CC_HAS_KASAN_SW_TAGS=y
 CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
 # CONFIG_KASAN is not set
 CONFIG_HAVE_ARCH_KFENCE=y
diff --git a/doc/OFLAG_fixes.md b/doc/OFLAG_fixes.md
new file mode 100644
index 000000000..99a3f5df2
--- /dev/null
+++ b/doc/OFLAG_fixes.md
@@ -0,0 +1,57 @@
+OFLAG fixes summary
+
+This document lists recent OFLAG (optimization flag) fixes applied in the repository and where to find validation evidence.
+
+- zlib
+  - Fix: packaging enforces CFLAGS=-Oz
+  - Validation: V=1 builds on x86 & ppc64 show -Oz usage in compile lines
+  - Logs: build/x86/log/zlib.log, build/ppc64/log/zlib.log
+
+- cryptsetup2
+  - Fix: pre-configure substitutions applied (remove -O3 from Argon2 templates and normalize libtool hardcode flags)
+  - Commit: fac65ebc7e
+  - Validation: V=1 x86 & ppc64 builds validated; grep shows no remaining -O3 in build trees
+  - Logs: build/ppc64/log/cryptsetup2.log, build/x86/log/cryptsetup2.log
+
+- cryptsetup (legacy)
+  - Packaging change: pre-configure sed added to normalize `-O[0-9]+`/`-Os` -> `-Oz` and `CXXFLAGS` set to `-g -Oz` in `modules/cryptsetup`.
+  - Note: this module is not used by current boards (`cryptsetup2` is the active module); change applied for completeness.
+
+- slang
+  - Fix: minimal pre-configure sed applied replacing -O2 with -Oz
+  - Validation: logged CFLAGS show -Oz in build output
+  - Logs: build/x86/log/slang.log
+
+- libaio
+  - Fix: pre-configure sed applied to replace `-O[0-9]+` and `-Os` with `-Oz`.
+  - Validation: V=1 x86 & ppc64 builds show `-Oz` in compile and link lines (see `build/x86/log/libaio.log` and `build/ppc64/log/libaio.log`).
+
+- tpmtotp
+  - Fix: guarded pre-build sed replaces -O[0-9]+ with -Oz in generated Makefile fragments (Makefile, util/Makefile, libtpm/Makefile)
+  - Validation: V=1 builds completed for x86 & ppc64 and grep shows no remaining -O3 in build trees
+  - Logs: build/x86/log/tpmtotp.log, build/ppc64/log/tpmtotp.log
+
+- tpm2-tools
+  - Fix: pre-configure sed normalizes `-O[0-9]+`/`-Os` -> `-Oz` and `CFLAGS`/`CXXFLAGS` set to `-g -Oz` defensively in `modules/tpm2-tools`.
+  - Validation: V=1 x86 build completed and compile/link lines show `-Oz`; TODO: run ppc64 validation if relevant.
+  - Logs: build/x86/log/tpm2-tools.log
+
+- dropbear
+  - Fix: packaging-time sed normalizes optimization flags to `-Oz` (replaces `-O[0-9]+` & `-Os` with `-Oz`) and configure is invoked with size-friendly env vars where applicable.
+  - Validation: V=1 x86 build shows `-Oz` in configure and build logs; a size regression vs an older CircleCI artifact was observed (investigate toolchain vs package changes).
+  - Logs: build/x86/dropbear-2025.88/config.log
+
+- kexec-tools
+  - Fix: packaging-time pre-configure sed normalizes `-O[0-9]+`/`-Os` -> `-Oz` and removes Makefile backup artifacts.
+  - Validation: V=1 x86 & ppc64 builds show `-Oz` only in compile/link lines.
+
+Notes & next steps
+- `.bak` files left in the build trees are artifacts of the reversible sed step; remove them for cleanliness if desired or keep them as audit evidence.
+- For cross-arch completeness, consider running per-package V=1 builds on additional arches (arm64, riscv) for packages that still show legacy -O tokens in non-built files.
+- Kernel config note: changes to enable `CONFIG_TMPFS` and `CONFIG_MEMFD_CREATE` have been applied repository-wide; see the header comment in `initrd/bin/kexec-boot` for rationale and validation guidance.
+
+Sed normalization patterns
+- Generic pre-configure sed applied across multiple modules normalizes optimization flags to `-Oz`:
+  - Pattern: `sed -e 's/-O[0-9]\+/-Oz/g' -e 's/-Os/-Oz/g'`
+  - Placement: applied in `module_configure` target before `./configure` invocation or in pre-build hooks.
+  - Artifact cleanup: `.bak` files generated by sed are kept or removed per module policy (kept for audit evidence by default).
diff --git a/docker/common.sh b/docker/common.sh
old mode 100755
new mode 100644
diff --git a/initrd/bin/kexec-boot b/initrd/bin/kexec-boot
index fa37ebf99..2f617c6de 100755
--- a/initrd/bin/kexec-boot
+++ b/initrd/bin/kexec-boot
@@ -1,5 +1,11 @@
 #!/bin/bash
 # Launches kexec from saved configuration entries
+#
+# NOTE: `kexec-boot` may use memfd-backed initrds and the kexec syscall/file-loader paths.
+# To avoid loader placement/copy errors (e.g., "Failed to copy decompressed buf") ensure
+# kernels intended to run `kexec --kexec-syscall --load ... --initrd=<memfd>` have:
+#   CONFIG_TMPFS=y
+#   CONFIG_MEMFD_CREATE=y
 set -e -o pipefail
 . /tmp/config
 . /etc/functions
@@ -65,10 +71,6 @@ adjust_cmd_line() {
 	adjusted_cmd_line="y"
 }
 
-if [ "$CONFIG_DEBUG_OUTPUT" = "y" ];then
-	#If expecting debug output, have kexec load (-l) output debug info
-	kexeccmd="$kexeccmd -d"
-fi
 
 module_number="1"
 while read line
@@ -79,21 +81,22 @@ do
 	if [ "$key" = "kernel" ]; then
 		fix_file_path
 		if [ "$kexectype" = "xen" ]; then
+			# Force syscall-only loader for Xen to avoid file-loader ELF placement failures
+			kexeccmd="$kexeccmd --kexec-syscall --load $filepath"
 			# always use xen with custom arguments
-			kexeccmd="$kexeccmd -l $filepath"
 			kexeccmd="$kexeccmd --command-line \"$restval no-real-mode reboot=no vga=current\""
 		elif [ "$kexectype" = "multiboot" ]; then
-			kexeccmd="$kexeccmd -l $filepath"
+			kexeccmd="$kexeccmd --load $filepath"
 			kexeccmd="$kexeccmd --command-line \"$restval\""
 		elif [ "$kexectype" = "elf" ]; then
 			DEBUG "kexectype= $kexectype"
 			DEBUG "restval= $restval"
 			DEBUG "filepath= $filepath"
-			kexeccmd="$kexeccmd -l $filepath"
+			kexeccmd="$kexeccmd --load $filepath"
 			DEBUG "kexeccmd= $kexeccmd"
 		else
 			DEBUG "unknown kexectype!!!!"
-			kexeccmd="$kexeccmd -l $filepath"
+			kexeccmd="$kexeccmd --load $filepath"
 		fi
 	fi
 	if [ "$key" = "module" ]; then
diff --git a/modules/bash b/modules/bash
index 62f063f93..e3e4e27ab 100644
--- a/modules/bash
+++ b/modules/bash
@@ -1,6 +1,12 @@
 # GNU bash
 modules-$(CONFIG_BASH) += bash
 
+
+# OFLAG: Enforce CFLAGS='-Oz' at packaging time (set in configure wrapper)
+# GCC15-BASH: Added -std=gnu11 for C23 keyword compatibility (bool, true, false conflicts)
+
+
+
 bash_version := 5.1.16
 bash_dir := bash-$(bash_version)
 bash_tar := bash-$(bash_version).tar.gz
@@ -10,7 +16,9 @@ bash_hash := 5bac17218d3911834520dad13cd1f85ab944e1c09ae1aba55906be1f8192f558
 # --enable-debugger: Enables BASH_SOURCE tracing through functions as well as
 # BASH_ARGV/BASH_ARGC.  (Otherwise BASH_SOURCE[0] is empty when calling a
 # function, it's only set in top level script code.)
-bash_configure := CFLAGS="-g0 -Os" LDFLAGS="-s" ./configure \
+# Also patched lib/termcap/tparam.c to include <unistd.h> for write() function declaration
+# Consider reverting when bash is updated for GCC 15.1.0 compatibility
+bash_configure := CFLAGS="-g0 -Oz -std=gnu11" LDFLAGS="-s" ./configure \
 	$(CROSS_TOOLS) \
 	--host $(target) \
 	--prefix="/usr" \
diff --git a/modules/busybox b/modules/busybox
index 8b9909da8..827c000dd 100644
--- a/modules/busybox
+++ b/modules/busybox
@@ -2,6 +2,12 @@
 CONFIG_BUSYBOX ?= y
 modules-$(CONFIG_BUSYBOX) += busybox
 
+
+# OFLAG: No packaging-time OFLAG normalization applied; validate with V=1 builds if needed.
+
+
+
+
 busybox_version := 1.36.1
 busybox_dir := busybox-$(busybox_version)
 busybox_tar := busybox-$(busybox_version).tar.bz2
diff --git a/modules/cairo b/modules/cairo
index 81d71e9a4..a56748e04 100644
--- a/modules/cairo
+++ b/modules/cairo
@@ -1,5 +1,14 @@
 modules-$(CONFIG_CAIRO) += cairo
 
+
+# OFLAG: Enforce CFLAGS='-Oz' at packaging time (set in configure wrapper)
+# GCC15-CAIRO: GCC 15.1 C23 standard requires workaround flags
+
+# Note: Cairo 1.18.0+ switched to Meson build system (1.16.0 was last autotools version).
+# Upgrading would require additional build infrastructure changes beyond simple autotools configure/make pattern
+
+
+
 cairo_version := 1.14.12
 cairo_dir := cairo-$(cairo_version)
 cairo_tar := cairo-$(cairo_version).tar.xz
@@ -7,7 +16,7 @@ cairo_url := https://www.cairographics.org/releases/$(cairo_tar)
 cairo_hash := 8c90f00c500b2299c0a323dd9beead2a00353752b2092ead558139bd67f7bf16
 
 cairo_configure := \
-	CFLAGS="-DCAIRO_NO_MUTEX=1 -Os"  \
+	CFLAGS="-DCAIRO_NO_MUTEX=1 -std=gnu11 -Wno-inline -Wno-incompatible-pointer-types -Oz"  \
 	$(CROSS_TOOLS) \
 	./configure \
 	--host $(MUSL_ARCH)-elf-linux \
diff --git a/modules/coreboot b/modules/coreboot
index c76e4da8d..b5fb70c29 100644
--- a/modules/coreboot
+++ b/modules/coreboot
@@ -1,5 +1,17 @@
 ifeq "$(CONFIG_COREBOOT)" "y"
 
+# TODO(GCC15-COREBOOT): Consider refactoring coreboot module to use standard module patterns
+# The coreboot module currently doesn't follow the standard module pattern used by other 
+# modules (with _configure, _target variables, etc.). This makes it difficult to apply
+# per-module compiler flags like those needed for GCC 15.1.0 compatibility.
+# OFLAG: No packaging-time -Oz normalization applied; coreboot applies per-version build flags and is expected to manage its own optimization flags (reproducible per-version builds).
+#  Coreboot builds commonly use `-Os` for space optimization in multiple subcomponents, but some toolchain/stage logs on PPC64 show other optimization flags too (see build/ppc64/log/coreboot-talos_2.log).
+#  Evidence: see per-board coreboot log `build/ppc64/log/coreboot-talos_2.log` for flagged compile lines.
+#
+# Current workaround: cbmem utility build in main Makefile uses CC override with 
+# -Wno-unterminated-string-initialization flag.
+# Future: Refactor to use standard module pattern or implement per-module heads_cc extension.
+
 CONFIG_COREBOOT_ROM			?= coreboot.rom
 CONFIG_COREBOOT_BOOTBLOCK	?=
 
@@ -82,6 +94,18 @@ $(eval $(call coreboot_module,24.02.01,))
 # talos_2 could use the 4.20.1 toolchain, but it's the only ppc64 fork, so
 # there is no point preparing another coreboot module that won't be shared with
 # anything.
+
+# GCC_15_PPC64_COREBOOT: PowerPC64 dual-compiler architecture GCC 15.1 compatibility
+# PowerPC64 builds use two different compilers:
+# 1. Coreboot components (bootblock/romstage/ramstage): Big-endian, coreboot's GCC 11.2.0 - no issues
+# 2. Skiboot payload: Little-endian, Heads' GCC 15.1 musl cross-compiler - requires patches
+# Skiboot compilation fixes applied via patches/coreboot-talos_2/0003-ugly_skiboot-patch_fix_for_newer_gcc_from_musl_125.patch
+# - Adds -Wno-error=unterminated-string-initialization for hardware definition arrays
+# - Adds -Wno-error=misleading-indentation for conditional statement formatting
+# - Maintains existing -Wno-error=address-of-packed-member and -Wno-error=format-overflow
+# Rationale: Third-party skiboot firmware has minimal upstream maintenance, warning suppressions
+# more maintainable than invasive code changes. Monitor for additional GCC 16+ warnings.
+
 coreboot-talos_2_repo := https://github.com/Dasharo/coreboot
 coreboot-talos_2_commit_hash := fc47236e9877f4113dfcce07fa928f52d4d2c8ee
 $(eval $(call coreboot_module,talos_2,))
@@ -123,6 +147,11 @@ endif
 
 coreboot_module := coreboot-$(CONFIG_COREBOOT_VERSION)
 modules-y += $(coreboot_module)
+
+
+# OFLAG: No packaging-time -Oz normalization applied; coreboot applies per-version build flags and is expected to manage its own optimization flags (reproducible per-version builds).
+
+
 # Don't make everyone type $($(coreboot_module)_dir)
 coreboot_dir := $($(coreboot_module)_dir)
 coreboot_base_dir := $($(coreboot_module)_base_dir)
diff --git a/modules/coreboot-blobs b/modules/coreboot-blobs
index b213c2f7d..26228f308 100644
--- a/modules/coreboot-blobs
+++ b/modules/coreboot-blobs
@@ -1,2 +1,5 @@
+
+# OFLAG: Untested in prior retest (no build logs observed).
+#
 # empty placeholder file
 # This submodule is defined in modules/coreboot if necessary
diff --git a/modules/cryptsetup b/modules/cryptsetup
index f4f534556..ab53446a5 100644
--- a/modules/cryptsetup
+++ b/modules/cryptsetup
@@ -1,5 +1,12 @@
 modules-$(CONFIG_CRYPTSETUP) += cryptsetup
 
+
+# OFLAG: Untested in prior retest (no build logs observed; boards use cryptsetup2 instead). Note: packaging sets CFLAGS='-Oz' but this module was not exercised.
+
+
+
+# Nothing uses this older module, cryptsetup2 is used instead
+
 cryptsetup_depends := util-linux popt lvm2 $(musl_dep)
 
 cryptsetup_version := 1.7.3
@@ -12,7 +19,7 @@ cryptsetup_hash := af2b04e8475cf40b8d9ffd97a1acfa73aa787c890430afd89804fb544d6ad
 # build path.
 cryptsetup_configure := \
 	$(CROSS_TOOLS) \
-	CFLAGS="-Os" \
+	CFLAGS="-Oz" \
 	./configure \
 	--host $(MUSL_ARCH)-elf-linux \
 	--prefix "/" \
diff --git a/modules/cryptsetup2 b/modules/cryptsetup2
index ff98639b6..7f2905548 100644
--- a/modules/cryptsetup2
+++ b/modules/cryptsetup2
@@ -10,9 +10,17 @@ cryptsetup2_hash := 410ded65a1072ab9c8e41added37b9729c087fef4d2db02bb4ef529ad6da
 
 # Use an empty prefix so that the executables will not include the
 # build path.
+# Pre-configure substitutions mirror other modules and are intentionally small
+# to avoid brittle edits in generated files.
+# Note: OFLAG fix applied and validated (commit fac65ebc7e) — removes embedded -O3 in Argon2 and normalizes libtool flags.
+
 cryptsetup2_configure := \
-	$(CROSS_TOOLS) \
-	CFLAGS="-Os" \
+	( \
+		sed -i 's/hardcode_into_libs=yes/hardcode_into_libs=no/g' configure || true; \
+		sed -i 's/-O3//g' lib/crypto_backend/argon2/*.am lib/crypto_backend/argon2/Makemodule.am || true; \
+		sed -E -i.bak 's/hardcode_libdir_flag_spec=.*/hardcode_libdir_flag_spec=" "/g' configure Makefile.in || true; \
+	) && $(CROSS_TOOLS) \
+	CFLAGS="-Oz" \
 	./configure \
 	--host $(MUSL_ARCH)-elf-linux \
 	--prefix "/" \
diff --git a/modules/dropbear b/modules/dropbear
index ac32a59ca..b66c46c2f 100644
--- a/modules/dropbear
+++ b/modules/dropbear
@@ -1,15 +1,46 @@
 # dropbear is a tiny ssh client
 modules-$(CONFIG_DROPBEAR) += dropbear
 
-dropbear_version := 2016.74
+# Inventory classification: UNKNOWN
+
+dropbear_version := 2025.88
 dropbear_dir := dropbear-$(dropbear_version)
 dropbear_tar := dropbear-$(dropbear_version).tar.bz2
-dropbear_url := https://mirror.dropbear.nl/mirror/releases/$(dropbear_tar)
-dropbear_hash := 2720ea54ed009af812701bcc290a2a601d5c107d12993e5d92c0f5f81f718891
+dropbear_url := https://matt.ucc.asn.au/dropbear/releases/$(dropbear_tar)
+dropbear_hash := 783f50ea27b17c16da89578fafdb6decfa44bb8f6590e5698a4e4d3672dc53d4
 
-dropbear_configure := ./configure \
-	$(CROSS_TOOLS) \
-	--host $(MUSL_ARCH)-elf-linux \
+# Build with space-optimised flags. Force -Oz for the main build and set
+# bundled libtommath to prefer size-friendly flags (configure respects
+# LTM_CFLAGS/DROPBEAR_LTM_CFLAGS when provided in the environment).
+# See other modules for examples: e.g., modules/gpg2
+#
+# NOTE: -Oz support here is partial — verbose builds show the main dropbear
+#       compilation using -Oz while the *bundled* libtommath is built with
+#       -Os (configurable via LTM_CFLAGS/DROPBEAR_LTM_CFLAGS). If you need
+#       further size tuning or to hunt GCC15 regressions, explore the
+#       libtommath/libtomcrypt flag variables (LTM_CFLAGS/LTC_CFLAGS) first.
+#
+# FIXED(-OFLAG): packaging-time sed normalizes optimization flags to `-Oz` only (replaces `-O[0-9]+` and `-Os` with `-Oz`). We intentionally do **not** strip `-funroll-loops` or `-fomit-frame-pointer` here — reintroducing those options into bundled libs did not change the final `dropbear`/`ssh` sizes in our experiments. Validated V=1: configure and build logs show `-Oz` for the main build, but a size regression remains versus an earlier CircleCI artifact (dropbear: 184,832 → 241,248; ssh: 176,416 → 233,048, both ≈ +56 KiB). Local builds use GCC 15.1.0 while the earlier artifact used GCC 9.4.0, so the most likely root cause is compiler/toolchain or upstream package-version changes rather than residual `-O` flags. Action: retain the minimal, reversible sed (creates `.bak`) for reproducibility; record this regression in `build_OFLAG_inventory.csv` and `doc/OFLAG_fixes.md` for future follow-up (possible experiments: rebuild with GCC 9.4, symbol/section diffs, or linker-level mitigations). Priority: Low.
+#
+# NOTE: network support under Heads is seldom used. The `#network-recovery-init`
+#       hook (when present) is currently the main place that invokes dropbear
+#       manually. Consider whether forcing -Oz globally for Dropbear is worth
+#       pursuing if network-recovery is not in active use.
+#
+# TODO: Revisit and document any further flag experiments or required
+#       compatibility fixes before widening -Oz usage elsewhere.
+# Force main build to use -Oz and prefer -Oz for the bundled libtommath.
+# This keeps main dropbear space-optimised while avoiding O3 for libtommath.
+# Use Autotools' cross-compile mechanism so configure knows it's a cross
+# build and won't probe the host compiler for runtime-only hardened flags.
+# Use $(CROSS_TOOLS) so CC and other crosstools are set consistently.
+
+dropbear_configure := \
+	( \
+		sed -E -i.bak 's/-O[0-9]+/-Oz/g; s/-Os/-Oz/g' configure libtommath/makefile_include.mk libtomcrypt/makefile_include.mk || true; \
+	) && $(CROSS_TOOLS) \
+	./configure \
+	--host $(MUSL_ARCH)-linux-musl \
 	--prefix "/" \
 	--disable-lastlog \
 	--disable-syslog \
@@ -17,8 +48,12 @@ dropbear_configure := ./configure \
 	--disable-utmpx \
 	--disable-wtmp \
 	--disable-wtmpx \
-	
-dropbear_output := ssh scp dropbear
+	--disable-loginfunc \
+	--disable-pututline \
+	--disable-pututxline \
+	--disable-openpty \
+	--disable-shadow \
+
 dropbear_target := \
 	$(MAKE_JOBS) \
 	$(CROSS_TOOLS) \
@@ -27,4 +62,6 @@ dropbear_target := \
 	&& \
 	cp -a $(build)/$(dropbear_dir)/dbclient $(build)/$(dropbear_dir)/ssh
 
+dropbear_output := ssh scp dropbear
+
 dropbear_depends := zlib $(musl_dep)
diff --git a/modules/e2fsprogs b/modules/e2fsprogs
index 383e98b49..6f7de47cc 100644
--- a/modules/e2fsprogs
+++ b/modules/e2fsprogs
@@ -2,6 +2,14 @@
 CONFIG_E2FSPROGS ?= y
 modules-$(CONFIG_E2FSPROGS) += e2fsprogs
 
+
+# OFLAG: Enforce CFLAGS='-Oz' at packaging time (set in configure wrapper)
+# GCC15-E2FSPROGS: Added -std=gnu11 for C23 compatibility (bool keyword redefinition conflicts)
+# Remove when e2fsprogs is updated for GCC 15.1.0 compatibility
+
+
+
+
 e2fsprogs_version := 1.47.0
 e2fsprogs_dir := e2fsprogs-$(e2fsprogs_version)
 e2fsprogs_tar := e2fsprogs-$(e2fsprogs_version).tar.xz
@@ -15,7 +23,7 @@ e2fsprogs_hash := 144af53f2bbd921cef6f8bea88bb9faddca865da3fbc657cc9b4d2001097d5
 # location.
 e2fsprogs_configure := \
 	$(CROSS_TOOLS) \
-	CFLAGS="-Os"  \
+	CFLAGS="-Oz -std=gnu11"  \
 	./configure \
 	--host $(MUSL_ARCH)-linux-musl \
 	--prefix "" \
diff --git a/modules/exfatprogs b/modules/exfatprogs
index f8b5ae993..7614f2486 100644
--- a/modules/exfatprogs
+++ b/modules/exfatprogs
@@ -2,6 +2,13 @@
 CONFIG_EXFATPROGS ?= y
 modules-$(CONFIG_EXFATPROGS) += exfatprogs
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
+
 exfatprogs_version := 1.2.1
 exfatprogs_dir := exfatprogs-$(exfatprogs_version)
 exfatprogs_tar := exfatprogs-$(exfatprogs_version).tar.xz
@@ -15,7 +22,7 @@ exfatprogs_hash := a6f3b1fb4bd37835c8f8cb421aac4eb75b880a51342b29850c40639731622
 # location.
 exfatprogs_configure := \
 	$(CROSS_TOOLS) \
-	CFLAGS="-Os"  \
+	CFLAGS="-Oz"  \
 	./configure \
 	--host $(MUSL_ARCH)-linux-musl \
 	--prefix "" \
diff --git a/modules/fbwhiptail b/modules/fbwhiptail
index 4516e8f7c..b4bd6b47b 100644
--- a/modules/fbwhiptail
+++ b/modules/fbwhiptail
@@ -1,5 +1,11 @@
 modules-$(CONFIG_FBWHIPTAIL) += fbwhiptail
 
+
+# OFLAG: Enforce CFLAGS='-Oz' at packaging time (set in configure wrapper)
+
+
+
+
 fbwhiptail_depends := cairo $(musl_dep)
 
 fbwhiptail_version := 1.3
@@ -10,7 +16,7 @@ fbwhiptail_hash := 2eb8fadfd3e2d574de52327bbc80ed6313739a3db9f4d87840c534352c66d
 
 fbwhiptail_target := \
 	$(MAKE_JOBS) \
-    CFLAGS="-g0 -Os" \
+    CFLAGS="-g0 -Oz" \
     LDFLAGS="-s" \
 	$(CROSS_TOOLS) \
 	fbwhiptail
diff --git a/modules/flashprog b/modules/flashprog
index ef34de70e..86f984825 100644
--- a/modules/flashprog
+++ b/modules/flashprog
@@ -1,5 +1,11 @@
 modules-$(CONFIG_FLASHPROG) += flashprog
 
+
+# OFLAG: Enforce CFLAGS='-Oz' at packaging time (set in configure wrapper)
+
+
+
+
 flashprog_depends := pciutils $(musl_dep)
 
 flashprog_version := eb2c04185f8f471c768b742d66e4c552effdd9cb
@@ -29,7 +35,7 @@ endif
 
 flashprog_target := \
 	$(MAKE_JOBS) \
-	CFLAGS="-Os -I$(INSTALL)/include/pci" \
+	CFLAGS="-Oz -I$(INSTALL)/include/pci" \
 	DESTDIR="$(INSTALL)" \
 	INSTALL="$(INSTALL)" \
 	LDFLAGS="-L$(INSTALL)/lib" \
diff --git a/modules/flashrom b/modules/flashrom
index 63143d9dd..2a02ad037 100644
--- a/modules/flashrom
+++ b/modules/flashrom
@@ -1,5 +1,11 @@
 modules-$(CONFIG_FLASHROM) += flashrom
 
+
+# OFLAG: Untested in prior retest (no build logs observed).
+
+
+
+
 flashrom_depends := pciutils $(musl_dep)
 
 flashrom_version := 1776bb46ba6ea3d1ab2ec3f0cd88158aabed7400
@@ -29,7 +35,7 @@ endif
 
 flashrom_target := \
 	$(MAKE_JOBS) \
-	CFLAGS="-Os -I$(INSTALL)/include/pci" \
+	CFLAGS="-Oz -I$(INSTALL)/include/pci" \
 	DESTDIR="$(INSTALL)" \
 	INSTALL="$(INSTALL)" \
 	LDFLAGS="-L$(INSTALL)/lib" \
diff --git a/modules/flashtools b/modules/flashtools
index 94386ba7c..68fdedfae 100644
--- a/modules/flashtools
+++ b/modules/flashtools
@@ -1,5 +1,11 @@
 modules-$(CONFIG_FLASHTOOLS) += flashtools
 
+
+# OFLAG: Enforce CFLAGS='-Oz' at packaging time (set in configure wrapper)
+
+
+
+
 flashtools_depends := $(musl_dep)
 
 flashtools_version := d1e6f12568cb23387144a4b7a6535fe1bc1e79b1
@@ -11,7 +17,7 @@ flashtools_hash := a68cdb4a2e312f96862119a6d829ac900b53d0cbc80caa5632efd43b5b7ee
 flashtools_target := \
 	$(CROSS_TOOLS) \
 	$(MAKE_JOBS) \
-	CFLAGS="-Os -I$(INSTALL)/include" \
+	CFLAGS="-Oz -I$(INSTALL)/include" \
 	LDFLAGS="-L$(INSTALL)/lib" \
 
 flashtools_output := \
diff --git a/modules/frotz b/modules/frotz
index 611e04a91..7004b1e69 100644
--- a/modules/frotz
+++ b/modules/frotz
@@ -1,5 +1,11 @@
 modules-$(CONFIG_FROTZ) += frotz
 
+
+# OFLAG: Untested in prior retest (no build logs observed).
+
+
+
+
 frotz_version := 2.44
 frotz_dir := frotz-$(frotz_version)
 frotz_tar := frotz-$(frotz_version).tar.gz
diff --git a/modules/gpg b/modules/gpg
index 7bab72e71..f41e486f7 100644
--- a/modules/gpg
+++ b/modules/gpg
@@ -1,5 +1,11 @@
 modules-$(CONFIG_GPG) += gpg
 
+
+# OFLAG: Untested in prior retest (no build logs observed; gpg2 is used instead). Note: packaging sets CFLAGS='-Oz'.
+
+
+
+
 # we install gpgv 1.4, which is an older version that has fewer
 # dependencies.  This may need to be revisted later.
 gpg_version := 1.4.21
@@ -18,7 +24,7 @@ gpg_hash := 6b47a3100c857dcab3c60e6152e56a997f2c7862c1b8b2b25adf3884a1ae2276
 # Otherwise it wil try to run tests.
 #
 gpg_configure := \
-	CFLAGS="-Os"  \
+	CFLAGS="-Oz"  \
 	$(CROSS_TOOLS) \
 	./configure \
 	--build $(MUSL_ARCH)-elf-linux \
diff --git a/modules/gpg2 b/modules/gpg2
index b121febc8..e2da15397 100644
--- a/modules/gpg2
+++ b/modules/gpg2
@@ -1,5 +1,11 @@
 modules-$(CONFIG_GPG2) += gpg2
 
+
+# OFLAG: Enforce CFLAGS='-Oz' at packaging time (set in configure wrapper)
+
+
+
+
 gpg2_version := 2.4.0
 gpg2_dir := gnupg-$(gpg2_version)
 gpg2_tar := gnupg-$(gpg2_version).tar.bz2
@@ -12,11 +18,14 @@ gpg2_depends := libgpg-error libgcrypt libksba libassuan npth libusb $(musl_dep)
 # be generated with the correct paths, but then re-write them when
 # we use the install target so that they will be copied to the correct
 # location.
+
+#TODO: remove -std=gnu11 when bumping gpg2 version (current 2.4.0 has C23 compatibility issues with GCC 15.1.0 true keyword conflicts)
 gpg2_configure := \
-	$(CROSS_TOOLS) \
-	CFLAGS="-Os"  \
+	sed -i 's/cross_compiling=no/cross_compiling=yes/' configure \
+	&& $(CROSS_TOOLS) \
+	CFLAGS="-Oz -std=gnu11"  \
 	./configure \
-	CPPFLAGS="-I$(INSTALL)/include/libusb-1.0" \
+	CPPFLAGS="-I$(INSTALL)/include/libusb-1.0 -DDISABLE_PHOTO_VIEWER" \
 	--host $(MUSL_ARCH)-linux-musl \
 	--prefix "/" \
 	--libexecdir "/bin" \
diff --git a/modules/hidapi b/modules/hidapi
index d62b4224f..df335260a 100644
--- a/modules/hidapi
+++ b/modules/hidapi
@@ -1,2 +1,4 @@
+
+# OFLAG: No packaging-time OFLAG normalization applied; validate with V=1 builds if needed.
 # empty placeholder file
 # This submodule is defined in modules/hotp-verification
diff --git a/modules/hotp-verification b/modules/hotp-verification
index 032c80903..537b71702 100644
--- a/modules/hotp-verification
+++ b/modules/hotp-verification
@@ -1,5 +1,11 @@
 modules-$(CONFIG_HOTPKEY) += hotp-verification
 
+
+# OFLAG: No packaging-time OFLAG normalization applied; validate with V=1 builds if needed.
+
+
+
+
 hotp-verification_depends := libusb $(musl_dep)
 
 # v1.7 + non-released stuff under 1.7 version bump (Nitrokey will do PR to change this in the future and also fixes to Heads related to regression fixes under Heads)
diff --git a/modules/io386 b/modules/io386
index 5ee33e630..5ff909d86 100644
--- a/modules/io386
+++ b/modules/io386
@@ -1,5 +1,11 @@
 modules-$(CONFIG_IO386) += io386
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
 io386_depends := $(musl_dep)
 
 io386_version := fc73fcf8e51a70638679c3e9b0ada10527f8a7c1
@@ -11,7 +17,7 @@ io386_hash := 874898af57d86dc057cea39b4a7e0621fc64aa4fb777dfb1eeb11e9134bc9a06
 io386_target := \
 	$(MAKE_JOBS) \
 	$(CROSS_TOOLS) \
-	CFLAGS="-Os" \
+	CFLAGS="-Oz" \
 	SHARED=yes \
 	PREFIX="/" \
 	&& \
diff --git a/modules/ioport b/modules/ioport
index ab25c9299..197fd3bfa 100644
--- a/modules/ioport
+++ b/modules/ioport
@@ -1,12 +1,20 @@
 modules-$(CONFIG_IOPORT) += ioport
 
+
+# OFLAG: Untested in prior retest (no build logs observed).
+
+
+
+
+# Not used in boards
+
 ioport_version := 1.2.orig
 ioport_dir := ioport-$(ioport_version)
 ioport_tar := ioport_$(ioport_version).tar.gz
 ioport_url := https://deb.debian.org/debian/pool/main/i/ioport/$(ioport_tar)
 ioport_hash := 7fac1c4b61eb9411275de0e1e7d7a8c3f34166f64f16413f50741e8fce2b8dc0
 
-ioport_configure := CFLAGS=-Os ./configure \
+ioport_configure := CFLAGS=-Oz ./configure \
 	$(CROSS_TOOLS) \
 	--host i386-elf-linux \
 	--prefix "/" \
diff --git a/modules/json-c b/modules/json-c
index cf310c3cf..842259533 100644
--- a/modules/json-c
+++ b/modules/json-c
@@ -1,5 +1,10 @@
 modules-$(CONFIG_CRYPTSETUP2) += json-c
 
+
+# OFLAG: No packaging-time OFLAG normalization applied; validate with V=1 builds if needed.
+
+
+
 json-c_version := 0.14
 json-c_dir := json-c-$(json-c_version)
 json-c_tar := json-c-$(json-c_version).tar.gz
diff --git a/modules/kbd b/modules/kbd
index b9b471f56..7c74841a9 100644
--- a/modules/kbd
+++ b/modules/kbd
@@ -8,20 +8,28 @@
 # set CONFIG_KBD_DEVTOOLS=y.
 modules-$(CONFIG_KBD) += kbd
 
+
+# OFLAG: Pre-configure sed normalizes optimization flags to '-Oz' (sed pattern replaces -O[0-9]+ and -Os with -Oz) applied before build.
+
+
+
+
 kbd_version := 2.6.1
 kbd_dir := kbd-$(kbd_version)
 kbd_tar := kbd-$(kbd_version).tar.gz
 kbd_url := https://www.kernel.org/pub/linux/utils/kbd/$(kbd_tar)
 kbd_hash := aaed530a1490d63d041448372e2ad4f38c3179042903251000b71d527c46e945
 
-kbd_configure := CFLAGS=-Os ./configure \
-	$(CROSS_TOOLS) \
-	--host i386-elf-linux \
-	--prefix "" \
-	--disable-libkeymap \
-	--disable-libkfont \
-	--disable-optional-progs \
-	--disable-vlock \
+kbd_configure := \
+	sed -E -i 's/-O[0-9]+/-Oz/g; s/-Os/-Oz/g' configure Makefile* */Makefile* || true; \
+	./configure \
+		$(CROSS_TOOLS) \
+		--host i386-elf-linux \
+		--prefix "" \
+		--disable-libkeymap \
+		--disable-libkfont \
+		--disable-optional-progs \
+		--disable-vlock \
 
 kbd_target := \
 	$(MAKE_JOBS) $(CROSS_TOOLS)
diff --git a/modules/kexec b/modules/kexec
deleted file mode 100644
index 515325626..000000000
--- a/modules/kexec
+++ /dev/null
@@ -1,27 +0,0 @@
-modules-$(CONFIG_KEXEC) += kexec
-
-kexec_version := 2.0.26
-kexec_dir := kexec-tools-$(kexec_version)
-kexec_tar := kexec-tools-$(kexec_version).tar.gz
-kexec_url := https://kernel.org/pub/linux/utils/kernel/kexec/$(kexec_tar)
-kexec_hash := 89bdd941542c64fec16311858df304ed3a3908c1a60874d69df5d9bf1611e062
-
-kexec_configure := \
-	CFLAGS="-g -Os -fno-strict-aliasing -Wall -Wstrict-prototypes" \
-	./configure \
-	$(CROSS_TOOLS) \
-	--host $(MUSL_ARCH)-elf-linux \
-	--target $(MUSL_ARCH) \
-	--prefix="/" \
-	--without-lzma \
-	&& $(MAKE) clean
-
-kexec_target := \
-	$(MAKE_JOBS) \
-	$(CROSS_TOOLS) \
-	DESTDIR="$(INSTALL)" \
-	install \
-
-kexec_output := build/sbin/kexec
-
-kexec_depends := zlib $(musl_dep)
diff --git a/modules/kexec-tools b/modules/kexec-tools
new file mode 100644
index 000000000..4b4cb1adb
--- /dev/null
+++ b/modules/kexec-tools
@@ -0,0 +1,35 @@
+modules-$(CONFIG_KEXEC) += kexec-tools
+
+
+# OFLAG: Enforce -Oz at packaging time (CFLAGS/CC set to '-Oz'; pre-configure sed also normalizes -O[0-9]+/-Os to -Oz)
+
+
+
+kexec-tools_commit_hash := e18a71faae081d075c8d3ec559aa68a59295c739
+kexec-tools_version := $(kexec-tools_commit_hash)
+kexec-tools_patch_version := $(kexec-tools_version)
+kexec-tools_dir := kexec-tools-$(kexec-tools_version)
+kexec-tools_repo := https://github.com/horms/kexec-tools.git
+
+kexec-tools_configure := \
+	autoreconf -fi \
+	&& sed -E -i 's/-O[0-9]+/-Oz/g; s/-Os/-Oz/g' configure Makefile* */Makefile* || true \
+	&& CFLAGS="-g -Oz -fno-strict-aliasing -Wall -Wstrict-prototypes" \
+	./configure \
+	$(CROSS_TOOLS) \
+	--host $(MUSL_ARCH)-elf-linux \
+	--target $(MUSL_ARCH) \
+	--prefix="/" \
+	--without-lzma \
+	&& $(MAKE) clean
+
+
+kexec-tools_target := \
+	$(MAKE_JOBS) \
+	$(CROSS_TOOLS) \
+	DESTDIR="$(INSTALL)" \
+	install \
+
+kexec-tools_output := build/sbin/kexec
+
+kexec-tools_depends := zlib zstd $(musl_dep)
diff --git a/modules/libaio b/modules/libaio
index bf83fb90a..07c57d22d 100644
--- a/modules/libaio
+++ b/modules/libaio
@@ -6,6 +6,15 @@ libaio_tar := libaio_$(libaio_version).orig.tar.gz
 libaio_url := https://deb.debian.org/debian/pool/main/liba/libaio/$(libaio_tar)
 libaio_hash := 2c44d1c5fd0d43752287c9ae1eb9c023f04ef848ea8d4aafa46e9aedb678200b
 
+# TODO(-OFLAG): Packaging-time sed to normalize -O flags; FIX applied to change -O2/-Os -> -Oz in source Makefiles prior to build.
+# Action: V=1 package builds validated on x86 & ppc64; compile and link lines show `-Oz`. Marked FIXED for both x86 and ppc64.
+# Inventory classification: fixed - pre-configure sed applied; validated V=1 (x86 & ppc64) — compile/link lines show -Oz
+
+# Packaging-time configure: normalize -O flags in upstream Makefiles to -Oz (non-fatal if files missing)
+libaio_configure := \
+	mkdir -p "$(build)/$(libaio_dir)"; \
+	sed -i 's/-O[0-9]\+/-Oz/g; s/-Os/-Oz/g' $(build)/$(libaio_dir)/src/Makefile $(build)/$(libaio_dir)/Makefile* 2>/dev/null || true
+
 libaio_target := \
 	DESTDIR="$(INSTALL)" \
 	prefix="/" \
diff --git a/modules/libassuan b/modules/libassuan
index e641854f5..fafeb4c2d 100644
--- a/modules/libassuan
+++ b/modules/libassuan
@@ -1,5 +1,11 @@
 modules-$(CONFIG_GPG2) += libassuan
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+#TODO: On version bump, check if hardcode_into_libs sed can be removed if configure script improves
 libassuan_version := 2.5.5
 libassuan_dir := libassuan-$(libassuan_version)
 libassuan_tar := libassuan-$(libassuan_version).tar.bz2
@@ -7,7 +13,8 @@ libassuan_url := https://gnupg.org/ftp/gcrypt/libassuan/$(libassuan_tar)
 libassuan_hash := 8e8c2fcc982f9ca67dcbb1d95e2dc746b1739a4668bc20b3a3c5be632edb34e4
 
 libassuan_configure := \
-	CFLAGS="-Os" \
+	sed -i 's/hardcode_into_libs=yes/hardcode_into_libs=no/g' configure \
+	&& CFLAGS="-Oz" \
 	$(CROSS_TOOLS) \
 	./configure \
 	--host $(MUSL_ARCH)-linux-musl \
diff --git a/modules/libgcrypt b/modules/libgcrypt
index a3ece058b..fc55b74ec 100644
--- a/modules/libgcrypt
+++ b/modules/libgcrypt
@@ -1,5 +1,12 @@
 modules-$(CONFIG_GPG2) += libgcrypt
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
+#TODO: On version bump, check if hardcode_into_libs sed can be removed if configure script improves
 libgcrypt_version := 1.10.1
 libgcrypt_dir := libgcrypt-$(libgcrypt_version)
 libgcrypt_tar := libgcrypt-$(libgcrypt_version).tar.bz2
@@ -7,13 +14,15 @@ libgcrypt_url := https://gnupg.org/ftp/gcrypt/libgcrypt/$(libgcrypt_tar)
 libgcrypt_hash := ef14ae546b0084cd84259f61a55e07a38c3b53afc0f546bffcef2f01baffe9de
 
 libgcrypt_configure := \
-	$(CROSS_TOOLS) \
-	CFLAGS="-Os"  \
+	sed -i 's/hardcode_into_libs=yes/hardcode_into_libs=no/g' configure \
+	&& $(CROSS_TOOLS) \
+	CFLAGS="-Oz"  \
 	./configure \
 	--host=$(MUSL_ARCH)-linux-musl \
 	--prefix "/" \
 	--disable-doc \
 	--disable-static \
+	--disable-jent-support \
 	--with-gpg-error-prefix="$(INSTALL)" \
 
 libgcrypt_target := $(MAKE_JOBS) \
diff --git a/modules/libgpg-error b/modules/libgpg-error
index 0c8553560..84e290e8a 100644
--- a/modules/libgpg-error
+++ b/modules/libgpg-error
@@ -1,5 +1,12 @@
 modules-$(CONFIG_GPG2) += libgpg-error
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
+#TODO: On version bump, check if PowerPC64LE lock object creation is still needed in patches/libgpg-error-1.46.patch
 libgpg-error_version := 1.46
 libgpg-error_dir := libgpg-error-$(libgpg-error_version)
 libgpg-error_tar := libgpg-error-$(libgpg-error_version).tar.bz2
@@ -8,7 +15,7 @@ libgpg-error_hash := b7e11a64246bbe5ef37748de43b245abd72cfcd53c9ae5e7fc5ca59f1c8
 
 libgpg-error_configure := \
 	$(CROSS_TOOLS) \
-	CFLAGS="-Os"  \
+	CFLAGS="-Oz"  \
 	./configure \
 	--host=$(MUSL_ARCH)-linux-musl \
 	--prefix "/" \
diff --git a/modules/libhidapi-libusb b/modules/libhidapi-libusb
index aa3e15b2c..860c3934e 100644
--- a/modules/libhidapi-libusb
+++ b/modules/libhidapi-libusb
@@ -1,5 +1,12 @@
 modules-$(CONFIG_NKSTORECLI) += libhidapi-libusb
 
+
+# OFLAG: Untested in prior retest (no build logs observed).
+
+
+
+
+
 libhidapi-libusb_depends  += libusb
 
 libhidapi-libusb_version := 0.9.0
@@ -9,7 +16,7 @@ libhidapi-libusb_url := https://github.com/libusb/hidapi/archive/$(libhidapi-lib
 libhidapi-libusb_hash := 630ee1834bdd5c5761ab079fd04f463a89585df8fcae51a7bfe4229b1e02a652
 
 MY_CROSS_TOOLS := \
-	CC="$(heads_cc) -Os" \
+	CC="$(heads_cc) -Oz" \
 	$(CROSS_TOOLS_NOCC) \
 
 
diff --git a/modules/libksba b/modules/libksba
index 7230237a7..a73aa9df2 100644
--- a/modules/libksba
+++ b/modules/libksba
@@ -1,5 +1,12 @@
 modules-$(CONFIG_GPG2) += libksba
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
+#TODO: On version bump, check if hardcode_into_libs sed can be removed if configure script improves
 libksba_version := 1.6.3
 libksba_dir := libksba-$(libksba_version)
 libksba_tar := libksba-$(libksba_version).tar.bz2
@@ -7,8 +14,9 @@ libksba_url := https://gnupg.org/ftp/gcrypt/libksba/$(libksba_tar)
 libksba_hash := 3f72c68db30971ebbf14367527719423f0a4d5f8103fc9f4a1c01a9fa440de5c
 
 libksba_configure := \
-	$(CROSS_TOOLS) \
-	CFLAGS="-Os" \
+	sed -i 's/hardcode_into_libs=yes/hardcode_into_libs=no/g' configure \
+	&& $(CROSS_TOOLS) \
+	CFLAGS="-Oz" \
 	./configure \
 	--host $(MUSL_ARCH)-linux-musl \
 	--prefix "/" \
diff --git a/modules/libnitrokey b/modules/libnitrokey
index 8bdb7116b..7dfac9bfa 100644
--- a/modules/libnitrokey
+++ b/modules/libnitrokey
@@ -1,5 +1,12 @@
 modules-$(CONFIG_NKSTORECLI) += libnitrokey
 
+
+# OFLAG: Untested in prior retest (no build logs observed).
+# no board uses this — no build logs available for `libnitrokey` in this retest. Re-run a targeted build to generate logs and re-classify. (audit updated 2026-01-27)
+
+
+
+
 libnitrokey_depends := libhidapi-libusb libusb $(musl_dep)
 
 libnitrokey_version := 3.6
@@ -15,7 +22,7 @@ libnitrokey_hash := 4f3382b6193afe69c2001321038fce9490bc28803ed687152a397ccd8914
 cmake_cross := "-DCMAKE_AR=$(CROSS)ar" \
 	-DCMAKE_CXX_COMPILER="$(CROSS)g++" \
 	-DCMAKE_CXX_COMPILER_AR="$(CROSS)ar" \
-	-DCMAKE_CXX_FLAGS="-Os -fdata-sections -ffunction-sections -ffile-prefix-map=$(pwd)=heads -gno-record-gcc-switches -D__MUSL__ -I$(INSTALL)/include -L$(INSTALL)/lib " \
+	-DCMAKE_CXX_FLAGS="-Oz -fdata-sections -ffunction-sections -ffile-prefix-map=$(pwd)=heads -gno-record-gcc-switches -D__MUSL__ -I$(INSTALL)/include -L$(INSTALL)/lib " \
 	-DCMAKE_C_COMPILER="$(CROSS)gcc" \
 	-DCMAKE_LINKER="$(CROSS)ld"
 	-DCMAKE_NM="$(CROSS)nm" \
diff --git a/modules/libpng b/modules/libpng
index dd2f4edcc..0c37db9aa 100644
--- a/modules/libpng
+++ b/modules/libpng
@@ -1,5 +1,11 @@
 modules-$(CONFIG_CAIRO) += libpng
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
 libpng_version := 1.6.34
 libpng_dir := libpng-$(libpng_version)
 libpng_tar := libpng-$(libpng_version).tar.gz
@@ -8,7 +14,7 @@ libpng_hash := 574623a4901a9969080ab4a2df9437026c8a87150dfd5c235e28c94b212964a7
 
 libpng_configure := \
 	$(CROSS_TOOLS) \
-	CFLAGS="-Os" \
+	CFLAGS="-Oz" \
 	./configure \
 	--host $(MUSL_ARCH)-elf-linux \
 	--prefix="/" \
diff --git a/modules/libusb b/modules/libusb
index 56dfc044e..4f148a214 100644
--- a/modules/libusb
+++ b/modules/libusb
@@ -1,7 +1,13 @@
 # GPG with Yubikey support requires libusb
 modules-$(CONFIG_GPG) += libusb
+
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
 modules-$(CONFIG_GPG2) += libusb
 
+
 libusb_version := 1.0.21
 libusb_dir := libusb-$(libusb_version)
 libusb_tar := libusb-$(libusb_version).tar.bz2
@@ -10,7 +16,7 @@ libusb_url := https://github.com/libusb/libusb/releases/download/v$(libusb_versi
 libusb_hash := 7dce9cce9a81194b7065ee912bcd55eeffebab694ea403ffb91b67db66b1824b
 
 libusb_configure := \
-	CFLAGS="-Os" \
+	CFLAGS="-Oz" \
 	./configure \
 	$(CROSS_TOOLS) \
 	--host $(MUSL_ARCH)-elf-linux \
diff --git a/modules/libusb-compat b/modules/libusb-compat
index 6c119e459..1ca0265b9 100644
--- a/modules/libusb-compat
+++ b/modules/libusb-compat
@@ -4,6 +4,12 @@
 
 modules-$(CONFIG_GPG) += libusb-compat
 
+
+# OFLAG: Untested in prior retest (no build logs observed; used only by GPG which is not enabled — gpg2 is used instead). Note: packaging sets CFLAGS='-Oz'.
+
+
+
+
 libusb-compat_version := 0.1.5
 libusb-compat_dir := libusb-compat-$(libusb-compat_version)
 libusb-compat_tar := libusb-compat-$(libusb-compat_version).tar.bz2
@@ -11,7 +17,7 @@ libusb-compat_url := https://downloads.sourceforge.net/project/libusb/libusb-com
 libusb-compat_hash := 404ef4b6b324be79ac1bfb3d839eac860fbc929e6acb1ef88793a6ea328bc55a
 
 libusb-compat_configure := \
-	CFLAGS="-Os" \
+	CFLAGS="-Oz" \
 	./configure \
 	$(CROSS_TOOLS) \
 	--host $(MUSL_ARCH)-elf-linux \
diff --git a/modules/linux b/modules/linux
index 206ff95f1..afeb7c12a 100644
--- a/modules/linux
+++ b/modules/linux
@@ -1,5 +1,11 @@
 modules-y += linux
 
+
+# OFLAG: No packaging-time -Oz normalization applied; the Linux kernel uses -Os (per kernel version), so package-level -Oz normalization is not applied here.
+
+
+
+
 ifeq "$(CONFIG_TARGET_ARCH)" "x86"
 	LINUX_ARCH			:= x86
 	LINUX_IMAGE_FILE	:= bzImage
@@ -38,6 +44,14 @@ else
 $(error "$(BOARD): does not specify linux kernel version under CONFIG_LINUX_VERSION")
 endif
 
+# Base EXTRA_FLAGS for all Linux versions
+EXTRA_FLAGS := -fdebug-prefix-map=$(pwd)=heads -gno-record-gcc-switches
+
+GCC15-LINUX: 6.1.8 requires -std=gnu11 for C23 compatibility (bool/false keyword conflicts)
+ifeq "$(CONFIG_LINUX_VERSION)" "6.1.8"
+EXTRA_FLAGS += -std=gnu11
+endif
+
 linux_base_dir := linux-$(linux_version)
 
 # input file in the heads config/ dir
@@ -144,6 +158,18 @@ ifeq "$(CONFIG_LINUX_VERSION)" "4.14.62"
 EXTRA_FLAGS += -Wno-cast-function-type
 endif
 
+# PowerPC specific alignment fixes for GCC 15.1.0
+ifeq "$(CONFIG_TARGET_ARCH)" "ppc64"
+# Comprehensive GCC 15.1.0 PowerPC compatibility flags
+EXTRA_FLAGS += -fno-stack-protector
+EXTRA_FLAGS += -O1
+EXTRA_FLAGS += -fno-schedule-insns -fno-schedule-insns2
+EXTRA_FLAGS += -fno-reorder-blocks
+EXTRA_FLAGS += -fno-tree-vectorize
+# Force GNU C11 for PowerPC boot code to avoid C23 bool keyword conflicts
+EXTRA_FLAGS += -std=gnu11
+endif
+
 linux_target := \
 	O="$(build)/$(linux_dir)" \
 	ARCH="$(LINUX_ARCH)" \
diff --git a/modules/linuxboot b/modules/linuxboot
index b95dad672..ec012487f 100644
--- a/modules/linuxboot
+++ b/modules/linuxboot
@@ -1,5 +1,12 @@
 modules-$(CONFIG_LINUXBOOT) += linuxboot
 
+
+# OFLAG: No packaging-time OFLAG normalization applied; validate with V=1 builds if needed.
+
+
+
+
+
 linuxboot_version := git
 linuxboot_repo := https://github.com/osresearch/linuxboot
 linuxboot_base_dir := linuxboot-$(linuxboot_version)
diff --git a/modules/lvm2 b/modules/lvm2
index 0306d56dc..ee6db7f26 100644
--- a/modules/lvm2
+++ b/modules/lvm2
@@ -1,11 +1,19 @@
 modules-$(CONFIG_LVM2) += lvm2
 
+
+# OFLAG: Enforce -Oz at packaging time (configure option --with-optimisation=-Oz)
+
+
+
+
+
 lvm2_version := 2.03.23
 lvm2_dir := lvm2.$(lvm2_version)
 lvm2_tar := LVM2.$(lvm2_version).tgz
 lvm2_url := https://mirrors.kernel.org/sourceware/lvm2/$(lvm2_tar)
 lvm2_hash := 74e794a9e9dee1bcf8a2065f65b9196c44fdf321e22d63b98ed7de8c9aa17a5d
 
+#TODO: remove libgen.h patch when bumping lvm2 version (current 2.03.23 needs libgen.h include for basename function with GCC 15.1.0)
 # cross compiling test assumes malloc/realloc aren't glibc compat
 # so we force it via the configure cache.
 lvm2_configure := \
@@ -19,7 +27,7 @@ lvm2_configure := \
 	--with-default-pid-dir=/run \
 	--with-default-dm-run-dir=/run \
 	--with-default-run-dir=/run/lvm \
-	--with-optimisation=-Os \
+	--with-optimisation=-Oz \
 	--enable-devmapper \
 	--disable-selinux \
 	--without-systemd \
@@ -37,7 +45,26 @@ lvm2_configure := \
 	--disable-cmirrord \
 	--disable-cache_check_needs_check \
 	--disable-thin_check_needs_check \
+	--disable-systemd-journal \
+	--disable-app-machineid \
+	--disable-blkid_wiping \
+	--disable-o_direct \
+	--disable-fsadm \
+	--disable-blkdeactivate \
+	--disable-blkzeroout \
+	--without-blkid \
+	--without-udev \
 	--with-cluster=none \
+	--with-thin=none \
+	--with-cache=none \
+	--with-vdo=none \
+	--with-writecache=none \
+	--with-integrity=none \
+	--with-snapshots=none \
+	--with-mirrors=none \
+	--disable-udev_rules \
+	--disable-pkgconfig \
+	--disable-nls \
 	--with-thin-check= \
 
 # not sure why LIB_SUFFIX is not defined in the cross build
diff --git a/modules/mbedtls b/modules/mbedtls
index 200b75f6b..56351c669 100644
--- a/modules/mbedtls
+++ b/modules/mbedtls
@@ -1,5 +1,12 @@
 modules-$(CONFIG_MBEDTLS) += mbedtls
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
+
 mbedtls_version := 2.4.2
 mbedtls_dir := mbedtls-$(mbedtls_version)
 mbedtls_tar := mbedtls-$(mbedtls_version).tar.gz
@@ -12,7 +19,7 @@ mbedtls_configure :=
 
 mbedtls_target := \
 	SHARED=1 \
-	CFLAGS="-Os"  \
+	CFLAGS="-Oz"  \
 	DESTDIR=$(INSTALL) \
 	$(CROSS_TOOLS) \
 	$(MAKE_JOBS) \
diff --git a/modules/msrtools b/modules/msrtools
index 25d2a3bc8..75b130594 100644
--- a/modules/msrtools
+++ b/modules/msrtools
@@ -1,5 +1,12 @@
 modules-$(CONFIG_MSRTOOLS) += msrtools
 
+
+# OFLAG: No packaging-time OFLAG normalization applied; validate with V=1 builds if needed.
+
+
+
+
+
 msrtools_depends := $(musl_dep)
 
 #msrtools_version := git
diff --git a/modules/musl-cross-make b/modules/musl-cross-make
index e4662e8ba..1b94394c7 100644
--- a/modules/musl-cross-make
+++ b/modules/musl-cross-make
@@ -1,14 +1,26 @@
 CONFIG_MUSL ?= y
 
+# GCC 15.1.0 Upgrade Notes:
+# - Upgraded from GCC 9.4.0 to 15.1.0 for improved -Oz optimization support
+# - Multiple modules required C23 compatibility fixes (see individual module TODOs)
+# - Systematic conversion from -Os to -Oz optimization across 33+ modules
+# - Key compatibility issues resolved: bool/false conflicts, basename function, true keyword, inlining
+
 ifeq "$(MUSL_CROSS_ONCE)" ""
 MUSL_CROSS_ONCE := 1
 modules-$(CONFIG_MUSL) += musl-cross-make
 
-musl-cross-make_version := fd6be58297ee21fcba89216ccd0d4aca1e3f1c5c
+
+# OFLAG: No packaging-time -Oz normalization applied; musl-cross-make is part of the buildstack and is intentionally not subject to package-level -Oz normalization.
+
+
+
+
+musl-cross-make_version := e5147dde912478dd32ad42a25003e82d4f5733aa
 musl-cross-make_dir := musl-cross-make-$(musl-cross-make_version)
 musl-cross-make_url := https://github.com/richfelker/musl-cross-make/archive/$(musl-cross-make_version).tar.gz
 musl-cross-make_tar := musl-cross-make-$(musl-cross-make_version).tar.gz
-musl-cross-make_hash := 15b8e0a287d738a46e069e90d67a8d96213b357b79aaf3e8cf0cd40e4b230d9e
+musl-cross-make_hash := 24af217c8f4f4335f53057eae475c7d1c73d8bc7f02e66acda83b624879e0b0f
 
 
 ifneq "$(CROSS)" ""
diff --git a/modules/ncurses b/modules/ncurses
index aee73e29e..9e1be3cec 100644
--- a/modules/ncurses
+++ b/modules/ncurses
@@ -1,5 +1,11 @@
 modules-$(CONFIG_NEWT) += ncurses
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
 ncurses_depends := $(musl_dep)
 
 ncurses_version := 6.5
@@ -9,7 +15,7 @@ ncurses_url := https://invisible-island.net/archives/ncurses/ncurses-$(ncurses_v
 ncurses_hash := 136d91bc269a9a5785e5f9e980bc76ab57428f604ce3e5a5a90cebc767971cc6
 
 ncurses_configure := \
-	CFLAGS="-Os" ./configure \
+	CFLAGS="-Oz" ./configure \
 	$(CROSS_TOOLS) \
 	--host $(MUSL_ARCH)-elf-linux \
 	--without-ada \
diff --git a/modules/newt b/modules/newt
index 10fd91be8..3e32a4039 100644
--- a/modules/newt
+++ b/modules/newt
@@ -1,5 +1,12 @@
 modules-$(CONFIG_NEWT) += newt
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
+
 newt_depends := popt slang ncurses $(musl_dep)
 
 newt_version := 0.52.24
@@ -20,7 +27,7 @@ newt_libraries := \
 	libnewt.so.0.52 \
 
 newt_configure := \
-	./autogen.sh && CFLAGS="-Os" ./configure \
+	./autogen.sh && CFLAGS="-Oz" ./configure \
 	$(CROSS_TOOLS) \
 	--host $(MUSL_ARCH)-elf-linux \
 	--prefix "/" \
diff --git a/modules/nkstorecli b/modules/nkstorecli
index 942b9a4dd..d4bc58395 100644
--- a/modules/nkstorecli
+++ b/modules/nkstorecli
@@ -1,5 +1,12 @@
 modules-$(CONFIG_NKSTORECLI) += nkstorecli
 
+
+# OFLAG: No packaging-time OFLAG normalization applied; validate with V=1 builds if needed.
+
+
+
+
+
 nkstorecli_depends := libnitrokey libusb $(musl_dep)
 
 nkstorecli_version := 0.4.1
diff --git a/modules/npth b/modules/npth
index 1bbec1c03..1ca1e3063 100644
--- a/modules/npth
+++ b/modules/npth
@@ -6,8 +6,17 @@ npth_tar := npth-$(npth_version).tar.bz2
 npth_url := https://gnupg.org/ftp/gcrypt/npth/$(npth_tar)
 npth_hash := 1393abd9adcf0762d34798dc34fdcf4d0d22a8410721e76f1e3afcd1daa4e2d1
 
-npth_configure := ./configure \
-	$(CROSS_TOOLS) \
+# FIXED(-OFLAG): pre-configure sed applied to normalize optimization flags; validated V=1 on x86 (compile/link lines show -Oz).
+# Evidence: build/x86/log/npth.log shows `-Oz` in compile/link lines; remaining `-O2` mentions are only in backup files (`configure.bak`) and libtool macro defaults.
+# Action: keep guarded sed (creates .bak files for audit); optional cleanup of .bak files later. Priority: Low.
+# Inventory classification: fixed - pre-configure sed applied (validated V=1 x86)
+
+
+npth_configure := \
+	( \
+		sed -E -i.bak 's/CFLAGS="-g -O[0-9]+"/CFLAGS="-g -Oz"/g; s/CFLAGS="-O[0-9]+"/CFLAGS="-Oz"/g; s/-O[0-9]+/-Oz/g' configure src/Makefile tests/Makefile libtool || true; \
+	) && $(CROSS_TOOLS) \
+	./configure \
 	--host $(MUSL_ARCH)-linux-musl \
 	--prefix "/" \
 	--disable-static \
diff --git a/modules/openssl b/modules/openssl
index 8bca5eaf7..062ed2e7b 100644
--- a/modules/openssl
+++ b/modules/openssl
@@ -1,6 +1,12 @@
 # OpenSSL library
 modules-$(CONFIG_OPENSSL) += openssl
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
 openssl_version := 3.0.8
 openssl_dir := openssl-$(openssl_version)
 openssl_tar := openssl-$(openssl_version).tar.gz
@@ -11,7 +17,7 @@ openssl_hash := 6c13d2bf38fdf31eac3ce2a347073673f5d63263398f1f69d0df4a41253e4b3e
 # and SM3.
 openssl_configure := \
 	$(CROSS_TOOLS) \
-	CFLAGS="-Os" \
+	CFLAGS="-Oz" \
 	./Configure \
 		--prefix="/" \
 		linux-$(strip $(arch)) \
@@ -25,9 +31,14 @@ openssl_configure := \
 		no-des \
 		no-dh \
 		no-dsa \
+		no-dtls \
+		no-ec2m \
 		no-ecdh \
 		no-ecdsa \
+		no-engine \
+		no-gost \
 		no-idea \
+		no-md2 \
 		no-md4 \
 		no-mdc2 \
 		no-ocb \
@@ -41,7 +52,11 @@ openssl_configure := \
 		no-siv \
 		no-sm2 \
 		no-sm4 \
+		no-srp \
+		no-ssl3 \
 		no-tests \
+		no-tls1 \
+		no-tls1_1 \
 		no-whirlpool \
 
 openssl_target := $(MAKE_JOBS) \
diff --git a/modules/pciutils b/modules/pciutils
index 08ba7b77d..f12b07314 100644
--- a/modules/pciutils
+++ b/modules/pciutils
@@ -11,6 +11,13 @@ pciutils_tar := pciutils-$(pciutils_version).tar.xz
 pciutils_url := https://www.kernel.org/pub/software/utils/pciutils/$(pciutils_tar)
 pciutils_hash := 64293c6ab9318c40ef262b76d87bd9097531759752bac556e50979b1e63cfe66
 
+# TODO(-OFLAG): OFLAG status: CONFIRMED — hardcoded -O2 (49 occurrences) observed in `pciutils` compile lines, preventing `CFLAGS=-Oz` from being decisive.
+# Evidence: build/x86/log/pciutils.log contains many `-O2` gcc invocations.
+# Action: use packaging-time `sed` to normalize optimization tokens to `-Oz` and keep the resulting `.bak` files as evidence (no upstream source patching; patches should only change runtime behaviour). Verify via V=1 package/board builds. Priority: Medium.
+# Inventory classification: hardcoded -O2 (49 occurrences)
+# Patch policy: if an upstream-source patch becomes necessary it must be placed under `patches/<package>-<version>/0001-<reason>.patch` and be named with a numbered prefix and short reason. For this package we include a source patch at `patches/pciutils-3.5.4/0001-add-PCI_HAVE_STDINT_H.patch` (non-OFLAG source fix). Compilation/build-time fixes remain packaging-time `sed` edits unless a source patch is required.
+
+
 # IDSDIR must be set to a constant during the build,
 # but not during the install to make the libpci.so.3
 # reproducible.  Otherwise the build path will be embedded
@@ -26,6 +33,7 @@ pciutils_target := \
 	SHARED=yes \
 	IDSDIR="/" \
 	PREFIX="/" \
+	&& sed -E -i.bak 's/-O[0-9]+/-Oz/g; s/-Os/-Oz/g;' $(build)/$(pciutils_dir)/Makefile* $(build)/$(pciutils_dir)/*/Makefile* 2>/dev/null || true \
 	&& \
 	$(MAKE) \
 	-C $(build)/$(pciutils_dir) \
diff --git a/modules/pinentry b/modules/pinentry
index 86ab96b6a..13fc518f1 100644
--- a/modules/pinentry
+++ b/modules/pinentry
@@ -2,6 +2,13 @@
 CONFIG_PINENTRY ?= $(CONFIG_GPG2)
 modules-$(CONFIG_PINENTRY) += pinentry
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
+
 pinentry_version := 1.1.0
 pinentry_dir := pinentry-$(pinentry_version)
 pinentry_tar := pinentry-$(pinentry_version).tar.bz2
@@ -15,7 +22,7 @@ pinentry_hash := 68076686fa724a290ea49cdf0d1c0c1500907d1b759a3bcbfbec0293e8f5657
 # location.
 pinentry_configure := \
 	$(CROSS_TOOLS) \
-	CFLAGS="-Os" \
+	CFLAGS="-Oz" \
 	./configure \
 	--host $(MUSL_ARCH)-linux-musl \
 	--prefix "/" \
diff --git a/modules/pixman b/modules/pixman
index 828696f93..1d8d36807 100644
--- a/modules/pixman
+++ b/modules/pixman
@@ -1,5 +1,11 @@
 modules-$(CONFIG_CAIRO) += pixman
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
 pixman_version := 0.34.0
 pixman_dir := pixman-$(pixman_version)
 pixman_tar := pixman-$(pixman_version).tar.gz
@@ -8,7 +14,7 @@ pixman_hash := 21b6b249b51c6800dc9553b65106e1e37d0e25df942c90531d4c3997aa20a88e
 
 pixman_configure := \
 	$(CROSS_TOOLS) \
-	CFLAGS="-Os"  \
+	CFLAGS="-Oz"  \
 	./configure \
 	--host $(MUSL_ARCH)-elf-linux \
 	--prefix="/" \
diff --git a/modules/popt b/modules/popt
index 6e24422d6..e60ae44a6 100644
--- a/modules/popt
+++ b/modules/popt
@@ -1,15 +1,24 @@
 modules-$(CONFIG_POPT) += popt
 
+
+# OFLAG: Pre-configure sed normalizes optimization flags to '-Oz' (sed pattern replaces -O[0-9]+ and -Os with -Oz) applied before build.
+
+
+
+
+
 popt_version := 1.19
 popt_dir := popt-$(popt_version)
 popt_tar := popt-$(popt_version).tar.gz
 popt_url := https://fossies.org/linux/misc/$(popt_tar)
 popt_hash := c25a4838fc8e4c1c8aacb8bd620edb3084a3d63bf8987fdad3ca2758c63240f9
 
-popt_configure := ./configure \
-	$(CROSS_TOOLS) \
-	--host $(MUSL_ARCH)-elf-linux \
-	--prefix "/" \
+popt_configure := \
+	sed -E -i 's/-O[0-9]+/-Oz/g' configure src/Makefile tests/Makefile libtool || true; \
+	./configure \
+		$(CROSS_TOOLS) \
+		--host $(MUSL_ARCH)-elf-linux \
+		--prefix "/" \
 
 popt_target := \
 	$(MAKE_JOBS) \
diff --git a/modules/powerpc-utils b/modules/powerpc-utils
index 5526afd8b..9dace5ef8 100644
--- a/modules/powerpc-utils
+++ b/modules/powerpc-utils
@@ -1,5 +1,23 @@
 modules-$(CONFIG_POWERPC_UTILS) += powerpc-utils
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
+
+# GCC_15_POWERPC_UTILS: Function pointer signature compatibility for GCC 15.1
+# powerpc-utils 1.3.5 used void (*)() function pointers for RTAS event helpers
+# even though the implementations have concrete signatures. GCC 15.1 C23
+# rejects those implicit conversions. Fixed via
+# patches/powerpc-utils-1.3.5/0001-fix-rtas-function-pointer-signatures-gcc15.patch
+# - parse_rtas_event: void *(*)(char *, int)
+# - rtas_print_event: void (*)(FILE *, void *, int)
+# - cleanup_rtas_event: void (*)(void *)
+# RTAS (Runtime Abstraction Services) is the PowerPC firmware interface; these
+# helpers must match its API. Monitor upstream for an official fix.
+
 powerpc-utils_version := 1.3.5
 powerpc-utils_dir := powerpc-utils-$(powerpc-utils_version)
 powerpc-utils_tar := powerpc-utils-$(powerpc-utils_version).tar.gz
@@ -9,7 +27,7 @@ powerpc-utils_hash := 77efe3978ac9c251c4728a35b9aebd6076583939a8e26cc7f07ffa8643
 powerpc-utils_configure := \
 	./autogen.sh && \
 	$(CROSS_TOOLS) \
-	CFLAGS="-Os"  \
+	CFLAGS="-Oz"  \
 	./configure \
 	--host $(MUSL_ARCH)-elf-linux \
 	--prefix "/" \
diff --git a/modules/purism-blobs b/modules/purism-blobs
index e75c6bd11..49c965030 100644
--- a/modules/purism-blobs
+++ b/modules/purism-blobs
@@ -1,5 +1,12 @@
 modules-$(CONFIG_PURISM_BLOBS) += purism-blobs
 
+
+# OFLAG: No packaging-time OFLAG normalization applied; validate with V=1 builds if needed.
+
+
+
+
+
 purism-blobs_base_dir := coreboot-$(CONFIG_COREBOOT_VERSION)/3rdparty/purism-blobs
 purism-blobs_version := 995f66c445841b86e6596e9b297cc4888c0257e5
 purism-blobs_tar := purism-blobs-${purism-blobs_version}.tar.gz
diff --git a/modules/qrencode b/modules/qrencode
index fbfbb870c..3f9a8636e 100644
--- a/modules/qrencode
+++ b/modules/qrencode
@@ -1,5 +1,12 @@
 modules-$(CONFIG_QRENCODE) += qrencode
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
+
 qrencode_version := 3.4.4
 qrencode_dir := qrencode-$(qrencode_version)
 qrencode_tar := qrencode-$(qrencode_version).tar.gz
@@ -9,7 +16,7 @@ qrencode_hash := e794e26a96019013c0e3665cb06b18992668f352c5553d0a553f5d144f7f2a7
 qrencode_libraries := .libs/libqrencode.so.3
 
 qrencode_configure := \
-	CFLAGS="-Os" \
+	CFLAGS="-Oz" \
 	./configure \
 	$(CROSS_TOOLS) \
 	--host $(MUSL_ARCH)-elf-linux \
diff --git a/modules/slang b/modules/slang
index 6a8f5d3c5..102c2c2ea 100644
--- a/modules/slang
+++ b/modules/slang
@@ -1,12 +1,20 @@
 modules-$(CONFIG_SLANG) += slang
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
 slang_version := 2.3.3
 slang_dir := slang-$(slang_version)
 slang_tar := slang-$(slang_version).tar.bz2
 slang_url := https://www.jedsoft.org/releases/slang/$(slang_tar)
 slang_hash := f9145054ae131973c61208ea82486d5dd10e3c5cdad23b7c4a0617743c8f5a18
 
-slang_configure := ./configure \
+
+slang_configure := \
+	sed -i 's/CFLAGS="-g -O2"/CFLAGS="-g -Oz"/g; s/CFLAGS="-O2"/CFLAGS="-Oz"/g; s/-O2/-Oz/g' configure src/mkfiles/makefile.all slsh/mkfiles/makefile.all modules/mkfiles/makefile.all slsh/Makefile.g32 autoconf/aclocal.m4 INSTALL.unx || true \
+	&& ./configure \
 	$(CROSS_TOOLS) \
 	ac_cv_path_nc5config=ncurses-config \
 	--host $(MUSL_ARCH)-elf-linux \
diff --git a/modules/tpm2-tools b/modules/tpm2-tools
index 0051a28a1..032dcbc2a 100644
--- a/modules/tpm2-tools
+++ b/modules/tpm2-tools
@@ -1,6 +1,12 @@
 # TPM2 tools program
 modules-$(CONFIG_TPM2_TOOLS) += tpm2-tools
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
 # CONFIG_TPM means any TPM version.  (CONFIG_TPM2_TOOLS differentiates them when
 # they must be handled differently, which should be localized.)  Boards setting
 # CONFIG_TPM2_TOOLS=y imply CONFIG_TPM=y.
@@ -20,13 +26,14 @@ tpm2-tools_hash := 52c8bcbaadca082abfe5eb7ee4967d2d632d84b1677675f2f071b6d2ec22c
 #tpm2-tools doesn't play nice with reproducible builds, hardcoding lib paths without providing a configure option to remove rpaths
 #  We make sure no hardcoding of libdir flags exist in configure script prior of calling the script with sed call
 #  We pass additional remapping of prefix-map from $INSTALL to local dir
-#
-# TODO: remove all patches and uniformize with similar sed calls.
+
+
 tpm2-tools_configure := \
 	echo "$(tpm2-tools_version)" > ./VERSION \
 	&& ./bootstrap \
 	&& sed -i 's/hardcode_libdir_flag_spec=.*/hardcode_libdir_flag_spec=" "/' configure \
-	&& ./configure \
+	&& sed -E -i 's/-O[0-9]+/-Oz/g; s/-Os/-Oz/g' configure \
+	&& CFLAGS="-g -Oz" CXXFLAGS="-g -Oz" ./configure \
 	$(CROSS_TOOLS) \
 	--host $(MUSL_ARCH)-elf-linux \
 	--prefix "/" \
diff --git a/modules/tpm2-tss b/modules/tpm2-tss
index 91e1a26cd..4845e507d 100644
--- a/modules/tpm2-tss
+++ b/modules/tpm2-tss
@@ -7,15 +7,23 @@ tpm2-tss_tar := tpm2-tss-$(tpm2-tss_version).tar.gz
 tpm2-tss_url := https://github.com/tpm2-software/tpm2-tss/releases/download/$(tpm2-tss_version)/$(tpm2-tss_tar)
 tpm2-tss_hash := ba9e52117f254f357ff502e7d60fce652b3bfb26327d236bbf5ab634235e40f1
 
-#Repro checks:
-# find build/x86/tpm2-tss-3.2.2/src/*/.libs/libtss2-*so* | while read file; do echo "library $file:"; strings $file|grep heads; done
-#  Should not return any result 
-
-#NEEDED otherwise output on previous command
-#sed -i 's/hardcode_into_libs=yes/hardcode_into_libs=no/g' configure
-# needed otherwise library build/x86/tpm2-tss-3.2.2/src/tss2-tcti/.libs/libtss2-tcti-pcap.so.0.0.0:
-# contains: /home/user/heads/build/x86/tpm2-tss-3.2.2/src/tss2-tcti/.libs:/home/user/heads/build/x86/tpm2-tss-3.2.2/src/tss2-mu/.libs://lib
-tpm2-tss_configure := aclocal && automake --add-missing && autoreconf -fi \
+
+# OFLAG status: addressed — packaging-time normalization applied to autotools inputs
+# Actions taken:
+#  - Applied in-place `sed -i` normalization to `configure.ac` and `m4/*` to replace `-O[0-9]+` and `-Os` with `-Oz` and to collapse duplicate `-Oz` tokens.
+#  - Avoided editing generated `configure` in-place to prevent corrupting embedded scripts/backreferences; instead we edit autotools inputs and run `autoreconf`.
+#  - Set `hardcode_into_libs=yes` -> `no` to avoid hardcoding lib paths into installed `.la` artifacts.
+# Validation & repro:
+#  - Full verbose board build (V=1) completed and `build/x86/log/tpm2-tss.log` shows compile invocations using `-Oz` and **no** `-O2` in effective compile/link lines.
+#  - Residual `-O2` occurrences remain only in autotools caches/traces (e.g. `autom4te.cache/*`, `configure~`), which are informational and do not affect actual compile commands.
+# Next steps:
+#  - Optionally run `make BOARD=XYZ tpm2-tss V=1` to validate package-only behavior and ensure regenerated files remain normalized; otherwise consider this module ready for committing the packaging-time edits.
+# Inventory classification: fixed — packaging-time sed applied; validated (no -O2 in compile lines; -Oz present)
+
+tpm2-tss_configure := \
+	sed -i 's/-O[0-9][0-9]*/-Oz/g; s/-Os/-Oz/g' configure.ac \
+	&& sed -i 's/-O[0-9][0-9]*/-Oz/g; s/-Os/-Oz/g' m4/* || true \
+	&& aclocal && automake --add-missing && autoreconf -fi \
 	&& sed -i 's/hardcode_into_libs=yes/hardcode_into_libs=no/g' configure \
 	&& ./configure \
 	$(CROSS_TOOLS) \
diff --git a/modules/tpmtotp b/modules/tpmtotp
index eb52f03c6..2744e8ec6 100644
--- a/modules/tpmtotp
+++ b/modules/tpmtotp
@@ -8,12 +8,19 @@ tpmtotp_tar := tpmtotp-$(tpmtotp_version).tar.gz
 tpmtotp_url := https://github.com/osresearch/tpmtotp/archive/$(tpmtotp_version).tar.gz
 tpmtotp_hash := eaac1e8f652f1da7f5a1ed6a8cfefb6511f1e5e1dabf93b44db3b29c18c5ae53
 
+# OFLAG status: FIXED — CFLAGS set to `-Oz` (overrides many cases) and a _configure `sed` applied to replace remaining `-O3` occurrences in generated Makefiles; validated on x86 and ppc64 (see build/x86/log/tpmtotp.log, build/ppc64/log/tpmtotp.log).
+# Inventory classification: OK - validated (x86 & ppc64)
+
+tpmtotp_configure := \
+	sed -E -i 's/-O[0-9]+/-Oz/g' Makefile util/Makefile libtpm/Makefile || true
+
 tpmtotp_target := \
 	$(CROSS_TOOLS) \
 	$(MAKE_JOBS) \
-	CFLAGS="-I$(INSTALL)/include -Os" \
+	CFLAGS="-I$(INSTALL)/include -Oz" \
 	LDFLAGS="-L$(INSTALL)/lib" \
 
+
 tpmtotp_output := \
 	totp \
 	hotp \
@@ -22,5 +29,3 @@ tpmtotp_output := \
 
 tpmtotp_libraries := \
 	libtpm/libtpm.so \
-
-tpmtotp_configure := 
diff --git a/modules/u-root b/modules/u-root
index c943bef43..286ab001d 100644
--- a/modules/u-root
+++ b/modules/u-root
@@ -1,9 +1,15 @@
+
+# OFLAG: No packaging-time OFLAG normalization applied; validate with V=1 builds if needed.
+
+
+
 #
 # u-root go runtime
 #
 # This is not a normal Heads module, since it builds all of its
 # own dependencies.
 #
+
 u-root_url := github.com/u-root/u-root
 u-root_output := $(build)/$(BOARD)/u-root.cpio
 UROOT_CMDS ?=
diff --git a/modules/util-linux b/modules/util-linux
index bb359d74d..9450743a3 100644
--- a/modules/util-linux
+++ b/modules/util-linux
@@ -1,5 +1,12 @@
 modules-$(CONFIG_UTIL_LINUX) += util-linux
 
+
+# OFLAG: Enforce CFLAGS='-Oz' for size-focused builds; packaging/configure sets CFLAGS accordingly.
+
+
+
+
+
 util-linux_version := 2.39
 util-linux_dir := util-linux-$(util-linux_version)
 util-linux_tar := util-linux-$(util-linux_version).tar.xz
@@ -8,7 +15,7 @@ util-linux_hash := 32b30a336cda903182ed61feb3e9b908b762a5e66fe14e43efb88d3716207
 
 util-linux_configure := \
 	$(CROSS_TOOLS) \
-	CFLAGS="-Os"  \
+	CFLAGS="-Oz"  \
 	./configure \
 	--host $(MUSL_ARCH)-elf-linux \
 	--prefix "/" \
diff --git a/modules/zlib b/modules/zlib
index 89602a0b4..19b40fb44 100644
--- a/modules/zlib
+++ b/modules/zlib
@@ -1,15 +1,18 @@
 CONFIG_ZLIB ?= y
 modules-$(CONFIG_ZLIB) += zlib
 
+# Inventory classification: fixed - CFLAGS=-Oz applied (verified)
+
 zlib_version := 1.2.11
 zlib_dir := zlib-$(zlib_version)
 zlib_tar := zlib-$(zlib_version).tar.gz
 zlib_url := https://zlib.net/fossils/$(zlib_tar)
 zlib_hash := c3e5e9fdd5004dcb542feda5ee4f0ff0744628baf8ed2dd5d66f8ca1197cb1a1
 
+# OFLAG: resolved — packaging enforces CFLAGS=-Oz; cross-arch verification tracked in TODO_zlib_cross_arch.md
+
 zlib_configure := \
-	$(CROSS_TOOLS) \
-	./configure \
+	CFLAGS=-Oz $(CROSS_TOOLS) ./configure \
 	--prefix="/" \
 
 zlib_target := \
diff --git a/modules/zstd b/modules/zstd
index e1fc3f71f..81ee6ff26 100644
--- a/modules/zstd
+++ b/modules/zstd
@@ -3,6 +3,13 @@
 CONFIG_ZSTD ?= y
 modules-$(CONFIG_ZSTD) += zstd
 
+
+# OFLAG: Enforce CFLAGS='-Oz' at packaging time (set in configure wrapper)
+
+
+
+
+
 zstd_version := 1.5.5
 zstd_dir := zstd-$(zstd_version)
 zstd_tar := zstd-$(zstd_version).tar.gz
@@ -14,7 +21,7 @@ zstd_configure := true
 # Only the decompressor is built and installed, to be able to read zstd-compressed
 # initramfs archives.
 zstd_target := \
-	$(MAKE_JOBS) $(CROSS_TOOLS) -C programs CFLAGS="-g0 -Os" \
+	$(MAKE_JOBS) $(CROSS_TOOLS) -C programs CFLAGS="-g0 -Oz" \
 	HAVE_ZLIB=0 \
 	HAVE_LZMA=0 \
 	HAVE_LZ4=0 \
diff --git a/patches/bash-5.1.16.patch b/patches/bash-5.1.16.patch
index ef59ceaa5..5fc41855c 100644
--- a/patches/bash-5.1.16.patch
+++ b/patches/bash-5.1.16.patch
@@ -9,3 +9,13 @@
  		&& mv newversion.h version.h
  
  bashversion$(EXEEXT): buildversion.o $(SUPPORT_SRC)bashversion.c
+--- clean/bash-5.1.16/lib/termcap/tparam.c	2018-12-20 14:47:44.000000000 -0600
++++ bash-5.1.16/lib/termcap/tparam.c	2025-07-30 15:40:00.000000000 +0000
+@@ -33,6 +33,7 @@
+ 
+ #if defined (HAVE_STRING_H)
+ #include <string.h>
++#include <unistd.h>
+ #endif
+ 
+ #if !defined (HAVE_BCOPY) && (defined (HAVE_STRING_H) || defined (STDC_HEADERS))
diff --git a/patches/coreboot-talos_2/0003-ugly_skiboot-patch_fix_for_newer_gcc_from_musl_125.patch b/patches/coreboot-talos_2/0003-ugly_skiboot-patch_fix_for_newer_gcc_from_musl_125.patch
index 97bb9cc62..88542e55f 100644
--- a/patches/coreboot-talos_2/0003-ugly_skiboot-patch_fix_for_newer_gcc_from_musl_125.patch
+++ b/patches/coreboot-talos_2/0003-ugly_skiboot-patch_fix_for_newer_gcc_from_musl_125.patch
@@ -11,7 +11,7 @@ index 0000000..5db9bca
 + endif
 + 
 +-CFLAGS := -fno-strict-aliasing -pie -fpie -fno-pic -mbig-endian -m64 -fno-asynchronous-unwind-tables
-++CFLAGS := -Wno-error=address-of-packed-member -Wno-error=format-overflow -fno-strict-aliasing -pie -fpie -fno-pic -mbig-endian -m64 -fno-asynchronous-unwind-tables
+++CFLAGS := -Wno-error=address-of-packed-member -Wno-error=format-overflow -Wno-error=unterminated-string-initialization -Wno-error=misleading-indentation -fno-strict-aliasing -pie -fpie -fno-pic -mbig-endian -m64 -fno-asynchronous-unwind-tables
 + CFLAGS += -mcpu=power7
 + CFLAGS += -Wl,--oformat,elf64-powerpc -ggdb
 + CFLAGS += $(call try-cflag,$(CC),-ffixed-r13)
diff --git a/patches/cryptsetup2-2.6.1.patch b/patches/cryptsetup2-2.6.1.patch
deleted file mode 100644
index 036aa007a..000000000
--- a/patches/cryptsetup2-2.6.1.patch
+++ /dev/null
@@ -1,706 +0,0 @@
-diff -u -r cryptsetup-2.4.3-clean/configure cryptsetup-2.4.3/configure
---- cryptsetup-2.4.3-clean/configure	2022-01-13 17:24:34.000000000 +0800
-+++ cryptsetup-2.4.3/configure	2022-01-16 14:08:37.088258763 +0800
-@@ -11056,7 +11056,7 @@
-   hardcode_automatic=no
-   hardcode_direct=no
-   hardcode_direct_absolute=no
--  hardcode_libdir_flag_spec=
-+  hardcode_libdir_flag_spec=" "
-   hardcode_libdir_separator=
-   hardcode_minus_L=no
-   hardcode_shlibpath_var=unsupported
-@@ -11140,7 +11140,7 @@
-     # are reset later if shared libraries are not supported. Putting them
-     # here allows them to be overridden if necessary.
-     runpath_var=LD_RUN_PATH
--    hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
-+    hardcode_libdir_flag_spec=" "
-     export_dynamic_flag_spec='$wl--export-dynamic'
-     # ancient GNU ld didn't support --whole-archive et. al.
-     if $LD --help 2>&1 | $GREP 'no-whole-archive' > /dev/null; then
-@@ -11186,7 +11186,7 @@
-         ;;
-       m68k)
-             archive_cmds='$RM $output_objdir/a2ixlibrary.data~$ECHO "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$ECHO "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$ECHO "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$ECHO "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)'
--            hardcode_libdir_flag_spec='-L$libdir'
-+            hardcode_libdir_flag_spec=" "
-             hardcode_minus_L=yes
-         ;;
-       esac
-@@ -11206,7 +11206,7 @@
-     cygwin* | mingw* | pw32* | cegcc*)
-       # _LT_TAGVAR(hardcode_libdir_flag_spec, ) is actually meaningless,
-       # as there is no search path for DLLs.
--      hardcode_libdir_flag_spec='-L$libdir'
-+      hardcode_libdir_flag_spec=" "
-       export_dynamic_flag_spec='$wl--export-all-symbols'
-       allow_undefined_flag=unsupported
-       always_export_symbols=no
-@@ -11236,7 +11236,7 @@
-       ;;
- 
-     os2*)
--      hardcode_libdir_flag_spec='-L$libdir'
-+      hardcode_libdir_flag_spec=" "
-       hardcode_minus_L=yes
-       allow_undefined_flag=unsupported
-       shrext_cmds=.dll
-@@ -11266,7 +11266,7 @@
-     interix[3-9]*)
-       hardcode_direct=no
-       hardcode_shlibpath_var=no
--      hardcode_libdir_flag_spec='$wl-rpath,$libdir'
-+      hardcode_libdir_flag_spec=" "
-       export_dynamic_flag_spec='$wl-E'
-       # Hack: On Interix 3.x, we cannot compile PIC because of a broken gcc.
-       # Instead, shared libraries are loaded at an image base (0x10000000 by
-@@ -11342,7 +11342,7 @@
- 	xlf* | bgf* | bgxlf* | mpixlf*)
- 	  # IBM XL Fortran 10.1 on PPC cannot create shared libs itself
- 	  whole_archive_flag_spec='--whole-archive$convenience --no-whole-archive'
--	  hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
-+	  hardcode_libdir_flag_spec=" "
- 	  archive_cmds='$LD -shared $libobjs $deplibs $linker_flags -soname $soname -o $lib'
- 	  if test yes = "$supports_anon_versioning"; then
- 	    archive_expsym_cmds='echo "{ global:" > $output_objdir/$libname.ver~
-@@ -11409,7 +11409,7 @@
- 	  # DT_RUNPATH tag from executables and libraries.  But doing so
- 	  # requires that you compile everything twice, which is a pain.
- 	  if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; then
--	    hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
-+	    hardcode_libdir_flag_spec=" "
- 	    archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
- 	    archive_expsym_cmds='$CC -shared $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-retain-symbols-file $wl$export_symbols -o $lib'
- 	  else
-@@ -11438,7 +11438,7 @@
- 
-     if test no = "$ld_shlibs"; then
-       runpath_var=
--      hardcode_libdir_flag_spec=
-+      hardcode_libdir_flag_spec=" "
-       export_dynamic_flag_spec=
-       whole_archive_flag_spec=
-     fi
-@@ -11556,7 +11556,7 @@
- 	  # path is not listed in the libpath.  Setting hardcode_minus_L
- 	  # to unsupported forces relinking
- 	  hardcode_minus_L=yes
--	  hardcode_libdir_flag_spec='-L$libdir'
-+	  hardcode_libdir_flag_spec=" "
- 	  hardcode_libdir_separator=
- 	  fi
- 	  ;;
-@@ -11642,11 +11642,11 @@
-   aix_libpath=$lt_cv_aix_libpath_
- fi
- 
--        hardcode_libdir_flag_spec='$wl-blibpath:$libdir:'"$aix_libpath"
-+        hardcode_libdir_flag_spec=" "
-         archive_expsym_cmds='$CC -o $output_objdir/$soname $libobjs $deplibs $wl'$no_entry_flag' $compiler_flags `if test -n "$allow_undefined_flag"; then func_echo_all "$wl$allow_undefined_flag"; else :; fi` $wl'$exp_sym_flag:\$export_symbols' '$shared_flag
-       else
- 	if test ia64 = "$host_cpu"; then
--	  hardcode_libdir_flag_spec='$wl-R $libdir:/usr/lib:/lib'
-+	  hardcode_libdir_flag_spec=" "
- 	  allow_undefined_flag="-z nodefs"
- 	  archive_expsym_cmds="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs '"\$wl$no_entry_flag"' $compiler_flags $wl$allow_undefined_flag '"\$wl$exp_sym_flag:\$export_symbols"
- 	else
-@@ -11697,7 +11697,7 @@
-   aix_libpath=$lt_cv_aix_libpath_
- fi
- 
--	 hardcode_libdir_flag_spec='$wl-blibpath:$libdir:'"$aix_libpath"
-+	 hardcode_libdir_flag_spec=" "
- 	  # Warning - without using the other run time loading flags,
- 	  # -berok will link without error, but may produce a broken library.
- 	  no_undefined_flag=' $wl-bernotok'
-@@ -11737,7 +11737,7 @@
-         ;;
-       m68k)
-             archive_cmds='$RM $output_objdir/a2ixlibrary.data~$ECHO "#define NAME $libname" > $output_objdir/a2ixlibrary.data~$ECHO "#define LIBRARY_ID 1" >> $output_objdir/a2ixlibrary.data~$ECHO "#define VERSION $major" >> $output_objdir/a2ixlibrary.data~$ECHO "#define REVISION $revision" >> $output_objdir/a2ixlibrary.data~$AR $AR_FLAGS $lib $libobjs~$RANLIB $lib~(cd $output_objdir && a2ixlibrary -32)'
--            hardcode_libdir_flag_spec='-L$libdir'
-+            hardcode_libdir_flag_spec=" "
-             hardcode_minus_L=yes
-         ;;
-       esac
-@@ -11847,7 +11847,7 @@
- 
-     dgux*)
-       archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
--      hardcode_libdir_flag_spec='-L$libdir'
-+      hardcode_libdir_flag_spec=" "
-       hardcode_shlibpath_var=no
-       ;;
- 
-@@ -11857,7 +11857,7 @@
-     # extra space).
-     freebsd2.2*)
-       archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags /usr/lib/c++rt0.o'
--      hardcode_libdir_flag_spec='-R$libdir'
-+      hardcode_libdir_flag_spec=" "
-       hardcode_direct=yes
-       hardcode_shlibpath_var=no
-       ;;
-@@ -11884,7 +11884,7 @@
-       else
- 	archive_cmds='$RM $output_objdir/$soname~$LD -b +b $install_libdir -o $output_objdir/$soname $libobjs $deplibs $linker_flags~test "x$output_objdir/$soname" = "x$lib" || mv $output_objdir/$soname $lib'
-       fi
--      hardcode_libdir_flag_spec='$wl+b $wl$libdir'
-+      hardcode_libdir_flag_spec=" "
-       hardcode_libdir_separator=:
-       hardcode_direct=yes
- 
-@@ -11901,7 +11901,7 @@
- 	archive_cmds='$LD -b +h $soname +b $install_libdir -o $lib $libobjs $deplibs $linker_flags'
-       fi
-       if test no = "$with_gnu_ld"; then
--	hardcode_libdir_flag_spec='$wl+b $wl$libdir'
-+	hardcode_libdir_flag_spec=" "
- 	hardcode_libdir_separator=:
- 	hardcode_direct=yes
- 	hardcode_direct_absolute=yes
-@@ -11979,7 +11979,7 @@
- 	esac
-       fi
-       if test no = "$with_gnu_ld"; then
--	hardcode_libdir_flag_spec='$wl+b $wl$libdir'
-+	hardcode_libdir_flag_spec=" "
- 	hardcode_libdir_separator=:
- 
- 	case $host_cpu in
-@@ -12040,7 +12040,7 @@
- 	archive_expsym_cmds='$CC -shared $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -exports_file $export_symbols -o $lib'
-       fi
-       archive_cmds_need_lc='no'
--      hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
-+      hardcode_libdir_flag_spec=" "
-       hardcode_libdir_separator=:
-       inherit_rpath=yes
-       link_all_deplibs=yes
-@@ -12062,7 +12062,7 @@
-       else
- 	archive_cmds='$LD -shared -o $lib $libobjs $deplibs $linker_flags'      # ELF
-       fi
--      hardcode_libdir_flag_spec='-R$libdir'
-+      hardcode_libdir_flag_spec=" "
-       hardcode_direct=yes
-       hardcode_shlibpath_var=no
-       ;;
-@@ -12070,7 +12070,7 @@
-     newsos6)
-       archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
-       hardcode_direct=yes
--      hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
-+      hardcode_libdir_flag_spec=" "
-       hardcode_libdir_separator=:
-       hardcode_shlibpath_var=no
-       ;;
-@@ -12086,11 +12086,11 @@
- 	if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`"; then
- 	  archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
- 	  archive_expsym_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags $wl-retain-symbols-file,$export_symbols'
--	  hardcode_libdir_flag_spec='$wl-rpath,$libdir'
-+	  hardcode_libdir_flag_spec=" "
- 	  export_dynamic_flag_spec='$wl-E'
- 	else
- 	  archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
--	  hardcode_libdir_flag_spec='$wl-rpath,$libdir'
-+	  hardcode_libdir_flag_spec=" "
- 	fi
-       else
- 	ld_shlibs=no
-@@ -12098,7 +12098,7 @@
-       ;;
- 
-     os2*)
--      hardcode_libdir_flag_spec='-L$libdir'
-+      hardcode_libdir_flag_spec=" "
-       hardcode_minus_L=yes
-       allow_undefined_flag=unsupported
-       shrext_cmds=.dll
-@@ -12134,7 +12134,7 @@
- 	archive_cmds='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
-       fi
-       archive_cmds_need_lc='no'
--      hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
-+      hardcode_libdir_flag_spec=" "
-       hardcode_libdir_separator=:
-       ;;
- 
-@@ -12142,7 +12142,7 @@
-       if test yes = "$GCC"; then
- 	allow_undefined_flag=' $wl-expect_unresolved $wl\*'
- 	archive_cmds='$CC -shared$allow_undefined_flag $pic_flag $libobjs $deplibs $compiler_flags $wl-msym $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations -o $lib'
--	hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
-+	hardcode_libdir_flag_spec=" "
-       else
- 	allow_undefined_flag=' -expect_unresolved \*'
- 	archive_cmds='$CC -shared$allow_undefined_flag $libobjs $deplibs $compiler_flags -msym -soname $soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
-@@ -12150,7 +12150,7 @@
-           $CC -shared$allow_undefined_flag $wl-input $wl$lib.exp $compiler_flags $libobjs $deplibs -soname $soname `test -n "$verstring" && $ECHO "-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib~$RM $lib.exp'
- 
- 	# Both c and cxx compiler support -rpath directly
--	hardcode_libdir_flag_spec='-rpath $libdir'
-+	hardcode_libdir_flag_spec=" "
-       fi
-       archive_cmds_need_lc='no'
-       hardcode_libdir_separator=:
-@@ -12179,7 +12179,7 @@
- 	  ;;
- 	esac
-       fi
--      hardcode_libdir_flag_spec='-R$libdir'
-+      hardcode_libdir_flag_spec=" "
-       hardcode_shlibpath_var=no
-       case $host_os in
-       solaris2.[0-5] | solaris2.[0-5].*) ;;
-@@ -12206,7 +12206,7 @@
-       else
- 	archive_cmds='$LD -assert pure-text -Bstatic -o $lib $libobjs $deplibs $linker_flags'
-       fi
--      hardcode_libdir_flag_spec='-L$libdir'
-+      hardcode_libdir_flag_spec=" "
-       hardcode_direct=yes
-       hardcode_minus_L=yes
-       hardcode_shlibpath_var=no
-@@ -12276,7 +12276,7 @@
-       allow_undefined_flag='$wl-z,nodefs'
-       archive_cmds_need_lc=no
-       hardcode_shlibpath_var=no
--      hardcode_libdir_flag_spec='$wl-R,$libdir'
-+      hardcode_libdir_flag_spec=" "
-       hardcode_libdir_separator=':'
-       link_all_deplibs=yes
-       export_dynamic_flag_spec='$wl-Bexport'
-@@ -12293,7 +12293,7 @@
- 
-     uts4*)
-       archive_cmds='$LD -G -h $soname -o $lib $libobjs $deplibs $linker_flags'
--      hardcode_libdir_flag_spec='-L$libdir'
-+      hardcode_libdir_flag_spec=" "
-       hardcode_shlibpath_var=no
-       ;;
- 
-@@ -12662,7 +12662,7 @@
-   version_type=linux # correct to gnu/linux during the next big refactor
-   need_lib_prefix=no
-   need_version=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test ia64 = "$host_cpu"; then
-     # AIX 5 supports IA64
-     library_names_spec='$libname$release$shared_ext$major $libname$release$shared_ext$versuffix $libname$shared_ext'
-@@ -12952,16 +12952,16 @@
-     ;;
-   freebsd3.[01]* | freebsdelf3.[01]*)
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   freebsd3.[2-9]* | freebsdelf3.[2-9]* | \
-   freebsd4.[0-5] | freebsdelf4.[0-5] | freebsd4.1.1 | freebsdelf4.1.1)
-     shlibpath_overrides_runpath=no
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   *) # from 4.6 on, and DragonFly
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   esac
-   ;;
-@@ -12976,7 +12976,7 @@
-   shlibpath_var=LIBRARY_PATH
-   shlibpath_overrides_runpath=no
-   sys_lib_dlsearch_path_spec='/boot/home/config/lib /boot/common/lib /boot/system/lib'
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- hpux9* | hpux10* | hpux11*)
-@@ -12988,7 +12988,7 @@
-   case $host_cpu in
-   ia64*)
-     shrext_cmds='.so'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.so"
-     shlibpath_var=LD_LIBRARY_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -13004,7 +13004,7 @@
-     ;;
-   hppa*64*)
-     shrext_cmds='.sl'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.sl"
-     shlibpath_var=LD_LIBRARY_PATH # How should we handle SHLIB_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -13037,7 +13037,7 @@
-   dynamic_linker='Interix 3.x ld.so.1 (PE, like ELF)'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- irix5* | irix6* | nonstopux*)
-@@ -13074,7 +13074,7 @@
-   shlibpath_overrides_runpath=no
-   sys_lib_search_path_spec="/usr/lib$libsuff /lib$libsuff /usr/local/lib$libsuff"
-   sys_lib_dlsearch_path_spec="/usr/lib$libsuff /lib$libsuff"
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- # No shared lib support for Linux oldld, aout, or coff.
-@@ -13095,11 +13095,11 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   dynamic_linker='Android linker'
-   # Don't embed -rpath directories since the linker doesn't support them.
--  hardcode_libdir_flag_spec='-L$libdir'
-+  hardcode_libdir_flag_spec=" "
-   ;;
- 
- # This must be glibc/ELF.
-@@ -13153,7 +13153,7 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   # Ideally, we could use ldconfig to report *all* directores which are
-   # searched for libraries, however this is still not possible.  Aside from not
-@@ -13183,7 +13183,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='NetBSD ld.elf_so'
-   ;;
- 
-@@ -13202,7 +13202,7 @@
-   fi
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- newsos6)
-@@ -13220,7 +13220,7 @@
-   soname_spec='$libname$release$shared_ext$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='ldqnx.so'
-   ;;
- 
-@@ -13292,7 +13292,7 @@
-   soname_spec='$libname$release$shared_ext$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   # ldd complains unless libraries are executable
-   postinstall_cmds='chmod +x $lib'
-   ;;
-@@ -13349,7 +13349,7 @@
-   soname_spec='$libname$release$shared_ext$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test yes = "$with_gnu_ld"; then
-     sys_lib_search_path_spec='/usr/local/lib /usr/gnu/lib /usr/ccs/lib /usr/lib /lib'
-   else
-@@ -13371,7 +13371,7 @@
-   library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- uts4*)
-@@ -14490,7 +14490,7 @@
-   acl_shlibext="$acl_cv_shlibext"
-   acl_libname_spec="$acl_cv_libname_spec"
-   acl_library_names_spec="$acl_cv_library_names_spec"
--  acl_hardcode_libdir_flag_spec="$acl_cv_hardcode_libdir_flag_spec"
-+  acl_hardcode_libdir_flag_spec=" "
-   acl_hardcode_libdir_separator="$acl_cv_hardcode_libdir_separator"
-   acl_hardcode_direct="$acl_cv_hardcode_direct"
-   acl_hardcode_minus_L="$acl_cv_hardcode_minus_L"
-@@ -22538,7 +22538,7 @@
- with_gnu_ld='`$ECHO "$with_gnu_ld" | $SED "$delay_single_quote_subst"`'
- allow_undefined_flag='`$ECHO "$allow_undefined_flag" | $SED "$delay_single_quote_subst"`'
- no_undefined_flag='`$ECHO "$no_undefined_flag" | $SED "$delay_single_quote_subst"`'
--hardcode_libdir_flag_spec='`$ECHO "$hardcode_libdir_flag_spec" | $SED "$delay_single_quote_subst"`'
-+hardcode_libdir_flag_spec=" "
- hardcode_libdir_separator='`$ECHO "$hardcode_libdir_separator" | $SED "$delay_single_quote_subst"`'
- hardcode_direct='`$ECHO "$hardcode_direct" | $SED "$delay_single_quote_subst"`'
- hardcode_direct_absolute='`$ECHO "$hardcode_direct_absolute" | $SED "$delay_single_quote_subst"`'
-@@ -22569,7 +22569,7 @@
- postuninstall_cmds='`$ECHO "$postuninstall_cmds" | $SED "$delay_single_quote_subst"`'
- finish_cmds='`$ECHO "$finish_cmds" | $SED "$delay_single_quote_subst"`'
- finish_eval='`$ECHO "$finish_eval" | $SED "$delay_single_quote_subst"`'
--hardcode_into_libs='`$ECHO "$hardcode_into_libs" | $SED "$delay_single_quote_subst"`'
-+hardcode_into_libs=no
- sys_lib_search_path_spec='`$ECHO "$sys_lib_search_path_spec" | $SED "$delay_single_quote_subst"`'
- configure_time_dlsearch_path='`$ECHO "$configure_time_dlsearch_path" | $SED "$delay_single_quote_subst"`'
- configure_time_lt_sys_library_path='`$ECHO "$configure_time_lt_sys_library_path" | $SED "$delay_single_quote_subst"`'
-@@ -23727,7 +23727,7 @@
- finish_eval=$lt_finish_eval
- 
- # Whether we should hardcode library paths into libraries.
--hardcode_into_libs=$hardcode_into_libs
-+hardcode_into_libs=no
- 
- # Compile-time system search path for libraries.
- sys_lib_search_path_spec=$lt_sys_lib_search_path_spec
-@@ -23824,7 +23824,7 @@
- 
- # Flag to hardcode \$libdir into a binary during linking.
- # This must work even if \$libdir does not exist
--hardcode_libdir_flag_spec=$lt_hardcode_libdir_flag_spec
-+hardcode_libdir_flag_spec=" "
- 
- # Whether we need a single "-rpath" flag with a separated argument.
- hardcode_libdir_separator=$lt_hardcode_libdir_separator
-diff -u -r cryptsetup-2.4.3-clean/Makefile.in cryptsetup-2.4.3/Makefile.in
---- cryptsetup-2.4.3-clean/Makefile.in	2022-01-13 17:24:33.000000000 +0800
-+++ cryptsetup-2.4.3/Makefile.in	2022-01-16 14:08:37.096258854 +0800
-@@ -1115,6 +1115,8 @@
- @CRYPTSETUP_TRUE@cryptsetup_LDADD = $(LDADD)	\
- @CRYPTSETUP_TRUE@	libcryptsetup.la	\
- @CRYPTSETUP_TRUE@	@POPT_LIBS@		\
-+@CRYPTSETUP_TRUE@	@DEVMAPPER_LIBS@	\
-+@CRYPTSETUP_TRUE@	@JSON_C_LIBS@		\
- @CRYPTSETUP_TRUE@	@PWQUALITY_LIBS@	\
- @CRYPTSETUP_TRUE@	@PASSWDQC_LIBS@		\
- @CRYPTSETUP_TRUE@	@UUID_LIBS@		\
-@@ -1147,6 +1149,9 @@
- @VERITYSETUP_TRUE@veritysetup_LDADD = $(LDADD)	\
- @VERITYSETUP_TRUE@	libcryptsetup.la	\
- @VERITYSETUP_TRUE@	@POPT_LIBS@		\
-+@VERITYSETUP_TRUE@     @UUID_LIBS@             \
-+@VERITYSETUP_TRUE@     @DEVMAPPER_LIBS@        \
-+@VERITYSETUP_TRUE@     @JSON_C_LIBS@           \
- @VERITYSETUP_TRUE@	@BLKID_LIBS@
- 
- @STATIC_TOOLS_TRUE@@VERITYSETUP_TRUE@veritysetup_static_SOURCES = $(veritysetup_SOURCES)
-@@ -1177,6 +1182,8 @@
- @INTEGRITYSETUP_TRUE@	libcryptsetup.la	\
- @INTEGRITYSETUP_TRUE@	@POPT_LIBS@		\
- @INTEGRITYSETUP_TRUE@	@UUID_LIBS@		\
-+@INTEGRITYSETUP_TRUE@	@DEVMAPPER_LIBS@	\
-+@INTEGRITYSETUP_TRUE@	@JSON_C_LIBS@		\
- @INTEGRITYSETUP_TRUE@	@BLKID_LIBS@
- 
- @INTEGRITYSETUP_TRUE@@STATIC_TOOLS_TRUE@integritysetup_static_SOURCES = $(integritysetup_SOURCES)
- 
---- ./configure.orig	2023-11-26 14:22:30.912000000 -0500
-+++ ./configure	2023-11-26 14:26:21.714000000 -0500
-@@ -12336,7 +12336,7 @@
- 
- 	case $cc_basename in
- 	tcc*)
--	  hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
-+	  hardcode_libdir_flag_spec=" "
- 	  export_dynamic_flag_spec='-rdynamic'
- 	  ;;
- 	xlf* | bgf* | bgxlf* | mpixlf*)
-@@ -12755,7 +12755,7 @@
-       case $cc_basename in
-       cl* | icl*)
- 	# Native MSVC or ICC
--	hardcode_libdir_flag_spec=' '
-+	hardcode_libdir_flag_spec=" "
- 	allow_undefined_flag=unsupported
- 	always_export_symbols=yes
- 	file_list_spec='@'
-@@ -12796,7 +12796,7 @@
- 	;;
-       *)
- 	# Assume MSVC and ICC wrapper
--	hardcode_libdir_flag_spec=' '
-+	hardcode_libdir_flag_spec=" "
- 	allow_undefined_flag=unsupported
- 	# Tell ltmain to make .lib files, not .a files.
- 	libext=lib
-@@ -12873,7 +12873,7 @@
-     # FreeBSD 3 and greater uses gcc -shared to do shared libraries.
-     freebsd* | dragonfly* | midnightbsd*)
-       archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
--      hardcode_libdir_flag_spec='-R$libdir'
-+      hardcode_libdir_flag_spec=" "
-       hardcode_direct=yes
-       hardcode_shlibpath_var=no
-       ;;
-@@ -13052,7 +13052,7 @@
- 	# Fabrice Bellard et al's Tiny C Compiler
- 	ld_shlibs=yes
- 	archive_cmds='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
--	hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
-+	hardcode_libdir_flag_spec=" "
- 	;;
-       esac
-       ;;
---- ./configure.mod	2023-11-26 14:46:49.779000000 -0500
-+++ ./configure	2023-11-26 14:47:56.962000000 -0500
-@@ -17670,7 +17670,7 @@
-   version_type=linux # correct to gnu/linux during the next big refactor
-   need_lib_prefix=no
-   need_version=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test ia64 = "$host_cpu"; then
-     # AIX 5 supports IA64
-     library_names_spec='$libname$release$shared_ext$major $libname$release$shared_ext$versuffix $libname$shared_ext'
-@@ -17958,16 +17958,16 @@
-     ;;
-   freebsd3.[01]* | freebsdelf3.[01]*)
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   freebsd3.[2-9]* | freebsdelf3.[2-9]* | \
-   freebsd4.[0-5] | freebsdelf4.[0-5] | freebsd4.1.1 | freebsdelf4.1.1)
-     shlibpath_overrides_runpath=no
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   *) # from 4.6 on, and DragonFly
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   esac
-   ;;
-@@ -17982,7 +17982,7 @@
-   shlibpath_var=LIBRARY_PATH
-   shlibpath_overrides_runpath=no
-   sys_lib_dlsearch_path_spec='/boot/home/config/lib /boot/common/lib /boot/system/lib'
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- hpux9* | hpux10* | hpux11*)
-@@ -17994,7 +17994,7 @@
-   case $host_cpu in
-   ia64*)
-     shrext_cmds='.so'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.so"
-     shlibpath_var=LD_LIBRARY_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -18010,7 +18010,7 @@
-     ;;
-   hppa*64*)
-     shrext_cmds='.sl'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.sl"
-     shlibpath_var=LD_LIBRARY_PATH # How should we handle SHLIB_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -18043,7 +18043,7 @@
-   dynamic_linker='Interix 3.x ld.so.1 (PE, like ELF)'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- irix5* | irix6* | nonstopux*)
-@@ -18080,7 +18080,7 @@
-   shlibpath_overrides_runpath=no
-   sys_lib_search_path_spec="/usr/lib$libsuff /lib$libsuff /usr/local/lib$libsuff"
-   sys_lib_dlsearch_path_spec="/usr/lib$libsuff /lib$libsuff"
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- # No shared lib support for Linux oldld, aout, or coff.
-@@ -18101,7 +18101,7 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   dynamic_linker='Android linker'
-   # Don't embed -rpath directories since the linker doesn't support them.
-@@ -18159,7 +18159,7 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   # Ideally, we could use ldconfig to report *all* directores which are
-   # searched for libraries, however this is still not possible.  Aside from not
-@@ -18189,7 +18189,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='NetBSD ld.elf_so'
-   ;;
- 
-@@ -18208,7 +18208,7 @@
-   fi
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- newsos6)
-@@ -18226,7 +18226,7 @@
-   soname_spec='$libname$release$shared_ext$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='ldqnx.so'
-   ;;
- 
-@@ -18298,7 +18298,7 @@
-   soname_spec='$libname$release$shared_ext$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   # ldd complains unless libraries are executable
-   postinstall_cmds='chmod +x $lib'
-   ;;
-@@ -18355,7 +18355,7 @@
-   soname_spec='$libname$release$shared_ext$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test yes = "$with_gnu_ld"; then
-     sys_lib_search_path_spec='/usr/local/lib /usr/gnu/lib /usr/ccs/lib /usr/lib /lib'
-   else
-@@ -18377,7 +18377,7 @@
-   library_names_spec='$libname$release$shared_ext$versuffix $libname$release$shared_ext$major $libname$shared_ext'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- uts4*)
diff --git a/patches/cryptsetup2-2.6.1/0001-add-deps-to-Makefile.in.patch b/patches/cryptsetup2-2.6.1/0001-add-deps-to-Makefile.in.patch
new file mode 100644
index 000000000..43228a82e
--- /dev/null
+++ b/patches/cryptsetup2-2.6.1/0001-add-deps-to-Makefile.in.patch
@@ -0,0 +1,32 @@
+diff -u -r cryptsetup-2.4.3-clean/Makefile.in cryptsetup-2.4.3/Makefile.in
+--- cryptsetup-2.4.3-clean/Makefile.in	2022-01-13 17:24:33.000000000 +0800
++++ cryptsetup-2.4.3/Makefile.in	2022-01-16 14:08:37.096258854 +0800
+@@ -1115,6 +1115,8 @@
+ @CRYPTSETUP_TRUE@cryptsetup_LDADD = $(LDADD)	\
+ @CRYPTSETUP_TRUE@	libcryptsetup.la	\
+ @CRYPTSETUP_TRUE@	@POPT_LIBS@		\
++@CRYPTSETUP_TRUE@	@DEVMAPPER_LIBS@	\
++@CRYPTSETUP_TRUE@	@JSON_C_LIBS@		\
+ @CRYPTSETUP_TRUE@	@PWQUALITY_LIBS@	\
+ @CRYPTSETUP_TRUE@	@PASSWDQC_LIBS@		\
+ @CRYPTSETUP_TRUE@	@UUID_LIBS@		\
+@@ -1147,6 +1149,9 @@
+ @VERITYSETUP_TRUE@veritysetup_LDADD = $(LDADD)	\
+ @VERITYSETUP_TRUE@	libcryptsetup.la	\
+ @VERITYSETUP_TRUE@	@POPT_LIBS@		\
++@VERITYSETUP_TRUE@     @UUID_LIBS@             \
++@VERITYSETUP_TRUE@     @DEVMAPPER_LIBS@        \
++@VERITYSETUP_TRUE@     @JSON_C_LIBS@           \
+ @VERITYSETUP_TRUE@	@BLKID_LIBS@
+ 
+ @STATIC_TOOLS_TRUE@@VERITYSETUP_TRUE@veritysetup_static_SOURCES = $(veritysetup_SOURCES)
+@@ -1177,6 +1182,8 @@
+ @INTEGRITYSETUP_TRUE@	libcryptsetup.la	\
+ @INTEGRITYSETUP_TRUE@	@POPT_LIBS@		\
+ @INTEGRITYSETUP_TRUE@	@UUID_LIBS@		\
++@INTEGRITYSETUP_TRUE@	@DEVMAPPER_LIBS@	\
++@INTEGRITYSETUP_TRUE@	@JSON_C_LIBS@		\
+ @INTEGRITYSETUP_TRUE@	@BLKID_LIBS@
+ 
+ @INTEGRITYSETUP_TRUE@@STATIC_TOOLS_TRUE@integritysetup_static_SOURCES = $(integritysetup_SOURCES)
+ 
diff --git a/patches/dropbear-2016.74.patch b/patches/dropbear-2025.88/0001-disable-fatal-user-group-change-errors-for-heads-environment.patch
similarity index 61%
rename from patches/dropbear-2016.74.patch
rename to patches/dropbear-2025.88/0001-disable-fatal-user-group-change-errors-for-heads-environment.patch
index f9d692606..e5f98726c 100644
--- a/patches/dropbear-2016.74.patch
+++ b/patches/dropbear-2025.88/0001-disable-fatal-user-group-change-errors-for-heads-environment.patch
@@ -1,7 +1,6 @@
-diff --recursive -u ../clean/dropbear-2016.74/svr-chansession.c ./dropbear-2016.74/svr-chansession.c
---- ../clean/dropbear-2016.74/svr-chansession.c	2016-07-21 11:17:09.000000000 -0400
-+++ dropbear-2016.74/svr-chansession.c	2017-09-19 11:01:34.889121503 -0400
-@@ -925,10 +925,10 @@
+--- a/src/svr-chansession.c
++++ b/src/svr-chansession.c
+@@ -987,10 +987,10 @@
  		if ((setgid(ses.authstate.pw_gid) < 0) ||
  			(initgroups(ses.authstate.pw_name, 
  						ses.authstate.pw_gid) < 0)) {
diff --git a/patches/gpg2-2.4.0.patch b/patches/gpg2-2.4.0.patch
index ef94377b7..732d8dec8 100644
--- a/patches/gpg2-2.4.0.patch
+++ b/patches/gpg2-2.4.0.patch
@@ -1,15 +1,4 @@
-diff -u --recursive gnupg-2.4.0/configure gnupg-2.4.0/configure
---- gnupg-2.4.0/configure	2016-08-17 09:20:25.000000000 -0400
-+++ gnupg-2.4.0/configure	2018-01-20 16:55:14.502067084 -0500
-@@ -572,7 +572,7 @@
- ac_clean_files=
- ac_config_libobj_dir=.
- LIBOBJS=
--cross_compiling=no
-+cross_compiling=yes
- subdirs=
- MFLAGS=
- MAKEFLAGS=
+diff -u --recursive gnupg-2.4.0/common/ttyio.c.orig gnupg-2.4.0/common/ttyio.c
 --- gnupg-2.4.0/common/ttyio.c.orig	2023-03-24 02:37:40.384435064 +0100
 +++ gnupg-2.4.0/common/ttyio.c	2023-03-24 02:38:21.825961221 +0100
 @@ -186,7 +186,7 @@
diff --git a/patches/kexec-tools-e18a71faae081d075c8d3ec559aa68a59295c739/0001-disable-vmcore-dmesg-and-kexec_test-modules.patch b/patches/kexec-tools-e18a71faae081d075c8d3ec559aa68a59295c739/0001-disable-vmcore-dmesg-and-kexec_test-modules.patch
new file mode 100644
index 000000000..d150953f1
--- /dev/null
+++ b/patches/kexec-tools-e18a71faae081d075c8d3ec559aa68a59295c739/0001-disable-vmcore-dmesg-and-kexec_test-modules.patch
@@ -0,0 +1,17 @@
+--- a/Makefile.in	2025-08-11 16:40:00.000000000 +0000
++++ b/Makefile.in	2025-08-11 16:40:00.000000000 +0000
+@@ -167,12 +167,12 @@ include $(srcdir)/kexec/Makefile
+ 
+ # vmcore-dmesg (read dmesg from a vmcore)
+ #
+-include $(srcdir)/vmcore-dmesg/Makefile
++#include $(srcdir)/vmcore-dmesg/Makefile
+ 
+ #
+ # kexec_test (test program)
+ #
+-include $(srcdir)/kexec_test/Makefile
++#include $(srcdir)/kexec_test/Makefile
+ 
+ SPEC=$(PACKAGE_NAME).spec
+ GENERATED_SRCS:= $(SPEC)
diff --git a/patches/kexec-2.0.26.patch b/patches/kexec-tools-e18a71faae081d075c8d3ec559aa68a59295c739/0002-improve-framebuffer-setup-with-intel-drm-support.patch
similarity index 59%
rename from patches/kexec-2.0.26.patch
rename to patches/kexec-tools-e18a71faae081d075c8d3ec559aa68a59295c739/0002-improve-framebuffer-setup-with-intel-drm-support.patch
index e2f16c8eb..fd6b95d23 100644
--- a/patches/kexec-2.0.26.patch
+++ b/patches/kexec-tools-e18a71faae081d075c8d3ec559aa68a59295c739/0002-improve-framebuffer-setup-with-intel-drm-support.patch
@@ -1,26 +1,5 @@
-diff --git a/Makefile.in b/Makefile.in
-index 09bbd5c..500ad35 100644
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -167,12 +167,12 @@ include $(srcdir)/kexec/Makefile
- 
- # vmcore-dmesg (read dmesg from a vmcore)
- #
--include $(srcdir)/vmcore-dmesg/Makefile
-+#include $(srcdir)/vmcore-dmesg/Makefile
- 
- #
- # kexec_test (test program)
- #
--include $(srcdir)/kexec_test/Makefile
-+#include $(srcdir)/kexec_test/Makefile
- 
- SPEC=$(PACKAGE_NAME).spec
- GENERATED_SRCS:= $(SPEC)
-diff --git a/kexec/arch/i386/x86-linux-setup.c b/kexec/arch/i386/x86-linux-setup.c
-index 14263b0..55291d6 100644
---- a/kexec/arch/i386/x86-linux-setup.c
-+++ b/kexec/arch/i386/x86-linux-setup.c
+--- a/kexec/arch/i386/x86-linux-setup.c	2025-08-11 16:40:00.000000000 +0000
++++ b/kexec/arch/i386/x86-linux-setup.c	2025-08-11 16:40:00.000000000 +0000
 @@ -138,31 +138,76 @@ static int setup_linux_vesafb(struct x86_linux_param_header *real_mode)
  	if (-1 == fd)
  		return -1;
@@ -102,60 +81,3 @@ index 14263b0..55291d6 100644
  	real_mode->lfb_width      = var.xres;
  	real_mode->lfb_height     = var.yres;
  	real_mode->lfb_depth      = var.bits_per_pixel;
-diff --git a/kexec/kexec.c b/kexec/kexec.c
-index 0e92d96..f7984a8 100644
---- a/kexec/kexec.c
-+++ b/kexec/kexec.c
-@@ -807,6 +807,27 @@ static int my_load(const char *type, int fileind, int argc, char **argv,
- 	if (sort_segments(&info) < 0) {
- 		return -1;
- 	}
-+
-+#if 1
-+	// force segment 0 to have memsz == bufsz
-+	// so that it won't overwrite EBDA
-+	if (info.segment[0].mem == 0)
-+	{
-+		if (kexec_debug)
-+			printf("hack ebda into segment 0!\n");
-+
-+		uint8_t * ebda = calloc(1, info.segment[0].memsz);
-+		memcpy(ebda, info.segment[0].buf, info.segment[0].bufsz);
-+		info.segment[0].bufsz = info.segment[0].memsz;
-+		info.segment[0].buf = ebda;
-+
-+		// install some default EBDA values that are off scale,
-+		// which will force Xen to use the multiboot info
-+		*(uint16_t*)(ebda + 0x40e) = 0xFFFF; // segment
-+		*(uint16_t*)(ebda + 0x413) = 0xFFFF; // size
-+	}
-+#endif
-+
- 	/* if purgatory is loaded update it */
- 	update_purgatory(&info);
- 	if (entry)
-diff --git a/purgatory/Makefile b/purgatory/Makefile
-index 4d2d071..ee5c642 100644
---- a/purgatory/Makefile
-+++ b/purgatory/Makefile
-@@ -45,7 +45,6 @@ purgatory/sha256.o: $(srcdir)/util_lib/sha256.c
- 	mkdir -p $(@D)
- 	$(COMPILE.c) -o $@ $^
- 
--$(PURGATORY): CC=$(TARGET_CC)
- $(PURGATORY): CFLAGS=$(PURGATORY_EXTRA_CFLAGS) \
- 		      $($(ARCH)_PURGATORY_EXTRA_CFLAGS) \
- 		      -Os -fno-builtin -ffreestanding \
-diff --git a/util/Makefile b/util/Makefile
-index 948ee63..833a897 100644
---- a/util/Makefile
-+++ b/util/Makefile
-@@ -2,7 +2,7 @@ BIN_TO_HEX:= bin/bin-to-hex
- 
- $(BIN_TO_HEX): $(srcdir)/util/bin-to-hex.c
- 	@$(MKDIR) -p $(@D)
--	$(LINK.o) $(CFLAGS) -o $@ $^
-+	$(BUILD_CC) $(BUILD_CFLAGS) -o $@ $^
- 
- $(BIN_TO_HEX): CC=$(BUILD_CC)
- $(BIN_TO_HEX): CFLAGS=$(BUILD_CFLAGS)
diff --git a/patches/kexec-tools-e18a71faae081d075c8d3ec559aa68a59295c739/0003-fix-purgatory-build-configuration.patch b/patches/kexec-tools-e18a71faae081d075c8d3ec559aa68a59295c739/0003-fix-purgatory-build-configuration.patch
new file mode 100644
index 000000000..8477d7455
--- /dev/null
+++ b/patches/kexec-tools-e18a71faae081d075c8d3ec559aa68a59295c739/0003-fix-purgatory-build-configuration.patch
@@ -0,0 +1,10 @@
+--- a/purgatory/Makefile	2025-08-11 16:40:00.000000000 +0000
++++ b/purgatory/Makefile	2025-08-11 16:40:00.000000000 +0000
+@@ -45,7 +45,6 @@ purgatory/sha256.o: $(srcdir)/util_lib/sha256.c
+ 	mkdir -p $(@D)
+ 	$(COMPILE.c) -o $@ $^
+ 
+-$(PURGATORY): CC=$(TARGET_CC)
+ $(PURGATORY): CFLAGS=$(PURGATORY_EXTRA_CFLAGS) \
+ 		      $($(ARCH)_PURGATORY_EXTRA_CFLAGS) \
+ 		      -Os -fno-builtin -ffreestanding \
diff --git a/patches/kexec-tools-e18a71faae081d075c8d3ec559aa68a59295c739/0004-fix-util-build-system-to-use-build-compiler.patch b/patches/kexec-tools-e18a71faae081d075c8d3ec559aa68a59295c739/0004-fix-util-build-system-to-use-build-compiler.patch
new file mode 100644
index 000000000..9d124fb8f
--- /dev/null
+++ b/patches/kexec-tools-e18a71faae081d075c8d3ec559aa68a59295c739/0004-fix-util-build-system-to-use-build-compiler.patch
@@ -0,0 +1,11 @@
+--- a/util/Makefile	2025-08-11 16:40:00.000000000 +0000
++++ b/util/Makefile	2025-08-11 16:40:00.000000000 +0000
+@@ -2,7 +2,7 @@ BIN_TO_HEX:= bin/bin-to-hex
+ 
+ $(BIN_TO_HEX): $(srcdir)/util/bin-to-hex.c
+ 	@$(MKDIR) -p $(@D)
+-	$(LINK.o) $(CFLAGS) -o $@ $^
++	$(BUILD_CC) $(BUILD_CFLAGS) -o $@ $^
+ 
+ $(BIN_TO_HEX): CC=$(BUILD_CC)
+ $(BIN_TO_HEX): CFLAGS=$(BUILD_CFLAGS)
diff --git a/patches/libassuan-2.5.5.patch b/patches/libassuan-2.5.5.patch
deleted file mode 100644
index 3d24a7f26..000000000
--- a/patches/libassuan-2.5.5.patch
+++ /dev/null
@@ -1,176 +0,0 @@
-diff -u -r libassuan-2.5.5-clean/configure libassuan-2.5.5/configure
---- libassuan-2.5.5-clean/configure	2017-12-07 06:55:50.000000000 -0800
-+++ libassuan-2.5.5/configure	2020-01-12 13:39:50.655638965 -0800
-@@ -10781,7 +10781,7 @@
-   version_type=linux # correct to gnu/linux during the next big refactor
-   need_lib_prefix=no
-   need_version=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test "$host_cpu" = ia64; then
-     # AIX 5 supports IA64
-     library_names_spec='${libname}${release}${shared_ext}$major ${libname}${release}${shared_ext}$versuffix $libname${shared_ext}'
-@@ -11020,16 +11020,16 @@
-     ;;
-   freebsd3.[01]* | freebsdelf3.[01]*)
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   freebsd3.[2-9]* | freebsdelf3.[2-9]* | \
-   freebsd4.[0-5] | freebsdelf4.[0-5] | freebsd4.1.1 | freebsdelf4.1.1)
-     shlibpath_overrides_runpath=no
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   *) # from 4.6 on, and DragonFly
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   esac
-   ;;
-@@ -11042,7 +11042,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- haiku*)
-@@ -11055,7 +11055,7 @@
-   shlibpath_var=LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
-   sys_lib_dlsearch_path_spec='/boot/home/config/lib /boot/common/lib /boot/system/lib'
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- hpux9* | hpux10* | hpux11*)
-@@ -11067,7 +11067,7 @@
-   case $host_cpu in
-   ia64*)
-     shrext_cmds='.so'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.so"
-     shlibpath_var=LD_LIBRARY_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -11082,7 +11082,7 @@
-     ;;
-   hppa*64*)
-     shrext_cmds='.sl'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.sl"
-     shlibpath_var=LD_LIBRARY_PATH # How should we handle SHLIB_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -11115,7 +11115,7 @@
-   dynamic_linker='Interix 3.x ld.so.1 (PE, like ELF)'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- irix5* | irix6* | nonstopux*)
-@@ -11152,7 +11152,7 @@
-   shlibpath_overrides_runpath=no
-   sys_lib_search_path_spec="/usr/lib${libsuff} /lib${libsuff} /usr/local/lib${libsuff}"
-   sys_lib_dlsearch_path_spec="/usr/lib${libsuff} /lib${libsuff}"
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- # No shared lib support for Linux oldld, aout, or coff.
-@@ -11173,7 +11173,7 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   dynamic_linker='Android linker'
-   # Don't embed -rpath directories since the linker doesn't support them.
-@@ -11228,7 +11228,7 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   # Append ld.so.conf contents to the search path
-   if test -f /etc/ld.so.conf; then
-@@ -11253,7 +11253,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='NetBSD ld.elf_so'
-   ;;
- 
-@@ -11272,7 +11272,7 @@
-   fi
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- newsos6)
-@@ -11290,7 +11290,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='ldqnx.so'
-   ;;
- 
-@@ -11352,7 +11352,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   # ldd complains unless libraries are executable
-   postinstall_cmds='chmod +x $lib'
-   ;;
-@@ -11409,7 +11409,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test "$with_gnu_ld" = yes; then
-     sys_lib_search_path_spec='/usr/local/lib /usr/gnu/lib /usr/ccs/lib /usr/lib /lib'
-   else
-@@ -11431,7 +11431,7 @@
-   library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major $libname${shared_ext}'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- uts4*)
-@@ -15680,7 +15680,7 @@
- postuninstall_cmds='`$ECHO "$postuninstall_cmds" | $SED "$delay_single_quote_subst"`'
- finish_cmds='`$ECHO "$finish_cmds" | $SED "$delay_single_quote_subst"`'
- finish_eval='`$ECHO "$finish_eval" | $SED "$delay_single_quote_subst"`'
--hardcode_into_libs='`$ECHO "$hardcode_into_libs" | $SED "$delay_single_quote_subst"`'
-+hardcode_into_libs=no
- sys_lib_search_path_spec='`$ECHO "$sys_lib_search_path_spec" | $SED "$delay_single_quote_subst"`'
- sys_lib_dlsearch_path_spec='`$ECHO "$sys_lib_dlsearch_path_spec" | $SED "$delay_single_quote_subst"`'
- hardcode_action='`$ECHO "$hardcode_action" | $SED "$delay_single_quote_subst"`'
-@@ -16896,7 +16896,7 @@
- finish_eval=$lt_finish_eval
- 
- # Whether we should hardcode library paths into libraries.
--hardcode_into_libs=$hardcode_into_libs
-+hardcode_into_libs=no
- 
- # Compile-time system search path for libraries.
- sys_lib_search_path_spec=$lt_sys_lib_search_path_spec
diff --git a/patches/libgcrypt-1.10.1.patch b/patches/libgcrypt-1.10.1.patch
deleted file mode 100644
index 4ac608846..000000000
--- a/patches/libgcrypt-1.10.1.patch
+++ /dev/null
@@ -1,195 +0,0 @@
-diff -u -r libgcrypt-1.8.10-clean/configure libgcrypt-1.8.10/configure
---- libgcrypt-1.8.10-clean/configure	2018-06-13 00:39:33.000000000 -0700
-+++ libgcrypt-1.8.10/configure	2020-01-12 13:32:34.840010800 -0800
-@@ -11292,7 +11292,7 @@
-   version_type=linux # correct to gnu/linux during the next big refactor
-   need_lib_prefix=no
-   need_version=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test "$host_cpu" = ia64; then
-     # AIX 5 supports IA64
-     library_names_spec='${libname}${release}${shared_ext}$major ${libname}${release}${shared_ext}$versuffix $libname${shared_ext}'
-@@ -11531,16 +11531,16 @@
-     ;;
-   freebsd3.[01]* | freebsdelf3.[01]*)
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   freebsd3.[2-9]* | freebsdelf3.[2-9]* | \
-   freebsd4.[0-5] | freebsdelf4.[0-5] | freebsd4.1.1 | freebsdelf4.1.1)
-     shlibpath_overrides_runpath=no
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   *) # from 4.6 on, and DragonFly
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   esac
-   ;;
-@@ -11553,7 +11553,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- haiku*)
-@@ -11566,7 +11566,7 @@
-   shlibpath_var=LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
-   sys_lib_dlsearch_path_spec='/boot/home/config/lib /boot/common/lib /boot/system/lib'
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- hpux9* | hpux10* | hpux11*)
-@@ -11578,7 +11578,7 @@
-   case $host_cpu in
-   ia64*)
-     shrext_cmds='.so'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.so"
-     shlibpath_var=LD_LIBRARY_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -11593,7 +11593,7 @@
-     ;;
-   hppa*64*)
-     shrext_cmds='.sl'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.sl"
-     shlibpath_var=LD_LIBRARY_PATH # How should we handle SHLIB_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -11626,7 +11626,7 @@
-   dynamic_linker='Interix 3.x ld.so.1 (PE, like ELF)'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- irix5* | irix6* | nonstopux*)
-@@ -11663,7 +11663,7 @@
-   shlibpath_overrides_runpath=no
-   sys_lib_search_path_spec="/usr/lib${libsuff} /lib${libsuff} /usr/local/lib${libsuff}"
-   sys_lib_dlsearch_path_spec="/usr/lib${libsuff} /lib${libsuff}"
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- # No shared lib support for Linux oldld, aout, or coff.
-@@ -11684,7 +11684,7 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   dynamic_linker='Android linker'
-   # Don't embed -rpath directories since the linker doesn't support them.
-@@ -11739,7 +11739,7 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   # Append ld.so.conf contents to the search path
-   if test -f /etc/ld.so.conf; then
-@@ -11764,7 +11764,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='NetBSD ld.elf_so'
-   ;;
- 
-@@ -11783,7 +11783,7 @@
-   fi
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- newsos6)
-@@ -11801,7 +11801,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='ldqnx.so'
-   ;;
- 
-@@ -11863,7 +11863,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   # ldd complains unless libraries are executable
-   postinstall_cmds='chmod +x $lib'
-   ;;
-@@ -11920,7 +11920,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test "$with_gnu_ld" = yes; then
-     sys_lib_search_path_spec='/usr/local/lib /usr/gnu/lib /usr/ccs/lib /usr/lib /lib'
-   else
-@@ -11942,7 +11942,7 @@
-   library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major $libname${shared_ext}'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- uts4*)
-@@ -19824,7 +19824,7 @@
- postuninstall_cmds='`$ECHO "$postuninstall_cmds" | $SED "$delay_single_quote_subst"`'
- finish_cmds='`$ECHO "$finish_cmds" | $SED "$delay_single_quote_subst"`'
- finish_eval='`$ECHO "$finish_eval" | $SED "$delay_single_quote_subst"`'
--hardcode_into_libs='`$ECHO "$hardcode_into_libs" | $SED "$delay_single_quote_subst"`'
-+hardcode_into_libs=no
- sys_lib_search_path_spec='`$ECHO "$sys_lib_search_path_spec" | $SED "$delay_single_quote_subst"`'
- sys_lib_dlsearch_path_spec='`$ECHO "$sys_lib_dlsearch_path_spec" | $SED "$delay_single_quote_subst"`'
- hardcode_action='`$ECHO "$hardcode_action" | $SED "$delay_single_quote_subst"`'
-@@ -21088,7 +21088,7 @@
- finish_eval=$lt_finish_eval
- 
- # Whether we should hardcode library paths into libraries.
--hardcode_into_libs=$hardcode_into_libs
-+hardcode_into_libs=no
- 
- # Compile-time system search path for libraries.
- sys_lib_search_path_spec=$lt_sys_lib_search_path_spec
---- libgcrypt-1.10.1/Makefile.in.orig	2023-03-27 09:35:30.902000000 -0400
-+++ libgcrypt-1.10.1/Makefile.in	2023-03-27 09:37:17.803000000 -0400
-@@ -417,12 +417,12 @@
- GITLOG_TO_CHANGELOG = gitlog-to-changelog
- @BUILD_DOC_FALSE@doc = 
- @BUILD_DOC_TRUE@doc = doc
--DIST_SUBDIRS = m4 compat mpi cipher random src doc tests
--SUBDIRS = compat mpi cipher random src $(doc) tests
-+DIST_SUBDIRS = m4 compat mpi cipher random src doc
-+SUBDIRS = compat mpi cipher random src $(doc)
- EXTRA_DIST = autogen.sh autogen.rc README.GIT LICENSES      	           \
-              ChangeLog-2011 build-aux/ChangeLog-2011 doc/ChangeLog-2011    \
-              m4/ChangeLog-2011 cipher/ChangeLog-2011 src/ChangeLog-2011    \
--             random/ChangeLog-2011 tests/ChangeLog-2011 mpi/ChangeLog-2011 \
-+             random/ChangeLog-2011 mpi/ChangeLog-2011 \
-              build-aux/git-log-footer build-aux/git-log-fix VERSION
- 
- DISTCLEANFILES = 
-
diff --git a/patches/libgcrypt-1.10.2.patch b/patches/libgcrypt-1.10.2.patch
deleted file mode 100644
index 902d96ec2..000000000
--- a/patches/libgcrypt-1.10.2.patch
+++ /dev/null
@@ -1,176 +0,0 @@
-diff -u -r libgcrypt-1.8.3-clean/configure libgcrypt-1.8.3/configure
---- libgcrypt-1.8.3-clean/configure	2018-06-13 00:39:33.000000000 -0700
-+++ libgcrypt-1.8.3/configure	2020-01-12 13:32:34.840010800 -0800
-@@ -11292,7 +11292,7 @@
-   version_type=linux # correct to gnu/linux during the next big refactor
-   need_lib_prefix=no
-   need_version=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test "$host_cpu" = ia64; then
-     # AIX 5 supports IA64
-     library_names_spec='${libname}${release}${shared_ext}$major ${libname}${release}${shared_ext}$versuffix $libname${shared_ext}'
-@@ -11531,16 +11531,16 @@
-     ;;
-   freebsd3.[01]* | freebsdelf3.[01]*)
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   freebsd3.[2-9]* | freebsdelf3.[2-9]* | \
-   freebsd4.[0-5] | freebsdelf4.[0-5] | freebsd4.1.1 | freebsdelf4.1.1)
-     shlibpath_overrides_runpath=no
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   *) # from 4.6 on, and DragonFly
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   esac
-   ;;
-@@ -11553,7 +11553,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- haiku*)
-@@ -11566,7 +11566,7 @@
-   shlibpath_var=LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
-   sys_lib_dlsearch_path_spec='/boot/home/config/lib /boot/common/lib /boot/system/lib'
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- hpux9* | hpux10* | hpux11*)
-@@ -11578,7 +11578,7 @@
-   case $host_cpu in
-   ia64*)
-     shrext_cmds='.so'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.so"
-     shlibpath_var=LD_LIBRARY_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -11593,7 +11593,7 @@
-     ;;
-   hppa*64*)
-     shrext_cmds='.sl'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.sl"
-     shlibpath_var=LD_LIBRARY_PATH # How should we handle SHLIB_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -11626,7 +11626,7 @@
-   dynamic_linker='Interix 3.x ld.so.1 (PE, like ELF)'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- irix5* | irix6* | nonstopux*)
-@@ -11663,7 +11663,7 @@
-   shlibpath_overrides_runpath=no
-   sys_lib_search_path_spec="/usr/lib${libsuff} /lib${libsuff} /usr/local/lib${libsuff}"
-   sys_lib_dlsearch_path_spec="/usr/lib${libsuff} /lib${libsuff}"
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- # No shared lib support for Linux oldld, aout, or coff.
-@@ -11684,7 +11684,7 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   dynamic_linker='Android linker'
-   # Don't embed -rpath directories since the linker doesn't support them.
-@@ -11739,7 +11739,7 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   # Append ld.so.conf contents to the search path
-   if test -f /etc/ld.so.conf; then
-@@ -11764,7 +11764,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='NetBSD ld.elf_so'
-   ;;
- 
-@@ -11783,7 +11783,7 @@
-   fi
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- newsos6)
-@@ -11801,7 +11801,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='ldqnx.so'
-   ;;
- 
-@@ -11863,7 +11863,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   # ldd complains unless libraries are executable
-   postinstall_cmds='chmod +x $lib'
-   ;;
-@@ -11920,7 +11920,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test "$with_gnu_ld" = yes; then
-     sys_lib_search_path_spec='/usr/local/lib /usr/gnu/lib /usr/ccs/lib /usr/lib /lib'
-   else
-@@ -11942,7 +11942,7 @@
-   library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major $libname${shared_ext}'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- uts4*)
-@@ -19824,7 +19824,7 @@
- postuninstall_cmds='`$ECHO "$postuninstall_cmds" | $SED "$delay_single_quote_subst"`'
- finish_cmds='`$ECHO "$finish_cmds" | $SED "$delay_single_quote_subst"`'
- finish_eval='`$ECHO "$finish_eval" | $SED "$delay_single_quote_subst"`'
--hardcode_into_libs='`$ECHO "$hardcode_into_libs" | $SED "$delay_single_quote_subst"`'
-+hardcode_into_libs=no
- sys_lib_search_path_spec='`$ECHO "$sys_lib_search_path_spec" | $SED "$delay_single_quote_subst"`'
- sys_lib_dlsearch_path_spec='`$ECHO "$sys_lib_dlsearch_path_spec" | $SED "$delay_single_quote_subst"`'
- hardcode_action='`$ECHO "$hardcode_action" | $SED "$delay_single_quote_subst"`'
-@@ -21088,7 +21088,7 @@
- finish_eval=$lt_finish_eval
- 
- # Whether we should hardcode library paths into libraries.
--hardcode_into_libs=$hardcode_into_libs
-+hardcode_into_libs=no
- 
- # Compile-time system search path for libraries.
- sys_lib_search_path_spec=$lt_sys_lib_search_path_spec
diff --git a/patches/libgcrypt-1.8.3.patch b/patches/libgcrypt-1.8.3.patch
deleted file mode 100644
index 902d96ec2..000000000
--- a/patches/libgcrypt-1.8.3.patch
+++ /dev/null
@@ -1,176 +0,0 @@
-diff -u -r libgcrypt-1.8.3-clean/configure libgcrypt-1.8.3/configure
---- libgcrypt-1.8.3-clean/configure	2018-06-13 00:39:33.000000000 -0700
-+++ libgcrypt-1.8.3/configure	2020-01-12 13:32:34.840010800 -0800
-@@ -11292,7 +11292,7 @@
-   version_type=linux # correct to gnu/linux during the next big refactor
-   need_lib_prefix=no
-   need_version=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test "$host_cpu" = ia64; then
-     # AIX 5 supports IA64
-     library_names_spec='${libname}${release}${shared_ext}$major ${libname}${release}${shared_ext}$versuffix $libname${shared_ext}'
-@@ -11531,16 +11531,16 @@
-     ;;
-   freebsd3.[01]* | freebsdelf3.[01]*)
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   freebsd3.[2-9]* | freebsdelf3.[2-9]* | \
-   freebsd4.[0-5] | freebsdelf4.[0-5] | freebsd4.1.1 | freebsdelf4.1.1)
-     shlibpath_overrides_runpath=no
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   *) # from 4.6 on, and DragonFly
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   esac
-   ;;
-@@ -11553,7 +11553,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- haiku*)
-@@ -11566,7 +11566,7 @@
-   shlibpath_var=LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
-   sys_lib_dlsearch_path_spec='/boot/home/config/lib /boot/common/lib /boot/system/lib'
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- hpux9* | hpux10* | hpux11*)
-@@ -11578,7 +11578,7 @@
-   case $host_cpu in
-   ia64*)
-     shrext_cmds='.so'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.so"
-     shlibpath_var=LD_LIBRARY_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -11593,7 +11593,7 @@
-     ;;
-   hppa*64*)
-     shrext_cmds='.sl'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.sl"
-     shlibpath_var=LD_LIBRARY_PATH # How should we handle SHLIB_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -11626,7 +11626,7 @@
-   dynamic_linker='Interix 3.x ld.so.1 (PE, like ELF)'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- irix5* | irix6* | nonstopux*)
-@@ -11663,7 +11663,7 @@
-   shlibpath_overrides_runpath=no
-   sys_lib_search_path_spec="/usr/lib${libsuff} /lib${libsuff} /usr/local/lib${libsuff}"
-   sys_lib_dlsearch_path_spec="/usr/lib${libsuff} /lib${libsuff}"
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- # No shared lib support for Linux oldld, aout, or coff.
-@@ -11684,7 +11684,7 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   dynamic_linker='Android linker'
-   # Don't embed -rpath directories since the linker doesn't support them.
-@@ -11739,7 +11739,7 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   # Append ld.so.conf contents to the search path
-   if test -f /etc/ld.so.conf; then
-@@ -11764,7 +11764,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='NetBSD ld.elf_so'
-   ;;
- 
-@@ -11783,7 +11783,7 @@
-   fi
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- newsos6)
-@@ -11801,7 +11801,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='ldqnx.so'
-   ;;
- 
-@@ -11863,7 +11863,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   # ldd complains unless libraries are executable
-   postinstall_cmds='chmod +x $lib'
-   ;;
-@@ -11920,7 +11920,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test "$with_gnu_ld" = yes; then
-     sys_lib_search_path_spec='/usr/local/lib /usr/gnu/lib /usr/ccs/lib /usr/lib /lib'
-   else
-@@ -11942,7 +11942,7 @@
-   library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major $libname${shared_ext}'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- uts4*)
-@@ -19824,7 +19824,7 @@
- postuninstall_cmds='`$ECHO "$postuninstall_cmds" | $SED "$delay_single_quote_subst"`'
- finish_cmds='`$ECHO "$finish_cmds" | $SED "$delay_single_quote_subst"`'
- finish_eval='`$ECHO "$finish_eval" | $SED "$delay_single_quote_subst"`'
--hardcode_into_libs='`$ECHO "$hardcode_into_libs" | $SED "$delay_single_quote_subst"`'
-+hardcode_into_libs=no
- sys_lib_search_path_spec='`$ECHO "$sys_lib_search_path_spec" | $SED "$delay_single_quote_subst"`'
- sys_lib_dlsearch_path_spec='`$ECHO "$sys_lib_dlsearch_path_spec" | $SED "$delay_single_quote_subst"`'
- hardcode_action='`$ECHO "$hardcode_action" | $SED "$delay_single_quote_subst"`'
-@@ -21088,7 +21088,7 @@
- finish_eval=$lt_finish_eval
- 
- # Whether we should hardcode library paths into libraries.
--hardcode_into_libs=$hardcode_into_libs
-+hardcode_into_libs=no
- 
- # Compile-time system search path for libraries.
- sys_lib_search_path_spec=$lt_sys_lib_search_path_spec
diff --git a/patches/libksba-1.3.5.patch b/patches/libksba-1.3.5.patch
deleted file mode 100644
index 8c1ee16e9..000000000
--- a/patches/libksba-1.3.5.patch
+++ /dev/null
@@ -1,200 +0,0 @@
-diff -u -r libksba-1.3.5-clean/configure libksba-1.3.5/configure
---- libksba-1.3.5-clean/configure	2016-08-22 02:56:54.000000000 -0700
-+++ libksba-1.3.5/configure	2020-01-12 13:34:53.557259138 -0800
-@@ -10734,7 +10734,7 @@
-   version_type=linux # correct to gnu/linux during the next big refactor
-   need_lib_prefix=no
-   need_version=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test "$host_cpu" = ia64; then
-     # AIX 5 supports IA64
-     library_names_spec='${libname}${release}${shared_ext}$major ${libname}${release}${shared_ext}$versuffix $libname${shared_ext}'
-@@ -10973,16 +10973,16 @@
-     ;;
-   freebsd3.[01]* | freebsdelf3.[01]*)
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   freebsd3.[2-9]* | freebsdelf3.[2-9]* | \
-   freebsd4.[0-5] | freebsdelf4.[0-5] | freebsd4.1.1 | freebsdelf4.1.1)
-     shlibpath_overrides_runpath=no
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   *) # from 4.6 on, and DragonFly
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   esac
-   ;;
-@@ -10995,7 +10995,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- haiku*)
-@@ -11008,7 +11008,7 @@
-   shlibpath_var=LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
-   sys_lib_dlsearch_path_spec='/boot/home/config/lib /boot/common/lib /boot/system/lib'
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- hpux9* | hpux10* | hpux11*)
-@@ -11020,7 +11020,7 @@
-   case $host_cpu in
-   ia64*)
-     shrext_cmds='.so'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.so"
-     shlibpath_var=LD_LIBRARY_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -11035,7 +11035,7 @@
-     ;;
-   hppa*64*)
-     shrext_cmds='.sl'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.sl"
-     shlibpath_var=LD_LIBRARY_PATH # How should we handle SHLIB_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -11068,7 +11068,7 @@
-   dynamic_linker='Interix 3.x ld.so.1 (PE, like ELF)'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- irix5* | irix6* | nonstopux*)
-@@ -11105,7 +11105,7 @@
-   shlibpath_overrides_runpath=no
-   sys_lib_search_path_spec="/usr/lib${libsuff} /lib${libsuff} /usr/local/lib${libsuff}"
-   sys_lib_dlsearch_path_spec="/usr/lib${libsuff} /lib${libsuff}"
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- # No shared lib support for Linux oldld, aout, or coff.
-@@ -11126,7 +11126,7 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   dynamic_linker='Android linker'
-   # Don't embed -rpath directories since the linker doesn't support them.
-@@ -11181,7 +11181,7 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   # Append ld.so.conf contents to the search path
-   if test -f /etc/ld.so.conf; then
-@@ -11206,7 +11206,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='NetBSD ld.elf_so'
-   ;;
- 
-@@ -11225,7 +11225,7 @@
-   fi
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- newsos6)
-@@ -11243,7 +11243,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='ldqnx.so'
-   ;;
- 
-@@ -11305,7 +11305,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   # ldd complains unless libraries are executable
-   postinstall_cmds='chmod +x $lib'
-   ;;
-@@ -11362,7 +11362,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test "$with_gnu_ld" = yes; then
-     sys_lib_search_path_spec='/usr/local/lib /usr/gnu/lib /usr/ccs/lib /usr/lib /lib'
-   else
-@@ -11384,7 +11384,7 @@
-   library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major $libname${shared_ext}'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- uts4*)
-@@ -15804,7 +15804,7 @@
- postuninstall_cmds='`$ECHO "$postuninstall_cmds" | $SED "$delay_single_quote_subst"`'
- finish_cmds='`$ECHO "$finish_cmds" | $SED "$delay_single_quote_subst"`'
- finish_eval='`$ECHO "$finish_eval" | $SED "$delay_single_quote_subst"`'
--hardcode_into_libs='`$ECHO "$hardcode_into_libs" | $SED "$delay_single_quote_subst"`'
-+hardcode_into_libs=no
- sys_lib_search_path_spec='`$ECHO "$sys_lib_search_path_spec" | $SED "$delay_single_quote_subst"`'
- sys_lib_dlsearch_path_spec='`$ECHO "$sys_lib_dlsearch_path_spec" | $SED "$delay_single_quote_subst"`'
- hardcode_action='`$ECHO "$hardcode_action" | $SED "$delay_single_quote_subst"`'
-@@ -17021,7 +17021,7 @@
- finish_eval=$lt_finish_eval
- 
- # Whether we should hardcode library paths into libraries.
--hardcode_into_libs=$hardcode_into_libs
-+hardcode_into_libs=no
- 
- # Compile-time system search path for libraries.
- sys_lib_search_path_spec=$lt_sys_lib_search_path_spec
-diff -u -r libksba-1.3.5-clean/src/asn1-gentables.c libksba-1.3.5/src/asn1-gentables.c
---- libksba-1.3.5-clean/src/asn1-gentables.c	2016-08-22 02:38:21.000000000 -0700
-+++ libksba-1.3.5/src/asn1-gentables.c	2020-01-12 13:34:45.877191990 -0800
-@@ -109,10 +109,17 @@
- static int
- cmp_string (const void *aptr, const void *bptr)
- {
--  const struct name_list_s **a = (const struct name_list_s **)aptr;
--  const struct name_list_s **b = (const struct name_list_s **)bptr;
-+  const char *a = (*(const struct name_list_s **)aptr)->name;
-+  const char *b = (*(const struct name_list_s **)bptr)->name;
- 
--  return strlen ((*a)->name) < strlen ((*b)->name);
-+  const size_t len_a = strlen(a);
-+  const size_t len_b = strlen(b);
-+
-+  if (len_a < len_b)
-+    return -1;
-+  if (len_a > len_b)
-+    return +1;
-+  return strcmp(a, b);
- }
- 
- static void
diff --git a/patches/libksba-1.6.3.patch b/patches/libksba-1.6.3.patch
deleted file mode 100644
index e0f00267f..000000000
--- a/patches/libksba-1.6.3.patch
+++ /dev/null
@@ -1,176 +0,0 @@
-diff -u -r libksba-1.4.0-clean/configure libksba-1.4.0/configure
---- libksba-1.4.0-clean/configure	2016-08-22 02:56:54.000000000 -0700
-+++ libksba-1.4.0/configure	2020-01-12 13:34:53.557259138 -0800
-@@ -10734,7 +10734,7 @@
-   version_type=linux # correct to gnu/linux during the next big refactor
-   need_lib_prefix=no
-   need_version=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test "$host_cpu" = ia64; then
-     # AIX 5 supports IA64
-     library_names_spec='${libname}${release}${shared_ext}$major ${libname}${release}${shared_ext}$versuffix $libname${shared_ext}'
-@@ -10973,16 +10973,16 @@
-     ;;
-   freebsd3.[01]* | freebsdelf3.[01]*)
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   freebsd3.[2-9]* | freebsdelf3.[2-9]* | \
-   freebsd4.[0-5] | freebsdelf4.[0-5] | freebsd4.1.1 | freebsdelf4.1.1)
-     shlibpath_overrides_runpath=no
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   *) # from 4.6 on, and DragonFly
-     shlibpath_overrides_runpath=yes
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     ;;
-   esac
-   ;;
-@@ -10995,7 +10995,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- haiku*)
-@@ -11008,7 +11008,7 @@
-   shlibpath_var=LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
-   sys_lib_dlsearch_path_spec='/boot/home/config/lib /boot/common/lib /boot/system/lib'
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- hpux9* | hpux10* | hpux11*)
-@@ -11020,7 +11020,7 @@
-   case $host_cpu in
-   ia64*)
-     shrext_cmds='.so'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.so"
-     shlibpath_var=LD_LIBRARY_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -11035,7 +11035,7 @@
-     ;;
-   hppa*64*)
-     shrext_cmds='.sl'
--    hardcode_into_libs=yes
-+    hardcode_into_libs=no
-     dynamic_linker="$host_os dld.sl"
-     shlibpath_var=LD_LIBRARY_PATH # How should we handle SHLIB_PATH
-     shlibpath_overrides_runpath=yes # Unless +noenvvar is specified.
-@@ -11068,7 +11068,7 @@
-   dynamic_linker='Interix 3.x ld.so.1 (PE, like ELF)'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- irix5* | irix6* | nonstopux*)
-@@ -11105,7 +11105,7 @@
-   shlibpath_overrides_runpath=no
-   sys_lib_search_path_spec="/usr/lib${libsuff} /lib${libsuff} /usr/local/lib${libsuff}"
-   sys_lib_dlsearch_path_spec="/usr/lib${libsuff} /lib${libsuff}"
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- # No shared lib support for Linux oldld, aout, or coff.
-@@ -11126,7 +11126,7 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   dynamic_linker='Android linker'
-   # Don't embed -rpath directories since the linker doesn't support them.
-@@ -11181,7 +11181,7 @@
-   # This implies no fast_install, which is unacceptable.
-   # Some rework will be needed to allow for fast_install
-   # before this can be enabled.
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
- 
-   # Append ld.so.conf contents to the search path
-   if test -f /etc/ld.so.conf; then
-@@ -11206,7 +11206,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='NetBSD ld.elf_so'
-   ;;
- 
-@@ -11225,7 +11225,7 @@
-   fi
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- newsos6)
-@@ -11243,7 +11243,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   dynamic_linker='ldqnx.so'
-   ;;
- 
-@@ -11305,7 +11305,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   # ldd complains unless libraries are executable
-   postinstall_cmds='chmod +x $lib'
-   ;;
-@@ -11362,7 +11362,7 @@
-   soname_spec='${libname}${release}${shared_ext}$major'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=yes
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   if test "$with_gnu_ld" = yes; then
-     sys_lib_search_path_spec='/usr/local/lib /usr/gnu/lib /usr/ccs/lib /usr/lib /lib'
-   else
-@@ -11384,7 +11384,7 @@
-   library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major $libname${shared_ext}'
-   shlibpath_var=LD_LIBRARY_PATH
-   shlibpath_overrides_runpath=no
--  hardcode_into_libs=yes
-+  hardcode_into_libs=no
-   ;;
- 
- uts4*)
-@@ -15804,7 +15804,7 @@
- postuninstall_cmds='`$ECHO "$postuninstall_cmds" | $SED "$delay_single_quote_subst"`'
- finish_cmds='`$ECHO "$finish_cmds" | $SED "$delay_single_quote_subst"`'
- finish_eval='`$ECHO "$finish_eval" | $SED "$delay_single_quote_subst"`'
--hardcode_into_libs='`$ECHO "$hardcode_into_libs" | $SED "$delay_single_quote_subst"`'
-+hardcode_into_libs=no
- sys_lib_search_path_spec='`$ECHO "$sys_lib_search_path_spec" | $SED "$delay_single_quote_subst"`'
- sys_lib_dlsearch_path_spec='`$ECHO "$sys_lib_dlsearch_path_spec" | $SED "$delay_single_quote_subst"`'
- hardcode_action='`$ECHO "$hardcode_action" | $SED "$delay_single_quote_subst"`'
-@@ -17021,7 +17021,7 @@
- finish_eval=$lt_finish_eval
- 
- # Whether we should hardcode library paths into libraries.
--hardcode_into_libs=$hardcode_into_libs
-+hardcode_into_libs=no
- 
- # Compile-time system search path for libraries.
- sys_lib_search_path_spec=$lt_sys_lib_search_path_spec
diff --git a/patches/linux-6.1.8/0003-fix-c23-bool-compat.patch b/patches/linux-6.1.8/0003-fix-c23-bool-compat.patch
new file mode 100644
index 000000000..d6880af4e
--- /dev/null
+++ b/patches/linux-6.1.8/0003-fix-c23-bool-compat.patch
@@ -0,0 +1,17 @@
+diff --git a/work/tmp-linux-orig/include/linux/stddef.h b/work/tmp-linux-edit/include/linux/stddef.h
+index 929d67710c..40862e3a77 100644
+--- ./include/linux/stddef.h
++++ ./include/linux/stddef.h
+@@ -7,10 +7,12 @@
+ #undef NULL
+ #define NULL ((void *)0)
+ 
++#if !(defined(__STDC_VERSION__) && __STDC_VERSION__ >= 202311L)
+ enum {
+ 	false	= 0,
+ 	true	= 1
+ };
++#endif
+ 
+ #undef offsetof
+ #define offsetof(TYPE, MEMBER)	__builtin_offsetof(TYPE, MEMBER)
diff --git a/patches/linux-6.1.8/0004-fix-c23-bool-typedef.patch b/patches/linux-6.1.8/0004-fix-c23-bool-typedef.patch
new file mode 100644
index 000000000..900025d0e
--- /dev/null
+++ b/patches/linux-6.1.8/0004-fix-c23-bool-typedef.patch
@@ -0,0 +1,15 @@
+diff --git a/work/tmp-linux-orig/include/linux/types.h b/work/tmp-linux-edit/include/linux/types.h
+index ea8cf60a8a..87bedca7a9 100644
+--- ./include/linux/types.h
++++ ./include/linux/types.h
+@@ -27,7 +27,9 @@ typedef __kernel_timer_t	timer_t;
+ typedef __kernel_clockid_t	clockid_t;
+ typedef __kernel_mqd_t		mqd_t;
+ 
+-typedef _Bool			bool;
++#if !(defined(__STDC_VERSION__) && __STDC_VERSION__ >= 202311L)
++typedef _Bool		bool;
++#endif
+ 
+ typedef __kernel_uid32_t	uid_t;
+ typedef __kernel_gid32_t	gid_t;
diff --git a/patches/linux-6.6.16-openpower/0008-powerpc-c23.patch b/patches/linux-6.6.16-openpower/0008-powerpc-c23.patch
new file mode 100644
index 000000000..4532ca639
--- /dev/null
+++ b/patches/linux-6.6.16-openpower/0008-powerpc-c23.patch
@@ -0,0 +1,24 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Heads Build System <no-reply@heads.example>
+Date: Mon, 26 Jan 2026 00:00:00 +0000
+Subject: [PATCH 8/8] powerpc: add -std=gnu11 for C23 compatibility in boot Makefile
+
+Add -std=gnu11 to arch/powerpc/boot/Makefile BOOTAFLAGS to avoid C23
+keyword and type compatibility issues when building with GCC 15.1.
+
+Signed-off-by: Heads Build System <no-reply@heads.example>
+---
+--- a/arch/powerpc/boot/Makefile	2025-08-19 18:11:03.942092926 +0000
++++ b/arch/powerpc/boot/Makefile	2025-08-19 18:11:03.943875445 +0000
+@@ -79,7 +79,7 @@
+ 		   $(call cc-option,-mno-pcrel) \
+ 		   $(call cc-option,-mno-mma) \
+ 		   $(call cc-option,-mno-spe) $(call cc-option,-mspe=no) \
+-		   -fomit-frame-pointer -fno-builtin -fPIC
++		   -fomit-frame-pointer -fno-builtin -fPIC -std=gnu11
+ 
+ BOOTAFLAGS	:= $(BOOTTARGETFLAGS) -D__ASSEMBLY__
+ 
+-- 
+2.47.1
+
diff --git a/patches/lvm2-2.02.168.patch b/patches/lvm2-2.02.168.patch
deleted file mode 100644
index 0a0956998..000000000
--- a/patches/lvm2-2.02.168.patch
+++ /dev/null
@@ -1,163 +0,0 @@
-diff --recursive -u clean/LVM2.2.02.168/lib/mm/memlock.c lvm2.2.02.168/lib/mm/memlock.c
---- clean/LVM2.2.02.168/lib/mm/memlock.c	2016-12-01 00:17:29.000000000 +0100
-+++ lvm2.2.02.168/lib/mm/memlock.c	2020-01-09 13:23:14.017310025 +0100
-@@ -150,6 +150,7 @@
- 
- static void _allocate_memory(void)
- {
-+#if 0
- #ifndef VALGRIND_POOL
- 	void *stack_mem;
- 	struct rlimit limit;
-@@ -208,11 +209,14 @@
- 	for (i = 0; i < area; ++i)
- 		free(areas[i]);
- #endif
-+#endif
- }
- 
- static void _release_memory(void)
- {
-+#if 0
- 	free(_malloc_mem);
-+#endif
- }
- 
- /*
-@@ -288,7 +292,7 @@
- 
- 	if (lock == LVM_MLOCK) {
- 		if (mlock((const void*)from, sz) < 0) {
--			log_sys_error("mlock", line);
-+			//log_sys_error("mlock", line);
- 			return 0;
- 		}
- 	} else {
-diff --recursive -u clean/LVM2.2.02.168/libdm/libdm-stats.c lvm2.2.02.168/libdm/libdm-stats.c
---- clean/LVM2.2.02.168/libdm/libdm-stats.c	2016-12-01 00:17:30.000000000 +0100
-+++ lvm2.2.02.168/libdm/libdm-stats.c	2020-01-09 13:23:14.017310025 +0100
-@@ -17,7 +17,24 @@
- 
- #include "dmlib.h"
- 
-+#if 0
- #include "math.h" /* log10() */
-+#else
-+static int ilog10(double x)
-+{
-+	int e = 0;
-+
-+	while(x > 10)
-+	{
-+		e++;
-+		x = x / 10;
-+	}
-+
-+	return e;
-+}
-+#endif
-+
-+
- 
- #include <sys/sysmacros.h>
- #include <sys/ioctl.h>
-@@ -502,7 +519,11 @@
- 	while(entry >= bins) {
- 		value = (double) (entry--)->upper;
- 		/* Use lround to avoid size_t -> double cast warning. */
-+#if 0
- 		hist_len += 1 + (size_t) lround(log10(value / scale));
-+#else
-+		hist_len += 1 + ilog10(value / scale);
-+#endif
- 		if (entry != bins)
- 			hist_len++; /* ',' */
- 	}
-@@ -1746,7 +1767,11 @@
- 		}
- 
- 		/* length of region_id or range start in characters */
-+#if 0
- 		id_len = (i) ? 1 + (size_t) log10(i) : 1;
-+#else
-+		id_len = (i) ? 1 + ilog10(i) : 1;
-+#endif
- 		buflen += id_len;
- 		j = i;
- 		do
-@@ -1761,7 +1786,11 @@
- 		/* handle range */
- 		if (i != j) {
- 			/* j is always > i, which is always >= 0 */
-+#if 0
- 			id_len = 1 + (size_t) log10(j);
-+#else
-+			id_len = 1 + ilog10(j);
-+#endif
- 			buflen += id_len + 1; /* range end plus "-" */
- 		}
- 		buflen++;
-diff --recursive -u clean/LVM2.2.02.168/libdm/Makefile.in lvm2.2.02.168/libdm/Makefile.in
---- clean/LVM2.2.02.168/libdm/Makefile.in	2016-12-01 00:17:30.000000000 +0100
-+++ lvm2.2.02.168/libdm/Makefile.in	2020-01-09 13:23:14.017310025 +0100
-@@ -56,7 +56,8 @@
- 
- CFLAGS += $(UDEV_CFLAGS) $(VALGRIND_CFLAGS)
- 
--LIBS += $(SELINUX_LIBS) $(UDEV_LIBS) $(PTHREAD_LIBS) $(M_LIBS)
-+#LIBS += $(SELINUX_LIBS) $(UDEV_LIBS) $(PTHREAD_LIBS) $(M_LIBS)
-+LIBS += $(SELINUX_LIBS) $(UDEV_LIBS)
- 
- device-mapper: all
- 
-diff --recursive -u clean/LVM2.2.02.168/make.tmpl.in lvm2.2.02.168/make.tmpl.in
---- clean/LVM2.2.02.168/make.tmpl.in	2016-12-01 00:17:30.000000000 +0100
-+++ lvm2.2.02.168/make.tmpl.in	2020-01-09 13:23:14.017310025 +0100
-@@ -142,7 +142,7 @@
- M_INSTALL_PROGRAM = -m 555
- M_INSTALL_DATA = -m 444
- endif
--INSTALL_PROGRAM = $(INSTALL) $(M_INSTALL_PROGRAM) $(STRIP)
-+INSTALL_PROGRAM = $(INSTALL) $(M_INSTALL_PROGRAM) $(STRIP_ARG)
- INSTALL_DATA = $(INSTALL) -p $(M_INSTALL_DATA)
- INSTALL_WDATA = $(INSTALL) -p -m 644
- 
-@@ -260,8 +260,8 @@
- #CFLAGS += -pg
- #LDFLAGS += -pg
- 
--STRIP=
--#STRIP = -s
-+STRIP_ARG=
-+#STRIP_ARG = -s
- 
- LVM_VERSION := $(shell cat $(top_srcdir)/VERSION)
- 
-diff --recursive -u clean/LVM2.2.02.168/tools/lvmcmdline.c lvm2.2.02.168/tools/lvmcmdline.c
---- clean/LVM2.2.02.168/tools/lvmcmdline.c	2016-12-01 00:17:32.000000000 +0100
-+++ lvm2.2.02.168/tools/lvmcmdline.c	2020-01-09 13:23:49.057418263 +0100
-@@ -1817,6 +1817,7 @@
- {
- 	int err = is_valid_fd(STDERR_FILENO);
- 
-+#if 0
- 	if (!is_valid_fd(STDIN_FILENO) &&
- 	    !(stdin = fopen(_PATH_DEVNULL, "r"))) {
- 		if (err)
-@@ -1841,6 +1842,7 @@
- 		       strerror(errno));
- 		return 0;
- 	}
-+#endif
- 
- 	return 1;
- }
-@@ -2023,7 +2025,7 @@
- 	 */
- 	dm_set_name_mangling_mode(DM_STRING_MANGLING_NONE);
- 
--	if (!(cmd = create_toolcontext(0, NULL, 1, 0,
-+	if (!(cmd = create_toolcontext(0, NULL, 0, 0,
- 			set_connections, set_filters))) {
- 		udev_fin_library_context();
- 		return_NULL;
diff --git a/patches/lvm2-2.03.23.patch b/patches/lvm2-2.03.23.patch
index 587e1bb69..3fcfef324 100644
--- a/patches/lvm2-2.03.23.patch
+++ b/patches/lvm2-2.03.23.patch
@@ -147,4 +147,15 @@
 +INSTALL_PROGRAM = $(INSTALL) $(M_INSTALL_PROGRAM)
  INSTALL_DATA = $(INSTALL) -p $(M_INSTALL_DATA)
  INSTALL_WDATA = $(INSTALL) -p -m 644
+
+--- ./lib/device/device_id.c.orig	2025-07-30 14:46:00.000000000 +0000
++++ ./lib/device/device_id.c	2025-07-30 14:46:00.000000000 +0000
+@@ -33,6 +33,7 @@
+ #include <sys/types.h>
+ #include <sys/file.h>
+ #include <sys/sysmacros.h>
++#include <libgen.h>
+ 
+ #define DEVICES_FILE_MAJOR 1
+ #define DEVICES_FILE_MINOR 1
  
diff --git a/patches/musl-cross-make-e5147dde912478dd32ad42a25003e82d4f5733aa/0001-use-gcc-15_1_0.patch b/patches/musl-cross-make-e5147dde912478dd32ad42a25003e82d4f5733aa/0001-use-gcc-15_1_0.patch
new file mode 100644
index 000000000..628caf28d
--- /dev/null
+++ b/patches/musl-cross-make-e5147dde912478dd32ad42a25003e82d4f5733aa/0001-use-gcc-15_1_0.patch
@@ -0,0 +1,11 @@
+--- ./Makefile.orig    2025-07-29 14:01:18.949933787 -0400
++++ ./Makefile         2025-07-29 14:03:06.285334095 -0400
+@@ -3,7 +3,7 @@
+ 
+ CONFIG_SUB_REV = 3d5db9ebe860
+ BINUTILS_VER = 2.44
+-GCC_VER = 9.4.0
++GCC_VER = 15.1.0
+ MUSL_VER = 1.2.5
+ GMP_VER = 6.3.0
+ MPC_VER = 1.3.1
diff --git a/patches/musl-cross-make-fd6be58297ee21fcba89216ccd0d4aca1e3f1c5c/0001-no-ssl-linux-headers.patch b/patches/musl-cross-make-fd6be58297ee21fcba89216ccd0d4aca1e3f1c5c/0001-no-ssl-linux-headers.patch
deleted file mode 100644
index 948f96867..000000000
--- a/patches/musl-cross-make-fd6be58297ee21fcba89216ccd0d4aca1e3f1c5c/0001-no-ssl-linux-headers.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- ../orig/Makefile	2024-05-07 02:14:37.000000000 +0100
-+++ ./Makefile	2025-10-27 00:11:38.045918046 +0000
-@@ -22,7 +22,7 @@
- MUSL_REPO = https://git.musl-libc.org/git/musl
- 
- LINUX_SITE = https://cdn.kernel.org/pub/linux/kernel
--LINUX_HEADERS_SITE = https://ftp.barfooze.de/pub/sabotage/tarballs/
-+LINUX_HEADERS_SITE = http://ftp.barfooze.de/pub/sabotage/tarballs/
- 
- DL_CMD = wget -c -O
- SHA1_CMD = sha1sum -c
diff --git a/patches/pciutils-3.5.4.patch b/patches/pciutils-3.5.4/0001-add-PCI_HAVE_STDINT_H.patch
similarity index 100%
rename from patches/pciutils-3.5.4.patch
rename to patches/pciutils-3.5.4/0001-add-PCI_HAVE_STDINT_H.patch
diff --git a/patches/powerpc-utils-1.3.5.patch b/patches/powerpc-utils-1.3.5.patch
deleted file mode 100644
index 35b27cdbd..000000000
--- a/patches/powerpc-utils-1.3.5.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-AC_FUNC_MALLOC somehow fails to find malloc(), so drop the check
-
-Weirdly, it doesn't fail configuration, but instead adds -Dmalloc=rpl_malloc
-and fails linking.
-
-diff --git a/configure.ac.orig b/configure.ac
-index a7be3ee95c..74aade323b 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -33,7 +33,6 @@ AC_TYPE_UINT8_T
- # Checks for library functions.
- AC_FUNC_FORK
- AC_FUNC_LSTAT_FOLLOWS_SLASHED_SYMLINK
--AC_FUNC_MALLOC
- AC_FUNC_MKTIME
- AC_CHECK_FUNCS([memset strchr strcspn strdup strerror strrchr strstr strtol strtoul strtoull gettimeofday])
- 
diff --git a/patches/powerpc-utils-1.3.5/0001-fix-rtas-function-pointer-signatures-gcc15.patch b/patches/powerpc-utils-1.3.5/0001-fix-rtas-function-pointer-signatures-gcc15.patch
new file mode 100644
index 000000000..a52718853
--- /dev/null
+++ b/patches/powerpc-utils-1.3.5/0001-fix-rtas-function-pointer-signatures-gcc15.patch
@@ -0,0 +1,23 @@
+Fix function pointer declarations for GCC 15.1 C23 compatibility
+
+GCC 15.1 with C23 standard is stricter about function pointer type
+mismatches. The RTAS event function pointers need proper signatures
+to match their actual usage.
+
+diff --git a/src/nvram.c b/src/nvram.c
+index a7be3ee95c..74aade323b 100644
+--- a/src/nvram.c
++++ b/src/nvram.c
+@@ -900,9 +900,9 @@ dump_rtas_event_entry(char *data, int len)
+ {
+     void *rtas_event;
+     void *handle;
+-    void *(*parse_rtas_event)();
+-    void (*rtas_print_event)();
+-    void (*cleanup_rtas_event)();
++    void *(*parse_rtas_event)(char *, int);
++    void (*rtas_print_event)(FILE *, void *, int);
++    void (*cleanup_rtas_event)(void *);
+ 
+     handle = dlopen("/usr/lib/librtasevent.so", RTLD_LAZY);
+     if (handle == NULL)
diff --git a/patches/slang-2.3.3/unhardcode-ln-in-Makefile.patch b/patches/slang-2.3.3/0001-unhardcode-ln-in-src-Makefile.patch
similarity index 64%
rename from patches/slang-2.3.3/unhardcode-ln-in-Makefile.patch
rename to patches/slang-2.3.3/0001-unhardcode-ln-in-src-Makefile.patch
index 590e06915..9d1f0045b 100644
--- a/patches/slang-2.3.3/unhardcode-ln-in-Makefile.patch
+++ b/patches/slang-2.3.3/0001-unhardcode-ln-in-src-Makefile.patch
@@ -1,3 +1,7 @@
+# 0001-unhardcode-ln-in-src-Makefile.patch
+# Purpose: avoid hardcoding an absolute /bin/ln in src/Makefile.in so the build uses the
+# ln on PATH (improves cross-build and portability).
+
 diff --git a/src/Makefile.in b/src/Makefile.in
 index 7fe4dc2..38fe174 100644
 --- a/src/Makefile.in
diff --git a/patches/tpm2-tss-3.2.2.patch b/patches/tpm2-tss-3.2.2/0001-remove-useradd-groupadd-check.patch
similarity index 100%
rename from patches/tpm2-tss-3.2.2.patch
rename to patches/tpm2-tss-3.2.2/0001-remove-useradd-groupadd-check.patch
diff --git a/patches/tpmtotp-4d63d21c8b7db2e92ddb393057f168aead147f47/0001-fix-printUsage-function-signature.patch b/patches/tpmtotp-4d63d21c8b7db2e92ddb393057f168aead147f47/0001-fix-printUsage-function-signature.patch
new file mode 100644
index 000000000..1a5239493
--- /dev/null
+++ b/patches/tpmtotp-4d63d21c8b7db2e92ddb393057f168aead147f47/0001-fix-printUsage-function-signature.patch
@@ -0,0 +1,56 @@
+--- a/util/getpubkey.c
++++ b/util/getpubkey.c
+@@ -42,10 +42,10 @@
+ 
+ #include "tpmfunc.h"
+ 
+-static void printUsage(const char *prg)
++static void printUsage(void)
+ {
+     printf("\n");
+-    printf("%s -ha <key handle> -pwdk keypassword\n", prg);
++    printf("getpubkey -ha <key handle> -pwdk keypassword\n");
+     printf("\n");
+     printf("\n");
+ }
+@@ -70,7 +70,7 @@
+                 keypass = argv[i];
+             } else {
+                 printf("Missing parameter to -pwdk\n");
+-	        printUsage(argv[0]);
++	        printUsage();
+ 	        exit(1);
+ 	    }
+         }
+@@ -83,12 +83,12 @@
+                 }
+ 	    } else {
+ 	        printf("Missing parameter to -ha\n");
+-	        printUsage(argv[0]);
++	        printUsage();
+ 	        exit(1);
+ 	    }
+         }
+         else if (!strcmp(argv[i], "-h")) {
+-            printUsage(argv[0]);
++            printUsage();
+             exit(0);
+         }
+         else if (!strcmp(argv[i], "-v")) {
+@@ -96,14 +96,14 @@
+         }
+         else {
+             printf("\n%s is not a valid option\n", argv[i]);
+-            printUsage(argv[0]);
++            printUsage();
+             exit(1);
+         }
+     }
+ 
+     if (keyHandle == 0) {
+         printf("Missing key handle.\n");
+-        printUsage(argv[0]);
++        printUsage();
+         exit(1);
+     }
+ 
diff --git a/patches/tpmtotp-4d63d21c8b7db2e92ddb393057f168aead147f47/0002-mbedtls-aes-compat.patch b/patches/tpmtotp-4d63d21c8b7db2e92ddb393057f168aead147f47/0002-mbedtls-aes-compat.patch
new file mode 100644
index 000000000..42054f6f3
--- /dev/null
+++ b/patches/tpmtotp-4d63d21c8b7db2e92ddb393057f168aead147f47/0002-mbedtls-aes-compat.patch
@@ -0,0 +1,13 @@
+--- a/libtpm/mbedtls-compat.h
++++ b/libtpm/mbedtls-compat.h
+@@ -92,7 +92,9 @@
+ #define AES_cbc_encrypt(in, out, len, key, ivec, dir) \
+ 	mbedtls_aes_crypt_cbc(key, dir, len, ivec, in, out)
+ 
+-#define AES_encrypt mbedtls_aes_encrypt
++/* Provide an AES_encrypt wrapper with the OpenSSL-like call order used by the TPM
++   code: AES_encrypt(in, out, key) -> mbedtls_aes_crypt_ecb(ctx, MBEDTLS_AES_ENCRYPT, in, out) */
++#define AES_encrypt(in, out, key) mbedtls_aes_crypt_ecb((mbedtls_aes_context *)(key), MBEDTLS_AES_ENCRYPT, (in), (out))
+ 
+ //--------------------------------------------------
+ 
diff --git a/scripts/collect_oflags.py b/scripts/collect_oflags.py
new file mode 100755
index 000000000..84f428ab3
--- /dev/null
+++ b/scripts/collect_oflags.py
@@ -0,0 +1,169 @@
+#!/usr/bin/env python3
+"""collect_oflags.py
+Scan build logs for -O flags and write a CSV summary.
+
+Usage:
+  ./scripts/collect_oflags.py [--out FILE]
+
+Produces lines: module,O,Os,O2,O3,Oz,total,examples
+"""
+
+import argparse
+import os
+import re
+from collections import defaultdict
+
+def module_from_path(p):
+    # If path contains /log/, use basename without .log
+    if '/log/' in p:
+        name = os.path.splitext(os.path.basename(p))[0]
+    else:
+        parts = p.split(os.sep)
+        try:
+            bi = parts.index('build')
+            name = parts[bi+2] if len(parts) > bi+2 else os.path.basename(os.path.dirname(p))
+        except ValueError:
+            name = os.path.basename(os.path.dirname(p))
+    m = re.match(r'(.+)-([0-9].*)$', name)
+    if m:
+        return m.group(1)
+    m = re.match(r'(.+)-([0-9a-f]{8,})$', name)
+    if m:
+        return m.group(1)
+    return name
+
+def scan(root='build'):
+    # Use token-aware regex matches to avoid false positives (e.g., '-os' CLI
+    # options or lowercase '-os' in source strings). Match only uppercase 'O'
+    # followed by the expected suffix and ensure the flag is a separate token.
+    regexes = {
+        'O2': re.compile(rb'(?<![A-Za-z0-9_-])\-O2(?![A-Za-z0-9_-])'),
+        'O3': re.compile(rb'(?<![A-Za-z0-9_-])\-O3(?![A-Za-z0-9_-])'),
+        'Os': re.compile(rb'(?<![A-Za-z0-9_-])\-Os(?![A-Za-z0-9_-])'),
+        'Oz': re.compile(rb'(?<![A-Za-z0-9_-])\-Oz(?![A-Za-z0-9_-])'),
+        # Generic -O that is not -O2/-O3/-Os/-Oz
+        'O': re.compile(rb'(?<![A-Za-z0-9_-])\-O(?![0-9sSzZA-Za-z0-9_-])'),
+    }
+    counts = defaultdict(lambda: {'O':0,'Os':0,'O2':0,'O3':0,'Oz':0,'paths':[]})
+<<<<<<< HEAD
+    # Only scan flat per-arch log directories: build/<arch>/log/*.log
+    try:
+        log_dirs = []
+        # If root itself has a 'log' directory, treat root as an arch path and scan it
+        root_log = os.path.join(root, 'log')
+        if os.path.isdir(root_log):
+            log_dirs = [root_log]
+        else:
+            for arch_entry in os.scandir(root):
+                if not arch_entry.is_dir():
+                    continue
+                arch_path = arch_entry.path
+                arch_log = os.path.join(arch_path, 'log')
+                if not os.path.isdir(arch_log):
+                    continue
+                log_dirs.append(arch_log)
+        for arch_log in log_dirs:
+            for fn in os.listdir(arch_log):
+                if not fn.endswith('.log'):
+                    continue
+                # Skip configure logs and unrelated config.log (also skip per-module configure logs like 'foo.configure.log')
+                if fn.startswith('configure.') or fn == 'config.log' or '.configure' in fn:
+                    continue
+                fp = os.path.join(arch_log, fn)
+                try:
+                    with open(fp, 'rb') as fh:
+                        b = fh.read()
+                except Exception:
+                    continue
+                # Quick reject: if none of the uppercase patterns exist in the file, skip
+                if not any(p in b for p in [b'-O2', b'-O3', b'-Os', b'-Oz', b'-O']):
+                    continue
+                mod = module_from_path(fp)
+                cO2 = cO3 = cOs = cOz = cO = 0
+                # Process file line-by-line so we can avoid matches inside sed substitution
+                # or other script/text contexts. If a line contains a pipeline ('|'), only
+                # consider the part before the pipe (compiler invocation) and ignore the
+                # rest (e.g., "... -Oz ... | sed -e 's/-O.../'"). For generic '-O' we only
+                # count occurrences when the line looks like a compiler command.
+                for line in b.splitlines():
+                    # If there's a pipeline, only analyze the part before the first '|'
+                    if b'|' in line:
+                        comp_part = line.split(b'|', 1)[0]
+                    else:
+                        comp_part = line
+                    # Heuristics to detect compiler-like lines.
+                    is_compiler_like = any(tok in comp_part for tok in [b'--mode=compile', b' gcc', b' g++', b' clang', b' -c ', b' -o ', b'cc '])
+                    # Skip purely sed/subst lines (they often contain s/-O.../ and are not compile invocations)
+                    if b'sed' in comp_part and not is_compiler_like:
+                        continue
+                    # Count explicit variants always in the compiler part
+                    cO2 += len(regexes['O2'].findall(comp_part))
+                    cO3 += len(regexes['O3'].findall(comp_part))
+                    cOs += len(regexes['Os'].findall(comp_part))
+                    cOz += len(regexes['Oz'].findall(comp_part))
+                    # Count generic '-O' only when the line looks like a compiler invocation
+                    if is_compiler_like:
+                        cO += len(regexes['O'].findall(comp_part))
+                counts[mod]['O'] += cO
+                counts[mod]['Os'] += cOs
+                counts[mod]['O2'] += cO2
+                counts[mod]['O3'] += cO3
+                counts[mod]['Oz'] += cOz
+                counts[mod]['paths'].append(fp)
+    except FileNotFoundError:
+        # Root does not exist or is invalid
+        pass
+=======
+    for dirpath, _, filenames in os.walk(root):
+        for fn in filenames:
+            if not (fn.endswith('.log') or fn == 'config.log'):
+                continue
+            fp = os.path.join(dirpath, fn)
+            try:
+                with open(fp, 'rb') as fh:
+                    b = fh.read()
+            except Exception:
+                continue
+            # Quick reject: if none of the uppercase patterns exist in the file, skip
+            if not any(p in b for p in [b'-O2', b'-O3', b'-Os', b'-Oz', b'-O']):
+                continue
+            mod = module_from_path(fp)
+            cO2 = len(regexes['O2'].findall(b))
+            cO3 = len(regexes['O3'].findall(b))
+            cOs = len(regexes['Os'].findall(b))
+            cOz = len(regexes['Oz'].findall(b))
+            cO = len(regexes['O'].findall(b))
+            counts[mod]['O'] += cO
+            counts[mod]['Os'] += cOs
+            counts[mod]['O2'] += cO2
+            counts[mod]['O3'] += cO3
+            counts[mod]['Oz'] += cOz
+            counts[mod]['paths'].append(fp)
+>>>>>>> 4e0c6208ca (tpmtotp: normalize -O flags to -Oz in pre-configure; harden OFLAG scanner; update inventory and build_oflags_summary)
+    return counts
+
+def write_csv(counts, out):
+    with open(out, 'w') as f:
+        f.write('module,O,Os,O2,O3,Oz,total,examples\n')
+        rows = []
+        for mod, v in counts.items():
+            total = v['O'] + v['Os'] + v['O2'] + v['O3'] + v['Oz']
+            if total == 0:
+                continue
+            rows.append((total, mod, v))
+        rows.sort(reverse=True)
+        for total, mod, v in rows:
+            ex = ';'.join(v['paths'][:3])
+            f.write(f'{mod},{v["O"]},{v["Os"]},{v["O2"]},{v["O3"]},{v["Oz"]},{total},{ex}\n')
+
+def main():
+    p = argparse.ArgumentParser()
+    p.add_argument('--out', '-o', default='build_oflags_summary.csv', help='Output CSV file')
+    p.add_argument('--root', default='build', help='Build tree root to scan')
+    args = p.parse_args()
+    counts = scan(args.root)
+    write_csv(counts, args.out)
+    print(f'Wrote {args.out} (modules with non-zero -O counts)')
+
+if __name__ == '__main__':
+    main()