pagebundler is a helper that needs to be built with the *host* compiler because it's used to generate some sources. In normal situations, HOSTCC and HOSTCFLAGS are just ${CC} and ${CFLAGS}, but folks that cross-compile can specify there the host compiler and flags to successfully build telescope. The idea is largely based on what gforth does: it re-uses ${CFLAGS} for the host compiler though, while I'm adding an extra variable for that.

landlock is applied only to the ui process to drop fs access and in the fs process to limit where telescope can read/write files. The network process is more difficult to landlock because while in theory it doesn't need *any* fs access, in practice it needs to read (at least) files inside /etc/ for DNS to work.

ncurses has "--with-termlib" build option, which forces some symbols from libncurses.so to be moved to libtinfo.so. It caused the following error: ld: ui.o: undefined reference to symbol 'keypad' ld: /lib64/libtinfow.so.6: error adding symbols: DSO missing from command line

Looking at the build failure for the nix package on darwin I noticed that explicit_bzero is used by recallocarray but not included in the compat layer...

on libevent2 we need to wrap evbuffer_add with evbuffer_freeze/evbuffer_unfreeze. Not sure exactly why, probably because we're doing some evbuffer_enable/disable/enable-again. Retain compatibility with the custom libevent1 in base on OpenBSD.