softbuffer — replaced via [patch.crates-io] with a fork (branch wayland-argb) that uses wl_shm Argb8888, so the tiny-skia fallback renderer honors alpha on Wayland (upstream hardcodes Xrgb8888, which the compositor treats as fully opaque). The fork is based on v0.4.8 to match the iced_tiny_skia release iced depends on — rebasing it past 0.4.x will break the patch.
Cargo.lock pins each source to an exact commit, so clones build reproducibly; only an explicit cargo update -p <crate> moves a branch-tracking dependency.
Dependencies go under overrides because package names differ per distro
(libxkbcommon0 on Debian/Ubuntu, libxkbcommon on Fedora). cargo-nfpm ignores
depends in the plain [package.metadata.nfpm.deb] / .rpm tables. When adding
a crate that links a new system library, add it to both lists. Check the result
with readelf -d target/release/ashell | grep NEEDED.