Fix dpdk build deps

docs/TODO.md

@@ -113,3 +113,37 @@ boot LAN.
   writable → multi-user.
 - This validation **gates** item #1 (network-manager port) and item #3
   (errata → design v3).
+
+## [ ] 6. Rolling fleet updates (multi-version serve → cohort reboots)
+
+Image-based, reboot-to-update across many live workstations. Hosts are immutable
+(read-only erofs/verity root over NVMe/TCP, ephemeral overlay), so updates are
+**atomic A/B reboots**, never in-place. The released OCI artifact + digest-pinned
+manifest + roothash coupling already give the atomic unit and instant rollback;
+this item builds the rollout machinery around it.
+
+- **Serve versions side-by-side** (must not overwrite a live rootfs): extend
+  `serving/` so SPDK/nvmet exposes each release as its **own subsystem/NQN**
+  (`nqn…:rootfs-<ver>`) and nginx serves multiple `fleet-<ver>.efi` (keep
+  current + previous). Make the UKI's NQN version-specific so each signed UKI
+  connects only its matching namespace (constant discovery DNS name).
+- **Version selection at boot**: dnsmasq **cohort tagging** (MAC / vendor class /
+  assigned tag) hands each cohort a different option-67 UKI URL. Moving a
+  cohort's URL = assigning the release.
+- **Control plane + in-image reboot agent**: a baked-in systemd timer polls a
+  "desired version" endpoint and reboots **when idle / in a maintenance window**
+  (or out-of-band via Redfish/BMC). Stagger + jitter reboots to avoid UKI-fetch
+  / NVMe-connect storms.
+- **Staged rollout**: canary → waves (10/50/100%) with health gates
+  (multi-user reached, NVMe connected, dm-verity mapped, kiosk URL rendered,
+  prod: MACsec/802.1X up); auto-halt on threshold.
+- **Rollback**: repoint cohort URL to previous UKI + reboot (current+previous
+  stay served); security rollback via dbx-revoke / TPM monotonic counter
+  (design §6).
+- **Drain & retire** an old version only when SPDK/nvmet reports zero connected
+  controllers on it.
+- **Availability**: run NVMe/TCP target replicas behind distinct discovery
+  entries (design §7) — never serve the whole fleet from one unreplicated node,
+  especially mid-rollout (N versions + reboot bursts).
+- Note: kiosk *content* changes are server-side (the website) and need no fleet
+  update — only OS/UKI/rootfs changes require a reboot.

serving/spdk/Dockerfile

@@ -26,8 +26,13 @@ RUN git clone --branch "${SPDK_VERSION}" --depth 1 "${SPDK_REPO}" /spdk \
 # build; trim the test artifacts) and build.
 # apt-get update first: the index was cleared above, and pkgdep.sh runs
 # `apt-get install` without refreshing it (else "Unable to locate package …").
+#
+# pkgdep.sh on Ubuntu 24.04 installs meson/pyelftools into a Python venv (PEP 668),
+# so they aren't on PATH where DPDK's make invokes bare `meson`/`ninja`. Install
+# the DPDK build tools globally too (meson, ninja-build, python3-pyelftools).
 RUN apt-get update \
  && /spdk/scripts/pkgdep.sh \
+ && apt-get install -y --no-install-recommends meson ninja-build python3-pyelftools \
  && cd /spdk \
  && ./configure --disable-tests --disable-unit-tests \
  && make -j"$(nproc)" \