From 5cc72ccac31361bd37101352bc4427712250e84e Mon Sep 17 00:00:00 2001
From: Audiobuzz <audiobuzz@gmail.com>
Date: Fri, 3 Jul 2026 05:55:00 +0000
Subject: [PATCH] =?UTF-8?q?trim:=20drop=20nss-mdns=20(+=20orphaned=20avahi?=
 =?UTF-8?q?)=20=E2=80=94=20media-independent=20mDNS=20resolver?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Investigating avahi/samba/rabbitmq in the image: ldd on libavformat.so confirms
samba (libsmbclient), librabbitmq, librist, libsrt and libzmq are all DT_NEEDED
by FFmpeg's libavformat-free — removing any breaks libavformat and thus future
HTML5 media in the kiosk, so they stay. avahi is the exception: it's absent from
libavformat's links and 'rpm -e --test avahi' shows its only reverse-dep is
nss-mdns (the mDNS/.local NSS resolver).

The fleet resolves via DHCP/DNS (boot.fleet.lab), never .local, so mDNS is dead
weight and a network-listening service unwanted on a locked-down kiosk. Remove
nss-mdns; dnf's clean_requirements_on_remove reaps avahi/avahi-glib/avahi-libs as
orphans. Belt-and-braces alongside install_weak_deps=False (which already drops
nss-mdns if it came in as a Recommends).
---
 diskless.pkr.hcl | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/diskless.pkr.hcl b/diskless.pkr.hcl
index 46d55ff..6edd4fa 100644
--- a/diskless.pkr.hcl
+++ b/diskless.pkr.hcl
@@ -941,6 +941,17 @@ build {
       # hard-needs it) and mask as a backstop against future weak-dep reinstalls.
       "dnf remove -y firewalld 2>/dev/null || true",
       "systemctl mask firewalld.service 2>/dev/null || true",
+      # nss-mdns: the mDNS/.local NSS resolver, and the ONLY reverse-dep of avahi
+      # (confirmed 2026-07-03: `rpm -e --test avahi` → "avahi is needed by nss-mdns",
+      # and avahi is absent from `ldd libavformat` so it's unrelated to Chromium's
+      # media stack — unlike samba/librabbitmq/librist/libsrt/libzmq, which ARE
+      # libavformat DT_NEEDED and must stay for future HTML5 media). This fleet
+      # resolves via DHCP/DNS (boot.fleet.lab), never .local, so mDNS is dead weight
+      # AND a network-listening service unwanted on a locked-down kiosk. Removing
+      # nss-mdns lets dnf's clean_requirements_on_remove reap avahi/avahi-glib/
+      # avahi-libs as orphans. (install_weak_deps=False may already drop nss-mdns if
+      # it's a Recommends; this is the belt-and-braces for the hard-dep case.)
+      "dnf remove -y nss-mdns 2>/dev/null || true",
       # (No Go toolchain to remove — fleet-hostapi + fleet-enrol are built OUT OF
       # the VM on the CI runner and file-provisioned in as static binaries.)
       # The build-time STIG reports must not ship inside the read-only rootfs.