From 68dee79832d2dfb512a45ae2635f0c4a3c82cae3 Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Sat, 4 Jul 2026 02:24:57 +0000 Subject: [PATCH] =?UTF-8?q?docs/TODO=20#18:=20record=20nss-mdns/chromium?= =?UTF-8?q?=20regression=20+=20fix;=20kiosk=20re-verified,=20image=201.8?= =?UTF-8?q?=20GiB=20=E2=86=92=20755=20MiB?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The '#18 render should be safe' call on the nss-mdns drop (5cc72cc) was wrong: it bricked the kiosk on trim-rpm-48dc3e1 (chromium hard-Requires nss-mdns, so the 2d remove cascaded chromium + its GUI stack out → 500 MB browserless image, flashing cursor). Fixed in 2bc2daf (keep nss-mdns, mask avahi daemon; final build guard asserts the kiosk stack survived). Re-verified booting into the kiosk on the 820; container image measured 1.8 GiB → 755 MiB (~58%). --- docs/TODO.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/docs/TODO.md b/docs/TODO.md index f96b7b4..9447b08 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -1559,6 +1559,28 @@ now **kernel-MODULE-bound, not firmware** (~10 MB fw): the `--no-hostonly` + ply - **BENCH-VERIFY:** kiosk still renders on the 820 (i915 kept); check the new "initramfs largest files" log line for the post-omit size + next targets. +**[x] FIXED — the `nss-mdns` drop bricked the kiosk (regression found+fixed 2026-07-04):** +the "render should be safe" call above (5cc72cc) was WRONG — it broke the kiosk, just +not via i915. `trim-rpm-48dc3e1` booted to a **flashing cursor, no kiosk**, and the image +was a suspicious **500 MB**. Root cause: the 2d `dnf remove -y nss-mdns` removed +**chromium** as a *dependent package* — the EPEL `chromium` **hard-Requires `nss-mdns`** +(Chromium uses `.local` mDNS hostnames for WebRTC ICE candidates) — then reaped chromium's +orphaned GUI stack (avahi, at-spi2, atk, adwaita, chromium-common; ~49 pkgs, 523→472). +With no browser, `kiosk-session` died at the `${BROWSER:?}` guard in 4 ms, before weston. +The original commit checked what `nss-mdns` NEEDS (avahi) but not what NEEDS it (chromium). +GPU/i915/firmware/plymouth were all healthy — a red herring. Fix (`2bc2daf`): +- **Keep `nss-mdns` + avahi** (satisfy chromium's Requires); **mask the avahi daemon + + socket** instead — nss-mdns is only an NSS module, needs no listener, and :5353 was the + real attack-surface concern. ~1.5 MB kept. +- **FINAL GUARD in 2d**: `rpm -q chromium chromium-common weston mesa-{dri-drivers,libEGL,libgbm}` + asserts the kiosk stack survived the whole pipeline, else **fail the build**. A missing + browser must brick the BUILD, never the fleet — catches any future remove-cascade / + oscap `package_*_removed` / autoremove. Look for `==> guard: kiosk stack intact` in CI. +**RE-VERIFIED 2026-07-04 (`trim-rpm-2bc2daf`): boots into the kiosk on the 820; image 755 MiB.** + +**Measured end-to-end (2026-07-04, `trim-rpm-2bc2daf`): container artifact image +1.8 GiB → 755 MiB (~58%, >1 GB off every host's per-boot NVMe/TCP read).** + **Combined:** ~**800 MB** off the uncompressed erofs (langpacks + firmware), dwarfing the kiosk weak-deps trim (#4), plus a smaller UKI/initramfs from the DRM-driver omit. NEXT candidates from the manifest (measure, don't guess): `iso-codes` (19 MB),