sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs/TODO #18: record nss-mdns/chromium regression + fix; kiosk re-verified, image 1.8 GiB → 755 MiB

Browse Source 
The '#18 render should be safe' call on the nss-mdns drop (5cc72cc) was wrong: it
bricked the kiosk on trim-rpm-48dc3e1 (chromium hard-Requires nss-mdns, so the 2d
remove cascaded chromium + its GUI stack out → 500 MB browserless image, flashing
cursor). Fixed in 2bc2daf (keep nss-mdns, mask avahi daemon; final build guard
asserts the kiosk stack survived). Re-verified booting into the kiosk on the 820;
container image measured 1.8 GiB → 755 MiB (~58%).
This commit is contained in:
Audiobuzz
2026-07-04 02:24:57 +00:00
parent 2bc2dafb1c
commit 68dee79832
1 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/TODO.md
+22
View File
@@ -1559,6 +1559,28 @@ now **kernel-MODULE-bound, not firmware** (~10 MB fw): the `--no-hostonly` + ply
- **BENCH-VERIFY:** kiosk still renders on the 820 (i915 kept); check the new
"initramfs largest files" log line for the post-omit size + next targets.
**[x] FIXED — the `nss-mdns` drop bricked the kiosk (regression found+fixed 2026-07-04):**
the "render should be safe" call above (5cc72cc) was WRONG — it broke the kiosk, just
not via i915. `trim-rpm-48dc3e1` booted to a **flashing cursor, no kiosk**, and the image
was a suspicious **500 MB**. Root cause: the 2d `dnf remove -y nss-mdns` removed
**chromium** as a *dependent package* — the EPEL `chromium` **hard-Requires `nss-mdns`**
(Chromium uses `.local` mDNS hostnames for WebRTC ICE candidates) — then reaped chromium's
orphaned GUI stack (avahi, at-spi2, atk, adwaita, chromium-common; ~49 pkgs, 523→472).
With no browser, `kiosk-session` died at the `${BROWSER:?}` guard in 4 ms, before weston.
The original commit checked what `nss-mdns` NEEDS (avahi) but not what NEEDS it (chromium).
GPU/i915/firmware/plymouth were all healthy — a red herring. Fix (`2bc2daf`):
- **Keep `nss-mdns` + avahi** (satisfy chromium's Requires); **mask the avahi daemon +
socket** instead — nss-mdns is only an NSS module, needs no listener, and :5353 was the
real attack-surface concern. ~1.5 MB kept.
- **FINAL GUARD in 2d**: `rpm -q chromium chromium-common weston mesa-{dri-drivers,libEGL,libgbm}`
asserts the kiosk stack survived the whole pipeline, else **fail the build**. A missing
browser must brick the BUILD, never the fleet — catches any future remove-cascade /
oscap `package_*_removed` / autoremove. Look for `==> guard: kiosk stack intact` in CI.
**RE-VERIFIED 2026-07-04 (`trim-rpm-2bc2daf`): boots into the kiosk on the 820; image 755 MiB.**
**Measured end-to-end (2026-07-04, `trim-rpm-2bc2daf`): container artifact image
1.8 GiB → 755 MiB (~58%, >1 GB off every host's per-boot NVMe/TCP read).**
**Combined:** ~**800 MB** off the uncompressed erofs (langpacks + firmware), dwarfing the
kiosk weak-deps trim (#4), plus a smaller UKI/initramfs from the DRM-driver omit. NEXT
candidates from the manifest (measure, don't guess): `iso-codes` (19 MB),