Merge remote-tracking branch 'origin/main' into fapolicyd-tmpfs

docs/TODO.md

@@ -306,6 +306,19 @@ step 8 and §5). Retire/reset the errata afterward. Needs the design-doc source
 trim, ship via CI `enable_kiosk=true`) and the phone-home/NTP lockdown (done) —
 all captured in the sub-notes below. Secure-path render check is folded into #8.
 
+**Package-footprint trim (2026-07-03):** the kiosk dnf transaction was measured at
+**229 pkgs / 1.0 GB** (weak deps ON). Added `--setopt=install_weak_deps=False` to
+the install in `diskless.pkr.hcl` — drops the flatpak/ostree sandbox runtime,
+tracker-miners (fs indexer = dead weight + threat surface), the pipewire/pulseaudio
+audio stack, and `libproxy-webkitgtk4 → webkit2gtk3-jsc` (an 8.9M *second* browser
+engine). Also added an `rpm -qa --qf %%{SIZE}` size-manifest diagnostic to the build
+log to quantify the result. The immovable floor is chromium + chromium-common +
+llvm-libs (mesa sw-GL) + gtk3/adwaita + libicu — all HARD deps. **BENCH-VERIFY:**
+with weak deps off, confirm the kiosk still renders (no genuine runtime dep was a
+weak dep — watch for a missing font or `libva`). NEXT trim candidates (measure via
+the new manifest): gstreamer/media codecs if the SPA plays no HTML5 media;
+mesa-dri-drivers + `--use-pixman`-only if the GPU path is abandoned.
+
 
 **WORKING / display-verified 2026-06-17** (kiosk renders Chromium fullscreen on
 the configured URL). Build-flagged OFF by default for now (`enable_kiosk=false`)
@@ -675,6 +688,37 @@ must be built around **never restarting the process that holds live connections.
     the current UKI), so auto-reap is safe; removal is still drain-gated +
     grace-debounced. The loader + target share the RPC socket on a named volume
     (`nvmf_tgt -r`); the loader reuses the SPDK image (has python3 + rpc.py).
+  - **BENCH FINDING 2026-07-03 (FIXED) — hosts did `connect-all`, so NO version
+    ever drained → auto-reap could never fire.** Observed: `spdk-release list`
+    showed more controllers than workstations, with every box appearing on *every*
+    served version's subsystem (e.g. 1/3/3/1/3 across 5 versions for ~3 boxes).
+    Root cause: the initramfs connected with **`nvme connect-all`** (test path
+    `nvmf-connect.sh`; secure path delegated to the dracut nvmf module's discovery
+    autoconnect), which attaches EVERY subsystem in the discovery log — the host
+    then mounts only its own by-UUID verity namespaces but leaves a live controller
+    on all the others. So each running host pinned every version above 0 conns, and
+    `spdk-loader`'s "auto-reap once drained (0 conns)" **could never trigger** while
+    the fleet was up — the served-version list grew without bound. This defeats the
+    whole drain/reap model, not just cosmetics. **Fix:** targeted connect. The
+    per-version subsystem NQN (`SUBNQN`, already in `verity.json .subnqn`) is now
+    also baked into the signed UKI cmdline as **`rd.nvmf.nqn=`** (`extract-artifacts.sh`),
+    and both connect paths use **`nvme connect -n <nqn>`** — `nvmf-connect.sh` (test)
+    and a new explicit step 6 in `dot1x-macsec-up.sh` (secure, replacing the module
+    delegation; runs after macsec0 is addressed per invariant #2). Legacy UKIs
+    without `rd.nvmf.nqn` fall back to `connect-all` (with a warning) so they still
+    boot. Now each host = 1 controller on its own subsystem → versions drain to 0
+    when their hosts move off → auto-reap works; connections scale O(hosts) not
+    O(hosts × versions). Requires a rebuild + re-sign (cmdline change, invariant #6).
+    **(a) TEST PATH BENCH-VERIFIED 2026-07-03 (commit `0bfe872`): builds, deploys, and
+    the host mounts ONLY ONE image** (its own version's subsystem) instead of connect-
+    all'ing every served version — the targeted `nvme connect -n rd.nvmf.nqn` works.
+    So each host now = 1 controller on its own subsystem, which is what lets old
+    versions drain to 0 and `spdk-loader` auto-reap. **Still to confirm:** the reap
+    payoff itself (migrate a host, watch its old version drain to 0 and get reaped);
+    (b) SECURE PATH — the new step-6 connect brings up the NVMe root over macsec0
+    (this path is not yet bench-confirmed end-to-end); (c) that the dracut nvmf module
+    isn't ALSO connect-all-ing on the secure path (if it is, suppress it — the targeted
+    connect is meant to be the sole connector).
   - **BENCH FINDING 2026-07-03 (FIXED) — the target WAS still recreated on an
     `IMAGE_VERSION` bump.** Despite the above, the `nvmeof` (spdk-target) service
     still carried a versioned `type: image` bootstrap mount
@@ -1456,3 +1500,73 @@ connection to `:4420` established in the initramfs BEFORE firewalld starts. Veri
 default → should, but UNVERIFIED); a reconnect within `ctrl_loss_tmo` re-establishes
 *through* the firewall; DHCP renew + MKA keepalives unaffected; SSH in; no AVCs; verity
 hash reproducible. If it drops the root, that is the fleet-wide outage risk — gate hard.
+
+## [~] 18. Slim the image — locale + firmware (biggest erofs-size wins)
+
+**Finding (image-size audit via the 2b `rpm -qa --qf '%{SIZE}'` manifest, 2026-07-03):**
+the largest packages in the 534-package image are NOT the kiosk — they're base bloat:
+`linux-firmware` **678 MB**, `glibc-all-langpacks` **228 MB**, then chromium (370) +
+llvm-libs (129). The uncompressed erofs is read over NVMe/TCP on every boot of every
+host, so every dead byte is fleet-wide waste + attack surface.
+
+**[x] DONE — glibc langpacks → en-only** (`diskless.pkr.hcl` step 2). `@^minimal-environment`
+pulls `glibc-all-langpacks` (all languages); swapped for `glibc-minimal-langpack` +
+`glibc-langpack-en`. ~220 MB reclaimed; image is English-only (we also strip
+`/usr/share/locale` in 2d). **BENCH-VERIFY:** locale still `en_US.UTF-8`; kiosk + login OK.
+
+**[x] DONE — linux-firmware strip to a hardware-audited keep-list** (`diskless.pkr.hcl`
+step 2, run **BEFORE the dracut build** so the UKI initramfs shrinks too — not just the
+rootfs. `--no-hostonly` + plymouth's `drm` dep instmods a broad DRM set and dracut bundles
+each module's firmware into the initramfs, amdgpu being the classic UKI bloater; the strip
+runs first so dracut never sees it. A post-build diagnostic reports the `.img` size + any
+firmware still bundled — expected i915 only.)
+Live fleet audit (`modinfo -F firmware` over all loaded modules + sysfs/`lspci` driver
+bindings on the real 820-class hosts AND the VMs) proved the **only** loadable firmware
+any host requests is Intel **i915** (GPU). Every other driver is firmware-free —
+crucially **e1000e** (on-chip NVM, not a fw file) and **virtio_net**, so NO NIC needs
+firmware and the fleet-brick case is off the table. Keep-list: `i915` + `intel/` (ice
+DDP insurance for the `ice`/`mlx5` server-NIC build variant + small Intel blobs) +
+`mellanox` + `intel-ucode`; strip the rest (amdgpu/nvidia/radeon/ath/qcom/rtl/iwlwifi…
+~600 MB). Wi-Fi (`iwl*-firmware`, ~83 MB) removed as packages (wired-only fleet).
+Strip-in-place (`find … -exec rm -rf`, not `rpm -e` — can't drop the package without
+losing i915); a `du -sh /usr/lib/firmware` line reports the result in the build log.
+**BENCH-VERIFIED 2026-07-03 (commit `f59eb79`): built, booted, AND the kiosk SPA RENDERS
+on both the VM (virtio-gpu) and the 820 (i915).** This clears the firmware strip's one
+real risk — the i915 DMC/GuC blobs load on real hardware, so the keep-list
+(i915/intel/mellanox/intel-ucode, pre-dracut) is validated end-to-end (firmware 678→147 MB,
+initramfs bundles only the keep-list). Remaining caveat: if a future host has a non-Intel
+GPU or an `ice`/`mlx5` NIC, widen the keep-list before trusting fleet-wide. **NOT yet in
+`f59eb79`** (bench-verify separately — none touch i915, so render should be safe): the
+`nss-mdns`/avahi drop (`5cc72cc`) and the `omit_drivers` GPU-kmod trim + keep-list
+tightening — dropped `mellanox/`, narrowed `intel/` to `ice` only (`853ae20`). Audited
+models: HP-820-class (i915 + e1000e + iwlwifi-dropped) and virtio VMs.
+
+**Build-verified 2026-07-03:** firmware **678 MB → 147 MB**; the initramfs diagnostic
+confirms only the keep-list is bundled (i915 all-gens + intel/ice + intel/ish + mellanox)
+— proving the pre-dracut ordering works. But the initramfs came out **97 MB**, and it's
+now **kernel-MODULE-bound, not firmware** (~10 MB fw): the `--no-hostonly` + plymouth
+`drm` set pulls every GPU driver (`amdgpu.ko` etc.) even though the fleet is i915-only.
+
+**[x] DONE — follow-on trims (2026-07-03):**
+- **`omit_drivers+=" amdgpu radeon nouveau "`** in `90-diskless.conf` — drops the
+  discrete-GPU kmods plymouth's `drm` dep would instmod (amdgpu.ko is the biggest single
+  module); keeps i915 + virtio-gpu/bochs for the splash. Targets the 97 MB initramfs/UKI.
+- **Firmware keep-list tightened**: dropped `mellanox/` (those are `mlxsw_spectrum`
+  SWITCH-ASIC blobs, NOT NIC fw — mlx5 NIC fw is on-card) and narrowed `intel/` to just
+  `ice` (dropped ish/sof/ibt = sensor-hub/audio/bluetooth, none loaded at boot).
+- **Initramfs top-25-files diagnostic** added after the dracut build (sorts `lsinitrd.txt`
+  by size) so the next build shows what dominates the `.img` — measure before the next cut.
+- **BENCH-VERIFY:** kiosk still renders on the 820 (i915 kept); check the new
+  "initramfs largest files" log line for the post-omit size + next targets.
+
+**Combined:** ~**800 MB** off the uncompressed erofs (langpacks + firmware), dwarfing the
+kiosk weak-deps trim (#4), plus a smaller UKI/initramfs from the DRM-driver omit. NEXT
+candidates from the manifest (measure, don't guess): `iso-codes` (19 MB),
+`samba-client-libs`/`intel-mediasdk`/`gstreamer` (chromium-common HARD deps — only
+removable by dropping HTML5 media, and samba/rabbitmq/rist/srt/zmq are libavformat
+DT_NEEDED so they can't go without breaking future media — confirmed via ldd 2026-07-03),
+`binutils` (25 MB, build-only?), `cracklib-dicts` (9.8 MB, needed for pam pwquality — keep).
+
+**Stack note:** committed on `trim-rpm`. When `optimise-ram` rebases onto the new
+`trim-rpm`, expect a trivial `docs/TODO.md` tail conflict (both branches appended after
+#16 — `optimise-ram` added #17 fapolicyd, this added #18); resolve by keeping both.