sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

kiosk: disable weak deps + add package-footprint audit

Browse Source 
The kiosk dnf transaction was measured at 229 pkgs / 1.0 GB. Nearly all
of the non-core packages are Recommends: a locked-down single-URL kiosk
never uses flatpak + its ostree/bubblewrap sandbox runtime, tracker-miners
(a filesystem indexer — dead weight and a threat surface), the pipewire/
pulseaudio audio stack, or libproxy-webkitgtk4 -> webkit2gtk3-jsc (an 8.9M
second browser engine dragged into a Chromium kiosk for libproxy's PAC
runner).

Add --setopt=install_weak_deps=False to cut them, and an rpm -qa size
manifest to the build log so the next CI build reports the exact new
footprint (turning 'seems unnecessary' into data for the next trim round:
gstreamer/media codecs, or mesa-dri-drivers if the GPU path is abandoned).

The immovable floor is chromium + chromium-common + llvm-libs (mesa sw-GL)
+ gtk3/adwaita + libicu, all hard deps. BENCH-VERIFY the kiosk still
renders with weak deps off (watch for a missing font or libva).
This commit is contained in:
Audiobuzz
2026-07-03 03:27:58 +00:00
parent d9d2b50bfb
commit c0a08438b2
2 changed files with 34 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/TODO.md
+13
View File
@@ -306,6 +306,19 @@ step 8 and §5). Retire/reset the errata afterward. Needs the design-doc source
trim, ship via CI `enable_kiosk=true`) and the phone-home/NTP lockdown (done) —
all captured in the sub-notes below. Secure-path render check is folded into #8.
**Package-footprint trim (2026-07-03):** the kiosk dnf transaction was measured at
**229 pkgs / 1.0 GB** (weak deps ON). Added `--setopt=install_weak_deps=False` to
the install in `diskless.pkr.hcl` — drops the flatpak/ostree sandbox runtime,
tracker-miners (fs indexer = dead weight + threat surface), the pipewire/pulseaudio
audio stack, and `libproxy-webkitgtk4 → webkit2gtk3-jsc` (an 8.9M *second* browser
engine). Also added an `rpm -qa --qf %%{SIZE}` size-manifest diagnostic to the build
log to quantify the result. The immovable floor is chromium + chromium-common +
llvm-libs (mesa sw-GL) + gtk3/adwaita + libicu — all HARD deps. **BENCH-VERIFY:**
with weak deps off, confirm the kiosk still renders (no genuine runtime dep was a
weak dep — watch for a missing font or `libva`). NEXT trim candidates (measure via
the new manifest): gstreamer/media codecs if the SPA plays no HTML5 media;
mesa-dri-drivers + `--use-pixman`-only if the GPU path is abandoned.
**WORKING / display-verified 2026-06-17** (kiosk renders Chromium fullscreen on
the configured URL). Build-flagged OFF by default for now (`enable_kiosk=false`)