fix(os): strip production kernel module debug data

Author: kvinwang

os/mkosi/build.sh

@@ -27,6 +27,12 @@ build_one() {
   rm -rf "$work" "$out"; mkdir -p "$stage" "$kstage" "$out"
   "$SELF/scripts/build-components.sh" "${component_cache_args[@]}" \
     "$work" "$stage" "$kstage" "$flavor"
+  if [[ $flavor == prod ]]; then
+    # Yocto splits module DWARF into debug packages which are not shipped in
+    # the production image. Keep BTF and loadable ELF metadata, but do not put
+    # hundreds of MiB of host-side DWARF into the immutable guest root.
+    find "$kstage/usr/lib/modules" -type f -name '*.ko' -exec objcopy --strip-debug {} +
+  fi
   # ExtraTrees is copied over Debian's usr-merged root where /bin, /sbin and
   # /lib are symlinks. Normalize build systems (notably OpenZFS) that install
   # into the legacy physical directories before handing the tree to mkosi.

os/mkosi/tests/acceptance.sh

@@ -24,6 +24,7 @@ grep -q 'image/assemble.sh' "$D/build.sh"
 grep -q 'build-ovmf.sh' "$D/scripts/build-components.sh"
 grep -q 'fbe0805b2091393406952e84724188f8c1941837' "$D/scripts/build-ovmf.sh"
 grep -q 'AmdSev/AmdSevX64.dsc' "$D/scripts/build-ovmf.sh"
+grep -q 'objcopy --strip-debug' "$D/build.sh"
 grep -q '"firmware_sev":"files/ovmf-sev.fd"' "$D/scripts/make-release-artifacts.sh"
 grep -q 'measurement.snp.cbor' "$D/tests/check-output.sh"
 grep -q '0001-validate-ocsp-response-freshness.patch' "$D/scripts/build-nvattest.sh"