fix(os): prune non-runtime production payload

Author: kvinwang

os/mkosi/build.sh

@@ -67,6 +67,9 @@ EOF
   mkosi --directory "$SELF" --force --extra-tree="$stage" "${devargs[@]}" \
     --format=directory --output-directory="$work" --output=rootfs \
     --compress-output=no --bootable=no build
+  if [[ $flavor == prod ]]; then
+    "$SELF/scripts/prune-rootfs.sh" "$tree"
+  fi
   # ldconfig's binary auxiliary cache records traversal-dependent ordering.
   # /var is volatile at runtime, so ship no host-generated cache.
   rm -f "$tree/var/cache/ldconfig/aux-cache"

os/mkosi/mkosi.conf

@@ -50,7 +50,6 @@ Packages=
         parted
         busybox-static
         cryptsetup-bin
-        ovmf
         systemd-boot-efi
         acpid
         numactl

os/mkosi/scripts/prune-rootfs.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+# SPDX-License-Identifier: Apache-2.0
+set -euo pipefail
+
+ROOTFS=$(realpath -m "${1:?rootfs tree required}")
+
+# Match Yocto's production packaging policy: development inputs, translated
+# messages and package-manager metadata are not part of the immutable guest.
+# /var/cache and /var/lib are hidden by volatile bind mounts at runtime.
+for path in \
+  usr/include \
+  usr/share/OVMF \
+  usr/share/ovmf \
+  usr/share/doc \
+  usr/share/info \
+  usr/share/locale \
+  usr/share/man \
+  var/cache/debconf \
+  var/lib/dpkg \
+  var/lib/ucf; do
+  rm -rf "${ROOTFS:?}/$path"
+done
+
+# Static archives and libtool metadata are build inputs. All production
+# consumers use the corresponding shared objects.
+find "$ROOTFS/usr" -type f \( -name '*.a' -o -name '*.la' \) -delete

os/mkosi/tests/acceptance.sh

@@ -25,6 +25,8 @@ grep -q 'build-ovmf.sh' "$D/scripts/build-components.sh"
 grep -q 'fbe0805b2091393406952e84724188f8c1941837' "$D/scripts/build-ovmf.sh"
 grep -q 'AmdSev/AmdSevX64.dsc' "$D/scripts/build-ovmf.sh"
 grep -q 'objcopy --strip-debug' "$D/build.sh"
+grep -q 'prune-rootfs.sh' "$D/build.sh"
+! grep -q '^[[:space:]]*ovmf$' "$D/mkosi.conf"
 grep -q '"firmware_sev":"files/ovmf-sev.fd"' "$D/scripts/make-release-artifacts.sh"
 grep -q 'measurement.snp.cbor' "$D/tests/check-output.sh"
 grep -q '0001-validate-ocsp-response-freshness.patch' "$D/scripts/build-nvattest.sh"