Remove non-essential packages from debian-12-minimal template

[emanruse]

The problem you're addressing (if any)

debian-12-minimal template includes non-essential packages:

• nftables

Since minimal templates provide no network functionality to AppVMs, this is not necessary.

• 3 text editor packages: nano, vim-tiny, vim-common

For a minimal system, one should suffice.

• tasksel

Non-essential. The target users of minimal templates are supposedly experienced enough to use apt-get to install packages (or to install tasksel additionally, if required).

The solution you'd like

No non-essential packages or packages duplicating functionality in minimal templates.

The value to a user, and who that user might be

The same which minimal templates aim to provide.

[andrewdavidwong]

• 3 text editor packages: nano, vim-tiny, vim-common

For a minimal system, one should suffice.

Or even zero. Let users install their own preferred text editor, if they even want one. I have to manually uninstall nano when I configure a fresh Debian minimal template for myself, or else it defaults to Nano instead of Vim. Having to manually uninstall a package from a minimal template for a reason like that should never happen. That just means the template isn't minimal enough.

[h01ger]

I do think that having both vim-tiny and nano installed on a minimal template is a sensible default. I don't think that the minimal template should have no editor installed. I do agree that having tasksel installed is useless.

…

-- cheers, Holger ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ holger@(debian|reproducible-builds|layer-acht).org ⢿⡄⠘⠷⠚⠋⠀ OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C ⠈⠳⣄ "Any fool can know. The point is to understand." - A. Einstein

[unman]

On Tue, Feb 27, 2024 at 03:57:05AM -0800, Holger Levsen wrote: I do think that having both vim-tiny and nano installed on a minimal template is a sensible default. I don't think that the minimal template should have no editor installed. I do agree that having tasksel installed is useless.

I agree with the first two points - not tasksel. If one downloads only the minimal version of a new template, it can be useful to clone and tasksel. (I have never done this, but I know people who do.)

[h01ger]

Can't those (very?) few who use tasksel not apt install it?

…

-- cheers, Holger ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ holger@(debian|reproducible-builds|layer-acht).org ⢿⡄⠘⠷⠚⠋⠀ OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C ⠈⠳⣄ 40% of homeless people in the United States have full-time jobs.

[emanruse]

If one downloads only the minimal version of a new template, it can be useful to clone and tasksel.

According to the documentation minimal templates "have only the most vital packages installed". Assuming that is correct and the dictionary meaning of vital: https://www.merriam-webster.com/dictionary/vital doesn't that make tasksel non-vital? Its absence definitely doesn't influence the work of the system and it is not a dependency.

but I know people who do.

Doesn't that belong to the category of "Do not ask for your favorite package to be added to the minimal template by default"?

[marmarek]

FWIW tasksel is installed because it's used to select packages for non-minimal templates. I think it's an oversight to have it installed in the minimal template too.

…

-- Best Regards, Marek Marczykowski-Górecki Invisible Things Lab

[emanruse]

A few others perhaps worth considering: - cpio (nothing depends on it, as per 'apt-get autopurge cpio') - cron (same) - debconf-i18n (Recommended by debconf, i.e. not required) - eatmydata (not a dependency) - fdisk (not a dependency) - ifupdown (not a dependency, implies networking) - iproute2 (networking) - iputils-ping (implies networking) - isc-dhcp-client (same) - isc-dhcp-common (same) - kmod (not a dependency) - less (just like editors) - installed as Suggested by gzip - libbpf1 (not a dependency) - libcap2-bin (not a dependency) - libglib2.0-bin (not a dependency) - libglib2.0-data (not a dependency) - libjansson4 (removes also libnftables1 during autopurge) - libmnl0 (removes also libnftables1 libnftnl11 nftables during autopurge) - libnewt0.52 (removes whiptail) - libnftables1 (removes nftables) - libxtables12 - libnftnl11 (removes nftables) - logrotate (non-essential) - netbase (networking) [Strangely, autopurging nftables does not remove the above libraries which remove it] - libregexp-ipv6-perl (implies networking, part of perl, mentioned below) - libtext-charwidth-perl - mawk (not a dependency, duplicates gawk which is a reverse dependency) - tzdata (not a dependency) - perl (no qubes packages depend on it) - whiptail (Suggested by debconf) - haveged (only libhavege2 depends on it) - might need special attention Also, according to https://wiki.debian.org/ReduceDebian the following are non-essential - aptitude (removes 6 non-qubes packages) - ca-certificates - gnupg ('apt-get autopurge gnupg' removes 17 non-qubes packages) - openssl - tasksel (discussed) - vim-common (discussed) - vim-tiny (discussed) Also: https://wiki.debian.org/ReduceDebian#Remove_foreign_language_man_files I see de, es, fr, pl exist.

[emanruse]

Additional info about haveged: it seems obsolete. jirka-h/haveged#57 (comment)

[emanruse]

Testing all this, I found: - kmod is necessary for proper boot-time mounting procedures. - tzdata is necessary too. I don't know why but removing it results in a non-bootable system. All the others can be removed and the system boots normally. The result is: 'free -m' shows 249M used memory (compared to 355M without the extra minification). icon-sender is the second most memory-consuming process.

[emanruse]

ca-certificates and openssl seem necessary for package management. Other candidates for removal: cron-daemon-common gpgv perl-modules-5.36 Even xterm can be removed and the template can be managed through qvm-console-dispvm. I don't know why xen packages depend on X11 (and if that is possible to change) but if one runs a headless service VM (with no guivm) even further minimization would be useful.

[emanruse]

If netbase is removed and qubes-core-agent-networking is installed, AppVMs can't connect to the network, i.e. the former should be a dependency to the latter.

[unman]

I dont know what it is about Debian templates that single them out for this sort of issue. AFAIK this is a duplicate of other existing issues relating to Debian templates. I dont recall *ever* seeing the same suggestions re Fedora minimal templates. What does "vital" mean? Are eyes vital? No - why not take them out. Are two kidneys vital? No - whip one out. Are legs vital? No - remove them. Vital in this usage is completely dependent on having an answer to the question, "vital for what?" So we should at least consider the question what minimal templates are to be used for, and how they fit in the context of "honoring the distro", before hacking out packages. Debian has the concepts of minbase and base systems. Minbase is a variant in debootstrap - it installs only essential packages and apt. The base system, or core installation, consists of essential packages, and those tagged as required or important. Almost all the proposed packages form part of the base system. Some of them, like mawk, are essential. Tasksel isnt installed because Qubes CHOOSES it - its installed because it's part of the base Debian system. The same for nftables. These are standard packages in the core Debian install, which any user would expect to be present - we should not remove them without good reason. Of course, it could be that there IS a good reason for doing this, but it hasnt yet been explained. It could also be that Qubes decides to create micro templates that contain only packages that Qubes chooses - these would not "honor the distro", but would serve some function in Qubes. I use such micro templates myself, but I dont consider them useful for distribution. Given the support questions that MINIMAL templates throw up, despite the prominent health warning in the docs, providing such micro templates would just create yet more support issues. There should be a careful assessment of the benefits and costs before going down this path. If we do, then it should apply to all official templates.