crates/nornir-build-thing/src/kconfig/deps-tinyconfig.config
# nordisk TINYCONFIG DEPENDENCY CLOSURE — merged FIRST, before the boot contract,
# for every preset that starts at `tinyconfig` (slim, nuked).
#
# `tinyconfig` starts at (almost) nothing, so the measured boot contract in
# base.config names options whose PARENTS are off — `olddefconfig` then silently
# drops them, and the canary refuses the build by name. This file turns each of
# those refusals into the parent that enables it.
#
# EVERY line here was produced by a refusal, not by reading Kconfig: run the slim
# arm, read `KERNEL-CONFIG-REFUSED-TOTAL`, add the parent, run again. The list
# it closes (12 options, measured 2026-08-22 on linux 6.12.104):
# EFI_STUB · SERIAL_8250 · SERIAL_8250_CONSOLE · TUN · VIRTIO · VIRTIO_PCI
# VIRTIO_BLK · VIRTIO_NET · VFAT_FS · ISO9660_FS · NLS_CODEPAGE_437
# NLS_ISO8859_1
# ── the bus everything virtio hangs off ────────────────────────────────────
CONFIG_PCI=y
# ── EFI: the stub boots the kernel directly from OVMF, and on x86 EFI needs ACPI
CONFIG_ACPI=y
CONFIG_EFI=y
# ── a console at all: SERIAL_8250 lives under the TTY layer ─────────────────
CONFIG_TTY=y
CONFIG_SERIAL_EARLYCON=y
# ── a network stack at all: TUN and virtio-net are NETDEVICES ───────────────
CONFIG_NET=y
CONFIG_INET=y
CONFIG_NETDEVICES=y
CONFIG_NET_CORE=y
# ── block layer: virtio-blk and every filesystem below need it ──────────────
CONFIG_BLOCK=y
# ── virtio itself is behind a menu symbol ──────────────────────────────────
CONFIG_VIRTIO_MENU=y
# ── filesystems: vfat is FAT + NLS; iso9660 needs the block layer above ─────
CONFIG_FAT_FS=y
CONFIG_NLS=y
# ── userspace has to be able to run at all: tinyconfig leaves ELF off, and a
# kernel that cannot exec PID 1 is not a smaller kernel, it is a brick. The
# canary CANNOT catch this one (it only checks what the fragment names), which
# is exactly why the probe-boot step exists.
CONFIG_BINFMT_ELF=y
# `CONFIG_MULTIUSER=y` stood here too, as a closure parent nothing in the list
# above had ever asked for. It is gone (lane AE, 2026-08-30): the appliance has
# one user and that user is root, so `nuked.config` vetoes it by name and the
# appliance-boot contract carries the matching `=n` requirement. Read the
# argument there.
#
# `CONFIG_UNIX` stays, and it is the one line in this file that NO consumer
# owns — deliberately. No PID-1 code path is measured to open an AF_UNIX socket
# (pid1's netlink is AF_NETLINK, the DHCP client is AF_INET/UDP), so
# `kernel_requires::appliance_boot_requirements` refuses to claim it: a
# requirement is a measured need, never a habit. It is therefore the model's
# worked example of an honest `preset-only` row — a donor line no consumer can
# claim — and `--opt kernel.unix=off` is the door that tests whether it is
# needed at all.
CONFIG_UNIX=y