I keep archive extractors out of my offline templates on purpose — unzip and friends are exactly the kind of parser attack surface a vault qube should never carry. So I was surprised to find this in a template that never had it installed:
$ rpm -q unzip
unzip-6.0-69.fc44.x86_64
Traced it back to fedora-44-minimal itself. The chain:
perl-devel → redhat-rpm-config → zip → unzip
and that same chain is quietly holding a full build toolchain in “minimal”: gcc, gcc-c++, binutils, make, glibc-devel, kernel-headers, plus the entire Perl distribution (~270 modules, including perl-Archive-Zip and perl-Archive-Tar — more archive parsers).
The kicker — on a virgin minimal clone:
$ sudo dnf remove zip
…
Transaction Summary: Removing: 281 packages (326 MiB freed)
I’ve done it in a test clone: desktop stack fine, reboots fine, dnf update quiet. Only real casualty is file (rides out as an unused dep — I re-added it).
Three questions:
-
Is this intended? Does anything in the Qubes template build actually need rpm-build machinery and gcc at runtime, or is this a packaging accident inherited from Fedora?
-
Is dnf remove zip the sane fix, or is there a better way to trim it?
-
Anyone know what breaks? Nothing I run has missed it yet, but I’d like to hear the corner case before rebuilding my whole lineage on the trimmed trunk.
Check your own minimal-derived templates:
rpm -q zip unzip gcc perl redhat-rpm-config
(Qubes 4.3.1, qubes-template-fedora-44-minimal.)