Headless firmware rootfs and DHCP renewal through dhcpcd

app/src/api/handlers/network.rs

@@ -87,19 +87,26 @@ pub async fn set_network_settings(params: NetworkSettingsParams) -> Result<Value
     Ok(Value::Null)
 }
 
+/// Set by the dhcpcd init script (S41dhcpcd) while the daemon runs.
+const DHCPCD_PIDFILE: &str = "/var/run/dhcpcd/pid";
+
 pub async fn renew_dhcp_lease() -> Result<Value> {
     info!("DHCP lease renewal requested");
     let if_name = crate::network::NET_IF_NAME;
-    let status = tokio::process::Command::new("/sbin/udhcpc")
-        .args(["-i", if_name, "-q", "-n", "-t", "3"])
-        .status()
-        .await;
+    // Ask the running dhcpcd to rebind rather than starting a second client
+    // on the same NIC; older images without dhcpcd still use one-shot udhcpc.
+    let (client, args): (&str, Vec<&str>) = if std::path::Path::new(DHCPCD_PIDFILE).exists() {
+        ("dhcpcd", vec!["-n", if_name])
+    } else {
+        ("/sbin/udhcpc", vec!["-i", if_name, "-q", "-n", "-t", "3"])
+    };
+    let status = tokio::process::Command::new(client).args(&args).status().await;
     match status {
         Ok(s) if s.success() => Ok(Value::Null),
-        Ok(s) => Err(anyhow::anyhow!("udhcpc exited with status {}", s)),
+        Ok(s) => Err(anyhow::anyhow!("{client} exited with status {s}")),
         Err(e) => {
-            tracing::warn!("DHCP renewal via udhcpc failed: {e}");
-            Err(anyhow::anyhow!("udhcpc not available: {e}"))
+            tracing::warn!("DHCP renewal via {client} failed: {e}");
+            Err(anyhow::anyhow!("{client} not available: {e}"))
         }
     }
 }

deny.toml

@@ -35,6 +35,14 @@ ignore = [
     # rustls-webpki 0.102 — panic in CRL parsing. "Applications that do not use CRLs
     # are not affected." rumqttc never parses CRLs.
     { id = "RUSTSEC-2026-0104", reason = "rumqttc does not parse CRLs; not affected" },
+    # rustls-webpki 0.102 — distrusted emSign intermediates. Fixed only in 0.103.16+
+    # (which the web server uses); rumqttc 0.25.1 is the latest release and pins 0.102.
+    # MQTT is off by default and talks only to the broker the operator configures.
+    { id = "RUSTSEC-2026-0382", reason = "rumqttc-only 0.102 copy; no fixed release; MQTT opt-in" },
+    # crypto-bigint 0.5 — timing leaks in constant-time ops; fixed only in 0.7.6.
+    # Pulled in by webrtc 0.17.2 (latest) via dtls → p256/p384 → elliptic-curve 0.13,
+    # which cannot take 0.7. Exposure is the per-session ephemeral DTLS key exchange.
+    { id = "RUSTSEC-2026-0387", reason = "webrtc-rs dtls via elliptic-curve 0.13; no compatible fix" },
 ]
 
 [licenses]

os/rk3588/README.md

@@ -21,12 +21,11 @@ empty and is mounted over the rootfs directory; `S99rustkvm` copies it to
 | Project | Change |
 | --- | --- |
 | `buildroot` | dhcpcd privsep seccomp allows `dup3` (SIGSYS at boot); chrony drift file ownership |
-| `buildroot` | RustKVM defconfig (GStreamer Opus, RGA, uvc-gadget, dropbear client, update engine); uvc-gadget builds with `-Dwerror=false` and accepts CONTINUOUS frame intervals |
-| `buildroot` | rkupdate's license points at its real `LICENSE` file, so `make legal-info` completes |
 | `kernel` | `nanopi6_linux_defconfig`: NBD built in (virtual media), USB UAC2 gadget |
 | `scripts/sd-fuse` | builds the `v4l2loopback` module (operator-camera passthrough) |
-| `external` | rockit links `librkAlgoDis.so` |
 | `device/friendlyelec` | installs `rustkvm-files` (this overlay) and disables the stock dropbear service |
+| `buildroot` | Headless defconfig: only what `rustkvm_app` and the boot scripts use (MPP/RGA, the GStreamer plugins the app loads, ALSA, chrony, dhcpcd, dropbear). No Weston, Chromium, Mali, NPU, ISP, PulseAudio, Bluetooth, OTA engine, uvc-gadget, benchmarks or fonts. `gst.sh` turns on RGA in videoconvert |
+| `device/friendlyelec` | `rustkvm-slim` runs last and deletes what the SDK installs unconditionally (prebuilt tools in `/usr/local/bin`, fonts, demo media, PulseAudio and usbdevice leftovers); drops the PulseAudio and usbdevice overlays |
 
 ## Changing the SDK