# The JavaScript image's subset (RFC 021 §8.1 R2; E75's research/e75-node-package/drop.txt), applied by
# guest/base/rootfs/mkroot.sh MODE=javascript. Alpine's `nodejs` is the node binary alone (no npm, no corepack, no
# headers: the separate `npm` and `nodejs-dev` packages are never installed); what can go is in its closure, and
# every library node links is NEEDED (E75 needed.txt), so the subset is small: 0.46 MB of 69.9.
# "pkg NAME"   — the whole package payload is not installed (`guest lock-apk --image javascript` leaves it out of
#                apk.lock unless a "keep" line needs a file of it).
# "path GLOB"  — removed from the installed tree (relative to /).
# "keep GLOB"  — re-added from the package payload after the pkg lines (none here).
#
# No network in the guest (D10): the CA store is never read. node links libssl/libcrypto itself (NEEDED), so those
# two libraries stay; their configuration, engines and providers go.
pkg ca-certificates
pkg ca-certificates-bundle
# ca-certificates' own dependencies in Alpine's closure: /bin/sh and the rest of busybox are the root set's
# (busybox-static; a dynamic busybox would replace it), ssl_client is busybox wget's TLS helper (no network).
pkg busybox
pkg busybox-binsh
pkg ssl_client
path etc/ssl
path usr/lib/engines-3
path usr/lib/ossl-modules
path usr/bin/c_rehash
path usr/bin/update-ca-certificates
path etc/ca-certificates*
path usr/share/ca-certificates
# ICU: node needs libicuuc + libicui18n (+ libicudata, English only: icu-data-en, R3); libicuio and the ICU tools are
# not NEEDED.
path usr/lib/libicuio.so*
path usr/lib/libicutest.so*
path usr/lib/libicutu.so*