busybox: build config from a fragment instead of a frozen .config

We've been carrying a full, 1200+ line busybox .config for the NVIDIA
images.  That's a pain to review and to keep in sync with a busybox
bump, as basically every default that changes upstream ends up as noise
in our file.

Switch to shipping only the handful of options we actually care about in
a small fragment and let busybox's own Kconfig fill in the rest at build
time: start from allnoconfig, drop the baseline entries for whatever the
fragment overrides (Kconfig keeps the first value it reads), append the
fragment and run silentoldconfig.  This reproduces the exact same
.config we had frozen, module loading included, so there's no functional
change here.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>

tools/packaging/kata-deploy/local-build/Makefile

@@ -184,7 +184,7 @@ agent-tarball: copy-scripts-for-the-agent-build
 agent-ctl-tarball: copy-scripts-for-the-tools-build
 	${MAKE} $@-build
 
-BUSYBOX_CONF_FILE ?= busybox.nvidia.conf
+BUSYBOX_CONF_FILE ?= busybox.nvidia.fragment
 busybox-tarball:
 	${MAKE} BUSYBOX_CONF_FILE=${BUSYBOX_CONF_FILE} $@-build
 

tools/packaging/static-build/busybox/build-static-busybox.sh

@@ -73,13 +73,22 @@ build_busybox_from_source()
 
 	cd busybox-"${BUSYBOX_VERSION:?}"
 
-	cp "${BUSYBOX_CONF_DIR:?}/${BUSYBOX_CONF_FILE:?}" .config
-
-	# shellcheck disable=SC2154
-	sed -i "s|CONFIG_PREFIX=\"./_install\"|CONFIG_PREFIX=\"${DESTDIR}\"|g" .config
+	# Regenerate the config from a small fragment instead of shipping a full,
+	# frozen .config. Start from allnoconfig, drop every symbol the fragment
+	# overrides (Kconfig keeps the first value it reads, so the baseline entries
+	# have to go), append the fragment and let silentoldconfig resolve the rest.
+	local fragment="${BUSYBOX_CONF_DIR:?}/${BUSYBOX_CONF_FILE:?}"
+	make allnoconfig
+	local sym
+	while read -r sym; do
+		sed -i -E "/^(${sym}=|# ${sym} is not set)/d" .config
+	done < <(grep -oE 'CONFIG_[A-Z0-9_]+' "${fragment}" | sort -u)
+	cat "${fragment}" >> .config
+	make silentoldconfig
 
 	make -j "$(nproc)"
-	make install
+	# shellcheck disable=SC2154
+	make CONFIG_PREFIX="${DESTDIR}" install
 
 }
 

tools/packaging/static-build/busybox/busybox.nvidia.fragment

@@ -0,0 +1,23 @@
+# Copyright (c) 2026 NVIDIA Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+CONFIG_STATIC=y
+CONFIG_SELINUX=y
+CONFIG_NTPD=y
+CONFIG_FEATURE_NTPD_CONF=y
+CONFIG_FEATURE_NTP_AUTH=y
+# CONFIG_SH_IS_ASH is not set
+# CONFIG_SH_IS_HUSH is not set
+CONFIG_SH_IS_NONE=y
+# CONFIG_BASH_IS_ASH is not set
+# CONFIG_BASH_IS_HUSH is not set
+CONFIG_BASH_IS_NONE=y
+# CONFIG_SHELL_ASH is not set
+CONFIG_MODPROBE=y
+CONFIG_FEATURE_MODPROBE_BLACKLIST=y
+CONFIG_FEATURE_CMDLINE_MODULE_OPTIONS=y
+CONFIG_FEATURE_MODUTILS_ALIAS=y
+CONFIG_FEATURE_MODUTILS_SYMBOLS=y
+CONFIG_DEFAULT_MODULES_DIR="/lib/modules"
+CONFIG_DEFAULT_DEPMOD_FILE="modules.dep"