1. Analyze and Adopt

Domain: Linux Systems Engineering / Gentoo Linux Distribution Specialist Expert Persona: Senior Gentoo Infrastructure Architect

2. Topic Reviewers

The ideal group to review this topic would be Gentoo Distribution Developers, Linux Security Hardening Specialists, and High-Performance Computing (HPC) Systems Administrators. These professionals prioritize minimal attack surfaces, deterministic build environments, and the elimination of extraneous software dependencies.

3. Summary and Abstract

Abstract: This documentation details the implementation of a "bare-minimal" Gentoo Linux configuration using the USE="-*" global variable in make.conf. By overriding the sane defaults provided by standard Gentoo profiles, users can explicitly control every enabled feature, effectively preventing unneeded dependencies from being pulled into the system during @world updates. While this approach can reduce total package counts by 6.5% to 13%, it requires a high degree of technical proficiency to manage manual USE flag resolution, USE_EXPAND variables, and hardware-specific configurations. The thread also addresses the controversial nature of this configuration in the community, specifically regarding the burden it places on forum volunteers when troubleshooting self-inflicted system breakages.

Tactical Advice for Reducing Bloat via USE="-*":

• Global Flag Negation: Implement USE="-*" as the first entry in make.conf to ignore all profile-default USE flags. This ensures that only explicitly defined flags are activated across the system.
• Motivation for Minimization: Transitioning to this model can remove 50–100 unneeded packages on a standard installation, significantly reducing the system's footprint and potential security vulnerabilities.
• Mandatory Variable Definitions: When using global negation, you must manually define USE_EXPAND variables in make.conf. Crucial variables include PYTHON_TARGETS, PYTHON_SINGLE_TARGET, CPU_FLAGS_X86, and LLVM_SLOT. Failure to set these results in numerous portage blockers.
• Granular Management via package.use: Shift the bulk of USE flag management from the global make.conf to /etc/portage/package.use. This forces the administrator to understand specific dependency requirements for each package.
• Hardware-Specific Drivers: Explicitly set VIDEO_CARDS and INPUT_DEVICES. Note that setting INPUT_DEVICES="" may disable necessary drivers like libinput unless handled via a static /dev or specific kernel configurations.
• Resolution of Blockers: Expect significant blockers during the initial @world update after enabling -*. Resolve these by incrementally adding required flags to package.use or removing the packages that demand the missing flags.
• Hardened Security Considerations: Be cautious not to disable flags essential for system hardening. Profile-forced flags like default-stack-clash-protection, default-znow, and pie should remain active to maintain a secure toolchain.
• Filesystem Capabilities: Retain the xattr flag for a hardened system, as it is functionally necessary for managing file capabilities (e.g., allowing ping to run without full root privileges).
• Optimization Trade-offs: Utilize specific flags like asm, jit, lto, and pgo to improve performance, but remain aware of tradeoffs such as doubled build times or increased memory consumption during compilation.
• Fresh Install Strategy: For maximum efficiency, set USE="-*" immediately after unpacking a Stage 3 tarball, rebuild the toolchain via bootstrap.sh, and run emerge -e @system to ensure the entire base system is built without bloat.
• Community Troubleshooting Etiquette: If seeking help on public forums, users must explicitly state they are using USE="-*". Failure to do so wastes volunteer time, as the configuration creates non-standard issues that appear as "bizarre" bugs to those on traditional profiles.