From 06576248d2751b902a460dc8ede3c5eff09ad65a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Mon, 15 Jun 2026 07:57:54 +0200 Subject: [PATCH] fixup! packaging: add built-time support for NVAT --- .../build-static-coco-guest-components.sh | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/tools/packaging/static-build/coco-guest-components/build-static-coco-guest-components.sh b/tools/packaging/static-build/coco-guest-components/build-static-coco-guest-components.sh index 604e9ac5c9..7ad50efe3c 100755 --- a/tools/packaging/static-build/coco-guest-components/build-static-coco-guest-components.sh +++ b/tools/packaging/static-build/coco-guest-components/build-static-coco-guest-components.sh @@ -55,6 +55,18 @@ build_coco_guest_components_from_source() { mkdir -p "${DESTDIR}/usr/local/lib" cp -a /usr/local/lib/libnvat.so* "${DESTDIR}/usr/local/lib/" + + # attestation-agent-nv links libnvat.so, which in turn pulls in + # libxml2/zlib/lzma and the C++ runtime. None of those ship in the + # guest rootfs, so bundle every non-glibc dependency next to + # libnvat.so. The coco-addon manifest points the nvidia attester's + # LD_LIBRARY_PATH here, so the dynamic linker resolves them at runtime. + ldd /usr/local/lib/libnvat.so | awk '/=> \// { print $3 }' | while read -r dep; do + case "$(basename "${dep}")" in + libc.so.*|libm.so.*|libdl.so.*|libpthread.so.*|librt.so.*|ld-linux*|linux-vdso*) continue ;; + esac + install -D -m0755 "${dep}" "${DESTDIR}/usr/local/lib/$(basename "${dep}")" + done fi popd