From 19a681dcca2883ff7e6e908a2e34c2a3ebea9d02 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <ffidencio@nvidia.com>
Date: Mon, 15 Jun 2026 15:16:36 +0200
Subject: [PATCH] fixup! agent: resolve and launch CoCo guest components via
 addon manifest

---
 src/agent/src/addon.rs | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/src/agent/src/addon.rs b/src/agent/src/addon.rs
index ad67ef9e48..a7293fc57f 100644
--- a/src/agent/src/addon.rs
+++ b/src/agent/src/addon.rs
@@ -517,7 +517,7 @@ id           = "confidential-data-hub"
 level        = 2
 path         = "usr/local/bin/confidential-data-hub"
 config       = "${cdh_config_path}"
-env          = { OCICRYPT_KEYPROVIDER_CONFIG = "${ocicrypt_config_path}" }
+env          = { OCICRYPT_KEYPROVIDER_CONFIG = "${ocicrypt_config_path}", PATH = "${addon_root}/usr/sbin:/bin:/sbin:/usr/bin:/usr/sbin" }
 wait_socket  = "${cdh_socket}"
 timeout_secs = "${launch_process_timeout}"
 
@@ -638,12 +638,21 @@ schema_version = 1
 
         let cdh = &specs[1];
         assert_eq!(cdh.id, "confidential-data-hub");
+        // env is sorted by key, so OCICRYPT_KEYPROVIDER_CONFIG precedes PATH.
+        // PATH puts the addon's cryptsetup (usr/sbin) ahead of the base dirs
+        // that carry mke2fs/mkfs.ext4/dd, which CDH's secure_mount shells out to.
         assert_eq!(
             cdh.env,
-            vec![(
-                "OCICRYPT_KEYPROVIDER_CONFIG".to_string(),
-                "/run/kata-addons/coco/etc/ocicrypt_config.json".to_string()
-            )]
+            vec![
+                (
+                    "OCICRYPT_KEYPROVIDER_CONFIG".to_string(),
+                    "/run/kata-addons/coco/etc/ocicrypt_config.json".to_string()
+                ),
+                (
+                    "PATH".to_string(),
+                    "/run/kata-addons/coco/usr/sbin:/bin:/sbin:/usr/bin:/usr/sbin".to_string()
+                )
+            ]
         );
 
         let api = &specs[2];