From 1fd554a6cc8ff77c171522719d754c1406bdda30 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Sun, 14 Jun 2026 23:33:41 +0200 Subject: [PATCH] fixup! agent: resolve and launch CoCo guest components via addon manifest --- src/agent/src/main.rs | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/src/agent/src/main.rs b/src/agent/src/main.rs index fd009ee564..59572b441d 100644 --- a/src/agent/src/main.rs +++ b/src/agent/src/main.rs @@ -523,9 +523,18 @@ fn build_substitution_ctx( "addon_root".to_string(), addon_root.to_string_lossy().into_owned(), ); - // kata-agent always runs the stock attestation-agent; NVRC selects the - // nvidia variant by injecting a different value here. - ctx.insert("attester_variant".to_string(), "default".to_string()); + // The CoCo addon ships several attestation-agent flavours and selects one + // via the manifest's "attester_variant". The guest init (NVRC) owns that + // decision: with a GPU present it sets KATA_ATTESTER_VARIANT=nvidia so the + // NVIDIA-attester build launches (it emits the GPU evidence a KBS GPU + // policy requires). Absent that signal we fall back to the stock attester. + // Cross-component contract: the env var name and "nvidia" value are set by + // NVRC (src/kata_agent.rs, src/gpu.rs); keep them in sync. + let attester_variant = env::var("KATA_ATTESTER_VARIANT") + .ok() + .filter(|v| !v.is_empty()) + .unwrap_or_else(|| "default".to_string()); + ctx.insert("attester_variant".to_string(), attester_variant); Ok(ctx) }