fixup! build: ship CoCo extension component manifest in extension image

This commit is contained in:
Fabiano Fidêncio
2026-07-09 18:32:05 +02:00
parent cb297876d6
commit 63ddcdaf39

View File

@@ -686,14 +686,11 @@ select = "${attester_variant}"
[process.variants.nvidia]
path = "usr/local/bin/attestation-agent-nv"
# attestation-agent-nv links libnvat.so (bundled in this CoCo extension under
# usr/local/lib), which dlopens libnvidia-ml.so.1 at runtime to collect GPU
# attestation evidence. NVML ships in the GPU extension, mounted by NVRC at the
# well-known /run/kata-extensions/gpu with its driver libraries under usr/lib, so
# both dirs must be on the loader path. The nvidia variant only runs when the
# GPU extension is present, so referencing its mount path here is safe; without
# the GPU lib dir NVML init fails ("NVAT Error 500: NVML Initialization
# Failed") and the RCAR handshake never produces GPU evidence.
env = { LD_LIBRARY_PATH = "${extension_root}/usr/local/lib:/run/kata-extensions/gpu/usr/lib" }
# usr/local/lib), which dlopens libnvidia-ml.so.1 for GPU attestation evidence.
# Only NVAT's own libs need LD_LIBRARY_PATH: NVML lives in the GPU extension,
# which NVRC folds into the guest loader cache before starting kata-agent, so it
# resolves without a path here (see NVRC gpu::setup).
env = { LD_LIBRARY_PATH = "${extension_root}/usr/local/lib" }
[[process]]
id = "confidential-data-hub"