diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh index 33a8046126..8f20e143e4 100755 --- a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh +++ b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh @@ -686,14 +686,11 @@ select = "${attester_variant}" [process.variants.nvidia] path = "usr/local/bin/attestation-agent-nv" # attestation-agent-nv links libnvat.so (bundled in this CoCo extension under - # usr/local/lib), which dlopens libnvidia-ml.so.1 at runtime to collect GPU - # attestation evidence. NVML ships in the GPU extension, mounted by NVRC at the - # well-known /run/kata-extensions/gpu with its driver libraries under usr/lib, so - # both dirs must be on the loader path. The nvidia variant only runs when the - # GPU extension is present, so referencing its mount path here is safe; without - # the GPU lib dir NVML init fails ("NVAT Error 500: NVML Initialization - # Failed") and the RCAR handshake never produces GPU evidence. - env = { LD_LIBRARY_PATH = "${extension_root}/usr/local/lib:/run/kata-extensions/gpu/usr/lib" } + # usr/local/lib), which dlopens libnvidia-ml.so.1 for GPU attestation evidence. + # Only NVAT's own libs need LD_LIBRARY_PATH: NVML lives in the GPU extension, + # which NVRC folds into the guest loader cache before starting kata-agent, so it + # resolves without a path here (see NVRC gpu::setup). + env = { LD_LIBRARY_PATH = "${extension_root}/usr/local/lib" } [[process]] id = "confidential-data-hub"