From 63ddcdaf395ffc059eebcbaed8cc5929aea610c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <ffidencio@nvidia.com>
Date: Thu, 9 Jul 2026 18:32:05 +0200
Subject: [PATCH] fixup! build: ship CoCo extension component manifest in
 extension image

---
 .../kata-deploy/local-build/kata-deploy-binaries.sh | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh
index 33a8046126..8f20e143e4 100755
--- a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh
+++ b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh
@@ -686,14 +686,11 @@ select        = "${attester_variant}"
   [process.variants.nvidia]
   path = "usr/local/bin/attestation-agent-nv"
   # attestation-agent-nv links libnvat.so (bundled in this CoCo extension under
-  # usr/local/lib), which dlopens libnvidia-ml.so.1 at runtime to collect GPU
-  # attestation evidence. NVML ships in the GPU extension, mounted by NVRC at the
-  # well-known /run/kata-extensions/gpu with its driver libraries under usr/lib, so
-  # both dirs must be on the loader path. The nvidia variant only runs when the
-  # GPU extension is present, so referencing its mount path here is safe; without
-  # the GPU lib dir NVML init fails ("NVAT Error 500: NVML Initialization
-  # Failed") and the RCAR handshake never produces GPU evidence.
-  env  = { LD_LIBRARY_PATH = "${extension_root}/usr/local/lib:/run/kata-extensions/gpu/usr/lib" }
+  # usr/local/lib), which dlopens libnvidia-ml.so.1 for GPU attestation evidence.
+  # Only NVAT's own libs need LD_LIBRARY_PATH: NVML lives in the GPU extension,
+  # which NVRC folds into the guest loader cache before starting kata-agent, so it
+  # resolves without a path here (see NVRC gpu::setup).
+  env  = { LD_LIBRARY_PATH = "${extension_root}/usr/local/lib" }
 
 [[process]]
 id           = "confidential-data-hub"