From 2c45c7a4d18ba33c85d575f6804a679eb986a944 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <ffidencio@nvidia.com>
Date: Mon, 20 Jul 2026 19:19:10 +0200
Subject: [PATCH 1/9] utils.mk: drop cross-compilation Rust linker selection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `HOST_ARCH != ARCH` branch in utils.mk existed solely to support
cross-compiling the Rust components (overriding the linker via `CC`).
Cross-compilation is not exercised on our side: all release/CI builds run
on native-arch runners, so this path is dead code. Remove it.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>
---
 utils.mk | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/utils.mk b/utils.mk
index 45744e9ed9..4e66822cd5 100644
--- a/utils.mk
+++ b/utils.mk
@@ -160,15 +160,6 @@ endif
 
 EXTRA_RUSTFLAGS :=
 
-ifneq ($(HOST_ARCH),$(ARCH))
-    ifeq ($(CC),)
-         CC = gcc
-         $(warning "WARNING: A foreign ARCH was passed, but no CC alternative. Using gcc.")
-    endif
-    override EXTRA_RUSTFLAGS += -C linker=$(CC)
-    undefine CC
-endif
-
 TRIPLE = $(ARCH)-unknown-linux-$(LIBC)
 
 CWD := $(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))

From 211393547d8919dc261d42a1d0c7d284c11da719 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <ffidencio@nvidia.com>
Date: Mon, 20 Jul 2026 19:24:13 +0200
Subject: [PATCH 2/9] kata-deploy: drop cross-build orchestration from
 local-build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The kata-deploy local-build pipeline auto-enabled a cross build whenever
the host arch differed from TARGET_ARCH, wiring up docker buildx, QEMU
binfmt emulation and an s390x cross toolchain (incl. building s390-tools
genprotimg with CROSS_COMPILE) in the builder image.

None of this is exercised on our side: every release/CI build runs on a
native-arch runner, so the cross paths are dead code. Remove the
CROSS_BUILD/TARGET_ARCH/BUILDX/PLATFORM/binfmt machinery and the s390x
cross toolchain from the builder image; the tarballs are always built for
the host arch now.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>
---
 .../kata-deploy/local-build/Makefile          |  8 +----
 .../local-build/dockerbuild/Dockerfile        | 30 +-----------------
 .../kata-deploy-binaries-in-docker.sh         | 31 -------------------
 .../local-build/kata-deploy-binaries.sh       |  3 --
 4 files changed, 2 insertions(+), 70 deletions(-)

diff --git a/tools/packaging/kata-deploy/local-build/Makefile b/tools/packaging/kata-deploy/local-build/Makefile
index 24f156cfc7..3680e16a7a 100644
--- a/tools/packaging/kata-deploy/local-build/Makefile
+++ b/tools/packaging/kata-deploy/local-build/Makefile
@@ -9,13 +9,7 @@ MK_DIR := $(dir $(MK_PATH))
 # Verbose build
 V := 1
 
-ifeq ($(CROSS_BUILD),)
-	CROSS_BUILD = false
-endif
-
-ifeq ($(CROSS_BUILD),false)
-	ARCH := $(shell uname -m)
-endif
+ARCH := $(shell uname -m)
 
 ifeq ($(ARCH), x86_64)
 BASE_TARBALLS = serial-targets \
diff --git a/tools/packaging/kata-deploy/local-build/dockerbuild/Dockerfile b/tools/packaging/kata-deploy/local-build/dockerbuild/Dockerfile
index 737fd8418d..68dbcae65f 100644
--- a/tools/packaging/kata-deploy/local-build/dockerbuild/Dockerfile
+++ b/tools/packaging/kata-deploy/local-build/dockerbuild/Dockerfile
@@ -7,7 +7,6 @@ ENV DEBIAN_FRONTEND=noninteractive
 ENV INSTALL_IN_GOPATH=false
 # Required for libxml2-dev
 ENV TZ=Etc/UTC
-ARG ARCH
 
 COPY install_yq.sh /usr/bin/install_yq.sh
 COPY install_oras.sh /usr/bin/install_oras.sh
@@ -40,13 +39,6 @@ RUN if [ ${IMG_USER} != "root" ] && [ ! -z ${HOST_DOCKER_GID} ] && [ ! $(getent
 RUN if [ ${IMG_USER} != "root" ] && [ ! -z ${HOST_DOCKER_GID} ]; then usermod -a -G ${HOST_DOCKER_GID} ${IMG_USER};fi
 RUN sh -c "echo '${IMG_USER} ALL=NOPASSWD: ALL' >> /etc/sudoers"
 
-RUN if [ "${ARCH}" != "$(uname -m)" ] && [ "${ARCH}" == "s390x" ]; then sed -i 's/^deb/deb [arch=amd64]/g' /etc/apt/sources.list && \
-    dpkg --add-architecture "s390x" && \
-    echo "deb [arch=s390x] http://ports.ubuntu.com/ jammy main multiverse universe" >> /etc/apt/sources.list && \
-    echo "deb [arch=s390x] http://ports.ubuntu.com/ jammy-security main multiverse universe" >> /etc/apt/sources.list && \
-    echo "deb [arch=s390x] http://ports.ubuntu.com/ jammy-backports main multiverse universe" >> /etc/apt/sources.list && \
-    echo "deb [arch=s390x] http://ports.ubuntu.com/ jammy-updates main multiverse universe" >> /etc/apt/sources.list; fi
-
 #FIXME: gcc is required as agent is build out of a container build.
 RUN apt-get update && \
     apt-get install --no-install-recommends -y \
@@ -59,28 +51,8 @@ RUN apt-get update && \
     wget \
     xz-utils \
     zstd && \
-    if [ "${ARCH}" != "$(uname -m)" ] && [ "${ARCH}" == "s390x" ]; then \
-        apt-get install -y --no-install-recommends \
-        gcc-s390x-linux-gnu \
-        g++-s390x-linux-gnu \
-        binutils-s390x-linux-gnu \
-        dpkg-dev \
-        apt-utils \
-        libssl-dev:s390x \
-        libcurl4-openssl-dev:s390x \
-        libjson-c-dev:s390x \
-        pkg-config:s390x \
-        libxml2-dev:s390x \
-        libjson-c-dev:s390x \
-        libglib2.0-0:s390x \
-        libglib2.0-dev:s390x; \
-    elif uname -m | grep -Eq 's390x'; then apt-get install -y s390-tools; fi && \
+    if uname -m | grep -Eq 's390x'; then apt-get install -y s390-tools; fi && \
     apt-get clean && rm -rf /var/lib/apt/lists
 
-RUN if [ "${ARCH}" != "$(uname -m)" ] && [ "${ARCH}" == "s390x" ]; then \
-        git clone -b v2.25.0 https://github.com/ibm-s390-linux/s390-tools.git && cd s390-tools && \
-        pushd genprotimg && pushd boot && make CROSS_COMPILE=s390x-linux-gnu- && popd && pushd src && \
-        make CROSS_COMPILE=s390x-linux-gnu- && popd && make install && popd || return; fi
-
 ENV USER ${IMG_USER}
 USER ${IMG_USER}
diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh
index ff56ce2833..88570f03e0 100755
--- a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh
+++ b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh
@@ -20,34 +20,6 @@ http_proxy="${http_proxy:-}"
 https_proxy="${https_proxy:-}"
 
 ARCH=${ARCH:-$(uname -m)}
-CROSS_BUILD=
-# shellcheck disable=SC2034
-BUILDX=""
-# shellcheck disable=SC2034
-PLATFORM=""
-TARGET_ARCH=${TARGET_ARCH:-$(uname -m)}
-[[ "$(uname -m)" != "${TARGET_ARCH}" ]] && CROSS_BUILD=true
-
-[[ "${TARGET_ARCH}" == "aarch64" ]] && TARGET_ARCH=arm64
-
-# used for cross build
-TARGET_OS=${TARGET_OS:-linux}
-TARGET_ARCH=${TARGET_ARCH:-${ARCH}}
-
-# We've seen issues related to the /home/runner/.docker/buildx/activity/default file
-# constantly being with the wrong permissions.
-# Let's just remove the file before we build.
-rm -f "${HOME}"/.docker/buildx/activity/default
-
-# shellcheck disable=SC2034
-[[ "${CROSS_BUILD}" == "true" ]] && BUILDX="buildx" && PLATFORM="--platform=${TARGET_OS}/${TARGET_ARCH}"
-if [[ "${CROSS_BUILD}" == "true" ]]; then
-       # check if the current docker support docker buildx
-       docker buildx ls > /dev/null 2>&1 || { echo "no docker buildx support, please upgrade your docker" && exit 1; }
-       # check if docker buildx support target_arch, if not install it
-       r=$(docker buildx ls | grep "${TARGET_ARCH}" || true)
-       [[ -z "${r}" ]] && sudo docker run --privileged --rm tonistiigi/binfmt --install "${TARGET_ARCH}"
-fi
 
 if [[ "${script_dir}" != "${PWD}" && ! -L "${PWD}/build" ]]; then
 	# If a parallel job creates the link between the check and our ln,
@@ -82,7 +54,6 @@ docker build -q -t build-kata-deploy \
 	--build-arg http_proxy="${http_proxy}" \
 	--build-arg https_proxy="${https_proxy}" \
 	--build-arg HOST_DOCKER_GID="${docker_gid}" \
-	--build-arg ARCH="${ARCH}" \
 	"${script_dir}/dockerbuild/"
 
 ARTEFACT_REGISTRY="${ARTEFACT_REGISTRY:-}"
@@ -169,8 +140,6 @@ docker run \
 	--env HKD_PATH="$(realpath "${HKD_PATH:-}" 2> /dev/null || true)" \
 	--env SE_KERNEL_PARAMS="${SE_KERNEL_PARAMS:-}" \
 	--env FAKE_SE_IMAGE="${FAKE_SE_IMAGE:-}" \
-	--env CROSS_BUILD="${CROSS_BUILD}" \
-	--env TARGET_ARCH="${TARGET_ARCH}" \
 	--env ARCH="${ARCH}" \
 	--rm \
 	-w "${script_dir}" \
diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh
index 45057c92b9..f212554ad5 100755
--- a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh
+++ b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh
@@ -805,9 +805,6 @@ install_initrd() {
 
 	latest_builder_image=""
 
-	# shellcheck disable=SC2154
-	[[ "${ARCH}" == "aarch64" && "${CROSS_BUILD}" == "true" ]] && echo "warning: Don't cross build initrd for aarch64 as it's too slow" && exit 0
-
 	install_cached_tarball_component \
 		"${component}" \
 		"${latest_artefact}" \

From 7632ffd8a81424e9172d193c2b23e61aac89940e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <ffidencio@nvidia.com>
Date: Mon, 20 Jul 2026 19:26:26 +0200
Subject: [PATCH 3/9] static-build: drop cross-build container handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The shared lib.sh exported CROSS_BUILD/TARGET_ARCH/BUILDX/PLATFORM so the
per-component static-build scripts could switch to `-cross-build` builder
images, run `docker buildx build --platform=...` under QEMU emulation and,
for shim-v2, swap in the messense/rust-musl-cross image with a matching
cross CC.

These cross paths are not exercised on our side (all builds run on
native-arch runners), so remove them: builder images are now built with a
plain `docker build`, and shim-v2 builds runtime-rs natively without the
musl-cross image or CC override.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>
---
 tools/packaging/scripts/lib.sh                  |  9 ---------
 tools/packaging/static-build/agent/build.sh     |  4 +---
 tools/packaging/static-build/busybox/build.sh   |  4 +---
 .../static-build/coco-guest-components/build.sh |  4 +---
 .../packaging/static-build/pause-image/build.sh |  4 +---
 tools/packaging/static-build/shim-v2/build.sh   | 17 +----------------
 tools/packaging/static-build/tools/build.sh     |  4 +---
 tools/packaging/static-build/virtiofsd/build.sh |  4 +---
 8 files changed, 7 insertions(+), 43 deletions(-)

diff --git a/tools/packaging/scripts/lib.sh b/tools/packaging/scripts/lib.sh
index 5e7067bab0..957154233d 100644
--- a/tools/packaging/scripts/lib.sh
+++ b/tools/packaging/scripts/lib.sh
@@ -19,16 +19,7 @@ short_commit_length=10
 
 gh_cli="gh-cli"
 
-#for cross build
-CROSS_BUILD=${CROSS_BUILD-:}
-BUILDX=""
-PLATFORM=""
-TARGET_ARCH=${TARGET_ARCH:-$(uname -m)}
 ARCH=${ARCH:-$(uname -m)}
-[[ "${TARGET_ARCH}" == "aarch64" ]] && TARGET_ARCH=arm64
-TARGET_OS=${TARGET_OS:-linux}
-# shellcheck disable=SC2034
-[[ "${CROSS_BUILD}" == "true" ]] && BUILDX=buildx && PLATFORM="--platform=${TARGET_OS}/${TARGET_ARCH}"
 
 install_yq() {
 	pushd "${repo_root_dir}" || return
diff --git a/tools/packaging/static-build/agent/build.sh b/tools/packaging/static-build/agent/build.sh
index 13d111d855..992b14ca4b 100755
--- a/tools/packaging/static-build/agent/build.sh
+++ b/tools/packaging/static-build/agent/build.sh
@@ -15,12 +15,10 @@ readonly agent_builder="${script_dir}/build-static-agent.sh"
 source "${script_dir}/../../scripts/lib.sh"
 
 container_image="${AGENT_CONTAINER_BUILDER:-$(get_agent_image_name)}"
-# shellcheck disable=SC2154
-[[ "${CROSS_BUILD}" == "true" ]] && container_image="${container_image}-cross-build"
 
 # shellcheck disable=SC2154,SC2086
 docker pull "${container_image}" || \
-	(docker ${BUILDX} build ${PLATFORM} \
+	(docker build \
 	    	--build-arg RUST_TOOLCHAIN="$(get_from_kata_deps ".languages.rust.meta.newest-version")" \
 		-t "${container_image}" "${script_dir}" && \
 	 # No-op unless PUSH_TO_REGISTRY is exported as "yes"
diff --git a/tools/packaging/static-build/busybox/build.sh b/tools/packaging/static-build/busybox/build.sh
index 0b2fe9169c..3b717bba17 100755
--- a/tools/packaging/static-build/busybox/build.sh
+++ b/tools/packaging/static-build/busybox/build.sh
@@ -27,12 +27,10 @@ readonly BUSYBOX_URL="${busybox_url}"
 
 
 container_image="${BUSYBOX_CONTAINER_BUILDER:-$(get_busybox_image_name)}"
-# shellcheck disable=SC2154
-[[ "${CROSS_BUILD}" == "true" ]] && container_image="${container_image}-cross-build"
 
 # shellcheck disable=SC2154,SC2086
 docker pull "${container_image}" || \
-	(docker ${BUILDX} build ${PLATFORM} \
+	(docker build \
 		-t "${container_image}" "${script_dir}" \
 	 # No-op unless PUSH_TO_REGISTRY is exported as "yes"
 	 push_to_registry "${container_image}")
diff --git a/tools/packaging/static-build/coco-guest-components/build.sh b/tools/packaging/static-build/coco-guest-components/build.sh
index f197ff565d..b4236cf8a1 100755
--- a/tools/packaging/static-build/coco-guest-components/build.sh
+++ b/tools/packaging/static-build/coco-guest-components/build.sh
@@ -33,12 +33,10 @@ nvat_version="${nvat_version:-}"
 [[ -n "${nvat_version}" ]] || nvat_version=$(get_from_kata_deps ".externals.nvidia.nvat.version" 2>/dev/null || true)
 
 container_image="${COCO_GUEST_COMPONENTS_CONTAINER_BUILDER:-$(get_coco_guest_components_image_name)}"
-# shellcheck disable=SC2154
-[[ "${CROSS_BUILD}" == "true" ]] && container_image="${container_image}-cross-build"
 
 # shellcheck disable=SC2154,SC2086
 docker pull "${container_image}" || \
-	(docker ${BUILDX} build ${PLATFORM} \
+	(docker build \
 	    	--build-arg RUST_TOOLCHAIN="${coco_guest_components_toolchain}" \
 		--build-arg NVAT_VERSION="${nvat_version}" \
 		-t "${container_image}" "${script_dir}" && \
diff --git a/tools/packaging/static-build/pause-image/build.sh b/tools/packaging/static-build/pause-image/build.sh
index 5748d057ba..2e2cf2fbac 100755
--- a/tools/packaging/static-build/pause-image/build.sh
+++ b/tools/packaging/static-build/pause-image/build.sh
@@ -27,12 +27,10 @@ package_output_dir="${package_output_dir:-}"
 [[ -n "${pause_image_version}" ]] || die "Failed to get pause image version or commit"
 
 container_image="${PAUSE_IMAGE_CONTAINER_BUILDER:-$(get_pause_image_name)}"
-# shellcheck disable=SC2154
-[[ "${CROSS_BUILD}" == "true" ]] && container_image="${container_image}-cross-build"
 
 # shellcheck disable=SC2154,SC2086
 docker pull "${container_image}" || \
-	(docker ${BUILDX} build ${PLATFORM} \
+	(docker build \
 		-t "${container_image}" "${script_dir}" && \
 	 # No-op unless PUSH_TO_REGISTRY is exported as "yes"
 	 push_to_registry "${container_image}")
diff --git a/tools/packaging/static-build/shim-v2/build.sh b/tools/packaging/static-build/shim-v2/build.sh
index a7eec5c51b..dd8c71254e 100755
--- a/tools/packaging/static-build/shim-v2/build.sh
+++ b/tools/packaging/static-build/shim-v2/build.sh
@@ -19,7 +19,6 @@ VMM_CONFIGS="qemu fc"
 GO_VERSION=${GO_VERSION}
 # shellcheck disable=SC2269
 RUST_VERSION=${RUST_VERSION}
-CC=""
 
 RUNTIME_CHOICE="${RUNTIME_CHOICE:-both}"
 DESTDIR=${DESTDIR:-${PWD}}
@@ -38,9 +37,6 @@ case "${RUNTIME_CHOICE}" in
 		;;
 esac
 
-# shellcheck disable=SC2154
-[[ "${CROSS_BUILD}" == "true" ]] && container_image_bk="${container_image}" && container_image="${container_image}-cross-build"
-
 # Variants (targets) that build a measured rootfs as of now are:
 # - rootfs-image (the base image, measured; root hash labelled "base")
 # - rootfs-image-confidential (monolithic CoCo image, root hash "confidential")
@@ -105,7 +101,7 @@ GO_EXTRA_OPTS+="$(read_verity_param "nvidia" "KERNELVERITYPARAMS_NV_BASE")"
 
 # shellcheck disable=SC2154,SC2086
 docker pull "${container_image}" || \
-	(docker ${BUILDX} build ${PLATFORM}  \
+	(docker build \
 		--build-arg GO_VERSION="${GO_VERSION}" \
 		--build-arg RUST_VERSION="${RUST_VERSION}" \
 		-t "${container_image}" \
@@ -113,30 +109,21 @@ docker pull "${container_image}" || \
 	 push_to_registry "${container_image}")
 
 arch=${ARCH:-$(uname -m)}
-GCC_ARCH=${arch}
 if [[ "${arch}" = "ppc64le" ]]; then
-	GCC_ARCH="powerpc64le"
 	arch="ppc64"
 fi
 
 case "${RUNTIME_CHOICE}" in
 	"rust"|"both")
-		#Build rust project using cross build musl image to speed up
-		[[ "${CROSS_BUILD}" == "true" && ${ARCH} != "s390x" ]] && container_image="messense/rust-musl-cross:${GCC_ARCH}-musl" && CC=${GCC_ARCH}-unknown-linux-musl-gcc
-
 		docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \
-			--env CROSS_BUILD="${CROSS_BUILD}" \
 			--env ARCH="${ARCH}" \
-			--env CC="${CC}" \
 			-w "${repo_root_dir}/src/runtime-rs" \
 			--user "$(id -u)":"$(id -g)" \
 			"${container_image}" \
 			bash -c "make clean-generated-files && make PREFIX=${PREFIX} QEMUCMD=qemu-system-${arch} ${EXTRA_OPTS}${RUST_EXTRA_OPTS}"
 
 		docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \
-			--env CROSS_BUILD="${CROSS_BUILD}" \
 		        --env ARCH="${ARCH}" \
-		        --env CC="${CC}" \
 			-w "${repo_root_dir}/src/runtime-rs" \
 			--user "$(id -u)":"$(id -g)" \
 			"${container_image}" \
@@ -154,8 +141,6 @@ fi
 
 case "${RUNTIME_CHOICE}" in
 	"go"|"both")
-		[[ "${CROSS_BUILD}" == "true" ]] && container_image="${container_image_bk}-cross-build"
-
 		docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \
 			-w "${repo_root_dir}/src/runtime" \
 			--user "$(id -u)":"$(id -g)" \
diff --git a/tools/packaging/static-build/tools/build.sh b/tools/packaging/static-build/tools/build.sh
index bb177a9ff4..55b8790278 100755
--- a/tools/packaging/static-build/tools/build.sh
+++ b/tools/packaging/static-build/tools/build.sh
@@ -17,12 +17,10 @@ source "${script_dir}/../../scripts/lib.sh"
 tool="${1}"
 
 container_image="${TOOLS_CONTAINER_BUILDER:-$(get_tools_image_name)}"
-# shellcheck disable=SC2154
-[[ "${CROSS_BUILD}" == "true" ]] && container_image="${container_image}-cross-build"
 
 # shellcheck disable=SC2154,SC2086
 docker pull "${container_image}" || \
-	(docker ${BUILDX} build ${PLATFORM} \
+	(docker build \
 	    	--build-arg GO_TOOLCHAIN="$(get_from_kata_deps ".languages.golang.meta.newest-version")" \
 	    	--build-arg RUST_TOOLCHAIN="$(get_from_kata_deps ".languages.rust.meta.newest-version")" \
 		-t "${container_image}" "${script_dir}" && \
diff --git a/tools/packaging/static-build/virtiofsd/build.sh b/tools/packaging/static-build/virtiofsd/build.sh
index b2de1a7471..92abf11c48 100755
--- a/tools/packaging/static-build/virtiofsd/build.sh
+++ b/tools/packaging/static-build/virtiofsd/build.sh
@@ -52,12 +52,10 @@ case ${ARCH} in
 esac
 
 container_image="${VIRTIOFSD_CONTAINER_BUILDER:-$(get_virtiofsd_image_name)}"
-# shellcheck disable=SC2154
-[[ "${CROSS_BUILD}" == "true" ]] && container_image="${container_image}-cross-build"
 
 # shellcheck disable=SC2154,SC2086
 docker pull "${container_image}" || \
-	(docker ${BUILDX} build ${PLATFORM} \
+	(docker build \
 		--build-arg RUST_TOOLCHAIN="${virtiofsd_toolchain}" \
 		-t "${container_image}" "${script_dir}/${libc}" && \
 	 # No-op unless PUSH_TO_REGISTRY is exported as "yes"

From 7925e678baef3079090b6cd65bfc92255711bb4e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <ffidencio@nvidia.com>
Date: Mon, 20 Jul 2026 19:42:48 +0200
Subject: [PATCH 4/9] qemu: drop cross-compilation build support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Building QEMU for a foreign arch relied on configure-hypervisor.sh
emitting --cross-prefix, build-qemu.sh passing --cc/--cross-prefix for
s390x, and the builder image installing foreign-arch -dev packages
(via dpkg multiarch/DPKG_ARCH) plus a gcc-<arch>-linux-gnu cross toolchain.

None of this is exercised on our side: QEMU is always built on a
native-arch runner. Remove the cross-prefix logic, the s390x cross
configure branch, and the DPKG_ARCH/cross-gcc plumbing from the Dockerfile
and build-base-qemu.sh.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>
---
 .../packaging/scripts/configure-hypervisor.sh | 12 ----
 tools/packaging/static-build/qemu/Dockerfile  | 61 +++++++------------
 .../static-build/qemu/build-base-qemu.sh      |  9 ---
 .../packaging/static-build/qemu/build-qemu.sh |  6 +-
 4 files changed, 24 insertions(+), 64 deletions(-)

diff --git a/tools/packaging/scripts/configure-hypervisor.sh b/tools/packaging/scripts/configure-hypervisor.sh
index 0160f7e27d..8ca899f74b 100755
--- a/tools/packaging/scripts/configure-hypervisor.sh
+++ b/tools/packaging/scripts/configure-hypervisor.sh
@@ -209,18 +209,6 @@ show_array() {
 
 generate_qemu_options() {
 	#---------------------------------------------------------------------
-	#check if cross-compile is needed
-	host=$(uname -m)
-	if [[ "${arch}" != "${host}" ]]; then
-		case ${arch} in
-			aarch64) qemu_options+=(size:--cross-prefix=aarch64-linux-gnu-);;
-			ppc64le) qemu_options+=(size:--cross-prefix=powerpc64le-linux-gnu-);;
-			s390x) exit;;
-			x86_64);;
-			*) exit;;
-		esac
-	fi
-
 	# Disabled options
 
 	# braille support not required
diff --git a/tools/packaging/static-build/qemu/Dockerfile b/tools/packaging/static-build/qemu/Dockerfile
index aaff0d6457..84b0b13b74 100644
--- a/tools/packaging/static-build/qemu/Dockerfile
+++ b/tools/packaging/static-build/qemu/Dockerfile
@@ -8,23 +8,10 @@ FROM ubuntu:22.04
 # This is required to keep build dependencies with security fixes.
 ARG CACHE_TIMEOUT
 ARG DEBIAN_FRONTEND=noninteractive
-ARG DPKG_ARCH
-ARG ARCH
-ARG GCC_ARCH
 ARG PREFIX
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
-RUN if [ "${ARCH}" != "$(uname -m)" ]; then sed -i 's/^deb/deb [arch=amd64]/g' /etc/apt/sources.list && \
-    dpkg --add-architecture "${DPKG_ARCH#:}" && \
-    echo "deb [arch=${DPKG_ARCH#:}] http://ports.ubuntu.com/ jammy main restricted" >> /etc/apt/sources.list && \
-    echo "deb [arch=${DPKG_ARCH#:}] http://ports.ubuntu.com/ jammy-updates main restricted" >> /etc/apt/sources.list && \
-    echo "deb [arch=${DPKG_ARCH#:}] http://ports.ubuntu.com/ jammy universe" >> /etc/apt/sources.list && \
-    echo "deb [arch=${DPKG_ARCH#:}] http://ports.ubuntu.com/ jammy-updates universe" >> /etc/apt/sources.list && \
-    echo "deb [arch=${DPKG_ARCH#:}] http://ports.ubuntu.com/ jammy multiverse" >> /etc/apt/sources.list && \
-    echo "deb [arch=${DPKG_ARCH#:}] http://ports.ubuntu.com/ jammy-updates multiverse" >> /etc/apt/sources.list && \
-    echo "deb [arch=${DPKG_ARCH#:}] http://ports.ubuntu.com/ jammy-backports main restricted universe multiverse" >> /etc/apt/sources.list; fi
-
 RUN apt-get update && apt-get upgrade -y && \
     apt-get --no-install-recommends install -y \
 	    apt-utils \
@@ -37,39 +24,37 @@ RUN apt-get update && apt-get upgrade -y && \
 	    dpkg-dev \
 	    flex \
 	    gawk \
-	    libaio-dev${DPKG_ARCH} \
-	    libaudit-dev${DPKG_ARCH} \
-	    libblkid-dev${DPKG_ARCH} \
-	    libcap-dev${DPKG_ARCH} \
-	    libcap-ng-dev${DPKG_ARCH} \
-	    libdw-dev${DPKG_ARCH} \
-	    libelf-dev${DPKG_ARCH} \
-	    libffi-dev${DPKG_ARCH} \
-	    libglib2.0-0${DPKG_ARCH} \
-	    libglib2.0-dev${DPKG_ARCH} \
-	    libglib2.0-dev${DPKG_ARCH} git \
-	    libltdl-dev${DPKG_ARCH} \
-	    libmount-dev${DPKG_ARCH} \
-	    libnuma-dev${DPKG_ARCH} \
-	    libpixman-1-dev${DPKG_ARCH} \
-	    libselinux1-dev${DPKG_ARCH} \
-	    libtool${DPKG_ARCH} \
-	    liburing-dev${DPKG_ARCH} \
+	    libaio-dev \
+	    libaudit-dev \
+	    libblkid-dev \
+	    libcap-dev \
+	    libcap-ng-dev \
+	    libdw-dev \
+	    libelf-dev \
+	    libffi-dev \
+	    libglib2.0-0 \
+	    libglib2.0-dev \
+	    libglib2.0-dev git \
+	    libltdl-dev \
+	    libmount-dev \
+	    libnuma-dev \
+	    libpixman-1-dev \
+	    libselinux1-dev \
+	    libtool \
+	    liburing-dev \
 	    make \
 	    ninja-build \
-	    pkg-config${DPKG_ARCH} \
-	    libseccomp-dev${DPKG_ARCH} \
-	    libseccomp2${DPKG_ARCH} \
+	    pkg-config \
+	    libseccomp-dev \
+	    libseccomp2 \
 	    patch \
 	    python3 \
 	    python3-dev \
 	    python3-venv \
 	    python3-tomli \
 	    rsync \
-	    zlib1g-dev${DPKG_ARCH} && \
-    if [ "${ARCH}" != s390x ]; then apt-get install -y --no-install-recommends libpmem-dev${DPKG_ARCH}; fi && \
-    GCC_ARCH="${ARCH}" && if [ "${ARCH}" = "ppc64le" ]; then GCC_ARCH="powerpc64le"; fi && \
-    if [ "${ARCH}" != "$(uname -m)" ]; then apt-get install --no-install-recommends -y gcc-"${GCC_ARCH}"-linux-gnu; fi && \
+	    zlib1g-dev && \
+    if [ "$(uname -m)" != s390x ]; then apt-get install -y --no-install-recommends libpmem-dev; fi && \
     apt-get clean && rm -rf /var/lib/apt/lists/
 
 # Detect architecture and set appropriate Ubuntu mirror
diff --git a/tools/packaging/static-build/qemu/build-base-qemu.sh b/tools/packaging/static-build/qemu/build-base-qemu.sh
index 39fde58638..1e6862c728 100755
--- a/tools/packaging/static-build/qemu/build-base-qemu.sh
+++ b/tools/packaging/static-build/qemu/build-base-qemu.sh
@@ -8,8 +8,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-CROSS_BUILD="${CROSS_BUILD:-false}"
-
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 readonly qemu_builder="${script_dir}/build-qemu.sh"
 
@@ -22,10 +20,6 @@ source "${script_dir}/../qemu.blacklist"
 repo_root_dir="${repo_root_dir:-$(git rev-parse --show-toplevel 2>/dev/null || echo "${script_dir}/../../../..")}"
 
 ARCH=${ARCH:-$(uname -m)}
-dpkg_arch=":${ARCH}"
-[[ "${dpkg_arch}" == ":aarch64" ]] && dpkg_arch=":arm64"
-[[ "${dpkg_arch}" == ":x86_64" ]] && dpkg_arch=""
-[[ "${dpkg_arch}" == ":ppc64le" ]] && dpkg_arch=":ppc64el"
 
 packaging_dir="${script_dir}/../.."
 qemu_destdir="/tmp/qemu-static/"
@@ -52,14 +46,11 @@ CACHE_TIMEOUT=$(date +"%Y-%m-%d")
 [[ -n "${build_suffix}" ]] && PKGVERSION="kata-static-${build_suffix}" || PKGVERSION="kata-static"
 
 container_image="${QEMU_CONTAINER_BUILDER:-$(get_qemu_image_name)}"
-[[ "${CROSS_BUILD}" == "true" ]] && container_image="${container_image}-cross-build"
 
 "${container_engine}" pull "${container_image}" || ("${container_engine}" build \
 	--build-arg CACHE_TIMEOUT="${CACHE_TIMEOUT}" \
 	--build-arg http_proxy="${http_proxy}" \
 	--build-arg https_proxy="${https_proxy}" \
-	--build-arg DPKG_ARCH="${dpkg_arch}" \
-	--build-arg ARCH="${ARCH}" \
 	"${packaging_dir}" \
 	-f "${script_dir}/Dockerfile" \
 	-t "${container_image}" && \
diff --git a/tools/packaging/static-build/qemu/build-qemu.sh b/tools/packaging/static-build/qemu/build-qemu.sh
index b9d327ec8e..fb7c2d01a8 100755
--- a/tools/packaging/static-build/qemu/build-qemu.sh
+++ b/tools/packaging/static-build/qemu/build-qemu.sh
@@ -34,11 +34,7 @@ git fetch --depth=1 origin "${QEMU_VERSION_NUM}"
 git checkout FETCH_HEAD
 scripts/git-submodule.sh update meson capstone
 "${kata_packaging_scripts}/patch_qemu.sh" "${QEMU_VERSION_NUM}" "${kata_packaging_dir}/qemu/patches"
-if [[ "$(uname -m)" != "${ARCH}" ]] && [[ "${ARCH}" == "s390x" ]]; then
-       PREFIX="${PREFIX}" "${kata_packaging_scripts}/configure-hypervisor.sh" -s "${HYPERVISOR_NAME}" "${ARCH}" | xargs ./configure  --with-pkgversion="${PKGVERSION}" --cc=s390x-linux-gnu-gcc --cross-prefix=s390x-linux-gnu- --prefix="${PREFIX}" --target-list=s390x-softmmu
-else
-       PREFIX="${PREFIX}" "${kata_packaging_scripts}/configure-hypervisor.sh" -s "${HYPERVISOR_NAME}" "${ARCH}" | xargs ./configure  --with-pkgversion="${PKGVERSION}"
-fi
+PREFIX="${PREFIX}" "${kata_packaging_scripts}/configure-hypervisor.sh" -s "${HYPERVISOR_NAME}" "${ARCH}" | xargs ./configure  --with-pkgversion="${PKGVERSION}"
 make -j"$(nproc --ignore=1)"
 make install DESTDIR="${QEMU_DESTDIR}"
 popd

From 4d1e78da2f7d5ff6616d5674510a134556a1e97d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <ffidencio@nvidia.com>
Date: Mon, 20 Jul 2026 19:46:35 +0200
Subject: [PATCH 5/9] kernel: drop cross-compilation build support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The guest kernel build derived a CROSS_COMPILE=<arch>-linux-gnu- prefix
whenever the target arch differed from the host, the static-build wrapper
switched to a per-arch `-cross-build` image (with buildx/--platform for
s390x), and the builder image installed gcc-<arch>-linux-gnu /
binutils-<arch>-linux-gnu cross toolchains.

None of this is exercised on our side: the kernel is always built on a
native-arch runner. Remove the CROSS_COMPILE plumbing, the cross-build
image/buildx handling and the cross toolchain install.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>
---
 tools/packaging/kernel/build-kernel.sh        | 10 ++-----
 tools/packaging/kernel/kata_config_version    |  2 +-
 .../packaging/static-build/kernel/Dockerfile  |  3 ---
 tools/packaging/static-build/kernel/build.sh  | 27 +------------------
 4 files changed, 4 insertions(+), 38 deletions(-)

diff --git a/tools/packaging/kernel/build-kernel.sh b/tools/packaging/kernel/build-kernel.sh
index 7ade097301..5ef2698620 100755
--- a/tools/packaging/kernel/build-kernel.sh
+++ b/tools/packaging/kernel/build-kernel.sh
@@ -69,8 +69,6 @@ kernel_ref=""
 # Enable measurement of the guest rootfs at boot.
 measured_rootfs="false"
 
-CROSS_BUILD_ARG=""
-
 packaging_scripts_dir="${script_dir}/../scripts"
 # shellcheck source=tools/packaging/scripts/lib.sh
 source "${packaging_scripts_dir}/lib.sh"
@@ -494,8 +492,7 @@ setup_kernel() {
 
 	info "Copying config file from: ${kernel_config_path}"
 	cp "${kernel_config_path}" ./.config
-	# shellcheck disable=SC2086
-	ARCH=${arch_target}  make oldconfig ${CROSS_BUILD_ARG}
+	ARCH=${arch_target}  make oldconfig
 	)
 
 	info "Fetching NVIDIA driver source code"
@@ -518,8 +515,7 @@ build_kernel() {
 	[[ -n "${arch_target}" ]] || arch_target="$(uname -m)"
 	arch_target=$(arch_to_kernel "${arch_target}")
 	pushd "${kernel_path}" >>/dev/null
-	# shellcheck disable=SC2086
-	make -j "$(nproc)" ARCH="${arch_target}" ${CROSS_BUILD_ARG}
+	make -j "$(nproc)" ARCH="${arch_target}"
 	if [[ "${conf_guest}" == "confidential" ]]; then
 		make -j "$(nproc)" INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH="${kernel_path}" modules_install
 	fi
@@ -740,8 +736,6 @@ main() {
 
 	info "Kernel version: ${kernel_version}"
 
-	[[ "${arch_target}" != "" ]] && [[ "${arch_target}" != "$(uname -m)" ]] && CROSS_BUILD_ARG="CROSS_COMPILE=${arch_target}-linux-gnu-"
-
 	case "${subcmd}" in
 		build)
 			build_kernel "${kernel_path}"
diff --git a/tools/packaging/kernel/kata_config_version b/tools/packaging/kernel/kata_config_version
index 08839f6bb2..3bc92d44ac 100644
--- a/tools/packaging/kernel/kata_config_version
+++ b/tools/packaging/kernel/kata_config_version
@@ -1 +1 @@
-200
+201
diff --git a/tools/packaging/static-build/kernel/Dockerfile b/tools/packaging/static-build/kernel/Dockerfile
index d39aafd18a..08fc03cca8 100644
--- a/tools/packaging/static-build/kernel/Dockerfile
+++ b/tools/packaging/static-build/kernel/Dockerfile
@@ -6,8 +6,6 @@ FROM ubuntu:22.04
 ENV DEBIAN_FRONTEND=noninteractive
 ENV INSTALL_IN_GOPATH=false
 
-ARG ARCH
-
 COPY install_yq.sh /usr/bin/install_yq.sh
 
 # kernel deps
@@ -32,7 +30,6 @@ RUN apt-get update && \
 	    cpio \
 	    patch \
 	    python3 && \
-    if [ "${ARCH}" != "$(uname -m)" ]; then apt-get install --no-install-recommends -y gcc-"${ARCH}"-linux-gnu binutils-"${ARCH}"-linux-gnu; fi && \
     apt-get clean && apt-get autoclean && rm -rf /var/lib/apt/lists/*
 
 RUN install_yq.sh
diff --git a/tools/packaging/static-build/kernel/build.sh b/tools/packaging/static-build/kernel/build.sh
index 3e2297ecfe..bc98b18834 100755
--- a/tools/packaging/static-build/kernel/build.sh
+++ b/tools/packaging/static-build/kernel/build.sh
@@ -19,9 +19,6 @@ repo_root_dir="${repo_root_dir:-}"
 [[ -n "${repo_root_dir}" ]] || die "repo_root_dir is not set"
 readonly kernel_builder="${repo_root_dir}/tools/packaging/kernel/build-kernel.sh"
 
-BUILDX=
-PLATFORM=
-
 DESTDIR=${DESTDIR:-${PWD}}
 PREFIX=${PREFIX:-/opt/kata}
 container_image="${KERNEL_CONTAINER_BUILDER:-$(get_kernel_image_name)}"
@@ -35,30 +32,8 @@ if [[ "${MEASURED_ROOTFS}" == "yes" ]] || [[ "${CONFIDENTIAL_GUEST}" == "yes" ]]
 	kernel_builder_args+=" -m"
 fi
 
-if [[ "${CROSS_BUILD:-}" == "true" ]]; then
-       container_image="${container_image}-${ARCH:-}-cross-build"
-       # Need to build a s390x image due to an issue at
-       # https://github.com/kata-containers/kata-containers/pull/6586#issuecomment-1603189242
-       if [[ ${ARCH:-} == "s390x" ]]; then
-               BUILDX="buildx"
-               PLATFORM="--platform=linux/s390x"
-       fi
-fi
-
 container_engine=${CONTAINER_ENGINE:-"docker"}
-container_build=${container_engine}
-
-if [[ -n "${BUILDX}" ]]; then
-	container_build+=" ${BUILDX}"
-fi
-
-container_build+=" build"
-
-if [[ -n "${PLATFORM}" ]]; then
-	container_build+=" ${PLATFORM}"
-fi
-
-container_build+=" --build-arg ARCH=${ARCH:-}"
+container_build="${container_engine} build"
 
 "${container_engine}" pull "${container_image}" || \
 	{

From 9a7d894cef9d2a41126bd6b62416dbe54b9db964 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <ffidencio@nvidia.com>
Date: Mon, 20 Jul 2026 19:53:14 +0200
Subject: [PATCH 6/9] osbuilder: drop cross-compilation rootfs/image support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Building a foreign-arch rootfs/image relied on CROSS_BUILD to enable docker
buildx/--platform emulation, a <arch>-linux-gnu-strip stripping tool, an
Ubuntu builder installing gcc-<arch>-linux-gnu + libc6-dev-<arch>-cross
(via the @ARCH@ template) and config.sh exporting a cross CC.

None of this is exercised on our side: rootfs and image are always built
on a native-arch runner. Remove the CROSS_BUILD/TARGET_ARCH/BUILDX/PLATFORM
plumbing, the cross toolchain/@ARCH@ substitution and the cross CC export;
the guest agent is stripped with the native `strip`.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>
---
 .../osbuilder/image-builder/image_builder.sh  | 11 +---------
 tools/osbuilder/rootfs-builder/rootfs.sh      | 22 -------------------
 .../rootfs-builder/ubuntu/Dockerfile.in       |  7 ------
 .../osbuilder/rootfs-builder/ubuntu/config.sh |  9 --------
 tools/osbuilder/scripts/lib.sh                |  1 -
 5 files changed, 1 insertion(+), 49 deletions(-)

diff --git a/tools/osbuilder/image-builder/image_builder.sh b/tools/osbuilder/image-builder/image_builder.sh
index 490edde19c..e7057b99ca 100755
--- a/tools/osbuilder/image-builder/image_builder.sh
+++ b/tools/osbuilder/image-builder/image_builder.sh
@@ -14,15 +14,7 @@ DOCKER_RUNTIME=${DOCKER_RUNTIME:-runc}
 MEASURED_ROOTFS=${MEASURED_ROOTFS:-no}
 IMAGE_SIZE_ALIGNMENT_MB=${IMAGE_SIZE_ALIGNMENT_MB:-128}
 
-#For cross build
-CROSS_BUILD=${CROSS_BUILD:-false}
-BUILDX=""
-PLATFORM=""
-TARGET_ARCH=${TARGET_ARCH:-$(uname -m)}
 ARCH=${ARCH:-$(uname -m)}
-[[ "${TARGET_ARCH}" == "aarch64" ]] && TARGET_ARCH=arm64
-TARGET_OS=${TARGET_OS:-linux}
-[[ "${CROSS_BUILD}" == "true" ]] && BUILDX=buildx && PLATFORM="--platform=${TARGET_OS}/${TARGET_ARCH}"
 BUILD_VARIANT=${BUILD_VARIANT:-}
 
 readonly script_name="${0##*/}"
@@ -144,7 +136,7 @@ build_with_container() {
 	fi
 
 	# shellcheck disable=SC2154,SC2086,SC2248
-	"${container_engine}" ${BUILDX} build ${PLATFORM}  \
+	"${container_engine}" build \
 		   ${engine_build_args} \
 		   --build-arg http_proxy="${http_proxy}" \
 		   --build-arg https_proxy="${https_proxy}" \
@@ -183,7 +175,6 @@ build_with_container() {
 		   --env SELINUX="${SELINUX}" \
 		   --env DEBUG="${DEBUG}" \
 		   --env ARCH="${ARCH}" \
-		   --env TARGET_ARCH="${TARGET_ARCH}" \
 		   --env USER="$(id -u)" \
 		   --env GROUP="$(id -g)" \
 		   --env IMAGE_SIZE_ALIGNMENT_MB="${IMAGE_SIZE_ALIGNMENT_MB}" \
diff --git a/tools/osbuilder/rootfs-builder/rootfs.sh b/tools/osbuilder/rootfs-builder/rootfs.sh
index f7a3242f01..67f64c2983 100755
--- a/tools/osbuilder/rootfs-builder/rootfs.sh
+++ b/tools/osbuilder/rootfs-builder/rootfs.sh
@@ -72,26 +72,8 @@ is_nvidia_confidential_variant() { [[ "${BUILD_VARIANT}" == "nvidia-gpu-confiden
 # shellcheck source=/dev/null
 is_nvidia_variant && source "${script_dir}/nvidia/nvidia_rootfs.sh"
 
-#For cross build
-CROSS_BUILD=${CROSS_BUILD:-false}
-BUILDX=""
-PLATFORM=""
-TARGET_ARCH=${TARGET_ARCH:-$(uname -m)}
 ARCH=${ARCH:-$(uname -m)}
-[[ "${TARGET_ARCH}" == "aarch64" ]] && TARGET_ARCH=arm64
-TARGET_OS=${TARGET_OS:-linux}
 stripping_tool="strip"
-if [[ "${CROSS_BUILD}" == "true" ]]; then
-	# shellcheck disable=SC2034
-	BUILDX=buildx
-	# shellcheck disable=SC2034
-	PLATFORM="--platform=${TARGET_OS}/${TARGET_ARCH}"
-	if command -v "${TARGET_ARCH}-linux-gnu-strip" >/dev/null; then
-		stripping_tool="${TARGET_ARCH}-linux-gnu-strip"
-	else
-		die "Could not find ${TARGET_ARCH}-linux-gnu-strip for cross build"
-	fi
-fi
 
 # The list of systemd units and files that are not needed in Kata Containers
 readonly -a systemd_units=(
@@ -211,8 +193,6 @@ AGENT_VERSION       Version of the agent to include in the rootfs.
                     Default value: ${AGENT_VERSION:-<not set>}
 
 ARCH                Target architecture (according to \`uname -m\`).
-                    Foreign bootstraps are currently only supported for Ubuntu
-                    and glibc agents.
                     Default value: $(uname -m)
 
 COCO_GUEST_COMPONENTS_TARBALL       Path to the kata-coco-guest-components.tar.zst tarball to be unpacked inside the
@@ -596,8 +576,6 @@ build_rootfs_distro()
 			--env SECCOMP="${SECCOMP}" \
 			--env SELINUX="${SELINUX}" \
 			--env DEBUG="${DEBUG}" \
-			--env CROSS_BUILD="${CROSS_BUILD}" \
-			--env TARGET_ARCH="${TARGET_ARCH}" \
 			--env HOME="/root" \
 			--env AGENT_POLICY="${AGENT_POLICY}" \
 			--env CONFIDENTIAL_GUEST="${CONFIDENTIAL_GUEST}" \
diff --git a/tools/osbuilder/rootfs-builder/ubuntu/Dockerfile.in b/tools/osbuilder/rootfs-builder/ubuntu/Dockerfile.in
index 0feafa7f7e..80e82e983a 100644
--- a/tools/osbuilder/rootfs-builder/ubuntu/Dockerfile.in
+++ b/tools/osbuilder/rootfs-builder/ubuntu/Dockerfile.in
@@ -30,13 +30,6 @@ RUN apt-get update && \
     ca-certificates \
     curl \
     g++ \
-    $(gcc_arch="@ARCH@" && [ "$(uname -m)" != "$gcc_arch" ] && ( \
-         libc_arch="$gcc_arch" && \
-         [ "$gcc_arch" = aarch64 ] && libc_arch=arm64; \
-         [ "$gcc_arch" = ppc64le ] && gcc_arch=powerpc64le && libc_arch=ppc64el; \
-         [ "$gcc_arch" = s390x ] && gcc_arch=s390x && libc_arch=s390x; \
-         [ "$gcc_arch" = x86_64 ] && gcc_arch=x86-64 && libc_arch=amd64; \
-         echo "gcc-$gcc_arch-linux-gnu libc6-dev-$libc_arch-cross")) \
     git \
     gnupg2 \
     libclang-dev \
diff --git a/tools/osbuilder/rootfs-builder/ubuntu/config.sh b/tools/osbuilder/rootfs-builder/ubuntu/config.sh
index 5f42012c25..333360d8a4 100644
--- a/tools/osbuilder/rootfs-builder/ubuntu/config.sh
+++ b/tools/osbuilder/rootfs-builder/ubuntu/config.sh
@@ -34,12 +34,3 @@ case "${ARCH}" in
 	*) die "${ARCH} not supported"
 esac
 REPO_URL=${REPO_URL:-http://ports.ubuntu.com}
-
-if [[ "$(uname -m)" != "${ARCH}" ]]; then
-	case "${ARCH}" in
-		ppc64le) cc_arch=powerpc64le;;
-		x86_64) cc_arch=x86-64;;
-		*) cc_arch="${ARCH}"
-	esac
-	export CC="${cc_arch}-linux-gnu-gcc"
-fi
diff --git a/tools/osbuilder/scripts/lib.sh b/tools/osbuilder/scripts/lib.sh
index 29221caf18..f43d779498 100644
--- a/tools/osbuilder/scripts/lib.sh
+++ b/tools/osbuilder/scripts/lib.sh
@@ -259,7 +259,6 @@ RUN . /root/.cargo/env; cargo install cargo-when
 
 	sed \
 		-e "s#@OS_VERSION@#${OS_VERSION:-}#g" \
-		-e "s#@ARCH@#${ARCH}#g" \
 		-e "s#@INSTALL_RUST@#${install_rust//$'\n'/\\n}#g" \
 		-e "s#@SET_PROXY@#${set_proxy:-}#g" \
 		Dockerfile.in > Dockerfile

From 89ba9cdeb0b62b35eb8e29750cfbc1b3a99d0cf0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <ffidencio@nvidia.com>
Date: Mon, 20 Jul 2026 19:53:53 +0200
Subject: [PATCH 7/9] kata-ctl: drop cross-rs cross-build tooling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

kata-ctl shipped a Cross.toml and a "Cross-builds" README section
describing how to cross compile the tool for other architectures with
cross-rs (installing foreign-arch libssl via dpkg multiarch pre-build
hooks).

This is not exercised on our side: kata-ctl is built on native-arch
runners. Remove Cross.toml and the cross-build documentation.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>
---
 src/tools/kata-ctl/Cross.toml | 12 ------------
 src/tools/kata-ctl/README.md  | 31 -------------------------------
 2 files changed, 43 deletions(-)
 delete mode 100644 src/tools/kata-ctl/Cross.toml

diff --git a/src/tools/kata-ctl/Cross.toml b/src/tools/kata-ctl/Cross.toml
deleted file mode 100644
index 88f18e96e5..0000000000
--- a/src/tools/kata-ctl/Cross.toml
+++ /dev/null
@@ -1,12 +0,0 @@
-[target.s390x-unknown-linux-gnu]
-pre-build = ["dpkg --add-architecture s390x && apt-get update && apt-get install -y libssl-dev:s390x"]
-
-[target.aarch64-unknown-linux-musl]
-pre-build = ["dpkg --add-architecture arm64 && apt-get update && apt-get install -y libssl-dev:arm64"]
-
-[target.x86-64-unknown-linux-musl]
-pre-build = ["dpkg --add-architecture amd64 && apt-get update && apt-get install -y libssl-dev:amd64"]
-
-# Powerpc compile seems to be broken, due to `ring` crate not being supported on powerpc.
-[target.powerpc64le-unknown-linux-gnu]
-pre-build = ["dpkg --add-architecture ppc64le && apt-get update && apt-get install -y libssl-dev:ppc64le"]
diff --git a/src/tools/kata-ctl/README.md b/src/tools/kata-ctl/README.md
index 4bc7c1ca51..0041454d8d 100644
--- a/src/tools/kata-ctl/README.md
+++ b/src/tools/kata-ctl/README.md
@@ -53,37 +53,6 @@ For a usage statement, run:
 $ kata-ctl --help
 ```
 
-## Cross-builds
-
-For developers that want to build and test the `kata-ctl` tool on various architectures,
-the makefile included does have support for that. This would however, require installing
-the cross compile toolchain for the target architecture on the host along with required libraries.
-
-[Cross](https://github.com/cross-rs/cross) is an open source tool that offers zero setup
-cross compile and requires no changes to the system installation for cross-compiling
-rust binaries. It makes use of docker containers for cross-compilation.
-
-You can install cross with:
-```
-cargo install -f cross
-```
-
-`cross` relies on `docker` or `podman`. For dependencies take a look at: https://github.com/cross-rs/cross#dependencies
-
-There is an included `cross` configuration file [Cross.yaml](./Cross.toml) that can be used
-to compile `kata-ctl` for various targets. This configuration helps install required
-dependencies inside a docker container.
-
-For example, to compile for target `s390x-unknown-linux-gnu` included in `Cross.yaml` simple run:
-```
-cross build --target=s390x-unknown-linux-gnu
-```
-
-You may also need to add the target on your host system prior to the above step as:
-```
-rustup target add s390x-unknown-linux-gnu
-```
-
 ## Documentation for included tools:
 | Component | Description |
 | [`log-parser`](src/log_parser) | Tool that aid in analyzing logs from the kata runtime. |

From fdcfe6222f1b2bad7b1faf87e90f670026eff051 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <ffidencio@nvidia.com>
Date: Mon, 20 Jul 2026 19:54:21 +0200
Subject: [PATCH 8/9] ci: drop cross-compilation from install_libseccomp.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the requested ARCH differed from the host, install_libseccomp.sh
selected a <arch>-linux-gnu-gcc cross compiler and passed --host=<arch> to
configure to cross-build the static libseccomp.

This is not exercised on our side: libseccomp is always built for the host
arch. Build it natively without the cross CC or --host.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>
---
 ci/install_libseccomp.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/ci/install_libseccomp.sh b/ci/install_libseccomp.sh
index e9032c5640..a8ecf2998f 100755
--- a/ci/install_libseccomp.sh
+++ b/ci/install_libseccomp.sh
@@ -111,8 +111,7 @@ build_and_install_libseccomp() {
 	curl -sLO "${libseccomp_tarball_url}"
 	tar -xf "${libseccomp_tarball}"
 	pushd "libseccomp-${libseccomp_version}"
-	[[ "${arch}" == $(uname -m) ]] && cc_name="" || cc_name="${arch}-linux-gnu-gcc"
-	CC=${cc_name} ./configure --prefix="${libseccomp_install_dir}" CFLAGS="${cflags}" --enable-static --host="${arch}"
+	./configure --prefix="${libseccomp_install_dir}" CFLAGS="${cflags}" --enable-static
 	make
 	make install
 	popd

From 59057cb2a6a9cd1d2c0b3b9b81f405b4ea8dbaf8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <ffidencio@nvidia.com>
Date: Mon, 20 Jul 2026 19:56:16 +0200
Subject: [PATCH 9/9] docs: drop cross-build instructions for SE boot image
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The SE VMs how-to documented building the s390x boot image on an x86_64
host via CROSS_BUILD=true TARGET_ARCH=s390x ARCH=s390x.

Cross builds are not exercised on our side and the supporting code has been
removed, so drop this instruction; the SE boot image is built on a native
s390x host.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>
---
 docs/how-to/how-to-run-kata-containers-with-SE-VMs.md | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/docs/how-to/how-to-run-kata-containers-with-SE-VMs.md b/docs/how-to/how-to-run-kata-containers-with-SE-VMs.md
index 5771c7a0da..5856d69e47 100644
--- a/docs/how-to/how-to-run-kata-containers-with-SE-VMs.md
+++ b/docs/how-to/how-to-run-kata-containers-with-SE-VMs.md
@@ -205,12 +205,6 @@ $ export INTERMEDIATE_CA_CERT_PATH=$HOME/certificates/DigiCertCA.crt
 $ export HOST_KEY_CRL_PATH=$HOME/certificates/ibm-z-host-key-gen2.crl
 ```
 
-To build an image on the `x86_64` platform, set the following environment variables together with the variables above before `make boot-image-se-tarball`:
-
-```
-CROSS_BUILD=true TARGET_ARCH=s390x ARCH=s390x
-```
-
 ### Adjust the configuration
 
 There still remains an opportunity to fine-tune the configuration file: