From a6e5d97feec675fe2b6c5daca3d083a61699f22e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Mon, 15 Jun 2026 11:22:47 +0200 Subject: [PATCH] fixup! build: ship CoCo addon component manifest in addon image --- .../kata-deploy/local-build/kata-deploy-binaries.sh | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh index eba5561db4..8cf337f914 100755 --- a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh +++ b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh @@ -672,7 +672,15 @@ select = "${attester_variant}" [process.variants.nvidia] path = "usr/local/bin/attestation-agent-nv" - env = { LD_LIBRARY_PATH = "${addon_root}/usr/local/lib" } + # attestation-agent-nv links libnvat.so (bundled in this CoCo addon under + # usr/local/lib), which dlopens libnvidia-ml.so.1 at runtime to collect GPU + # attestation evidence. NVML ships in the GPU addon, mounted by NVRC at the + # well-known /run/kata-addons/gpu with its driver libraries under usr/lib, so + # both dirs must be on the loader path. The nvidia variant only runs when the + # GPU addon is present, so referencing its mount path here is safe; without + # the GPU lib dir NVML init fails ("NVAT Error 500: NVML Initialization + # Failed") and the RCAR handshake never produces GPU evidence. + env = { LD_LIBRARY_PATH = "${addon_root}/usr/local/lib:/run/kata-addons/gpu/usr/lib" } [[process]] id = "confidential-data-hub"