From bcb4c601dfe3987953d23ffbe41f214cd2558066 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Mon, 15 Jun 2026 15:16:36 +0200 Subject: [PATCH] fixup! build: ship CoCo addon component manifest in addon image --- .../kata-deploy/local-build/kata-deploy-binaries.sh | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh index 8cf337f914..b50ccd8475 100755 --- a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh +++ b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh @@ -687,7 +687,14 @@ id = "confidential-data-hub" level = 2 path = "usr/local/bin/confidential-data-hub" config = "${cdh_config_path}" -env = { OCICRYPT_KEYPROVIDER_CONFIG = "${ocicrypt_config_path}" } +# CDH's secure_mount shells out (by PATH lookup) to cryptsetup for encrypted +# storage and to mke2fs/mkfs.ext4/dd for the filesystem. cryptsetup is CoCo-only +# and ships in this addon under usr/sbin (see +# build-static-coco-guest-components.sh); the plain mkfs/dd tooling lives in the +# base-nvidia image's /sbin and /bin. The agent launches CDH with +# PATH=/bin:/sbin:/usr/bin:/usr/sbin, but setting any env here overrides it +# wholesale, so prepend the addon's usr/sbin and restore the base dirs. +env = { OCICRYPT_KEYPROVIDER_CONFIG = "${ocicrypt_config_path}", PATH = "${addon_root}/usr/sbin:/bin:/sbin:/usr/bin:/usr/sbin" } wait_socket = "${cdh_socket}" timeout_secs = "${launch_process_timeout}"