From 9c9b48f38602177112d7e896eced64cbd9ce33b2 Mon Sep 17 00:00:00 2001 From: Zvonko Kaiser Date: Fri, 24 Jul 2026 02:42:30 +0000 Subject: [PATCH 1/3] nvgpu: include CUDA/tools APT repo in rootfs cache key The CUDA and tools repositories from versions.yaml feed setup_apt_repositories() in the rootfs chroot. Overriding them (e.g. to point at a local CUDA repository installer) must invalidate the cached rootfs artefact - today the oras cache still hits and silently serves a rootfs built from the default repositories. Add a get_latest_nvidia_repo_version helper (sha256 over the arch-specific cuda/tools repo url+pkg) and fold it into the cache key of the nvidia-gpu, nvidia-gpu-extension and nvidia-gpu-confidential image/initrd variants. The driver-agnostic nvidia base image is left untouched. Signed-off-by: Zvonko Kaiser --- .../local-build/kata-deploy-binaries.sh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh index f212554ad5..2f450eb924 100755 --- a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh +++ b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh @@ -433,6 +433,20 @@ get_latest_nvidia_nvat_version() { get_from_kata_deps ".externals.nvidia.nvat.version" } +# The CUDA and tools APT repositories feed setup_apt_repositories() in the +# rootfs chroot; overriding them in versions.yaml (e.g. to point at an +# internal release-candidate mirror) must invalidate the cached rootfs. +get_latest_nvidia_repo_version() { + local arch + arch="$(uname -m)" + + echo "$(get_from_kata_deps ".externals.nvidia.cuda.repo.${arch}.url")" \ + "$(get_from_kata_deps ".externals.nvidia.cuda.repo.${arch}.pkg")" \ + "$(get_from_kata_deps ".externals.nvidia.tools.repo.${arch}.url")" \ + "$(get_from_kata_deps ".externals.nvidia.tools.repo.${arch}.pkg")" \ + | sha256sum | cut -c1-9 +} + #Install guest image install_image() { local variant="${1:-}" @@ -476,6 +490,7 @@ install_image() { latest_artefact+="-$(get_latest_nvidia_ctk_version)" latest_artefact+="-$(get_latest_nvidia_nvrc_version)" latest_artefact+="-$(get_latest_nvidia_nvat_version)" + latest_artefact+="-$(get_latest_nvidia_repo_version)" else latest_artefact+="-$(get_latest_kernel_artefact_and_builder_image_version)" fi @@ -495,6 +510,7 @@ install_image() { latest_artefact+="-$(get_latest_nvidia_driver_version)" latest_artefact+="-$(get_latest_nvidia_ctk_version)" latest_artefact+="-$(get_latest_nvidia_nvrc_version)" + latest_artefact+="-$(get_latest_nvidia_repo_version)" fi if [[ "${variant}" == "nvidia" ]]; then @@ -788,6 +804,7 @@ install_initrd() { latest_artefact+="-$(get_latest_nvidia_ctk_version)" latest_artefact+="-$(get_latest_nvidia_nvrc_version)" latest_artefact+="-$(get_latest_nvidia_nvat_version)" + latest_artefact+="-$(get_latest_nvidia_repo_version)" else latest_artefact+="-$(get_latest_kernel_artefact_and_builder_image_version)" fi @@ -801,6 +818,7 @@ install_initrd() { latest_artefact+="-$(get_latest_nvidia_driver_version)" latest_artefact+="-$(get_latest_nvidia_ctk_version)" latest_artefact+="-$(get_latest_nvidia_nvrc_version)" + latest_artefact+="-$(get_latest_nvidia_repo_version)" fi latest_builder_image="" From 3c2d198b89bfc37d5d81fcc5ebe937c55a2315db Mon Sep 17 00:00:00 2001 From: Zvonko Kaiser Date: Fri, 24 Jul 2026 03:14:24 +0000 Subject: [PATCH 2/3] nvgpu: fix local CUDA repo keyring copy - [[ -e ]] does not glob The keyring path for a local CUDA repository was stored as a glob string and tested with [[ -e ]], which performs no pathname expansion, so the keyring was never copied to /usr/share/keyrings and apt failed with "repository is not signed" (NO_PUBKEY). Iterate over the glob instead - nullglob is already set, so no match means no iteration. Only the local-repo flow (e.g. an internal release-candidate kitpick installer) hits this path; the public flow uses the remote keyring package and never exercises it. Signed-off-by: Zvonko Kaiser --- .../osbuilder/rootfs-builder/nvidia/nvidia_chroot.sh | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/tools/osbuilder/rootfs-builder/nvidia/nvidia_chroot.sh b/tools/osbuilder/rootfs-builder/nvidia/nvidia_chroot.sh index 3b17408fe9..7ae03659bd 100644 --- a/tools/osbuilder/rootfs-builder/nvidia/nvidia_chroot.sh +++ b/tools/osbuilder/rootfs-builder/nvidia/nvidia_chroot.sh @@ -124,10 +124,13 @@ setup_apt_repositories() { curl -fsSL -O "${cuda_repo_url}/${cuda_repo_pkg}" dpkg -i "${cuda_repo_pkg}" && rm -f "${cuda_repo_pkg}" - # Copy keyring if local repo was installed - keyring="/var/cuda-repo-*-local/cuda-*-keyring.gpg" - # shellcheck disable=SC2128 # Intentional: expect exactly one match - [[ -e "${keyring}" ]] && cp "${keyring}" /usr/share/keyrings/ + # A local repo ships its signing key inside its own tree, but apt only + # trusts keys under /usr/share/keyrings - without this copy `apt update` + # rejects the repo as unsigned. A loop because [[ -e ]] would test the + # glob literally (nullglob: remote-repo flow matches nothing, skips). + for keyring in /var/cuda-repo-*-local/cuda-*-keyring.gpg; do + cp "${keyring}" /usr/share/keyrings/ + done # Set priorities: CUDA repos highest, Ubuntu non-driver next, Ubuntu blocked for driver packages cat <<-CHROOT_EOF > /etc/apt/preferences.d/nvidia-priority From efd49dc5078d825320a90ee2418efa81d48416e4 Mon Sep 17 00:00:00 2001 From: Zvonko Kaiser Date: Fri, 24 Jul 2026 03:24:06 +0000 Subject: [PATCH 3/3] nvgpu: stage install_yq.sh atomically to fix parallel-build race Every parallel target invokes kata-deploy-copy-yq-installer.sh on the host to stage the docker build context. On a fresh clone the destination does not exist, so coreutils cp opens it with O_CREAT|O_EXCL and concurrent copies race - the losers fail with "cp: cannot create regular file ...: File exists" (observed as a spurious ovmf-sev build failure in CI). Copy to a private temp file and rename into place: rename is atomic, never returns EEXIST, and every writer produces identical content. The copy stays per-invocation so each target still works standalone. Signed-off-by: Zvonko Kaiser --- .../local-build/kata-deploy-copy-yq-installer.sh | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-copy-yq-installer.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-copy-yq-installer.sh index 600a5239bd..974b6a5404 100755 --- a/tools/packaging/kata-deploy/local-build/kata-deploy-copy-yq-installer.sh +++ b/tools/packaging/kata-deploy/local-build/kata-deploy-copy-yq-installer.sh @@ -14,4 +14,14 @@ set -o errtrace script_dir=$(dirname "$(readlink -f "$0")") install_yq_script_path="${script_dir}/../../../../ci/install_yq.sh" -cp "${install_yq_script_path}" "${script_dir}/dockerbuild/install_yq.sh" +# Parallel targets each stage the docker build context on the host. When the +# destination does not exist yet (fresh clone), coreutils cp opens it with +# O_CREAT|O_EXCL, so concurrent copies race and the losers fail with +# "File exists". Write to a private temp file and rename: rename is atomic, +# never returns EEXIST, and all writers produce identical content. +tmp="$(mktemp "${script_dir}/dockerbuild/.install_yq.sh.XXXXXX")" +cp "${install_yq_script_path}" "${tmp}" +# mktemp creates 0600 and cp into an existing file keeps it; the docker +# build RUNs this script, so it must stay executable like the source. +chmod --reference="${install_yq_script_path}" "${tmp}" +mv -f "${tmp}" "${script_dir}/dockerbuild/install_yq.sh"