Skip to content

Update NVAT and stop building from source #1798

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fitzthum wants to merge 2 commits into
base: main
Choose a base branch
from
+31 −50
Open

Update NVAT and stop building from source #1798

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3de9834
nvidia: bump libnvat and nvidia-attestation-sdk
fitzthum Oct 9, 2026
e537439
nvidia: don't build libnvat from source for extension images
fitzthum Oct 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/actions/install-nvat-sdk/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ inputs:
attestation-agent/attester/Cargo.toml (see that crate's GitHub release
notes for its corresponding libnvat/libnvat-dev version).
required: false
default: "1.2.2"
default: "2.0.0"
cuda-keyring-version:
description: cuda-keyring package version used to register NVIDIA's apt repository
required: false
Expand Down
15 changes: 3 additions & 12 deletions .github/workflows/coco-extension-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,9 +54,8 @@ env:
PAUSE_IMAGE_REPO: docker://registry.k8s.io/pause
PAUSE_IMAGE_VERSION: "3.10"
UMOCI_VERSION: v0.6.0
# The C++ SDK is linked by the Rust bindings, so the two have to be the same
# release; the crate pin below is the single source of truth for both.
NVAT_CARGO_MANIFEST: attestation-agent/attester/Cargo.toml
# Keep in sync with the version specified in install-nvat-sdk/action.yml.
NVAT_VERSION: "2.0.0"
Comment on lines +57 to +58

@Xynnn007 Xynnn007 Oct 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There was once a cmment for this that can we align the version with Cargo.toml's than re-defining it?


jobs:
build:
Expand Down Expand Up @@ -145,15 +144,7 @@ jobs:
# The NVIDIA SDK is only consumed by the x86_64 attestation-agent-nv
# variant; an empty version skips it entirely.
nvat_version=""
if [ "${ARCH}" = "x86_64" ]; then
nvat_version="$(sed -n \
's/^nv-attestation-sdk[[:space:]]*=.*tag[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' \
"${NVAT_CARGO_MANIFEST}")"
[ -n "${nvat_version}" ] || {
echo "failed to read the nv-attestation-sdk tag from ${NVAT_CARGO_MANIFEST}" >&2
exit 1
}
fi
[ "${ARCH}" = "x86_64" ] && nvat_version="${NVAT_VERSION}"

# Building the environment (notably the NVIDIA SDK) costs more than
# building the payload itself, so reuse a published one whenever the
Expand Down
12 changes: 6 additions & 6 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion attestation-agent/attester/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ rstest.workspace = true
# When bumping this tag, check the crate's release notes on GitHub for its
# corresponding libnvat/libnvat-dev version, and update the `version` input
# default in .github/actions/install-nvat-sdk/action.yml to match.
nv-attestation-sdk = { git = "https://github.com/NVIDIA/attestation-sdk", tag = "2026.06.09", optional = true }
nv-attestation-sdk = { git = "https://github.com/NVIDIA/attestation-sdk", tag = "2026.10.02", optional = true }

[[bin]]
name = "evidence_getter"
Expand Down
37 changes: 15 additions & 22 deletions tools/coco-extension/Dockerfile.builder
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,11 @@
ARG UBUNTU_VERSION=26.04
FROM ubuntu:${UBUNTU_VERSION}

ARG UBUNTU_VERSION
ARG RUST_TOOLCHAIN
ARG UMOCI_VERSION=v0.6.0
ARG TARGETARCH
ARG CUDA_KEYRING_VERSION=1.1-1

ENV DEBIAN_FRONTEND=noninteractive
ENV RUSTUP_HOME=/opt/rustup
Expand All @@ -32,12 +34,10 @@ RUN apt-get update && \
binutils \
ca-certificates \
clang \
cmake \
cryptsetup-bin \
curl \
g++ \
gcc \
git \
libclang-dev \
libdevmapper-dev \
libssl-dev \
Expand All @@ -56,30 +56,23 @@ RUN apt-get update && \
"https://github.com/opencontainers/umoci/releases/download/${UMOCI_VERSION}/umoci.linux.${TARGETARCH}" && \
chmod +x /usr/local/bin/umoci

# nv-attestation-sdk-sys looks for the C header at /usr/include/nvat.h, but
# cmake installs it under /usr/local/include, hence the symlink below.
# NVAT_VERSION: libnvat/libnvat-dev version; keep in sync with install-nvat-sdk/action.yml.
ARG NVAT_VERSION
RUN if [ "$(uname -m)" = "x86_64" ] && [ -n "${NVAT_VERSION}" ]; then \
apt-get update && \
apt-get install -y --no-install-recommends \
build-essential \
libcurl4-openssl-dev \
libxml2-dev \
libxmlsec1-dev \
zlib1g-dev && \
case "${UBUNTU_VERSION}" in \
24.04) nv_repo=ubuntu2404 ;; \
26.04) nv_repo=ubuntu2604 ;; \
*) echo "no NVIDIA apt repository known for Ubuntu ${UBUNTU_VERSION}" >&2; exit 1 ;; \
esac && \
tmpdir="$(mktemp -d)" && \
git clone https://github.com/NVIDIA/attestation-sdk "${tmpdir}/attestation-sdk" && \
git -C "${tmpdir}/attestation-sdk" fetch --depth=1 origin "${NVAT_VERSION}" && \
git -C "${tmpdir}/attestation-sdk" checkout FETCH_HEAD && \
cmake -S "${tmpdir}/attestation-sdk/nv-attestation-sdk-cpp" \
-B "${tmpdir}/attestation-sdk/nv-attestation-sdk-cpp/build" \
-DCMAKE_BUILD_TYPE=Release && \
cmake --build "${tmpdir}/attestation-sdk/nv-attestation-sdk-cpp/build" --parallel "$(nproc)" && \
cmake --install "${tmpdir}/attestation-sdk/nv-attestation-sdk-cpp/build" && \
mkdir -p /usr/include && \
ln -sf /usr/local/include/nvat.h /usr/include/nvat.h && \
ldconfig && \
curl -fsSL -o "${tmpdir}/cuda-keyring.deb" \
"https://developer.download.nvidia.com/compute/cuda/repos/${nv_repo}/x86_64/cuda-keyring_${CUDA_KEYRING_VERSION}_all.deb" && \
dpkg -i "${tmpdir}/cuda-keyring.deb" && \
rm -rf "${tmpdir}" && \
apt-get update && \
apt-get install -y --no-install-recommends \
"libnvat=${NVAT_VERSION}*" \
"libnvat-dev=${NVAT_VERSION}*" && \
apt-get clean && rm -rf /var/lib/apt/lists/*; \
fi

Expand Down
13 changes: 5 additions & 8 deletions tools/coco-extension/assemble-rootfs.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ NV_ATTESTER="${NV_ATTESTER:-${ATTESTER},nvidia-attester}"
# Optional: set ENABLE_KBS=false to build without cc_kbc. Default is enabled.
INCLUDE_NVIDIA_ATTESTER="${INCLUDE_NVIDIA_ATTESTER:-auto}"
INCLUDE_CRYPTSETUP="${INCLUDE_CRYPTSETUP:-yes}"
NVAT_LIB_DIR="${NVAT_LIB_DIR:-/usr/local/lib}"
NVAT_LIB_DIR="${NVAT_LIB_DIR:-/usr/lib/x86_64-linux-gnu}"

# TEE_PLATFORM is intentionally left empty so the top-level Makefile does not
# override the ATTESTER value passed in the environment. This mirrors kata's
Expand Down Expand Up @@ -137,8 +137,9 @@ build_nvidia_attestation_agent() {
*) die "unsupported INCLUDE_NVIDIA_ATTESTER=${INCLUDE_NVIDIA_ATTESTER}" ;;
esac

[[ -e "${NVAT_LIB_DIR}/libnvat.so" || -e "${NVAT_LIB_DIR}/libnvat.so.1" ]] || \
die "NVIDIA SDK libnvat.so not found in ${NVAT_LIB_DIR}"
local libnvat
libnvat="$(find "${NVAT_LIB_DIR}" -maxdepth 1 -name 'libnvat.so*' | sort | head -n 1)"
[[ -n "${libnvat}" ]] || die "NVIDIA SDK libnvat.so not found in ${NVAT_LIB_DIR}"

info "Building NVIDIA attester variant (ATTESTER=${NV_ATTESTER} LIBC=${LIBC})"
rm -f "${build_dir}/attestation-agent"
Expand All @@ -160,11 +161,7 @@ build_nvidia_attestation_agent() {
mkdir -p "${ROOTFS_DIR}/usr/local/lib"
cp -a "${NVAT_LIB_DIR}"/libnvat.so* "${ROOTFS_DIR}/usr/local/lib/"

local libnvat
libnvat="$(find "${NVAT_LIB_DIR}" -maxdepth 1 -name 'libnvat.so*' | sort | head -n 1)"
if [[ -n "${libnvat}" ]]; then
copy_non_glibc_library_closure "${libnvat}"
fi
copy_non_glibc_library_closure "${libnvat}"
}

install_cryptsetup() {
Expand Down
Loading