From 1c5882a502b141fca16d8fcd26936103c6091285 Mon Sep 17 00:00:00 2001
From: Gerald Pinder <gmpinder@gmail.com>
Date: Sat, 20 Dec 2025 14:20:53 -0500
Subject: [PATCH] Update how we install nvidia

---
 files/scripts/installnvidia.sh | 102 +++++++++++++++++++++++++++++++++
 recipes/base/nvidia.yml        |   9 +--
 2 files changed, 107 insertions(+), 4 deletions(-)
 create mode 100644 files/scripts/installnvidia.sh

diff --git a/files/scripts/installnvidia.sh b/files/scripts/installnvidia.sh
new file mode 100644
index 0000000..3111453
--- /dev/null
+++ b/files/scripts/installnvidia.sh
@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+
+# Copyright 2025 Universal Blue
+# Copyright 2025 The Secureblue Authors
+# Copyright 2025 The BlueBuild Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed under the License is
+# distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and limitations under the License.
+
+set -oue pipefail
+
+mkdir -p /var/tmp
+chmod 1777 /var/tmp
+
+##################################
+# Repository setup
+##################################
+KERNEL_VERSION="$(rpm -q "kernel" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
+RELEASE="$(rpm -E '%fedora.%_arch')"
+if [[ "$IMAGE_NAME" == *"open"* ]]; then
+    curl -fLsS --retry 5 -o /etc/yum.repos.d/negativo17-fedora-nvidia.repo https://negativo17.org/repos/fedora-nvidia.repo
+    sed -i '/^enabled=1/a\priority=90' /etc/yum.repos.d/negativo17-fedora-nvidia.repo
+else 
+    curl -fLsS --retry 5 -o /etc/yum.repos.d/fedora-nvidia-580.repo https://negativo17.org/repos/fedora-nvidia-580.repo
+    sed -i '/^enabled=1/a\priority=90' /etc/yum.repos.d/fedora-nvidia-580.repo
+
+    if [ -f /etc/yum.repos.d/fedora-multimedia.repo ]; then
+        sed -i 's/^enabled=.*/enabled=0/' /etc/yum.repos.d/fedora-multimedia.repo
+    fi
+fi
+
+#################################
+# Kernel module
+#################################
+dnf install -y --setopt=install_weak_deps=False "kernel-devel-matched-$(rpm -q 'kernel' --queryformat '%{VERSION}')"
+
+dnf install -y --setopt=install_weak_deps=False akmods gcc-c++
+cp /usr/sbin/akmodsbuild /usr/sbin/akmodsbuild.backup
+# TODO remove this when fixed upstream
+sed -i '/if \[\[ -w \/var \]\] ; then/,/fi/d' /usr/sbin/akmodsbuild
+dnf install -y --setopt=install_weak_deps=False nvidia-kmod-common nvidia-modprobe
+mv /usr/sbin/akmodsbuild.backup /usr/sbin/akmodsbuild
+
+echo "Installing kmod..."
+akmods --force --kernels "${KERNEL_VERSION}" --kmod "nvidia"
+
+# Depends on word splitting
+# shellcheck disable=SC2086
+modinfo /usr/lib/modules/${KERNEL_VERSION}/extra/nvidia/nvidia{,-drm,-modeset,-peermem,-uvm}.ko.xz > /dev/null || \
+    (cat "/var/cache/akmods/nvidia/*.failed.log" && exit 1)
+
+# View license information
+# Depends on word splitting
+# shellcheck disable=SC2086
+modinfo -l /usr/lib/modules/${KERNEL_VERSION}/extra/nvidia/nvidia{,-drm,-modeset,-peermem,-uvm}.ko.xz
+
+./signmodules.sh "nvidia"
+
+##################################
+# Extra packages
+##################################
+nvidia_packages_list=(\
+    'nvidia-driver' \
+    'nvidia-persistenced' \
+    'nvidia-settings' \
+    'nvidia-driver-cuda' \
+    'nvidia-container-toolkit' \
+    'libnvidia-fbc' \
+    'libva-nvidia-driver' \
+)
+
+curl -L https://nvidia.github.io/libnvidia-container/stable/rpm/nvidia-container-toolkit.repo \
+    -o /etc/yum.repos.d/nvidia-container-toolkit.repo
+sed -i 's/^gpgcheck=0/gpgcheck=1/' /etc/yum.repos.d/nvidia-container-toolkit.repo
+sed -i 's/^enabled=0.*/enabled=1/' /etc/yum.repos.d/nvidia-container-toolkit.repo
+
+dnf -y --setopt=install_weak_deps=False install "${nvidia_packages_list[@]}"
+
+curl -L https://raw.githubusercontent.com/NVIDIA/dgx-selinux/master/bin/RHEL9/nvidia-container.pp \
+    -o nvidia-container.pp
+semodule -i nvidia-container.pp
+
+##################################
+# Cleanup
+##################################
+dnf -y remove akmod-nvidia akmods kernel-devel kernel-headers
+
+if [ -f /etc/yum.repos.d/fedora-multimedia.repo ]; then
+    sed -i 's/^enabled=.*/enabled=1/' /etc/yum.repos.d/fedora-multimedia.repo
+fi
+
+rm -f nvidia-container.pp
+rm -f /etc/yum.repos.d/nvidia-container-toolkit.repo
+rm -f /etc/yum.repos.d/fedora-nvidia-580.repo
+rm -f /etc/yum.repos.d/negativo17-fedora-nvidia.repo
diff --git a/recipes/base/nvidia.yml b/recipes/base/nvidia.yml
index f03fa71..c4fe3b8 100644
--- a/recipes/base/nvidia.yml
+++ b/recipes/base/nvidia.yml
@@ -11,10 +11,11 @@ modules:
           type: file
           destination: /tmp/certs/private_key.priv
     scripts:
-      - installnvidiakmod.sh
-  - type: script
-    scripts:
-      - installnvidiapackages.sh
+      - installnvidia.sh
+      # - installnvidiakmod.sh
+  # - type: script
+  #   scripts:
+  #     - installnvidiapackages.sh
   - type: files
     files:
       - source: nvidia