max / alloy

alloy-nvidia: a derived aarch64 image carrying the open NVIDIA module Mechanism decided in alloy 2a382a75 (Max chose option c). The shipped Containerfile is not touched. Derived rather than a build ARG, and the reason is structural. The kernel and the module come from the same digest by construction, so the kernel-lock failure the ARG option had is impossible here: there is no build-time assertion to write, and no way for refresh-base-digests.sh to ship a machine that boots with no GPU and no signal, because moving the base digest cannot reach an image built from the old one. It also keeps the shipped image out of it -- an aarch64 NVIDIA card is not a role almost all Alloy users have, which under wiki alloy-selection-discipline means the shipped image should not serve one by default. The digest is the input, so build-nvidia.sh resolves it and prints it rather than deriving from a tag: two runs a week apart from a tag would produce modules for different kernels while claiming the same provenance, which is the drift the Containerfile's base pins exist to stop. The kernel is read out of /usr/lib/modules rather than written down. There is exactly one and it came with the digest, so a number spelled by hand is the same drift from the other end. NOT kmod-nvidia, which exists prebuilt for aarch64 and is built against RPM Fusion's kernel rather than the image's. Installing it would put a module in the image whose vermagic does not match the kernel beside it -- the exact failure this shape exists to make impossible -- and it would look installed. Three things the build asserts rather than assumes, each because its absence is invisible until a machine boots with no display: that a module was produced, that its vermagic is this image's kernel, and that its licence is Dual MIT/GPL. The last is what tells the open module from the proprietary one, and Blackwell GB203 does not run on the proprietary one. akmods at build time, not on the machine: a bootc filesystem is immutable and its kernel only changes by taking a new image, so there is no later moment for the module to be built in. dracut and depmod follow, or the module ships present and unloadable early enough to drive the console. nouveau is blacklisted in the image rather than by a kernel argument, so the fact travels with the image that needs it.