feat: switch to akmods repo provided nvidia kmod (#146)

* feat: switch to akmods repo provided nvidia kmod

This removes the akmod build process for nvidia drivers and the build
of ublue-os-nvidia-addons from this repo, and instead installs said
RPMs which are now built in the ublue-os/akmods repo.

* chore(ci): fix forgotten change of Containerfile name

* chore(ci): remove driver 530 references from workflow

* chore(ci): use versioned akmods-nvidia images instead of akmods common

.github/workflows/build.yml

@@ -9,163 +9,8 @@ env:
   IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
 
 jobs:
-  build-akmods:
-    name: Build akmods package
-    runs-on: ubuntu-22.04
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-    strategy:
-      fail-fast: false
-      matrix:
-        major_version: [37, 38]
-        driver_version: [470, 535]
-        exclude:
-          - driver_version: 530
-            major_version: 38
-          - driver_version: 530
-            major_version: 37
-    steps:
-      # Checkout push-to-registry action GitHub repository
-      - name: Checkout Push to Registry action
-        uses: actions/checkout@v3
-
-      - name: Matrix Variables
-        run: |
-            REPO=${{ github.repository }}
-            echo "IMAGE_NAME=akmods-${REPO##*/}" >> $GITHUB_ENV
-      - name: Generate tags
-        id: generate-tags
-        shell: bash
-        run: |
-          # Generate a timestamp for creating an image version history
-          TIMESTAMP="$(date +%Y%m%d)"
-          VARIANT="${{ matrix.major_version }}-${{ matrix.driver_version }}"
-
-          COMMIT_TAGS=()
-          BUILD_TAGS=()
-
-          # Have tags for tracking builds during pull request
-          SHA_SHORT="${GITHUB_SHA::7}"
-          COMMIT_TAGS+=("pr-${{ github.event.number }}-${VARIANT}")
-          COMMIT_TAGS+=("${SHA_SHORT}-${VARIANT}")
-
-          BUILD_TAGS=("${VARIANT}" "${VARIANT}-${TIMESTAMP}")
-
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-              echo "Generated the following commit tags: "
-              for TAG in "${COMMIT_TAGS[@]}"; do
-                  echo "${TAG}"
-              done
-
-              alias_tags=("${COMMIT_TAGS[@]}")
-          else
-              alias_tags=("${BUILD_TAGS[@]}")
-          fi
-
-          echo "Generated the following build tags: "
-          for TAG in "${BUILD_TAGS[@]}"; do
-              echo "${TAG}"
-          done
-
-          echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT
-
-      - name: Retrieve akmods signing key
-        run: |
-          mkdir -p certs
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-              echo "Using test signing key"
-          else
-              echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key.priv
-          fi
-          # DEBUG: get character count of key
-          wc -c certs/private_key.priv
-
-      # Build metadata
-      - name: Image Metadata
-        uses: docker/metadata-action@v4
-        id: meta
-        with:
-          images: |
-            ${{ env.IMAGE_NAME }}
-          labels: |
-            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
-            org.opencontainers.image.description=ublue-os ${{ env.IMAGE_NAME }} with akmods-nvidia packages pre-built
-            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md
-            io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/1728152?s=200&v=4
-
-      # Build image using Buildah action
-      - name: Build Image
-        id: build_image
-        uses: redhat-actions/buildah-build@v2
-        with:
-          containerfiles: |
-            ./build.Containerfile
-          image: ${{ env.IMAGE_NAME }}
-          tags: |
-            ${{ steps.generate-tags.outputs.alias_tags }}
-          build-args: |
-            IMAGE_NAME=base
-            FEDORA_MAJOR_VERSION=${{ matrix.major_version }}
-            NVIDIA_MAJOR_VERSION=${{ matrix.driver_version }}
-          labels: ${{ steps.meta.outputs.labels }}
-          oci: false
-
-      # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
-      # https://github.com/macbre/push-to-ghcr/issues/12
-      - name: Lowercase Registry
-        id: registry_case
-        uses: ASzc/change-string-case-action@v5
-        with:
-          string: ${{ env.IMAGE_REGISTRY }}
-
-      # Push the image to GHCR (Image Registry)
-      - name: Push To GHCR
-        uses: redhat-actions/push-to-registry@v2
-        if: github.event_name != 'pull_request'
-        id: push
-        env:
-          REGISTRY_USER: ${{ github.actor }}
-          REGISTRY_PASSWORD: ${{ github.token }}
-        with:
-          image: ${{ steps.build_image.outputs.image }}
-          tags: ${{ steps.build_image.outputs.tags }}
-          registry: ${{ steps.registry_case.outputs.lowercase }}
-          username: ${{ env.REGISTRY_USER }}
-          password: ${{ env.REGISTRY_PASSWORD }}
-          extra-args: |
-            --disable-content-trust
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
-        if: github.event_name != 'pull_request'
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      # Sign container
-      - uses: sigstore/cosign-installer@v3.1.1
-        if: github.event_name != 'pull_request'
-
-      - name: Sign container image
-        if: github.event_name != 'pull_request'
-        run: |
-          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS}
-        env:
-          TAGS: ${{ steps.push.outputs.digest }}
-          COSIGN_EXPERIMENTAL: false
-          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
-
-      - name: Echo outputs
-        if: github.event_name != 'pull_request'
-        run: |
-          echo "${{ toJSON(steps.push.outputs) }}"
-
   push-ghcr:
     name: Build and push image
-    needs: build-akmods
     runs-on: ubuntu-22.04
     permissions:
       contents: read
@@ -191,10 +36,6 @@ jobs:
           # When F38 is added, sericea will automatically be built too
           - image_name: sericea
             major_version: 37
-          - driver_version: 530
-            major_version: 38
-          - driver_version: 530
-            major_version: 37
     steps:
       # Checkout push-to-registry action GitHub repository
       - name: Checkout Push to Registry action
@@ -253,10 +94,8 @@ jobs:
               done
 
               alias_tags=("${COMMIT_TAGS[@]}")
-              echo "AKMODS_VERSION=pr-${{ github.event.number }}-${{ matrix.major_version }}" >> $GITHUB_ENV
           else
               alias_tags=("${BUILD_TAGS[@]}")
-              echo "AKMODS_VERSION=${{ matrix.major_version }}" >> $GITHUB_ENV
           fi
 
           echo "Generated the following build tags: "
@@ -266,17 +105,6 @@ jobs:
 
           echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT
 
-      - name: Retrieve akmods signing key
-        run: |
-          mkdir -p certs
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-              echo "Using test signing key"
-          else
-              echo "${{ secrets.AKMOD_PRIVKEY }}" > certs/private_key.priv
-          fi
-          # DEBUG: get character count of key
-          wc -c certs/private_key.priv
-
       - name: Get current version
         id: labels
         run: |
@@ -303,13 +131,12 @@ jobs:
         uses: redhat-actions/buildah-build@v2
         with:
           containerfiles: |
-            ./install.Containerfile
+            ./Containerfile
           image: ${{ env.IMAGE_NAME }}
           tags: |
             ${{ steps.generate-tags.outputs.alias_tags }}
           build-args: |
             IMAGE_NAME=${{ matrix.image_name }}
-            AKMODS_VERSION=${{ env.AKMODS_VERSION }}
             FEDORA_MAJOR_VERSION=${{ matrix.major_version }}
             NVIDIA_MAJOR_VERSION=${{ matrix.driver_version }}
           labels: ${{ steps.meta.outputs.labels }}

Containerfile

@@ -0,0 +1,20 @@
+ARG IMAGE_NAME="${IMAGE_NAME:-silverblue}"
+ARG BASE_IMAGE="ghcr.io/ublue-os/${IMAGE_NAME}-main"
+ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-37}"
+
+FROM ${BASE_IMAGE}:${FEDORA_MAJOR_VERSION}
+
+ARG IMAGE_NAME="${IMAGE_NAME:-silverblue}"
+ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-37}"
+ARG NVIDIA_MAJOR_VERSION="${NVIDIA_MAJOR_VERSION:-535}"
+
+COPY install.sh /tmp/install.sh
+COPY post-install.sh /tmp/post-install.sh
+
+COPY --from=ghcr.io/ublue-os/akmods-nvidia:${FEDORA_MAJOR_VERSION}-${NVIDIA_MAJOR_VERSION} /rpms /tmp/akmods-rpms
+
+RUN /tmp/install.sh
+RUN /tmp/post-install.sh
+RUN rm -rf /tmp/* /var/*
+RUN ostree container commit
+RUN mkdir -p /var/tmp && chmod -R 1777 /tmp /var/tmp