fix(nvidia): enforce single-repo invariant against negativo17 skew (#313)

The first scheduled weekly NVIDIA build (run 29184241364) failed because
fedora-multimedia (negativo17) published nvidia-driver 610.43.03 while
NVIDIA's CUDA repo was still at 610.43.02: dnf --best mixed the two
sources and the transaction was unsolvable. ADR 0009's 'kmod + userland
from the single NVIDIA repo' invariant was documented but not enforced.

Exclude *nvidia* from fedora-multimedia for the install transaction so
the whole driver family always resolves from the CUDA repo, whichever
repo is ahead on a given day.

Author: daniel-g-carrasco

build_files/custom-kernel/install.sh

@@ -331,13 +331,19 @@ if [[ "${ENABLE_NVIDIA:-0}" == "1" ]]; then
     || { err "no NVIDIA CUDA repo for fedora${_verid}/${_arch} (or fetch failed)"; exit 1; }
 
   # kmod source + matching userland from the SINGLE NVIDIA repo, one
-  # transaction → no kmod/userland version skew. The RPM %post runs a dkms
-  # autoinstall against the HOST kernel that fails harmlessly (no host
-  # kernel-devel in the build); coreos relies on the same, and we rebuild
-  # explicitly with -k below. (If a future package makes that %post fatal to
-  # the dnf transaction, add --setopt=tsflags=noscripts here AND an explicit
-  # `dkms add -m nvidia -v "$DRIVER_VERSION"` before the build.)
+  # transaction → no kmod/userland version skew. The excludepkgs setopt
+  # ENFORCES that: the base image's fedora-multimedia (negativo17) also
+  # ships nvidia-driver, and whenever it publishes ahead of NVIDIA's CUDA
+  # repo (610.43.03 vs .02, run 29184241364, 2026-07-12) dnf --best mixes
+  # the two sources and the transaction is unsolvable. The RPM %post runs
+  # a dkms autoinstall against the HOST kernel that fails harmlessly (no
+  # host kernel-devel in the build); coreos relies on the same, and we
+  # rebuild explicitly with -k below. (If a future package makes that
+  # %post fatal to the dnf transaction, add --setopt=tsflags=noscripts
+  # here AND an explicit `dkms add -m nvidia -v "$DRIVER_VERSION"` before
+  # the build.)
   dnf -y install --no-docs --best --setopt=install_weak_deps=False \
+    --setopt='fedora-multimedia.excludepkgs=*nvidia*' \
     kmod-nvidia-open-dkms nvidia-driver nvidia-driver-libs nvidia-driver-cuda nvidia-persistenced nvidia-modprobe \
     || { err "nvidia upstream kmod + userland install failed"; exit 1; }
 

docs/spec/adr/0009-nvidia-variant.md

@@ -158,3 +158,15 @@ the `modinfo -F signer` CN-match warning) are **superseded** by v1: userland
 left entirely to the existing loop (no CN gate). Status stays **experimental**
 — rollout steps 2 (build green in CI) and 3 (real-hardware runtime validation)
 are unchanged and still gate `:stable-nvidia`.
+
+## Update 2026-07-12 — single-repo invariant enforced against negativo17
+
+First scheduled weekly run (29184241364) failed: the base image's
+fedora-multimedia repo (negativo17) also ships `nvidia-driver`, and it had
+published 610.43.03 while NVIDIA's CUDA repo was still at .02. With `--best`,
+dnf tried to take the userland from negativo17 and the kmod from CUDA and the
+transaction became unsolvable. The "single NVIDIA repo, one transaction"
+invariant above was stated but not enforced; it now is, via
+`--setopt='fedora-multimedia.excludepkgs=*nvidia*'` on the install, so the
+whole nvidia family always resolves from the CUDA repo regardless of which
+repo happens to be ahead on a given day.