From ee8931f171c79199fb4771b92be3b7fd58d3718c Mon Sep 17 00:00:00 2001
From: Mikhail Chusavitin <mchusavitin@mchusmbp.local>
Date: Wed, 25 Mar 2026 12:26:59 +0300
Subject: [PATCH] fix(iso): pin ISO kernel to same ABI as compiled NVIDIA
 modules

Export detected DEBIAN_KERNEL_ABI as BEE_KERNEL_ABI from build.sh so
auto/config can pin linux-packages to the exact versioned package
(e.g. linux-image-6.1.0-31 + flavour amd64 = linux-image-6.1.0-31-amd64).
This prevents nvidia.ko vermagic mismatch if the linux-image-amd64
meta-package is updated between build start and lb build chroot step.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 iso/builder/auto/config | 11 ++++++++++-
 iso/builder/build.sh    |  5 +++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/iso/builder/auto/config b/iso/builder/auto/config
index cc44ceb..50ba931 100755
--- a/iso/builder/auto/config
+++ b/iso/builder/auto/config
@@ -7,6 +7,15 @@ set -e
 
 . "$(dirname "$0")/../VERSIONS"
 
+# Pin the exact kernel ABI detected by build.sh so the ISO kernel matches
+# the kernel headers used to compile NVIDIA modules. Falls back to meta-package
+# when lb config is run manually without the environment variable.
+if [ -n "${BEE_KERNEL_ABI:-}" ] && [ "${BEE_KERNEL_ABI}" != "auto" ]; then
+    LB_LINUX_PACKAGES="linux-image-${BEE_KERNEL_ABI}"
+else
+    LB_LINUX_PACKAGES="linux-image"
+fi
+
 lb config noauto \
     --distribution bookworm \
     --architectures amd64 \
@@ -19,7 +28,7 @@ lb config noauto \
     --mirror-binary "https://deb.debian.org/debian" \
     --security true \
     --linux-flavours "amd64" \
-    --linux-packages "linux-image" \
+    --linux-packages "${LB_LINUX_PACKAGES}" \
     --memtest none \
     --iso-volume "EASY-BEE" \
     --iso-application "EASY-BEE" \
diff --git a/iso/builder/build.sh b/iso/builder/build.sh
index e79fbe1..211eba6 100755
--- a/iso/builder/build.sh
+++ b/iso/builder/build.sh
@@ -51,6 +51,11 @@ if [ -z "${DEBIAN_KERNEL_ABI}" ] || [ "${DEBIAN_KERNEL_ABI}" = "auto" ]; then
     echo "=== kernel ABI: ${DEBIAN_KERNEL_ABI} ==="
 fi
 
+# Export detected ABI so that auto/config can pin the exact kernel package
+# (prevents NVIDIA module/kernel mismatch if linux-image-amd64 meta-package
+# gets updated between build.sh start and lb build chroot step)
+export BEE_KERNEL_ABI="${DEBIAN_KERNEL_ABI}"
+
 KVER="${DEBIAN_KERNEL_ABI}-amd64"
 if [ ! -d "/usr/src/linux-headers-${KVER}" ]; then
     echo "=== installing linux-headers-${KVER} (kernel updated since image build) ==="