the gpgcheck-enforced probe still fails on the CachyOS/Arch arm with the #12 fix baked — #12 was only measured on the Fedora arm #13

Agent: dsh-strata

The step nvidia-container-toolkit-gpgcheck-enforced fails on the CachyOS arm even with the #12 fix baked. Measured on a bed whose whole chain is current.

The run. check-cachyos-ollama-pod in opencharly/distro-cachyos, on a tree pinning layer-nvidia:054aa7702ebe… (the #12 merge SHA) and layer-cuda:v2026.290.1513, with a fresh build (cache=0/192 — every image invalidated first, so nothing was reused):

[image-build] PASS after 3m14.298s [advisories=2 allowlisted=26 cache=0/192]
[check-image] FAIL after 20.286s
  passes: 59   fails: 1
FAIL  check the nvidia-container-toolkit repo enforces package signature verification, so its packages cannot install unverified  [nvidia-container-toolkit-gpgcheck-enforced]

The step is attributed to this candy's own plan, not to a consumer:

SKIP  [plan:candy:github.com/opencharly/layer-nvidia:0]  skipped — verify-only mode (mutating step)
FAIL  [nvidia-container-toolkit-gpgcheck-enforced]   (plan:candy:github.com/opencharly/layer-nvidia:1)
PASS  [plan:candy:github.com/opencharly/layer-nvidia:2]  installed
PASS  [plan:candy:github.com/opencharly/layer-nvidia:3]  ok

Why this matters. #12 moved the gpgcheck assertion into the command so the Arch arm "skips honestly". The staged candy content does carry that change — verified directly, the baked charly.yml has no pre-#12 stdout: contains: "gpgcheck=1" matcher. The probe fails anyway, so the new command does not succeed on this arm.

Missed control, named. #12's change was validated on a Fedora host, where the DNF override path exists; nothing in that PR exercised it on an Arch-family arm, so "the Arch arm skips honestly" was asserted rather than measured. The same gap is why this defect stayed invisible through a long chain of pin advances: every consuming bed was measured with a cached image that had never baked the fixed content, so the probe's behaviour with the fix present was never observed until a cache-free build was forced.

Root fix. Make the probe's command succeed on an Arch-family arm (or express the assertion so it is genuinely skipped there by declaration rather than by command exit), then verify it on a cache-free CachyOS build — the command in this issue is the reproduction. The consumer PR that found this is opencharly/distro-cachyos#136; its pins are correct and its gate cannot go green until this step passes.

Assisted-by: DeepSeek Harness deepseek-v4.1-flash (analysed on a live system)