add nvidia-dual-branch image feature

CHANGELOG.md

@@ -7,7 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-[unreleased]: https://github.com/bottlerocket-os/twoliter/compare/v0.24.2...HEAD
+### Added
+* Add a new image feature, `nvidia-dual-branch`, which when enabled builds an image supporting multiple NVIDIA driver branches
+
+### Breaking Changes
+* Bump the kit metadata version to `v4`. This release cannot consume kits built with older Twoliter versions, and its kits cannot be consumed by them
 
 ## [0.24.2] - 2026-09-08
 

tools/buildsys/src/manifest.rs

@@ -1260,6 +1260,7 @@ pub enum ImageFeature {
     EncryptedStorage,
     EphemeralEncryptionKeys,
     StandaloneImage,
+    NvidiaDualBranch,
 }
 
 const EXPERIMENTAL_IMAGE_FEATURES: &[&ImageFeature] = &[
@@ -1528,6 +1529,7 @@ impl TryFrom<String> for ImageFeature {
             "encrypted-storage" => Ok(ImageFeature::EncryptedStorage),
             "ephemeral-encryption-keys" => Ok(ImageFeature::EphemeralEncryptionKeys),
             "standalone-image" => Ok(ImageFeature::StandaloneImage),
+            "nvidia-dual-branch" => Ok(ImageFeature::NvidiaDualBranch),
             _ => error::ParseImageFeatureSnafu { what: s }.fail()?,
         }
     }
@@ -1574,6 +1576,7 @@ impl fmt::Display for ImageFeature {
             ImageFeature::EncryptedStorage => write!(f, "ENCRYPTED_STORAGE"),
             ImageFeature::EphemeralEncryptionKeys => write!(f, "EPHEMERAL_ENCRYPTION_KEYS"),
             ImageFeature::StandaloneImage => write!(f, "STANDALONE_IMAGE"),
+            ImageFeature::NvidiaDualBranch => write!(f, "NVIDIA_DUAL_BRANCH"),
         }
     }
 }

twoliter/embedded/build.Dockerfile

@@ -227,6 +227,7 @@ ARG EROFS_ROOT_PARTITION
 ARG IN_PLACE_UPDATES
 ARG HOST_CONTAINERS
 ARG FIPS
+ARG NVIDIA_DUAL_BRANCH
 ARG EXTERNAL_KMOD_DEVELOPMENT
 ARG ENCRYPTED_STORAGE
 ARG EPHEMERAL_ENCRYPTION_KEYS
@@ -249,6 +250,7 @@ RUN \
    && echo "%bcond_without $(V=${VARIANT_FAMILY,,}; echo ${V//-/_})_family" >> "${RPM_BCONDS}" \
    && echo "%bcond_without $(V=${VARIANT_FLAVOR:-no}; V=${V,,}; echo ${V//-/_})_flavor" >> "${RPM_BCONDS}" \
    && echo -e -n "${FIPS:+%bcond_without fips\n}" >> "${RPM_BCONDS}" \
+   && echo -e -n "${NVIDIA_DUAL_BRANCH:+%bcond_without nvidia_dual_branch\n}" >> "${RPM_BCONDS}" \
    && echo -e -n "${UEFI_SECURE_BOOT:+%bcond_without uefi_secure_boot\n}" >> "${RPM_BCONDS}" \
    && echo -e -n "${XFS_DATA_PARTITION:+%bcond_without xfs_data_partition\n}" >> "${RPM_BCONDS}" \
    && echo -e -n "${EROFS_ROOT_PARTITION:+%bcond_without erofs_root_partition\n}" >> "${RPM_BCONDS}" \

twoliter/embedded/metadata.spec

@@ -54,6 +54,12 @@ Provides: %{_cross_os}image-feature(fips)
 Provides: %{_cross_os}image-feature(no-fips)
 %endif
 
+%if %{with nvidia_dual_branch}
+Provides: %{_cross_os}image-feature(nvidia-dual-branch)
+%else
+Provides: %{_cross_os}image-feature(no-nvidia-dual-branch)
+%endif
+
 %if %{with external_kmod_development}
 Provides: %{_cross_os}image-feature(external-kmod-development)
 %else

twoliter/embedded/rpm2kit

@@ -125,7 +125,7 @@ CONFIG="$(jq --compact-output <<EOF
     "WorkingDir": "/",
     "OnBuild": null,
     "Labels": {
-      "dev.bottlerocket.kit.v3": "${METADATA}"
+      "dev.bottlerocket.kit.v4": "${METADATA}"
     }
   },
   "created": "${TIMESTAMP}",

twoliter/src/compatibility.rs

@@ -10,4 +10,4 @@ pub const SUPPORTED_TWOLITER_LOCK_SCHEMA_VERSION: u32 = 2;
 ///
 /// The kit metadata version is embeddeded in a label within the OCI image's configuration blob,
 /// with the value stored at that label including the kit metadata itself.
-pub const SUPPORTED_KIT_METADATA_VERSION: &str = "v3";
+pub const SUPPORTED_KIT_METADATA_VERSION: &str = "v4";