fix(nix): pin tmachine runtime on macOS

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

architecture/build.md

@@ -278,6 +278,8 @@ The Nix test guest harness under `nix/test-guest` boots native-architecture clou
 through QEMU for package, release, and E2E validation. A prepared cache entry is
 captured after the exact ordered Ansible configuration list and before
 test-specific packages, copied binaries, forwarded ports, or commands.
+On macOS, the test guest and tmachine paths use the same pinned QEMU and OVMF
+package set so the hypervisor and firmware remain compatible.
 
 Prepared disks are flattened, sanitized QCOW2 images. The local cache keeps them
 read-only and each test receives a fresh writable overlay and cloud-init

flake.nix

@@ -45,6 +45,7 @@
           overlays = [ (import rust-overlay) ];
         };
         testGuestPkgs = import nixpkgs-test-guest { inherit system; };
+        tmachineRuntimePkgs = if pkgs.stdenv.hostPlatform.isDarwin then testGuestPkgs else pkgs;
         commonDevShellPackages =
           with pkgs;
           [
@@ -121,7 +122,11 @@
           qemuPkgs = testGuestPkgs;
           firmwarePkgs = testGuestPkgs;
         };
-        testMachines = import ./tests/config.nix { inherit pkgs toolchains; };
+        testMachines = import ./tests/config.nix {
+          inherit pkgs toolchains;
+          qemuPkgs = tmachineRuntimePkgs;
+          firmwarePkgs = tmachineRuntimePkgs;
+        };
         artifacts = pkgs.callPackage ./tests/artifacts.nix { inherit rustToolchain toolchains; };
       in
       {

tests/config.nix

@@ -1,14 +1,24 @@
 # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-{ pkgs, toolchains }:
+{
+  pkgs,
+  toolchains,
+  qemuPkgs ? pkgs,
+  firmwarePkgs ? pkgs,
+}:
 
 let
   isAarch64 = pkgs.stdenv.hostPlatform.isAarch64;
   gnuTarget = toolchains.${if isAarch64 then "aarch64-gnu" else "x86_64-gnu"}.target;
   muslTarget = toolchains.${if isAarch64 then "aarch64-musl" else "x86_64-musl"}.target;
-  images = import ./images.nix { inherit pkgs; };
-  tmachine = pkgs.callPackage ./tmachine { };
+  images = import ./images.nix {
+    inherit pkgs qemuPkgs firmwarePkgs;
+  };
+  tmachine = pkgs.callPackage ./tmachine {
+    OVMF = firmwarePkgs.OVMF;
+  };
+  qemu = qemuPkgs.qemu.override { hostCpuOnly = true; };
   config = (pkgs.formats.yaml { }).generate "tmachine-config.yaml" {
     machines = [
       {
@@ -98,7 +108,7 @@ let
   runner = pkgs.writeShellApplication {
     name = "tmachine";
     runtimeInputs = [
-      pkgs.qemu
+      qemu
       pkgs.ansible
       pkgs.sshpass
     ];

tests/images.nix

@@ -1,14 +1,18 @@
 # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-{ pkgs }:
+{
+  pkgs,
+  qemuPkgs ? pkgs,
+  firmwarePkgs ? pkgs,
+}:
 
 let
   isAarch64 = pkgs.stdenv.hostPlatform.isAarch64;
   isDarwin = pkgs.stdenv.hostPlatform.isDarwin;
   architecture = if isAarch64 then "aarch64" else "x86_64";
   ubuntuArchitecture = if isAarch64 then "arm64" else "amd64";
-  qemu = pkgs.qemu.override { hostCpuOnly = true; };
+  qemu = qemuPkgs.qemu.override { hostCpuOnly = true; };
   qemuBinary =
     if isAarch64 then "${qemu}/bin/qemu-system-aarch64" else "${qemu}/bin/qemu-system-x86_64";
   machine = if isAarch64 then "virt" else "q35";
@@ -35,7 +39,7 @@ let
   ]
   ++ pkgs.lib.optionals isAarch64 [
     "-drive"
-    "if=pflash,format=raw,readonly=on,file=${pkgs.OVMF.firmware}"
+    "if=pflash,format=raw,readonly=on,file=${firmwarePkgs.OVMF.firmware}"
     "-drive"
     "if=pflash,format=raw,file=firmware-vars.fd"
   ]
@@ -72,7 +76,7 @@ let
           16G
 
         ${pkgs.lib.optionalString isAarch64 ''
-          cp ${pkgs.OVMF.variables} firmware-vars.fd
+          cp ${firmwarePkgs.OVMF.variables} firmware-vars.fd
           chmod 0600 firmware-vars.fd
         ''}