Use repo-bundled nvflash automatically (no system install needed)

cxlib.py

@@ -102,6 +102,23 @@ def which(name):
     return shutil.which(name)
 
 
+def find_nvflash():
+    """nvflash binary: repo-bundled copy first (no system install needed), then PATH."""
+    import platform
+    arch_map = {"x86_64": "x64", "amd64": "x64", "aarch64": "aarch64",
+                "ppc64le": "ppc64", "ppc64": "ppc64", "i686": "x86", "i386": "x86"}
+    arch = arch_map.get(platform.machine(), "x64")
+    candidates = [
+        *sorted(SCRIPT_DIR.glob(f"nvflash_*_linux/{arch}/nvflash")),
+        *sorted(SCRIPT_DIR.glob("nvflash_*_linux/x64/nvflash")),
+        SCRIPT_DIR / "nvflash",
+    ]
+    for p in candidates:
+        if p.is_file() and os.access(p, os.X_OK):
+            return str(p)
+    return which("nvflash")
+
+
 def have_root():
     return os.geteuid() == 0 or bool(shutil.which("sudo"))
 
@@ -159,7 +176,7 @@ TOOL_CHECKS = {
     "lspci": ("critical", "PCIe checks (package: pciutils)"),
     "setpci": ("critical", "link generation probe (package: pciutils)"),
     "nvidia-smi": ("critical-if-card-present", "GPU state / cmpunlocker verify"),
-    "nvflash": ("critical", "VBIOS backup + serial (not packaged: manual install)"),
+    "nvflash": ("critical", "VBIOS backup + serial (bundled in repo, or on PATH)"),
     "dmesg": ("optional", "kernel log scrape"),
     "journalctl": ("optional", "kernel log scrape fallback"),
     "vulkaninfo": ("optional", "vulkan presence (package: vulkan-tools)"),
@@ -230,7 +247,7 @@ def preflight(auto_install=True, do_clone=True):
     info(f"OS: {report['os']['pretty']}")
 
     for tool, (level, why) in TOOL_CHECKS.items():
-        path = which(tool)
+        path = find_nvflash() if tool == "nvflash" else which(tool)
         report["tools"][tool] = {"found": bool(path), "path": path, "level": level, "why": why}
         if not path:
             (critical_missing if level.startswith("critical") else optional_missing).append(tool)
@@ -300,10 +317,12 @@ def preflight(auto_install=True, do_clone=True):
             mark = f"{C.YELLOW}missing (optional){C.RESET}"
         print(f"   {t:<14} {mark}  {C.DIM}{st['why']}{C.RESET}")
 
-    if not which("nvflash"):
-        warn("nvflash missing - VBIOS backup will fall back to sysfs ROM, serial to manual entry")
-        print("     Download Linux x64 nvflash from https://www.nvidia.com/en-us/drivers/nvflash/")
-        print("     and pass --nvflash /path/to/nvflash, or place it on PATH.")
+    if not find_nvflash():
+        warn("nvflash not found - VBIOS backup will fall back to sysfs ROM, serial to manual entry")
+        print("     Bundle it in the repo: nvflash_<version>_linux/x64/nvflash (chmod +x),")
+        print("     or pass --nvflash /path/to/nvflash, or place it on PATH.")
+    else:
+        info(f"nvflash: {find_nvflash()}")
     if not which("nvidia-smi"):
         warn("nvidia-smi missing - cmpunlocker verify will be skipped (install nvidia-open driver)")
     if not report["root"]:
@@ -512,7 +531,9 @@ def dmesg_capture(bdf):
 # ---------------------------------------------------------------- BIOS / serial
 
 def nvflash_bin(args):
-    return args.nvflash if getattr(args, "nvflash", None) else which("nvflash")
+    if getattr(args, "nvflash", None):
+        return args.nvflash
+    return find_nvflash()
 
 
 def nvflash_list(nf):