add versionlocks

install.sh

@@ -74,13 +74,24 @@ if [ "${KERNEL_FLAVOR}" = "asus" ]; then
     echo "install.sh: post-install for: ${KERNEL_FLAVOR}"
 elif [ "${KERNEL_FLAVOR}" = "surface" ]; then
     echo "install.sh: post-install for: ${KERNEL_FLAVOR}"
-    if grep -q "silverblue" <<< "${IMAGE_NAME}"; then
-      systemctl enable dconf-update
+    if grep -q "silverblue" <<<"${IMAGE_NAME}"; then
+        systemctl enable dconf-update
     fi
     systemctl enable fprintd
     systemctl enable surface-hardware-setup
 else
     echo "install.sh: post-install for unexpected KERNEL_FLAVOR: ${KERNEL_FLAVOR}"
 fi
 
+# Kernel Lock
+if [[ ! -x /usr/bin/dnf5 ]]; then
+    rpm-ostree install --idempotent dnf5 dnf5-plugins
+fi
+if [[ "${IMAGE_NAME}" =~ nvidia ]]; then
+    dnf5 versionlock add kernel kernel-core kernel-modules kernel-modules-core kernel-modules-extra
+fi
+if [[ "${IMAGE_NAME}" =~ surface-nvidia ]]; then
+    dnf5 versionlock add kernel-surface kernel-surface-core kernel-surface-modules kernel-surface-modules-core kernel-surface-modules-extra
+fi
+
 /ctx/build-initramfs.sh