From 76a4ec7bb3d9a9a84ba332a3ae13fa39bab75f4c Mon Sep 17 00:00:00 2001 From: Aswin Kumar Date: Sun, 25 Oct 2026 23:30:56 +0530 Subject: [PATCH 1/2] build(vm): re-pin both rootfs images for Go 1.26.10 The publish from main (run 40216091795) stopped at the guest build: Alpine moved go to 1.26.10 and libcurl to 8.23.0, so semantic-fs-daemon no longer built to its pin. New pins from update_pins runs 40217496771 (aarch64) and 40217494503 (x86_64). --- docs/design/microvm-linux.md | 4 ++++ docs/local-vm.md | 6 +++--- packages/cli/src/vm/pins.ts | 8 ++++---- packages/vmm/guest/agent-init.aarch64.apk.lock | 2 +- packages/vmm/guest/agent-init.x86_64.apk.lock | 2 +- packages/vmm/guest/berth-init.aarch64.apk.lock | 2 +- packages/vmm/guest/berth-init.x86_64.apk.lock | 2 +- packages/vmm/guest/semantic-fs.aarch64.apk.lock | 2 +- packages/vmm/guest/semantic-fs.x86_64.apk.lock | 2 +- packages/vmm/kernel/aarch64.apk.lock | 2 +- packages/vmm/kernel/x86_64.apk.lock | 2 +- packages/vmm/rootfs/manifest-aarch64.toml | 8 ++++---- packages/vmm/rootfs/manifest-x86_64.toml | 8 ++++---- 13 files changed, 27 insertions(+), 23 deletions(-) diff --git a/docs/design/microvm-linux.md b/docs/design/microvm-linux.md index cfd3bf51..f7f7c83e 100644 --- a/docs/design/microvm-linux.md +++ b/docs/design/microvm-linux.md @@ -144,6 +144,10 @@ Each is its own branch, tested before the next. one run in three. Both manifests now pin agent-init to the fix (`0204e8f2…`), which also carries main's libc, tokio and sqlite bumps. `update_pins` runs 40198606357 (aarch64) and 40198603422 (x86_64) give rootfs `e6017262…` (aarch64) and `0c623b43…` (x86_64); the kernels are unchanged. +- **Re-pinned for Go 1.26.10, 2026-10-25.** The first publish from main (run 40216091795) stopped at the + guest build: Alpine had moved go to 1.26.10 a few hours after the re-pin above, so semantic-fs-daemon no + longer built to its pin on either architecture. `update_pins` runs 40217496771 (aarch64) and 40217494503 + (x86_64) give rootfs `dfb5f6b0…` and `af4f3fc0…`. Open problem 10 again. - **Linux arm64 booted**, 2026-10-24, on a nested-KVM Lima VM (Ubuntu 24.04, Linux 6.8, VZ on an M4) with the published linux-arm64 berth-vmm `a3cf2a09…` and its libkrun, rootfs `62f96e1b…`: host sandbox Landlock ABI 4 with TCP rules and seccomp; `e2e.mjs` single 18/18, multi 17/17, enforce 12/12, stdio 3/3, diff --git a/docs/local-vm.md b/docs/local-vm.md index f4cae695..09ce9426 100644 --- a/docs/local-vm.md +++ b/docs/local-vm.md @@ -65,11 +65,11 @@ By default, from the GitHub release that [`.github/workflows/vm-artifacts.yml`]( | File | Asset | sha256 (this CLI) | Size | |---|---|---|---| | `~/.berth/vm/kernel/sha256//Image` | `Image-` | `8f79e8dae97ebc0ab8fcdc4ad209bb025ec967be82c713503e0612cfdd340ec8` | 23,668,744 B | -| `~/.berth/vm/rootfs/rootfs-.erofs` | `rootfs-.erofs` | `e60172628d1bbc5d36f3df44d81e4b9cf79b02fd87a974621d15e51dec570522` | 108,072,960 B | +| `~/.berth/vm/rootfs/rootfs-.erofs` | `rootfs-.erofs` | `dfb5f6b030ca59884f2466783961169dd2f4d6fb71ff08d30028f67eff29331f` | 108,072,960 B | | `~/.berth/vm/bin/berth-vmm` | `berth-vmm-darwin-arm64-`, `berth-vmm-linux-arm64-` | `VMM_PINS` in `packages/cli/src/vm/pins.ts` | about 700 KB (macOS), 2.7 MB (Linux) | | `~/.berth/vm/bin/libkrun.1.19.6.dylib`, `libkrun.so.1.19.6` | `libkrun-darwin-arm64-.dylib`, `libkrun-linux-arm64-.so` | `LIBKRUN_PINS` in the same file | about 4.7 MB | -That is `https://github.com/Ash20pk/BerthOS/releases/download/vm-artifacts-8f79e8da-e6017262/`. The x86_64 one is `vm-artifacts-10d4b54c-0c623b43`: kernel `10d4b54c0896668a93f9d26d0a701aac4a14ce813f3ed4d3b4d26e50d7b7b8d1` (an ELF `vmlinux`, 27,928,992 B), rootfs `0c623b43a2c2852fd156d1ea6d4f00a8612143299ec7381cf2d1516607d0a9f6` (108,904,448 B), and `berth-vmm-linux-x64-` with `libkrun-linux-x64-.so`. CI rebuilds each architecture's kernel and rootfs from source on GitHub's Linux runners of that architecture, and publishes the release only if they match the pins bit for bit. The release also carries `SHA256SUMS`, each rootfs's input record, berth-vmm's build record, and the kernel's GPL sources (the exact linux and libkrunfw tarballs, the config delta, the resolved config and the build script; see `SOURCES.md` there). +That is `https://github.com/Ash20pk/BerthOS/releases/download/vm-artifacts-8f79e8da-dfb5f6b0/`. The x86_64 one is `vm-artifacts-10d4b54c-af4f3fc0`: kernel `10d4b54c0896668a93f9d26d0a701aac4a14ce813f3ed4d3b4d26e50d7b7b8d1` (an ELF `vmlinux`, 27,928,992 B), rootfs `af4f3fc0be1429cf324ffc77157c1c2359c641078675c1d6d0d82b746259ac69` (108,904,448 B), and `berth-vmm-linux-x64-` with `libkrun-linux-x64-.so`. CI rebuilds each architecture's kernel and rootfs from source on GitHub's Linux runners of that architecture, and publishes the release only if they match the pins bit for bit. The release also carries `SHA256SUMS`, each rootfs's input record, berth-vmm's build record, and the kernel's GPL sources (the exact linux and libkrunfw tarballs, the config delta, the resolved config and the build script; see `SOURCES.md` there). berth-vmm and its libkrun are downloaded only when the CLI pins their sha256 for your platform (macOS arm64, Linux arm64 and Linux x86_64). A build from CI can't be pinned until CI has built it, so a CLI released before the first artifacts release has no pin, and says so. Then build berth-vmm and pass `--vmm`, or download it by hand (below). @@ -95,7 +95,7 @@ If the kernel and rootfs aren't installed, `berth dev --runtime vm` installs the #### Verifying by hand ```bash -tag=vm-artifacts-8f79e8da-e6017262 +tag=vm-artifacts-8f79e8da-dfb5f6b0 gh release download "$tag" -R Ash20pk/BerthOS -p 'Image-*' -p 'rootfs-*.erofs' -p 'berth-vmm-darwin-arm64-*' -p 'libkrun-darwin-arm64-*' -p SHA256SUMS shasum -a 256 -c --ignore-missing SHA256SUMS # each asset against the list shasum -a 256 Image-* rootfs-*.erofs # and against the pins above, which are also in diff --git a/packages/cli/src/vm/pins.ts b/packages/cli/src/vm/pins.ts index 9d6f8cfe..878a686e 100644 --- a/packages/cli/src/vm/pins.ts +++ b/packages/cli/src/vm/pins.ts @@ -40,11 +40,11 @@ export interface GuestPins { export const GUEST_PINS: Partial> = { aarch64: { kernel: { sha256: "8f79e8dae97ebc0ab8fcdc4ad209bb025ec967be82c713503e0612cfdd340ec8", size: 23668744, linux: "6.12.109", configSha256: "e3f33c2bd4bffa16e52a066c325967e4bde091f20063e6eb5b81e8a2efac4dc8" }, - rootfs: { sha256: "e60172628d1bbc5d36f3df44d81e4b9cf79b02fd87a974621d15e51dec570522", size: 108072960 }, + rootfs: { sha256: "dfb5f6b030ca59884f2466783961169dd2f4d6fb71ff08d30028f67eff29331f", size: 108072960 }, }, x86_64: { kernel: { sha256: "10d4b54c0896668a93f9d26d0a701aac4a14ce813f3ed4d3b4d26e50d7b7b8d1", size: 27928992, linux: "6.12.109", configSha256: "6e0fd31c75cd563f8bf650765504d97989316f70e9bbb333fb0230db78fe4283" }, - rootfs: { sha256: "0c623b43a2c2852fd156d1ea6d4f00a8612143299ec7381cf2d1516607d0a9f6", size: 108904448 }, + rootfs: { sha256: "af4f3fc0be1429cf324ffc77157c1c2359c641078675c1d6d0d82b746259ac69", size: 108904448 }, }, }; @@ -121,8 +121,8 @@ export type VmmPlatform = "darwin-arm64" | "linux-arm64" | "linux-x64"; * `berth vm install` refuses any other bytes, and clears macOS's quarantine * attribute only on a file that matched. * - * All three are from the per-architecture releases vm-artifacts-8f79e8da-e6017262 - * (aarch64: darwin-arm64, linux-arm64) and vm-artifacts-10d4b54c-0c623b43 + * All three are from the per-architecture releases vm-artifacts-8f79e8da-dfb5f6b0 + * (aarch64: darwin-arm64, linux-arm64) and vm-artifacts-10d4b54c-af4f3fc0 * (x86_64: linux-x64). Run 40200731376 built all three; it also rebuilt both * rootfs images to their pins and passed the x86_64 e2e under KVM. */ diff --git a/packages/vmm/guest/agent-init.aarch64.apk.lock b/packages/vmm/guest/agent-init.aarch64.apk.lock index 985d50ab..2010ef27 100644 --- a/packages/vmm/guest/agent-init.aarch64.apk.lock +++ b/packages/vmm/guest/agent-init.aarch64.apk.lock @@ -25,7 +25,7 @@ libatomic-15.2.0-r5 libblkid-2.42.3-r1 libcom_err-1.47.4-r0 libcrypto3-3.5.8-r0 -libcurl-8.22.0-r0 +libcurl-8.23.0-r0 libeconf-0.8.3-r0 libffi-3.5.2-r1 libgcc-15.2.0-r5 diff --git a/packages/vmm/guest/agent-init.x86_64.apk.lock b/packages/vmm/guest/agent-init.x86_64.apk.lock index 985d50ab..2010ef27 100644 --- a/packages/vmm/guest/agent-init.x86_64.apk.lock +++ b/packages/vmm/guest/agent-init.x86_64.apk.lock @@ -25,7 +25,7 @@ libatomic-15.2.0-r5 libblkid-2.42.3-r1 libcom_err-1.47.4-r0 libcrypto3-3.5.8-r0 -libcurl-8.22.0-r0 +libcurl-8.23.0-r0 libeconf-0.8.3-r0 libffi-3.5.2-r1 libgcc-15.2.0-r5 diff --git a/packages/vmm/guest/berth-init.aarch64.apk.lock b/packages/vmm/guest/berth-init.aarch64.apk.lock index 4222d6c4..6c5e22f2 100644 --- a/packages/vmm/guest/berth-init.aarch64.apk.lock +++ b/packages/vmm/guest/berth-init.aarch64.apk.lock @@ -131,7 +131,7 @@ libatomic-15.2.0-r5 libblkid-2.42.3-r1 libcom_err-1.47.4-r0 libcrypto3-3.5.8-r0 -libcurl-8.22.0-r0 +libcurl-8.23.0-r0 libeconf-0.8.3-r0 libffi-3.5.2-r1 libgcc-15.2.0-r5 diff --git a/packages/vmm/guest/berth-init.x86_64.apk.lock b/packages/vmm/guest/berth-init.x86_64.apk.lock index 4222d6c4..6c5e22f2 100644 --- a/packages/vmm/guest/berth-init.x86_64.apk.lock +++ b/packages/vmm/guest/berth-init.x86_64.apk.lock @@ -131,7 +131,7 @@ libatomic-15.2.0-r5 libblkid-2.42.3-r1 libcom_err-1.47.4-r0 libcrypto3-3.5.8-r0 -libcurl-8.22.0-r0 +libcurl-8.23.0-r0 libeconf-0.8.3-r0 libffi-3.5.2-r1 libgcc-15.2.0-r5 diff --git a/packages/vmm/guest/semantic-fs.aarch64.apk.lock b/packages/vmm/guest/semantic-fs.aarch64.apk.lock index c7f389af..c718ccb9 100644 --- a/packages/vmm/guest/semantic-fs.aarch64.apk.lock +++ b/packages/vmm/guest/semantic-fs.aarch64.apk.lock @@ -11,7 +11,7 @@ e2fsprogs-1.47.4-r0 e2fsprogs-libs-1.47.4-r0 gcc-15.2.0-r5 gmp-6.3.0-r4 -go-1.26.9-r0 +go-1.26.10-r0 isl26-0.26-r2 jansson-2.15.0-r0 libapk-3.0.8-r0 diff --git a/packages/vmm/guest/semantic-fs.x86_64.apk.lock b/packages/vmm/guest/semantic-fs.x86_64.apk.lock index c7f389af..c718ccb9 100644 --- a/packages/vmm/guest/semantic-fs.x86_64.apk.lock +++ b/packages/vmm/guest/semantic-fs.x86_64.apk.lock @@ -11,7 +11,7 @@ e2fsprogs-1.47.4-r0 e2fsprogs-libs-1.47.4-r0 gcc-15.2.0-r5 gmp-6.3.0-r4 -go-1.26.9-r0 +go-1.26.10-r0 isl26-0.26-r2 jansson-2.15.0-r0 libapk-3.0.8-r0 diff --git a/packages/vmm/kernel/aarch64.apk.lock b/packages/vmm/kernel/aarch64.apk.lock index bcb9438f..80e2b169 100644 --- a/packages/vmm/kernel/aarch64.apk.lock +++ b/packages/vmm/kernel/aarch64.apk.lock @@ -35,7 +35,7 @@ libblkid-2.42.3-r1 libbz2-1.0.8-r6 libcom_err-1.47.4-r0 libcrypto3-3.5.9-r0 -libcurl-8.22.0-r0 +libcurl-8.23.0-r0 libdebuginfod-0.195-r0 libdw-0.195-r0 libeconf-0.8.3-r0 diff --git a/packages/vmm/kernel/x86_64.apk.lock b/packages/vmm/kernel/x86_64.apk.lock index bcb9438f..80e2b169 100644 --- a/packages/vmm/kernel/x86_64.apk.lock +++ b/packages/vmm/kernel/x86_64.apk.lock @@ -35,7 +35,7 @@ libblkid-2.42.3-r1 libbz2-1.0.8-r6 libcom_err-1.47.4-r0 libcrypto3-3.5.9-r0 -libcurl-8.22.0-r0 +libcurl-8.23.0-r0 libdebuginfod-0.195-r0 libdw-0.195-r0 libeconf-0.8.3-r0 diff --git a/packages/vmm/rootfs/manifest-aarch64.toml b/packages/vmm/rootfs/manifest-aarch64.toml index 98d424af..b75e8483 100644 --- a/packages/vmm/rootfs/manifest-aarch64.toml +++ b/packages/vmm/rootfs/manifest-aarch64.toml @@ -28,7 +28,7 @@ context_bus_daemon_sha256 = "401eec5ecd99024fdca5cbaee626947f47be2075e04b8b30013 # /usr/local/bin/semantic-fs-daemon: build-semantic-fs.sh, from # packages/semantic-fs-daemon at HEAD: the daemon that serves /context # (docs/design/microvm-semantic-fs.md). -semantic_fs_daemon_sha256 = "ef1a0d0c62b6e0f10120de5ceb947fad1b975f48fa999f54343de504244d4b78" +semantic_fs_daemon_sha256 = "a6d4b1b5f0d9a16dea236f5abfb1e5baf853219156ed5d2c2f51f2b917da4341" # /usr/local/bin/berth-github-api-broker.cjs: packages/docker-orchestrator/docker/github-api-broker.cjs. github_api_broker_sha256 = "0a809855c067d76b2074746b2390f6b204d1d80a7cafdc8cea4371efa624baaa" # /usr/local/bin/berth-egress-broker.cjs: packages/docker-orchestrator/docker/egress-broker.cjs. @@ -56,13 +56,13 @@ terminal = "tmux" # builder.apk.lock the builder's (erofs-utils). .github/workflows/vm-artifacts.yml # rebuilds it on a Linux runner and fails on any other hash. berth-vmm # compiles this in; berth-vmm run boots it by default. -image_sha256 = "e60172628d1bbc5d36f3df44d81e4b9cf79b02fd87a974621d15e51dec570522" +image_sha256 = "dfb5f6b030ca59884f2466783961169dd2f4d6fb71ff08d30028f67eff29331f" image_size = 108072960 # Optional layer example (rootfs/layers/example, build-layer.sh), built for the base above. layer_example_sha256 = "707d1c9ea2b77472954ae2cddb281dbbd1ca2e8f45b1bd191ba8c1f1ee3359c6" layer_example_size = 471040 -layer_example_base = "e60172628d1bbc5d36f3df44d81e4b9cf79b02fd87a974621d15e51dec570522" +layer_example_base = "dfb5f6b030ca59884f2466783961169dd2f4d6fb71ff08d30028f67eff29331f" # Optional layer browser (rootfs/layers/browser, build-layer.sh), built for the base above. layer_browser_sha256 = "643b36055173d7698bfcd103646ec09d0c57b9f61977d4c30e29bef3d5957ce8" layer_browser_size = 485203968 -layer_browser_base = "e60172628d1bbc5d36f3df44d81e4b9cf79b02fd87a974621d15e51dec570522" +layer_browser_base = "dfb5f6b030ca59884f2466783961169dd2f4d6fb71ff08d30028f67eff29331f" diff --git a/packages/vmm/rootfs/manifest-x86_64.toml b/packages/vmm/rootfs/manifest-x86_64.toml index 267e2426..d0d79d84 100644 --- a/packages/vmm/rootfs/manifest-x86_64.toml +++ b/packages/vmm/rootfs/manifest-x86_64.toml @@ -28,7 +28,7 @@ context_bus_daemon_sha256 = "c9f32a6f42f18c48b3647c5c06b03fc87611f123d2642f33dcf # /usr/local/bin/semantic-fs-daemon: build-semantic-fs.sh, from # packages/semantic-fs-daemon at HEAD: the daemon that serves /context # (docs/design/microvm-semantic-fs.md). -semantic_fs_daemon_sha256 = "fbf507612ce1714172e103d2fa3df2dc524ccd2dd899d047970ce7e8a0761deb" +semantic_fs_daemon_sha256 = "4e3b991879ac1a5f67533017632caee229dbfb3ab006b4ade682f17153aa57f8" # /usr/local/bin/berth-github-api-broker.cjs: packages/docker-orchestrator/docker/github-api-broker.cjs. github_api_broker_sha256 = "0a809855c067d76b2074746b2390f6b204d1d80a7cafdc8cea4371efa624baaa" # /usr/local/bin/berth-egress-broker.cjs: packages/docker-orchestrator/docker/egress-broker.cjs. @@ -56,13 +56,13 @@ terminal = "tmux" # builder.apk.lock the builder's (erofs-utils). .github/workflows/vm-artifacts.yml # rebuilds it on a Linux runner and fails on any other hash. berth-vmm # compiles this in; berth-vmm run boots it by default. -image_sha256 = "0c623b43a2c2852fd156d1ea6d4f00a8612143299ec7381cf2d1516607d0a9f6" +image_sha256 = "af4f3fc0be1429cf324ffc77157c1c2359c641078675c1d6d0d82b746259ac69" image_size = 108904448 # Optional layer example (rootfs/layers/example, build-layer.sh), built for the base above. layer_example_sha256 = "a79169aeed42b12ecb28cf40427439d5870056362ea8728036354137cd6d273d" layer_example_size = 475136 -layer_example_base = "0c623b43a2c2852fd156d1ea6d4f00a8612143299ec7381cf2d1516607d0a9f6" +layer_example_base = "af4f3fc0be1429cf324ffc77157c1c2359c641078675c1d6d0d82b746259ac69" # Optional layer browser (rootfs/layers/browser, build-layer.sh), built for the base above. layer_browser_sha256 = "b02cec7e83efe1dcb39b78ebbef5bf30e8ebda082c7b87a4bd30e7375d976fb2" layer_browser_size = 511885312 -layer_browser_base = "0c623b43a2c2852fd156d1ea6d4f00a8612143299ec7381cf2d1516607d0a9f6" +layer_browser_base = "af4f3fc0be1429cf324ffc77157c1c2359c641078675c1d6d0d82b746259ac69" From fc536b39f289f5b8ea8174e9cd8cadbb2d52f3d4 Mon Sep 17 00:00:00 2001 From: Aswin Kumar Date: Sun, 25 Oct 2026 23:48:57 +0530 Subject: [PATCH 2/2] build(vm): pin the berth-vmm builds for the Go 1.26.10 rootfs pins Run 40219221120 built all three, rebuilt both rootfs images to their pins, and passed the x86_64 e2e. libkrun is unchanged. --- packages/cli/src/vm/pins.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/cli/src/vm/pins.ts b/packages/cli/src/vm/pins.ts index 878a686e..3a1b23b8 100644 --- a/packages/cli/src/vm/pins.ts +++ b/packages/cli/src/vm/pins.ts @@ -123,13 +123,13 @@ export type VmmPlatform = "darwin-arm64" | "linux-arm64" | "linux-x64"; * * All three are from the per-architecture releases vm-artifacts-8f79e8da-dfb5f6b0 * (aarch64: darwin-arm64, linux-arm64) and vm-artifacts-10d4b54c-af4f3fc0 - * (x86_64: linux-x64). Run 40200731376 built all three; it also rebuilt both + * (x86_64: linux-x64). Run 40219221120 built all three; it also rebuilt both * rootfs images to their pins and passed the x86_64 e2e under KVM. */ export const VMM_PINS: Partial> = { - "darwin-arm64": { sha256: "628e6ac16dde4657a2c177a0614ee89de91f9d47db631b8c8d59e111fc2904f0", size: 700608 }, - "linux-arm64": { sha256: "1b72e4966c5c96c0ff89eab64bb868e8ee9a2cac75640f8b3ee65ec2c53e7fd1", size: 725632 }, - "linux-x64": { sha256: "308dd7d8a6e7a0cb5c821dcd2c2eefe7775d3a3859c7891ea5154ed8582cb0dd", size: 742152 }, + "darwin-arm64": { sha256: "8a2f4b50d6190f092b2df0e09c1820db37056e520f7177cdda2c80b13bdd8a25", size: 700608 }, + "linux-arm64": { sha256: "c6bffa0328d276b88e3e339b67f8afc915d2e9d0791d4219360a6acc7b56983d", size: 725632 }, + "linux-x64": { sha256: "c57289843cd8e147118e783a0bd1415f4b33b4ed327980fcd67033eb645785ad", size: 742152 }, }; export function vmmPin(platform: string = `${process.platform}-${process.arch}`, pins: Partial> = VMM_PINS): ArtifactPin | undefined {