build(vm): re-pin both rootfs images for Go 1.26.10

docs/design/microvm-linux.md

@@ -144,6 +144,10 @@ Each is its own branch, tested before the next.
   one run in three. Both manifests now pin agent-init to the fix (`0204e8f2…`), which also carries main's
   libc, tokio and sqlite bumps. `update_pins` runs 40198606357 (aarch64) and 40198603422 (x86_64) give
   rootfs `e6017262…` (aarch64) and `0c623b43…` (x86_64); the kernels are unchanged.
+- **Re-pinned for Go 1.26.10, 2026-10-25.** The first publish from main (run 40216091795) stopped at the
+  guest build: Alpine had moved go to 1.26.10 a few hours after the re-pin above, so semantic-fs-daemon no
+  longer built to its pin on either architecture. `update_pins` runs 40217496771 (aarch64) and 40217494503
+  (x86_64) give rootfs `dfb5f6b0…` and `af4f3fc0…`. Open problem 10 again.
 - **Linux arm64 booted**, 2026-10-24, on a nested-KVM Lima VM (Ubuntu 24.04, Linux 6.8, VZ on an M4) with
   the published linux-arm64 berth-vmm `a3cf2a09…` and its libkrun, rootfs `62f96e1b…`: host sandbox
   Landlock ABI 4 with TCP rules and seccomp; `e2e.mjs` single 18/18, multi 17/17, enforce 12/12, stdio 3/3,

docs/local-vm.md

@@ -65,11 +65,11 @@ By default, from the GitHub release that [`.github/workflows/vm-artifacts.yml`](
 | File | Asset | sha256 (this CLI) | Size |
 |---|---|---|---|
 | `~/.berth/vm/kernel/sha256/<sha>/Image` | `Image-<sha>` | `8f79e8dae97ebc0ab8fcdc4ad209bb025ec967be82c713503e0612cfdd340ec8` | 23,668,744 B |
-| `~/.berth/vm/rootfs/rootfs-<sha>.erofs` | `rootfs-<sha>.erofs` | `e60172628d1bbc5d36f3df44d81e4b9cf79b02fd87a974621d15e51dec570522` | 108,072,960 B |
+| `~/.berth/vm/rootfs/rootfs-<sha>.erofs` | `rootfs-<sha>.erofs` | `dfb5f6b030ca59884f2466783961169dd2f4d6fb71ff08d30028f67eff29331f` | 108,072,960 B |
 | `~/.berth/vm/bin/berth-vmm` | `berth-vmm-darwin-arm64-<sha>`, `berth-vmm-linux-arm64-<sha>` | `VMM_PINS` in `packages/cli/src/vm/pins.ts` | about 700 KB (macOS), 2.7 MB (Linux) |
 | `~/.berth/vm/bin/libkrun.1.19.6.dylib`, `libkrun.so.1.19.6` | `libkrun-darwin-arm64-<sha>.dylib`, `libkrun-linux-arm64-<sha>.so` | `LIBKRUN_PINS` in the same file | about 4.7 MB |
 
-That is `https://github.com/Ash20pk/BerthOS/releases/download/vm-artifacts-8f79e8da-e6017262/`. The x86_64 one is `vm-artifacts-10d4b54c-0c623b43`: kernel `10d4b54c0896668a93f9d26d0a701aac4a14ce813f3ed4d3b4d26e50d7b7b8d1` (an ELF `vmlinux`, 27,928,992 B), rootfs `0c623b43a2c2852fd156d1ea6d4f00a8612143299ec7381cf2d1516607d0a9f6` (108,904,448 B), and `berth-vmm-linux-x64-<sha>` with `libkrun-linux-x64-<sha>.so`. CI rebuilds each architecture's kernel and rootfs from source on GitHub's Linux runners of that architecture, and publishes the release only if they match the pins bit for bit. The release also carries `SHA256SUMS`, each rootfs's input record, berth-vmm's build record, and the kernel's GPL sources (the exact linux and libkrunfw tarballs, the config delta, the resolved config and the build script; see `SOURCES.md` there).
+That is `https://github.com/Ash20pk/BerthOS/releases/download/vm-artifacts-8f79e8da-dfb5f6b0/`. The x86_64 one is `vm-artifacts-10d4b54c-af4f3fc0`: kernel `10d4b54c0896668a93f9d26d0a701aac4a14ce813f3ed4d3b4d26e50d7b7b8d1` (an ELF `vmlinux`, 27,928,992 B), rootfs `af4f3fc0be1429cf324ffc77157c1c2359c641078675c1d6d0d82b746259ac69` (108,904,448 B), and `berth-vmm-linux-x64-<sha>` with `libkrun-linux-x64-<sha>.so`. CI rebuilds each architecture's kernel and rootfs from source on GitHub's Linux runners of that architecture, and publishes the release only if they match the pins bit for bit. The release also carries `SHA256SUMS`, each rootfs's input record, berth-vmm's build record, and the kernel's GPL sources (the exact linux and libkrunfw tarballs, the config delta, the resolved config and the build script; see `SOURCES.md` there).
 
 berth-vmm and its libkrun are downloaded only when the CLI pins their sha256 for your platform (macOS arm64, Linux arm64 and Linux x86_64). A build from CI can't be pinned until CI has built it, so a CLI released before the first artifacts release has no pin, and says so. Then build berth-vmm and pass `--vmm`, or download it by hand (below).
 
@@ -95,7 +95,7 @@ If the kernel and rootfs aren't installed, `berth dev --runtime vm` installs the
 #### Verifying by hand
 
 ```bash
-tag=vm-artifacts-8f79e8da-e6017262
+tag=vm-artifacts-8f79e8da-dfb5f6b0
 gh release download "$tag" -R Ash20pk/BerthOS -p 'Image-*' -p 'rootfs-*.erofs' -p 'berth-vmm-darwin-arm64-*' -p 'libkrun-darwin-arm64-*' -p SHA256SUMS
 shasum -a 256 -c --ignore-missing SHA256SUMS     # each asset against the list
 shasum -a 256 Image-* rootfs-*.erofs              # and against the pins above, which are also in

packages/cli/src/vm/pins.ts

@@ -40,11 +40,11 @@ export interface GuestPins {
 export const GUEST_PINS: Partial<Record<GuestArch, GuestPins>> = {
   aarch64: {
     kernel: { sha256: "8f79e8dae97ebc0ab8fcdc4ad209bb025ec967be82c713503e0612cfdd340ec8", size: 23668744, linux: "6.12.109", configSha256: "e3f33c2bd4bffa16e52a066c325967e4bde091f20063e6eb5b81e8a2efac4dc8" },
-    rootfs: { sha256: "e60172628d1bbc5d36f3df44d81e4b9cf79b02fd87a974621d15e51dec570522", size: 108072960 },
+    rootfs: { sha256: "dfb5f6b030ca59884f2466783961169dd2f4d6fb71ff08d30028f67eff29331f", size: 108072960 },
   },
   x86_64: {
     kernel: { sha256: "10d4b54c0896668a93f9d26d0a701aac4a14ce813f3ed4d3b4d26e50d7b7b8d1", size: 27928992, linux: "6.12.109", configSha256: "6e0fd31c75cd563f8bf650765504d97989316f70e9bbb333fb0230db78fe4283" },
-    rootfs: { sha256: "0c623b43a2c2852fd156d1ea6d4f00a8612143299ec7381cf2d1516607d0a9f6", size: 108904448 },
+    rootfs: { sha256: "af4f3fc0be1429cf324ffc77157c1c2359c641078675c1d6d0d82b746259ac69", size: 108904448 },
   },
 };
 
@@ -121,15 +121,15 @@ export type VmmPlatform = "darwin-arm64" | "linux-arm64" | "linux-x64";
  * `berth vm install` refuses any other bytes, and clears macOS's quarantine
  * attribute only on a file that matched.
  *
- * All three are from the per-architecture releases vm-artifacts-8f79e8da-e6017262
- * (aarch64: darwin-arm64, linux-arm64) and vm-artifacts-10d4b54c-0c623b43
- * (x86_64: linux-x64). Run 40200731376 built all three; it also rebuilt both
+ * All three are from the per-architecture releases vm-artifacts-8f79e8da-dfb5f6b0
+ * (aarch64: darwin-arm64, linux-arm64) and vm-artifacts-10d4b54c-af4f3fc0
+ * (x86_64: linux-x64). Run 40219221120 built all three; it also rebuilt both
  * rootfs images to their pins and passed the x86_64 e2e under KVM.
  */
 export const VMM_PINS: Partial<Record<VmmPlatform, { sha256: string; size: number }>> = {
-  "darwin-arm64": { sha256: "628e6ac16dde4657a2c177a0614ee89de91f9d47db631b8c8d59e111fc2904f0", size: 700608 },
-  "linux-arm64": { sha256: "1b72e4966c5c96c0ff89eab64bb868e8ee9a2cac75640f8b3ee65ec2c53e7fd1", size: 725632 },
-  "linux-x64": { sha256: "308dd7d8a6e7a0cb5c821dcd2c2eefe7775d3a3859c7891ea5154ed8582cb0dd", size: 742152 },
+  "darwin-arm64": { sha256: "8a2f4b50d6190f092b2df0e09c1820db37056e520f7177cdda2c80b13bdd8a25", size: 700608 },
+  "linux-arm64": { sha256: "c6bffa0328d276b88e3e339b67f8afc915d2e9d0791d4219360a6acc7b56983d", size: 725632 },
+  "linux-x64": { sha256: "c57289843cd8e147118e783a0bd1415f4b33b4ed327980fcd67033eb645785ad", size: 742152 },
 };
 
 export function vmmPin(platform: string = `${process.platform}-${process.arch}`, pins: Partial<Record<string, { sha256: string; size: number }>> = VMM_PINS): ArtifactPin | undefined {

packages/vmm/guest/agent-init.aarch64.apk.lock

@@ -25,7 +25,7 @@ libatomic-15.2.0-r5
 libblkid-2.42.3-r1
 libcom_err-1.47.4-r0
 libcrypto3-3.5.8-r0
-libcurl-8.22.0-r0
+libcurl-8.23.0-r0
 libeconf-0.8.3-r0
 libffi-3.5.2-r1
 libgcc-15.2.0-r5

packages/vmm/guest/agent-init.x86_64.apk.lock

@@ -25,7 +25,7 @@ libatomic-15.2.0-r5
 libblkid-2.42.3-r1
 libcom_err-1.47.4-r0
 libcrypto3-3.5.8-r0
-libcurl-8.22.0-r0
+libcurl-8.23.0-r0
 libeconf-0.8.3-r0
 libffi-3.5.2-r1
 libgcc-15.2.0-r5

packages/vmm/guest/berth-init.aarch64.apk.lock

@@ -131,7 +131,7 @@ libatomic-15.2.0-r5
 libblkid-2.42.3-r1
 libcom_err-1.47.4-r0
 libcrypto3-3.5.8-r0
-libcurl-8.22.0-r0
+libcurl-8.23.0-r0
 libeconf-0.8.3-r0
 libffi-3.5.2-r1
 libgcc-15.2.0-r5

packages/vmm/guest/berth-init.x86_64.apk.lock

@@ -131,7 +131,7 @@ libatomic-15.2.0-r5
 libblkid-2.42.3-r1
 libcom_err-1.47.4-r0
 libcrypto3-3.5.8-r0
-libcurl-8.22.0-r0
+libcurl-8.23.0-r0
 libeconf-0.8.3-r0
 libffi-3.5.2-r1
 libgcc-15.2.0-r5

packages/vmm/guest/semantic-fs.aarch64.apk.lock

@@ -11,7 +11,7 @@ e2fsprogs-1.47.4-r0
 e2fsprogs-libs-1.47.4-r0
 gcc-15.2.0-r5
 gmp-6.3.0-r4
-go-1.26.9-r0
+go-1.26.10-r0
 isl26-0.26-r2
 jansson-2.15.0-r0
 libapk-3.0.8-r0

packages/vmm/guest/semantic-fs.x86_64.apk.lock

@@ -11,7 +11,7 @@ e2fsprogs-1.47.4-r0
 e2fsprogs-libs-1.47.4-r0
 gcc-15.2.0-r5
 gmp-6.3.0-r4
-go-1.26.9-r0
+go-1.26.10-r0
 isl26-0.26-r2
 jansson-2.15.0-r0
 libapk-3.0.8-r0

packages/vmm/kernel/aarch64.apk.lock

@@ -35,7 +35,7 @@ libblkid-2.42.3-r1
 libbz2-1.0.8-r6
 libcom_err-1.47.4-r0
 libcrypto3-3.5.9-r0
-libcurl-8.22.0-r0
+libcurl-8.23.0-r0
 libdebuginfod-0.195-r0
 libdw-0.195-r0
 libeconf-0.8.3-r0

packages/vmm/kernel/x86_64.apk.lock

@@ -35,7 +35,7 @@ libblkid-2.42.3-r1
 libbz2-1.0.8-r6
 libcom_err-1.47.4-r0
 libcrypto3-3.5.9-r0
-libcurl-8.22.0-r0
+libcurl-8.23.0-r0
 libdebuginfod-0.195-r0
 libdw-0.195-r0
 libeconf-0.8.3-r0

packages/vmm/rootfs/manifest-aarch64.toml

@@ -28,7 +28,7 @@ context_bus_daemon_sha256 = "401eec5ecd99024fdca5cbaee626947f47be2075e04b8b30013
 # /usr/local/bin/semantic-fs-daemon: build-semantic-fs.sh, from
 # packages/semantic-fs-daemon at HEAD: the daemon that serves /context
 # (docs/design/microvm-semantic-fs.md).
-semantic_fs_daemon_sha256 = "ef1a0d0c62b6e0f10120de5ceb947fad1b975f48fa999f54343de504244d4b78"
+semantic_fs_daemon_sha256 = "a6d4b1b5f0d9a16dea236f5abfb1e5baf853219156ed5d2c2f51f2b917da4341"
 # /usr/local/bin/berth-github-api-broker.cjs: packages/docker-orchestrator/docker/github-api-broker.cjs.
 github_api_broker_sha256 = "0a809855c067d76b2074746b2390f6b204d1d80a7cafdc8cea4371efa624baaa"
 # /usr/local/bin/berth-egress-broker.cjs: packages/docker-orchestrator/docker/egress-broker.cjs.
@@ -56,13 +56,13 @@ terminal = "tmux"
 # builder.apk.lock the builder's (erofs-utils). .github/workflows/vm-artifacts.yml
 # rebuilds it on a Linux runner and fails on any other hash. berth-vmm
 # compiles this in; berth-vmm run boots it by default.
-image_sha256 = "e60172628d1bbc5d36f3df44d81e4b9cf79b02fd87a974621d15e51dec570522"
+image_sha256 = "dfb5f6b030ca59884f2466783961169dd2f4d6fb71ff08d30028f67eff29331f"
 image_size = 108072960
 # Optional layer example (rootfs/layers/example, build-layer.sh), built for the base above.
 layer_example_sha256 = "707d1c9ea2b77472954ae2cddb281dbbd1ca2e8f45b1bd191ba8c1f1ee3359c6"
 layer_example_size = 471040
-layer_example_base = "e60172628d1bbc5d36f3df44d81e4b9cf79b02fd87a974621d15e51dec570522"
+layer_example_base = "dfb5f6b030ca59884f2466783961169dd2f4d6fb71ff08d30028f67eff29331f"
 # Optional layer browser (rootfs/layers/browser, build-layer.sh), built for the base above.
 layer_browser_sha256 = "643b36055173d7698bfcd103646ec09d0c57b9f61977d4c30e29bef3d5957ce8"
 layer_browser_size = 485203968
-layer_browser_base = "e60172628d1bbc5d36f3df44d81e4b9cf79b02fd87a974621d15e51dec570522"
+layer_browser_base = "dfb5f6b030ca59884f2466783961169dd2f4d6fb71ff08d30028f67eff29331f"

packages/vmm/rootfs/manifest-x86_64.toml

@@ -28,7 +28,7 @@ context_bus_daemon_sha256 = "c9f32a6f42f18c48b3647c5c06b03fc87611f123d2642f33dcf
 # /usr/local/bin/semantic-fs-daemon: build-semantic-fs.sh, from
 # packages/semantic-fs-daemon at HEAD: the daemon that serves /context
 # (docs/design/microvm-semantic-fs.md).
-semantic_fs_daemon_sha256 = "fbf507612ce1714172e103d2fa3df2dc524ccd2dd899d047970ce7e8a0761deb"
+semantic_fs_daemon_sha256 = "4e3b991879ac1a5f67533017632caee229dbfb3ab006b4ade682f17153aa57f8"
 # /usr/local/bin/berth-github-api-broker.cjs: packages/docker-orchestrator/docker/github-api-broker.cjs.
 github_api_broker_sha256 = "0a809855c067d76b2074746b2390f6b204d1d80a7cafdc8cea4371efa624baaa"
 # /usr/local/bin/berth-egress-broker.cjs: packages/docker-orchestrator/docker/egress-broker.cjs.
@@ -56,13 +56,13 @@ terminal = "tmux"
 # builder.apk.lock the builder's (erofs-utils). .github/workflows/vm-artifacts.yml
 # rebuilds it on a Linux runner and fails on any other hash. berth-vmm
 # compiles this in; berth-vmm run boots it by default.
-image_sha256 = "0c623b43a2c2852fd156d1ea6d4f00a8612143299ec7381cf2d1516607d0a9f6"
+image_sha256 = "af4f3fc0be1429cf324ffc77157c1c2359c641078675c1d6d0d82b746259ac69"
 image_size = 108904448
 # Optional layer example (rootfs/layers/example, build-layer.sh), built for the base above.
 layer_example_sha256 = "a79169aeed42b12ecb28cf40427439d5870056362ea8728036354137cd6d273d"
 layer_example_size = 475136
-layer_example_base = "0c623b43a2c2852fd156d1ea6d4f00a8612143299ec7381cf2d1516607d0a9f6"
+layer_example_base = "af4f3fc0be1429cf324ffc77157c1c2359c641078675c1d6d0d82b746259ac69"
 # Optional layer browser (rootfs/layers/browser, build-layer.sh), built for the base above.
 layer_browser_sha256 = "b02cec7e83efe1dcb39b78ebbef5bf30e8ebda082c7b87a4bd30e7375d976fb2"
 layer_browser_size = 511885312
-layer_browser_base = "0c623b43a2c2852fd156d1ea6d4f00a8612143299ec7381cf2d1516607d0a9f6"
+layer_browser_base = "af4f3fc0be1429cf324ffc77157c1c2359c641078675c1d6d0d82b746259ac69"