From 539eb07cebd399e6363ec9e946621301df8f6fa5 Mon Sep 17 00:00:00 2001 From: Anastassios Nanos Date: Sat, 31 Oct 2026 22:58:38 +0200 Subject: [PATCH] fix(bundle): Carry hvi 0.1.0-rc.2 hvi 0.1.0-rc.1 advertised RDRAND and RDSEED to x86 guests whatever the host CPU had. On a host without them, as a VM with a generic CPU model (kvm64, qemu64, x86-64-v2-AES) is, the guest kernel triple-faulted at its first rdrand, and every brig run ended in "guest stopped: SystemReset". hvi is the default monitor of a generic boot on Linux, so brig v0.5.0 did not boot there at all. rc.2 passes the host's bits through (brig-sh/hvi-vmm#343). The tag, commit and both tarball shas move together. README, DESIGN.md and docs/variants.md name the new release. Signed-off-by: Anastassios Nanos --- DESIGN.md | 2 +- README.md | 2 +- docs/variants.md | 2 +- scripts/build-bundle.sh | 8 ++++---- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/DESIGN.md b/DESIGN.md index ac724e7..273a822 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -33,7 +33,7 @@ now done and is what `install.sh` and `scripts/build-bundle.sh` produce. fetches nothing else. Because the config files carry the fixed layout, the paths above are not configurable at install time. - **Why urunc is built (at release).** Most components are upstream release - artifacts, hvi among them (`brig-sh/hvi-vmm` `v0.1.0-rc.1`, cosign-verified). + artifacts, hvi among them (`brig-sh/hvi-vmm` `v0.1.0-rc.2`, cosign-verified). urunc has no release that carries what brig needs, so the build compiles it from `urunc-dev/urunc` at commit `3c00b69`, on `feat/linux-hvi-v050` (CGO static, so native per arch under qemu/binfmt). The source is pinned to a diff --git a/README.md b/README.md index b5b28d0..c07a43f 100644 --- a/README.md +++ b/README.md @@ -283,7 +283,7 @@ urunc, which has none: | --- | --- | --- | | brig, brigd, brig-broker | `brig-sh/brig` release | fetched, verified against its signed `checksums.txt` | | urunc, containerd-shim-urunc-v2 | built from `urunc-dev/urunc` at commit `3c00b69` (branch `feat/linux-hvi-v050`) | CGO-static, built in a Go container | -| hvi | `brig-sh/hvi-vmm` release `v0.1.0-rc.1` (commit `65570c7`), the one hull ships on macOS | fetched, musl-static; its `SHA256SUMS` cosign-verified against hvi-vmm's release workflow, the tarball pinned by sha256 | +| hvi | `brig-sh/hvi-vmm` release `v0.1.0-rc.2` (commit `2ed8f61`), the one hull ships on macOS | fetched, musl-static; its `SHA256SUMS` cosign-verified against hvi-vmm's release workflow, the tarball pinned by sha256 | | guest kernel, container-initrd | `ghcr.io/nofireai/hull-assets` `0.1.11` | fetched by digest once its cosign signature checks out; the initrd is urunit. urunc's `packaging/container-initrd/urunit.pin` names `48a61bd`; hull-assets `0.1.11` does not record its urunit, so the bundle records that commit as `urunit_expected`. The build refuses a hull-assets bundle built from another urunc | | monitors, virtiofsd | `urunc-dev/monitors-build` | fetched, pinned by sha256 | | containerd, runc, nerdctl, CNI | upstream releases | fetched, upstream checksums | diff --git a/docs/variants.md b/docs/variants.md index 65048a1..95bf70d 100644 --- a/docs/variants.md +++ b/docs/variants.md @@ -166,7 +166,7 @@ refuses a stock binary, rather than printing a table of zeroes. from that urunc. urunc is pinned to a commit because a branch tip moves with every push; the README's build section says how to move it. 4. Settled: `build-bundle.sh` fetches hvi from the `brig-sh/hvi-vmm` release - hull ships on macOS (`v0.1.0-rc.1`). `scripts/fetch-hvi.sh` checks the + hull ships on macOS (`v0.1.0-rc.2`). `scripts/fetch-hvi.sh` checks the cosign signature on its `SHA256SUMS`, the pinned sha256 of the tarball and the commit its manifest names. 5. Is `introspection` a variant at all, or `generic-boot` plus an opt-in flag? diff --git a/scripts/build-bundle.sh b/scripts/build-bundle.sh index d25eedb..b2e16be 100755 --- a/scripts/build-bundle.sh +++ b/scripts/build-bundle.sh @@ -134,10 +134,10 @@ URUNC_GO_IMAGE="${URUNC_GO_IMAGE:-golang:1.26.8}" # brig-sh/hvi-vmm release hull ships on macOS, static against musl. The tag, # its commit and the sha256 of each tarball describe one release, so a bump # changes all four together. scripts/fetch-hvi.sh checks them. -HVI_VERSION=0.1.0-rc.1 -HVI_COMMIT=65570c78e6830ec6166fd5f9079998a47535b09f -HVI_SHA256_LINUX_AMD64=1fc870d4946c08a576fe775b631ed225dc5687611f73c118b14b19dd75469853 -HVI_SHA256_LINUX_ARM64=277c0cfbd9a669f79e9819b35b327a9d815128e181215fa46618acca05bf9acc +HVI_VERSION=0.1.0-rc.2 +HVI_COMMIT=2ed8f61dde8c20facd5f1a3668b170b07fb0eee1 +HVI_SHA256_LINUX_AMD64=e62358d9abcf2c8999227ef7ba16c25b57e131467eb4df916bffb68578b9ff25 +HVI_SHA256_LINUX_ARM64=3c11e3b1443fb9e39a652a0011ac74d548a7bd05674b6c4115ffbd5a0260e903 # A branch given without a ref would otherwise build the pinned commit and # ignore the branch, so ask which one was meant. if [ -n "${URUNC_BRANCH:-}" ] && [ "$URUNC_BRANCH" != "$URUNC_BRANCH_DEFAULT" ] && [ -z "${URUNC_REF+set}" ]; then