Publish signed BuildStream/FSDK VM runner and guest artifacts

[castrojo]

The VM launcher now consumes immutable runner and guest references but the release-owned artifacts do not exist yet.

Required artifacts:

• amd64/arm64 pinned QEMU microVM runner OCI image
• amd64/arm64 guest kernel, initramfs, and rootfs
• SPDX SBOM and provenance referrers
• keyless Cosign signatures

The contract is documented in vm/manifest.json and vm/README.md. The producer should be projectbluefin/fsdk-containers or another explicitly owned release pipeline.

[castrojo]

Investigated against projectbluebluefin/fsdk-containers main. It does not currently produce the donate-clanker VM contract. Its build matrix contains base/static/skopeo/lab-runner/python/buildah/qemu-img/ramalama; elements/oci/qemu-img.bst produces only a distroless /usr/bin/qemu-img image, and the QEMU source build disables system/user QEMU. No runner, guest kernel, initramfs, or rootfs producer exists.

The required contract remains defined in vm/manifest.json, documented in vm/README.md, and verified by scripts/verify-vm-artifacts.sh. The producer must add an explicitly owned BuildStream/release pipeline for signed amd64/arm64 runner and guest artifacts, publish immutable references, attach SPDX and provenance referrers, and provide the five values consumed by .github/workflows/publish-vm.yml. Do not close this issue or duplicate the VM image pipeline in donate-clanker until those artifacts exist.

[castrojo]

The producer track added a first slice in projectbluefin/fsdk-containers branch feat/donate-clanker-vm-artifacts at commit 187759e: multi-arch QEMU/KVM runner OCI target, guest-rootfs contract, and release/SBOM/signing/validation wiring. It is not yet a bootable VM: real guest kernel, initramfs, and donate-clanker guest runtime producers are still required. No fake digests were created.

[castrojo]

The proper full-OS VM target was implemented in the producer agent workspace at commit 3a50e44, but that branch is not yet visible on the public fsdk-containers remote. It needs to be pushed/opened as a reviewable branch before artifact production can proceed.

[castrojo]

The proper full-OS VM producer is now published in projectbluefin/fsdk-containers: branch feat/donate-clanker-vm-artifacts, commit 3a50e4426d9b20f4d1d2162bdc036739e1e00bed. Target: podman-vm/podman-vm-efi.bst; output: full-OS donate-clanker-vm-<fsdk-version>-<arch>.qcow2 plus SHA256. It still needs the donate-clanker guest worker/runtime payload and release publication before this repo can consume signed digests.

[castrojo]

Lean VM producer is now pushed on fsdk-containers branch feat/donate-clanker-vm-artifacts, latest commit c42384f. It removes Podman, SSH, cloud-init, generic VM config, and qemu-img conversion. The target reuses the FSDK VM OS/uutils stack and emits a raw disk directly. Local BuildStream build succeeded for x86_64: donate-clanker-vm-25.08.14-x86_64.raw, 2.2G on disk, SHA256 985366fd0d20867f5849a4ed606d6002358d1a3d3948bcfb235d14db689356e. Multi-arch CI still needs to build arm64 and publish signed artifacts.

[castrojo]

Triggered the FSDK Build images workflow for feat/donate-clanker-vm-artifacts: https://github.com/projectbluefin/fsdk-containers/actions/runs/30590164011. Local x86_64 BuildStream build already succeeded; CI is now queued for release-matrix validation/publication.

[castrojo]

Investigating the active fsdk-containers VM artifact workflow; raw disk builds passed, but the QEMU boot gate must pass before release assets upload.

[castrojo]

Audit against main @ 52938e8. Still valid, blocked outside this repository. Leaving open.

Consumer side in this repo is ready and unchanged by the refactor

• vm/manifest.json — the contract: VM_RUNNER_REF, VM_GUEST_REF, VM_GUEST_KERNEL_REF, VM_GUEST_INITRAMFS_REF, VM_GUEST_ROOTFS_REF, each amd64+arm64 with signature, spdx, provenance referrers, immutable-digest regex, and cosign identity/issuer envs.
• scripts/verify-vm-artifacts.sh:16-70 — enforces it: digest-only refs, docker manifest inspect per arch, cosign verify and cosign verify-attestation --type spdxjson. VM_VERIFY_REMOTE=false gives the static-only mode CI uses.
• .github/workflows/validate.yml ("VM artifact contract" step) runs the static half on every push with placeholder digests, so the contract itself cannot rot.
• internal/vm/spec.go:22,49-56 — digestPattern refuses any runner/guest reference that is not …@sha256:<64 hex>; the launcher cannot be pointed at a mutable tag.
• just/61-donate-clanker.just:775-780 — with no DONATE_CLANKER_VM_RUNNER_IMAGE the runner path refuses outright.

Relationship to #17

#17 added .github/workflows/publish-vm.yml:30, if: vars.DONATE_CLANKER_VM_RUNNER_REF != ''. That is a symptom of this issue, not a fix for it, and it is the exact place this issue gets closed out. I confirmed via gh api repos/projectbluefin/donate-clanker/actions/variables that the only repository variable set today is DONATE_CLANKER_PUBLISH_STABLE; all five VM refs and both cosign vars are unset, so the validation job is skipped on every release tag. Once the artifacts exist and those variables are set, the job runs and verify-vm-artifacts.sh still fails hard on anything unsigned or missing an arch — nothing was weakened.

Where the blocker actually is

Not code in this repo. It is production + configuration in projectbluefin/fsdk-containers:

• The guest bootstrap consumer landed there (elements/podman-vm/files/donate-clanker-bootstrap.py + .service, on main), and the lean VM target on feat/donate-clanker-vm-artifacts (head c0a283e, "fix: use binary virtio bootstrap channel").
• Release assets today are raw disk + sha256 sidecar only, and incomplete: v25.08.14 has donate-clanker-vm-25.08.14-x86_64.raw.zst + .sha256; v25.08.15 has only donate-clanker-vm-25.08.15-aarch64.raw.sha256 and no disk. That feeds the checksum-verified local path (just/61-donate-clanker.just:531-566), which is not the same thing as this issue: no OCI runner/guest images, no cosign signatures, no SPDX or provenance referrers, no arm64 disk.

Remaining work, in order

1. fsdk-containers publishes amd64+arm64 runner OCI image and guest kernel/initramfs/rootfs as immutable digest references, with keyless cosign signatures and SPDX + provenance referrers.
2. A human with admin on this repository sets DONATE_CLANKER_VM_RUNNER_REF, DONATE_CLANKER_VM_GUEST_REF, DONATE_CLANKER_VM_GUEST_KERNEL_REF, DONATE_CLANKER_VM_GUEST_INITRAMFS_REF, DONATE_CLANKER_VM_GUEST_ROOTFS_REF, DONATE_CLANKER_VM_COSIGN_IDENTITY_REGEXP, DONATE_CLANKER_VM_COSIGN_ISSUER.
3. A release tag runs validate VM artifacts green with VM_VERIFY_REMOTE at its default true.

Until (1) and (2), do not close this and do not duplicate the VM image pipeline here. No fake digests.

[castrojo]

Citation correction to my previous comment: the runner-path refusal is just/61-donate-clanker.just:749-753 ([[ -n "{{vm_runner_image}}" ]] || { ... exit 1; }), not 775-780. Everything else stands.