You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
add typed Alpine and Ubuntu guest descriptors and explicit --guest selection for build, run, and correctness workflows while preserving Alpine defaults
build Ubuntu Base 26.04.1 from verified immutable inputs, install a locked supplemental .deb closure without maintainer-script execution, and emit deterministic initramfs and EROFS artifacts with package/helper provenance
add exact Ubuntu corresponding-source collection, including Launchpad publishing-history fallback for superseded source versions
move shared guest helpers into guest/common, retain Alpine-only sandbox entry helpers under guest/alpine, and add the Ubuntu shell-ready and sandbox smoke profiles
wire Ubuntu artifacts through Docker, caching, CI, release/download packaging, setup scripts, notices, and user/design documentation
all 65 exact Ubuntu source identities resolved; a superseded source package was downloaded and checksum-validated end to end
Scope
This change does not modify the OpenVMM submodule or kernel/config-microvm. Ubuntu uses the existing NVX kernel and fixed microVM ABI. Systemd remains unsupported for the initial Ubuntu profiles.
Introduce typed guest descriptors and explicit --guest selection for native and Docker builds, run commands, and correctness workflows while preserving Alpine defaults and artifact names.
Build Ubuntu Base 26.04.1 from a repository-owned SHA-256 pin, install a complete locked supplemental .deb closure without executing maintainer scripts, enforce safe archive extraction and sandbox metadata policy, and emit deterministic initramfs and EROFS artifacts with binary-package and helper provenance.
Add exact Ubuntu source collection with Launchpad publishing-history fallback for superseded versions, extend release and download packaging, add Docker and CI artifact coverage, move common guest helpers into a distribution-neutral layout, and document both the interactive initramfs and non-root sandbox layer profiles. The OpenVMM submodule and kernel configuration remain unchanged.
Validated with the 217-test Python suite, Ruff and Pyright on Linux and Windows targets, ShellCheck and shfmt, deterministic double builds, native Alpine and Ubuntu artifact builds, and local WHP initramfs, lifecycle, SMP, console, networking, HostFs, snapshot, and sandbox execution.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6f9e68de-6b8a-4d23-b59e-ce1026001e15
Authenticate Ubuntu source collection through signed live and historical indexes, harden output handling and guest identity checks, and fix the Windows, Ubuntu network, and low-memory benchmark regressions.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep the wget customization regression test privilege-independent on Windows and align performance collection with the supported 128 MiB minimum shell-snapshot profile.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Drop the unsupported 64 MiB shell-snapshot metrics from collection and matrix verification, and keep the Ubuntu wget regression test portable to unprivileged Windows runners.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pin Debian toolchain packages for reproducible builds
docker/Dockerfile:4
The base-image digest does not make this build environment immutable because the later apt-get update resolves unversioned compiler, libc, cpio, gzip, and zstd packages from moving Debian repositories. Those tools contribute bytes to the Ubuntu helpers/initramfs, while the determinism target only compares two builds against the same current repository state. Use a dated Debian snapshot with pinned package versions (or a fully provisioned immutable tool image) so clean rebuilds remain reproducible over time.
The reason will be displayed to describe this comment to others. Learn more.
Copilot review overview
🟡 Changes recommended
Ubuntu release validation can accept stale artifact-manifest pairs, and parts of the documentation disagree with implemented defaults and scenario support.
Get a fresh assessment by requesting another Copilot review.
Record the shared Ubuntu input digest in both artifact manifests, require it during source collection and packaging, keep absolute archive links rooted safely, and document the complete Ubuntu scenario contract.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The Alpine cache has the same missing build input: Docker runs scripts/nvx.py build-initramfs --guest alpine, but this key does not hash scripts/nvx.py. CLI wiring changes can therefore reuse stale Alpine artifacts; include the entry point in this hash as well.
This cache key omits scripts/nvx.py, even though the Docker stages invoke that file to construct the Ubuntu build configuration. A change to the CLI's Ubuntu build wiring can therefore restore and publish stale cached artifacts instead of rebuilding them. Include the entry point among the hashed inputs.
Restrict guest argument to supported Ubuntu value
scripts/nvx.py:587
The parser advertises and accepts --guest alpine, but command_build_distro_layer immediately rejects it because this command only supports Ubuntu. Restrict the argparse choice so invalid input fails at parsing and the generated help matches the actual API.
This issue also appears on line 600 of the same file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--guestselection for build, run, and correctness workflows while preserving Alpine defaults.debclosure without maintainer-script execution, and emit deterministic initramfs and EROFS artifacts with package/helper provenanceguest/common, retain Alpine-only sandbox entry helpers underguest/alpine, and add the Ubuntu shell-ready and sandbox smoke profilesValidation
python3 -m unittest scripts/test_performance.py scripts/test_nvx_tools.py scripts/test_microvm_tests.py -v— 217 tests passed, 1 skippedpython3 scripts/nvx.py verify, CLI help smoke tests, host inventory tests, and PowerShell syntax parsingScope
This change does not modify the OpenVMM submodule or
kernel/config-microvm. Ubuntu uses the existing NVX kernel and fixed microVM ABI. Systemd remains unsupported for the initial Ubuntu profiles.