Passport

Passport

Cutover Passport is the assurance artifact ops/security accept before convert — not a virt-v2v / MTV replacement. GuestKit certifies; hyper2kvm converts.

Deep docs: migration-assurance § passport.

Emit / verify

guestkit passport emit vm.qcow2 --target kvm -o passport.json --bundle
guestkit passport verify passport.json --fail-below 80

--bundle also writes <stem>.passport/ with companion FixPlan YAML.

Signing (optional)

Requires build with --features agent:

guestkit passport keygen --seed ./ed25519.seed --public ./ed25519.pub
guestkit passport emit vm.qcow2 --target kvm -o p.json \
  --sign-key ./ed25519.seed --issuer "ci/prod" --expires-hours 72
guestkit passport verify p.json --fail-below 80 --require-signature \
  --trust-keys ./trusted-pubs.txt --max-age-hours 168

Live attestation

guestkit passport emit vm.qcow2 --target kvm -o p.json \
  --live-url http://127.0.0.1:8765

Needs guestkit agent-proxy (or equivalent) answering /doctor.

What blocks hard

• BitLocker offline hard-block when evidence says the volume is encrypted / not decryptable offline
• Score below --fail-below on verify
• Missing / invalid signature when --require-signature
• Passport older than --max-age-hours

When you still need MTV / virt-v2v

Passport does not convert disks, move networks, or delete AD computer accounts. Use conversion/orchestration tools after verify succeeds; keep the Passport on the change ticket.

Web

Dock Passport → POST /api/v1/vms/:id/passport → download JSON.