Farrow 0.1.0

Farrow 0.1.0

Farrow 0.1.0 is the first public, pre-1.0 developer release of the native
Go/QEMU runtime for Pigsty-compatible local labs.

Highlights

• One Pigsty-compatible Inventory is both the VM specification and the Pigsty
  deployment inventory; there is no second project format.
• One owner-scoped deployment supports fixed-IP additive scale-out on macOS
  and Linux, with explicit drift, recreate, and deletion boundaries.
• QMP plus full process identity, atomic state, transaction journals, and
  manifest-scoped host networking keep lifecycle recovery fail-closed.
• Locale/timezone-independent process identity, QMP-bound interrupted-start
  adoption, and bounded post-spawn compensation close the startup recovery
  window without weakening PID-reuse protection.
• Signed image Catalogs, SHA-256/qcow2 verification, immutable upstream
  fallback, local imports, and bounded cache pruning cover the image path.
• Interrupted image downloads resume from the staged bytes and are bounded by an
  inactivity watchdog rather than an overall deadline, so a multi-gigabyte
  artifact on a slow link finishes instead of failing partway through.
• Static image repositories use a source-controlled repo.yaml, generated
  schema-3 catalog.json, immutable readable artifact names, and explicit
  farrow repo scan/build/verify operations.
• Exact image releases and numeric version prefixes are both available;
  Pigsty inventories can keep vm_image: el9 and select the newest matching
  9.x or 9.7.x build with vm_version.
• Release assets include four platform archives, amd64/arm64 DEB and RPM
  packages, SPDX SBOMs, checksums, a Homebrew formula, a user-scoped installer,
  and keyless Sigstore signature/provenance bundles. Reconstructed dependency
  license texts ship inside every archive and package.

Validated boundary

The dated native matrix covers macOS arm64 with HVF/QEMU 11.1/socket_vmnet and
Ubuntu 26.04 amd64 with KVM/QEMU 10.2.1/NetworkManager. Other shipped targets
are cross-built and package-verified but retain the narrower status documented
at https://farrow.pgsty.com/docs/about/status/.

The embedded schema-3 Catalog revision 2026082903 contains 9 image families
and 27 architecture-specific artifacts. Current built-in versions are
supported, except EOL EL7 and the retained EL9 9.3/9.6 and EL10 10.0
compatibility versions, which are deprecated. Apple Silicon runs the stock
Rocky Linux 8 arm64 image with visible same-architecture TCG because its
64K-granule kernel is incompatible with HVF. TCG results are compatibility
evidence, not performance evidence.

Image availability

The built-in Catalog pins distribution-owned artifacts by exact SHA-256, and
distributions rotate those artifacts on their own schedule. Rocky publishes only
the current point release under /pub/rocky/<major>/, and Ubuntu keeps a
rolling window of dated directories, so el8, el9:stable, el10:stable, and
the u22/u24/u26 entries will eventually stop resolving upstream even
though the digests remain correct. Every one of the 27 artifacts resolves as of
this release.

When that happens Farrow says so explicitly and names the three remedies:
upgrade to a Farrow release with a newer Catalog, farrow image sync a
published Catalog, or point --repo/$FARROW_REPO at a mirror that still
carries the bytes. Public builds use https://repo.pigsty.cc/farrow as the
default signed Catalog and artifact mirror. --repo and $FARROW_REPO override
it; if it is unavailable, Farrow uses the embedded Catalog and immutable
distribution upstreams.

Start

Download the archive or native Linux package for your host from this Release.
The release install.sh performs a user-scoped archive install after checking
the selected asset against checksums.txt. If cosign is on the PATH it also
requires the Sigstore bundle and verifies checksums.txt against this
workflow's signing identity first; a missing or invalid bundle fails closed:

chmod +x install.sh
FARROW_VERSION=0.1.0 ./install.sh
farrow setup --dry-run
farrow setup --yes
farrow up

Review the full installation and privilege boundary before applying setup:
https://farrow.pgsty.com/docs/start/tutorial/.

Release integrity

checksums.txt.sigstore.json signs the checksum manifest, and
checksums.provenance.sigstore.json attests its SLSA provenance predicate.
The release workflow verifies both bundles against its exact GitHub Actions
OIDC identity before creating this immutable draft.

Because 0.1.0 is below 1.0.0, the release is marked as a GitHub pre-release and
release.json records the prerelease channel; one rule decides both.

This draft must not be published until source CI, the packaging workflow, the
external native gates, the documentation site/DNS, and clean-host package
consumption are confirmed.