piwork-microvm v0.1.0

piwork-microvm v0.1.0

Bundles original Piwork 0.0.9 at commit a6c36da16ebcc0e96f0e34ef820d857f2bea4877, unmodified.

Artifacts

File	Platform	Bytes	SHA256
piwork-microvm-v0.1.0-linux-amd64	linux/amd64	391890720	e78a2ca0925f8271bdf1d1fe4b69ec177060b0b7316861e09059e5a733b1898a
piwork-microvm-v0.1.0-windows-amd64.exe	windows/amd64	408697560	515455547b62ce8ab580a2fad13fe5d9ccea393131434d19f6ec15a6df55ea92

Verify downloads with these checksums.

Verification

Acceptance evidence covers the locked inputs, not these artifact bytes: the Guest ext4 rootfs is regenerated with fresh UUIDs on every build, so artifacts are not byte-reproducible. Verify downloads with the checksums in this manifest.

Platform	Status	Evidence
linux	verified	openspec/changes/support-windows-and-disk-only-storage/evidence/completion/linux
windows	verified	openspec/changes/support-windows-and-disk-only-storage/evidence/completion/windows

Corresponding source

This release distributes binaries and a Guest image that include GPL and LGPL components. The written offer below covers every component listed here.

Component	License	Source
Linux 6.6.159, unmodified	GPL-2.0	https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.159.tar.xz, sha256 7206727244da5d85f4a03758d29e1c0673f2f01877793f494c0f3638c46b8fa5
QEMU 10.0.8, modified by 2 patches	GPL-2.0	https://download.qemu.org/qemu-10.0.8.tar.xz, sha256 e038542a698b003605f4982d469d9f55ad17ea8172ebe2b92e97e3a675aa338f, plus the attached qemu-patches.tar.gz
qboot ROM	GPL-2.0	roms/qboot in the QEMU source archive above, sha256 9b9dfc6c25740d6225625570d71cab6805cc9216e68c8932e343266daaeb8c4b
libfdt / dtc, linked into QEMU	GPL-2+	dtc/ in the QEMU source archive above
BusyBox, in the Guest initramfs and rootfs	GPL-2.0	the busybox-static source package at Debian snapshot 20261018T000000Z
167 Debian packages in the Guest rootfs	GPL and LGPL mix	source packages at Debian snapshot 20261018T000000Z; the installed list is usr/share/piwork-guest-packages.txt inside rootfs.ext4
MinGW-w64 runtime libraries in the Windows QEMU	GPL-3.0 with the GCC runtime exception, or LGPL	the source packages recorded in provenance/windows-toolchain.lock.json
Shared libraries shipped beside QEMU (qemu/lib/*.so, *.dll)	LGPL-2.1+, BSD or GPL-2+	shipped with the artifact; source as listed above

Written offer: the complete corresponding source for every GPL and LGPL component listed above is available on request for three years from this release date (GPL-2.0 section 3(b)).

Known limitations

• License texts for the Guest rootfs packages and BusyBox exist only inside rootfs.ext4 (167 Debian copyright files), so they cannot be read without booting the VM. Kernel and QEMU license texts ship alongside in provenance/ and qemu/licenses/.
• Windows artifacts are unsigned, so SmartScreen may warn on first run.
• Acceptance evidence is recorded against the locked inputs, not against these artifact bytes; see Verification above.