piwork-microvm v0.1.1

piwork-microvm v0.1.1

Bundles original Piwork 0.0.9 at commit a6c36da16ebcc0e96f0e34ef820d857f2bea4877, unmodified.

Artifacts

File	Platform	Bytes	SHA256
piwork-microvm-v0.1.1-linux-amd64	linux/amd64	392490610	67e523c6c590ea93a5a07680fa530e009526b7c4f340ff3f9d8cc812b594f26b
piwork-microvm-v0.1.1-windows-amd64.exe	windows/amd64	409301106	f79ca827b73041033ddb5c30f4e0e4fce17aeda998c04d7209f0f01ed35bd077

Verify downloads with these checksums.

Verification

Acceptance evidence covers the locked inputs, not these artifact bytes: the Guest ext4 rootfs is regenerated with fresh UUIDs on every build, so artifacts are not byte-reproducible. Verify downloads with the checksums in this manifest.

Platform	Status	Evidence
linux	verified	openspec/changes/archive/2026-10-21-support-windows-and-disk-only-storage/evidence/completion/linux
windows	verified	openspec/changes/archive/2026-10-21-support-windows-and-disk-only-storage/evidence/completion/windows

Corresponding source

This release distributes binaries and a Guest image that include GPL and LGPL components. The written offer below covers every component listed here.

Component	License	Source
Linux 6.6.159, unmodified	GPL-2.0	https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.159.tar.xz, sha256 7206727244da5d85f4a03758d29e1c0673f2f01877793f494c0f3638c46b8fa5
QEMU 10.0.8, modified by 2 patches	GPL-2.0	https://download.qemu.org/qemu-10.0.8.tar.xz, sha256 e038542a698b003605f4982d469d9f55ad17ea8172ebe2b92e97e3a675aa338f, plus the attached qemu-patches.tar.gz
qboot ROM	GPL-2.0	roms/qboot in the QEMU source archive above, sha256 9b9dfc6c25740d6225625570d71cab6805cc9216e68c8932e343266daaeb8c4b
libfdt / dtc, linked into QEMU	GPL-2+	dtc/ in the QEMU source archive above
BusyBox, in the Guest initramfs and rootfs	GPL-2.0	the busybox-static source package at Debian snapshot 20261018T000000Z
167 Debian packages in the Guest rootfs	GPL and LGPL mix	source packages at Debian snapshot 20261018T000000Z; the installed list is usr/share/piwork-guest-packages.txt inside rootfs.ext4
MinGW-w64 runtime libraries in the Windows QEMU	GPL-3.0 with the GCC runtime exception, or LGPL	the source packages recorded in provenance/windows-toolchain.lock.json
Shared libraries shipped beside QEMU (qemu/lib/*.so, *.dll)	LGPL-2.1+, BSD or GPL-2+	shipped with the artifact; source as listed above

Written offer: the complete corresponding source for every GPL and LGPL component listed above is available on request for three years from this release date (GPL-2.0 section 3(b)).

Known limitations

• License texts for the Guest rootfs packages and BusyBox ship at provenance/guest-licenses/ inside the artifact and in guest-licenses.tar.gz, so they can be read without booting the VM; all 167 Guest packages have a text. Kernel and QEMU license texts ship alongside in provenance/ and qemu/licenses/.
• Windows artifacts are unsigned, so SmartScreen may warn on first run.
• Acceptance evidence is recorded against the locked inputs, not against these artifact bytes; see Verification above.