Repository navigation
piwork-microvm v0.2.2
piwork-microvm v0.2.2
Bundles original Piwork 0.0.14 at commit 3355a106766116a9d64b8492209a93218f3b4b21, unmodified.
Official release input: v0.0.14 (upstream Preview), actual build commit 3355a106766116a9d64b8492209a93218f3b4b21, publication commit 7f32eae2219be4fd43f786eccefbab20fa896dc5. Four asset sizes/SHA256 and three production image digests are recorded in the manifest.
Artifacts
| File | Platform | Bytes | SHA256 |
|---|---|---|---|
piwork-microvm-v0.2.2-linux-amd64 |
cli linux/amd64 | 405905461 | f4d72b964245a033d5977d6c4136a66dc7dc4c6a9c092682ece51d4c46e7a360 |
piwork-microvm-v0.2.2-windows-amd64.exe |
cli windows/amd64 | 422725876 | a6fc044e9d84402eeb0733d896acf733b102e594df54f91834f0618107a456fc |
piwork-microvm-gui-v0.2.2-linux-amd64 |
gui linux/amd64 | 410246972 | aa0ed3b959bace3d3e9f7a6fed53f79e6fc296463795281435191293cfa44a0c |
piwork-microvm-gui-v0.2.2-windows-amd64.exe |
gui windows/amd64 | 427952721 | 9bfdc9d294ebf020e38813ec6307e1e97e1253a7dca2e3c583399910c519f1d2 |
Verify downloads with these checksums.
Verification
Acceptance evidence covers the locked inputs, not these artifact bytes: the Guest ext4 rootfs is regenerated with fresh UUIDs on every build, so artifacts are not byte-reproducible. Verify downloads with the checksums in this manifest.
Input fingerprint: 31326e44b53624320170b581678ae88394825b83f172ed28a8702d5f29565eee
| Scope | Platform | Status | Evidence |
|---|---|---|---|
| build | linux | verified | dist/release-evidence/build-linux.json |
| build | windows | verified | dist/release-evidence/build-windows.json |
| integration | linux | not-verified | recorded evidence lacks a matching input fingerprint, is incomplete, or covers other inputs |
| integration | windows | not-verified | recorded evidence lacks a matching input fingerprint, is incomplete, or covers other inputs |
| realModel | linux | not-verified | recorded evidence lacks a matching input fingerprint, is incomplete, or covers other inputs |
| realModel | windows | not-verified | recorded evidence lacks a matching input fingerprint, is incomplete, or covers other inputs |
| upstream | - | none | Upstream verification is informational and never upgrades a MicroVM scope. |
Corresponding source
This release distributes binaries and a Guest image that include GPL and LGPL components. The written offer below covers every component listed here.
| Component | License | Source |
|---|---|---|
| Linux 6.6.159, unmodified | GPL-2.0 | https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.159.tar.xz, sha256 7206727244da5d85f4a03758d29e1c0673f2f01877793f494c0f3638c46b8fa5 |
| QEMU 10.0.8, modified by 2 patches | GPL-2.0 | https://download.qemu.org/qemu-10.0.8.tar.xz, sha256 e038542a698b003605f4982d469d9f55ad17ea8172ebe2b92e97e3a675aa338f, plus the attached qemu-patches.tar.gz |
| qboot ROM | GPL-2.0 | roms/qboot in the QEMU source archive above, sha256 9b9dfc6c25740d6225625570d71cab6805cc9216e68c8932e343266daaeb8c4b |
| libfdt / dtc, linked into QEMU | GPL-2+ | dtc/ in the QEMU source archive above |
| BusyBox, in the Guest initramfs and rootfs | GPL-2.0 | the busybox-static source package at Debian snapshot 20261018T000000Z |
| 167 Debian packages in the Guest rootfs | GPL and LGPL mix | source packages at Debian snapshot 20261018T000000Z; the installed list is usr/share/piwork-guest-packages.txt inside rootfs.ext4 |
| MinGW-w64 runtime libraries in the Windows QEMU | GPL-3.0 with the GCC runtime exception, or LGPL | the source packages recorded in provenance/windows-toolchain.lock.json |
Production piwork-agentd, piwork-file-helper and piwork-snapshot-helper images, embedded in images.tar |
Node.js MIT plus npm/Debian component licenses | built from the Piwork source at commit 3355a106766116a9d64b8492209a93218f3b4b21; readable texts in piwork-licenses.tar.gz and provenance/piwork-upstream/licenses/images/ |
| Node.js 24 runtime, npm and Yarn inside the Agent image | MIT and bundled package licenses | same image source above; texts in piwork-licenses.tar.gz |
| Debian packages inside the production Agent image, including GCC runtime libraries | GPL/LGPL and other Debian licenses | exact installed versions and copyright/source notices in piwork-licenses.tar.gz (images/agent/INDEX.json); Debian sources at https://deb.debian.org/debian/pool/ and https://snapshot.debian.org/; covered by the written offer below |
Shared libraries shipped beside QEMU (qemu/lib/*.so, *.dll) |
LGPL-2.1+, BSD or GPL-2+ | shipped with the artifact; source as listed above |
Written offer: the complete corresponding source for every GPL and LGPL component listed above is available on request for three years from this release date (GPL-2.0 section 3(b)).
Known limitations
- License texts for the Guest rootfs packages and BusyBox ship at
provenance/guest-licenses/inside the artifact and inguest-licenses.tar.gz, so they can be read without booting the VM; all 167 Guest packages have a text. Kernel and QEMU license texts ship alongside inprovenance/andqemu/licenses/. - Windows artifacts are unsigned, so SmartScreen may warn on first run. Windows requires WHPX and WebView2; Linux requires KVM and the documented GTK/WebKit runtime for the GUI.
- Piwork 0.0.14 is an upstream Preview. This scoped integration does not verify real-model calls, a full failure matrix or general downgrade compatibility. Upgrade a stopped backup copy and retain the untouched backup.
- Readable license texts for the imported binaries, Go modules and production images ship as
piwork-licenses.tar.gzand underprovenance/piwork-upstream/licenses/. The index records every extraction gap. The imported binaries/images index also records 0 Go modules and 0 Debian package texts without an extractable file; seepiwork-licenses.tar.gz. - Acceptance evidence is recorded against the locked inputs, not against these artifact bytes; see Verification above.