piwork-microvm v0.2.3

piwork-microvm v0.2.3

Bundles original Piwork 0.0.15 at commit 95aee2f32cbeed2e55dc5b7d496322facf01cc6c, unmodified.

Official release input: v0.0.15 (upstream Preview), actual build commit 95aee2f32cbeed2e55dc5b7d496322facf01cc6c, publication commit 0f2a2385891c301b10dd1e1fa844d9b10bdd760a. Four asset sizes/SHA256 and three production image digests are recorded in the manifest.

Artifacts

File	Platform	Bytes	SHA256
piwork-microvm-v0.2.3-linux-amd64	cli linux/amd64	406463580	e9f34388eaf29aa06ff7f0563b609707dca63a2f9086bdc2d6563fd910106fb4
piwork-microvm-v0.2.3-windows-amd64.exe	cli windows/amd64	423286582	492819b7e65c4180707c961d43f7e95f4cbb5ca6e924f16832b85c9ca690024a
piwork-microvm-gui-v0.2.3-linux-amd64	gui linux/amd64	410926412	2baa539bd2012f7fc12a1a33b1d5728dc778c6da70503d10d17eadcc376bbc7f
piwork-microvm-gui-v0.2.3-windows-amd64.exe	gui windows/amd64	428544014	b494dff521b419d471bfb56f163b97d43eb85835f2f9c27a34d4e8d8014a8737

Verify downloads with these checksums.

Verification

Acceptance evidence covers the locked inputs, not these artifact bytes: the Guest ext4 rootfs is regenerated with fresh UUIDs on every build, so artifacts are not byte-reproducible. Verify downloads with the checksums in this manifest.

Input fingerprint: c9a176639a2d2e35989c830aa429aeb9865dd5c6fe331d711539555378fedcf7

Scope	Platform	Status	Evidence
build	linux	not-verified	recorded evidence lacks a matching input fingerprint, is incomplete, or covers other inputs
build	windows	not-verified	recorded evidence lacks a matching input fingerprint, is incomplete, or covers other inputs
integration	linux	not-verified	recorded evidence lacks a matching input fingerprint, is incomplete, or covers other inputs
integration	windows	not-verified	recorded evidence lacks a matching input fingerprint, is incomplete, or covers other inputs
realModel	linux	not-verified	recorded evidence lacks a matching input fingerprint, is incomplete, or covers other inputs
realModel	windows	not-verified	recorded evidence lacks a matching input fingerprint, is incomplete, or covers other inputs
upstream	-	none	Upstream verification is informational and never upgrades a MicroVM scope.

Corresponding source

This release distributes binaries and a Guest image that include GPL and LGPL components. The written offer below covers every component listed here.

Component	License	Source
Linux 6.6.159, unmodified	GPL-2.0	https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.159.tar.xz, sha256 7206727244da5d85f4a03758d29e1c0673f2f01877793f494c0f3638c46b8fa5
QEMU 10.0.8, modified by 2 patches	GPL-2.0	https://download.qemu.org/qemu-10.0.8.tar.xz, sha256 e038542a698b003605f4982d469d9f55ad17ea8172ebe2b92e97e3a675aa338f, plus the attached qemu-patches.tar.gz
qboot ROM	GPL-2.0	roms/qboot in the QEMU source archive above, sha256 9b9dfc6c25740d6225625570d71cab6805cc9216e68c8932e343266daaeb8c4b
libfdt / dtc, linked into QEMU	GPL-2+	dtc/ in the QEMU source archive above
BusyBox, in the Guest initramfs and rootfs	GPL-2.0	the busybox-static source package at Debian snapshot 20261018T000000Z
167 Debian packages in the Guest rootfs	GPL and LGPL mix	source packages at Debian snapshot 20261018T000000Z; the installed list is usr/share/piwork-guest-packages.txt inside rootfs.ext4
MinGW-w64 runtime libraries in the Windows QEMU	GPL-3.0 with the GCC runtime exception, or LGPL	the source packages recorded in provenance/windows-toolchain.lock.json
Production piwork-agentd, piwork-file-helper and piwork-snapshot-helper images, embedded in images.tar	Node.js MIT plus npm/Debian component licenses	built from the Piwork source at commit 95aee2f32cbeed2e55dc5b7d496322facf01cc6c; readable texts in piwork-licenses.tar.gz and provenance/piwork-upstream/licenses/images/
Node.js 24 runtime, npm and Yarn inside the Agent image	MIT and bundled package licenses	same image source above; texts in piwork-licenses.tar.gz
Debian packages inside the production Agent image, including GCC runtime libraries	GPL/LGPL and other Debian licenses	exact installed versions and copyright/source notices in piwork-licenses.tar.gz (images/agent/INDEX.json); Debian sources at https://deb.debian.org/debian/pool/ and https://snapshot.debian.org/; covered by the written offer below
Shared libraries shipped beside QEMU (qemu/lib/*.so, *.dll)	LGPL-2.1+, BSD or GPL-2+	shipped with the artifact; source as listed above

Written offer: the complete corresponding source for every GPL and LGPL component listed above is available on request for three years from this release date (GPL-2.0 section 3(b)).

Known limitations

• License texts for the Guest rootfs packages and BusyBox ship at provenance/guest-licenses/ inside the artifact and in guest-licenses.tar.gz, so they can be read without booting the VM; all 167 Guest packages have a text. Kernel and QEMU license texts ship alongside in provenance/ and qemu/licenses/.
• Windows artifacts are unsigned, so SmartScreen may warn on first run. Windows requires WHPX and WebView2; Linux requires KVM and the documented GTK/WebKit runtime for the GUI.
• Piwork 0.0.15 is an upstream Preview. This scoped integration does not verify real-model calls, a full failure matrix or general downgrade compatibility. Upgrade a stopped backup copy and retain the untouched backup.
• Readable license texts for the imported binaries, Go modules and production images ship as piwork-licenses.tar.gz and under provenance/piwork-upstream/licenses/. The index records every extraction gap. The imported binaries/images index also records 0 Go modules and 0 Debian package texts without an extractable file; see piwork-licenses.tar.gz.
• Acceptance evidence is recorded against the locked inputs, not against these artifact bytes; see Verification above.

Additional acceptance limitations

• When the browser UI port is set to 80, requests using the normal HTTP origin return INVALID_HOST. Use a non-default-numbered UI port such as 17891.
• During Linux/KVM acceptance, a tool-bearing Session history read returned HTTP 503; ordinary text Session history and persisted Run results were readable. This behavior needs further investigation.