v0.1.0 (contract v4.2)

beskar7-inspector v0.1.0

Implements controller↔inspector contract v4.2
(verified byte-identical against beskar7 contract/v4.2).

Pair this with a beskar7 controller that speaks v4.2.
The controller's contract version is in test/contract/VERSION in the beskar7 repo.

Boot artifacts

vmlinuz and initrd.img are the two files your boot server serves.
Serve them under one directory and point Beskar7Machine.spec.inspectionImageURL
at that directory (the controller appends /vmlinuz and /initrd.img).

curl -fsSLO https://github.com/projectbeskar/beskar7-inspector/releases/download/v0.1.0/vmlinuz
curl -fsSLO https://github.com/projectbeskar/beskar7-inspector/releases/download/v0.1.0/initrd.img
curl -fsSLO https://github.com/projectbeskar/beskar7-inspector/releases/download/v0.1.0/sha256sums.txt
sha256sum -c sha256sums.txt --ignore-missing

Container image

Carries both files at /vmlinuz and /initrd.img (useful for air-gapped mirrors):

docker pull ghcr.io/projectbeskar/beskar7-inspector:contract-v4.2   # or :v0.1.0
cid=$(docker create ghcr.io/projectbeskar/beskar7-inspector:v0.1.0) && docker cp $cid:/vmlinuz . && docker cp $cid:/initrd.img . && docker rm $cid

Verifying

The image is signed (keyless/OIDC) and sha256sums.txt carries a cosign bundle:

IDENTITY='^https://github.com/projectbeskar/beskar7-inspector/\.github/workflows/release\.yml@refs/tags/.*$'
ISSUER=https://token.actions.githubusercontent.com

cosign verify ghcr.io/projectbeskar/beskar7-inspector:v0.1.0 \
  --certificate-identity-regexp "$IDENTITY" --certificate-oidc-issuer "$ISSUER"

cosign verify-blob --bundle sha256sums.txt.cosign.bundle \
  --certificate-identity-regexp "$IDENTITY" --certificate-oidc-issuer "$ISSUER" sha256sums.txt

Checksums

ba69e102b48124440a73ed4097fe187536609a53fc0d5165d1683cc5b194b4e0  vmlinuz
d0bc6d085d5012bbfc85425ea1bb4eb11b9134a00c9b10a4554d400ebbcdb1d5  initrd.img
3bfec357084a9214e4448f01f95059fc05456fd68c8cfb9b2d6b1a91f0e7c05e  contract-version.txt