guestartifacts

Overview ¶

Package guestartifacts serves the guest boot artifacts (the Linux kernel and the vminitd initfs) that ossein hands to Virtualization.framework.

Both are EMBEDDED into the ossein binary at build time and EXTRACTED to a content-addressed cache on first use (VZ's bootloader/disk APIs take file paths, not bytes). `just build` fetches + cosign/sha verifies the pinned ossein-kernel release and builds the initfs, then `go build` bundles them via //go:embed — so trust is settled at build time and the runtime carries no network, cosign, or GitHub dependency. A fresh binary's artifacts hash differently and land in a new cache dir, so they never collide with a previous build's.