[kwsantiago]

Summary

• scripts/vm/vm.sh: builds and checks the sargo images in a throwaway QEMU/KVM VM, so the privileged steps (build-image.sh, verify-image.sh, negative-test.sh) never need the host's root or Docker socket. It runs as the user, with no libvirt and no sudo.
• Base image: the Arch cloud image is pinned in manifest.toml [build-vm] by version and sha256, and checked against the arch-boxes signing key in scripts/vm/arch-boxes.asc.
• Isolation: networking goes through passt with the host's loopback unmapped, QEMU runs under -sandbox on with spawn denied, and the guest's host key is generated and pinned before first boot (StrictHostKeyChecking yes). Before every build, listeners on the host's loopback (IPv4 and IPv6) check that the guest cannot reach them; the verdict comes from the host, not from the guest.
• Every build gets a fresh VM unless VM_REUSE=1. Only a git bundle of the requested ref goes in, and only the named image files come out, copied as bytes, with size caps. Guest output is treated as data: both streams are filtered of terminal control sequences, bounded in size, and never evaluated, and no terminal input reaches the guest. The guest's serial console log is capped at 64M. One build runs at a time per state directory.
• scripts/vm/in-vm-build.sh runs CI's image steps: the packages, the release image and its verify, the QML tests, the PIN door, the negative test, and the dev image.
• scripts/vm/flash-sargo.sh flashes the result from the repo's own script, never from a flash.sh that came out of the VM.
• The defaults are at most 16 CPUs and QEMU at nice 10, so the host stays usable during a build.
• docs/build-vm.md covers usage, isolation and its residual risk (the guest can reach the LAN and the host's non-loopback addresses), and the measured times.

Test plan

• vm.sh fetch-base: the sha256 and signature were verified against the pinned key.
• A fresh vm.sh build HEAD <dev key> passed end to end on the final commit: the isolation check passed (IPv4 and IPv6 loopback unreachable, outbound HTTPS working), all packages built including the kernel, and so did both images. verify-image passed (apart from the online-resize check, which qemu-user cannot emulate and CI runs natively), as did the QML tests, the PIN door and the negative tests. The images and SHA256SUMS were copied out and their checksums matched.
• flash-sargo.sh passed its file and SHA256SUMS checks on the copied-out images.
• stop escalates to SIGKILL on a QEMU that ignores TERM, and keeps its pidfile until it is gone.
• Other checks, by hand:
  • guest output is not evaluated by the host (an injected arithmetic payload, a zero-padded line count);
  • the output filter strips OSC and CSI sequences, resists doubled UTF-8 C1 bytes, and bounds line length;
  • stale or garbage pidfiles are ignored;
  • cleanup runs on Ctrl-C and TERM, and with a state path containing quotes and $.