[KoLDXr00T]

Follow-up to #4, which introduced the cached isolation proof this fixes. Found while running the escape suite for #55.

The bugs

The isolation check that gates every run, exec and up (EnsureIsolated) is cached once per box home. The cache key is RuntimeIdentity(), which on Linux fingerprints krun, crun and podman whatever the backend.

1. box up fails on a firecracker-only host. RuntimeIdentity requires krun on PATH and returns no 'krun' on PATH, although firecracker never runs krun. The self-hosted kvm runner has krun installed, which hid this.
2. A proof made on one backend clears every other. A firecracker sandbox passing the check stores the one token, and a podman sandbox then skips its own check, so its krun path was never proven. podmanBackend.Preflight checks only that krun exists and leaves libkrun to this check. On a host whose crun lacks libkrun, the podman sandbox could therefore run as a plain container on the host kernel, cleared by the firecracker proof. This takes a broken toolchain plus a mix of backends (which backend: auto makes ordinary), and it defeats the one guard against that fallback.
3. The Firecracker build and its guest kernel are not in the fingerprint. A change to them did not force a re-check.

The fix

• RuntimeIdentity(backend) fingerprints only what that backend runs:
  • podman and krun: krun and the crun it resolves to (path, size, mtime, --version with its +LIBKRUN tag);
  • firecracker: the pinned Firecracker and kernel hashes (fcAssets checks both before every use), the tools image tag, and crun, which runs the VMM;
  • all backends: podman's version and the backend name.
• verify.json holds one proof per backend ({"backends": {...}}), written via a temp file and rename. A cache in the old single-token format reads as empty, so each backend re-verifies once after upgrade. That costs one double boot and never clears a run.
• MarkVerified takes the spec, so box build and box verify record the proof under the sandbox's backend.
• box doctor reports a row per proven backend. box inspect --security-report reports the proof for the sandbox's own backend.
• SECURITY.md says each backend is proven on its own.

Checked

• Unit tests:
  • a firecracker proof doesn't clear podman or krun, and proving podman doesn't drop the firecracker proof;
  • the old and corrupt cache formats read as unverified, and a fresh proof replaces them;
  • with only crun and podman on PATH, the firecracker identity works while podman and krun refuse;
  • an upgraded crun changes the firecracker identity;
  • all three backends get distinct identities.
• go test -race ./..., go vet, gofmt.
• CI on the fork (check, vulncheck, three fuzz targets): https://github.com/KoLDXr00T/bluebox/actions/runs/39483914902
• Escape suite, firecracker, strict and standard, on a GitHub-hosted runner with no krun on PATH (a step fails the job if krun is present): no escapes, one expected warning in standard mode (the VMM runs as your own UID): https://github.com/KoLDXr00T/bluebox/actions/runs/39483949749. Before this fix, the same setup failed at up with no 'krun' on PATH: https://github.com/KoLDXr00T/bluebox/actions/runs/39482241469

Not run: the podman and krun backends' escape suite. That needs crun built with libkrun, i.e. the self-hosted kvm runner, and none is registered yet (#31).

Left as is

box doctor still marks a missing krun as FAIL on a firecracker-only host. That's now only cosmetic, since up works, but it misleads. It could become a warning that names the backends needing krun, as a follow-up.