nvx-rs: delete the bundled feature and its build script (SL6.6a)

.github/actions/check-nvx-rs/action.yml

@@ -40,9 +40,6 @@ runs:
     - name: Lint
       shell: bash
       working-directory: nvx-rs
-      env:
-        # --all-features enables `bundled`; stage nothing instead of downloading a release.
-        NVX_BUNDLE: skip
       run: |
         set -euo pipefail
         cargo "+${{ steps.toolchains.outputs.toolchain }}" clippy --locked --all-targets --all-features \
@@ -64,9 +61,6 @@ runs:
     - name: Test
       shell: bash
       working-directory: nvx-rs
-      env:
-        # --all-features enables `bundled`; stage nothing instead of downloading a release.
-        NVX_BUNDLE: skip
       run: |
         set -euo pipefail
         cargo "+${{ steps.toolchains.outputs.toolchain }}" test --locked --all-features
@@ -75,40 +69,10 @@ runs:
         cargo "+${{ steps.toolchains.outputs.toolchain }}" build --locked --lib --no-default-features
         cargo "+${{ steps.toolchains.outputs.toolchain }}" test --locked --lib --no-default-features
 
-    # Stages a synthetic release in the current layout, with nvx-rs and its
-    # provenance, which the bundled-artifacts test then requires to find.
-    - name: Check artifact bundling
-      shell: bash
-      working-directory: nvx-rs
-      run: |
-        set -euo pipefail
-        bundle=$(mktemp -d)
-        executable=openvmm
-        cli=nvx-rs
-        bundle_dir="${bundle}"
-        if [[ "${RUNNER_OS}" == Windows ]]; then
-          executable=openvmm.exe
-          cli=nvx-rs.exe
-          bundle_dir=$(cygpath -w "${bundle}")
-        fi
-        mkdir -p "${bundle}/bin" "${bundle}/guest" "${bundle}/provenance"
-        printf openvmm > "${bundle}/bin/${executable}"
-        printf nvx-rs > "${bundle}/bin/${cli}"
-        printf '{}' > "${bundle}/provenance/nvx-rs.provenance.json"
-        printf kernel > "${bundle}/guest/vmlinux"
-        printf initramfs > "${bundle}/guest/initramfs.cpio.gz"
-        cp ../SOURCE-MANIFEST.json "${bundle}/"
-        (cd "${bundle}" && sha256sum "bin/${executable}" "bin/${cli}" guest/vmlinux \
-          guest/initramfs.cpio.gz provenance/nvx-rs.provenance.json \
-          SOURCE-MANIFEST.json > SHA256SUMS)
-        NVX_BUNDLE_DIR="${bundle_dir}" cargo "+${{ steps.toolchains.outputs.toolchain }}" test --locked --lib \
-          --features bundled artifacts
-
     - name: Build documentation
       shell: bash
       working-directory: nvx-rs
       env:
-        NVX_BUNDLE: skip
         RUSTDOCFLAGS: -D warnings
       run: cargo "+${{ steps.toolchains.outputs.toolchain }}" doc --locked --no-deps --all-features
 
@@ -124,9 +88,6 @@ runs:
     - name: Check the minimum supported Rust version
       shell: bash
       working-directory: nvx-rs
-      env:
-        # --all-features enables `bundled`; stage nothing instead of downloading a release.
-        NVX_BUNDLE: skip
       run: >-
         cargo "+${{ steps.toolchains.outputs.msrv }}" check
         --locked --all-targets --all-features
@@ -135,9 +96,6 @@ runs:
       if: runner.os == 'Linux'
       shell: bash
       working-directory: nvx-rs
-      env:
-        # --all-features enables `bundled`; stage nothing instead of downloading a release.
-        NVX_BUNDLE: skip
       run: |
         set -euo pipefail
         rustup target add --toolchain "${{ steps.toolchains.outputs.toolchain }}" aarch64-apple-darwin

.github/workflows/nvx-rs-mutants.yml

@@ -145,8 +145,6 @@ jobs:
         shell: bash
         working-directory: nvx-rs
         env:
-          # --all-features enables `bundled`; stage nothing instead of downloading a release.
-          NVX_BUNDLE: skip
           FILES: ${{ needs.plan.outputs.files }}
           TESTS: ${{ needs.plan.outputs.tests }}
           TARGETS: ${{ needs.plan.outputs.targets }}

doc/acceptance-case-matrix.md

@@ -33,7 +33,7 @@ its own in turn.
 | [The adapter's scenarios](#the-adapters-scenarios) | 157 | 0 | 113 | 44 |
 | [The adapter's other tests](#the-adapters-other-tests) | 169 | 0 | 9 | 160 |
 | [MicroVM scenarios](#microvm-scenarios) | 54 | 50 | 3 | 1 |
-| [CI](#ci) | 69 | 43 | 3 | 23 |
+| [CI](#ci) | 69 | 42 | 3 | 24 |
 | [Docs](#docs) | 36 | 25 | 3 | 8 |
 
 ## The adapter's scenarios
@@ -424,7 +424,7 @@ their own. The tests that a step runs have rows of their own where they concern
 | `.github/actions/check-nvx-rs` | Check formatting | kept |  |
 | `.github/actions/check-nvx-rs` | Lint | kept | Builds `nvx` with each feature set, warnings denied: all features, `host` (the default), no default features, and `serde`, `cli` and `testing` alone, which checks `serde` alone since this matrix |
 | `.github/actions/check-nvx-rs` | Test | kept | Runs `nvx-rs/tests/security_checklist.rs` too |
-| `.github/actions/check-nvx-rs` | Check artifact bundling | kept |  |
+| `.github/actions/check-nvx-rs` | Check artifact bundling | retired | The `bundled` feature, which staged a release at build time, leaves NVX with its build script and `artifacts.json` (SL6.6a, #1122) |
 | `.github/actions/check-nvx-rs` | Build documentation | kept |  |
 | `.github/actions/check-nvx-rs` | Check the public API | kept |  |
 | `.github/actions/check-nvx-rs` | Check the minimum supported Rust version | kept |  |
@@ -443,8 +443,8 @@ their own. The tests that a step runs have rows of their own where they concern
 | `.github/workflows/ci.yml` | openvmm-ci: Check OpenVMM's CI of the pinned revision | kept |  |
 | `.github/workflows/ci.yml` | performance-gate: Gate on performance regressions | kept |  |
 | `.github/workflows/ci.yml` | required-status-check: Verify required jobs | kept | SL5.2 removes the adapter's job from what it requires |
-| `.github/workflows/ci.yml` | crate-package: Package, check, and build the nvx crate | kept |  |
-| `.github/workflows/ci.yml` | crate-release: Check the nvx package | kept |  |
+| `.github/workflows/ci.yml` | crate-package: Package, check, and build the nvx crate | kept | Since SL6.6a, the package holds no build script or `artifacts.json`, and builds once, with every feature |
+| `.github/workflows/ci.yml` | crate-release: Check the nvx package | kept | Since SL6.6a, the package holds no build script or `artifacts.json` |
 | `.github/workflows/ci.yml` | nvx-microvm-adapter-whp: the runtime adapter's job on WHP | retired | The adapter's scenarios, whose fates are above |
 | `.github/workflows/run-nvx-microvm-tests.yml` | Run NVX microVM tests on Linux and on Windows | kept | The default suite's scenarios, by shard and on the debug kernel |
 | `.github/workflows/run-nvx-microvm-tests.yml` | Run public managed sandbox acceptance on Linux and on Windows | kept | Runs `sandbox-gpt-layer` and `vm-lifecycle` too, since SL5.1b: see [Cold boots](#cold-boots); and `snapshot-core` and `snapshot-tiers`, since SL5.1c: see [Snapshots](#snapshots) |

doc/ci.md

@@ -525,7 +525,7 @@ of the Rust guest binaries' inputs that the guest package manifests record,
 which `nvx.py guest-binary-source-identity` prints, because the images carry
 only those binaries of `nvx-rs` and `hashFiles` hashes contents only. The
 inputs are the files that the guest binaries' build reads:
-`rust-toolchain.toml`; the crate's manifest, lockfile, build script, and Cargo
+`rust-toolchain.toml`; the crate's manifest, lockfile, and Cargo
 configuration; every file under `nvx-rs/src/` but the host side, which is the
 `host` and `testing` modules and the `nvx-rs` and `nvx-fake-openvmm` binaries,
 and the test modules, which are the `tests.rs` files and the `tests`
@@ -2120,11 +2120,8 @@ the commit's files in the version alone.
 - Every file is the commit's byte for byte, which rules out CRLF line endings,
   but for the rewritten version and the files that Cargo generates,
   `Cargo.toml` and `.cargo_vcs_info.json`, which must hold no CR either.
-- It holds the license, the readme, the build script, and `artifacts.json`.
-- Its files build with every feature, as a dependent's build does. `bundled`
-  downloads the Linux KVM and MSHV packages of the release that
-  `artifacts.json` pins, which must match their digests and declare the
-  crate's control contract.
+- It holds the license and the readme.
+- Its files build with every feature, as a dependent's build does.
 
 The job outputs the version and the package's SHA-256. Its build runs the
 build scripts and procedural macros of the crate's dependencies, so it holds
@@ -2302,15 +2299,12 @@ otherwise use; the musl check of the guest binaries checks `guest` alone.
 Clippy's checks of all targets compile the crate's examples, among them the
 compile-only `host-workflows` and, in the musl check, `guest-workflows`, so
 that the documented workflows keep compiling against the public API.
-It also validates bundled artifact staging with a fixture package. The action
-sets `NVX_BUNDLE=skip` for `--all-features` builds, so that `bundled` stages
-nothing instead of downloading the pinned release.
 
 On Linux, the `nvx-rs` job also checks the public API of `nvx` against its
 snapshots, [`nvx-rs/public-api/linux.txt`](../nvx-rs/public-api/linux.txt) and
 [`windows.txt`](../nvx-rs/public-api/windows.txt), with
 [`public_api.py`](../scripts/public_api.py). The script builds the library's
-rustdoc JSON with every feature but `bundled`, on the pinned Rust release, for
+rustdoc JSON with every feature, on the pinned Rust release, for
 `x86_64-unknown-linux-musl`, the guests' target, and for
 `x86_64-pc-windows-msvc`, after it adds both targets to that release with
 rustup. rustdoc needs only a target's standard library, not its linker, so the

doc/contribute.md

@@ -89,7 +89,7 @@ the Python, shell, and link checks.
 | `scripts/setup/setup-windows-whp.ps1` | PowerShell syntax | [check-quality](../.github/actions/check-quality/action.yml) |
 | Markdown files and `doc/` paths | Every relative link and image in a tracked Markdown file resolves to a tracked file, and every anchor to a heading slug that GitHub generates, ignoring code. Every `doc/` path that a tracked file mentions resolves too, except the test fixtures that `DOC_PATH_FIXTURES` lists. | [check-quality](../.github/actions/check-quality/action.yml), [check_markdown_links.py](../scripts/check_markdown_links.py) |
 | Tests | Every test lives in a test file, and production files hold only the test hooks that the allowlist allows; see [Test layout](#test-layout) | [check-quality](../.github/actions/check-quality/action.yml), [check_test_layout.py](../scripts/check_test_layout.py) |
-| `nvx-rs/` | rustfmt, Clippy and rustdoc with warnings denied, Clippy also for the `serde`, `cli` and `testing` features alone, tests including a bundled-release fixture, the minimum supported Rust version, a macOS check, the public API against its snapshots in `nvx-rs/public-api/`, and, through `nvx.py`, the musl lint, tests, build, digest manifest, and static-ELF check of the guest binaries; see [Rust crates](ci.md#rust-crates) | [check-nvx-rs](../.github/actions/check-nvx-rs/action.yml), [public_api.py](../scripts/public_api.py) |
+| `nvx-rs/` | rustfmt, Clippy and rustdoc with warnings denied, Clippy also for the `serde`, `cli` and `testing` features alone, tests, the minimum supported Rust version, a macOS check, the public API against its snapshots in `nvx-rs/public-api/`, and, through `nvx.py`, the musl lint, tests, build, digest manifest, and static-ELF check of the guest binaries; see [Rust crates](ci.md#rust-crates) | [check-nvx-rs](../.github/actions/check-nvx-rs/action.yml), [public_api.py](../scripts/public_api.py) |
 | NVX CLI | Compiles `scripts/`, runs every `scripts/test_*.py` module, and checks command help, on Linux and Windows, and compares the copies of OpenVMM's protocol vectors in `nvx-rs/tests/vectors/openvmm/`, and of the identities of its built-in CPU profiles in `nvx-rs/src/host/cli/cpu_generations.json`, with the submodule's files | [validate-nvx](../.github/actions/validate-nvx/action.yml), [ci.yml](../.github/workflows/ci.yml) |
 
 check-quality names each shell script that it checks, and a CLI test fails

doc/distribution.md

@@ -162,13 +162,7 @@ change reaches crates.io within a day of its merge.
 
 The version that `nvx-rs/Cargo.toml` declares is the lowest that CI
 publishes. A pull request changes it to start another series, such as
-`0.2.0-alpha.1`. Only `nvx`'s version changes in `nvx-rs/Cargo.lock`. The
-`bundled` feature of the published crate downloads the release that
-[`nvx-rs/artifacts.json`](../nvx-rs/artifacts.json) pins and fails unless that
-release declares the crate's microVM, time, restore-packet, control-session,
-and control contracts, which CI checks before it publishes. When a contract has
-changed, publication stays blocked until a pull request repins a compatible release;
-see [Bundled artifacts](../nvx-rs/README.md#bundled-artifacts).
+`0.2.0-alpha.1`. Only `nvx`'s version changes in `nvx-rs/Cargo.lock`.
 
 When CI cannot publish, as when the newest version on crates.io records no
 commit that `dev` holds, a pull request declares the next version as above,
@@ -179,7 +173,6 @@ and once it merges, a crate owner publishes that version from a fresh clone of
 git clone --branch dev https://github.com/microsoft/nvx.git nvx-crate
 cd nvx-crate/nvx-rs
 git ls-files --eol . | grep -E 'w/(crlf|mixed)'  # prints nothing
-cargo check --locked --features bundled          # stages the pinned release
 cargo publish --locked --dry-run
 cargo publish --locked
 ```

doc/project-structure.md

@@ -108,9 +108,7 @@ nvx/
 |   |   `-- bin/                 nvx-rs CLI, nvx-fake-openvmm test double, and the guest binaries
 |   |-- examples/                The external-launch example, and the documented host and guest workflows, which only compile
 |   |-- tests/                   Fake-OpenVMM behavior, process and VM spawn, CLI scenario, NVXS session, guest-binary, and hypervisor public-API VM lifecycle tests, the security checklist, sandbox configurations of every format, the cases of the export and root boot tokens, and the conformance vectors of the wire formats
-|   |-- public-api/              The crate's public API on Linux and on Windows, which CI checks
-|   |-- build.rs                 Stages the bundled artifacts (feature `bundled`)
-|   `-- artifacts.json           Release package pinned for the bundled artifacts
+|   `-- public-api/              The crate's public API on Linux and on Windows, which CI checks
 |-- openvmm/                     OpenVMM Git submodule
 |-- scripts/                     Build, run, benchmark, and release tooling
 |   |-- nvx_tools/               Python implementation behind the NVX CLI
@@ -292,8 +290,8 @@ for other kernel-specific details.
 ### `nvx-rs/`
 
 The Rust crate `nvx` holds the NVX mechanics: the
-authenticated control protocol of the guest agent, artifact discovery and
-bundled-release staging, OpenVMM's command line, the lowering of network and
+authenticated control protocol of the guest agent, artifact discovery,
+OpenVMM's command line, the lowering of network and
 filesystem policies, the compiler of the egress policy files that `nvx-rs run`
 and `nvx-rs sandbox` accept, process and platform primitives for Linux and
 Windows hosts, the creation, spawn, and stop of VMs, the sandbox launch profile

doc/usage.md

@@ -60,7 +60,7 @@ their `nvx-rs` tests.
 
 The provenance of a checkout's `nvx-rs`, `build/nvx-rs.provenance.json`, binds
 the SHA-256 of its executable to a digest of the `nvx-rs` sources that built
-it, the crate's manifest, lock file, build script, and `src/` tree and
+it, the crate's manifest, lock file, and `src/` tree and
 `rust-toolchain.toml`, and to the Rust release, target, and Cargo features of
 the build. `nvx.py` records it when it builds `nvx-rs` for the scenarios, and
 [`record-nvx-rs-provenance`](#record-nvx-rs-provenance) records it for a build
@@ -681,7 +681,7 @@ python3 scripts/nvx.py guest-binary-source-identity [--root PATH]
 
 Prints the source digest that guest package manifests record for the Rust guest
 binaries: a digest of the relative path and content of every file that their
-build reads. Those are the crate's manifest, lockfile, and build script, its
+build reads. Those are the crate's manifest and lockfile, its
 Cargo configuration under `nvx-rs/.cargo/`, every file under `nvx-rs/src/`
 except the host side and the test modules, `rust-toolchain.toml`, and the
 `build_constants.py` and `guest_binaries.py` build modules. The host side is

nvx-rs/Cargo.toml

@@ -10,11 +10,7 @@ readme = "README.md"
 keywords = ["sandbox", "microvm", "openvmm", "virtualization"]
 categories = ["virtualization"]
 publish = ["crates-io"]
-# Lets the build scripts of dependents read the staged bundle as `DEP_NVX_ARTIFACTS_DIR`.
-links = "nvx"
 
-# docs.rs builds without network access, so its documentation leaves out `bundled`, whose build
-# script downloads a release.
 [package.metadata.docs.rs]
 features = ["cli", "testing", "guest"]
 targets = ["x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]
@@ -35,10 +31,6 @@ host = [
     "dep:nix",
     "dep:windows-sys",
 ]
-# Stages the OpenVMM executable, guest kernel, and control initramfs at build time; see
-# `Artifacts::bundled`. The build script downloads the release pinned in `artifacts.json`, or
-# copies the release directory named by `NVX_BUNDLE_DIR`.
-bundled = ["host", "dep:sha2"]
 # NVX's own `nvx-fake-openvmm` binary, a fake OpenVMM for tests. It adds no API.
 testing = ["dep:getrandom", "dep:serde", "dep:serde_json", "dep:nix", "dep:windows-sys"]
 # NVX's own `nvx-rs` binary, the command-line interface that runs NVX's microVMs and sandboxes,
@@ -55,7 +47,6 @@ crossterm = { version = "0.29", default-features = false, features = ["windows"]
 getrandom = { version = "0.4", optional = true }
 serde = { version = "1.0.200", features = ["derive"], optional = true }
 serde_json = { version = "1.0.120", optional = true }
-# The same release as the build script's: `host` enables both.
 sha2 = { version = "0.10", optional = true }
 
 [target.'cfg(windows)'.dependencies]
@@ -94,12 +85,6 @@ nix = { version = "0.31.3", default-features = false, optional = true, features
     "user",
 ] }
 
-[build-dependencies]
-# Only the `bundled` build script reads JSON and computes digests; `host`, which `bundled`
-# enables, enables both here too.
-serde_json = { version = "1.0.120", optional = true }
-sha2 = { version = "0.10", optional = true }
-
 [dev-dependencies]
 # The property tests of the protocol's codecs, which need none of the forking and timeouts of its
 # default features.