host: delete the unused artifact discovery and checked-file accessors (SL6.6b) by ppenna · Pull Request #1532 · microsoft/nvx

Pedro Henrique Penna (ppenna) · 2026-11-12T12:05:39Z

Leaving code only. This PR changes only code that this effort removes from NVX: the public artifact discovery that no NVX program uses (Artifacts, nvx::Artifacts, discover_with, check_manifest and read_json), ArtifactDir::{sandbox_artifacts, require_openvmm}, Guest::from_name, DistroBinding::{import, import_with} and its getters, CheckedDistro's and CheckedScratch's unused parts, ScratchBinding's getters, and FileSeal::{modified, changed}, with the edits that remove references to them. Nothing that stays changes, and no later PR uses what it changes, so the size limits for kept code don't apply.

Part of #1122 (SL6.6b, "the unused artifact discovery and checked-file accessors are gone"). Parent #1087, umbrella #1076.

It needs SL6.3 (#1530) and SL6.6a (#1524), which have both merged: it starts from 671a192d0a5, the tip after them. SL6.4 (#1533, in #1124) stacks on it and makes what stays private to the CLI.

What and why

Once SL6.3 deleted the old launch, instance and template code, about 15 groups of public items in host::artifacts, host::sandbox::{distro, scratch} and host::seal had no caller in any NVX program, only in the public API, its doc examples and tests. The CLI has always used its own discovery, through ArtifactDir and Guest, and verifies distro layers rather than importing their bindings. SL6.4 makes these modules private to the CLI, which would leave these items dead, so this PR deletes them first, as SL6.6b in #1122 records. Two commits:

host: delete the artifact discovery that no NVX program uses (2ef545e9):
- Artifacts goes, with its fields, its methods (new, discover, from_dir, from_release_dir, from_repo_layout, artifact_dir, runtime_identity, probe) and its constants (ENV_OPENVMM, ENV_KERNEL, ENV_INITRD, ENV_DIR, BESIDE_EXE_DIR), and so does its re-export, nvx::Artifacts. So do the private discover_with and read_json, the public check_manifest (the release manifest's check, which only discovery called), ArtifactDir::{sandbox_artifacts, require_openvmm} and Guest::from_name.
- The variables that only discovery read, NVX_ARTIFACTS_DIR, NVX_KERNEL and NVX_INITRD, and its nvx/ directory beside the executable, go with it. NVX_OPENVMM and NVX_AUTO_DOWNLOAD, which the CLI reads through its own constants, keep their meaning. contract::manifest_mismatches stays for the CLI's downloads, and ArtifactDir, Guest, ArtifactPaths and the layouts' names and requirements stay for the CLI.
- The crate's example in src/lib.rs (the doc test nvx-rs/src/lib.rs - (line 57), which still compiles a cold boot and a stop through host::vm) and the README's example take the three paths and their SHA-256 digests from the command line, with RuntimeIdentity::new and ArtifactIdentity::sha256, instead of Artifacts::discover and Artifacts::runtime_identity. The host bullet of the crate's docs says "the layouts of NVX's artifacts" instead of "artifact discovery", and the README's host::artifacts section drops Artifacts.
host: delete the binding and checked-file accessors that nothing reads (008035d2):
- DistroBinding loses import, the crate-private import_with that implemented it, and its five getters (format, identity, image, manifest, policy). A binding still comes from verify, and check and the serde form, which nvx-rs sandbox provision records, don't change.
- CheckedDistro keeps only the open file that the start holds while it launches, as _file, which nothing reads; its file, path, geometry and into_file go, with the path and format fields that only they read.
- CheckedScratch keeps its claim and its file: file stays on the hosts where the start reads it, other than Windows, and into_file on Windows, where the start takes the guard. path and geometry go, with the path field. The description of the geometry that both geometry methods documented moves to block_geometry, which the start, host::vm and host::snapshot call.
- ScratchBinding loses its five getters (scheme, device, file_id, kind, length), and FileSeal loses modified and changed. Seals still compare whole, and record every field.
- The README's distro-bindings section and host::sandbox's docs stop naming the import and the geometry methods.

The public API snapshots lose 58 lines on each platform, all in the items above (38 for the first commit, 20 for the second). Nothing is added. The warning-denied builds of every feature set pass on Windows, Linux and the macOS check, so nothing else became unused.

Size

Measured against 671a192d0a5, by #1076's rules: leaving code only, no limit. The measuring script counts 10 added or changed code lines, in 4 files: 6 import lines that shrink with what goes (artifacts/dir.rs 3, artifacts/mod.rs 1, sandbox/distro.rs 1, sandbox/scratch.rs 1), the 2 lines of CheckedDistro's remaining field, _file, and the 2 platform cfgs of CheckedScratch::{file, into_file}. Counted files: 7, src/lib.rs, src/host/artifacts/{mod, dir, guest}.rs, src/host/sandbox/{distro, scratch}.rs and src/host/seal.rs; src/host/sandbox/mod.rs changes only its docs. 17 files change: +193 and −1068 lines, tests, docs and snapshots included.

Old tests of the area

Retired, since they only cover what goes:
- host::artifacts::tests::release_layout_names_the_guest_artifacts (Artifacts::from_dir and from_release_dir on a release; a_release_holds_the_guest_artifacts_in_guest keeps the release's names);
- the_directory_variable_accepts_a_repository_checkout, explicit_variables_win_and_must_be_complete, the_directory_variable_precedes_the_executable_directory and discovery_fails_when_no_source_is_present (discovery's sources and their order), with their helper variables;
- incompatible_manifests_are_unavailable (check_manifest's errors; contract's tests keep manifest_mismatches' own);
- located_artifacts_have_the_identity_of_their_directory (Artifacts::runtime_identity; ArtifactDir::runtime_identity keeps its tests);
- host::sandbox::distro::tests::imports_bind_a_staged_layer_without_reading_it (DistroBinding::import).
Rewritten, keeping what they check of the code that stays:
- host::artifacts::tests::repository_layout_is_detected_beside_the_guest_sources and this_repository_uses_the_repository_layout check the paths through ArtifactDir::from_dir instead of Artifacts, and the first one also checks the layout;
- repository_manifest_declares_the_supported_contract checks the checkout's SOURCE-MANIFEST.json with contract::manifest_mismatches, which check_manifest called;
- guests_name_their_artifacts_as_nvx_py_does no longer checks Guest::from_name;
- a_release_holds_the_guest_artifacts_in_guest no longer compares the release with discovery's artifacts;
- guest_artifacts_are_required_in_the_order_and_words_of_nvx_py becomes guest_artifacts_are_required_in_the_words_of_nvx_py: the order was sandbox_artifacts'; the requirements of the kernel, the initramfs and the distro layer and manifest, in nvx.py's words, stay.
Kept: the other tests of host::artifacts, host::sandbox, host::seal and the CLI, the checklist and the doc tests. Those that the report below lists change only to stop naming what goes.

Test changes

python scripts/check_test_changes.py --base 671a192d0a5 lists 38 changes to existing tests, hence tests-modified:

nvx-rs/src/host/artifacts/tests.rs: the imports; the removed helper and tests and the rewritten tests above.
nvx-rs/src/host/sandbox/distro/tests.rs: the removed imports_bind_a_staged_layer_without_reading_it (above), and, with the same assertions:
- verification_binds_the_layer_its_manifest_and_the_policy, bindings_round_trip_through_their_serde_form, the_staged_check_reads_no_content, gpt_disks_bind_by_their_disk_guid, a_manifest_path_whose_lookup_fails_is_no_absent_manifest_for_a_binding and the_checked_file_is_the_object_that_the_check_compared read the binding's fields and the checked file, as a child module may, instead of the getters;
- checked_layers_present_the_geometry_that_openvmm_reads_through_them and layers_present_the_block_size_of_their_filesystem read the geometry with block_geometry through the checked file, which CheckedDistro::geometry called, and make their bindings with verify_with instead of import_with;
- the_staged_check_fails_without_reading_for_another_policy_or_layer makes its rejected binding from the verified one, with another verdict, instead of importing it;
- gpt_disks_bind_by_their_disk_guid no longer compares the verified binding with an imported one, and expects the failure for a missing disk from verify instead of import; a_manifest_path_whose_lookup_fails_is_no_absent_manifest_for_a_binding checks the staged check's refusal alone, without the import's.
nvx-rs/src/host/sandbox/scratch/tests.rs: binds_record_the_image_without_reading_it, bindings_round_trip_through_their_serde_form, checks_claim_the_image_without_reading_it, a_check_that_waited_for_a_claim_compares_the_image_again and the_checked_image_is_the_object_that_the_check_compared read the fields instead of the getters (checks_claim_the_image_without_reading_it no longer checks CheckedScratch::path); checked_images_present_the_geometry_that_openvmm_reads_through_them reads the geometry with block_geometry, as CheckedScratch::geometry did.
nvx-rs/src/host/sandbox/options/tests.rs: distro_manifest_binds_the_layer, the_entrypoint_check_needs_no_manifest_and_precedes_the_distro_verification and sandbox_rejects_systemd_from_bound_distro_metadata read the binding's identity, format and manifest from its serde form, which the CLI records, instead of the getters.
nvx-rs/src/host/seal/tests.rs: a_seal_holds_the_identity_kind_length_and_times_of_an_open_file and seals_differ_when_their_file_changes read the modified and changed fields instead of the getters.
nvx-rs/tests/security_checklist.rs: a_staged_image_that_was_replaced_fails_its_check binds the layer with DistroBinding::verify instead of import, with the imports.

doc/acceptance-case-matrix.md names none of the retired or renamed tests, so it doesn't change.

Validation

local_gates.py --files (from dev) selects test-changes, markdown-links, test-layout, the check-nvx-rs steps and nvx-cli on both systems; I ran them from this branch's action definitions, with Rust 1.95.0. Nothing here changes runtime behavior that a VM shows: the CLI's discovery and staging paths don't change, and SL6.4's microVM runs, which hold these commits, passed (below).

The checks first ran on 5d0894b021a, on a local base of SL6.3's and SL6.6a's pre-merge heads (34233747c4b). After both merged, this branch was rebased onto 671a192d0a5 with no conflicts, and git range-diff shows = for both commits. On this head, 008035d2893:

Check	Windows (local)	Linux
`cargo fmt --all --check`	passed	passed (KVM)
Clippy `-D warnings`: `--all-targets --all-features`, `--lib`, `--lib --no-default-features`, `serde`, `cli` and `testing` alone	passed, natively and for `--target x86_64-unknown-linux-gnu`	passed (KVM)
Guest Clippy, `--target x86_64-unknown-linux-musl --no-default-features --features guest -D warnings`	passed
`cargo check --all-targets --all-features --target aarch64-apple-darwin`	passed; its one warning, in `host/snapshot/tests.rs`, is the base's
`cargo test --locked --all-features`	passed: lib 1043 passed, 15 ignored; every integration test and the doc tests, `nvx-rs/src/lib.rs - (line 57)` included	KVM (kernel 6.6): integration tests 209 passed; the lib's same 28 `guest::` failures as on the base, by name, as below. MSHV (kernel 6.18), with `--no-fail-fast`: passed, lib 1877 passed and 57 ignored, and every integration and doc test
`cargo test --locked`, `cargo build --locked --lib --no-default-features`, `cargo test --locked --lib --no-default-features`	passed	passed (KVM)
`RUSTDOCFLAGS=-D warnings cargo doc --locked --no-deps --all-features`	passed	passed (KVM)
MSRV: `cargo +1.89 check --locked --all-targets --all-features`	passed	passed (KVM)
`python scripts/public_api.py`	passed	passed (KVM)
`check-guest-binaries`, `build-guest-binaries`, `test-guest-binaries`		KVM: the build and its test passed; `check-guest-binaries` has the base's same 7 `guest::` failures. MSHV: `check-guest-binaries` passed
`check_test_layout.py`, `check_markdown_links.py`	passed
`check_matrix.py <worktree> 99d2022085f`	passed

On kernel 6.6, nvx-kvm-test fails the same 28 guest:: lib tests and 7 guest-binary tests on the current tip, 00c55b965f0, as on this head, by name; kernel 6.18 runs them all.

Each commit passes Clippy with -D warnings, with every feature, with cli and without default features, on Windows and for Linux.

The validate-nvx unittest list passed on Windows on the first head (1824 tests, 73 skipped); this PR changes no script.

Left to CI: the microVM scenarios on each backend, and openvmm-ci, for the unchanged pin.

github-actions · 2026-11-12T12:06:01Z

This pull request changes existing tests

It modifies or removes 38 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Relocated unchanged: 0; added: 0. Compared the merge base 2afac6237b5b with 7e7ef6e2f4a7.

Copilot

🟢 Approval recommended

No active review issues block approval of the unused-API cleanup.

No open issues 🎉

What changed in this PR

This PR removes unused artifact-discovery and checked-file APIs as part of the nvx library-slimming workstream. It prepares the remaining helpers for CLI-only visibility in #1533 while retaining the CLI’s discovery, verification, and launch paths.

Changes:

Deletes Artifacts, unused artifact helpers, binding accessors, and checked-file methods.
Retires tests for deleted APIs and adapts retained tests to verification, fields, and serialized bindings.
Updates examples and documentation, and removes 58 public API snapshot entries per platform.

File	Description
`nvx-rs/tests/security_checklist.rs`	Creates the staged-image binding through verification instead of import.
`nvx-rs/src/lib.rs`	Removes the `Artifacts` re-export and uses explicit paths and digests in the example.
`nvx-rs/src/host/seal/tests.rs`	Reads timestamp fields directly after getter removal.
`nvx-rs/src/host/seal.rs`	Deletes unused timestamp getters.
`nvx-rs/src/host/sandbox/scratch/tests.rs`	Adapts binding, geometry, and checked-file assertions.
`nvx-rs/src/host/sandbox/scratch.rs`	Removes unused accessors and retains platform-specific file access.
`nvx-rs/src/host/sandbox/options/tests.rs`	Checks serialized binding values instead of removed getters.
`nvx-rs/src/host/sandbox/mod.rs`	Moves geometry documentation to the retained helper.
`nvx-rs/src/host/sandbox/distro/tests.rs`	Retires import tests and adapts retained verification and geometry cases.
`nvx-rs/src/host/sandbox/distro.rs`	Deletes import APIs and getters; retains the checked file as a guard.
`nvx-rs/src/host/artifacts/tests.rs`	Retires discovery tests and preserves layout, requirements, and contract checks.
`nvx-rs/src/host/artifacts/mod.rs`	Deletes `Artifacts`, discovery, and the release-manifest wrapper.
`nvx-rs/src/host/artifacts/guest.rs`	Removes the unused guest-name parser.
`nvx-rs/src/host/artifacts/dir.rs`	Removes unused sandbox-artifact and OpenVMM requirement helpers.
`nvx-rs/README.md`	Updates API descriptions and the explicit-runtime example.
`nvx-rs/public-api/windows.txt`	Records the Windows public API removals.
`nvx-rs/public-api/linux.txt`	Records the Linux public API removals.

_{Review effort: Balanced}

nvx::Artifacts, with Artifacts::discover, located the OpenVMM executable, the guest kernel and the Alpine initramfs from the NVX_OPENVMM, NVX_KERNEL and NVX_INITRD variables, NVX_ARTIFACTS_DIR, or an nvx/ release beside the executable, and read their runtime identity from the install metadata of the release or checkout. The old launch, instance and template paths that called it are gone (#1121, #1122), and the CLI has its own discovery: --root, the release or checkout that holds the executable, and NVX_OPENVMM, over ArtifactDir. Once SL6.4 (#1124) makes host::artifacts private to the CLI, Artifacts would have no caller in any feature set, so it goes now, while it is public. It goes whole: the type and its fields, new, artifact_dir, runtime_identity, probe, from_dir, from_release_dir, from_repo_layout, discover, ENV_OPENVMM, ENV_KERNEL, ENV_INITRD, ENV_DIR and BESIDE_EXE_DIR, with the crate root's re-export, the private discover_with and read_json, and check_manifest, which only it called. ArtifactDir::sandbox_artifacts, which returned an Artifacts, goes with ArtifactDir::require_openvmm, which only it called, and so does Guest::from_name, which nothing calls: the CLI reads --guest itself. The public API snapshots lose these 38 lines on each platform. ArtifactDir, its layouts and paths, its runtime identity, Guest and the artifacts' names stay, and so do the CLI's NVX_OPENVMM and NVX_AUTO_DOWNLOAD. contract::manifest_mismatches stays for the CLI's downloads. The crate's example, which the doc test at line 62 compiles, and the README's take the runtime's paths and the SHA-256 digests that identify them from their caller, as examples/external-launch.rs does, rather than discover them. Tests of host::artifacts: - Retired, since they checked only what goes: release_layout_names_the_guest_artifacts, the_directory_variable_accepts_a_repository_checkout, explicit_variables_win_and_must_be_complete, the_directory_variable_precedes_the_executable_directory, discovery_fails_when_no_source_is_present, located_artifacts_have_the_identity_of_their_directory, and incompatible_manifests_are_unavailable, whose mismatches contract's mismatches_name_each_field_with_its_expected_and_declared_values covers. - repository_layout_is_detected_beside_the_guest_sources and this_repository_uses_the_repository_layout check the layouts through ArtifactDir alone. - repository_manifest_declares_the_supported_contract checks the checkout's SOURCE-MANIFEST.json with manifest_mismatches. - guests_name_their_artifacts_as_nvx_py_does and a_release_holds_the_guest_artifacts_in_guest drop their checks of from_name and of the release's discovery. - guest_artifacts_are_required_in_the_order_and_words_of_nvx_py, which checked sandbox_artifacts's order, becomes guest_artifacts_are_required_in_the_words_of_nvx_py, which keeps its checks of require_kernel and require_initramfs. Part of #1122 (SL6.6b). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Since the checked-file handoff left (SL6.3, #1122), a start checks the bindings of its sandbox's images and holds what the checks return, but launches OpenVMM by path: it drops the checked distro layer once the VM runs, and hands the VMM the scratch image's claim, through CheckedScratch::file on Linux and CheckedScratch::claim and into_file on Windows. What the old launch and the template store read of a binding or a checked file, and the import of a layer that a staging caller verified itself, no NVX program reads any more. Once SL6.4 (#1124) makes host::sandbox's distro and scratch modules and host::seal private to the CLI, they would have no caller in any feature set, so they go now, while they are public. What goes: - DistroBinding::import and its private import_with, and the getters format, identity, image, manifest and policy; - CheckedDistro's file, path, geometry and into_file, with its path and format, which only they read; it keeps the checked layer, which a start holds open, as a field that nothing reads; - CheckedScratch's path and geometry, with its path, file on Windows and into_file on Linux; - ScratchBinding's scheme, device, file_id, kind and length; - FileSeal::modified and FileSeal::changed. The public API snapshots lose these 20 lines on each platform. What the bindings record and check, their serde forms, the claims of scratch images, and the block geometry that the private block_geometry reads for host::vm, host::snapshot and the CLI's captures stay. The docs of block_geometry take the description of the geometry that CheckedDistro::geometry gave, and the README and host::sandbox's docs no longer present the import or the checked files' geometry. Tests: imports_bind_a_staged_layer_without_reading_it retires with the import. The other tests of distro bindings, scratch bindings and seals read the private fields of the values that they check in place of the deleted getters, and make the bindings that they need by verification, which reads nothing of a layer without a manifest, or by changing a verified binding's verdict, in place of an import: - distro: verification_binds_the_layer_its_manifest_and_the_policy, bindings_round_trip_through_their_serde_form, the_staged_check_reads_no_content, the_staged_check_fails_without_reading_for_another_policy_or_layer, the_checked_file_is_the_object_that_the_check_compared, gpt_disks_bind_by_their_disk_guid, which no longer compares the verification of a disk with its import, and a_manifest_path_whose_lookup_fails_is_no_absent_manifest_for_a_binding, which no longer checks an import of such a path; - distro: checked_layers_present_the_geometry_that_openvmm_reads_through_them and layers_present_the_block_size_of_their_filesystem, and scratch: checked_images_present_the_geometry_that_openvmm_reads_through_them, read the geometry through the checked file with block_geometry; - scratch: binds_record_the_image_without_reading_it, bindings_round_trip_through_their_serde_form, checks_claim_the_image_without_reading_it, which no longer checks the deleted path, a_check_that_waited_for_a_claim_compares_the_image_again and the_checked_image_is_the_object_that_the_check_compared; - seal: a_seal_holds_the_identity_kind_length_and_times_of_an_open_file and seals_differ_when_their_file_changes; - options: distro_manifest_binds_the_layer, the_entrypoint_check_needs_no_manifest_and_precedes_the_distro_verification and sandbox_rejects_systemd_from_bound_distro_metadata read the binding's serde form, which callers record; - the security checklist's a_staged_image_that_was_replaced_fails_its_check binds its layer, which has no manifest, by verification. Part of #1122 (SL6.6b). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Pedro Henrique Penna (ppenna) added tests-modified Changes existing tests, test data, or test wiring feat-nvx-refactor labels Nov 12, 2026

Pedro Henrique Penna (ppenna) self-assigned this Nov 12, 2026

Pedro Henrique Penna (ppenna) mentioned this pull request Nov 12, 2026

host: make image staging and artifact discovery private to the CLI (SL6.4) #1533

Merged

Pedro Henrique Penna (ppenna) requested a balanced review from Copilot November 12, 2026 12:06

Copilot started reviewing on behalf of Pedro Henrique Penna (ppenna) November 12, 2026 12:06

View session

Copilot AI reviewed Nov 12, 2026

View reviewed changes

Pedro Henrique Penna (ppenna) and others added 2 commits November 12, 2026 05:42

Pedro Henrique Penna (ppenna) force-pushed the agents/slim-sl6-6b-unused-discovery branch from 008035d to 7e7ef6e Compare November 12, 2026 13:42

Pedro Henrique Penna (ppenna) marked this pull request as ready for review November 12, 2026 13:43

Pedro Henrique Penna (ppenna) marked this pull request as draft November 12, 2026 13:45

Pedro Henrique Penna (ppenna) marked this pull request as ready for review November 12, 2026 13:45

Pedro Henrique Penna (ppenna) merged commit fc5d450 into feature/nvx-refactor Nov 12, 2026
103 of 124 checks passed

Pedro Henrique Penna (ppenna) deleted the agents/slim-sl6-6b-unused-discovery branch November 12, 2026 14:05

This was referenced Nov 12, 2026

nvx-rs slimming 4.3.1: image staging, artifact discovery, the policy-file reader and the mount syntax are private to the CLI #1124

Closed

nvx-rs slimming 4.2.3: the old configs, the old launch code and bundled are gone #1122

Closed

Navigation Menu

Repository navigation

host: delete the unused artifact discovery and checked-file accessors (SL6.6b) - #1532

host: delete the unused artifact discovery and checked-file accessors (SL6.6b)#1532
Pedro Henrique Penna (ppenna) merged 2 commits into
feature/nvx-refactorfrom
agents/slim-sl6-6b-unused-discovery

Pedro Henrique Penna (ppenna) commented Nov 12, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 12, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Pedro Henrique Penna (ppenna) commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What and why

Size

Old tests of the area

Test changes

Validation

Uh oh!

github-actions Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

This pull request changes existing tests

Test code

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Pedro Henrique Penna (ppenna) commented Nov 12, 2026 •

edited

Loading

github-actions Bot commented Nov 12, 2026 •

edited

Loading