ci(distro): establish Fedora 42 fresh-install VM proof

[Jesssullivan]

Summary

Track Fedora 42 fresh-install proof for Linux-native cmux.

This is no longer a strategy-selection issue. The repo now has a Fedora 42 VM
lane wired in; the remaining work is proving it in CI and keeping it stable.

Current State

• hosted Linux CI already proves that cmux-linux builds on Fedora 42
• repo-local fresh-install coverage now exists in:
  • nix/tests-distro.nix
  • .github/workflows/test-distro.yml
  • .github/workflows/release-linux.yml
• the Fedora 42 check now resolves to a real .sandboxed VM run, not just a
  driver derivation
• the repo pins nix-vm-test through Jesssullivan/nix-vm-test, but that fork
  is still content-identical to upstream at 797184bcad6205f0360250298598de38cf781df0

Remaining Work

1. record the first green Fedora 42 CI result
2. keep the lane stable in release-gated validation
3. keep the owned Jesssullivan/nix-vm-test pin and carry reason visible in
   repo docs and owned trackers

References

• nix/tests-distro.nix
• .github/workflows/test-distro.yml
• .github/workflows/release-linux.yml
• docs/distro-testing-readiness-plan.md
• docs/linux-packaging-cd-plan.md
• docs/flakehub-qa-ownership-notes.md
• docs/linear-qa-shard-punchlist.md (KVM-002)

Exit Criteria

• one green Fedora 42 fresh-install VM result is recorded in an owned repo lane
• Fedora 42 remains part of release-gated fresh-install validation
• docs and tracker language stay aligned with the actual harness state

[Jesssullivan]

Status update — upstream tracking

Filed upstream issue: numtide/nix-vm-test#170 (asks for Fedora 42 + Rocky 10 image entries; URLs and architecture coverage drafted in the issue body, ready to PR with computed hashes).

Local fallback options if upstream takes time

1. Fork pin — fork numtide/nix-vm-test to Jesssullivan/nix-vm-test, add the entries there, pin flake.nix input to the fork. Smallest code touch. Carries fork-drift maintenance until upstream merges, then we can re-pin to numtide.
2. Local overlay patch — apply a Nix patch over the upstream source via pkgs.applyPatches inside nix/tests-distro.nix. No external repo. Patches break on upstream rev bump.
3. Bypass nix-vm-test for these two distros — write a thin local wrapper in nix/tests-distro.nix that calls pkgs.fetchurl + pkgs.guestfs-tools (virt-customize) directly, mirroring nix-vm-test/fedora/default.nix for just F42 (and nix-vm-test/rocky/default.nix for just Rocky 10). Self-contained but ~50 lines of duplicated infra per distro.

Recommendation: hold for upstream first; fall back to (1) if no movement after ~2 weeks. Decision deferred to maintainer.

[Jesssullivan]

Status update — 2026-04-25

The upstream Fedora image blocker has cleared: numtide/nix-vm-test#172 merged on 2026-04-22 with Fedora 42 and Rocky 10.1 image support.

This issue is now about execution, not strategy selection:

1. re-pin the VM harness to upstream numtide/nix-vm-test
2. record the first green Fedora 42 fresh-install VM result
3. keep Fedora 42 release-gated proof visible and stable
4. keep any temporary Jesssullivan/nix-vm-test pin documented only as exit debt

Repo docs updated to reflect the post-merge state and remove the old “waiting on upstream images” framing.

[Jesssullivan]

Implementation update — 2026-04-25

The nix-vm-test re-pin is now complete locally.

• flake.nix points back to github:numtide/nix-vm-test
• flake.lock is at upstream be5379d18ae1c4ad25d950d9a785008cb5998d69
• nix/tests-distro.nix uses upstream nvt.fedora."42" directly instead of a local Fedora image wrapper

Lightweight evaluation passed:

• nix eval --no-write-lock-file --json '.#checks.x86_64-linux' --apply builtins.attrNames
• nix eval --no-write-lock-file '.#checks.x86_64-linux.distro-fedora42.drvPath'

No local VM tests were run. Remaining work for this issue is the first green Fedora 42 VM result in the owned CI lane.

[Jesssullivan]

CI check-in — 2026-04-25

Fedora 42 proof run is queued but has not started:

• run: https://github.com/Jesssullivan/cmux/actions/runs/24936258631
• target SHA: 05170f90972d2bc9f1088a75f45c2d6a0221c540
• job labels: self-hosted, linux, kvm, cmux-distro-test
• matching runner: honey-cmux
• runner status from GitHub Actions API: offline
• no job steps have started and no runner has been assigned

This is currently runner availability, not a Fedora test failure. Leaving the queued run in place; next proof step is bringing honey-cmux back online or otherwise providing a runner with the same labels.

[Jesssullivan]

2026-04-25 reconciliation note:

The issue body still mentions the old Jesssullivan/nix-vm-test pin. Current repo state is now:

• flake.nix points at upstream github:numtide/nix-vm-test.
• flake.lock pins upstream rev be5379d18ae1c4ad25d950d9a785008cb5998d69.
• Fedora 42 remains wired as a real .sandboxed VM lane.
• The latest relevant self-hosted proof runs are still queued on runner availability, so the remaining work is first green CI evidence, not image availability or FlakeHub ownership.

Keep this issue open until the first green Fedora 42 fresh-install VM result is recorded with the workflow URL.

[Jesssullivan]

Fedora 42 VM proof state rechecked during the cmux hygiene pass.

Current blocker is runner/proof availability, not nix-vm-test image support. Upstream numtide/nix-vm-test now has the needed Fedora/Rocky image support and cmux is pinned back to upstream.

Current queued proof runs:

• Older branch proof run: https://github.com/Jesssullivan/cmux/actions/runs/24936258631
• Current post-Rocky-artifact main distro run: https://github.com/Jesssullivan/cmux/actions/runs/24944693678

Repo-visible runner state: only honey-cmux, currently offline. Next action is to bring the matching KVM runner back, let the current main test-distro.yml run complete or rerun it, then attach the Fedora 42 package-install proof here.

[Jesssullivan]

Proof update — 2026-04-29

First Fedora 42 fresh-install VM proof is recorded.

• Workflow: https://github.com/Jesssullivan/cmux/actions/runs/25087301829
• Head SHA: 4d30e33f73e79f2e46e30ad5a54a3b64eef882f9
• Validation job: Validate Linux packages in distro VMs
• Step: Fedora 42 package test passed
• Artifact class: just-built signed Fedora 42 x86_64 RPM from the release workflow

The workflow failed later on Debian 12 because the current broad-feature Ubuntu-family DEB is not the right Debian baseline artifact. That is now tracked separately as a Debian/no-WebKit artifact taxonomy issue and does not invalidate this Fedora proof.

PR #277 changes release validation so Ubuntu/Fedora/Rocky are the upload gates and Debian remains diagnostic until the Debian artifact path is real.

[Jesssullivan]

Closing: first Fedora 42 fresh-install VM proof is recorded in release run 25087301829. Ongoing release-gate stability remains covered by the release workflow and the Debian artifact follow-up is split to TIN-745.