refactor(vm): source runtime pins only from pins.env

The VM runtime scripts sourced pins.env optionally and duplicated the
LIBKRUN_REF and UMOCI_VERSION defaults, so every bump had to update the
same value in several files.

Require pins.env, drop the duplicated defaults, and fail on an invalid
LIBKRUN_REF instead of silently building upstream HEAD. Environment
overrides still take precedence through the defaults in pins.env.

Signed-off-by: Florent Benoit <fbenoit@redhat.com>

Author: benoitf

tasks/scripts/vm/build-libkrun-macos.sh

@@ -33,7 +33,7 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
 
 # Source pinned dependency versions.
-source "${ROOT}/crates/openshell-driver-vm/runtime/pins.env" 2>/dev/null || true
+source "${ROOT}/crates/openshell-driver-vm/runtime/pins.env"
 
 BUILD_DIR="${ROOT}/target/libkrun-build"
 OUTPUT_DIR="${BUILD_DIR}"
@@ -153,9 +153,6 @@ echo "    Built: libkrunfw.${ABI_VERSION}.dylib ($(du -sh "${OUTPUT_DIR}/libkrun
 
 # ── Clone libkrun ───────────────────────────────────────────────────────
 
-# LIBKRUN_REF is sourced from pins.env; env-var override still works.
-LIBKRUN_REF="${LIBKRUN_REF:-227b2de6ed323fe180e02f871c5f325a90c13cc2}"
-
 if [ ! -d libkrun ]; then
     echo "==> Cloning libkrun..."
     git clone https://github.com/libkrun/libkrun.git

tasks/scripts/vm/build-libkrun.sh

@@ -29,7 +29,7 @@ source "${SCRIPT_DIR}/_lib.sh"
 ROOT="$(vm_lib_root)"
 
 # Source pinned dependency versions.
-source "${ROOT}/crates/openshell-driver-vm/runtime/pins.env" 2>/dev/null || true
+source "${ROOT}/crates/openshell-driver-vm/runtime/pins.env"
 
 BUILD_DIR="${ROOT}/target/libkrun-build"
 OUTPUT_DIR="${BUILD_DIR}"
@@ -133,18 +133,16 @@ echo "==> Building libkrunfw with custom kernel config..."
 ensure_python3_with_pyelftools_for_libkrunfw
 
 if [ ! -d libkrunfw ]; then
-  echo "    Cloning libkrunfw (pinned: ${LIBKRUNFW_REF:-HEAD})..."
+  echo "    Cloning libkrunfw (pinned: ${LIBKRUNFW_REF})..."
   git clone https://github.com/libkrun/libkrunfw.git
 fi
 
 cd libkrunfw
 
 # Ensure we're on the pinned commit for reproducible builds
-if [ -n "${LIBKRUNFW_REF:-}" ]; then
-  echo "    Checking out pinned ref: ${LIBKRUNFW_REF}"
-  git fetch origin
-  git checkout "${LIBKRUNFW_REF}"
-fi
+echo "    Checking out pinned ref: ${LIBKRUNFW_REF}"
+git fetch origin
+git checkout "${LIBKRUNFW_REF}"
 
 # Copy custom kernel config fragment
 if [ -f "$KERNEL_CONFIG" ]; then
@@ -415,21 +413,16 @@ echo "==> Building libkrun..."
 ensure_cargo_for_libkrun
 ensure_libclang_for_libkrun
 
-# LIBKRUN_REF is sourced from pins.env (line 32); env-var override still works.
-LIBKRUN_REF="${LIBKRUN_REF:-227b2de6ed323fe180e02f871c5f325a90c13cc2}"
-
 if [ ! -d libkrun ]; then
   echo "    Cloning libkrun..."
   git clone https://github.com/libkrun/libkrun.git
 fi
 
 cd libkrun
 
-if [ -n "${LIBKRUN_REF:-}" ]; then
-  echo "    Checking out pinned ref: ${LIBKRUN_REF}"
-  git fetch origin "${LIBKRUN_REF}" 2>/dev/null || git fetch origin
-  git checkout "${LIBKRUN_REF}" 2>/dev/null || git checkout "origin/${LIBKRUN_REF}" 2>/dev/null || true
-fi
+echo "    Checking out pinned ref: ${LIBKRUN_REF}"
+git fetch origin "${LIBKRUN_REF}" 2>/dev/null || git fetch origin
+git checkout "${LIBKRUN_REF}" 2>/dev/null || git checkout "origin/${LIBKRUN_REF}"
 
 echo "    Building libkrun with NET=1 BLK=1..."
 cargo build --release --features blk --features net --target-dir="$(pwd)/target"

tasks/scripts/vm/compress-vm-runtime.sh

@@ -27,8 +27,7 @@ source "${SCRIPT_DIR}/_lib.sh"
 ROOT="$(vm_lib_root)"
 
 # Source pins for runtime tool versions.
-source "${ROOT}/crates/openshell-driver-vm/runtime/pins.env" 2>/dev/null || true
-UMOCI_VERSION="${UMOCI_VERSION:-v0.6.0}"
+source "${ROOT}/crates/openshell-driver-vm/runtime/pins.env"
 
 # ── macOS dylib portability helpers ─────────────────────────────────────
 

tasks/scripts/vm/download-kernel-runtime.sh

@@ -24,12 +24,11 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/_lib.sh"
 ROOT="$(vm_lib_root)"
-source "${ROOT}/crates/openshell-driver-vm/runtime/pins.env" 2>/dev/null || true
+source "${ROOT}/crates/openshell-driver-vm/runtime/pins.env"
 
 RELEASE_TAG="${VM_RUNTIME_RELEASE_TAG:-vm-runtime}"
 REPO="${GITHUB_REPOSITORY:-NVIDIA/OpenShell}"
 OUTPUT_DIR="${OPENSHELL_VM_RUNTIME_COMPRESSED_DIR:-${ROOT}/target/vm-runtime-compressed}"
-UMOCI_VERSION="${UMOCI_VERSION:-v0.6.0}"
 
 # ── Auto-detect platform (detect_platform from _lib.sh) ─────────────────
 

tasks/scripts/vm/package-vm-runtime.sh

@@ -30,8 +30,7 @@ source "${SCRIPT_DIR}/_lib.sh"
 ROOT="$(vm_lib_root)"
 
 # Source pins for runtime tool versions.
-source "${ROOT}/crates/openshell-driver-vm/runtime/pins.env" 2>/dev/null || true
-UMOCI_VERSION="${UMOCI_VERSION:-v0.6.0}"
+source "${ROOT}/crates/openshell-driver-vm/runtime/pins.env"
 
 PLATFORM=""
 BUILD_DIR=""