The vrtmv client runs in your environment. Linux x86-64, self-contained — no runtime to install.
Your key is on the account page. Reading a disk image read-only needs the usual block-device privileges (losetup / qemu-nbd) on the host you run it from.
Beta builds carry features that have not reached a stable release yet, so you can try them against your own estate first. They are signed and SBOM'd exactly as stable builds are — beta means early, not unchecked. In exchange, a beta binary reports diagnostics back to Vrtmv on every run: engine version, which command ran, whether it succeeded, the source and target OS, timings and counts, and — on a failure — an error message with paths, hostnames, IPs and email addresses stripped out. It never sends image contents, configuration, accounts, keys or your package list. That reporting is the condition of the channel; there is no way to take the builds without it.
Enrolling covers the whole account, so it takes two steps: any user reads the terms and requests access, then an account admin accepts the same terms on the account's behalf. Full field list and retention: the beta channel reference.
Read the terms and request access →The engine download is available to signed-in accounts. It's free.
Log inEvery artifact is signed with keyless Sigstore (cosign) and ships a CycloneDX SBOM. The signature is bound to the GitHub Actions workflow, tag and run that produced the bytes — there is no key for anyone to copy or leak. Verifying needs nothing from us: no account, no call home, and it keeps working if we disappear.
cosign verify-blob --bundle vrtmv-<ver>-<target>.tar.gz.bundle \
--certificate-identity-regexp 'https://github.com/vrtmv/vrtmv/.*' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
vrtmv-<ver>-<target>.tar.gz
Verified OK means these exact bytes were built and signed by the vrtmv release workflow. A modified binary, a re-signed one, or an artifact from anywhere else fails. The same command verifies the SBOM by swapping .tar.gz for .cdx.json, and checksums are in the .sha256 file (shasum -a 256 -c). Install cosign: docs.sigstore.dev/cosign.
