openvmm: add minimal tag-derived source identity

Cargo.lock

@@ -5600,6 +5600,14 @@ dependencies = [
  "openvmm_resources",
 ]
 
+[[package]]
+name = "openvmm_build_info"
+version = "0.0.0"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "openvmm_core"
 version = "0.0.0"
@@ -5770,6 +5778,7 @@ dependencies = [
  "net_tap",
  "netvsp_resources",
  "nvme_resources",
+ "openvmm_build_info",
  "openvmm_defs",
  "openvmm_helpers",
  "openvmm_pcat_locator",

Cargo.toml

@@ -81,6 +81,7 @@ flowey_lib_hvlite = { path = "flowey/flowey_lib_hvlite" }
 schema_ado_yaml = { path = "flowey/schema_ado_yaml" }
 
 openvmm_core = { path = "openvmm/openvmm_core" }
+openvmm_build_info = { path = "openvmm/openvmm_build_info" }
 openvmm_defs = { path = "openvmm/openvmm_defs" }
 openvmm_entry = { path = "openvmm/openvmm_entry" }
 openvmm_helpers = { path = "openvmm/openvmm_helpers" }

Guide/src/reference/openvmm/management/cli.md

@@ -7,6 +7,12 @@ The most up to date reference is always the [code itself](https://openvmm.dev/ru
 as well as the generated CLI help (via `cargo run -- --help`).
 ```
 
+* `--version`, `-V`: Print the displayed OpenVMM source version and exit. An
+  exact release tag prints `MAJOR.MINOR.PATCH`, with `+dirty` appended for a
+  tracked-file change. An untagged Git checkout prints
+  `0.0.0-dev+g<SHORT_REVISION>`, where `<SHORT_REVISION>` is the first nine
+  revision characters, with `.dirty` appended for a tracked-file change. Source
+  without usable identity metadata prints `0.0.0-dev`.
 * `--processors <COUNT>`: The number of processors. Defaults to 1.
 * `--memory <SPEC>`: Configure guest RAM. Defaults to `size=1G`.
   `SPEC` can be a size-only shorthand, such as `--memory 4G`, or a

openvmm/openvmm_build_info/Cargo.toml

@@ -0,0 +1,14 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+[package]
+name = "openvmm_build_info"
+edition.workspace = true
+rust-version.workspace = true
+
+[build-dependencies]
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true, features = ["std"] }
+
+[lints]
+workspace = true

openvmm/openvmm_build_info/build.rs

@@ -0,0 +1,141 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+#![expect(missing_docs)]
+
+use serde::Deserialize;
+
+mod version;
+
+const RELEASE_METADATA_SCHEMA: u32 = 1;
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct SerializedReleaseMetadata {
+    schema_version: u32,
+    version: String,
+    tag: String,
+    revision: String,
+}
+
+fn read_release_metadata(path: &std::path::Path) -> Option<version::ReleaseMetadata> {
+    let contents = match std::fs::read(path) {
+        Ok(contents) => contents,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return None,
+        Err(error) => panic!("failed to read {}: {error}", path.display()),
+    };
+    let metadata: SerializedReleaseMetadata = serde_json::from_slice(&contents)
+        .unwrap_or_else(|error| panic!("failed to parse {}: {error}", path.display()));
+    assert_eq!(
+        metadata.schema_version, RELEASE_METADATA_SCHEMA,
+        "unsupported OpenVMM release metadata schema"
+    );
+    let metadata = version::ReleaseMetadata {
+        version: metadata.version,
+        tag: metadata.tag,
+        revision: metadata.revision,
+    };
+    version::validate_release_metadata(&metadata)
+        .unwrap_or_else(|error| panic!("invalid {}: {error}", path.display()));
+    Some(metadata)
+}
+
+fn git_output(repo: &std::path::Path, args: &[&str]) -> Option<String> {
+    let output = std::process::Command::new("git")
+        .arg("-C")
+        .arg(repo)
+        .args(args)
+        .output()
+        .ok()?;
+    output
+        .status
+        .success()
+        .then(|| String::from_utf8_lossy(&output.stdout).trim().to_owned())
+}
+
+fn watch_tracked_files(repo: &std::path::Path) {
+    let output = std::process::Command::new("git")
+        .arg("-C")
+        .arg(repo)
+        .args(["ls-files", "-z"])
+        .output()
+        .expect("failed to list tracked OpenVMM files");
+    assert!(
+        output.status.success(),
+        "git ls-files failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    for path in output.stdout.split(|byte| *byte == 0) {
+        if path.is_empty() {
+            continue;
+        }
+        let path = std::str::from_utf8(path).expect("tracked OpenVMM file path is not valid UTF-8");
+        assert!(
+            !path.contains(['\r', '\n']),
+            "tracked OpenVMM file path contains a line break"
+        );
+        println!("cargo:rerun-if-changed={}", repo.join(path).display());
+    }
+}
+
+fn watch_git_inputs(repo: &std::path::Path, github_actions: bool) {
+    for path in ["HEAD", "index", "refs/tags", "packed-refs"] {
+        if let Some(path) = git_output(repo, &["rev-parse", "--git-path", path]) {
+            println!("cargo:rerun-if-changed={}", repo.join(path).display());
+        }
+    }
+    if let Some(head_ref) = git_output(repo, &["symbolic-ref", "HEAD"]) {
+        if let Some(path) = git_output(repo, &["rev-parse", "--git-path", &head_ref]) {
+            println!("cargo:rerun-if-changed={}", repo.join(path).display());
+        }
+    }
+    if let Some(tag_refs) = git_output(
+        repo,
+        &["for-each-ref", "--format=%(refname)", "refs/tags/openvmm-v"],
+    ) {
+        for tag_ref in tag_refs.lines() {
+            if let Some(path) = git_output(repo, &["rev-parse", "--git-path", tag_ref]) {
+                println!("cargo:rerun-if-changed={}", repo.join(path).display());
+            }
+        }
+    }
+    if !github_actions {
+        watch_tracked_files(repo);
+    }
+}
+
+fn main() {
+    println!("cargo:rerun-if-changed=build.rs");
+    println!("cargo:rerun-if-env-changed=GITHUB_ACTIONS");
+
+    let repo_root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let release_metadata_path = repo_root.join(".openvmm-release.json");
+    println!("cargo:rerun-if-changed={}", release_metadata_path.display());
+
+    let release_metadata = read_release_metadata(&release_metadata_path);
+    let github_actions = std::env::var("GITHUB_ACTIONS").as_deref() == Ok("true");
+    let git = version::collect_git_source(&repo_root, github_actions)
+        .unwrap_or_else(|error| panic!("failed to collect OpenVMM Git identity: {error}"));
+    if git.is_some() {
+        watch_git_inputs(&repo_root, github_actions);
+    }
+    let version = version::resolve_version(git.as_ref(), release_metadata.as_ref())
+        .unwrap_or_else(|error| panic!("failed to resolve OpenVMM version: {error}"));
+
+    if git.is_none() && release_metadata.is_none() {
+        println!(
+            "cargo:warning=OpenVMM release metadata is unavailable. This build will report \
+             0.0.0-dev and must not be treated as an official release build. Use a Git checkout \
+             with the release tag available or the official source bundle attached to the GitHub \
+             Release."
+        );
+    }
+
+    println!(
+        "cargo:rustc-env=OPENVMM_PRODUCT_VERSION={}",
+        version.product_version
+    );
+    println!("cargo:rustc-env=OPENVMM_VERSION={}", version.version);
+    println!("cargo:rustc-env=BUILD_GIT_SHA={}", version.revision);
+}

openvmm/openvmm_build_info/src/lib.rs

@@ -0,0 +1,61 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! OpenVMM product version and source revision.
+
+#![expect(missing_docs)]
+
+#[cfg(test)]
+#[path = "../version.rs"]
+mod version;
+
+#[derive(Debug)]
+pub struct BuildInfo {
+    product_version: &'static str,
+    version: &'static str,
+    revision: &'static str,
+}
+
+impl BuildInfo {
+    pub const fn new() -> Self {
+        Self {
+            product_version: env!("OPENVMM_PRODUCT_VERSION"),
+            version: env!("OPENVMM_VERSION"),
+            revision: env!("BUILD_GIT_SHA"),
+        }
+    }
+
+    pub const fn product_version(&self) -> &'static str {
+        self.product_version
+    }
+
+    pub const fn version(&self) -> &'static str {
+        self.version
+    }
+
+    pub const fn scm_revision(&self) -> &'static str {
+        self.revision
+    }
+}
+
+// Keep the build information easy to discover without a debugger.
+//
+// The static remains reachable through `get`, so `#[used]` is not required.
+//
+// UNSAFETY: `link_section` and `export_name` are unsafe attributes.
+#[expect(unsafe_code)]
+// SAFETY: These are custom metadata sections with no safety requirements.
+#[cfg_attr(target_os = "windows", unsafe(link_section = ".build_i"))]
+#[cfg_attr(target_vendor = "apple", unsafe(link_section = "__DATA,__build_info"))]
+#[cfg_attr(
+    not(any(target_os = "windows", target_vendor = "apple")),
+    unsafe(link_section = ".build_info")
+)]
+// SAFETY: This symbol is uniquely named for OpenVMM and has no runtime ABI.
+#[unsafe(export_name = "OPENVMM_BUILD_INFO")]
+static OPENVMM_BUILD_INFO: BuildInfo = BuildInfo::new();
+
+pub fn get() -> &'static BuildInfo {
+    // Prevent fat LTO from optimizing away the metadata static.
+    std::hint::black_box(&OPENVMM_BUILD_INFO)
+}