agent-dev-env 0.1.0

package/dist/assets/images/windows-arm64-qemu/autounattend.xml

@@ -0,0 +1,325 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  autounattend.xml — Windows 11 ARM64 unattended install for the Packer
+  QEMU build (images/windows-arm64-qemu/sandbox.pkr.hcl).
+
+  Windows Setup probes attached removable media for Autounattend.xml at
+  the root and applies it before the language picker. The CD is built by
+  Packer's cd_files from this file + the drivers/ tree staged by the
+  build flow (the ARM64 viostor/vioscsi/NetKVM driver subset
+  extracted from virtio-win.iso). WinPE drive-letter enumeration on
+  ARM64 + EFI is non-deterministic, so the driver paths below list
+  D:..G: candidates.
+
+  Schema components carry processorArchitecture="arm64". The
+  Administrator password must stay in sync with the winrm_password
+  variable in vars/sandbox-windows-11-arm64-qemu.pkrvars.hcl — change both together.
+
+  References:
+  - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/
+  - Recipe verified end-to-end on Apple Silicon in the mac-vms project
+    (https://github.com/bbirkinbine/mac-vms, packer/windows-11-arm64/).
+-->
+<unattend xmlns="urn:schemas-microsoft-com:unattend">
+
+  <settings pass="windowsPE">
+
+    <!-- Virtio drivers for the QEMU emulated disk + NIC. Without viostor
+         WinPE can't see the boot disk (the template uses disk_interface
+         "virtio"); without NetKVM the NIC has no driver and WinRM never
+         comes up. -->
+    <component name="Microsoft-Windows-PnpCustomizationsWinPE"
+               processorArchitecture="arm64"
+               publicKeyToken="31bf3856ad364e35"
+               language="neutral" versionScope="nonSxS"
+               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"
+               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+      <DriverPaths>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="viostor-d">
+          <Path>D:\drivers\staging\viostor</Path>
+        </PathAndCredentials>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="viostor-e">
+          <Path>E:\drivers\staging\viostor</Path>
+        </PathAndCredentials>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="viostor-f">
+          <Path>F:\drivers\staging\viostor</Path>
+        </PathAndCredentials>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="viostor-g">
+          <Path>G:\drivers\staging\viostor</Path>
+        </PathAndCredentials>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="vioscsi-d">
+          <Path>D:\drivers\staging\vioscsi</Path>
+        </PathAndCredentials>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="vioscsi-e">
+          <Path>E:\drivers\staging\vioscsi</Path>
+        </PathAndCredentials>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="vioscsi-f">
+          <Path>F:\drivers\staging\vioscsi</Path>
+        </PathAndCredentials>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="vioscsi-g">
+          <Path>G:\drivers\staging\vioscsi</Path>
+        </PathAndCredentials>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="NetKVM-d">
+          <Path>D:\drivers\staging\NetKVM</Path>
+        </PathAndCredentials>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="NetKVM-e">
+          <Path>E:\drivers\staging\NetKVM</Path>
+        </PathAndCredentials>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="NetKVM-f">
+          <Path>F:\drivers\staging\NetKVM</Path>
+        </PathAndCredentials>
+        <PathAndCredentials wcm:action="add" wcm:keyValue="NetKVM-g">
+          <Path>G:\drivers\staging\NetKVM</Path>
+        </PathAndCredentials>
+      </DriverPaths>
+    </component>
+
+    <component name="Microsoft-Windows-International-Core-WinPE"
+               processorArchitecture="arm64"
+               publicKeyToken="31bf3856ad364e35"
+               language="neutral" versionScope="nonSxS"
+               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
+      <SetupUILanguage>
+        <UILanguage>en-US</UILanguage>
+      </SetupUILanguage>
+      <InputLocale>en-US</InputLocale>
+      <SystemLocale>en-US</SystemLocale>
+      <UILanguage>en-US</UILanguage>
+      <UserLocale>en-US</UserLocale>
+    </component>
+
+    <component name="Microsoft-Windows-Setup"
+               processorArchitecture="arm64"
+               publicKeyToken="31bf3856ad364e35"
+               language="neutral" versionScope="nonSxS"
+               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
+
+      <!-- Pure-UEFI layout for ARM64: ESP + MSR + Windows. -->
+      <DiskConfiguration>
+        <Disk wcm:action="add">
+          <DiskID>0</DiskID>
+          <WillWipeDisk>true</WillWipeDisk>
+          <CreatePartitions>
+            <CreatePartition wcm:action="add">
+              <Order>1</Order>
+              <Type>EFI</Type>
+              <Size>300</Size>
+            </CreatePartition>
+            <CreatePartition wcm:action="add">
+              <Order>2</Order>
+              <Type>MSR</Type>
+              <Size>16</Size>
+            </CreatePartition>
+            <CreatePartition wcm:action="add">
+              <Order>3</Order>
+              <Type>Primary</Type>
+              <Extend>true</Extend>
+            </CreatePartition>
+          </CreatePartitions>
+          <ModifyPartitions>
+            <ModifyPartition wcm:action="add">
+              <Order>1</Order>
+              <PartitionID>1</PartitionID>
+              <Format>FAT32</Format>
+              <Label>System</Label>
+            </ModifyPartition>
+            <ModifyPartition wcm:action="add">
+              <Order>2</Order>
+              <PartitionID>2</PartitionID>
+            </ModifyPartition>
+            <ModifyPartition wcm:action="add">
+              <Order>3</Order>
+              <PartitionID>3</PartitionID>
+              <Format>NTFS</Format>
+              <Label>Windows</Label>
+              <Letter>C</Letter>
+            </ModifyPartition>
+          </ModifyPartitions>
+        </Disk>
+      </DiskConfiguration>
+
+      <!-- Multi-edition ISO: pick Pro by image name. If the release uses
+           a different SKU label (e.g. "Windows 11 Pro for ARM"), the
+           install halts — check with `dism /Get-WimInfo` on the ISO. -->
+      <ImageInstall>
+        <OSImage>
+          <InstallTo>
+            <DiskID>0</DiskID>
+            <PartitionID>3</PartitionID>
+          </InstallTo>
+          <InstallFrom>
+            <MetaData wcm:action="add">
+              <Key>/IMAGE/NAME</Key>
+              <Value>Windows 11 Pro</Value>
+            </MetaData>
+          </InstallFrom>
+        </OSImage>
+      </ImageInstall>
+
+      <UserData>
+        <AcceptEula>true</AcceptEula>
+        <FullName>agent-sandbox</FullName>
+        <Organization>agent-sandbox</Organization>
+        <!-- Generic install key for Windows 11 Pro: lets Setup complete
+             without prompting; does NOT activate (the sandbox runs
+             unactivated with a watermark). -->
+        <ProductKey>
+          <Key>VK7JG-NPHTM-C97JM-9MPGT-3V66T</Key>
+          <WillShowUI>OnError</WillShowUI>
+        </ProductKey>
+      </UserData>
+
+      <!-- Bypass the Win11 hardware-requirements checks. swtpm provides a
+           real TPM 2.0 and edk2 provides UEFI Secure Boot, but `-cpu
+           host` advertises Apple Silicon to the guest and Apple Silicon
+           is not on Microsoft's supported CPU list, so BypassCPUCheck is
+           mandatory; the rest are belt-and-braces. RunSynchronous in the
+           windowsPE pass runs strictly before Setup's hardware probe. -->
+      <RunSynchronous>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Path>reg add HKLM\System\Setup\LabConfig /v BypassTPMCheck /t REG_DWORD /d 1 /f</Path>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>2</Order>
+          <Path>reg add HKLM\System\Setup\LabConfig /v BypassSecureBootCheck /t REG_DWORD /d 1 /f</Path>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>3</Order>
+          <Path>reg add HKLM\System\Setup\LabConfig /v BypassRAMCheck /t REG_DWORD /d 1 /f</Path>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>4</Order>
+          <Path>reg add HKLM\System\Setup\LabConfig /v BypassCPUCheck /t REG_DWORD /d 1 /f</Path>
+        </RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add">
+          <Order>5</Order>
+          <Path>reg add HKLM\System\Setup\LabConfig /v BypassStorageCheck /t REG_DWORD /d 1 /f</Path>
+        </RunSynchronousCommand>
+      </RunSynchronous>
+    </component>
+  </settings>
+
+  <settings pass="specialize">
+    <component name="Microsoft-Windows-Shell-Setup"
+               processorArchitecture="arm64"
+               publicKeyToken="31bf3856ad364e35"
+               language="neutral" versionScope="nonSxS"
+               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
+      <!-- NetBIOS computer names are limited to 15 chars — longer names
+           fail the specialize pass with hrResult=0x80220005. -->
+      <ComputerName>win11-sandbox</ComputerName>
+      <TimeZone>UTC</TimeZone>
+      <RegisteredOrganization>agent-sandbox</RegisteredOrganization>
+      <RegisteredOwner>agent-sandbox</RegisteredOwner>
+    </component>
+    <component name="Microsoft-Windows-International-Core"
+               processorArchitecture="arm64"
+               publicKeyToken="31bf3856ad364e35"
+               language="neutral" versionScope="nonSxS"
+               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
+      <InputLocale>en-US</InputLocale>
+      <SystemLocale>en-US</SystemLocale>
+      <UILanguage>en-US</UILanguage>
+      <UserLocale>en-US</UserLocale>
+    </component>
+  </settings>
+
+  <settings pass="oobeSystem">
+    <component name="Microsoft-Windows-Shell-Setup"
+               processorArchitecture="arm64"
+               publicKeyToken="31bf3856ad364e35"
+               language="neutral" versionScope="nonSxS"
+               xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
+
+      <OOBE>
+        <HideEULAPage>true</HideEULAPage>
+        <HideLocalAccountScreen>true</HideLocalAccountScreen>
+        <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
+        <!-- Bypasses the Microsoft-account requirement on Win11 24H2. If a
+             future release blocks this too, add BYPASSNRO registry writes
+             via RunSynchronous in the specialize pass. -->
+        <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
+        <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
+        <NetworkLocation>Work</NetworkLocation>
+        <ProtectYourPC>3</ProtectYourPC>
+        <SkipUserOOBE>true</SkipUserOOBE>
+        <SkipMachineOOBE>true</SkipMachineOOBE>
+      </OOBE>
+
+      <UserAccounts>
+        <AdministratorPassword>
+          <!-- MUST match winrm_password in the vars file. -->
+          <Value>sandbox1</Value>
+          <PlainText>true</PlainText>
+        </AdministratorPassword>
+        <LocalAccounts>
+          <LocalAccount wcm:action="add">
+            <Name>Administrator</Name>
+            <Group>Administrators</Group>
+            <Password>
+              <Value>sandbox1</Value>
+              <PlainText>true</PlainText>
+            </Password>
+            <Description>Local admin; also the SSH/RDP account of the sandbox.</Description>
+            <DisplayName>Administrator</DisplayName>
+          </LocalAccount>
+        </LocalAccounts>
+      </UserAccounts>
+
+      <!-- LogonCount=1: exactly one auto-login (the first OOBE boot, where
+           FirstLogonCommands brings up WinRM); Windows clears
+           AutoAdminLogon itself afterwards. -->
+      <AutoLogon>
+        <Username>Administrator</Username>
+        <Password>
+          <Value>sandbox1</Value>
+          <PlainText>true</PlainText>
+        </Password>
+        <Enabled>true</Enabled>
+        <LogonCount>1</LogonCount>
+      </AutoLogon>
+
+      <!-- Bring up WinRM so Packer's provisioners can connect.
+           Order is load-bearing:
+             1. Install the staged ARM64 virtio drivers into the running
+                OS's driver store — NetKVM does NOT survive the WinPE ->
+                installed-system handoff (install.wim carries no ARM64
+                virtio NIC driver), so the NIC is dead until pnputil
+                registers it. Drive letters differ from the WinPE phase,
+                so scan D:..I: for the staging tree.
+             2. Wait for the NIC to attach and complete DHCP, then force
+                the network category to Private (WinRM's AllowUnencrypted
+                refuses to apply on Public).
+             3. Enable + configure WinRM (Basic + AllowUnencrypted) and
+                open port 5985. -->
+      <FirstLogonCommands>
+        <SynchronousCommand wcm:action="add">
+          <Order>1</Order>
+          <Description>Install ARM64 virtio drivers into the driver store</Description>
+          <CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $found=$false; foreach ($l in 'D','E','F','G','H','I') { $p = ${l} + ':\drivers\staging'; if (Test-Path $p) { Get-ChildItem -Path $p -Recurse -Filter *.inf | ForEach-Object { pnputil.exe /add-driver $_.FullName /install | Out-Null }; $found=$true; break } }; if (-not $found) { Write-Error 'drivers\staging not found on D:..I: — unattend CD missing or relocated' }"</CommandLine>
+        </SynchronousCommand>
+        <SynchronousCommand wcm:action="add">
+          <Order>2</Order>
+          <Description>Wait for network and force profile to Private</Description>
+          <CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "for ($i=0; $i -lt 60; $i++) { $p = Get-NetConnectionProfile -ErrorAction SilentlyContinue; if ($p) { break }; Start-Sleep 2 }; Get-NetConnectionProfile | Set-NetConnectionProfile -NetworkCategory Private"</CommandLine>
+        </SynchronousCommand>
+        <SynchronousCommand wcm:action="add">
+          <Order>3</Order>
+          <Description>Enable WinRM service</Description>
+          <CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Set-Service -Name WinRM -StartupType Automatic; Start-Service WinRM"</CommandLine>
+        </SynchronousCommand>
+        <SynchronousCommand wcm:action="add">
+          <Order>4</Order>
+          <Description>Configure WinRM listener and auth</Description>
+          <CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "winrm quickconfig -quiet; winrm set winrm/config/service '@{AllowUnencrypted=\"true\"}'; winrm set winrm/config/service/auth '@{Basic=\"true\"}'"</CommandLine>
+        </SynchronousCommand>
+        <SynchronousCommand wcm:action="add">
+          <Order>5</Order>
+          <Description>Open firewall for WinRM</Description>
+          <CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "New-NetFirewallRule -Name 'WinRM HTTP-In' -DisplayName 'WinRM HTTP-In' -Profile Any -LocalPort 5985 -Protocol TCP -Action Allow"</CommandLine>
+        </SynchronousCommand>
+      </FirstLogonCommands>
+    </component>
+  </settings>
+</unattend>

package/dist/assets/images/windows-arm64-qemu/qemu-with-tpm.sh

@@ -0,0 +1,170 @@
+#!/bin/bash
+# qemu-with-tpm.sh — wrapper around qemu-system-aarch64 that fills in the
+# gaps Packer's qemu plugin can't generate for an ARM64 Windows build.
+#
+# Packer's qemu plugin treats `qemuargs` as a *replacement* for all
+# auto-generated args, not an append — so instead of qemuargs, this script
+# sits between Packer and qemu: Packer invokes it as if it were qemu, it
+# forwards every arg verbatim (with surgical edits) and appends its
+# additions at the end.
+#
+# What it adds / rewrites:
+#
+#   1. TPM 2.0 via the swtpm Unix socket (Windows 11 system requirement).
+#   2. `ramfb` simple linear framebuffer. ARM `virt` machines ship no
+#      graphics card by default; ramfb works because EFI firmware writes
+#      to it directly (via GOP) — virtio-gpu needs guest drivers the
+#      Windows installer doesn't have yet. (The build stages the ARM64
+#      viogpudo driver onto the unattend CD anyway, so the *runtime*
+#      runner can boot the built image with virtio-gpu-pci and the guest
+#      driver store resolves it.)
+#   3. USB controller + keyboard + tablet (no input devices otherwise;
+#      usb-tablet gives absolute pointing).
+#   4. virtio-win.iso attached as a CD-ROM via usb-storage, so the built
+#      image can install virtio-win-guest-tools (full driver suite + qemu
+#      guest agent). The boot-critical ARM64 driver subset WinPE needs at
+#      install time is bundled into the unattend CD by the build flow, not
+#      this CD.
+#   5. Rewrite of Packer-generated CD-ROM drives to usb-storage. QEMU's
+#      ARM `virt` machine has no IDE/SATA controller, and WinPE has no
+#      in-box driver for the plugin's default CD attachment; it does
+#      include the xHCI/USB stack, so usb-storage CDs are visible
+#      immediately.
+#
+# USB enumeration order is load-bearing: EDK2 walks USB devices in argv
+# order looking for `\EFI\Boot\bootaa64.efi`. The install ISO's
+# usb-storage device MUST come before virtio-win.iso's, otherwise EDK2
+# bails to the EFI Shell instead of booting Windows Setup.
+#
+# Required env (exported by the agent-dev-env CLI build flow):
+#   SWTPM_SOCK          — absolute path to the swtpm Unix socket
+#   VIRTIO_WIN_ISO_PATH — absolute path to virtio-win.iso
+#   QEMU_WITH_TPM_LOG   — log file for the final qemu invocation
+#                         (build/windows-arm64-qemu/packer_cache/
+#                         qemu-with-tpm.cmd.log)
+#
+# Adapted from bbirkinbine/mac-vms (MIT):
+# https://github.com/bbirkinbine/mac-vms/blob/main/scripts/qemu-with-tpm.sh
+
+set -euo pipefail
+
+# Packer's qemu plugin probes the qemu binary with `-version` before it
+# spawns the VM; answer it directly instead of erroring on the env checks
+# below (SWTPM_SOCK/VIRTIO_WIN_ISO_PATH are only set for real VM runs).
+if [[ "${1:-}" == "-version" || "${1:-}" == "--version" ]]; then
+  exec qemu-system-aarch64 "$@"
+fi
+
+if [[ -z "${SWTPM_SOCK:-}" ]]; then
+  echo "ERROR: SWTPM_SOCK not set; `agent-dev-env build` must export it." >&2
+  exit 1
+fi
+
+if [[ ! -S "${SWTPM_SOCK}" ]]; then
+  echo "ERROR: SWTPM_SOCK=${SWTPM_SOCK} is not a Unix socket. Is swtpm running?" >&2
+  exit 1
+fi
+
+if [[ -z "${VIRTIO_WIN_ISO_PATH:-}" ]]; then
+  echo "ERROR: VIRTIO_WIN_ISO_PATH not set; `agent-dev-env build` must export it." >&2
+  exit 1
+fi
+
+if [[ ! -f "${VIRTIO_WIN_ISO_PATH}" ]]; then
+  echo "ERROR: VIRTIO_WIN_ISO_PATH=${VIRTIO_WIN_ISO_PATH} does not exist." >&2
+  exit 1
+fi
+
+# ---- rewrite Packer-generated CD-ROM drives to usb-storage ---------------
+#
+# Walk $@: for every `-drive` whose value contains `media=cdrom`, strip the
+# `if=...` and `index=...` keys, append `if=none,id=cd<N>`, and emit a
+# matching `-device usb-storage,drive=cd<N>` after all argument rewriting
+# is done. Non-cdrom drives (notably `if=pflash` for EFI firmware/vars and
+# `if=virtio` for the qcow2 system disk) pass through untouched.
+
+rewritten_args=()
+device_appends=()
+cd_counter=0
+
+args=("$@")
+i=0
+while (( i < ${#args[@]} )); do
+  arg="${args[$i]}"
+  if [[ "$arg" == "-drive" ]] && (( i + 1 < ${#args[@]} )); then
+    val="${args[$((i + 1))]}"
+    if [[ "$val" == *"media=cdrom"* ]]; then
+      stripped="$(printf '%s' "$val" \
+        | sed -E 's/(^|,)if=[^,]*//g; s/(^|,)index=[^,]*//g; s/^,+//; s/,,+/,/g; s/,$//')"
+      cd_id="cd-pkr-${cd_counter}"
+      cd_counter=$((cd_counter + 1))
+      rewritten_args+=("-drive" "${stripped},if=none,id=${cd_id}")
+      # bus=usb.0 explicit: the xhci controller defined in `extras` below
+      # is the only USB bus on this VM, and unqualified `-device
+      # usb-storage` can fail-fast on "no usb bus" because qemu resolves
+      # device buses in argv order on ARM virt.
+      device_appends+=("-device" "usb-storage,drive=${cd_id},bus=usb.0")
+      i=$((i + 2))
+      continue
+    fi
+  fi
+  rewritten_args+=("$arg")
+  i=$((i + 1))
+done
+
+# ---- our own appends ------------------------------------------------------
+#
+# Ordering is load-bearing for two independent reasons:
+#
+#   1. qemu-xhci MUST come before any usb-storage entries (both the
+#      rewritten Packer cdroms in device_appends and our own virtio-win
+#      attach below) — qemu's device-graph resolution can fail at parse
+#      time if a usb-* device is seen before its bus exists.
+#
+#   2. The Packer install ISO's usb-storage device MUST enumerate before
+#      virtio-win.iso's (see the header comment on USB enumeration
+#      order).
+#
+# So the argv layout is split into two extras chunks:
+#   - bus_extras (xhci + input + tpm + ramfb) — defines the USB bus
+#   - virtio_win_storage (our virtio-win.iso usb-storage) — emitted LAST
+# with device_appends (Packer's CDs as usb-storage) wedged between.
+
+bus_extras=(
+  -chardev "socket,id=chrtpm,path=${SWTPM_SOCK}"
+  -tpmdev "emulator,id=tpm0,chardev=chrtpm"
+  # ppi=off: QEMU 11.1's HVF memory path aborts on the PPI region (a 1 KB,
+  # non-page-aligned RAM device) with HV_BAD_ARGUMENT — hv_vm_unmap rejects
+  # the unaligned size. Windows does not need PPI; disabling it dodges the
+  # regression. See https://gitlab.com/qemu-project/qemu/-/issues for the
+  # accel/hvf "Simplify hvf_set_phys_mem" fallout.
+  -device "tpm-tis-device,tpmdev=tpm0,ppi=off"
+  -device "ramfb"
+  -device "qemu-xhci,id=usb"
+  -device "usb-kbd,bus=usb.0"
+  -device "usb-tablet,bus=usb.0"
+)
+
+virtio_win_storage=(
+  -drive "file=${VIRTIO_WIN_ISO_PATH},media=cdrom,if=none,id=cd-virtio-win"
+  -device "usb-storage,drive=cd-virtio-win,bus=usb.0"
+)
+
+final_argv=(
+  "${rewritten_args[@]}"
+  "${bus_extras[@]}"
+  "${device_appends[@]}"
+  "${virtio_win_storage[@]}"
+)
+
+# Log the final qemu invocation so future "Qemu failed to start" errors
+# are debuggable without PACKER_LOG=1. The build flow exports the
+# per-image log path; the fallback matches the old platform-dir layout
+# for standalone runs.
+qemu_log_file="${QEMU_WITH_TPM_LOG:-packer_cache/qemu-with-tpm.cmd.log}"
+{
+  echo "==> $(date -u +%FT%TZ) qemu-system-aarch64 invocation"
+  printf '  %q\n' qemu-system-aarch64 "${final_argv[@]}"
+} >"$qemu_log_file" 2>/dev/null || true
+
+exec qemu-system-aarch64 "${final_argv[@]}"