kettle

Build, publish, run, and verify measured CVM (confidential VM) guest images with kettle and kettle-orchestrator. Covers the full guest-image pipeline: reproducible StageX builds of the kettle/kettle-server binaries, mkosi-based image builds that emit disk.raw + guest.igvm + OVMF.fd + uki.efi + dm-verity roothash, IGVM launch measurement, OCI artifact distribution via oras/GHCR, booting AMD SEV-SNP guests under QEMU+KVM, and end-to-end attested-build verification (SLSA provenance + hardware evidence). Trigger this skill whenever the task involves: CVM guest images, IGVM files or launch measurements, UKI (unified kernel images), dm-verity roothash binding, SEV-SNP guests under QEMU, OCI image artifacts for confidential VMs, measured boot chains, launching or orchestrating confidential VMs, kettle / kettle-server / kettle-orchestrator / igvm-tools commands, or verifying attested builds against the exact VM image that produced them.