Add explicit img disk image support

[popey]

Summary

• recognize .img as an explicit raw disk-image fallback when qemu-img cannot determine a format
• continue preferring content detection so qcow2 or vmdk images with an .img suffix are handled correctly
• fall back cleanly when qemu-img is unavailable
• keep gzip fallback limited to the existing .ami and .raw paths so untrusted .img inputs cannot trigger decompression
• document .img behavior and the existing partition/filesystem limitations
• add regression coverage for detected formats, failed and unavailable probes, and gzip-looking .img input

Validation

• python3 -m unittest discover -s tests -v
• python3 -m py_compile sbom-vm.py generate-test-images.py tests/test_image_format.py
• node --test .github/change-review/publish-review.test.mjs
• git diff --check

Closes #5

[github-actions]

tessl change review:

Reviewed against skills: review-code-legibility, review-test-risk, review-security-risks

review-code-legibility

• Found 2 issues; overall, the new fallback behavior is understandable but a couple of names/documentation entries blur formats vs suffix fallbacks.

review-test-risk

• Found 1 issue; coverage is mostly aligned, but one assertion is brittle implementation coupling.

review-security-risks

• Found 1 issue; .img fallback can now route untrusted input into unbounded decompression.

---

To trigger a re-review write a comment that says @tessl-change-review.

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[minnielove2026]

External Linux .img test

Tested this PR end-to-end on Linux with an official Raspberry Pi OS image.

Test input and host

• Image: Raspberry Pi OS Trixie Lite ARM64, 2026-06-18
• URL: https://downloads.raspberrypi.com/raspios_lite_arm64/images/raspios_lite_arm64-2026-06-19/2026-06-18-raspios-trixie-arm64-lite.img.xz
• Publisher SHA-256: acff736ca7945e3b305f07cda4abdb870910e12634991da69783611756e381b3 (verified)
• Host: Ubuntu 24.04.4 LTS, x86_64
• Compressed size: 524,875,608 bytes
• Expanded size: 2,977,955,840 bytes

Finding and fix

The first run correctly detected the expanded .img as raw, but qemu-nbd failed because the detected format was not passed to the connection command. A direct connection using --format=raw --read-only succeeded, confirming the cause.

Commit 8494e41 now carries the prepared image's actual format into the NBD connection and makes the NBD export explicitly read-only. This accounts for raw images, gzip inputs prepared as raw, and VMDK/VHD/VPC inputs converted to QCOW2.

Successful rerun

• Format detection: raw
• NBD connection: raw, read-only
• Partitions found: /dev/nbd0p1 (FAT32) and /dev/nbd0p2 (ext4)
• Selected partition: /dev/nbd0p2, ext4, 2,433 MB
• Syft: succeeded with version 1.50.0
• SBOM artifacts: 4,742
• SBOM relationships: 73,929
• SBOM size: 48,658,616 bytes
• Total runtime: 32.852 seconds
• Cleanup: successful; no remaining mount, NBD attachment, or temporary directory

Local validation

• 12 Python unit tests pass, including the new qemu-nbd command regression test
• Python compilation passes
• Publisher test passes
• git diff --check passes