Where an instance came from
Every instance carries a signed record of its origin, and MSL can tell a copy from an original.
On this page 3 sections
msl identity [instance]Every instance is given a signed identity when it is created. It records the family it belongs to, how many times it has been copied, and the name it was born under.
Ubuntu: an original
lineage vtp6ismgxwsxmj4kcmvx7hojug
copies 0 (0)
born as Ubuntu on machine b8072e055c9775b6A copy says copy 0.1 of its lineage and keeps its parent's lineage, so a family stays recognisable however far it spreads. The dots are the copies: 0.1.2 is the second copy of the first copy of an original.
What it is for#
Denying instance.clone stops the Clone button. It does not stop somebody copying a disk file by hand, or exporting a shipment where copying is allowed and importing it where it is not. An identity makes those answerable: a copy that arrives any other way still carries the family it came from, and a Mac can refuse it.
What MSL notices#
| What you see | |
|---|---|
| A copied disk with a new registry entry | no identity recorded — it makes no claim to be an original |
| A copied identity file too | ALSO CLAIMED BY … — two instances cannot be the same instance |
| An edited identity | the signature does not match |
| An imported shipment | arrives as a copy, one generation deeper |
The marker inside the guest#
MSL also writes the identity to /etc/msl-instance inside the instance. The host record does not travel with a disk; that does. If somebody swaps the disk under a name whose identity is perfectly valid, the two disagree and MSL says so.
A missing marker is reported and never rewritten. Writing it back would stamp this instance's identity onto whatever disk is actually there, which is the exact thing the marker exists to catch. If you know the disk is right — a cleanup removed the file, say — put it back deliberately:
msl identity <instance> --rewrite-marker