Download the engine

The vrtmv client runs in your environment. Linux x86-64, self-contained — no runtime to install.

vrtmv — Linux x86-64

vrtmv-linux-x86_64.tar.gz · latest

1 · Unpack & install

tar xzf vrtmv-linux-x86_64.tar.gz
sudo install vrtmv /usr/local/bin/vrtmv
vrtmv --help

2 · Point it at your account

export VRTMV_API_URL=https://api.vrtmv.com
export VRTMV_API_KEY=your-key   # from your account page

3 · Migrate a workload

vrtmv migrate --image prod-web01.vmdk --target alma9 -o ./out
# → roles/vrtmv_migration/tasks/main.yml + vrtmv-attestation.json

Your key is on the account page. Reading a disk image read-only needs the usual block-device privileges (losetup / qemu-nbd) on the host you run it from.

Log in to download

The engine download is available to signed-in accounts. It's free.

No account? Sign up free — 10 migrations on us.

Verify what you downloaded

Every artifact is signed with cosign against a published key (cosign.pub, which ships inside the tarball and as its own release asset) and carries a CycloneDX SBOM. Verifying needs nothing from us: no account, no call home, no transparency-log lookup, and it keeps working offline if we disappear.

cosign verify-blob --key cosign.pub --insecure-ignore-tlog=true \
  --bundle vrtmv-<ver>-<target>.tar.gz.bundle \
  vrtmv-<ver>-<target>.tar.gz

Verified OK means these exact bytes were signed with the vrtmv release key. A modified binary, a re-signed one, or an artifact from anywhere else fails. (--insecure-ignore-tlog=true just says "don't consult a transparency log" — keyed signing uses no public log; it is not a weakening.) The same command verifies the SBOM by swapping .tar.gz for .cdx.json, and checksums are in the .sha256 file (shasum -a 256 -c). Install cosign: docs.sigstore.dev/cosign.