Enhance UVM installation and configuration for Ubuntu 22.04 root filesystem

- Update README and USAGE documentation to reflect changes in rootfs handling, including the default local build from Ubuntu 22.04 packages.
- Modify the installer to support building the rootfs locally with authenticated packages and to require SHA-256 checksums for prebuilt images.
- Implement checks for setuid permissions on sudo and update the provisioning logic for guest users to ensure proper sudo access.
- Adjust tests to validate the new rootfs building process and ensure that existing functionality is preserved.
- Refactor code to improve clarity and maintainability, including the introduction of constants for Ubuntu release and guest packages.

USAGE.md

@@ -138,21 +138,22 @@ not disable confirmations, and errors may still be plain text on stderr.
 ## 4. Install UVM Assets
 
 UVM installs host packages, Firecracker, Jailer, a guest kernel, and a guest
-rootfs template. It requires SHA-256 checksums by default because it downloads
-artifacts that will be used by a privileged process.
+rootfs template. The default rootfs is built locally from authenticated Ubuntu
+22.04 packages, including OpenSSH, sudo, and complete apt/dpkg metadata. The
+downloaded Firecracker archive and kernel require trusted SHA-256 checksums.
 
 ### ARM64 Hosts (NVIDIA DGX Spark)
 
-UVM detects the host architecture and selects matching Firecracker, kernel,
-and rootfs downloads. NVIDIA DGX Spark uses the `aarch64` assets; the `arm64`
-architecture alias is also accepted. The default ARM64 guest downloads are:
+UVM detects the host architecture and selects matching Firecracker and kernel
+downloads and native Ubuntu packages. NVIDIA DGX Spark uses `aarch64` artifacts
+and `arm64` packages; the `arm64` architecture alias is also accepted:
 
 - Kernel: `https://s3.amazonaws.com/spec.ccfc.min/img/quickstart_guide/aarch64/kernels/vmlinux.bin`
-- Rootfs: `https://s3.amazonaws.com/spec.ccfc.min/img/quickstart_guide/aarch64/rootfs/bionic.rootfs.ext4`
+- Rootfs: Ubuntu 22.04 built with `debootstrap` from `ports.ubuntu.com/ubuntu-ports`.
 
-Use the installation commands below with checksums for those ARM64 artifacts
-and the ARM64 Firecracker release archive. `UVM_KERNEL_URL` and
-`UVM_ROOTFS_URL` can override either download independently. Custom images must
+Use the installation commands below with checksums for the ARM64 kernel
+and Firecracker release archive. `UVM_KERNEL_URL` overrides the kernel download;
+`UVM_ROOTFS_URL` selects a prebuilt ext4 image instead of the local build. Custom images must
 match the host architecture and the [guest image contract](README.md#guest-image-contract).
 On ARM64, the kernel must be an uncompressed ARM64 Linux `Image` (PE format),
 and the rootfs must be an ARM64 ext4 filesystem. UVM adds `keep_bootcon` to the
@@ -166,7 +167,6 @@ Obtain trusted checksums independently, then run:
 sudo env \
   UVM_FIRECRACKER_SHA256='<sha256-of-firecracker-archive>' \
   UVM_KERNEL_SHA256='<sha256-of-vmlinux>' \
-  UVM_ROOTFS_SHA256='<sha256-of-rootfs>' \
   ./uvm.py install
 ```
 
@@ -174,6 +174,12 @@ Installation prints the Firecracker, kernel, and rootfs paths under
 `/var/lib/uvm`. Checksums and verification provenance are recorded in
 `/var/lib/uvm/integrity.json`.
 
+The default build installs `debootstrap` and `ubuntu-keyring` on the host,
+checks Ubuntu archive signatures, and builds inside private mount/PID
+namespaces. It requires native root execution with namespace support. Leave
+`UVM_ROOTFS_URL` and `UVM_ROOTFS_SHA256` unset for this mode. To use a prebuilt
+ext4 image, supply both its URL and SHA-256 instead.
+
 ### Scenario: Refresh Firecracker or Guest Assets
 
 Use `--force` after changing a URL, replacing an image, or rotating checksums:
@@ -182,12 +188,17 @@ Use `--force` after changing a URL, replacing an image, or rotating checksums:
 sudo env \
   UVM_FIRECRACKER_SHA256='<new-firecracker-archive-sha256>' \
   UVM_KERNEL_SHA256='<new-kernel-sha256>' \
-  UVM_ROOTFS_SHA256='<new-rootfs-sha256>' \
   ./uvm.py install --force
 ```
 
-`--force` downloads to temporary files and only replaces the existing artifact
-after checksum verification succeeds.
+`--force` stages downloads and builds in temporary paths. Downloaded artifacts
+are checksum-verified; the built rootfs is checked for installed packages,
+sudo permissions, and filesystem consistency before replacement.
+
+To upgrade from the old stripped Bionic demo rootfs, run this refresh with
+`UVM_ROOTFS_URL` and `UVM_ROOTFS_SHA256` unset, then create a new VM. Restart a
+running API server to load the new provisioner. Existing VM disks retain their
+installed OS, files, and credentials.
 
 ### Scenario: Local Experimentation Without Checksums
 
@@ -215,6 +226,7 @@ sudo env UVM_ALLOW_UNVERIFIED_DOWNLOADS=1 ./uvm.py start VM
 | `checksum is required` | Provide the requested `UVM_*_SHA256` variable. |
 | `SHA-256 mismatch` | Stop and obtain the correct digest or artifact URL. |
 | `unsupported host architecture` | Use an x86_64 or ARM64 Linux host. |
+| `unshare: Operation not permitted` | Run the builder as root on a host permitting private mount/PID namespaces. |
 
 ## 5. Create VMs
 
@@ -245,7 +257,8 @@ create DNS records, and identifiers are not matched by ID prefix.
 
 `--username` selects the guest login account. If a custom username is missing,
 UVM creates it on the private disk with a primary group, `/home/USERNAME`, and
-the `/bin/sh` login shell. Existing accounts keep their identity and home.
+the `/bin/sh` login shell. Custom logins receive sudo access using their guest
+password. Existing accounts keep their identity and home.
 
 A `--password` value is visible in process arguments and may enter shell
 history. Prefer `--password-stdin`, which reads one line, strips the trailing
@@ -415,6 +428,20 @@ guest image must include:
 - An SSH server.
 - Standard passwd and shadow files, plus `/etc/ssh/sshd_config`.
 - `/etc/group` and `/bin/sh` for new users; the default `root` account must exist.
+- Root-owned setuid `/usr/bin/sudo` and `/etc/sudoers` for a custom login user.
+
+For a custom login, run these commands inside the VM:
+
+```sh
+sudo -i                 # Authenticate with the custom user's SSH password.
+sudo apt update
+sudo apt install htop
+```
+
+`su -` requests root's password, which is separate from the custom user's
+password. Use `sudo -i` for administrative access. The default Ubuntu image
+includes an intact `/var/lib/dpkg` database; an old Bionic demo image missing
+that database needs a replacement template and a new VM for package management.
 
 UVM replaces conventional RSA, ECDSA, and Ed25519 SSH host keys in the private
 disk during creation and removes Firecracker's publicly known demo login key.