The guide keeps the full WeKan and FerretDB stack on a guest-owned disk behind KVM, libvirt NAT, SELinux sVirt and a local-only display, without forwarding host files, credentials, Docker, devices or clipboard integration. Host-side helpers install the Fedora virtualization stack, stage verified ARM64 media in libvirt’s protected image directory, create a conservatively sized VM, start its local console and request a bounded graceful shutdown without ever forcing power off. Shell syntax checks cover all three lifecycle scripts.

The Fedora files now live in their own AsahiFedora directory, while a parallel AsahiUbuntu guide and executable lifecycle helpers install Ubuntu’s native QEMU, libvirt and AArch64 UEFI packages. The Ubuntu VM retains the same KVM, NAT, local-display and guest-owned-storage boundary, stages installation media where AppArmor permits system libvirt to read it, and shares no host directory, agent, Docker socket, device or clipboard channel.

MongoDB’s legacy SCRAM-SHA-1 protocol requires MD5 password preparation before its salted PBKDF2-SHA-1 derivation. Replacing that operation would reject compatible credentials rather than strengthen them, so the query-specific CodeQL and LGTM annotations are restored on that operation alone. A source regression keeps both annotations attached to the single digest, MongoDB-generated positive vectors retain interoperability coverage, and invalid salt and authentication cases remain covered. New deployments should use SCRAM-SHA-256.

FerretDB’s runtime, integration, tools and database-image dependency sets now move together with Go 1.27.0. The maintained wire library replaces removed document iteration, message-section decoding and logging interfaces while retaining MongoDB document sequences and IEEE-754 NaN handling. The MongoDB database image, Citus, OpenTelemetry, SAP HANA driver and resolved indirect dependencies are updated at the same time.

The test-event decoder accepts Go 1.27’s new fields without accepting unknown input, and all root, integration, release and container build paths use the same Go version. Unit tests, vet, race-enabled tools tests, SQLite/TLS integration tests and a binary containing the SQLite, PostgreSQL, MySQL and HANA handlers passed.

The runtime and integration module graphs update the indirect MongoDB v2 driver from 2.2.2 to 2.4.2, while the tools graph updates gRPC from 1.83.0 to 1.83.1. Module checksums verify and the complete unit, vet and SQLite/TLS integration pipeline passes with the refreshed dependency graphs.

The Database Tools build now clones current upstream master, including fixes not yet present in a release, instead of resolving the newest 100.x tag. Each source snapshot gets a master-SHORT-COMMIT-HASH release identity, while the full commit remains embedded in every binary and linked from its provenance notes, so fill-in builds cannot mix assets from different upstream revisions.

The workflows install the newest stable Go, upgrade every compatible direct and transitive dependency used by the complete package graph, tidy the modules and regenerate vendor/ before cross-compiling. Offline coverage checks ref selection, commit-derived identities, dependency steps, patch integrity and all 136 tool/target combinations. A real current-master preparation and focused options, mongodump and mongorestore tests pass with Go 1.27.