handing an image to a machine that does not exist yet

The last stage of building a machine image is giving it to whoever will install it. Here the installer is the hosting provider's own automation, running against hardware that has not been commissioned, holding no credentials of ours, and fetching the artefact over a network we do not control. That is the shape of the problem: the consumer cannot be authenticated, because there is nothing stable yet to authenticate. It has an address, a build request, and nothing else.

Every conventional answer — a shared secret, an account, a private store — assumes a machine that already exists and can be told something.

The decision was to make the address itself the capability. Each build is placed at a location that cannot be guessed, that location is handed over once with the build request, and nothing else is reachable from outside. Whoever holds the address can fetch the image; whoever does not, cannot. It is the smallest authorisation model available and it is honest about what it protects.

The costs are real. The address becomes a secret that has to travel beside the request, so the request itself becomes sensitive, and nothing can be rotated afterwards without breaking a fetch already in flight.

What it proves is that the awkward end of infrastructure is not building the artefact. It is delivery to a party whose identity does not exist yet.