build: move the entitlements next to the Homebrew formula

All consumers live in packaging already: the formula codesigns at
install, and the CI and release workflows codesign the built binary.
The macOS dir held nothing else.

.github/workflows/ci.yml

@@ -71,7 +71,7 @@ jobs:
       # HVF grants VM creation only to binaries carrying the hypervisor
       # entitlement on current macOS; packaging signs the same way.
       - name: Sign the binary with the hypervisor entitlement
-        run: codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou
+        run: codesign --force --sign - --entitlements packaging/homebrew/ecrou.entitlements target/release/ecrou
 
       - name: Probe
         run: ./target/release/ecrou probe

.github/workflows/release.yml

@@ -87,7 +87,7 @@ jobs:
         run: cargo build --release -p ecrou-cli
 
       - name: Sign the binary with the hypervisor entitlement
-        run: codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou
+        run: codesign --force --sign - --entitlements packaging/homebrew/ecrou.entitlements target/release/ecrou
 
       - name: Package
         run: |

SPEC.md

@@ -342,7 +342,7 @@ the release tarball and pushes it (gated on a `HOMEBREW_TAP_TOKEN`
 PAT; without the secret the job no-ops). The formula carries the runtime
 dependencies (`libkrun` from the krun tap, `e2fsprogs`, `libarchive`),
 builds from source with cargo, and re-signs the binary with the
-entitlements plist from `packaging/macos/` — brew bottles are
+entitlements plist from `packaging/homebrew/` — brew bottles are
 ad-hoc signed, so the signature is part of the formula's install,
 not of the artifact. The formula is pinned by tag until the first
 release exists, then switches to the release tarball + sha256 the

packaging/homebrew/Formula/ecrou.rb

@@ -3,7 +3,7 @@
 # krunkit comes from, because the engine is dlopen'd from those kegs
 # at runtime.
 class Ecrou < Formula
-  desc "One-shot microVM environments"
+  desc "a small microVM runtime based on libkrun"
   homepage "https://github.com/vhaudiquet/ecrou"
   # Pinned by tag until the first release exists; switch to the
   # release tarball + sha256 then.
@@ -26,14 +26,14 @@ class Ecrou < Formula
     # with the hypervisor entitlement; on current macOS the signature
     # is a hard requirement, the same one krunkit's formula carries.
     system "codesign", "--force", "--sign", "-",
-      "--entitlements", "packaging/macos/ecrou.entitlements", bin/"ecrou"
+      "--entitlements", "packaging/homebrew/ecrou.entitlements", bin/"ecrou"
   end
 
   def caveats
     <<~EOS
       The binary is ad-hoc signed with the com.apple.security.hypervisor
       entitlement. Rebuilding from source (cargo) requires re-signing:
-        codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou
+        codesign --force --sign - --entitlements packaging/homebrew/ecrou.entitlements target/release/ecrou
       `ecrou probe` reports this when the entitlement is missing.
     EOS
   end