From ff7362489147deb11b407c2cca04354bab7ec631 Mon Sep 17 00:00:00 2001 From: Valentin Haudiquet Date: Sat, 31 Oct 2026 18:10:33 -0500 Subject: [PATCH] build: add the macOS gate, darwin artifacts, and a Homebrew formula MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI runs fmt/clippy/test plus a real alpine boot on a macos-26 runner with libkrun from the krun tap; the release workflow ships a signed darwin-arm64 tarball beside the snaps. The formula installs from the tap, carries the runtime kegs (libkrun, e2fsprogs, libarchive), and codesigns the binary with the hypervisor entitlement — Hypervisor .framework grants VM creation only to entitled binaries on current macOS, the same requirement krunkit's formula signs for. --- .github/workflows/ci.yml | 45 ++++++++++++++++++++++++++++ .github/workflows/release.yml | 39 ++++++++++++++++++++++++ packaging/homebrew/Formula/ecrou.rb | 46 +++++++++++++++++++++++++++++ packaging/macos/ecrou.entitlements | 5 ++++ 4 files changed, 135 insertions(+) create mode 100644 packaging/homebrew/Formula/ecrou.rb create mode 100644 packaging/macos/ecrou.entitlements diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ff6a2ce..a947001 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -38,6 +38,51 @@ jobs: - name: cargo test run: cargo test + macos: + name: macos — fmt, clippy, test, boot + runs-on: macos-26 + timeout-minutes: 45 + steps: + - uses: actions/checkout@v4 + + - uses: dtolnay/rust-toolchain@stable + with: + components: clippy, rustfmt + + - uses: Swatinem/rust-cache@v2 + + # The engine is dlopen'd from the brew kegs at runtime; e2fsprogs + # supplies mke2fs and libarchive its tar path. + - name: Install the engine and the image tooling + run: brew install libkrun/homebrew-krun/libkrun e2fsprogs libarchive + + - name: cargo fmt + run: cargo fmt --all -- --check + + - name: cargo clippy + run: cargo clippy --all-targets -- -D warnings + + - name: cargo test + run: cargo test + + - name: Build the CLI + run: cargo build --release -p ecrou-cli + + # HVF grants VM creation only to binaries carrying the hypervisor + # entitlement on current macOS; packaging signs the same way. + - name: Sign the binary with the hypervisor entitlement + run: codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou + + - name: Probe + run: ./target/release/ecrou probe + + - name: Boot alpine + run: | + set -euo pipefail + guest="$(./target/release/ecrou run --quiet alpine -- uname -r | tail -n 1)" + echo "guest kernel: $guest" + test -n "$guest" + t6: name: T6 strace audit runs-on: ubuntu-latest diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index af14e9d..8f03122 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -62,6 +62,45 @@ jobs: name: ${{ matrix.artifact }} path: ${{ steps.build.outputs.snap }} + # The macos distribution is a signed tarball, not a store release: + # brew taps install from it, and the entitlement signature rides in + # the artifact. + build-macos: + needs: gate + if: needs.gate.outputs.release == 'true' + runs-on: macos-26 + timeout-minutes: 45 + steps: + - uses: actions/checkout@v4 + + - uses: dtolnay/rust-toolchain@stable + + - uses: Swatinem/rust-cache@v2 + + - name: Stamp the tag version into the manifests + run: | + v="${GITHUB_REF_NAME#v}" + sed -i '' "s/^version = \".*\"/version = \"$v\"/" Cargo.toml + grep -H '^version' Cargo.toml + + - name: Build the CLI + run: cargo build --release -p ecrou-cli + + - name: Sign the binary with the hypervisor entitlement + run: codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou + + - name: Package + run: | + v="${GITHUB_REF_NAME#v}" + tar -czf "ecrou-v$v-darwin-arm64.tar.gz" -C target/release ecrou + shasum -a 256 "ecrou-v$v-darwin-arm64.tar.gz" > "ecrou-v$v-darwin-arm64.tar.gz.sha256" + mkdir dist && mv ecrou-v$v-darwin-* dist/ + + - uses: actions/upload-artifact@v4 + with: + name: ecrou-darwin-arm64 + path: dist/* + publish-snap: needs: build-snap runs-on: ubuntu-latest diff --git a/packaging/homebrew/Formula/ecrou.rb b/packaging/homebrew/Formula/ecrou.rb new file mode 100644 index 0000000..c82f702 --- /dev/null +++ b/packaging/homebrew/Formula/ecrou.rb @@ -0,0 +1,46 @@ +# The formula lives in the repo and ships through the +# vhaudiquet/homebrew-ecrou tap; it needs the same tap libkrun's +# krunkit comes from, because the engine is dlopen'd from those kegs +# at runtime. +class Ecrou < Formula + desc "One-shot microVM environments" + homepage "https://github.com/vhaudiquet/ecrou" + # Pinned by tag until the first release exists; switch to the + # release tarball + sha256 then. + url "https://github.com/vhaudiquet/ecrou.git", tag: "v0.1.0" + license "MIT" + + # libkrun's Hypervisor.framework backend is arm64-only upstream. + depends_on arch: :arm64 + depends_on "rust" => :build + depends_on "libkrun/homebrew-krun/libkrun" + depends_on "e2fsprogs" + # A libarchive-capable mke2fs populates ext4 images from tarballs in + # one pass; without it the build falls back to a per-file tree walk. + depends_on "libarchive" + + def install + system "cargo", "build", "--release" + bin.install "target/release/ecrou" + # Hypervisor.framework grants VM creation only to binaries signed + # with the hypervisor entitlement; on current macOS the signature + # is a hard requirement, the same one krunkit's formula carries. + system "codesign", "--force", "--sign", "-", + "--entitlements", "packaging/macos/ecrou.entitlements", bin/"ecrou" + end + + def caveats + <<~EOS + The binary is ad-hoc signed with the com.apple.security.hypervisor + entitlement. Rebuilding from source (cargo) requires re-signing: + codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou + `ecrou probe` reports this when the entitlement is missing. + EOS + end + + test do + system bin/"ecrou", "probe" + output = shell_output("#{bin}/ecrou run --quiet alpine -- uname -r").strip + assert_match(/\d+\.\d+/, output) + end +end diff --git a/packaging/macos/ecrou.entitlements b/packaging/macos/ecrou.entitlements new file mode 100644 index 0000000..6423840 --- /dev/null +++ b/packaging/macos/ecrou.entitlements @@ -0,0 +1,5 @@ + + + +com.apple.security.hypervisor +