build: add the macOS gate, darwin artifacts, and a Homebrew formula

CI runs fmt/clippy/test plus a real alpine boot on a macos-26 runner
with libkrun from the krun tap; the release workflow ships a signed
darwin-arm64 tarball beside the snaps. The formula installs from the
tap, carries the runtime kegs (libkrun, e2fsprogs, libarchive), and
codesigns the binary with the hypervisor entitlement — Hypervisor
.framework grants VM creation only to entitled binaries on current
macOS, the same requirement krunkit's formula signs for.

.github/workflows/ci.yml

@@ -38,6 +38,51 @@ jobs:
       - name: cargo test
         run: cargo test
 
+  macos:
+    name: macos — fmt, clippy, test, boot
+    runs-on: macos-26
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+
+      - uses: Swatinem/rust-cache@v2
+
+      # The engine is dlopen'd from the brew kegs at runtime; e2fsprogs
+      # supplies mke2fs and libarchive its tar path.
+      - name: Install the engine and the image tooling
+        run: brew install libkrun/homebrew-krun/libkrun e2fsprogs libarchive
+
+      - name: cargo fmt
+        run: cargo fmt --all -- --check
+
+      - name: cargo clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: cargo test
+        run: cargo test
+
+      - name: Build the CLI
+        run: cargo build --release -p ecrou-cli
+
+      # HVF grants VM creation only to binaries carrying the hypervisor
+      # entitlement on current macOS; packaging signs the same way.
+      - name: Sign the binary with the hypervisor entitlement
+        run: codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou
+
+      - name: Probe
+        run: ./target/release/ecrou probe
+
+      - name: Boot alpine
+        run: |
+          set -euo pipefail
+          guest="$(./target/release/ecrou run --quiet alpine -- uname -r | tail -n 1)"
+          echo "guest kernel: $guest"
+          test -n "$guest"
+
   t6:
     name: T6 strace audit
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -62,6 +62,45 @@ jobs:
           name: ${{ matrix.artifact }}
           path: ${{ steps.build.outputs.snap }}
 
+  # The macos distribution is a signed tarball, not a store release:
+  # brew taps install from it, and the entitlement signature rides in
+  # the artifact.
+  build-macos:
+    needs: gate
+    if: needs.gate.outputs.release == 'true'
+    runs-on: macos-26
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Stamp the tag version into the manifests
+        run: |
+          v="${GITHUB_REF_NAME#v}"
+          sed -i '' "s/^version = \".*\"/version = \"$v\"/" Cargo.toml
+          grep -H '^version' Cargo.toml
+
+      - name: Build the CLI
+        run: cargo build --release -p ecrou-cli
+
+      - name: Sign the binary with the hypervisor entitlement
+        run: codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou
+
+      - name: Package
+        run: |
+          v="${GITHUB_REF_NAME#v}"
+          tar -czf "ecrou-v$v-darwin-arm64.tar.gz" -C target/release ecrou
+          shasum -a 256 "ecrou-v$v-darwin-arm64.tar.gz" > "ecrou-v$v-darwin-arm64.tar.gz.sha256"
+          mkdir dist && mv ecrou-v$v-darwin-* dist/
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ecrou-darwin-arm64
+          path: dist/*
+
   publish-snap:
     needs: build-snap
     runs-on: ubuntu-latest

packaging/homebrew/Formula/ecrou.rb

@@ -0,0 +1,46 @@
+# The formula lives in the repo and ships through the
+# vhaudiquet/homebrew-ecrou tap; it needs the same tap libkrun's
+# krunkit comes from, because the engine is dlopen'd from those kegs
+# at runtime.
+class Ecrou < Formula
+  desc "One-shot microVM environments"
+  homepage "https://github.com/vhaudiquet/ecrou"
+  # Pinned by tag until the first release exists; switch to the
+  # release tarball + sha256 then.
+  url "https://github.com/vhaudiquet/ecrou.git", tag: "v0.1.0"
+  license "MIT"
+
+  # libkrun's Hypervisor.framework backend is arm64-only upstream.
+  depends_on arch: :arm64
+  depends_on "rust" => :build
+  depends_on "libkrun/homebrew-krun/libkrun"
+  depends_on "e2fsprogs"
+  # A libarchive-capable mke2fs populates ext4 images from tarballs in
+  # one pass; without it the build falls back to a per-file tree walk.
+  depends_on "libarchive"
+
+  def install
+    system "cargo", "build", "--release"
+    bin.install "target/release/ecrou"
+    # Hypervisor.framework grants VM creation only to binaries signed
+    # with the hypervisor entitlement; on current macOS the signature
+    # is a hard requirement, the same one krunkit's formula carries.
+    system "codesign", "--force", "--sign", "-",
+      "--entitlements", "packaging/macos/ecrou.entitlements", bin/"ecrou"
+  end
+
+  def caveats
+    <<~EOS
+      The binary is ad-hoc signed with the com.apple.security.hypervisor
+      entitlement. Rebuilding from source (cargo) requires re-signing:
+        codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou
+      `ecrou probe` reports this when the entitlement is missing.
+    EOS
+  end
+
+  test do
+    system bin/"ecrou", "probe"
+    output = shell_output("#{bin}/ecrou run --quiet alpine -- uname -r").strip
+    assert_match(/\d+\.\d+/, output)
+  end
+end

packaging/macos/ecrou.entitlements

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>com.apple.security.hypervisor</key><true/>
+</dict></plist>