Hosted macOS runners run without nested virtualization: kern
.hv_support is 0 and no binary can boot a VM there, entitlement or
not. The macos job keeps the full compile gate and asserts the probe
reports the known HVF absence with a working engine load, so any
other regression still fails; the boot e2e stays on Linux and real
Macs.
Homebrew now refuses formulae from third-party taps unless trusted:
the explicitly requested formula is trusted automatically, but its
dependencies are not, so the install died on libkrunfw. Users hit
the same wall on their first install; the README leads with the
one-time brew trust now.
All consumers live in packaging already: the formula codesigns at
install, and the CI and release workflows codesign the built binary.
The macOS dir held nothing else.
CI runs fmt/clippy/test plus a real alpine boot on a macos-26 runner
with libkrun from the krun tap; the release workflow ships a signed
darwin-arm64 tarball beside the snaps. The formula installs from the
tap, carries the runtime kegs (libkrun, e2fsprogs, libarchive), and
codesigns the binary with the hypervisor entitlement — Hypervisor
.framework grants VM creation only to entitled binaries on current
macOS, the same requirement krunkit's formula signs for.
The payload's stdout is a serial console, so fastfetch reads a tty
and decorates its output with cursor escapes; the ^OS: anchor
matched nothing and would have failed a green run. --pipe --logo
none prints a plain key-value list, and a sed strips anything left
before the grep. SPEC records the first measured apt wall time: 24 s
cache-warm, boot included.
The snap only got built at tag time, so the pack rotted between
releases; ci now packs it on every change, the same action the
release workflow uses, and boots it twice: an alpine uname check
that proves the machine virtualized under strict confinement, and
apt update + install fastfetch on ubuntu, which is T8 — a real
package install through the TSI proxy, the staged e2fsprogs, and
the exit-code path, with the wall time as the standing
re-measurement of the ln driver's throughput.
Same dlopen as the snap stages for: the runner has e2fsprogs but not
the lib, and the first cold pull would fail. The t64 name with a
fallback keeps it honest if the runner image changes base.
The T6 run boots from a block device now; an engine without the blk
feature fails the lookup for krun_add_disk and the audit never sees a
machine. Same feature set as the snap ships.
The test has been declared as CI-only since it landed and never ran
anywhere. The job builds the engine from the tag the snap bundles,
takes libkrunfw from the pool, opens /dev/kvm, and runs the ignored
test with ECROU_BIN and LD_LIBRARY_PATH pointed at them.
Testing runs the pre-commit trio on pushes to main and PRs.
Releasing builds the snap on plain vX tags and publishes it to the
stable store channel; rc tags fail the version gate and leave the
publish job skipped.
vhaudiquet