mirror of
https://github.com/vhaudiquet/ecrou.git
synced 2026-11-12 22:22:44 +00:00
vhaudiquet
ff73624891
CI runs fmt/clippy/test plus a real alpine boot on a macos-26 runner with libkrun from the krun tap; the release workflow ships a signed darwin-arm64 tarball beside the snaps. The formula installs from the tap, carries the runtime kegs (libkrun, e2fsprogs, libarchive), and codesigns the binary with the hypervisor entitlement — Hypervisor .framework grants VM creation only to entitled binaries on current macOS, the same requirement krunkit's formula signs for.
47 lines
1.8 KiB
Ruby
47 lines
1.8 KiB
Ruby
# The formula lives in the repo and ships through the
|
|
# vhaudiquet/homebrew-ecrou tap; it needs the same tap libkrun's
|
|
# krunkit comes from, because the engine is dlopen'd from those kegs
|
|
# at runtime.
|
|
class Ecrou < Formula
|
|
desc "One-shot microVM environments"
|
|
homepage "https://github.com/vhaudiquet/ecrou"
|
|
# Pinned by tag until the first release exists; switch to the
|
|
# release tarball + sha256 then.
|
|
url "https://github.com/vhaudiquet/ecrou.git", tag: "v0.1.0"
|
|
license "MIT"
|
|
|
|
# libkrun's Hypervisor.framework backend is arm64-only upstream.
|
|
depends_on arch: :arm64
|
|
depends_on "rust" => :build
|
|
depends_on "libkrun/homebrew-krun/libkrun"
|
|
depends_on "e2fsprogs"
|
|
# A libarchive-capable mke2fs populates ext4 images from tarballs in
|
|
# one pass; without it the build falls back to a per-file tree walk.
|
|
depends_on "libarchive"
|
|
|
|
def install
|
|
system "cargo", "build", "--release"
|
|
bin.install "target/release/ecrou"
|
|
# Hypervisor.framework grants VM creation only to binaries signed
|
|
# with the hypervisor entitlement; on current macOS the signature
|
|
# is a hard requirement, the same one krunkit's formula carries.
|
|
system "codesign", "--force", "--sign", "-",
|
|
"--entitlements", "packaging/macos/ecrou.entitlements", bin/"ecrou"
|
|
end
|
|
|
|
def caveats
|
|
<<~EOS
|
|
The binary is ad-hoc signed with the com.apple.security.hypervisor
|
|
entitlement. Rebuilding from source (cargo) requires re-signing:
|
|
codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou
|
|
`ecrou probe` reports this when the entitlement is missing.
|
|
EOS
|
|
end
|
|
|
|
test do
|
|
system bin/"ecrou", "probe"
|
|
output = shell_output("#{bin}/ecrou run --quiet alpine -- uname -r").strip
|
|
assert_match(/\d+\.\d+/, output)
|
|
end
|
|
end
|