feat(minvmd): build minvmd for release, tweak libkrun search paths - #614
Conversation
📝 WalkthroughWalkthroughUpdates the CI workflow to build native minvmd artifacts for Linux amd64 and a new self-hosted macOS arm64 job with codesigning, increasing the release job timeout and expanding release dependencies. Reworks build.rs rpath emission into a multi-entry helper backed by a shared Linux library directory constant. ChangesCI Release Workflow Changes
build.rs Rpath Emission Rework
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant CI as CI Workflow
participant Linux as build-release-linux-amd64
participant MacOS as build-release-macos-arm64
participant Release as release job
CI->>Linux: run fetch-libkrun.sh, build minvmd
Linux->>Linux: rename binary, upload minvmd-linux-amd64
CI->>MacOS: provision libkrun via Homebrew, build minvmd
MacOS->>MacOS: codesign binary with entitlements
MacOS->>MacOS: rename binary, upload minvmd-macos-arm64
Linux-->>Release: artifact ready
MacOS-->>Release: artifact ready
Release->>Release: proceed once both artifacts are ready
Possibly related issues
Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
277-280: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win
persist-credentials: falseapplied only to this new job.This checkout step sets
persist-credentials: false, but no otheractions/checkoutstep in this file (including the other release jobs) sets it. Based on learnings, this repo's convention is to apply that hardening consistently repo-wide rather than piecemeal per step/job.📝 Learning reference
Learnt from: norrietaylor, Repo: gominimal/minimal PR: 274 — "don't harden individual
actions/checkoutsteps by addingpersist-credentials: falseonly in one workflow/step ... apply it consistently as a repo-wide change".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 277 - 280, The checkout hardening is applied only in one new job, but the repo convention is to make this consistent across all `actions/checkout` uses in this workflow. Update every `actions/checkout` step in `.github/workflows/ci.yml`—including the other release jobs—to use the same `persist-credentials: false` setting, keeping the change uniform rather than scoped to just one job.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 295-300: The current minvmd codesigning step in the CI workflow
uses ad-hoc signing, which will still trigger Gatekeeper for downloaded macOS
releases. Update the release workflow around the codesign step to either use
Developer ID signing and notarization for the published binary, or explicitly
document the manual Gatekeeper override for users if ad-hoc signing is intended.
Reference the existing “Codesign minvmd” job so the release packaging and upload
flow stay consistent.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 277-280: The checkout hardening is applied only in one new job,
but the repo convention is to make this consistent across all `actions/checkout`
uses in this workflow. Update every `actions/checkout` step in
`.github/workflows/ci.yml`—including the other release jobs—to use the same
`persist-credentials: false` setting, keeping the change uniform rather than
scoped to just one job.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 65abd26c-4d41-4525-8454-6df5b31d4d82
📒 Files selected for processing (2)
.github/workflows/ci.ymlcrates/minvmd/build.rs
| - name: Codesign minvmd (hypervisor entitlement, R1.4) | ||
| # Codesigning must be the LAST thing to touch the binary: any later relink | ||
| # (a stray cargo build/test) drops the ad-hoc signature and | ||
| # krun_start_enter then fails with EINVAL. Renaming + uploading below | ||
| # preserve the embedded signature (they don't rewrite the Mach-O). | ||
| run: codesign --entitlements crates/minvmd/minvmd.entitlements --force -s - target/release/minvmd |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Does an ad-hoc codesigned macOS binary trigger Gatekeeper "unidentified developer" warning when downloaded from the internet?
💡 Result:
Yes, an ad-hoc codesigned macOS binary will trigger a Gatekeeper warning if it is downloaded from the internet and carries a quarantine attribute [1][2][3]. When a binary is downloaded via a browser or similar application, macOS attaches a com.apple.quarantine extended attribute to the file [1][4]. Upon the first execution, Gatekeeper checks the binary's code signature and notarization status [1]. Because ad-hoc signing does not involve a trusted developer identity (i.e., a certificate issued by Apple to an identified developer), the binary fails the requirement for being from an "identified developer" [1][5][6]. Consequently, Gatekeeper will prevent the application from running and typically display a security dialog indicating that the developer cannot be verified or that the app is from an unidentified developer [1][3]. To bypass this, a user must manually override the restriction (e.g., via the Privacy & Security settings in System Settings or by right-clicking the app and selecting "Open") [7][1][8]. Note that on modern versions of macOS, simply ad-hoc signing a binary is insufficient to satisfy Gatekeeper's trust requirements for downloaded software; only software signed with a valid Developer ID and notarized by Apple can pass these checks without manual user intervention [1][4].
Citations:
- 1: https://www.macinternals.app/en/blog/gatekeeper
- 2: https://developer.apple.com/forums/thread/740680
- 3: https://docs.godotengine.org/en/stable/tutorials/export/running_on_macos.html
- 4: https://hacktricks.wiki/en/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html
- 5: macOS Applications Signed with Ad-Hoc Certificate qupath/qupath#1672
- 6: https://apple.stackexchange.com/questions/288291/what-are-the-restrictions-of-ad-hoc-code-signing
- 7: https://support.apple.com/en-us/102445
- 8: https://support.apple.com/guide/mac-help/open-a-mac-app-from-an-unknown-developer-mh40616/mac
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the workflow around the cited lines
sed -n '260,330p' .github/workflows/ci.yml
# Find where this binary is uploaded/published
rg -n "minvmd|codesign --entitlements|upload|release|artifact|notar|gatekeeper" .github/workflows . -g '!**/node_modules/**'Repository: gominimal/minimal
Length of output: 50374
Ad-hoc signing will still trip Gatekeeper on the published macOS release
Browser downloads of this binary will hit the unidentified-developer prompt unless the release is Developer ID–signed and notarized. If that’s intentional, document the manual override for macOS users.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 295 - 300, The current minvmd
codesigning step in the CI workflow uses ad-hoc signing, which will still
trigger Gatekeeper for downloaded macOS releases. Update the release workflow
around the codesign step to either use Developer ID signing and notarization for
the published binary, or explicitly document the manual Gatekeeper override for
users if ad-hoc signing is intended. Reference the existing “Codesign minvmd”
job so the release packaging and upload flow stay consistent.
An attempt to build
minvmdfor distribution. We cannot build static as libkrun needs libc unfortunately.Summary by CodeRabbit
New Features
minvmd.Bug Fixes
Chores