Skip to content

fix(installer): selfsign with hypervisor entitlement for minvmd - #669

Merged
twitchyliquid64 merged 1 commit into
mainfrom
tom/release
Jul 8, 2026
Merged

fix(installer): selfsign with hypervisor entitlement for minvmd#669
twitchyliquid64 merged 1 commit into
mainfrom
tom/release

Conversation

@twitchyliquid64

@twitchyliquid64 twitchyliquid64 commented Jul 8, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Member

Fixes a strange bug where minvmd would give an obscure krun error.

Summary by CodeRabbit

  • Bug Fixes
    • Improved macOS installation for bin components by handling one component with a more specific signing setup.
    • Other bin components continue to use the same signing behavior as before.

@coderabbitai

coderabbitai Bot commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6d563c2f-107c-4534-824b-8f90d74d50db

📥 Commits

Reviewing files that changed from the base of the PR and between c6c63e4 and ce7dd3c.

📒 Files selected for processing (1)
  • scripts/install.sh
📝 Walkthrough

Walkthrough

The macOS installer's ad-hoc codesigning step for bin components now special-cases the minvmd component: it generates a hypervisor entitlements plist and signs with codesign --entitlements, while other bin components continue using the generic unconditional codesign call.

Changes

Installer Codesigning Update

Layer / File(s) Summary
Conditional entitlements codesign for minvmd
scripts/install.sh		 Adds a branch detecting comp == minvmd to write an entitlements plist and codesign with --entitlements, falling back to the prior generic codesign --sign - --force for other bin components.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

  • gominimal/minimal#645: Both PRs modify scripts/install.sh's macOS codesign/bin-signing logic, directly connected at the installer's signing code level.

Suggested reviewers: msample, norrietaylor

Poem

A hop, a plist, an entitlement scroll,
minvmd signs with a hypervisor role. 🐇
Other bins still sign the same old way,
One rabbit's tweak, one script's new day.
Thump thump — approved, hooray!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the installer change to self-sign minvmd with the required hypervisor entitlement.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@twitchyliquid64
twitchyliquid64 enabled auto-merge (squash) July 8, 2026 01:38
@twitchyliquid64
twitchyliquid64 merged commit 0ca62d1 into main Jul 8, 2026
58 of 61 checks passed
@twitchyliquid64
twitchyliquid64 deleted the tom/release branch July 8, 2026 01:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@msample msample msample approved these changes
@norrietaylor norrietaylor norrietaylor approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@twitchyliquid64 @msample @norrietaylor