Skip to content

feat(release): attempt to properly sign MacOS release binaries - #677

Merged
twitchyliquid64 merged 1 commit into
mainfrom
tom/release2
Jul 8, 2026
Merged

feat(release): attempt to properly sign MacOS release binaries#677
twitchyliquid64 merged 1 commit into
mainfrom
tom/release2

Conversation

@twitchyliquid64

@twitchyliquid64 twitchyliquid64 commented Jul 8, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Member

Summary by CodeRabbit

  • Bug Fixes
    • Improved macOS release signing for binaries and libraries.
    • Release artifacts are now verified more strictly before publishing.
    • Temporary unsigned macOS library files are no longer included in final release packages.

@coderabbitai

coderabbitai Bot commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 939df617-0ee8-4f96-b237-d72722398447

📥 Commits

Reviewing files that changed from the base of the PR and between 1c35174 and b7d5c88.

📒 Files selected for processing (1)
  • .github/workflows/release.yml
📝 Walkthrough

Walkthrough

Updates the macOS ARM64 release workflow: replaces early adhoc signing with a Developer ID signing step for minvmd/minimal binaries, and restructures libkrun dylib signing into a two-stage unsigned-upload then signed-re-upload pipeline via a new dedicated job, with updated job dependencies and temp-artifact cleanup.

Changes

Release workflow codesigning

Layer / File(s) Summary
Developer ID signing for minvmd/minimal binaries
.github/workflows/release.yml		 Removes early adhoc signing before verification; adds a step that unlocks the keychain with KC_PW and codesigns minvmd-macos-arm64 (with entitlements) and minimal-macos-arm64 using Hardened Runtime, timestamps, and strict verification.
Two-stage libkrun dylib signing pipeline
.github/workflows/release.yml		 Splits libkrun signing into unsigned temp-artifact upload followed by a new sign-libkrun-macos-arm64 job that downloads, signs, verifies, and re-uploads the signed dylib; updates release job dependency and adds cleanup of temp-* artifacts before packaging.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

  • gominimal/minimal#615: Both update the macOS ARM64 release workflow's signing and artifact flow for minvmd/minimal binaries.
  • gominimal/minimal#659: Both modify the build-libkrun-macos-arm64 pipeline's codesigning approach.

Suggested reviewers: norrietaylor, msample

Poem

Hop, hop, through keychains I creep,
Signing binaries while others sleep,
Temp dylibs vanish, signed ones stay,
Codesign verified, come what may,
A rabbit's release, clean and neat—
Thump thump goes my little feet! 🐰✨

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately reflects the main change: updating the macOS release workflow to sign release binaries.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

Comment @coderabbitai help to get the list of available commands.

@twitchyliquid64
twitchyliquid64 enabled auto-merge (squash) July 8, 2026 21:51
@twitchyliquid64
twitchyliquid64 merged commit 83c15aa into main Jul 8, 2026
9 checks passed
@twitchyliquid64
twitchyliquid64 deleted the tom/release2 branch July 8, 2026 22:17
@coderabbitai coderabbitai Bot mentioned this pull request Jul 9, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jtnkminimal jtnkminimal jtnkminimal approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@twitchyliquid64 @jtnkminimal