8000 fix(installer): build + ship libkrun on MacOS by twitchyliquid64 · Pull Request #655 · gominimal/minimal · GitHub
[go: up one dir, main page]
Skip to content

fix(installer): build + ship libkrun on MacOS #655

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
twitchyliquid64 merged 1 commit into from
Jul 7, 2026
Merged

fix(installer): build + ship libkrun on MacOS #655

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 69 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,6 +228,12 @@ jobs:
fi
- name: Build release minvmd binary
run: cargo build --release -p minvmd --bin minvmd
- name: Print libkrun load command (informational)
# Show the name+path minvmd records for libkrun. For the shipped
# bin/libkrun.dylib (next to minvmd) to resolve via @loader_path, this
# must be an @rpath entry whose basename matches the staged dylib's
# install name (see build-release-libkrun-macos-arm64). Non-gating.
run: otool -L target/release/minvmd | grep -i krun || true
- name: Build release minimal binary
run: cargo build --release -p minimal --bin minimal
- name: Rename binaries with platform suffix
Expand All @@ -249,6 +255,68 @@ jobs:
path: target/release/minimal-macos-arm64
retention-days: 7

build-libkrun-macos-arm64:
# Build a TRIMMED libkrun.dylib from source to SHIP in the release, so
# macOS users don't have to `brew install` it themselves. GitHub-hosted
# macos-latest is Apple Silicon (arm64).
runs-on: macos-latest
timeout-minutes: 45
env:
# Pin to the libkrun the slp/krun tap currently ships, so the dylib we
# ship matches the ABI the macOS CI lanes build and test against.
LIBKRUN_REF: v1.19.4
steps:
- name: Checkout libkrun (${{ env.LIBKRUN_REF }})
uses: actions/checkout@v7
with:
repository: containers/libkrun
ref: ${{ env.LIBKRUN_REF }}
persist-credentials: false
- name: Toolchain
uses: dtolnay/rust-toolchain@stable
- name: Install build dependencies
# Mirrors upstream's cross-compile-macos job: the default init-blob
# feature cross-compiles a small Linux init, which needs the LLVM
# linker (lld) and xz (to unpack the auto-generated Debian sysroot).
run: brew install lld xz
- name: Build trimmed libkrun (BLK + NET, no GPU)
run: make BLK=1 NET=1
- name: Install into a staging prefix
run: make PREFIX="$RUNNER_TEMP/krun" install
- name: Assert the dylib is self-contained, then stage it
# A trimmed build must link only system libraries. Any /opt/homebrew or
# /usr/local reference means a dependency leaked (e.g. a stray GPU lib)
# and the dylib would fail to load on a machine without Homebrew — fail
# loudly so we revisit the make flags rather than ship an unloadable
# artifact. `libkrun.dylib` is the install symlink to the versioned
# real file; cp/otool deref it.
run: |
dylib="$RUNNER_TEMP/krun/lib/libkrun.dylib"
echo "otool -L $dylib"; otool -L "$dylib"
if otool -L "$dylib" | grep -E '/opt/homebrew|/usr/local'; then
echo "::error::trimmed libkrun links a non-system (Homebrew) dylib; see otool -L above" >&2
exit 1
fi
cp -L "$dylib" "$RUNNER_TEMP/libkrun-macos-arm64.dylib"
- name: Ad-hoc codesign
# `make install` leaves the dylib's signature stale after any tooling;
# arm64 macOS refuses to load a dylib with an invalid signature. Match
# the installer's self-sign of shipped bin/ files.
run: codesign --sign - --force "$RUNNER_TEMP/libkrun-macos-arm64.dylib"
- name: Print install name (informational)
# For @loader_path resolution to work, minvmd's recorded load command
# basename must match this dylib's install-name basename (and be
# @rpath-based). Print it so a name mismatch is visible in the logs;
# non-gating — never fail the release over a diagnostic.
run: otool -D "$RUNNER_TEMP/libkrun-macos-arm64.dylib" || true
- name: Upload libkrun dylib
uses: actions/upload-artifact@v7
with:
name: libkrun-macos-arm64
path: ${{ runner.temp }}/libkrun-macos-arm64.dylib
if-no-files-found: error
retention-days: 7

fetch-release-guest-artifacts:
# Fetched guest microVM artifacts shipped in the release: the raw guest
# kernel Image, the ext4 rootfs image, and the pinned gvproxy switch
Expand Down Expand Up @@ -420,6 +488,7 @@ jobs:
build-release-linux-amd64,
build-release-linux-arm64,
build-release-macos-arm64,
build-libkrun-macos-arm64,
fetch-release-guest-artifacts,
build-release-initramfs,
]
Expand Down
5 changes: 5 additions & 0 deletions scripts/stage-release.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,11 @@ COMPONENTS=(
# macOS arm64 (darwin)
"minimal|darwin|arm64|file|bin/minimal|minimal-macos-arm64"
"minvmd|darwin|arm64|file|bin/minvmd|minvmd-macos-arm64"
# The trimmed libkrun.dylib minvmd links against (built from source by the
# release workflow's build-release-libkrun-macos-arm64 job). Stamped into
# bin/ next to minvmd for now — weird for a dylib, but it puts it on a known
# user-owned path the loader can be pointed at; the +x bit bin/ adds is inert.
"libkrun|darwin|arm64|file|bin/libkrun.dylib|libkrun-macos-arm64.dylib"
Comment on lines +116 to +120
@coderabbitai coderabbitai Bot Jul 7, 2026
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Stale job-name reference in comment.

The comment cites build-release-libkrun-macos-arm64, but the actual workflow job is build-libkrun-macos-arm64 (the same mismatch also appears in .github/workflows/release.yml around Line 235). Correct it so maintainers can grep for the real job.

Note: the bin/libkrun.dylib install-name/basename resolution concern is tracked in the release.yml review; this install path is the other half of that contract.

✏️ Proposed change 
-    # release workflow's build-release-libkrun-macos-arm64 job). Stamped into
+    # release workflow's build-libkrun-macos-arm64 job). Stamped into
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# The trimmed libkrun.dylib minvmd links against (built from source by the
# release workflow's build-release-libkrun-macos-arm64 job). Stamped into
# bin/ next to minvmd for now — weird for a dylib, but it puts it on a known
# user-owned path the loader can be pointed at; the +x bit bin/ adds is inert.
"libkrun|darwin|arm64|file|bin/libkrun.dylib|libkrun-macos-arm64.dylib"
# The trimmed libkrun.dylib minvmd links against (built from source by the
# release workflow's build-libkrun-macos-arm64 job). Stamped into
# bin/ next to minvmd for now — weird for a dylib, but it puts it on a known
# user-owned path the loader can be pointed at; the +x bit bin/ adds is inert.
"libkrun|darwin|arm64|file|bin/libkrun.dylib|libkrun-macos-arm64.dylib"
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/stage-release.sh` around lines 116 - 120, Update the stale workflow
job reference in the comment attached to the libkrun.dylib entry so it matches
the real job name used by the release workflow. In the script section around the
libkrun/macOS arm64 mapping, replace the incorrect
build-release-libkrun-macos-arm64 mention with build-libkrun-macos-arm64, and
make the same wording consistent with the corresponding comment in release.yml
so maintainers can grep the correct symbol.

"gvproxy|darwin|arm64|file|bin/gvproxy|gvproxy-darwin-arm64"
"initramfs|darwin|arm64|file|data/initramfs.cpio|initramfs-arm64.cpio"
"rootfs|darwin|arm64|file|data/rootfs.img|rootfs-arm64.img"
Expand Down
Loading
0