Repository navigation
ci(macos): consolidate libkrun on our own pinned source build #694
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,32 +1,73 @@ | ||
| name: Setup libkrun (macOS) | ||
| description: > | ||
| Provision the libkrun.dylib we SHIP — built from source at the commit | ||
| pinned in vendor/libkrun/libkrun.lock via scripts/build-libkrun-macos.sh — | ||
| into a commit-keyed prefix, and publish LIBKRUN_PREFIX to GITHUB_ENV. | ||
| minvmd's build.rs prefers LIBKRUN_PREFIX over its /opt/homebrew fallback | ||
| and bakes the prefix as an rpath, so every later cargo build links, and | ||
| every test boots, the exact dylib users receive — a leftover brew libkrun | ||
| on a runner is ignored, and the old slp/krun tap is no longer a CI | ||
| dependency. Build-on-miss: on GitHub-hosted runners the prefix rides | ||
| actions/cache; on the persistent self-hosted mini the directory itself | ||
| survives between runs, so the source build happens once per pin bump. | ||
| Requires a Rust toolchain (run this after dtolnay/rust-toolchain) and the | ||
| repository checked out. | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Resolve libkrun pin | ||
| id: pin | ||
| shell: bash | ||
| run: | | ||
| commit="$(sed -n 's/^commit=//p' vendor/libkrun/libkrun.lock)" | ||
| if [ -z "$commit" ]; then | ||
| echo "::error::no commit= line in vendor/libkrun/libkrun.lock" >&2 | ||
| exit 1 | ||
| fi | ||
| script_hash="$(shasum -a 256 scripts/build-libkrun-macos.sh | cut -d' ' -f1)" | ||
| { | ||
| echo "commit=$commit" | ||
| # The prefix embeds BOTH build inputs (pinned commit + build-script | ||
| # hash) so the persistent mini rebuilds when either changes — the | ||
| # same invalidation the actions/cache key gives GitHub-hosted | ||
| # runners. Stale sibling prefixes on the mini are inert (nothing | ||
| # references them) and may be deleted by hand. | ||
| echo "prefix=$HOME/.cache/minimal-ci/libkrun/$commit-${script_hash:0:12}" | ||
| echo "script_hash=$script_hash" | ||
| } >> "$GITHUB_OUTPUT" | ||
| - name: Cache built libkrun (GitHub-hosted) | ||
| # The mini needs no cache action: the input-keyed prefix under $HOME | ||
| # persists across runs on its own. | ||
| if: runner.environment == 'github-hosted' | ||
| uses: actions/cache@v6 | ||
| with: | ||
| path: ~/.cache/minimal-ci/libkrun | ||
| key: libkrun-macos-${{ runner.arch }}-${{ steps.pin.outputs.commit }}-${{ steps.pin.outputs.script_hash }} | 10BC8||
| - name: Build libkrun from source (on miss) | ||
| shell: bash | ||
| env: | ||
| PREFIX: ${{ steps.pin.outputs.prefix }} | ||
| run: | | ||
| if [ ! -f "$PREFIX/libkrun.1.dylib" ]; then | ||
| ./scripts/build-libkrun-macos.sh "$PREFIX" | ||
| else | ||
| echo "libkrun already staged at $PREFIX (cache hit)" | ||
| fi | ||
| - name: Verify staged libkrun + export LIBKRUN_PREFIX | ||
| # Re-assert the API floor on the staged (possibly cache-restored) dylib | ||
| # so a corrupt or hand-tampered prefix fails here with an actionable | ||
| # message instead of a cryptic dyld error at VM boot. | ||
| shell: bash | ||
| env: | ||
| PREFIX: ${{ steps.pin.outputs.prefix }} | ||
| run: | | ||
| if [ ! -f "$PREFIX/libkrun.1.dylib" ]; then | ||
| echo "::error::libkrun.1.dylib missing from $PREFIX after build/restore" >&2 | ||
| exit 1 | ||
| fi | ||
| if ! nm -gU "$PREFIX/libkrun.1.dylib" 2>/dev/null | grep -q '_krun_add_disk3'; then | ||
| echo "::error::staged libkrun lacks krun_add_disk3 (need >= 1.19.0); delete $PREFIX and re-run to rebuild" >&2 | ||
| exit 1 | ||
| fi | ||
| echo "LIBKRUN_PREFIX=$PREFIX" >> "$GITHUB_ENV" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| #!/usr/bin/env bash | ||
| # Build the trimmed libkrun.dylib for macOS from source, at the commit pinned | ||
| # in vendor/libkrun/libkrun.lock, and stage it into PREFIX. This is the ONE | ||
| # libkrun macOS CI links/boots against and the release ships — CI exercises | ||
| # the exact dylib users receive, and no third-party bottle (the old slp/krun | ||
| # Homebrew tap) is in the supply chain. | ||
| # | ||
| # Trimmed build (this is exactly the Makefile's INIT_BLOB=0 config): | ||
| # -p libkrun scope to the libkrun crate, so the src/input & | ||
| # src/display workspace members (whose bindgen build | ||
| # scripts need libclang) are never built. | ||
| # --no-default-features drop `init-blob`, whose build script cross-compiles | ||
| # a Linux init — the ONLY reason the Makefile needs | ||
| # lld + a Debian sysroot. minvmd supplies its own | ||
| # initramfs, so libkrun's bundled init is unused. | ||
| # --features blk,net blk = rootfs disk (krun_add_disk2/3), net = | ||
| # virtio-net. No gpu => no libepoxy/virglrenderer. | ||
| # Hypervisor.framework is linked by src/vmm/build.rs. | ||
| # | ||
| # The staged dylib's install name is set to @rpath/libkrun.1.dylib so anything | ||
| # linking it (minvmd) records a relocatable load command from the start — the | ||
| # shipped bin/../lib layout then needs only an rpath, not a load-command | ||
| # rewrite. Ad-hoc signed (arm64 macOS refuses to load an invalid signature); | ||
| # the release pipeline re-signs with Developer ID before shipping. | ||
| # | ||
| # Stages: | ||
| # PREFIX/libkrun.1.dylib the dylib (dyld resolves @rpath/libkrun.1.dylib) | ||
| # PREFIX/libkrun.dylib symlink for the build-time linker (-l krun) | ||
| # | ||
| # Requires: git, a Rust toolchain, Xcode CLT (codesign/otool/install_name_tool). | ||
| # | ||
| # Usage: scripts/build-libkrun-macos.sh <prefix-dir> | ||
| set -euo pipefail | ||
|
|
||
| PREFIX="${1:?usage: build-libkrun-macos.sh <prefix-dir>}" | ||
|
|
||
| case "$(uname -s)" in | ||
| Darwin) ;; | ||
| *) echo "build-libkrun-macos.sh is macOS-only (got $(uname -s))" >&2; exit 1 ;; | ||
| esac | ||
|
|
||
| ROOT="$(cd "$(dirname "$0")/.." && pwd)" | ||
| LOCK="$ROOT/vendor/libkrun/libkrun.lock" | ||
| VERSION="$(sed -n 's/^version=//p' "$LOCK")" | ||
| COMMIT="$(sed -n 's/^commit=//p' "$LOCK")" | ||
| if [ -z "$VERSION" ] || [ -z "$COMMIT" ]; then | ||
| echo "::error::malformed $LOCK: need version= and commit= lines" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| WORK="$(mktemp -d)" | ||
| trap 'rm -rf "$WORK"' EXIT | ||
|
|
||
| # Fetch the pinned commit directly (not the tag): a moved or deleted tag can | ||
| # never change what we build, and GitHub serves arbitrary-sha fetches. | ||
| echo "fetching containers/libkrun @ $COMMIT ($VERSION)" | ||
| git -C "$WORK" init -q | ||
| git -C "$WORK" remote add origin https://github.com/containers/libkrun | ||
| git -C "$WORK" fetch -q --depth 1 origin "$COMMIT" | ||
| git -C "$WORK" checkout -q FETCH_HEAD | ||
| actual="$(git -C "$WORK" rev-parse HEAD)" | ||
| if [ "$actual" != "$COMMIT" ]; then | ||
| echo "::error::fetched libkrun HEAD $actual != pinned commit $COMMIT" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "building trimmed libkrun (blk,net; no gpu, no init-blob)" | ||
| # --locked: build exactly upstream's committed Cargo.lock — a silent | ||
| # re-resolve would undermine the pinned, reproducible-build guarantee. | ||
| cargo build --release --locked -p libkrun --no-default-features --features blk,net \ | ||
| --manifest-path "$WORK/Cargo.toml" | ||
| DYLIB="$WORK/target/release/libkrun.dylib" | ||
| test -f "$DYLIB" || { echo "::error::build produced no $DYLIB" >&2; exit 1; } | ||
|
|
||
| # A trimmed build must link only system libraries. Any /opt/homebrew or | ||
| # /usr/local reference means a dependency leaked (e.g. a stray GPU lib) and | ||
| # the dylib would fail to load on a machine without Homebrew. | ||
| otool -L "$DYLIB" | ||
| if otool -L "$DYLIB" | grep -E '/opt/homebrew|/usr/local'; then | ||
| echo "::error::trimmed libkrun links a non-system dylib; see otool -L above" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| # krun_add_disk3 (the /dev/vdb attach) needs libkrun >= 1.19.0 — assert the | ||
| # pin never silently regresses below the API surface minvmd uses. | ||
| if ! nm -gU "$DYLIB" | grep -q '_krun_add_disk3'; then | ||
| echo "::error::built libkrun lacks krun_add_disk3 (need >= 1.19.0); check the pin in $LOCK" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Relocatable install name + a valid (ad-hoc) signature, then stage. | ||
| install_name_tool -id @rpath/libkrun.1.dylib "$DYLIB" | ||
| codesign --sign - --force "$DYLIB" | ||
|
|
||
| mkdir -p "$PREFIX" | ||
| cp "$DYLIB" "$PREFIX/libkrun.1.dylib" | ||
| ln -sfn libkrun.1.dylib "$PREFIX/libkrun.dylib" | ||
| echo "staged libkrun $VERSION ($COMMIT) -> $PREFIX" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| # libkrun (containers/libkrun) pinned source build for macOS. | ||
| # Single source of truth for the libkrun that macOS CI links/boots against | ||
| # AND that the release ships — built by scripts/build-libkrun-macos.sh | ||
| # (trimmed: --no-default-features --features blk,net). | ||
| # `commit` is the resolved commit of `version` at pin time; the build fetches | ||
| # the commit, so a moved/deleted tag cannot change what we build. | ||
| version=v1.19.4 | ||
| commit=728df8125077d0db44265f6e997c72b81b65c015 |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.