feat: publish macOS and Linux arm64 rolling-release binaries - #28
Merged
Merged
Conversation
|
planger
force-pushed
the
feat/rolling-release-macos-arm64
branch
from
August 7, 2026 07:12
f7f4aaa to
71b25e0
Compare
planger
marked this pull request as ready for review
August 7, 2026 07:18
The rolling release now ships enclave-darwin-arm64, enclave-darwin-amd64, and enclave-linux-arm64 alongside the existing linux-amd64 binary and the amd64 deb and rpm. darwin/amd64 is cross-compiled on the arm64 macOS runner and therefore not smoke-tested; the other three run the smoke test natively. No native Windows binary is published: native Windows is unsupported at runtime, so Windows users are documented onto WSL2 with the Linux artifact. The smoke test gained macOS support, since bash 3.2 has no mapfile and the Apple cache layout ignores the XDG_* overrides the script relied on. CI runs it on macOS so that path is covered before merge. Also documents that the experimental qemu backend is x86-64 only: it hardcodes qemu-system-x86_64, its bundle builder pins --platform linux/amd64 with apk --arch x86_64, and it launches with -machine microvm,accel=kvm:tcg, so only x86-64 Linux hosts get KVM. This was already true but unstated, and becomes misleading once arm64 and macOS binaries exist.
planger
force-pushed
the
feat/rolling-release-macos-arm64
branch
from
August 13, 2026 11:38
71b25e0 to
204c01c
Compare
xai
approved these changes
Aug 13, 2026
xai
left a comment
xai
left a comment
Collaborator
There was a problem hiding this comment.
Looks good and all cross-compiled binaries I tested work fine!
I tested Windows (amd64) via WSL2 and Linux (arm64).
@kalyi tested macOS (arm64).
Currently, the make cross-build target does not produce actual binaries, it rather serves only as a portability check. To get actual cross-compiled binaries, users still have to run something like CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -o enclave-darwin-arm64 ./cmd/enclave. Fine by me, especially with rolling releases that include all binaries.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What it does
Extends the rolling release from one Linux x86-64 binary to all four platforms Enclave supports natively, and documents the platform story: Windows through WSL2, and the x86-64-only QEMU backend.
The build matrix in
.github/workflows/rolling.ymlnow produces:enclave-linux-amd64ubuntu-24.04enclave-linux-arm64ubuntu-24.04-armenclave-darwin-arm64macos-15enclave-darwin-amd64macos-15(cross-compiled)::notice::Everything builds with
CGO_ENABLED=0and explicitGOOS/GOARCH, replacing the per-matrix-entrycgotoggle. The runner labels are pinned instead of-latest, so the host architecture an artifact is built and tested on cannot change under a moving alias.Supporting changes:
scripts/smoke-standalone-binary.shruns on macOS. The asset cache path is derived per platform (the Apple layout under~/Library/Caches/org.eclipse.enclaveinstead ofXDG_CACHE_HOME), andmapfileis gone, since Bash 3.2 on the macOS runners lacks it. The legacy-root decoy stays at the former XDG data root on both platforms, because that is the lookup it guards..github/workflows/ci.ymlgains asmoke-macosjob, so the Darwin path in that script is covered on every pull request rather than first running after merge.make cross-buildcovers every published non-native target (darwin/arm64,darwin/amd64,linux/arm64) instead of onlydarwin/arm64.windows/amd64stays in as an unpublished portability guard.README.md, andwebsite/docs/docs/getting-started.mdlist the per-platform artifacts with install commands that are runnable as written on each platform. The macOS binaries are unsigned and not notarized, so the quarantine attribute is cleared beforeinstallcan propagate it, and the command tolerates its absence after acurlorgh release download. Both also get a WSL2 section for Windows, including keeping the project inside the WSL filesystem rather than under/mnt/c..rpmthatmainalready publishes.qemubackend is x86-64 only: it requiresqemu-system-x86_64, always builds an x86-64 Alpine guest, and gets KVM acceleration only on x86-64 Linux hosts. On arm64 hosts and on macOS it falls back to TCG emulation. TouchesREADME.md,docs/ARCHITECTURE.md,docs/cli-reference.md, and the website page. No behavior change; this was already true but unstated.No Go source changes.
How to test
CI covers most of it: the four
rollingbuild jobs, plus the newsmoke-macosjob on pull requests.Locally:
Verifying the published artifacts needs a merge to
main, since the rolling release only builds from there. Download each binary, check it againstchecksums.txt, and runenclavein a git repository on the matching platform.Follow-ups
darwin/amd64is cross-compiled on the arm64 runner and never executed. GitHub's Intel macOS labels are billed large runners, so this is accepted risk; the job logs a notice so the gap stays visible.xattrstep..debor.rpm. The release table marks both packages x86-64.Breaking changes
Review checklist