Skip to content

ci(vm): codesign macOS driver-vm with hypervisor entitlement in CI - #3507

Open
benoitf wants to merge 1 commit into
NVIDIA:mainfrom
benoitf:fix/vm-driver-macos-hypervisor-entitlement
Open

ci(vm): codesign macOS driver-vm with hypervisor entitlement in CI#3507
benoitf wants to merge 1 commit into
NVIDIA:mainfrom
benoitf:fix/vm-driver-macos-hypervisor-entitlement

Conversation

@benoitf

@benoitf benoitf commented Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

The macOS openshell-driver-vm release tarball ships an unsigned binary missing the com.apple.security.hypervisor entitlement. This PR ad-hoc signs the binary during the CI build so the release artifact works out of the box.

Related Issue

related to #3506
(then can cleanup install/brew scripts)

Changes

  • Add optional entitlements-file input to the build-rust-binary composite action
  • Add a codesign step between "Verify" and "Upload" that runs when entitlements-file is provided and runner.os == 'macOS'
  • Pass entitlements-file from the macOS matrix entry in build-vm-driver.yml, using the existing crates/openshell-driver-vm/entitlements.plist

Testing

  • mise run pre-commit passes
  • Trigger a dev release build, download openshell-driver-vm-aarch64-apple-darwin.tar.gz, extract, and verify via codesign -d --entitlements - openshell-driver-vm
  • Homebrew install path still works (formula post_install harmlessly re-signs the pre-signed binary)

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)
  • Architecture docs updated (if applicable)

@benoitf
fix(vm): codesign macOS driver-vm with hypervisor entitlement in CI
1a11685 
The release tarball ships an unsigned binary that fails at runtime
when Hypervisor.framework rejects the caller. Sign with the existing
entitlements plist during the build, before artifact upload.

Closes NVIDIA#3506

Signed-off-by: Florent Benoit <fbenoit@redhat.com>
@copy-pr-bot

copy-pr-bot Bot commented Sep 21, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@benoitf benoitf changed the title fix(vm): codesign macOS driver-vm with hypervisor entitlement in CI ci(vm): codesign macOS driver-vm with hypervisor entitlement in CI Sep 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner
@sjenning sjenning Awaiting requested review from sjenning sjenning is a code owner
@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr derekwaynecarr is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@benoitf