P0-4: Mac and Windows CI runners #19

New issue

Open

opened 2026-09-10 17:40:12 +00:00 by Cordy · 0 comments

Cordy commented

2026-09-10 17:40:12 +00:00

Owner

Manual task. Needed before Phase 3 packaging (issues P3-*). Not needed for Phase 1 or 2.

The constraint

The existing Forgejo runner is Alpine on arm64 Raspberry Pis. It can build and test the Go core and the Linux binary. It cannot build, sign or notarise macOS, iOS or Windows artifacts.

Mac runner

A Mac is non-negotiable. Apple's licence terms permit macOS only on Apple hardware, so this cannot be virtualised on pve1/pve2. Two options:

Buy a Mac mini (Apple silicon). ~CHF 700+. One-off, sits in the rack, becomes a self-hosted Forgejo runner. Preferred: you own the signing environment and the Developer ID key never leaves your premises.
Rent a hosted Mac (MacStadium, Scaleway, etc.). No capital outlay, but your Developer ID private key lives on someone else's hardware. For a sovereignty-positioned product, that is an awkward look.
Decide and acquire.
Install Xcode command line tools (xcode-select --install) — needed for codesign, notarytool, stapler.
Register it as a self-hosted Forgejo runner with a label such as macos.
Install the Developer ID Application certificate into its keychain.
Store notary credentials once: xcrun notarytool store-credentials "cairn-notary" --apple-id … --team-id … --password …

Windows runner

This one can be a VM on pve1/pve2.

Create a Windows VM.
Install Go, the WiX Toolset, and the Windows SDK (for signtool).
Register as a self-hosted Forgejo runner with a label such as windows.
Attach the code-signing token from P0-3, or configure cloud HSM signing. Verify unattended signing works — some tokens demand an interactive PIN on every operation, which is fatal for CI. If yours does, you need either a PIN-caching middleware or a cloud HSM.

Target CI topology

Pi runner (Alpine/arm64) — Go core tests, fuzz, integration vs cairnd, Linux build
Mac runner               — macOS build, sign, notarise, staple; later iOS
Windows runner           — Windows build, MSI via WiX, signtool

Acceptance criteria

Both runners visible and idle in Forgejo.
A hello-world job succeeds on each.
The Windows runner can sign without human interaction.
The Mac runner can codesign and notarytool submit without human interaction.

**Manual task.** Needed before Phase 3 packaging (issues P3-*). Not needed for Phase 1 or 2. ## The constraint The existing Forgejo runner is **Alpine on arm64 Raspberry Pis**. It can build and test the Go core and the Linux binary. It **cannot** build, sign or notarise macOS, iOS or Windows artifacts. ## Mac runner **A Mac is non-negotiable.** Apple's licence terms permit macOS only on Apple hardware, so this cannot be virtualised on pve1/pve2. Two options: - **Buy a Mac mini (Apple silicon).** ~CHF 700+. One-off, sits in the rack, becomes a self-hosted Forgejo runner. Preferred: you own the signing environment and the Developer ID key never leaves your premises. - **Rent a hosted Mac** (MacStadium, Scaleway, etc.). No capital outlay, but your Developer ID private key lives on someone else's hardware. For a sovereignty-positioned product, that is an awkward look. - [ ] Decide and acquire. - [ ] Install Xcode command line tools (`xcode-select --install`) — needed for `codesign`, `notarytool`, `stapler`. - [ ] Register it as a self-hosted Forgejo runner with a label such as `macos`. - [ ] Install the Developer ID Application certificate into its keychain. - [ ] Store notary credentials once: `xcrun notarytool store-credentials "cairn-notary" --apple-id … --team-id … --password …` ## Windows runner This one **can** be a VM on pve1/pve2. - [ ] Create a Windows VM. - [ ] Install Go, the WiX Toolset, and the Windows SDK (for `signtool`). - [ ] Register as a self-hosted Forgejo runner with a label such as `windows`. - [ ] Attach the code-signing token from P0-3, or configure cloud HSM signing. **Verify unattended signing works** — some tokens demand an interactive PIN on every operation, which is fatal for CI. If yours does, you need either a PIN-caching middleware or a cloud HSM. ## Target CI topology ``` Pi runner (Alpine/arm64) — Go core tests, fuzz, integration vs cairnd, Linux build Mac runner — macOS build, sign, notarise, staple; later iOS Windows runner — Windows build, MSI via WiX, signtool ``` ## Acceptance criteria - Both runners visible and idle in Forgejo. - A hello-world job succeeds on each. - The Windows runner can sign **without human interaction**. - The Mac runner can `codesign` and `notarytool submit` without human interaction.