{{ message }}
Repository navigation
Tags: unstablebuild/rune-language-python
Tags
Update make ro sign macOS packages with Rune's Developer ID v0.3.0 shipped macOS packages whose tree-sitter.so carried only the linker's ad-hoc signature. Rune.app runs with the hardened runtime, whose library validation refuses any library not signed by its own team, so Rune reported the Python syntax tree parser as unavailable. The check runs on every load, so installing packages without the quarantine attribute does not avoid it. Every Mach-O file in a macOS package is now signed with the Developer ID, found by scanning so a binary added later is signed too. make test fails unless each one is signed by the team and tree-sitter.so loads into a process signed like Rune.app, on both architectures, so a build that drops signing cannot ship. Packages are not notarized: Gatekeeper never assesses packages that Rune installs. dist-<env>-all and the darwin dist targets need macOS and the signing identity, so they fail before building on Linux or without the identity. scripts/macos-signing.sh is shared verbatim with the other language repos. Co-Authored-By: Rune Agent (claude/claude-opus-5-5) <agent@rune.build> Signed-off-by: ernestrc <ernest@unstable.build>
Release from make dist targets instead of GitHub Actions Drop the release workflow and macOS signing and notarization. Rune strips com.apple.quarantine from installed packages, so Gatekeeper never assesses these binaries. make dist-<env>-all builds, tests and uploads all four targets from one Mac. The Linux tree-sitter.so is cross compiled with zig cc against glibc 2.28, and make test reads glibc requirements with objdump so it also runs on macOS. make test now rejects files outside the expected payload. The dist-* targets refuse to publish unless HEAD is a clean semver tag, and dist.sh strips credentials from the git remote URL it publishes. Co-Authored-By: Rune Agent (claude/claude-opus-5-5) <agent@rune.build> Signed-off-by: ernestrc <ernest@unstable.build>
PreviousNext