Homebrew packaging (macOS solo install)

The macOS "solo" distribution of Kibur is a Homebrew formula (kibur.rb) served from a self-hosted Forgejo tap. See ADR 0028 for the why, and ADR 0102 for the binary-only delivery this README describes.

brew tap kibur/kibur https://git.urkilden.no/Kibur/homebrew-kibur
brew install kibur
kibur up

kibur.rb here is the canonical source; the release CI syncs it into the tap repo's Formula/kibur.rb. Edit it here and let a tagged release propagate it.

What the formula delivers

• A prebuilt binary tarball — brew install kibur downloads kibur-X.Y.Z-arm64-macos.tar.gz and copies the four binaries into place. No source is distributed and no compiler runs on the user's Mac (no Rust/Zig/Node). The binaries: kibur, kibur-server, kibur-runner, and the cross-compiled aarch64-unknown-linux-musl kibur-guest-agent. They install into libexec/bin; only kibur is symlinked into bin, and kibur up finds the others as siblings of the running binary.
• depends_on "slp/krun/libkrun" — the macOS VMM (the only macOS backend), pulled as an arm64 bottle (with libkrunfw). A runtime dependency: the runner dlopens libkrun, nothing links it.
• depends_on "apko" — the kibox wolfi engine subprocesses apko build to bake every wolfi workspace rootfs. Also a runtime dependency (the runner execs it); without it a workspace create fails with "no engine in registry could handle the request". From homebrew-core.
• depends_on "e2fsprogs" — mkfs.ext4 for the workspace disks (ADR 0015); keg-only, discovered under the keg.
• install ad-hoc-codesigns kibur-runner with the com.apple.security.hypervisor entitlement — libkrun uses Hypervisor.framework, which without it fails krun_start_enter with EINVAL. The entitlement needs no Apple Developer identity, and brew-installed binaries aren't Gatekeeper-quarantined. The signing runs at install time, on the user's machine.

There is no bottle do block and no source tarball — the formula's url is the binary artifact (ADR 0102). This suits an open-core split (only binaries leave the build host) and keeps source to a single home.

One-time: create the tap repo

The tap is an ordinary Forgejo repo named homebrew-kibur (the homebrew- prefix is what lets brew tap kibur/kibur resolve it):

# On git.urkilden.no, create Kibur/homebrew-kibur, then:
git clone ssh://git@git.urkilden.no/Kibur/homebrew-kibur.git
mkdir -p homebrew-kibur/Formula
cp packaging/homebrew/kibur.rb homebrew-kibur/Formula/kibur.rb
cd homebrew-kibur && git add Formula/kibur.rb && git commit -m "Add kibur formula" && git push

Because the tap isn't on GitHub, users tap it by full URL (the form in the install snippet above). After this first seed, the release CI keeps Formula/kibur.rb up to date via the Forgejo contents API.

Per release (what the CI does, and how to do it by hand)

A tagged release (vX.Y.Z) drives .forgejo/workflows/release-macos.yml, which, on the self-hosted Apple-Silicon runner:

1. Builds the solo frontend (pnpm build → frontend/dist/solo, which kibur-server embeds) and cross-compiles the guest-agent (cargo zigbuild --target aarch64-unknown-linux-musl -p kibur-guest-agent).
2. Builds the three host binaries (cargo build --release: solo kibur-server, krun-only kibur-runner, the kibur CLI).
3. Assembles the binary tarball kibur-X.Y.Z-arm64-macos.tar.gz (the four binaries at the tarball root) and uploads it to the tap repo's kibur-X.Y.Z release as an asset.
4. Stamps packaging/homebrew/kibur.rb (the url version, version, and sha256) and pushes it to the tap repo's Formula/kibur.rb via the Forgejo contents API.

The placeholders in kibur.rb marked RELEASE-CI (the url version, version, and the sha256) are what steps 3–4 fill. Until the first release runs, the formula points at a tag/asset that must exist.

Local check

brew style packaging/homebrew/kibur.rb     # rubocop lint
brew audit --formula packaging/homebrew/kibur.rb

To smoke the install end-to-end before wiring up a real tag, build the tarball by hand, point url at it, and set sha256:

# from a repo checkout, after `cargo build --release` of the three host
# bins + the zigbuild'd guest-agent (see the workflow steps above):
tar -czf /tmp/kibur-0.0.0-arm64-macos.tar.gz -C /tmp/stage \
    kibur-server kibur-runner kibur kibur-guest-agent
shasum -a 256 /tmp/kibur-0.0.0-arm64-macos.tar.gz
# edit kibur.rb: url "file:///tmp/kibur-0.0.0-arm64-macos.tar.gz", matching sha256
brew install --formula packaging/homebrew/kibur.rb