Prepare repo for wider publication - #20
Merged
Merged
Conversation
- Add Apache-2.0 LICENSE, NOTICE, and license metadata in Cargo manifests - Fix tests.yml: runner context is unavailable in job-level env, which failed every run at 0s since the workflow was added; use bun run test and install podman/llvm - Name-constrain the ingress CA (critical nameConstraints permitting only .lnx DNS names, excluding all IPs, pathlen:0) and de-dupe stale trusted roots on enable; add lnx ingress uninstall to remove the trusted CA and ingress state, with unit and integration coverage - Attach release binaries to GitHub Releases on v* tags, with an optional Developer ID sign+notarize path when MACOS_SIGN_* secrets are set - Remove the old Go implementation, its dead submodules, and TODO.txt (content moved to docs/testing.md) - Rewrite README value-prop-first with measured restore/exec timings and split details into docs/ (architecture, security, faq, troubleshooting, testing); add CONTRIBUTING.md and a Homebrew formula; refresh site copy
- ingress disable now removes the trusted lnx CA from the System keychain; uninstall additionally deletes the on-disk CA/certificate state - Describe third_party/libkrun as an in-tree vendored copy with snapshot patches instead of pointing at an external fork; remove copy.bara.sky - Delete leftover empty old/ directories
GitHub-hosted macOS runners do not support Apple nested virtualization, so lnx tests can never boot VMs there. Depot's macos-26 runners are M4 hosts with nested virtualization available, matching the existing Depot CI setup used for kernel and rootfs builds. Also installs Go, which build.rs needs for the embedded gvproxy bridge.
GitHub-hosted macOS runners do not support Apple nested virtualization, so lnx tests can never boot VMs there. Depot CI (.depot/workflows) is Linux-only, so keep the workflow on GitHub Actions but run it on Depot's depot-macos-26 runners (M4, macOS 26, nested virtualization available). Also installs Go, which build.rs needs for the embedded gvproxy bridge.
The system suite boots VMs, which requires Hypervisor.framework on bare-metal macOS. Hosted macOS CI is always a VM and Apple only supports nested virtualization for Linux guests, so no hosted provider can run it (Depot CI is x86_64 Linux only; Depot managed runners do not support personal accounts). Unit tests run on GitHub-hosted macos-26; the system job targets a self-hosted Mac and is dispatch-only until one is registered.
…work test_vm_memory_init is the only unit test that creates a real HVF VM. Hosted macOS CI runners are themselves VMs without HVF, so gate the test on kern.hv_support instead of failing there.
The synthesized snapshot metadata still said dax:false, so the server rejected the push with share_mismatch since host shares became always-DAX. The import fixture got the same fix earlier; this one was missed because the test workflow never ran.
The macOS virtiofs server faked lseek: SEEK_DATA always returned the requested offset (never ENXIO at EOF) and SEEK_HOLE returned size+offset via SEEK_END. macOS supports both seeks natively — the whence values are just numbered opposite to Linux — so translate them instead. The fake semantics made guest cp --sparse drop trailing holes, truncating copies of pmem-aligned images. Add a sparse-geometry regression step to the system suite. The Linux snapshot fixture also kept the inner VM base on virtiofs, where nested KVM cannot map DAX pages (vcpu EFAULT), and its shrunk outer rootfs had no room for staging. Stage the inner base on guest-local disk like the nested-kvm suite does and grow the outer rootfs sparsely to 16 GiB. Verified: system, snapshot-roundtrip, and nested-kvm suites pass; snapshot-roundtrip previously failed fixture creation on every run.
Forks all restore the running browser stack and answer on noVNC; the count is tunable with LNX_BROWSER_FORK_COUNT. Measured on an M5 Pro: 10 forks with verified endpoints in 1.16s.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pre-publicity pass over the repo ahead of sharing it more widely.
Licensing & metadata
CI fixes
${{ runner.temp }}is not a valid context in job-levelenv. Moved to a$GITHUB_ENVstep; also switchedcargo testtobun run test(sets libclang env + codesign runner) and added podman/llvm to the deps installv*tags, creates the GitHub Release, and uploadslnx-macos-arm64.tar.gz+ sha256; optional Developer ID sign+notarize path activates whenMACOS_SIGN_*secrets are configured (ad-hoc fallback otherwise)Ingress CA hardening
nameConstraints(permittedDNS:.lnx/DNS:lnx, all IPv4/IPv6 excluded),basicConstraints CA:TRUE,pathlen:0, andkeyUsage keyCertSign,cRLSign— trusting it cannot enable interception of any real domainingress disablenow removes the trusted CA from the System keychain; newlnx ingress uninstalladditionally deletes on-disk CA/cert statetrust_cade-dupes stale trusted roots so repeated enables cannot accumulate old CAsrun_hiddenbool soup refactored into aHiddenActionenumDocs
docs/: architecture (moved from README), security (exactly what ingress installs and how to remove it), FAQ (positioning vs OrbStack/Lima/Apple container), troubleshooting, testing (absorbed TODO.txt)Formula/lnx.rbso the repo doubles as a Homebrew tap; site copy refreshedthird_party/libkrundescribed as an in-tree vendored copy with snapshot patches; external fork references and copy.bara.sky removedCleanup
old/, ~26k lines), its dead submodules and .gitmodules, TODO.txt, and the trackedresults/placeholder (now gitignored)Testing
openssl x509 -textbun run test:ingresspasses with new steps: CA files survivedisable,uninstallremoves CA/cert statebun run test:systempasses end-to-end (after refreshing a stale local image cache that predated images-v0.6.0)