Begin MACOS_VM_NATIVE_AGENT_Markdown

Nucleic-Session: 8BBA8B40-FA38-4556-8B3A-7A2DFD4C87B2 Co-authored-by: Nucleic <[email protected]>
2026-07-06 03:36:33 -07:00
parent b288f9f20f
commit bdaf160e59
1 changed files with 53 additions and 0 deletions
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+#
+# Build guest/NucleicVMAgent into a signed NucleicVMAgent.app bundle, ready to be baked into the
+# macOS-VM golden base image (docs/MACOS_VM_NATIVE_AGENT.md §11).
+#
+#   ./scripts/build-vm-agent.sh [output-dir]        # default output: guest/NucleicVMAgent/dist
+#
+# Signing: TCC keys its grants to the app's DESIGNATED REQUIREMENT, and an ad-hoc signature changes
+# identity every build — so a pre-inserted TCC row would stop matching after a rebuild. Sign with a
+# stable identity via $NUCLEIC_VMAGENT_SIGN_IDENTITY (a Developer ID, or a self-signed code-signing
+# cert in the login keychain). Falls back to ad-hoc WITH A WARNING so a first local round-trip still
+# works (you must re-provision TCC after every ad-hoc rebuild).
+#
+# Runs on the HOST (needs the Swift toolchain); the produced .app runs inside the GUEST. Stage the
+# app next to scripts/provision-macos-guest.sh (or in the shared workspace) when provisioning.
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+PKG_DIR="$REPO_ROOT/guest/NucleicVMAgent"
+OUT_DIR="${1:-$PKG_DIR/dist}"
+APP="$OUT_DIR/NucleicVMAgent.app"
+IDENTITY="${NUCLEIC_VMAGENT_SIGN_IDENTITY:-}"
+
+echo "▸ Building NucleicVMAgent (release) …"
+swift build --package-path "$PKG_DIR" -c release
+BIN="$(swift build --package-path "$PKG_DIR" -c release --show-bin-path)/NucleicVMAgent"
+[ -x "$BIN" ] || { echo "✗ build produced no binary at $BIN" >&2; exit 1; }
+
+echo "▸ Assembling $APP …"
+rm -rf "$APP"
+mkdir -p "$APP/Contents/MacOS"
+cp "$PKG_DIR/Packaging/Info.plist" "$APP/Contents/Info.plist"
+cp "$BIN" "$APP/Contents/MacOS/NucleicVMAgent"
+# The LaunchAgent plist rides along so the provisioner can install it from one staged directory.
+cp "$PKG_DIR/Packaging/xyz.blakeslee.nucleic.vmagent.plist" "$OUT_DIR/"
+
+echo "▸ Signing …"
+if [ -n "$IDENTITY" ]; then
+  codesign --force --options runtime --sign "$IDENTITY" "$APP"
+  echo "  ✓ signed with '$IDENTITY' (hardened runtime)."
+else
+  codesign --force --sign - "$APP"
+  echo "  ⚠ AD-HOC signed (set NUCLEIC_VMAGENT_SIGN_IDENTITY for a stable identity)." >&2
+  echo "    An ad-hoc identity changes EVERY build, so the guest's pre-granted TCC rows stop" >&2
+  echo "    matching after a rebuild — re-run provisioning Phase 7d after installing this build." >&2
+fi
+# Never let a quarantine xattr ride into the guest (the app is never downloaded, but be safe).
+xattr -dr com.apple.quarantine "$APP" 2>/dev/null || true
+
+codesign --verify --deep "$APP"
+echo "✓ $APP"
+echo "  Stage it for provisioning: copy $OUT_DIR/* next to scripts/provision-macos-guest.sh in the guest."