mirror of
https://github.com/mudler/LocalAI.git
synced 2026-07-08 07:18:31 -04:00
5b3572f8b8
Produce a Gatekeeper-clean macOS distribution with no user workaround: - Launcher DMG + the LocalAI.app inside it are built via fyne, codesigned with the Developer ID under the hardened runtime, then the DMG is signed, notarized (notarytool) and stapled. Replaces macos-dmg-creator (which had no signing hook) with fyne package + hdiutil so we control the .app before packaging. - The bare local-ai darwin server binary is signed + notarized via GoReleaser's native notarize block (quill backend, runs on Linux). - All signing is gated on secrets being present, so forks/PRs/local builds stay unsigned and green (contrib/macos/sign-and-notarize.sh no-ops). - Add hardened-runtime entitlements and FyneApp.toml for deterministic packaging; update macOS install docs to drop the quarantine workaround. Assisted-by: Claude:claude-opus-4-8 [Claude Code] Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Co-authored-by: Ettore Di Giacinto <mudler@localai.io>
55 lines
1.5 KiB
YAML
55 lines
1.5 KiB
YAML
version: 2
|
|
before:
|
|
hooks:
|
|
- make protogen-go
|
|
- make react-ui
|
|
- go mod tidy
|
|
dist: release
|
|
source:
|
|
enabled: true
|
|
name_template: '{{ .ProjectName }}-{{ .Tag }}-source'
|
|
builds:
|
|
- id: local-ai
|
|
main: ./cmd/local-ai
|
|
env:
|
|
- CGO_ENABLED=0
|
|
ldflags:
|
|
- -s -w
|
|
- -X "github.com/mudler/LocalAI/internal.Version={{ .Tag }}"
|
|
- -X "github.com/mudler/LocalAI/internal.Commit={{ .FullCommit }}"
|
|
goos:
|
|
- linux
|
|
- darwin
|
|
#- windows
|
|
goarch:
|
|
- amd64
|
|
- arm64
|
|
ignore:
|
|
- goos: darwin
|
|
goarch: amd64
|
|
archives:
|
|
- formats: [ 'binary' ] # this removes the tar of the archives, leaving the binaries alone
|
|
name_template: local-ai-{{ .Tag }}-{{ .Os }}-{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}
|
|
checksum:
|
|
name_template: '{{ .ProjectName }}-{{ .Tag }}-checksums.txt'
|
|
snapshot:
|
|
version_template: "{{ .Tag }}-next"
|
|
changelog:
|
|
use: github-native
|
|
# Sign + notarize the macOS server binary via the quill backend (runs on Linux,
|
|
# no macOS runner needed). Disabled automatically when MACOS_SIGN_P12 is unset
|
|
# (forks / PRs), so those builds stay unsigned and green.
|
|
notarize:
|
|
macos:
|
|
- enabled: '{{ isEnvSet "MACOS_SIGN_P12" }}'
|
|
ids:
|
|
- local-ai
|
|
sign:
|
|
certificate: "{{.Env.MACOS_SIGN_P12}}"
|
|
password: "{{.Env.MACOS_SIGN_PASSWORD}}"
|
|
notarize:
|
|
issuer_id: "{{.Env.MACOS_NOTARY_ISSUER_ID}}"
|
|
key_id: "{{.Env.MACOS_NOTARY_KEY_ID}}"
|
|
key: "{{.Env.MACOS_NOTARY_KEY}}"
|
|
wait: true
|