Build and publish the CLI for NetBSD x64.
The cross images cannot link pnpm for x86_64-unknown-netbsd: their
NetBSD 9 sysroot has no libexecinfo, which Rust's std links, and no
getentropy, which aws-lc calls. NetBSD 9 is end-of-life, and a native
build on NetBSD 10.2 needs no workaround.
The NetBSD entry of the CLI release build matrix runs on a GitHub-hosted
runner, which has KVM. A composite action installs NetBSD 10.2 with
anita from the official release files and boots it, and
.github/scripts/netbsd-vm/vm.sh builds inside it and copies the
artifacts back to where the existing archive, attest, and upload steps
expect them. The release files are checked against a committed SHA512
list, and anita and rustup-init against pinned SHA-256 hashes.
A separate workflow runs the same build, plus an install, on changes to
the VM files and weekly, since only a release tag runs the release jobs.
---------
Co-authored-by: Alessio Attilio <attilio.alessio@protonmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
