From 8365f638666ac0f80d9ccb0558f58be2c004784f Mon Sep 17 00:00:00 2001 From: tas0dev <156896971+tas0dev@users.noreply.github.com> Date: Wed, 11 Nov 2026 15:14:38 +0900 Subject: [PATCH 1/5] Build and test native Edit packages using the standalone SDK Actions --- .github/workflows/package.yml | 57 +++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 .github/workflows/package.yml diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml new file mode 100644 index 0000000..103eede --- /dev/null +++ b/.github/workflows/package.yml @@ -0,0 +1,57 @@ +name: Build native Edit MPKG +on: + push: + branches: [staging, main, master] + pull_request: + branches: [main, master] + workflow_dispatch: +permissions: + contents: read +concurrency: + group: edit-package-${{ github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} +jobs: + build: + runs-on: ubuntu-24.04 + timeout-minutes: 60 + env: + CARGO_BUILD_JOBS: '4' + steps: + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + with: + persist-credentials: false + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 + with: + python-version: '3.12' + - name: Install host dependencies + run: | + sudo apt-get update + sudo apt-get install -y pkg-config libxkbcommon-dev libwayland-dev libfontconfig1-dev libx11-dev libxcursor-dev libxi-dev libxrandr-dev unzip curl perl cmake + - name: Prepare the pinned standalone Rust SDK + id: sdk + uses: mochiOS/devkit/actions/setup-rust-sdk@c978f59725ab4995daa9e0df9b2df8b7d30e7182 + with: + output: ${{ runner.temp }}/mochios-rust-sdk + - name: Test, compile and stage Edit + env: + SDK: ${{ steps.sdk.outputs.sdk }} + HELPER: ${{ steps.sdk.outputs.helper }} + run: python3 "$HELPER" --source "$GITHUB_WORKSPACE" --sdk "$SDK" --output "$RUNNER_TEMP/app-build" --test + - name: Build unsigned MPKG using the public Action + id: package + uses: mochiOS/devkit/actions/build-mpkg@20d3fb71b952ae7a4ff583dafe8cc3d00e24d3a3 + with: + manifest: ${{ runner.temp }}/app-build/stage/manifest.toml + payload: ${{ runner.temp }}/app-build/stage/payload + output: dist/Edit.mpkg + - name: Retain package and reviewable dependency resolution + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + with: + name: edit-unsigned-mpkg + path: | + ${{ steps.package.outputs.package }} + ${{ steps.package.outputs.checksum-file }} + ${{ runner.temp }}/app-build/build-info.json + ${{ runner.temp }}/app-build/resolved.Cargo.lock + if-no-files-found: error + retention-days: 14 From 09ec0701f47e0cd46a3bd26cebb137749e4d1920 Mon Sep 17 00:00:00 2001 From: tas0dev <156896971+tas0dev@users.noreply.github.com> Date: Wed, 11 Nov 2026 15:20:17 +0900 Subject: [PATCH 2/5] Pin corrected SDK tests and keep package artifacts in one distribution directory --- .github/workflows/package.yml | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml index 103eede..61827b3 100644 --- a/.github/workflows/package.yml +++ b/.github/workflows/package.yml @@ -1,7 +1,7 @@ name: Build native Edit MPKG on: push: - branches: [staging, main, master] + branches: [main, master] pull_request: branches: [main, master] workflow_dispatch: @@ -29,7 +29,7 @@ jobs: sudo apt-get install -y pkg-config libxkbcommon-dev libwayland-dev libfontconfig1-dev libx11-dev libxcursor-dev libxi-dev libxrandr-dev unzip curl perl cmake - name: Prepare the pinned standalone Rust SDK id: sdk - uses: mochiOS/devkit/actions/setup-rust-sdk@c978f59725ab4995daa9e0df9b2df8b7d30e7182 + uses: mochiOS/devkit/actions/setup-rust-sdk@125686a1eb4e953542c4bcd0125e084e37faadd5 with: output: ${{ runner.temp }}/mochios-rust-sdk - name: Test, compile and stage Edit @@ -45,13 +45,14 @@ jobs: payload: ${{ runner.temp }}/app-build/stage/payload output: dist/Edit.mpkg - name: Retain package and reviewable dependency resolution + shell: bash + run: | + cp "$RUNNER_TEMP/app-build/build-info.json" dist/build-info.json + cp "$RUNNER_TEMP/app-build/resolved.Cargo.lock" dist/resolved.Cargo.lock + - name: Upload distributable files only uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 with: name: edit-unsigned-mpkg - path: | - ${{ steps.package.outputs.package }} - ${{ steps.package.outputs.checksum-file }} - ${{ runner.temp }}/app-build/build-info.json - ${{ runner.temp }}/app-build/resolved.Cargo.lock + path: dist/ if-no-files-found: error retention-days: 14 From 9cd2551509009ec28a06a7e92ec8c0a9572e88b5 Mon Sep 17 00:00:00 2001 From: tas0dev <156896971+tas0dev@users.noreply.github.com> Date: Wed, 11 Nov 2026 15:31:16 +0900 Subject: [PATCH 3/5] Use the unified standard-library source graph in Edit CI --- .github/workflows/package.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml index 61827b3..72eb756 100644 --- a/.github/workflows/package.yml +++ b/.github/workflows/package.yml @@ -29,7 +29,7 @@ jobs: sudo apt-get install -y pkg-config libxkbcommon-dev libwayland-dev libfontconfig1-dev libx11-dev libxcursor-dev libxi-dev libxrandr-dev unzip curl perl cmake - name: Prepare the pinned standalone Rust SDK id: sdk - uses: mochiOS/devkit/actions/setup-rust-sdk@125686a1eb4e953542c4bcd0125e084e37faadd5 + uses: mochiOS/devkit/actions/setup-rust-sdk@9fbeaeaaeb8dcb597b662fe0cdc8df145d065395 with: output: ${{ runner.temp }}/mochios-rust-sdk - name: Test, compile and stage Edit From 7703aac5f0baea18994ca65be4d13a357ef68d5f Mon Sep 17 00:00:00 2001 From: tas0dev <156896971+tas0dev@users.noreply.github.com> Date: Wed, 11 Nov 2026 16:06:32 +0900 Subject: [PATCH 4/5] Adopt the dependency resolution validated by native Edit package CI --- Cargo.lock | 60 +++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 55 insertions(+), 5 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 70267d4..33e24cf 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1054,6 +1054,7 @@ dependencies = [ "mochios-capability-protocol", "mochios-package-manifest", "mochios-workspace-protocol", + "zeroize", ] [[package]] @@ -1091,6 +1092,7 @@ version = "0.1.0" [[package]] name = "mochios-fonts" version = "0.1.0" +source = "git+https://github.com/mochiOS/fonts?rev=233cb947ed6b10e175b0c6570611eb5605f112e1#233cb947ed6b10e175b0c6570611eb5605f112e1" dependencies = [ "sha2", "ttf-parser", @@ -2430,9 +2432,9 @@ checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20" [[package]] name = "ui_layout" -version = "0.9.8" +version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fe00a83f195b147e7ea8a2b9abc08b9b3ca043e7fcca996bd7a980174438fb1b" +checksum = "afbdfab90b0052416a13fa78be0f151f5bb6480242601b97e76207f58e8761b0" [[package]] name = "unicode-bidi" @@ -3292,17 +3294,45 @@ name = "mboot-protocol" version = "0.1.0" [[patch.unused]] -name = "mnu" -version = "0.1.0" +name = "rustc-std-workspace-alloc" +version = "1.99.0" + +[[patch.unused]] +name = "rustc-std-workspace-core" +version = "1.99.0" [[patch.unused]] -name = "mochios-mdriver-protocol" +name = "rustc-std-workspace-std" +version = "1.99.0" + +[[patch.unused]] +name = "mochi-user-newlib-runtime" version = "0.1.0" [[patch.unused]] name = "mochi-user-runtime" version = "0.1.0" +[[patch.unused]] +name = "mochios-certificate" +version = "0.1.0" + +[[patch.unused]] +name = "mochios-certificate-database" +version = "0.1.0" + +[[patch.unused]] +name = "mochios-driver-control-protocol" +version = "0.1.0" + +[[patch.unused]] +name = "mochios-elf-signature" +version = "0.1.0" + +[[patch.unused]] +name = "mochios-http-client" +version = "0.1.0" + [[patch.unused]] name = "mochios-linux-gui-protocol" version = "0.1.0" @@ -3311,14 +3341,34 @@ version = "0.1.0" name = "mochios-linux-portal-protocol" version = "0.1.0" +[[patch.unused]] +name = "mochios-network-stack" +version = "0.1.0" + +[[patch.unused]] +name = "mochios-package-client" +version = "0.1.0" + +[[patch.unused]] +name = "mochios-package-protocol" +version = "0.1.0" + [[patch.unused]] name = "mochios-signature-protocol" version = "0.1.0" +[[patch.unused]] +name = "mochios-test-support" +version = "0.1.0" + [[patch.unused]] name = "mochios-tls-client" version = "0.1.0" +[[patch.unused]] +name = "mochios-tls-stream-ffi" +version = "0.1.0" + [[patch.unused]] name = "mochios-user-database" version = "0.1.0" From e2765b5d996ca599c8c78b6e3f2534c1a41b0f17 Mon Sep 17 00:00:00 2001 From: tas0dev <156896971+tas0dev@users.noreply.github.com> Date: Wed, 11 Nov 2026 16:06:35 +0900 Subject: [PATCH 5/5] Gate signed Edit releases behind application maintainer approval --- .github/workflows/package.yml | 48 ++++++++++++++++++++++++++++++++++- BUILDING.md | 36 ++++++++++++++++++++++++++ 2 files changed, 83 insertions(+), 1 deletion(-) create mode 100644 BUILDING.md diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml index 72eb756..0417220 100644 --- a/.github/workflows/package.yml +++ b/.github/workflows/package.yml @@ -29,7 +29,7 @@ jobs: sudo apt-get install -y pkg-config libxkbcommon-dev libwayland-dev libfontconfig1-dev libx11-dev libxcursor-dev libxi-dev libxrandr-dev unzip curl perl cmake - name: Prepare the pinned standalone Rust SDK id: sdk - uses: mochiOS/devkit/actions/setup-rust-sdk@9fbeaeaaeb8dcb597b662fe0cdc8df145d065395 + uses: mochiOS/devkit/actions/setup-rust-sdk@1ae906d7417e9882b11541e338552c3039c981fb with: output: ${{ runner.temp }}/mochios-rust-sdk - name: Test, compile and stage Edit @@ -56,3 +56,49 @@ jobs: path: dist/ if-no-files-found: error retention-days: 14 + publish: + if: github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && vars.APP_RELEASE_ENABLED == 'true' + needs: build + runs-on: ubuntu-24.04 + timeout-minutes: 30 + environment: app-release + permissions: + actions: read + contents: write + steps: + - name: Download this run's verified build artifact + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + with: + name: edit-unsigned-mpkg + path: unsigned-package + - name: Prepare trusted tooling without checking out application code + id: sdk + uses: mochiOS/devkit/actions/setup-rust-sdk@1ae906d7417e9882b11541e338552c3039c981fb + with: + output: ${{ runner.temp }}/mochios-rust-sdk + - name: Build the pinned signing tool + env: + SDK: ${{ steps.sdk.outputs.sdk }} + HELPER: ${{ steps.sdk.outputs.helper }} + run: python3 "$(dirname "$HELPER")/host-tool.py" --sdk "$SDK" --tool msign --output "$RUNNER_TEMP/host-tools" + - name: Sign, verify and publish the approved package + env: + GH_TOKEN: ${{ github.token }} + MSIGN_CERTIFICATE_B64: ${{ secrets.MSIGN_CERTIFICATE_B64 }} + MSIGN_PRIVATE_KEY_B64: ${{ secrets.MSIGN_PRIVATE_KEY_B64 }} + MSIGN_ROOT_PUBLIC_KEY_B64: ${{ vars.MSIGN_ROOT_PUBLIC_KEY_B64 }} + HELPER: ${{ steps.sdk.outputs.helper }} + SOURCE_COMMIT: ${{ github.sha }} + RELEASE_REPOSITORY: ${{ github.repository }} + RELEASE_BRANCH: ${{ github.event.repository.default_branch }} + run: | + python3 "$(dirname "$HELPER")/release.py" \ + --artifacts "$GITHUB_WORKSPACE/unsigned-package" \ + --msign "$RUNNER_TEMP/host-tools/release/msign" \ + --package-id org.mochios.edit \ + --commit "$SOURCE_COMMIT" \ + --sdk-ref 1ae906d7417e9882b11541e338552c3039c981fb \ + --repository "$RELEASE_REPOSITORY" \ + --environment app-release \ + --reviewer-team 17892808 \ + --branch "$RELEASE_BRANCH" diff --git a/BUILDING.md b/BUILDING.md new file mode 100644 index 0000000..3c8be4c --- /dev/null +++ b/BUILDING.md @@ -0,0 +1,36 @@ +# Native package builds + +The PR workflow builds Edit independently of the OS workspace using the pinned +DevKit setup Action and published shared.8 SDK. It runs host unit tests, builds +the native mochiOS executable, and uses the public `build-mpkg` Action to create +an unsigned package. Native programs are inspected, not executed on Linux. + +Download `edit-unsigned-mpkg` from the successful Actions run. It contains +`Edit.mpkg`, `SHA256SUMS`, `build-info.json`, and `resolved.Cargo.lock`. Review and +commit an updated dependency resolution when changing SDK/source pins. Runner +paths and the local SDK description are not distributed. The normal source +manifest still supports built-in/preview staging; the package build derives +digest-bound ordinary `/applications/Edit.app` installation metadata without +built-in provenance, preserving declared resources, document roles and capabilities. + +Changes go to `staging` and a PR targeting `main`. PRs never sign or release. +After merging, the default-branch workflow builds again and, once releases have +been enabled, waits for approval in the `app-release` Environment. That +environment is restricted to the default branch and reviewed by +`mochiOS/application-maintainers`. + +Publication is initially disabled. Before setting the repository variable +`APP_RELEASE_ENABLED=true`, configure these Environment values: + +* Secret `MSIGN_CERTIFICATE_B64`: base64 of the issued app Developer Certificate file. +* Secret `MSIGN_PRIVATE_KEY_B64`: base64 of its corresponding private-key file. +* Variable `MSIGN_ROOT_PUBLIC_KEY_B64`: base64 of the trusted issuer public-key file. + +Do not commit key files or use development fixture identities. The approval job +does not check out or run application code. It checks the build's source commit, +SDK Action revision, actual package ID, and unsigned checksum, signs with msign, +checks that the configured Team approval and branch restrictions are still present, +then verifies the signature/certificate/payload before publishing. It creates a +prerelease named `v-r` and never replaces existing tags or assets. +Increase `package.revision` before another release of the same version. An +approval cannot override a missing, invalid, expired or insufficient signing identity.