native-packages 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0f937a8788833696a7e7f71ae4a2892c9fbd5dc9da1492376155530e0fa349e6
-  data.tar.gz: 7dc4b26da615673f0639bdb54344978bc60f54386451e35286e00bb76f8228de
+  metadata.gz: 164594265b7f47190d318ad3507446103c389206e0ab2901a54371b21c53f0ed
+  data.tar.gz: 79cfdca9089b718e2e65f4203e3ca4629542517e859992340c79229df715e68c
 SHA512:
-  metadata.gz: 6a66d883eb494ac1a0d04311fa09a844a110b88c9fd2e75df1178f4fb79e027fdd694185c15169a705a77b99a62f041e0a9f4415617ff20dc6a1b40aaf457fb5
-  data.tar.gz: a0900c282473d8b1b1b1da1855889a2279dcaa8eaddefc7abf7aaa554c6db40435f86aae1def077e189294adc3b1c142247a62fdeefeb9a34073e93abee460fc
+  metadata.gz: 587d2a749a8b5d6f380a37ca932dbb0d587bd6bee763269a5783a54d8f50bc5ab0102b32958c6eabcab79de4447b4acaa7cc8e063340a848a123b9b34d851342
+  data.tar.gz: a0935ea30ddf612535a11903912b2bfbe34ec947ac396254b0abefb0182e9a54e0551f797520916cb402208421251dfb2cc583fdf050c2e1eef1f3808ca82194

data/README.md

@@ -6,14 +6,11 @@ Applications keep their build scripts, installation assets and native recipes. T
 
 ## Install and build
 
-Version 0.2 is being prepared for RubyGems publication. Until published, build and install the gem from this repository:
-
 ```sh
-gem build native-packages.gemspec
-gem install ./native-packages-0.2.0.gem
+gem install native-packages
 ```
 
-After publication, installation is `gem install native-packages`. Install nFPM 2.47.0 separately for local use; the reusable CI workflow installs it for you. Ruby 3.2 or later is required.
+Install nFPM 2.47.0 separately for local use; the reusable CI workflow installs it for you. Ruby 3.2 or later is required.
 
 From an application directory:
 
@@ -59,6 +56,19 @@ Linux binary targets declare `libc: glibc`, `musl` or `static`. The tool inspect
 
 See [configuration and commands](docs/configuration.md) for tokens, release assets, hooks, version selection and publishing, and [platform coverage](docs/platforms.md) for each format's requirements.
 
+Version 0.3 adds [native DMG and Inno recipes](docs/native-recipes.md). These run
+the application's existing packaging commands on macOS or Windows, using the
+same verified build manifests as Linux packages. Native recipes consume prepared
+directories and need no nFPM installation. The gem checks Mach-O/PE architecture,
+preserves safe internal bundle links and hashes the output after signing hooks.
+App compilation, installer policy and signing identities stay in the application
+repository.
+
+Preview package versions are explicit: set `release.prereleases: true` to build
+`1.2.3-alpha.N`, `-beta.N` or `-rc.N` for DEB/RPM/DMG/Inno. Other formats and
+downstream recipe publication remain stable-only. Uploads require an existing
+GitHub release already marked as a prerelease.
+
 The [all-formats example](examples/native-packages-all-formats.yaml) shows separate Linux, OpenWrt, Windows and source inputs, including MSIX identity/assets and an SRPM source/spec layout.
 
 ## Release inputs and publication
@@ -85,14 +95,14 @@ packaging:
   needs: release
   permissions:
     contents: write
-  uses: crmne/native-packages/.github/workflows/package.yml@v0.2.0
+  uses: crmne/native-packages/.github/workflows/package.yml@v0.3.0
   with:
     version: ${{ github.ref_name }}
     publish: true
   secrets: inherit
 ```
 
-This reference becomes available when v0.2.0 is tagged. Pin the corresponding commit SHA for an immutable workflow reference. With no version, the workflow validates configuration only. With a version, it installs the configured gem and nFPM, builds packages and uploads an Actions artifact. `publish: true` attaches packages to the existing release.
+Pin the corresponding commit SHA for an immutable workflow reference. With no version, the workflow validates configuration only. With a version, it installs the configured gem and nFPM, builds packages and uploads an Actions artifact. `publish: true` attaches packages to the existing release.
 
 To consume an Actions artifact instead, set `source-artifact` and, if necessary, `source-directory` (default `dist`). Its files must match the local input paths in the configuration. This workflow packages on Linux, including MSIX creation from Windows binaries; native application builds and platform-specific signing jobs can use the CLI separately.
 
@@ -111,7 +121,7 @@ Migration combines `packaging/project.yml`, its nFPM definition and repository r
 bundle install
 bundle exec ruby -Ilib -e 'Dir["test/*_test.rb"].sort.each { |path| require_relative path }'
 gem build native-packages.gemspec
-ruby test/gem_install.rb native-packages-0.2.0.gem
+ruby test/gem_install.rb native-packages-0.3.0.gem
 ```
 
 Tests build real packages, inspect their payloads and exercise repository publication against local Git fixtures. CI additionally runs disposable Linux install/upgrade/remove checks, SRPM rebuilds and Windows MSIX acceptance. Runtime build manifests report installation as `not-tested`: CI fixture coverage is not a substitute for testing each application's packages.

data/docs/cli-design.md

@@ -1,5 +1,11 @@
 # Proposal: an installable CLI with one project configuration
 
+The owner approved compatible shared support for RekordFlash's native alpha
+packaging on 2026-09-13. Version 0.3's [native recipe and prerelease policy](native-recipes.md)
+extends the original stable-only policy explicitly; published 0.2 consumers stay
+pinned. DMG/Inno adapters coordinate existing app scripts and retain their
+signing/version decisions, without adding a compiler or plugin framework.
+
 Status: accepted, 2026-09-13. Publishing was subsequently aligned with RubyLLM: GitHub release publication triggers the workflow, using `RUBYGEMS_AUTH_TOKEN`. The original Trusted Publishing proposal below is superseded by that decision. The v0.2 implementation follows this design. See the current [configuration reference](configuration.md) and [release setup](releasing.md) for the implemented interface and publication requirements. This document records the original design; it does not describe v0.1.0.
 
 The proposed interface is `gem install native-packages`, `native-packages init`, and `native-packages build`. A project normally needs one `native-packages.yaml` file. The tool should expose every nFPM packager and use the application's declared inputs to decide what to build.

data/docs/configuration.md

@@ -19,6 +19,12 @@
 
 ## Targets
 
+Version 0.3 additionally accepts macOS `dmg` and Windows `inno` targets with an
+application-owned `native.command` and `native.output`. These consume local
+prepared directories on their native host, with no nFPM executable required.
+See [native recipes](native-recipes.md) for the complete contract and examples.
+The nFPM targets below retain their existing behavior.
+
 A target declares `platform` (`linux` or `windows`), `arch` (nFPM/Go architecture name), `formats`, and `input`. `kind` defaults to `binary`; `data` permits packages without executables, and `source` is required for a separate SRPM target. Linux binaries declare `libc` as `glibc`, `musl` or `static`. IPK also requires an `abi` label identifying the device/distribution baseline.
 
 A target's optional `nfpm` mapping overrides the shared definition. Maps merge recursively; lists replace in full. Package name, version, platform and architecture must not conflict with their canonical declarations. Format-specific architecture overrides belong in the corresponding nFPM section. Distinct target inputs must be supplied for incompatible ABIs or platforms.
@@ -41,7 +47,7 @@ Strings can contain `@NAME@`, `@VERSION@`, `@TAG@`, `@DATE@`, `@SOURCE_DATE_EPOC
 
 Additional `assets` retain the existing `file`, optional `url`, and `checksummed` fields. Local builds require `local` paths for these assets. Release builds download and hash them, checking the published checksum unless `checksummed: false` is explicitly set for a source asset. Each contributes `@KEY_FILE@`, `@KEY_URL@` and `@KEY_SHA256@` to recipe rendering. Unresolved tokens fail validation/build.
 
-Omitting `--version` requires an exact stable release tag at HEAD. `--release` supplies the version and conflicts with a different `--version`. Stable versions currently use `vMAJOR.MINOR.PATCH`; prerelease tags are rejected. Build timestamps use `SOURCE_DATE_EPOCH`, otherwise the relevant Git commit timestamp, otherwise the current time for projects without Git metadata. Supply `SOURCE_DATE_EPOCH` for repeatable builds outside Git.
+Omitting `--version` requires an exact supported release tag at HEAD. `--release` supplies the version and conflicts with a different `--version`. Versions default to stable `vMAJOR.MINOR.PATCH`. Setting `release.prereleases: true` additionally permits `-alpha.N`, `-beta.N` and `-rc.N` for DEB/RPM/DMG/Inno builds without downstream recipes; preview upload requires an existing GitHub prerelease. Native directory recipes use local `--version` mode. Build timestamps use `SOURCE_DATE_EPOCH`, otherwise the relevant Git commit timestamp, otherwise the current time for projects without Git metadata. Supply `SOURCE_DATE_EPOCH` for repeatable builds outside Git.
 
 ## Output and publication
 

data/docs/native-recipes.md

@@ -0,0 +1,127 @@
+# Native DMG and Inno recipes (0.3)
+
+The shared build command can coordinate existing macOS and Windows packaging
+scripts. These are native command adapters, separate from nFPM. They do not
+generate an installer recipe, compile an app, supply signing identities or
+automatically notarize anything. The application retains those decisions.
+
+```yaml
+schema: 1
+tool:
+  version: '0.3.0'
+  nfpm: '2.47.0'
+nfpm:
+  name: example-app
+  maintainer: Example <example@example.org>
+  description: Example application
+  license: MIT
+release:
+  repository: example/example-app
+  prereleases: true
+targets:
+  macos-arm64:
+    platform: macos
+    arch: arm64
+    formats: [dmg]
+    input:
+      kind: directory
+      local: Example.app
+    native:
+      command: [ruby, packaging/dmg.rb, '@PAYLOAD@', '@PACKAGE@', '@VERSION@']
+      output: 'example-app-@TAG@-macos-arm64.dmg'
+  windows-amd64:
+    platform: windows
+    arch: amd64
+    formats: [inno]
+    input:
+      kind: directory
+      local: dist/windows
+    native:
+      command: [ruby, packaging/setup.rb, '@PAYLOAD@', '@PACKAGE@', '@VERSION@']
+      output: 'example-app-@TAG@-windows-setup.exe'
+```
+
+Run each target on its own host using `build --version VERSION --target ID`.
+Use the normal `aggregate` command to combine complete target results later.
+Use the same configuration and `SOURCE_DATE_EPOCH` across jobs. No nFPM binary
+is required when only native targets are selected; its version remains part of
+the configuration for compatibility with mixed Linux/native builds.
+
+`native.command` is a nonempty argument array, including `@PACKAGE@`, which
+resolves to the exact output filename in a fresh directory. `@PAYLOAD@` is an
+owned copy of the input directory's contents. It does not retain the original
+directory's basename: a DMG script should copy it into its own temporary
+`Example.app` folder before calling hdiutil. Other existing target tokens apply.
+Commands run in the application configuration directory and receive the same
+target/version environment as other build hooks.
+
+DMG requires a macOS binary target; Inno requires a Windows binary target. Both
+use one format per target and `input.kind: directory` with `input.local`.
+Release-download mode cannot supply a directory: prepare or download/unpack
+the app in its build job, then use local mode. `validate` and dry runs do not
+execute commands. `doctor` checks the host and recipe executable; the recipe
+must check its own additional tools. Mac architecture inspection also needs
+Apple's `lipo`. Supported Mac targets are `amd64`, `arm64` and `universal` (both).
+
+Input copying preserves file modes and internal relative symlinks, including
+framework links. Escaping, dangling and special-file entries fail. The staged
+tree must match the original digest and remain unchanged after packaging and
+signing hooks. Package only this staged input; do not read another application
+build from a global location. Recipes should preserve existing destinations,
+clean only their own temporary files and use argument arrays for subprocesses.
+
+The command must create exactly its declared `.dmg` or `.exe` file. The adapter
+checks a UDIF trailer or PE container respectively. This is a container check,
+not proof of a valid installer, signature or application. The existing
+`after_package` hook can sign/notarize the output in place before the final hash
+is recorded. Do not modify a package after building its manifest: signature
+stapling changes bytes and must run inside that hook if the manifest is to verify.
+
+Applications should invoke hdiutil's verification, platform signature checks and
+their normal installer compiler checks in their recipes. Preserve native numeric
+version ordering across alpha and stable releases; a SemVer suffix cannot be
+passed directly to a numeric Windows/macOS version field. The gem does not infer
+that policy from an application's release numbering.
+
+## Prerelease policy
+
+`release.prereleases: true` explicitly enables `MAJOR.MINOR.PATCH-alpha.N`,
+`-beta.N` and `-rc.N`, with a positive sequence number and no build suffix.
+Default/legacy commands continue to require stable versions. Preview builds
+support DEB, RPM, DMG and Inno only and cannot contain downstream recipes.
+nFPM's normal SemVer conversion produces, for example, `1.2.3~alpha.1` in DEB/RPM;
+overriding that prerelease or disabling conversion is rejected. Other package
+formats need their own reviewed version policy before being enabled.
+
+Preview publication only attaches to an existing GitHub release marked as a
+prerelease. It never creates a release or changes one from stable to prerelease.
+All configured targets must be aggregated and their hashes must verify first.
+This opt-in cannot affect applications still pinned to the published 0.2.0 gem.
+
+## Acceptance scope
+
+`ruby -Ilib test/native_acceptance.rb NEW_DIRECTORY` builds a small real native
+executable and packages alpha 1, alpha 2 and stable versions. It installs into an
+owned disposable directory, checks the executable/version and model fixture,
+rolls back to alpha 1 and removes the installation. Mac images are attached
+read-only and detached; Windows uses a unique per-user fixture identity and
+uninstaller. On Windows, run with a C compiler environment and set
+`NATIVE_PACKAGES_ISCC` to the actual Inno compiler path.
+
+These are gem fixtures, not application installation evidence. They do not
+exercise a DJ library, USB export, licensing, notarization or OS-store acceptance.
+The generated application build manifest continues to say `installation:
+not-tested`; do not turn that into a success claim merely because gem CI passed.
+
+The [2026-09-13 native record](acceptance/0.3.0-native.json) records successful
+DMG lifecycle checks on an ARM64 Mac and Inno lifecycle checks on Windows x64.
+Both covered alpha 1 → alpha 2 → stable → alpha 1 and final removal, preserving
+the fixture model and exact executable bytes. The native Mac run exposed the
+SSH-locale command-output bug, fixed before the successful run. Inno Setup
+6.7.3's official installer was verified against its SHA-256 and Pyrsys B.V.
+signature; fixtures compiled with MSVC 14.51. Linux passed 49 tests and 287
+assertions, including all existing package formats; the isolated gem install
+and build check passed. These local results precede hosted CI for this version.
+
+References: [nFPM version conversion](https://nfpm.goreleaser.com/docs/configuration/),
+[Inno command-line compiler](https://jrsoftware.org/ishelp/topic_compilercmdline.htm).

data/docs/platforms.md

@@ -15,7 +15,9 @@ All seven nFPM 2.47.0 packagers are exposed by the v0.2 CLI. Each target explici
 | Homebrew | Hash/render supplied formulae or casks and publish a tap | macOS bundles, signing/notarization, native recipe logic |
 | Nixpkgs/Gentoo/Void and similar repositories | Template rendering and configured Git/PR/MR publication | Native recipes, dependency hashes, distro checks and review |
 | Flatpak | No build/publication adapter yet | Use flatpak-builder and native manifests/runtime/sandbox settings |
-| Other Windows installers | No installer adapter beyond MSIX | Existing Inno Setup/NSIS/WiX and WinGet/Scoop integrations |
+| Inno Setup | Native command adapter, PE inspection, copied input and final output hashes | Inno recipe/compiler, application version mapping, signing and installation tests |
+| macOS DMG | Native command adapter, Mach-O inspection, copied bundle and final output hashes | Bundle, hdiutil recipe, signing/notarization, update/rollback testing |
+| Other Windows installers | No adapter for NSIS/WiX yet | Existing native tools and WinGet/Scoop integrations |
 
 The IPK acceptance fixture targets OpenWrt 24.10.8. OpenWrt 25.12 switched to APK, so IPK is not the package format for every OpenWrt release. [OpenWrt 25.12 release notes](https://openwrt.org/releases/25.12/notes-25.12.0)
 

data/docs/releasing.md

@@ -23,7 +23,7 @@ Update the gemspec, `NativePackages::VERSION`, example/version references and ch
 Create a GitHub release for that commit:
 
 ```sh
-gh release create v0.2.0 --target main --title 'native-packages 0.2.0' --notes-file release-notes.md
+gh release create v0.3.0 --target main --title 'native-packages 0.3.0' --notes-file release-notes.md
 ```
 
 Adding `--draft` permits review before publication and does not trigger the publisher. The tag must match the exact gem version and point to a commit on `main`. Set `--prerelease` only for a prerelease gem version.

data/examples/native-packages-all-formats.yaml

@@ -1,7 +1,7 @@
 # Supply the listed build outputs before running this example.
 schema: 1
 tool:
-  version: '0.2.0'
+  version: '0.3.0'
   nfpm: '2.47.0'
 nfpm:
   name: example-app

data/examples/native-packages.yaml

@@ -1,6 +1,6 @@
 schema: 1
 tool:
-  version: '0.2.0'
+  version: '0.3.0'
   nfpm: '2.47.0'
 nfpm:
   name: example-app

data/lib/native_packages/build.rb

@@ -2,6 +2,7 @@
 
 require_relative "configuration"
 require_relative "inspection"
+require_relative "native_recipe"
 
 module NativePackages
   class Build
@@ -29,7 +30,12 @@ module NativePackages
     def doctor(ids: [], formats: [], release: false)
       configuration.validate
       selected = configuration.select(ids: ids, formats: formats)
-      nfpm_version unless selected.empty?
+      nfpm_version if selected.values.any? { |target| (target.fetch("formats") & Configuration::NATIVE_FORMATS).empty? }
+      selected.each do |id, target|
+        next unless target["native"]
+        metadata = configuration.target_tokens(configuration.tokens("9.8.7"), id, target, "/payload").merge("PACKAGE" => "/output/package", "FORMAT" => target.fetch("formats").first)
+        NativeRecipe.new(root).doctor(target, render_tree(target.fetch("native").fetch("command"), metadata))
+      end
       required = []
       required << "readelf" if selected.values.any? { |target| target["platform"] == "linux" && target.fetch("kind", "binary") == "binary" }
       required << "bsdtar" if selected.values.any? { |target| target.fetch("input").fetch("kind", "archive") == "archive" }
@@ -44,12 +50,12 @@ module NativePackages
     end
 
     def version(value, release)
-      if release && value && version_arg(value) != version_arg(release)
+      if release && value && configuration.package_version(value) != configuration.package_version(release)
         raise Error, "--release and --version disagree"
       end
       value ||= release
       value ||= capture("git", "describe", "--exact-match", "--tags", "HEAD")
-      version_arg(value)
+      configuration.package_version(value)
     rescue Error => error
       raise error if value
       raise Error, "no exact release tag at HEAD; supply --version"
@@ -71,10 +77,14 @@ module NativePackages
       configuration.validate
       selected = configuration.select(ids: ids, formats: formats)
       number = version(value, release)
+      configuration.check_prerelease(number, selected)
+      if release && selected.values.any? { |target| target["native"] }
+        raise Error, "native recipes consume local prepared directories; use --version with native build artifacts"
+      end
       output = Pathname.new(output || root / "dist/packages" / number).expand_path(root)
       if dry_run
         puts JSON.pretty_generate("version" => number, "mode" => release ? "release" : "local", "output" => output.to_s,
-          "targets" => selected.transform_values { |target| target.slice("formats", "platform", "arch", "input", "before_build", "after_package") })
+          "targets" => selected.transform_values { |target| target.slice("formats", "platform", "arch", "input", "before_build", "after_package", "native") })
         return
       end
       raise Error, "output exists: #{output}; choose a fresh --output" if output.exist?
@@ -98,28 +108,54 @@ module NativePackages
           if source.directory? && (output.to_s == source.expand_path.to_s || output.to_s.start_with?(source.expand_path.to_s + File::SEPARATOR))
             raise Error, "package output must be outside the input directory"
           end
-          sources << { "target" => id, "path" => source.to_s, "sha256" => input_digest(source) }
+          native = target["native"] && NativeRecipe.new(root)
+          digest = native ? native.digest(source) : input_digest(source)
+          sources << { "target" => id, "path" => source.to_s, "sha256" => digest }
           Dir.mktmpdir("native-packages-input-") do |directory|
             payload = Pathname.new(directory) / "payload"
-            copy_input(source, payload, input.fetch("kind", "archive"))
+            if native
+              FileUtils.cp_r(source, payload, preserve: true)
+              raise Error, "native input changed while staging" unless native.digest(payload) == digest
+            else
+              copy_input(source, payload, input.fetch("kind", "archive"))
+            end
             target.fetch("formats").each do |format|
-              package = render_tree(configuration.package(target), configuration.target_tokens(info, id, target, payload))
-              package.merge!("name" => configuration.name, "version" => number, "arch" => target.fetch("arch"),
-                "platform" => target.fetch("platform"), "mtime" => info.fetch("DATE"))
-              inspection = Inspection.new(root, configuration.data.fetch("libraries")).check(package, target, format)
-              config_path = Pathname.new(directory) / "nfpm.yaml"
-              write(config_path, YAML.dump(package))
               destination = staging / "packages" / id / format
               destination.mkpath
-              run "nfpm", "package", "--config", config_path, "--packager", format, "--target", destination,
-                env: { "SOURCE_DATE_EPOCH" => info.fetch("SOURCE_DATE_EPOCH").to_s }
-              packages = files(destination)
-              raise Error, "nFPM did not create exactly one #{format} package" unless packages.length == 1
+              if native
+                inspection = native.inspect(payload, target)
+                recipe = target.fetch("native")
+                tokens = configuration.target_tokens(info, id, target, payload)
+                package_path = destination / render(recipe.fetch("output"), tokens)
+                run(*render_tree(recipe.fetch("command"), tokens.merge("PACKAGE" => package_path.to_s, "FORMAT" => format)),
+                  env: { "SOURCE_DATE_EPOCH" => info.fetch("SOURCE_DATE_EPOCH").to_s, "NATIVE_PACKAGES_TARGET" => id, "NATIVE_PACKAGES_VERSION" => number })
+                packages = files(destination)
+                raise Error, "native recipe must create only its declared output" unless packages == [package_path]
+                native.check_output(package_path, format)
+              else
+                package = render_tree(configuration.package(target), configuration.target_tokens(info, id, target, payload))
+                if number.include?("-") && (package.fetch("version_schema", "semver") != "semver" || %w[prerelease version_metadata].any? { |key| package.key?(key) && !package[key].to_s.empty? })
+                  raise Error, "prerelease package versions must use unmodified nFPM semver conversion"
+                end
+                package.merge!("name" => configuration.name, "version" => number, "arch" => target.fetch("arch"),
+                  "platform" => target.fetch("platform"), "mtime" => info.fetch("DATE"))
+                inspection = Inspection.new(root, configuration.data.fetch("libraries")).check(package, target, format)
+                config_path = Pathname.new(directory) / "nfpm.yaml"
+                write(config_path, YAML.dump(package))
+                run "nfpm", "package", "--config", config_path, "--packager", format, "--target", destination,
+                  env: { "SOURCE_DATE_EPOCH" => info.fetch("SOURCE_DATE_EPOCH").to_s }
+                packages = files(destination)
+                raise Error, "nFPM did not create exactly one #{format} package" unless packages.length == 1
+              end
               if target["after_package"]
                 signing = configuration.target_tokens(info, id, target, payload).merge("PACKAGE" => packages.first.to_s, "FORMAT" => format)
                 run(*render_tree(target.fetch("after_package"), signing), env: { "NATIVE_PACKAGES_TARGET" => id, "NATIVE_PACKAGES_VERSION" => number })
                 raise Error, "after_package must preserve the package path and output set" unless files(destination) == packages
               end
+              if native
+                native.check_output(packages.first, format)
+                raise Error, "native recipes/signing must not change their input payload" unless native.digest(payload) == digest
+              end
               records << { "target" => id, "format" => format, "path" => packages.first.relative_path_from(staging).to_s,
                 "sha256" => sha256(packages.first), "validation" => inspection }
             end
@@ -127,7 +163,7 @@ module NativePackages
         end
         recipes = staging / "recipes"
         project.generate(recipes, info)
-        project.check(recipes)
+        project.check(recipes, prerelease: number.include?("-"))
         if !configuration.data.fetch("templates").empty?
           project.recipe_archive(recipes, staging, name: configuration.name, version: number, epoch: info.fetch("SOURCE_DATE_EPOCH"))
           (staging / "packaging-checksums.txt").delete
@@ -217,7 +253,9 @@ module NativePackages
       manifest = JSON.parse((output / "build.json").read)
       raise Error, "unsupported build manifest" unless manifest.fetch("schema") == 1
       raise Error, "build belongs to another project/configuration" unless manifest.fetch("name") == configuration.name && manifest.fetch("configuration") == configuration.digest
-      version_arg(manifest.fetch("version"))
+      number = configuration.package_version(manifest.fetch("version"))
+      selected = configuration.select(ids: manifest.fetch("targets").keys)
+      configuration.check_prerelease(number, selected)
       expected = configuration.targets.transform_values { |target| target.fetch("formats") }
       raise Error, "incomplete target set; aggregate all configured targets before publishing" if complete && manifest.fetch("targets") != expected
       expected_pairs = manifest.fetch("targets").flat_map { |id, formats| formats.map { |format| [id, format] } }.sort
@@ -242,6 +280,11 @@ module NativePackages
       manifest = verify(output)
       raise Error, "supply at least one --to destination" if destinations.empty?
       destinations.each { |name| project.repositories.select(name) unless name == "github" }
+      if manifest.fetch("version").include?("-")
+        raise Error, "prereleases can only attach to an existing GitHub prerelease" unless destinations == ["github"]
+        marked = capture("gh", "release", "view", "v#{manifest.fetch('version')}", "--repo", project.repository, "--json", "isPrerelease", "--jq", ".isPrerelease")
+        raise Error, "destination release must already be marked prerelease" unless marked == "true"
+      end
       destinations.each do |destination|
         if destination == "github"
           paths = manifest.fetch("packages").map { |entry| output / entry.fetch("path") }

data/lib/native_packages/configuration.rb

@@ -5,7 +5,8 @@ require_relative "project"
 module NativePackages
   class Configuration
     include Support
-    FORMATS = %w[deb rpm archlinux apk ipk msix srpm].freeze
+    NATIVE_FORMATS = %w[dmg inno].freeze
+    FORMATS = (%w[deb rpm archlinux apk ipk msix srpm] + NATIVE_FORMATS).freeze
     NFPM_VERSION = "2.47.0"
     NAMES = %w[native-packages.yaml native-packages.yml].freeze
     KEYS = %w[schema tool nfpm targets release assets templates repositories revisions libraries version_file version_section].freeze
@@ -53,6 +54,15 @@ module NativePackages
     def targets = data.fetch("targets")
     def digest = OpenSSL::Digest::SHA256.hexdigest(JSON.generate(data))
     def package(target) = merge(data.fetch("nfpm"), target.fetch("nfpm", {}))
+    def package_version(value) = version_arg(value, prerelease: data.fetch("release").fetch("prereleases", false))
+
+    def check_prerelease(version, selected)
+      return unless version.include?("-")
+      raise Error, "prerelease builds require release.prereleases: true" unless data.fetch("release")["prereleases"] == true
+      unless selected.values.all? { |target| (target.fetch("formats") - %w[deb rpm dmg inno]).empty? } && data.fetch("templates").empty?
+        raise Error, "prereleases support deb, rpm, dmg and inno only, without downstream recipes"
+      end
+    end
 
     def project
       config = { "version" => 1, "name" => name, "repository" => data.fetch("release").fetch("repository", ""),
@@ -69,21 +79,44 @@ module NativePackages
         raise Error, "configuration needs native-packages #{wanted}; run gem install native-packages -v #{wanted}, then native-packages _#{wanted}_ COMMAND"
       end
       raise Error, "unsupported nFPM version; use #{NFPM_VERSION}" unless data.fetch("tool").fetch("nfpm") == NFPM_VERSION
+      if data.fetch("release").key?("prereleases") && ![true, false].include?(data.fetch("release")["prereleases"])
+        raise Error, "release.prereleases must be true or false"
+      end
       metadata = tokens("9.8.7", epoch: 1_767_225_600)
       targets.each do |id, target|
         raise Error, "invalid target name: #{id}" unless /\A[a-z0-9][a-z0-9-]*\z/.match?(id)
-        unknown = target.keys - %w[platform arch libc abi kind formats input nfpm before_build after_package compiler_target]
+        unknown = target.keys - %w[platform arch libc abi kind formats input nfpm before_build after_package compiler_target native]
         raise Error, "targets.#{id}: unknown fields #{unknown.join(', ')}" unless unknown.empty?
         formats = target.fetch("formats")
         unless formats.is_a?(Array) && !formats.empty? && formats.uniq == formats && (formats - FORMATS).empty?
           raise Error, "targets.#{id}.formats: choose from #{FORMATS.join(', ')}"
         end
-        raise Error, "targets.#{id}.platform: use linux or windows" unless %w[linux windows].include?(target.fetch("platform"))
+        raise Error, "targets.#{id}.platform: use linux, windows or macos" unless %w[linux windows macos].include?(target.fetch("platform"))
         raise Error, "targets.#{id}.arch: expected an architecture" unless /\A[a-zA-Z0-9_+-]+\z/.match?(target.fetch("arch"))
         kind = target.fetch("kind", "binary")
         raise Error, "targets.#{id}.kind: use binary, data or source" unless %w[binary data source].include?(kind)
         raise Error, "#{id}: MSIX requires a Windows target with only msix format" if formats.include?("msix") && (target["platform"] != "windows" || formats != ["msix"])
-        raise Error, "#{id}: Windows targets require msix" if target["platform"] == "windows" && formats != ["msix"]
+        raise Error, "#{id}: Windows targets require msix or inno" if target["platform"] == "windows" && ![["msix"], ["inno"]].include?(formats)
+        raise Error, "#{id}: macOS targets require dmg" if target["platform"] == "macos" && formats != ["dmg"]
+        native = !(formats & NATIVE_FORMATS).empty?
+        if native
+          expected = { "dmg" => "macos", "inno" => "windows" }[formats.first]
+          raise Error, "#{id}: native formats require a separate binary target on their native platform" unless formats.length == 1 && expected == target["platform"] && kind == "binary"
+          recipe = mapping(target.fetch("native"), "#{id}.native")
+          raise Error, "#{id}.native: expected command and output" unless recipe.keys.sort == %w[command output]
+          command = recipe["command"]
+          unless command.is_a?(Array) && !command.empty? && command.all? { |part| part.is_a?(String) } && command.any? { |part| part.include?("@PACKAGE@") }
+            raise Error, "#{id}.native.command: use command arguments including @PACKAGE@"
+          end
+          filename = render(recipe.fetch("output"), target_tokens(metadata, id, target, "/payload"))
+          extension = formats == ["dmg"] ? ".dmg" : ".exe"
+          unless /\A[a-zA-Z0-9][a-zA-Z0-9._+-]*\z/.match?(filename) && filename.end_with?(extension)
+            raise Error, "#{id}.native.output: expected a safe #{extension} filename"
+          end
+          render_tree(command, target_tokens(metadata, id, target, "/payload").merge("PACKAGE" => "/output/#{filename}", "FORMAT" => formats.first))
+        elsif target.key?("native")
+          raise Error, "#{id}: native commands require a dmg or inno target"
+        end
         raise Error, "#{id}: SRPM requires a separate source target" if (formats.include?("srpm") && (kind != "source" || formats != ["srpm"])) || (kind == "source" && formats != ["srpm"])
         if kind == "binary" && target["platform"] == "linux"
           raise Error, "#{id}.libc: declare glibc, musl or static" unless %w[glibc musl static].include?(target["libc"])
@@ -92,12 +125,14 @@ module NativePackages
         input = mapping(target.fetch("input"), "#{id}.input")
         raise Error, "#{id}.input: declare local or release_asset" unless input["local"] || input["release_asset"]
         raise Error, "#{id}.input.kind: use file, directory or archive" unless %w[file directory archive].include?(input.fetch("kind", "archive"))
+        raise Error, "#{id}: native packaging requires an input directory" if native && input.fetch("kind", "archive") != "directory"
+        raise Error, "#{id}: native packaging requires input.local" if native && !input["local"]
         %w[before_build after_package].each do |key|
           hook = target[key]
           raise Error, "#{id}.#{key}: use a nonempty array of command arguments" if hook && (!hook.is_a?(Array) || hook.empty? || !hook.all? { |part| part.is_a?(String) })
         end
         rendered = render_tree(package(target), target_tokens(metadata, id, target, "/payload"))
-        raise Error, "#{id}: nfpm.contents must be an array" unless rendered["contents"].is_a?(Array)
+        raise Error, "#{id}: nfpm.contents must be an array" unless native || rendered["contents"].is_a?(Array)
         %w[maintainer description license].each do |key|
           raise Error, "#{id}: fill in nfpm.#{key}" unless rendered[key].is_a?(String) && !rendered[key].strip.empty?
         end

data/lib/native_packages/native_recipe.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require "find"
+
+module NativePackages
+  # Coordinate application-owned native recipes. The gem owns the input copy,
+  # output boundary and manifest; applications retain installer/signing policy.
+  class NativeRecipe
+    include Support
+    MACHO = ["feedface", "feedfacf", "cefaedfe", "cffaedfe", "cafebabe", "bebafeca", "cafebabf", "bfbafeca"].freeze
+    attr_reader :root
+
+    def initialize(root)
+      @root = root
+    end
+
+    def self.host
+      return "windows" if Gem.win_platform?
+      RUBY_PLATFORM.include?("darwin") ? "macos" : "linux"
+    end
+
+    def doctor(target, command)
+      raise Error, "#{target.fetch('platform')} packaging must run on that native host" unless self.class.host == target.fetch("platform")
+      required = [command.first]
+      required << "lipo" if target["platform"] == "macos"
+      missing = required.reject { |tool| available?(tool) || (Pathname.new(tool).absolute? && File.file?(tool) && File.executable?(tool)) }
+      raise Error, "install required native tools: #{missing.join(', ')}" unless missing.empty?
+    end
+
+    def tree(path)
+      path = Pathname.new(path)
+      raise Error, "native input must be a real directory" unless path.directory? && !path.symlink?
+      boundary = path.realpath.to_s + File::SEPARATOR
+      Find.find(path.to_s).sort.map do |name|
+        item = Pathname.new(name)
+        stat = item.lstat
+        relative = item.relative_path_from(path).to_s
+        if stat.symlink?
+          link = item.readlink
+          unless !link.absolute? && item.realpath.to_s.start_with?(boundary)
+            raise Error, "native input symlink leaves the payload: #{relative}"
+          end
+          [relative, "symlink", link.to_s]
+        elsif stat.directory?
+          [relative, "directory", stat.mode & 0o777]
+        elsif stat.file?
+          [relative, "file", stat.mode & 0o777, sha256(item)]
+        else
+          raise Error, "unsupported native input entry: #{relative}"
+        end
+      end
+    rescue Errno::ENOENT, Errno::ELOOP => error
+      raise Error, "invalid native input link or missing entry: #{error.message}"
+    end
+
+    def digest(path) = OpenSSL::Digest::SHA256.hexdigest(JSON.generate(tree(path)))
+
+    def inspect(payload, target)
+      paths = tree(payload).filter_map { |relative, kind, *| payload / relative if kind == "file" }
+      return Inspection.new(root).pe(paths, target) if target["platform"] == "windows"
+      expected = { "amd64" => "x86_64", "arm64" => "arm64", "universal" => "arm64 x86_64" }[target.fetch("arch")]
+      raise Error, "Mach-O inspection supports amd64, arm64 and universal" unless expected
+      binaries = paths.select { |path| MACHO.include?(path.binread(4).unpack1("H*")) }
+      raise Error, "macOS target contains no Mach-O binaries" if binaries.empty?
+      binaries.each do |path|
+        arches = capture("lipo", "-archs", path).split.sort
+        raise Error, "wrong Mach-O architecture: #{path}" unless (expected.split - arches).empty?
+      end
+      { "kind" => "macho", "binaries" => binaries.length, "architecture" => target.fetch("arch"), "dependencies" => "explicit", "installation" => "not-tested" }
+    end
+
+    def check_output(path, format)
+      raise Error, "native recipe must create a regular package file" unless path.file? && !path.symlink?
+      valid = File.open(path, "rb") do |file|
+        if format == "dmg"
+          next false if file.size < 512
+          file.seek(-512, IO::SEEK_END)
+          file.read(4) == "koly"
+        else
+          next false unless file.size >= 64 && file.read(2) == "MZ"
+          file.seek(0x3c)
+          offset = file.read(4).unpack1("L<")
+          next false unless offset >= 64 && offset + 24 <= file.size
+          file.seek(offset)
+          file.read(4) == "PE\0\0"
+        end
+      end
+      raise Error, "native recipe output is not a #{format} container" unless valid
+    end
+  end
+end

data/lib/native_packages/project.rb

@@ -103,11 +103,11 @@ module NativePackages
       write(output / "release.json", JSON.pretty_generate(metadata.sort.to_h) + "\n")
     end
 
-    def check(output)
+    def check(output, prerelease: false)
       output = Pathname.new(output).expand_path
       metadata = JSON.parse((output / "release.json").read)
       raise Error, "prepared recipes belong to another project" unless metadata.fetch("NAME") == package_name
-      version_arg(metadata.fetch("VERSION"))
+      version_arg(metadata.fetch("VERSION"), prerelease: prerelease)
       Dir.mktmpdir("native-packages-check-") do |temporary|
         expected = Pathname.new(temporary)
         generate(expected, metadata)

data/lib/native_packages/support.rb

@@ -12,7 +12,7 @@ require "tmpdir"
 require "yaml"
 
 module NativePackages
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
   class Error < StandardError; end
 
   module Support
@@ -24,7 +24,9 @@ module NativePackages
     end
 
     def capture(*arguments, env: {}, chdir: root)
-      output, error, status = Open3.capture3(env, *arguments.map(&:to_s), chdir: chdir.to_s)
+      # Native tools can emit UTF-8 progress even when an SSH session declares
+      # US-ASCII. Preserve those bytes; locale-dependent strip would raise.
+      output, error, status = Open3.capture3(env, *arguments.map(&:to_s), chdir: chdir.to_s, binmode: true)
       raise Error, "#{arguments.first} failed: #{error.strip}" unless status.success?
       output.strip
     end
@@ -36,9 +38,13 @@ module NativePackages
       end
     end
 
-    def version_arg(value)
+    def version_arg(value, prerelease: false)
       version = value.delete_prefix("v")
-      raise Error, "expected a stable version such as 1.2.3" unless /\A(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)\z/.match?(version)
+      stable = /\A(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)\z/.match?(version)
+      preview = prerelease && /\A(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)-(alpha|beta|rc)\.[1-9]\d*\z/.match?(version)
+      unless stable || preview
+        raise Error, prerelease ? "expected 1.2.3 or 1.2.3-alpha.N, -beta.N or -rc.N" : "expected a stable version such as 1.2.3"
+      end
       version
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: native-packages
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Carmine Paolino
@@ -21,6 +21,7 @@ files:
 - docs/cli-design.md
 - docs/configuration.md
 - docs/legacy.md
+- docs/native-recipes.md
 - docs/platforms.md
 - docs/releasing.md
 - examples/native-packages-all-formats.yaml
@@ -35,6 +36,7 @@ files:
 - lib/native_packages/cli.rb
 - lib/native_packages/configuration.rb
 - lib/native_packages/inspection.rb
+- lib/native_packages/native_recipe.rb
 - lib/native_packages/project.rb
 - lib/native_packages/repositories.rb
 - lib/native_packages/scaffold.rb