native-packages 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ccc727393fcd07bd511465e0b2c46b19679a387b6ffee081693231061424fbd9
-  data.tar.gz: 9a402ad593dd1035f1ab350e9cdc1a81292f0976303d6454c2ad9a3ecc53ae91
+  metadata.gz: 1c07643e9e68f0b147f4e0e53867fb60bb19364460e8b8959aae3cb590cc495e
+  data.tar.gz: e7bc9be87ac919c2f943ad26c9076825c990cc8ffccdbb84afb86ed436caa1af
 SHA512:
-  metadata.gz: ee7950fbfd3a6d8e8d934e2c51a2620e717644c30803d660617d3e44d9c2274819fdc37dd815208493244b553976df685d2d3ec2d129eede0301bb61f7dd80d5
-  data.tar.gz: a57e20ba12b60b53bcbe0b9e5d896fb874d2535ae73f6f24a03b067ef9310eb35133bd51654d29a58d6e2990577a7dd6d4d056bf796ed44905c00866a087d983
+  metadata.gz: fa5823b8ee458ebf4b751dc5693ad5d7d47c356a4a99791a44dda34285aafb89ae60f75ac16ac8a7b0e0d318131ed5d73448e16515e9c52cffb6edd497296cf6
+  data.tar.gz: 37440431bcf73aec4eee92929f42fa8b42fe37b4b2911c744ee51ebf643bafd7a34ccc56eb74bca492795a5756b4cae2b203def2fb486b8c6c170ee3bd876e14

data/README.md

@@ -46,7 +46,9 @@ targets:
       release_asset: my-app_@VERSION@_linux_amd64.tar.gz
 ```
 
-`build` creates all configured outputs. `--target ID` and `--format FORMAT` select a subset; repeat either option for several values. A missing target input fails the build.
+`build` creates all configured outputs. `--target ID` and `--format FORMAT` select a subset; repeat either option for several values. A missing selected target input fails the build. `publish --target ID` requires
+every format for exactly the requested targets, while publication without a
+selection still requires all configured targets.
 
 Inputs support `kind: archive` (default), `directory` or `file`. Paths resolve from the configuration directory. Targets can add `nfpm` overrides; maps merge recursively and arrays replace. `nfpm` can also reference a separate YAML file. `.yml` and `--config FILE` are supported.
 
@@ -92,7 +94,8 @@ Since 0.4.0, `build --defer-recipes` lets each platform package its
 own inputs without acquiring global recipe assets or requiring AUR tools.
 Then `aggregate --finalize-recipes` generates the downstream recipes once,
 using hashes of the completed packages. This allows a Homebrew cask to reference
-the DMG being built in the same release. Deferred builds cannot be published.
+the DMG being built in the same release. Deferred builds cannot be published. Native prerelease jobs may defer the
+stable recipes in a shared configuration; those recipes remain stable-only.
 See [deferred recipe generation](docs/configuration.md#deferred-recipe-generation)
 for the finalizer's inputs and checks.
 
@@ -107,7 +110,7 @@ packaging:
   needs: release
   permissions:
     contents: write
-  uses: crmne/native-packages/.github/workflows/package.yml@v0.5.0
+  uses: crmne/native-packages/.github/workflows/package.yml@v0.6.0
   with:
     version: ${{ github.ref_name }}
     publish: true
@@ -116,6 +119,8 @@ packaging:
 
 Pin the corresponding commit SHA for an immutable workflow reference. With no version, the workflow validates configuration only. With a version, it installs the configured gem and nFPM, builds packages and uploads an Actions artifact. `publish: true` attaches packages to the existing release.
 
+Separate configurations have independent concurrency groups. A workflow can validate its stable, alpha and macOS configurations without one queued call cancelling another. The released `v0.5.0` workflow predates this fix; serialize multiple calls with `needs` when using that tag or its commit.
+
 To consume an Actions artifact instead, set `source-artifact` and, if necessary, `source-directory` (default `dist`). Its files must match the local input paths in the configuration. This workflow packages on Linux, including MSIX creation from Windows binaries; native application builds and platform-specific signing jobs can use the CLI separately.
 
 AUR publication additionally requires `PUBLISH_AUR=true`, `AUR_SSH_KEY` and `AUR_KNOWN_HOSTS`. Homebrew publication requires `PUBLISH_HOMEBREW=true` and `HOMEBREW_TAP_GITHUB_TOKEN`. Keep existing GoReleaser publishers for destinations they already own.
@@ -133,9 +138,14 @@ Migration combines `packaging/project.yml`, its nFPM definition and repository r
 bundle install
 bundle exec ruby -Ilib -e 'Dir["test/*_test.rb"].sort.each { |path| require_relative path }'
 gem build native-packages.gemspec
-ruby test/gem_install.rb native-packages-0.5.0.gem
+ruby test/gem_install.rb native-packages-0.6.0.gem
 ```
 
 Tests build real packages, inspect their payloads and exercise repository publication against local Git fixtures. CI additionally runs disposable Linux install/upgrade/remove checks, SRPM rebuilds and Windows MSIX acceptance. Runtime build manifests report installation as `not-tested`: CI fixture coverage is not a substitute for testing each application's packages.
 
 The [design document](docs/cli-design.md) records the agreed direction. [Gem release setup](docs/releasing.md) explains the RubyLLM-style token setup and GitHub release workflow.
+
+For one configuration spanning native hosts, select the Linux target IDs in the
+reusable workflow's `targets` input. Native release jobs use the same config
+with `build --target macos-universal --defer-recipes` on the Mac. See
+[one configuration across native hosts](docs/configuration.md#one-configuration-across-native-hosts).

data/docs/apple-notarization.md

@@ -31,8 +31,12 @@ native-packages --config native-packages.macos.yaml build \
 ```
 
 The gem imports the certificate and notary credentials into a fresh, temporary
-keychain. It never replaces the default keychain or its search list, and deletes
-its keychain after success or failure. Credential values are excluded from
+keychain. Since 0.5.1, it adds that keychain to the user's search list when needed
+on a clean runner, retaining existing entries and leaving the default keychain
+unchanged. Signing calls under the same OS user share a lock, so parallel native
+packaging hooks wait for the active signing call instead of racing search-list
+updates. It deletes only its own keychain and search-list entry after success or
+failure, preserving keychains added by other processes. Credential values are excluded from
 manifests and redacted from tool errors.
 
 The input is copied and checked before signing. All Mach-O code and nested

data/docs/configuration.md

@@ -124,3 +124,39 @@ output. Existing destinations are never overwritten.
 Deferral does not enable stable downstream recipes in a prerelease configuration.
 The existing preview-format and stable-recipe restrictions still apply. Use a
 preview configuration without downstream templates when building previews.
+
+## One configuration across native hosts
+
+Keep Linux, macOS and Windows targets in the same `native-packages.yaml`.
+Build native inputs on their native host. Use `--defer-recipes` there when
+stable distribution recipes need assets that have not yet been published:
+
+```sh
+native-packages build --version 1.2.3 --target macos-universal --defer-recipes
+```
+
+The application's release job may collect that native output directly. If it
+uses the shared Linux packaging workflow afterward, set its `targets` input
+to the complete Linux target IDs, for example `linux-amd64,linux-arm64`.
+The workflow passes that exact selection to both build and publication.
+An empty input retains the original all-target behavior. Native targets still
+require their native host; selecting a Mac target does not turn an Ubuntu job
+into a Mac runner.
+
+The corresponding CLI publication is explicit:
+
+```sh
+native-packages build --release v1.2.3 --target linux-amd64 --target linux-arm64
+native-packages publish --from dist/packages/1.2.3 --to github \
+  --target linux-amd64 --target linux-arm64
+```
+
+Every format for every selected target must be present, and no extra targets
+may be in that build. Unknown IDs, missing formats, altered files, unfinished
+recipes and configuration mismatches still fail before publication. Omitting
+`--target` requires all targets from the configuration. This does not authorize
+publishing an arbitrary partial build.
+
+With `release.prereleases: true`, `--defer-recipes` also permits a native
+prerelease to share its config with stable AUR/Homebrew templates. Those
+recipes remain deferred and cannot be finalized or published for a prerelease.

data/docs/native-recipes.md

@@ -10,7 +10,7 @@ See [Apple notarization](apple-notarization.md).
 ```yaml
 schema: 1
 tool:
-  version: '0.5.0'
+  version: '0.6.0'
   nfpm: '2.47.0'
 nfpm:
   name: example-app

data/docs/releasing.md

@@ -23,7 +23,7 @@ Update the gemspec, `NativePackages::VERSION`, example/version references and ch
 Create a GitHub release for that commit:
 
 ```sh
-gh release create v0.4.0 --target main --title 'native-packages 0.4.0' --notes-file release-notes.md
+gh release create v0.6.0 --target main --title 'native-packages 0.6.0' --notes-file release-notes.md
 ```
 
 Adding `--draft` permits review before publication and does not trigger the publisher. The tag must match the exact gem version and point to a commit on `main`. Set `--prerelease` only for a prerelease gem version.

data/examples/native-packages-all-formats.yaml

@@ -1,7 +1,7 @@
 # Supply the listed build outputs before running this example.
 schema: 1
 tool:
-  version: '0.5.0'
+  version: '0.6.0'
   nfpm: '2.47.0'
 nfpm:
   name: example-app

data/examples/native-packages.yaml

@@ -1,6 +1,6 @@
 schema: 1
 tool:
-  version: '0.5.0'
+  version: '0.6.0'
   nfpm: '2.47.0'
 nfpm:
   name: example-app

data/lib/native_packages/build.rb

@@ -85,7 +85,7 @@ module NativePackages
       configuration.validate
       selected = configuration.select(ids: ids, formats: formats)
       number = version(value, release)
-      configuration.check_prerelease(number, selected)
+      configuration.check_prerelease(number, selected, defer_recipes: defer_recipes)
       if release && selected.values.any? { |target| target["native"] }
         raise Error, "native recipes consume local prepared directories; use --version with native build artifacts"
       end
@@ -330,16 +330,16 @@ module NativePackages
       raise Error, "missing recipe outputs: #{missing.join(', ')}" unless missing.empty?
     end
 
-    def verify(output, complete: true)
+    def verify(output, complete: true, ids: [])
       output = Pathname.new(output).expand_path(root)
       manifest = JSON.parse((output / "build.json").read)
       raise Error, "unsupported build manifest" unless manifest.fetch("schema") == 1
       raise Error, "build belongs to another project/configuration" unless manifest.fetch("name") == configuration.name && manifest.fetch("configuration") == configuration.digest
       number = configuration.package_version(manifest.fetch("version"))
       selected = configuration.select(ids: manifest.fetch("targets").keys)
-      configuration.check_prerelease(number, selected)
-      expected = configuration.targets.transform_values { |target| target.fetch("formats") }
-      raise Error, "incomplete target set; aggregate all configured targets before publishing" if complete && manifest.fetch("targets") != expected
+      configuration.check_prerelease(number, selected, defer_recipes: manifest.dig("recipes", "state") == "deferred")
+      expected = configuration.select(ids: ids).transform_values { |target| target.fetch("formats") }
+      raise Error, "incomplete target set; supply every format for all requested targets before publishing" if complete && manifest.fetch("targets") != expected
       expected_pairs = manifest.fetch("targets").flat_map { |id, formats| formats.map { |format| [id, format] } }.sort
       actual_pairs = manifest.fetch("packages").map { |entry| entry.values_at("target", "format") }.sort
       raise Error, "manifest packages do not match its target set" unless actual_pairs == expected_pairs
@@ -357,10 +357,10 @@ module NativePackages
       manifest
     end
 
-    def publish(output, destinations, body_file: nil)
+    def publish(output, destinations, body_file: nil, ids: [])
       configuration.validate
       output = Pathname.new(output).expand_path(root)
-      manifest = verify(output)
+      manifest = verify(output, ids: ids)
       raise Error, "supply at least one --to destination" if destinations.empty?
       destinations.each { |name| project.repositories.select(name) unless name == "github" }
       if manifest.fetch("version").include?("-")

data/lib/native_packages/cli.rb

@@ -18,6 +18,7 @@ module NativePackages
         aggregate DIR... --output DIRECTORY        Combine target builds before publishing
           [--finalize-recipes]                    Generate recipes from deferred builds
         publish --from DIRECTORY --to github,aur   Publish a complete, verified build
+          [--target ID]                           Require exactly these complete targets
         migrate [--dry-run]                        Convert packaging/project.yml
         repositories                               List downstream destinations
         stage TARGET DIRECTORY                     Stage prepared recipes
@@ -49,8 +50,8 @@ module NativePackages
         flags.on("--help", "-h") { puts HELP; return }
         flags.on("--output DIRECTORY") { |value| options[:output] = Pathname.new(value).expand_path(root) } if %w[build aggregate artifacts prepare notarize-macos].include?(command)
         flags.on("--body-file FILE") { |value| options[:body_file] = Pathname.new(value).expand_path(root) } if command == "publish"
+        flags.on("--target ID") { |value| options[:ids] << value } if %w[build doctor publish].include?(command)
         if %w[build doctor].include?(command)
-          flags.on("--target ID") { |value| options[:ids] << value }
           flags.on("--format FORMAT") { |value| options[:formats] << value }
           flags.on("--release TAG") { |value| options[:release] = value }
           flags.on("--defer-recipes") { options[:defer_recipes] = true }
@@ -77,6 +78,7 @@ module NativePackages
         end
       end
       parser.parse!(arguments)
+      raise Error, "publish --target requires --from" if command == "publish" && !options[:from] && !options[:ids].empty?
       arity = { "init" => 0..0, "migrate" => 0..0, "build" => 0..0, "doctor" => 0..0, "aggregate" => 1..,
         "prepare" => 1..1, "check" => 1..1, "artifacts" => 1..1, "publish-release" => 2..2,
         "notarize-macos" => 1..1, "repositories" => 0..0, "stage" => 2..2, "diff" => 1..1, "publish" => options[:from] ? 0..0 : 1..1,
@@ -104,7 +106,7 @@ module NativePackages
         when "aggregate"
           raise Error, "aggregate requires --output" unless options[:output]
           return builder.aggregate(arguments, output: options.fetch(:output), finalize_recipes: options.fetch(:finalize_recipes, false))
-        when "publish" then return builder.publish(options.fetch(:from), options.fetch(:destinations), body_file: options[:body_file])
+        when "publish" then return builder.publish(options.fetch(:from), options.fetch(:destinations), body_file: options[:body_file], ids: options[:ids])
         end
       end
       if configuration

data/lib/native_packages/configuration.rb

@@ -56,10 +56,10 @@ module NativePackages
     def package(target) = merge(data.fetch("nfpm"), target.fetch("nfpm", {}))
     def package_version(value) = version_arg(value, prerelease: data.fetch("release").fetch("prereleases", false))
 
-    def check_prerelease(version, selected)
+    def check_prerelease(version, selected, defer_recipes: false)
       return unless version.include?("-")
       raise Error, "prerelease builds require release.prereleases: true" unless data.fetch("release")["prereleases"] == true
-      unless selected.values.all? { |target| (target.fetch("formats") - %w[deb rpm dmg inno]).empty? } && data.fetch("templates").empty?
+      unless selected.values.all? { |target| (target.fetch("formats") - %w[deb rpm dmg inno]).empty? } && (defer_recipes || data.fetch("templates").empty?)
         raise Error, "prereleases support deb, rpm, dmg and inno only, without downstream recipes"
       end
     end

data/lib/native_packages/macos_signing.rb

@@ -41,6 +41,21 @@ module NativePackages
     def with_identity
       doctor
       return yield(nil) unless enabled?
+      # The search list belongs to the OS user, not this project. Coordinate
+      # our signing calls across checkouts, including parallel packaging hooks.
+      lock_path = signing_lock_path
+      FileUtils.mkdir_p(lock_path.dirname, mode: 0o700)
+      File.open(lock_path, File::RDWR | File::CREAT, 0o600) do |lock|
+        lock.flock(File::LOCK_EX)
+        with_temporary_identity { yield self }
+      end
+    end
+
+    private def signing_lock_path
+      Pathname.new(Dir.home) / "Library/Caches/native-packages/macos-signing.lock"
+    end
+
+    private def with_temporary_identity
       Dir.mktmpdir("native-packages-signing-") do |directory|
         @keychain = Pathname.new(directory) / "signing.keychain-db"
         certificate = Pathname.new(directory) / "certificate.p12"
@@ -49,6 +64,12 @@ module NativePackages
         @redactions << password
         begin
           execute "security", "create-keychain", "-p", password, @keychain
+          # Clean runners may not add new keychains to the user search list.
+          # codesign needs that entry even when given an explicit --keychain.
+          search_list = Shellwords.shellsplit(execute("security", "list-keychains", "-d", "user"))
+          unless search_list.any? { |path| File.identical?(path, @keychain) }
+            execute "security", "list-keychains", "-d", "user", "-s", *search_list, @keychain
+          end
           execute "security", "set-keychain-settings", "-lut", "21600", @keychain
           execute "security", "unlock-keychain", "-p", password, @keychain
           execute "security", "import", certificate, "-k", @keychain,
@@ -63,8 +84,8 @@ module NativePackages
             "--password", @credentials.fetch("APPLE_APP_PASSWORD")
           yield self
         ensure
-          # Never replace the user's search list or default keychain. Deleting
-          # just this keychain also removes its own entry from the search list.
+          # delete-keychain removes only this keychain and its search-list entry.
+          # Never restore an old list over keychains added by another process.
           execute "security", "delete-keychain", @keychain if @keychain.exist?
           @keychain = nil
         end

data/lib/native_packages/support.rb

@@ -12,7 +12,7 @@ require "tmpdir"
 require "yaml"
 
 module NativePackages
-  VERSION = "0.5.0"
+  VERSION = "0.6.0"
   class Error < StandardError; end
 
   module Support

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: native-packages
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Carmine Paolino