ci: FlowAccount release pipeline — signed macOS pkg + Linux rpm/deb - #1
Open
wickstargazer wants to merge 1 commit into
Open
ci: FlowAccount release pipeline — signed macOS pkg + Linux rpm/deb#1wickstargazer wants to merge 1 commit into
wickstargazer wants to merge 1 commit into
Conversation
The fork inherits .goreleaser.yaml and release_files/ but no release automation, because upstream builds its published packages outside this repository. A fork with no workflow produces no artifacts, so there is nothing to deploy from it. goreleaser already covers most of it — universal darwin binaries, plus deb and rpm through nfpms with the existing postinstall and preremove scripts. Only the macOS installer is new: pkgbuild, Developer ID signing and notarization. Adds release_files/darwin_pkg_headless/ as a variant rather than a replacement. Upstream's darwin_pkg/ scripts install /Applications/NetBird.app and quit and relaunch the UI around the install, which is right for a laptop and meaningless on mm-1/2/3 and ryzen where there is no console user. The headless package installs the binary and registers the launchd service using the client's own "service install" subcommand — rather than hand-rolling a plist that would drift from upstream — and stops there. It deliberately does NOT bring the peer up. Joining the mesh needs a setup key, and baking one into a package makes it a reusable bearer credential shipped to every machine: anything that can read the package can join the network. Enrolment stays a per-host step with a one-off key. The macOS job fails loudly when signing secrets are absent rather than producing an uninstallable package. An unsigned or un-notarized pkg is blocked by Gatekeeper and would also be refused by the fleet's Santa rules and System Extensions profile, so shipping one wastes more time than the failed build. Blocked on an Apple Developer Program membership, which also unblocks signing the CrewOps daemon and Tray for ADR-009. One purchase, two blockers.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a release pipeline so the fork can actually produce deployable artifacts.
Why
The fork inherits
.goreleaser.yamlandrelease_files/but no release automation — upstream builds its published packages outside this repository. A fork with no workflow produces nothing to deploy.What it produces
Linux is nearly free — goreleaser already builds
debandrpmvianfpmsusing upstream's ownpost_install.shandpre_remove.sh. Only the macOS installer is new.Headless vs GUI packaging
release_files/darwin_pkg_headless/is a variant, not a replacement. Upstream'sdarwin_pkg/scripts install/Applications/NetBird.appand quit/relaunch the UI around the install — correct for a laptop, meaningless onmm-1/2/3andryzenwhere there is no console user.The headless package installs the binary and registers the launchd service using the client's own
service installsubcommand, rather than hand-rolling a plist that would drift from upstream.It deliberately does not bring the peer up
Joining the mesh needs a setup key. Baking one into a package makes it a reusable bearer credential shipped to every machine — anything that can read the package can join the network. Enrolment stays a per-host step with a one-off key.
Blocked on
An Apple Developer Program membership for Developer ID certificates. Apple requires MDM-deployed packages to be signed with a Developer ID Installer cert; unsigned ones fail to install, and there is no user present to click through a warning. Our own Santa policy and System Extensions profile also key on signing identity.
The macOS job fails loudly when secrets are absent rather than producing an uninstallable package — a build that "succeeds" and yields a
.pkgnobody can install wastes more time than a red X.Secrets required are documented in the workflow header. Setup brief for whoever holds Apple Developer access is in
incident-2026-08/handoff/apple-signing-brief.md.Version pinning
Client must match the management server.
flowaccount.infrastructurepinsnetbirdio/netbird-server:0.76.3. A client ahead of its server is unsupported and fails quietly — the peer connects, looks healthy, does not route correctly.Worth a reviewer's judgement
release_files/darwin_pkg_headless/README.mdrecords that having the fork and building from it are separate decisions. The fork is insurance against an upstream licence change. Building from it means owning NetBird security patches on the component that gates all network access — which ADR-010 inflowaccount.infrastructureexplicitly declined for that reason.If the fleet ships from these artifacts, someone needs to own tracking upstream security releases. That ownership should be named before the first machine is deployed from here.
🤖 Generated with Claude Code