Skip to content

Improve bundling libssh2 for mac#10

Open
eddymoulton wants to merge 4 commits intooctopus/masterfrom
em/octopus-em-attempt-bundling-for-mac
Open

Improve bundling libssh2 for mac#10
eddymoulton wants to merge 4 commits intooctopus/masterfrom
em/octopus-em-attempt-bundling-for-mac

Conversation

@eddymoulton
Copy link
Copy Markdown
Collaborator

@eddymoulton eddymoulton commented Apr 28, 2026

For just Mac (not linux or windows) we are able to include all of the required binaries alongside libgit2 so users don't need to bring their own.

This not desirable for Linux or Windows because we want to allow users to bring their own crypto library for FIPS compliance, which those builds already do.

Because we do not ship a version of Octopus server for Mac (it's only used for development), we can accept that we include the crypto library with this package.

@eddymoulton eddymoulton changed the title Attempt bundling libssh2 for mac Improve bundling libssh2 for mac Apr 30, 2026
@eddymoulton eddymoulton marked this pull request as ready for review April 30, 2026 06:37
Copy link
Copy Markdown

@liam-mackie liam-mackie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Comment thread build.libgit2.sh

is_homebrew_path() {
case "$1" in
/opt/homebrew/*|/usr/local/Cellar/*|/usr/local/opt/*) return 0 ;;
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
/opt/homebrew/*|/usr/local/Cellar/*|/usr/local/opt/*) return 0 ;;
/opt/homebrew/*|/usr/local/Cellar/*) return 0 ;;

Consider not including /usr/local/opt/* so that we don't accidentally bundle libraries that come from tools like xcode (and so might have dependencies across osx versions)

Comment thread build.libgit2.sh

# Ad-hoc re-sign — install_name_tool invalidates the existing signature, which is fatal on Apple Silicon.
for DYLIB in "$NATIVE_DIR"/*.dylib; do
codesign --force --sign - "$DYLIB"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

May be worth checking that this works on laptops that don't have arm64e signing exclusions in their NVRAM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants