From 9b5407f3970204372d694776a24e65ae8844770f Mon Sep 17 00:00:00 2001 From: Etienne Lescot Date: Fri, 4 Sep 2026 17:12:03 +0200 Subject: [PATCH] fix(macos): serve ONNX Runtime from a build that respects the 13.0 floor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `npm run build:mac` could not package at all. Microsoft's published `onnxruntime-osx-arm64-1.27.1.tgz` is built with `minos 14.0`, the app declares a 13.0 floor, and `before-pack.cjs` refuses a payload that demands more than the app promises — correctly, since the deployment target decides which symbols the linker resolves against the OS rather than emitting locally (#515). No published release fixes it: every one from 1.24 on is 14.0, and every one before it is at least 13.3. So the archive now comes from `build-onnxruntime-macos.yml`, which builds the same upstream commit with the target pinned, checks `minos` and the ABI surface, and attests provenance. Only the origin of the bytes moves; the URL is still immutable and the SHA-256 is still verified before the archive is opened. Also stops that workflow from triggering on tag pushes: `on.push` had `paths:` but no `branches:`, so publishing the artifact under its own tag started a fresh 22-minute build of what had just been attached to the release. Closes #591 --- .github/workflows/build-onnxruntime-macos.yml | 5 +++++ scripts/fetch-onnxruntime.mjs | 22 ++++++++++++++++++- 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-onnxruntime-macos.yml b/.github/workflows/build-onnxruntime-macos.yml index bfa12b7e8..22aef9432 100644 --- a/.github/workflows/build-onnxruntime-macos.yml +++ b/.github/workflows/build-onnxruntime-macos.yml @@ -34,6 +34,11 @@ name: Build ONNX Runtime (macOS 13 floor) on: workflow_dispatch: push: + # BRANCHES ONLY. Without this, pushing a tag matches too — and publishing the + # artifact under `v0.0.0-onnxruntime-1.27.1` started a fresh 22-minute build of + # the very thing that had just been attached to the release. + branches: + - main paths: - ".github/workflows/build-onnxruntime-macos.yml" - "scripts/fetch-onnxruntime.mjs" diff --git a/scripts/fetch-onnxruntime.mjs b/scripts/fetch-onnxruntime.mjs index 674c34040..b97af4d40 100644 --- a/scripts/fetch-onnxruntime.mjs +++ b/scripts/fetch-onnxruntime.mjs @@ -114,12 +114,32 @@ const PINNED = { member: "onnxruntime.dll", out: "onnxruntime.dll", }, + // The one target that does NOT come from upstream, and it is not a preference. + // Microsoft's `onnxruntime-osx-arm64-1.27.1.tgz` is built for macOS 14, this app + // declares a 13.0 floor, and `before-pack.cjs` refuses a payload demanding more — + // correctly, since the deployment target decides which symbols the linker resolves + // against the OS rather than emitting locally (#515). So `npm run build:mac` could + // not package at all. No published release fixes that: every one from 1.24 on is + // `minos 14.0`, and every one before it is at least 13.3. + // + // This one is built by `.github/workflows/build-onnxruntime-macos.yml` from the + // commit above, with the deployment target pinned, and published under a + // `v0.0.0-*` tag — the marker this repo already uses for a binary that needs a + // permanent URL but is not a product version. Its provenance is attested: + // + // gh attestation verify onnxruntime-osx-arm64-1.27.1.tgz --repo getopenscreen/openscreen + // + // Everything else about it is unchanged: immutable URL, SHA-256 verified before + // the archive is opened. What moved is who built the bytes, not how far they are + // trusted. "darwin-arm64": { slug: "osx-arm64", ext: "tgz", - sha256: "e42b77a7281cc6e55141bf44fcfbac2c782b823a491bbb6ac33c781dd991f8a6", + sha256: "b8b7e62786eea42fc867bdbc2d3f573655a4b0e602c6938c4cea151a9ef71623", member: `libonnxruntime.${VERSION}.dylib`, out: "libonnxruntime.dylib", + baseUrl: + "https://github.com/getopenscreen/openscreen/releases/download/v0.0.0-onnxruntime-1.27.1", }, // Linux is wired into `build:linux` since its back-end gained the capture half // (`capture_webcam_rgb` + `set_webcam_mask` in `compositor_linux.rs`). Until