macadmins / macadmins/python

Replace munki-pkg with swiftpkg for managed Python packaging

Offen
#94 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Dieses Issue hat noch niemand übernommen.

Vorherrschende Sprache
Shell
Sterne
257
Forks
29
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

## Objective
Migrate this repository's managed Python installer packaging to [codecarton/swiftpkg](https://github.com/codecarton/swiftpkg) and retire the munki-pkg build dependency.

## Current behavior
`build_python_framework_pkgs.zsh` downloads a pinned munki-pkg commit using `MP_SHA`, `MP_BINDIR`, and `MP_ZIP`. Its `build_pkg()` function generates `recommended/build-info.json`, stages `preinstall-cleanup`, invokes `munkipkg`, and moves the signed package into `outputs/`. Notarization and stapling run separately. Without an installer identity, the script skips package creation and still produces the framework ZIP.

## Implementation scope
- Select and pin a published swiftpkg CLI release compatible with Apple Silicon build hosts; verify the downloaded artifact against a pinned SHA-256 and document prerequisites.
- Replace the munki-pkg download, temporary paths, and invocation with swiftpkg; propagate failures clearly.
- Validate compatibility of every generated build-info setting, especially `ownership`, `suppress_bundle_relocation`, `preserve_xattr`, `distribution_style`, and `signing_info`. Implement equivalent behavior for any unsupported settings.
- Preserve the package identifier (`io.macadmins.python.recommended`), version derivation, output filename/location, payload layout, permissions, symlinks, extended attributes, and preinstall cleanup behavior.
- Preserve framework code signing and the existing installer signing/notarization/stapling sequence; avoid duplicate notarization.
- Ensure Python 3.11, 3.12, 3.13, and 3.14 workflows use the replacement and continue publishing expected artifacts; update workflows only where necessary.
- Update README build prerequisites and credits. Remove active munki-pkg dependencies and obsolete bootstrap references while retaining appropriate historical attribution.

## Acceptance criteria
- [ ] Local and CI packaging use the pinned swiftpkg CLI with verified artifact integrity; no active build path downloads or executes munki-pkg.
- [ ] All generated build-info options have verified equivalent behavior, with any migration differences documented.
- [ ] On Apple Silicon, inspect a baseline munki-pkg package and replacement package to confirm equivalent receipts, version, install paths, payload, ownership/modes, symlinks, extended attributes, installer scripts, and non-relocation behavior.
- [ ] Signed packages pass signature checks, notarization, and stapling validation using the existing signing credentials.
- [ ] Clean-install and upgrade smoke tests on a disposable Apple Silicon Mac confirm preinstall cleanup, framework installation at `/Library/ManagedFrameworks/Python/Python3.framework`, the `managed_python3` symlink, and execution/imports of the managed runtime and bundled dependencies.
- [ ] The no-installer-identity path continues producing the framework ZIP without requiring signing credentials.
- [ ] Each supported Python workflow builds and publishes the expected package artifact.
- [ ] `zsh -n build_python_framework_pkgs.zsh` passes; any modified workflow YAML parses successfully.
- [ ] README documents the replacement tool, pinned version/update procedure, and prerequisites.

## Boundaries
This change replaces the package builder. It does not remove support for deploying the resulting installer through Munki, change Python/runtime dependencies, add the Swiftpkgr desktop app, or change the managed framework's installation contract.

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Erste Schritte

  1. Lies das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreib ins Issue, dass du es übernimmst — das erspart doppelte Arbeit.
  3. Forke das Repository und arbeite in einem Branch.
  4. Öffne einen Pull Request, der die Issue-Nummer nennt.

Rechercherichtung

Beginnen Sie mit build_python_framework_pkgs.zsh, insbesondere mit build_pkg(), den munki-pkg-Bootstrap-Variablen und der bestehenden Generierung von build-info.json. Untersuchen Sie anschließend die Workflow-Dateien für Python 3.11–3.14 und die Voraussetzungen im README. Vergleichen Sie Baseline- und Ersatzpakete auf Apple Silicon und verwenden Sie die aufgeführten Prüfungen für Shell, Signierung, Notarisierung, Smoke-Tests und Artefakte, um den Abschluss zu verifizieren.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
shell
Bereich
build-system, ci-cd, tooling
Issue-Typ
Refactoring
Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Aktivitätsstatus
Aktiv
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
35/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.