From de069d1bfaad303fdc1b249d2288a91bb756ecb5 Mon Sep 17 00:00:00 2001 From: Matthew John Cheetham Date: Thu, 8 Oct 2026 15:45:16 +0100 Subject: [PATCH 1/2] release: install native Rust for macOS builds The new ACES macOS image does not include Rust or rustup, so release builds can no longer rely on the previous image's preinstalled tools. Native Homebrew Rust supplies Cargo and the host standard library, making rustup target installation unnecessary. An explicit Rust target keeps the static archive aligned with the C objects, while checking for its libraries provides a clear failure before starting the build. Keep the host, C and Rust architecture names together in the macOS matrix so compilation, packaging and validation stay aligned. The existing ARM64-only output is unchanged. Signed-off-by: Matthew John Cheetham --- .azure-pipelines/release.yml | 63 +++++++++++++++++++++--------------- 1 file changed, 37 insertions(+), 26 deletions(-) diff --git a/.azure-pipelines/release.yml b/.azure-pipelines/release.yml index 07d274c4933f34..e506315a71eb48 100644 --- a/.azure-pipelines/release.yml +++ b/.azure-pipelines/release.yml @@ -70,6 +70,9 @@ parameters: # Use the image override to issue a demand as this is a self-hosted pool imageOverride: ACES_VM_SharedPool_GoldenGate os: macos + cpu_arch: arm64 + rustc_target: aarch64-apple-darwin + cc_arch: arm64 - name: linux_matrix type: object @@ -694,6 +697,9 @@ extends: tag_name: $[stageDependencies.prereqs.prebuild.outputs['info.tag_name']] tag_sha: $[stageDependencies.prereqs.prebuild.outputs['info.tag_sha']] git_version: $[stageDependencies.prereqs.prebuild.outputs['info.git_version']] + cpu_arch: ${{ dim.cpu_arch }} + cc_arch: ${{ dim.cc_arch }} + rustc_target: ${{ dim.rustc_target }} templateContext: outputs: - output: pipelineArtifact @@ -701,11 +707,11 @@ extends: artifactName: '${{ dim.id }}' # macOS build flow: # - # 1. Configure for an ARM64 build and produce + # 1. Configure for an $(cc_arch) build and produce # Git's own dist tarballs (`make dist dist-doc`). # 2. Extract the source tarball into payload/, copy # config.mak in, run `make payload` to compile and - # install into stage/git-arm64-/. + # install into stage/git-$(cc_arch)-/. # 3. Mirror stage/ into build-artifacts/ (which is # what the macos-installer Makefile's `pkg` target # consumes - see note in the build step). @@ -732,11 +738,11 @@ extends: script: | set -euo pipefail - # Ensure native Homebrew (arm64) is up-to-date beforehand. + # Ensure native Homebrew is up-to-date beforehand. HOMEBREW_NO_AUTO_UPDATE='' brew update - # Native (arm64) build dependencies. - brew install automake asciidoc xmlto docbook gettext + # Native build dependencies. + brew install automake asciidoc xmlto docbook gettext rust brew link --force gettext # Use the native static libintl.a. It depends on @@ -744,7 +750,7 @@ extends: # Homebrew's incompatible _libiconv* symbols. cp "$(brew --prefix gettext)/lib/libintl.a" libintl.a - task: Bash@3 - displayName: 'Configure ARM64 build' + displayName: 'Configure $(cc_arch) build' inputs: targetType: inline script: | @@ -756,8 +762,8 @@ extends: echo "$BUILD_VERSION" >version cat >config.mak </ + # the install tree at stage/git-$(cc_arch)-/ # but its `pkg` target packages from # build-artifacts/. Copy the tree across so the # pipeline (signing, pkg) finds it where the @@ -874,9 +885,9 @@ extends: # installer Makefiles out of .github/ (they are # build infrastructure, not GitHub-specific). mkdir -p .github/macos-installer/build-artifacts - cp -R "stage/git-arm64-$BUILD_VERSION/." \ + cp -R "stage/git-$(cc_arch)-$BUILD_VERSION/." \ .github/macos-installer/build-artifacts/ - # ESRP-sign the ARM64 Mach-O binaries inside the + # ESRP-sign the Mach-O binaries inside the # payload tree. The existing esrp/sign.yml template's # CopyFiles@2 step uses minimatch globs and the only # reliable way to detect Mach-O is by file content @@ -962,7 +973,7 @@ extends: # (the `ifdef APPLE_INSTALLER_IDENTITY` branch in # pkg_cmd is skipped). ESRP signs it in the next # step. - make -C .github/macos-installer V=1 ARCH_UNIV=arm64 pkg + make -C .github/macos-installer V=1 ARCH_UNIV=${{ dim.cc_arch }} pkg - ${{ if eq(parameters.esrp, true) }}: - template: .azure-pipelines/esrp/sign.yml@self parameters: @@ -1012,9 +1023,9 @@ extends: VERSION="$(git_version)" export VERSION - # Builds git--arm64.dmg from disk-image/, + # Builds git--$(cc_arch).dmg from disk-image/, # which contains the signed and notarized .pkg. - make -C .github/macos-installer V=1 ARCH_UNIV=arm64 image + make -C .github/macos-installer V=1 ARCH_UNIV=$(cc_arch) image - task: Bash@3 displayName: 'Stage installer artifacts for upload' inputs: @@ -1029,25 +1040,25 @@ extends: # or, after ESRP MacAppNotarize re-packs it, inside # disk-image/.zip.unzipped/. Find it. pkg=$(find .github/macos-installer/disk-image \ - -name 'git-*-arm64.pkg' -type f \ + -name "git-*-$(cc_arch).pkg" -type f \ | head -1) - mv .github/macos-installer/git-*-arm64.dmg \ + mv .github/macos-installer/git-*-$(cc_arch).dmg \ "$pkg" \ "$(Build.ArtifactStagingDirectory)/_final/" # Validate the freshly built pkg in-place: install it, # assert `git --version`, and confirm the binary contains - # only the ARM64 architecture. Folded into the build job + # only the specific architecture. Folded into the build job # so it runs on the same agent without the 1ES job-startup # overhead a separate validate job carries. - bash: | set -e - if [ "$(uname -m)" = arm64 ] && command -v brew >/dev/null; then + if [ "$(uname -m)" = $(cpu_arch) ] && command -v brew >/dev/null; then brew uninstall git || true fi pkg=$(find "$(Build.ArtifactStagingDirectory)/_final" \ - -name 'git-*-arm64.pkg' -type f | head -1) + -name "git-*-$(cc_arch).pkg" -type f | head -1) if [ -z "$pkg" ]; then - echo "No git-*-arm64.pkg found in _final" >&2 + echo "No git-*-$(cc_arch).pkg found in _final" >&2 exit 1 fi echo "Installing $pkg" @@ -1065,10 +1076,10 @@ extends: set -ex git version --build-options >actual cat actual - grep '^cpu: arm64$' actual + grep "^cpu: $(cc_arch)$" actual git_path="$(command -v git)" - test "$(lipo -archs "$git_path")" = arm64 - displayName: 'Validate ARM64 binary CPU architecture' + test "$(lipo -archs "$git_path")" = $(cc_arch) + displayName: 'Validate binary CPU architecture' # # Linux build jobs From df414b73935314ea03e52d1abc212478b8ce3116 Mon Sep 17 00:00:00 2001 From: Matthew John Cheetham Date: Thu, 8 Oct 2026 16:08:58 +0100 Subject: [PATCH 2/2] release: ensure Git user/email is set in Mac builds The Mac builds make temporary commits when building. In previous macOS images we had the user.name and user.email already set. Set the commit author variables for our build so these temporary commits continue to work. Signed-off-by: Matthew John Cheetham --- .azure-pipelines/release.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.azure-pipelines/release.yml b/.azure-pipelines/release.yml index e506315a71eb48..da3b18797e9fda 100644 --- a/.azure-pipelines/release.yml +++ b/.azure-pipelines/release.yml @@ -817,6 +817,11 @@ extends: VERSION="$(git_version)" BUILD_VERSION="$VERSION" + # Set Git user.name and user.email as we make temporary + # commits during the build. + git config --global user.name "1ES Git Client Team" + git config --global user.email "gitclient@microsoft.com" + # The asciidoc/xmlto build steps need the catalogs # from Homebrew docbook. export XML_CATALOG_FILES="$(brew --prefix)/etc/xml/catalog"