ci: cross-publish full NativeAOT matrix from Windows

2026-10-04 12:10:06 -07:00
1 parent 17a69c1c7a
commit 55756f7695
@@ -18,28 +18,6 @@ depends_on:
 concurrency: 1

 steps:
-  - name: linux-amd64-agent
-    image: bash
-    environment:
-      NUGET_PACKAGES: /home/justme/.nuget/packages
-      GITEA_BASE: http://192.168.2.162:3100
-      GITEA_TOKEN:
-        from_secret: gitea_token
-    commands:
-      - bash ci/release-linux.sh amd64 agent
-    depends_on: []
-
-  - name: linux-amd64-probe
-    image: bash
-    environment:
-      NUGET_PACKAGES: /home/justme/.nuget/packages
-      GITEA_BASE: http://192.168.2.162:3100
-      GITEA_TOKEN:
-        from_secret: gitea_token
-    commands:
-      - bash ci/release-linux.sh amd64 probe
-    depends_on: []
-
  - name: linux-amd64-backend
    image: bash
    environment:
@@ -53,28 +31,6 @@ steps:
      - bash ci/release-linux.sh amd64 backend
    depends_on: []

-  - name: linux-arm64-agent
-    image: bash
-    environment:
-      NUGET_PACKAGES: /home/justme/.nuget/packages
-      GITEA_BASE: http://192.168.2.162:3100
-      GITEA_TOKEN:
-        from_secret: gitea_token
-    commands:
-      - bash ci/release-linux.sh arm64 agent
-    depends_on: []
-
-  - name: linux-arm64-probe
-    image: bash
-    environment:
-      NUGET_PACKAGES: /home/justme/.nuget/packages
-      GITEA_BASE: http://192.168.2.162:3100
-      GITEA_TOKEN:
-        from_secret: gitea_token
-    commands:
-      - bash ci/release-linux.sh arm64 probe
-    depends_on: []
-
  - name: linux-arm64-backend
    image: bash
    environment:
@@ -18,46 +18,86 @@ depends_on:
 concurrency: 1

 steps:
-  - name: windows-amd64-agent
+  - name: linux-x64
    image: powershell
-    environment:
+    environment: &build-env
      GITEA_BASE: http://localhost:3100
      GITEA_TOKEN:
        from_secret: gitea_token
+      NUGET_PACKAGES: 'C:\Users\JustMe-NAS\.nuget\packages'
    commands:
      - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
-      - ./ci/release-windows.ps1 -Architecture amd64 -Role agent
+      - ./ci/release-cross-platform.ps1 -RuntimeIdentifier linux-x64
    depends_on: []

-  - name: windows-amd64-probe
+  - name: linux-arm64
    image: powershell
-    environment:
-      GITEA_BASE: http://localhost:3100
-      GITEA_TOKEN:
-        from_secret: gitea_token
+    environment: *build-env
    commands:
      - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
-      - ./ci/release-windows.ps1 -Architecture amd64 -Role probe
+      - ./ci/release-cross-platform.ps1 -RuntimeIdentifier linux-arm64
    depends_on: []

-  - name: windows-arm64-agent
+  - name: linux-arm
    image: powershell
-    environment:
-      GITEA_BASE: http://localhost:3100
-      GITEA_TOKEN:
-        from_secret: gitea_token
+    environment: *build-env
    commands:
      - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
-      - ./ci/release-windows.ps1 -Architecture arm64 -Role agent
+      - ./ci/release-cross-platform.ps1 -RuntimeIdentifier linux-arm
    depends_on: []

-  - name: windows-arm64-probe
+  - name: linux-musl-x64
    image: powershell
-    environment:
-      GITEA_BASE: http://localhost:3100
-      GITEA_TOKEN:
-        from_secret: gitea_token
+    environment: *build-env
    commands:
      - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
-      - ./ci/release-windows.ps1 -Architecture arm64 -Role probe
+      - ./ci/release-cross-platform.ps1 -RuntimeIdentifier linux-musl-x64
+    depends_on: []
+
+  - name: linux-musl-arm64
+    image: powershell
+    environment: *build-env
+    commands:
+      - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
+      - ./ci/release-cross-platform.ps1 -RuntimeIdentifier linux-musl-arm64
+    depends_on: []
+
+  - name: linux-musl-arm
+    image: powershell
+    environment: *build-env
+    commands:
+      - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
+      - ./ci/release-cross-platform.ps1 -RuntimeIdentifier linux-musl-arm
+    depends_on: []
+
+  - name: macos-x64
+    image: powershell
+    environment: *build-env
+    commands:
+      - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
+      - ./ci/release-cross-platform.ps1 -RuntimeIdentifier osx-x64
+    depends_on: []
+
+  - name: macos-arm64
+    image: powershell
+    environment: *build-env
+    commands:
+      - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
+      - ./ci/release-cross-platform.ps1 -RuntimeIdentifier osx-arm64
+    depends_on: []
+
+  - name: windows-x64
+    image: powershell
+    environment: *build-env
+    commands:
+      - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
+      - ./ci/release-cross-platform.ps1 -RuntimeIdentifier win-x64
+    depends_on: []
+
+  - name: windows-arm64
+    image: powershell
+    environment: *build-env
+    commands:
+      - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
+      - ./ci/release-cross-platform.ps1 -RuntimeIdentifier win-arm64
    depends_on: []
@@ -42,9 +42,9 @@ npm ci --prefix web
 npm run build --prefix web
 ```

-前端产物位于 `web/display/dist/` 和 `web/admin/dist/`。NativeAOT 发布还需要对应平台的 C/C++ 工具链；Linux 发布脚本和 RID 说明见 [`docs/deployment.md`](docs/deployment.md)。
+前端产物位于 `web/display/dist/` 和 `web/admin/dist/`。NativeAOT 目标平台和 Windows 上使用 AotAnywhere 交叉构建的说明见 [`docs/deployment.md`](docs/deployment.md)。

-Backend 以 OCI 镜像发布，支持 Linux/amd64 与 Linux/arm64；Agent 和 Probe 以 Windows/Linux 的 amd64/arm64 二进制包发布。容器部署配置见 [`compose.yaml`](compose.yaml)，发布说明见 [`docs/deployment.md`](docs/deployment.md)。
+Backend 以 OCI 镜像发布，支持 Linux/amd64 与 Linux/arm64；Agent 和 Probe 发布 Linux glibc/musl x64、arm64、arm，macOS x64/arm64，以及 Windows x64/arm64 二进制包。容器部署配置见 [`compose.yaml`](compose.yaml)，发布说明见 [`docs/deployment.md`](docs/deployment.md)。

 ### 本地运行

@@ -1,4 +1,7 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project>
+  <Import Project="Sdk.props" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.props" Sdk="StuDev.AotAnywhere"
+          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <AssemblyName>monitor-agent</AssemblyName>
@@ -11,4 +14,7 @@
    <ProjectReference Include="..\..\..\fleet\src\Fleet.Hosting\Fleet.Hosting.csproj" />
    <ProjectReference Include="..\..\..\shared\Monitor.Measurement\Monitor.Measurement.csproj" />
  </ItemGroup>
+  <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.targets" Sdk="StuDev.AotAnywhere"
+          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
 </Project>
@@ -1,4 +1,7 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project>
+  <Import Project="Sdk.props" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.props" Sdk="StuDev.AotAnywhere"
+          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <AssemblyName>fleet-enroll</AssemblyName>
@@ -8,4 +11,7 @@
  <ItemGroup>
    <ProjectReference Include="..\..\src\Fleet.Enrollment.Client\Fleet.Enrollment.Client.csproj" />
  </ItemGroup>
+  <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.targets" Sdk="StuDev.AotAnywhere"
+          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
 </Project>
@@ -3,6 +3,9 @@
    "version": "10.0.200",
    "rollForward": "latestFeature"
  },
+  "msbuild-sdks": {
+    "StuDev.AotAnywhere": "1.0.5"
+  },
  "test": {
    "runner": "Microsoft.Testing.Platform"
  }
@@ -1,4 +1,7 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project>
+  <Import Project="Sdk.props" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.props" Sdk="StuDev.AotAnywhere"
+          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <AssemblyName>monitor-probe</AssemblyName>
@@ -11,4 +14,7 @@
    <ProjectReference Include="..\..\..\fleet\src\Fleet.Hosting\Fleet.Hosting.csproj" />
    <ProjectReference Include="..\..\..\shared\Monitor.Measurement\Monitor.Measurement.csproj" />
  </ItemGroup>
+  <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.targets" Sdk="StuDev.AotAnywhere"
+          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
 </Project>
@@ -252,9 +252,32 @@ public sealed class AgentEndToEndTests
        await using ProbeSimulator probe = await agent.ConnectProbeAsync();
        await BackendFixture.EventuallyAsync(async () => (await AgentViewAsync(agent))["probe_connected"]!.GetValue<bool>());

-        using HttpResponseMessage accepted = await _backend.Admin.PostAsync($"/api/admin/lines/{agent.Id}~{probe.ProbeId}/tests", BackendFixture.Json(new JsonObject { ["plan"] = "hy2_ladder", ["params"] = new JsonObject { ["size"] = 1000 } }));
-        Assert.True(accepted.StatusCode == System.Net.HttpStatusCode.Accepted, await accepted.Content.ReadAsStringAsync());
-        string testId = JsonNode.Parse(await accepted.Content.ReadAsStringAsync())!["id"]!.GetValue<string>();
+        HttpResponseMessage? accepted = null;
+        string? startFailure = null;
+        for (int attempt = 0; attempt < 5; attempt++)
+        {
+            accepted = await _backend.Admin.PostAsync($"/api/admin/lines/{agent.Id}~{probe.ProbeId}/tests", BackendFixture.Json(new JsonObject { ["plan"] = "hy2_ladder", ["params"] = new JsonObject { ["size"] = 1000 } }));
+            if (accepted.StatusCode == System.Net.HttpStatusCode.Accepted)
+            {
+                break;
+            }
+
+            startFailure = await accepted.Content.ReadAsStringAsync();
+            string? code = JsonNode.Parse(startFailure)?["code"]?.GetValue<string>();
+            accepted.Dispose();
+            accepted = null;
+            if (code != "probe_offline" || attempt == 4)
+            {
+                Assert.Fail($"The test request was rejected: {startFailure}");
+            }
+
+            await BackendFixture.EventuallyAsync(async () => (await AgentViewAsync(agent))["probe_connected"]!.GetValue<bool>(), TimeSpan.FromSeconds(15), "the probe should reconnect after a transient disconnect");
+        }
+
+        HttpResponseMessage acceptedResponse = accepted ?? throw new InvalidOperationException("The test request was not accepted.");
+        using (acceptedResponse)
+        {
+            string testId = JsonNode.Parse(await acceptedResponse.Content.ReadAsStringAsync())!["id"]!.GetValue<string>();

        JsonNode test = null!;
        await BackendFixture.EventuallyAsync(
@@ -273,6 +296,7 @@ public sealed class AgentEndToEndTests
        await BackendFixture.EventuallyAsync(
            async () => (await _backend.GetJsonAsync(_backend.Admin, $"/api/admin/raw/chunks?agent_id={agent.Id}"))["items"]!.AsArray().Count(c => c!["kind"]!.GetValue<string>() == "udp_train") == agent.App.Counters.Fragments,
            because: (await _backend.GetJsonAsync(_backend.Admin, $"/api/admin/events?agent_id={agent.Id}")).ToJsonString() + $" fragments={agent.App.Counters.Fragments} discarded={agent.App.Counters.FragmentsDiscarded} pending={agent.App.Link.Outbox.PendingCount}/{agent.App.Link.Outbox.PendingBytes} dropped={agent.App.Link.Outbox.Dropped} link={agent.App.Link.IsConnected}");
+        }
    }

    [Fact]
@@ -26,14 +26,17 @@ printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$
 chmod 600 "$netrc"
 trap 'rm -rf "$tmp"' EXIT

+release_body="Agent and Probe builds: Linux glibc and musl (x64, arm64, arm), macOS (x64, arm64), and Windows (x64, arm64). macOS binaries are not Developer ID signed or notarized. Backend OCI images: registry.oeo.one/monitor/monitor-backend:$version (linux/amd64 and linux/arm64)."
+payload="$(printf '{"tag_name":"%s","target_commitish":"%s","name":"MyMonitor %s","body":"%s","draft":false,"prerelease":false}' \
+  "$tag" "${CI_COMMIT_SHA:-}" "$tag" "$release_body")"
 release_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
  --output "$release_json" --write-out '%{http_code}' "$api/releases/tags/$tag")"
+release_created=false
 if [[ "$release_status" == 404 ]]; then
-  payload="$(printf '{"tag_name":"%s","target_commitish":"%s","name":"MyMonitor %s","body":"Agent and Probe archives for Linux and Windows amd64 and arm64. Backend OCI images: registry.oeo.one/monitor/monitor-backend:%s (linux/amd64 and linux/arm64).","draft":false,"prerelease":false}' \
-    "$tag" "${CI_COMMIT_SHA:-}" "$tag" "$version")"
  release_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
    --header 'Content-Type: application/json' --data "$payload" \
    --output "$release_json" --write-out '%{http_code}' "$api/releases")"
+  release_created=true
 fi
 [[ "$release_status" =~ ^2 ]] || {
  echo "Gitea Release lookup/create failed (HTTP $release_status)" >&2
@@ -42,6 +45,17 @@ fi
 }
 release_id="$(grep -o '"id":[[:space:]]*[0-9][0-9]*' "$release_json" | head -1 | tr -cd '0-9')"
 [[ -n "$release_id" ]] || { echo "Could not read Gitea Release ID" >&2; exit 1; }
+if [[ "$release_created" == false ]]; then
+  update_response="$tmp/release-update.json"
+  update_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
+    --request PATCH --header 'Content-Type: application/json' --data "$payload" \
+    --output "$update_response" --write-out '%{http_code}' "$api/releases/$release_id")"
+  [[ "$update_status" =~ ^2 ]] || {
+    echo "Gitea Release update failed (HTTP $update_status)" >&2
+    cat "$update_response" >&2
+    exit 1
+  }
+fi
 curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
  "$api/releases/$release_id/assets" -o "$assets_json"

@@ -50,6 +64,18 @@ assets=(
  "monitor-agent-v$version-linux-arm64.tar.gz"
  "monitor-probe-v$version-linux-amd64.tar.gz"
  "monitor-probe-v$version-linux-arm64.tar.gz"
+  "monitor-agent-v$version-linux-arm.tar.gz"
+  "monitor-probe-v$version-linux-arm.tar.gz"
+  "monitor-agent-v$version-linux-musl-amd64.tar.gz"
+  "monitor-probe-v$version-linux-musl-amd64.tar.gz"
+  "monitor-agent-v$version-linux-musl-arm64.tar.gz"
+  "monitor-probe-v$version-linux-musl-arm64.tar.gz"
+  "monitor-agent-v$version-linux-musl-arm.tar.gz"
+  "monitor-probe-v$version-linux-musl-arm.tar.gz"
+  "monitor-agent-v$version-macos-x64.tar.gz"
+  "monitor-probe-v$version-macos-x64.tar.gz"
+  "monitor-agent-v$version-macos-arm64.tar.gz"
+  "monitor-probe-v$version-macos-arm64.tar.gz"
  "monitor-agent-v$version-windows-amd64.zip"
  "monitor-agent-v$version-windows-arm64.zip"
  "monitor-probe-v$version-windows-amd64.zip"
@@ -0,0 +1,209 @@
+param(
+    [Parameter(Mandatory)]
+    [ValidateSet(
+        'linux-x64', 'linux-arm64', 'linux-arm',
+        'linux-musl-x64', 'linux-musl-arm64', 'linux-musl-arm',
+        'osx-x64', 'osx-arm64', 'win-x64', 'win-arm64'
+    )]
+    [string]$RuntimeIdentifier
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+if (-not $env:CI_COMMIT_TAG -or $env:CI_COMMIT_TAG -notmatch '^v(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$') {
+    throw 'Release must run from a vMAJOR.MINOR.PATCH tag.'
+}
+$version = $Matches[1]
+$root = Split-Path -Parent $PSScriptRoot
+$backend = Join-Path $root 'backend'
+$projectVersion = [regex]::Match((Get-Content (Join-Path $backend 'Directory.Build.props') -Raw), '<Version>([^<]+)</Version>').Groups[1].Value
+if ($version -ne $projectVersion) {
+    throw "Tag version $version does not match project version $projectVersion."
+}
+if (-not $env:GITEA_TOKEN) {
+    throw 'GITEA_TOKEN is required.'
+}
+
+$isWindows = $RuntimeIdentifier.StartsWith('win-', [StringComparison]::Ordinal)
+$isMacOS = $RuntimeIdentifier.StartsWith('osx-', [StringComparison]::Ordinal)
+$os = if ($isWindows) { 'windows' } elseif ($isMacOS) { 'macos' } else { 'linux' }
+$arch = switch ($RuntimeIdentifier) {
+    'linux-x64' { 'amd64' }
+    'linux-arm64' { 'arm64' }
+    'linux-arm' { 'arm' }
+    'linux-musl-x64' { 'musl-amd64' }
+    'linux-musl-arm64' { 'musl-arm64' }
+    'linux-musl-arm' { 'musl-arm' }
+    'osx-x64' { 'x64' }
+    'osx-arm64' { 'arm64' }
+    'win-x64' { 'amd64' }
+    'win-arm64' { 'arm64' }
+}
+
+if ($isWindows) {
+    $vcArchitecture = if ($RuntimeIdentifier -eq 'win-x64') { 'x64' } else { 'arm64' }
+    $vsWhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
+    $vsPath = & $vsWhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath
+    if (-not $vsPath) {
+        throw 'Visual Studio C++ Build Tools were not found.'
+    }
+    $devCmd = Join-Path $vsPath 'Common7\Tools\VsDevCmd.bat'
+    $environmentLines = & cmd.exe /d /s /c "call `"$devCmd`" -no_logo -arch=$vcArchitecture -host_arch=x64 && set"
+    foreach ($line in $environmentLines) {
+        $separator = $line.IndexOf('=')
+        if ($separator -gt 0) {
+            [Environment]::SetEnvironmentVariable($line.Substring(0, $separator), $line.Substring($separator + 1), 'Process')
+        }
+    }
+}
+
+$publishRoot = Join-Path $root ".release\$RuntimeIdentifier-$PID"
+$buildRoot = Join-Path $root ".release\build\$RuntimeIdentifier-$PID"
+$packageRoot = Join-Path $root '.release\packages'
+$agentOut = Join-Path $publishRoot 'agent'
+$probeOut = Join-Path $publishRoot 'probe'
+$enrollOut = Join-Path $publishRoot 'fleet-enroll'
+$null = New-Item -ItemType Directory -Force -Path $agentOut, $probeOut, $enrollOut, $packageRoot
+
+function Publish-Aot([string]$Project, [string]$Output) {
+    $arguments = @(
+        'publish', $Project,
+        '-m:2',
+        '-c', 'Release',
+        '-r', $RuntimeIdentifier,
+        '--self-contained', 'true',
+        '-p:PublishAot=true',
+        '-p:StripSymbols=true',
+        '-p:DebugType=none',
+        '--artifacts-path', $buildRoot,
+        '-o', $Output
+    )
+    Push-Location $backend
+    try {
+        & dotnet @arguments
+        if ($LASTEXITCODE -ne 0) {
+            throw "NativeAOT publish failed for $Project ($RuntimeIdentifier)."
+        }
+    }
+    finally {
+        Pop-Location
+    }
+}
+
+function New-TarGzArchive([string]$SourceDirectory, [string]$ArchivePath, [string[]]$Executables) {
+    $tarFile = [IO.File]::Create($ArchivePath)
+    $gzip = [IO.Compression.GZipStream]::new($tarFile, [IO.Compression.CompressionLevel]::Optimal, $true)
+    $writer = [System.Formats.Tar.TarWriter]::new($gzip, [System.Formats.Tar.TarEntryFormat]::Pax, $true)
+    $executableMode = [System.IO.UnixFileMode]::UserRead -bor [System.IO.UnixFileMode]::UserWrite -bor [System.IO.UnixFileMode]::UserExecute -bor [System.IO.UnixFileMode]::GroupRead -bor [System.IO.UnixFileMode]::GroupExecute -bor [System.IO.UnixFileMode]::OtherRead -bor [System.IO.UnixFileMode]::OtherExecute
+    $regularMode = [System.IO.UnixFileMode]::UserRead -bor [System.IO.UnixFileMode]::UserWrite -bor [System.IO.UnixFileMode]::GroupRead -bor [System.IO.UnixFileMode]::OtherRead
+    try {
+        foreach ($file in Get-ChildItem -LiteralPath $SourceDirectory -File -Recurse) {
+            $relativePath = [IO.Path]::GetRelativePath($SourceDirectory, $file.FullName).Replace('\', '/')
+            $entry = [System.Formats.Tar.PaxTarEntry]::new([System.Formats.Tar.TarEntryType]::RegularFile, $relativePath)
+            $entry.Mode = if ($Executables -contains $relativePath) { $executableMode } else { $regularMode }
+            $entry.DataStream = [IO.File]::OpenRead($file.FullName)
+            try {
+                $writer.WriteEntry($entry)
+            }
+            finally {
+                $entry.DataStream.Dispose()
+            }
+        }
+    }
+    finally {
+        $writer.Dispose()
+        $gzip.Dispose()
+        $tarFile.Dispose()
+    }
+}
+
+Publish-Aot 'agent/src/Monitor.Agent' $agentOut
+Publish-Aot 'probe/src/Monitor.Probe' $probeOut
+Publish-Aot 'fleet/tools/fleet-enroll' $enrollOut
+
+$giteaBase = if ($env:GITEA_BASE) { $env:GITEA_BASE.TrimEnd('/') } else { 'http://localhost:3100' }
+$netrc = Join-Path $env:TEMP ("monitor-gitea-$([guid]::NewGuid().ToString('N')).netrc")
+$giteaHost = ([Uri]$giteaBase).Host
+Set-Content -LiteralPath $netrc -Value "machine $giteaHost login justme password $($env:GITEA_TOKEN)" -Encoding ascii -NoNewline
+
+function Publish-Package([string]$Role, [string]$BinaryDirectory) {
+    $stage = Join-Path $publishRoot "stage-$Role"
+    $null = New-Item -ItemType Directory -Force -Path $stage
+    $binaryName = if ($isWindows) { "monitor-$Role.exe" } else { "monitor-$Role" }
+    Copy-Item -LiteralPath (Join-Path $BinaryDirectory $binaryName) -Destination $stage
+    Copy-Item -LiteralPath (Join-Path $root 'LICENSE') -Destination $stage
+    Copy-Item -LiteralPath (Join-Path $root "backend\$Role\README.md") -Destination $stage
+
+    if ($Role -eq 'agent') {
+        $enrollName = if ($isWindows) { 'fleet-enroll.exe' } else { 'fleet-enroll' }
+        Copy-Item -LiteralPath (Join-Path $enrollOut $enrollName) -Destination $stage
+    }
+    if ($os -eq 'linux') {
+        Copy-Item -LiteralPath (Join-Path $root 'packaging/install.sh') -Destination $stage
+        $systemd = Join-Path $stage 'systemd'
+        $null = New-Item -ItemType Directory -Force -Path $systemd
+        Copy-Item -LiteralPath (Join-Path $root "packaging/systemd/monitor-$Role.service") -Destination $systemd
+        if ($Role -eq 'probe') {
+            $openwrt = Join-Path $stage 'openwrt'
+            $null = New-Item -ItemType Directory -Force -Path $openwrt
+            Copy-Item -LiteralPath (Join-Path $root 'packaging/openwrt/monitor-probe.init') -Destination $openwrt
+            Copy-Item -LiteralPath (Join-Path $root 'packaging/openwrt/monitor.keep') -Destination $openwrt
+        }
+    }
+    elseif ($os -eq 'macos') {
+        @'
+This macOS NativeAOT binary is not signed with a Developer ID certificate and
+has not been notarized by Apple. Apple Silicon builds receive an ad-hoc code
+signature; Intel builds are unsigned. Gatekeeper may block browser-downloaded
+files. A Developer ID signature and notarization are required for a seamless
+consumer install.
+'@ | Set-Content -LiteralPath (Join-Path $stage 'MACOS-SECURITY.txt') -Encoding utf8
+    }
+
+    $archiveName = if ($isWindows) {
+        "monitor-$Role-v$version-windows-$arch.zip"
+    }
+    else {
+        "monitor-$Role-v$version-$os-$arch.tar.gz"
+    }
+    $archive = Join-Path $packageRoot $archiveName
+    if ($isWindows) {
+        Compress-Archive -Path (Join-Path $stage '*') -DestinationPath $archive -CompressionLevel Optimal -Force
+    }
+    else {
+        $executables = if ($os -eq 'linux') { @("monitor-$Role", 'install.sh') } else { @("monitor-$Role") }
+        if ($Role -eq 'agent') { $executables += 'fleet-enroll' }
+        New-TarGzArchive $stage $archive $executables
+    }
+
+    $hash = (Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash.ToLowerInvariant()
+    $checksumPath = "$archive.sha256"
+    [IO.File]::WriteAllText($checksumPath, "$hash  $archiveName`n", [Text.UTF8Encoding]::new($false))
+
+    foreach ($file in @($archive, $checksumPath)) {
+        $name = Split-Path -Leaf $file
+        $url = "$giteaBase/api/packages/justme/generic/monitor-node/$version/$name"
+        $status = & curl.exe --silent --show-error --retry 3 --netrc-file $netrc --upload-file $file --output NUL --write-out '%{http_code}' $url
+        if ($LASTEXITCODE -ne 0) {
+            throw "Gitea package upload failed for $name."
+        }
+        if ($status -match '^2') {
+            Write-Output "uploaded Gitea package $name"
+        }
+        elseif ($status -eq '409') {
+            Write-Output "Gitea package $name already exists; reusing the existing release file"
+        }
+        else {
+            throw "Gitea package upload failed for $name (HTTP $status)."
+        }
+    }
+}
+
+try {
+    Publish-Package 'agent' $agentOut
+    Publish-Package 'probe' $probeOut
+}
+finally {
+    Remove-Item -LiteralPath $netrc -Force -ErrorAction SilentlyContinue
+}
@@ -1,127 +1,50 @@
 #!/usr/bin/env bash
-# Build one Linux architecture/component, then publish its package or OCI image.
+# Publish one framework-dependent Backend OCI image for the requested arch.
 set -euo pipefail

-arch="${1:?usage: release-linux.sh <amd64|arm64> <agent|probe|backend>}"
-component="${2:?usage: release-linux.sh <amd64|arm64> <agent|probe|backend>}"
+arch="${1:?usage: release-linux.sh <amd64|arm64>}"
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 tag="${CI_COMMIT_TAG:-}"
 [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
  echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
  exit 2
 }
-version="${tag#v}"
-
+[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_PASSWORD:-}" ]] || {
+  echo "Zot credentials are required" >&2; exit 2;
+}
 case "$arch" in
-  amd64) rid=linux-x64; objcopy=llvm-objcopy ;;
-  arm64) rid=linux-arm64; objcopy=aarch64-linux-gnu-objcopy ;;
+  amd64|arm64) ;;
  *) echo "unsupported architecture: $arch" >&2; exit 2 ;;
 esac
-case "$component" in
-  agent|probe|backend) ;;
-  *) echo "unsupported component: $component" >&2; exit 2 ;;
-esac

+version="${tag#v}"
 project_version="$(sed -n 's#.*<Version>\(.*\)</Version>.*#\1#p' "$root/backend/Directory.Build.props" | head -1)"
 if [[ "$version" != "$project_version" ]]; then
  echo "tag version $version does not match project version $project_version" >&2
  exit 1
 fi

-output="$root/.release/linux-$arch/$component"
-build_root="$root/.release/build/linux-$arch-$component"
-stage_root="$root/.release/stage/linux-$arch-$component"
-mkdir -p "$output" "$build_root" "$stage_root"
+registry="${ZOT_REGISTRY:-192.168.2.162:5000}"
+image="$registry/monitor/monitor-backend"
+output="$root/.release/linux-$arch/backend"
+build_root="$root/.release/build/linux-$arch-backend"
+container_context="$root/.release/container/linux-$arch"
+mkdir -p "$output" "$build_root" "$container_context/app" "$container_context/data"

-publish_aot() {
-  local name="$1" project="$2" destination="$3"
-  (cd "$root/backend" && dotnet publish "$project" \
-    -m:3 \
-    -c Release -r "$rid" --self-contained true \
-    -p:PublishAot=true -p:StripSymbols=true -p:DebugType=none \
-    -p:ObjCopyName="$objcopy" \
-    --artifacts-path "$build_root" \
-    -o "$destination")
-}
+(cd "$root/backend" && dotnet publish src/Monitor.Backend \
+  -m:3 -c Release --no-self-contained \
+  -p:UseAppHost=false -p:OpenApiGenerateDocuments=false \
+  --artifacts-path "$build_root" -o "$output")
+cp -a "$output/." "$container_context/app/"
+: > "$container_context/data/.keep"

-if [[ "$component" == backend ]]; then
-  [[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_PASSWORD:-}" ]] || {
-    echo "Zot credentials are required" >&2; exit 2;
-  }
-  registry="${ZOT_REGISTRY:-192.168.2.162:5000}"
-  image="$registry/monitor/monitor-backend"
-  publish_backend() {
-    (cd "$root/backend" && dotnet publish src/Monitor.Backend \
-      -m:3 \
-      -c Release --no-self-contained \
-      -p:UseAppHost=false -p:OpenApiGenerateDocuments=false \
-      --artifacts-path "$build_root" \
-      -o "$output")
-  }
-  publish_backend
-
-  container_context="$root/.release/container/linux-$arch"
-  mkdir -p "$container_context/app" "$container_context/data"
-  cp -a "$output/." "$container_context/app/"
-  : > "$container_context/data/.keep"
-
-  export REGISTRY_AUTH_FILE="$root/.release/auth/zot-linux-$arch.json"
-  mkdir -p "$(dirname "$REGISTRY_AUTH_FILE")"
-  buildah login --tls-verify=false --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_PASSWORD" >/dev/null
-  local_image="localhost/monitor-backend:$version-$arch"
-  buildah bud --tls-verify=false --arch "$arch" \
-    --build-arg "APP_VERSION=$version" \
-    -f "$root/packaging/container/Backend.Containerfile" \
-    -t "$local_image" "$container_context" >/dev/null
-  buildah push --tls-verify=false "$local_image" "docker://$image:$version-$arch" >/dev/null
-  echo "pushed Zot image $image:$version-$arch"
-  exit 0
-fi
-
-[[ -n "${GITEA_TOKEN:-}" ]] || { echo "GITEA_TOKEN is required" >&2; exit 2; }
-gitea_base="${GITEA_BASE:-http://192.168.2.162:3100}"
-gitea_host="${gitea_base#https://}"
-gitea_host="${gitea_host#http://}"
-gitea_host="${gitea_host%%/*}"
-gitea_host="${gitea_host%%:*}"
-netrc="$(mktemp)"
-chmod 600 "$netrc"
-printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$netrc"
-trap 'rm -f "$netrc"' EXIT
-
-upload_package() {
-  local file="$1" name status
-  name="$(basename "$file")"
-  status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
-    --upload-file "$file" --output /dev/null --write-out '%{http_code}' \
-    "$gitea_base/api/packages/justme/generic/monitor-node/$version/$name")"
-  case "$status" in
-    2*) echo "uploaded Gitea package $name" ;;
-    409) echo "Gitea package $name already exists; reusing the existing release file" ;;
-    *) echo "Gitea package upload failed for $name (HTTP $status)" >&2; return 1 ;;
-  esac
-}
-
-stage="$stage_root/$component"
-mkdir -p "$stage/systemd"
-publish_aot "$component" "$component/src/Monitor.$(tr '[:lower:]' '[:upper:]' <<< "${component:0:1}")${component:1}" "$output/$component"
-
-cp "$output/$component/monitor-$component" "$stage/monitor-$component"
-cp "$root/packaging/install.sh" "$stage/install.sh"
-cp "$root/LICENSE" "$stage/LICENSE"
-cp "$root/backend/$component/README.md" "$stage/README.md"
-cp "$root/packaging/systemd/monitor-$component.service" "$stage/systemd/monitor-$component.service"
-if [[ "$component" == agent ]]; then
-  publish_aot fleet-enroll fleet/tools/fleet-enroll "$output/fleet-enroll"
-  cp "$output/fleet-enroll/fleet-enroll" "$stage/fleet-enroll"
-else
-  mkdir -p "$stage/openwrt"
-  cp "$root/packaging/openwrt/monitor-probe.init" "$stage/openwrt/"
-  cp "$root/packaging/openwrt/monitor.keep" "$stage/openwrt/"
-fi
-
-archive="$output/monitor-$component-v$version-linux-$arch.tar.gz"
-tar -C "$stage" -czf "$archive" .
-(cd "$output" && sha256sum "$(basename "$archive")" > "$(basename "$archive").sha256")
-upload_package "$archive"
-upload_package "$archive.sha256"
+export REGISTRY_AUTH_FILE="$root/.release/auth/zot-linux-$arch.json"
+mkdir -p "$(dirname "$REGISTRY_AUTH_FILE")"
+buildah login --tls-verify=false --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_PASSWORD" >/dev/null
+local_image="localhost/monitor-backend:$version-$arch"
+buildah bud --tls-verify=false --arch "$arch" \
+  --build-arg "APP_VERSION=$version" \
+  -f "$root/packaging/container/Backend.Containerfile" \
+  -t "$local_image" "$container_context" >/dev/null
+buildah push --tls-verify=false "$local_image" "docker://$image:$version-$arch" >/dev/null
+echo "pushed Zot image $image:$version-$arch"
@@ -1,134 +0,0 @@
-param(
-    [Parameter(Mandatory)]
-    [ValidateSet('amd64', 'arm64')]
-    [string]$Architecture,
-    [Parameter(Mandatory)]
-    [ValidateSet('agent', 'probe')]
-    [string]$Role
-)
-
-$ErrorActionPreference = 'Stop'
-Set-StrictMode -Version Latest
-
-if (-not $env:CI_COMMIT_TAG -or $env:CI_COMMIT_TAG -notmatch '^v(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$') {
-    throw 'Release must run from a vMAJOR.MINOR.PATCH tag.'
-}
-$version = $Matches[1]
-$root = Split-Path -Parent $PSScriptRoot
-$backend = Join-Path $root 'backend'
-$projectVersion = [regex]::Match((Get-Content (Join-Path $backend 'Directory.Build.props') -Raw), '<Version>([^<]+)</Version>').Groups[1].Value
-if ($version -ne $projectVersion) {
-    throw "Tag version $version does not match project version $projectVersion."
-}
-if (-not $env:GITEA_TOKEN) {
-    throw 'GITEA_TOKEN is required.'
-}
-
-$rid = if ($Architecture -eq 'amd64') { 'win-x64' } else { 'win-arm64' }
-$vcArchitecture = if ($Architecture -eq 'amd64') { 'x64' } else { 'arm64' }
-$vsWhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
-$vsPath = & $vsWhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath
-if (-not $vsPath) {
-    throw 'Visual Studio C++ Build Tools were not found.'
-}
-
-$devCmd = Join-Path $vsPath 'Common7\Tools\VsDevCmd.bat'
-$environmentLines = & cmd.exe /d /s /c "call `"$devCmd`" -no_logo -arch=$vcArchitecture -host_arch=x64 && set"
-foreach ($line in $environmentLines) {
-    $separator = $line.IndexOf('=')
-    if ($separator -gt 0) {
-        [Environment]::SetEnvironmentVariable($line.Substring(0, $separator), $line.Substring($separator + 1), 'Process')
-    }
-}
-
-$buildRoot = Join-Path $root ".release\build\windows-$Architecture-$Role-$PID"
-$publishRoot = Join-Path $root ".release\windows-$Architecture-$Role-$PID"
-$packageRoot = Join-Path $root '.release\packages'
-$null = New-Item -ItemType Directory -Force -Path $publishRoot, $packageRoot
-
-function Publish-Aot([string]$Project, [string]$Output) {
-    $arguments = @(
-        'publish', $Project,
-        '-m:3',
-        '-c', 'Release',
-        '-r', $rid,
-        '--self-contained', 'true',
-        '-p:PublishAot=true',
-        '-p:StripSymbols=true',
-        '-p:DebugType=none',
-        '--artifacts-path', $buildRoot,
-        '-o', $Output
-    )
-    Push-Location $backend
-    try {
-        & dotnet @arguments
-        if ($LASTEXITCODE -ne 0) {
-            throw "NativeAOT publish failed for $Project ($rid)."
-        }
-    }
-    finally {
-        Pop-Location
-    }
-}
-
-$roleOut = Join-Path $publishRoot $Role
-$null = New-Item -ItemType Directory -Force -Path $roleOut
-$enrollOut = $null
-if ($Role -eq 'agent') {
-    Publish-Aot 'agent/src/Monitor.Agent' $roleOut
-    $enrollOut = Join-Path $publishRoot 'fleet-enroll'
-    $null = New-Item -ItemType Directory -Force -Path $enrollOut
-    Publish-Aot 'fleet/tools/fleet-enroll' $enrollOut
-}
-else {
-    Publish-Aot 'probe/src/Monitor.Probe' $roleOut
-}
-
-$giteaBase = if ($env:GITEA_BASE) { $env:GITEA_BASE.TrimEnd('/') } else { 'http://localhost:3100' }
-$netrc = Join-Path $env:TEMP ("monitor-gitea-$([guid]::NewGuid().ToString('N')).netrc")
-$giteaHost = ([Uri]$giteaBase).Host
-Set-Content -LiteralPath $netrc -Value "machine $giteaHost login justme password $($env:GITEA_TOKEN)" -Encoding ascii -NoNewline
-
-function Publish-Package([string]$Role, [string]$BinaryDirectory) {
-    $stage = Join-Path $publishRoot "stage-$Role"
-    $null = New-Item -ItemType Directory -Force -Path $stage
-    Copy-Item -LiteralPath (Join-Path $BinaryDirectory "monitor-$Role.exe") -Destination $stage
-    Copy-Item -LiteralPath (Join-Path $root 'LICENSE') -Destination $stage
-    Copy-Item -LiteralPath (Join-Path $root "backend\$Role\README.md") -Destination $stage
-    if ($Role -eq 'agent') {
-        Copy-Item -LiteralPath (Join-Path $enrollOut 'fleet-enroll.exe') -Destination $stage
-    }
-
-    $archiveName = "monitor-$Role-v$version-windows-$Architecture.zip"
-    $archive = Join-Path $packageRoot $archiveName
-    Compress-Archive -Path (Join-Path $stage '*') -DestinationPath $archive -CompressionLevel Optimal -Force
-    $hash = (Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash.ToLowerInvariant()
-    $checksum = "$hash  $archiveName`n"
-    $checksumPath = "$archive.sha256"
-    [IO.File]::WriteAllText($checksumPath, $checksum, [Text.UTF8Encoding]::new($false))
-
-    foreach ($file in @($archive, $checksumPath)) {
-        $name = Split-Path -Leaf $file
-        $url = "$giteaBase/api/packages/justme/generic/monitor-node/$version/$name"
-        $status = & curl.exe --silent --show-error --retry 3 --netrc-file $netrc --upload-file $file --output NUL --write-out '%{http_code}' $url
-        if ($LASTEXITCODE -ne 0) {
-            throw "Gitea package upload failed for $name."
-        }
-        if ($status -match '^2') {
-            Write-Output "uploaded Gitea package $name"
-        }
-        elseif ($status -eq '409') {
-            Write-Output "Gitea package $name already exists; reusing the existing release file"
-        }
-        else {
-            throw "Gitea package upload failed for $name (HTTP $status)."
-        }
-    }
-}
-
-try {
-    Publish-Package $Role $roleOut
-}
-finally {
-    Remove-Item -LiteralPath $netrc -Force -ErrorAction SilentlyContinue
-}
@@ -11,14 +11,14 @@ scripts/package.sh <agent|probe> <rid>                           → backend/art

 | rid | 目标 | 构建方式 |
 | --- | --- | --- |
-| `linux-musl-x64` | Alpine、OpenWrt x86 | Alpine 的 NativeAOT SDK 容器（任何有 Docker 的主机，包括 Windows） |
-| `linux-x64` | Debian、Ubuntu 等 glibc 发行版 | Ubuntu noble 的 NativeAOT SDK 容器 |
-| `win-x64` | Windows | 在 Windows 上直接 `dotnet publish -p:PublishAot=true`（需要 VS 的 C++ 工具链，`vswhere.exe` 所在目录要在 PATH 里） |
-| `linux-musl-arm64`、`linux-arm64` | 路由器、树莓派 | 需要在 arm64 主机（或 CI 的 arm64 runner）上运行同一个脚本；脚本在 x64 主机上会拒绝并说明 |
+| `linux-x64`、`linux-arm64`、`linux-arm` | Debian/Ubuntu glibc、ARMv7 | Windows CI 主机通过 AotAnywhere 交叉编译 |
+| `linux-musl-x64`、`linux-musl-arm64`、`linux-musl-arm` | Alpine、OpenWrt、musl ARMv7 | Windows CI 主机通过 AotAnywhere 交叉编译 |
+| `osx-x64`、`osx-arm64` | Intel Mac、Apple Silicon | Windows CI 主机通过 AotAnywhere 交叉编译；发布包未做 Developer ID 签名或 Apple 公证 |
+| `win-x64`、`win-arm64` | Windows x64、ARM64 | Windows CI 主机上的 Visual Studio C++ 工具链 |

-NativeAOT 不能交叉编译到别的操作系统；MIPS 不支持（见 `project-layout.md`）。
+macOS 的 Apple Silicon 产物带临时 ad-hoc 签名，Intel 产物未签名。通过浏览器下载时，macOS Gatekeeper 可能阻止启动；面向普通用户分发前需要 Developer ID 签名和 Apple 公证。MIPS 不在当前目标列表中（见 `project-layout.md`）。

-仓库内的 `scripts/publish.sh` 面向本机目标平台；tag 发布流水线另使用 Linux 交叉工具链生成 arm64 产物，并在 Windows runner 上构建 Windows x64/arm64 产物。
+仓库内的 `scripts/publish.sh` 面向本机目标平台；Woodpecker 的 tag 流水线在 Windows runner 上构建 Agent、Probe 和 `fleet-enroll` 的所有发布目标，Backend OCI 镜像仍在 Linux runner 上构建。

 ## Backend 容器

@@ -36,7 +36,7 @@ Compose 将容器端口只绑定到宿主机 `127.0.0.1:8080`，适合由同机

 ## 节点二进制发布

-Woodpecker 在 `vMAJOR.MINOR.PATCH` tag 上构建 Agent 和 Probe 的 Windows/Linux amd64/arm64 NativeAOT 程序，打包为 `.zip` 或 `.tar.gz` 并上传到 Gitea Generic Packages。发布前会确认该 tag 指向的 commit 已通过 push 验证；Agent、Probe 和 Backend 按架构并行构建。所有产物成功后，CI 会创建对应的 Gitea Release，并将四个平台的 Agent/Probe 压缩包及 SHA-256 校验文件作为附件。Agent 包还包含一次性注册工具 `fleet-enroll`。Linux 包带有安装脚本和 systemd/OpenWrt 单元；Windows 包包含可执行文件及对应 README。安装说明见 [`../backend/agent/README.md`](../backend/agent/README.md) 与 [`../backend/probe/README.md`](../backend/probe/README.md)。
+Woodpecker 在 `vMAJOR.MINOR.PATCH` tag 上，先确认 commit 已通过 push 验证，再由 Windows runner 使用 AotAnywhere 并行构建 Agent/Probe 的 Linux glibc、Linux musl、macOS 和 Windows 产物。Agent 包还包含一次性注册工具 `fleet-enroll`。Linux 归档带有安装脚本和 systemd/OpenWrt 单元；Windows 产物为 `.zip`，Linux/macOS 产物为 `.tar.gz`。所有平台产物和 Backend OCI 镜像成功后，CI 会创建对应的 Gitea Release，并附上压缩包和 SHA-256 校验文件。macOS 产物目前未签名/公证。安装说明见 [`../backend/agent/README.md`](../backend/agent/README.md) 与 [`../backend/probe/README.md`](../backend/probe/README.md)。

 实测体积（`StackTraceSupport=false`、`IlcFoldIdenticalMethodBodies=true`、`OptimizationPreference=Size`）：