CI: fix QEMU binary signature

Workaround for:
- lima-vm/lima issue 1742
- Homebrew/homebrew-core issue 140244

Signed-off-by: Akihiro Suda <[email protected]>

Author: AkihiroSuda

.github/workflows/test.yml

@@ -118,6 +118,8 @@ jobs:
         # Github runners seem to have lima installed by brew already; we don't want/need it
         time brew uninstall --ignore-dependencies lima colima
         time brew install qemu bash coreutils curl jq
+    - name: "Fix QEMU binary signature (Workaround for https://github.com/Homebrew/homebrew-core/issues/140244)"
+      run: ./hack/fix-qemu-signature.sh
     - name: "Show cache"
       run: ./hack/debug-cache.sh
     - name: "Test default.yaml"
@@ -272,6 +274,8 @@ jobs:
       run: make install
     - name: Install test dependencies
       run: brew install qemu bash coreutils iperf3
+    - name: "Fix QEMU binary signature (Workaround for https://github.com/Homebrew/homebrew-core/issues/140244)"
+      run: ./hack/fix-qemu-signature.sh
     - name: Install vde_switch and vde_vmnet (Deprecated)
       env:
         VDE_VMNET_VERSION: v0.6.0
@@ -341,6 +345,8 @@ jobs:
         key: ${{ runner.os }}-upgrade-${{ matrix.oldver }}
     - name: Install test dependencies
       run: brew install qemu bash coreutils
+    - name: "Fix QEMU binary signature (Workaround for https://github.com/Homebrew/homebrew-core/issues/140244)"
+      run: ./hack/fix-qemu-signature.sh
     - name: Test
       uses: nick-invision/retry@v2
       with:

hack/fix-qemu-signature.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+# This script fixes the signature of QEMU binary with the "com.apple.security.hypervisor" entitlement.
+#
+# A workaround for "QEMU (homebrew) is broken on Intel: `[hostagent] Driver stopped due to error: "signal: abort trap"` ..."
+#
+# https://github.com/lima-vm/lima/issues/1742
+# https://github.com/Homebrew/homebrew-core/issues/140244
+
+set -eux
+
+cat >entitlements.xml <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.hypervisor</key>
+    <true/>
+</dict>
+</plist>
+EOF
+
+codesign --sign - --entitlements entitlements.xml --force "$(which qemu-system-"$(uname -m | sed -e s/arm64/aarch64/)")"
+
+rm -f entitlements.xml