Hackios xnu integration

.gitattributes

@@ -0,0 +1,3 @@
+*.sh text eol=lf
+*.patch text eol=lf
+userland/patches/*.patch whitespace=-blank-at-eol,-space-before-tab

.github/workflows/build-hackios-xnu.yml

@@ -0,0 +1,104 @@
+name: build-hackios-xnu
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main, hackios-xnu-integration]
+    paths:
+      - "scripts/**"
+      - ".github/workflows/build-hackios-xnu.yml"
+  pull_request:
+    paths:
+      - "scripts/**"
+      - ".github/workflows/build-hackios-xnu.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: build-hackios-xnu-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      # Safety net: the tree must never carry Apple firmware, iOS images,
+      # credentials or other non-distributable artifacts into CI.
+      - name: Provenance and license check
+        run: |
+          set -euo pipefail
+          bad=0
+          for ext in ipsw dmg img simg; do
+            found=$(find . -type f -name "*.$ext" -not -path './.git/*' | head -20 || true)
+            if [ -n "$found" ]; then
+              echo "::error::non-distributable $ext file found:"; echo "$found"
+              bad=1
+            fi
+          done
+          for secret in .env .env.* id_rsa credentials.json; do
+            found=$(find . -type f -name "$secret" -not -path './.git/*' | head -20 || true)
+            if [ -n "$found" ]; then
+              echo "::error::secret-like file found: $secret"; bad=1
+            fi
+          done
+          [ "$bad" -eq 0 ] || exit 1
+          echo "provenance check passed: no Apple firmware, iOS images or secrets"
+
+      - name: Install toolchain
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends shellcheck
+
+      - name: Shell syntax check
+        run: |
+          set -euo pipefail
+          mapfile -t sh < <(find scripts tools shim userland xnu/patches -type f -name '*.sh' | sort)
+          fail=0
+          for f in "${sh[@]}"; do
+            if ! bash -n "$f"; then echo "::error::bash -n failed: $f"; fail=1; fi
+          done
+          [ "$fail" -eq 0 ] || exit 1
+          echo "checked ${#sh[@]} shell scripts"
+
+      - name: Python syntax check
+        run: |
+          set -euo pipefail
+          mapfile -t py < <(find scripts tools -type f -name '*.py' | sort)
+          for f in "${py[@]}"; do
+            python3 -X utf8 -m py_compile "$f" || { echo "::error::py_compile failed: $f"; exit 1; }
+          done
+          echo "checked ${#py[@]} python files"
+
+      - name: Repository validation
+        run: python3 -X utf8 tools/validate-repo.py --verbose
+
+      - name: Static analysis (shellcheck)
+        run: |
+          set -euo pipefail
+          mapfile -t sh < <(find scripts tools shim userland xnu/patches -type f -name '*.sh' | sort)
+          for f in "${sh[@]}"; do
+            shellcheck -S warning "$f" || true
+          done
+          echo "shellcheck pass complete"
+
+      - name: Build reproducible patch/tool artifact
+        run: |
+          set -euo pipefail
+          mkdir -p out-hackios
+          cp -R xnu/patches out-hackios/patches
+          cp -R scripts out-hackios/scripts
+          cp -R userland/patches out-hackios/userland-patches
+          cp tools/*.py out-hackios/ 2>/dev/null || true
+          (cd out-hackios && find . -type f -print0 | sort -z | xargs -0 sha256sum > SHA256SUMS)
+          tar czf hackios-build-artifacts.tgz out-hackios
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: hackios-build-artifacts
+          path: hackios-build-artifacts.tgz
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/redwood-userland.yml

@@ -0,0 +1,42 @@
+name: redwood-userland
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "userland/**"
+      - ".github/workflows/redwood-userland.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: redwood-userland-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: macos-14
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/checkout@v4
+        with:
+          repository: oosexgang/hackios-xnu-userland
+          ref: a79ff0772a3454fd1ef127e181e5b3bce6c9ce18
+          path: hackios-userland
+
+      - name: Apply the 20H392 offset overlay
+        run: git -C hackios-userland apply "$GITHUB_WORKSPACE/userland/patches/20H392-redwood.patch"
+
+      - name: Build the arm64 Redwood libraries
+        run: bash userland/build-redwood.sh hackios-userland/userland/src out
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: redwood-20H392
+          path: out/
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/xnu.yml

@@ -48,6 +48,18 @@ jobs:
           git -C dxb checkout -q FETCH_HEAD
           # 12.5-14.3 use the top-level patches dir; ours go next to blacktop's
           cp xnu/patches/*.patch xnu/patches/*.sh dxb/patches/
+          # The upstream helper only warns and continues when a patch fails to apply.
+          # Make CI fail instead, so a green kernel build proves the patches were used.
+          python3 - <<'PY'
+          from pathlib import Path
+          build = Path("dxb/build.sh")
+          source = build.read_text()
+          old = 'warning "Skipping patch ${PATCH} (already upstream, previously applied, or malformed): ${APPLY_CHECK}"'
+          new = 'case "${PATCH##*/}" in [0-9][0-9][0-9][0-9]-*) printf "Required XNU patch failed to apply: %s\\n%s\\n" "$PATCH" "$APPLY_CHECK" >&2; exit 1;; *) warning "Skipping helper patch ${PATCH}: ${APPLY_CHECK}";; esac'
+          if source.count(old) != 1:
+              raise SystemExit("Could not install strict patch-application check")
+          build.write_text(source.replace(old, new))
+          PY
           # libfirehose_kernel is built arm64e-only; the SWEET kernel is plain arm64
           sed -i '' 's/ARCHS="x86_64 arm64e" VALID_ARCHS="x86_64 arm64e"/ARCHS="x86_64 arm64e arm64" VALID_ARCHS="x86_64 arm64e arm64"/' dxb/build.sh
           grep -c 'VALID_ARCHS="x86_64 arm64e arm64"' dxb/build.sh

.gitignore

@@ -2,9 +2,21 @@
 backup/
 dtb/
 recovery/
+# Apple restore packages and filesystem components
+*.ipsw
+*.dmg
 # third-party/Apple sources fetched for reading
 research/
 shim/out/
 xnu/out/
 xnu/out-*/
 __pycache__/
+# build output: disk images, local logs, caches and secrets must never be committed
+output/
+logs/
+*.img
+*.simg
+*.log
+.cache/
+.env
+.env.*