Consider releasing Lima as a dmg/pkg installer on macOS

[msimkunas]

Description

As per our discussion @afbjorklund

It would be pretty convenient if Lima had a dmg/pkg installer for macOS. For users who do not/can not use Homebrew or other package managers in a work environment, the only alternative right now is to download the tarballs manually.

Having a signed and notarized installer/image would also improve trust (if the signing infrastructure is set up properly, that is).

[afbjorklund]

Do you still need dmg files? I thought that pkg have been stand-alone (xar archives) for quite some time now

(as a side note, we should mention that all releases are signed, through the SHA256SUMS.asc mechanism...)

[msimkunas]

As per my understanding, if your app is self-contained, you should use dmg, otherwise pkg.

Personally, I wouldn't mind having either, as long as either one exists.

[afbjorklund]

Converting the tar to a dmg is possible, but probably not enough (with just the disk image).

Once you mounted it, you would end up with the same "bin" and "share"

[msimkunas]

The docs imply that Lima could be placed "somewhere else".

I haven't tried this but even if it worked, I assume you would still have to figure out how to put Lima in the user's $PATH. Perhaps a pkg is better for this.

[afbjorklund]

A pkg is better, only problem is that it requires root* and is a pain to make on other OS...
* it is technically possible to make an installer that uses home directory, not /usr/local

If you don't use something on the system path, chances are you still have to edit profile?

export PATH=$HOME/bin:$PATH

So it is similar to making an rpm or a deb, just some repackaging and some metadata.
Signing the result and hosting* it is another thing, that requires a bit more infrastructure.

* like in a repository or an appstore

But unfortunately, no support in nfpm

[jandubois]

Having a signed and notarized installer/image would also improve trust (if the signing infrastructure is set up properly, that is).

The tarballs are already signed by the release manager, so I assume you are looking for an installer signed with an Apple ID, so it can be trusted by GateKeeper etc.

This will require downloading the bits, notarizing and signing them locally, and then uploading them to GitHub again, which would mean they will lose the GitHub attestation, which does not really make the final result more trustworthy unless the Apple ID is owned by a larger organization and not a single developer.

[afbjorklund]

I don't see any immediate "win", and mostly found .pkg annoying now when I revisited AC and Swift after all these years*.

* since https://macpkg.sourceforge.net/ et al, I was trying to use RPM back then...

DarwinPorts became MacPorts, but there was no more look at .rpm packages.

We had Fink that used .deb, but in the end everyone used Brew ports instead...

It seems like the support in fpm is just using Apple's proprietary tools, so we still need mkbom and xar to make one:

https://github.com/jordansissel/fpm/blob/main/lib/fpm/package/osxpkg.rb

Something like this https://hogliux.github.io/bomutils/tutorial.html (or so).

The xar (xml archive) is what makes not need dmg images (or zip) anymore...

_output/
├── bin
└── share
    ├── doc
    │   └── lima
    ├── lima
    │   └── templates
    │       ├── _default
    │       ├── experimental
    │       └── _images
    └── man
        └── man1

The actual payload in the package is just cpio, which is quite similar to tar.

Bom
Payload
PackageInfo