From c272ca481088eb9c82da0791dd3ee695d0e02a63 Mon Sep 17 00:00:00 2001
From: Vaayne <liu.vaayne@gmail.com>
Date: Thu, 5 Mar 2026 09:21:03 +0800
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=90=9B=20fix:=20pin=20BoxLite=20runti?=
 =?UTF-8?q?me=20build=20to=20Cargo.lock=20revision?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The release workflow and install script clone BoxLite at HEAD to build
the runtime (shim, guest, dylibs), but the boxrun server binary is
compiled against the boxlite version pinned in Cargo.lock. When
BoxLite's InstanceSpec struct changes between these versions, the
server produces JSON config that the shim cannot deserialize, causing
"missing field" errors and VM startup timeouts.

This was the root cause of #7: the server (compiled against boxlite
cc236c4/v0.5.10) serialized InstanceSpec with `parent_pid` but without
`exit_file`/`stderr_file`, while the shim (built from latest main)
expected the opposite set of fields.

Fix: extract the boxlite git revision from Cargo.lock and checkout
that exact commit before building the runtime, ensuring the server
and shim always agree on the InstanceSpec schema.
---
 .github/workflows/release.yml |  7 +++++--
 scripts/install-local.sh      | 10 ++++++++--
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5b00cd5..6e7f4c9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,8 +38,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Check out BoxLite
-        run: git clone --recurse-submodules --depth 1 https://github.com/boxlite-ai/boxlite.git ../boxlite
+      - name: Check out BoxLite (pinned to Cargo.lock revision)
+        run: |
+          BOXLITE_REV=$(grep -A2 'name = "boxlite"' Cargo.lock | sed -n 's/.*#\([0-9a-f]*\)".*/\1/p')
+          git clone --recurse-submodules https://github.com/boxlite-ai/boxlite.git ../boxlite
+          cd ../boxlite && git checkout "$BOXLITE_REV"
 
       - uses: dtolnay/rust-toolchain@stable
         with:
diff --git a/scripts/install-local.sh b/scripts/install-local.sh
index 5132a80..25910fc 100755
--- a/scripts/install-local.sh
+++ b/scripts/install-local.sh
@@ -13,13 +13,19 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 BOXLITE_ROOT="$PROJECT_ROOT/../boxlite"
 
-# 0) Auto-clone BoxLite if not present
+# 0) Auto-clone BoxLite if not present, pinned to Cargo.lock revision
+BOXLITE_REV=$(grep -A2 'name = "boxlite"' "$PROJECT_ROOT/Cargo.lock" | sed -n 's/.*#\([0-9a-f]*\)".*/\1/p')
 if [ ! -d "$BOXLITE_ROOT" ]; then
   echo "==> BoxLite not found at $BOXLITE_ROOT, cloning..."
-  git clone --recurse-submodules --depth 1 \
+  git clone --recurse-submodules \
     https://github.com/boxlite-ai/boxlite.git "$BOXLITE_ROOT"
 fi
 BOXLITE_ROOT="$(cd "$BOXLITE_ROOT" && pwd)"
+if [ -n "$BOXLITE_REV" ]; then
+  echo "==> Pinning BoxLite to Cargo.lock revision: $BOXLITE_REV"
+  cd "$BOXLITE_ROOT" && git checkout "$BOXLITE_REV"
+  cd "$PROJECT_ROOT"
+fi
 
 # 1) Build boxrun binary
 echo "==> Building boxrun (release)..."

From d636c7898ca767def84770272429d08e30ddb9c1 Mon Sep 17 00:00:00 2001
From: Vaayne <liu.vaayne@gmail.com>
Date: Thu, 5 Mar 2026 09:51:25 +0800
Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=90=9B=20fix:=20add=20rpath=20to=20bo?=
 =?UTF-8?q?xrun=20binary=20in=20install-local.sh?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The boxrun binary links against runtime dylibs (libkrun, libgvproxy)
via @rpath. The release workflow adds the rpath with install_name_tool,
but the local install script was missing this step, causing a dyld
"no LC_RPATH's found" error on macOS.
---
 scripts/install-local.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/scripts/install-local.sh b/scripts/install-local.sh
index 25910fc..7581b82 100755
--- a/scripts/install-local.sh
+++ b/scripts/install-local.sh
@@ -46,6 +46,11 @@ mkdir -p "${BOXRUN_HOME}/runtime"
 cp "$PROJECT_ROOT/target/release/boxrun" "${BOXRUN_HOME}/boxrun"
 chmod +x "${BOXRUN_HOME}/boxrun"
 
+# Add rpath so the binary can find runtime dylibs (libkrun, libgvproxy, etc.)
+if [ "$(uname)" = "Darwin" ]; then
+  install_name_tool -add_rpath @executable_path/runtime "${BOXRUN_HOME}/boxrun" 2>/dev/null || true
+fi
+
 cp -f "$RUNTIME_DIR"/* "${BOXRUN_HOME}/runtime/" 2>/dev/null || true
 chmod +x "${BOXRUN_HOME}/runtime/boxlite-guest" "${BOXRUN_HOME}/runtime/boxlite-shim" 2>/dev/null || true