refactor(installer): use Homebrew for macOS dev installs

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

.github/workflows/release-dev.yml

@@ -753,6 +753,15 @@ jobs:
             openshell-sandbox-aarch64-unknown-linux-gnu.tar.gz > openshell-sandbox-checksums-sha256.txt
           cat openshell-sandbox-checksums-sha256.txt
 
+      - name: Generate Homebrew formula
+        run: |
+          set -euo pipefail
+          python3 tasks/scripts/release.py generate-homebrew-formula \
+            --release-tag dev \
+            --release-dir release \
+            --output release/openshell.rb
+          cat release/openshell.rb
+
       - name: Attest VM driver artifacts
         uses: actions/attest@v4
         with:
@@ -859,6 +868,7 @@ jobs:
             release/openshell-driver-vm-aarch64-unknown-linux-gnu.tar.gz
             release/openshell-driver-vm-aarch64-apple-darwin.tar.gz
             release/*.whl
+            release/openshell.rb
             release/openshell-checksums-sha256.txt
             release/openshell-gateway-checksums-sha256.txt
             release/openshell-sandbox-checksums-sha256.txt

.github/workflows/release-tag.yml

@@ -837,15 +837,6 @@ jobs:
             curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=${{ env.RELEASE_TAG }} sh
             ```
 
-            ### Apple Silicon macOS local gateway via Homebrew
-
-            ```bash
-            curl -fsSLo /tmp/openshell.rb https://github.com/NVIDIA/OpenShell/releases/download/${{ env.RELEASE_TAG }}/openshell.rb
-            brew install /tmp/openshell.rb
-            brew services restart openshell
-            openshell gateway add http://127.0.0.1:17670 --local --name local
-            ```
-
           files: |
             release/openshell-x86_64-unknown-linux-musl.tar.gz
             release/openshell-aarch64-unknown-linux-musl.tar.gz

README.md

@@ -33,22 +33,11 @@ curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh |
 uv tool install -U openshell
 ```
 
-**Apple Silicon macOS local gateway via Homebrew formula:**
-
-```bash
-VERSION=v0.0.10 # replace with the release tag you want
-curl -fsSLo /tmp/openshell.rb "https://github.com/NVIDIA/OpenShell/releases/download/${VERSION}/openshell.rb"
-brew install /tmp/openshell.rb
-brew services restart openshell
-openshell gateway add http://127.0.0.1:17670 --local --name local
-```
-
 The binary and PyPI methods install the latest stable release by default. To
 install a specific version, set `OPENSHELL_VERSION` (binary), pin the version
-with `uv tool install openshell==<version>`, or download the matching
-`openshell.rb` formula from a tagged release. A
-[`dev` release](https://github.com/NVIDIA/OpenShell/releases/tag/dev) is also
-available that tracks the latest commit on `main`.
+with `uv tool install openshell==<version>`. A [`dev`
+release](https://github.com/NVIDIA/OpenShell/releases/tag/dev) is also available
+that tracks the latest commit on `main`.
 
 ### Create a sandbox
 

architecture/custom-vm-runtime.md

@@ -325,10 +325,9 @@ only for the kernel build).
 
 macOS driver binaries produced via osxcross are not codesigned. Development
 builds are signed automatically by `tasks/scripts/gateway-vm.sh`
-(registered as `mise run gateway:vm`) and by `install-dev.sh` when it installs
-the Apple Silicon development tarballs from the selected release. Tagged
-releases also publish a generated Homebrew formula that ad-hoc signs the
-installed driver in `post_install`. A packaged release needs signing in CI.
+(registered as `mise run gateway:vm`) and by the generated Homebrew formula
+when `install-dev.sh` installs the selected release on Apple Silicon macOS. A
+packaged release needs signing in CI.
 
 ## Rollout Strategy
 

crates/openshell-driver-vm/README.md

@@ -182,14 +182,11 @@ On Linux amd64 and arm64, `install-dev.sh` installs the Debian package from the
 selected `OPENSHELL_VERSION` release tag. That package includes
 `openshell-gateway` and `openshell-driver-vm`.
 
-On Apple Silicon macOS, `install-dev.sh` installs `openshell`,
-`openshell-gateway`, and `openshell-driver-vm` from the selected release
-tarballs. It ad-hoc signs `openshell-driver-vm` with the Hypervisor entitlement
-before registering the local LaunchAgent gateway.
-
-Tagged releases also publish an `openshell.rb` release asset. Installing that
-formula by path lets Homebrew own the binary layout and `brew services` gateway
-lifecycle without requiring a tap or cask yet.
+On Apple Silicon macOS, `install-dev.sh` installs the generated `openshell.rb`
+formula from the selected release. Homebrew installs `openshell`,
+`openshell-gateway`, and `openshell-driver-vm`, ad-hoc signs the driver with
+the Hypervisor entitlement in `post_install`, and owns the `brew services`
+gateway lifecycle.
 
 ## Relationship to `openshell-vm`
 
@@ -198,4 +195,4 @@ lifecycle without requiring a tap or cask yet.
 ## TODOs
 
 - The gateway still configures the driver via CLI args; this will move to a gRPC bootstrap call so the driver interface is uniform across backends. See the `TODO(driver-abstraction)` notes in `crates/openshell-server/src/lib.rs` and `crates/openshell-server/src/compute/vm.rs`.
-- macOS local builds are codesigned by `tasks/scripts/gateway-vm.sh`; `install-dev.sh` and the tagged-release Homebrew formula sign the release tarball driver for local installs.
+- macOS local builds are codesigned by `tasks/scripts/gateway-vm.sh`; the generated Homebrew formula signs the release tarball driver for local installs.

docs/get-started/quickstart.mdx

@@ -33,17 +33,6 @@ If you prefer [uv](https://docs.astral.sh/uv/):
 uv tool install -U openshell
 ```
 
-Tagged releases also publish a temporary Homebrew formula for Apple Silicon
-macOS local gateways:
-
-```shell
-VERSION=v0.0.10 # replace with the release tag you want
-curl -fsSLo /tmp/openshell.rb "https://github.com/NVIDIA/OpenShell/releases/download/${VERSION}/openshell.rb"
-brew install /tmp/openshell.rb
-brew services restart openshell
-openshell gateway add http://127.0.0.1:17670 --local --name local
-```
-
 After installing the CLI, run `openshell --help` in your terminal to see the full CLI reference.
 
 <Tip>