Stop publishing a System Extension nobody can install

The release built, signed, notarized, stapled and published
USBIPDSystemExtension.systemextension.tar.gz on every tag. No installed
component could locate it, and it was not a System Extension bundle by
structure: the workflow's `find` for a SwiftPM-produced bundle never matched,
so the fallback synthesised one from an inline heredoc with no NSExtension
dict and no IOKitPersonalities. It also wrote Contents/embedded.provisionprofile
empty whenever DRIVERKIT_PROVISIONING_PROFILE was unset, which was always —
so the managed DriverKit entitlements it was signed with were inert.

Removed: the product build, the hand-rolled bundle, the profile embed, the
signing, the notarization and stapling, the tarball, the checksum
extraction, and the systemextension_url / systemextension_sha256 fields in
the Homebrew metadata. Verified before removing that nothing consumes them:
validate-homebrew-metadata.sh requires only version, archive_url, sha256 and
timestamp, and the tap's formula-sync.yml reads only the two per-arch
binaries.

Signing collapses to one path. usbipd carried
com.apple.developer.system-extension.install, a restricted entitlement AMFI
kills without an authorising profile — measured as exit 137 on launch — so
the workflow had to withhold entitlements whenever no profile was present.
With nothing to install, there is nothing restricted to claim:
usbipd.entitlements is deleted and every artifact is signed the same way.
If a DriverKit extension arrives it will live in an app bundle in
/Applications, and that app, not this binary, will need the entitlement.

The release notes no longer tell people to run
`sudo usbipd install-system-extension`, a command removed some releases ago,
and point at the per-arch binaries rather than the compatibility copy.

Also drops the CI step that built the deleted product.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017rmyikdjWveP99ZUCDLY89

Author: beriberikix

.github/workflows/ci.yml

@@ -80,9 +80,6 @@ jobs:
           echo "Building main targets..."
           swift build --verbose
           
-          echo "Building System Extension target..."
-          swift build --product USBIPDSystemExtension --verbose
-          
           echo "Building test server..."
           swift build --product QEMUTestServer --verbose
 

.github/workflows/release.yml

@@ -30,7 +30,6 @@ env:
   # Base64-encoded .provisionprofile carrying the DriverKit managed capabilities.
   # Without it the DriverKit entitlements are signed in but inert — see
   # Documentation/development/entitlement-validation.md
-  DRIVERKIT_PROVISIONING_PROFILE: ${{ secrets.DRIVERKIT_PROVISIONING_PROFILE }}
 
 jobs:
   release-validation:
@@ -184,11 +183,8 @@ jobs:
 
           echo "🔍 Universal binary: $(lipo -archs "$UNIVERSAL")"
 
-          # The rest of the build stays host-architecture: only the CLI is distributed
-          # to end users, and the system extension is inert (see the formula).
+          # The rest of the build stays host-architecture: only the CLI is distributed.
           swift build --configuration release
-          echo "🏗️ Building system extension bundle..."
-          swift build --configuration release --product USBIPDSystemExtension
 
           # Split into per-architecture artifacts. lipo -thin drops the code signature,
           # so each slice is signed separately further down — signing before this point
@@ -212,68 +208,6 @@ jobs:
           USBIPD_PATH="$ARTIFACTS_DIR/usbipd-$VERSION-macos"
           cp "$USBIPD_ARM64" "$USBIPD_PATH"
           
-          # Package system extension bundle
-          echo "📦 Packaging system extension bundle..."
-          BUNDLE_PATH=$(find .build/release -name "*.systemextension" -type d | head -1)
-          if [ -n "$BUNDLE_PATH" ]; then
-            echo "Found system extension bundle at: $BUNDLE_PATH"
-            cp -R "$BUNDLE_PATH" "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension"
-          else
-            echo "Creating system extension bundle structure..."
-            mkdir -p "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension/Contents/MacOS"
-            cp .build/release/USBIPDSystemExtension "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension/Contents/MacOS/"
-            
-            # Create Info.plist for system extension
-            cat > "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension/Contents/Info.plist" << EOF
-          <?xml version="1.0" encoding="UTF-8"?>
-          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-          <plist version="1.0">
-          <dict>
-              <key>CFBundleExecutable</key>
-              <string>USBIPDSystemExtension</string>
-              <key>CFBundleIdentifier</key>
-              <string>com.github.usbipd-mac.systemextension</string>
-              <key>CFBundleInfoDictionaryVersion</key>
-              <string>6.0</string>
-              <key>CFBundleName</key>
-              <string>USBIPD System Extension</string>
-              <key>CFBundlePackageType</key>
-              <string>SYSX</string>
-              <key>CFBundleShortVersionString</key>
-              <string>$VERSION</string>
-              <key>CFBundleVersion</key>
-              <string>$VERSION</string>
-              <key>NSSystemExtensionUsageDescription</key>
-              <string>Enables USB device sharing over IP networks</string>
-          </dict>
-          </plist>
-          EOF
-          fi
-          
-          # Copy entitlements files for code signing
-          echo "📋 Copying entitlements..."
-          cp Sources/SystemExtension/SystemExtension.entitlements "$ARTIFACTS_DIR/"
-          cp usbipd.entitlements "$ARTIFACTS_DIR/"
-
-          # Embed the provisioning profile into the system extension bundle.
-          #
-          # The DriverKit entitlements in SystemExtension.entitlements are managed
-          # capabilities: codesign will happily embed the keys, but the kernel only
-          # honours them when the same keys appear in an Apple-issued provisioning
-          # profile shipped inside the bundle. Without this the entitlements are inert,
-          # which is indistinguishable at signing time from them working.
-          if [ -n "$DRIVERKIT_PROVISIONING_PROFILE" ]; then
-            echo "📋 Embedding provisioning profile..."
-            if [ -d "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" ]; then
-              echo "$DRIVERKIT_PROVISIONING_PROFILE" | base64 --decode \
-                > "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension/Contents/embedded.provisionprofile"
-              echo "✅ Provisioning profile embedded"
-            else
-              echo "::warning::DRIVERKIT_PROVISIONING_PROFILE set but no system extension bundle to embed it in"
-            fi
-          else
-            echo "::warning::No DRIVERKIT_PROVISIONING_PROFILE secret configured. The DriverKit entitlements will be signed into the bundle but will not take effect, so device claiming will fail at runtime. See Documentation/development/entitlement-validation.md"
-          fi
 
           # Package QEMU test server if available
           if [ -f .build/release/QEMUTestServer ]; then
@@ -284,97 +218,34 @@ jobs:
           # Code sign binaries if certificates available
           if [ -n "$DEVELOPER_ID_CERTIFICATE" ]; then
             echo "🔒 Code signing release artifacts..."
-            # usbipd carries com.apple.developer.system-extension.install, which is a
-            # RESTRICTED entitlement: AMFI kills a binary that claims it without a
-            # provisioning profile authorising it. Measured, not assumed — a binary
-            # signed with just that key and no profile exits 137 on launch.
+            # usbipd needs no entitlements. It used to carry
+            # com.apple.developer.system-extension.install so it could activate the
+            # extension — a RESTRICTED entitlement that AMFI kills without an
+            # authorising provisioning profile, measured as exit 137 on launch. The
+            # signing step therefore had to withhold it whenever no profile was
+            # present, which was always. With the extension gone there is nothing to
+            # install and nothing restricted to claim, so there is one path.
+            #
+            # If a DriverKit extension arrives it will live in an app bundle in
+            # /Applications, and that app — not this binary — is what will need the
+            # install entitlement and a profile.
             #
-            # So the entitlements are only applied when a profile is present. Without
-            # one, sign exactly as before: hardened runtime for notarization, no
-            # entitlements, and a daemon that actually starts.
             # Every usbipd artifact is signed, including both architecture slices:
             # lipo -thin strips the signature, so an unsigned slice would ship.
             for target in "$USBIPD_PATH" "$USBIPD_ARM64" "$USBIPD_X86_64"; do
               [ -f "$target" ] || continue
-              if [ -n "$DRIVERKIT_PROVISIONING_PROFILE" ]; then
-                echo "   signing $(basename "$target") with entitlements (provisioning profile present)"
-                codesign --sign "Developer ID Application" --entitlements "$ARTIFACTS_DIR/usbipd.entitlements" --options runtime --timestamp "$target" || echo "::warning::Code signing failed for $(basename "$target")"
-              else
-                echo "   signing $(basename "$target") without entitlements (no provisioning profile)"
-                codesign --sign "Developer ID Application" --options runtime --timestamp "$target" || echo "::warning::Code signing failed for $(basename "$target")"
-              fi
+              echo "   signing $(basename "$target")"
+              codesign --sign "Developer ID Application" --options runtime --timestamp "$target" || echo "::warning::Code signing failed for $(basename "$target")"
             done
-            if [ -z "$DRIVERKIT_PROVISIONING_PROFILE" ]; then
-              echo "::warning::usbipd signed without entitlements. It cannot install the System Extension, but it will launch. Set DRIVERKIT_PROVISIONING_PROFILE to enable them."
-            fi
 
-            # Sign system extension bundle
-            if [ -d "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" ]; then
-              echo "🔒 Code signing system extension bundle..."
-              codesign --sign "Developer ID Application" --entitlements "$ARTIFACTS_DIR/SystemExtension.entitlements" --options runtime --timestamp "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" || echo "::warning::Code signing failed for system extension"
-            fi
-            
             if [ -f "$QEMU_SERVER_PATH" ]; then
               codesign --sign "Developer ID Application" --timestamp "$QEMU_SERVER_PATH" || echo "::warning::Code signing failed for QEMUTestServer"
             fi
             echo "✅ Code signing completed"
-
-            # Read the entitlements back out of the signatures rather than trusting
-            # what we passed in. A managed capability that was silently dropped looks
-            # identical to a successful signing run without this check.
-            echo "🔍 Verifying embedded entitlements..."
-            codesign -d --entitlements - --xml "$USBIPD_PATH" 2>/dev/null || echo "::warning::Could not read back usbipd entitlements"
-            if [ -d "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" ]; then
-              SYSEXT_ENTITLEMENTS=$(codesign -d --entitlements - --xml "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" 2>/dev/null || echo "")
-              echo "$SYSEXT_ENTITLEMENTS"
-              if ! echo "$SYSEXT_ENTITLEMENTS" | grep -q "com.apple.developer.driverkit.transport.usb"; then
-                echo "::warning::com.apple.developer.driverkit.transport.usb is not present in the signed system extension. Device claiming will not work."
-              fi
-            fi
-
-            # Notarize system extension bundle if notarization credentials available
-            if [ -n "$NOTARIZATION_USERNAME" ] && [ -n "$NOTARIZATION_PASSWORD" ] && [ -d "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" ]; then
-              echo "🔒 Notarizing system extension bundle..."
-              
-              # Create zip for notarization (required format)
-              ditto -c -k --keepParent "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" "$ARTIFACTS_DIR/USBIPDSystemExtension_notarization.zip"
-              
-              # Submit for notarization with timeout
-              echo "📤 Submitting system extension for notarization..."
-              xcrun notarytool submit "$ARTIFACTS_DIR/USBIPDSystemExtension_notarization.zip" \
-                --apple-id "$NOTARIZATION_USERNAME" \
-                --password "$NOTARIZATION_PASSWORD" \
-                --team-id "592A3U6J26" \
-                --wait --timeout 10m || {
-                  echo "::warning::System extension notarization failed or timed out"
-                  echo "::warning::This may prevent proper System Extension installation"
-                }
-              
-              # Staple the notarization if successful
-              if xcrun stapler staple "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" 2>/dev/null; then
-                echo "✅ System extension notarization completed and stapled"
-              else
-                echo "::warning::Failed to staple notarization to system extension"
-              fi
-              
-              # Clean up notarization zip
-              rm -f "$ARTIFACTS_DIR/USBIPDSystemExtension_notarization.zip"
-            else
-              echo "::warning::Notarization credentials not available - System Extension will not be notarized"
-              echo "::warning::This will prevent proper System Extension installation on user machines"
-            fi
           else
             echo "::warning::No code signing certificates available - binaries will be unsigned"
           fi
           
-          # Create compressed system extension bundle for release
-          if [ -d "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension" ]; then
-            echo "📦 Creating compressed system extension bundle..."
-            tar -czf "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension.tar.gz" -C "$ARTIFACTS_DIR" USBIPDSystemExtension.systemextension
-            # Remove the directory after creating the tar.gz to avoid upload conflicts
-            rm -rf "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension"
-          fi
-          
           # Create archive with all non-tar.gz files 
           ARCHIVE_PATH="$ARTIFACTS_DIR/usbipd-mac-$VERSION.tar.gz"
           # Include all files except other .tar.gz files
@@ -386,9 +257,6 @@ jobs:
           if [ -f "$QEMU_SERVER_PATH" ]; then
             PATHS="$PATHS,$QEMU_SERVER_PATH"
           fi
-          if [ -f "$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension.tar.gz" ]; then
-            PATHS="$PATHS,$ARTIFACTS_DIR/USBIPDSystemExtension.systemextension.tar.gz"
-          fi
           PATHS="$PATHS,$ARCHIVE_PATH"
           
           echo "paths=$PATHS" >> $GITHUB_OUTPUT
@@ -441,15 +309,6 @@ jobs:
           CLI_SHA256=$(shasum -a 256 usbipd-${{ needs.release-validation.outputs.version }}-macos | cut -d' ' -f1)
           echo "CLI_SHA256=$CLI_SHA256" >> $GITHUB_ENV
           
-          if [ -f "USBIPDSystemExtension.systemextension.tar.gz" ]; then
-            SYSEXT_SHA256=$(shasum -a 256 USBIPDSystemExtension.systemextension.tar.gz | cut -d' ' -f1)
-            echo "SYSEXT_SHA256=$SYSEXT_SHA256" >> $GITHUB_ENV
-            echo "✅ System extension checksum: ${SYSEXT_SHA256:0:16}..."
-          else
-            echo "SYSEXT_SHA256=" >> $GITHUB_ENV
-            echo "⚠️  System extension bundle not found"
-          fi
-          
           echo "::notice title=Checksums Generated::SHA256 checksums created for all artifacts"
           echo "✅ Checksums saved to $CHECKSUMS_FILE"
           echo "✅ CLI binary checksum: ${CLI_SHA256:0:16}..."
@@ -570,18 +429,6 @@ jobs:
               "generator": "usbipd-mac homebrew metadata generator v2.0"
           EOF
           
-          # Add system extension metadata if available
-          if [ -n "${SYSEXT_SHA256:-}" ] && [ "$SYSEXT_SHA256" != "" ]; then
-            cat >> "$METADATA_FILE" << EOF
-          ,
-              "systemextension_url": "https://github.com/beriberikix/usbipd-mac/releases/download/$VERSION/USBIPDSystemExtension.systemextension.tar.gz",
-              "systemextension_sha256": "$SYSEXT_SHA256"
-          EOF
-            echo "✅ System extension metadata included"
-          else
-            echo "⚠️  System extension metadata not available"
-          fi
-          
           cat >> "$METADATA_FILE" << EOF
             },
             "formula_updates": {
@@ -590,15 +437,6 @@ jobs:
               "url_pattern": "releases/download/{{VERSION}}/usbipd-{{VERSION}}-macos"
           EOF
           
-          # Add system extension formula updates if available
-          if [ -n "${SYSEXT_SHA256:-}" ] && [ "$SYSEXT_SHA256" != "" ]; then
-            cat >> "$METADATA_FILE" << EOF
-          ,
-              "sysext_sha256_placeholder": "{{SYSEXT_SHA256}}",
-              "sysext_url_pattern": "releases/download/{{VERSION}}/USBIPDSystemExtension.systemextension.tar.gz"
-          EOF
-          fi
-          
           cat >> "$METADATA_FILE" << EOF
             }
           }
@@ -720,7 +558,6 @@ jobs:
           
           This release includes the following artifacts:
           - **usbipd**: Main USB/IP daemon executable for macOS
-          - **USBIPDSystemExtension.systemextension.tar.gz**: System Extension bundle for advanced USB device access
           - **QEMUTestServer**: QEMU integration test server (if available)
           - **Archive**: Complete packaged release (tar.gz)
           - **Checksums**: SHA256 verification checksums
@@ -736,22 +573,19 @@ jobs:
           \`\`\`
           
           **Manual Installation:**
-          1. Download \`usbipd-$VERSION-macos\` and \`USBIPDSystemExtension.systemextension.tar.gz\`
-          2. Make the binary executable: \`chmod +x usbipd-$VERSION-macos\`
-          3. Extract and install the system extension bundle
-          4. Install the system extension: \`sudo ./usbipd-$VERSION-macos install-system-extension\`
+          1. Download \`usbipd-$VERSION-macos-arm64\` (Apple silicon) or \`usbipd-$VERSION-macos-x86_64\` (Intel)
+          2. Make it executable: \`chmod +x usbipd-$VERSION-macos-*\`
+          3. Move it somewhere on your PATH
           
           ## Requirements
           
           - macOS 11.0 or later
           - Administrator privileges for USB device access
-          - System extension approval in System Preferences
           
           ## Notes
           
           - Binaries are code-signed with Apple Developer ID when available
-          - System extension requires user approval on first installation
-          - Full functionality requires both the CLI binary and system extension
+          - Devices macOS has bound a driver to are refused by \`bind\`, which names the owner
           EOF
           
           echo "::notice title=Release Notes Ready::Release notes generated successfully"