[Marc-André Moreau (mamoreau-devolutions)]

Enable Devolutions Agent on macOS with separate arm64 and x64 installer packages. Install and start the Agent as a root launchd daemon, keep existing configuration root-only during upgrades, and wait for launchd to unload before replacing or removing package files. PowerShell Universal jobs require Microsoft's macOS PowerShell package; the root daemon does not search Homebrew prefixes. The uninstaller can preserve or purge configuration.

Build, sign, notarize, and publish the packages through the release workflows using the configured Apple credentials.

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

[github-actions]

Let maintainers know that an action is required on their side

• Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)

• Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release

• Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)

• Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries

[Marc-André Moreau (mamoreau-devolutions)]

Change summary (772c20f, c08a0ff)

• Production code: package/AgentMacOS/com.devolutions.agent.plist:14 restricts the root daemon PATH to Microsoft PowerShell and system directories. package/AgentMacOS/scripts/postinstall:10-20 rejects symlinks and resets the existing data directory to root:wheel 700 with ACLs removed. package/AgentMacOS/scripts/preinstall:19-22 and package/AgentMacOS/devolutions-agent-uninstall:39-42 abort if launchd does not unload before replacement or removal.
• Tests: package/AgentMacOS/Test-Package.sh:36-41,49-54 prepares a user-owned 0755 data directory with a broad ACL, then checks the root-only permissions, ACL removal, and daemon PATH. The privileged installation smoke test passed on macOS arm64; full CI run 42916587708 passed on retry after a transient GitHub Actions cache DNS failure.
• Other files: package/AgentMacOS/README.md:32-33 documents the Microsoft PowerShell package and restricted PATH; .github/workflows/package.yml removes the obsolete installer-signing note.
• Review: All 3 inline review threads are resolved.
• UNTESTED: package/AgentMacOS/scripts/postinstall:10-15 symlink rejection and the unload-timeout failure paths in package/AgentMacOS/scripts/preinstall:19-22 and package/AgentMacOS/devolutions-agent-uninstall:39-42 are not exercised by the smoke test. Verify these branches when changing path handling or unload waits.

Note

Human-tuned, LLM-assisted content.

[Copilot]

🟡 Changes recommended

Critical issues permit root execution of user-controlled PowerShell when PSU is enabled and expose credentials through insecure permissions on existing configuration directories.

3 open issues

• Root daemon executes PowerShell from a user-writable PATH · New
• Existing data directories can expose configuration credentials · New
• Preinstall proceeds when the launch daemon fails to unload · New

What changed in this PR

This PR adds macOS Agent installer packages to the build and release pipeline, with production signing and notarization verification for both architectures.

Changes:

• Add architecture-specific packages, launchd configuration, installation scripts, and lifecycle checks.
• Sign Agent binaries and packages, notarize packages, and verify production artifacts.
• Publish macOS packages and document installation and required signing secrets.

File	Description
package/​AgentMacOS/​Test-Package.sh	Checks installation, service control, upgrade, and removal.
package/​AgentMacOS/​scripts/​preinstall	Stops the existing service before payload replacement.
package/​AgentMacOS/​scripts/​postinstall	Initializes configuration and loads the daemon.
package/​AgentMacOS/​README.md	Documents installation, operation, removal, and packaging.
package/​AgentMacOS/​distribution.xml	Defines architecture and OS requirements for the installer.
package/​AgentMacOS/​devolutions-agent-uninstall	Removes the service and optionally purges stored data.
package/​AgentMacOS/​com.devolutions.agent.plist	Defines the launchd daemon and its environment.
devolutions-agent/​src/​cli.rs	Uses the package’s launchd label for macOS service control.
ci/​tlk.ps1	Builds and optionally signs macOS Agent packages.
.github/​workflows/​release.yml	Includes both macOS packages in release outputs.
.github/​workflows/​README.md	Documents macOS signing and notarization secrets.
.github/​workflows/​package.yml	Signs, notarizes, and verifies macOS Agent artifacts.
.github/​workflows/​ci.yml	Builds macOS Agent packages and checks arm64 installation.

_{Review effort: Balanced}