lczyk · lczyk · Jul 28, 2026 · Jul 28, 2026 · Jul 28, 2026 · Jul 28, 2026
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -50,8 +50,8 @@ jobs:
 
       - name: Assert committed inlined yamls match templates + scripts
         run: |
-          make inlined-yaml-files
+          make inline
           if ! git diff --exit-code inlined/; then
-            echo "::error::inlined/*.yaml is stale -- run 'make inlined-yaml-files' and commit the result"
+            echo "::error::inlined/*.yaml is stale -- run 'make inline' and commit the result"
             exit 1
           fi
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -49,7 +49,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Regenerate inlined yamls
-        run: make inlined-yaml-files
+        run: make inline
 
       - name: Restore cached binaries
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

diff --git a/README.md b/README.md
@@ -55,13 +55,6 @@ BREAD_NET=publish spread   # force port-publishing (e.g. to test the macOS path
 BREAD_NET=bridge  spread   # force bridge IPs
 ```
 
-one more macOS gotcha: spread packs the project with the host `tar`, and macOS `tar` injects `._*` AppleDouble sidecar files (resource-fork metadata) into the archive. they unpack as real files in the container and can break tools that scan for `*.yaml` etc. export `COPYFILE_DISABLE=1` so macOS `tar` skips them:
-
-```
-export COPYFILE_DISABLE=1
-spread
-```
-
 ## install spread
 
 prefer a precompiled spread CLI over `go install`? same release ships statically-linked binaries for linux amd64 / arm64 / s390x / ppc64le:
@@ -137,7 +130,7 @@ make build-bread-chisel-releases ARCH=arm64
 regenerate distribution yamls (already committed under `inlined/`, but regenerate after script edits):
 
 ```
-make inlined-yaml-files
+make inline
 ```
 
 run the demo (LTS systems only -- 24.04 + 26.04 x amd64 / arm64). builds the required `bread` images first if missing:

diff --git a/demo/spread.yaml b/demo/spread.yaml
@@ -11,6 +11,19 @@ exclude:
   - .git
   - .github
 
+# macOS tar packs an AppleDouble `._*` sidecar next to every file; they unpack as
+# real files on the remote. `exclude:` can't drop them (tar synthesises them below
+# its glob filter), so extract and repack with COPYFILE_DISABLE=1.
+repack: |
+  if [ "$(uname -s)" = Darwin ]; then
+      tmp=$(mktemp -d)
+      trap 'rm -rf "$tmp"' EXIT
+      tar -xf - -C "$tmp" <&3
+      ( cd "$tmp" && shopt -s dotglob && COPYFILE_DISABLE=1 tar -cf - -- * ) >&4
+  else
+      cat <&3 >&4
+  fi
+
 backends:
   docker:
     type: adhoc

diff --git a/hack/inline_scripts.rb b/hack/inline_scripts.rb
@@ -1,13 +1,12 @@
 #!/usr/bin/env ruby
 # Inline `source scripts/<name>.sh` references inside spread yaml templates.
 #
-# For each line matching `allocate: source scripts/<name>.sh` or
-# `discard: source scripts/<name>.sh`, substitute the script's content as a
-# yaml block scalar under the matching key.
+# For each line matching `<key>: source scripts/<name>.sh`, substitute the
+# script's content as a yaml block scalar under the matching key.
 
 require "fileutils"
 
-LINE_RE = /\A(?<indent>\s*)(?<key>allocate|discard):\s*source\s+(?<path>scripts\/[\w.-]+\.sh)\s*\z/
+LINE_RE = /\A(?<indent>\s*)(?<key>allocate|discard|repack):\s*source\s+(?<path>scripts\/[\w.-]+\.sh)\s*\z/
 
 def inline_scripts(content, yaml_indent: 2)
   out = []

diff --git a/inlined/bread-22.04.yaml b/inlined/bread-22.04.yaml
@@ -11,6 +11,18 @@ exclude:
   - .git
   - .github
 
+repack: |
+  # macOS tar packs an AppleDouble ._* sidecar next to every file; they unpack as
+  # real files on the remote. Repack to remove them.
+  if [ "$(uname -s)" = Darwin ]; then
+      tmp=$(mktemp -d)
+      trap 'rm -rf "$tmp"' EXIT
+      tar -xf - -C "$tmp" <&3
+      ( cd "$tmp" && shopt -s dotglob && COPYFILE_DISABLE=1 tar -cf - -- * ) >&4
+  else
+      cat <&3 >&4
+  fi
+
 backends:
   docker:
     type: adhoc

diff --git a/inlined/bread-24.04.yaml b/inlined/bread-24.04.yaml
@@ -11,6 +11,18 @@ exclude:
   - .git
   - .github
 
+repack: |
+  # macOS tar packs an AppleDouble ._* sidecar next to every file; they unpack as
+  # real files on the remote. Repack to remove them.
+  if [ "$(uname -s)" = Darwin ]; then
+      tmp=$(mktemp -d)
+      trap 'rm -rf "$tmp"' EXIT
+      tar -xf - -C "$tmp" <&3
+      ( cd "$tmp" && shopt -s dotglob && COPYFILE_DISABLE=1 tar -cf - -- * ) >&4
+  else
+      cat <&3 >&4
+  fi
+
 backends:
   docker:
     type: adhoc

diff --git a/inlined/bread-25.10.yaml b/inlined/bread-25.10.yaml
@@ -11,6 +11,18 @@ exclude:
   - .git
   - .github
 
+repack: |
+  # macOS tar packs an AppleDouble ._* sidecar next to every file; they unpack as
+  # real files on the remote. Repack to remove them.
+  if [ "$(uname -s)" = Darwin ]; then
+      tmp=$(mktemp -d)
+      trap 'rm -rf "$tmp"' EXIT
+      tar -xf - -C "$tmp" <&3
+      ( cd "$tmp" && shopt -s dotglob && COPYFILE_DISABLE=1 tar -cf - -- * ) >&4
+  else
+      cat <&3 >&4
+  fi
+
 backends:
   docker:
     type: adhoc

diff --git a/inlined/bread-26.04.yaml b/inlined/bread-26.04.yaml
@@ -11,6 +11,18 @@ exclude:
   - .git
   - .github
 
+repack: |
+  # macOS tar packs an AppleDouble ._* sidecar next to every file; they unpack as
+  # real files on the remote. Repack to remove them.
+  if [ "$(uname -s)" = Darwin ]; then
+      tmp=$(mktemp -d)
+      trap 'rm -rf "$tmp"' EXIT
+      tar -xf - -C "$tmp" <&3
+      ( cd "$tmp" && shopt -s dotglob && COPYFILE_DISABLE=1 tar -cf - -- * ) >&4
+  else
+      cat <&3 >&4
+  fi
+
 backends:
   docker:
     type: adhoc

diff --git a/inlined/bread-26.10.yaml b/inlined/bread-26.10.yaml
@@ -11,6 +11,18 @@ exclude:
   - .git
   - .github
 
+repack: |
+  # macOS tar packs an AppleDouble ._* sidecar next to every file; they unpack as
+  # real files on the remote. Repack to remove them.
+  if [ "$(uname -s)" = Darwin ]; then
+      tmp=$(mktemp -d)
+      trap 'rm -rf "$tmp"' EXIT
+      tar -xf - -C "$tmp" <&3
+      ( cd "$tmp" && shopt -s dotglob && COPYFILE_DISABLE=1 tar -cf - -- * ) >&4
+  else
+      cat <&3 >&4
+  fi
+
 backends:
   docker:
     type: adhoc

diff --git a/inlined/bread-chisel-releases-22.04.yaml b/inlined/bread-chisel-releases-22.04.yaml
@@ -18,6 +18,18 @@ exclude:
   - work
   - rootfs
 
+repack: |
+  # macOS tar packs an AppleDouble ._* sidecar next to every file; they unpack as
+  # real files on the remote. Repack to remove them.
+  if [ "$(uname -s)" = Darwin ]; then
+      tmp=$(mktemp -d)
+      trap 'rm -rf "$tmp"' EXIT
+      tar -xf - -C "$tmp" <&3
+      ( cd "$tmp" && shopt -s dotglob && COPYFILE_DISABLE=1 tar -cf - -- * ) >&4
+  else
+      cat <&3 >&4
+  fi
+
 backends:
   docker:
     type: adhoc

diff --git a/inlined/bread-chisel-releases-24.04.yaml b/inlined/bread-chisel-releases-24.04.yaml
@@ -18,6 +18,18 @@ exclude:
   - work
   - rootfs
 
+repack: |
+  # macOS tar packs an AppleDouble ._* sidecar next to every file; they unpack as
+  # real files on the remote. Repack to remove them.
+  if [ "$(uname -s)" = Darwin ]; then
+      tmp=$(mktemp -d)
+      trap 'rm -rf "$tmp"' EXIT
+      tar -xf - -C "$tmp" <&3
+      ( cd "$tmp" && shopt -s dotglob && COPYFILE_DISABLE=1 tar -cf - -- * ) >&4
+  else
+      cat <&3 >&4
+  fi
+
 backends:
   docker:
     type: adhoc

diff --git a/inlined/bread-chisel-releases-25.10.yaml b/inlined/bread-chisel-releases-25.10.yaml
@@ -18,6 +18,18 @@ exclude:
   - work
   - rootfs
 
+repack: |
+  # macOS tar packs an AppleDouble ._* sidecar next to every file; they unpack as
+  # real files on the remote. Repack to remove them.
+  if [ "$(uname -s)" = Darwin ]; then
+      tmp=$(mktemp -d)
+      trap 'rm -rf "$tmp"' EXIT
+      tar -xf - -C "$tmp" <&3
+      ( cd "$tmp" && shopt -s dotglob && COPYFILE_DISABLE=1 tar -cf - -- * ) >&4
+  else
+      cat <&3 >&4
+  fi
+
 backends:
   docker:
     type: adhoc

diff --git a/inlined/bread-chisel-releases-26.04.yaml b/inlined/bread-chisel-releases-26.04.yaml
@@ -18,6 +18,18 @@ exclude:
   - work
   - rootfs
 
+repack: |
+  # macOS tar packs an AppleDouble ._* sidecar next to every file; they unpack as
+  # real files on the remote. Repack to remove them.
+  if [ "$(uname -s)" = Darwin ]; then
+      tmp=$(mktemp -d)
+      trap 'rm -rf "$tmp"' EXIT
+      tar -xf - -C "$tmp" <&3
+      ( cd "$tmp" && shopt -s dotglob && COPYFILE_DISABLE=1 tar -cf - -- * ) >&4
+  else
+      cat <&3 >&4
+  fi
+
 backends:
   docker:
     type: adhoc

diff --git a/inlined/bread-chisel-releases-26.10.yaml b/inlined/bread-chisel-releases-26.10.yaml
@@ -18,6 +18,18 @@ exclude:
   - work
   - rootfs
 
+repack: |
+  # macOS tar packs an AppleDouble ._* sidecar next to every file; they unpack as
+  # real files on the remote. Repack to remove them.
+  if [ "$(uname -s)" = Darwin ]; then
+      tmp=$(mktemp -d)
+      trap 'rm -rf "$tmp"' EXIT
+      tar -xf - -C "$tmp" <&3
+      ( cd "$tmp" && shopt -s dotglob && COPYFILE_DISABLE=1 tar -cf - -- * ) >&4
+  else
+      cat <&3 >&4
+  fi
+
 backends:
   docker:
     type: adhoc

diff --git a/makefile b/makefile
@@ -56,7 +56,7 @@ help:  ## Show this help
 		awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-40s\033[0m %s\n", $$1, $$2}'
 
 .PHONY: all
-all: build-all inlined-yaml-files  ## Build all images + generate inlined yamls
+all: build-all inline  ## Build all images + generate inlined yamls
 
 .PHONY: build-all
 build-all: build-bread build-bread-chisel-releases  ## Build all images (narrow via VER=... ARCH=...)
@@ -84,7 +84,7 @@ SPREAD_ARGS ?=
 TEST_STAMPS := .stamp/bread-test-26.04-$(SELECTED_ARCH) \
 	$(foreach v,$(VERSIONS),.stamp/bread-$(v)-$(SELECTED_ARCH) .stamp/bread-chisel-releases-$(v)-$(SELECTED_ARCH))
 .PHONY: test
-test: $(TEST_STAMPS) inlined-yaml-files  ## Run the spread test suite (host arch; ARCH=... to override, SPREAD_ARGS=... for flags)
+test: $(TEST_STAMPS) inline  ## Run the spread test suite (host arch; ARCH=... to override, SPREAD_ARGS=... for flags)
 	cd tests && spread $(SPREAD_ARGS) outer:ubuntu-26.04-$(SELECTED_ARCH)
 
 .PHONY: check-base
@@ -102,8 +102,8 @@ DEMO_STAMPS := $(foreach a,$(NATIVE_ARCHES),.stamp/bread-24.04-$(a) .stamp/bread
 demo: $(DEMO_STAMPS)  ## Run the spread demo on LTS systems (24.04 + 26.04, native arches)
 	$(MAKE) -C demo run
 
-.PHONY: inlined-yaml-files
-inlined-yaml-files: $(INLINED)  ## Generate inlined/*.yaml from templates/*.yaml.in
+.PHONY: inline
+inline: $(INLINED)  ## Generate inlined/*.yaml from templates/*.yaml.in
 
 # Hash-stamp pattern: stamp file contents = hash of all inputs that affect
 # this image. FORCE-dep makes us recompute hash each run; stamp content only

diff --git a/scripts/spread_repack_bread.sh b/scripts/spread_repack_bread.sh
@@ -0,0 +1,10 @@
+# macOS tar packs an AppleDouble ._* sidecar next to every file; they unpack as
+# real files on the remote. Repack to remove them.
+if [ "$(uname -s)" = Darwin ]; then
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    tar -xf - -C "$tmp" <&3
+    ( cd "$tmp" && shopt -s dotglob && COPYFILE_DISABLE=1 tar -cf - -- * ) >&4
+else
+    cat <&3 >&4
+fi
diff --git a/templates/bread-22.04.yaml.in b/templates/bread-22.04.yaml.in
@@ -11,6 +11,8 @@ exclude:
   - .git
   - .github
 
+repack: source scripts/spread_repack_bread.sh
+
 backends:
   docker:
     type: adhoc

diff --git a/templates/bread-24.04.yaml.in b/templates/bread-24.04.yaml.in
@@ -11,6 +11,8 @@ exclude:
   - .git
   - .github
 
+repack: source scripts/spread_repack_bread.sh
+
 backends:
   docker:
     type: adhoc

diff --git a/templates/bread-25.10.yaml.in b/templates/bread-25.10.yaml.in
@@ -11,6 +11,8 @@ exclude:
   - .git
   - .github
 
+repack: source scripts/spread_repack_bread.sh
+
 backends:
   docker:
     type: adhoc

diff --git a/templates/bread-26.04.yaml.in b/templates/bread-26.04.yaml.in
@@ -11,6 +11,8 @@ exclude:
   - .git
   - .github
 
+repack: source scripts/spread_repack_bread.sh
+
 backends:
   docker:
     type: adhoc

diff --git a/templates/bread-26.10.yaml.in b/templates/bread-26.10.yaml.in
@@ -11,6 +11,8 @@ exclude:
   - .git
   - .github
 
+repack: source scripts/spread_repack_bread.sh
+
 backends:
   docker:
     type: adhoc

diff --git a/templates/bread-chisel-releases-22.04.yaml.in b/templates/bread-chisel-releases-22.04.yaml.in
@@ -18,6 +18,8 @@ exclude:
   - work
   - rootfs
 
+repack: source scripts/spread_repack_bread.sh
+
 backends:
   docker:
     type: adhoc

diff --git a/templates/bread-chisel-releases-24.04.yaml.in b/templates/bread-chisel-releases-24.04.yaml.in
@@ -18,6 +18,8 @@ exclude:
   - work
   - rootfs
 
+repack: source scripts/spread_repack_bread.sh
+
 backends:
   docker:
     type: adhoc

diff --git a/templates/bread-chisel-releases-25.10.yaml.in b/templates/bread-chisel-releases-25.10.yaml.in
@@ -18,6 +18,8 @@ exclude:
   - work
   - rootfs
 
+repack: source scripts/spread_repack_bread.sh
+
 backends:
   docker:
     type: adhoc

diff --git a/templates/bread-chisel-releases-26.04.yaml.in b/templates/bread-chisel-releases-26.04.yaml.in
@@ -18,6 +18,8 @@ exclude:
   - work
   - rootfs
 
+repack: source scripts/spread_repack_bread.sh
+
 backends:
   docker:
     type: adhoc

diff --git a/templates/bread-chisel-releases-26.10.yaml.in b/templates/bread-chisel-releases-26.10.yaml.in
@@ -18,6 +18,8 @@ exclude:
   - work
   - rootfs
 
+repack: source scripts/spread_repack_bread.sh
+
 backends:
   docker:
     type: adhoc
-Original file line number
+Diff line change
@@ Expand Up / @@ -11,6 +11,8 @@ exclude: @@
       - .git
       - .github
+    repack: source scripts/spread_repack_bread.sh
     backends:
       docker:
         type: adhoc
@@ Expand Down @@