cringe

scripts/README.md

@@ -19,13 +19,31 @@ releases root. Set `VPS_AGENT_MINISIGN_PUBLIC_KEY` to require verification of
 `SHA256SUMS.minisig`; checksums are always mandatory. Supported artifact names
 are `vps-agent-linux-amd64` and `vps-agent-linux-arm64`.
 
-Maintainers can create that release layout from two cross-compiled binaries:
+Each architecture can be built and packaged independently on its matching Linux
+builder. An amd64-only release does not require an arm64 binary:
 
 ```bash
-./package-agent-release.sh path/to/x86_64/vps-agent path/to/aarch64/vps-agent dist
+./scripts/build-agent-native.sh dist
 ```
 
-This produces both canonical names and `SHA256SUMS`; when
+The script detects the current Linux host architecture, builds the release
+binary, and packages only that architecture. To package an existing binary:
+
+```bash
+./package-agent-release.sh --output dist --amd64 path/to/x86_64/vps-agent
+```
+
+Use `--arm64 path/to/aarch64/vps-agent` on a separate arm64 Linux builder. Both
+options may also be passed in one invocation after the artifacts have been copied
+to the same machine. The script regenerates `SHA256SUMS` for every canonical
+artifact already present in the output directory and supports both Linux
+`sha256sum` and macOS `shasum -a 256`.
+
+Native macOS builds produce Mach-O binaries and cannot be published as Linux
+agent artifacts. macOS may be used to combine and sign Linux binaries that were
+built independently on matching Linux hosts.
+
+Packaging produces the selected canonical names and `SHA256SUMS`; when
 `VPS_AGENT_MINISIGN_SECRET_KEY` is set it also creates `SHA256SUMS.minisig`.
 
 Install checks root, Linux/systemd and architecture, creates the locked service