Re: Cirrus CI to shut down

On 12 Apr 2026, at 12:56, Joe Schaefer <[email protected]> wrote:
> 
> Good points.  But I don’t mean host your own build farm. I mean use the laptop your company gave you.

There are many reasons not to do this.  The top ones:

 - Our builds are done in a pristine environment.  An attacker who compromises a developer’s laptop can potentially commit malicious code to the repo, but disabling force pushes means that we have an auditable view of this.  With builds done on the developers’ machine, they could just inject malicious code into the binaries.
 - PRs from external contributors may be malicious.  Running them on a cloud VM means that they have zero access to anything we care about and the VM is destroyed at the end.  Running them on a developer machine means you’re just one container escape away from a flow from a GitHub PR to a compromised developer laptop.
 - Developer laptops are slower than big cloud machines.
 - Developer laptops are a single architecture, doing cross builds is annoying.
 - Developer laptops have smaller disks, but ccache works *really* nicely if it has a lot of space to store caches for every branch.
 - Developers often submit PRs at the end of the day and close their laptops, the cloud VM can start up when this happens.

And you are talking about hosting your own build farm.  That’s the only other option.  You’re just talking about running your build farm on machines that are not always on and hold sensitive data.

David