DevNews

Kakehashi: useful experiment, maintenance has stopped

On this page
  1. The current repository changes the conclusion
  2. Same instruction set, different operating-system contract
  3. A compatibility layer is not a security boundary

The important update is the notice at the top of the repository: its maintainer says they can no longer maintain Kakehashi. Treat the project as an experiment with a support gap.

Kakehashi bridges Mach-O loading, library expectations and BSD system calls to Linux aarch64. ARM64 code shares an instruction set; host filesystem access and the maintenance gap remain independent concerns.
Kakehashi bridges Mach-O loading, library expectations and BSD system calls to Linux aarch64. ARM64 code shares an instruction set; host filesystem access and the maintenance gap remain independent concerns. Chart : PeopleAreGeek. Data source.
View full-size image

The current repository changes the conclusion

The project README now includes Apple git and clang examples alongside 7-Zip and curl. It still excludes a full macOS application stack and working codesign. Live execution requires Linux aarch64, with a manually prepared guest filesystem. Its reference Ubuntu environment runs inside UTM, not simultaneously on bare metal. The maintenance notice means these examples are not a commitment to future compatibility.

Same instruction set, different operating-system contract

A Mach-O executable carries more assumptions than its ARM64 instructions. It expects a loader, library symbols, thread behaviour, paths and system calls. Kakehashi bridges that contract to Linux. CPU-compatible instructions can execute directly while operating-system boundaries still add work or expose missing behaviour.

This explains why “no instruction emulator” does not mean “no overhead.” A compression loop and a directory walk can make very different numbers of boundary crossings. We removed an obsolete slowdown figure rather than presenting a developer’s changing microbenchmark as a prediction for your build.

A compatibility layer is not a security boundary

The documented /Volumes/linux mapping exposes the host filesystem. A guest tool that writes a host-mounted path can therefore affect real files. Run evaluation jobs with disposable data and deliberately limited host access; do not infer isolation from the presence of a guest directory.

Before moving a CI step, test the exact binary, libraries and input set, then compare output validity and total job duration. Keep signing and release verification as separate requirements. A successful clang example does not establish a complete distributable macOS build, and a working demonstration does not answer who will fix tomorrow’s breakage. The project may be a useful research base, but its current maintenance status is a substantial adoption cost.

September 8: record maintainer departure and current git/clang examples; remove obsolete 5.2x benchmark and misleading bare-metal-under-UTM description.