UltradesuandClaude Opus 4.8
63178574ce
Release / tsunagi-linux-aarch64 (push) Successful in 2m39s
Release / tsunagi-linux-x86_64 (push) Successful in 2m32s
Release / tsunagi-macos-aarch64 (push) Canceled after 0s
Release / tsunagi-windows-x86_64 (push) Canceled after 0s
Release / Publish release (push) Canceled after 0s
Reworks the Linux packaging so the service runs as an unprivileged, dedicated "tsunagi" user instead of root — the point of a native package is to set things up properly for that OS's users — and adds Arch Linux packages beside the deb. Both package families are built from the already-compiled static binary; nothing is recompiled. Service model (shared systemd unit, dist/linux/tsunagi.service): - User=tsunagi with AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE, so it creates the TUN and binds low ports without root. - StateDirectory/CacheDirectory/RuntimeDirectory give it /var/lib/tsunagi, /var/cache/tsunagi and /run/tsunagi, and the agent is pointed at them (and the socket at /run/tsunagi/agent.sock) through TSUNAGI_* env in the unit. - The polkit rule now grants the resolve1 actions to the "tsunagi" group; the service user is in it, and admins can add themselves. CLI: when no state dir is chosen, the control commands prefer the system service's socket at /run/tsunagi/agent.sock when it exists, so `sudo tsunagi status`/`join` reach the packaged daemon with no flags. A per-user agent (its socket absent from /run) still uses its own. Packaging: - deb (build-deb.sh): postinst now creates the tsunagi system user+group; unit installed to /lib/systemd/system, binary to /usr/bin. - Arch (new dist/arch/build-pkg.sh): a dependency-free .pkg.tar.zst assembled with bsdtar + zstd (no makepkg, no Arch host) — .PKGINFO, a .INSTALL scriptlet that creates the user and reloads systemd, and a gzipped .MTREE; unit to /usr/lib/systemd/system. - The polkit rule moved to dist/linux (shared by deb, Arch and the tarball), and the tarball install.sh now creates the user and installs the unit + rule. - Both release workflows build the deb and the Arch package on the two Linux matrix entries (deb_arch/pkg_arch), install libarchive-tools+zstd for it, and attach both to the release (Gitea API loop / gh). Not exercised in this session: the .deb and .pkg.tar.zst build and install only on Linux (no dpkg-deb/bsdtar+pacman locally); CLI build, clippy, fmt and tests pass, and all shell/YAML is syntax-checked. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
96 lines
3.1 KiB
Bash
Executable File
96 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Assemble an Arch Linux package (.pkg.tar.zst) from a prebuilt static tsunagi
|
|
# binary, using only bsdtar + zstd on a non-Arch host — no makepkg, no Arch
|
|
# container. The binary is static, so the package has no dependencies.
|
|
#
|
|
# Usage: build-pkg.sh <binary> <arch> <version> <output.pkg.tar.zst>
|
|
# <binary> path to the built tsunagi executable
|
|
# <arch> pacman architecture: x86_64 or aarch64
|
|
# <version> package version (the tag without its leading v)
|
|
# <output> path to write the package to
|
|
#
|
|
# Needs bsdtar (libarchive-tools) and zstd on the builder.
|
|
set -euo pipefail
|
|
|
|
binary="$1"
|
|
arch="$2"
|
|
version="$3"
|
|
output="$4"
|
|
|
|
here="$(cd "$(dirname "$0")" && pwd)"
|
|
root="$(mktemp -d)"
|
|
trap 'rm -rf "$root"' EXIT
|
|
|
|
# pacman pkgver may not contain '-', so a prerelease tag like 0.1.0-rc.9 becomes
|
|
# 0.1.0_rc.9.
|
|
pkgver="$(printf '%s' "$version" | tr '-' '_')"
|
|
pkgrel=1
|
|
|
|
# Payload. Arch keeps units under /usr/lib/systemd/system and installs to
|
|
# /usr/bin, so the service's ExecStart is rewritten to match.
|
|
install -D -m 0755 "$binary" "$root/usr/bin/tsunagi"
|
|
|
|
mkdir -p "$root/usr/lib/systemd/system"
|
|
sed 's#/usr/local/bin/tsunagi#/usr/bin/tsunagi#' \
|
|
"$here/../linux/tsunagi.service" > "$root/usr/lib/systemd/system/tsunagi.service"
|
|
chmod 0644 "$root/usr/lib/systemd/system/tsunagi.service"
|
|
|
|
install -D -m 0644 "$here/../linux/50-tsunagi-resolved.rules" \
|
|
"$root/usr/share/polkit-1/rules.d/50-tsunagi-resolved.rules"
|
|
install -D -m 0644 "$here/../../README.md" "$root/usr/share/doc/tsunagi/README.md"
|
|
install -D -m 0644 "$here/../linux/README.md" "$root/usr/share/doc/tsunagi/INSTALL.md"
|
|
|
|
# Installed size (payload only), before the metadata files are written.
|
|
size="$(du -sb "$root" | cut -f1)"
|
|
|
|
cat > "$root/.PKGINFO" <<PKGINFO
|
|
pkgname = tsunagi
|
|
pkgver = ${pkgver}-${pkgrel}
|
|
pkgdesc = Serverless private mesh networking agent
|
|
url = https://github.com/Ultradesu/tsunagi
|
|
builddate = $(date +%s)
|
|
packager = AB <ab@hexor.cy>
|
|
size = ${size}
|
|
arch = ${arch}
|
|
license = MIT
|
|
license = Apache
|
|
PKGINFO
|
|
|
|
# Scriptlet: create the dedicated system user the service runs as, and keep
|
|
# systemd in step. The "tsunagi" user is in the "tsunagi" group, which the
|
|
# polkit rule grants the resolver actions.
|
|
cat > "$root/.INSTALL" <<'INSTALL'
|
|
post_install() {
|
|
getent group tsunagi >/dev/null 2>&1 || groupadd -r tsunagi
|
|
getent passwd tsunagi >/dev/null 2>&1 || \
|
|
useradd -r -g tsunagi -d /var/lib/tsunagi -s /usr/bin/nologin -c "tsunagi agent" tsunagi
|
|
systemctl daemon-reload >/dev/null 2>&1 || true
|
|
}
|
|
post_upgrade() {
|
|
post_install
|
|
}
|
|
pre_remove() {
|
|
systemctl disable --now tsunagi.service >/dev/null 2>&1 || true
|
|
}
|
|
post_remove() {
|
|
systemctl daemon-reload >/dev/null 2>&1 || true
|
|
}
|
|
INSTALL
|
|
|
|
# .MTREE over the metadata and payload (not over itself), gzip-compressed, as
|
|
# pacman expects.
|
|
(
|
|
cd "$root"
|
|
LANG=C bsdtar -czf .MTREE --format=mtree \
|
|
--options='!all,use-set,type,uid,gid,mode,time,size,md5,sha256,link' \
|
|
.PKGINFO .INSTALL usr
|
|
)
|
|
|
|
# Pack with .PKGINFO first, then the rest, and zstd-compress.
|
|
(
|
|
cd "$root"
|
|
bsdtar -cf - .PKGINFO .MTREE .INSTALL usr
|
|
) | zstd -c -19 -T0 > "$output"
|
|
|
|
echo "built $output"
|