UltradesuandClaude Opus 4.8
63178574ce
Release / tsunagi-linux-aarch64 (push) Successful in 2m39s
Release / tsunagi-linux-x86_64 (push) Successful in 2m32s
Release / tsunagi-macos-aarch64 (push) Canceled after 0s
Release / tsunagi-windows-x86_64 (push) Canceled after 0s
Release / Publish release (push) Canceled after 0s
Reworks the Linux packaging so the service runs as an unprivileged, dedicated "tsunagi" user instead of root — the point of a native package is to set things up properly for that OS's users — and adds Arch Linux packages beside the deb. Both package families are built from the already-compiled static binary; nothing is recompiled. Service model (shared systemd unit, dist/linux/tsunagi.service): - User=tsunagi with AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE, so it creates the TUN and binds low ports without root. - StateDirectory/CacheDirectory/RuntimeDirectory give it /var/lib/tsunagi, /var/cache/tsunagi and /run/tsunagi, and the agent is pointed at them (and the socket at /run/tsunagi/agent.sock) through TSUNAGI_* env in the unit. - The polkit rule now grants the resolve1 actions to the "tsunagi" group; the service user is in it, and admins can add themselves. CLI: when no state dir is chosen, the control commands prefer the system service's socket at /run/tsunagi/agent.sock when it exists, so `sudo tsunagi status`/`join` reach the packaged daemon with no flags. A per-user agent (its socket absent from /run) still uses its own. Packaging: - deb (build-deb.sh): postinst now creates the tsunagi system user+group; unit installed to /lib/systemd/system, binary to /usr/bin. - Arch (new dist/arch/build-pkg.sh): a dependency-free .pkg.tar.zst assembled with bsdtar + zstd (no makepkg, no Arch host) — .PKGINFO, a .INSTALL scriptlet that creates the user and reloads systemd, and a gzipped .MTREE; unit to /usr/lib/systemd/system. - The polkit rule moved to dist/linux (shared by deb, Arch and the tarball), and the tarball install.sh now creates the user and installs the unit + rule. - Both release workflows build the deb and the Arch package on the two Linux matrix entries (deb_arch/pkg_arch), install libarchive-tools+zstd for it, and attach both to the release (Gitea API loop / gh). Not exercised in this session: the .deb and .pkg.tar.zst build and install only on Linux (no dpkg-deb/bsdtar+pacman locally); CLI build, clippy, fmt and tests pass, and all shell/YAML is syntax-checked. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
99 lines
3.3 KiB
Bash
Executable File
99 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Assemble a dependency-free Debian package from a prebuilt static tsunagi
|
|
# binary, using only dpkg-deb (no cargo-deb, no nfpm). The binary is statically
|
|
# linked, so the package declares no Depends and runs on any Debian/Ubuntu.
|
|
#
|
|
# Usage: build-deb.sh <binary> <deb_arch> <version> <output.deb>
|
|
# <binary> path to the built tsunagi executable
|
|
# <deb_arch> Debian architecture: amd64 or arm64
|
|
# <version> package version (the tag without its leading v)
|
|
# <output> path to write the .deb to
|
|
set -euo pipefail
|
|
|
|
binary="$1"
|
|
arch="$2"
|
|
version="$3"
|
|
output="$4"
|
|
|
|
here="$(cd "$(dirname "$0")" && pwd)"
|
|
root="$(mktemp -d)"
|
|
trap 'rm -rf "$root"' EXIT
|
|
|
|
# Payload. Debian installs to /usr/bin (not /usr/local), so the service's
|
|
# ExecStart is rewritten to match; the source unit targets /usr/local/bin for
|
|
# the tarball installer.
|
|
install -D -m 0755 "$binary" "$root/usr/bin/tsunagi"
|
|
|
|
mkdir -p "$root/lib/systemd/system"
|
|
sed 's#/usr/local/bin/tsunagi#/usr/bin/tsunagi#' \
|
|
"$here/../linux/tsunagi.service" > "$root/lib/systemd/system/tsunagi.service"
|
|
chmod 0644 "$root/lib/systemd/system/tsunagi.service"
|
|
|
|
install -D -m 0644 "$here/../linux/50-tsunagi-resolved.rules" \
|
|
"$root/usr/share/polkit-1/rules.d/50-tsunagi-resolved.rules"
|
|
install -D -m 0644 "$here/../../README.md" "$root/usr/share/doc/tsunagi/README.md"
|
|
install -D -m 0644 "$here/../linux/README.md" "$root/usr/share/doc/tsunagi/INSTALL.md"
|
|
|
|
mkdir -p "$root/DEBIAN"
|
|
|
|
cat > "$root/DEBIAN/control" <<CTRL
|
|
Package: tsunagi
|
|
Version: ${version}
|
|
Architecture: ${arch}
|
|
Maintainer: AB <ab@hexor.cy>
|
|
Section: net
|
|
Priority: optional
|
|
Homepage: https://github.com/Ultradesu/tsunagi
|
|
Description: Serverless private mesh networking agent
|
|
tsunagi forms small private mesh IP networks between peers, with NAT
|
|
traversal and no central server. This package installs a static,
|
|
dependency-free binary, a systemd service that runs the agent as a dedicated
|
|
unprivileged "tsunagi" user with only CAP_NET_ADMIN and CAP_NET_BIND_SERVICE,
|
|
and a polkit rule for the local DNS resolver.
|
|
CTRL
|
|
|
|
# The dedicated system user the service runs as. It is in the "tsunagi" group,
|
|
# which the polkit rule grants the resolve1 actions. systemd creates the state,
|
|
# cache and runtime directories for it on first start.
|
|
cat > "$root/DEBIAN/postinst" <<'POSTINST'
|
|
#!/bin/sh
|
|
set -e
|
|
if ! getent group tsunagi >/dev/null 2>&1; then
|
|
addgroup --system tsunagi >/dev/null 2>&1 || true
|
|
fi
|
|
if ! getent passwd tsunagi >/dev/null 2>&1; then
|
|
adduser --system --ingroup tsunagi --home /var/lib/tsunagi --no-create-home \
|
|
--gecos "tsunagi agent" --disabled-login tsunagi >/dev/null 2>&1 || true
|
|
fi
|
|
if [ -d /run/systemd/system ]; then
|
|
systemctl daemon-reload >/dev/null 2>&1 || true
|
|
fi
|
|
exit 0
|
|
POSTINST
|
|
|
|
cat > "$root/DEBIAN/prerm" <<'PRERM'
|
|
#!/bin/sh
|
|
set -e
|
|
if [ "$1" = remove ] || [ "$1" = purge ]; then
|
|
if [ -d /run/systemd/system ]; then
|
|
systemctl disable --now tsunagi.service >/dev/null 2>&1 || true
|
|
fi
|
|
fi
|
|
exit 0
|
|
PRERM
|
|
|
|
cat > "$root/DEBIAN/postrm" <<'POSTRM'
|
|
#!/bin/sh
|
|
set -e
|
|
if [ -d /run/systemd/system ]; then
|
|
systemctl daemon-reload >/dev/null 2>&1 || true
|
|
fi
|
|
exit 0
|
|
POSTRM
|
|
|
|
chmod 0755 "$root/DEBIAN/postinst" "$root/DEBIAN/prerm" "$root/DEBIAN/postrm"
|
|
|
|
# --root-owner-group writes the payload as root:root without needing fakeroot.
|
|
dpkg-deb --root-owner-group --build "$root" "$output"
|
|
echo "built $output"
|