From e7e33c1a3226882b8d9f37f39387d439e99bd31b Mon Sep 17 00:00:00 2001 From: mrvasil Date: Fri, 23 Oct 2026 22:38:17 +0300 Subject: [PATCH] Record verified Linux release and downloaded-archive checks [skip ci] --- agent.md | 2 ++ docs/linux-release-verification.md | 13 +++++++++++++ progress.md | 2 ++ task_plan.md | 2 +- 4 files changed, 18 insertions(+), 1 deletion(-) create mode 100644 docs/linux-release-verification.md diff --git a/agent.md b/agent.md index 0120950..38f7175 100644 --- a/agent.md +++ b/agent.md @@ -48,3 +48,5 @@ User explicitly requires optional substitution, default off. Implemented per-ser ## Portable Linux release in progress User wants a ready-to-run Linux x64 build on GitHub, exact distribution unknown. Package static musl binary with run.sh, empty first-run config and random persistent private password; do not package runtime data or enable substitution. Workflow verifies native Clippy/fmt and musl tests plus archive login/API/TCP/restart smoke, then tag releases publish privately. Main push artifacts do not replace releases. Actual CI/package verification pending; docs in deploy/QUICKSTART.md. + +Portable release completed: v0.1.0 at source f264f8a, private GitHub Release includes static musl Linux x64 tar.gz + SHA256SUMS. CI40011983417 succeeded: fmt/Clippy,50 musl tests, static linkage check, release build and packaged first-run/login/API/restart/256KiB TCP smoke. Downloaded release independently passed SHA256, full package smoke in Orb Ubuntu amd64 and launcher/HTTP/graceful-stop in isolated Alpine3.22 without glibc. Native49 tests/fmt/Clippy also passed. No runtime/compiler/database dependencies beyond normal shell utilities for run.sh. First-run config is empty; real targets still require operator setup. Live demo unchanged. See docs/linux-release-verification.md. diff --git a/docs/linux-release-verification.md b/docs/linux-release-verification.md new file mode 100644 index 0000000..280e2dc --- /dev/null +++ b/docs/linux-release-verification.md @@ -0,0 +1,13 @@ +# Portable Linux x64 release — 2026-10-23 + +Published [v0.1.0](https://github.com/mrvasil/ctf-ad-mirror-tool-rust/releases/tag/v0.1.0), source f264f8a. Repository remains PRIVATE. Assets: mirror-tool-linux-x64.tar.gz (4717473 bytes) and SHA256SUMS. Archive SHA256: `43ec87c748b7c1957bd0fe0b270e6ccff5f55deca308b9ab98d072c586f4f7be`. + +[Successful tag workflow40011983417](https://github.com/mrvasil/ctf-ad-mirror-tool-rust/actions/runs/40011983417): pinned Rust1.93.1, musl-tools, fmt, all-target Clippy with warnings denied,50 all-target musl tests, JS/shell syntax, optimized musl build, static ELF validation and package integration smoke. Initial duplicate main run was intentionally cancelled. Native macOS fmt/Clippy and49 tests passed before publication. + +Downloaded the actual Release assets through gh, checked SHA256 and independently ran scripts/verify-linux-package.py in Orb Ubuntu26.04 amd64. It extracts into a path containing spaces, creates empty configuration and48-character random password with0600 permissions, starts from a different cwd, logs in, adds a team/service, verifies exact256KiB TCP echo plus half-close, restarts and checks config/password/topology persistence and default-off substitution. SIGTERM exits cleanly. No real targets or credentials used. + +file reports x86-64 static-pie ELF; package script rejects PT_INTERP or DT_NEEDED. Actual release also ran in Alpine3.22 via Orb Docker with network disabled and read-only root, writable tmpfs only: run.sh check, automatic password, HTTP login page and graceful stop passed without glibc. Initial readiness connection refusal was retried until the listener started. No packages installed inside the Alpine test. + +Local downloaded artifacts: ignored dist/github-v0.1.0 and host Downloads/mirror-tool-linux-work/github-v0.1.0. Existing live demo was not restarted or changed. Release includes binary, launcher, example TOML, docs, systemd template and BUILD-COMMIT; no runtime config/state/credentials. + +run.sh depends on ordinary POSIX shell/Linux utilities and /dev/urandom; extracting needs tar/gzip. Binary requires Linux x86-64, no AVX-specific tuning, no external libc/SQLite/OpenSSL/compiler. This is not a guarantee for arbitrary old kernels, seccomp policies or insufficient resources. Rust target baseline Linux3.2+ was documented, not tested on a3.2 kernel. Real protocol/checker compatibility still requires a pre-game check. diff --git a/progress.md b/progress.md index 3d6d46f..e107844 100644 --- a/progress.md +++ b/progress.md @@ -21,3 +21,5 @@ 2026-10-23 flag feature: user selected universal configurable mode. Design explained before implementation; use same-format random tokenization plus authenticated encrypted durable SQLite records (not homemade same-length encryption). Initial cargo-add multiple-dependency feature syntax rejected; retried separate dependency additions successfully. No existing source behavior changed yet. 2026-10-23 flag completion: per-service opt-in defaults off for existing/new configurations; UI switch and indicator preserve the legacy page. Encrypted durable cache, split-safe transformations and documented protocol limits complete. Final native49/Orb50 tests, fmt/Clippy/JS and releases passed. Browser verified on/off persistence; loopback round-trips, replicas, half-close, errors and restart covered. Demo16700 updated with original topology and protection off. Orb lacked rsync, so staging used cp; launchctl bootstrap rejected relative plist path, succeeded with the absolute path after validating plist and absent job. See docs/flag-protection-verification.md. + +2026-10-23 Linux packaging: added static x86_64-unknown-linux-musl archive, run.sh with non-overwriting config and private persistent random password, standalone quickstart and pinned Actions build/release. Published v0.1.0 automatically after CI40011983417 passed50 musl tests and archive smoke. Downloaded published artifact verified in Orb Ubuntu and glibc-free Alpine3.22; SHA256 and static ELF confirmed. Native49 tests/fmt/Clippy pass. Initial main CI cancelled deliberately in favor of identical tag run. No game endpoints touched; demo remains unchanged. diff --git a/task_plan.md b/task_plan.md index 063dbce..49f78f4 100644 --- a/task_plan.md +++ b/task_plan.md @@ -48,4 +48,4 @@ Flag implementation issues recorded: cargo-add combined feature syntax rejected ## Portable Linux release — 2026-10-23 - [complete] Add static x86_64-unknown-linux-musl packaging, first-run launcher and operator quickstart. - [complete] Add pinned GitHub Actions build/test/artifact and tag-triggered release workflow. -- [in progress] Validate actual archive on Linux, publish private GitHub release and verify downloaded asset. +- [complete] Validate actual archive on Linux, publish private GitHub release and verify downloaded asset.