ctf-ad-mirror-tool-rust/docs/linux-release-verification.md

3.6 KiB

Portable Linux x64 release — 2026-10-23

Published v0.1.0, source f264f8a. Repository remains PRIVATE. Assets: mirror-tool-linux-x64.tar.gz (4717473 bytes) and SHA256SUMS. Archive SHA256: 43ec87c748b7c1957bd0fe0b270e6ccff5f55deca308b9ab98d072c586f4f7be.

Successful tag workflow40011983417: pinned Rust1.93.1, musl-tools, fmt, all-target Clippy with warnings denied,50 all-target musl tests, JS/shell syntax, optimized musl build, static ELF validation and package integration smoke. Initial duplicate main run was intentionally cancelled. Native macOS fmt/Clippy and49 tests passed before publication.

Downloaded the actual Release assets through gh, checked SHA256 and independently ran scripts/verify-linux-package.py in Orb Ubuntu26.04 amd64. It extracts into a path containing spaces, creates empty configuration and48-character random password with0600 permissions, starts from a different cwd, logs in, adds a team/service, verifies exact256KiB TCP echo plus half-close, restarts and checks config/password/topology persistence and default-off substitution. SIGTERM exits cleanly. No real targets or credentials used.

file reports x86-64 static-pie ELF; package script rejects PT_INTERP or DT_NEEDED. Actual release also ran in Alpine3.22 via Orb Docker with network disabled and read-only root, writable tmpfs only: run.sh check, automatic password, HTTP login page and graceful stop passed without glibc. Initial readiness connection refusal was retried until the listener started. No packages installed inside the Alpine test.

Local downloaded artifacts: ignored dist/github-v0.1.0 and host Downloads/mirror-tool-linux-work/github-v0.1.0. Existing live demo was not restarted or changed. Release includes binary, launcher, example TOML, docs, systemd template and BUILD-COMMIT; no runtime config/state/credentials.

run.sh depends on ordinary POSIX shell/Linux utilities and /dev/urandom; extracting needs tar/gzip. Binary requires Linux x86-64, no AVX-specific tuning, no external libc/SQLite/OpenSSL/compiler. This is not a guarantee for arbitrary old kernels, seccomp policies or insufficient resources. Rust target baseline Linux3.2+ was documented, not tested on a3.2 kernel. Real protocol/checker compatibility still requires a pre-game check.

v0.1.1 — 2026-10-24

User explicitly superseded fresh-install defaults: listen on0.0.0.0:6700 with password in TOML. Published v0.1.1, source3674534, successful workflow40026012470. Archive4718568 bytes, SHA256 f6b4bdeb30a3abdf610fe10bf3828f4f5449f9997a6e95678da00d47c2e7ff25.

Fresh native50 tests/fmt/Clippy passed; CI51 musl tests/fmt/Clippy/static linking/release/package tests passed. Actual release was downloaded and checksum-verified, then package tests repeated in Orb Ubuntu x64. /proc/net/tcp proves wildcard IPv4 listener; default TOML password authenticates, edited password authenticates after restart, explicit TOML wins over legacy file, absent TOML password preserves old-file fallback. Config remains0600 and unmodified by launcher, API contains no password, topology persists,256KiB TCP half-close remains exact, flags remain off. Rust auth regression also checks Debug/serialization redaction and short-password rejection.

Existing configs (including local demo) were preserved. To migrate v0.1.0, edit [web] listen/password and restart; no silent config rewrite.