Document packaging and release artifacts
This commit is contained in:
Luna
parent
aee984d862
commit
e0e5cd62d9
14 changed files with 470 additions and 13 deletions
|
|
@ -1,6 +1,6 @@
|
|||
# Maintainer: Enodia
|
||||
pkgname=enodia-sentinel
|
||||
pkgver=0.6.0
|
||||
pkgver=0.7.0
|
||||
pkgrel=1
|
||||
pkgdesc="Linux IDS/IPS/EDR agent with integrity, anti-rootkit, forensic evidence, and explicit prevention workflows"
|
||||
arch=('any')
|
||||
|
|
@ -9,7 +9,8 @@ license=('GPL-3.0-or-later')
|
|||
depends=('python>=3.11' 'iproute2' 'procps-ng')
|
||||
optdepends=('python-bpfcc: eBPF event-driven execve/syscall monitors (catches short-lived processes and memory telemetry)'
|
||||
'bpftrace: execve tracing of short-lived processes in snapshots'
|
||||
'libnotify: desktop notifications on alert')
|
||||
'libnotify: desktop notifications on alert'
|
||||
'libarchive: signed-package verification against cached package .MTREE manifests')
|
||||
backup=('etc/enodia-sentinel.toml')
|
||||
source=()
|
||||
sha256sums=()
|
||||
|
|
@ -24,7 +25,21 @@ package() {
|
|||
install -Dm644 systemd/enodia-sentinel.service "$pkgdir/usr/lib/systemd/system/enodia-sentinel.service"
|
||||
install -Dm644 systemd/enodia-sentinel-web.service "$pkgdir/usr/lib/systemd/system/enodia-sentinel-web.service"
|
||||
install -Dm644 packaging/enodia-sentinel-fim.hook "$pkgdir/usr/share/libalpm/hooks/enodia-sentinel-fim.hook"
|
||||
install -Dm644 packaging/enodia-sentinel.tmpfiles "$pkgdir/usr/lib/tmpfiles.d/enodia-sentinel.conf"
|
||||
install -Dm644 config/enodia-sentinel.toml "$pkgdir/etc/enodia-sentinel.toml"
|
||||
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
|
||||
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
|
||||
install -Dm644 docs/INDEX.md "$pkgdir/usr/share/doc/$pkgname/INDEX.md"
|
||||
install -Dm644 docs/COMMAND_REFERENCE.md "$pkgdir/usr/share/doc/$pkgname/COMMAND_REFERENCE.md"
|
||||
install -Dm644 docs/SCHEMAS.md "$pkgdir/usr/share/doc/$pkgname/SCHEMAS.md"
|
||||
install -Dm644 docs/PACKAGING.md "$pkgdir/usr/share/doc/$pkgname/PACKAGING.md"
|
||||
install -Dm644 docs/OPERATIONS.md "$pkgdir/usr/share/doc/$pkgname/OPERATIONS.md"
|
||||
install -Dm644 docs/RUNBOOKS.md "$pkgdir/usr/share/doc/$pkgname/RUNBOOKS.md"
|
||||
install -Dm644 docs/RULES.md "$pkgdir/usr/share/doc/$pkgname/RULES.md"
|
||||
install -Dm644 docs/SPECIFICATION.md "$pkgdir/usr/share/doc/$pkgname/SPECIFICATION.md"
|
||||
install -Dm644 docs/ROADMAP.md "$pkgdir/usr/share/doc/$pkgname/ROADMAP.md"
|
||||
install -Dm644 docs/THREAT_MODEL.md "$pkgdir/usr/share/doc/$pkgname/THREAT_MODEL.md"
|
||||
install -Dm644 docs/VERSION.json "$pkgdir/usr/share/doc/$pkgname/VERSION.json"
|
||||
install -Dm644 systemd/enodia-sentinel-ebpf.conf "$pkgdir/usr/share/doc/$pkgname/examples/enodia-sentinel-ebpf.conf"
|
||||
install -dm750 "$pkgdir/var/log/enodia-sentinel"
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,9 +1,14 @@
|
|||
#!/bin/bash
|
||||
# SPDX-License-Identifier: GPL-3.0-or-later
|
||||
# Build the Arch package from the repo root.
|
||||
set -e
|
||||
set -eu
|
||||
cd "$(dirname "$0")"
|
||||
command -v makepkg >/dev/null 2>&1 || {
|
||||
echo "error: makepkg not found; install pacman/base-devel tooling first" >&2
|
||||
exit 127
|
||||
}
|
||||
echo "Building enodia-sentinel package..."
|
||||
makepkg -f --noconfirm
|
||||
umask 022
|
||||
makepkg -f --cleanbuild --noconfirm
|
||||
mv -f *.pkg.tar.zst ../ 2>/dev/null || true
|
||||
echo "Done. Install with: sudo pacman -U enodia-sentinel-*.pkg.tar.zst"
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Refresh the Enodia Sentinel file-integrity baseline after every package
|
||||
# transaction, so legitimate package changes never trigger a FIM alert.
|
||||
# Install as: /etc/pacman.d/hooks/enodia-sentinel-fim.hook
|
||||
# Packaged as: /usr/share/libalpm/hooks/enodia-sentinel-fim.hook
|
||||
[Trigger]
|
||||
Operation = Install
|
||||
Operation = Upgrade
|
||||
|
|
@ -14,5 +14,5 @@ Target = opt/*
|
|||
[Action]
|
||||
Description = Refreshing Enodia Sentinel file-integrity baseline...
|
||||
When = PostTransaction
|
||||
Exec = /usr/bin/env enodia-sentinel fim-update
|
||||
Exec = /usr/bin/enodia-sentinel fim-update
|
||||
Depends = python
|
||||
|
|
|
|||
3
packaging/enodia-sentinel.tmpfiles
Normal file
3
packaging/enodia-sentinel.tmpfiles
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
# SPDX-License-Identifier: GPL-3.0-or-later
|
||||
# Runtime log/state directory for Enodia Sentinel.
|
||||
d /var/log/enodia-sentinel 0750 root root -
|
||||
103
packaging/release-artifacts.sh
Executable file
103
packaging/release-artifacts.sh
Executable file
|
|
@ -0,0 +1,103 @@
|
|||
#!/bin/bash
|
||||
# SPDX-License-Identifier: GPL-3.0-or-later
|
||||
# Build release artifacts: source tarball, checksum file, manifest, optional
|
||||
# detached signature over SHA256SUMS.
|
||||
set -euo pipefail
|
||||
|
||||
cd "$(dirname "$0")/.."
|
||||
|
||||
version="$(python3 - <<'PY'
|
||||
import tomllib
|
||||
from pathlib import Path
|
||||
print(tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"])
|
||||
PY
|
||||
)"
|
||||
project="enodia-sentinel"
|
||||
prefix="${project}-${version}"
|
||||
distdir="${DISTDIR:-dist}"
|
||||
archive="${prefix}.tar.gz"
|
||||
manifest="RELEASE_MANIFEST.json"
|
||||
checksums="SHA256SUMS"
|
||||
signature="SHA256SUMS.asc"
|
||||
allow_dirty="${RELEASE_ALLOW_DIRTY:-0}"
|
||||
sign="${RELEASE_SIGN:-0}"
|
||||
signing_key="${RELEASE_SIGNING_KEY:-}"
|
||||
|
||||
if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
|
||||
dirty=0
|
||||
git diff --quiet || dirty=1
|
||||
git diff --cached --quiet || dirty=1
|
||||
if [ -n "$(git ls-files --others --exclude-standard)" ]; then
|
||||
dirty=1
|
||||
fi
|
||||
git_commit="$(git rev-parse --verify HEAD)"
|
||||
if [ "$dirty" -ne 0 ] && [ "$allow_dirty" != "1" ]; then
|
||||
echo "error: worktree is dirty; commit changes or set RELEASE_ALLOW_DIRTY=1" >&2
|
||||
exit 2
|
||||
fi
|
||||
else
|
||||
dirty=1
|
||||
git_commit=""
|
||||
fi
|
||||
|
||||
mkdir -p "$distdir"
|
||||
tmp="$(mktemp -d "${TMPDIR:-/tmp}/enodia-release.XXXXXX")"
|
||||
cleanup() {
|
||||
rm -rf "$tmp"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
mkdir -p "$tmp/$prefix"
|
||||
tar \
|
||||
--exclude='./.git' \
|
||||
--exclude='./dist' \
|
||||
--exclude='./__pycache__' \
|
||||
--exclude='*/__pycache__' \
|
||||
--exclude='./.pytest_cache' \
|
||||
--exclude='./.mypy_cache' \
|
||||
--exclude='./.ruff_cache' \
|
||||
--exclude='*.pyc' \
|
||||
--exclude='*.pkg.tar.zst' \
|
||||
-cf - . | tar -xf - -C "$tmp/$prefix"
|
||||
|
||||
tar --sort=name --mtime='@0' --owner=0 --group=0 --numeric-owner \
|
||||
-czf "$distdir/$archive" -C "$tmp" "$prefix"
|
||||
|
||||
generated_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||
cat > "$distdir/$manifest" <<JSON
|
||||
{
|
||||
"project": "$project",
|
||||
"version": "$version",
|
||||
"generated_at": "$generated_at",
|
||||
"git_commit": "$git_commit",
|
||||
"dirty": $dirty,
|
||||
"artifacts": [
|
||||
"$archive",
|
||||
"$checksums"
|
||||
]
|
||||
}
|
||||
JSON
|
||||
|
||||
(
|
||||
cd "$distdir"
|
||||
sha256sum "$archive" "$manifest" > "$checksums"
|
||||
)
|
||||
|
||||
if [ "$sign" = "1" ]; then
|
||||
command -v gpg >/dev/null 2>&1 || {
|
||||
echo "error: RELEASE_SIGN=1 requires gpg" >&2
|
||||
exit 127
|
||||
}
|
||||
gpg_args=(--batch --yes --armor --detach-sign)
|
||||
if [ -n "$signing_key" ]; then
|
||||
gpg_args+=(--local-user "$signing_key")
|
||||
fi
|
||||
gpg "${gpg_args[@]}" -o "$distdir/$signature" "$distdir/$checksums"
|
||||
echo "Signed $distdir/$signature"
|
||||
else
|
||||
echo "Signing skipped; set RELEASE_SIGN=1 to create $signature"
|
||||
fi
|
||||
|
||||
echo "Wrote $distdir/$archive"
|
||||
echo "Wrote $distdir/$checksums"
|
||||
echo "Wrote $distdir/$manifest"
|
||||
Loading…
Add table
Add a link
Reference in a new issue