From 108fc4fba7c454da089d4780efa1cad4744e5b82 Mon Sep 17 00:00:00 2001 From: Markus Fritsche Date: Sun, 19 Jul 2026 12:32:22 +0200 Subject: [PATCH] sic: add sicd + sic-agent packages (Arch + Debian) + CI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit sicd (daemon, target hosts) and sic-agent (client + agent skills) from git.reauktion.de/marfrit/sic v0.1.0. Go binaries, cross-built with GOARCH. - arch/sicd, arch/sic-agent: PKGBUILDs (build from source via go). - debian/sicd, debian/sic-agent: control/copyright/changelog + build-deb.sh (per-arch amd64/arm64). - .gitea/workflows/build.yml: 4 jobs — Arch aarch64 (repo-signed, -> nc) and Debian amd64+arm64 (-> hertz reprepro, bookworm+trixie). continue-on-error, chained after the existing jobs. Validated locally: Arch aarch64 pkgs + Debian arm64/amd64 debs build; the packaged sicd binary runs (netstring exec). --- .gitea/workflows/build.yml | 274 ++++++++++++++++++++++++++++++ .gitignore | 5 + arch/sic-agent/PKGBUILD | 35 ++++ arch/sicd/PKGBUILD | 33 ++++ debian/sic-agent/build-deb.sh | 65 +++++++ debian/sic-agent/debian/changelog | 5 + debian/sic-agent/debian/control | 19 +++ debian/sic-agent/debian/copyright | 26 +++ debian/sicd/build-deb.sh | 61 +++++++ debian/sicd/debian/changelog | 6 + debian/sicd/debian/control | 19 +++ debian/sicd/debian/copyright | 26 +++ 12 files changed, 574 insertions(+) create mode 100644 .gitignore create mode 100644 arch/sic-agent/PKGBUILD create mode 100644 arch/sicd/PKGBUILD create mode 100755 debian/sic-agent/build-deb.sh create mode 100644 debian/sic-agent/debian/changelog create mode 100644 debian/sic-agent/debian/control create mode 100644 debian/sic-agent/debian/copyright create mode 100755 debian/sicd/build-deb.sh create mode 100644 debian/sicd/debian/changelog create mode 100644 debian/sicd/debian/control create mode 100644 debian/sicd/debian/copyright diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index ed44453a8..583014c97 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -1732,3 +1732,277 @@ jobs: if: always() run: rm -f /root/.ssh/id_ed25519_hertz + + # =========================================================================== + # sic — quoting-proof remote command execution (git.reauktion.de/marfrit/sic). + # Two packages: sicd (daemon, target hosts) and sic-agent (client + skills). + # Go binaries -> arch-specific. Arch: aarch64 (the Arch fleet is aarch64). + # Debian: amd64 + arm64 (the Debian/Proxmox hosts span both). Cross-built with + # Go's GOARCH on the aarch64 runner. + # =========================================================================== + + sicd-arch: + needs: daedalus-v4l2-dkms-debian + runs-on: arch-aarch64 + continue-on-error: true + steps: + - uses: actions/checkout@v4 + - name: bootstrap runner (idempotent) + run: | + set -e + retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; } + retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo go + - name: import signing key + env: + PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }} + PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }} + run: | + set -e + gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true + rm -rf /root/.gnupg /root/repo_pass + mkdir -m700 -p /root/.gnupg + printf '%s' "$PASS" > /root/repo_pass + chmod 600 /root/repo_pass + printf '%s\n' "$PRIV" | gpg --batch --import + echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust + - name: install deploy ssh key + env: + KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }} + run: | + mkdir -m700 -p /root/.ssh + printf '%s\n' "$KEY" > /root/.ssh/id_ed25519 + chmod 600 /root/.ssh/id_ed25519 + ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null + - name: makepkg sicd + run: | + set -e + rm -rf /tmp/build-sicd + cp -r arch/sicd /tmp/build-sicd + chown -R builder:builder /tmp/build-sicd + cd /tmp/build-sicd + sudo -u builder -H makepkg --nocheck --noconfirm --syncdeps --cleanbuild + ls -la *.pkg.tar.* | grep -v "\.sig$" + - name: sign sicd + run: | + set -e + cd /tmp/build-sicd + for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do + [ -f "$f" ] || continue + gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \ + --detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f" + done + - name: update aarch64 repo db + run: | + set -e + mkdir -p /tmp/arch-stage-sicd + cd /tmp/arch-stage-sicd + rm -f * + for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do + curl -sSLf "https://packages.reauktion.de/arch/aarch64/$f" -o "$f" || rm -f "$f" + done + for ext in xz zst gz; do + ls /tmp/build-sicd/*.pkg.tar.$ext 2>/dev/null && \ + mv /tmp/build-sicd/*.pkg.tar.$ext /tmp/build-sicd/*.pkg.tar.$ext.sig . + done || true + export GNUPGHOME=/root/.gnupg + printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf + printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf + gpg-connect-agent reloadagent /bye + pkgs=() + for ext in xz zst gz; do + for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done + done + if [ -f marfrit.db.tar.gz ]; then + for f in "${pkgs[@]}"; do + name=$(echo "$f" | sed -E 's/-[0-9].*//') + repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \ + marfrit.db.tar.gz "$name" 2>/dev/null || true + done + fi + repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \ + --verify marfrit.db.tar.gz "${pkgs[@]}" + ln -sf marfrit.db.tar.gz marfrit.db + ln -sf marfrit.files.tar.gz marfrit.files + ln -sf marfrit.db.tar.gz.sig marfrit.db.sig + rm -f marfrit.files.sig + - name: publish to aarch64 + run: | + set -e + retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; } + cd /tmp/arch-stage-sicd + retry rsync -avL --copy-unsafe-links -e 'ssh -i /root/.ssh/id_ed25519' \ + ./ mfritsche@nc.reauktion.de:arch/aarch64/ + - name: wipe secrets + if: always() + run: rm -f /root/repo_pass /root/.ssh/id_ed25519 + + sic-agent-arch: + needs: sicd-arch + runs-on: arch-aarch64 + continue-on-error: true + steps: + - uses: actions/checkout@v4 + - name: bootstrap runner (idempotent) + run: | + set -e + retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; } + retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo go + - name: import signing key + env: + PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }} + PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }} + run: | + set -e + gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true + rm -rf /root/.gnupg /root/repo_pass + mkdir -m700 -p /root/.gnupg + printf '%s' "$PASS" > /root/repo_pass + chmod 600 /root/repo_pass + printf '%s\n' "$PRIV" | gpg --batch --import + echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust + - name: install deploy ssh key + env: + KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }} + run: | + mkdir -m700 -p /root/.ssh + printf '%s\n' "$KEY" > /root/.ssh/id_ed25519 + chmod 600 /root/.ssh/id_ed25519 + ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null + - name: makepkg sic-agent + run: | + set -e + rm -rf /tmp/build-sic-agent + cp -r arch/sic-agent /tmp/build-sic-agent + chown -R builder:builder /tmp/build-sic-agent + cd /tmp/build-sic-agent + sudo -u builder -H makepkg --nocheck --noconfirm --syncdeps --cleanbuild + ls -la *.pkg.tar.* | grep -v "\.sig$" + - name: sign sic-agent + run: | + set -e + cd /tmp/build-sic-agent + for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do + [ -f "$f" ] || continue + gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \ + --detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f" + done + - name: update aarch64 repo db + run: | + set -e + mkdir -p /tmp/arch-stage-sic-agent + cd /tmp/arch-stage-sic-agent + rm -f * + for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do + curl -sSLf "https://packages.reauktion.de/arch/aarch64/$f" -o "$f" || rm -f "$f" + done + for ext in xz zst gz; do + ls /tmp/build-sic-agent/*.pkg.tar.$ext 2>/dev/null && \ + mv /tmp/build-sic-agent/*.pkg.tar.$ext /tmp/build-sic-agent/*.pkg.tar.$ext.sig . + done || true + export GNUPGHOME=/root/.gnupg + printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf + printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf + gpg-connect-agent reloadagent /bye + pkgs=() + for ext in xz zst gz; do + for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done + done + if [ -f marfrit.db.tar.gz ]; then + for f in "${pkgs[@]}"; do + name=$(echo "$f" | sed -E 's/-[0-9].*//') + repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \ + marfrit.db.tar.gz "$name" 2>/dev/null || true + done + fi + repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \ + --verify marfrit.db.tar.gz "${pkgs[@]}" + ln -sf marfrit.db.tar.gz marfrit.db + ln -sf marfrit.files.tar.gz marfrit.files + ln -sf marfrit.db.tar.gz.sig marfrit.db.sig + rm -f marfrit.files.sig + - name: publish to aarch64 + run: | + set -e + retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; } + cd /tmp/arch-stage-sic-agent + retry rsync -avL --copy-unsafe-links -e 'ssh -i /root/.ssh/id_ed25519' \ + ./ mfritsche@nc.reauktion.de:arch/aarch64/ + - name: wipe secrets + if: always() + run: rm -f /root/repo_pass /root/.ssh/id_ed25519 + + sicd-debian: + needs: sic-agent-arch + runs-on: arch-aarch64 + continue-on-error: true + steps: + - uses: actions/checkout@v4 + - name: install deps + run: | + set -e + retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; } + retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl go + - name: install hertz deploy ssh key + env: + KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }} + run: | + mkdir -m700 -p /root/.ssh + printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz + chmod 600 /root/.ssh/id_ed25519_hertz + ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null + - name: build + publish sicd .deb (amd64 + arm64) + run: | + set -e + retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; } + cd debian/sicd + for arch in amd64 arm64; do + ./build-deb.sh "$arch" + DEB=$(ls sicd_*_${arch}.deb | head -1) + retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \ + marfritrepo@hertz.fritz.box: + for suite in bookworm trixie; do + retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \ + "publish-deb $suite $DEB" + done + done + - name: wipe secrets + if: always() + run: rm -f /root/.ssh/id_ed25519_hertz + + sic-agent-debian: + needs: sicd-debian + runs-on: arch-aarch64 + continue-on-error: true + steps: + - uses: actions/checkout@v4 + - name: install deps + run: | + set -e + retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; } + retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl go + - name: install hertz deploy ssh key + env: + KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }} + run: | + mkdir -m700 -p /root/.ssh + printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz + chmod 600 /root/.ssh/id_ed25519_hertz + ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null + - name: build + publish sic-agent .deb (amd64 + arm64) + run: | + set -e + retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; } + cd debian/sic-agent + for arch in amd64 arm64; do + ./build-deb.sh "$arch" + DEB=$(ls sic-agent_*_${arch}.deb | head -1) + retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \ + marfritrepo@hertz.fritz.box: + for suite in bookworm trixie; do + retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \ + "publish-deb $suite $DEB" + done + done + - name: wipe secrets + if: always() + run: rm -f /root/.ssh/id_ed25519_hertz diff --git a/.gitignore b/.gitignore new file mode 100644 index 000000000..cd7990811 --- /dev/null +++ b/.gitignore @@ -0,0 +1,5 @@ +arch/*/src/ +arch/*/pkg/ +arch/*/*.pkg.tar.* +debian/*/*.deb +arch/*/*.tar.gz diff --git a/arch/sic-agent/PKGBUILD b/arch/sic-agent/PKGBUILD new file mode 100644 index 000000000..99e08453a --- /dev/null +++ b/arch/sic-agent/PKGBUILD @@ -0,0 +1,35 @@ +# Maintainer: Markus Fritsche +# sic client + agent skills. For agent hosts that drive remote commands. +# Source of truth: git.reauktion.de/marfrit/sic + +pkgname=sic-agent +pkgver=0.1.0 +pkgrel=1 +pkgdesc="sic client + agent skills: frame argv as netstrings and run it on a remote host via sicd (foreground + background skills)" +arch=('x86_64' 'aarch64') +url="https://git.reauktion.de/marfrit/sic" +license=('MIT') +makedepends=('go') +depends=('openssh') +source=("sic-${pkgver}.tar.gz::https://git.reauktion.de/marfrit/sic/archive/v${pkgver}.tar.gz") +sha256sums=('5cd10c3a1ab7361e72e7579af5819f9d322ecd59424541cfb80e5b7514253511') + +build() { + cd "${srcdir}/sic" + case "$CARCH" in + x86_64) export GOARCH=amd64 ;; + aarch64) export GOARCH=arm64 ;; + esac + export GOOS=linux CGO_ENABLED=0 GOFLAGS='-buildvcs=false -trimpath' + go build -ldflags='-s -w' -o sic ./cmd/sic +} + +package() { + cd "${srcdir}/sic" + install -Dm755 sic "${pkgdir}/usr/bin/sic" + # Agent skills — link into the agent's skills dir (e.g. ~/.claude/skills/). + install -Dm644 SKILL.md "${pkgdir}/usr/share/sic-agent/skills/sic/SKILL.md" + install -Dm644 SKILL-bg.md "${pkgdir}/usr/share/sic-agent/skills/sic-bg/SKILL.md" + install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md" + install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" +} diff --git a/arch/sicd/PKGBUILD b/arch/sicd/PKGBUILD new file mode 100644 index 000000000..0b2a19843 --- /dev/null +++ b/arch/sicd/PKGBUILD @@ -0,0 +1,33 @@ +# Maintainer: Markus Fritsche +# sic daemon — netstring-framed argv over stdin, execvp'd. Deploy on target hosts. +# Source of truth: git.reauktion.de/marfrit/sic + +pkgname=sicd +pkgver=0.1.0 +pkgrel=1 +pkgdesc="sic daemon: reads netstring-framed argv from stdin and execvp's it (deploy on remote/target hosts)" +arch=('x86_64' 'aarch64') +url="https://git.reauktion.de/marfrit/sic" +license=('MIT') +makedepends=('go') +optdepends=('openssh: run sicd as an ssh ForceCommand / authorized_keys command') +source=("sic-${pkgver}.tar.gz::https://git.reauktion.de/marfrit/sic/archive/v${pkgver}.tar.gz") +sha256sums=('5cd10c3a1ab7361e72e7579af5819f9d322ecd59424541cfb80e5b7514253511') + +build() { + cd "${srcdir}/sic" + case "$CARCH" in + x86_64) export GOARCH=amd64 ;; + aarch64) export GOARCH=arm64 ;; + esac + export GOOS=linux CGO_ENABLED=0 GOFLAGS='-buildvcs=false -trimpath' + go build -ldflags='-s -w' -o sicd ./cmd/sicd +} + +package() { + cd "${srcdir}/sic" + install -Dm755 sicd "${pkgdir}/usr/bin/sicd" + install -Dm644 gateway/sicd "${pkgdir}/usr/share/doc/${pkgname}/sicd-reference.py" + install -Dm644 docs/design.md "${pkgdir}/usr/share/doc/${pkgname}/design.md" + install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" +} diff --git a/debian/sic-agent/build-deb.sh b/debian/sic-agent/build-deb.sh new file mode 100755 index 000000000..6edc12a44 --- /dev/null +++ b/debian/sic-agent/build-deb.sh @@ -0,0 +1,65 @@ +#!/bin/bash +# Build sic-agent__.deb using dpkg-deb (Go cross-build of the client +# plus the agent skills). +# +# Usage: ./build-deb.sh [amd64|arm64] (default: host dpkg architecture) +# Needs: go, dpkg-deb, curl. +set -euo pipefail + +PKGVER=0.1.0 +PKGREL=1 +SIC_TARBALL_SHA256=5cd10c3a1ab7361e72e7579af5819f9d322ecd59424541cfb80e5b7514253511 +HERE=$(dirname "$(readlink -f "$0")") + +DEB_ARCH="${1:-$(dpkg --print-architecture)}" +case "$DEB_ARCH" in + amd64) GOARCH=amd64 ;; + arm64) GOARCH=arm64 ;; + *) echo "unsupported arch: $DEB_ARCH (use amd64 or arm64)" >&2; exit 1 ;; +esac + +export SOURCE_DATE_EPOCH=1784462400 + +work=$(mktemp -d) +trap "rm -rf $work" EXIT +cd "$work" + +curl -sSLfo sic.tar.gz \ + "https://git.reauktion.de/marfrit/sic/archive/v${PKGVER}.tar.gz" +echo "$SIC_TARBALL_SHA256 sic.tar.gz" | sha256sum -c +tar xzf sic.tar.gz + +( cd sic && GOOS=linux GOARCH="$GOARCH" CGO_ENABLED=0 \ + GOFLAGS='-buildvcs=false -trimpath' go build -ldflags='-s -w' -o sic ./cmd/sic ) + +ROOT="$work/pkgroot" +mkdir -p "$ROOT/DEBIAN" "$ROOT/usr/bin" \ + "$ROOT/usr/share/sic-agent/skills/sic" \ + "$ROOT/usr/share/sic-agent/skills/sic-bg" \ + "$ROOT/usr/share/doc/sic-agent" +install -m755 sic/sic "$ROOT/usr/bin/sic" +install -m644 sic/SKILL.md "$ROOT/usr/share/sic-agent/skills/sic/SKILL.md" +install -m644 sic/SKILL-bg.md "$ROOT/usr/share/sic-agent/skills/sic-bg/SKILL.md" +install -m644 sic/README.md "$ROOT/usr/share/doc/sic-agent/README.md" +install -m644 "$HERE/debian/copyright" "$ROOT/usr/share/doc/sic-agent/copyright" + +{ + echo "Package: sic-agent" + echo "Version: ${PKGVER}-${PKGREL}" + echo "Architecture: ${DEB_ARCH}" + echo "Maintainer: Markus Fritsche " + echo "Section: net" + echo "Priority: optional" + echo "Depends: openssh-client" + echo "Homepage: https://git.reauktion.de/marfrit/sic" + echo "Description: sic client and agent skills for remote command execution" + echo " The sic client frames argv as netstrings and pipes it over ssh to" + echo " sicd on a remote host. Installs /usr/bin/sic and foreground/background" + echo " agent skills under /usr/share/sic-agent/skills/; link them into the" + echo " agent's skills directory to activate. Targets need the sicd package." +} > "$ROOT/DEBIAN/control" + +OUT="$HERE/sic-agent_${PKGVER}-${PKGREL}_${DEB_ARCH}.deb" +rm -f "$OUT" +dpkg-deb --root-owner-group --build "$ROOT" "$OUT" +echo "built $OUT" diff --git a/debian/sic-agent/debian/changelog b/debian/sic-agent/debian/changelog new file mode 100644 index 000000000..4b19277c4 --- /dev/null +++ b/debian/sic-agent/debian/changelog @@ -0,0 +1,5 @@ +sic-agent (0.1.0-1) unstable; urgency=low + + * Initial release: sic client plus foreground/background agent skills. + + -- Markus Fritsche Sat, 19 Jul 2026 12:00:00 +0000 diff --git a/debian/sic-agent/debian/control b/debian/sic-agent/debian/control new file mode 100644 index 000000000..b50a0849c --- /dev/null +++ b/debian/sic-agent/debian/control @@ -0,0 +1,19 @@ +Source: sic-agent +Section: net +Priority: optional +Maintainer: Markus Fritsche +Build-Depends: debhelper-compat (= 13), golang-go +Standards-Version: 4.6.2 +Homepage: https://git.reauktion.de/marfrit/sic + +Package: sic-agent +Architecture: any +Depends: ${misc:Depends}, openssh-client +Description: sic client and agent skills for remote command execution + The sic client frames argv as netstrings and pipes it over ssh to sicd on a + remote host, which runs it with execvp — no shell re-parses the arguments. + . + Installs /usr/bin/sic and two agent skills (foreground and background remote + exec) under /usr/share/sic-agent/skills/. Link the skills into the agent's + skills directory (for example ~/.claude/skills/) to activate them. The target + hosts need the sicd package. diff --git a/debian/sic-agent/debian/copyright b/debian/sic-agent/debian/copyright new file mode 100644 index 000000000..2af8dd456 --- /dev/null +++ b/debian/sic-agent/debian/copyright @@ -0,0 +1,26 @@ +Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ +Upstream-Name: sic +Source: https://git.reauktion.de/marfrit/sic + +Files: * +Copyright: 2026 marfrit +License: MIT + +License: MIT + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + . + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + . + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + SOFTWARE. diff --git a/debian/sicd/build-deb.sh b/debian/sicd/build-deb.sh new file mode 100755 index 000000000..3cad14f94 --- /dev/null +++ b/debian/sicd/build-deb.sh @@ -0,0 +1,61 @@ +#!/bin/bash +# Build sicd__.deb using dpkg-deb. Mirrors the lmcp/claude-his-agent +# pattern, plus a Go cross-build step (sicd is a compiled binary). +# +# Usage: ./build-deb.sh [amd64|arm64] (default: host dpkg architecture) +# Needs: go, dpkg-deb, curl. +set -euo pipefail + +PKGVER=0.1.0 +PKGREL=1 +SIC_TARBALL_SHA256=5cd10c3a1ab7361e72e7579af5819f9d322ecd59424541cfb80e5b7514253511 +HERE=$(dirname "$(readlink -f "$0")") + +DEB_ARCH="${1:-$(dpkg --print-architecture)}" +case "$DEB_ARCH" in + amd64) GOARCH=amd64 ;; + arm64) GOARCH=arm64 ;; + *) echo "unsupported arch: $DEB_ARCH (use amd64 or arm64)" >&2; exit 1 ;; +esac + +# Reproducible build: pin mtimes + ar timestamps (v0.1.0, 2026-07-19 12:00 UTC). +export SOURCE_DATE_EPOCH=1784462400 + +work=$(mktemp -d) +trap "rm -rf $work" EXIT +cd "$work" + +curl -sSLfo sic.tar.gz \ + "https://git.reauktion.de/marfrit/sic/archive/v${PKGVER}.tar.gz" +echo "$SIC_TARBALL_SHA256 sic.tar.gz" | sha256sum -c +tar xzf sic.tar.gz + +( cd sic && GOOS=linux GOARCH="$GOARCH" CGO_ENABLED=0 \ + GOFLAGS='-buildvcs=false -trimpath' go build -ldflags='-s -w' -o sicd ./cmd/sicd ) + +ROOT="$work/pkgroot" +mkdir -p "$ROOT/DEBIAN" "$ROOT/usr/bin" "$ROOT/usr/share/doc/sicd" +install -m755 sic/sicd "$ROOT/usr/bin/sicd" +install -m644 sic/gateway/sicd "$ROOT/usr/share/doc/sicd/sicd-reference.py" +install -m644 sic/docs/design.md "$ROOT/usr/share/doc/sicd/design.md" +install -m644 "$HERE/debian/copyright" "$ROOT/usr/share/doc/sicd/copyright" + +{ + echo "Package: sicd" + echo "Version: ${PKGVER}-${PKGREL}" + echo "Architecture: ${DEB_ARCH}" + echo "Maintainer: Markus Fritsche " + echo "Section: net" + echo "Priority: optional" + echo "Recommends: openssh-server" + echo "Homepage: https://git.reauktion.de/marfrit/sic" + echo "Description: sic daemon — netstring argv over stdin, execvp'd" + echo " sicd reads netstring-framed argv from stdin and runs it with execvp," + echo " so no shell re-parses the arguments. Deploy on target hosts and run" + echo " it over ssh (as the remote command, or command=\"sicd\" on a key)." +} > "$ROOT/DEBIAN/control" + +OUT="$HERE/sicd_${PKGVER}-${PKGREL}_${DEB_ARCH}.deb" +rm -f "$OUT" +dpkg-deb --root-owner-group --build "$ROOT" "$OUT" +echo "built $OUT" diff --git a/debian/sicd/debian/changelog b/debian/sicd/debian/changelog new file mode 100644 index 000000000..fde586949 --- /dev/null +++ b/debian/sicd/debian/changelog @@ -0,0 +1,6 @@ +sicd (0.1.0-1) unstable; urgency=low + + * Initial release: netstring-framed argv over stdin, execvp'd. Deploy on + target hosts, run over ssh. + + -- Markus Fritsche Sat, 19 Jul 2026 12:00:00 +0000 diff --git a/debian/sicd/debian/control b/debian/sicd/debian/control new file mode 100644 index 000000000..e8b0a5766 --- /dev/null +++ b/debian/sicd/debian/control @@ -0,0 +1,19 @@ +Source: sicd +Section: net +Priority: optional +Maintainer: Markus Fritsche +Build-Depends: debhelper-compat (= 13), golang-go +Standards-Version: 4.6.2 +Homepage: https://git.reauktion.de/marfrit/sic + +Package: sicd +Architecture: any +Depends: ${misc:Depends} +Recommends: openssh-server +Description: sic daemon — netstring-framed argv over stdin, execvp'd + sicd reads netstring-framed argv from stdin and runs it with execvp, so no + shell re-parses the arguments. Deploy it on target hosts and run it over ssh + (as the remote command, or pinned to a key with command="sicd"). + . + Installs /usr/bin/sicd. A Python reference implementation and the wire-format + design doc are under /usr/share/doc/sicd/. diff --git a/debian/sicd/debian/copyright b/debian/sicd/debian/copyright new file mode 100644 index 000000000..2af8dd456 --- /dev/null +++ b/debian/sicd/debian/copyright @@ -0,0 +1,26 @@ +Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ +Upstream-Name: sic +Source: https://git.reauktion.de/marfrit/sic + +Files: * +Copyright: 2026 marfrit +License: MIT + +License: MIT + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + . + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + . + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + SOFTWARE.