sic: add sicd + sic-agent packages (Arch + Debian) + CI

sicd (daemon, target hosts) and sic-agent (client + agent skills) from git.reauktion.de/marfrit/sic v0.1.0. Go binaries, cross-built with GOARCH. - arch/sicd, arch/sic-agent: PKGBUILDs (build from source via go). - debian/sicd, debian/sic-agent: control/copyright/changelog + build-deb.sh (per-arch amd64/arm64). - .gitea/workflows/build.yml: 4 jobs — Arch aarch64 (repo-signed, -> nc) and Debian amd64+arm64 (-> hertz reprepro, bookworm+trixie). continue-on-error, chained after the existing jobs. Validated locally: Arch aarch64 pkgs + Debian arm64/amd64 debs build; the packaged sicd binary runs (netstring exec).
2026-07-19 12:32:22 +02:00
parent 5716775f91
commit 108fc4fba7
12 changed files with 574 additions and 0 deletions
@@ -1732,3 +1732,277 @@ jobs:
        if: always()
        run: rm -f /root/.ssh/id_ed25519_hertz

+
+  # ===========================================================================
+  # sic — quoting-proof remote command execution (git.reauktion.de/marfrit/sic).
+  # Two packages: sicd (daemon, target hosts) and sic-agent (client + skills).
+  # Go binaries -> arch-specific. Arch: aarch64 (the Arch fleet is aarch64).
+  # Debian: amd64 + arm64 (the Debian/Proxmox hosts span both). Cross-built with
+  # Go's GOARCH on the aarch64 runner.
+  # ===========================================================================
+
+  sicd-arch:
+    needs: daedalus-v4l2-dkms-debian
+    runs-on: arch-aarch64
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - name: bootstrap runner (idempotent)
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo go
+      - name: import signing key
+        env:
+          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
+          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
+        run: |
+          set -e
+          gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
+          rm -rf /root/.gnupg /root/repo_pass
+          mkdir -m700 -p /root/.gnupg
+          printf '%s' "$PASS" > /root/repo_pass
+          chmod 600 /root/repo_pass
+          printf '%s\n' "$PRIV" | gpg --batch --import
+          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
+      - name: install deploy ssh key
+        env:
+          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
+        run: |
+          mkdir -m700 -p /root/.ssh
+          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
+          chmod 600 /root/.ssh/id_ed25519
+          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
+      - name: makepkg sicd
+        run: |
+          set -e
+          rm -rf /tmp/build-sicd
+          cp -r arch/sicd /tmp/build-sicd
+          chown -R builder:builder /tmp/build-sicd
+          cd /tmp/build-sicd
+          sudo -u builder -H makepkg --nocheck --noconfirm --syncdeps --cleanbuild
+          ls -la *.pkg.tar.* | grep -v "\.sig$"
+      - name: sign sicd
+        run: |
+          set -e
+          cd /tmp/build-sicd
+          for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
+            [ -f "$f" ] || continue
+            gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
+                --detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
+          done
+      - name: update aarch64 repo db
+        run: |
+          set -e
+          mkdir -p /tmp/arch-stage-sicd
+          cd /tmp/arch-stage-sicd
+          rm -f *
+          for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
+            curl -sSLf "https://packages.reauktion.de/arch/aarch64/$f" -o "$f" || rm -f "$f"
+          done
+          for ext in xz zst gz; do
+            ls /tmp/build-sicd/*.pkg.tar.$ext 2>/dev/null && \
+              mv /tmp/build-sicd/*.pkg.tar.$ext /tmp/build-sicd/*.pkg.tar.$ext.sig .
+          done || true
+          export GNUPGHOME=/root/.gnupg
+          printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
+          printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
+          gpg-connect-agent reloadagent /bye
+          pkgs=()
+          for ext in xz zst gz; do
+            for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
+          done
+          if [ -f marfrit.db.tar.gz ]; then
+            for f in "${pkgs[@]}"; do
+              name=$(echo "$f" | sed -E 's/-[0-9].*//')
+              repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
+                marfrit.db.tar.gz "$name" 2>/dev/null || true
+            done
+          fi
+          repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
+            --verify marfrit.db.tar.gz "${pkgs[@]}"
+          ln -sf marfrit.db.tar.gz     marfrit.db
+          ln -sf marfrit.files.tar.gz  marfrit.files
+          ln -sf marfrit.db.tar.gz.sig marfrit.db.sig
+          rm -f marfrit.files.sig
+      - name: publish to aarch64
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          cd /tmp/arch-stage-sicd
+          retry rsync -avL --copy-unsafe-links -e 'ssh -i /root/.ssh/id_ed25519' \
+            ./ mfritsche@nc.reauktion.de:arch/aarch64/
+      - name: wipe secrets
+        if: always()
+        run: rm -f /root/repo_pass /root/.ssh/id_ed25519
+
+  sic-agent-arch:
+    needs: sicd-arch
+    runs-on: arch-aarch64
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - name: bootstrap runner (idempotent)
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo go
+      - name: import signing key
+        env:
+          PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
+          PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
+        run: |
+          set -e
+          gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
+          rm -rf /root/.gnupg /root/repo_pass
+          mkdir -m700 -p /root/.gnupg
+          printf '%s' "$PASS" > /root/repo_pass
+          chmod 600 /root/repo_pass
+          printf '%s\n' "$PRIV" | gpg --batch --import
+          echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
+      - name: install deploy ssh key
+        env:
+          KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
+        run: |
+          mkdir -m700 -p /root/.ssh
+          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
+          chmod 600 /root/.ssh/id_ed25519
+          ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
+      - name: makepkg sic-agent
+        run: |
+          set -e
+          rm -rf /tmp/build-sic-agent
+          cp -r arch/sic-agent /tmp/build-sic-agent
+          chown -R builder:builder /tmp/build-sic-agent
+          cd /tmp/build-sic-agent
+          sudo -u builder -H makepkg --nocheck --noconfirm --syncdeps --cleanbuild
+          ls -la *.pkg.tar.* | grep -v "\.sig$"
+      - name: sign sic-agent
+        run: |
+          set -e
+          cd /tmp/build-sic-agent
+          for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
+            [ -f "$f" ] || continue
+            gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
+                --detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
+          done
+      - name: update aarch64 repo db
+        run: |
+          set -e
+          mkdir -p /tmp/arch-stage-sic-agent
+          cd /tmp/arch-stage-sic-agent
+          rm -f *
+          for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
+            curl -sSLf "https://packages.reauktion.de/arch/aarch64/$f" -o "$f" || rm -f "$f"
+          done
+          for ext in xz zst gz; do
+            ls /tmp/build-sic-agent/*.pkg.tar.$ext 2>/dev/null && \
+              mv /tmp/build-sic-agent/*.pkg.tar.$ext /tmp/build-sic-agent/*.pkg.tar.$ext.sig .
+          done || true
+          export GNUPGHOME=/root/.gnupg
+          printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
+          printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
+          gpg-connect-agent reloadagent /bye
+          pkgs=()
+          for ext in xz zst gz; do
+            for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
+          done
+          if [ -f marfrit.db.tar.gz ]; then
+            for f in "${pkgs[@]}"; do
+              name=$(echo "$f" | sed -E 's/-[0-9].*//')
+              repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
+                marfrit.db.tar.gz "$name" 2>/dev/null || true
+            done
+          fi
+          repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
+            --verify marfrit.db.tar.gz "${pkgs[@]}"
+          ln -sf marfrit.db.tar.gz     marfrit.db
+          ln -sf marfrit.files.tar.gz  marfrit.files
+          ln -sf marfrit.db.tar.gz.sig marfrit.db.sig
+          rm -f marfrit.files.sig
+      - name: publish to aarch64
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          cd /tmp/arch-stage-sic-agent
+          retry rsync -avL --copy-unsafe-links -e 'ssh -i /root/.ssh/id_ed25519' \
+            ./ mfritsche@nc.reauktion.de:arch/aarch64/
+      - name: wipe secrets
+        if: always()
+        run: rm -f /root/repo_pass /root/.ssh/id_ed25519
+
+  sicd-debian:
+    needs: sic-agent-arch
+    runs-on: arch-aarch64
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - name: install deps
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl go
+      - name: install hertz deploy ssh key
+        env:
+          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
+        run: |
+          mkdir -m700 -p /root/.ssh
+          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
+          chmod 600 /root/.ssh/id_ed25519_hertz
+          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
+      - name: build + publish sicd .deb (amd64 + arm64)
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          cd debian/sicd
+          for arch in amd64 arm64; do
+            ./build-deb.sh "$arch"
+            DEB=$(ls sicd_*_${arch}.deb | head -1)
+            retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
+                marfritrepo@hertz.fritz.box:
+            for suite in bookworm trixie; do
+              retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
+                  "publish-deb $suite $DEB"
+            done
+          done
+      - name: wipe secrets
+        if: always()
+        run: rm -f /root/.ssh/id_ed25519_hertz
+
+  sic-agent-debian:
+    needs: sicd-debian
+    runs-on: arch-aarch64
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - name: install deps
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl go
+      - name: install hertz deploy ssh key
+        env:
+          KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
+        run: |
+          mkdir -m700 -p /root/.ssh
+          printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
+          chmod 600 /root/.ssh/id_ed25519_hertz
+          ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
+      - name: build + publish sic-agent .deb (amd64 + arm64)
+        run: |
+          set -e
+          retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
+          cd debian/sic-agent
+          for arch in amd64 arm64; do
+            ./build-deb.sh "$arch"
+            DEB=$(ls sic-agent_*_${arch}.deb | head -1)
+            retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
+                marfritrepo@hertz.fritz.box:
+            for suite in bookworm trixie; do
+              retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
+                  "publish-deb $suite $DEB"
+            done
+          done
+      - name: wipe secrets
+        if: always()
+        run: rm -f /root/.ssh/id_ed25519_hertz
@@ -0,0 +1,5 @@
+arch/*/src/
+arch/*/pkg/
+arch/*/*.pkg.tar.*
+debian/*/*.deb
+arch/*/*.tar.gz
@@ -0,0 +1,35 @@
+# Maintainer: Markus Fritsche <mfritsche@reauktion.de>
+# sic client + agent skills. For agent hosts that drive remote commands.
+# Source of truth: git.reauktion.de/marfrit/sic
+
+pkgname=sic-agent
+pkgver=0.1.0
+pkgrel=1
+pkgdesc="sic client + agent skills: frame argv as netstrings and run it on a remote host via sicd (foreground + background skills)"
+arch=('x86_64' 'aarch64')
+url="https://git.reauktion.de/marfrit/sic"
+license=('MIT')
+makedepends=('go')
+depends=('openssh')
+source=("sic-${pkgver}.tar.gz::https://git.reauktion.de/marfrit/sic/archive/v${pkgver}.tar.gz")
+sha256sums=('5cd10c3a1ab7361e72e7579af5819f9d322ecd59424541cfb80e5b7514253511')
+
+build() {
+    cd "${srcdir}/sic"
+    case "$CARCH" in
+        x86_64)  export GOARCH=amd64 ;;
+        aarch64) export GOARCH=arm64 ;;
+    esac
+    export GOOS=linux CGO_ENABLED=0 GOFLAGS='-buildvcs=false -trimpath'
+    go build -ldflags='-s -w' -o sic ./cmd/sic
+}
+
+package() {
+    cd "${srcdir}/sic"
+    install -Dm755 sic          "${pkgdir}/usr/bin/sic"
+    # Agent skills — link into the agent's skills dir (e.g. ~/.claude/skills/).
+    install -Dm644 SKILL.md     "${pkgdir}/usr/share/sic-agent/skills/sic/SKILL.md"
+    install -Dm644 SKILL-bg.md  "${pkgdir}/usr/share/sic-agent/skills/sic-bg/SKILL.md"
+    install -Dm644 README.md    "${pkgdir}/usr/share/doc/${pkgname}/README.md"
+    install -Dm644 LICENSE      "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+}
@@ -0,0 +1,33 @@
+# Maintainer: Markus Fritsche <mfritsche@reauktion.de>
+# sic daemon — netstring-framed argv over stdin, execvp'd. Deploy on target hosts.
+# Source of truth: git.reauktion.de/marfrit/sic
+
+pkgname=sicd
+pkgver=0.1.0
+pkgrel=1
+pkgdesc="sic daemon: reads netstring-framed argv from stdin and execvp's it (deploy on remote/target hosts)"
+arch=('x86_64' 'aarch64')
+url="https://git.reauktion.de/marfrit/sic"
+license=('MIT')
+makedepends=('go')
+optdepends=('openssh: run sicd as an ssh ForceCommand / authorized_keys command')
+source=("sic-${pkgver}.tar.gz::https://git.reauktion.de/marfrit/sic/archive/v${pkgver}.tar.gz")
+sha256sums=('5cd10c3a1ab7361e72e7579af5819f9d322ecd59424541cfb80e5b7514253511')
+
+build() {
+    cd "${srcdir}/sic"
+    case "$CARCH" in
+        x86_64)  export GOARCH=amd64 ;;
+        aarch64) export GOARCH=arm64 ;;
+    esac
+    export GOOS=linux CGO_ENABLED=0 GOFLAGS='-buildvcs=false -trimpath'
+    go build -ldflags='-s -w' -o sicd ./cmd/sicd
+}
+
+package() {
+    cd "${srcdir}/sic"
+    install -Dm755 sicd           "${pkgdir}/usr/bin/sicd"
+    install -Dm644 gateway/sicd   "${pkgdir}/usr/share/doc/${pkgname}/sicd-reference.py"
+    install -Dm644 docs/design.md "${pkgdir}/usr/share/doc/${pkgname}/design.md"
+    install -Dm644 LICENSE        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+}
@@ -0,0 +1,65 @@
+#!/bin/bash
+# Build sic-agent_<ver>_<arch>.deb using dpkg-deb (Go cross-build of the client
+# plus the agent skills).
+#
+# Usage: ./build-deb.sh [amd64|arm64]     (default: host dpkg architecture)
+# Needs: go, dpkg-deb, curl.
+set -euo pipefail
+
+PKGVER=0.1.0
+PKGREL=1
+SIC_TARBALL_SHA256=5cd10c3a1ab7361e72e7579af5819f9d322ecd59424541cfb80e5b7514253511
+HERE=$(dirname "$(readlink -f "$0")")
+
+DEB_ARCH="${1:-$(dpkg --print-architecture)}"
+case "$DEB_ARCH" in
+    amd64) GOARCH=amd64 ;;
+    arm64) GOARCH=arm64 ;;
+    *) echo "unsupported arch: $DEB_ARCH (use amd64 or arm64)" >&2; exit 1 ;;
+esac
+
+export SOURCE_DATE_EPOCH=1784462400
+
+work=$(mktemp -d)
+trap "rm -rf $work" EXIT
+cd "$work"
+
+curl -sSLfo sic.tar.gz \
+    "https://git.reauktion.de/marfrit/sic/archive/v${PKGVER}.tar.gz"
+echo "$SIC_TARBALL_SHA256  sic.tar.gz" | sha256sum -c
+tar xzf sic.tar.gz
+
+( cd sic && GOOS=linux GOARCH="$GOARCH" CGO_ENABLED=0 \
+    GOFLAGS='-buildvcs=false -trimpath' go build -ldflags='-s -w' -o sic ./cmd/sic )
+
+ROOT="$work/pkgroot"
+mkdir -p "$ROOT/DEBIAN" "$ROOT/usr/bin" \
+         "$ROOT/usr/share/sic-agent/skills/sic" \
+         "$ROOT/usr/share/sic-agent/skills/sic-bg" \
+         "$ROOT/usr/share/doc/sic-agent"
+install -m755 sic/sic          "$ROOT/usr/bin/sic"
+install -m644 sic/SKILL.md     "$ROOT/usr/share/sic-agent/skills/sic/SKILL.md"
+install -m644 sic/SKILL-bg.md  "$ROOT/usr/share/sic-agent/skills/sic-bg/SKILL.md"
+install -m644 sic/README.md    "$ROOT/usr/share/doc/sic-agent/README.md"
+install -m644 "$HERE/debian/copyright" "$ROOT/usr/share/doc/sic-agent/copyright"
+
+{
+    echo "Package: sic-agent"
+    echo "Version: ${PKGVER}-${PKGREL}"
+    echo "Architecture: ${DEB_ARCH}"
+    echo "Maintainer: Markus Fritsche <mfritsche@reauktion.de>"
+    echo "Section: net"
+    echo "Priority: optional"
+    echo "Depends: openssh-client"
+    echo "Homepage: https://git.reauktion.de/marfrit/sic"
+    echo "Description: sic client and agent skills for remote command execution"
+    echo " The sic client frames argv as netstrings and pipes it over ssh to"
+    echo " sicd on a remote host. Installs /usr/bin/sic and foreground/background"
+    echo " agent skills under /usr/share/sic-agent/skills/; link them into the"
+    echo " agent's skills directory to activate. Targets need the sicd package."
+} > "$ROOT/DEBIAN/control"
+
+OUT="$HERE/sic-agent_${PKGVER}-${PKGREL}_${DEB_ARCH}.deb"
+rm -f "$OUT"
+dpkg-deb --root-owner-group --build "$ROOT" "$OUT"
+echo "built $OUT"
@@ -0,0 +1,5 @@
+sic-agent (0.1.0-1) unstable; urgency=low
+
+  * Initial release: sic client plus foreground/background agent skills.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Sat, 19 Jul 2026 12:00:00 +0000
@@ -0,0 +1,19 @@
+Source: sic-agent
+Section: net
+Priority: optional
+Maintainer: Markus Fritsche <mfritsche@reauktion.de>
+Build-Depends: debhelper-compat (= 13), golang-go
+Standards-Version: 4.6.2
+Homepage: https://git.reauktion.de/marfrit/sic
+
+Package: sic-agent
+Architecture: any
+Depends: ${misc:Depends}, openssh-client
+Description: sic client and agent skills for remote command execution
+ The sic client frames argv as netstrings and pipes it over ssh to sicd on a
+ remote host, which runs it with execvp — no shell re-parses the arguments.
+ .
+ Installs /usr/bin/sic and two agent skills (foreground and background remote
+ exec) under /usr/share/sic-agent/skills/. Link the skills into the agent's
+ skills directory (for example ~/.claude/skills/) to activate them. The target
+ hosts need the sicd package.
@@ -0,0 +1,26 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: sic
+Source: https://git.reauktion.de/marfrit/sic
+
+Files: *
+Copyright: 2026 marfrit
+License: MIT
+
+License: MIT
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in
+ all copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ SOFTWARE.
@@ -0,0 +1,61 @@
+#!/bin/bash
+# Build sicd_<ver>_<arch>.deb using dpkg-deb. Mirrors the lmcp/claude-his-agent
+# pattern, plus a Go cross-build step (sicd is a compiled binary).
+#
+# Usage: ./build-deb.sh [amd64|arm64]     (default: host dpkg architecture)
+# Needs: go, dpkg-deb, curl.
+set -euo pipefail
+
+PKGVER=0.1.0
+PKGREL=1
+SIC_TARBALL_SHA256=5cd10c3a1ab7361e72e7579af5819f9d322ecd59424541cfb80e5b7514253511
+HERE=$(dirname "$(readlink -f "$0")")
+
+DEB_ARCH="${1:-$(dpkg --print-architecture)}"
+case "$DEB_ARCH" in
+    amd64) GOARCH=amd64 ;;
+    arm64) GOARCH=arm64 ;;
+    *) echo "unsupported arch: $DEB_ARCH (use amd64 or arm64)" >&2; exit 1 ;;
+esac
+
+# Reproducible build: pin mtimes + ar timestamps (v0.1.0, 2026-07-19 12:00 UTC).
+export SOURCE_DATE_EPOCH=1784462400
+
+work=$(mktemp -d)
+trap "rm -rf $work" EXIT
+cd "$work"
+
+curl -sSLfo sic.tar.gz \
+    "https://git.reauktion.de/marfrit/sic/archive/v${PKGVER}.tar.gz"
+echo "$SIC_TARBALL_SHA256  sic.tar.gz" | sha256sum -c
+tar xzf sic.tar.gz
+
+( cd sic && GOOS=linux GOARCH="$GOARCH" CGO_ENABLED=0 \
+    GOFLAGS='-buildvcs=false -trimpath' go build -ldflags='-s -w' -o sicd ./cmd/sicd )
+
+ROOT="$work/pkgroot"
+mkdir -p "$ROOT/DEBIAN" "$ROOT/usr/bin" "$ROOT/usr/share/doc/sicd"
+install -m755 sic/sicd            "$ROOT/usr/bin/sicd"
+install -m644 sic/gateway/sicd    "$ROOT/usr/share/doc/sicd/sicd-reference.py"
+install -m644 sic/docs/design.md  "$ROOT/usr/share/doc/sicd/design.md"
+install -m644 "$HERE/debian/copyright" "$ROOT/usr/share/doc/sicd/copyright"
+
+{
+    echo "Package: sicd"
+    echo "Version: ${PKGVER}-${PKGREL}"
+    echo "Architecture: ${DEB_ARCH}"
+    echo "Maintainer: Markus Fritsche <mfritsche@reauktion.de>"
+    echo "Section: net"
+    echo "Priority: optional"
+    echo "Recommends: openssh-server"
+    echo "Homepage: https://git.reauktion.de/marfrit/sic"
+    echo "Description: sic daemon — netstring argv over stdin, execvp'd"
+    echo " sicd reads netstring-framed argv from stdin and runs it with execvp,"
+    echo " so no shell re-parses the arguments. Deploy on target hosts and run"
+    echo " it over ssh (as the remote command, or command=\"sicd\" on a key)."
+} > "$ROOT/DEBIAN/control"
+
+OUT="$HERE/sicd_${PKGVER}-${PKGREL}_${DEB_ARCH}.deb"
+rm -f "$OUT"
+dpkg-deb --root-owner-group --build "$ROOT" "$OUT"
+echo "built $OUT"
@@ -0,0 +1,6 @@
+sicd (0.1.0-1) unstable; urgency=low
+
+  * Initial release: netstring-framed argv over stdin, execvp'd. Deploy on
+    target hosts, run over ssh.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Sat, 19 Jul 2026 12:00:00 +0000
@@ -0,0 +1,19 @@
+Source: sicd
+Section: net
+Priority: optional
+Maintainer: Markus Fritsche <mfritsche@reauktion.de>
+Build-Depends: debhelper-compat (= 13), golang-go
+Standards-Version: 4.6.2
+Homepage: https://git.reauktion.de/marfrit/sic
+
+Package: sicd
+Architecture: any
+Depends: ${misc:Depends}
+Recommends: openssh-server
+Description: sic daemon — netstring-framed argv over stdin, execvp'd
+ sicd reads netstring-framed argv from stdin and runs it with execvp, so no
+ shell re-parses the arguments. Deploy it on target hosts and run it over ssh
+ (as the remote command, or pinned to a key with command="sicd").
+ .
+ Installs /usr/bin/sicd. A Python reference implementation and the wire-format
+ design doc are under /usr/share/doc/sicd/.
@@ -0,0 +1,26 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: sic
+Source: https://git.reauktion.de/marfrit/sic
+
+Files: *
+Copyright: 2026 marfrit
+License: MIT
+
+License: MIT
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in
+ all copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ SOFTWARE.