sic 0.2.0: nested targets + v2 argv-boundary wire (dual-read, backward compatible)

Bumps sicd + sic-agent (arch PKGBUILDs, debian build-deb.sh, both changelogs) to 0.2.0-1 against sic tag v0.2.0 (tarball sha fe0569013da5...). New tarball verified building all four packages locally (debian amd64 debs + arch verifysource) before push. What 0.2.0 ships (source git.reauktion.de/marfrit/sic @ 4fcd851): * Nested targets: sic host/hop1/hop2 cmd peels incus/docker/pct container hops, resolved via /etc/sic/hosts.toml, built as a netstring onion. * argv boundaries preserved end to end (length-framed [][]byte, never space-split) -- the founding guarantee: sic host touch 'a b' stays ONE file. * Daemon dual-reads v1 and v2 (first-byte dispatch), so pre-0.2.0 clients keep working during the staged rollout. * Client forwards stdin AFTER the frame (fixes the v0.1.0 zero-byte trap), ssh -T binary-safe, exit status inherited. * Hardened + reviewed (bullpen 964/970): outer-length cap before alloc, per-element and byte caps, explicit canonical argc (empty "" args representable). Also removes continue-on-error from the four sic CI jobs (sicd/sic-agent x arch/debian) so a broken build fails the workflow loudly instead of silently producing nothing -- the reason the sic jobs went unnoticed as never-succeeding since 2026-07-19. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-23 12:15:46 +02:00
parent 748b2fb3e9
commit 522f9c0364
7 changed files with 33 additions and 14 deletions
@@ -1744,7 +1744,6 @@ jobs:
  sicd-arch:
    needs: daedalus-v4l2-dkms-debian
    runs-on: arch-aarch64
-    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: bootstrap runner (idempotent)
@@ -1839,7 +1838,6 @@ jobs:
  sic-agent-arch:
    needs: sicd-arch
    runs-on: arch-aarch64
-    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: bootstrap runner (idempotent)
@@ -1934,7 +1932,6 @@ jobs:
  sicd-debian:
    needs: sic-agent-arch
    runs-on: arch-aarch64
-    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: install deps
@@ -1972,7 +1969,6 @@ jobs:
  sic-agent-debian:
    needs: sicd-debian
    runs-on: arch-aarch64
-    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: install deps
@@ -3,7 +3,7 @@
 # Source of truth: git.reauktion.de/marfrit/sic

 pkgname=sic-agent
-pkgver=0.1.0
+pkgver=0.2.0
 pkgrel=1
 pkgdesc="sic client + agent skills: frame argv as netstrings and run it on a remote host via sicd (foreground + background skills)"
 arch=('x86_64' 'aarch64')
@@ -12,7 +12,7 @@ license=('MIT')
 makedepends=('go')
 depends=('openssh')
 source=("sic-${pkgver}.tar.gz::https://git.reauktion.de/marfrit/sic/archive/v${pkgver}.tar.gz")
-sha256sums=('5cd10c3a1ab7361e72e7579af5819f9d322ecd59424541cfb80e5b7514253511')
+sha256sums=('fe0569013da5bfa248743cd04bc2f09da8217b04432aa69827ed5287a133a37c')

 build() {
    cd "${srcdir}/sic"
@@ -3,7 +3,7 @@
 # Source of truth: git.reauktion.de/marfrit/sic

 pkgname=sicd
-pkgver=0.1.0
+pkgver=0.2.0
 pkgrel=1
 pkgdesc="sic daemon: reads netstring-framed argv from stdin and execvp's it (deploy on remote/target hosts)"
 arch=('x86_64' 'aarch64')
@@ -12,7 +12,7 @@ license=('MIT')
 makedepends=('go')
 optdepends=('openssh: run sicd as an ssh ForceCommand / authorized_keys command')
 source=("sic-${pkgver}.tar.gz::https://git.reauktion.de/marfrit/sic/archive/v${pkgver}.tar.gz")
-sha256sums=('5cd10c3a1ab7361e72e7579af5819f9d322ecd59424541cfb80e5b7514253511')
+sha256sums=('fe0569013da5bfa248743cd04bc2f09da8217b04432aa69827ed5287a133a37c')

 build() {
    cd "${srcdir}/sic"
@@ -6,9 +6,9 @@
 # Needs: go, dpkg-deb, curl.
 set -euo pipefail

-PKGVER=0.1.0
+PKGVER=0.2.0
 PKGREL=1
-SIC_TARBALL_SHA256=5cd10c3a1ab7361e72e7579af5819f9d322ecd59424541cfb80e5b7514253511
+SIC_TARBALL_SHA256=fe0569013da5bfa248743cd04bc2f09da8217b04432aa69827ed5287a133a37c
 HERE=$(dirname "$(readlink -f "$0")")

 DEB_ARCH="${1:-$(dpkg --print-architecture)}"
@@ -18,7 +18,7 @@ case "$DEB_ARCH" in
    *) echo "unsupported arch: $DEB_ARCH (use amd64 or arm64)" >&2; exit 1 ;;
 esac

-export SOURCE_DATE_EPOCH=1784462400
+export SOURCE_DATE_EPOCH=1784808000

 work=$(mktemp -d)
 trap "rm -rf $work" EXIT
@@ -1,3 +1,14 @@
+sic-agent (0.2.0-1) unstable; urgency=low
+
+  * Client rewritten onto the v2 wire: nested `host/hop1/hop2` targets resolved
+    via /etc/sic/hosts.toml, boundary-preserved argv ([][]byte, never space-
+    joined; --sh is the sole shell-line exception). Now forwards stdin AFTER the
+    frame — fixes the v0.1.0 trap where `sic host 'cat >f' <local` wrote a
+    zero-byte file and reported success. `ssh -T` (binary-safe frame), exit
+    status inherited. Reviewed (bullpen 964/970).
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Thu, 23 Jul 2026 12:00:00 +0000
+
 sic-agent (0.1.0-1) unstable; urgency=low

  * Initial release: sic client plus foreground/background agent skills.
@@ -6,9 +6,9 @@
 # Needs: go, dpkg-deb, curl.
 set -euo pipefail

-PKGVER=0.1.0
+PKGVER=0.2.0
 PKGREL=1
-SIC_TARBALL_SHA256=5cd10c3a1ab7361e72e7579af5819f9d322ecd59424541cfb80e5b7514253511
+SIC_TARBALL_SHA256=fe0569013da5bfa248743cd04bc2f09da8217b04432aa69827ed5287a133a37c
 HERE=$(dirname "$(readlink -f "$0")")

 DEB_ARCH="${1:-$(dpkg --print-architecture)}"
@@ -19,7 +19,7 @@ case "$DEB_ARCH" in
 esac

 # Reproducible build: pin mtimes + ar timestamps (v0.1.0, 2026-07-19 12:00 UTC).
-export SOURCE_DATE_EPOCH=1784462400
+export SOURCE_DATE_EPOCH=1784808000

 work=$(mktemp -d)
 trap "rm -rf $work" EXIT
@@ -1,3 +1,15 @@
+sicd (0.2.0-1) unstable; urgency=low
+
+  * Nested targets + v2 argv-boundary wire. `sic host/hop1/hop2 cmd` peels
+    incus/docker/pct container hops; argv is length-framed end to end so
+    `sic host touch 'a b'` stays ONE file (no space-split anywhere). The
+    daemon dual-reads v1 and v2 (first-byte dispatch), so pre-0.2.0 clients
+    keep working during rollout. Hardened: outer-netstring length cap before
+    alloc, per-element/byte caps, explicit argc (empty "" args representable,
+    canonical decimal only). Reviewed (bullpen 964/970).
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Thu, 23 Jul 2026 12:00:00 +0000
+
 sicd (0.1.0-1) unstable; urgency=low

  * Initial release: netstring-framed argv over stdin, execvp'd. Deploy on