sic 0.2.1: fix the v2 stdin hang (sicd reaps on child-exit)

sicd + sic-agent -> 0.2.1-1 against sic tag v0.2.1 (tarball sha 0efe5acc…). The daemon fix: it
no longer blocks the stdin pump after the child exits, so sic calls with a never-EOFing stdin
(non-interactive callers holding the pipe open) return promptly instead of hanging to a timeout.
Client unchanged. Pre-flight built (debian amd64 + arch verifysource).

arch/sic-agent/PKGBUILD

@@ -3,7 +3,7 @@
 # Source of truth: git.reauktion.de/marfrit/sic
 
 pkgname=sic-agent
-pkgver=0.2.0
+pkgver=0.2.1
 pkgrel=1
 pkgdesc="sic client + agent skills: frame argv as netstrings and run it on a remote host via sicd (foreground + background skills)"
 arch=('x86_64' 'aarch64')
@@ -12,7 +12,7 @@ license=('MIT')
 makedepends=('go')
 depends=('openssh')
 source=("sic-${pkgver}.tar.gz::https://git.reauktion.de/marfrit/sic/archive/v${pkgver}.tar.gz")
-sha256sums=('fe0569013da5bfa248743cd04bc2f09da8217b04432aa69827ed5287a133a37c')
+sha256sums=('0efe5acc0218fab02faf0c3c6f8cc1bcd57de64d0bff64bd08affe293b4f0bb6')
 
 build() {
     cd "${srcdir}/sic"

arch/sicd/PKGBUILD

@@ -3,7 +3,7 @@
 # Source of truth: git.reauktion.de/marfrit/sic
 
 pkgname=sicd
-pkgver=0.2.0
+pkgver=0.2.1
 pkgrel=1
 pkgdesc="sic daemon: reads netstring-framed argv from stdin and execvp's it (deploy on remote/target hosts)"
 arch=('x86_64' 'aarch64')
@@ -12,7 +12,7 @@ license=('MIT')
 makedepends=('go')
 optdepends=('openssh: run sicd as an ssh ForceCommand / authorized_keys command')
 source=("sic-${pkgver}.tar.gz::https://git.reauktion.de/marfrit/sic/archive/v${pkgver}.tar.gz")
-sha256sums=('fe0569013da5bfa248743cd04bc2f09da8217b04432aa69827ed5287a133a37c')
+sha256sums=('0efe5acc0218fab02faf0c3c6f8cc1bcd57de64d0bff64bd08affe293b4f0bb6')
 
 build() {
     cd "${srcdir}/sic"

debian/sic-agent/build-deb.sh

@@ -6,9 +6,9 @@
 # Needs: go, dpkg-deb, curl.
 set -euo pipefail
 
-PKGVER=0.2.0
+PKGVER=0.2.1
 PKGREL=1
-SIC_TARBALL_SHA256=fe0569013da5bfa248743cd04bc2f09da8217b04432aa69827ed5287a133a37c
+SIC_TARBALL_SHA256=0efe5acc0218fab02faf0c3c6f8cc1bcd57de64d0bff64bd08affe293b4f0bb6
 HERE=$(dirname "$(readlink -f "$0")")
 
 DEB_ARCH="${1:-$(dpkg --print-architecture)}"
@@ -18,7 +18,7 @@ case "$DEB_ARCH" in
     *) echo "unsupported arch: $DEB_ARCH (use amd64 or arm64)" >&2; exit 1 ;;
 esac
 
-export SOURCE_DATE_EPOCH=1784808000
+export SOURCE_DATE_EPOCH=1784829600
 
 work=$(mktemp -d)
 trap "rm -rf $work" EXIT

debian/sic-agent/debian/changelog

@@ -1,3 +1,9 @@
+sic-agent (0.2.1-1) unstable; urgency=low
+
+  * Version bump only (shares the sic v0.2.1 tag). No client changes; the fix is in sicd.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Thu, 23 Jul 2026 18:00:00 +0000
+
 sic-agent (0.2.0-1) unstable; urgency=low
 
   * Client rewritten onto the v2 wire: nested `host/hop1/hop2` targets resolved

debian/sicd/build-deb.sh

@@ -6,9 +6,9 @@
 # Needs: go, dpkg-deb, curl.
 set -euo pipefail
 
-PKGVER=0.2.0
+PKGVER=0.2.1
 PKGREL=1
-SIC_TARBALL_SHA256=fe0569013da5bfa248743cd04bc2f09da8217b04432aa69827ed5287a133a37c
+SIC_TARBALL_SHA256=0efe5acc0218fab02faf0c3c6f8cc1bcd57de64d0bff64bd08affe293b4f0bb6
 HERE=$(dirname "$(readlink -f "$0")")
 
 DEB_ARCH="${1:-$(dpkg --print-architecture)}"
@@ -19,7 +19,7 @@ case "$DEB_ARCH" in
 esac
 
 # Reproducible build: pin mtimes + ar timestamps (v0.1.0, 2026-07-19 12:00 UTC).
-export SOURCE_DATE_EPOCH=1784808000
+export SOURCE_DATE_EPOCH=1784829600
 
 work=$(mktemp -d)
 trap "rm -rf $work" EXIT

debian/sicd/debian/changelog

@@ -1,3 +1,15 @@
+sicd (0.2.1-1) unstable; urgency=medium
+
+  * Fix a hang: the daemon's stdin pump blocked on the ssh stdin channel long after the child
+    command had exited, when the v2 client forwarded a stdin that never EOFs (a caller holding
+    the pipe open). sicd now races the stdin copy against the child's exit and reaps on
+    child-exit (like ssh itself), so `sic host cmd` returns as soon as cmd finishes instead of
+    hanging until stdin close or a timeout. Piped/redirected stdin still forwards; a genuine
+    truncation to a still-reading child is still a non-zero failure. Daemon-only; client
+    unchanged; v1/v2 dual-read unaffected.
+
+ -- Markus Fritsche <mfritsche@reauktion.de>  Thu, 23 Jul 2026 18:00:00 +0000
+
 sicd (0.2.0-1) unstable; urgency=low
 
   * Nested targets + v2 argv-boundary wire. `sic host/hop1/hop2 cmd` peels