From de15a18c30abd025acbfc2d7e58daaa14de35b4a Mon Sep 17 00:00:00 2001 From: CyberMind-FR Date: Thu, 18 Jun 2026 18:03:40 +0200 Subject: [PATCH] feat(#662 Phase 5-prep B): debian packaging for sbxmitm (DISABLED, dark) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New packages/secubox-toolbox-ng/debian/ producing the secubox-toolbox-ng binary package (Architecture: arm64): - control: Maintainer Gerald KERMA; B-D golang-go; Depends only (static CGO_ENABLED=0 binary → no shlib deps). Compat 13 via debhelper-compat build-dep (debhelper rejects compat both ways). - changelog: 0.1.0-1~bookworm1. - rules: dh; GOOS=linux GOARCH=arm64 CGO_ENABLED=0 GOPROXY=off go build (pure stdlib, offline). dh_installsystemd --no-enable --no-start so the unit is shipped but NEVER enabled/started. - secubox-toolbox-ng-worker@.service: systemd template mirroring the Python mitm-wg worker@ but running sbxmitm on 127.0.0.1:809%i (distinct from the Python 808%i so both fleets coexist during cutover). Reads the ca-wg CA. DISABLED BY DESIGN — header documents Phase-6-cutover-only enablement. - postinst: daemon-reload only; explicitly NO enable/start; NO nft. Built locally for arm64: dpkg-deb verified — ships /usr/sbin/sbxmitm (arm64 static ELF) + the disabled template; postinst contains ZERO deb-systemd-helper enable lines. .gitignore extended for in-tree build artifacts. DARK: install changes no runtime behaviour (no service start, no DNAT, no live-R3 wiring). Co-Authored-By: Claude Opus 4.8 (1M context) --- packages/secubox-toolbox-ng/.gitignore | 9 ++++ packages/secubox-toolbox-ng/debian/changelog | 9 ++++ packages/secubox-toolbox-ng/debian/control | 22 ++++++++ packages/secubox-toolbox-ng/debian/postinst | 27 ++++++++++ packages/secubox-toolbox-ng/debian/rules | 44 ++++++++++++++++ .../debian/secubox-toolbox-ng-worker@.service | 52 +++++++++++++++++++ .../secubox-toolbox-ng/debian/source/format | 1 + 7 files changed, 164 insertions(+) create mode 100644 packages/secubox-toolbox-ng/debian/changelog create mode 100644 packages/secubox-toolbox-ng/debian/control create mode 100755 packages/secubox-toolbox-ng/debian/postinst create mode 100755 packages/secubox-toolbox-ng/debian/rules create mode 100644 packages/secubox-toolbox-ng/debian/secubox-toolbox-ng-worker@.service create mode 100644 packages/secubox-toolbox-ng/debian/source/format diff --git a/packages/secubox-toolbox-ng/.gitignore b/packages/secubox-toolbox-ng/.gitignore index 0ba0541e..ad792589 100644 --- a/packages/secubox-toolbox-ng/.gitignore +++ b/packages/secubox-toolbox-ng/.gitignore @@ -1,3 +1,12 @@ /sbxmitm *.test cmd/sbxmitm/sbxmitm +# Debian build artifacts (rules builds the binary + go caches in-tree) +/_gocache/ +/_gopath/ +/debian/.debhelper/ +/debian/files +/debian/*.substvars +/debian/secubox-toolbox-ng/ +/debian/debhelper-build-stamp +/debian/*.debhelper.log diff --git a/packages/secubox-toolbox-ng/debian/changelog b/packages/secubox-toolbox-ng/debian/changelog new file mode 100644 index 00000000..16135d8e --- /dev/null +++ b/packages/secubox-toolbox-ng/debian/changelog @@ -0,0 +1,9 @@ +secubox-toolbox-ng (0.1.0-1~bookworm1) bookworm; urgency=medium + + * Initial packaging of the Go MITM engine migration target (#662 Phase 5-prep). + Ships /usr/sbin/sbxmitm + a DISABLED systemd template unit + (secubox-toolbox-ng-worker@.service). DARK by design: the unit is not + enabled or started, no nft DNAT, no live-R3 wiring — enabled only at the + Phase 6 cutover. + + -- Gerald KERMA Wed, 18 Jun 2026 22:00:00 +0200 diff --git a/packages/secubox-toolbox-ng/debian/control b/packages/secubox-toolbox-ng/debian/control new file mode 100644 index 00000000..846d6c73 --- /dev/null +++ b/packages/secubox-toolbox-ng/debian/control @@ -0,0 +1,22 @@ +Source: secubox-toolbox-ng +Section: net +Priority: optional +Maintainer: Gerald KERMA +Build-Depends: debhelper-compat (= 13), golang-go (>= 2:1.22~) +Standards-Version: 4.6.2 +Homepage: https://cybermind.fr/secubox +Rules-Requires-Root: no + +Package: secubox-toolbox-ng +Architecture: arm64 +Depends: ${misc:Depends} +Description: SecuBox-Deb — Go MITM engine (migration target, DARK) + Multi-core Go re-implementation of the R3 toolbox MITM engine (#662), + ported off the GIL-bound Python mitmproxy worker fleet. Ships the + standalone sbxmitm binary plus a DISABLED systemd template unit. + . + This package is the Phase-6-cutover migration target. The unit is NOT + enabled or started by the maintainer scripts — the live R3 tunnel keeps + running on the Python workers until the cutover is performed manually. + Installing this package changes NO runtime behaviour (no service start, + no nft DNAT). diff --git a/packages/secubox-toolbox-ng/debian/postinst b/packages/secubox-toolbox-ng/debian/postinst new file mode 100755 index 00000000..cc49a681 --- /dev/null +++ b/packages/secubox-toolbox-ng/debian/postinst @@ -0,0 +1,27 @@ +#!/bin/sh +# SPDX-License-Identifier: LicenseRef-CMSD-1.0 +# SecuBox-Deb :: toolbox-ng — postinst +# +# DARK by design (#662 Phase 5-prep): +# - DO reload the systemd unit catalogue so the template is known. +# - DO NOT enable or start secubox-toolbox-ng-worker@.service — this is the +# Phase-6 cutover target; the live R3 tunnel keeps running on the Python +# workers until the operator performs the cutover manually. +# - DO NOT touch nftables (no DNAT, no live-R3 rewiring). +set -e + +case "$1" in + configure) + if [ -d /run/systemd/system ]; then + systemctl daemon-reload >/dev/null 2>&1 || true + fi + # Intentionally NO `systemctl enable --now`. See the unit header and + # debian/changelog: enabled only at the Phase 6 cutover. + ;; + abort-upgrade|abort-remove|abort-deconfigure) + ;; +esac + +#DEBHELPER# + +exit 0 diff --git a/packages/secubox-toolbox-ng/debian/rules b/packages/secubox-toolbox-ng/debian/rules new file mode 100755 index 00000000..e5a04347 --- /dev/null +++ b/packages/secubox-toolbox-ng/debian/rules @@ -0,0 +1,44 @@ +#!/usr/bin/make -f +# SPDX-License-Identifier: LicenseRef-CMSD-1.0 +# SecuBox-Deb :: toolbox-ng — Go MITM engine (migration target, DARK) +# +# The binary is pure-stdlib (no go.sum, no external modules), so it +# cross-compiles offline with GOPROXY=off. CI cross-builds for arm64; +# this rules file does the same with `GOOS=linux GOARCH=arm64 go build`. + +export DH_VERBOSE = 1 + +# Build the static arm64 binary offline (stdlib only — no network, no go.sum). +export GOOS = linux +export GOARCH = arm64 +export CGO_ENABLED = 0 +export GOFLAGS = -mod=mod +export GOPROXY = off +# Keep the Go build/module cache inside the build tree (sandbox-friendly). +export GOCACHE = $(CURDIR)/_gocache +export GOPATH = $(CURDIR)/_gopath + +%: + dh $@ + +override_dh_auto_build: + go build -trimpath -ldflags=-s -o sbxmitm ./cmd/sbxmitm + +# No Go unit tests at package-build time (run in CI on the host arch; the +# arm64 cross-binary cannot execute its tests here). +override_dh_auto_test: + +override_dh_auto_install: + install -d debian/secubox-toolbox-ng/usr/sbin + install -m 0755 sbxmitm debian/secubox-toolbox-ng/usr/sbin/sbxmitm + +override_dh_auto_clean: + rm -f sbxmitm + rm -rf _gocache _gopath + +# DARK: install the unit file into the catalogue but DO NOT enable or start it. +# This is the Phase-6 cutover target; the live R3 tunnel stays on the Python +# workers until the operator enables it manually. The postinst still reloads the +# unit catalogue so `systemctl` knows the template exists. +override_dh_installsystemd: + dh_installsystemd --no-enable --no-start --name=secubox-toolbox-ng-worker@ diff --git a/packages/secubox-toolbox-ng/debian/secubox-toolbox-ng-worker@.service b/packages/secubox-toolbox-ng/debian/secubox-toolbox-ng-worker@.service new file mode 100644 index 00000000..e6876b27 --- /dev/null +++ b/packages/secubox-toolbox-ng/debian/secubox-toolbox-ng-worker@.service @@ -0,0 +1,52 @@ +# SPDX-License-Identifier: LicenseRef-CMSD-1.0 +# SecuBox-Deb :: toolbox-ng — Go MITM engine worker template (#662) +# +# ── DISABLED BY DESIGN (DARK) ──────────────────────────────────────────────── +# This is the Phase-6 CUTOVER MIGRATION TARGET. It is NOT enabled or started by +# the package (postinst does not `systemctl enable --now`). The live R3 tunnel +# keeps running on the Python mitmproxy workers +# (secubox-toolbox-mitm-wg-worker@{1..4}, ports 8081-8084) until the cutover is +# performed manually. +# +# Mirrors the Python worker@ fanout: each %i ∈ {1..4} listens on 127.0.0.1:809%i +# (distinct from the Python 808%i ports so both fleets can coexist during a +# side-by-side cutover validation). Enable ONLY at Phase 6: +# +# systemctl enable --now secubox-toolbox-ng-worker@{1,2,3,4}.service +# # then re-point the nft DNAT at 809%i and retire the Python workers +# +# Rollback: disable these, re-point DNAT at the Python 808%i workers. + +[Unit] +Description=SecuBox ToolBoX-NG Go MITM worker %i (migration target, port 809%i) +Documentation=https://github.com/CyberMind-FR/secubox-deb/issues/662 +After=network.target + +[Service] +Type=simple +User=secubox-toolbox +Group=secubox-toolbox + +# Reuse the EXISTING ca-wg CA (R3 clients already trust it — no re-enroll). +# The anti-track jar key is best-effort: absent → poison stays off. +ExecStart=/usr/sbin/sbxmitm \ + --listen 127.0.0.1:809%i \ + --ca-cert /etc/secubox/toolbox/ca-wg/ca.pem \ + --ca-key /etc/secubox/toolbox/ca-wg/key.pem \ + --jar-key /etc/secubox/secrets/privacy-jar.key + +Restart=on-failure +RestartSec=5 + +# Hardening (mirrors the Python worker envelope). +NoNewPrivileges=yes +ProtectSystem=strict +ProtectHome=yes +PrivateTmp=yes +ReadOnlyPaths=/etc/secubox +MemoryHigh=100M +MemoryMax=128M +TasksMax=128 + +[Install] +WantedBy=multi-user.target diff --git a/packages/secubox-toolbox-ng/debian/source/format b/packages/secubox-toolbox-ng/debian/source/format new file mode 100644 index 00000000..89ae9db8 --- /dev/null +++ b/packages/secubox-toolbox-ng/debian/source/format @@ -0,0 +1 @@ +3.0 (native)