mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 09:14:33 +00:00
CyberMind-FR
de15a18c30
New packages/secubox-toolbox-ng/debian/ producing the secubox-toolbox-ng
binary package (Architecture: arm64):
- control: Maintainer Gerald KERMA; B-D golang-go; Depends
only (static CGO_ENABLED=0 binary → no shlib deps). Compat 13 via
debhelper-compat build-dep (debhelper rejects compat both ways).
- changelog: 0.1.0-1~bookworm1.
- rules: dh; GOOS=linux GOARCH=arm64 CGO_ENABLED=0 GOPROXY=off go build
(pure stdlib, offline). dh_installsystemd --no-enable --no-start so the
unit is shipped but NEVER enabled/started.
- secubox-toolbox-ng-worker@.service: systemd template mirroring the Python
mitm-wg worker@ but running sbxmitm on 127.0.0.1:809%i (distinct from the
Python 808%i so both fleets coexist during cutover). Reads the ca-wg CA.
DISABLED BY DESIGN — header documents Phase-6-cutover-only enablement.
- postinst: daemon-reload only; explicitly NO enable/start; NO nft.
Built locally for arm64: dpkg-deb verified — ships /usr/sbin/sbxmitm (arm64
static ELF) + the disabled template; postinst contains ZERO deb-systemd-helper
enable lines. .gitignore extended for in-tree build artifacts. DARK: install
changes no runtime behaviour (no service start, no DNAT, no live-R3 wiring).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
45 lines
1.5 KiB
Makefile
Executable File
45 lines
1.5 KiB
Makefile
Executable File
#!/usr/bin/make -f
|
|
# SPDX-License-Identifier: LicenseRef-CMSD-1.0
|
|
# SecuBox-Deb :: toolbox-ng — Go MITM engine (migration target, DARK)
|
|
#
|
|
# The binary is pure-stdlib (no go.sum, no external modules), so it
|
|
# cross-compiles offline with GOPROXY=off. CI cross-builds for arm64;
|
|
# this rules file does the same with `GOOS=linux GOARCH=arm64 go build`.
|
|
|
|
export DH_VERBOSE = 1
|
|
|
|
# Build the static arm64 binary offline (stdlib only — no network, no go.sum).
|
|
export GOOS = linux
|
|
export GOARCH = arm64
|
|
export CGO_ENABLED = 0
|
|
export GOFLAGS = -mod=mod
|
|
export GOPROXY = off
|
|
# Keep the Go build/module cache inside the build tree (sandbox-friendly).
|
|
export GOCACHE = $(CURDIR)/_gocache
|
|
export GOPATH = $(CURDIR)/_gopath
|
|
|
|
%:
|
|
dh $@
|
|
|
|
override_dh_auto_build:
|
|
go build -trimpath -ldflags=-s -o sbxmitm ./cmd/sbxmitm
|
|
|
|
# No Go unit tests at package-build time (run in CI on the host arch; the
|
|
# arm64 cross-binary cannot execute its tests here).
|
|
override_dh_auto_test:
|
|
|
|
override_dh_auto_install:
|
|
install -d debian/secubox-toolbox-ng/usr/sbin
|
|
install -m 0755 sbxmitm debian/secubox-toolbox-ng/usr/sbin/sbxmitm
|
|
|
|
override_dh_auto_clean:
|
|
rm -f sbxmitm
|
|
rm -rf _gocache _gopath
|
|
|
|
# DARK: install the unit file into the catalogue but DO NOT enable or start it.
|
|
# This is the Phase-6 cutover target; the live R3 tunnel stays on the Python
|
|
# workers until the operator enables it manually. The postinst still reloads the
|
|
# unit catalogue so `systemctl` knows the template exists.
|
|
override_dh_installsystemd:
|
|
dh_installsystemd --no-enable --no-start --name=secubox-toolbox-ng-worker@
|