EchoLot/echolot
1
0
Fork 0
Code Pull Requests Actions Packages Projects Releases 31 Wiki Activity
15 Commits 1 Branch 31 Tags
8d15a318fb0ed744dd49a0dd3e3815b7facb7f0e
Commit Graph
3 Commits
Author SHA1 Message Date
mrambossekandClaude Opus 5 8d15a318fb ci: split server release into independent binaries and image jobs
server-release / release (push) Failing after 40s
Details
server-release / image (push) Failing after 5s
Details 
First tag run failed as one monolithic job. Binaries + Gitea release now
need only Go and curl (jq dropped too) and succeed on any runner; the
docker image build is a separate job that can fail without killing the
release self-update depends on.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-30 16:00:23 +02:00
mrambossekandClaude Opus 5 0c988df7e8 ci: split server test and release workflows — mixed paths+tags never fired
server-test / test (push) Successful in 1m3s
Details 
A push trigger that declares tags: stops matching branch pushes, and the
paths filter doesn't apply to tag pushes — so the combined workflow could
effectively never run. test-server.yml now covers branch pushes touching
server/; build-server.yml is tags-only (server-v*).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-30 15:41:25 +02:00
mrambossekandClaude Opus 5 8a80026d49 server: Go skeleton — control plane, UDP data plane, Docker + systemd modes 
Pure stdlib. Implements the spec's core: enrollment (single-use tokens),
profile (SPKI pin, only real capabilities advertised), sessions with the
§2.4 HKDF-SHA256 key schedule; UDP data plane with the 32-byte ELT1
header, 4-byte HMAC gate, 1024-wide anti-replay window, ECHO_RESP with
observation block, TIMESYNC, and the §3.4 anti-amplification cap. Wire
format has tests (roundtrip + silent-drop cases); enroll→profile→session
smoke-tested live.

Modes: container (autodetect /.dockerenv|/run/.containerenv|cgroup, or
--docker/ECHOLOT_DOCKER=1; config via ECHOLOT_* env; distroless image;
network_mode host required — Docker NAT would falsify observed sources)
and native (--install-systemd/--uninstall-systemd with a hardened unit,
opt-in --self-update from Gitea releases; refused in containers).

CI: tests on any server/ push; server-v* tags build+push the image to the
Gitea registry and attach linux amd64/arm64 binaries + SHA256SUMS to a
release — the artifact self-update consumes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-30 13:09:08 +02:00