Self-update now verifies SHA256SUMS.sig (ed25519, relsign package) against
a public key baked into the binary; the private key exists only in the CI
secret store, so a compromised release host can withhold updates but not
inject one. CI signs on every server-v* tag and hard-fails without the
secret. Operators with their own pipeline override the key via
ECHOLOT_SELF_UPDATE_PUBKEY (mint a pair with release-sign -gen).
Startup also now proves 80/443 are actually free on the reserved
measurement addresses by asking the OS (throwaway bind), not the config -
CheckReserved could never see a stray process, and the adb-beacon receiver
on 0.0.0.0:443 was exactly that.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
docker was present on the echolot runner; the login failed because
Gitea's container registry does not accept the ephemeral Actions token.
Requires a PAT with package read/write scope as the REGISTRY_TOKEN repo
secret (REGISTRY_USER optional, defaults to the actor); fails with a
self-explanatory error when missing.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
compilesau-echolot (repo runner, label echolot) handles the docker image
build. Registry host defaults to git.rambossek.at (runner-internal
GITHUB_SERVER_URL is http://app:3000). Asset re-uploads on tag re-runs
warn instead of failing the completed release.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The job log showed uploads 404ing: sed's greedy .* matched the LAST "id"
in the release JSON (a nested user id), not the release's. First-match
grep now. Release creation falls back to GET-by-tag on re-runs, and the
image job strips any scheme from the internal server URL (http://app:3000)
with an ECHOLOT_REGISTRY_HOST override for the public registry host.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
First tag run failed as one monolithic job. Binaries + Gitea release now
need only Go and curl (jq dropped too) and succeed on any runner; the
docker image build is a separate job that can fail without killing the
release self-update depends on.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A push trigger that declares tags: stops matching branch pushes, and the
paths filter doesn't apply to tag pushes — so the combined workflow could
effectively never run. test-server.yml now covers branch pushes touching
server/; build-server.yml is tags-only (server-v*).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Pure stdlib. Implements the spec's core: enrollment (single-use tokens),
profile (SPKI pin, only real capabilities advertised), sessions with the
§2.4 HKDF-SHA256 key schedule; UDP data plane with the 32-byte ELT1
header, 4-byte HMAC gate, 1024-wide anti-replay window, ECHO_RESP with
observation block, TIMESYNC, and the §3.4 anti-amplification cap. Wire
format has tests (roundtrip + silent-drop cases); enroll→profile→session
smoke-tested live.
Modes: container (autodetect /.dockerenv|/run/.containerenv|cgroup, or
--docker/ECHOLOT_DOCKER=1; config via ECHOLOT_* env; distroless image;
network_mode host required — Docker NAT would falsify observed sources)
and native (--install-systemd/--uninstall-systemd with a hardened unit,
opt-in --self-update from Gitea releases; refused in containers).
CI: tests on any server/ push; server-v* tags build+push the image to the
Gitea registry and attach linux amd64/arm64 binaries + SHA256SUMS to a
release — the artifact self-update consumes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
