Arch) #61

Merged

danny merged 3 commits from issue10_add_packaging into main

2026-07-05 16:03:24 +01:00

danny commented

2026-07-05 14:50:30 +01:00

(Migrated from gitlab.keyop.co.uk)

Closes #10.

Fixes and completes the previously partial/broken nfpms: block in .goreleaser.yaml:

Corrects bindir (/usr/sbin -> /usr/local/bin, matching every other hardcoded path in the Makefile/service file)
Fills in the placeholder description
Adds apk and archlinux formats alongside the existing deb/rpm (per the issue's "anything goreleaser can handle should be handled" - Nix is out of scope, nfpm has no Nix output at all)
Expands contents: to actually ship the bundled iptables binary, the systemd unit, sample config, and the web UI's PAM file

Capabilities are granted via a new postinstall scriptlet (scripts/nfpm-postinstall.sh) run against the installed paths, not baked in at build time - nfpm has no native capability field, and capabilities are xattrs that don't reliably survive archive-based packaging. setcap's own package is declared as a runtime dependency per format. The build-time sudo setcap hooks are dropped as redundant (and to remove goreleaser's only dependency on sudo).

nfq_forwarder.service and config.example.yaml move into a new docs/ directory alongside a new packaging-focused README, all shipped as inert reference copies under /usr/share/doc/nfq_forwarder/ - packages never touch systemd themselves, matching this project's --user-service design. nfq_forwarder.pam is the one file that does install to a live path (/etc/pam.d/nfq_forwarder), since it's dormant until actively used.

Adds a make package target and fixes CI's mislabeled "build" job (previously just re-ran make lint) to actually build and package, uploading the produced packages as job artifacts.

Verified locally

go build ./..., make lint (golangci-lint + yamllint) clean
make package succeeds without sudo, producing .deb/.rpm/.apk/.pkg.tar.zst
Inspected all four packages' file layout, dependencies, and postinstall script content directly (dpkg-deb, rpm -qlp/--scripts) - correct destinations, correct libcap2-bin/libcap dependency declared, postinstall script matches exactly (no systemctl calls anywhere)

Still needs real-host verification (can't be done in this sandbox - see CLAUDE.md's Known issues)

Actually installing the .deb/.rpm on real Debian/RHEL hosts and confirming setcap -v shows both capability grants post-install
The .apk/Arch packages on real Alpine/Arch hosts, including confirming the exact libcap package name resolves on each
Confirming the CI image's new iptables package addition is sufficient for make package to succeed in real GitLab CI

Closes #10. Fixes and completes the previously partial/broken `nfpms:` block in `.goreleaser.yaml`: - Corrects `bindir` (`/usr/sbin` -> `/usr/local/bin`, matching every other hardcoded path in the Makefile/service file) - Fills in the placeholder `description` - Adds `apk` and `archlinux` formats alongside the existing `deb`/`rpm` (per the issue's "anything goreleaser can handle should be handled" - Nix is out of scope, nfpm has no Nix output at all) - Expands `contents:` to actually ship the bundled `iptables` binary, the systemd unit, sample config, and the web UI's PAM file Capabilities are granted via a new postinstall scriptlet (`scripts/nfpm-postinstall.sh`) run against the installed paths, not baked in at build time - nfpm has no native capability field, and capabilities are xattrs that don't reliably survive archive-based packaging. `setcap`'s own package is declared as a runtime dependency per format. The build-time `sudo setcap` hooks are dropped as redundant (and to remove goreleaser's only dependency on `sudo`). `nfq_forwarder.service` and `config.example.yaml` move into a new `docs/` directory alongside a new packaging-focused README, all shipped as inert reference copies under `/usr/share/doc/nfq_forwarder/` - **packages never touch systemd themselves**, matching this project's `--user`-service design. `nfq_forwarder.pam` is the one file that does install to a live path (`/etc/pam.d/nfq_forwarder`), since it's dormant until actively used. Adds a `make package` target and fixes CI's mislabeled "build" job (previously just re-ran `make lint`) to actually build and package, uploading the produced packages as job artifacts. ## Verified locally - `go build ./...`, `make lint` (golangci-lint + yamllint) clean - `make package` succeeds without `sudo`, producing `.deb`/`.rpm`/`.apk`/`.pkg.tar.zst` - Inspected all four packages' file layout, dependencies, and postinstall script content directly (`dpkg-deb`, `rpm -qlp`/`--scripts`) - correct destinations, correct `libcap2-bin`/`libcap` dependency declared, postinstall script matches exactly (no `systemctl` calls anywhere) ## Still needs real-host verification (can't be done in this sandbox - see CLAUDE.md's Known issues) - Actually installing the `.deb`/`.rpm` on real Debian/RHEL hosts and confirming `setcap -v` shows both capability grants post-install - The `.apk`/Arch packages on real Alpine/Arch hosts, including confirming the exact `libcap` package name resolves on each - Confirming the CI image's new `iptables` package addition is sufficient for `make package` to succeed in real GitLab CI

danny (Migrated from gitlab.keyop.co.uk) approved these changes

2026-07-05 14:50:30 +01:00

danny commented

2026-07-05 14:58:49 +01:00

(Migrated from gitlab.keyop.co.uk)

approved this merge request

danny commented

2026-07-05 15:01:00 +01:00

(Migrated from gitlab.keyop.co.uk)

added 1 commit

79a66053 - Add tag-triggered GitLab release publishing

Compare with previous version

added 1 commit <ul><li>79a66053 - Add tag-triggered GitLab release publishing</li></ul> [Compare with previous version](/keyop/go/nfq_forwarder/-/merge_requests/20/diffs?diff_id=264&start_sha=a103a09430ab2267d5f008544e7f733a5b1e3781)

danny commented

2026-07-05 15:30:19 +01:00

(Migrated from gitlab.keyop.co.uk)

added 1 commit

37d6d038 - Fix GitLab release 404: don't use_job_token with a real access token

Compare with previous version

added 1 commit <ul><li>37d6d038 - Fix GitLab release 404: don't use_job_token with a real access token</li></ul> [Compare with previous version](/keyop/go/nfq_forwarder/-/merge_requests/20/diffs?diff_id=266&start_sha=79a66053aef78497559027c322324a5ee5d7fbd9)