From 336efbd050a1b6c1a8d945a8c57fee46c8a30c0b Mon Sep 17 00:00:00 2001 From: Ring Zero Security Date: Sun, 11 Oct 2026 08:06:25 +0530 Subject: [PATCH 1/5] release: install bpftool from the kernel tools; publish a rolling latest build on every merge to main - Ubuntu 24.04 has no standalone bpftool package, so the first v0.1.0 release run failed on both architectures before building anything. Use the binary from linux-tools, as CI already does. - Every merge to main now replaces a 'latest' pre-release with that build's .deb packages and checksums. Tagged v* releases are unchanged. --- .github/workflows/release.yml | 52 ++++++++++++++++++++++++++++++++++- 1 file changed, 51 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2febfa2..68d8abb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,11 +14,19 @@ name: release # Tag a version to publish packages: git tag v0.1.0 && git push origin v0.1.0 +# Every merge to main also refreshes the "latest" pre-release, so the newest +# build is always downloadable. on: push: tags: ["v*"] + branches: [main] workflow_dispatch: +# One "latest" publish at a time; a newer merge replaces an older one in flight. +concurrency: + group: release-${{ github.ref }} + cancel-in-progress: ${{ github.ref == 'refs/heads/main' }} + permissions: contents: write @@ -40,9 +48,18 @@ jobs: - name: Install build dependencies run: | sudo apt-get update - sudo apt-get install -y clang llvm libbpf-dev libelf-dev zlib1g-dev bpftool \ + sudo apt-get install -y clang llvm libbpf-dev libelf-dev zlib1g-dev \ pkg-config libssl-dev dpkg-dev \ libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev + # Ubuntu 24.04 has no standalone bpftool package: it ships with the + # kernel tools. Use the binary directly; the /usr/sbin wrapper insists + # on tools for the exact running kernel. + sudo apt-get install -y linux-tools-common "linux-tools-$(uname -r)" \ + || sudo apt-get install -y linux-tools-common linux-tools-generic + BPFTOOL=$(ls /usr/lib/linux-tools/*/bpftool | head -1) + test -x "$BPFTOOL" + "$BPFTOOL" version + echo "BPFTOOL=$BPFTOOL" >> "$GITHUB_ENV" - name: Install the Tauri CLI run: cargo install tauri-cli --version '^2' --locked @@ -108,3 +125,36 @@ jobs: Verify downloads against `SHA256SUMS-.txt`. The installer adds `bpf` to the GRUB command line and asks for a reboot; until you reboot the daemon runs in a degraded, userspace-only mode. + + publish-latest: + name: publish latest build + needs: deb + runs-on: ubuntu-24.04 + if: github.ref == 'refs/heads/main' + steps: + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + with: + path: dist + merge-multiple: true + - name: List what is being published + run: ls -la dist + # The rolling "latest" pre-release is replaced, never edited: deleting it + # and its tag first means its files are always exactly this build's. + - name: Replace the latest pre-release + env: + GH_TOKEN: ${{ github.token }} + GH_REPO: ${{ github.repository }} + run: | + gh release delete latest --yes --cleanup-tag || true + gh release create latest dist/*.deb dist/SHA256SUMS-*.txt \ + --prerelease \ + --target "${{ github.sha }}" \ + --title "Latest build from main" \ + --notes "The newest build from main (${GITHUB_SHA::7}), rebuilt on every merge. For a stable version, use the newest v* release. + + \`\`\`sh + sudo apt install ./ringzero-security__.deb + sudo apt install ./ringzero-desktop__.deb # optional viewer + \`\`\` + + Verify downloads against SHA256SUMS-.txt." From d048d2486b514128cc801fac3a00724db9974b0c Mon Sep 17 00:00:00 2001 From: Ring Zero Security Date: Sun, 11 Oct 2026 08:08:13 +0530 Subject: [PATCH 2/5] release: find bpftool where Ubuntu installs it --- .github/workflows/release.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 68d8abb..a63037c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -56,7 +56,10 @@ jobs: # on tools for the exact running kernel. sudo apt-get install -y linux-tools-common "linux-tools-$(uname -r)" \ || sudo apt-get install -y linux-tools-common linux-tools-generic - BPFTOOL=$(ls /usr/lib/linux-tools/*/bpftool | head -1) + # Ubuntu installs it under /usr/lib/linux-tools-/ (and a + # per-flavour directory of symlinks); search rather than guess. + BPFTOOL=$(find /usr/lib -path '*linux-tools*' -name bpftool \( -type f -o -type l \) 2>/dev/null | head -1) + echo "bpftool: $BPFTOOL" test -x "$BPFTOOL" "$BPFTOOL" version echo "BPFTOOL=$BPFTOOL" >> "$GITHUB_ENV" From 5c1929602d2db9178cacceabac4a3fe2d29f0bf2 Mon Sep 17 00:00:00 2001 From: Ring Zero Security Date: Sun, 11 Oct 2026 08:10:39 +0530 Subject: [PATCH 3/5] release: pinned, checksummed bpftool; refuse a package without the eBPF objects --- .github/workflows/release.yml | 34 ++++++++++++++++++++++++---------- 1 file changed, 24 insertions(+), 10 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a63037c..14720fa 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -51,16 +51,25 @@ jobs: sudo apt-get install -y clang llvm libbpf-dev libelf-dev zlib1g-dev \ pkg-config libssl-dev dpkg-dev \ libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev - # Ubuntu 24.04 has no standalone bpftool package: it ships with the - # kernel tools. Use the binary directly; the /usr/sbin wrapper insists - # on tools for the exact running kernel. - sudo apt-get install -y linux-tools-common "linux-tools-$(uname -r)" \ - || sudo apt-get install -y linux-tools-common linux-tools-generic - # Ubuntu installs it under /usr/lib/linux-tools-/ (and a - # per-flavour directory of symlinks); search rather than guess. - BPFTOOL=$(find /usr/lib -path '*linux-tools*' -name bpftool \( -type f -o -type l \) 2>/dev/null | head -1) - echo "bpftool: $BPFTOOL" - test -x "$BPFTOOL" + + # bpftool generates vmlinux.h for the eBPF build. Ubuntu 24.04 runners have + # no bpftool package, and their kernel-tools packages do not ship it, so + # take the bpftool project's own static release, pinned and checksummed. + - name: Install bpftool (pinned static release) + env: + BPFTOOL_VERSION: v7.7.0 + SHA256_amd64: 09150596f09356b0ff632dd7f9856e0ea86bf96b269e9bc94278d9a9432a268c + SHA256_arm64: d68443d945c146080151eb215bebaa400294ab7ada22af4f5d0a940f5992b9d9 + run: | + arch=${{ matrix.arch }} + tgz="bpftool-${BPFTOOL_VERSION}-${arch}.tar.gz" + curl -fsSL -o "$tgz" "https://github.com/libbpf/bpftool/releases/download/${BPFTOOL_VERSION}/${tgz}" + want_var="SHA256_${arch}" + echo "${!want_var} $tgz" | sha256sum -c - + mkdir -p "$RUNNER_TEMP/bpftool" + tar -xzf "$tgz" -C "$RUNNER_TEMP/bpftool" + BPFTOOL=$(find "$RUNNER_TEMP/bpftool" -name bpftool -type f | head -1) + chmod +x "$BPFTOOL" "$BPFTOOL" version echo "BPFTOOL=$BPFTOOL" >> "$GITHUB_ENV" @@ -83,6 +92,11 @@ jobs: cd target/deb test -f ringzero-security_*_${{ matrix.arch }}.deb test -f ringzero-desktop_*_${{ matrix.arch }}.deb + # build-deb.sh skips the eBPF build when the host has no kernel BTF; a + # package without the kernel objects would enforce nothing, so refuse it. + dpkg -c ringzero-security_*_${{ matrix.arch }}.deb | grep -q 'usr/lib/ringzero/ringzero.bpf.o' + dpkg -c ringzero-security_*_${{ matrix.arch }}.deb | grep -q 'usr/lib/ringzero/stdiocap.bpf.o' + echo "both eBPF objects are in the package" sha256sum *.deb > SHA256SUMS-${{ matrix.arch }}.txt cat SHA256SUMS-${{ matrix.arch }}.txt From db9f2eb6baf438ea0d4bd1bebe906296f7130569 Mon Sep 17 00:00:00 2001 From: Ring Zero Security Date: Sun, 11 Oct 2026 08:29:15 +0530 Subject: [PATCH 4/5] release: keep the bpftool download outside the checkout --- .github/workflows/release.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 14720fa..9277820 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -62,10 +62,12 @@ jobs: SHA256_arm64: d68443d945c146080151eb215bebaa400294ab7ada22af4f5d0a940f5992b9d9 run: | arch=${{ matrix.arch }} - tgz="bpftool-${BPFTOOL_VERSION}-${arch}.tar.gz" + # Download outside the checkout, so the build's version is not "dirty". + tgz="$RUNNER_TEMP/bpftool-${BPFTOOL_VERSION}-${arch}.tar.gz" curl -fsSL -o "$tgz" "https://github.com/libbpf/bpftool/releases/download/${BPFTOOL_VERSION}/${tgz}" want_var="SHA256_${arch}" echo "${!want_var} $tgz" | sha256sum -c - + git status --porcelain mkdir -p "$RUNNER_TEMP/bpftool" tar -xzf "$tgz" -C "$RUNNER_TEMP/bpftool" BPFTOOL=$(find "$RUNNER_TEMP/bpftool" -name bpftool -type f | head -1) From f82a14c6c8a466e904aafecef123cb9ab4b97157 Mon Sep 17 00:00:00 2001 From: Ring Zero Security Date: Sun, 11 Oct 2026 08:29:29 +0530 Subject: [PATCH 5/5] release: download URL uses the file name, not the temp path --- .github/workflows/release.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9277820..8adbade 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -63,8 +63,9 @@ jobs: run: | arch=${{ matrix.arch }} # Download outside the checkout, so the build's version is not "dirty". - tgz="$RUNNER_TEMP/bpftool-${BPFTOOL_VERSION}-${arch}.tar.gz" - curl -fsSL -o "$tgz" "https://github.com/libbpf/bpftool/releases/download/${BPFTOOL_VERSION}/${tgz}" + name="bpftool-${BPFTOOL_VERSION}-${arch}.tar.gz" + tgz="$RUNNER_TEMP/$name" + curl -fsSL -o "$tgz" "https://github.com/libbpf/bpftool/releases/download/${BPFTOOL_VERSION}/${name}" want_var="SHA256_${arch}" echo "${!want_var} $tgz" | sha256sum -c - git status --porcelain