diff --git a/CHANGELOG.md b/CHANGELOG.md index a5fd68f5..194f5509 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -57,9 +57,11 @@ Nothing yet. Everything previously staged here is folded into it looked healthy while the daemon was dead. No source code caused this and none was changed. The Linux artifacts are now built in a container pinned to the oldest supported distribution, declared with the floor in - `packaging/build-floor.env`, and every producer runs + `packaging/build-floor.env`, and every producer on the release path runs `testing/check-glibc-floor.sh` on what it made, so a package or a tarball that - would not load fails the build rather than reaching a user. The declared + would not load fails the build rather than reaching a user. The deprecated + host-build targets in `packaging/Makefile` are not on that path and are not + floor-checked. The declared dependency is derived from the binaries instead of hand-written, so it states the floor it was built against. diff --git a/README.md b/README.md index a57b886b..6c26c371 100644 --- a/README.md +++ b/README.md @@ -194,9 +194,10 @@ takes `fips` from the AUR, and NixOS uses the Nix flake described below. **Only the `.deb` is exercised by an install test**, by the `deb-install` suite across debian12, debian13, ubuntu22, ubuntu24 and ubuntu26; neither the AUR package nor the flake is. That suite runs on -every push and pull request, against a `.deb` built by the same pinned -container as the released one. It does not run at a tag: no workflow -installs the published artifact, so the released package is checked by +every push and pull request, on x86_64, against a `.deb` built by the same +pinned container as the released one. It does not run at a tag, and the +arm64 package is install-tested by nothing: no workflow installs a published +artifact, so the released packages are checked by hand. OpenWrt is a musl target rather than glibc, and it takes an `.ipk` on 24.x and earlier or an `.apk` on 25 and later; both carry the `fips-mesh-setup` and @@ -308,12 +309,15 @@ that makes the Linux packages install and run on Debian 12 and Ubuntu 22.04, where every artifact from v0.3.0 through v0.5.0 installed and then could not start. [v0.5.0](https://github.com/jmcorgan/fips/releases/tag/v0.5.0) was the -last feature release, so how much of it is new to you depends on which -version you are upgrading from. The core +last feature release, so how much of that release is new to you depends on +which version you are upgrading from. The core protocol works end-to-end over UDP, TCP, Ethernet, Tor, Nym, and Bluetooth on a global, public test mesh of thousands of nodes. +v0.5.1 is a packaging fix and carries two discovery fixes; the feature +content below is v0.5.0's. + v0.5.0 is a platform-and-lifecycle release. It adds FreeBSD as a packaged platform (x86_64 only), OpenWrt setup helpers for an 802.11s mesh between routers (`fips-mesh-setup`) and for the open `!FIPS` client diff --git a/RELEASE-NOTES.md b/RELEASE-NOTES.md index 36e0425d..17868235 100644 --- a/RELEASE-NOTES.md +++ b/RELEASE-NOTES.md @@ -22,9 +22,9 @@ contribution. There is no wire format change and no new configuration. it. - **Any other Linux: upgrade at your convenience.** Your daemon was running, and you gain the two discovery fixes. -- **macOS, Windows, FreeBSD and OpenWrt: nothing changed for you.** The - defect was in how the Linux artifacts were built. Those artifacts are - rebuilt from the same source and are otherwise as v0.5.0 shipped them. +- **macOS, Windows, FreeBSD and OpenWrt: the packaging defect never + affected you**, since it was in how the Linux artifacts were built. You + do get the two discovery fixes, which are not gated by platform. - **From source: you were never affected.** A binary you built runs against the C library you built it on. @@ -54,9 +54,10 @@ an older C library. **`fipsctl` was unaffected**, which is why an install checked by running a command looked healthy while the daemon was dead. -**No source code caused this and none was changed.** The defect was in -the build environment, and the release contains no behavioral change to -the daemon. +**No source code caused the packaging defect and none was changed to fix +it.** The defect was in the build environment. The two discovery fixes +below are this release's only behavioral change, and they are unrelated to +it. **Why the declared dependency did not stop it.** The `.deb` said it needed `libc6` with no version, which every glibc satisfies. So a @@ -126,9 +127,10 @@ It now has its own rejection reason and counter, `req_own_loopback`, shown in `fipstop` as "Own Loopback". `req_duplicate` returns to meaning only what it says. -**If you watch these counters**, expect `req_duplicate` to drop and a -new non-zero `Own Loopback` to appear. That is the same traffic, -correctly attributed, not a new fault. +**If you watch these counters**, expect a new non-zero `Own Loopback` to +appear on a node that originates lookups. That is traffic that was +previously counted elsewhere or not at all, correctly attributed, rather +than a new fault. ## Compatibility @@ -145,18 +147,19 @@ The library surface is unchanged. Configuration is unchanged. **Package upgrade, Debian and Ubuntu.** The usual upgrade replaces the binaries and restarts the service. On Debian 12 and Ubuntu 22.04 the daemon will start for the first time, so this is a first start rather -than a restart: check `fipsctl status` afterwards and expect to see peer -establishment, not a resumed session. +than a restart: check `fipsctl show status` afterwards and expect to see +peer establishment, not a resumed session. **Check what you actually have.** If you want to confirm the floor of an installed binary rather than trust the version string: ```text objdump -T /usr/bin/fips | grep GLIBC_ | sed 's/.*GLIBC_//' | sort -uV | tail -1 -```text +``` -An artifact from this release reports 2.34. One from v0.5.0 or earlier -reports 2.39. +An artifact from this release prints `2.34) __libc_start_main`. One from +v0.5.0 or earlier prints `2.39) pidfd_spawnp`, which names the symbol that +caused this. **Rolling upgrade.** No coordination is needed. Upgrade nodes in any order. @@ -182,9 +185,11 @@ There is no Android daemon artifact. Android is supported as an embedded crate. The full per-commit changelog lives in -[`CHANGELOG.md`](CHANGELOG.md). Issues and discussion at +[`CHANGELOG.md`](https://github.com/jmcorgan/fips/blob/v0.5.1/CHANGELOG.md). +Issues and discussion at [github.com/jmcorgan/fips](https://github.com/jmcorgan/fips). Security -reports have a private channel; see [`SECURITY.md`](SECURITY.md). +reports have a private channel; see +[`SECURITY.md`](https://github.com/jmcorgan/fips/blob/v0.5.1/SECURITY.md). ## Contributors diff --git a/docs/getting-started.md b/docs/getting-started.md index b8de0a73..ee3280f9 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -66,12 +66,15 @@ per-platform installer: - Windows: `.zip` with service-install scripts - Generic systemd Linux: `.tar.gz` with an `install.sh` script -FIPS supports every version of a supported distribution that its vendor -still supports for free: currently Ubuntu 22.04, Debian 12, Ubuntu 24.04, -Debian 13 and Ubuntu 26.04. The Linux binaries are built in a container -pinned to the oldest of those, so they run on all of them. The glibc floor -that follows is declared in `packaging/build-floor.env` and is enforced on -every artifact by `testing/check-glibc-floor.sh`. +The `.deb` and the systemd tarball support every version of a glibc +distribution that its vendor still supports for free: currently Ubuntu +22.04, Debian 12, Ubuntu 24.04, Debian 13 and Ubuntu 26.04. Those binaries +are built in a container pinned to the oldest of them, so they run on all +five, and the glibc floor that follows is declared in +`packaging/build-floor.env` and checked by `testing/check-glibc-floor.sh` on +what the release workflow produces. Arch and NixOS build from source on your +own machine, and OpenWrt is a musl target rather than glibc, so none of them +depends on that floor. See the [project README's Quick start section](../README.md#quick-start) for download links and per-platform invocations. diff --git a/docs/releases/release-notes-v0.5.1.md b/docs/releases/release-notes-v0.5.1.md index 4662c6cf..17868235 100644 --- a/docs/releases/release-notes-v0.5.1.md +++ b/docs/releases/release-notes-v0.5.1.md @@ -22,9 +22,9 @@ contribution. There is no wire format change and no new configuration. it. - **Any other Linux: upgrade at your convenience.** Your daemon was running, and you gain the two discovery fixes. -- **macOS, Windows, FreeBSD and OpenWrt: nothing changed for you.** The - defect was in how the Linux artifacts were built. Those artifacts are - rebuilt from the same source and are otherwise as v0.5.0 shipped them. +- **macOS, Windows, FreeBSD and OpenWrt: the packaging defect never + affected you**, since it was in how the Linux artifacts were built. You + do get the two discovery fixes, which are not gated by platform. - **From source: you were never affected.** A binary you built runs against the C library you built it on. @@ -54,9 +54,10 @@ an older C library. **`fipsctl` was unaffected**, which is why an install checked by running a command looked healthy while the daemon was dead. -**No source code caused this and none was changed.** The defect was in -the build environment, and the release contains no behavioral change to -the daemon. +**No source code caused the packaging defect and none was changed to fix +it.** The defect was in the build environment. The two discovery fixes +below are this release's only behavioral change, and they are unrelated to +it. **Why the declared dependency did not stop it.** The `.deb` said it needed `libc6` with no version, which every glibc satisfies. So a @@ -126,9 +127,10 @@ It now has its own rejection reason and counter, `req_own_loopback`, shown in `fipstop` as "Own Loopback". `req_duplicate` returns to meaning only what it says. -**If you watch these counters**, expect `req_duplicate` to drop and a -new non-zero `Own Loopback` to appear. That is the same traffic, -correctly attributed, not a new fault. +**If you watch these counters**, expect a new non-zero `Own Loopback` to +appear on a node that originates lookups. That is traffic that was +previously counted elsewhere or not at all, correctly attributed, rather +than a new fault. ## Compatibility @@ -145,18 +147,19 @@ The library surface is unchanged. Configuration is unchanged. **Package upgrade, Debian and Ubuntu.** The usual upgrade replaces the binaries and restarts the service. On Debian 12 and Ubuntu 22.04 the daemon will start for the first time, so this is a first start rather -than a restart: check `fipsctl status` afterwards and expect to see peer -establishment, not a resumed session. +than a restart: check `fipsctl show status` afterwards and expect to see +peer establishment, not a resumed session. **Check what you actually have.** If you want to confirm the floor of an installed binary rather than trust the version string: ```text objdump -T /usr/bin/fips | grep GLIBC_ | sed 's/.*GLIBC_//' | sort -uV | tail -1 -```text +``` -An artifact from this release reports 2.34. One from v0.5.0 or earlier -reports 2.39. +An artifact from this release prints `2.34) __libc_start_main`. One from +v0.5.0 or earlier prints `2.39) pidfd_spawnp`, which names the symbol that +caused this. **Rolling upgrade.** No coordination is needed. Upgrade nodes in any order. @@ -182,9 +185,11 @@ There is no Android daemon artifact. Android is supported as an embedded crate. The full per-commit changelog lives in -[`CHANGELOG.md`](../../CHANGELOG.md). Issues and discussion at +[`CHANGELOG.md`](https://github.com/jmcorgan/fips/blob/v0.5.1/CHANGELOG.md). +Issues and discussion at [github.com/jmcorgan/fips](https://github.com/jmcorgan/fips). Security -reports have a private channel; see [`SECURITY.md`](../../SECURITY.md). +reports have a private channel; see +[`SECURITY.md`](https://github.com/jmcorgan/fips/blob/v0.5.1/SECURITY.md). ## Contributors diff --git a/packaging/freebsd/README.md b/packaging/freebsd/README.md index a3a1147a..5bbb1cdb 100644 --- a/packaging/freebsd/README.md +++ b/packaging/freebsd/README.md @@ -24,7 +24,7 @@ Output: `deploy/fips--freebsd-.pkg` (e.g. ## Install ```sh -pkg add ./deploy/fips--freebsd-amd64.pkg +pkg add ./deploy/fips-0.5.1-freebsd-amd64.pkg # post-install seeds this from the sample if absent, at mode 0600 vi /usr/local/etc/fips/fips.yaml sysrc fips_enable=YES fips_dns_enable=YES