adam/guard
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Compare commits

base: adam/guard:v0.1.0-rc.1
adam/guard:main
adam/guard:v0.1.0-rc.2 adam/guard:v0.1.0-rc.1+git7-b87cc6f adam/guard:v0.1.0-rc.1+git5-73ab640 adam/guard:v0.1.0-rc.1
...
compare: adam/guard:96f551be80630e1f28b54fb5aa311a6bb15d48e0
adam/guard:main
adam/guard:v0.1.0-rc.2 adam/guard:v0.1.0-rc.1+git7-b87cc6f adam/guard:v0.1.0-rc.1+git5-73ab640 adam/guard:v0.1.0-rc.1
3 Commits
v0.1.0-rc.1 ... 96f551be80
Author SHA1 Message Date
abrown38andClaude Opus 5.5 96f551be80 Release 0.1.0-rc.1+git5-73ab640
release / release (push) Successful in 23s
Details 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-23 12:47:17 +01:00
abrown38andClaude Opus 5.5 73ab6405aa Release script: encode + in the tag and asset names 
A build of a candidate (0.1.0-rc.1+git4-8fa62f9) put a raw + in the
release lookup and the upload's ?name=, where it reads as a space.
Housecarl's script has the same fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-23 12:47:17 +01:00
abrown38andClaude Opus 5.5 8fa62f9b91 Package: put the guard user in adm and systemd-journal 
Only the unit's SupplementaryGroups gave them, so 'sudo -u guard guard
test' and 'guard check' could read neither /var/log's files nor the
journal. systemd-sysusers (run on every install and upgrade) adds them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-23 12:46:53 +01:00
5 changed files with 18 additions and 5 deletions
Expand all files Collapse all files

No files matched your search

CHANGELOG.md
+8
View File
@@ -28,3 +28,11 @@ All notable changes to Guard are documented here. The format follows
the `adm` and `systemd-journal` groups, published with each release to
the Gitea Debian registry (`stable`, or `testing` for a release
candidate) along with tarballs for Linux amd64 and arm64.
### Fixed
- The package's `guard` user is now in the `adm` and `systemd-journal`
groups itself, as the documentation said, not only through its unit's
`SupplementaryGroups`. `sudo -u guard guard test` and `guard check`
could read neither `/var/log`'s files (`permission denied`) nor the
journal. Upgrading adds the groups.
README.md
+1 -1
View File
@@ -65,4 +65,4 @@ Housecarl's side: its [docs/bans.md](https://gitea.adbraun.lol/adam/housecarl/sr
## Status
Guard 0.1.0 is in testing (0.1.0-rc.1). Go, `CGO_ENABLED=0`, Linux. MIT licence.
Guard 0.1.0 is in testing (0.1.0-rc.1+git5-73ab640). Go, `CGO_ENABLED=0`, Linux. MIT licence.
VERSION
+1 -1
View File
@@ -1 +1 @@
0.1.0-rc.1
0.1.0-rc.1+git5-73ab640
deploy/sysusers.d/guard.conf
+5 -1
View File
@@ -1,3 +1,7 @@
# Guard's system user (systemd-sysusers): it reads logs and talks to
# Housecarl, nothing more.
# Housecarl, nothing more. adm reads /var/log's files, systemd-journal
# the journal, for the daemon (its unit adds them too) and for
# 'sudo -u guard guard test'.
u guard - "Guard log watcher" /var/lib/guard /usr/sbin/nologin
m guard adm
m guard systemd-journal
scripts/gitea-release.sh
+3 -2
View File
@@ -114,7 +114,7 @@ done
files="$files dist/SHA256SUMS"
# The release (created, or found when publishing again).
release=$(call 404 "$api/releases/tags/$tag")
release=$(call 404 "$api/releases/tags/$(printf '%s' "$tag" | sed 's/+/%2B/g')")
id=$(printf '%s\n' "$release" | jq -r '.id // empty')
if [ -z "$id" ]; then
body=$(jq -n --arg tag "$tag" --arg notes "$notes" --argjson pre "$prerelease" \
@@ -127,7 +127,8 @@ for f in $files; do
name=${f#dist/}
old=$(printf '%s\n' "$release" | jq -r --arg n "$name" '.assets[]? | select(.name == $n) | .id')
[ -z "$old" ] || call "" -X DELETE "$api/releases/$id/assets/$old" >/dev/null
call "" -X POST -F "attachment=@$f" "$api/releases/$id/assets?name=$name" >/dev/null
# A + (build metadata, 0.1.0-rc.1+git4-8fa62f9) would be a space in a query.
call "" -X POST -F "attachment=@$f" "$api/releases/$id/assets?name=$(printf '%s' "$name" | sed 's/+/%2B/g')" >/dev/null
echo "gitea-release: attached $name"
done