Release 0.1.0-rc.1+git5-73ab640

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -28,3 +28,11 @@ All notable changes to Guard are documented here. The format follows
   the `adm` and `systemd-journal` groups, published with each release to
   the Gitea Debian registry (`stable`, or `testing` for a release
   candidate) along with tarballs for Linux amd64 and arm64.
+
+### Fixed
+
+- The package's `guard` user is now in the `adm` and `systemd-journal`
+  groups itself, as the documentation said, not only through its unit's
+  `SupplementaryGroups`. `sudo -u guard guard test` and `guard check`
+  could read neither `/var/log`'s files (`permission denied`) nor the
+  journal. Upgrading adds the groups.

README.md

@@ -65,4 +65,4 @@ Housecarl's side: its [docs/bans.md](https://gitea.adbraun.lol/adam/housecarl/sr
 
 ## Status
 
-Guard 0.1.0 is in testing (0.1.0-rc.1). Go, `CGO_ENABLED=0`, Linux. MIT licence.
+Guard 0.1.0 is in testing (0.1.0-rc.1+git5-73ab640). Go, `CGO_ENABLED=0`, Linux. MIT licence.

VERSION

@@ -1 +1 @@
-0.1.0-rc.1
+0.1.0-rc.1+git5-73ab640

deploy/sysusers.d/guard.conf

@@ -1,3 +1,7 @@
 # Guard's system user (systemd-sysusers): it reads logs and talks to
-# Housecarl, nothing more.
+# Housecarl, nothing more. adm reads /var/log's files, systemd-journal
+# the journal, for the daemon (its unit adds them too) and for
+# 'sudo -u guard guard test'.
 u guard - "Guard log watcher" /var/lib/guard /usr/sbin/nologin
+m guard adm
+m guard systemd-journal

scripts/gitea-release.sh

@@ -114,7 +114,7 @@ done
 files="$files dist/SHA256SUMS"
 
 # The release (created, or found when publishing again).
-release=$(call 404 "$api/releases/tags/$tag")
+release=$(call 404 "$api/releases/tags/$(printf '%s' "$tag" | sed 's/+/%2B/g')")
 id=$(printf '%s\n' "$release" | jq -r '.id // empty')
 if [ -z "$id" ]; then
 	body=$(jq -n --arg tag "$tag" --arg notes "$notes" --argjson pre "$prerelease" \
@@ -127,7 +127,8 @@ for f in $files; do
 	name=${f#dist/}
 	old=$(printf '%s\n' "$release" | jq -r --arg n "$name" '.assets[]? | select(.name == $n) | .id')
 	[ -z "$old" ] || call "" -X DELETE "$api/releases/$id/assets/$old" >/dev/null
-	call "" -X POST -F "attachment=@$f" "$api/releases/$id/assets?name=$name" >/dev/null
+	# A + (build metadata, 0.1.0-rc.1+git4-8fa62f9) would be a space in a query.
+	call "" -X POST -F "attachment=@$f" "$api/releases/$id/assets?name=$(printf '%s' "$name" | sed 's/+/%2B/g')" >/dev/null
 	echo "gitea-release: attached $name"
 done