chore: Release v1.2.3 — AI mode aspect-distortion fix #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Security CI (Phase 5): supply-chain audit + lint + tests, and a checksec-style | |
| # verification that the hardened link flags actually landed in the binary. | |
| name: security | |
| on: | |
| push: | |
| branches: [main, dev] | |
| pull_request: | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| # System libraries the app links (WebKitGTK/GTK/GStreamer). Mirrors the proven | |
| # set in release.yml so the lib/binary build succeeds on the runner. landlock + | |
| # seccompiler are pure-Rust crates, so no libseccomp-dev is needed. | |
| APT_DEPS: >- | |
| libwebkit2gtk-4.1-dev libwebkit2gtk-4.0-dev libgtk-3-dev | |
| libayatana-appindicator3-dev librsvg2-dev patchelf | |
| build-essential curl wget file libxdo-dev libssl-dev libunwind-dev | |
| libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev | |
| jobs: | |
| # Supply-chain HARD GATE. Everything fixable by a semver-compatible bump has | |
| # been applied (cargo update); the few residual advisories are triaged + ignored | |
| # with justification in deny.toml (and mirrored in the cargo-audit --ignore list | |
| # below): the `ring`<0.17 AES panic (debug-only, pinned via jsonwebtoken) and the | |
| # glib unsoundness (inherent to the unmaintained gtk-rs GTK3 stack). A NEW | |
| # advisory or a disallowed license will fail this job. | |
| supply-chain: | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Install cargo-audit and cargo-deny | |
| run: cargo install cargo-audit cargo-deny --locked | |
| - name: cargo audit (known vulnerabilities) | |
| # Keep these IDs in sync with deny.toml's [advisories] ignore. | |
| run: cargo audit --ignore RUSTSEC-2025-0009 --ignore RUSTSEC-2024-0429 --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195 | |
| - name: cargo deny (advisories + licenses + bans + sources) | |
| run: cargo deny check | |
| lint-and-test: | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: System deps (WebKitGTK/GTK/GStreamer) | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y $APT_DEPS | |
| - name: Stub web assets | |
| # This job verifies the Rust backend (tests) — not the web bundle. tauri_build | |
| # only checks that the bundled NoScript .so and the frontendDist exist, so we | |
| # stub them instead of running the full pnpm/vite/noscript build. | |
| run: | | |
| mkdir -p apps/reclaim/src-tauri/resources/noscript | |
| touch apps/reclaim/src-tauri/resources/noscript/libearth_noscript_ext.so | |
| mkdir -p apps/reclaim/dist | |
| printf '<!doctype html><meta charset="utf-8"><title>ci</title><div id="root"></div>' > apps/reclaim/dist/index.html | |
| - name: Unit tests (vault isolation, totp, hygiene) | |
| run: cargo test --lib | |
| - name: Clippy (our crates) | |
| run: cargo clippy --lib -- -W clippy::all | |
| hardening-flags: | |
| # checksec-style verification that RELRO/NX/PIE actually made it into the built | |
| # binary — so the .cargo/config.toml flags can't silently regress. | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: System deps | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y $APT_DEPS | |
| - name: Stub web assets | |
| # We only readelf the binary's hardening flags here, not run the app, so the | |
| # NoScript .so + frontendDist just need to exist for tauri_build. | |
| run: | | |
| mkdir -p apps/reclaim/src-tauri/resources/noscript | |
| touch apps/reclaim/src-tauri/resources/noscript/libearth_noscript_ext.so | |
| mkdir -p apps/reclaim/dist | |
| printf '<!doctype html><meta charset="utf-8"><title>ci</title><div id="root"></div>' > apps/reclaim/dist/index.html | |
| - name: Build release binary | |
| run: cargo build --release --bin reclaim | |
| - name: Verify hardening (RELRO now + NX + PIE) | |
| run: | | |
| BIN=target/release/reclaim | |
| echo "== dynamic section ==" | |
| readelf -d "$BIN" | grep -E 'BIND_NOW|FLAGS' || true | |
| echo "== program headers ==" | |
| readelf -lW "$BIN" | grep -E 'GNU_RELRO|GNU_STACK|interp' || true | |
| fail=0 | |
| readelf -d "$BIN" | grep -q 'BIND_NOW' || { echo "MISSING: BIND_NOW (full RELRO)"; fail=1; } | |
| readelf -lW "$BIN" | grep -q 'GNU_RELRO' || { echo "MISSING: GNU_RELRO"; fail=1; } | |
| # PIE: ET_DYN executable | |
| readelf -h "$BIN" | grep -q 'DYN' || { echo "MISSING: PIE (ET_DYN)"; fail=1; } | |
| # NX stack: GNU_STACK must NOT be RWE | |
| if readelf -lW "$BIN" | grep 'GNU_STACK' | grep -q 'RWE'; then echo "BAD: executable stack"; fail=1; fi | |
| exit $fail |