Lucas RayanandClaude Sonnet 5
8a80504c45
Release / Plan (reuse the published image?) (push) Successful in 3s
CI / Docker image (build and smoke test) (push) Skipped
CI / Format and clippy (push) Successful in 4m32s
CI / Dependency audit (push) Successful in 11s
CI / Tests (Linux) (push) Successful in 9m15s
Release / ci (push) Successful in 9m18s
Release / Build image (arm64) (push) Failing after 7m7s
Release / Build image (amd64) (push) Failing after 13m53s
Release / Publish tags (push) Skipped
Release / Gitea release (push) Skipped
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
56 lines
2.6 KiB
Bash
Executable File
56 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Installs the official prebuilt DuckDB shared library (libduckdb.so and
|
|
# duckdb.h) for the current CPU architecture into <dest-dir>, after checking
|
|
# its SHA-256. DuckDB is never compiled from source in this project.
|
|
#
|
|
# scripts/fetch-libduckdb.sh <dest-dir>
|
|
#
|
|
# Then build with DUCKDB_LIB_DIR=<dest-dir> and run tests or the binary with
|
|
# LD_LIBRARY_PATH=<dest-dir> (the Docker image uses ldconfig instead).
|
|
#
|
|
# The pinned version MUST match the duckdb crate in Cargo.lock: duckdb-rs
|
|
# encodes the DuckDB version in its second component (DuckDB 1.5.6 <-> duckdb
|
|
# 1.10506.x); scripts/check.sh enforces this. To upgrade, change the version
|
|
# and both checksums together (from the "digest" field of each asset in
|
|
# https://api.github.com/repos/duckdb/duckdb/releases/tags/v<version>).
|
|
# DuckDB 2.x renamed these assets to duckdb-shared-libs-linux-<arch>.tar.gz.
|
|
set -euo pipefail
|
|
|
|
DUCKDB_VERSION=1.5.6
|
|
dest=${1:?usage: fetch-libduckdb.sh <dest-dir>}
|
|
|
|
case "$(uname -m)" in
|
|
x86_64 | amd64) arch=amd64 sha256=b845005f5132a7d8180057c35e14a7626632258782f871a90861b19c1c03841b ;;
|
|
aarch64 | arm64) arch=arm64 sha256=b72ed9f05003f5e9d2015f7ceada6416b377d9dd33169cdde3c9e33897856eee ;;
|
|
*) echo "fetch-libduckdb: unsupported architecture: $(uname -m)" >&2; exit 1 ;;
|
|
esac
|
|
stamp="$DUCKDB_VERSION-linux-$arch"
|
|
|
|
installed() { [ -f "$dest/libduckdb.so" ] && [ "$(cat "$dest/.duckdb-release" 2>/dev/null)" = "$stamp" ]; }
|
|
if installed; then
|
|
echo "libduckdb $stamp already in $dest"
|
|
exit 0
|
|
fi
|
|
|
|
command -v unzip >/dev/null || { echo "fetch-libduckdb: unzip is required" >&2; exit 1; }
|
|
parent=$(dirname "$dest")
|
|
mkdir -p "$parent"
|
|
# Stage next to the destination so the final rename is atomic: parallel CI
|
|
# jobs sharing /opt/hostedtoolcache never see a half-extracted library.
|
|
stage=$(mktemp -d "$parent/.libduckdb.XXXXXX")
|
|
trap 'rm -rf "$stage"' EXIT
|
|
asset="libduckdb-linux-$arch.zip"
|
|
curl -fsSL --retry 3 -o "$stage/$asset" \
|
|
"https://github.com/duckdb/duckdb/releases/download/v$DUCKDB_VERSION/$asset"
|
|
echo "$sha256 $stage/$asset" | sha256sum -c --quiet - \
|
|
|| { echo "fetch-libduckdb: checksum mismatch for $asset" >&2; exit 1; }
|
|
# The archive also carries libduckdb_static.a (~80 MB) and duckdb.hpp; only the
|
|
# shared library and the C header are needed.
|
|
unzip -o -j -q "$stage/$asset" libduckdb.so duckdb.h -d "$stage/lib"
|
|
echo "$stamp" > "$stage/lib/.duckdb-release"
|
|
if ! mv -T "$stage/lib" "$dest" 2>/dev/null; then
|
|
# Either another job just installed the same release, or an older one is there.
|
|
installed || { rm -rf "$dest" && mv -T "$stage/lib" "$dest"; }
|
|
fi
|
|
echo "libduckdb $stamp installed in $dest"
|