d15774f1cd
govulncheck ab sofort fest im Release-Prozess. Baseline-Scan fand 6 aktiv aufgerufene Vulns (SSH-Backup-Pfad internal/services/backup/remote): - 5× golang.org/x/crypto (SSH DoS/Deadlock/Panic: GO-2026-5013/5017/5018/5019/5020) → x/crypto v0.51.0 => v0.52.0 - 1× golang.org/x/net (GO-2026-5026) → v0.53.0 => v0.55.0 Re-Scan danach: "No vulnerabilities found." Go-Quality-Baseline (Makefile + .golangci.yml, portabel): - release-check läuft autom. vor jedem deb/publish: vet → golangci-lint (Rollout: non-blocking) → govulncheck (HARTER Gate) → build → test -race. - make vulncheck / make test-race als eigene Targets. - .golangci.yml: staticcheck/govet/errcheck/ineffassign/unused/misspell + gosec/bodyclose/rowserrcheck/sqlclosecheck/noctx/contextcheck. - go test -race: aktuell 0 Races (Gate sicher). Doku in CLAUDE.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
127 lines
4.7 KiB
Makefile
127 lines
4.7 KiB
Makefile
# EdgeGuard — Build-System.
|
|
# Cross-Compile für Debian 13 + Ubuntu 24.04 auf amd64 und arm64.
|
|
# CGO_ENABLED=0 (statische Binaries, keine libre2-/CGO-Abhängigkeit in v1).
|
|
|
|
GO ?= $(shell which go || echo /usr/local/go/bin/go)
|
|
MODULE := git.netcell-it.de/projekte/edgeguard-native
|
|
BINARIES := edgeguard-api edgeguard-scheduler edgeguard-ctl edgeguard-waf
|
|
VERSION := $(shell cat VERSION 2>/dev/null || echo 0.0.1-dev)
|
|
LDFLAGS := -s -w -X main.version=$(VERSION)
|
|
GOFLAGS := -trimpath -mod=readonly
|
|
export CGO_ENABLED ?= 0
|
|
|
|
.PHONY: all help build test test-race lint vulncheck release-check tidy clean ui \
|
|
build-linux-amd64 build-linux-arm64 \
|
|
deb deb-amd64 deb-arm64 \
|
|
publish publish-amd64 publish-arm64
|
|
|
|
all: build
|
|
|
|
help:
|
|
@echo "EdgeGuard build targets:"
|
|
@echo " build Build all binaries for the host architecture (build/host/)"
|
|
@echo " build-linux-amd64 Cross-compile all binaries for linux/amd64 (build/amd64/)"
|
|
@echo " build-linux-arm64 Cross-compile all binaries for linux/arm64 (build/arm64/)"
|
|
@echo " test go test ./..."
|
|
@echo " lint go vet + staticcheck (if installed)"
|
|
@echo " tidy go mod tidy"
|
|
@echo " ui Build management-ui (vite)"
|
|
@echo " deb-amd64 Cross-compile + build edgeguard_<ver>_amd64.deb"
|
|
@echo " deb-arm64 Cross-compile + build edgeguard_<ver>_arm64.deb"
|
|
@echo " deb Build both amd64 and arm64 .deb packages"
|
|
@echo " publish-amd64 Build amd64 deb AND upload to Gitea"
|
|
@echo " publish-arm64 Same for arm64"
|
|
@echo " publish publish-amd64 + publish-arm64"
|
|
@echo " clean Remove build artifacts"
|
|
|
|
build:
|
|
@mkdir -p build/host
|
|
@for bin in $(BINARIES); do \
|
|
echo " -> build/host/$$bin"; \
|
|
$(GO) build $(GOFLAGS) -ldflags '$(LDFLAGS)' \
|
|
-o build/host/$$bin ./cmd/$$bin || exit 1; \
|
|
done
|
|
|
|
build-linux-amd64:
|
|
@mkdir -p build/amd64
|
|
@for bin in $(BINARIES); do \
|
|
echo " -> build/amd64/$$bin"; \
|
|
GOOS=linux GOARCH=amd64 $(GO) build $(GOFLAGS) -ldflags '$(LDFLAGS)' \
|
|
-o build/amd64/$$bin ./cmd/$$bin || exit 1; \
|
|
done
|
|
|
|
build-linux-arm64:
|
|
@mkdir -p build/arm64
|
|
@for bin in $(BINARIES); do \
|
|
echo " -> build/arm64/$$bin"; \
|
|
GOOS=linux GOARCH=arm64 $(GO) build $(GOFLAGS) -ldflags '$(LDFLAGS)' \
|
|
-o build/arm64/$$bin ./cmd/$$bin || exit 1; \
|
|
done
|
|
|
|
test:
|
|
$(GO) test $(GOFLAGS) ./...
|
|
|
|
test-race:
|
|
CGO_ENABLED=1 $(GO) test $(GOFLAGS) -race ./...
|
|
|
|
lint:
|
|
$(GO) vet ./...
|
|
@command -v golangci-lint >/dev/null 2>&1 && golangci-lint run \
|
|
|| echo "golangci-lint nicht installiert (go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest) — übersprungen"
|
|
|
|
GOBIN := $(shell $(GO) env GOPATH)/bin
|
|
|
|
# govulncheck — Go-Vuln-DB-Scan. HARTER Release-Gate: bricht ab, wenn der
|
|
# Code eine bekannte Vulnerability tatsächlich aufruft. Tool wird bei Bedarf
|
|
# automatisch installiert.
|
|
vulncheck:
|
|
@command -v govulncheck >/dev/null 2>&1 || GOFLAGS= $(GO) install golang.org/x/vuln/cmd/govulncheck@latest
|
|
@PATH="$(GOBIN):$$PATH" govulncheck ./...
|
|
|
|
# Go-Quality-Baseline — läuft automatisch vor jedem Release (deb/publish).
|
|
# Reihenfolge: vet → golangci-lint (Rollout: NON-BLOCKING) → govulncheck (GATE)
|
|
# → build → test -race. govulncheck bricht bei jedem Fund ab; der Linter ist
|
|
# in der Rollout-Phase noch non-blocking (Bestand aufräumen, dann auf Gate).
|
|
release-check:
|
|
$(GO) vet ./...
|
|
@command -v golangci-lint >/dev/null 2>&1 && (golangci-lint run || echo " ⚠ golangci-lint-Findings (non-blocking, Rollout-Phase)") \
|
|
|| echo " golangci-lint nicht installiert — übersprungen (Rollout-Phase)"
|
|
@$(MAKE) --no-print-directory vulncheck
|
|
$(GO) build ./...
|
|
CGO_ENABLED=1 $(GO) test $(GOFLAGS) -race ./...
|
|
@echo " ✓ Go-Quality-Baseline bestanden (vet, govulncheck, build, test -race)"
|
|
|
|
tidy:
|
|
$(GO) mod tidy
|
|
|
|
ui:
|
|
@echo " -> management-ui (vite build, version $(VERSION))"
|
|
@cd management-ui && \
|
|
if [ -x "$$(command -v bun)" ]; then bun install --silent && bun run build; \
|
|
else npm install --silent && npm run build; fi
|
|
|
|
deb-amd64: release-check build-linux-amd64 ui
|
|
@./scripts/apt-repo/build-package.sh amd64 $(VERSION)
|
|
|
|
deb-arm64: release-check build-linux-arm64 ui
|
|
@./scripts/apt-repo/build-package.sh arm64 $(VERSION)
|
|
|
|
deb: deb-amd64 deb-arm64
|
|
|
|
GITEA_DEB_URL := https://git.netcell-it.de/api/packages/projekte/debian/pool/trixie/main/upload
|
|
|
|
publish-amd64: deb-amd64
|
|
@./scripts/apt-repo/publish.sh $(VERSION) amd64
|
|
@echo " -> cleanup-old (keep last $${KEEP:-10})"
|
|
@./scripts/apt-repo/cleanup-old.sh
|
|
|
|
publish-arm64: deb-arm64
|
|
@./scripts/apt-repo/publish.sh $(VERSION) arm64
|
|
@echo " -> cleanup-old (keep last $${KEEP:-10})"
|
|
@./scripts/apt-repo/cleanup-old.sh
|
|
|
|
publish: publish-amd64 publish-arm64
|
|
|
|
clean:
|
|
rm -rf build/
|