[vxfemboy]

Summary

Closes #147 (Phase 2: Zero-Friction Distribution & Operations).

This PR delivers the complete production distribution, operational, and packaging suite for yip. It eliminates installation friction for systems engineers, self-hosters, and enterprise operators by providing statically linked musl binaries for x86_64 and aarch64, a hardened multi-init service suite (systemd, OpenRC, runit), a multi-stage production container image, a turnkey POSIX 1-line installer with cryptographic SHA-256 validation, cargo-binstall integration, and automated CI release pipelines.

---

Architectural Deliverables

1. Hardened Multi-Init Service Suite (contrib/)

• systemd (contrib/systemd/):
  • contrib/systemd/yipd.service: Configured with modern Linux sandboxing (ProtectSystem=strict, ProtectHome=true, NoNewPrivileges=true, PrivateTmp=true, ProtectControlGroups=true, RuntimeDirectory=yipd), LimitMEMLOCK=infinity (preventing UMEM page locking ENOMEM failures in io_uring and AF_XDP), DeviceAllow=/dev/net/tun rw, and capabilities CAP_NET_ADMIN CAP_NET_RAW CAP_BPF CAP_IPC_LOCK.
  • contrib/systemd/yip-rendezvous.service: Hardened server unit with CAP_NET_BIND_SERVICE.
  • Control socket alignment: Default control socket path aligned to /run/yipd/yip.sock across example.config and bin/yipd/src/control.rs to operate cleanly under ProtectSystem=strict and RuntimeDirectory=yipd.
• OpenRC (contrib/openrc/):
  • contrib/openrc/yipd and contrib/openrc/yip-rendezvous: Production OpenRC runscripts with supervisor="supervise-daemon", capability bounding, rc_ulimit="-l unlimited", pre-start directory preparation, and configuration existence validation.
• runit (contrib/runit/):
  • contrib/runit/yipd/ and contrib/runit/yip-rendezvous/: Standard run scripts and dedicated svlogd -tt logging scripts.

2. Multi-Stage Production Container (Dockerfile)

• Targetable multi-stage build:
  • builder: Alpine Rust environment with musl toolchain and BoringSSL/bindgen dependencies.
  • yipd: Minimal (~20MB) Alpine runtime with ca-certificates and libstdc++, /etc/yip and /run/yipd volume directories, entrypoint /usr/local/bin/yipd.
  • yip-rendezvous: Minimal (~18MB) runtime with ca-certificates and libstdc++, entrypoint /usr/local/bin/yip-rendezvous.
• .dockerignore configured to keep build context clean and minimal.

3. Turnkey POSIX Installer (install.sh) & Sandbox Test Suite (tests/test_install_sh.sh)

• install.sh:
  • 100% POSIX /bin/sh compliant.
  • Privilege escalation handling (sudo/doas), with graceful unprivileged fallback defaulting to ${HOME}/.local/bin and ${XDG_CONFIG_HOME:-$HOME/.config}/yip when running without root privileges.
  • Architecture detection (x86_64 / aarch64 musl).
  • Cryptographic SHA-256 verification via sha256sum -c (fallback shasum -a 256 -c) against release manifests; aborts on checksum mismatch.
  • Offline testing support via LOCAL_TARBALL and LOCAL_SHA256SUMS.
  • Binary installation (yipd, yip-ca, yip-rendezvous) with 0755 permissions and example configuration seeding.
  • Smart init system auto-detection (systemd, openrc, runit, none).
• tests/test_install_sh.sh:
  • Comprehensive automated integration test suite executing 6 test cases (9 assertion phases) in temporary unprivileged sandboxes across bash, sh, and dash.

4. cargo-binstall Package Metadata

• Added [package.metadata.cargo-binstall] to bin/yipd/Cargo.toml, bin/yip-ca/Cargo.toml, and bin/yip-rendezvous/Cargo.toml.
• Root virtual workspace manifest remains untouched.

5. Static Musl Libc Portability

• In crates/yip-device: Target-specific IoctlReq conditional alias (c_int on musl, c_ulong on glibc) for ioctl requests.
• In crates/yip-io: Added empty_msghdr() and empty_mmsghdr() struct initializers to safely initialize structs with private padding fields without violating #![forbid(unsafe_code)] / #![deny(unsafe_op_in_unsafe_fn)], alongside MsgFlags and CmsgLen type aliases.
• Verified pure static-pie linked binaries for x86_64-unknown-linux-musl with zero dynamic interpreter headers.

6. Automated Multi-Arch Release Pipelines (.github/workflows/ & .forgejo/workflows/)

• Added .github/workflows/release.yml and .forgejo/workflows/release.yml triggered on git tags (v*) and manual dispatch.
• Cross-compiles for x86_64-unknown-linux-musl and aarch64-unknown-linux-musl using hermetic musl toolchains (musl-gcc and musl-g++).
• Packages tarballs (yip-${TAG}-${TARGET}.tar.gz) containing binaries, example.config, LICENSE, README.md, and contrib/.
• Computes per-archive SHA-256 digests and publishes consolidated SHA256SUMS on releases.

7. Documentation & Quick Start

• Updated root README.md with prominent 1-line installation snippets (curl -fsSL https://.../install.sh | sh, cargo binstall yipd, docker run) above compilation from source.
• Updated ROADMAP.md moving feat(packaging): Phase 2: Zero-Friction Distribution & Operations (Static Musl, Systemd, Packaging) #147 to ## Done.
• Documented all features in CHANGELOG.md under ## [Unreleased].

---

Verification

• cargo fmt --check: Passed cleanly.
• cargo clippy --workspace --all-targets -- -D warnings: Passed with zero warnings.
• python3 crates/yip-bench/generate-graphs.py --check: Passed cleanly.
• cargo test --workspace: All 422 workspace unit and integration tests passed.
• sh -n install.sh & tests/test_install_sh.sh: All 6 test scenarios passed on sh and bash.
• Pre-commit hooks: Passed.