[adubovikov]

Requested by Alex · project thread

Summary

This PR brings in the nine open PRs from @jwarnier. All of them conflicted with master after 2.1.0. Each one is merged with a merge commit, so their commits and authorship are kept, and the conflicts are resolved in those merge commits:

• fix(packaging): install binary to /usr/bin and repair .goreleaser.yml #365 and feat(packaging): maintainer scripts, dedicated user and hardened unit #367 come in via ci(package): add static checks for the deb and rpm #382: packaging fixes, maintainer scripts, hardened unit, package checks.
• feat(docker): default to Debian trixie, non-root image, working compose file #369: Docker on trixie, non-root image, compose file, CI image job.
• fix(homebrew): bump formula to 2.0.28 and update it after each release #371: Homebrew formula updated after each release.
• docs(readme): document the deb/rpm packages #373: README section for the deb/rpm packages.
• ci(release): harden and simplify the release workflow #375 comes in via feat(deb): ship a dynamically linked binary using system libpcap and libc #384: release workflow hardening and a dynamically linked .deb.
• ci: enable Dependabot updates and pin GitHub Actions by SHA #377: Dependabot groups, Actions pinned by SHA.

Merging this with a merge commit (not squash) should mark those PRs as merged.

How conflicts with 2.1.0 were resolved

• User: homer:homer everywhere, following Run heplify as homer:homer in Docker and systemd #399.

  • postinstall creates homer, or reuses an existing one.
  • The unit runs as User=homer/Group=homer, without DynamicUser, since the package now creates the user.
  • The config file is root:homer with mode 0640.

• systemd unit: feat(packaging): maintainer scripts, dedicated user and hardened unit #367's header, /usr/bin path and layout, plus the 2.1.0 hardening:

  • CAP_NET_BIND_SERVICE;
  • the syscall filter with EPERM;
  • MemoryDenyWriteExecute;
  • UMask;
  • LogsDirectory.

  The README and COLLECTOR docs no longer say that ports below 1024 need a drop-in.

• Docker: feat(docker): default to Debian trixie, non-root image, working compose file #369's trixie base, cache mounts, OCI labels and libpcap0.8t64 fallback, with the 2.1.0 choices on top:

  • Go 1.26 builder;
  • file capabilities limited to NET_RAW and NET_BIND_SERVICE. Both are in Docker's default set, so the binary also starts without cap_add. Promiscuous mode still needs --user root --cap-add NET_ADMIN.

  The CI image job now also runs the image with default capabilities and checks that it runs as homer.

• nfpm: the /usr/bin path and maintainer scripts from fix(packaging): install binary to /usr/bin and repair .goreleaser.yml #365/feat(packaging): maintainer scripts, dedicated user and hardened unit #367, combined with the per-package ${BINARY} from feat(deb): ship a dynamically linked binary using system libpcap and libc #384.

• Actions: pinned to the SHAs from ci: enable Dependabot updates and pin GitHub Actions by SHA #377, and the jobs added in 2.1.0 (fuzz, security, package check) are pinned to the same SHAs. The package check uses Go 1.26.x. dependabot.yml keeps the Docker ecosystem from 2.1.0.

• Docs from feat(version): show libpcap version and linkage; document build matrix and NSS limit #400: the linkage table now shows the dynamically linked .deb.

Test plan

• go build ./..., go vet ./... and go test ./... pass. There are no Go changes beyond master.
• systemd-analyze verify examples/heplify.service is clean, apart from the missing binary in the sandbox.
• All workflow files parse as YAML.
• I couldn't check the pinned action SHAs from the sandbox. CI on this PR exercises them.

---

Generated by Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ jwarnier
❌ claude
_{You have signed the CLA already but the status is still pending? Let us recheck it.}