Skip to content

Commit bf2a9dc

Browse files
itcmsgrclaude
itcmsgr
and
claude
authored
feat(v1.100.1b.A): GOTH PR-D4 stage 1 — stop shipping nftban-ui + nftban-ui-auth (#499)
Stop shipping the nftban-ui Web GUI binary, nftban-ui-auth PAM daemon, and their three systemd units. Source trees retained; cross-cutting references retained; documentation retained — those are 1.100.1b.B/C/D. Transitional handling: DEB prerm + RPM %pre stop, disable, mask, and remove orphaned units + binaries on upgrade from prior installs. PR-25 restore execution, PR-26 verification gate, PR-27-30 maintenance remain explicitly OPEN lifecycle completion work. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent a42ac4d commit bf2a9dc

14 files changed

Lines changed: 157 additions & 267 deletions

‎.github/slsa/nftban-ui-auth.yml‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

‎.github/slsa/nftban-ui.yml‎

Lines changed: 0 additions & 34 deletions
This file was deleted.

‎.github/workflows/build-packages.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ jobs:
110110
- name: Validate binaries are real ELF files
111111
run: |
112112
echo "Validating Go binaries..."
113-
for binary in bin/nftban-core bin/nftband bin/nftban-ui bin/nftban-ui-auth bin/nftban-installer; do
113+
for binary in bin/nftban-core bin/nftband bin/nftban-installer; do
114114
if [[ -f "$binary" ]]; then
115115
file_type=$(file -b "$binary")
116116
if [[ "$file_type" != *"ELF"* ]]; then
@@ -210,7 +210,7 @@ jobs:
210210
cd /tmp/rpm-check
211211
rpm2cpio "$GITHUB_WORKSPACE/$rpm" | cpio -idmv 2>/dev/null
212212
213-
for binary in usr/lib/nftban/bin/nftban-core usr/lib/nftban/bin/nftband usr/lib/nftban/bin/nftban-ui usr/lib/nftban/bin/nftban-ui-auth usr/lib/nftban/bin/nftban-installer; do
213+
for binary in usr/lib/nftban/bin/nftban-core usr/lib/nftban/bin/nftband usr/lib/nftban/bin/nftban-installer; do
214214
if [[ -f "$binary" ]]; then
215215
file_type=$(file -b "$binary")
216216
if [[ "$file_type" != *"ELF"* ]]; then
@@ -318,7 +318,7 @@ jobs:
318318
ar x "$GITHUB_WORKSPACE/$deb"
319319
tar -xf data.tar.* 2>/dev/null || tar -xf data.tar.xz 2>/dev/null || tar -xf data.tar.gz 2>/dev/null
320320
321-
for binary in usr/lib/nftban/bin/nftban-core usr/lib/nftban/bin/nftband usr/lib/nftban/bin/nftban-ui usr/lib/nftban/bin/nftban-ui-auth usr/lib/nftban/bin/nftban-installer; do
321+
for binary in usr/lib/nftban/bin/nftban-core usr/lib/nftban/bin/nftband usr/lib/nftban/bin/nftban-installer; do
322322
if [[ -f "$binary" ]]; then
323323
file_type=$(file -b "$binary")
324324
if [[ "$file_type" != *"ELF"* ]]; then
@@ -647,7 +647,7 @@ jobs:
647647
# Get source binary hashes (the canonical reference)
648648
echo "=== Source Binary Hashes (Reference) ==="
649649
declare -A SOURCE_HASHES
650-
for binary in nftband nftban-core nftban-ui nftban-ui-auth nftban-installer; do
650+
for binary in nftband nftban-core nftban-installer; do
651651
if [[ -f "source-binaries/$binary" ]]; then
652652
hash=$(sha256sum "source-binaries/$binary" | cut -d' ' -f1)
653653
SOURCE_HASHES[$binary]="$hash"
@@ -670,7 +670,7 @@ jobs:
670670
cd /tmp/rpm-extract
671671
rpm2cpio "$GITHUB_WORKSPACE/$rpm" | cpio -idmv 2>/dev/null
672672
673-
for binary in nftband nftban-core nftban-ui nftban-ui-auth nftban-installer; do
673+
for binary in nftband nftban-core nftban-installer; do
674674
pkg_binary="usr/lib/nftban/bin/$binary"
675675
if [[ -f "$pkg_binary" ]]; then
676676
pkg_hash=$(sha256sum "$pkg_binary" | cut -d' ' -f1)
@@ -704,7 +704,7 @@ jobs:
704704
ar x "$GITHUB_WORKSPACE/$deb"
705705
tar -xf data.tar.* 2>/dev/null || tar -xf data.tar.xz 2>/dev/null || tar -xf data.tar.gz 2>/dev/null || true
706706
707-
for binary in nftband nftban-core nftban-ui nftban-ui-auth nftban-installer; do
707+
for binary in nftband nftban-core nftban-installer; do
708708
pkg_binary="usr/lib/nftban/bin/$binary"
709709
if [[ -f "$pkg_binary" ]]; then
710710
pkg_hash=$(sha256sum "$pkg_binary" | cut -d' ' -f1)

‎.github/workflows/ci-go.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -103,16 +103,17 @@ jobs:
103103
run: |
104104
mkdir -p bin
105105
go build -trimpath -o bin/nftban-core ./cmd/nftban-core
106-
go build -trimpath -o bin/nftban-ui ./cmd/nftban-ui
107-
go build -trimpath -o bin/nftban-ui-auth ./cmd/nftban-ui-auth
106+
# nftban-ui + nftban-ui-auth: removed from shipped binary list per
107+
# v1.100.1b.A (GOTH PR-D4 stage 1 — stop shipping). Source trees
108+
# remain in repo and are still compiled by `go build ./...` above.
108109
go build -trimpath -o bin/nftband ./cmd/nftband
109110
go build -trimpath -o bin/nftban-validate ./cmd/nftban-validate
110111
111112
- name: Verify binaries
112113
run: |
113114
echo "=== Built binaries ==="
114115
ls -lh bin/
115-
for binary in nftban-core nftband nftban-ui nftban-ui-auth nftban-validate; do
116+
for binary in nftban-core nftband nftban-validate; do
116117
file bin/$binary
117118
TYPE=$(file -b bin/$binary)
118119
if [[ ! "$TYPE" =~ ELF ]]; then

‎.github/workflows/release.yml‎

Lines changed: 11 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -366,10 +366,11 @@ jobs:
366366
# Copy all DEB packages
367367
find all-packages -name "*.deb" -exec cp {} dist/packages/ \;
368368
369-
# Copy raw Go binaries that SLSA can't build (require CGO/PAM)
370-
# NOTE: nftban-core and nftban-ui are built by SLSA workflow with provenance
369+
# Copy raw Go binaries that SLSA can't build (require CGO)
370+
# NOTE: nftban-core is built by SLSA workflow with provenance.
371+
# nftban-ui + nftban-ui-auth removed in v1.100.1b.A (GOTH PR-D4 stage 1).
371372
if [ -d "all-packages" ]; then
372-
for binary in nftband nftban-ui-auth; do
373+
for binary in nftband; do
373374
if [ -f "all-packages/${binary}" ]; then
374375
cp "all-packages/${binary}" "dist/packages/${binary}-linux-amd64"
375376
chmod +x "dist/packages/${binary}-linux-amd64"
@@ -397,7 +398,6 @@ jobs:
397398
"nftban-debian12-amd64.deb"
398399
"nftban-debian13-amd64.deb"
399400
"nftband-linux-amd64"
400-
"nftban-ui-auth-linux-amd64"
401401
"SHA256SUMS"
402402
"SHA256SUMS.build"
403403
"MANIFEST.txt"
@@ -416,9 +416,7 @@ jobs:
416416
"${ASSETS_TO_REPLACE[@]}"
417417
"RELEASE_NOTES.md"
418418
"nftban-core-linux-amd64"
419-
"nftban-ui-linux-amd64"
420419
"nftban-core-linux-amd64.intoto.jsonl"
421-
"nftban-ui-linux-amd64.intoto.jsonl"
422420
)
423421
424422
CURRENT_ASSETS=$(gh release view "$VERSION" --json assets --jq '.assets[].name' 2>/dev/null || echo "")
@@ -440,7 +438,7 @@ jobs:
440438
# Generate checksums for all packages and binaries
441439
shopt -s nullglob
442440
packages=(*.rpm *.deb)
443-
binaries=(nftban-core-linux-amd64 nftband-linux-amd64 nftban-ui-linux-amd64 nftban-ui-auth-linux-amd64)
441+
binaries=(nftban-core-linux-amd64 nftband-linux-amd64)
444442
445443
# Combine all files that exist
446444
all_files=()
@@ -645,14 +643,14 @@ jobs:
645643
# - Include SHA256SUMS.build as ground truth reference
646644
# - verify-release job will: download with retry, verify checksums,
647645
# generate final SHA256SUMS, then publish the release
648-
# NOTE: nftban-core and nftban-ui are uploaded by SLSA workflow with provenance
646+
# NOTE: nftban-core is uploaded by SLSA workflow with provenance.
647+
# nftban-ui + nftban-ui-auth removed in v1.100.1b.A (GOTH PR-D4 stage 1).
649648
uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
650649
with:
651650
files: |
652651
dist/packages/*.rpm
653652
dist/packages/*.deb
654653
dist/packages/nftband-linux-amd64
655-
dist/packages/nftban-ui-auth-linux-amd64
656654
dist/packages/SHA256SUMS.build
657655
dist/packages/MANIFEST.txt
658656
dist/packages/VERIFY.txt
@@ -710,7 +708,6 @@ jobs:
710708
"nftban-ubuntu22.04-amd64.deb"
711709
"nftban-ubuntu24.04-amd64.deb"
712710
"nftband-linux-amd64"
713-
"nftban-ui-auth-linux-amd64"
714711
"SHA256SUMS.build"
715712
)
716713
@@ -748,13 +745,10 @@ jobs:
748745
echo ""
749746
echo "::error::Failed to download all assets after $MAX_ATTEMPTS attempts"
750747
echo "Missing assets: ${MISSING[*]}"
751-
# Allow missing optional assets (nftban-ui-auth may not exist)
752-
REQUIRED_MISSING=0
748+
# All listed assets are required after v1.100.1b.A (no optional UI binaries left).
749+
REQUIRED_MISSING="${#MISSING[@]}"
753750
for m in "${MISSING[@]}"; do
754-
case "$m" in
755-
nftban-ui-auth-linux-amd64) echo " WARN: $m is optional (SLSA-built)" ;;
756-
*) echo " FATAL: $m is required!"; REQUIRED_MISSING=$((REQUIRED_MISSING + 1)) ;;
757-
esac
751+
echo " FATAL: $m is required!"
758752
done
759753
if [ "$REQUIRED_MISSING" -gt 0 ]; then
760754
exit 1
@@ -768,7 +762,7 @@ jobs:
768762
769763
# Also try SLSA-built binaries (optional — uploaded by separate workflow)
770764
cd "$GITHUB_WORKSPACE"
771-
for slsa_asset in "nftban-core-linux-amd64" "nftban-ui-linux-amd64"; do
765+
for slsa_asset in "nftban-core-linux-amd64"; do
772766
gh release download "$VERSION" -p "$slsa_asset" -D /tmp/release-verify --clobber 2>/dev/null && \
773767
echo "Downloaded SLSA asset: $slsa_asset" || true
774768
done

‎.github/workflows/slsa-go-releaser.yml‎

Lines changed: 10 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,11 @@
1414
#
1515
# Builds:
1616
# - nftban-core (main CLI for firewall operations)
17-
# - nftban-ui (web GUI server)
1817
#
19-
# NOTE: nftban-ui-auth is excluded - requires PAM headers (libpam-dev) which
20-
# are not available in SLSA's hermetic build environment. It's built via
21-
# the regular release.yml workflow instead.
18+
# NOTE (v1.100.1b.A): nftban-ui + nftban-ui-auth removed from shipped
19+
# artifact set per GOTH PR-D4 stage 1. SLSA build coverage now scoped
20+
# to nftban-core only. Source trees for the UI surface remain in repo
21+
# but are not built or published.
2222
#
2323
# COORDINATION: This workflow runs AFTER Release Packages completes to avoid
2424
# race conditions when uploading assets to the same GitHub release.
@@ -91,30 +91,12 @@ jobs:
9191
upload-tag-name: ${{ needs.get-tag.outputs.tag }}
9292

9393
# ============================================================================
94-
# Job 2: Build nftban-ui with SLSA provenance
94+
# Job 2: Assemble all artifacts and upload to release
9595
# ============================================================================
96-
build-nftban-ui:
97-
name: Build nftban-ui (SLSA3)
98-
needs: get-tag
99-
permissions:
100-
id-token: write
101-
contents: write
102-
actions: read
103-
uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v2.1.0
104-
with:
105-
go-version: "1.25"
106-
config-file: .github/slsa/nftban-ui.yml
107-
evaluated-envs: "VERSION:${{ needs.get-tag.outputs.tag }}"
108-
# Upload provenance directly to release (fixes workflow_run trigger skip)
109-
upload-tag-name: ${{ needs.get-tag.outputs.tag }}
110-
111-
# ============================================================================
112-
# Job 3: Assemble all artifacts and upload to release
113-
# ============================================================================
114-
# NOTE: nftban-ui-auth excluded - requires PAM headers not available in SLSA
96+
# NOTE (v1.100.1b.A): nftban-ui + nftban-ui-auth removed — GOTH PR-D4 stage 1.
11597
assemble-release:
11698
name: Assemble Release Artifacts
117-
needs: [get-tag, build-nftban-core, build-nftban-ui]
99+
needs: [get-tag, build-nftban-core]
118100
runs-on: ubuntu-latest
119101
# Run for workflow_run (after Release Packages) but not for manual dispatch
120102
if: ${{ github.event_name == 'workflow_run' }}
@@ -134,17 +116,9 @@ jobs:
134116
name: ${{ needs.build-nftban-core.outputs.go-provenance-name }}
135117
path: dist/
136118

137-
- name: Download nftban-ui artifacts
138-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
139-
with:
140-
name: ${{ needs.build-nftban-ui.outputs.go-binary-name }}
141-
path: dist/
142-
143-
- name: Download nftban-ui provenance
144-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
145-
with:
146-
name: ${{ needs.build-nftban-ui.outputs.go-provenance-name }}
147-
path: dist/
119+
# nftban-ui artifact + provenance downloads removed in v1.100.1b.A
120+
# (GOTH PR-D4 stage 1 — stop shipping). nftban-ui no longer built
121+
# by SLSA pipeline.
148122

149123
- name: List artifacts
150124
run: ls -la dist/

‎CHANGELOG.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,41 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
1111
1212
---
1313

14+
## [Unreleased] - v1.100.1b.A GOTH PR-D4 stage 1 (stop shipping nftban-ui + nftban-ui-auth)
15+
16+
### Changed (operator-impacting)
17+
18+
- **`nftban-ui` (Web GUI server) and `nftban-ui-auth` (PAM auth daemon) are no longer shipped.** New releases under v1.100.1b.A and later do not include these binaries, their systemd units, or their SLSA provenance artifacts.
19+
- **Existing installs receive automatic cleanup on upgrade.** Transitional postinst/prerm hooks (DEB) and `%pre` scriptlet (RPM) stop, disable, mask, and remove any prior `nftban-ui.service`, `nftban-ui-auth.service`, `nftban-ui-auth.socket` units, plus the `/usr/sbin/nftban-ui` and `/usr/libexec/nftban-ui-auth` binaries and `/run/nftban-ui` runtime directory.
20+
- **PAM development headers are no longer a build requirement** for the standard `nftban` package (only `nftban-ui-auth` consumed PAM, and it is no longer built).
21+
22+
### Removed from build / packaging / release pipeline
23+
24+
- `.github/workflows/ci-go.yml`: nftban-ui + nftban-ui-auth build/verify entries removed.
25+
- `.github/workflows/build-packages.yml`: nftban-ui + nftban-ui-auth removed from binary inventory loops.
26+
- `.github/workflows/slsa-go-releaser.yml`: `build-nftban-ui` job removed; assemble-release no longer downloads nftban-ui artifacts.
27+
- `.github/slsa/nftban-ui.yml` and `.github/slsa/nftban-ui-auth.yml`: deleted.
28+
- `.github/workflows/release.yml`: nftban-ui + nftban-ui-auth removed from binary copy step, asset-replacement list, expected-package list, expected-asset list, SHA256SUMS.build binary list, draft-release upload list, and SLSA download retry loop.
29+
- `build.sh`: `build_gui`, `build_ui_auth`, `generate_templ` functions removed; `gui` and `ui-auth` subcommands now error with explanation; PAM headers prerequisite check removed; `nftban-ui` and `nftban-ui-auth` removed from `go mod tidy` loop.
30+
- `packaging/build_nftban.sh`: RPM `%install` no longer installs the binaries or systemd unit files; RPM `%files` no longer references them; DEB build helper drops the equivalent installs. RPM `%pre` and DEB prerm now also disable + mask + remove orphaned unit files transitionally.
31+
- `packaging/deb/postinst`: `/usr/sbin/nftban-ui` removed from chown/chmod loop.
32+
- `packaging/deb/prerm`: extended transitional cleanup (disable + mask + remove unit files + delete orphaned binaries).
33+
- `install/download-binaries.sh`: nftban-ui + nftban-ui-auth removed from fetch, install, verify, and SLSA-provenance check loops.
34+
- `install/verify_installation.sh`: optional checks for `/usr/sbin/nftban-ui`, `nftban-ui.service`, `nftban-ui-auth.socket` removed.
35+
36+
### Notes
37+
38+
- Source trees under `cmd/nftban-ui/`, `cmd/nftban-ui-auth/`, `internal/ui/`, `internal/auth/`, `internal/session/`, `internal/authproto/` are **intentionally retained** in the repo at this stage. They will be removed in a separate later release (v1.100.1b.B). They still compile via `go build ./...` and their unit tests still run, but the binaries are no longer published.
39+
- Cross-cutting shell + Go references to the UI surface (87 in `cli/lib/`, 13 in `internal/installer/`, 14 in `internal/nftbanconf/`, 6 in `internal/api/`) are **also intentionally retained** at this stage. They will be cleaned up in v1.100.1b.C.
40+
- Documentation references (`docs/ARCHITECTURE.md`, `CONTRIBUTING.md`, `docs/REPRODUCIBLE_BUILDS.md`, `SECURITY.md`, `docs/systemd/UNITS.md`, `docs/systemd/TIMERS.md`) are not edited in this release; deferred to v1.100.1b.D.
41+
- Lifecycle completion work (PR-25 restore execution, PR-26 verification gate, PR-27-30 maintenance) remains explicitly **open** and is not affected by this release.
42+
43+
### Why a transitional approach
44+
45+
A hard removal would orphan running services on prior-version hosts (operators with active `nftban-ui.service` would get it left behind after upgrade). The transitional approach disables, masks, and removes the unit files via the package's own upgrade hooks, so the post-upgrade state is clean even though the new package no longer carries those artifacts.
46+
47+
---
48+
1449
## [Unreleased] - v1.100.1a CLI jail surgical rename
1550

1651
### Changed

0 commit comments

Comments
 (0)