PURE LINUX

Author: spectral-mesh

.github/workflows/ci.yml

@@ -49,14 +49,6 @@ jobs:
           TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
           CGO_ENABLED=1 go build -ldflags "-X main.Version=ci -X main.GitCommit=${COMMIT} -X main.BuildTime=${TS}" -o spectral-mesh .
 
-      - name: cross-compile spectral-mesh (Windows, macOS, no CGO)
-        run: |
-          COMMIT=$(echo "${GITHUB_SHA}" | cut -c1-7)
-          TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-          LDFLAGS="-X main.Version=ci -X main.GitCommit=${COMMIT} -X main.BuildTime=${TS}"
-          GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -ldflags "${LDFLAGS}" -o /dev/null .
-          GOOS=darwin GOARCH=arm64 CGO_ENABLED=0 go build -ldflags "${LDFLAGS}" -o /dev/null .
-
       - name: go build spectral-edge (no CGO)
         run: |
           COMMIT=$(echo "${GITHUB_SHA}" | cut -c1-7)
@@ -98,14 +90,6 @@ jobs:
           TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
           CGO_ENABLED=1 go build -ldflags "-X main.Version=ci -X main.GitCommit=${COMMIT} -X main.BuildTime=${TS}" -o spectral-mesh .
 
-      - name: cross-compile spectral-mesh (Windows, macOS, no CGO)
-        run: |
-          COMMIT=$(echo "${GITHUB_SHA}" | cut -c1-7)
-          TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-          LDFLAGS="-X main.Version=ci -X main.GitCommit=${COMMIT} -X main.BuildTime=${TS}"
-          GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -ldflags "${LDFLAGS}" -o /dev/null .
-          GOOS=darwin GOARCH=arm64 CGO_ENABLED=0 go build -ldflags "${LDFLAGS}" -o /dev/null .
-
       - name: go build spectral-edge (no CGO)
         run: |
           COMMIT=$(echo "${GITHUB_SHA}" | cut -c1-7)

.gitignore

@@ -4,5 +4,4 @@
 *.tfstate.*
 /spectral-edge
 /spectral-mesh
-hook/darwin/*.dylib
 docs/.pdf-venv/

CHANGELOG.md

@@ -2,14 +2,12 @@
 
 ## Unreleased
 
+- **spectral-mesh (Linux only):** Removed Windows and macOS sensor entrypoints, **`hook/darwin`** / **`hook/windows`**, **`internal/capture/winssl`**, **`internal/capture/esmmap`**, **`internal/capture/platformhint`**, **`cmd/spectral-ssl-wrap`**, **`packaging/macos`**, and **`metrics_other.go`**. **`cli.go`** now holds all mesh flags (including **`-k8s-enrich`**). CI and **`make ci`** no longer cross-compile the root package for **`GOOS=windows`** / **`darwin`**. Optional cleartext bridges (**`-capture-ingest-addr`**, stdin JSONL, hook socket) remain on Linux for tests and auxiliary feeds.
 - **Repository layout:** **Helm** charts (`helm/spectral-mesh`, `helm/spectral-edge`), **cloud Terraform** (`deploy/aws`, `deploy/gcp`, `deploy/azure`), **OpenShift** manifests (`openshift/`), and Kubernetes-focused docs (**`DEPLOY_*`**, **`ENTERPRISE_SELF_HOSTED`**, **`K8S_ALERT_ENRICHMENT`**, **`MESH_RUNBOOK`**) moved to the companion repository **[Spectral-Cloud](https://github.com/spectral-mesh/Spectral-Cloud)**. This repository remains the **Spectral Mesh** application and BPF source; cross-links in **`README.md`** and **`docs/`** point at **Spectral-Cloud** for installs.
 - **Observability:** New scripts **`scripts/simulate_mesh_ingest.sh`**, **`simulate_mesh_grafana.sh`**, **`simulate_capture_demo.sh`**, **`simulate_edge_scan.sh`**; fix **`simulate_mesh_ingest.sh`** under **`set -u`** when **`INGEST_TOKEN`** is unset (avoid empty **`extra[@]`** expansion). Grafana dashboards **`monitoring/grafana/dashboards/spectral-mesh.json`** (cleartext/ingest wording + metric semantics row) and **`spectral-edge.json`** (**Job**/**Instance** variables, **HTTP 429** rate on throughput panel, simulation note). **`monitoring/README.md`** documents the script matrix.
 - **Docs:** Refresh **Windows/macOS** descriptions across **`README.md`**, **`docs/EDGE_VS_MESH.md`**, **`docs/EDGE.md`**, **`docs/POLICY_MESH_AND_EDGE.md`**, **Spectral-Cloud `docs/ENTERPRISE_SELF_HOSTED.md`**, **`docs/SAAS_ARCHITECTURE.md`**, **`docs/INFOSEC_SUMMARY.md`**, **`docs/BACKGROUND_OF_INVENTION.md`**, and **`docs/INVENTION_DISCLOSURE_OUTLINE_US.md`** to match **ingest**, **hookwire**, optional **hooks**, and **edge** vs host rolling-buffer behavior (replacing outdated “capture stub” wording).
-- **Windows OpenSSL discovery:** **`-windows-openssl-discovery-interval`** polls module lists via Toolhelp32 and logs **`windows_openssl_module_mapped`** (`internal/capture/winssl`).
-- **macOS Endpoint Security (opt-in build):** **`-darwin-es-mmap-watch`** with **`go build -tags spectral_es`** (CGO) subscribes to **`ES_EVENT_TYPE_NOTIFY_MMAP`** and logs **`es_openssl_mmap`** when mapped paths look like OpenSSL (`internal/capture/esmmap`, **`internal/capture/platformhint`**). Default macOS binaries omit ES linkage; use an SDK-equipped toolchain to link **EndpointSecurity.framework**.
-- **OpenSSL TLS hook path:** **`-capture-hook-socket unix:…` or `tcp:…`** accepts a binary **`hookwire`** frame stream into **`HandleChunk`**. **macOS:** `hook/darwin/spectral_ssl_hook.dylib` (**`make hook-darwin`**) interposes **`SSL_write`**; **`cmd/spectral-ssl-wrap`** sets **`DYLD_INSERT_LIBRARIES`** and execs a child. **Windows:** **`hook/windows/CMakeLists.txt`** builds **`spectral_openssl_hook.dll`** (MinHook via **FetchContent**) + **`spectral_inject.exe`** (`LoadLibraryW` injection); shared TCP sender in **`hook_send_tcp.c`**. **Packaging:** **`packaging/macos/entitlements/EndpointSecurityClient.plist`** and **`packaging/macos/SYSTEM_EXTENSION_SIGNING.md`** for ES / System Extension signing.
-- **Capture ingest bridge:** **`-capture-ingest-addr`** (localhost HTTP **`POST /v1/ingest/chunk`**) and **`-capture-stdin-jsonl`** feed **`sensorcore.HandleChunkWithMeta`** on **Linux, Windows, and macOS**; optional **`subject_*`** identity fields in JSON. **`cmd/spectral-capture-demo`** posts split chunks for cross-platform **`policy_alert`** demos without kernel hooks.
-- **Multi-platform `spectral-mesh` source:** **`main_linux.go`**, **`main_windows.go`**, **`main_darwin.go`** with shared **`internal/sensorcore`** (`Processor.HandleChunk`, alert limiter). **Linux** retains full eBPF + uprobes; **Windows/macOS** share the same policy path with **pluggable** cleartext feeds (ingest, stdin JSONL, hook socket, native hooks); kernel enforcement remains **Linux-only** until separate platform integration. **`cli.go`**, **`metrics_other.go`**, **`spectral_bpf_generate.go`**; **`internal/rollbuf`** gains OS-specific PID listing for prune. **CI** / **`make ci`**: cross-compile **windows/amd64** and **darwin/arm64** with **`CGO_ENABLED=0`**. **`policy_alert`** adds **`enforcement_mode`**.
+- **Capture ingest bridge:** **`-capture-ingest-addr`** (localhost HTTP **`POST /v1/ingest/chunk`**) and **`-capture-stdin-jsonl`** feed **`sensorcore.HandleChunkWithMeta`** on **Linux**; optional **`subject_*`** identity fields in JSON. **`cmd/spectral-capture-demo`** posts split chunks for **`policy_alert`** demos without kernel hooks.
+- **OpenSSL TLS hook socket:** **`-capture-hook-socket unix:…` or `tcp:…`** accepts a binary **`hookwire`** frame stream into **`HandleChunk`** (see **`internal/capture/hookwire`**).
 - **Enterprise self-hosted:** Spectral-Cloud [`docs/ENTERPRISE_SELF_HOSTED.md`](https://github.com/spectral-mesh/Spectral-Cloud/blob/main/docs/ENTERPRISE_SELF_HOSTED.md), [`docs/INFOSEC_SUMMARY.md`](docs/INFOSEC_SUMMARY.md), Spectral-Cloud [`docs/MESH_RUNBOOK.md`](https://github.com/spectral-mesh/Spectral-Cloud/blob/main/docs/MESH_RUNBOOK.md); Helm **[`README.md`](https://github.com/spectral-mesh/Spectral-Cloud/blob/main/helm/spectral-mesh/README.md)** / **[`README.md`](https://github.com/spectral-mesh/Spectral-Cloud/blob/main/helm/spectral-edge/README.md)** and **[`values-enterprise.yaml`](https://github.com/spectral-mesh/Spectral-Cloud/blob/main/helm/spectral-edge/values-enterprise.yaml)**; root **[`SECURITY.md`](SECURITY.md)**; **`spectral-edge` GitHub Releases** ship a **CycloneDX** Go dependency SBOM (`spectral-edge-<tag>-sbom.cdx.json`). Chart **`version`** / **`appVersion`** bumped to **0.2.0**; **`spectral-edge`** default **PodDisruptionBudget** enabled.
 - **Network edge:** `cmd/spectral-edge` — HTTP server that scans request bodies with the same policy as the host sensor; **`POST /v1/scan`**, optional **`-upstream`** reverse proxy, **`policy_alert`** with **`sensor_kind: edge`**. Shared **`internal/policyengine`** (refactor from in-tree policy state). See **`docs/EDGE.md`**. **`make edge`** / CI builds with **`CGO_ENABLED=0`**.
 - Build metadata: **`-version`**, **`GET /version`**, **`sensor_active`** fields (`version`, `git_commit`, `build_time` via Makefile `LDFLAGS`).

Makefile

@@ -5,20 +5,16 @@ BUILD_TIME ?= $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
 VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 LDFLAGS := -X main.Version=$(VERSION) -X main.GitCommit=$(GIT_COMMIT) -X main.BuildTime=$(BUILD_TIME)
 
-# bpf2go passes $BPF2GO_CFLAGS to clang. On Linux, libbpf headers are usually in /usr/include (e.g. apt install libbpf-dev).
-# macOS: Homebrew’s libbpf formula is Linux-only — use `make generate-docker` or run generate on a Linux machine/VM.
+# bpf2go passes $BPF2GO_CFLAGS to clang. libbpf headers are usually in /usr/include (e.g. apt install libbpf-dev).
+# Use `make generate-docker` if your host lacks a Linux-capable clang/libbpf for bpf2go.
 
 # Override if your libbpf headers live elsewhere (e.g. custom prefix).
 BPF2GO_CFLAGS ?=
 
 # Ubuntu 24.04: clang 18 + libbpf-dev (bookworm’s clang 14 breaks BPF_UPROBE here). GOTOOLCHAIN=auto pulls Go from go.mod.
 GO_GEN_IMAGE ?= ubuntu:24.04
 
-.PHONY: all generate generate-docker build edge edge-docker hook-darwin test bench ci clean
-
-# macOS OpenSSL interpose dylib (see README, hook/darwin/).
-hook-darwin:
-	./scripts/build_darwin_ssl_hook.sh
+.PHONY: all generate generate-docker build edge edge-docker test bench ci clean
 
 all: generate build
 
@@ -65,11 +61,8 @@ ci:
 	go test ./... -short -count=1
 	BPF2GO_CFLAGS="$(BPF2GO_CFLAGS)" go generate ./...
 	CGO_ENABLED=1 go build -ldflags "$(LDFLAGS)" -o /dev/null .
-	GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -ldflags "$(LDFLAGS)" -o /dev/null .
-	GOOS=darwin GOARCH=arm64 CGO_ENABLED=0 go build -ldflags "$(LDFLAGS)" -o /dev/null .
 	CGO_ENABLED=0 go build -ldflags "$(LDFLAGS)" -o /dev/null ./cmd/spectral-edge
 	CGO_ENABLED=0 go build -ldflags "$(LDFLAGS)" -o /dev/null ./cmd/spectral-capture-demo
-	CGO_ENABLED=0 go build -ldflags "$(LDFLAGS)" -o /dev/null ./cmd/spectral-ssl-wrap
 
 clean:
 	rm -f $(TARGET) spectral-edge spectral_x86_bpfel.go spectral_x86_bpfel.o spectral_arm64_bpfel.go spectral_arm64_bpfel.o