Harden source builds on low-resource hosts

[wiresock]

Summary

• add a shared resource-aware Cargo build helper for amneziawg-web and amneziawg-proxy
• select executable build storage with disk and inode checks, cgroup-aware memory detection, and one-job fallback on constrained hosts
• preserve Cargo target and linker overrides while locating binaries from external target directories
• align standalone bootstrap behavior and document the supported build-root override
• add focused helper, installer, proxy, and CI coverage

Verification

• helper tests: 15/15
• installer tests: 411/411
• Ubuntu PPA tests: 140/140
• proxy tests: 196/196
• ShellCheck and Bash syntax checks
• real four-CPU WSL cgroup with 1 GiB memory and no swap
• full Ubuntu 24.04 Docker installer integration

Closes #102

[Copilot]

Pull request overview

Adds shared, resource-aware Cargo build handling for web and proxy source installations on constrained hosts.

Changes:

• Adds disk, inode, execution, CPU, memory, and cgroup-aware build preparation.
• Supports external Cargo targets and configurable build roots.
• Expands installer, bootstrap, CI, and documentation coverage.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/amneziawg-cargo-build.sh	Adds shared Cargo build helper.
tests/test-cargo-build-common.sh	Tests helper policies and cleanup.
tests/test-install-mock.sh	Tests web external targets and bootstrap overrides.
tests/test-proxy-scripts.sh	Tests proxy external-target binary resolution.
amneziawg-web/scripts/amneziawg-web-install.sh	Integrates helper into installation.
amneziawg-web/scripts/amneziawg-web-upgrade.sh	Integrates helper into upgrades.
amneziawg-web.sh	Honors explicit bootstrap build roots.
amneziawg-web/docs/INSTALL.md	Documents source-build requirements.
amneziawg-proxy/scripts/amneziawg-proxy-install.sh	Integrates helper into installation.
amneziawg-proxy/scripts/amneziawg-proxy-upgrade.sh	Integrates helper into upgrades.
amneziawg-proxy.sh	Adds resource-aware bootstrap selection.
amneziawg-proxy/doc/USAGE.md	Documents proxy build requirements.
README.md	Documents shared build policy and overrides.
docs/IMPLEMENTATION_PLAN_102_103.md	Records implementation and acceptance plans.
.github/workflows/test.yml	Runs helper tests and syntax checks.
.github/workflows/lint.yml	Expands Bash and ShellCheck coverage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

Suppressed comments (1)

scripts/amneziawg-cargo-build.sh:684

• CARGO_BUILD_TARGET can be a path to a custom JSON target. Cargo places that build under the target file's stem, but this appends the raw path. For example, /targets/device.json makes this look for .../target//targets/device.json/release/app although Cargo wrote .../target/device/release/app, so a successful build is reported as missing. Normalize JSON targets to their basename without .json.

    if [[ -n "${CARGO_BUILD_TARGET:-}" ]]; then
        release_dir+="/${CARGO_BUILD_TARGET}"
    fi

[wiresock]

Addressed the suppressed Copilot finding from review 4964173341 in a448e67. awg_cargo_release_binary now normalizes custom JSON CARGO_BUILD_TARGET paths to the target filename stem while preserving ordinary target triples. Tests cover absolute and relative JSON paths. This matches the Cargo build-cache layout documented at https://doc.rust-lang.org/cargo/reference/build-cache.html. Suppressed findings do not create review threads, so there was no separate thread to resolve.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

Suppressed comments (1)

amneziawg-proxy.sh:31

• The launcher now intentionally honors TMPDIR/AMNEZIAWG_BUILD_ROOT to choose the bootstrap location (and propagates TMPDIR to the inner scripts), but the header comment still says “env overrides are never honored”. This is now inaccurate and can mislead operators/security reviewers; please update the comment to reflect which overrides are actually honored and in what scope.

SCRIPT_DIR="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
SCRIPTS_DIR="${SCRIPT_DIR}/amneziawg-proxy/scripts"
BOOTSTRAP_DIR=""
BOOTSTRAP_TMPDIR=""

[wiresock]

Addressed the suppressed Copilot finding from review 4969850460 in d7a61d0. The proxy launcher header now documents that repository source settings remain fixed while TMPDIR and AMNEZIAWG_BUILD_ROOT are honored only for temporary bootstrap/Cargo build placement. Focused WSL validation passed: bash -n, ShellCheck, and 6/6 proxy bootstrap tests. GitHub does not create a review thread for suppressed comments, so there is no thread to resolve.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.