Merge 1b9f483a08 into 8b92b80b4a

.github/workflows/release.yml

@@ -123,43 +123,7 @@ jobs:
       - name: Install deps
         run: |
           apt-get update
-          apt-get install -y \
-            musl-tools \
-            pkg-config \
-            curl
-  
-      - uses: actions/cache@v4
-        if: matrix.target == 'aarch64-unknown-linux-musl'
-        with:
-          path: ~/.musl-aarch64
-          key: musl-toolchain-aarch64-v1
-  
-      - name: Install aarch64 musl toolchain
-        if: matrix.target == 'aarch64-unknown-linux-musl'
-        run: |
-          set -e
-  
-          TOOLCHAIN_DIR="$HOME/.musl-aarch64"
-          ARCHIVE="aarch64-linux-musl-cross.tgz"
-          URL="https://github.com/telemt/telemt/releases/download/toolchains/$ARCHIVE"
-  
-          if [ -x "$TOOLCHAIN_DIR/bin/aarch64-linux-musl-gcc" ]; then
-            echo "✅ MUSL toolchain cached"
-          else
-            echo "⬇️ Downloading MUSL toolchain..."
-  
-            curl -fL \
-              --retry 5 \
-              --retry-delay 3 \
-              --connect-timeout 10 \
-              --max-time 120 \
-              -o "$ARCHIVE" "$URL"
-  
-            mkdir -p "$TOOLCHAIN_DIR"
-            tar -xzf "$ARCHIVE" --strip-components=1 -C "$TOOLCHAIN_DIR"
-          fi
-  
-          echo "$TOOLCHAIN_DIR/bin" >> $GITHUB_PATH
+          apt-get install -y musl-tools pkg-config curl
 
       - name: Add rust target
         run: rustup target add ${{ matrix.target }}
@@ -176,11 +140,9 @@ jobs:
         run: |
           if [ "${{ matrix.target }}" = "aarch64-unknown-linux-musl" ]; then
             export CC=aarch64-linux-musl-gcc
-            export CC_aarch64_unknown_linux_musl=aarch64-linux-musl-gcc
             export RUSTFLAGS="-C target-feature=+crt-static -C linker=aarch64-linux-musl-gcc"
           else
             export CC=musl-gcc
-            export CC_x86_64_unknown_linux_musl=musl-gcc
             export RUSTFLAGS="-C target-feature=+crt-static"
           fi
 
@@ -232,12 +194,12 @@ jobs:
           prerelease: ${{ contains(github.ref, '-') }}
 
 # ==========================
-# Docker
+# Docker (FROM RELEASE)
 # ==========================
   docker:
-    name: Docker
+    name: Docker (from release)
     runs-on: ubuntu-latest
-    needs: [build-gnu, build-musl]
+    needs: release
 
     permissions:
       contents: read
@@ -246,19 +208,26 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/download-artifact@v4
-        with:
-          path: dist
+      - name: Install gh
+        run: apt-get update && apt-get install -y gh
 
-      - name: Extract binaries
+      - name: Extract version
+        id: vars
+        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
+
+      - name: Download binary
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          mkdir bin
+          mkdir dist
 
-          tar -xzf dist/telemt-x86_64-linux-musl/telemt-x86_64-linux-musl.tar.gz -C bin
-          mv bin/telemt bin/telemt-amd64
+          gh release download ${{ steps.vars.outputs.VERSION }} \
+            --repo ${{ github.repository }} \
+            --pattern "telemt-x86_64-linux-musl.tar.gz" \
+            --dir dist
 
-          tar -xzf dist/telemt-aarch64-linux-musl/telemt-aarch64-linux-musl.tar.gz -C bin
-          mv bin/telemt bin/telemt-arm64
+          tar -xzf dist/telemt-x86_64-linux-musl.tar.gz -C dist
+          chmod +x dist/telemt
 
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
@@ -269,11 +238,7 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Extract version
-        id: vars
-        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
-  
-      - name: Build & Push (multi-arch)
+      - name: Build & Push
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -283,5 +248,4 @@ jobs:
             ghcr.io/${{ github.repository }}:${{ steps.vars.outputs.VERSION }}
             ghcr.io/${{ github.repository }}:latest
           build-args: |
-            BINARY_AMD64=bin/telemt-amd64
-            BINARY_ARM64=bin/telemt-arm64
+            BINARY=dist/telemt

Cargo.toml

@@ -83,6 +83,4 @@ name = "crypto_bench"
 harness = false
 
 [profile.release]
-lto = "fat"
-codegen-units = 1
-
+lto = "thin"

Dockerfile

@@ -1,78 +1,47 @@
 # syntax=docker/dockerfile:1
 
-ARG TARGETARCH
-ARG BINARY_AMD64
-ARG BINARY_ARM64
+ARG BINARY
 
 # ==========================
-# Minimal Image
+# Stage: minimal
 # ==========================
 FROM debian:12-slim AS minimal
 
-ARG TARGETARCH
-ARG BINARY_AMD64
-ARG BINARY_ARM64
-
-RUN set -eux; \
-    apt-get update; \
-    apt-get install -y --no-install-recommends \
-        binutils \
-        curl \
-        xz-utils \
-        ca-certificates; \
-    rm -rf /var/lib/apt/lists/*
-
-# --- Select correct binary ---
-RUN set -eux; \
-    case "${TARGETARCH}" in \
-        amd64) BIN="${BINARY_AMD64}" ;; \
-        arm64) BIN="${BINARY_ARM64}" ;; \
-        *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
-    esac; \
-    echo "Using binary: $BIN"; \
-    test -f "$BIN"; \
-    cp "$BIN" /telemt
-
-# --- Install UPX (arch-aware) ---
-RUN set -eux; \
-    case "${TARGETARCH}" in \
-        amd64) UPX_ARCH="amd64" ;; \
-        arm64) UPX_ARCH="arm64" ;; \
-        *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
-    esac; \
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    binutils \
+    curl \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
     \
-    curl -fL \
+    && curl -fL \
         --retry 5 \
         --retry-delay 3 \
         --connect-timeout 10 \
         --max-time 120 \
         -o /tmp/upx.tar.xz \
-        "https://github.com/telemt/telemt/releases/download/toolchains/upx-${UPX_ARCH}_linux.tar.xz"; \
-    \
-    tar -xf /tmp/upx.tar.xz -C /tmp; \
-    install -m 0755 /tmp/upx*/upx /usr/local/bin/upx; \
-    rm -rf /tmp/upx*
+        https://github.com/telemt/telemt/releases/download/toolchains/upx-amd64_linux.tar.xz \
+    && tar -xf /tmp/upx.tar.xz -C /tmp \
+    && mv /tmp/upx*/upx /usr/local/bin/upx \
+    && chmod +x /usr/local/bin/upx \
+    && rm -rf /tmp/upx*
 
-# --- Optimize binary ---
-RUN set -eux; \
-    test -f /telemt; \
-    strip --strip-unneeded /telemt || true; \
-    upx --best --lzma /telemt || true
+COPY ${BINARY} /telemt
+
+RUN strip /telemt || true
+RUN upx --best --lzma /telemt || true
 
 # ==========================
-# Debug Image
+# Debug image
 # ==========================
 FROM debian:12-slim AS debug
 
-RUN set -eux; \
-    apt-get update; \
-    apt-get install -y --no-install-recommends \
-        ca-certificates \
-        tzdata \
-        curl \
-        iproute2 \
-        busybox; \
-    rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    tzdata \
+    curl \
+    iproute2 \
+    busybox \
+    && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
@@ -85,7 +54,7 @@ ENTRYPOINT ["/app/telemt"]
 CMD ["config.toml"]
 
 # ==========================
-# Production Distroless on MUSL
+# Production (REAL distroless)
 # ==========================
 FROM gcr.io/distroless/static-debian12 AS prod