Two days. No sleep. GitHub Actions. In that order, causally.
🎧 Recommended listening while reading this:
What's Happening 2 BATTLE (full tape)It is a battle tape. This was a battle. The tape won. So did we, eventually,
at roughly 04:00, with the enemy being a YAML file.
There is no new radio code in this release. Not one line. The spectrum is
the spectrum, the waterfall is the waterfall, RDS still decodes, the FM
discriminator is still hand written and still correct.
What changed is everything about how sdrtop gets to you, and I would like to
tell you about it, because I have not slept in 48 hours and the alternative is
lying down and thinking about librtlsdr sonames. ❤️
📦 cargo install sdrtop
That is it. That is the headline.
cargo install sdrtop --lockedAny architecture. Any distribution. It compiles on your machine and links what
your machine actually has, which sidesteps roughly ninety percent of the
problems described below by simply refusing to participate in them.
You still need libhackrf and librtlsdr first. You always will. Both, even if
you own one radio. I am sorry. It is a linker thing.
🔥 What we deleted, and why you should be glad
Previously, shipping sdrtop involved a .deb matrix. Three architectures.
Including armhf. Which was built under QEMU emulation, slowly, so that a
package could be produced for a machine that does not exist in this flat, and
then tested on that same emulated non-existent machine, even more slowly, to
confirm that the package nobody needed worked on the hardware nobody had.
At one point there was a conversation about producing a .dmg.
For a terminal application.
On Linux.
All of that is gone. In its place: one crate on crates.io, one tarball, one
installer, and a fourth thing called "reading the documentation", which remains
optional as always.
🕵️ The bug that had been lying to everyone for months
install.sh verified the checksum of every download. It printed nothing when it
did, which was fine, because it worked.
Except the check lived inside an if whose every single branch continued.
If the SHA256SUMS download hiccuped, or your machine simply had no
sha256sum, the installer skipped verification entirely, said absolutely
nothing about it, and installed the binary anyway.
It looked like a check. It read like a check in review. It was a decoration.
It now stops. Loudly. --no-verify exists for people who have a reason and know
that they have one.
🐳 The container that refused to be rebuilt
The release image was rebuilt only if it did not already exist.
So: edit the Containerfile, run the build on a machine that already had an
image, and receive a tarball built by the previous recipe, with nothing on
screen indicating that anything had been ignored. CI never noticed, because a
fresh runner has no image to skip.
This is the kind of bug that does not bite you. It bites the person who trusts
you six months later.
🔬 The genuinely nerdy part
For anyone who cares about supply chains, and you should:
The tarball is reproducible. Build the same commit twice, get the same
bytes. Archive and binary. Verified by actually doing it, with the build cache
deleted in between so the second run really recompiled:
archive c73147...64a0 c73147...64a0 identical
binary ab969b...9fad ab969b...9fad identical
That required pinning the base image by digest rather than by tag, pinning
the compiler to an exact version, taking SOURCE_DATE_EPOCH from the commit
date, and beating five separate sources of entropy out of tar and gzip. The
one that gets everybody is the gzip header, which quietly stamps itself with the
current time. gzip -n. You are welcome.
Every artefact is signed. Sigstore provenance, bound to this repository and
this workflow, with no key for me to lose:
gh attestation verify sdrtop-0.4.2-x86_64-unknown-linux-gnu.tar.gz --repo mustang6139/sdrtopA checksum tells you the download arrived intact. It tells you nothing about
where it came from, because it is served from the same place by the same person
who could have replaced both. This is the other half.
The binary knows which build it is. sdrtop --version now prints
0.4.2 (a1b2c3d), resolved from three sources in order of authority: an
environment variable set by the release build, then git, then the
.cargo_vcs_info.json that cargo buries inside every published crate. A
-dirty suffix means somebody built it from an edited tree and you should ask
them about that.
The release workflow now also asserts the exact set of shared libraries the
binary asks for, rather than printing them into a log that nobody reads. If a
dependency ever quietly drags in a new .so, the release fails instead of
succeeding and then failing on somebody's laptop.
🗡️ The Debian versus Ubuntu thing, for the record
Debian ships the rtl-sdr runtime as librtlsdr0.
Ubuntu packages the identical upstream source as librtlsdr2, soname
.so.2.
Kali and Raspberry Pi OS follow Debian. Mint follows Ubuntu. Nobody is wrong.
Everybody is incompatible. One prebuilt binary cannot serve both, and no amount
of clever detection changes that.
So install.sh does not detect. It runs the binary. If it starts, use it.
If it does not, compile. That single decision is why one script covers every
architecture including a Raspberry Pi, and it is the only part of this project I
am smug about.
📋 Also in this release
install.sh --gitbuildsmain, for the reckless- The prebuilt tarball is named after the full Rust target triple now, because
x86_64-linuxdoes not say which libc and that is precisely the axis that
keeps hurting us - The installer no longer writes udev rules or edits your groups. Your
distribution's packages already ship those, and two sets of rules that agree
only by coincidence is worse than one - Release notes are written by a human and read out of
CHANGELOG.mdby the
pipeline, instead of being a list of commit subjects pretending to be prose - There is now a
RELEASING.md. It has a Bestiary of Disasters in it. I regret
nothing
🙃 One last thing
docs.rs, asked to document this crate, replied:
sdrtop-0.4.1 is not a library.
Correct. Devastating. No further questions.
Still early development, the known issues list has not got any shorter, and if
something looks broken it is either a bug or an undocumented feature. Flip a
coin, then open an issue. I will read it after I have slept.
73 de sdrtop. 📻
Full Changelog: v0.4.1...v0.4.2