demo code change and introduce compile.sh -docker option

Author: Daniel-Nashed

README.md

@@ -468,28 +468,32 @@ Produces `libsrvguard.a` for static linking into any native application.
 
 ## Building srvguard
 
-### Development binary
+Use `compile.sh` — output always lands in `bin/`.
 
-```bash
-go build -o srvguard .
-```
-
-### Production static binary
+### Native (requires Go)
 
 ```bash
-CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o srvguard .
+./compile.sh              # current platform → bin/srvguard
+./compile.sh -amd64       # → bin/srvguard-linux-amd64
+./compile.sh -arm64       # → bin/srvguard-linux-arm64
+./compile.sh -all         # both amd64 + arm64
 ```
 
-### Container — test image (Wolfi runtime)
+### Without Go — build inside a container
 
 ```bash
-docker build --target test -t srvguard:test .
+./compile.sh -docker      # uses golang:alpine, no local Go required
 ```
 
-### Container — release image (Chainguard static)
+Output is written to `bin/srvguard` on the host via a volume mount.
+Override the image with `GO_IMAGE=golang:1.22-alpine ./compile.sh -docker`.
+
+### Container image (Docker)
 
 ```bash
-docker build --target release -t srvguard:latest .
+./build.sh                # release image, local platform → docker load
+./build.sh -docker test   # test image
+REGISTRY=myregistry.example.com/srvguard ./build.sh push   # multi-arch push
 ```
 
 ## Vault Secret Format

bin/README.md

@@ -3,3 +3,4 @@
 Local build output directory.
 
 Run `../compile.sh` to build the `srvguard` binary here.
+Run `../compile.sh -docker` if Go is not installed locally.

compile.sh

@@ -1,9 +1,12 @@
-#!/bin/bash
+#!/bin/sh
 # compile.sh — build srvguard binary
 #
 # Usage:
-#   ./compile.sh           — build for current platform
-#   ./compile.sh all       — build for all supported platforms (amd64, arm64)
+#   ./compile.sh              — build for current platform (requires Go)
+#   ./compile.sh -all         — build amd64 + arm64 (requires Go)
+#   ./compile.sh -amd64       — build linux/amd64 (requires Go)
+#   ./compile.sh -arm64       — build linux/arm64 (requires Go)
+#   ./compile.sh -docker      — build for current platform inside golang:alpine
 
 set -e
 
@@ -14,34 +17,59 @@ git config core.hooksPath .githooks 2>/dev/null || true
 SRC_DIR="${SCRIPT_DIR}/src"
 BIN_DIR="${SCRIPT_DIR}/bin"
 
+GO_IMAGE="${GO_IMAGE:-golang:alpine}"
+
+usage() { printf "Usage: %s [-docker|-all|-amd64|-arm64]\n" "$0"; exit 1; }
+
+# ── Argument parsing ──────────────────────────────────────────────────────────
+
+OPT_DOCKER=false
+OPT_ALL=false
+OPT_ARCH=""
+
+for arg in "$@"; do
+    case "$arg" in
+        -docker) OPT_DOCKER=true ;;
+        -all)    OPT_ALL=true    ;;
+        -amd64)  OPT_ARCH=amd64  ;;
+        -arm64)  OPT_ARCH=arm64  ;;
+        *)       usage            ;;
+    esac
+done
+
+# ── Docker mode ───────────────────────────────────────────────────────────────
+
+if $OPT_DOCKER; then
+    command -v docker &>/dev/null || { printf "ERROR: docker not found\n" >&2; exit 1; }
+    printf "Building inside container (%s) → bin/srvguard ...\n" "${GO_IMAGE}"
+    docker run --rm \
+        -v "${SCRIPT_DIR}:/work" \
+        -w /work \
+        "${GO_IMAGE}" \
+        sh -c "sh compile.sh"
+    exit $?
+fi
+
+# ── Native build ──────────────────────────────────────────────────────────────
+
 build_target()
 {
-  local arch="$1"
-  local out="$2"
+    local arch="$1"
+    local out="$2"
 
-  printf "Building %s ...\n" "${out}"
-  ( cd "${SRC_DIR}" && CGO_ENABLED=0 GOOS=linux GOARCH="${arch}" \
-      go build -buildvcs=false -ldflags="-s -w" -o "${out}" . )
+    printf "Building %s ...\n" "${out}"
+    ( cd "${SRC_DIR}" && CGO_ENABLED=0 GOOS=linux GOARCH="${arch}" \
+        go build -buildvcs=false -ldflags="-s -w" -o "${out}" . )
 }
 
-TARGET="${1:-native}"
-
-case "${TARGET}" in
-  native)
-    NATIVE_ARCH=$(go env GOARCH)
-    build_target "${NATIVE_ARCH}" "${BIN_DIR}/srvguard"
-    ;;
-  all)
+if $OPT_ALL; then
     build_target amd64 "${BIN_DIR}/srvguard-linux-amd64"
     build_target arm64 "${BIN_DIR}/srvguard-linux-arm64"
-    ;;
-  amd64|arm64)
-    build_target "${TARGET}" "${BIN_DIR}/srvguard-linux-${TARGET}"
-    ;;
-  *)
-    printf "Usage: %s [all|amd64|arm64]\n" "$0"
-    exit 1
-    ;;
-esac
+elif [ -n "$OPT_ARCH" ]; then
+    build_target "${OPT_ARCH}" "${BIN_DIR}/srvguard-linux-${OPT_ARCH}"
+else
+    NATIVE_ARCH=$(go env GOARCH)
+    build_target "${NATIVE_ARCH}" "${BIN_DIR}/srvguard"
+fi
 
 printf "Done.\n"

consumers/cpp/demo.sh

@@ -58,11 +58,15 @@ SYSTEMD_VER=$(systemctl --version | awk 'NR==1{print $2}')
 [[ "$SYSTEMD_VER" -ge 250 ]]        || die "systemd v250+ required (have $SYSTEMD_VER)"
 log "systemd version: $SYSTEMD_VER"
 
-# Verify credential support is available on this machine
-if ! systemd-creds has-tpm2 &>/dev/null && \
-   [[ ! -f /var/lib/systemd/credential.secret ]]; then
-    log "creating /var/lib/systemd/credential.secret ..."
+# Verify credential support and report which backend is active
+if systemd-creds has-tpm2 &>/dev/null; then
+    log "credential backend: TPM2 (hardware-bound)"
+elif [[ -f /var/lib/systemd/credential.secret ]]; then
+    log "credential backend: credential.secret (machine-specific, no TPM2)"
+else
+    log "no credential backend found — running systemd-creds setup ..."
     systemd-creds setup
+    log "credential backend: credential.secret (created)"
 fi
 
 # ── Build example binary ──────────────────────────────────────────────────────
@@ -123,13 +127,4 @@ sleep 1
 journalctl -u "${UNIT_NAME}.service" --no-pager -o cat | grep -v "^$"
 
 echo
-if journalctl -u "${UNIT_NAME}.service" --no-pager -o cat | grep -q "keyring: got password"; then
-    echo "  ✓ systemd credential decrypted into \$CREDENTIALS_DIRECTORY"
-    echo "  ✓ srvguard loaded it into the kernel keyring"
-    echo "  ✓ example consumer read it — key revoked, memory zeroed"
-    echo
-    echo "  Next step: demo-transient.sh — same flow with Vault in the middle"
-else
-    echo "  ✗ check output above"
-    exit 1
-fi
+echo "  Next step: demo-transient.sh — same flow with Vault in the middle"