You were right about the licensing and it was sloppy of me. The binary is BlueZs btproxy and the repo just had a blanket MIT sitting on top of it. That just go fixed and is now: GPL-2.0-or-later is disclosed properly, along with the LGPL-2.1 and BSD-2-Clause parts it links. I have completely missed that ecc.c is BSD-2-Clause and requires its notice to ship with binary redistributions; my bad. the install.sh script now writes the notice and a source offer to disk and releases carry the license texts next to the binary instead of leaving them in git where nobody installing it would looked.
On the opaque binary, the CI now rebuilds it from the kernel.org bluez-5.66 tarball inside a pinned debian:bookworm container and fails if a single byte differs from what's committed!
The tarball's checksum is pinned too otherwise the whole thing rests on whatever the download happened to return. There is a oneline docker command in the README if you want to verify it yourself rather than take my word for it ;-) I also added a MANUAL_INSTALL.md which is moer or less the blog post you suggested... build btproxy from source and write the two units by hand -> no script and no binary from me!
One correction to my own docs while I'm here: Id written that btproxy isnt packaged anywhere. That was wrong! Accoreding to my reading, Arch ships it in bluez-utils. Its Debian, Ubuntu and Fedora that donesn't which happens to be Proxmox and the guests this is for...
Also fixed a few things the review shook loose, including a bug where the port restriction I added could be bypassed with a /0 CIDR while still reporting itself as locked down.
Lastly, you said the repo merits very low trust. That's fair! And it's the right default for any new repo asking for root on your hypervisor and so mine included. Pinning the hash and making the build reproducible isn't me trying to convince you that I'm trustworthy. Its so that it doesn't have to matter...
On the opaque binary, the CI now rebuilds it from the kernel.org bluez-5.66 tarball inside a pinned debian:bookworm container and fails if a single byte differs from what's committed!
The tarball's checksum is pinned too otherwise the whole thing rests on whatever the download happened to return. There is a oneline docker command in the README if you want to verify it yourself rather than take my word for it ;-) I also added a MANUAL_INSTALL.md which is moer or less the blog post you suggested... build btproxy from source and write the two units by hand -> no script and no binary from me!
One correction to my own docs while I'm here: Id written that btproxy isnt packaged anywhere. That was wrong! Accoreding to my reading, Arch ships it in bluez-utils. Its Debian, Ubuntu and Fedora that donesn't which happens to be Proxmox and the guests this is for...
Also fixed a few things the review shook loose, including a bug where the port restriction I added could be bypassed with a /0 CIDR while still reporting itself as locked down.
Lastly, you said the repo merits very low trust. That's fair! And it's the right default for any new repo asking for root on your hypervisor and so mine included. Pinning the hash and making the build reproducible isn't me trying to convince you that I'm trustworthy. Its so that it doesn't have to matter...