jcoffey-dev
674ae5d037
A release published an image and nothing else, so there was nothing for a host install to download -- the only way to get the binary was to pull the image and copy it out, which makes "install without Docker" depend on Docker. Each release now carries inbuxa-linux-amd64.tar.gz, inbuxa-linux-arm64.tar.gz and SHA256SUMS, named as stalwart-migrator's are. They are taken out of the image this pipeline just pushed rather than compiled again. A second Rust build per architecture is the slowest thing here, and it would leave two artifacts that are meant to be the same build and only probably are. Extracting makes that identity a fact: the binary in the tarball is the file the image runs. `docker create` starts nothing, so copying a file out of an arm64 image on an amd64 runner needs no emulation. One thing the extraction cannot carry: the image grants the binary cap_net_bind_service, and a tar archive does not keep that xattr. The release body says so, and says what to do instead -- setcap, or AmbientCapabilities in the unit -- because a server that cannot bind 25 and does not say why is a bad first hour. Checked by hand against v2026.9.23 before this landed: both architectures extract to the right ELF, and the amd64 binary runs on a bare Debian 13 with every library resolved and reports its own version.