Makefile

BIN        := bin
DATA       := data
GO         ?= go
CLANG      ?= clang
GOVULNCHECK ?= golang.org/x/vuln/cmd/govulncheck@v1.1.4

.PHONY: all build agent collector verifier test probe-test fmt vet vulncheck \
	generate verify-bpf demo tamper-demo clean

all: build

## build: compile all three binaries into bin/
build: agent collector verifier

## agent: compile the eBPF-backed audit agent
agent: $(BIN)/audit-agent

## collector: compile the HTTP collector
collector: $(BIN)/audit-collector

## verifier: compile the verification CLI
verifier: $(BIN)/audit-verify

# Phony on purpose. Timestamp prerequisites cannot see every input that matters
# here - go.mod, go.sum, the generated bindings, and above all the toolchain,
# whose standard library is linked into these binaries. A binary make declares
# up to date is one still carrying whatever the last toolchain shipped. The
# build cache makes the unconditional call cheap.
.PHONY: $(BIN)/audit-agent $(BIN)/audit-collector $(BIN)/audit-verify

$(BIN)/audit-agent:
	@mkdir -p $(BIN)
	$(GO) build -o $@ ./cmd/audit-agent

$(BIN)/audit-collector:
	@mkdir -p $(BIN)
	$(GO) build -o $@ ./cmd/audit-collector

$(BIN)/audit-verify:
	@mkdir -p $(BIN)
	$(GO) build -o $@ ./cmd/audit-verify

## test: run the unit and integration tests
test:
	$(GO) test ./...

## fmt: format the Go sources
fmt:
	$(GO) fmt ./...

## vet: run go vet
vet:
	$(GO) vet ./...

## vulncheck: report known vulnerabilities in the toolchain and dependencies
##
## The standard library ships inside these binaries, so a vulnerable toolchain is
## a vulnerable release. Build with Go 1.26.6 or later.
vulncheck:
	$(GO) run $(GOVULNCHECK) ./...

## verify-bpf: check that the committed eBPF artifacts match their source
##
## bpf/exec_bpfel.o and bpf/exec_bpfel.go are kept in the tree so `go build`
## works without clang. This regenerates both and fails if either differs.
## A check, not a build step: what it regenerates is discarded, so the tree is
## byte-identical afterwards whether the comparison passes, fails, or the
## generator dies. One shell under an EXIT trap - split across recipe lines, a
## failed generation would skip the cleanup and leave half-regenerated files.
verify-bpf: bpf/headers/vmlinux.h
	@set -e; \
	saved="$$(mktemp -d)"; \
	trap 'cp -p "$$saved"/exec_bpfel.o "$$saved"/exec_bpfel.go bpf/; rm -rf "$$saved"' EXIT; \
	cp -p bpf/exec_bpfel.o bpf/exec_bpfel.go "$$saved"/; \
	$(MAKE) --no-print-directory generate >/dev/null; \
	status=0; \
	for f in exec_bpfel.o exec_bpfel.go; do \
		if ! cmp -s bpf/$$f "$$saved"/$$f; then \
			echo "bpf/$$f does not match bpf/exec.bpf.c - run 'make generate' and commit the result"; \
			status=1; \
		fi; \
	done; \
	if [ $$status -eq 0 ]; then echo "committed eBPF artifacts match bpf/exec.bpf.c"; fi; \
	exit $$status

## generate: recompile the eBPF program and regenerate its Go bindings
##
## Needs clang. bpf/headers/vmlinux.h is committed next to the other libbpf
## headers, so the output depends on the source and the compiler and not on
## whichever kernel happens to be running. The object stays CO-RE relocatable
## and resolves field offsets against the target kernel at load time.
generate: bpf/headers/vmlinux.h
	cd bpf && GOPACKAGE=bpf $(GO) generate ./...

# Only fires if the committed header is missing. Dumping it from a different
# kernel rewrites the struct definitions clang copies into the object's BTF, so
# `make verify-bpf` would then report drift that is not in bpf/exec.bpf.c.
bpf/headers/vmlinux.h:
	@command -v bpftool >/dev/null || { echo "bpftool is required to regenerate vmlinux.h"; exit 1; }
	bpftool btf dump file /sys/kernel/btf/vmlinux format c > $@

## probe-test: run the privileged eBPF probe test
##
## `sudo go test` does not work here: sudo replaces PATH with its own
## secure_path, which has no Go toolchain, and running the toolchain as root
## leaves root-owned files in the build cache. Compile as the current user and
## run only the test binary under sudo.
probe-test: $(BIN)/bpf.test
	sudo $(BIN)/bpf.test -test.run TestProbeCapturesExecution -test.v

.PHONY: $(BIN)/bpf.test
$(BIN)/bpf.test:
	@mkdir -p $(BIN)
	$(GO) test -c -o $@ ./bpf

## demo: run the full pipeline end to end
demo: build
	./scripts/demo.sh

## tamper-demo: show the verifier catching an edited audit log
tamper-demo: build
	./scripts/tamper-demo.sh

## clean: remove build output and demo data
clean:
	rm -rf $(BIN) $(DATA)