feat: support AmneziaWG 3.1

tools/build.sh

@@ -64,7 +64,7 @@ Flags:
   --build               Run build gate (default when no action flags)
   --package             Build Debian package into dist/ (runs build gate by default)
   --dist-dir <path>     Output directory for package artifacts (default: ./dist)
-  --version <version>   Override package version (default: read from Cargo.toml)
+  --version <version>   Override with a valid Debian package version (default: Cargo.toml)
   --install             Install binary and systemd unit (no enable/start)
   --enable              Enable and start awg2-harness.service
   --yes                 Confirm system mutations (apt/rustup)
@@ -297,6 +297,25 @@ read_package_version_from_manifest() {
   awk -F '"' '/^[[:space:]]*version[[:space:]]*=[[:space:]]*"/ { print $2; exit }' "$CRATE_MANIFEST"
 }
 
+validate_package_version() {
+  local version="$1"
+
+  if [[ -z "$version" ]]; then
+    echo "Package version must not be empty"
+    exit 1
+  fi
+  if [[ "$version" == *'/'* || "$version" == *'\'* ]]; then
+    echo "Package version must not contain path separators: $version"
+    exit 1
+  fi
+
+  require_cmd dpkg
+  if ! dpkg --validate-version "$version"; then
+    echo "Invalid Debian package version: $version"
+    exit 1
+  fi
+}
+
 package_deb() {
   require_cmd dpkg-deb
   require_cmd install
@@ -304,6 +323,8 @@ package_deb() {
   require_cmd file
   require_cmd ldd
   require_cmd mktemp
+  require_cmd grep
+  require_cmd sh
 
   if [[ "$DO_BUILD" != true ]]; then
     prepare_build_gate
@@ -325,6 +346,7 @@ package_deb() {
     echo "Unable to determine package version"
     exit 1
   fi
+  validate_package_version "$version"
 
   local staging
   staging="$(mktemp -d)"
@@ -429,6 +451,9 @@ exit 0
 EOF
 
   chmod 0755 "$staging/DEBIAN/preinst" "$staging/DEBIAN/postinst" "$staging/DEBIAN/postrm"
+  sh -n "$staging/DEBIAN/preinst"
+  sh -n "$staging/DEBIAN/postinst"
+  sh -n "$staging/DEBIAN/postrm"
 
   mkdir -p "$DIST_DIR"
   local pkg_name
@@ -436,9 +461,33 @@ EOF
   local pkg_path
   pkg_path="$DIST_DIR/$pkg_name"
 
-  dpkg-deb --build "$staging" "$pkg_path"
+  dpkg-deb --build --root-owner-group "$staging" "$pkg_path"
   dpkg-deb --info "$pkg_path"
-  dpkg-deb --contents "$pkg_path" | sort
+  local contents
+  contents="$(dpkg-deb --contents "$pkg_path")"
+  printf '%s\n' "$contents" | sort
+
+  local actual_package actual_version actual_arch
+  actual_package="$(dpkg-deb -f "$pkg_path" Package)"
+  actual_version="$(dpkg-deb -f "$pkg_path" Version)"
+  actual_arch="$(dpkg-deb -f "$pkg_path" Architecture)"
+  [[ "$actual_package" == "awg2-harness" ]] || { echo "Unexpected package name: $actual_package"; exit 1; }
+  [[ "$actual_version" == "$version" ]] || { echo "Package version mismatch: expected $version, got $actual_version"; exit 1; }
+  [[ "$actual_arch" == "amd64" ]] || { echo "Unexpected package architecture: $actual_arch"; exit 1; }
+
+  local required_path
+  for required_path in \
+    ./usr/sbin/awg2-harness \
+    ./usr/sbin/awg2-reboot-scheduler \
+    ./lib/systemd/system/awg2-harness.service \
+    ./lib/systemd/system/awg2-reboot-scheduler.service \
+    ./usr/share/doc/awg2-harness/repo/config.example.toml \
+    ./usr/share/doc/awg2-harness/repo/docs/UPSTREAM_COMPATIBILITY.md; do
+    grep -Fq "$required_path" <<<"$contents" || {
+      echo "Package is missing required path: $required_path"
+      exit 1
+    }
+  done
 
   (
     cd "$DIST_DIR"