feat: add Linux x86_64/ARM64 release support

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: GoogleOAuth2
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: "1.93.0"

.github/workflows/release.yml

@@ -8,22 +8,28 @@ on:
 jobs:
   build:
     name: Build (${{ matrix.target }})
-    runs-on: macos-14
+    runs-on: ${{ matrix.os }}
     environment: GoogleOAuth2
     strategy:
+      fail-fast: false
       matrix:
-        target:
-          - aarch64-apple-darwin
-          - x86_64-apple-darwin
+        include:
+          - target: aarch64-apple-darwin
+            os: macos-14
+          - target: x86_64-apple-darwin
+            os: macos-14
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-22.04
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-22.04-arm
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: "1.93.0"
 
-      - name: Install cross-compilation target
-        if: matrix.target != 'aarch64-apple-darwin'
+      - name: Install Rust target
         run: rustup target add ${{ matrix.target }}
 
       - uses: Swatinem/rust-cache@v2
@@ -60,7 +66,7 @@ jobs:
 
           tar -C dist -czf "dist/${PACKAGE_NAME}.tar.gz" "${PACKAGE_NAME}"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: artifact-${{ matrix.target }}
           path: dist/*.tar.gz
@@ -71,7 +77,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v5
         with:
           pattern: artifact-*
           path: dist
@@ -83,7 +89,7 @@ jobs:
           shasum -a 256 *.tar.gz > checksums.txt
           cat checksums.txt
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: checksums
           path: dist/checksums.txt
@@ -96,15 +102,15 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v5
         with:
           pattern: artifact-*
           path: dist
           merge-multiple: true
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v5
         with:
           name: checksums
           path: dist
@@ -152,8 +158,16 @@ jobs:
             echo "xattr -d com.apple.quarantine ok"
             echo '```'
             echo ""
+            echo "### Linux Requirements"
+            echo ""
+            echo "Linux builds target glibc 2.35 or newer (Ubuntu 22.04+, Debian 12+, Fedora, RHEL/Rocky/Alma 9+, Arch, openSUSE). They do not cover Alpine (musl) or older glibc releases such as Debian 11."
+            echo ""
+            echo "ok locks secrets in memory with mlock. Most distributions default to a low RLIMIT_MEMLOCK (often 64 KiB), which can cause vault creation or unlock to fail. Raise it before running ok, for example: ulimit -l unlimited, a /etc/security/limits.conf entry, a systemd LimitMEMLOCK=infinity directive, or setcap cap_ipc_lock=ep. See INSTALL.md for details."
+            echo ""
             echo "### Install"
             echo ""
+            echo "Available targets: aarch64-apple-darwin, x86_64-apple-darwin, x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu."
+            echo ""
             echo '```bash'
             echo "tar -xzf ok-v${VERSION}-<target>.tar.gz"
             echo "sudo mv ok-v${VERSION}-<target>/ok /usr/local/bin/"
@@ -200,15 +214,15 @@ jobs:
     needs: build
     environment: NPM
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v5
         with:
           pattern: artifact-*
           path: dist
           merge-multiple: true
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
@@ -225,6 +239,8 @@ jobs:
         run: |
           npm --prefix npm/ok-darwin-arm64 version "$VERSION" --no-git-tag-version
           npm --prefix npm/ok-darwin-x64 version "$VERSION" --no-git-tag-version
+          npm --prefix npm/ok-linux-x64 version "$VERSION" --no-git-tag-version
+          npm --prefix npm/ok-linux-arm64 version "$VERSION" --no-git-tag-version
           npm --prefix npm/ok version "$VERSION" --no-git-tag-version
           # Update optionalDependencies to match
           node -e "
@@ -243,6 +259,8 @@ jobs:
         run: |
           npm pack ./npm/ok-darwin-arm64 --dry-run
           npm pack ./npm/ok-darwin-x64 --dry-run
+          npm pack ./npm/ok-linux-x64 --dry-run
+          npm pack ./npm/ok-linux-arm64 --dry-run
           npm pack ./npm/ok --dry-run
 
       - name: Publish @openkeyring/ok-darwin-arm64
@@ -255,6 +273,16 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
+      - name: Publish @openkeyring/ok-linux-x64
+        run: npm publish ./npm/ok-linux-x64
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish @openkeyring/ok-linux-arm64
+        run: npm publish ./npm/ok-linux-arm64
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
       - name: Publish @openkeyring/ok
         run: npm publish ./npm/ok
         env:

CHANGELOG.md

@@ -6,8 +6,9 @@ This project is in first-preview status. Preview releases may change local vault
 
 ## Unreleased
 
+- Added Linux x86_64/ARM64 (glibc 2.35+) release builds, distribution, and documentation support: release workflow now builds `x86_64-unknown-linux-gnu` and `aarch64-unknown-linux-gnu` targets; npm ships `@openkeyring/ok-linux-x64` and `@openkeyring/ok-linux-arm64`; Homebrew formula adds an `on_linux` block; INSTALL documents `mlock`/`RLIMIT_MEMLOCK` requirements.
 - Added first-preview installation, support, contribution, security, and issue-reporting documentation.
-- Clarified the preview boundary: macOS Apple Silicon and Intel only; Linux and Windows are not supported yet.
+- Updated the preview boundary: macOS Apple Silicon/Intel and Linux x86_64/ARM64 (glibc 2.35+) are supported; Alpine (musl) and Windows are not yet.
 - Clarified that preview builds are unsigned and not notarized, with best-effort community support and no formal SLA.
 
 ## 0.8.0-preview.1

CONTRIBUTING.md

@@ -7,7 +7,7 @@ Thanks for helping improve oak-keyring. The project is in a first-preview phase,
 - Reproducible bug reports with environment details.
 - Documentation fixes for install, support, or troubleshooting gaps.
 - Small code fixes with clear tests.
-- Preview packaging feedback for macOS Apple Silicon and Intel.
+- Preview packaging feedback for macOS Apple Silicon/Intel and Linux x86_64/ARM64.
 
 Avoid large roadmap proposals, broad architecture rewrites, or speculative platform work in a first contribution. Open a discussion first for anything that changes user-visible behavior or security-sensitive code.
 
@@ -33,4 +33,4 @@ Local builds need `OAK_GOOGLE_CLIENT_ID` and `OAK_GOOGLE_CLIENT_SECRET` in the e
 
 ## Preview Scope
 
-The current preview supports macOS on Apple Silicon and Intel only. Linux and Windows are not supported yet, preview builds are unsigned and not notarized, data formats may change, and support is best effort without a formal SLA.
+The current preview supports macOS on Apple Silicon/Intel and Linux x86_64/ARM64 (glibc 2.35+). Alpine (musl) and Windows are not supported yet; preview builds are unsigned and not notarized, data formats may change, and support is best effort without a formal SLA.

INSTALL-ZH.md

@@ -4,8 +4,8 @@ oak-keyring 是 OpenKeyring 项目的 privacy-first、local-first 预览版密
 
 ## 预览版支持边界
 
-- 支持的操作系统：Apple Silicon 和 Intel 芯片的 macOS。
-- 暂不支持 Linux 和 Windows。
+- 支持的操作系统：Apple Silicon 和 Intel 芯片的 macOS，以及 glibc 2.35 及以上版本的 Linux x86_64/ARM64（Ubuntu 22.04+、Debian 12+、Fedora、RHEL/Rocky/Alma 9+、Arch、openSUSE）。暂不支持 Alpine（musl）和 Windows。
+- 在 Linux 上，内存锁定（`mlock`）可能需要调高 `RLIMIT_MEMLOCK`，详见下文「Linux 内存锁定」章节。
 - 预览版构建未签名、未公证。macOS Gatekeeper 可能会在首次运行前提示风险。
 - 本地 vault 和同步数据格式在稳定版前可能变化。预览版数据不提供兼容性保证。
 - 社区支持通过 GitHub Issues 和 Discussions 尽力提供，不提供正式 SLA。
@@ -14,10 +14,10 @@ oak-keyring 是 OpenKeyring 项目的 privacy-first、local-first 预览版密
 
 ## GitHub Release 未签名构建
 
-GitHub Release 是主要用户安装路径。Release 提供 Apple Silicon 和 Intel macOS 的未签名构建产物。
+GitHub Release 是主要用户安装路径。Release 提供 macOS（Apple Silicon 和 Intel）与 Linux（x86_64 和 ARM64，glibc 2.35+）的未签名构建产物。
 
 1. 打开最新 release：`https://github.com/OpenKeyring/oak-keyring/releases`。
-2. 下载与你的 Mac 架构匹配的产物。
+2. 下载与你的操作系统和架构匹配的产物。
 3. 解压后，把 `ok` 移动到 `PATH` 中的目录，例如 `/usr/local/bin` 或 `~/.local/bin`。
 4. 验证安装：
 
@@ -36,7 +36,7 @@ brew install ok
 
 ## npm 内置二进制包
 
-npm 包会为 macOS 安装内置的 `ok` 二进制文件：
+npm 包会为 macOS 和 Linux 安装内置的 `ok` 二进制文件：
 
 ```bash
 npm install -g @openkeyring/ok
@@ -45,15 +45,50 @@ ok --version
 
 如果 npm 包暂时不支持你的架构，请改用 GitHub Release。
 
+## Linux 内存锁定
+
+`ok` 使用 `mlock` 把机密数据（主密钥、派生密钥等）锁定在内存中，使其不会被交换到磁盘。在 Linux 上，默认的 `RLIMIT_MEMLOCK` 通常只有 64 KiB，太小了。当 `mlock` 失败时，`ok` 会显式报错：创建或解锁 vault 会返回错误，而不是在没有内存保护的情况下静默运行。
+
+在运行 `ok` 之前调高该限制。请根据你的环境选择合适的方式：
+
+**交互式会话（临时）：**
+
+```bash
+ulimit -l unlimited
+ok
+```
+
+**通过 PAM 持久化** — 在 `/etc/security/limits.conf` 中添加，然后重新登录：
+
+```
+*  soft  memlock  unlimited
+*  hard  memlock  unlimited
+```
+
+**systemd 服务** — 在 unit 文件中添加：
+
+```
+[Service]
+LimitMEMLOCK=infinity
+```
+
+**Capability（无需调整 ulimit）** — 一次性授予，重启后仍生效：
+
+```bash
+sudo setcap cap_ipc_lock=ep "$(command -v ok)"
+```
+
+macOS 不需要对普通用户施加同样的 `mlock` 配额，因此该步骤在 macOS 上不需要。
+
 ## 开发者源码构建
 
 源码构建不是预览版的主要分发方式，因为当前构建会把用于同步的 Google OAuth2 配置编译进二进制。这个路径适合开发或源码审查。
 
 前置条件：
 
-- Apple Silicon 或 Intel 芯片的 macOS
+- Apple Silicon 或 Intel 芯片的 macOS，或 Linux x86_64/ARM64（glibc 2.35+）
 - 通过 `rustup` 安装的 Rust 工具链
-- Xcode Command Line Tools
+- macOS 上：Xcode Command Line Tools。Linux 上：C 编译器和构建工具（`build-essential`/`gcc`/`make`）
 - 本地构建需要 Google OAuth 值，可以放在环境变量或 `.env` 中
 
 ```bash

INSTALL.md

@@ -4,8 +4,8 @@ oak-keyring is a privacy-first, local-first preview password manager for the Ope
 
 ## Preview Support Boundary
 
-- Supported operating systems: macOS on Apple Silicon and Intel.
-- Linux and Windows are not yet supported.
+- Supported operating systems: macOS on Apple Silicon and Intel, and Linux x86_64/ARM64 with glibc 2.35 or newer (Ubuntu 22.04+, Debian 12+, Fedora, RHEL/Rocky/Alma 9+, Arch, openSUSE). Alpine (musl) and Windows are not supported yet.
+- On Linux, memory locking (`mlock`) may require raising `RLIMIT_MEMLOCK`; see the Linux Memory Locking section below.
 - Preview builds are unsigned and not notarized. macOS Gatekeeper may warn before first launch.
 - The local vault and sync data formats may change before a stable release. Preview data does not carry a compatibility guarantee.
 - Community support is best effort through GitHub Issues and Discussions. There is no formal SLA.
@@ -14,10 +14,10 @@ Back up any vault data before upgrading between preview builds.
 
 ## GitHub Release Builds
 
-GitHub Release assets are the primary user installation path. Assets are unsigned macOS builds for Apple Silicon and Intel.
+GitHub Release assets are the primary user installation path. Assets are unsigned builds for macOS (Apple Silicon and Intel) and Linux (x86_64 and ARM64, glibc 2.35+).
 
 1. Open the latest release at `https://github.com/OpenKeyring/oak-keyring/releases`.
-2. Download the asset that matches your Mac architecture.
+2. Download the asset that matches your OS and architecture.
 3. Unpack it and move `ok` into a directory on your `PATH`, such as `/usr/local/bin` or `~/.local/bin`.
 4. Verify it:
 
@@ -36,7 +36,7 @@ brew install ok
 
 ## npm Bundled Binary Package
 
-The npm package installs a bundled `ok` binary for macOS:
+The npm package installs a bundled `ok` binary for macOS and Linux:
 
 ```bash
 npm install -g @openkeyring/ok
@@ -45,15 +45,50 @@ ok --version
 
 Use the GitHub Release path if the npm package is not available for your architecture yet.
 
+## Linux Memory Locking
+
+`ok` locks secrets (master key, derived keys) in RAM with `mlock` so they cannot be swapped to disk. On Linux, the default `RLIMIT_MEMLOCK` is often only 64 KiB, which is too small. When `mlock` fails, `ok` fails loudly: vault creation or unlock surfaces an error rather than silently running without memory protection.
+
+Raise the limit before running `ok`. Pick whichever fits your setup:
+
+**Interactive session (temporary):**
+
+```bash
+ulimit -l unlimited
+ok
+```
+
+**Persistent via PAM** — add to `/etc/security/limits.conf`, then log out and back in:
+
+```
+*  soft  memlock  unlimited
+*  hard  memlock  unlimited
+```
+
+**systemd service** — add to the unit file:
+
+```
+[Service]
+LimitMEMLOCK=infinity
+```
+
+**Capability (no ulimit needed)** — grant once, persists across reboots:
+
+```bash
+sudo setcap cap_ipc_lock=ep "$(command -v ok)"
+```
+
+This step is not needed on macOS, which does not impose the same `mlock` quota on regular users.
+
 ## Developer Source Build
 
 Source builds are not the primary preview distribution path because the current build embeds Google OAuth2 configuration for sync. Use this path for development or source inspection.
 
 Prerequisites:
 
-- macOS on Apple Silicon or Intel
+- macOS on Apple Silicon or Intel, or Linux x86_64/ARM64 (glibc 2.35+)
 - Rust toolchain from `rustup`
-- Xcode Command Line Tools
+- On macOS: Xcode Command Line Tools. On Linux: a C compiler and build tools (`build-essential`/`gcc`/`make`)
 - Google OAuth values for local builds, either in the environment or `.env`
 
 ```bash

README-ZH.md

@@ -27,12 +27,13 @@ oak-keyring 是一个 privacy-first、local-first 的密码管理器，提供键
 - **自动锁定** — 不活动后自动锁定密码库
 - **密码健康** — 泄露密码指示器和健康检查
 - **macOS** — Apple Silicon 和 Intel 构建（预览）
+- **Linux** — x86_64 和 ARM64 构建，glibc 2.35+（预览）
 
 ## 安装
 
 ### GitHub Release（推荐）
 
-1. 下载与你的 Mac 架构匹配的 tarball。
+1. 下载与你的操作系统和架构匹配的 tarball。
 2. 校验 `checksums.txt`。
 3. 解压后运行 `ok --version`。
 
@@ -97,7 +98,7 @@ oak-keyring 会打开一个全屏终端界面。主要使用流程是：
 
 oak-keyring 仍处于 pre-1.0 预览阶段（v0.8.0-preview.1）。
 
-- 当前构建仅支持 macOS（Apple Silicon 和 Intel）；暂不提供 Linux 和 Windows 构建。
+- 当前构建支持 macOS（Apple Silicon 和 Intel）和 Linux（x86_64/ARM64，glibc 2.35+）；暂不提供 Windows 构建。Linux 上可能需要调高 `mlock` 的 `RLIMIT_MEMLOCK`（见 INSTALL-ZH.md）。
 - macOS 二进制未签名，也未 notarize。
 - 密码库数据、配置和发布打包方式在后续稳定版之前可能变化。
 - 没有正式支持 SLA。