staltz / ssb-keys-neon

A drop-in replacement of ssb-keys, implemented in Rust and delivered as a native module in Node.js

ssb-keys-neon

A drop-in replacement of ssb-keys, implemented in Rust and delivered as a native module in Node.js

npm install ssb-keys-neon

Motivation

It would make a lot of sense for SSB to be implemented in Rust, a language for safety and performance. Sunrise Choir has written a lot of SSB modules in Rust, but these are not yet running in production, simply because it requires a lot of work to migrate from Node.js (and/or Electron) to Rust.

Neon allows you to create native modules for Node.js written in Rust. This is great, because it allows us to use Sunrise Choir's modules directly inside Node.js!

ssb-keys-neon does exactly that, it runs ssb-crypto, ssb-keyfile, ssb-multiformats (Rust crates) under the hood, but provides an API that perfectly mirrors that of ssb-keys. There is no code you need to migrate, just replace ssb-keys with ssb-keys-neon and it's done.

We even run the same test suite for ssb-keys on ssb-keys-neon.

Usage

There are two ways you can use this npm package.

Option 1: (easiest) automatically replace

In your package.json, assuming you already have ssb-keys, you can replace its implementation by pointing to the GitHub repo for ssb-keys-neon:

   // ...
   "dependencies": {
     "ssb-ebt": "^5.6.7",
     "ssb-friends": "^4.1.4",
     "ssb-invite": "^2.1.3",
-    "ssb-keys": "7.2.0",
+    "ssb-keys": "staltz/ssb-keys-neon#replace-7.2.0",
     "ssb-lan": "^0.2.0",
     "ssb-logging": "^1.0.0",
     "ssb-markdown": "^6.0.4",
   }
   // ...

This is the easiest method because you only need to change package.json, your code can still require('ssb-keys') and under the hood it will load ssb-keys-neon.

Note that you cannot specify version ranges. If you previously had "ssb-keys": "7.x.x", you will have to specify an exact version when you write "staltz/ssb-keys-neon#replace-7.2.0", you cannot write "staltz/ssb-keys-neon#replace-7.x.x".

Option 2: manually replace

This method gives you more control over the usage of ssb-keys-neon, as well as allows you to specify version ranges. Just remove ssb-keys from your package.json, and add ssb-keys-neon:

   // ...
   "dependencies": {
     "ssb-ebt": "^5.6.7",
     "ssb-friends": "^4.1.4",
     "ssb-invite": "^2.1.3",
-    "ssb-keys": "8.0.0",
+    "ssb-keys-neon": ">=8.0.0-1",
     "ssb-lan": "^0.2.0",
     "ssb-logging": "^1.0.0",
     "ssb-markdown": "^6.0.4",
   }
   // ...

Then, you also have to replace usages of ssb-keys manually in JavaScript source files:

-var ssbKeys = require('ssb-keys')
+var ssbKeys = require('ssb-keys-neon')

 // ...

Versioning and support

[email protected] is compatible with [email protected]. Versions older than 8.0.0 still use the old name ssb-neon-keys so be sure to type it correctly.

Versions of ssb-keys that are mirrored by ssb-keys-neon currently include (and which platforms are guaranteed to be supported):

8.0.0 (click here to see which platforms are supported)

As of [email protected]

• macOS (darwin-x64)
  • Node 10.x
  • Node 12.x
  • Node 14.x
  • Electron 7.x
  • Electron 8.x
  • Electron 9.x
  • Electron 10.x
• Linux (linux-x64)
  • Node 10.x
  • Node 12.x
  • Node 14.x
  • Electron 7.x
  • Electron 8.x
  • Electron 9.x
  • Electron 10.x
• Windows (win32-x64)
  • Node 10.x
  • Node 12.x
  • Node 14.x
  • Electron 7.x
  • Electron 8.x
  • Electron 9.x
  • Electron 10.x

7.2.2 (click here to see which platforms are supported)

As of [email protected]

• macOS (darwin-x64)
  • Node 10.x
  • Node 12.x
  • Node 14.x
  • Electron 7.x
  • Electron 8.x
  • Electron 9.x
  • Electron 10.x
• Linux (linux-x64)
  • Node 10.x
  • Node 12.x
  • Node 14.x
  • Electron 7.x
  • Electron 8.x
  • Electron 9.x
  • Electron 10.x
• Windows (win32-x64)
  • Node 10.x
  • Node 12.x
  • Node 14.x
  • Electron 7.x
  • Electron 8.x
  • Electron 9.x
  • Electron 10.x

7.2.1 (click here to see which platforms are supported)

As of [email protected]

• macOS (darwin-x64)
  • Node 10.x
  • Node 12.x
  • Node 14.x
  • Electron 7.x
  • Electron 8.x
  • Electron 9.x
  • Electron 10.x
• Linux (linux-x64)
  • Node 10.x
  • Node 12.x
  • Node 14.x
  • Electron 7.x
  • Electron 8.x
  • Electron 9.x
  • Electron 10.x
• Windows (win32-x64)
  • Node 10.x
  • Node 12.x
  • Node 14.x
  • Electron 7.x
  • Electron 8.x
  • Electron 9.x
  • Electron 10.x

7.2.0 (click here to see which platforms are supported)

As of [email protected]

• macOS (darwin-x64)
  • Node 10.x
  • Node 12.x
  • Node 14.x
  • Electron 7.x
  • Electron 8.x
  • Electron 9.x
  • Electron 10.x
• Linux (linux-x64)
  • Node 10.x
  • Node 12.x
  • Node 14.x
  • Electron 7.x
  • Electron 8.x
  • Electron 9.x
  • Electron 10.x
• Windows (win32-x64)
  • Node 10.x
  • Node 12.x
  • Node 14.x
  • Electron 7.x
  • Electron 8.x
  • Electron 9.x
  • Electron 10.x

License

LGPL-3.0

ssb-keys-neon's Issues

Support Windows and macOS

• support macOS
• support Windows

Fix "invalid sigil" rust error from ssb-multiformats

 create and load presigil-legacy async
{"curve":"ed25519","id":"xPvwSVYnIaRiAbQWndTeHq5GUmzhEX49hkurrAiJ0mI=.ed25519","private":"TW/2MuiUL2MK08qdiHsk7j/FfoE6msWRHFgtapMDD/nE+/BJVichpGIBtBad1N4erkZSbOERfj2GS6usCInSYg==.ed25519","public":"xPvwSVYnIaRiAbQWndTeHq5GUmzhEX49hkurrAiJ0mI=.ed25519"}
./ssb-neon-keys/test-extra/index.js:11
  var k2 = ssbkeys.loadSync(path);
                   ^

Error: Failed to deserialize secret file: Invalid multikey: Invalid sigil at line 1 column 78

Perhaps ssb-multiformats(-rs) and ssb-keyfile(-rs) don't support presigil-legacy id field?

---

TODO

• Create forks of ssb-multiformats and ssb-keyfile
• Consume branches of ssb-multiformats and ssb-keyfile from ssb-neon-keys
• Get sunrise-choir/ssb-multiformats#4 merged
• Get a new version of ssb-multiformats released
• Get a new version of ssb-keyfile released, that includes the new ssb-multiformats version
• Update ssb-keyfile in this repo

Support prebuilds and Electron

• Producer side: Build electron binaries in CI, use electron-build-env
• Producer side: ❓ Replace node-pre-gyp with prebuildify to ship .node for all variants in the npm package, no GitHub releases
• Consumer side: In Electron projects node-pre-gyp install should be node-pre-gyp install --runtime=electron --target=X.Y.Z
• Create replacement for node-gyp-build that looks for various binaries in ./prebuilds
• Consumer side: use that replacement module to pick the correct binary in runtime
• Producer side: make it easy/simple to build all binaries in ./prebuilds
• Producer side: only allow npm publish from CI
• Producer side: make sure prebuild binaries end up in npm package
• Producer side: npm publish from CI

"No native build" is producing an error, should be a warning or info maybe

When installing the software with npm on a system without a native build, the display shows an error and continue, with a fallback to build the rust program.

I think this shouldn't be reported as an error because it's not blocking the installation process.

$ npm install ssb-keys-neon

> [email protected] install /home/test/node_modules/ssb-keys-neon
> neon-load-or-build

/home/test/node_modules/neon-load-or-build/index.js:62
  throw new Error('No native build was found for ' + target + '\n    loaded from: ' + dir + '\n')
  ^

Error: No native build was found for platform=openbsd arch=x64 runtime=node abi=72 uv=1 libc=glibc node=12.16.1
    loaded from: /home/test/node_modules/ssb-keys-neon

    at Function.load.path (/home/test/node_modules/neon-load-or-build/index.js:62:9)
    at load (/home/test/node_modules/neon-load-or-build/index.js:27:30)
    at Object.<anonymous> (/home/test/node_modules/neon-load-or-build/build-test.js:19:19)
    at Module._compile (internal/modules/cjs/loader.js:1158:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:1178:10)
    at Module.load (internal/modules/cjs/loader.js:1002:32)
    at Function.Module._load (internal/modules/cjs/loader.js:901:14)
    at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:74:12)
    at internal/main/run_main_module.js:18:47

neon info forcing rebuild for new build settings
neon info running cargo
    Updating crates.io index
  Downloaded stream-cipher v0.4.1
[...]

Migrate to Travis to support more platforms

Looks good, eh? https://docs.travis-ci.com/user/multi-cpu-architectures/

Read this thread: prebuild/prebuildify#25

Check out leveldown's CI configs: https://github.com/Level/leveldown

Better README

• Write full content
• List platform support in 7.2.0
• List platform support in 7.2.1
• List platform support in 7.2.2
• Make ssb-neon repo
• Write announcement

Significantly slower than ssb-keys

Hey @sbillig, after merging your PR I also added benchmarks (see the ./benchmarks directory) from an older branch. I remember the results being consistently ssb-neon-keys lasting 95% of the time that ssb-keys lasts, but with the new changes it's now:

➜  ssb-neon-keys git:(master) node benchmarks/test.js
ssb-keys      ran in 3143ms
ssb-neon-keys ran in 26469ms (842.2%)

➜  ssb-neon-keys git:(master) node benchmarks/test.js
ssb-keys      ran in 3319ms
ssb-neon-keys ran in 29489ms (888.5%)

Maybe this is due to Dalek? From your PR I didn't see any significant changes other than libsodium=>dalek.

GH actions now disallows set-env by default

Used here:

ssb-keys-neon/.github/workflows/main.yml

Line 206 in e250744

run: echo ::set-env name=BRANCH_VERSION::$(node .github/get-pkg-version.js)

I stumbled over this while playing with my own branch, and I see you also have a failed workflow for the same reason.
https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands

Not sure how much work this will be

Release 7.2.2

• Nothing new to implement
• Update our test-extras to use os.tmpdir()
• Release 7.2.2

On non native platform: get a ENOENT error after rust compilation

Installing ssb-keys-neon with npm on OpenBSD amd64 produces an error after the rust compilation which seems to happens correctly.

kongroo$ npm install ssb-keys-neon

> [email protected] install /home/test/node_modules/ssb-keys-neon
> neon-load-or-build

/home/test/node_modules/neon-load-or-build/index.js:62
  throw new Error('No native build was found for ' + target + '\n    loaded from: ' + dir + '\n')
  ^

Error: No native build was found for platform=openbsd arch=x64 runtime=node abi=72 uv=1 libc=glibc node=12.16.1
    loaded from: /home/test/node_modules/ssb-keys-neon

    at Function.load.path (/home/test/node_modules/neon-load-or-build/index.js:62:9)
    at load (/home/test/node_modules/neon-load-or-build/index.js:27:30)
    at Object.<anonymous> (/home/test/node_modules/neon-load-or-build/build-test.js:19:19)
    at Module._compile (internal/modules/cjs/loader.js:1158:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:1178:10)
    at Module.load (internal/modules/cjs/loader.js:1002:32)
    at Function.Module._load (internal/modules/cjs/loader.js:901:14)
    at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:74:12)
    at internal/main/run_main_module.js:18:47

neon info forcing rebuild for new build settings
neon info running cargo
    Updating crates.io index
  Downloaded stream-cipher v0.4.1
  Downloaded aho-corasick v0.7.6
  Downloaded cc v1.0.50
  Downloaded opaque-debug v0.3.0
  Downloaded semver v0.9.0
  Downloaded curve25519-dalek v3.0.0
  Downloaded semver-parser v0.7.0
  Downloaded serde v1.0.116
  Downloaded serde_derive v1.0.116
  Downloaded quote v1.0.2
  Downloaded thiserror v1.0.20
  Downloaded typenum v1.12.0
  Downloaded universal-hash v0.4.0
  Downloaded zerocopy v0.3.0
  Downloaded signature v1.2.2
  Downloaded zeroize v1.1.1
  Downloaded zeroize_derive v1.0.1
  Downloaded aead v0.3.2
  Downloaded cslice v0.2.0
  Downloaded base64 v0.12.3
  Downloaded cpuid-bool v0.1.2
  Downloaded crypto-mac v0.9.1
  Downloaded block-buffer v0.9.0
  Downloaded digest v0.9.0
  Downloaded generic-array v0.14.4
  Downloaded hmac v0.9.0
  Downloaded itoa v0.4.5
  Downloaded poly1305 v0.6.0
  Downloaded neon-runtime v0.5.1
  Downloaded ppv-lite86 v0.2.9
  Downloaded ed25519 v1.0.2
  Downloaded proc-macro2 v1.0.21
  Downloaded rand_chacha v0.2.2
  Downloaded ed25519-dalek v1.0.1
  Downloaded rand_core v0.5.1
  Downloaded neon-build v0.5.1
  Downloaded subtle v2.3.0
  Downloaded sha2 v0.9.1
  Downloaded synstructure v0.12.4
  Downloaded thiserror-impl v1.0.20
  Downloaded arrayvec v0.5.1
  Downloaded version_check v0.9.2
  Downloaded base64 v0.11.0
  Downloaded cfg-if v0.1.10
  Downloaded salsa20 v0.5.2
  Downloaded byteorder v1.3.4
  Downloaded ryu v1.0.2
  Downloaded unicode-xid v0.2.0
  Downloaded smallvec v1.4.2
  Downloaded xsalsa20poly1305 v0.4.2
  Downloaded thread_local v1.0.1
  Downloaded getrandom v0.1.15
  Downloaded lazy_static v1.4.0
  Downloaded memchr v2.3.0
  Downloaded neon-sys v0.5.1
  Downloaded ssb-crypto v0.2.1
  Downloaded ssb-keyfile v0.4.0
  Downloaded private-box v0.6.0
  Downloaded serde_json v1.0.45
  Downloaded rand v0.7.3
  Downloaded x25519-dalek v1.1.0
  Downloaded neon v0.5.1
  Downloaded regex-syntax v0.6.13
  Downloaded syn v1.0.41
  Downloaded regex v1.3.3
  Downloaded libc v0.2.66
  Downloaded zerocopy-derive v0.2.0
  Downloaded 67 crates (3.9 MB) in 4.63s
   Compiling proc-macro2 v1.0.21
   Compiling unicode-xid v0.2.0
   Compiling version_check v0.9.2
   Compiling typenum v1.12.0
   Compiling syn v1.0.41
   Compiling cfg-if v0.1.10
   Compiling memchr v2.3.0
   Compiling lazy_static v1.4.0
   Compiling libc v0.2.66
   Compiling regex-syntax v0.6.13
   Compiling subtle v2.3.0
   Compiling cc v1.0.50
   Compiling getrandom v0.1.15
   Compiling byteorder v1.3.4
   Compiling ppv-lite86 v0.2.9
   Compiling serde_derive v1.0.116
   Compiling signature v1.2.2
   Compiling cpuid-bool v0.1.2
   Compiling opaque-debug v0.3.0
   Compiling ryu v1.0.2
   Compiling serde v1.0.116
   Compiling base64 v0.12.3
   Compiling semver-parser v0.7.0
   Compiling itoa v0.4.5
   Compiling cslice v0.2.0
   Compiling smallvec v1.4.2
   Compiling base64 v0.11.0
   Compiling arrayvec v0.5.1
   Compiling neon-build v0.5.1
   Compiling thread_local v1.0.1
   Compiling generic-array v0.14.4
   Compiling ed25519 v1.0.2
   Compiling semver v0.9.0
   Compiling quote v1.0.2
   Compiling aho-corasick v0.7.6
   Compiling regex v1.3.3
   Compiling rand_core v0.5.1
   Compiling digest v0.9.0
   Compiling stream-cipher v0.4.1
   Compiling block-buffer v0.9.0
   Compiling universal-hash v0.4.0
   Compiling crypto-mac v0.9.1
   Compiling aead v0.3.2
   Compiling synstructure v0.12.4
   Compiling rand_chacha v0.2.2
   Compiling sha2 v0.9.1
   Compiling poly1305 v0.6.0
   Compiling hmac v0.9.0
   Compiling rand v0.7.3
   Compiling neon-sys v0.5.1
   Compiling zeroize_derive v1.0.1
   Compiling zerocopy-derive v0.2.0
   Compiling thiserror-impl v1.0.20
   Compiling zeroize v1.1.1
   Compiling neon-runtime v0.5.1
   Compiling curve25519-dalek v3.0.0
   Compiling salsa20 v0.5.2
   Compiling neon v0.5.1
   Compiling ssb-keys-neon v8.0.0 (/home/test/node_modules/ssb-keys-neon/native)
   Compiling ed25519-dalek v1.0.1
   Compiling x25519-dalek v1.1.0
   Compiling zerocopy v0.3.0
   Compiling xsalsa20poly1305 v0.4.2
   Compiling thiserror v1.0.20
   Compiling ssb-crypto v0.2.1
   Compiling private-box v0.6.0
   Compiling serde_json v1.0.45
   Compiling ssb-keyfile v0.4.0
    Finished release [optimized] target(s) in 4m 31s
neon info generating native/index.node
neon ERR! ENOENT: no such file or directory, copyfile '/home/test/node_modules/ssb-keys-neon/native/target/release/undefinedssb_neon_keysundefined' -> '/home/test/node_modules/ssb-keys-neon/native/index.node'

Error: ENOENT: no such file or directory, copyfile '/home/test/node_modules/ssb-keys-neon/native/target/release/undefinedssb_neon_keysundefined' -> '/home/test/node_modules/ssb-keys-neon/native/index.node'
npm WARN enoent ENOENT: no such file or directory, open '/home/test/package.json'
npm WARN [email protected] requires a peer of secret-stack@>=6.2.0 but none is installed. You must install peer dependencies yourself.
npm WARN test No description
npm WARN test No repository field.
npm WARN test No README data
npm WARN test No license field.

npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! [email protected] install: `neon-load-or-build`
npm ERR! Exit status 1
npm ERR! 
npm ERR! Failed at the [email protected] install script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/test/.npm/_logs/2020-11-06T07_51_13_664Z-debug.log

Cross compile?

• See Rustup cross compilation
• E.g. https://github.com/Terrahop/react-native-rust-demo#rust
• Read rust-cross https://github.com/japaric/rust-cross#cross-compiling-with-cargo
• But neon-bindings/rfcs#16

Error: No native build was found for platform=linux arch=x64 runtime=electron abi=85 uv=1 libc=glibc node=12.18.3 electron=11.2.1

Slightly different to #23 because it doesn't mention rebuilding it? Electron seems to launch correctly though.

Getting this in manyverse desktop when I tried to update to electron 11

> [email protected] electron /home/me/prj/ssb/manyverse/desktop/nodejs-project
> electron .

App threw an error during load
Error: No native build was found for platform=linux arch=x64 runtime=electron abi=85 uv=1 libc=glibc node=12.18.3 electron=11.2.1
    loaded from: /home/me/prj/ssb/manyverse/desktop/nodejs-project/node_modules/ssb-keys-neon

    at Function.SeIAA+v1biYg+xx+VMFvALJXYDOtGjIMIN+wmwqcARc=.load.path (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:47747:9)
    at load (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:47712:30)
    at Object.SA2A364X82V7Hc9sltQAMSM5AJ/s1AXFK9wKY8Lmu/Q= (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:46626:47)
    at load (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:14:8)
    at /home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:17:29
    at Object.ods4p4vuydn9swzsvmQ6C/RgGtgTL9B2E8ySD4OmAdc= (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:73084:17)
    at load (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:14:8)
    at /home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:17:29
    at Object.ceDFZ1vphrnsjkSFXVorvao4nv1qtzyPZ7Um5/ddwuA= (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:58766:5)
    at load (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:14:8)
A JavaScript error occurred in the main process
Uncaught Exception:
Error: No native build was found for platform=linux arch=x64 runtime=electron abi=85 uv=1 libc=glibc node=12.18.3 electron=11.2.1
    loaded from: /home/me/prj/ssb/manyverse/desktop/nodejs-project/node_modules/ssb-keys-neon

    at Function.SeIAA+v1biYg+xx+VMFvALJXYDOtGjIMIN+wmwqcARc=.load.path (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:47747:9)
    at load (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:47712:30)
    at Object.SA2A364X82V7Hc9sltQAMSM5AJ/s1AXFK9wKY8Lmu/Q= (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:46626:47)
    at load (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:14:8)
    at /home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:17:29
    at Object.ods4p4vuydn9swzsvmQ6C/RgGtgTL9B2E8ySD4OmAdc= (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:73084:17)
    at load (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:14:8)
    at /home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:17:29
    at Object.ceDFZ1vphrnsjkSFXVorvao4nv1qtzyPZ7Um5/ddwuA= (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:58766:5)
    at load (/home/me/prj/ssb/manyverse/desktop/nodejs-project/index.js:14:8)

Release 7.2.1

• implement ssbSecretKeyToPrivateBoxSecret
• release 7.2.1-x

Switch to libsodium

Dalek is really cool, and I would prefer it for performance, and for keeping things in one language (Rust), but I heard crypto libraries have to be triple checked for security, and Dalek being a young project, I don't see it being audited sufficiently.

ssb-crypto(-rs) allows switching to Libsodium as a togglable feature. We could switch back to Dalek once we have enough confidence and security audits.

---

That said, audits of Dalek's security:

• dalek-cryptography/curve25519-dalek#276
• dalek-cryptography/ed25519-dalek#100
• https://blog.quarkslab.com/security-audit-of-dalek-libraries.html

Make CI workflow D-R-Y

The setup part with git checkout, Node installation, Rust installation, could be generalized into one action file in .github/actions/setup.yml. This action would need some inputs: (1) node version, (2) os version (see #4), etc.

Replacer branches

We should make it possible for people to download this package to replace ssb-keys, like this in package.json

 "dependencies": {
-  "ssb-keys": "7.2.0",
+  "ssb-keys": "staltz/ssb-neon-keys#replace-7.2.0",

The package.json > name should be ssb-keys because that's necessary to make the replacement above work when npm install happens, but because of the install script that runs node-pre-gyp, we have to maintain some metadata in order to fetch the .tar files from GitHub releases.

• replacer branch to test if this works
• replace-X.Y.Z branch
• Fetch prebuilds from the npm package and put it in git
• Use CI to automatically create branch replace-X.Y.Z

Improve CI workflow

See this example https://github.com/hyperdivision/rabin-native/blob/master/.github/workflows/build-release.yml