feat: add static binary releases for linux/amd64 and arm64 (#65)

GitHub Actions workflow builds musl-static binaries on tag push,
uploads them as release assets with SHA256 checksums.

Author: dvershinin

.github/workflows/release.yml

@@ -0,0 +1,73 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+          - arch: arm64
+            platform: linux/arm64
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up QEMU
+        if: matrix.arch == 'arm64'
+        uses: docker/setup-qemu-action@v3
+
+      - name: Build static binary
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          docker run --rm --platform ${{ matrix.platform }} \
+            -v "$PWD:/src" -w /src alpine:3.21 sh -c "
+              apk add --no-cache build-base openssl-dev openssl-libs-static zlib-dev zlib-static linux-headers git
+              git config --global --add safe.directory /src
+              make clean
+              make -j\$(nproc) EXTRA_VERSION=${VERSION} EXTRA_LDFLAGS='-static'
+            "
+
+      - name: Verify static linking
+        run: |
+          file objs/bin/mtproto-proxy | tee /dev/stderr | grep -q "statically linked"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: mtproto-proxy-linux-${{ matrix.arch }}
+          path: objs/bin/mtproto-proxy
+
+  release:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: Prepare release assets
+        run: |
+          mkdir -p release
+          cp artifacts/mtproto-proxy-linux-amd64/mtproto-proxy release/mtproto-proxy-linux-amd64
+          cp artifacts/mtproto-proxy-linux-arm64/mtproto-proxy release/mtproto-proxy-linux-arm64
+          chmod +x release/mtproto-proxy-linux-*
+          cd release
+          sha256sum mtproto-proxy-linux-* > SHA256SUMS
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: release/*
+          generate_release_notes: true

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file.
 
+## [3.3.0] - 2026-03-27
+
+### Added
+- **Static binary releases** — pre-built `mtproto-proxy` binaries for Linux amd64 and arm64, statically linked against musl libc. Zero dependencies — download and run ([#65](https://github.com/GetPageSpeed/MTProxy/issues/65))
+- **Secret labels** — name your secrets with `label:hex` syntax for human-readable per-secret metrics in Prometheus (`mtproxy_secret_connections{label="office"}`) and stats endpoint ([#60](https://github.com/GetPageSpeed/MTProxy/issues/60))
+- CI: AddressSanitizer (ASan) job catches heap overflows and use-after-free at build time
+- CI: direct-mode E2E tests with real Telethon session (`get_me()` through proxy)
+
+### Fixed
+- Direct mode: client transport tag (e.g. `0xdddddddd`) now correctly propagated to DC obfuscated2 init — previously hardcoded, breaking all direct-mode connections ([#64](https://github.com/GetPageSpeed/MTProxy/issues/64))
+- Direct mode: obfuscated2 init to DC written as raw bytes to post-crypto buffer, preventing double encryption
+
 ## [3.2.0] - 2026-03-25
 
 ### Added

README.md

@@ -50,6 +50,7 @@ The table below compares it with the original and the two main third-party alter
 | ARM64 / Apple Silicon | No | Yes | Yes | Yes |
 | IPv6 | Yes | Yes | Yes | Yes |
 | Multi-worker processes | Yes | Yes | — | — |
+| Static binary releases | No | Yes | Yes | Yes |
 | RPM packages | No | Yes | No | No |
 | Systemd integration | Partial | Yes | — | Yes |
 | ***Monitoring & management*** | | | | |
@@ -80,6 +81,24 @@ This includes:
 - Firewall configuration
 - Fake TLS setup instructions
 
+### Static Binary (Any Linux)
+
+Pre-built static binaries (musl libc, zero dependencies) are available for every [release](https://github.com/GetPageSpeed/MTProxy/releases):
+
+```bash
+# Download (choose amd64 or arm64)
+curl -Lo mtproto-proxy https://github.com/GetPageSpeed/MTProxy/releases/latest/download/mtproto-proxy-linux-amd64
+chmod +x mtproto-proxy
+
+# Generate a secret
+SECRET=$(head -c 16 /dev/urandom | xxd -ps)
+
+# Run in direct mode (simplest — no config files needed)
+./mtproto-proxy -S "$SECRET" -H 443 --direct -p 8888 --aes-pwd /dev/null
+```
+
+Binaries are available for `linux/amd64` and `linux/arm64`. SHA256 checksums are published alongside each release.
+
 ### Manual Build (Advanced)