BirdNet-Behavior v0.18.1

Fixed

• The container image is built from a release tag again. The image workflow checks
  that a tag is on main before it publishes anything, and its checkout asked for the full
  history with fetch-depth: ${{ startsWith(github.ref, 'refs/tags/') && 0 || 1 }}. In a
  GitHub expression 0 is falsy, so that is always 1: the checkout was shallow, there was
  no origin/main to look at, and the check refused the tag within seconds. It is the first
  tag push the check has seen, so 0.18.0 has no container image and this release is the first
  since 0.17.1 to ask for one. The checkout is now fetch-depth: 0, and
  scripts/check-ci-config.py refuses that shape in any workflow expression.
• One mutant in the duplicate-detection gate was uncovered. Every test of
  DuplicateGate::is_enabled asserted that it was false, so a body of false passed them
  all; a test now asserts it is true for a positive interval. No behaviour changed.

Changed

• CI budgets for the mutation shards that crossed the 75% line on main's latest runs:
  civil.rs 85 → 100 minutes, inference/model.rs 45 → 60, validate.rs 45 → 50.

---

Installation

One-line installer (Raspberry Pi / bare-metal Linux)

curl --proto '=https' --tlsv1.2 -fsSL https://github.com/tomtom215/BirdNet-Behavior/releases/download/v0.18.1/install.sh | sudo bash -s -- --version 0.18.1

Run it as root via the pipe above. Do not use sudo bash <(curl ...) — sudo
closes the process-substitution file descriptor, so the script never loads.

Download a binary directly

Target	Platform
aarch64-unknown-linux-gnu	Raspberry Pi 4 / 5, ARM64 Linux
x86_64-unknown-linux-gnu	Standard 64-bit Linux
aarch64-apple-darwin	Apple Silicon Mac (no sudo)

Archives are gzipped tarballs containing the stripped binary,
README.md, CHANGELOG.md, LICENSE, LICENSE-UPSTREAM, NOTICE,
THIRD_PARTY_LICENSES.txt, install.sh, and a help/ directory with the rendered operator
manual (served offline at /help). Each binary ships the DuckDB
behavioral-analytics engine built in; install.sh enables it by
default (for a manual run, pass --analytics-db).

Runtime requirement: glibc 2.39 or newer — Raspberry Pi OS
Trixie, Debian 13, or Ubuntu 24.04. Pi OS Bookworm
(glibc 2.36) is not supported by the native binary: run the
Docker image instead (it bundles its own runtime) or upgrade to
Trixie. There is no 32-bit (armv7) binary — use the 64-bit Pi OS.

Model

The BirdNET+ V3.0 model (~541 MB) is not bundled in the archive.
On first run, install.sh and the Docker image fetch it
(sha256-verified) from the shared, arch-independent model release
https://github.com/tomtom215/BirdNet-Behavior/releases/tag/models-v3.0-preview3
— the same GitHub origin as the binary — falling back to Zenodo
(the upstream source) if that asset is unavailable. The install is
offline-capable after that one fetch.

Docker

docker pull ghcr.io/tomtom215/birdnet-behavior:0.18.1

The image includes DuckDB analytics (no separate -analytics tag).
Multi-arch manifests cover linux/amd64 and linux/arm64.

Documentation

The operator manual for exactly this version, built from this tag:
https://tomtom215.github.io/BirdNet-Behavior/v0.18.1/

The binary serves the same manual offline at /help.

Verification

Checksums

sha256sum -c SHA256SUMS --ignore-missing

SLSA build provenance

Every release archive carries a signed SLSA build provenance
attestation produced by this workflow run. Verify it with the GitHub CLI:

gh attestation verify \
  --repo tomtom215/BirdNet-Behavior \
  birdnet-behavior-0.18.1-aarch64-unknown-linux-gnu.tar.gz

Software Bill of Materials (CycloneDX)

A CycloneDX 1.5 SBOM for the full workspace is attached as a
release asset in both JSON and XML formats:

• birdnet-behavior-0.18.1-sbom.cdx.json
• birdnet-behavior-0.18.1-sbom.cdx.xml

Consumers can ingest these into Dependency-Track, GitHub
Dependency Graph, or any CycloneDX-aware vulnerability
scanner. Both files are signed by the same SLSA build
provenance attestation as the binaries.