-
Notifications
You must be signed in to change notification settings - Fork 338
/
build.sh
executable file
·395 lines (336 loc) · 13.1 KB
/
build.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
#!/usr/bin/env bash
# This script is used to build, and optionally sign the app.
# See `README.md` for further instructions.
set -eu
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
cd "$SCRIPT_DIR"
source scripts/utils/host
source scripts/utils/log
################################################################################
# Analyze environment and parse arguments
################################################################################
RUSTC_VERSION=$(rustc --version)
CARGO_TARGET_DIR=${CARGO_TARGET_DIR:-"target"}
echo "Computing build version..."
PRODUCT_VERSION=$(cargo run -q --bin mullvad-version)
log_header "Building Mullvad VPN $PRODUCT_VERSION"
# If compiler optimization and artifact compression should be turned on or not
OPTIMIZE="false"
# If the produced binaries should be signed (Windows + macOS only)
SIGN="false"
# If the produced app and pkg should be notarized by apple (macOS only)
NOTARIZE="false"
# If a macOS build should create an installer artifact working on both
# Intel and Apple Silicon Macs
UNIVERSAL="false"
while [[ "$#" -gt 0 ]]; do
case $1 in
--optimize) OPTIMIZE="true";;
--sign) SIGN="true";;
--notarize) NOTARIZE="true";;
--universal)
if [[ "$(uname -s)" != "Darwin" ]]; then
log_error "--universal only works on macOS"
exit 1
fi
UNIVERSAL="true"
;;
*)
log_error "Unknown parameter: $1"
exit 1
;;
esac
shift
done
# Check if we are a building a release. Meaning we are configured to build with optimizations,
# sign the artifacts, AND we are currently building on a release git tag.
# Everything that is not a release build is called a "dev build" and has "-dev-{commit hash}"
# appended to the version name.
IS_RELEASE="false"
if [[ "$SIGN" == "true" && "$OPTIMIZE" == "true" && "$PRODUCT_VERSION" != *"-dev-"* ]]; then
IS_RELEASE="true"
fi
################################################################################
# Configure build
################################################################################
CARGO_ARGS=()
NPM_PACK_ARGS=()
if [[ -n ${TARGETS:-""} ]]; then
NPM_PACK_ARGS+=(--targets "${TARGETS[*]}")
fi
NPM_PACK_ARGS+=(--host-target-triple "$HOST")
if [[ "$UNIVERSAL" == "true" ]]; then
if [[ -n ${TARGETS:-""} ]]; then
log_error "'TARGETS' and '--universal' cannot be specified simultaneously."
exit 1
else
log_info "Building universal macOS distribution"
fi
# Universal macOS builds package targets for both aarch64-apple-darwin and x86_64-apple-darwin.
# We leave the target corresponding to the host machine empty to avoid rebuilding multiple times.
# When the --target flag is provided to cargo it always puts the build in the target/$ENV_TARGET
# folder even when it matches you local machine, as opposed to just the target folder.
# This causes the cached build not to get used when later running e.g.
# 'cargo run --bin mullvad --shell-completions'.
case $HOST in
x86_64-apple-darwin) TARGETS=("" aarch64-apple-darwin);;
aarch64-apple-darwin) TARGETS=("" x86_64-apple-darwin);;
esac
NPM_PACK_ARGS+=(--universal)
fi
if [[ "$OPTIMIZE" == "true" ]]; then
CARGO_ARGS+=(--release)
RUST_BUILD_MODE="release"
CPP_BUILD_MODE="Release"
NPM_PACK_ARGS+=(--release)
else
RUST_BUILD_MODE="debug"
NPM_PACK_ARGS+=(--no-compression)
CPP_BUILD_MODE="Debug"
fi
if [[ "$SIGN" == "true" ]]; then
if [[ $(git diff --shortstat 2> /dev/null | tail -n1) != "" ]]; then
log_error "Dirty working directory!"
log_error "Will only build a signed app in a clean working directory"
exit 1
fi
if [[ "$(uname -s)" == "Darwin" ]]; then
log_info "Configuring environment for signing of binaries"
if [[ -z ${CSC_LINK-} ]]; then
log_error "The variable CSC_LINK is not set. It needs to point to a file containing the"
log_error "private key used for signing of binaries."
exit 1
fi
if [[ -z ${CSC_KEY_PASSWORD-} ]]; then
read -rsp "CSC_KEY_PASSWORD = " CSC_KEY_PASSWORD
echo ""
export CSC_KEY_PASSWORD
fi
# macOS: This needs to be set to 'true' to activate signing, even when CSC_LINK is set.
export CSC_IDENTITY_AUTO_DISCOVERY=true
elif [[ "$(uname -s)" == "MINGW"* ]]; then
if [[ -z ${CERT_HASH-} ]]; then
log_error "The variable CERT_HASH is not set. It needs to be set to the thumbprint of"
log_error "the signing certificate."
exit 1
fi
unset CSC_LINK CSC_KEY_PASSWORD
export CSC_IDENTITY_AUTO_DISCOVERY=false
else
unset CSC_LINK CSC_KEY_PASSWORD
export CSC_IDENTITY_AUTO_DISCOVERY=false
fi
else
log_info "!! Unsigned build. Not for general distribution !!"
unset CSC_LINK CSC_KEY_PASSWORD
export CSC_IDENTITY_AUTO_DISCOVERY=false
fi
if [[ "$NOTARIZE" == "true" ]]; then
NPM_PACK_ARGS+=(--notarize)
fi
if [[ "$IS_RELEASE" == "true" ]]; then
log_info "Removing old Rust build artifacts..."
cargo clean
# Will not allow an outdated lockfile in releases
CARGO_ARGS+=(--locked)
else
# Allow dev builds to override which API server to use at runtime.
CARGO_ARGS+=(--features api-override)
fi
# Make Windows builds include a manifest in the daemon binary declaring it must
# be run as admin.
if [[ "$(uname -s)" == "MINGW"* ]]; then
export MULLVAD_ADD_MANIFEST="1"
fi
################################################################################
# Compile and build
################################################################################
# Sign all binaries passed as arguments to this function
function sign_win {
local NUM_RETRIES=3
for binary in "$@"; do
# Try multiple times in case the timestamp server cannot
# be contacted.
for i in $(seq 0 ${NUM_RETRIES}); do
log_info "Signing $binary..."
if signtool sign \
-tr http://timestamp.digicert.com -td sha256 \
-fd sha256 -d "Mullvad VPN" \
-du "https://github.com/mullvad/mullvadvpn-app#readme" \
-sha1 "$CERT_HASH" "$binary"
then
break
fi
if [ "$i" -eq "${NUM_RETRIES}" ]; then
return 1
fi
sleep 1
done
done
return 0
}
# Build the daemon and other Rust/C++ binaries, optionally
# sign them, and copy to `dist-assets/`.
function build {
local current_target=${1:-""}
local for_target_string=" for local target $HOST"
if [[ -n $current_target ]]; then
for_target_string=" for $current_target"
fi
################################################################################
# Compile and link all binaries.
################################################################################
log_header "Building Rust code in $RUST_BUILD_MODE mode using $RUSTC_VERSION$for_target_string"
local cargo_target_arg=()
if [[ -n $current_target ]]; then
cargo_target_arg+=(--target="$current_target")
fi
local cargo_crates_to_build=(
-p mullvad-daemon --bin mullvad-daemon
-p mullvad-cli --bin mullvad
-p mullvad-setup --bin mullvad-setup
-p mullvad-problem-report --bin mullvad-problem-report
-p talpid-openvpn-plugin --lib
)
if [[ ("$(uname -s)" == "Linux") ]]; then
cargo_crates_to_build+=(-p mullvad-exclude --bin mullvad-exclude)
fi
cargo build "${cargo_target_arg[@]}" "${CARGO_ARGS[@]}" "${cargo_crates_to_build[@]}"
################################################################################
# Move binaries to correct locations in dist-assets
################################################################################
# All the binaries produced by cargo that we want to include in the app
if [[ ("$(uname -s)" == "Darwin") ]]; then
BINARIES=(
mullvad-daemon
mullvad
mullvad-problem-report
libtalpid_openvpn_plugin.dylib
mullvad-setup
)
elif [[ ("$(uname -s)" == "Linux") ]]; then
BINARIES=(
mullvad-daemon
mullvad
mullvad-problem-report
libtalpid_openvpn_plugin.so
mullvad-setup
mullvad-exclude
)
elif [[ ("$(uname -s)" == "MINGW"*) ]]; then
BINARIES=(
mullvad-daemon.exe
mullvad.exe
mullvad-problem-report.exe
talpid_openvpn_plugin.dll
mullvad-setup.exe
)
fi
if [[ -n $current_target ]]; then
local cargo_output_dir="$CARGO_TARGET_DIR/$current_target/$RUST_BUILD_MODE"
# To make it easier to package multiple targets, the binaries are
# located in a directory with the name of the target triple.
local destination_dir="dist-assets/$current_target"
mkdir -p "$destination_dir"
else
local cargo_output_dir="$CARGO_TARGET_DIR/$RUST_BUILD_MODE"
local destination_dir="dist-assets"
fi
for binary in "${BINARIES[@]}"; do
local source="$cargo_output_dir/$binary"
local destination="$destination_dir/$binary"
log_info "Copying $source => $destination"
cp "$source" "$destination"
if [[ "$SIGN" == "true" && "$(uname -s)" == "MINGW"* ]]; then
sign_win "$destination"
fi
done
if [[ "$current_target" == "aarch64-pc-windows-msvc" ]]; then
# TODO: We still ship x64 OpenVPN with ARM64, so we need an x64 talpid-openvpn-plugin
# to include in the package.
log_info "Workaround: building x64 talpid-openvpn-plugin"
cargo build --target x86_64-pc-windows-msvc "${CARGO_ARGS[@]}" -p talpid-openvpn-plugin --lib
cp "$CARGO_TARGET_DIR/x86_64-pc-windows-msvc/$RUST_BUILD_MODE/talpid_openvpn_plugin.dll" "dist-assets/aarch64-pc-windows-msvc/talpid_openvpn_plugin.dll"
if [[ "$SIGN" == "true" ]]; then
sign_win "dist-assets/talpid_openvpn_plugin.dll"
fi
fi
}
if [[ "$(uname -s)" == "MINGW"* ]]; then
for t in "${TARGETS[@]:-"x86_64-pc-windows-msvc"}"; do
case $t in
x86_64-pc-windows-msvc) CPP_BUILD_TARGET=x64;;
aarch64-pc-windows-msvc) CPP_BUILD_TARGET=ARM64;;
*)
log_error "Unknown Windows target: $t"
exit 1
;;
esac
log_header "Building C++ code in $CPP_BUILD_MODE mode for $CPP_BUILD_TARGET"
CPP_BUILD_MODES=$CPP_BUILD_MODE CPP_BUILD_TARGETS=$CPP_BUILD_TARGET IS_RELEASE=$IS_RELEASE ./build-windows-modules.sh
if [[ "$SIGN" == "true" ]]; then
CPP_BINARIES=(
"windows/winfw/bin/$CPP_BUILD_TARGET-$CPP_BUILD_MODE/winfw.dll"
"windows/driverlogic/bin/$CPP_BUILD_TARGET-$CPP_BUILD_MODE/driverlogic.exe"
# The nsis plugin is always built in 32 bit release mode
windows/nsis-plugins/bin/Win32-Release/*.dll
)
sign_win "${CPP_BINARIES[@]}"
fi
done
fi
for t in "${TARGETS[@]:-""}"; do
source env.sh "$t"
build "$t"
done
################################################################################
# Package app.
################################################################################
log_header "Preparing for packaging Mullvad VPN $PRODUCT_VERSION"
if [[ "$(uname -s)" == "Darwin" || "$(uname -s)" == "Linux" ]]; then
mkdir -p "build/shell-completions"
for sh in bash zsh fish; do
log_info "Generating shell completion script for $sh..."
cargo run --bin mullvad "${CARGO_ARGS[@]}" -- shell-completions "$sh" \
"build/shell-completions/"
done
else
mkdir -p "build"
fi
log_info "Updating relays.json..."
cargo run --bin relay_list "${CARGO_ARGS[@]}" > build/relays.json
log_header "Installing JavaScript dependencies"
pushd gui
npm ci
log_header "Packing Mullvad VPN $PRODUCT_VERSION artifact(s)"
case "$(uname -s)" in
Linux*) npm run pack:linux -- "${NPM_PACK_ARGS[@]}";;
Darwin*) npm run pack:mac -- "${NPM_PACK_ARGS[@]}";;
MINGW*) npm run pack:win -- "${NPM_PACK_ARGS[@]}";;
esac
popd
# sign installer on Windows
if [[ "$SIGN" == "true" && "$(uname -s)" == "MINGW"* ]]; then
for installer_path in dist/*"$PRODUCT_VERSION"*.exe; do
log_info "Signing $installer_path"
sign_win "$installer_path"
done
fi
# notarize installer on macOS
if [[ "$NOTARIZE" == "true" && "$(uname -s)" == "Darwin" ]]; then
log_info "Notarizing pkg"
xcrun notarytool submit dist/*"$PRODUCT_VERSION"*.pkg \
--keychain "$NOTARIZE_KEYCHAIN" \
--keychain-profile "$NOTARIZE_KEYCHAIN_PROFILE" \
--wait
log_info "Stapling pkg"
xcrun stapler staple dist/*"$PRODUCT_VERSION"*.pkg
fi
log_success "**********************************"
log_success ""
log_success " The build finished successfully! "
log_success " You have built:"
log_success ""
log_success " $PRODUCT_VERSION"
log_success ""
log_success "**********************************"