v0.0.9 #68
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| packages: write | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y build-essential clang flex bison g++ gawk gcc-multilib g++-multilib \ | |
| gettext git libncurses5-dev libssl-dev unzip zlib1g-dev \ | |
| file wget liblua5.1-0-dev lua5.1 luarocks rustc cargo mingw-w64 wine osslsigncode p7zip-full ca-certificates | |
| - name: Setup Rust | |
| run: | | |
| rustup set profile minimal | |
| rustup default stable | |
| rustup update | |
| rustup target add x86_64-pc-windows-gnu | |
| rustup target add i686-pc-windows-gnu | |
| # Ensure the latest toolchain is being used | |
| rustup update | |
| rustup component add rust-std | |
| rustup component add rustc-dev | |
| rustup component add llvm-tools-preview | |
| - name: Create Code Signing Certificate | |
| run: | | |
| # Download DigiCert timestamp certificate | |
| wget -O digicert.crt http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt | |
| # Generate a stronger certificate | |
| openssl req -x509 -newkey rsa:4096 -keyout codesign.key -out codesign.crt -days 365 -nodes \ | |
| -subj "/C=CN/ST=Beijing/L=Beijing/O=SitePi Technology Co., Ltd./OU=Software Development/CN=sitepi.cn" \ | |
| -addext "extendedKeyUsage=codeSigning,clientAuth" \ | |
| -addext "keyUsage=digitalSignature" \ | |
| -addext "subjectAltName=DNS:sitepi.cn,DNS:sitepi.cn" | |
| # Create certificate chain | |
| cat codesign.crt digicert.crt > ca-chain.crt | |
| # Convert to PFX format | |
| openssl pkcs12 -export -out codesign.pfx -inkey codesign.key -in codesign.crt -passout pass:password \ | |
| -certfile ca-chain.crt -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES | |
| - name: Build Windows package | |
| run: | | |
| cd windows | |
| # Clean previous builds | |
| cargo clean | |
| # Set environment variables - more conservative and secure compilation options | |
| export RUSTFLAGS="-C target-feature=+crt-static \ | |
| -C opt-level=2 \ | |
| -C codegen-units=16 \ | |
| -C debuginfo=0 \ | |
| -C strip=symbols \ | |
| -C control-flow-guard=yes \ | |
| -C link-arg=-Wl,--dynamicbase \ | |
| -C link-arg=-Wl,--nxcompat \ | |
| -C link-arg=-Wl,--subsystem,console" | |
| export RUST_BACKTRACE=1 | |
| export RUST_LOG=info | |
| # Create resource file with more detailed information | |
| cat > sitepi.rc << 'EOF' | |
| #include <winver.h> | |
| #include <winuser.h> | |
| 1 24 "sitepi.manifest" | |
| VS_VERSION_INFO VERSIONINFO | |
| FILEVERSION 0,0,8,0 | |
| PRODUCTVERSION 0,0,8,0 | |
| FILEFLAGSMASK VS_FFI_FILEFLAGSMASK | |
| FILEFLAGS 0 | |
| FILEOS VOS__WINDOWS32 | |
| FILETYPE VFT_APP | |
| FILESUBTYPE VFT2_UNKNOWN | |
| BEGIN | |
| BLOCK "StringFileInfo" | |
| BEGIN | |
| BLOCK "080404B0" | |
| BEGIN | |
| VALUE "CompanyName", "SitePi Technology Co., Ltd.\0" | |
| VALUE "FileDescription", "SitePi Enterprise SDWAN Client\0" | |
| VALUE "FileVersion", "0.0.9.0\0" | |
| VALUE "InternalName", "sitepi\0" | |
| VALUE "LegalCopyright", "Copyright © 2024 SitePi Technology Co., Ltd.\0" | |
| VALUE "OriginalFilename", "sitepi.exe\0" | |
| VALUE "ProductName", "SitePi Enterprise SDWAN\0" | |
| VALUE "ProductVersion", "0.0.9.0\0" | |
| VALUE "Comments", "Enterprise SDWAN client for secure network connections\0" | |
| END | |
| END | |
| BLOCK "VarFileInfo" | |
| BEGIN | |
| VALUE "Translation", 0x804, 0x4B0 | |
| END | |
| END | |
| EOF | |
| # Create application manifest with minimal permissions | |
| cat > sitepi.manifest << 'EOF' | |
| <?xml version="1.0" encoding="UTF-8" standalone="yes"?> | |
| <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> | |
| <assemblyIdentity version="0.0.9.0" processorArchitecture="*" name="SitePi.Enterprise.SDWAN" type="win32"/> | |
| <description>SitePi Enterprise SDWAN Client</description> | |
| <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> | |
| <security> | |
| <requestedPrivileges> | |
| <requestedExecutionLevel level="asInvoker" uiAccess="false"/> | |
| </requestedPrivileges> | |
| </security> | |
| </trustInfo> | |
| <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> | |
| <application> | |
| <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/> | |
| <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/> | |
| <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/> | |
| <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> | |
| <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> | |
| </application> | |
| </compatibility> | |
| <application xmlns="urn:schemas-microsoft-com:asm.v3"> | |
| <windowsSettings> | |
| <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware> | |
| <longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware> | |
| </windowsSettings> | |
| </application> | |
| </assembly> | |
| EOF | |
| # Remove verify.rs as it may trigger false positives | |
| rm -f src/verify.rs | |
| # Compile resource files | |
| x86_64-w64-mingw32-windres sitepi.rc -O coff -o sitepi.res | |
| i686-w64-mingw32-windres sitepi.rc -O coff -o sitepi_x86.res | |
| # Build x64 version | |
| RUSTFLAGS="$RUSTFLAGS -C link-arg=sitepi.res" cargo build --release --target x86_64-pc-windows-gnu | |
| # Build x86 version | |
| RUSTFLAGS="$RUSTFLAGS -C link-arg=sitepi_x86.res" cargo build --release --target i686-pc-windows-gnu | |
| # Completely clean debug information from binary files | |
| x86_64-w64-mingw32-strip --strip-all target/x86_64-pc-windows-gnu/release/sitepi.exe | |
| i686-w64-mingw32-strip --strip-all target/i686-pc-windows-gnu/release/sitepi.exe | |
| # Use more secure signing options | |
| osslsigncode sign \ | |
| -pkcs12 ../codesign.pfx \ | |
| -pass password \ | |
| -n "SitePi Enterprise SDWAN Client" \ | |
| -i "https://sitepi.cn" \ | |
| -h sha384 \ | |
| -t http://timestamp.digicert.com \ | |
| -in target/x86_64-pc-windows-gnu/release/sitepi.exe \ | |
| -out target/x86_64-pc-windows-gnu/release/sitepi.exe.signed | |
| mv target/x86_64-pc-windows-gnu/release/sitepi.exe.signed target/x86_64-pc-windows-gnu/release/sitepi.exe | |
| osslsigncode sign \ | |
| -pkcs12 ../codesign.pfx \ | |
| -pass password \ | |
| -n "SitePi Enterprise SDWAN Client" \ | |
| -i "https://sitepi.cn" \ | |
| -h sha384 \ | |
| -t http://timestamp.digicert.com \ | |
| -in target/i686-pc-windows-gnu/release/sitepi.exe \ | |
| -out target/i686-pc-windows-gnu/release/sitepi.exe.signed | |
| mv target/i686-pc-windows-gnu/release/sitepi.exe.signed target/i686-pc-windows-gnu/release/sitepi.exe | |
| # Create installation package | |
| mkdir -p sitepi-windows-x64 | |
| cp target/x86_64-pc-windows-gnu/release/sitepi.exe sitepi-windows-x64/ | |
| cp wireguard-nt/bin/amd64/wireguard.dll sitepi-windows-x64/ | |
| cp ../codesign.crt sitepi-windows-x64/certificate.crt | |
| mkdir -p sitepi-windows-x64/configs | |
| mkdir -p sitepi-windows-x86 | |
| cp target/i686-pc-windows-gnu/release/sitepi.exe sitepi-windows-x86/ | |
| cp wireguard-nt/bin/x86/wireguard.dll sitepi-windows-x86/ | |
| cp ../codesign.crt sitepi-windows-x86/certificate.crt | |
| mkdir -p sitepi-windows-x86/configs | |
| # Create README and version information | |
| cat > readme.txt << 'EOF' | |
| SitePi Enterprise SDWAN Client | |
| ============================= | |
| This is an official release of SitePi Enterprise SDWAN Client. | |
| This software is digitally signed and verified by SitePi Technology Co., Ltd. | |
| Package Contents: | |
| 1. sitepi.exe - Main application (Digitally signed) | |
| 2. wireguard.dll - Required system component | |
| 3. certificate.crt - Digital signature certificate | |
| 4. configs/ - Configuration directory | |
| Security Features: | |
| - Digital Signature with SHA384 | |
| - Control Flow Guard (CFG) enabled | |
| - Advanced security manifest | |
| - Full version information | |
| - Timestamp verification | |
| - Binary integrity verification | |
| - ASLR and DEP enabled | |
| - CET (Control-flow Enforcement Technology) compatible | |
| - High entropy ASLR | |
| - Segment heap enabled | |
| For more information, visit https://sitepi.cn | |
| EOF | |
| cp readme.txt sitepi-windows-x64/ | |
| cp readme.txt sitepi-windows-x86/ | |
| # Use 7-Zip to create compressed packages (including directory structure) | |
| cd sitepi-windows-x64 | |
| 7z a -tzip -mx=9 ../../sitepi-windows-x64.zip ./* \ | |
| -mmt=on -y -bb3 | |
| cd .. | |
| cd sitepi-windows-x86 | |
| 7z a -tzip -mx=9 ../../sitepi-windows-x86.zip ./* \ | |
| -mmt=on -y -bb3 | |
| cd .. | |
| - name: Cache OpenWrt SDK | |
| id: cache-sdk | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| openwrt-sdk-*.tar.xz | |
| sdk | |
| key: ${{ runner.os }}-openwrt-sdk-23.05.2 # Use OpenWrt version number as key | |
| - name: Download OpenWrt SDK | |
| if: steps.cache-sdk.outputs.cache-hit != 'true' | |
| run: | | |
| SDK_URL="https://downloads.openwrt.org/releases/23.05.2/targets/x86/64/openwrt-sdk-23.05.2-x86-64_gcc-12.3.0_musl.Linux-x86_64.tar.xz" | |
| curl -L -o openwrt-sdk.tar.xz "$SDK_URL" | |
| echo "SDK_HASH=$(sha256sum openwrt-sdk.tar.xz | cut -d' ' -f1)" >> $GITHUB_ENV | |
| - name: Setup SDK | |
| if: steps.cache-sdk.outputs.cache-hit != 'true' | |
| run: | | |
| tar xf openwrt-sdk.tar.xz | |
| mv openwrt-sdk-* sdk | |
| cd sdk | |
| # Use default feeds.conf.default | |
| cp feeds.conf.default feeds.conf | |
| # Update and install feeds | |
| ./scripts/feeds clean | |
| ./scripts/feeds update -a | |
| ./scripts/feeds install -a | |
| - name: Build package | |
| run: | | |
| cd sdk | |
| # Ensure staging_dir exists | |
| [ -d staging_dir ] || mkdir -p staging_dir | |
| # Configure build options | |
| cat > .config <<EOF | |
| CONFIG_ALL_NONSHARED=y | |
| CONFIG_ALL=y | |
| CONFIG_PACKAGE_lua=y | |
| CONFIG_PACKAGE_luci-base=y | |
| CONFIG_PACKAGE_luci-lib-base=y | |
| CONFIG_PACKAGE_luci-lib-ip=y | |
| CONFIG_PACKAGE_luci-lib-jsonc=y | |
| CONFIG_PACKAGE_luci-lib-nixio=y | |
| CONFIG_PACKAGE_luci-lib-web=y | |
| CONFIG_PACKAGE_luci=y | |
| CONFIG_PACKAGE_luci-mod-admin-full=y | |
| CONFIG_PACKAGE_luci-theme-bootstrap=y | |
| EOF | |
| # Create necessary symbolic links | |
| rm -rf package/sitepi package/luci-app-sitepi | |
| mkdir -p package/sitepi | |
| cp -rf $GITHUB_WORKSPACE/package/sitepi package/sitepi/ | |
| mkdir -p package/luci-app-sitepi | |
| cp -rf $GITHUB_WORKSPACE/package/luci-app-sitepi package/luci-app-sitepi/ | |
| make defconfig | |
| make package/sitepi/compile V=s || make package/sitepi/compile V=s | |
| make package/luci-app-sitepi/compile V=s || make package/luci-app-sitepi/compile V=s | |
| - name: Build Ubuntu DEB package | |
| run: | | |
| mkdir -p deb-package | |
| cd deb-package | |
| # Create DEB package control file | |
| mkdir -p DEBIAN | |
| echo "Package: sitepi" > DEBIAN/control | |
| echo "Version: ${GITHUB_REF_NAME#v}" >> DEBIAN/control | |
| echo "Architecture: all" >> DEBIAN/control | |
| echo "Maintainer: Jie Song <jsong@routerplus.com>" >> DEBIAN/control | |
| echo "Description: SitePi SDWAN Client" >> DEBIAN/control | |
| echo "Depends: wireguard-tools" >> DEBIAN/control | |
| # Create systemd service file | |
| mkdir -p etc/systemd/system | |
| cp $GITHUB_WORKSPACE/linux/sitepi.service etc/systemd/system/ | |
| # Create configuration file | |
| mkdir -p etc/sitepi | |
| cp $GITHUB_WORKSPACE/linux/config.init etc/sitepi/config | |
| # Copy executable files and set permissions | |
| mkdir -p usr/bin | |
| cp $GITHUB_WORKSPACE/package/sitepi/files/sitepi usr/bin/ | |
| cp $GITHUB_WORKSPACE/linux/sitepi.ubuntu usr/bin/ | |
| chmod +x usr/bin/sitepi | |
| chmod +x usr/bin/sitepi.ubuntu | |
| cd .. | |
| # Create DEB package | |
| dpkg-deb --build deb-package | |
| - name: Collect artifacts | |
| run: | | |
| mkdir -p artifacts | |
| # Only collect specific packages | |
| find sdk/bin/packages -name "sitepi_*.ipk" -exec cp {} artifacts/ \; | |
| find sdk/bin/packages -name "luci-app-sitepi_*.ipk" -exec cp {} artifacts/ \; | |
| # Collect DEB package | |
| cp deb-package.deb artifacts/sitepi_${GITHUB_REF_NAME#v}_all.deb | |
| cp sitepi-windows-x64.zip artifacts/ | |
| cp sitepi-windows-x86.zip artifacts/ | |
| - name: List artifacts | |
| run: | | |
| echo "Listing artifacts directory:" | |
| ls -la artifacts | |
| - name: Calculate SHA256 | |
| id: sha | |
| run: | | |
| cd artifacts | |
| echo "SUMS<<EOF" >> $GITHUB_OUTPUT | |
| sha256sum *.ipk *.deb *.zip >> $GITHUB_OUTPUT | |
| echo "EOF" >> $GITHUB_OUTPUT | |
| - name: Upload to GitHub Assets | |
| uses: softprops/action-gh-release@v2 | |
| if: startsWith(github.ref, 'refs/tags/') | |
| with: | |
| files: artifacts/* | |
| tag_name: ${{ github.ref_name }} | |
| name: Release ${{ github.ref_name }} | |
| draft: false | |
| prerelease: false | |
| body: | | |
| ## SitePi SDWAN Release ${{ github.ref_name }} | |
| ### SHA256 Checksums | |
| ``` | |
| ${{ steps.sha.outputs.SUMS }} | |
| ``` | |
| **Full Changelog**: https://github.com/sitepi/sdwan/compare/v0.0.8...v0.0.9 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: packages | |
| path: artifacts/*.* | |
| retention-days: 7 |