961 lines
26 KiB
YAML
961 lines
26 KiB
YAML
name: Build Fluxer Desktop
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
env:
|
|
NODE_VERSION: "24"
|
|
PNPM_VERSION: "10.29.3"
|
|
|
|
BUILD_CHANNEL: "stable"
|
|
NODE_ENV: "production"
|
|
FLUXER_DESKTOP_PRODUCTION: "true"
|
|
|
|
VERSION: "1.0.${{ gitea.run_number }}"
|
|
PUBLIC_BUILD_VERSION: "1.0.${{ gitea.run_number }}"
|
|
PUBLIC_RELEASE_CHANNEL: "stable"
|
|
|
|
jobs:
|
|
windows-x64:
|
|
name: Windows x64
|
|
|
|
runs-on: rustdesk-windows
|
|
|
|
steps:
|
|
- name: Clone Fluxer
|
|
shell: powershell
|
|
run: |
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
if (Test-Path "fluxer-src") {
|
|
Remove-Item "fluxer-src" -Recurse -Force
|
|
}
|
|
|
|
git clone `
|
|
--depth 1 `
|
|
--branch main `
|
|
https://github.com/fluxerapp/fluxer.git `
|
|
fluxer-src
|
|
|
|
if (-not (Test-Path "fluxer-src\fluxer_desktop\src\common\Constants.ts")) {
|
|
throw "Fluxer source tree is invalid: Constants.ts not found"
|
|
}
|
|
|
|
Write-Host "Fluxer revision:"
|
|
git -C fluxer-src rev-parse HEAD
|
|
|
|
Write-Host "Desktop directory:"
|
|
Get-ChildItem "fluxer-src\fluxer_desktop"
|
|
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "24"
|
|
|
|
|
|
- name: Setup pnpm
|
|
shell: powershell
|
|
run: |
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
corepack enable
|
|
corepack prepare pnpm@10.29.3 --activate
|
|
|
|
node --version
|
|
pnpm --version
|
|
|
|
- name: Setup Rust
|
|
shell: powershell
|
|
run: |
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
rustup update stable
|
|
rustup default stable
|
|
rustup target add x86_64-pc-windows-msvc
|
|
|
|
rustc --version
|
|
cargo --version
|
|
|
|
- name: Show build tools
|
|
shell: powershell
|
|
run: |
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
Write-Host "Node:"
|
|
node --version
|
|
|
|
Write-Host "pnpm:"
|
|
pnpm --version
|
|
|
|
Write-Host "Rust:"
|
|
rustc --version
|
|
|
|
Write-Host "Cargo:"
|
|
cargo --version
|
|
|
|
Write-Host "CMake:"
|
|
cmake --version
|
|
|
|
Write-Host "Ninja:"
|
|
ninja --version
|
|
|
|
Write-Host "Clang:"
|
|
clang --version
|
|
|
|
Write-Host "NASM:"
|
|
nasm --version
|
|
|
|
|
|
- name: Configure self-hosted server
|
|
shell: powershell
|
|
run: |
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
$Path = "fluxer-src\fluxer_desktop\src\common\Constants.ts"
|
|
|
|
if (-not (Test-Path $Path)) {
|
|
throw "Constants.ts not found at $Path"
|
|
}
|
|
|
|
$Content = Get-Content $Path -Raw
|
|
|
|
$Content = $Content -replace `
|
|
"export const STABLE_APP_URL = '[^']+';", `
|
|
"export const STABLE_APP_URL = 'https://ds.gandc.ru';"
|
|
|
|
$Content = $Content -replace `
|
|
"export const CANARY_APP_URL = '[^']+';", `
|
|
"export const CANARY_APP_URL = 'https://ds.gandc.ru';"
|
|
|
|
Set-Content `
|
|
-Path $Path `
|
|
-Value $Content `
|
|
-NoNewline `
|
|
-Encoding utf8
|
|
|
|
Write-Host "Result:"
|
|
Get-Content $Path
|
|
|
|
$Result = Get-Content $Path -Raw
|
|
|
|
if ($Result -notmatch "STABLE_APP_URL = 'https://ds\.gandc\.ru'") {
|
|
throw "STABLE_APP_URL was not configured"
|
|
}
|
|
|
|
if ($Result -notmatch "CANARY_APP_URL = 'https://ds\.gandc\.ru'") {
|
|
throw "CANARY_APP_URL was not configured"
|
|
}
|
|
|
|
$PackagePath = "fluxer-src\fluxer_desktop\package.json"
|
|
|
|
if (-not (Test-Path $PackagePath)) {
|
|
throw "package.json not found at $PackagePath"
|
|
}
|
|
|
|
$Package = Get-Content $PackagePath -Raw | ConvertFrom-Json
|
|
$Package.homepage = "https://ds.gandc.ru"
|
|
|
|
$Package |
|
|
ConvertTo-Json -Depth 100 |
|
|
Set-Content `
|
|
-Path $PackagePath `
|
|
-Encoding utf8
|
|
|
|
Write-Host "Desktop homepage configured:"
|
|
(Get-Content $PackagePath -Raw | ConvertFrom-Json).homepage
|
|
|
|
$WindowPath = "fluxer-src\fluxer_desktop\src\main\Window.ts"
|
|
|
|
if (-not (Test-Path $WindowPath)) {
|
|
throw "Window.ts not found at $WindowPath"
|
|
}
|
|
|
|
$WindowContent = Get-Content $WindowPath -Raw
|
|
|
|
$NavigationPattern = "webContents\.on\('will-navigate', \(event, url\) => \{\r?\n\s*if \(!isTrustedOrigin\(url\)\) \{\r?\n\s*event\.preventDefault\(\);\r?\n\s*\}\r?\n\s*\}\);"
|
|
|
|
$NavigationReplacementLines = @(
|
|
"const isAllowedSsoOrigin = (url: string): boolean => {"
|
|
"`ttry {"
|
|
"`t`treturn new URL(url).origin === 'https://sso.gandc.ru';"
|
|
"`t} catch {"
|
|
"`t`treturn false;"
|
|
"`t}"
|
|
"};"
|
|
""
|
|
"`tconst allowTrustedOrSsoNavigation = (event: Electron.Event, url: string): void => {"
|
|
"`t`tif (isTrustedOrigin(url) || isAllowedSsoOrigin(url)) {"
|
|
"`t`t`treturn;"
|
|
"`t`t}"
|
|
""
|
|
"`t`tlogger.warn('Blocked navigation outside trusted and SSO origins', {url});"
|
|
"`t`tevent.preventDefault();"
|
|
"`t};"
|
|
""
|
|
"`twebContents.on('will-navigate', allowTrustedOrSsoNavigation);"
|
|
"`twebContents.on('will-redirect', allowTrustedOrSsoNavigation);"
|
|
)
|
|
|
|
$NavigationReplacement = $NavigationReplacementLines -join "`n"
|
|
|
|
$PatchedWindowContent = [regex]::Replace(
|
|
$WindowContent,
|
|
$NavigationPattern,
|
|
$NavigationReplacement,
|
|
1
|
|
)
|
|
|
|
if ($PatchedWindowContent -eq $WindowContent) {
|
|
throw "Unable to patch Window.ts SSO navigation handler"
|
|
}
|
|
|
|
Set-Content `
|
|
-Path $WindowPath `
|
|
-Value $PatchedWindowContent `
|
|
-NoNewline `
|
|
-Encoding utf8
|
|
|
|
Write-Host "SSO navigation allowlist patch applied"
|
|
|
|
Select-String `
|
|
-Path $WindowPath `
|
|
-Pattern "sso.gandc.ru|will-redirect|allowTrustedOrSsoNavigation"
|
|
|
|
|
|
- name: Force WebRTC ICE policy to all
|
|
shell: powershell
|
|
run: |
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
$Path = "fluxer-src\fluxer_desktop\src\preload\index.ts"
|
|
|
|
if (-not (Test-Path $Path)) {
|
|
throw "Desktop preload not found at $Path"
|
|
}
|
|
|
|
$Content = Get-Content $Path -Raw
|
|
$Anchor = "import {contextBridge, ipcRenderer, webFrame} from 'electron';"
|
|
|
|
if ($Content -notmatch [regex]::Escape($Anchor)) {
|
|
throw "Unable to locate Electron preload import"
|
|
}
|
|
|
|
if ($Content -match "installForceAllIceTransportPolicy") {
|
|
throw "WebRTC ICE policy patch is already present"
|
|
}
|
|
|
|
$Patch = [Text.Encoding]::UTF8.GetString(
|
|
[Convert]::FromBase64String(
|
|
"aW1wb3J0IHtjb250ZXh0QnJpZGdlLCBpcGNSZW5kZXJlciwgd2ViRnJhbWV9IGZyb20gJ2VsZWN0cm9uJzsKCmZ1bmN0aW9uIGluc3RhbGxGb3JjZUFsbEljZVRyYW5zcG9ydFBvbGljeSgpOiB2b2lkIHsKCWNvbnRleHRCcmlkZ2UuZXhlY3V0ZUluTWFpbldvcmxkKHsKCQlmdW5jOiAoKSA9PiB7CgkJCWNvbnN0IE5hdGl2ZVJUQ1BlZXJDb25uZWN0aW9uID0gd2luZG93LlJUQ1BlZXJDb25uZWN0aW9uOwoKCQkJaWYgKHR5cGVvZiBOYXRpdmVSVENQZWVyQ29ubmVjdGlvbiAhPT0gJ2Z1bmN0aW9uJykgewoJCQkJcmV0dXJuOwoJCQl9CgoJCQl3aW5kb3cuUlRDUGVlckNvbm5lY3Rpb24gPSBuZXcgUHJveHkoTmF0aXZlUlRDUGVlckNvbm5lY3Rpb24sIHsKCQkJCWNvbnN0cnVjdChUYXJnZXQsIGFyZ3MsIG5ld1RhcmdldCkgewoJCQkJCWNvbnN0IGNvbmZpZyA9IGFyZ3NbMF0gYXMgUlRDQ29uZmlndXJhdGlvbiB8IHVuZGVmaW5lZDsKCgkJCQkJaWYgKGNvbmZpZz8uaWNlVHJhbnNwb3J0UG9saWN5ID09PSAncmVsYXknKSB7CgkJCQkJCWFyZ3NbMF0gPSB7CgkJCQkJCQkuLi5jb25maWcsCgkJCQkJCQlpY2VUcmFuc3BvcnRQb2xpY3k6ICdhbGwnLAoJCQkJCQl9OwoJCQkJCX0KCgkJCQkJcmV0dXJuIFJlZmxlY3QuY29uc3RydWN0KFRhcmdldCwgYXJncywgbmV3VGFyZ2V0KTsKCQkJCX0sCgkJCX0pOwoKCQkJY29uc29sZS5pbmZvKCdbRmx1eGVyIERlc2t0b3BdIFdlYlJUQyBpY2VUcmFuc3BvcnRQb2xpY3kgZm9yY2VkIHRvIGFsbCcpOwoJCX0sCgl9KTsKfQoKaW5zdGFsbEZvcmNlQWxsSWNlVHJhbnNwb3J0UG9saWN5KCk7"
|
|
)
|
|
)
|
|
|
|
$Content = $Content.Replace(
|
|
$Anchor,
|
|
$Patch
|
|
)
|
|
|
|
Set-Content `
|
|
-Path $Path `
|
|
-Value $Content `
|
|
-NoNewline `
|
|
-Encoding utf8
|
|
|
|
$Result = Get-Content $Path -Raw
|
|
|
|
if ($Result -notmatch "installForceAllIceTransportPolicy") {
|
|
throw "WebRTC ICE policy patch verification failed"
|
|
}
|
|
|
|
Write-Host "Installed preload WebRTC ICE policy override"
|
|
|
|
Select-String `
|
|
-Path $Path `
|
|
-Pattern "installForceAllIceTransportPolicy|iceTransportPolicy forced to all"
|
|
|
|
- name: Install dependencies
|
|
shell: powershell
|
|
run: |
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
Set-Location fluxer-src
|
|
|
|
pnpm install --frozen-lockfile
|
|
|
|
|
|
- name: Build Fluxer Desktop
|
|
shell: powershell
|
|
env:
|
|
ELECTRON_ARCH: x64
|
|
run: |
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
Set-Location fluxer-src
|
|
|
|
pnpm --filter fluxer_desktop build
|
|
|
|
|
|
- name: Package Windows portable
|
|
shell: powershell
|
|
env:
|
|
ELECTRON_ARCH: x64
|
|
CSC_IDENTITY_AUTO_DISCOVERY: "false"
|
|
run: |
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
Set-Location fluxer-src\fluxer_desktop
|
|
|
|
pnpm exec electron-builder `
|
|
--config electron-builder.config.cjs `
|
|
--win portable `
|
|
--x64 `
|
|
--publish never
|
|
|
|
|
|
- name: Show Windows artifacts
|
|
shell: powershell
|
|
run: |
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
Get-ChildItem `
|
|
-Path "fluxer-src\fluxer_desktop\dist-electron" `
|
|
-Recurse |
|
|
Select-Object FullName, Length
|
|
|
|
|
|
- name: Upload Windows artifact
|
|
uses: actions/upload-artifact@v4.6.2
|
|
with:
|
|
name: fluxer-windows-x64
|
|
path: |
|
|
fluxer-src/fluxer_desktop/dist-electron/*.exe
|
|
if-no-files-found: error
|
|
|
|
|
|
linux-x64:
|
|
name: Linux x64
|
|
|
|
runs-on: ubuntu-22.04
|
|
|
|
steps:
|
|
- name: Clone Fluxer
|
|
shell: bash
|
|
run: |
|
|
set -euxo pipefail
|
|
|
|
rm -rf fluxer-src
|
|
|
|
git clone \
|
|
--depth 1 \
|
|
--branch main \
|
|
https://github.com/fluxerapp/fluxer.git \
|
|
fluxer-src
|
|
|
|
test -f \
|
|
fluxer-src/fluxer_desktop/src/common/Constants.ts
|
|
|
|
echo "Fluxer revision:"
|
|
git -C fluxer-src rev-parse HEAD
|
|
|
|
echo "Desktop directory:"
|
|
ls -la fluxer-src/fluxer_desktop
|
|
|
|
|
|
- name: Install Linux build dependencies
|
|
shell: bash
|
|
run: |
|
|
set -euxo pipefail
|
|
|
|
apt-get update
|
|
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y \
|
|
build-essential \
|
|
ca-certificates \
|
|
clang \
|
|
cmake \
|
|
curl \
|
|
desktop-file-utils \
|
|
dpkg-dev \
|
|
fakeroot \
|
|
ffmpeg \
|
|
git \
|
|
libasound2 \
|
|
libaom-dev \
|
|
libavcodec-dev \
|
|
libavfilter-dev \
|
|
libavformat-dev \
|
|
libavutil-dev \
|
|
libcbor-dev \
|
|
libdbus-1-dev \
|
|
libdav1d-dev \
|
|
libde265-dev \
|
|
libfido2-dev \
|
|
libgbm1 \
|
|
libgtk-3-0 \
|
|
liblcms2-dev \
|
|
libnotify4 \
|
|
libnss3 \
|
|
libpipewire-0.3-dev \
|
|
libpulse-dev \
|
|
libsecret-1-0 \
|
|
libssl-dev \
|
|
libswresample-dev \
|
|
libswscale-dev \
|
|
libudev-dev \
|
|
libvips-dev \
|
|
libwayland-dev \
|
|
libwebp-dev \
|
|
libx11-xcb1 \
|
|
libxcb-dri3-0 \
|
|
libxcomposite1 \
|
|
libxdamage1 \
|
|
libxkbcommon-dev \
|
|
libxkbcommon0 \
|
|
libxrandr2 \
|
|
libxshmfence1 \
|
|
libxss1 \
|
|
libxtst6 \
|
|
llvm \
|
|
meson \
|
|
nasm \
|
|
ninja-build \
|
|
pkg-config \
|
|
python3 \
|
|
python3-pip \
|
|
rpm \
|
|
unzip \
|
|
xdg-utils \
|
|
xz-utils \
|
|
yasm \
|
|
zlib1g-dev \
|
|
zstd
|
|
|
|
- name: Install modern libfido2
|
|
shell: bash
|
|
run: |
|
|
set -euxo pipefail
|
|
|
|
rm -rf /tmp/libfido2
|
|
|
|
git clone \
|
|
--depth 1 \
|
|
--branch 1.17.0 \
|
|
https://github.com/Yubico/libfido2.git \
|
|
/tmp/libfido2
|
|
|
|
cmake \
|
|
-S /tmp/libfido2 \
|
|
-B /tmp/libfido2/build \
|
|
-DCMAKE_BUILD_TYPE=Release \
|
|
-DCMAKE_INSTALL_PREFIX=/usr/local \
|
|
-DCMAKE_INSTALL_LIBDIR=lib/x86_64-linux-gnu \
|
|
-DBUILD_EXAMPLES=OFF \
|
|
-DBUILD_MANPAGES=OFF \
|
|
-DBUILD_TOOLS=OFF
|
|
|
|
cmake \
|
|
--build /tmp/libfido2/build \
|
|
--parallel "$(nproc)"
|
|
|
|
cmake \
|
|
--install /tmp/libfido2/build
|
|
|
|
ldconfig
|
|
|
|
echo "=== libfido2 ==="
|
|
|
|
PKG_CONFIG_PATH="/usr/local/lib/x86_64-linux-gnu/pkgconfig:/usr/local/lib/pkgconfig:/usr/lib/x86_64-linux-gnu/pkgconfig" \
|
|
pkg-config --modversion libfido2
|
|
|
|
test -f /usr/local/include/fido/es384.h
|
|
|
|
ls -la /usr/local/include/fido/
|
|
|
|
echo "=== libraries ==="
|
|
|
|
find /usr/local/lib \
|
|
-name 'libfido2*' \
|
|
-print
|
|
|
|
- name: Install modern PipeWire
|
|
shell: bash
|
|
run: |
|
|
set -euxo pipefail
|
|
|
|
PIPEWIRE_VERSION="1.0.5"
|
|
|
|
rm -rf /tmp/pipewire
|
|
|
|
git clone \
|
|
--depth 1 \
|
|
--branch "${PIPEWIRE_VERSION}" \
|
|
https://github.com/PipeWire/pipewire.git \
|
|
/tmp/pipewire
|
|
|
|
meson setup \
|
|
/tmp/pipewire/build \
|
|
/tmp/pipewire \
|
|
--prefix=/usr/local \
|
|
--libdir=lib/x86_64-linux-gnu \
|
|
--buildtype=release \
|
|
-Ddocs=disabled \
|
|
-Dman=disabled \
|
|
-Dexamples=disabled \
|
|
-Dtests=disabled \
|
|
-Dinstalled_tests=disabled \
|
|
-Dsession-managers=[] \
|
|
-Dgstreamer=disabled \
|
|
-Dsystemd=disabled \
|
|
-Dselinux=disabled \
|
|
-Dpipewire-jack=disabled \
|
|
-Dpipewire-v4l2=disabled \
|
|
-Dbluez5=disabled \
|
|
-Djack=disabled \
|
|
-Dv4l2=disabled \
|
|
-Dlibcamera=disabled \
|
|
-Dvulkan=disabled \
|
|
-Dsdl2=disabled \
|
|
-Dlibmysofa=disabled \
|
|
-Droc=disabled \
|
|
-Davahi=disabled \
|
|
-Decho-cancel-webrtc=disabled \
|
|
-Dlibusb=disabled \
|
|
-Draop=disabled \
|
|
-Dlv2=disabled \
|
|
-Dlibcanberra=disabled \
|
|
-Dlibffado=disabled
|
|
|
|
meson compile \
|
|
-C /tmp/pipewire/build \
|
|
-j "$(nproc)"
|
|
|
|
meson install \
|
|
-C /tmp/pipewire/build
|
|
|
|
ldconfig
|
|
|
|
export PKG_CONFIG_PATH="/usr/local/lib/x86_64-linux-gnu/pkgconfig:/usr/local/lib/pkgconfig:/usr/lib/x86_64-linux-gnu/pkgconfig"
|
|
|
|
echo "=== PipeWire ==="
|
|
|
|
pkg-config \
|
|
--modversion \
|
|
libpipewire-0.3
|
|
|
|
pkg-config \
|
|
--modversion \
|
|
libspa-0.2
|
|
|
|
echo "=== PipeWire CFLAGS ==="
|
|
|
|
pkg-config \
|
|
--cflags \
|
|
libpipewire-0.3
|
|
|
|
pkg-config \
|
|
--cflags \
|
|
libspa-0.2
|
|
|
|
echo "=== Checking headers ==="
|
|
|
|
grep -R \
|
|
"spa_meta_region_is_valid" \
|
|
/usr/local/include/spa-0.2/spa \
|
|
| head
|
|
|
|
echo "=== PipeWire libraries ==="
|
|
|
|
find /usr/local/lib \
|
|
\( -name 'libpipewire-0.3.so*' -o -name 'libspa*.so*' \) \
|
|
-print
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "24"
|
|
|
|
|
|
- name: Setup pnpm
|
|
shell: bash
|
|
run: |
|
|
set -euxo pipefail
|
|
|
|
corepack enable
|
|
corepack prepare pnpm@10.29.3 --activate
|
|
|
|
node --version
|
|
pnpm --version
|
|
|
|
|
|
- name: Setup Rust
|
|
shell: bash
|
|
run: |
|
|
set -euxo pipefail
|
|
|
|
curl \
|
|
--proto '=https' \
|
|
--tlsv1.2 \
|
|
-sSf \
|
|
https://sh.rustup.rs |
|
|
sh -s -- -y --profile minimal
|
|
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
|
|
"$HOME/.cargo/bin/rustup" update stable
|
|
"$HOME/.cargo/bin/rustup" default stable
|
|
|
|
"$HOME/.cargo/bin/rustc" --version
|
|
"$HOME/.cargo/bin/cargo" --version
|
|
|
|
|
|
- name: Configure self-hosted server
|
|
shell: bash
|
|
run: |
|
|
set -euxo pipefail
|
|
|
|
python3 <<'PY'
|
|
from pathlib import Path
|
|
import re
|
|
|
|
path = Path(
|
|
"fluxer-src/fluxer_desktop/src/common/Constants.ts"
|
|
)
|
|
|
|
if not path.is_file():
|
|
raise SystemExit(
|
|
f"Constants.ts not found: {path}"
|
|
)
|
|
|
|
data = path.read_text(
|
|
encoding="utf-8"
|
|
)
|
|
|
|
data, stable_count = re.subn(
|
|
r"export const STABLE_APP_URL = '[^']+';",
|
|
"export const STABLE_APP_URL = 'https://ds.gandc.ru';",
|
|
data,
|
|
count=1,
|
|
)
|
|
|
|
data, canary_count = re.subn(
|
|
r"export const CANARY_APP_URL = '[^']+';",
|
|
"export const CANARY_APP_URL = 'https://ds.gandc.ru';",
|
|
data,
|
|
count=1,
|
|
)
|
|
|
|
if stable_count != 1:
|
|
raise SystemExit(
|
|
"Unable to patch STABLE_APP_URL"
|
|
)
|
|
|
|
if canary_count != 1:
|
|
raise SystemExit(
|
|
"Unable to patch CANARY_APP_URL"
|
|
)
|
|
|
|
path.write_text(
|
|
data,
|
|
encoding="utf-8"
|
|
)
|
|
|
|
result = path.read_text(
|
|
encoding="utf-8"
|
|
)
|
|
|
|
if (
|
|
"export const STABLE_APP_URL = "
|
|
"'https://ds.gandc.ru';"
|
|
not in result
|
|
):
|
|
raise SystemExit(
|
|
"STABLE_APP_URL verification failed"
|
|
)
|
|
|
|
if (
|
|
"export const CANARY_APP_URL = "
|
|
"'https://ds.gandc.ru';"
|
|
not in result
|
|
):
|
|
raise SystemExit(
|
|
"CANARY_APP_URL verification failed"
|
|
)
|
|
|
|
print(result)
|
|
PY
|
|
|
|
python3 <<'PY'
|
|
from pathlib import Path
|
|
import json
|
|
|
|
path = Path(
|
|
"fluxer-src/fluxer_desktop/package.json"
|
|
)
|
|
|
|
if not path.is_file():
|
|
raise SystemExit(
|
|
f"package.json not found: {path}"
|
|
)
|
|
|
|
package = json.loads(
|
|
path.read_text(
|
|
encoding="utf-8"
|
|
)
|
|
)
|
|
|
|
package["homepage"] = "https://ds.gandc.ru"
|
|
|
|
path.write_text(
|
|
json.dumps(
|
|
package,
|
|
ensure_ascii=False,
|
|
indent=2,
|
|
) + "\n",
|
|
encoding="utf-8",
|
|
)
|
|
|
|
print(
|
|
"Desktop homepage configured:",
|
|
package["homepage"],
|
|
)
|
|
PY
|
|
|
|
python3 <<'PY'
|
|
from pathlib import Path
|
|
import re
|
|
|
|
path = Path(
|
|
"fluxer-src/fluxer_desktop/src/main/Window.ts"
|
|
)
|
|
|
|
if not path.is_file():
|
|
raise SystemExit(
|
|
f"Window.ts not found: {path}"
|
|
)
|
|
|
|
data = path.read_text(
|
|
encoding="utf-8"
|
|
)
|
|
|
|
pattern = re.compile(
|
|
r"webContents\.on\('will-navigate', \(event, url\) => \{\s*"
|
|
r"if \(!isTrustedOrigin\(url\)\) \{\s*"
|
|
r"event\.preventDefault\(\);\s*"
|
|
r"\}\s*"
|
|
r"\}\);"
|
|
)
|
|
|
|
replacement = "\n".join([
|
|
"const isAllowedSsoOrigin = (url: string): boolean => {",
|
|
"\ttry {",
|
|
"\t\treturn new URL(url).origin === 'https://sso.gandc.ru';",
|
|
"\t} catch {",
|
|
"\t\treturn false;",
|
|
"\t}",
|
|
"};",
|
|
"",
|
|
"\tconst allowTrustedOrSsoNavigation = (event: Electron.Event, url: string): void => {",
|
|
"\t\tif (isTrustedOrigin(url) || isAllowedSsoOrigin(url)) {",
|
|
"\t\t\treturn;",
|
|
"\t\t}",
|
|
"",
|
|
"\t\tlogger.warn('Blocked navigation outside trusted and SSO origins', {url});",
|
|
"\t\tevent.preventDefault();",
|
|
"\t};",
|
|
"",
|
|
"\twebContents.on('will-navigate', allowTrustedOrSsoNavigation);",
|
|
"\twebContents.on('will-redirect', allowTrustedOrSsoNavigation);",
|
|
])
|
|
|
|
data, count = pattern.subn(
|
|
replacement,
|
|
data,
|
|
count=1,
|
|
)
|
|
|
|
if count != 1:
|
|
raise SystemExit(
|
|
"Unable to patch Window.ts SSO navigation handler"
|
|
)
|
|
|
|
path.write_text(
|
|
data,
|
|
encoding="utf-8",
|
|
)
|
|
|
|
print("SSO navigation allowlist patch applied")
|
|
PY
|
|
|
|
grep -n \
|
|
-E 'sso\.gandc\.ru|will-redirect|allowTrustedOrSsoNavigation' \
|
|
fluxer-src/fluxer_desktop/src/main/Window.ts
|
|
|
|
|
|
- name: Force WebRTC ICE policy to all
|
|
shell: bash
|
|
run: |
|
|
set -euxo pipefail
|
|
|
|
python3 - <<'PY'
|
|
from pathlib import Path
|
|
import base64
|
|
|
|
path = Path(
|
|
"fluxer-src/fluxer_desktop/"
|
|
"src/preload/index.ts"
|
|
)
|
|
|
|
if not path.is_file():
|
|
raise SystemExit(
|
|
f"Desktop preload not found: {path}"
|
|
)
|
|
|
|
data = path.read_text(
|
|
encoding="utf-8"
|
|
)
|
|
|
|
anchor = "import {contextBridge, ipcRenderer, webFrame} from 'electron';"
|
|
|
|
if anchor not in data:
|
|
raise SystemExit(
|
|
"Unable to locate Electron preload import"
|
|
)
|
|
|
|
if "installForceAllIceTransportPolicy" in data:
|
|
raise SystemExit(
|
|
"WebRTC ICE policy patch is already present"
|
|
)
|
|
|
|
patch = base64.b64decode(
|
|
"aW1wb3J0IHtjb250ZXh0QnJpZGdlLCBpcGNSZW5kZXJlciwgd2ViRnJhbWV9IGZyb20gJ2VsZWN0cm9uJzsKCmZ1bmN0aW9uIGluc3RhbGxGb3JjZUFsbEljZVRyYW5zcG9ydFBvbGljeSgpOiB2b2lkIHsKCWNvbnRleHRCcmlkZ2UuZXhlY3V0ZUluTWFpbldvcmxkKHsKCQlmdW5jOiAoKSA9PiB7CgkJCWNvbnN0IE5hdGl2ZVJUQ1BlZXJDb25uZWN0aW9uID0gd2luZG93LlJUQ1BlZXJDb25uZWN0aW9uOwoKCQkJaWYgKHR5cGVvZiBOYXRpdmVSVENQZWVyQ29ubmVjdGlvbiAhPT0gJ2Z1bmN0aW9uJykgewoJCQkJcmV0dXJuOwoJCQl9CgoJCQl3aW5kb3cuUlRDUGVlckNvbm5lY3Rpb24gPSBuZXcgUHJveHkoTmF0aXZlUlRDUGVlckNvbm5lY3Rpb24sIHsKCQkJCWNvbnN0cnVjdChUYXJnZXQsIGFyZ3MsIG5ld1RhcmdldCkgewoJCQkJCWNvbnN0IGNvbmZpZyA9IGFyZ3NbMF0gYXMgUlRDQ29uZmlndXJhdGlvbiB8IHVuZGVmaW5lZDsKCgkJCQkJaWYgKGNvbmZpZz8uaWNlVHJhbnNwb3J0UG9saWN5ID09PSAncmVsYXknKSB7CgkJCQkJCWFyZ3NbMF0gPSB7CgkJCQkJCQkuLi5jb25maWcsCgkJCQkJCQlpY2VUcmFuc3BvcnRQb2xpY3k6ICdhbGwnLAoJCQkJCQl9OwoJCQkJCX0KCgkJCQkJcmV0dXJuIFJlZmxlY3QuY29uc3RydWN0KFRhcmdldCwgYXJncywgbmV3VGFyZ2V0KTsKCQkJCX0sCgkJCX0pOwoKCQkJY29uc29sZS5pbmZvKCdbRmx1eGVyIERlc2t0b3BdIFdlYlJUQyBpY2VUcmFuc3BvcnRQb2xpY3kgZm9yY2VkIHRvIGFsbCcpOwoJCX0sCgl9KTsKfQoKaW5zdGFsbEZvcmNlQWxsSWNlVHJhbnNwb3J0UG9saWN5KCk7"
|
|
).decode("utf-8")
|
|
|
|
data = data.replace(
|
|
anchor,
|
|
patch,
|
|
1,
|
|
)
|
|
|
|
path.write_text(
|
|
data,
|
|
encoding="utf-8",
|
|
)
|
|
|
|
result = path.read_text(
|
|
encoding="utf-8"
|
|
)
|
|
|
|
if "installForceAllIceTransportPolicy" not in result:
|
|
raise SystemExit(
|
|
"WebRTC ICE policy patch verification failed"
|
|
)
|
|
|
|
print(
|
|
"Installed preload WebRTC ICE policy override"
|
|
)
|
|
PY
|
|
|
|
grep -n \
|
|
-E 'installForceAllIceTransportPolicy|iceTransportPolicy forced to all' \
|
|
fluxer-src/fluxer_desktop/src/preload/index.ts
|
|
|
|
- name: Install dependencies
|
|
shell: bash
|
|
run: |
|
|
set -euxo pipefail
|
|
|
|
cd fluxer-src
|
|
|
|
pnpm install --frozen-lockfile
|
|
|
|
|
|
- name: Build Fluxer Desktop
|
|
shell: bash
|
|
env:
|
|
ELECTRON_ARCH: x64
|
|
PKG_CONFIG_PATH: /usr/local/lib/x86_64-linux-gnu/pkgconfig:/usr/local/lib/pkgconfig:/usr/lib/x86_64-linux-gnu/pkgconfig
|
|
LD_LIBRARY_PATH: /usr/local/lib/x86_64-linux-gnu:/usr/local/lib
|
|
run: |
|
|
set -euxo pipefail
|
|
|
|
echo "libfido2 version:"
|
|
pkg-config --modversion libfido2
|
|
|
|
echo "libfido2 include flags:"
|
|
pkg-config --cflags libfido2
|
|
|
|
echo "Checking ES384 header:"
|
|
test -f /usr/local/include/fido/es384.h
|
|
|
|
cd fluxer-src
|
|
|
|
pnpm --filter fluxer_desktop build
|
|
|
|
- name: Inspect Linux native libraries
|
|
shell: bash
|
|
run: |
|
|
set -euxo pipefail
|
|
|
|
cd fluxer-src
|
|
|
|
echo "Searching for WebAuthn native module..."
|
|
|
|
find fluxer_desktop \
|
|
-type f \
|
|
\( -name '*.node' -o -name 'libfido2.so*' \) \
|
|
-print
|
|
|
|
echo "Dynamic dependencies:"
|
|
|
|
while IFS= read -r file; do
|
|
echo "===== $file ====="
|
|
ldd "$file" || true
|
|
done < <(
|
|
find fluxer_desktop \
|
|
-type f \
|
|
-name '*.node'
|
|
)
|
|
|
|
- name: Package Linux
|
|
shell: bash
|
|
env:
|
|
ELECTRON_ARCH: x64
|
|
CSC_IDENTITY_AUTO_DISCOVERY: "false"
|
|
run: |
|
|
set -euxo pipefail
|
|
|
|
cd fluxer-src/fluxer_desktop
|
|
|
|
pnpm exec electron-builder \
|
|
--config electron-builder.config.cjs \
|
|
--linux AppImage deb \
|
|
--x64 \
|
|
--publish never
|
|
|
|
|
|
- name: Show Linux artifacts
|
|
shell: bash
|
|
run: |
|
|
set -euxo pipefail
|
|
|
|
find \
|
|
fluxer-src/fluxer_desktop/dist-electron \
|
|
-maxdepth 2 \
|
|
-type f \
|
|
-printf '%p %s bytes\n' |
|
|
sort
|
|
|
|
|
|
- name: Upload Linux artifacts
|
|
uses: actions/upload-artifact@v4.6.2
|
|
with:
|
|
name: fluxer-linux-x64
|
|
path: |
|
|
fluxer-src/fluxer_desktop/dist-electron/*.AppImage
|
|
fluxer-src/fluxer_desktop/dist-electron/*.deb
|
|
if-no-files-found: error
|