Merge branch 'develop' into feature/app-update

# Conflicts: # .github/workflows/appimage.yml # .github/workflows/check-jdk-updates.yml # .github/workflows/debian.yml # .github/workflows/mac-dmg-x64.yml # .github/workflows/mac-dmg.yml # .github/workflows/win-exe.yml
2026-07-24 17:12:42 +00:00 · 2025-11-12 11:50:21 +01:00
parent f91cc2374c 593a64c9bd
commit d3d57312ba
72 changed files with 1816 additions and 103 deletions
@@ -19,7 +19,7 @@ on:

 env:
  JAVA_DIST: 'temurin'
-  JAVA_VERSION: '25.0.0'
+  JAVA_VERSION: '25.0.1+8.0.LTS'

 jobs:
  get-version:
@@ -42,7 +42,7 @@ jobs:
          - os: ubuntu-24.04-arm
            appimage-suffix: aarch64
            openjfx-url: 'https://download2.gluonhq.com/openjfx/25/openjfx-25_linux-aarch64_bin-jmods.zip'
-            openjfx-sha: '951c52481af0ec5885b06f1ebaa8a10da7e8ea23c5e1ef3e2f6f11fa1b3a7ce1'
+            openjfx-sha: '9ad4ca7b769ca4ee6419f1e99143dd6ff812f8be4fddb46a7d7cacbeea148af4'
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - name: Setup Java
@@ -6,7 +6,7 @@ on:
  workflow_dispatch:

 env:
-  JAVA_VERSION: '25.0.0'
+  JDK_VERSION: '25.0.1+8.0.LTS'
  JDK_VENDOR: temurin
  RUNTIME_VERSION_HELPER: >
    public class Test {
@@ -23,7 +23,7 @@ jobs:
        JDK_MAJOR_VERSION: 'toBeFilled'
    steps:
      - name: Determine current major version
-        run: echo 'JDK_MAJOR_VERSION=${{ env.JDK_VERSION }}'.substring(0,20) >> "$env:GITHUB_ENV"
+        run: echo 'JDK_MAJOR_VERSION=${{ env.JDK_VERSION }}'.substring(0,2) >> "$env:GITHUB_ENV"
        shell: pwsh
      - name: Checkout latest JDK ${{ env.JDK_MAJOR_VERSION }}
        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
@@ -23,12 +23,12 @@ on:

 env:
  JAVA_DIST: 'temurin'
-  JAVA_VERSION: '25.0.0'
+  JAVA_VERSION: '25.0.1+8.0.LTS'
  DEB_BUILD_DEPENDS: 'debhelper (>=10), openjdk-25-jdk (>= 25+36), libgtk-3-0 (>= 3.20.0), libxxf86vm1, libgl1'
  OPENJFX_JMODS_AMD64: 'https://download2.gluonhq.com/openjfx/25/openjfx-25_linux-x64_bin-jmods.zip'
  OPENJFX_JMODS_AMD64_HASH: '96e520f48610d8ffb94ca30face1f11ffe8a977ddc1c4ff80b1a9e9f048bd94e'
  OPENJFX_JMODS_AARCH64: 'https://download2.gluonhq.com/openjfx/25/openjfx-25_linux-aarch64_bin-jmods.zip'
-  OPENJFX_JMODS_AARCH64_HASH: '951c52481af0ec5885b06f1ebaa8a10da7e8ea23c5e1ef3e2f6f11fa1b3a7ce1'
+  OPENJFX_JMODS_AARCH64_HASH: '9ad4ca7b769ca4ee6419f1e99143dd6ff812f8be4fddb46a7d7cacbeea148af4'

 jobs:
  get-version:
@@ -24,7 +24,7 @@ on:

 env:
  JAVA_DIST: 'temurin'
-  JAVA_VERSION: '25.0.0'
+  JAVA_VERSION: '25.0.1+8.0.LTS'

 jobs:
  get-version:
@@ -22,7 +22,7 @@ on:

 env:
  JAVA_DIST: 'temurin'
-  JAVA_VERSION: '25.0.0'
+  JAVA_VERSION: '25.0.1+8.0.LTS'

 jobs:
  get-version:
@@ -8,10 +8,6 @@ on:
      version:
        description: 'Version'
        required: false
-      isDebug:
-        description: 'Build debug version with console output'
-        type: boolean
-        default: false
      sign:
        description: 'Sign binaries'
        required: false
@@ -51,8 +47,8 @@ jobs:
        include:
          - arch: x64
            os: windows-latest
-            java-dist: 'zulu' #TODO: is finally temurin possible?
-            java-version: '25.0.0+36'
+            java-dist: 'zulu' #cannot use temurin, see https://github.com/cryptomator/cryptomator/issues/3824#issuecomment-2829827427
+            java-version: '25.0.1+8'
            java-package: 'jdk'
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -192,6 +188,16 @@ jobs:
          New-Item -Path appdir/jpackage-jmod -ItemType Directory
          & $env:JAVA_HOME\bin\jmod.exe extract --dir jpackage-jmod "${env:JAVA_HOME}\jmods\jdk.jpackage.jmod"
          Get-ChildItem -Recurse -Path "jpackage-jmod" -File wixhelper.dll | Select-Object -Last 1 | Copy-Item -Destination "appdir"
+      - name: Sign DLLs with Azure Trusted Signing
+        if: inputs.sign || github.event_name == 'release'
+        uses: ./.github/actions/win-sign-action
+        with:
+          base-dir: ${{ github.workspace }}\appdir
+          recursive: true
+          append-signature: true
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
      - name: Sign DLLs with Actalis CodeSigner
        if: inputs.sign || github.event_name == 'release'
        uses: skymatic/workflows/.github/actions/win-sign-action@450e322ff2214d0be0b079b63343c894f3ef735f # no specific version
@@ -251,16 +257,16 @@ jobs:
        env:
          JP_WIXWIZARD_RESOURCES: ${{ github.workspace }}/dist/win/resources # requires abs path, used in resources/main.wxs
          JP_WIXHELPER_DIR: ${{ github.workspace }}\appdir
-      - name: Sign msi with Actalis CodeSigner
+      - name: Sign MSI with Azure Trusted Signing
        if: inputs.sign || github.event_name == 'release'
-        uses: skymatic/workflows/.github/actions/win-sign-action@450e322ff2214d0be0b079b63343c894f3ef735f # no specific version
+        uses: ./.github/actions/win-sign-action
        with:
-          base-dir: 'installer'
-          file-extensions: 'msi'
-          sign-description: 'Cryptomator Installer'
-          sign-url: 'https://cryptomator.org'
-          username: ${{ secrets.WIN_CODESIGN_USERNAME }}
-          password: ${{ secrets.WIN_CODESIGN_PW }}
+          base-dir: ${{ github.workspace }}\installer
+          file-extensions: msi
+          description: 'Cryptomator Installer'
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
      - name: Add possible alpha/beta tags and architecture to installer name
        run: mv installer/Cryptomator-*.msi Cryptomator-${{ needs.get-version.outputs.semVerStr }}-${{ matrix.arch }}.msi
      - name: Create detached GPG signature with key 615D449FE6E6A235
@@ -357,6 +363,17 @@ jobs:
      - name: Detach burn engine in preparation to sign
        run: >
          wix burn detach installer/unsigned/Cryptomator-Installer.exe -engine tmp/engine.exe
+      - name: Sign WiX burn engine with Azure Trusted Signing
+        if: inputs.sign || github.event_name == 'release'
+        uses: ./.github/actions/win-sign-action
+        with:
+          base-dir: ${{ github.workspace }}\tmp
+          file-extensions: exe
+          append-signature: true
+          description: 'Cryptomator Bundle Installer'
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
      - name: Sign burn engine with Actalis CodeSigner
        if: inputs.sign || github.event_name == 'release'
        uses: skymatic/workflows/.github/actions/win-sign-action@450e322ff2214d0be0b079b63343c894f3ef735f # no specific version
@@ -370,6 +387,17 @@ jobs:
      - name: Reattach signed burn engine to installer
        run: >
          wix burn reattach installer/unsigned/Cryptomator-Installer.exe -engine tmp/engine.exe -o installer/Cryptomator-Installer.exe
+      - name: Sign EXE installer with Azure Trusted Signing
+        if: inputs.sign || github.event_name == 'release'
+        uses: ./.github/actions/win-sign-action
+        with:
+          base-dir: ${{ github.workspace }}\installer
+          file-extensions: exe
+          append-signature: true
+          description: 'Cryptomator Bundle Installer'
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
      - name: Sign installer with Actalis CodeSigner
        if: inputs.sign || github.event_name == 'release'
        uses: skymatic/workflows/.github/actions/win-sign-action@450e322ff2214d0be0b079b63343c894f3ef735f # no specific version