diff --git a/.github/dependabot.yml b/.github/dependabot.yml index be3ba6a19..b2ace54c2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -53,6 +53,4 @@ updates: groups: github-actions: patterns: - - "*" - labels: - - "misc:ci" \ No newline at end of file + - "*" \ No newline at end of file diff --git a/.github/workflows/appimage.yml b/.github/workflows/appimage.yml index c80be8844..521edeedd 100644 --- a/.github/workflows/appimage.yml +++ b/.github/workflows/appimage.yml @@ -8,16 +8,24 @@ on: version: description: 'Version' required: false + push: + branches-ignore: + - 'dependabot/**' + paths: + - '.github/workflows/appimage.yml' + - 'dist/linux/appimage/**' + - 'dist/linux/common/**' + - 'dist/linux/resources/**' env: JAVA_DIST: 'temurin' - JAVA_VERSION: '23.0.2' + JAVA_VERSION: '24.0.1+9' jobs: get-version: uses: ./.github/workflows/get-version.yml with: - version: ${{ inputs.version }} + version: ${{ inputs.version }} #okay if not defined build: name: Build AppImage @@ -29,12 +37,12 @@ jobs: include: - os: ubuntu-latest appimage-suffix: x86_64 - openjfx-url: 'https://download2.gluonhq.com/openjfx/23.0.2/openjfx-23.0.2_linux-x64_bin-jmods.zip' - openjfx-sha: '063baebc6922e4a89c94b9dfb7a4f53e59e8d6fec400d4e670b31bc2ab324dec' + openjfx-url: 'https://download2.gluonhq.com/openjfx/24.0.1/openjfx-24.0.1_linux-x64_bin-jmods.zip' + openjfx-sha: '425fac742b9fbd095b2ce868cff82d1024620f747c94a7144d0a4879e756146c' - os: ubuntu-24.04-arm appimage-suffix: aarch64 - openjfx-url: 'https://download2.gluonhq.com/openjfx/23.0.2/openjfx-23.0.2_linux-aarch64_bin-jmods.zip' - openjfx-sha: '9bbedaeae1590b69e2b22237bda310936df33e344dbc243bea2e86acaab3a0d8' + openjfx-url: 'https://download2.gluonhq.com/openjfx/24.0.1/openjfx-24.0.1_linux-aarch64_bin-jmods.zip' + openjfx-sha: '7e02edd0f4ee5527a27c94b0bbba66fcaaff41009119e45d0eca0f96ddfb6e7b' steps: - uses: actions/checkout@v4 - name: Setup Java @@ -61,7 +69,7 @@ jobs: POM_JFX_VERSION=${POM_JFX_VERSION#*@} POM_JFX_VERSION=${POM_JFX_VERSION%%.*} - if [ $POM_JFX_VERSION -ne $JMOD_VERSION_AMD64 ]; then + if [ $POM_JFX_VERSION -ne $JMOD_VERSION ]; then >&2 echo "Major JavaFX version in pom.xml (${POM_JFX_VERSION}) != amd64 jmod version (${JMOD_VERSION})" exit 1 fi @@ -73,13 +81,21 @@ jobs: run: | cp LICENSE.txt target cp target/cryptomator-*.jar target/mods + - name: Run jlink with help option + id: jep-493-check + run: | + JMOD_PATHS="openjfx-jmods" + if ! ${JAVA_HOME}/bin/jlink --help | grep -q "Linking from run-time image enabled"; then + JMOD_PATHS="${JAVA_HOME}/jmods:${JMOD_PATHS}" + fi + echo "jmod_paths=${JMOD_PATHS}" >> "$GITHUB_OUTPUT" - name: Run jlink #Remark: no compression is applied for improved build compression later (here appimage) run: > ${JAVA_HOME}/bin/jlink --verbose --output runtime - --module-path "${JAVA_HOME}/jmods:openjfx-jmods" + --module-path "${{ steps.jep-493-check.outputs.jmod_paths }}" --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,javafx.base,javafx.graphics,javafx.controls,javafx.fxml,jdk.unsupported,jdk.security.auth,jdk.accessibility,jdk.management.jfr,jdk.net,java.compiler --strip-native-commands --no-header-files @@ -101,7 +117,8 @@ jobs: --copyright "(C) 2016 - 2025 Skymatic GmbH" --app-version "${{ needs.get-version.outputs.semVerNum }}.${{ needs.get-version.outputs.revNum }}" --java-options "--enable-preview" - --java-options "--enable-native-access=org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64,org.purejava.appindicator" + --java-options "--enable-native-access=javafx.graphics,org.cryptomator.jfuse.linux.amd64,org.cryptomator.jfuse.linux.aarch64,org.purejava.appindicator" + --java-options "--sun-misc-unsafe-memory-access=allow" --java-options "-Xss5m" --java-options "-Xmx256m" --java-options "-Dcryptomator.appVersion=\"${{ needs.get-version.outputs.semVerStr }}\"" @@ -152,7 +169,7 @@ jobs: - name: Build AppImage run: > ./squashfs-root/AppRun Cryptomator.AppDir cryptomator-${{ needs.get-version.outputs.semVerStr }}-${{ matrix.appimage-suffix }}.AppImage - -u 'gh-releases-zsync|cryptomator|cryptomator|latest|cryptomator-*-${{ matrix.appimage-suffix }}.AppImage.zsync' + -u "gh-releases-zsync|cryptomator|cryptomator|latest|cryptomator-*-${{ matrix.appimage-suffix }}.AppImage.zsync" --sign --sign-key=615D449FE6E6A235 - name: Create detached GPG signatures run: | diff --git a/.github/workflows/av-whitelist.yml b/.github/workflows/av-whitelist.yml index 3cc164b30..8febeca49 100644 --- a/.github/workflows/av-whitelist.yml +++ b/.github/workflows/av-whitelist.yml @@ -76,7 +76,7 @@ jobs: name: ${{ needs.download-file.outputs.fileName }} path: upload - name: Upload to Avast - uses: wlixcc/SFTP-Deploy-Action@v1.2.5 + uses: wlixcc/SFTP-Deploy-Action@v1.2.6 with: server: whitelisting.avast.com port: 22 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 545513129..7dae2755c 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -2,12 +2,16 @@ name: Build on: push: + paths: + - '.github/workflows/build.yml' + - 'pom.xml' + - 'src/**' pull_request_target: types: [labeled] env: JAVA_DIST: 'temurin' - JAVA_VERSION: 23 + JAVA_VERSION: 24 defaults: run: diff --git a/.github/workflows/check-jdk-updates.yml b/.github/workflows/check-jdk-updates.yml index 64456baae..bf8d19e15 100644 --- a/.github/workflows/check-jdk-updates.yml +++ b/.github/workflows/check-jdk-updates.yml @@ -6,7 +6,7 @@ on: workflow_dispatch: env: - JDK_VERSION: '23.0.1+11' + JDK_VERSION: '24.0.1+9' JDK_VENDOR: temurin RUNTIME_VERSION_HELPER: > public class Test { diff --git a/.github/workflows/debian.yml b/.github/workflows/debian.yml index 197aaf7dc..9763717b3 100644 --- a/.github/workflows/debian.yml +++ b/.github/workflows/debian.yml @@ -5,41 +5,52 @@ on: inputs: semver: description: 'SemVer String (e.g. 1.7.0-beta1)' - required: true ppaver: description: 'Base PPA Version String (e.g. 1.6.16+1.7.0~beta1) without -0ppa1' - required: true dput: description: 'Upload to PPA' required: true default: false type: boolean + push: + branches-ignore: + - 'dependabot/**' + paths: + - '.github/workflows/debian.yml' + - 'dist/linux/debian/**' + - 'dist/linux/common/**' + - 'dist/linux/resources/**' env: JAVA_DIST: 'temurin' - JAVA_VERSION: '23.0.2+7' - COFFEELIBS_JDK: 23 - COFFEELIBS_JDK_VERSION: '23.0.2+7-0ppa1' - OPENJFX_JMODS_AMD64: 'https://download2.gluonhq.com/openjfx/23.0.2/openjfx-23.0.2_linux-x64_bin-jmods.zip' - OPENJFX_JMODS_AMD64_HASH: '063baebc6922e4a89c94b9dfb7a4f53e59e8d6fec400d4e670b31bc2ab324dec' - OPENJFX_JMODS_AARCH64: 'https://download2.gluonhq.com/openjfx/23.0.2/openjfx-23.0.2_linux-aarch64_bin-jmods.zip' - OPENJFX_JMODS_AARCH64_HASH: '9bbedaeae1590b69e2b22237bda310936df33e344dbc243bea2e86acaab3a0d8' + JAVA_VERSION: '24.0.1+9' + COFFEELIBS_JDK: 24 + COFFEELIBS_JDK_VERSION: '24.0.1+9-0ppa3' + OPENJFX_JMODS_AMD64: 'https://download2.gluonhq.com/openjfx/24.0.1/openjfx-24.0.1_linux-x64_bin-jmods.zip' + OPENJFX_JMODS_AMD64_HASH: '425fac742b9fbd095b2ce868cff82d1024620f747c94a7144d0a4879e756146c' + OPENJFX_JMODS_AARCH64: 'https://download2.gluonhq.com/openjfx/24.0.1/openjfx-24.0.1_linux-aarch64_bin-jmods.zip' + OPENJFX_JMODS_AARCH64_HASH: '7e02edd0f4ee5527a27c94b0bbba66fcaaff41009119e45d0eca0f96ddfb6e7b' jobs: + get-version: + uses: ./.github/workflows/get-version.yml + with: + version: ${{ inputs.semver }} #okay if not defined + build: name: Build Debian Package runs-on: ubuntu-22.04 + needs: [get-version] steps: - uses: actions/checkout@v4 - - id: versions - name: Get version information + - id: deb-version + name: Determine deb-version run: | - SEM_VER_STR="${{ inputs.semver }}" - SEM_VER_NUM=`echo ${SEM_VER_STR} | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/'` - REVCOUNT=`git rev-list --count HEAD` - echo "semVerStr=${SEM_VER_STR}" >> $GITHUB_OUTPUT - echo "semVerNum=${SEM_VER_NUM}" >> $GITHUB_OUTPUT - echo "revNum=${REVCOUNT}" >> $GITHUB_OUTPUT + if [ -n "${{inputs.ppaver}}" ]; then + echo "debVersion=${{inputs.ppaver }}" >> "$GITHUB_OUTPUT" + else + echo "debVersion=${{needs.get-version.outputs.semVerStr}}" >> "$GITHUB_OUTPUT" + fi - name: Install build tools run: | sudo add-apt-repository ppa:coffeelibs/openjdk @@ -94,7 +105,7 @@ jobs: cp -r jmods pkgdir cp -r dist/linux/common/ pkgdir cp target/cryptomator-*.jar pkgdir/mods - tar -cJf cryptomator_${{ inputs.ppaver }}.orig.tar.xz -C pkgdir . + tar -cJf cryptomator_${{ steps.deb-version.outputs.debVersion }}.orig.tar.xz -C pkgdir . - name: Patch and rename pkgdir run: | cp -r dist/linux/debian/ pkgdir @@ -103,12 +114,12 @@ jobs: envsubst '${SEMVER_STR} ${VERSION_NUM} ${REVISION_NUM} ${DISABLE_UPDATE_CHECK}' < dist/linux/debian/rules > pkgdir/debian/rules envsubst '${PPA_VERSION} ${RFC2822_TIMESTAMP}' < dist/linux/debian/changelog > pkgdir/debian/changelog find . -name "*.jar" >> pkgdir/debian/source/include-binaries - mv pkgdir cryptomator_${{ inputs.ppaver }} + mv pkgdir cryptomator_${{ steps.deb-version.outputs.debVersion }} env: - SEMVER_STR: ${{ steps.versions.outputs.semVerStr }} - VERSION_NUM: ${{ steps.versions.outputs.semVerNum }} - REVISION_NUM: ${{ steps.versions.outputs.revNum }} - PPA_VERSION: ${{ inputs.ppaver }}-0ppa1 + SEMVER_STR: ${{ needs.get-version.outputs.semVerStr }} + VERSION_NUM: ${{ needs.get-version.outputs.semVerNum }} + REVISION_NUM: ${{ needs.get-version.outputs.revNum }} + PPA_VERSION: ${{ steps.deb-version.outputs.debVersion }}-0ppa1 - name: Prepare GPG-Agent for signing with key 615D449FE6E6A235 run: | echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import @@ -118,12 +129,13 @@ jobs: GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }} - name: debuild run: | + (sleep 8m; gpg --batch --quiet --pinentry-mode loopback -u 615D449FE6E6A235 --dry-run --sign README.md) & debuild -S -sa -d debuild -b -sa -d env: DEBSIGN_PROGRAM: gpg --batch --pinentry-mode loopback DEBSIGN_KEYID: 615D449FE6E6A235 - working-directory: cryptomator_${{ inputs.ppaver }} + working-directory: cryptomator_${{ steps.deb-version.outputs.debVersion }} - name: Create detached GPG signatures run: | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator_*_amd64.deb @@ -140,7 +152,7 @@ jobs: cryptomator_*_amd64.deb cryptomator_*.asc - name: Publish on PPA - if: inputs.dput + if: inputs.dput && inputs.ppaver != '' run: dput ppa:sebastian-stenzel/cryptomator-beta cryptomator_*_source.changes # If ref is a tag, also upload to GitHub Releases: - name: Publish Debian package on GitHub Releases diff --git a/.github/workflows/dependency-check.yml b/.github/workflows/dependency-check.yml index 00e30c984..b44604490 100644 --- a/.github/workflows/dependency-check.yml +++ b/.github/workflows/dependency-check.yml @@ -11,7 +11,7 @@ jobs: with: runner-os: 'ubuntu-latest' java-distribution: 'temurin' - java-version: 23 + java-version: 24 check-command: 'mvn -B validate -Pdependency-check -Djavafx.platform=linux' secrets: nvd-api-key: ${{ secrets.NVD_API_KEY }} diff --git a/.github/workflows/get-version.yml b/.github/workflows/get-version.yml index 5a5ab09b0..4ee423386 100644 --- a/.github/workflows/get-version.yml +++ b/.github/workflows/get-version.yml @@ -23,7 +23,7 @@ on: env: JAVA_DIST: 'temurin' - JAVA_VERSION: 23 + JAVA_VERSION: 24 jobs: determine-version: diff --git a/.github/workflows/mac-dmg-x64.yml b/.github/workflows/mac-dmg-x64.yml index a26e32565..0a52e71a8 100644 --- a/.github/workflows/mac-dmg-x64.yml +++ b/.github/workflows/mac-dmg-x64.yml @@ -2,20 +2,29 @@ name: Build macOS .dmg for x64 ####################################### # STOP! DO NOT EDIT THIS FILE! -# +# # It is a copy of mac-dmg.yml with tiny adjustements (mainly lines 42 to 47) # It was made necessary, since Github does not offer free macos intel runners for macos 15 and above. -# This workflow can only be triggered by a release. -# +# ####################################### on: release: types: [published] + workflow_dispatch: + inputs: + version: + description: 'Version' + required: false + notarize: + description: 'Notarize' + required: true + default: false + type: boolean env: JAVA_DIST: 'temurin' - JAVA_VERSION: '23.0.2+7' + JAVA_VERSION: '24.0.1+9' jobs: get-version: @@ -35,8 +44,8 @@ jobs: architecture: x64 output-suffix: x64 fuse-lib: macFUSE - openjfx-url: 'https://download2.gluonhq.com/openjfx/23.0.2/openjfx-23.0.2_osx-x64_bin-jmods.zip' - openjfx-sha: '5e6c65c065eea22430c0eab36f37a5985eb8ad99e19e8772262021740d338f68' + openjfx-url: 'https://download2.gluonhq.com/openjfx/24.0.1/openjfx-24.0.1_osx-x64_bin-jmods.zip' + openjfx-sha: '6e62a426d43c168a488521f904a523f3dd6ee2cf103e08136f2fd465c828a105' steps: - uses: actions/checkout@v4 - name: Setup Java @@ -75,13 +84,21 @@ jobs: run: | cp LICENSE.txt target cp target/cryptomator-*.jar target/mods + - name: Run jlink with help option + id: jep-493-check + run: | + JMOD_PATHS="openjfx-jmods" + if ! ${JAVA_HOME}/bin/jlink --help | grep -q "Linking from run-time image enabled"; then + JMOD_PATHS="${JAVA_HOME}/jmods:${JMOD_PATHS}" + fi + echo "jmod_paths=${JMOD_PATHS}" >> "$GITHUB_OUTPUT" - name: Run jlink #Remark: no compression is applied for improved build compression later (here dmg) run: > ${JAVA_HOME}/bin/jlink --verbose --output runtime - --module-path "${JAVA_HOME}/jmods:openjfx-jmods" + --module-path "${{ steps.jep-493-check.outputs.jmod_paths }}" --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,javafx.base,javafx.graphics,javafx.controls,javafx.fxml,jdk.unsupported,jdk.accessibility,jdk.management.jfr,java.compiler --strip-native-commands --no-header-files @@ -103,7 +120,8 @@ jobs: --copyright "(C) 2016 - 2025 Skymatic GmbH" --app-version "${{ needs.get-version.outputs.semVerNum }}" --java-options "--enable-preview" - --java-options "--enable-native-access=org.cryptomator.jfuse.mac" + --java-options "--enable-native-access=javafx.graphics,org.cryptomator.jfuse.mac" + --java-options "--sun-misc-unsafe-memory-access=allow" --java-options "-Xss5m" --java-options "-Xmx256m" --java-options "-Dfile.encoding=\"utf-8\"" @@ -223,6 +241,11 @@ jobs: Cryptomator-${VERSION_NO}-${{ matrix.output-suffix }}.dmg dmg env: VERSION_NO: ${{ needs.get-version.outputs.semVerNum }} + - name: Codesign .dmg + run: | + codesign -s ${CODESIGN_IDENTITY} --timestamp Cryptomator-*.dmg + env: + CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }} - name: Notarize .dmg if: startsWith(github.ref, 'refs/tags/') || inputs.notarize uses: cocoalibs/xcode-notarization-action@v1 diff --git a/.github/workflows/mac-dmg.yml b/.github/workflows/mac-dmg.yml index 27dd8cfdc..29b4a4b0c 100644 --- a/.github/workflows/mac-dmg.yml +++ b/.github/workflows/mac-dmg.yml @@ -13,10 +13,16 @@ on: required: true default: false type: boolean + push: + branches-ignore: + - 'dependabot/**' + paths: + - '.github/workflows/mac-dmg.yml' + - 'dist/mac/**' env: JAVA_DIST: 'temurin' - JAVA_VERSION: '23.0.2+7' + JAVA_VERSION: '24.0.1+9' jobs: get-version: @@ -36,8 +42,8 @@ jobs: architecture: aarch64 output-suffix: arm64 fuse-lib: FUSE-T - openjfx-url: 'https://download2.gluonhq.com/openjfx/23.0.2/openjfx-23.0.2_osx-aarch64_bin-jmods.zip' - openjfx-sha: 'c690cc642a3924cf56622951f478ba57aec9ce09063761f800c3319331bed3fc' + openjfx-url: 'https://download2.gluonhq.com/openjfx/24.0.1/openjfx-24.0.1_osx-aarch64_bin-jmods.zip' + openjfx-sha: 'b5a94a13077507003fa852512bfa33f4fb680bc8076d8002e4227a84c85171d4' steps: - uses: actions/checkout@v4 - name: Setup Java @@ -76,13 +82,21 @@ jobs: run: | cp LICENSE.txt target cp target/cryptomator-*.jar target/mods + - name: Run jlink with help option + id: jep-493-check + run: | + JMOD_PATHS="openjfx-jmods" + if ! ${JAVA_HOME}/bin/jlink --help | grep -q "Linking from run-time image enabled"; then + JMOD_PATHS="${JAVA_HOME}/jmods:${JMOD_PATHS}" + fi + echo "jmod_paths=${JMOD_PATHS}" >> "$GITHUB_OUTPUT" - name: Run jlink #Remark: no compression is applied for improved build compression later (here dmg) run: > ${JAVA_HOME}/bin/jlink --verbose --output runtime - --module-path "${JAVA_HOME}/jmods:openjfx-jmods" + --module-path "${{ steps.jep-493-check.outputs.jmod_paths }}" --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,javafx.base,javafx.graphics,javafx.controls,javafx.fxml,jdk.unsupported,jdk.accessibility,jdk.management.jfr,java.compiler --strip-native-commands --no-header-files @@ -104,7 +118,8 @@ jobs: --copyright "(C) 2016 - 2025 Skymatic GmbH" --app-version "${{ needs.get-version.outputs.semVerNum }}" --java-options "--enable-preview" - --java-options "--enable-native-access=org.cryptomator.jfuse.mac" + --java-options "--enable-native-access=javafx.graphics,org.cryptomator.jfuse.mac" + --java-options "--sun-misc-unsafe-memory-access=allow" --java-options "-Xss5m" --java-options "-Xmx256m" --java-options "-Dfile.encoding=\"utf-8\"" @@ -224,6 +239,11 @@ jobs: Cryptomator-${VERSION_NO}-${{ matrix.output-suffix }}.dmg dmg env: VERSION_NO: ${{ needs.get-version.outputs.semVerNum }} + - name: Codesign .dmg + run: | + codesign -s ${CODESIGN_IDENTITY} --timestamp Cryptomator-*.dmg + env: + CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }} - name: Notarize .dmg if: startsWith(github.ref, 'refs/tags/') || inputs.notarize uses: cocoalibs/xcode-notarization-action@v1 diff --git a/.github/workflows/pullrequest.yml b/.github/workflows/pullrequest.yml index 5b0cb5111..28ab593cd 100644 --- a/.github/workflows/pullrequest.yml +++ b/.github/workflows/pullrequest.yml @@ -5,7 +5,7 @@ on: env: JAVA_DIST: 'temurin' - JAVA_VERSION: 23 + JAVA_VERSION: 24 defaults: run: @@ -15,7 +15,6 @@ jobs: test: name: Compile and Test runs-on: ubuntu-latest - if: "!contains(github.event.head_commit.message, '[ci skip]') && !contains(github.event.head_commit.message, '[skip ci]')" steps: - uses: actions/checkout@v4 - uses: actions/setup-java@v4 diff --git a/.github/workflows/win-exe.yml b/.github/workflows/win-exe.yml index ed525a7f6..cfbbc05a7 100644 --- a/.github/workflows/win-exe.yml +++ b/.github/workflows/win-exe.yml @@ -12,14 +12,19 @@ on: description: 'Build debug version with console output' type: boolean default: false + push: + branches-ignore: + - 'dependabot/**' + paths: + - '.github/workflows/win-exe.yml' + - 'dist/win/**' env: - JAVA_DIST: 'zulu' - JAVA_VERSION: '23.0.2+7' - OPENJFX_JMODS_AMD64: 'https://download2.gluonhq.com/openjfx/23.0.1/openjfx-23.0.1_windows-x64_bin-jmods.zip' - OPENJFX_JMODS_AMD64_HASH: 'ee176dcee3bd78bde7910735bd67f67c792882f5b89626796ae06f7a1c0119d3' - WINFSP_MSI: 'https://github.com/winfsp/winfsp/releases/download/v2.0/winfsp-2.0.23075.msi' + OPENJFX_JMODS_AMD64: 'https://download2.gluonhq.com/openjfx/24.0.1/openjfx-24.0.1_windows-x64_bin-jmods.zip' + OPENJFX_JMODS_AMD64_HASH: 'f13d17c7caf88654fc835f1b4e75a9b0f34a888eb8abef381796c0002e63b03f' + WINFSP_MSI: 'https://github.com/winfsp/winfsp/releases/download/v2.1/winfsp-2.1.25156.msi' + WINFSP_MSI_HASH: '073a70e00f77423e34bed98b86e600def93393ba5822204fac57a29324db9f7a' WINFSP_UNINSTALLER: 'https://github.com/cryptomator/winfsp-uninstaller/releases/latest/download/winfsp-uninstaller.exe' defaults: @@ -34,8 +39,21 @@ jobs: build-msi: name: Build .msi Installer - runs-on: windows-latest - needs: [get-version] + runs-on: ${{ matrix.os }} + needs: [ get-version ] + strategy: + matrix: + include: + - arch: x64 + os: windows-latest + java-dist: 'zulu' + java-version: '24.0.1+9' + java-package: 'jdk' + - arch: arm64 + os: windows-11-arm + java-dist: 'liberica' + java-version: '24.0.1+11' + java-package: 'jdk+fx' #This is needed, as liberica contains JFX 24 Jmods for Windows ARM64 env: LOOPBACK_ALIAS: 'cryptomator-vault' WIN_CONSOLE_FLAG: '' @@ -44,23 +62,31 @@ jobs: - name: Setup Java uses: actions/setup-java@v4 with: - distribution: ${{ env.JAVA_DIST }} - java-version: ${{ env.JAVA_VERSION }} + distribution: ${{ matrix.java-dist }} + java-version: ${{ matrix.java-version }} + java-package: ${{ matrix.java-package }} check-latest: true cache: 'maven' + - name: Install wix and extensions + run: | + dotnet tool install --global wix --version 6.0.0 + wix.exe extension add WixToolset.UI.wixext/6.0.0 --global + wix.exe extension add WixToolset.Util.wixext/6.0.0 --global - name: Download and extract JavaFX jmods from Gluon + if: matrix.arch == 'x64' #In the last step we move all jmods files a dir level up because jmods are placed inside a directory in the zip run: | - curl --output jfxjmods.zip -L "${{ env.OPENJFX_JMODS_AMD64 }}" - if(!(Get-FileHash -Path jfxjmods.zip -Algorithm SHA256).Hash.ToLower().equals("${{ env.OPENJFX_JMODS_AMD64_HASH }}")) { + curl --output openjfx-jmods.zip -L "${{ env.OPENJFX_JMODS_AMD64 }}" + if(!(Get-FileHash -Path openjfx-jmods.zip -Algorithm SHA256).Hash.ToLower().equals("${{ env.OPENJFX_JMODS_AMD64_HASH }}")) { throw "Wrong checksum of JMOD archive downloaded from ${{ env.OPENJFX_JMODS_AMD64 }}."; } - Expand-Archive -Path jfxjmods.zip -DestinationPath jfxjmods - Get-ChildItem -Path jfxjmods -Recurse -Filter "*.jmod" | ForEach-Object { Move-Item -Path $_ -Destination $_.Directory.Parent} + Expand-Archive -Path openjfx-jmods.zip -DestinationPath openjfx-jmods + Get-ChildItem -Path openjfx-jmods -Recurse -Filter "*.jmod" | ForEach-Object { Move-Item -Path $_ -Destination $_.Directory.Parent} shell: pwsh - name: Ensure major jfx version in pom and in jmods is the same + if: matrix.arch == 'x64' run: | - JMOD_VERSION_AMD64=$(jmod describe jfxjmods/javafx.base.jmod | head -1) + JMOD_VERSION_AMD64=$(jmod describe openjfx-jmods/javafx.base.jmod | head -1) JMOD_VERSION_AMD64=${JMOD_VERSION_AMD64#*@} JMOD_VERSION_AMD64=${JMOD_VERSION_AMD64%%.*} POM_JFX_VERSION=$(mvn help:evaluate "-Dexpression=javafx.version" -q -DforceStdout) @@ -72,20 +98,28 @@ jobs: exit 1 fi - name: Set version - run : mvn versions:set -DnewVersion=${{ needs.get-version.outputs.semVerStr }} + run: mvn versions:set -DnewVersion=${{ needs.get-version.outputs.semVerStr }} - name: Run maven run: mvn -B clean package -Pwin -DskipTests -Djavafx.platform=win - name: Patch target dir run: | cp LICENSE.txt target cp target/cryptomator-*.jar target/mods + - name: Run jlink with help option + id: jep-493-check + run: | + JMOD_PATHS="openjfx-jmods" + if ! $(${JAVA_HOME}/bin/jlink --help | grep -q "Linking from run-time image enabled"); then + JMOD_PATHS="${JAVA_HOME}/jmods;${JMOD_PATHS}" + fi + echo "jmod_paths=${JMOD_PATHS}" >> "$GITHUB_OUTPUT" - name: Run jlink - #Remark: no compression is applied for improved build compression later (here msi) + # Remark: no compression is applied for improved build compression later (here msi) run: > ${JAVA_HOME}/bin/jlink --verbose --output runtime - --module-path "jfxjmods;${JAVA_HOME}/jmods" + --module-path "${{ steps.jep-493-check.outputs.jmod_paths }}" --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,javafx.base,javafx.graphics,javafx.controls,javafx.fxml,jdk.crypto.mscapi,jdk.unsupported,jdk.accessibility,jdk.management.jfr,java.compiler --strip-native-commands --no-header-files @@ -110,7 +144,8 @@ jobs: --copyright "(C) 2016 - 2025 Skymatic GmbH" --app-version "${{ needs.get-version.outputs.semVerNum }}.${{ needs.get-version.outputs.revNum }}" --java-options "--enable-preview" - --java-options "--enable-native-access=org.cryptomator.jfuse.win,org.cryptomator.integrations.win" + --java-options "--enable-native-access=javafx.graphics,org.cryptomator.jfuse.win,org.cryptomator.integrations.win" + --java-options "--sun-misc-unsafe-memory-access=allow" --java-options "-Xss5m" --java-options "-Xmx256m" --java-options "-Dcryptomator.appVersion=\"${{ needs.get-version.outputs.semVerStr }}\"" @@ -127,6 +162,7 @@ jobs: --java-options "-Dcryptomator.buildNumber=\"msi-${{ needs.get-version.outputs.revNum }}\"" --java-options "-Dcryptomator.integrationsWin.autoStartShellLinkName=\"Cryptomator\"" --java-options "-Dcryptomator.integrationsWin.keychainPaths=\"@{appdata}/Cryptomator/keychain.json;@{userhome}/AppData/Roaming/Cryptomator/keychain.json\"" + --java-options "-Dcryptomator.integrationsWin.windowsHelloKeychainPaths=\"@{appdata}/Cryptomator/windowsHelloKeychain.json\"" --java-options "-Djavafx.verbose=${{ inputs.isDebug }}" --resource-dir dist/win/resources --icon dist/win/resources/Cryptomator.ico @@ -237,8 +273,8 @@ jobs: description: Cryptomator Installer timestampUrl: 'http://timestamp.digicert.com' folder: installer - - name: Add possible alpha/beta tags to installer name - run: mv installer/Cryptomator-*.msi Cryptomator-${{ needs.get-version.outputs.semVerStr }}-x64.msi + - name: Add possible alpha/beta tags and architecture to installer name + run: mv installer/Cryptomator-*.msi Cryptomator-${{ needs.get-version.outputs.semVerStr }}-${{ matrix.arch }}.msi - name: Create detached GPG signature with key 615D449FE6E6A235 run: | echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import @@ -249,7 +285,7 @@ jobs: - name: Upload artifacts uses: actions/upload-artifact@v4 with: - name: msi + name: msi-${{ matrix.arch }} path: | Cryptomator-*.msi Cryptomator-*.asc @@ -257,21 +293,43 @@ jobs: build-exe: name: Build .exe installer - runs-on: windows-latest - needs: [get-version, build-msi] + runs-on: ${{ matrix.os }} + needs: [ get-version, build-msi ] + strategy: + matrix: + include: + - arch: x64 + os: windows-latest + executable-suffix: x64 + java-dist: 'zulu' + java-version: '24.0.1+9' + java-package: 'jdk' + - arch: arm64 + os: windows-11-arm + executable-suffix: arm64 + java-dist: 'liberica' + java-version: '24.0.1+11' + java-package: 'jdk+fx' #This is needed, as liberica contains JFX 24 Jmods for Windows ARM64 steps: - uses: actions/checkout@v4 + - name: Install wix and extensions + run: | + dotnet tool install --global wix --version 6.0.0 + wix.exe extension add WixToolset.BootstrapperApplications.wixext/6.0.0 --global + wix.exe extension add WixToolset.Util.wixext/6.0.0 --global - name: Download .msi uses: actions/download-artifact@v4 with: - name: msi + name: msi-${{ matrix.arch }} path: dist/win/bundle/resources - name: Strip version info from msi file name run: mv dist/win/bundle/resources/Cryptomator*.msi dist/win/bundle/resources/Cryptomator.msi - - uses: actions/setup-java@v4 + - name: Setup Java + uses: actions/setup-java@v4 with: - distribution: ${{ env.JAVA_DIST }} - java-version: ${{ env.JAVA_VERSION }} + distribution: ${{ matrix.java-dist }} + java-version: ${{ matrix.java-version }} + java-package: ${{ matrix.java-package }} check-latest: true cache: 'maven' - name: Generate license for exe @@ -287,35 +345,36 @@ jobs: shell: pwsh - name: Download WinFsp run: | - curl --output dist/win/bundle/resources/winfsp.msi -L ${{ env.WINFSP_MSI }} + curl --output $env:WINFSP_PATH -L ${{ env.WINFSP_MSI }} + $computedHash = (Get-FileHash -Path $env:WINFSP_PATH -Algorithm SHA256).Hash.ToLower() + if ($computedHash -ne "${{ env.WINFSP_MSI_HASH }}") { + throw "Checksum mismatch for $env:WINFSP_PATH (expected ${{ env.WINFSP_MSI_HASH }}, got $computedHash)." + } + env: + WINFSP_PATH: 'dist/win/bundle/resources/winfsp.msi' shell: pwsh - name: Download Legacy-WinFsp uninstaller run: | curl --output dist/win/bundle/resources/winfsp-uninstaller.exe -L ${{ env.WINFSP_UNINSTALLER }} shell: pwsh - - name: Compile to wixObj file + - name: Create Wix Burn bundle + working-directory: dist/win run: > - "${WIX}/bin/candle.exe" dist/win/bundle/bundleWithWinfsp.wxs - -ext WixBalExtension - -ext WixUtilExtension - -out dist/win/bundle/ - -dBundleVersion="${{ needs.get-version.outputs.semVerNum }}.${{ needs.get-version.outputs.revNum }}" - -dBundleVendor="Skymatic GmbH" - -dBundleCopyright="(C) 2016 - 2025 Skymatic GmbH" - -dAboutUrl="https://cryptomator.org" - -dHelpUrl="https://cryptomator.org/contact" - -dUpdateUrl="https://cryptomator.org/downloads/" - - name: Create executable with linker - run: > - "${WIX}/bin/light.exe" -b dist/win/ dist/win/bundle/bundleWithWinfsp.wixobj - -ext WixBalExtension - -ext WixUtilExtension - -out installer/unsigned/Cryptomator-Installer.exe + wix build + -define BundleName="Cryptomator" + -define BundleVersion="${{ needs.get-version.outputs.semVerNum }}.${{ needs.get-version.outputs.revNum}}" + -define BundleVendor="Skymatic GmbH" + -define BundleCopyright="(C) 2016 - 2025 Skymatic GmbH" + -define AboutUrl="https://cryptomator.org" + -define HelpUrl="https://cryptomator.org/contact" + -define UpdateUrl="https://cryptomator.org/downloads/" + -ext "WixToolset.Util.wixext" + -ext "WixToolset.BootstrapperApplications.wixext" + ./bundle/bundleWithWinfsp.wxs + -out "../../installer/unsigned/Cryptomator-Installer.exe" - name: Detach burn engine in preparation to sign run: > - "${WIX}/bin/insignia.exe" - -ib installer/unsigned/Cryptomator-Installer.exe - -o tmp/engine.exe + wix burn detach installer/unsigned/Cryptomator-Installer.exe -engine tmp/engine.exe - name: Codesign burn engine uses: skymatic/code-sign-action@v3 with: @@ -326,10 +385,8 @@ jobs: timestampUrl: 'http://timestamp.digicert.com' folder: tmp - name: Reattach signed burn engine to installer - run : > - "${WIX}/bin/insignia.exe" - -ab tmp/engine.exe installer/unsigned/Cryptomator-Installer.exe - -o installer/Cryptomator-Installer.exe + run: > + wix burn reattach installer/unsigned/Cryptomator-Installer.exe -engine tmp/engine.exe -o installer/Cryptomator-Installer.exe - name: Codesign EXE uses: skymatic/code-sign-action@v3 with: @@ -340,7 +397,7 @@ jobs: timestampUrl: 'http://timestamp.digicert.com' folder: installer - name: Add possible alpha/beta tags to installer name - run: mv installer/Cryptomator-Installer.exe Cryptomator-${{ needs.get-version.outputs.semVerStr }}-x64.exe + run: mv installer/Cryptomator-Installer.exe Cryptomator-${{ needs.get-version.outputs.semVerStr }}-${{ matrix.executable-suffix }}.exe - name: Create detached GPG signature with key 615D449FE6E6A235 run: | echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import @@ -351,7 +408,7 @@ jobs: - name: Upload artifacts uses: actions/upload-artifact@v4 with: - name: exe + name: exe-${{ matrix.executable-suffix }} path: | Cryptomator-*.exe Cryptomator-*.asc @@ -361,16 +418,18 @@ jobs: name: Publish installers to the github release if: startsWith(github.ref, 'refs/tags/') && github.event.action == 'published' runs-on: ubuntu-latest - needs: [build-msi, build-exe] + needs: [ build-msi, build-exe ] outputs: - download-url-msi: ${{ fromJSON(steps.publish.outputs.assets)[0].browser_download_url }} - download-url-exe: ${{ fromJSON(steps.publish.outputs.assets)[1].browser_download_url }} + download-url-msi-x64: ${{ fromJSON(steps.publish.outputs.assets)[0].browser_download_url }} + download-url-msi-arm64: ${{ fromJSON(steps.publish.outputs.assets)[1].browser_download_url }} + download-url-exe-x64: ${{ fromJSON(steps.publish.outputs.assets)[2].browser_download_url }} + download-url-exe-arm64: ${{ fromJSON(steps.publish.outputs.assets)[3].browser_download_url }} steps: - name: Download installers uses: actions/download-artifact@v4 with: merge-multiple: true - - name: Publish .msi on GitHub Releases + - name: Publish installers on GitHub Releases id: publish uses: softprops/action-gh-release@v2 with: @@ -378,22 +437,38 @@ jobs: token: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }} # do not change ordering of filelist, required for correct job output files: | - *.msi - *.exe + *x64.msi + *arm64.msi + *x64.exe + *arm64.exe *.asc - allowlist-msi: + allowlist-msi-x64: uses: ./.github/workflows/av-whitelist.yml - needs: [publish] + needs: [ publish ] with: - url: ${{ needs.publish.outputs.download-url-msi }} + url: ${{ needs.publish.outputs.download-url-msi-x64 }} secrets: inherit - allowlist-exe: + allowlist-msi-arm64: uses: ./.github/workflows/av-whitelist.yml - needs: [publish, allowlist-msi] + needs: [ publish ] with: - url: ${{ needs.publish.outputs.download-url-exe }} + url: ${{ needs.publish.outputs.download-url-msi-arm64 }} + secrets: inherit + + allowlist-exe-x64: + uses: ./.github/workflows/av-whitelist.yml + needs: [ publish, allowlist-msi-x64 ] + with: + url: ${{ needs.publish.outputs.download-url-exe-x64 }} + secrets: inherit + + allowlist-exe-arm64: + uses: ./.github/workflows/av-whitelist.yml + needs: [ publish, allowlist-msi-arm64 ] + with: + url: ${{ needs.publish.outputs.download-url-exe-arm64 }} secrets: inherit notify-winget: @@ -410,7 +485,7 @@ jobs: SLACK_ICON: false SLACK_ICON_EMOJI: ':bot:' SLACK_CHANNEL: 'cryptomator-desktop' - SLACK_TITLE: "MSI of ${{ github.event.repository.name }} ${{ github.event.release.tag_name }} published." - SLACK_MESSAGE: "Ready to ." + SLACK_TITLE: "MSI packages of ${{ github.event.repository.name }} ${{ github.event.release.tag_name }} published." + SLACK_MESSAGE: "Ready to ." SLACK_FOOTER: false - MSG_MINIMAL: true \ No newline at end of file + MSG_MINIMAL: true diff --git a/.github/workflows/winget.yml b/.github/workflows/winget.yml index 6d5a9c57d..476e409e3 100644 --- a/.github/workflows/winget.yml +++ b/.github/workflows/winget.yml @@ -23,5 +23,5 @@ jobs: identifier: Cryptomator.Cryptomator version: ${{ inputs.tag }} release-tag: ${{ inputs.tag }} - installers-regex: '\.msi$' + installers-regex: '-x64\.msi$' token: ${{ secrets.CRYPTOBOT_WINGET_TOKEN }} \ No newline at end of file diff --git a/.idea/misc.xml b/.idea/misc.xml index 09accc25b..cbe05c79b 100644 --- a/.idea/misc.xml +++ b/.idea/misc.xml @@ -8,7 +8,7 @@ - + \ No newline at end of file diff --git a/.idea/runConfigurations/Cryptomator_Linux.xml b/.idea/runConfigurations/Cryptomator_Linux.xml index 1a1b394b5..e9ecf3a50 100644 --- a/.idea/runConfigurations/Cryptomator_Linux.xml +++ b/.idea/runConfigurations/Cryptomator_Linux.xml @@ -2,7 +2,7 @@