tailscale

Commit Graph

Author	SHA1	Message	Date
Brad Fitzpatrick	e499a6bae8	release/dist/unixpkgs: revert iptables move to Recommends, make it Depends Partially reverts `1bd3edbb46` (but keeps part of it) iptables is almost always required but not strictly needed. Even if you can technically run Tailscale without it (by manually configuring nftables or userspace mode), we still now mark this as "Depends" because our previous experiment in https://github.com/tailscale/tailscale/issues/9236 of making it only Recommends caused too many problems. Until our nftables table is more mature, we'd rather err on the side of wasting a little disk by including iptables for people who might not need it rather than handle reports of it being missing. Updates #9236 Change-Id: I86cc8aa3f78dafa0b4b729f55fb82eef6066be1c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Aaron Klotz	ea6ca78963	release/dist, tool/gocross: add fake "windowsdll" GOOS to gocross We're going to need to build a DLL containing custom actions for the installer. This patch adds the foundations of that capability to dist and gocross. Updates https://github.com/tailscale/corp/issues/13998 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	1 year ago
Brad Fitzpatrick	1bd3edbb46	release/dist/unixpkgs: demote deb iptables+iproute2 packages to recommended Fixes #9236 Change-Id: Idbad2edb0262ef842afd6b40ae47f46e685b112d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Will Norris	9a3bc9049c	client/web,cmd/tailscale: add prefix flag for web command We already had a path on the web client server struct, but hadn't plumbed it through to the CLI. Add that now and use it for Synology and QNAP instead of hard-coding the path. (Adding flag for QNAP is tailscale/tailscale-qpkg#112) This will allow supporting other environments (like unraid) without additional changes to the client/web package. Also fix a small bug in unraid handling to only include the csrf token on POST requests. Updates tailscale/corp#13775 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Will Norris	d74c771fda	client/web: always use new web client; remove old client This uses the new react-based web client for all builds, not just with the --dev flag. If the web client assets have not been built, the client will serve a message that Tailscale was built without the web client, and link to build instructions. Because we will include the web client in all of our builds, this should only be seen by developers or users building from source. (And eventually this will be replaced by attempting to download needed assets as runtime.) We do now checkin the build/index.html file, which serves the error message when assets are unavailable. This will also eventually be used to trigger in CI when new assets should be built and uploaded to a well-known location. Updates tailscale/corp#13775 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Andrew Lytvynov	18d9c92342	release/dist/cli: add verify-package-signature command (#9110 ) Helper command to verify package signatures, mainly for debugging. Also fix a copy-paste mistake in error message in distsign. Updates #8760 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	ce5909dafc	release/dist: remove extra Close on a signed file (#9094 ) We pass the file as an io.Reader to http.Post under the hood as request body. Post, helpfully, detects that the body is an io.Closer and closes it. So when we try to explicitly close it again, we get "file already closed" error. The Close there is not load-bearing, we have a defer for it anyway. Remove the explicit close and error check. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	b42c4e2da1	cmd/dist,release/dist: add distsign signing hooks (#9070 ) Add `dist.Signer` hook which can arbitrarily sign linux/synology artifacts. Plumb it through in `cmd/dist` and remove existing tarball signing key. Distsign signing will happen on a remote machine, not using a local key. Updates #755 Updates #8760 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	d45af7c66f	release/dist/cli: add sign-key and verify-key-signature commands (#9041 ) Now we have all the commands to generate the key hierarchy and verify that signing keys were signed correctly: ``` $ ./tool/go run ./cmd/dist gen-key --priv-path root-priv.pem --pub-path root-pub.pem --root wrote private key to root-priv.pem wrote public key to root-pub.pem $ ./tool/go run ./cmd/dist gen-key --priv-path signing-priv.pem --pub-path signing-pub.pem --signing wrote private key to signing-priv.pem wrote public key to signing-pub.pem $ ./tool/go run ./cmd/dist sign-key --root-priv-path root-priv.pem --sign-pub-path signing-pub.pem wrote signature to signature.bin $ ./tool/go run ./cmd/dist verify-key-signature --root-pub-path root-pub.pem --sign-pub-path signing-pub.pem --sig-path signature.bin signature ok ``` Updates #8760 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	f61dd12f05	clientupdate/distsign: use distinct PEM types for root/signing keys (#9045 ) To make key management less error-prone, use different PEM block types for root and signing keys. As a result, separate out most of the Go code between root/signing keys too. Updates #8760 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Will Norris	09068f6c16	release: add empty embed.FS for release files This ensures that `go mod vendor` includes these files, which are needed for client builds run in corp. Updates tailscale/corp#13775 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Andrew Lytvynov	05523bdcdd	release/dist/cli: add gen-key command (#9023 ) Add a new subcommand to generate a Ed25519 key pair for release signing. The same command can be used to generate both root and signing keys. Updates #8760 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Will Norris	3722b05465	release/dist: run yarn build before building CLI This builds the assets for the new web client as part of our release process. The path to the web client source is specified by the -web-client-root flag. This allows corp builds to first vendor the tailscale.com module, and then build the web client assets in the vendor directory. The default value for the -web-client-root flag is empty, so no assets are built by default. This is an update of the previously reverted `0fb95ec` Updates tailscale/corp#13775 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Will Norris	a461d230db	Revert "release/dist: run yarn build before building CLI" This caused breakages on the build server: synology/dsm7/x86_64: chdir /home/ubuntu/builds/2023-08-21T21-47-38Z-unstable-main-tagged-devices/0/client/web: no such file or directory synology/dsm7/i686: chdir /home/ubuntu/builds/2023-08-21T21-47-38Z-unstable-main-tagged-devices/0/client/web: no such file or directory synology/dsm7/armv8: chdir /home/ubuntu/builds/2023-08-21T21-47-38Z-unstable-main-tagged-devices/0/client/web: no such file or directory ... Reverting while I investigate. This reverts commit `0fb95ec07d`. Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Will Norris	0fb95ec07d	release/dist: run yarn build before building CLI This builds the assets for the new web client as part of our release process. These assets will soon be embedded into the cmd/tailscale binary, but are not actually done so yet. Updates tailscale/corp#13775 Signed-off-by: Will Norris <will@tailscale.com>	1 year ago
Andrew Lytvynov	371e1ebf07	cmd/dist,release/dist: expose RPM signing hook (#8789 ) Plumb a signing callback function to `unixpkgs.rpmTarget` to allow signing RPMs. This callback is optional and RPMs will build unsigned if not set, just as before. Updates https://github.com/tailscale/tailscale/issues/1882 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	eb6883bb5a	go.mod: upgrade nfpm to v2 (#8786 ) Upgrade the nfpm package to the latest version to pick up `24a43c5ad7`. The upgrade is from v0 to v2, so there was some breakage to fix. Generated packages should have the same contents as before. Updates https://github.com/tailscale/tailscale/issues/1882 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	eef15b4ffc	cmd/dist,release/dist: sign release tarballs with an ECDSA key (#8759 ) Pass an optional PEM-encoded ECDSA key to `cmd/dist` to sign all built tarballs. The signature is stored next to the tarball with a `.sig` extension. Tested this with an `openssl`-generated key pair and verified the resulting signature. Updates #8760 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
David Anderson	0a86705d59	release/dist: add helper to build Go binaries with custom tags Updates tailscale/corp#12861 Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	4a58b1c293	release/dist/synology: remove 'version' field from ui/config As far as I can tell from the DSM documentation and known undocumented fields, there is no 'version' field in this config file that DSM cares about. Updates #8232 Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	fc5b137d25	release/dist/synology: build hi3535 as armv5, not armv7 This platform is technically an armv7, but has no hardware floating point unit. armv5 is the only target Go understands to lack floating point, so use that. Updates #6860 Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	32e0ba5e68	release/dist/synology: build synology packages with cmd/dist Updates #8217 Signed-off-by: David Anderson <danderson@tailscale.com>	1 year ago
David Anderson	c0b4a54146	release/dist/cli: correctly handle absolute build outputs in manifest Some builders return absolute paths to build products already. When that happens, the manifest writing logic shouldn't tack on another absolute prefix. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
salman	1ce08256c0	release/dist: add deb/rpm arch mappings for mipses According to https://wiki.debian.org/SupportedArchitectures Debian does not support big-endian mips64, so that one remains disabled. According to https://fedoraproject.org/wiki/Architectures Fedora only supports little-endian mips, so leaving both big-endian ones out too. Updates #8005. Signed-off-by: salman <salman@tailscale.com>	2 years ago
David Anderson	311352d195	release/dist/cli: add --verbose to print subcommand output By default, cmd/dist only prints the output of failed commands. With this, you can turn all the noisy output back on. Updates tailscale/corp#9045 Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	0df11253ec	release/dist: add a helper to run commands The helper suppresses output if the command runs successfully. If the command fails, it dumps the buffered output to stdout before returning the error. This means the happy path isn't swamped by debug noise or xcode being intensely verbose about what kind of day it's having, but you still get debug output when something goes wrong. Updates tailscale/corp#9045 Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	04be5ea725	release/dist/cli: default to "all" for list if no filters given Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	587eb32a83	release/dist: add forgotten license headers Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	cf74ee49ee	release/dist/cli: factor out the CLI boilerplace from cmd/dist Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	fc4b25d9fd	release: open-source release build logic for unix packages Updates tailscale/corp#9221 Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago

30 Commits (de2af54ffcf22e995c9e09f32a7ef14c6906a5ac)