Merge branch 'master' of github.com:Eugeny/tabby

.github/workflows/build.yml

@@ -31,7 +31,7 @@ jobs:
       run: yarn run lint
 
   macOS-Build:
-    runs-on: macos-12
+    runs-on: macos-15
     needs: Lint
     strategy:
       matrix:
@@ -61,8 +61,6 @@ jobs:
 
     - name: Install deps
       run: |
-        sudo -H pip3 install setuptools
-        sudo npm i -g yarn
         yarn --network-timeout 1000000
       env:
         ARCH: ${{matrix.arch}}
@@ -82,7 +80,7 @@ jobs:
 
     - name: Build and sign packages
       run: scripts/build-macos.mjs
-      if: github.repository == 'Eugeny/tabby' && github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags'))
+      if: github.event_name == 'push' && (github.ref_protected || startsWith(github.ref, 'refs/tags'))
       env:
         ARCH: ${{matrix.arch}}
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -97,7 +95,7 @@ jobs:
 
     - name: Build packages without signing
       run: scripts/build-macos.mjs
-      if: "! (github.repository == 'Eugeny/tabby' && github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags')))"
+      if: "! (github.event_name == 'push' && (github.ref_protected || startsWith(github.ref, 'refs/tags')))"
       env:
         ARCH: ${{matrix.arch}}
         # DEBUG: electron-builder,electron-builder:*
@@ -244,7 +242,7 @@ jobs:
 
     - name: Upload packages to packagecloud.io
       uses: TykTechnologies/packagecloud-action@main
-      if: github.repository == 'Eugeny/tabby' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
+      if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
       env:
         PACKAGECLOUD_TOKEN: ${{ secrets.PACKAGECLOUD_TOKEN }}
       with:
@@ -312,6 +310,10 @@ jobs:
       with:
         fetch-depth: 0
 
+    - name: Code signing with Software Trust Manager
+      uses: digicert/[email protected]
+      if: github.event_name == 'push' && (startsWith(github.ref, 'refs/tags'))
+
     - name: Installing Node
       uses: actions/[email protected]
       with:
@@ -335,20 +337,48 @@ jobs:
       env:
         ARCH: ${{matrix.arch}}
 
+    - name: Decode certificate
+      if: github.event_name == 'push' && (startsWith(github.ref, 'refs/tags'))
+      env:
+        SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+      run: |
+        SM_CLIENT_CERT_FILE=$RUNNER_TEMP/certificate.p12
+        echo "$SM_CLIENT_CERT_FILE_B64" | base64 --decode > $SM_CLIENT_CERT_FILE
+        echo "SM_CLIENT_CERT_FILE=$SM_CLIENT_CERT_FILE" >> "$GITHUB_ENV"
+      shell: bash
+
     - name: Build and sign packages
-      run: node scripts/build-windows.mjs
-      if: github.repository == 'Eugeny/tabby' && github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags'))
+      if: github.event_name == 'push' && (startsWith(github.ref, 'refs/tags'))
+      shell: powershell
+      run: |
+        Get-FileHash $env:SM_CLIENT_CERT_FILE -Algorithm MD5
+        smksp_registrar.exe list
+        smctl.exe healthcheck
+        smctl.exe keypair ls
+        smctl windows certsync --keypair-alias $env:SM_KEYPAIR_ALIAS
+        smctl.exe certificate ls
+        C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
+        smksp_cert_sync.exe
+
+        # not used but necessary for electron-builder to run
+        $env:WIN_CSC_LINK=$env:SM_CLIENT_CERT_FILE
+        $env:WIN_CSC_KEY_PASSWORD=$env:SM_CLIENT_CERT_PASSWORD
+        node scripts/build-windows.mjs
       env:
         ARCH: ${{matrix.arch}}
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         KEYGEN_TOKEN: ${{ secrets.KEYGEN_TOKEN }}
-        WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
-        WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
+        SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+        SM_PUBLISHER_NAME: ${{ secrets.SM_PUBLISHER_NAME }}
+        SM_API_KEY: ${{ vars.SM_API_KEY }}
+        SM_HOST: ${{ vars.SM_HOST }}
+        SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ vars.SM_CODE_SIGNING_CERT_SHA1_HASH }}
+        SM_KEYPAIR_ALIAS: ${{ vars.SM_KEYPAIR_ALIAS }}
         DEBUG: electron-builder,electron-builder:*
 
     - name: Build packages without signing
       run: node scripts/build-windows.mjs
-      if: "! (github.repository == 'Eugeny/tabby' && github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags')))"
+      if: "! (github.event_name == 'push' && (startsWith(github.ref, 'refs/tags')))"
       env:
         ARCH: ${{matrix.arch}}
 

extras/clink/clink.bat

@@ -1,63 +1,64 @@
-:: Copyright (c) 2012 Martin Ridgers
-:: License: http://opensource.org/licenses/MIT
-
 @echo off
+rem -- Copyright (c) 2012 Martin Ridgers
+rem -- Portions Copyright (c) 2020-2024 Christopher Antos
+rem -- License: http://opensource.org/licenses/MIT
+
 setlocal enableextensions
 set clink_profile_arg=
 set clink_quiet_arg=
 
-:: Mimic cmd.exe's behaviour when starting from the start menu.
-if /i "%1"=="startmenu" (
+rem -- Mimic cmd.exe's behaviour when starting from the start menu.
+if /i "%~1"=="startmenu" (
     cd /d "%userprofile%"
     shift
 )
 
-:: Check for the --profile option.
-if /i "%1"=="--profile" (
+rem -- Check for the --profile option.
+if /i "%~1"=="--profile" (
     set clink_profile_arg=--profile "%~2"
     shift
     shift
 )
 
-:: Check for the --quiet option.
-if /i "%1"=="--quiet" (
+rem -- Check for the --quiet option.
+if /i "%~1"=="--quiet" (
     set clink_quiet_arg= --quiet
     shift
 )
 
-:: If the .bat is run without any arguments, then start a cmd.exe instance.
-if "%1"=="" (
+rem -- If the .bat is run without any arguments, then start a cmd.exe instance.
+if _%1==_ (
     call :launch
     goto :end
 )
 
-:: Test for autorun.
-if defined CLINK_NOAUTORUN if /i "%1"=="inject" if /i "%2"=="--autorun" goto :end
-
-:: Endlocal before inject tags the prompt.
-endlocal
+rem -- Test for autorun.
+if defined CLINK_NOAUTORUN if /i "%~1"=="inject" if /i "%~2"=="--autorun" goto :end
 
-:: Pass through to appropriate loader.
+rem -- Forward to appropriate loader, and endlocal before inject tags the prompt.
 if /i "%processor_architecture%"=="x86" (
+        endlocal
         "%~dp0\clink_x86.exe" %*
 ) else if /i "%processor_architecture%"=="arm64" (
+        endlocal
         "%~dp0\clink_arm64.exe" %*
 ) else if /i "%processor_architecture%"=="amd64" (
     if defined processor_architew6432 (
+        endlocal
         "%~dp0\clink_x86.exe" %*
     ) else (
+        endlocal
         "%~dp0\clink_x64.exe" %*
     )
 )
 
-:end
-goto :eof
+goto :end
 
-::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
 :launch
-setlocal
+setlocal enableextensions
 set WT_PROFILE_ID=
 set WT_SESSION=
 start "Clink" cmd.exe /s /k ""%~dpnx0" inject %clink_profile_arg%%clink_quiet_arg%"
 endlocal
-exit /b 0
+
+:end

extras/clink/default_inputrc

@@ -4,10 +4,10 @@
 # Override the built-in Readline defaults with ones that provide a more
 # enhanced Clink experience.
 
-colored-completion-prefix                   on
-colored-stats                               on
-mark-symlinked-directories                  on
-completion-auto-query-items                 on
-history-point-at-end-of-anchored-search     on
-search-ignore-case                          on
+set colored-completion-prefix                   on
+set colored-stats                               on
+set mark-symlinked-directories                  on
+set completion-auto-query-items                 on
+set history-point-at-end-of-anchored-search     on
+set search-ignore-case                          on
 

extras/clink/default_settings

@@ -4,28 +4,26 @@
 # Override built-in default settings with ones that provide a more
 # enhanced Clink experience.
 
-autosuggest.enable                = True
 clink.default_bindings            = windows
 cmd.ctrld_exits                   = False
 color.arginfo                     = sgr 38;5;172
 color.argmatcher                  = sgr 1;38;5;40
-color.cmd                         = sgr 1;38;5;231
+color.cmd                         = bold
 color.cmdredir                    = sgr 38;5;172
-color.cmdsep                      = sgr 38;5;214
+color.cmdsep                      = sgr 38;5;135
 color.comment_row                 = sgr 38;5;87;48;5;18
 color.description                 = sgr 38;5;39
 color.doskey                      = sgr 1;38;5;75
 color.executable                  = sgr 1;38;5;33
-color.filtered                    = sgr 38;5;231
+color.filtered                    = bold
 color.flag                        = sgr 38;5;117
 color.hidden                      = sgr 38;5;160
 color.histexpand                  = sgr 97;48;5;55
 color.horizscroll                 = sgr 38;5;16;48;5;30
-color.input                       = sgr 38;5;222
+color.input                       = sgr 38;5;214
 color.readonly                    = sgr 38;5;28
-color.selected_completion         = sgr 38;5;16;48;5;254
+color.selected_completion         = sgr 7
 color.selection                   = sgr 38;5;16;48;5;179
-color.suggestion                  = sgr 38;5;239
 color.unrecognized                = sgr 38;5;203
 history.max_lines                 = 25000
 history.time_stamp                = show

package.json

@@ -96,7 +96,8 @@
     "*/pug": "^3",
     "lzma-native": "^8.0.6",
     "**/graceful-fs": "^4.2.4",
-    "nan": "2.17.0"
+    "nan": "2.17.0",
+    "node-gyp": "^10.0.0"
   },
   "scripts": {
     "build": "npm run build:typings && node scripts/build-modules.mjs",

scripts/build-windows.mjs

@@ -2,11 +2,15 @@
 /* eslint-disable @typescript-eslint/prefer-nullish-coalescing */
 import { build as builder } from 'electron-builder'
 import * as vars from './vars.mjs'
+import { execSync } from 'child_process'
 
 const isTag = (process.env.GITHUB_REF || process.env.BUILD_SOURCEBRANCH || '').startsWith('refs/tags/')
+const keypair = process.env.SM_KEYPAIR_ALIAS
 
 process.env.ARCH = process.env.ARCH || process.arch
 
+console.log('Signing enabled:', !!keypair)
+
 builder({
     dir: true,
     win: ['nsis', 'zip'],
@@ -22,7 +26,32 @@ builder({
                 channel: `latest-${process.env.ARCH}`,
             },
         ] : undefined,
+        forceCodeSigning: !!keypair,
+        win: {
+            certificateSha1: process.env.SM_CODE_SIGNING_CERT_SHA1_HASH,
+            publisherName: process.env.SM_PUBLISHER_NAME,
+            signingHashAlgorithms: ['sha256'],
+            sign: keypair ? async function (configuration) {
+                console.log('Signing', configuration)
+                if (configuration.path) {
+                    try {
+                        const out = execSync(
+                            `smctl sign --keypair-alias=${keypair} --input "${String(configuration.path)}"`
+                        )
+                        if (out.toString().includes('FAILED')) {
+                            throw new Error(out.toString())
+                        }
+                        console.log(out)
+                    } catch (e) {
+                        console.error(`Failed to sign ${configuration.path}`)
+                        console.error(e)
+                        process.exit(1)
+                    }
+                }
+            } : undefined,
+        },
     },
+
     publish: process.env.KEYGEN_TOKEN ? isTag ? 'always' : 'onTagOrDraft' : 'never',
 }).catch(e => {
     console.error(e)

tabby-electron/yarn.lock

@@ -413,6 +413,11 @@ simple-swizzle@^0.2.2:
   dependencies:
     is-arrayish "^0.3.1"
 
+ssh-config@^5.0.0:
+  version "5.0.1"
+  resolved "https://registry.yarnpkg.com/ssh-config/-/ssh-config-5.0.1.tgz#44ee7db10d3340c79780afd142af05cf641408b9"
+  integrity sha512-Bh9CRGFq7pLpWFPmLOyirzYhbpme8FXZe3lZckWvmABdcIEiGB8tNbmEEZdppnr6EiQ0WcGTMoYDp8Tjomq9gw==
+
 [email protected]:
   version "0.0.10"
   resolved "https://registry.yarnpkg.com/stack-trace/-/stack-trace-0.0.10.tgz#547c70b347e8d32b4e108ea1a2a159e5fdde19c0"