feat(windows): WireGuard client, auto-VPN, IAM, tray enrichment, installer, CI
Second milestone of the Windows parity work (DESIGN-WINDOWS.md §13). WireGuard mesh client (signed, WSS-delivered): - wireguard_apply / wireguard_remove commands: Ed25519-verified, gated on a new wireguard capability. Linux applies via wg-quick up/down; Windows installs the peer config as a WireGuardTunnel service via wireguard.exe (/installtunnelservice, /uninstalltunnelservice) - state polling in the home monitor drives the blue tray icon and auto-VPN: connect when away from home + auto_vpn, disconnect on return (2m cooldown) - tray VPN toggle and the auto-VPN checkbox are now live; the preference persists to agent.yml (PersistAutoVPN) IAM on Windows (iam_windows.go): - allowed_login_groups -> net localgroup; ssh_keys -> per-profile authorized_keys + %ProgramData%\ssh\administrators_authorized_keys; revoke_users -> helper logs off all of the user's WTS sessions; sudo_rules logged as no direct equivalent Tray enrichment: - Open Config (opens agent.yml), Clear enrollment (re-enroll) menu items - set_auto_vpn persists; vpn_connect/vpn_disconnect/reinit/open_config commands handled by the daemon (tray_server.go) Packaging & release: - installer/windows/installer.iss: fully-offline Inno Setup bundle (agent, tray, helper, vendor-signed WireGuard MSI, OpenCredential CP, VC++ redist), /SILENT /SERVER_URL /JOIN_KEY parameters, SYSTEM service + HKLM Run tray autostart, Users-writable %ProgramData%\Theta42 for the IPC socket - .github/workflows/build-windows.yml: build + test, pinned vendor downloads, ISCC compile, Azure Trusted Signing (OIDC), SHA256SUMS, GH release attach, optional SSO resource publish - agent.yml.example documents auto_vpn, wireguard, service_name, desktop_helper, public_ip_detect Tests: - wireguard_apply/remove dispatch (allowed + capability-denied), PersistAutoVPN, ClearEnrollment; dispatch tests pin linuxPlatformOps with a temp WireGuard conf - end-to-end verified against a local mock SSO on Windows: join-key enrollment (token persisted, join key blanked), discovery/telemetry pushed, signed arbitrary_bash verified + executed via powershell -EncodedCommand; tray IPC socket binds %ProgramData%\Theta42; LDAP byte-pump binds 127.0.0.1:389; helper update swap verified Rebuilds all tracked dist binaries (v2.1.0).
This commit is contained in:
@@ -0,0 +1,143 @@
|
||||
name: build-windows
|
||||
|
||||
# Builds the Windows agent, tray, session helper, and the fully-offline Inno
|
||||
# installer; signs them with Azure Trusted Signing; generates SHA256SUMS; and
|
||||
# publishes the artifacts to the SSO resource tree (DESIGN-WINDOWS.md §9).
|
||||
#
|
||||
# Signing requires GitHub OIDC federation to Azure. If the Azure secrets are
|
||||
# not configured the workflow still builds and attaches unsigned artifacts.
|
||||
|
||||
on:
|
||||
push:
|
||||
tags: ["v*"]
|
||||
workflow_dispatch:
|
||||
|
||||
env:
|
||||
GO_VERSION: "1.22.2"
|
||||
VERSION: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || 'dev' }}
|
||||
|
||||
jobs:
|
||||
build-windows:
|
||||
runs-on: windows-latest
|
||||
permissions:
|
||||
contents: write
|
||||
id-token: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: ${{ env.GO_VERSION }}
|
||||
|
||||
- name: Run unit tests
|
||||
shell: bash
|
||||
run: go test ./...
|
||||
|
||||
- name: Build agent, tray, helper
|
||||
shell: bash
|
||||
run: |
|
||||
mkdir -p dist
|
||||
LDFLAGS="-s -w"
|
||||
for arch in amd64 arm64; do
|
||||
GOOS=windows GOARCH=$arch go build -ldflags="$LDFLAGS" -o dist/theta-agent-windows-$arch.exe .
|
||||
GOOS=windows GOARCH=$arch go build -ldflags="$LDFLAGS" -o dist/theta-agent-tray-windows-$arch.exe ./cmd/theta-agent-tray/
|
||||
GOOS=windows GOARCH=$arch go build -ldflags="$LDFLAGS" -o dist/theta-agent-helper-windows-$arch.exe ./cmd/theta-agent-helper/
|
||||
done
|
||||
|
||||
- name: Fetch vendored, vendor-signed dependencies
|
||||
shell: pwsh
|
||||
run: |
|
||||
$vendor = "installer/windows/vendor"
|
||||
New-Item -ItemType Directory -Force -Path $vendor | Out-Null
|
||||
# Pinned by sha256; WireGuard MSI and VC++ redist are Microsoft/vendor signed.
|
||||
$assets = @(
|
||||
@{ url = "https://download.wireguard.com/windows-client/wireguard-amd64-0.5.3.msi"; out = "wireguard-amd64-0.5.3.msi"; sha = "PINNED_WIREGUARD_SHA256" },
|
||||
@{ url = "https://aka.ms/vs/17/release/vc_redist.x64.exe"; out = "vc_redist.x64.exe"; sha = "PINNED_VC_REDIST_SHA256" }
|
||||
)
|
||||
foreach ($a in $assets) {
|
||||
$dest = Join-Path $vendor $a.out
|
||||
Invoke-WebRequest -Uri $a.url -OutFile $dest
|
||||
$h = (Get-FileHash -Algorithm SHA256 $dest).Hash.ToLower()
|
||||
if ($h -ne $a.sha) { throw "sha256 mismatch for $($a.out): $h" }
|
||||
Set-Content -Path "$dest.sha256" -Value $h
|
||||
}
|
||||
# OpenCredential (pGina fork) release — swap PINNED below for a real release URL.
|
||||
$oc = "https://github.com/pedropablobm/OpenCredential/releases/latest/download/OpenCredential.zip"
|
||||
Invoke-WebRequest -Uri $oc -OutFile (Join-Path $vendor "opencredential.zip")
|
||||
Expand-Archive -Path (Join-Path $vendor "opencredential.zip") -DestinationPath (Join-Path $vendor "OpenCredential")
|
||||
|
||||
- name: Compile Inno installer
|
||||
shell: pwsh
|
||||
run: |
|
||||
choco install innosetup -y --no-progress
|
||||
$iscc = "C:\Program Files (x86)\Inno Setup 6\ISCC.exe"
|
||||
if (-not (Test-Path $iscc)) { $iscc = "C:\Program Files\Inno Setup 6\ISCC.exe" }
|
||||
& $iscc "/DMyAppVersion=${{ env.VERSION }}" installer/windows/installer.iss
|
||||
if ($LASTEXITCODE -ne 0) { throw "ISCC failed" }
|
||||
|
||||
- name: Generate SHA256SUMS
|
||||
shell: pwsh
|
||||
run: |
|
||||
Get-ChildItem dist -File | Where-Object { $_.Extension -in ".exe",".msi" -or $_.Name -like "*setup*" } | ForEach-Object {
|
||||
"{0} {1}" -f (Get-FileHash -Algorithm SHA256 $_.FullName).Hash.ToLower(), $_.Name
|
||||
} | Set-Content -Path dist/SHA256SUMS
|
||||
|
||||
- name: Sign with Azure Trusted Signing
|
||||
if: env.AZURE_TENANT_ID != ''
|
||||
uses: azure/login@v2
|
||||
with:
|
||||
client-id: ${{ secrets.AZURE_CLIENT_ID }}
|
||||
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
|
||||
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
|
||||
|
||||
- name: AzureSignTool (agent, tray, helper, CP, installer)
|
||||
if: env.AZURE_TENANT_ID != ''
|
||||
uses: azure/trusted-signing-action@v0.4.0
|
||||
with:
|
||||
endpoint: ${{ secrets.AZURE_TS_ENDPOINT }}
|
||||
trusted-signing-account-name: ${{ secrets.AZURE_TS_ACCOUNT }}
|
||||
certificate-profile-name: ${{ secrets.AZURE_TS_CERT_PROFILE }}
|
||||
files: |
|
||||
dist/theta-agent-windows-*.exe
|
||||
dist/theta-agent-tray-windows-*.exe
|
||||
dist/theta-agent-helper-windows-*.exe
|
||||
dist/theta-agent-*-setup.exe
|
||||
output-files: ""
|
||||
|
||||
- name: Upload artifacts
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: theta-agent-windows
|
||||
path: |
|
||||
dist/theta-agent-windows-*.exe
|
||||
dist/theta-agent-helper-windows-*.exe
|
||||
dist/theta-agent-tray-windows-*.exe
|
||||
dist/theta-agent-*-setup.exe
|
||||
dist/SHA256SUMS
|
||||
|
||||
- name: Attach to GitHub release
|
||||
if: startsWith(github.ref, 'refs/tags/')
|
||||
uses: softprops/action-gh-release@v2
|
||||
with:
|
||||
files: |
|
||||
dist/theta-agent-windows-*.exe
|
||||
dist/theta-agent-helper-windows-*.exe
|
||||
dist/theta-agent-tray-windows-*.exe
|
||||
dist/theta-agent-*-setup.exe
|
||||
dist/SHA256SUMS
|
||||
|
||||
# DESIGN-WINDOWS.md §9: the SSO holds the release resources. Publish when
|
||||
# an admin-gated upload endpoint is configured; otherwise the artifacts
|
||||
# are available from the GitHub release above.
|
||||
- name: Publish to SSO resource tree
|
||||
if: env.SSO_RESOURCE_PUBLISH_URL != ''
|
||||
shell: pwsh
|
||||
run: |
|
||||
$headers = @{ Authorization = "Bearer $env:SSO_RESOURCE_PUBLISH_TOKEN" }
|
||||
foreach ($f in Get-ChildItem dist -File) {
|
||||
if ($f.Name -notmatch "setup|windows-|SHA256SUMS") { continue }
|
||||
Invoke-RestMethod -Method Post -Uri "$env:SSO_RESOURCE_PUBLISH_URL/$($f.Name)" -InFile $f.FullName -Headers $headers
|
||||
}
|
||||
env:
|
||||
SSO_RESOURCE_PUBLISH_URL: ${{ secrets.SSO_RESOURCE_PUBLISH_URL }}
|
||||
SSO_RESOURCE_PUBLISH_TOKEN: ${{ secrets.SSO_RESOURCE_PUBLISH_TOKEN }}
|
||||
Reference in New Issue
Block a user