feat(windows): WireGuard client, auto-VPN, IAM, tray enrichment, installer, CI

Second milestone of the Windows parity work (DESIGN-WINDOWS.md §13).

WireGuard mesh client (signed, WSS-delivered):
- wireguard_apply / wireguard_remove commands: Ed25519-verified, gated on a new
  wireguard capability. Linux applies via wg-quick up/down; Windows installs the
  peer config as a WireGuardTunnel service via wireguard.exe
  (/installtunnelservice, /uninstalltunnelservice)
- state polling in the home monitor drives the blue tray icon and auto-VPN:
  connect when away from home + auto_vpn, disconnect on return (2m cooldown)
- tray VPN toggle and the auto-VPN checkbox are now live; the preference
  persists to agent.yml (PersistAutoVPN)

IAM on Windows (iam_windows.go):
- allowed_login_groups -> net localgroup; ssh_keys -> per-profile
  authorized_keys + %ProgramData%\ssh\administrators_authorized_keys;
  revoke_users -> helper logs off all of the user's WTS sessions;
  sudo_rules logged as no direct equivalent

Tray enrichment:
- Open Config (opens agent.yml), Clear enrollment (re-enroll) menu items
- set_auto_vpn persists; vpn_connect/vpn_disconnect/reinit/open_config commands
  handled by the daemon (tray_server.go)

Packaging & release:
- installer/windows/installer.iss: fully-offline Inno Setup bundle (agent,
  tray, helper, vendor-signed WireGuard MSI, OpenCredential CP, VC++ redist),
  /SILENT /SERVER_URL /JOIN_KEY parameters, SYSTEM service + HKLM Run tray
  autostart, Users-writable %ProgramData%\Theta42 for the IPC socket
- .github/workflows/build-windows.yml: build + test, pinned vendor downloads,
  ISCC compile, Azure Trusted Signing (OIDC), SHA256SUMS, GH release attach,
  optional SSO resource publish
- agent.yml.example documents auto_vpn, wireguard, service_name,
  desktop_helper, public_ip_detect

Tests:
- wireguard_apply/remove dispatch (allowed + capability-denied), PersistAutoVPN,
  ClearEnrollment; dispatch tests pin linuxPlatformOps with a temp WireGuard conf
- end-to-end verified against a local mock SSO on Windows: join-key enrollment
  (token persisted, join key blanked), discovery/telemetry pushed, signed
  arbitrary_bash verified + executed via powershell -EncodedCommand; tray IPC
  socket binds %ProgramData%\Theta42; LDAP byte-pump binds 127.0.0.1:389;
  helper update swap verified

Rebuilds all tracked dist binaries (v2.1.0).
This commit is contained in:
2026-08-09 17:49:40 -07:00
parent 4a619f7adc
commit e613874de5
29 changed files with 920 additions and 22 deletions
+143
View File
@@ -0,0 +1,143 @@
name: build-windows
# Builds the Windows agent, tray, session helper, and the fully-offline Inno
# installer; signs them with Azure Trusted Signing; generates SHA256SUMS; and
# publishes the artifacts to the SSO resource tree (DESIGN-WINDOWS.md §9).
#
# Signing requires GitHub OIDC federation to Azure. If the Azure secrets are
# not configured the workflow still builds and attaches unsigned artifacts.
on:
push:
tags: ["v*"]
workflow_dispatch:
env:
GO_VERSION: "1.22.2"
VERSION: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || 'dev' }}
jobs:
build-windows:
runs-on: windows-latest
permissions:
contents: write
id-token: write
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
go-version: ${{ env.GO_VERSION }}
- name: Run unit tests
shell: bash
run: go test ./...
- name: Build agent, tray, helper
shell: bash
run: |
mkdir -p dist
LDFLAGS="-s -w"
for arch in amd64 arm64; do
GOOS=windows GOARCH=$arch go build -ldflags="$LDFLAGS" -o dist/theta-agent-windows-$arch.exe .
GOOS=windows GOARCH=$arch go build -ldflags="$LDFLAGS" -o dist/theta-agent-tray-windows-$arch.exe ./cmd/theta-agent-tray/
GOOS=windows GOARCH=$arch go build -ldflags="$LDFLAGS" -o dist/theta-agent-helper-windows-$arch.exe ./cmd/theta-agent-helper/
done
- name: Fetch vendored, vendor-signed dependencies
shell: pwsh
run: |
$vendor = "installer/windows/vendor"
New-Item -ItemType Directory -Force -Path $vendor | Out-Null
# Pinned by sha256; WireGuard MSI and VC++ redist are Microsoft/vendor signed.
$assets = @(
@{ url = "https://download.wireguard.com/windows-client/wireguard-amd64-0.5.3.msi"; out = "wireguard-amd64-0.5.3.msi"; sha = "PINNED_WIREGUARD_SHA256" },
@{ url = "https://aka.ms/vs/17/release/vc_redist.x64.exe"; out = "vc_redist.x64.exe"; sha = "PINNED_VC_REDIST_SHA256" }
)
foreach ($a in $assets) {
$dest = Join-Path $vendor $a.out
Invoke-WebRequest -Uri $a.url -OutFile $dest
$h = (Get-FileHash -Algorithm SHA256 $dest).Hash.ToLower()
if ($h -ne $a.sha) { throw "sha256 mismatch for $($a.out): $h" }
Set-Content -Path "$dest.sha256" -Value $h
}
# OpenCredential (pGina fork) release — swap PINNED below for a real release URL.
$oc = "https://github.com/pedropablobm/OpenCredential/releases/latest/download/OpenCredential.zip"
Invoke-WebRequest -Uri $oc -OutFile (Join-Path $vendor "opencredential.zip")
Expand-Archive -Path (Join-Path $vendor "opencredential.zip") -DestinationPath (Join-Path $vendor "OpenCredential")
- name: Compile Inno installer
shell: pwsh
run: |
choco install innosetup -y --no-progress
$iscc = "C:\Program Files (x86)\Inno Setup 6\ISCC.exe"
if (-not (Test-Path $iscc)) { $iscc = "C:\Program Files\Inno Setup 6\ISCC.exe" }
& $iscc "/DMyAppVersion=${{ env.VERSION }}" installer/windows/installer.iss
if ($LASTEXITCODE -ne 0) { throw "ISCC failed" }
- name: Generate SHA256SUMS
shell: pwsh
run: |
Get-ChildItem dist -File | Where-Object { $_.Extension -in ".exe",".msi" -or $_.Name -like "*setup*" } | ForEach-Object {
"{0} {1}" -f (Get-FileHash -Algorithm SHA256 $_.FullName).Hash.ToLower(), $_.Name
} | Set-Content -Path dist/SHA256SUMS
- name: Sign with Azure Trusted Signing
if: env.AZURE_TENANT_ID != ''
uses: azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- name: AzureSignTool (agent, tray, helper, CP, installer)
if: env.AZURE_TENANT_ID != ''
uses: azure/trusted-signing-action@v0.4.0
with:
endpoint: ${{ secrets.AZURE_TS_ENDPOINT }}
trusted-signing-account-name: ${{ secrets.AZURE_TS_ACCOUNT }}
certificate-profile-name: ${{ secrets.AZURE_TS_CERT_PROFILE }}
files: |
dist/theta-agent-windows-*.exe
dist/theta-agent-tray-windows-*.exe
dist/theta-agent-helper-windows-*.exe
dist/theta-agent-*-setup.exe
output-files: ""
- name: Upload artifacts
uses: actions/upload-artifact@v4
with:
name: theta-agent-windows
path: |
dist/theta-agent-windows-*.exe
dist/theta-agent-helper-windows-*.exe
dist/theta-agent-tray-windows-*.exe
dist/theta-agent-*-setup.exe
dist/SHA256SUMS
- name: Attach to GitHub release
if: startsWith(github.ref, 'refs/tags/')
uses: softprops/action-gh-release@v2
with:
files: |
dist/theta-agent-windows-*.exe
dist/theta-agent-helper-windows-*.exe
dist/theta-agent-tray-windows-*.exe
dist/theta-agent-*-setup.exe
dist/SHA256SUMS
# DESIGN-WINDOWS.md §9: the SSO holds the release resources. Publish when
# an admin-gated upload endpoint is configured; otherwise the artifacts
# are available from the GitHub release above.
- name: Publish to SSO resource tree
if: env.SSO_RESOURCE_PUBLISH_URL != ''
shell: pwsh
run: |
$headers = @{ Authorization = "Bearer $env:SSO_RESOURCE_PUBLISH_TOKEN" }
foreach ($f in Get-ChildItem dist -File) {
if ($f.Name -notmatch "setup|windows-|SHA256SUMS") { continue }
Invoke-RestMethod -Method Post -Uri "$env:SSO_RESOURCE_PUBLISH_URL/$($f.Name)" -InFile $f.FullName -Headers $headers
}
env:
SSO_RESOURCE_PUBLISH_URL: ${{ secrets.SSO_RESOURCE_PUBLISH_URL }}
SSO_RESOURCE_PUBLISH_TOKEN: ${{ secrets.SSO_RESOURCE_PUBLISH_TOKEN }}