From 7ec547a581de7c45bd6feda2df92bcfe6474154f Mon Sep 17 00:00:00 2001 From: Maurus Decimus <11444311+mdecimus@users.noreply.github.com> Date: Sat, 18 Apr 2026 21:26:07 +0200 Subject: [PATCH] CI job updated to compile aws-lc-rs --- .github/workflows/ci.yml | 63 ++++++++++++++++++++-------------------- CHANGELOG.md | 3 ++ Cargo.lock | 23 ++++----------- Cargo.toml | 2 +- Dockerfile | 2 -- Dockerfile.build | 43 ++++++++++++++++----------- 6 files changed, 67 insertions(+), 69 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9d4ad862..b1f7c79b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,6 +18,7 @@ env: SCCACHE_GHA_ENABLED: true RUSTC_WRAPPER: sccache CARGO_TERM_COLOR: always + AWS_LC_SYS_PREBUILT_NASM: 1 concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -42,28 +43,28 @@ jobs: if: github.event_name == 'push' || inputs.Docker steps: - name: Install Cosign - uses: sigstore/cosign-installer@v3 + uses: sigstore/cosign-installer@v4 - name: Log In to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{github.repository_owner}} password: ${{github.token}} - name: Log In to DockerHub - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: username: ${{secrets.DOCKERHUB_USERNAME}} password: ${{secrets.DOCKERHUB_TOKEN}} - name: Download ${{matrix.variant}} meta bake definition - uses: actions/download-artifact@v7 + uses: actions/download-artifact@v8 with: name: bake-meta-${{matrix.variant}} path: ${{ runner.temp }}/${{matrix.variant}} - name: Download ${{matrix.variant}} digests - uses: actions/download-artifact@v7 + uses: actions/download-artifact@v8 with: path: ${{ runner.temp }}/${{matrix.variant}}/digests pattern: digests-${{matrix.variant}}-* @@ -88,14 +89,14 @@ jobs: cosign sign --yes $(jq --arg DOCKERHUB_DIGEST_SHA "$(cat DOCKERHUB_DIGEST_SHA)" -cr '.target."docker-metadata-action".tags | map(select(startswith("index.docker.io/${{github.repository}}")) | . + "@" + $DOCKERHUB_DIGEST_SHA) | join(" ")' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json) - name: Attest GHCR - uses: actions/attest-build-provenance@v3 + uses: actions/attest-build-provenance@v4 with: subject-name: ghcr.io/${{github.repository}} subject-digest: ${{ env.GHCR_DIGEST_SHA }} push-to-registry: true - name: Attest Dockerhub - uses: actions/attest-build-provenance@v3 + uses: actions/attest-build-provenance@v4 with: subject-name: index.docker.io/${{github.repository}} subject-digest: ${{ env.DOCKERHUB_DIGEST_SHA }} @@ -147,15 +148,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6.0.1 + uses: actions/checkout@v6.0.2 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 with: platforms: "arm64,arm" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 with: buildkitd-config-inline: | [registry."docker.io"] @@ -164,14 +165,14 @@ jobs: network=host - name: Log In to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{github.repository_owner}} password: ${{github.token}} - name: Log In to DockerHub - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: username: ${{secrets.DOCKERHUB_USERNAME}} password: ${{secrets.DOCKERHUB_TOKEN}} @@ -182,7 +183,7 @@ jobs: echo "checksum=$(yq -p toml -oy '.package[] | select((.source | contains("")) or (.checksum | contains("")))' Cargo.lock | sha256sum | awk '{print $1}')" >> "$GITHUB_OUTPUT" - name: Cache apt - uses: actions/cache@v5 + uses: actions/cache@v5.0.5 id: apt-cache with: path: | @@ -191,7 +192,7 @@ jobs: key: apt-cache-${{ hashFiles('Dockerfile.build') }} - name: Cache Cargo - uses: actions/cache@v5 + uses: actions/cache@v5.0.5 id: cargo-cache with: path: | @@ -200,7 +201,7 @@ jobs: key: cargo-cache-${{ steps.cal-dep-shasum.outputs.checksum }} - name: Inject cache into docker - uses: reproducible-containers/buildkit-cache-dance@v3.3.0 + uses: reproducible-containers/buildkit-cache-dance@v3.3.2 with: cache-map: | { @@ -212,7 +213,7 @@ jobs: skip-extraction: ${{ steps.cargo-cache.outputs.cache-hit }} && ${{ steps.apt-cache.outputs.cache-hit }} - name: Extract Metadata for Docker - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 id: meta with: images: | @@ -228,7 +229,7 @@ jobs: - name: Build Artifact id: bake - uses: docker/bake-action@v6 + uses: docker/bake-action@v7 env: DOCKER_BUILD_RECORD_UPLOAD: false TARGET: ${{matrix.target}} @@ -247,7 +248,7 @@ jobs: targets: ${{(github.event_name == 'push' || inputs.Docker) && 'build,image' || 'build'}} - name: Upload Artifacts - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: artifact-${{matrix.target}} path: | @@ -264,7 +265,7 @@ jobs: - name: Upload digest if: github.event_name == 'push' || inputs.Docker - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: digests-${{matrix.suffix == '' && 'gnu' || 'musl'}}-${{ matrix.target }} path: ${{ runner.temp }}/digests/* @@ -272,7 +273,7 @@ jobs: retention-days: 1 - name: Upload GNU meta bake definition - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 if: (github.event_name == 'push' || inputs.Docker) && endsWith(matrix.target,'gnu') && startsWith(matrix.target,'x86') with: name: bake-meta-gnu @@ -281,7 +282,7 @@ jobs: retention-days: 1 - name: Upload musl meta bake definition - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 if: (github.event_name == 'push' || inputs.Docker) && endsWith(matrix.target,'musl') && startsWith(matrix.target,'x86') with: name: bake-meta-musl @@ -301,7 +302,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6.0.1 + uses: actions/checkout@v6.0.2 - name: Run sccache-cache uses: mozilla-actions/sccache-action@v0.0.9 @@ -316,7 +317,7 @@ jobs: mv ./target/${{matrix.target}}/release/stalwart.exe ./artifacts/stalwart.exe - name: Upload Artifacts - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: artifact-${{matrix.target}} path: artifacts @@ -332,7 +333,7 @@ jobs: - target: x86_64-apple-darwin steps: - name: Checkout - uses: actions/checkout@v6.0.1 + uses: actions/checkout@v6.0.2 - name: Run sccache-cache uses: mozilla-actions/sccache-action@v0.0.9 @@ -344,8 +345,8 @@ jobs: # GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} # run: | # rustup target add ${{matrix.target}} - # # Get latest FoundationDB installer - # curl --retry 5 -Lso foundationdb.pkg "$(gh api -X GET /repos/apple/foundationdb/releases --jq '.[] | select(.prerelease == false) | .assets[] | select(.name | test("${{startsWith(matrix.target, 'x86') && 'x86_64' || 'arm64'}}" + ".pkg$")) | .browser_download_url' | head -n1)" + # # Pin FoundationDB 7.4.x (Apple publishes these as prereleases) + # curl --retry 5 -Lso foundationdb.pkg "$(gh api -X GET /repos/apple/foundationdb/releases --jq '[.[] | select(.tag_name | startswith("7.4."))] | sort_by(.tag_name | split(".") | map(tonumber)) | reverse | .[0].assets[] | select(.name | test("${{startsWith(matrix.target, 'x86') && 'x86_64' || 'arm64'}}" + ".pkg$")) | .browser_download_url')" # echo "=== Package contents ===" # pkgutil --payload-files foundationdb.pkg || true # sudo installer -allowUntrusted -verbose -dumplog -pkg foundationdb.pkg -target / @@ -361,7 +362,7 @@ jobs: mv ./target/${{matrix.target}}/release/stalwart ./artifacts/stalwart - name: Upload Artifacts - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: artifact-${{matrix.target}} path: artifacts @@ -377,7 +378,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Download Artifacts - uses: actions/download-artifact@v7 + uses: actions/download-artifact@v8 with: path: archive pattern: artifact-* @@ -410,21 +411,21 @@ jobs: - name: Attest binary id: attest - uses: actions/attest-build-provenance@v3 + uses: actions/attest-build-provenance@v4 with: subject-path: | archive/**/*.tar.gz archive/**/*.zip - name: Use cosign to sign existing artifacts - uses: sigstore/gh-action-sigstore-python@v3.2.0 + uses: sigstore/gh-action-sigstore-python@v3.3.0 with: inputs: | archive/**/*.tar.gz archive/**/*.zip - name: Release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v3 with: files: | archive/**/*.tar.gz diff --git a/CHANGELOG.md b/CHANGELOG.md index 21b6e85a..b9c0e045 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,8 @@ All notable changes to this project will be documented in this file. This projec This version includes **multiple breaking changes**. If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions. ## Added +- [Web UI](https://github.com/stalwartlabs/webui): rewritten from the ground up using the JMAP management API, featuring a refreshed design and addressing 76 enhancement requests and bug fixes. +- [CLI](https://github.com/stalwartlabs/cli): rewritten from the ground up to use the JMAP management API. - Security enhancements: - Password strength enforcement using the `zxcvbn` algorithm - Password expiration, rotation policies and IP address restrictions for user accounts @@ -90,6 +92,7 @@ This version includes **multiple breaking changes**. If you are upgrading from v - Return `304` `NOT_MODIFIED` on `If-None-Match` - Use RFC 2616 instead of RFC 1123 for date formatting - Fix ACL container/item mismatch in reports. + - CalDAV: Allow organized properties to be present in `PUT` requests if they are equal to the existing ones. - Configuration: Prefix parsing issues (#2495) - OIDC: JWKS Exposes Symmetric Signing Key - SQLite: Fix thread pool exhaustion. diff --git a/Cargo.lock b/Cargo.lock index 72c356a6..40276b21 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3177,7 +3177,7 @@ dependencies = [ "js-sys", "log", "wasm-bindgen", - "windows-core 0.62.2", + "windows-core", ] [[package]] @@ -8809,7 +8809,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893" dependencies = [ "windows-collections", - "windows-core 0.61.2", + "windows-core", "windows-future", "windows-link 0.1.3", "windows-numerics", @@ -8821,7 +8821,7 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8" dependencies = [ - "windows-core 0.61.2", + "windows-core", ] [[package]] @@ -8837,26 +8837,13 @@ dependencies = [ "windows-strings 0.4.2", ] -[[package]] -name = "windows-core" -version = "0.62.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb" -dependencies = [ - "windows-implement", - "windows-interface", - "windows-link 0.2.1", - "windows-result 0.4.1", - "windows-strings 0.5.1", -] - [[package]] name = "windows-future" version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e" dependencies = [ - "windows-core 0.61.2", + "windows-core", "windows-link 0.1.3", "windows-threading", ] @@ -8901,7 +8888,7 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1" dependencies = [ - "windows-core 0.61.2", + "windows-core", "windows-link 0.1.3", ] diff --git a/Cargo.toml b/Cargo.toml index 320e80ba..f0680c8c 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -51,7 +51,7 @@ panic = 'unwind' debug-assertions = false overflow-checks = false rpath = false -strip = true +strip = false [profile.test] opt-level = 0 diff --git a/Dockerfile b/Dockerfile index a5ec513f..3309e048 100644 --- a/Dockerfile +++ b/Dockerfile @@ -25,7 +25,6 @@ COPY --from=planner /recipe.json /recipe.json RUN RUSTFLAGS="$(cat /flags.txt)" cargo chef cook --target "$(cat /target.txt)" --release --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise" --recipe-path /recipe.json COPY . . RUN RUSTFLAGS="$(cat /flags.txt)" cargo build --target "$(cat /target.txt)" --release -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise" -RUN RUSTFLAGS="$(cat /flags.txt)" cargo build --target "$(cat /target.txt)" --release -p stalwart-cli RUN mv "/build/target/$(cat /target.txt)/release" "/output" FROM docker.io/debian:trixie-slim @@ -34,7 +33,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ apt-get update && \ apt-get install -yq --no-install-recommends ca-certificates COPY --from=builder /output/stalwart /usr/local/bin -COPY --from=builder /output/stalwart-cli /usr/local/bin COPY ./resources/docker/entrypoint.sh /usr/local/bin/entrypoint.sh RUN chmod -R 755 /usr/local/bin CMD ["/usr/local/bin/stalwart"] diff --git a/Dockerfile.build b/Dockerfile.build index dbbb9988..f760fcec 100644 --- a/Dockerfile.build +++ b/Dockerfile.build @@ -11,23 +11,34 @@ ENV DEBIAN_FRONTEND="noninteractive" \ CARGO_TERM_COLOR=always \ LANG=C.UTF-8 \ TZ=UTC \ - TERM=xterm-256color -# With zig, we only need libclang and make + TERM=xterm-256color \ + AWS_LC_SYS_PREBUILT_NASM=1 +# With zig, we only need libclang and make. ca-certificates is required for curl +# to verify HTTPS downloads (zig tarballs, FoundationDB debs, crates.io, etc). RUN \ --mount=type=cache,target=/var/cache/apt,sharing=locked \ --mount=type=cache,target=/var/lib/apt,sharing=locked \ rm -f /etc/apt/apt.conf.d/docker-clean && \ echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' >/etc/apt/apt.conf.d/keep-cache && \ apt-get update && \ - apt-get install -yq --no-install-recommends curl jq xz-utils make libclang-19-dev -# Install zig + apt-get install -yq --no-install-recommends ca-certificates curl jq xz-utils make libclang-19-dev +# Zig is pinned to 0.13.0. Zig 0.14+ changed how its default target ABI is +# resolved for `x86_64-linux-gnu`-style triples, and on Stalwart's dep tree +# (rocksdb, jemalloc, aws-lc-sys, libfdb_c.so, rust-std 1.87+) this surfaces +# as ld.lld undefined references to pthread_*/stat/pow@GLIBC_2.33+. An +# explicit glibc suffix (`.2.17`) is NOT a workaround — C deps compiled via +# zig cc against Zig 0.16 headers still emit @2.33+ symbols even when the +# linker target is 2.17. Zig 0.13 produces binaries with a max glibc ref of +# ~2.28 which stays compatible with Debian 11 / RHEL 8. Revisit this pin if +# Zig upstream stabilizes a backwards-compatible default or if Stalwart drops +# its hard C deps. RUN \ ZIG_VERSION=0.13.0 && \ - [ ! -z "$ZIG_VERSION" ] && \ - curl --retry 5 -Ls "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-$(uname -m)-${ZIG_VERSION}.tar.xz" | tar -J -x -C /usr/local && \ - ln -s "/usr/local/zig-linux-$(uname -m)-${ZIG_VERSION}/zig" /usr/local/bin/zig + curl --retry 5 -fsSL "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-$(uname -m)-${ZIG_VERSION}.tar.xz" | tar -J -x -C /usr/local && \ + ln -s "/usr/local/zig-linux-$(uname -m)-${ZIG_VERSION}/zig" /usr/local/bin/zig && \ + zig version # Install cargo-binstall -RUN curl --retry 5 -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash +RUN curl --retry 5 -fL --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash # Install cargo-chef & sccache & cargo-zigbuild RUN cargo binstall --no-confirm cargo-chef sccache cargo-zigbuild @@ -73,11 +84,14 @@ RUN \ ;; \ esac; \ fi -# Install FoundationDB +# Install FoundationDB (pinned to latest 7.4.x; Apple publishes 7.4 as +# prereleases on GitHub, so the release list is fetched without the +# prerelease filter and narrowed by tag name). +ARG FDB_VERSION_RANGE="7.4" RUN \ source /env-cargo && \ if [ ! -z "${FDB_ARCH}" ]; then \ - curl --retry 5 -Lso fdb-client.deb "$(curl --retry 5 -Ls 'https://api.github.com/repos/apple/foundationdb/releases' | jq --arg FDB_ARCH "$FDB_ARCH" -r '.[] | select(.prerelease == false) | .assets[] | select(.name | test("foundationdb-clients.*" + $FDB_ARCH + ".deb$")) | .browser_download_url' | head -n1)" && \ + curl --retry 5 -fLso fdb-client.deb "$(curl --retry 5 -fLs 'https://api.github.com/repos/apple/foundationdb/releases?per_page=100' | jq --arg FDB_ARCH "$FDB_ARCH" --arg RANGE "${FDB_VERSION_RANGE}" -r '[.[] | select(.tag_name | startswith($RANGE + "."))] | sort_by(.tag_name | split(".") | map(tonumber)) | reverse | .[0].assets[] | select(.name | test("foundationdb-clients.*" + $FDB_ARCH + ".deb$")) | .browser_download_url')" && \ mkdir -p /fdb && \ dpkg -x fdb-client.deb /fdb && \ mv /fdb/usr/include/foundationdb /usr/include && \ @@ -100,8 +114,7 @@ RUN \ --mount=type=cache,target=/usr/local/cargo/registry \ --mount=type=cache,target=/usr/local/cargo/git \ source /env-cargo && \ - cargo chef cook --recipe-path recipe.json --zigbuild --release --target ${TARGET} -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise" && \ - cargo chef cook --recipe-path recipe.json --zigbuild --release --target ${TARGET} -p stalwart-cli + cargo chef cook --recipe-path recipe.json --zigbuild --release --target ${TARGET} -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise" # Copy the source code COPY . . ENV RUSTC_WRAPPER="sccache" \ @@ -125,9 +138,7 @@ RUN \ --mount=type=cache,target=/usr/local/cargo/git \ source /env-cargo && \ cargo zigbuild --release --target ${TARGET} -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise" && \ - cargo zigbuild --release --target ${TARGET} -p stalwart-cli && \ - mv /app/target/${TARGET}/release/stalwart /app/artifact/stalwart && \ - mv /app/target/${TARGET}/release/stalwart-cli /app/artifact/stalwart-cli + mv /app/target/${TARGET}/release/stalwart /app/artifact/stalwart # ***************** # Binary stage @@ -144,7 +155,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \ apt-get update && \ apt-get install -yq --no-install-recommends ca-certificates tzdata COPY --from=builder /app/artifact/stalwart /usr/local/bin -COPY --from=builder /app/artifact/stalwart-cli /usr/local/bin COPY ./resources/docker/entrypoint.sh /usr/local/bin/entrypoint.sh RUN chmod -R 755 /usr/local/bin CMD ["/usr/local/bin/stalwart"] @@ -159,7 +169,6 @@ FROM --platform=$TARGETPLATFORM alpine AS musl WORKDIR /opt/stalwart RUN apk add --update --no-cache ca-certificates tzdata && rm -rf /var/cache/apk/* COPY --from=builder /app/artifact/stalwart /usr/local/bin -COPY --from=builder /app/artifact/stalwart-cli /usr/local/bin COPY ./resources/docker/entrypoint.sh /usr/local/bin/entrypoint.sh RUN chmod -R 755 /usr/local/bin CMD ["/usr/local/bin/stalwart"]