code:
#!/bin/bash
[% c("var/set_default_env") -%]
distdir=/var/tmp/dist/[% project %]

mkdir /var/tmp/build
mkdir /var/tmp/dist
cd /var/tmp/dist
tar xf $rootdir/[% c('input_files_by_name/binutils') %]
mv binutils $distdir
export PATH="$distdir/bin:$PATH"

cd /var/tmp/build
tar xf $rootdir/[% project %]-[% c("version") %].tar.gz
mkdir -p builddir/mingw-w64/mingw-w64-headers32
cd builddir/mingw-w64/mingw-w64-headers32
/var/tmp/build/[% project %]-[% c("version") %]/mingw-w64-headers/configure \
                --prefix=$distdir/[% c("arch") %]-w64-mingw32 --host=[% c("arch") %]-w64-mingw32 \
                --enable-sdk=all --enable-idl
make install

cd /var/tmp/build
mkdir gcc
cd gcc
tar xJf $rootdir/gcc-[% c("var/gcc_version") %].tar.xz
# LDFLAGS_FOR_TARGET does not work for some reason. Thus, we take
# CFLAGS_FOR_TARGET.
export CFLAGS_FOR_TARGET="-Wl,--nxcompat -Wl,--dynamicbase -Wl,--no-insert-timestamp [% c('var/flag_noSEH') %]"
# Rust requires enabling pthreads
gcc-[% c("var/gcc_version") %]/configure --prefix=$distdir --target=[% c("arch") %]-w64-mingw32 --with-gnu-ld --with-gnu-as --disable-multilib --enable-threads=posix --enable-languages=c,c++[% IF c("var/windows-i686") %] --disable-sjlj-exceptions --with-dwarf2[% END %]
make -j[% c("num_procs") %] all-gcc
make install-gcc

mkdir -p /var/tmp/build/builddir/mingw-w64/mingw-w64-crt32
cd /var/tmp/build/builddir/mingw-w64/mingw-w64-crt32
/var/tmp/build/[% project %]-[% c("version") %]/mingw-w64-crt/configure \
                 --host=[% c("arch") %]-w64-mingw32 --prefix=$distdir/[% c("arch") %]-w64-mingw32
make -j[% c("num_procs") %]
make install

mkdir -p /var/tmp/build/builddir/mingw-w64/mingw-w64-pthread
cd /var/tmp/build/builddir/mingw-w64/mingw-w64-pthread
/var/tmp/build/[% project %]-[% c("version") %]/mingw-w64-libraries/winpthreads/configure \
  LDFLAGS="-Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -Wl,--no-insert-timestamp [% c('var/flag_noSEH') %]" \
  --host=[% c("arch") %]-w64-mingw32 --prefix=$distdir/[% c("arch") %]-w64-mingw32
make -j[% c("num_procs") %]
make install

mkdir -p /var/tmp/build/builddir/mingw-w64/widl32
cd /var/tmp/build/builddir/mingw-w64/widl32
/var/tmp/build/[% project %]-[% c("version") %]/mingw-w64-tools/widl/configure \
                 --prefix=$distdir --target=[% c("arch") %]-w64-mingw32
make -j[% c("num_procs") %]
make install

cd /var/tmp/build/gcc
make -j[% c("num_procs") %]
make install
mkdir -p $distdir/gcclibs
# We compile libssp both for being used dynamically (in tor) and statically (in
# firefox).
cp [% c("arch") %]-w64-mingw32/libssp/.libs/libssp* $distdir/gcclibs
cp [% c("arch") %]-w64-mingw32/libgcc/shlib/[% c("var/libgcc_dll") %] $distdir/gcclibs

cd /var/tmp/dist
[% c('tar', {
        tar_src => [ project ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
        }) %]

repo_name: JeremyRand/tor

license: mit


code:
# vim: filetype=yaml sw=2
filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz'
git_url: https://git.code.sf.net/p/mingw-w64/mingw-w64
git_hash: cdb052f1d4056cd510cb83197b55868427b87476
version: '[% c("abbrev") %]'
container:
  use_container: 1
var:
  gcc_version: 10.3.0
  deps:
    - automake
    - build-essential
    - libmpc-dev
  setup: |
    mkdir -p /var/tmp/dist
    tar -C /var/tmp/dist -xf $rootdir/[% c("compiler_tarfile") %]
    export PATH="/var/tmp/dist/mingw-w64/bin:$PATH"
    export gcclibs=/var/tmp/dist/mingw-w64/gcclibs
targets:
  windows-i686:
    var:
      libgcc_dll: libgcc_s_dw2-1.dll
      arch_deps:
        - g++-mingw-w64-i686
  windows-x86_64:
    var:
      libgcc_dll: libgcc_s_seh-1.dll
      arch_deps:
        - g++-mingw-w64-x86-64
input_files:
  - project: container-image
  - URL: 'https://ftp.gnu.org/gnu/gcc/gcc-[% c("var/gcc_version") %]/gcc-[% c("var/gcc_version") %].tar.xz'
    sha256sum: 64f404c1a650f27fc33da242e1f2df54952e3963a49e06e73f6940f3223ac344
  - name: binutils
    project: binutils


code:
#!/bin/sh
set -e
# Doing nothing

path: projects/mmdebstrap-image/build


code:
# vim: filetype=yaml sw=2
filename: 'container-image_[% c("var/container/suite") %]-[% c("var/container/arch") %]-[% c("version") %].tar.gz'
version: 1
pkg_type: build
container:
  use_container: 1

var:
  ubuntu_version: 22.04

pre: |
  #!/bin/sh
  set -e
  rootdir=$(pwd)
  export DEBIAN_FRONTEND=noninteractive
  apt-get update -y -q
  apt-get install -y -q debian-archive-keyring ubuntu-keyring mmdebstrap gnupg

  export SOURCE_DATE_EPOCH='[% c("timestamp") %]'
  tar -xf [% c('input_files_by_name/mmdebstrap') %]
  ./mmdebstrap/mmdebstrap --mode=unshare [% c("var/container/mmdebstrap_opt") %] [% c("var/container/suite") %] output.tar.gz [% c("var/container/debian_mirror") %]

  [% IF c("var/minimal_apt_version") -%]
    mkdir base-image
    tar -C base-image -xf output.tar.gz ./var/lib/dpkg
    apt_version=$(dpkg --admindir=$rootdir/base-image/var/lib/dpkg -s apt | grep '^Version: ' | cut -d ' ' -f 2)
    echo "apt version: $apt_version"
    dpkg --compare-versions "$apt_version" ge '[% c("var/minimal_apt_version") %]'
  [% END -%]

  mv output.tar.gz [% dest_dir %]/[% c("filename") %]

targets:
  jessie-amd64:
    var:
      minimal_apt_version: 1.0.9.8.6

      container:
        suite: jessie
        arch: amd64
        debian_mirror: >
          "deb [signed-by=/usr/share/keyrings/debian-archive-removed-keys.gpg] http://deb.debian.org/debian jessie main"
          "deb [signed-by=/usr/share/keyrings/debian-archive-removed-keys.gpg] http://deb.debian.org/debian jessie-updates main"
          "deb [signed-by=/usr/share/keyrings/debian-archive-removed-keys.gpg] http://security.debian.org/debian-security jessie/updates main"

  bullseye-amd64:
    var:
      minimal_apt_version: 2.2.4
      container:
        suite: bullseye
        arch: amd64

input_files:
  - project: mmdebstrap
    name: mmdebstrap
  - URL: 'https://cdimage.ubuntu.com/ubuntu-base/releases/[% c("var/ubuntu_version") %]/release/ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz'
    filename: 'container-image_ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz'
    sha256sum: df6fe77cee11bd216ac532f0ee082bdc4da3c0cc1f1d9cb20f3f743196bc4b07

path: projects/mmdebstrap-image/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]
tar xf [% project %]-[% c("version") %].tar.gz
mv [% project %]-[% c("version") %] [% project %]
[% c('tar', {
        tar_src => [ project ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
    }) %]

path: projects/mmdebstrap/build


code:
# vim: filetype=yaml sw=2
filename: '[% project %]-src-[% c("version") %]-[% c("var/build_id") %].tar.gz'
version: 0.8.6
git_hash: '[% c("version") %]'
git_url: https://gitlab.mister-muffin.de/josch/mmdebstrap.git
gpg_keyring: mmdebstrap.gpg
tag_gpg_id: 1

path: projects/mmdebstrap/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]

tar xvf [% project %]-[% c('version') %].tar.gz

mkdir -p /var/tmp/dist/[% project %]
cd /var/tmp/dist/

cp -a $rootdir/[% project %]*/[% project %]/*.py ./[% project %]/

[% c('tar', {
        tar_src => '.',
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
        }) %]

path: projects/multidict/build


code:
# vim: filetype=yaml sw=2
version: 4.5.2
git_url: https://github.com/aio-libs/multidict.git
git_hash: bd40998bf220820a7d636d5f02912c8d4abcac23
# TODO: This Git repo doesn't use GPG sigs.  We should pester them about that.
filename: "[% project %]-[% c('version') %]-[% c('var/build_id') %].tar.gz"
container:
  use_container: 1
input_files:
  - project: container-image

path: projects/multidict/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]
[% IF c("var/linux") %]
  # We need a link to our GCC, otherwise the system cc gets used which points to
  # /usr/bin/gcc.
  [% pc('gcc', 'var/setup', { compiler_tarfile => c('input_files_by_name/gcc'),
                              hardened_gcc => 0 }) %]
  ln -s gcc /var/tmp/dist/gcc/bin/cc
  tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %]
  export PATH="/var/tmp/dist/binutils/bin:$PATH"
[% END -%]
distdir=/var/tmp/dist/[% project %]
tar -xf [% project %]-[% c('version') %].tar.xz
cd [% project %]-[% c('version') %]

./configure --prefix=$distdir
make -j[% c("num_procs") %]
make install

cd /var/tmp/dist
[% c('tar', {
        tar_src => [ project ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
    }) %]

path: projects/nasm/build


code:
# vim: filetype=yaml sw=2
version: 2.14.02
filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

input_files:
  - project: container-image
  - project: binutils
    name: binutils
    enable: '[% c("var/linux") %]'
  - project: '[% c("var/compiler") %]'
    name: '[% c("var/compiler") %]'
    enable: '[% c("var/linux") %]'
  - URL: 'https://www.nasm.us/pub/nasm/releasebuilds/[% c("version") %]/nasm-[% c("version") %].tar.xz'
    sha256sum: e24ade3e928f7253aa8c14aa44726d1edf3f98643f87c9d72ec1df44b26be8f5

path: projects/nasm/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]
[% pc('go', 'var/setup', { go_tarfile => c('input_files_by_name/go') }) %]
[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %]

tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %]
export PATH="/var/tmp/dist/binutils/bin:$PATH"
export CGO_ENABLED=1
distdir=/var/tmp/dist/[% project %]
mkdir -p $distdir

[% FOREACH dep = c("var/go_lib_deps") -%]
  tar -C /var/tmp/dist -xf [% c('input_files_by_name/' _ dep) %]
[% END -%]

mkdir -p $GOPATH/src/github.com/namecoin
tar -C $GOPATH/src/github.com/namecoin -xf [% project %]-[% c('version') %].tar.gz
mv $GOPATH/src/github.com/namecoin/ncdns-[% c('version') %] $GOPATH/src/github.com/namecoin/ncdns

TAGS="-tags no_namecoin_tls"

[% FOREACH inst IN c("var/go_lib_install") %]
  go install $TAGS -ldflags '-s' [% inst %]
[% END %]

cd /var/tmp/dist

[% c('tar', {
  tar_src => [ 'gopath' ],
  tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
}) %]

path: projects/ncdns/build


code:
# vim: filetype=yaml sw=2
#version: 0.0.9
# Using latest master branch because we need the stream isolation and
# disable_namecoin_tlsa features.  Once they're in a tagged release, we'll go
# back to using a version number here.
version: '[% c("abbrev") %]'
git_url: https://github.com/namecoin/ncdns.git
# Using latest master branch because we need the stream isolation and
# disable_namecoin_tlsa features.  Once they're in a tagged release, we'll go
# back to using a hash that corresponds to a tag here.
git_hash: 'ca0fe5552806a4275f38468c4d3fbcb2cba1cb79'
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

var:
  go_lib_deps:
    - gogroupcache
    - godegoutils
    - godexlogconfig
    - goncbtcjson
    - goncrpcclient
    - gobtcd
    - gopretty
    - godns
    - gomadns
    - goeasyconfig
    - goservice
    - goxnet
  go_lib_install:
    - github.com/namecoin/ncdns
    - github.com/namecoin/ncdns/backend
    - github.com/namecoin/ncdns/namecoin
    - github.com/namecoin/ncdns/ncdomain
    - github.com/namecoin/ncdns/ncdt
    - github.com/namecoin/ncdns/rrtourl
    - github.com/namecoin/ncdns/server
    - github.com/namecoin/ncdns/testutil
    - github.com/namecoin/ncdns/tlshook
    - github.com/namecoin/ncdns/util

targets:
  linux-i686:
    var:
      arch_deps:
        - libcap-dev:i386
  linux-x86_64:
    var:
      arch_deps:
        - libcap-dev

input_files:
  - project: container-image
  - name: go
    project: go
  - name: '[% c("var/compiler") %]'
    project: '[% c("var/compiler") %]'
  - name: binutils
    project: binutils
  - name: godexlogconfig
    project: godexlogconfig
  - name: goeasyconfig
    project: goeasyconfig
  - name: goservice
    project: goservice
  - name: gogroupcache
    project: gogroupcache
  - name: goncbtcjson
    project: goncbtcjson
  - name: goncrpcclient
    project: goncrpcclient
  - name: gobtcd
    project: gobtcd
  - name: godns
    project: godns
  - name: gomadns
    project: gomadns
  - name: gopretty
    project: gopretty
  - name: godegoutils
    project: godegoutils
  - name: goxnet
    project: goxnet

path: projects/ncdns/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]
[% pc('go', 'var/setup', { go_tarfile => c('input_files_by_name/go') }) %]
export CGO_ENABLED=0
distdir=/var/tmp/dist/[% project %]
mkdir -p $distdir

[% FOREACH dep = c("var/go_lib_deps") -%]
  tar -C /var/tmp/dist -xf [% c('input_files_by_name/' _ dep) %]
[% END -%]

mkdir -p $GOPATH/src/github.com/namecoin
tar -C $GOPATH/src/github.com/namecoin -xf [% project %]-[% c('version') %].tar.gz
mv $GOPATH/src/github.com/namecoin/ncprop279-[% c('version') %] $GOPATH/src/github.com/namecoin/ncprop279

TAGS="-tags no_namecoin_tls"

go install $TAGS -ldflags '-s' github.com/namecoin/ncprop279

[% IF c("var/linux-x86_64") -%]
  GOPATHBIN="${GOPATH}/bin"
[% ELSE -%]
  GOPATHBIN="${GOPATH}/bin/${GOOS}_${GOARCH}"
[% END -%]

cp -a $GOPATHBIN/ncprop279 $distdir/

cd $distdir
[% c('tar', {
     tar_src   => [ '.' ],
     tar_args  => '-czf ' _ dest_dir _ '/' _ c('filename'),
   }) %]


code:
# vim: filetype=yaml sw=2
#version: '0.0.2'
# Using latest master branch because we need the stream isolation feature.
# Once it's in a tagged release, we'll go back to using a version number here.
version: '[% c("abbrev") %]'
git_url:  https://github.com/namecoin/ncprop279.git
# Using latest master branch because we need the stream isolation feature.
# Once it's in a tagged release, we'll go back to using a hash that corresponds
# to a tag here.
git_hash: '7bdd741d70258407f66aab52b24788f1acccc56b'
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

var:
  go_lib_deps:
    - godns
    - goeasyconfig
    - gomadns
    - ncdns

input_files:
  - project: container-image
  - name: go
    project: go
  - name: godns
    project: godns
  - name: goeasyconfig
    project: goeasyconfig
  - name: gomadns
    project: gomadns
  - name: ncdns
    project: ncdns


code:
#!/bin/bash
[% c("var/set_default_env") -%]
distdir=/var/tmp/dist/[% project %]
[% IF c("var/linux") %]
  [% pc('gcc', 'var/setup', { compiler_tarfile => c('input_files_by_name/gcc'),
                              hardened_gcc => 0 }) %]
[% END -%]
[% IF c("var/linux") -%]
  [% pc('python', 'var/setup', { python_tarfile => c('input_files_by_name/python') }) %]
[% END -%]
mkdir /var/tmp/build
tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz
cd /var/tmp/build/[% project %]-[% c('version') %]

[% IF !c("var/linux") -%]
  # Starting with Debian Bullseye, /usr/bin/python does not exist, so
  # we need to use python3 explicitly
  sed -i 's/env python$/env python3/' configure.py
[% END -%]
./configure.py --bootstrap

mkdir -p $distdir
cp ninja $distdir
cd /var/tmp/dist
[% c('tar', {
        tar_src => [ project ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
    }) %]

path: projects/ninja/build


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/ninja-build/ninja.git
git_hash: b25c08bda4949192c69cea4cee057887341a2ffc #v1.9.0
filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

input_files:
  - project: container-image
  - name: '[% c("var/compiler") %]'
    project: '[% c("var/compiler") %]'
    enable: '[% c("var/linux") %]'
  - name: python
    project: python
    enable: '[% c("var/linux") %]'

path: projects/ninja/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]
[% IF c("var/linux") %]
  # We need a link to our GCC, otherwise the system cc gets used which points to
  # /usr/bin/gcc.
  [% pc('gcc', 'var/setup', { compiler_tarfile => c('input_files_by_name/gcc'),
                              hardened_gcc => 0 }) %]
  ln -s gcc /var/tmp/dist/gcc/bin/cc
  tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %]
  export PATH="/var/tmp/dist/binutils/bin:$PATH"
[% END -%]
distdir=/var/tmp/dist/[% project %]
tar -xf [% c('input_files_by_name/node') %]
cd node-v[% c('version') %]

./configure --prefix=$distdir
make -j[% c("num_procs") %]
make install

cd /var/tmp/dist
[% c('tar', {
        tar_src => [ project ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
    }) %]

path: projects/node/build


code:
# vim: filetype=yaml sw=2
version: '[% c("var/node_version") %]'
filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1
var:
  node_version: 12.22.1
  node_hash: dd650df7773a6ed3e390320ba51ef33cba6499f0e9397709ea3d1debdcbcb989

targets:
  windows:
    var:
      arch_deps:
        - python2
  osx-x86_64:
    var:
      arch_deps:
        - python2
  android:
    var:
      arch_deps:
        - python2

input_files:
  - project: container-image
  - project: binutils
    name: binutils
    enable: '[% c("var/linux") %]'
  - project: '[% c("var/compiler") %]'
    name: '[% c("var/compiler") %]'
    enable: '[% c("var/linux") %]'
  - URL: 'https://nodejs.org/dist/v[% c("var/node_version") %]/node-v[% c("var/node_version") %].tar.xz'
    sha256sum: '[% c("var/node_hash") %]'
    name: node

path: projects/node/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]
[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %]
mkdir -p /var/tmp/build
tar -C /var/tmp/build -xf nsis-[% c('version') %].tar.bz2

# NSIS requires zlib and we later set the path using ZLIB_W32.
tar -C /var/tmp/build -xf [% c('input_files_by_name/zlib') %]

cd /var/tmp/build/nsis-[% c('version') %]-src
# Adding --no-insert-timestamp to APPEND_LINKFLAGS is not working as it
# is used for both the host and cross-compiled parts, but this option is
# only valid for the Windows linker. Therefore we add it using a patch
# to the cross-compilation part only. Still needed as of 3.06.1, see: #40090.
patch -p1 < $rootdir/no-insert-timestamp.patch

[% IF c("var/windows-x86_64") %]
  # Seems like setting TARGET_ARCH is not enough so we need to patch build.cpp
  # manually; this is confirmed by a comment in the same file.
  sed -i 's/m_target_type=TARGET_X86ANSI/m_target_type=TARGET_AMD64/' Source/build.cpp
  [% SET target = "amd64" %]
[% ELSE %]
  [% SET target = "x86" %]
[% END %]

[% SET scons_args = 'VERSION=' _ c("version")
        _ ' APPEND_CCFLAGS="-fgnu89-inline"'
        _ " SKIPUTILS='NSIS Menu' XGCC_W32_PREFIX=" _ c("arch") _ "-w64-mingw32-"
        _ " TARGET_ARCH=" _ target
        _ " ZLIB_W32=/var/tmp/build/zlib/"
        _ ' PREFIX=/var/tmp/dist/nsis' -%]
scons [% scons_args %]
scons [% scons_args %] install
cd /var/tmp/dist
[% c('tar', {
        tar_src => [ project ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
        }) %]

path: projects/nsis/build


code:
# vim: filetype=yaml sw=2
version: 3.06.1
filename: 'nsis-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1
var:
  deps:
    - build-essential
    - libmpc-dev
    - scons
    - zlib1g-dev
    - libcppunit-dev
    - xsltproc

input_files:
  - project: container-image
  - filename: 'nsis-[% c("version") %].tar.bz2'
    URL: 'https://downloads.sourceforge.net/nsis/nsis-[% c("version") %]-src.tar.bz2'
    sha256sum: 9b5d68bf1874a7b393432410c7e8c376f174d2602179883845d2508152153ff0
  - filename: no-insert-timestamp.patch
  - name: '[% c("var/compiler") %]'
    project: '[% c("var/compiler") %]'
  - name: zlib
    project: zlib

path: projects/nsis/config


code:
diff -ur nsis-3.03-src/SCons/Config/gnu nsis-3.03-src.n/SCons/Config/gnu
--- nsis-3.03-src/SCons/Config/gnu	2017-10-06 15:30:20.000000000 -0400
+++ nsis-3.03-src.n/SCons/Config/gnu	2018-06-17 13:26:05.945495151 -0400
@@ -102,6 +102,7 @@
 stub_env.Append(LINKFLAGS = ['$NODEFLIBS_FLAG'])    # no standard libraries
 stub_env.Append(LINKFLAGS = ['$ALIGN_FLAG'])        # 512 bytes align
 stub_env.Append(LINKFLAGS = ['$MAP_FLAG'])          # generate map file
+stub_env.Append(LINKFLAGS = ['-Wl,--no-insert-timestamp']) # remove timestamps for reproducible builds

 stub_uenv = stub_env.Clone()
 stub_uenv.Append(CPPDEFINES = ['_UNICODE', 'UNICODE'])
@@ -142,6 +143,7 @@
 plugin_env.Append(LINKFLAGS = ['$MAP_FLAG'])        # generate map file
 plugin_env.Append(LINKFLAGS = ['-static-libgcc'])   # remove libgcc*.dll dependency
 plugin_env.Append(LINKFLAGS = ['-static-libstdc++']) # remove libstdc++*.dll dependency
+plugin_env.Append(LINKFLAGS = ['-Wl,--no-insert-timestamp']) # remove timestamps for reproducible builds

 plugin_uenv = plugin_env.Clone()
 plugin_uenv.Append(CPPDEFINES = ['_UNICODE', 'UNICODE'])
@@ -181,6 +183,7 @@

 util_env.Append(LINKFLAGS = ['-mwindows'])          # build windows executables
 util_env.Append(LINKFLAGS = ['$ALIGN_FLAG'])        # 512 bytes align
+util_env.Append(LINKFLAGS = ['-Wl,--no-insert-timestamp']) # remove timestamps for reproducible builds

 conf = FlagsConfigure(util_env)


code:
From 2f0888c348561249d3083555db33c5619840dbfa Mon Sep 17 00:00:00 2001
From: Mike Perry <mikeperry-git@torproject.org>
Date: Mon, 29 Sep 2014 14:30:19 -0700
Subject: [PATCH] Bug 13028: Prevent potential proxy bypass cases.

It looks like these cases should only be invoked in the NSS command line
tools, and not the browser, but I decided to patch them anyway because there
literally is a maze of network function pointers being passed around, and it's
very hard to tell if some random code might not pass in the proper proxied
versions of the networking code here by accident.

diff --git a/security/nss/lib/certhigh/ocsp.c b/security/nss/lib/certhigh/ocsp.c
index cea8456606bf..86fa971cfbef 100644
--- a/security/nss/lib/certhigh/ocsp.c
+++ b/security/nss/lib/certhigh/ocsp.c
@@ -2932,6 +2932,14 @@ ocsp_ConnectToHost(const char *host, PRUint16 port)
     PRNetAddr addr;
     char *netdbbuf = NULL;

+    // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but
+    // we want to ensure nothing can ever hit this code in production.
+#if 1
+    printf("Tor Browser BUG: Attempted OSCP direct connect to %s, port %u\n", host,
+            port);
+    goto loser;
+#endif
+
     sock = PR_NewTCPSocket();
     if (sock == NULL)
         goto loser;
diff --git a/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c b/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c
index e8698376b5be..85791d84a932 100644
--- a/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c
+++ b/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c
@@ -1334,6 +1334,13 @@ pkix_pl_Socket_Create(
                     plContext),
                     PKIX_COULDNOTCREATESOCKETOBJECT);

+        // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but
+        // we want to ensure nothing can ever hit this code in production.
+#if 1
+        printf("Tor Browser BUG: Attempted pkix direct socket connect\n");
+        PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED);
+#endif
+
         socket->isServer = isServer;
         socket->timeout = timeout;
         socket->clientSock = NULL;
@@ -1433,6 +1440,13 @@ pkix_pl_Socket_CreateByName(

         localCopyName = PL_strdup(serverName);

+        // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but
+        // we want to ensure nothing can ever hit this code in production.
+#if 1
+        printf("Tor Browser BUG: Attempted pkix direct connect to %s\n", serverName);
+        PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED);
+#endif
+
         sepPtr = strchr(localCopyName, ':');
         /* First strip off the portnum, if present, from the end of the name */
         if (sepPtr) {
@@ -1582,6 +1596,13 @@ pkix_pl_Socket_CreateByHostAndPort(
         PKIX_ENTER(SOCKET, "pkix_pl_Socket_CreateByHostAndPort");
         PKIX_NULLCHECK_THREE(hostname, pStatus, pSocket);

+        // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but
+        // we want to ensure nothing can ever hit this code in production.
+#if 1
+        printf("Tor Browser BUG: Attempted pkix direct connect to %s, port %u\n", hostname,
+                portnum);
+        PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED);
+#endif

         prstatus = PR_GetHostByName(hostname, buf, sizeof(buf), &hostent);

--
2.27.0


code:
#!/bin/bash
[% c("var/set_default_env") -%]
[% IF ! c("var/nss-linux-x86_64") -%]
  [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %]
[% END -%]
distdir=/var/tmp/dist/nss
builddir=/var/tmp/build/[% project %]
mkdir -p /var/tmp/build /var/tmp/dist

tar -C /var/tmp/dist -xf [% c('input_files_by_name/ninja') %]
export PATH=/var/tmp/dist/ninja:$PATH

[% IF ! c("var/nss-linux-x86_64") -%]
  nspr_64=""
  [% IF c("var/cross_prefix") == "armv7a-linux-androideabi" -%]
    gyp_arch="arm"
  [% ELSIF c("var/cross_prefix") == "i686-linux-android" -%]
    gyp_arch="ia32"
  [% ELSIF c("var/cross_prefix") == "x86_64-linux-android" -%]
    gyp_arch="x64"
    nspr_64="--enable-64bit"
  [% ELSIF c("var/cross_prefix") == "aarch64-linux-android" -%]
    gyp_arch="arm64"
    nspr_64="--enable-64bit"
  [% END -%]

  export AR="[% c('var/cross_prefix') %]-ar"
  # XXX: Mozilla really uses the NDK_API_VERSION here, which is weird.
  export CC="[% c('var/cross_prefix') %][% pc('android-toolchain', 'var/android_ndk_version') %]-clang"
  export CXX="[% c('var/cross_prefix') %][% pc('android-toolchain', 'var/android_ndk_version') %]-clang++"
  export LD="[% c('var/cross_prefix') %]-ld"
  export NM="[% c('var/cross_prefix') %]-nm"
  export RANLIB="[% c('var/cross_prefix') %]-ranlib"
  export READELF="[% c('var/cross_prefix') %]-readelf"
[% END -%]

tar -C /var/tmp/build -xf [% c('input_files_by_name/nss') %]
mv /var/tmp/build/[% project %]-[% c('version') %] $builddir
cd $builddir
# Early return hack to prevent NSPR Android setup
# which does not work with ndk unified headers and clang. See:
# application-services/libs/build-all.sh
cat $rootdir/configure.patch | patch nspr/configure
# Some NSS symbols clash with OpenSSL symbols, rename them using
# C preprocessor define macros. See:
# application-services/libs/build-all.sh
patch -p2 < $rootdir/config.patch
# Let's apply our proxy bypass defense-in-depth here as well to be on the safe
# side.
patch -p2 < $rootdir/bug_13028.patch

patch -p1 < $rootdir/use-python3.patch

[% IF c("var/nss-linux-x86_64") -%]
  patch -p1 < $rootdir/use-python3-build-sh.patch
  $builddir/nss/build.sh \
    -v \
    --opt \
    --static \
    --disable-tests \
    -Ddisable_dbm=1 \
    -Dsign_libs=0 \
    -Ddisable_libpkix=1 \
    -Dpython=python3
  mv $builddir/dist/Release "$builddir/nss_build"
[% ELSE -%]
  # Building NSPR
  mkdir $builddir/nspr_build
  cd $builddir/nspr_build
  ../nspr/configure \
    $nspr_64 \
    --target=[% IF c("arch") == "armv7" %]arm-linux-androideabi[% ELSE %][% c("var/cross_prefix") %][% END %] \
    --disable-debug \
    --enable-optimize
  make
  cd ..

  # Building NSS
  mkdir $builddir/nss_build
  gyp -f ninja-android "$builddir/nss/nss.gyp" \
    --depth "$builddir/nss/" \
    --generator-output=. \
    -DOS=android \
    -Dnspr_lib_dir="$builddir/nspr_build/dist/lib" \
    -Dnspr_include_dir="$builddir/nspr_build/dist/include/nspr" \
    -Dnss_dist_dir="$builddir/nss_build" \
    -Dnss_dist_obj_dir="$builddir/nss_build" \
    -Dhost_arch="$gyp_arch" \
    -Dtarget_arch="$gyp_arch" \
    -Dstatic_libs=1 \
    -Ddisable_dbm=1 \
    -Dsign_libs=0 \
    -Denable_sslkeylogfile=0 \
    -Ddisable_tests=1 \
    -Ddisable_libpkix=1 \
    -Dpython=python3

  gendir="$builddir/nss/out/Release"
  ninja -C "$gendir"
[% END -%]

mkdir -p $distdir/include/nss
mkdir -p $distdir/lib
cp -p -L "$builddir/nss_build/lib/libcertdb.a" "$distdir/lib"
cp -p -L "$builddir/nss_build/lib/libcerthi.a" "$distdir/lib"
cp -p -L "$builddir/nss_build/lib/libcryptohi.a" "$distdir/lib"
cp -p -L "$builddir/nss_build/lib/libfreebl_static.a" "$distdir/lib"
cp -p -L "$builddir/nss_build/lib/libnss_static.a" "$distdir/lib"
cp -p -L "$builddir/nss_build/lib/libmozpkix.a" "$distdir/lib"
cp -p -L "$builddir/nss_build/lib/libnssb.a" "$distdir/lib"
cp -p -L "$builddir/nss_build/lib/libnssdev.a" "$distdir/lib"
cp -p -L "$builddir/nss_build/lib/libnsspki.a" "$distdir/lib"
cp -p -L "$builddir/nss_build/lib/libnssutil.a" "$distdir/lib"
cp -p -L "$builddir/nss_build/lib/libpk11wrap_static.a" "$distdir/lib"
cp -p -L "$builddir/nss_build/lib/libpkcs12.a" "$distdir/lib"
cp -p -L "$builddir/nss_build/lib/libpkcs7.a" "$distdir/lib"
cp -p -L "$builddir/nss_build/lib/libsmime.a" "$distdir/lib"
cp -p -L "$builddir/nss_build/lib/libsoftokn_static.a" "$distdir/lib"
cp -p -L "$builddir/nss_build/lib/libssl.a" "$distdir/lib"

[% IF c("var/nss-linux-x86_64") -%]
  cp -p -L "$builddir/nss_build/lib/libintel-gcm-wrap_c_lib.a" "$distdir/lib"
  cp -p -L "$builddir/nss_build/lib/libintel-gcm-s_lib.a" "$distdir/lib"
  cp -p -L "$builddir/nss_build/lib/libhw-acc-crypto-avx.a" "$distdir/lib"
  cp -p -L "$builddir/nss_build/lib/libhw-acc-crypto-avx2.a" "$distdir/lib"
  cp -p -L "$builddir/nss_build/lib/libgcm-aes-x86_c_lib.a" "$distdir/lib"
[% ELSE -%]
  # HW specific.
  # https://searchfox.org/nss/rev/08c4d05078d00089f8d7540651b0717a9d66f87e/lib/freebl/freebl.gyp#278-296
  [% IF c("var/cross_prefix") == "i686-linux-android" || c("var/cross_prefix") == "x86_64-linux-android"-%]
    cp -p -L "$builddir/nss_build/lib/libgcm-aes-x86_c_lib.a" "$distdir/lib"
  [% END %]
  [% IF c("var/cross_prefix") == "armv7a-linux-androideabi" || c("var/cross_prefix") == "aarch64-linux-android"-%]
    cp -p -L "$builddir/nss_build/lib/libarmv8_c_lib.a" "$distdir/lib"
  [% END %]
  [% IF c("var/cross_prefix") == "aarch64-linux-android" -%]
    cp -p -L "$builddir/nss_build/lib/libgcm-aes-aarch64_c_lib.a" "$distdir/lib"
  [% END %]
  [% IF c("var/cross_prefix") == "armv7a-linux-androideabi" -%]
    cp -p -L "$builddir/nss_build/lib/libgcm-aes-arm32-neon_c_lib.a" "$distdir/lib"
  [% END %]
  # https://searchfox.org/nss/rev/08c4d05078d00089f8d7540651b0717a9d66f87e/lib/freebl/freebl.gyp#315-324
  # https://searchfox.org/nss/rev/08c4d05078d00089f8d7540651b0717a9d66f87e/lib/freebl/freebl.gyp#43-47
  [% IF c("var/cross_prefix") == "x86_64-linux-android"-%]
    cp -p -L "$builddir/nss_build/lib/libintel-gcm-wrap_c_lib.a" "$distdir/lib"
    cp -p -L "$builddir/nss_build/lib/libintel-gcm-s_lib.a" "$distdir/lib"
    cp -p -L "$builddir/nss_build/lib/libhw-acc-crypto-avx.a" "$distdir/lib"
    cp -p -L "$builddir/nss_build/lib/libhw-acc-crypto-avx2.a" "$distdir/lib"
  [% END %]
[% END -%]

[% IF c("var/nss-linux-x86_64") -%]
  nspr_libdir="$builddir/nss_build/lib"
  nss_include_dir="$builddir/dist/public/nss/"
  nspr_include_dir="$builddir/nss_build/include/nspr/"
[% ELSE -%]
  nspr_libdir="$builddir/nspr_build/dist/lib"
  nss_include_dir="$builddir/nss_build/public/nss/"
  nspr_include_dir="$builddir/nspr_build/dist/include/nspr/"
[% END -%]

cp -p -L "$nspr_libdir/libplc4.a" "$distdir/lib"
cp -p -L "$nspr_libdir/libplds4.a" "$distdir/lib"
cp -p -L "$nspr_libdir/libnspr4.a" "$distdir/lib"

cp -p -L -R "$nss_include_dir/"* "$distdir/include/nss"
cp -p -L -R "$nspr_include_dir/"* "$distdir/include/nss"

cd /var/tmp/dist
[% c('tar', {
        tar_src => [ project ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
    }) %]

path: projects/nss/build


code:
# vim: filetype=yaml sw=2
filename: '[% project %]-[% c("version") %]-with-nspr-[% c("nspr_version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
# The required versions for application-services can be found at the respective
# commit in libs/build-all.sh
version: 3.66
nspr_version: 4.30
container:
  use_container: 1
var:
  deps:
    - build-essential
    - gyp
    - zlib1g-dev

targets:
  nss-linux-x86_64:
    var:
      osname: linux-x86_64
      nss-linux-x86_64: 1

input_files:
  - project: container-image
  - name: '[% c("var/compiler") %]'
    project: '[% c("var/compiler") %]'
    enable: '[% ! c("var/nss-linux-x86_64") %]'
  - name: ninja
    project: ninja
  - URL: 'https://ftp.mozilla.org/pub/security/nss/releases/NSS_[% c("version") | replace("\\.", "_") %]_RTM/src/nss-[% c("version") %]-with-nspr-[% c("nspr_version") %].tar.gz'
    name: nss
    sha256sum: 4eb72ca78b497a2a425139fdcfb9068cbd318dd51542baaa5365fcfbcb165009
  - filename: configure.patch
  - filename: config.patch
  - filename: bug_13028.patch
  - filename: use-python3.patch
  - filename: use-python3-build-sh.patch
    enable: '[% c("var/nss-linux-x86_64") %]'

path: projects/nss/config


code:
From c11dc3a73349fc7d8fa451f9e3a4e3952aa54fd2 Mon Sep 17 00:00:00 2001
From: Georg Koppen <gk@torproject.org>
Date: Wed, 1 Jul 2020 09:57:01 +0000
Subject: [PATCH] Patch for building NSS for application-services

See: application-services/libs/build-all.sh

diff --git a/security/nss/coreconf/config.gypi b/security/nss/coreconf/config.gypi
index 62d3cc71ecaf..dd30de079081 100644
--- a/security/nss/coreconf/config.gypi
+++ b/security/nss/coreconf/config.gypi
@@ -144,6 +144,23 @@
       '<(nspr_include_dir)',
       '<(nss_dist_dir)/private/<(module)',
     ],
+    'defines': [
+      'HMAC_Update=NSS_HMAC_Update',
+      'HMAC_Init=NSS_HMAC_Init',
+      'CMAC_Update=NSS_CMAC_Update',
+      'CMAC_Init=NSS_CMAC_Init',
+      'MD5_Update=NSS_MD5_Update',
+      'SHA1_Update=NSS_SHA1_Update',
+      'SHA256_Update=NSS_SHA256_Update',
+      'SHA224_Update=NSS_SHA224_Update',
+      'SHA512_Update=NSS_SHA512_Update',
+      'SHA384_Update=NSS_SHA384_Update',
+      'SEED_set_key=NSS_SEED_set_key',
+      'SEED_encrypt=NSS_SEED_encrypt',
+      'SEED_decrypt=NSS_SEED_decrypt',
+      'SEED_ecb_encrypt=NSS_SEED_ecb_encrypt',
+      'SEED_cbc_encrypt=NSS_SEED_cbc_encrypt',
+    ],
     'conditions': [
       [ 'mozpkix_only==1 and OS=="linux"', {
         'include_dirs': [
--
2.27.0


code:
@@ -2662,6 +2662,9 @@

 case "$target" in
 *-android*|*-linuxandroid*)
+    $as_echo "#define ANDROID 1" >>confdefs.h
+    ;;
+    unreachable)
     if test -z "$android_ndk" ; then
        as_fn_error $? "You must specify --with-android-ndk=/path/to/ndk when targeting Android." "$LINENO" 5
     fi


code:
diff -ru nss-3.66/nss/build.sh nss-3.66.n/nss/build.sh
--- nss-3.66/nss/build.sh	2021-05-28 09:50:43.000000000 +0000
+++ nss-3.66.n/nss/build.sh	2021-10-15 15:20:52.027557223 +0000
@@ -69,7 +69,7 @@
 ninja_params=()

 # Assume that the target architecture is the same as the host by default.
-host_arch=$(python "$cwd/coreconf/detect_host_arch.py")
+host_arch=$(python3 "$cwd/coreconf/detect_host_arch.py")
 target_arch=$host_arch

 # Assume that MSVC is wanted if this is running on windows.


code:
diff -ru nss-3.65/nss/lib/ckfw/builtins/builtins.gyp nss-3.65.n/nss/lib/ckfw/builtins/builtins.gyp
--- nss-3.65/nss/lib/ckfw/builtins/builtins.gyp	2021-09-29 12:48:34.982000000 +0200
+++ nss-3.65.n/nss/lib/ckfw/builtins/builtins.gyp	2021-09-29 12:48:43.152000000 +0200
@@ -30,7 +30,7 @@
         {
           'msvs_cygwin_shell': 0,
           'action': [
-            'python',
+            'python3',
             'certdata.py',
             'certdata.txt',
             '<@(_outputs)',


code:
#!/bin/bash
[% c("var/set_default_env") -%]
[% pc('go', 'var/setup', { go_tarfile => c('input_files_by_name/go') }) %]
distdir=/var/tmp/dist/[% project %]
[% c("var/set_PTDIR_DOCSDIR") -%]
mkdir -p $PTDIR

[% IF c("var/android") -%]
  [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %]
  # We need to explicitly set CGO_ENABLED with Go 1.13.x as the Android build
  # breaks otherwise.
  export CGO_ENABLED=1
[% END -%]

tar -C /var/tmp/dist -xf [% c('input_files_by_name/goptlib') %]
tar -C /var/tmp/dist -xf [% c('input_files_by_name/edwards25519') %]
tar -C /var/tmp/dist -xf [% c('input_files_by_name/edwards25519-extra') %]
tar -C /var/tmp/dist -xf [% c('input_files_by_name/siphash') %]
tar -C /var/tmp/dist -xf [% c('input_files_by_name/goxcrypto') %]
tar -C /var/tmp/dist -xf [% c('input_files_by_name/goxnet') %]
tar -C /var/tmp/dist -xf [% c('input_files_by_name/goutls') %]
tar -C /var/tmp/dist -xf [% c('input_files_by_name/goxtext') %]

mkdir -p /var/tmp/build
tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz
cd /var/tmp/build/[% project %]-[% c('version') %]

mkdir -p "$GOPATH/src/gitlab.com/yawning"
ln -sf "$PWD" "$GOPATH/src/gitlab.com/yawning/obfs4.git"

cd obfs4proxy
go build -ldflags '-s'
cp -a obfs4proxy[% IF c("var/windows") %].exe[% END %] $PTDIR

cd $distdir
[% c('tar', {
        tar_src => [ '.' ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
    }) %]


code:
# vim: filetype=yaml sw=2
version: 0.0.12
git_url: https://gitlab.com/yawning/obfs4.git
git_hash: 'obfs4proxy-[% c("version") %]'
tag_gpg_id: 1
gpg_keyring: yawning.gpg
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'

container:
  use_container: 1

targets:
  nightly:
    git_hash: master
    version: '[% c("abbrev") %]'
    tag_gpg_id: 0

input_files:
  - project: container-image
  - name: go
    project: go
  - name: goptlib
    project: goptlib
  - name: edwards25519
    project: edwards25519
  - name: edwards25519-extra
    project: edwards25519-extra
  - name: siphash
    project: siphash
  - name: goxcrypto
    project: goxcrypto
  - name: goxnet
    project: goxnet
  - name: goutls
    project: goutls
  - name: goxtext
    project: goxtext
  - name: '[% c("var/compiler") %]'
    project: '[% c("var/compiler") %]'
    enable: '[% c("var/android") %]'


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/stretchr/objx
git_hash: facf9a85c22f48d2f52f2380e4efce1768749a89 # v0.1.0
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/stretchr/objx

input_files:
  - project: container-image
  - name: go
    project: go

path: projects/objx/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]
[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %]
distdir=/var/tmp/dist/[% project %]
mkdir -p /var/tmp/build
tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz
cd /var/tmp/build/[% project %]-[% c('version') %]
[% IF c("var/osname") == "linux-i686" -%]
export CC='gcc -m32'
[% END %]
[% IF c("var/osx") -%]
  # Tricking OpenSSL into using our clang as cross-compiler
  ln -s $clangdir/bin/clang $clangdir/bin/x86_64-apple-darwin-cc
  export CC="cc [% c("var/FLAGS") %]"
[% END -%]
export SOURCE_DATE_EPOCH='[% c("timestamp") %]'
./Configure [% c('var/configure_opts') %]
make
make DESTDIR="$distdir" install
cd /var/tmp/dist
ln -s '[% c("var/openssldir") %]' openssl/openssl
[% c('tar', {
        tar_src => [ project ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
    }) %]

path: projects/openssl/build


code:
# vim: filetype=yaml sw=2
version: 1.1.1o
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

var:
  openssldir: 'usr/local'

targets:
  linux-x86_64:
    var:
      configure_opts: -shared enable-ec_nistp_64_gcc_128 linux-x86_64
  linux-i686:
    var:
      configure_opts: -shared linux-x86
  windows:
    var:
      flag_mwindows: ''
      configure_opts: '-shared --cross-compile-prefix=[% c("arch") %]-w64-mingw32- mingw[% IF c("var/windows-x86_64") %]64[% END %] "[% c("var/CFLAGS") %] [% c("var/LDFLAGS") %]"'
      openssldir: 'Program Files[% IF c("var/windows-i686") %] (x86)[% END %]/OpenSSL'
  osx-x86_64:
    var:
      configure_opts: --cross-compile-prefix=x86_64-apple-darwin- darwin64-x86_64-cc enable-ec_nistp_64_gcc_128
  android:
    var:
      configure_opts: 'CC=[% c("var/CC") %] android-[% c("var/toolchain_arch") %] -no-shared -D__ANDROID_API__=[% c("var/android_min_api") %]'

input_files:
  - project: container-image
  - name: '[% c("var/compiler") %]'
    project: '[% c("var/compiler") %]'
  - URL: 'https://www.openssl.org/source/openssl-[% c("version") %].tar.gz'
    sha256sum: 9384a2b0570dd80358841464677115df785edb941c71211f75076d72fe6b438f

path: projects/openssl/config


code:
From 86931f9d7c3d73b97010e598a5ad41ea4fab2b63 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Reimar=20D=C3=B6ffinger?= <Reimar.Doeffinger@gmx.de>
Date: Sun, 12 Mar 2017 23:00:12 +0100
Subject: [PATCH] Make code work with OpenSSL 1.1.

Changes in consist of:
- Use EVP_MD_CTX_new/free API instead of on-stack allocation
- Remove some M_ prefixes like for ASN1_IA5STRING_new
- Remove pagehash functionality because it is useless to me and
  fixing it would be a pain. Would require declaring a few
  ASN_SEQUENCES and use that to get the required i2d functions
  from what I could find out.
- Remove OBJ_create calls that seem to serve no purpose,
  now crash because NULL pointers are no longer handled
  (who changes API that way?!) and even if that was fixed
  lead to errors when these objects are later created
  again/"for real" by OBJ_txt2nid or OBJ_txt2obj (I think,
  did not investigate further).

diff --git a/osslsigncode.c b/osslsigncode.c
index 2978c02..3797458 100644
--- a/osslsigncode.c
+++ b/osslsigncode.c
@@ -450,16 +450,16 @@ static SpcSpOpusInfo* createOpus(const char *desc, const char *url)
 	if (desc) {
 		info->programName = SpcString_new();
 		info->programName->type = 1;
-		info->programName->value.ascii = M_ASN1_IA5STRING_new();
-		ASN1_STRING_set((ASN1_STRING *)info->programName->value.ascii,
+		info->programName->value.ascii = ASN1_IA5STRING_new();
+		ASN1_STRING_set(info->programName->value.ascii,
 						(const unsigned char*)desc, strlen(desc));
 	}

 	if (url) {
 		info->moreInfo = SpcLink_new();
 		info->moreInfo->type = 0;
-		info->moreInfo->value.url = M_ASN1_IA5STRING_new();
-		ASN1_STRING_set((ASN1_STRING *)info->moreInfo->value.url,
+		info->moreInfo->value.url = ASN1_IA5STRING_new();
+		ASN1_STRING_set(info->moreInfo->value.url,
 						(const unsigned char*)url, strlen(url));
 	}

@@ -609,19 +609,20 @@ static int add_timestamp(PKCS7 *sig, char *url, char *proxy, int rfc3161, const

 	if (rfc3161) {
 		unsigned char mdbuf[EVP_MAX_MD_SIZE];
-		EVP_MD_CTX mdctx;
+		EVP_MD_CTX *mdctx = EVP_MD_CTX_new();

-		EVP_MD_CTX_init(&mdctx);
-		EVP_DigestInit(&mdctx, md);
-		EVP_DigestUpdate(&mdctx, si->enc_digest->data, si->enc_digest->length);
-		EVP_DigestFinal(&mdctx, mdbuf, NULL);
+		EVP_DigestInit(mdctx, md);
+		EVP_DigestUpdate(mdctx, si->enc_digest->data, si->enc_digest->length);
+		EVP_DigestFinal(mdctx, mdbuf, NULL);
+		EVP_MD_CTX_free(mdctx);
+		mdctx = NULL;

 		TimeStampReq *req = TimeStampReq_new();
 		ASN1_INTEGER_set(req->version, 1);
 		req->messageImprint->digestAlgorithm->algorithm = OBJ_nid2obj(EVP_MD_nid(md));
 		req->messageImprint->digestAlgorithm->parameters = ASN1_TYPE_new();
 		req->messageImprint->digestAlgorithm->parameters->type = V_ASN1_NULL;
-		M_ASN1_OCTET_STRING_set(req->messageImprint->digest, mdbuf, EVP_MD_size(md));
+		ASN1_OCTET_STRING_set(req->messageImprint->digest, mdbuf, EVP_MD_size(md));
 		req->certReq = (void*)0x1;

 		len = i2d_TimeStampReq(req, NULL);
@@ -921,83 +922,8 @@ static const unsigned char classid_page_hash[] = {
 	0xAE, 0x05, 0xA2, 0x17, 0xDA, 0x8E, 0x60, 0xD6
 };

-static unsigned char *calc_page_hash(char *indata, unsigned int peheader, int pe32plus,
-									 unsigned int sigpos, int phtype, unsigned int *phlen);
-
-DECLARE_STACK_OF(ASN1_OCTET_STRING)
-#ifndef sk_ASN1_OCTET_STRING_new_null
-#define sk_ASN1_OCTET_STRING_new_null() SKM_sk_new_null(ASN1_OCTET_STRING)
-#define sk_ASN1_OCTET_STRING_free(st) SKM_sk_free(ASN1_OCTET_STRING, (st))
-#define sk_ASN1_OCTET_STRING_push(st, val) SKM_sk_push(ASN1_OCTET_STRING, (st), (val))
-#define i2d_ASN1_SET_OF_ASN1_OCTET_STRING(st, pp, i2d_func, ex_tag, ex_class, is_set) \
-	SKM_ASN1_SET_OF_i2d(ASN1_OCTET_STRING, (st), (pp), (i2d_func), (ex_tag), (ex_class), (is_set))
-#endif
-
-DECLARE_STACK_OF(SpcAttributeTypeAndOptionalValue)
-#ifndef sk_SpcAttributeTypeAndOptionalValue_new_null
-#define sk_SpcAttributeTypeAndOptionalValue_new_null() SKM_sk_new_null(SpcAttributeTypeAndOptionalValue)
-#define sk_SpcAttributeTypeAndOptionalValue_free(st) SKM_sk_free(SpcAttributeTypeAndOptionalValue, (st))
-#define sk_SpcAttributeTypeAndOptionalValue_push(st, val) SKM_sk_push(SpcAttributeTypeAndOptionalValue, (st), (val))
-#define i2d_SpcAttributeTypeAndOptionalValue(st, pp, i2d_func, ex_tag, ex_class, is_set) \
-	SKM_ASN1_SET_OF_i2d(SpcAttributeTypeAndOptionalValue, (st), (pp), (i2d_func), (ex_tag), (ex_class), (is_set))
-#endif
-
-static SpcLink *get_page_hash_link(int phtype, char *indata, unsigned int peheader, int pe32plus, unsigned int sigpos)
-{
-	unsigned int phlen;
-	unsigned char *ph = calc_page_hash(indata, peheader, pe32plus, sigpos, phtype, &phlen);
-	if (!ph) {
-		fprintf(stderr, "Failed to calculate page hash\n");
-		exit(-1);
-	}
-
-	ASN1_OCTET_STRING *ostr = M_ASN1_OCTET_STRING_new();
-	M_ASN1_OCTET_STRING_set(ostr, ph, phlen);
-	free(ph);
-
-	STACK_OF(ASN1_OCTET_STRING) *oset = sk_ASN1_OCTET_STRING_new_null();
-	sk_ASN1_OCTET_STRING_push(oset, ostr);
-	unsigned char *p, *tmp;
-	unsigned int l;
-	l = i2d_ASN1_SET_OF_ASN1_OCTET_STRING(oset, NULL, i2d_ASN1_OCTET_STRING,
-										  V_ASN1_SET, V_ASN1_UNIVERSAL, IS_SET);
-	tmp = p = OPENSSL_malloc(l);
-	i2d_ASN1_SET_OF_ASN1_OCTET_STRING(oset, &tmp, i2d_ASN1_OCTET_STRING,
-									  V_ASN1_SET, V_ASN1_UNIVERSAL, IS_SET);
-	ASN1_OCTET_STRING_free(ostr);
-	sk_ASN1_OCTET_STRING_free(oset);
-
-	SpcAttributeTypeAndOptionalValue *aval = SpcAttributeTypeAndOptionalValue_new();
-	aval->type = OBJ_txt2obj((phtype == NID_sha1) ? SPC_PE_IMAGE_PAGE_HASHES_V1 : SPC_PE_IMAGE_PAGE_HASHES_V2, 1);
-	aval->value = ASN1_TYPE_new();
-	aval->value->type = V_ASN1_SET;
-	aval->value->value.set = ASN1_STRING_new();
-	ASN1_STRING_set(aval->value->value.set, p, l);
-	OPENSSL_free(p);
-
-	STACK_OF(SpcAttributeTypeAndOptionalValue) *aset = sk_SpcAttributeTypeAndOptionalValue_new_null();
-	sk_SpcAttributeTypeAndOptionalValue_push(aset, aval);
-	l = i2d_SpcAttributeTypeAndOptionalValue(aset, NULL, i2d_SpcAttributeTypeAndOptionalValue,
-											 V_ASN1_SET, V_ASN1_UNIVERSAL, IS_SET);
-	tmp = p = OPENSSL_malloc(l);
-	l = i2d_SpcAttributeTypeAndOptionalValue(aset, &tmp, i2d_SpcAttributeTypeAndOptionalValue,
-											 V_ASN1_SET, V_ASN1_UNIVERSAL, IS_SET);
-	sk_SpcAttributeTypeAndOptionalValue_free(aset);
-	SpcAttributeTypeAndOptionalValue_free(aval);
-
-	SpcSerializedObject *so = SpcSerializedObject_new();
-	M_ASN1_OCTET_STRING_set(so->classId, classid_page_hash, sizeof(classid_page_hash));
-	M_ASN1_OCTET_STRING_set(so->serializedData, p, l);
-	OPENSSL_free(p);
-
-	SpcLink *link = SpcLink_new();
-	link->type = 1;
-	link->value.moniker = so;
-	return link;
-}
-
 static void get_indirect_data_blob(u_char **blob, int *len, const EVP_MD *md, file_type_t type,
-								   int pagehash, char *indata, unsigned int peheader, int pe32plus,
+								   char *indata, unsigned int peheader, int pe32plus,
 								   unsigned int sigpos)
 {
 	static const unsigned char msistr[] = {
@@ -1024,14 +950,7 @@ static void get_indirect_data_blob(u_char **blob, int *len, const EVP_MD *md, fi
 	} else if (type == FILE_TYPE_PE) {
 		SpcPeImageData *pid = SpcPeImageData_new();
 		ASN1_BIT_STRING_set(pid->flags, (unsigned char*)"0", 0);
-		if (pagehash) {
-			int phtype = NID_sha1;
-			if (EVP_MD_size(md) > EVP_MD_size(EVP_sha1()))
-				phtype = NID_sha256;
-			pid->file = get_page_hash_link(phtype, indata, peheader, pe32plus, sigpos);
-		} else {
-			pid->file = get_obsolete_link();
-		}
+		pid->file = get_obsolete_link();
 		l = i2d_SpcPeImageData(pid, NULL);
 		p = OPENSSL_malloc(l);
 		i2d_SpcPeImageData(pid, &p);
@@ -1046,7 +965,7 @@ static void get_indirect_data_blob(u_char **blob, int *len, const EVP_MD *md, fi
 		ASN1_INTEGER_set(si->d, 0);
 		ASN1_INTEGER_set(si->e, 0);
 		ASN1_INTEGER_set(si->f, 0);
-		M_ASN1_OCTET_STRING_set(si->string, msistr, sizeof(msistr));
+		ASN1_OCTET_STRING_set(si->string, msistr, sizeof(msistr));
 		l = i2d_SpcSipInfo(si, NULL);
 		p = OPENSSL_malloc(l);
 		i2d_SpcSipInfo(si, &p);
@@ -1068,7 +987,7 @@ static void get_indirect_data_blob(u_char **blob, int *len, const EVP_MD *md, fi
 	hashlen = EVP_MD_size(md);
 	hash = OPENSSL_malloc(hashlen);
 	memset(hash, 0, hashlen);
-	M_ASN1_OCTET_STRING_set(idc->messageDigest->digest, hash, hashlen);
+	ASN1_OCTET_STRING_set(idc->messageDigest->digest, hash, hashlen);
 	OPENSSL_free(hash);

 	*len  = i2d_SpcIndirectDataContent(idc, NULL);
@@ -1923,19 +1842,18 @@ static void calc_pe_digest(BIO *bio, const EVP_MD *md, unsigned char *mdbuf,
 						   unsigned int peheader, int pe32plus, unsigned int fileend)
 {
 	static unsigned char bfb[16*1024*1024];
-	EVP_MD_CTX mdctx;
+	EVP_MD_CTX *mdctx = EVP_MD_CTX_new();

-	EVP_MD_CTX_init(&mdctx);
-	EVP_DigestInit(&mdctx, md);
+	EVP_DigestInit(mdctx, md);

 	memset(mdbuf, 0, EVP_MAX_MD_SIZE);

 	(void)BIO_seek(bio, 0);
 	BIO_read(bio, bfb, peheader + 88);
-	EVP_DigestUpdate(&mdctx, bfb, peheader + 88);
+	EVP_DigestUpdate(mdctx, bfb, peheader + 88);
 	BIO_read(bio, bfb, 4);
 	BIO_read(bio, bfb, 60+pe32plus*16);
-	EVP_DigestUpdate(&mdctx, bfb, 60+pe32plus*16);
+	EVP_DigestUpdate(mdctx, bfb, 60+pe32plus*16);
 	BIO_read(bio, bfb, 8);

 	unsigned int n = peheader + 88 + 4 + 60+pe32plus*16 + 8;
@@ -1946,11 +1864,12 @@ static void calc_pe_digest(BIO *bio, const EVP_MD *md, unsigned char *mdbuf,
 		int l = BIO_read(bio, bfb, want);
 		if (l <= 0)
 			break;
-		EVP_DigestUpdate(&mdctx, bfb, l);
+		EVP_DigestUpdate(mdctx, bfb, l);
 		n += l;
 	}

-	EVP_DigestFinal(&mdctx, mdbuf, NULL);
+	EVP_DigestFinal(mdctx, mdbuf, NULL);
+	EVP_MD_CTX_free(mdctx);
 }

@@ -2019,16 +1938,15 @@ static unsigned char *calc_page_hash(char *indata, unsigned int peheader, int pe
 	int phlen = pphlen * (3 + nsections + sigpos / pagesize);
 	unsigned char *res = malloc(phlen);
 	unsigned char *zeroes = calloc(pagesize, 1);
-	EVP_MD_CTX mdctx;
-
-	EVP_MD_CTX_init(&mdctx);
-	EVP_DigestInit(&mdctx, md);
-	EVP_DigestUpdate(&mdctx, indata, peheader + 88);
-	EVP_DigestUpdate(&mdctx, indata + peheader + 92, 60 + pe32plus*16);
-	EVP_DigestUpdate(&mdctx, indata + peheader + 160 + pe32plus*16, hdrsize - (peheader + 160 + pe32plus*16));
-	EVP_DigestUpdate(&mdctx, zeroes, pagesize - hdrsize);
+	EVP_MD_CTX *mdctx = EVP_MD_CTX_new();
+
+	EVP_DigestInit(mdctx, md);
+	EVP_DigestUpdate(mdctx, indata, peheader + 88);
+	EVP_DigestUpdate(mdctx, indata + peheader + 92, 60 + pe32plus*16);
+	EVP_DigestUpdate(mdctx, indata + peheader + 160 + pe32plus*16, hdrsize - (peheader + 160 + pe32plus*16));
+	EVP_DigestUpdate(mdctx, zeroes, pagesize - hdrsize);
 	memset(res, 0, 4);
-	EVP_DigestFinal(&mdctx, res + 4, NULL);
+	EVP_DigestFinal(mdctx, res + 4, NULL);

 	unsigned short sizeofopthdr = GET_UINT16_LE(indata + peheader + 20);
 	char *sections = indata + peheader + 24 + sizeofopthdr;
@@ -2040,18 +1958,20 @@ static unsigned char *calc_page_hash(char *indata, unsigned int peheader, int pe
 		unsigned int l;
 		for (l=0; l < rs; l+=pagesize, pi++) {
 			PUT_UINT32_LE(ro + l, res + pi*pphlen);
-			EVP_DigestInit(&mdctx, md);
+			EVP_DigestInit(mdctx, md);
 			if (rs - l < pagesize) {
-				EVP_DigestUpdate(&mdctx, indata + ro + l, rs - l);
-				EVP_DigestUpdate(&mdctx, zeroes, pagesize - (rs - l));
+				EVP_DigestUpdate(mdctx, indata + ro + l, rs - l);
+				EVP_DigestUpdate(mdctx, zeroes, pagesize - (rs - l));
 			} else {
-				EVP_DigestUpdate(&mdctx, indata + ro + l, pagesize);
+				EVP_DigestUpdate(mdctx, indata + ro + l, pagesize);
 			}
-			EVP_DigestFinal(&mdctx, res + pi*pphlen + 4, NULL);
+			EVP_DigestFinal(mdctx, res + pi*pphlen + 4, NULL);
 		}
 		lastpos = ro + rs;
 		sections += 40;
 	}
+	EVP_MD_CTX_free(mdctx);
+	mdctx = NULL;
 	PUT_UINT32_LE(lastpos, res + pi*pphlen);
 	memset(res + pi*pphlen + 4, 0, EVP_MD_size(md));
 	pi++;
@@ -2413,7 +2333,7 @@ int main(int argc, char **argv)
 	int nturl = 0, ntsurl = 0;
 	int addBlob = 0;
 	u_char *p = NULL;
-	int ret = 0, i, len = 0, jp = -1, pe32plus = 0, comm = 0, pagehash = 0;
+	int ret = 0, i, len = 0, jp = -1, pe32plus = 0, comm = 0;
 	unsigned int tmp, peheader = 0, padlen = 0;
 	off_t filesize, fileend, sigfilesize, sigfileend, outdatasize;
 	file_type_t type;
@@ -2448,13 +2368,6 @@ int main(int argc, char **argv)
 	ERR_load_crypto_strings();
 	OPENSSL_add_all_algorithms_conf();

-	/* create some MS Authenticode OIDS we need later on */
-	if (!OBJ_create(SPC_STATEMENT_TYPE_OBJID, NULL, NULL) ||
-		!OBJ_create(SPC_MS_JAVA_SOMETHING, NULL, NULL) ||
-		!OBJ_create(SPC_SP_OPUS_INFO_OBJID, NULL, NULL) ||
-		!OBJ_create(SPC_NESTED_SIGNATURE_OBJID, NULL, NULL))
-		DO_EXIT_0("Failed to add objects\n");
-
 	md = EVP_sha1();

 	if (argc > 1) {
@@ -2531,8 +2444,6 @@ int main(int argc, char **argv)
 			readpass = *(++argv);
 		} else if ((cmd == CMD_SIGN) && !strcmp(*argv, "-comm")) {
 			comm = 1;
-		} else if ((cmd == CMD_SIGN) && !strcmp(*argv, "-ph")) {
-			pagehash = 1;
 		} else if ((cmd == CMD_SIGN) && !strcmp(*argv, "-n")) {
 			if (--argc < 1) usage(argv0);
 			desc = *(++argv);
@@ -3243,7 +3154,7 @@ int main(int argc, char **argv)
 		p7x = NULL;
 	}

-	get_indirect_data_blob(&p, &len, md, type, pagehash, indata, peheader, pe32plus, fileend);
+	get_indirect_data_blob(&p, &len, md, type, indata, peheader, pe32plus, fileend);
 	len -= EVP_MD_size(md);
 	memcpy(buf, p, len);
 	OPENSSL_free(p);
--
2.34.1


code:
#!/bin/bash
[% c("var/set_default_env") -%]
distdir=$(pwd)/dist
mkdir -p $distdir/[% project %]
tar xf [% project %]-[% c('version') %].tar.gz
cd [% project %]-[% c('version') %]
patch -p1 < ../0001-Make-code-work-with-OpenSSL-1.1.patch
patch -p1 < ../timestamping.patch

./autogen.sh
./configure --prefix=/[% project %]
make
make DESTDIR=$distdir install

cd $distdir
[% c('tar', {
        tar_src => [ project ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
        }) %]

path: projects/osslsigncode/build


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/mtrojnar/osslsigncode
git_hash: e72a1937d1a13e87074e4584f012f13e03fc1d64
filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 0
var:
  deps:
    - autoconf
    - libtool
    - pkg-config
    - libssl-dev
    - libcurl4-openssl-dev
input_files:
  - filename: 0001-Make-code-work-with-OpenSSL-1.1.patch
  - filename: timestamping.patch

path: projects/osslsigncode/config


code:
From 28b384e77fa0d4dd38751a0c72ab5976d2e38f75 Mon Sep 17 00:00:00 2001
From: Georg Koppen <gk@torproject.org>
Date: Fri, 5 Feb 2016 09:23:10 +0000
Subject: [PATCH] Allow timestamping with the 'add' command

diff --git a/osslsigncode.c b/osslsigncode.c
index 32e37c8..2978c02 100644
--- a/osslsigncode.c
+++ b/osslsigncode.c
@@ -2556,16 +2556,16 @@ int main(int argc, char **argv)
 			if (--argc < 1) usage(argv0);
 			url = *(++argv);
 #ifdef ENABLE_CURL
-		} else if ((cmd == CMD_SIGN) && !strcmp(*argv, "-t")) {
+		} else if ((cmd == CMD_SIGN || cmd == CMD_ADD) && !strcmp(*argv, "-t")) {
 			if (--argc < 1) usage(argv0);
 			turl[nturl++] = *(++argv);
-		} else if ((cmd == CMD_SIGN) && !strcmp(*argv, "-ts")) {
+		} else if ((cmd == CMD_SIGN || cmd == CMD_ADD) && !strcmp(*argv, "-ts")) {
 			if (--argc < 1) usage(argv0);
 			tsurl[ntsurl++] = *(++argv);
-		} else if ((cmd == CMD_SIGN) && !strcmp(*argv, "-p")) {
+		} else if ((cmd == CMD_SIGN || cmd == CMD_ADD) && !strcmp(*argv, "-p")) {
 			if (--argc < 1) usage(argv0);
 			proxy = *(++argv);
-		} else if ((cmd == CMD_SIGN) && !strcmp(*argv, "-noverifypeer")) {
+		} else if ((cmd == CMD_SIGN || cmd == CMD_ADD) && !strcmp(*argv, "-noverifypeer")) {
 			noverifypeer = 1;
 #endif
 		} else if ((cmd == CMD_SIGN || cmd == CMD_ADD) && !strcmp(*argv, "-addUnauthenticatedBlob")) {
--
2.7.0

From 8159546dfa270da0e3512dcba983ce15029111d0 Mon Sep 17 00:00:00 2001
From: Georg Koppen <gk@torproject.org>
Date: Sat, 11 Apr 2020 05:50:36 +0000
Subject: [PATCH] fixup! Allow timestamping with the 'add' command

diff --git a/osslsigncode.c b/osslsigncode.c
index 3797458..4f4b897 100644
--- a/osslsigncode.c
+++ b/osslsigncode.c
@@ -2447,7 +2447,7 @@ int main(int argc, char **argv)
 		} else if ((cmd == CMD_SIGN) && !strcmp(*argv, "-n")) {
 			if (--argc < 1) usage(argv0);
 			desc = *(++argv);
-		} else if ((cmd == CMD_SIGN) && !strcmp(*argv, "-h")) {
+		} else if ((cmd == CMD_SIGN || cmd == CMD_ADD) && !strcmp(*argv, "-h")) {
 			if (--argc < 1) usage(argv0);
 			++argv;
 			if (!strcmp(*argv, "md5")) {
--
2.26.0


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/datachannel
git_hash: 74e13972527c0130d4245897fef9c300a091b14b #v1.5.2
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/datachannel
  go_lib_deps:
    - pion-logging
    - pion-sctp
    - pion-transport
    - testify

input_files:
  - project: container-image
  - name: go
    project: go
  - name: pion-logging
    project: pion-logging
  - name: pion-sctp
    project: pion-sctp
  - name: pion-transport
    project: pion-transport
  - name: testify
    project: testify

path: projects/pion-datachannel/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/dtls
git_hash: d2f797183a9f044ce976e6df6f362662ca722412 #v2.1.5
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/dtls
  go_lib_deps:
    - goxcrypto
    - goxnet
    - goxxerrors
    - pion-logging
    - pion-transport
    - pion-udp

input_files:
  - project: container-image
  - name: go
    project: go
  - name: goxcrypto
    project: goxcrypto
  - name: goxnet
    project: goxnet
  - name: goxxerrors
    project: goxxerrors
  - name: pion-logging
    project: pion-logging
  - name: pion-transport
    project: pion-transport
  - name: pion-udp
    project: pion-udp

path: projects/pion-dtls/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/ice
git_hash: 9b523704bbc3c73764dfee81c5215e2c23641ba4 #v2.2.6
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/ice
  go_lib_deps:
    - gocheck
    - goxnet
    - pion-dtls
    - pion-logging
    - pion-mdns
    - pion-randutil
    - pion-stun
    - pion-transport
    - pion-turn
    - pretty
    - testify
    - uuid

input_files:
  - project: container-image
  - name: go
    project: go
  - name: gocheck
    project: gocheck
  - name: goxnet
    project: goxnet
  - name: pion-dtls
    project: pion-dtls
  - name: pion-logging
    project: pion-logging
  - name: pion-mdns
    project: pion-mdns
  - name: pion-randutil
    project: pion-randutil
  - name: pion-stun
    project: pion-stun
  - name: pion-transport
    project: pion-transport
  - name: pion-turn
    project: pion-turn
  - name: pretty
    project: pretty
  - name: testify
    project: testify
  - name: uuid
    project: uuid

path: projects/pion-ice/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/interceptor
git_hash: ec75ceafde7ff8751f8a2a759208a7b349804d97 #v0.1.11
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/interceptor
  go_lib_deps:
    - pion-logging
    - pion-rtcp
    - pion-rtp
    - testify

input_files:
  - project: container-image
  - name: go
    project: go
  - name: pion-logging
    project: pion-logging
  - name: pion-rtcp
    project: pion-rtcp
  - name: pion-rtp
    project: pion-rtp
  - name: testify
    project: testify

path: projects/pion-interceptor/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/logging
git_hash: 0387f8acdeb20faf48e539e74906dd633851f3a8 #v0.2.2
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/logging

input_files:
  - project: container-image
  - name: go
    project: go

path: projects/pion-logging/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/mdns
git_hash: 9199cc788e17df3558f7069ffcf099da260f5913 #v0.0.5
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/mdns
  go_lib_deps:
    - goxnet
    - pion-logging
    - pion-transport

input_files:
  - project: container-image
  - name: go
    project: go
  - name: goxnet
    project: goxnet
  - name: pion-logging
    project: pion-logging
  - name: pion-transport
    project: pion-transport

path: projects/pion-mdns/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/randutil
git_hash: 3e7aefb6fd280d89fca72f1596348f1939525187 #v0.1.0
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/randutil

input_files:
  - project: container-image
  - name: go
    project: go

path: projects/pion-randutil/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/rtcp
git_hash: a4508c4eaed67332f45d8e2d41b9a936b596ca5c #v1.2.9
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/rtcp
  go_lib_deps:
    - testify

input_files:
  - project: container-image
  - name: go
    project: go
  - name: testify
    project: testify

path: projects/pion-rtcp/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/rtp
git_hash: f47320ba42ace6b75f1f579fc4404c26cf2b0dce #v1.7.13
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/rtp
  go_lib_deps:
    - pion-randutil

input_files:
  - project: container-image
  - name: go
    project: go
  - name: pion-randutil
    project: pion-randutil

path: projects/pion-rtp/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/sctp
git_hash: 7e00bf835f80c3e37a83f4127e14440b647ce316 #v1.8.2
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/sctp
  go_lib_deps:
    - go-spew
    - gocheck
    - pion-logging
    - pion-randutil
    - pion-transport
    - pretty
    - testify

input_files:
  - project: container-image
  - name: go
    project: go
  - name: go-spew
    project: go-spew
  - name: gocheck
    project: gocheck
  - name: pion-logging
    project: pion-logging
  - name: pion-randutil
    project: pion-randutil
  - name: pion-transport
    project: pion-transport
  - name: pretty
    project: pretty
  - name: testify
    project: testify

path: projects/pion-sctp/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/sdp
git_hash: 36cd1e811dcddcbd38730f981533ea7c68fab715 #v3.0.5
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/sdp
  go_lib_deps:
    - pion-randutil
    - testify

input_files:
  - project: container-image
  - name: go
    project: go
  - name: pion-randutil
    project: pion-randutil
  - name: testify
    project: testify

path: projects/pion-sdp/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/srtp
git_hash: 4555d8ddce7c5fdf808d34d2b1a9be4a6458e417 #v2.0.9
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/srtp
  go_lib_deps:
    - pion-logging
    - pion-rtcp
    - pion-rtp
    - pion-transport
    - testify

input_files:
  - project: container-image
  - name: go
    project: go
  - name: pion-logging
    project: pion-logging
  - name: pion-rtcp
    project: pion-rtcp
  - name: pion-rtp
    project: pion-rtp
  - name: pion-transport
    project: pion-transport
  - name: testify
    project: testify

path: projects/pion-srtp/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/stun
git_hash: 4fa7a9d658b6037114fd35b6cb257979ed474a9b # v0.3.5
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/stun

input_files:
  - project: container-image
  - name: go
    project: go

path: projects/pion-stun/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/transport
git_hash: 538d788545fbf8f8379e09ed7747543561bfe8d9 #v0.13.0
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/transport
  go_lib_deps:
    - goxnet
    - pion-logging
    - testify
  go_lib_install:
    - github.com/pion/transport/packetio
    - github.com/pion/transport/test
    - github.com/pion/transport/vnet

input_files:
  - project: container-image
  - name: go
    project: go
  - name: goxnet
    project: goxnet
  - name: pion-logging
    project: pion-logging
  - name: testify
    project: testify

path: projects/pion-transport/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/turn
git_hash: ed2e7a9679b43e4040ae932b705d6cbd95536db4 #v2.0.8
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/turn
  go_lib_deps:
    - pion-logging
    - pion-randutil
    - pion-stun
    - pion-transport
    - testify

input_files:
  - project: container-image
  - name: go
    project: go
  - name: pion-logging
    project: pion-logging
  - name: pion-randutil
    project: pion-randutil
  - name: pion-stun
    project: pion-stun
  - name: pion-transport
    project: pion-transport
  - name: testify
    project: testify

path: projects/pion-turn/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/udp
git_hash: 534f92eb13db661274eb15a8ea186585e9f1e182 #v0.1.1
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/udp
  go_lib_deps:
    - pion-transport

input_files:
  - project: container-image
  - name: go
    project: go
  - name: pion-transport
    project: pion-transport

path: projects/pion-udp/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/pion/webrtc
git_hash: 7367daf2324b66290f0bdbaab1e51297de1f4989 #v3.1.41
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/pion/webrtc
  go_lib_deps:
    - agouti
    - goxcrypto
    - goxnet
    - pion-datachannel
    - pion-dtls
    - pion-ice
    - pion-interceptor
    - pion-logging
    - pion-randutil
    - pion-rtcp
    - pion-rtp
    - pion-sctp
    - pion-sdp
    - pion-srtp
    - pion-transport
    - testify

input_files:
  - project: container-image
  - name: go
    project: go
  - name: agouti
    project: agouti
  - name: goxcrypto
    project: goxcrypto
  - name: goxnet
    project: goxnet
  - name: pion-datachannel
    project: pion-datachannel
  - name: pion-dtls
    project: pion-dtls
  - name: pion-ice
    project: pion-ice
  - name: pion-interceptor
    project: pion-interceptor
  - name: pion-logging
    project: pion-logging
  - name: pion-randutil
    project: pion-randutil
  - name: pion-rtcp
    project: pion-rtcp
  - name: pion-rtp
    project: pion-rtp
  - name: pion-sctp
    project: pion-sctp
  - name: pion-sdp
    project: pion-sdp
  - name: pion-srtp
    project: pion-srtp
  - name: pion-transport
    project: pion-transport
  - name: testify
    project: testify

path: projects/pion-webrtc/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/kr/pretty
git_hash: 73f6ac0b30a98e433b289500d779f50c1a6f0712 # v0.1.0
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/kr/pretty
  go_lib_deps:
    - text

input_files:
  - project: container-image
  - name: go
    project: go
  - name: text
    project: text

path: projects/pretty/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/kr/pty
git_hash: 282ce0e5322c82529687d609ee670fac7c7d917c # v1.1.1
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/kr/pty

input_files:
  - project: container-image
  - name: go
    project: go

path: projects/pty/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]

tar xvf [% project %]-[% c('version') %].tar.gz

mkdir -p /var/tmp/dist/
cd /var/tmp/dist/

cp -a $rootdir/[% project %]*/[% project %] ./[% project %]

[% c('tar', {
        tar_src => '.',
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
        }) %]

path: projects/pyaes/build


code:
# vim: filetype=yaml sw=2
version: 1.6.1
filename: "[% project %]-[% c('version') %]-[% c('var/build_id') %].tar.gz"
container:
  use_container: 1
input_files:
  - project: container-image
  - URL: https://files.pythonhosted.org/packages/source/p/pyaes/pyaes-[% c("version") %].tar.gz
    sha256sum: 02c1b1405c38d3c370b085fb952dd8bea3fadcee6411ad99f312cc129c536d8f
    # TODO: This version doesn't show up as a Git tag; where did it come from?

path: projects/pyaes/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]
distdir=/var/tmp/dist/[% project %]
mkdir -p $distdir
tar xf [% c('input_files_by_name/python') %]
cd Python-[% c('version') %]
./configure --prefix=$distdir
make -j[% c("num_procs") %]
make prefix=$distdir install
cd /var/tmp/dist
[% c('tar', {
	tar_src => 'python',
	tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
    }) %]

path: projects/python/build


code:
# vim: filetype=yaml sw=2
version: 3.6.8
filename: 'python-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1
var:
  deps:
    - xz-utils
    - build-essential
    - python-all
    - zlib1g-dev
    - libssl-dev
    - libsqlite3-dev

  setup: |
    mkdir -p /var/tmp/dist
    tar -C /var/tmp/dist -xf $rootdir/[% c("python_tarfile") %]
    export PATH=/var/tmp/dist/python/bin:"$PATH"

input_files:
  - project: container-image
  - name: python
    URL: 'https://www.python.org/ftp/python/[% c("version") %]/Python-[% c("version") %].tar.xz'
    gpg_keyring: python.gpg
    sig_ext: asc
    file_gpg_id: 1

path: projects/python/config


code:
#!/bin/sh
[% c("var/set_default_env") -%]
# reset HOME which was changed by var/set_default_env, for gpg
[% IF ENV.HOME %]export HOME="[% ENV.HOME %]"[% END %]
destdir="[% dest_dir _ '/' _ c("var/publish_dir") %]"
mkdir -p "$destdir"
[% IF c("var/browser-android-armv7") -%]
  mv [% c('input_files_by_name/android-armv7') %]/* "$destdir"/
[% END -%]
[% IF c("var/browser-android-x86") -%]
  mv [% c('input_files_by_name/android-x86') %]/* "$destdir"/
[% END -%]
[% IF c("var/browser-android-x86_64") -%]
  mv [% c('input_files_by_name/android-x86_64') %]/* "$destdir"/
[% END -%]
[% IF c("var/browser-android-aarch64") -%]
  mv [% c('input_files_by_name/android-aarch64') %]/* "$destdir"/
[% END -%]
[% IF c("var/browser-windows-i686") -%]
  mv [% c('input_files_by_name/windows-i686') %]/* "$destdir"/
  [% IF c("var/tor-browser") -%]
    mv [% c('input_files_by_name/windows-expert-bundle') %]/* "$destdir"/
  [% END -%]
[% END -%]
[% IF c("var/browser-windows-x86_64") -%]
  mv [% c('input_files_by_name/windows-x86_64') %]/* "$destdir"/
  [% IF c("var/tor-browser") -%]
    mv [% c('input_files_by_name/windows64-expert-bundle') %]/* "$destdir"/
  [% END -%]
[% END -%]
[% IF c("var/browser-osx-x86_64") -%]
  mv [% c('input_files_by_name/osx-x86_64') %]/* "$destdir"/
[% END -%]
[% IF c("var/browser-linux-i686") -%]
  mv [% c('input_files_by_name/linux-i686') %]/* "$destdir"/
[% END -%]
[% IF c("var/browser-linux-x86_64") -%]
  mv [% c('input_files_by_name/linux-x86_64') %]/* "$destdir"/
[% END -%]
[% IF c("var/torbrowser-src") -%]
  mv  [% c('input_files_by_name/src-firefox') %]      \
      [% IF c("var/tor-browser"); GET c('input_files_by_name/src-tor-launcher'); END %] \
      "$destdir"/
[% END -%]
cd "$destdir"
cat > .htaccess <<EOF
RewriteEngine On
RewriteRule ^sha256sums.txt$ sha256sums-unsigned-build.txt
RewriteRule ^sha256sums.txt.asc$ sha256sums-unsigned-build.txt.asc
RewriteRule ^sha256sums.incrementals.txt$ sha256sums-unsigned-build.incrementals.txt
RewriteRule ^sha256sums.incrementals.txt.asc$ sha256sums-unsigned-build.incrementals.txt.asc
EOF
sha256sum $(ls -1 *.exe *.tar.xz *.dmg *.mar *.zip *.tar.gz *.apk *.json | grep -v '\.incremental\.mar$' | sort) > sha256sums-unsigned-build.txt
[% IF c("var/sign_build") -%]
  gpg -abs [% c("var/sign_build_gpg_opts") %] sha256sums-unsigned-build.txt
[% END -%]
cat sha256sums-unsigned-build.txt

path: projects/release/build


code:
# vim: filetype=yaml sw=2
version: '[% c("var/torbrowser_version") %]'
output_dir: release
link_input_files: 1

var:
  signed_status: unsigned
  publish_dir: '[% c("var/signed_status") %]/[% c("version") %]-[% c("var/torbrowser_build") %]'
  containers_target: with_containers

targets:
  browser-all:
    - browser-linux-x86_64
    - browser-linux-i686
    - browser-windows-i686
    - browser-windows-x86_64
    - browser-osx-x86_64
    - browser-android-armv7
    - browser-android-x86
    - browser-android-x86_64
    - browser-android-aarch64
    - browser-src
  browser-all-desktop:
    - browser-linux-x86_64
    - browser-linux-i686
    - browser-windows-i686
    - browser-windows-x86_64
    - browser-osx-x86_64
    - browser-src
  browser-all-android:
    - browser-android-armv7
    - browser-android-x86
    - browser-android-x86_64
    - browser-android-aarch64
  browser-android-armv7:
    var:
      browser-android-armv7: 1
  browser-android-x86:
    var:
      browser-android-x86: 1
  browser-android-x86_64:
    var:
      browser-android-x86_64: 1
  browser-android-aarch64:
    var:
      browser-android-aarch64: 1
  browser-linux-x86_64:
    var:
      browser-linux-x86_64: 1
  browser-linux-x86_64-asan:
    var:
      browser-linux-x86_64: 1
      asan-build: '-asan'
  browser-linux-i686:
    var:
      browser-linux-i686: 1
  browser-windows-i686:
    var:
      browser-windows-i686: 1
  browser-windows-x86_64:
    var:
      browser-windows-x86_64: 1
  browser-osx-x86_64:
    var:
      browser-osx-x86_64: 1
  browser-src:
    var:
      browser-src: '[% ! c("var/testbuild") %]'
  browser-src-testbuild:
    var:
      browser-src: 1

  notarget:
    - torbrowser
    - release
    - browser-all
    - browser-all-android
    - browser-all-desktop

  noversiondir:
    var:
      publish_dir: ''

  torbrowser:
    var:
      browser_type: torbrowser
  basebrowser:
    var:
      browser_type: basebrowser

  release:
    var:
      build_target: release

  nightly:
    output_dir: 'nightly'
    var:
      build_target: nightly
      publish_dir: '[% c("version") %]'

  alpha:
    output_dir: alpha
    var:
      build_target: alpha

  testbuild:
    output_dir: 'testbuild'
    var:
      testbuild: 1
      build_target: '[% c("var/browser_type") %]-testbuild'
      publish_dir: ''

  no_containers:
    var:
      containers_target: no_containers

  signed:
    var:
      signed_status: signed

  create_unsigned_incrementals:
    var:
      create_unsigned_incrementals: 1

input_files:

# Release
 - name: android-armv7
   project: browser
   enable: '[% c("var/browser-android-armv7") %]'
   target:
     - '[% c("var/containers_target") %]'
     - '[% c("var/build_target") %]'
     - '[% c("var/browser_type") %]-android-armv7'

 - name: android-x86
   project: browser
   enable: '[% c("var/browser-android-x86") %]'
   target:
     - '[% c("var/containers_target") %]'
     - '[% c("var/build_target") %]'
     - '[% c("var/browser_type") %]-android-x86'

 - name: android-x86_64
   project: browser
   enable: '[% c("var/browser-android-x86_64") %]'
   target:
     - '[% c("var/containers_target") %]'
     - '[% c("var/build_target") %]'
     - '[% c("var/browser_type") %]-android-x86_64'

 - name: android-aarch64
   project: browser
   enable: '[% c("var/browser-android-aarch64") %]'
   target:
     - '[% c("var/containers_target") %]'
     - '[% c("var/build_target") %]'
     - '[% c("var/browser_type") %]-android-aarch64'

 - name: linux-x86_64
   project: browser
   enable: '[% c("var/browser-linux-x86_64") %]'
   target:
     - '[% c("var/build_target") %]'
     - '[% c("var/browser_type") %]-linux-x86_64[% c("var/asan-build") %]'

 - name: linux-i686
   project: browser
   enable: '[% c("var/browser-linux-i686") %]'
   target:
     - '[% c("var/build_target") %]'
     - '[% c("var/browser_type") %]-linux-i686'

 - name: windows-i686
   project: browser
   enable: '[% c("var/browser-windows-i686") %]'
   target:
     - '[% c("var/build_target") %]'
     - '[% c("var/browser_type") %]-windows-i686'

 - name: windows-x86_64
   project: browser
   enable: '[% c("var/browser-windows-x86_64") %]'
   target:
     - '[% c("var/build_target") %]'
     - '[% c("var/browser_type") %]-windows-x86_64'

 - name: osx-x86_64
   project: browser
   enable: '[% c("var/browser-osx-x86_64") %]'
   target:
     - '[% c("var/build_target") %]'
     - '[% c("var/browser_type") %]-osx-x86_64'

 - name: windows-expert-bundle
   project: tor
   enable: '[% c("var/browser-windows-i686") %]'
   target:
     - '[% c("var/build_target") %]'
     - '[% c("var/browser_type") %]-windows-i686'
     - expert-bundle

 - name: windows64-expert-bundle
   project: tor
   enable: '[% c("var/browser-windows-x86_64") && c("var/tor-browser") %]'
   target:
     - '[% c("var/build_target") %]'
     - '[% c("var/browser_type") %]-windows-x86_64'
     - expert-bundle

 - name: src-firefox
   project: firefox
   enable: '[% c("var/browser-src") %]'
   pkg_type: src-tarballs
   target:
     - '[% c("var/build_target") %]'
     - browser-src
     - '[% c("var/browser_type") %]'

 - name: src-tor-launcher
   project: tor-launcher
   enable: '[% c("var/browser-src") && c("var/tor-browser") %]'
   pkg_type: src-tarballs
   target:
     - '[% c("var/build_target") %]'
     - browser-src
     - '[% c("var/browser_type") %]'

steps:
  signtag:
    build_log: '-'
    debug: 0
    input_files: []
    signtag: '[% INCLUDE signtag %]'
  update_responses_config:
    build_log: '-'
    debug: 0
    input_files: []
    update_responses_config: '[% INCLUDE update_responses_config %]'
  create_update_responses_tar:
    build_log: '-'
    debug: 0
    input_files: []
    create_update_responses_tar: '[% INCLUDE create_update_responses_tar %]'
  hash_incrementals:
    build_log: '-'
    debug: 0
    input_files: []
    hash_incrementals: '[% INCLUDE hash_incrementals %]'
  dmg2mar:
    build_log: '-'
    debug: 0
    input_files: []
    dmg2mar: '[% INCLUDE dmg2mar %]'

path: projects/release/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]
[% shell_quote(c("basedir")) %]/tools/update-responses/update_responses
mkdir -p [% shell_quote(path(dest_dir)) %]/update-responses
[% SET channel = c('var/channel') -%]
mv [% shell_quote(c("basedir")) %]/tools/update-responses/htdocs/[% channel %] [% channel %]
chmod 775 [% channel %]
chmod 664 [% channel %]/.htaccess [% channel %]/*
tar cf [% shell_quote(path(dest_dir)) %]/update-responses/update-responses-[% channel %]-[%  c("version") %].tar [% channel %]


code:
#!/bin/bash
[% c("var/set_default_env") -%]
cd [% shell_quote(path(dest_dir)) %]/[% c("var/signed_status") %]/[%  c("version") %]
[% shell_quote(c("basedir")) %]/tools/dmg2mar [% c("var/channel") %]


code:
#!/bin/bash
[% IF c("var/sign_build") -%]
  # var/set_default_env will reset HOME. We need to restore it to use gpg.
  old_HOME="$HOME"
[% END -%]
[% c("var/set_default_env") -%]
[% IF c("var/nightly") -%]
  cd [% shell_quote(path(dest_dir)) %]/[%  c("version") %]
[% ELSE -%]
  cd [% shell_quote(path(dest_dir)) %]/[% c("var/signed_status") %]/[% c("version") %]-[% c("var/torbrowser_build") %]
[% END -%]
if ls -1 | grep -q '\.incremental\.mar$'
then
  sha256sum `ls -1 | grep '\.incremental\.mar$' | sort` > sha256sums-[% c("var/signed_status") %]-build.incrementals.txt
else
  echo 'No incrementals were found' >&2
  exit 1
fi
[% IF c("var/sign_build") -%]
  export HOME="$old_HOME"
  gpg -abs [% c("var/sign_build_gpg_opts") %] sha256sums-[% c("var/signed_status") %]-build.incrementals.txt
[% END -%]


code:
#!/bin/bash
[% c("var/set_default_env") -%]
# reset HOME which was changed by var/set_default_env, for gpg/git
[% IF ENV.HOME %]export HOME="[% ENV.HOME %]"[% END %]
cd [% c("basedir") %]
git tag [% c("buildconf/git_signtag_opt") %] -m \
        'Tagging [% c("var/torbrowser_build") %] for [% c("var/torbrowser_version") %]' \
        tbb-[% c("var/torbrowser_version") %]-[% c("var/torbrowser_build") %]

path: projects/release/signtag


code:
#!/bin/bash
[% c("var/set_default_env") -%]
cat > [% shell_quote(c("basedir")) %]/tools/update-responses/config.yml << 'EOF'
[% INCLUDE update_responses_config.yml -%]
EOF

[% IF ! c("var/nightly") -%]
  # Update / create symlink $torbrowser_version -> $torbrowser_version-buildN
  versiondir=[% shell_quote(path(dest_dir)) _ '/' _ c("var/signed_status") _ '/' _ c("version") %]
  test -L "$versiondir" && rm -f "$versiondir"
  test -d "$versiondir" || ln -s [% shell_quote(c("version")) %]-[% shell_quote(c("var/torbrowser_build")) %] "$versiondir"
[% END -%]


code:
---
tmp_dir: '[% c("tmp_dir") %]'
create_downloads_json: 1
appname_marfile: tor-browser
appname_bundle_osx: TorBrowser
appname_bundle_linux: tor-browser
appname_bundle_win32: torbrowser-install
appname_bundle_win64: torbrowser-install-win64
releases_dir: [% path(c('output_dir')) %][% IF ! c("var/nightly") %]/signed[% END %]
download:
    archive_url: https://archive.torproject.org/tor-package-archive/torbrowser
    gpg_keyring: ../../keyring/torbrowser.gpg
    bundles_url: https://dist.torproject.org/torbrowser
    mars_url: https://cdn.torproject.org/aus1/torbrowser
build_targets:
    linux32: Linux_x86-gcc3
    linux64: Linux_x86_64-gcc3
    win32:
        - WINNT_x86-gcc3
        - WINNT_x86-gcc3-x86
        - WINNT_x86-gcc3-x64
    win64: WINNT_x86_64-gcc3-x64
    osx32: Darwin_x86-gcc3
    osx64: Darwin_x86_64-gcc3
channels:
    [% c('var/channel') %]: [% c("var/torbrowser_version") %]
versions:
    [% c("var/torbrowser_version") %]:
[% IF c("var/create_unsigned_incrementals") -%]
        releases_dir: [% path(c('output_dir')) %]/unsigned
[% END -%]
        platformVersion: [% pc('firefox', 'var/firefox_platform_version') %]
        detailsURL: https://blog.torproject.org/new-release-tor-browser-[% c("var/torbrowser_version") FILTER remove('\.') %]
        incremental_from:
[% SET incr_from = c("var/nightly") ? c("var_p/nightly_torbrowser_incremental_from") : c("var/torbrowser_incremental_from");
   FOREACH v IN incr_from -%]
          - [% v %]
[% END -%]
        migrate_archs:
          osx32: osx64
        migrate_langs:
            pt-PT: pt-BR
        minSupportedInstructionSet: SSE2
        osx32:
            minSupportedOSVersion: 13.0.0
        osx64:
            minSupportedOSVersion: 13.0.0
        win32:
            minSupportedOSVersion: 6.1
        win64:
            minSupportedOSVersion: 6.1
mar_compression: xz
tag: 'tbb-[% c("var/torbrowser_version") %]-[% c("var/torbrowser_build") %]'
htaccess_rewrite_rules:
    alpha: |
        # bug 26569: Redirect pre-8.0a9 alpha users to a separate update directory
        RewriteRule ^[^/]+/8\.0a[12345678]/.* https://aus1.torproject.org/torbrowser/update_pre8.0a9/alpha/$0 [last]
        RewriteRule ^[^/]+/[4567]\..*/.* https://aus1.torproject.org/torbrowser/update_pre8.0a9/alpha/$0 [last]
    release: |
        # bug 26570: Redirect pre-8.0 stable users to a separate update directory
        RewriteRule ^[^/]+/[4567]\..*/.* https://aus1.torproject.org/torbrowser/update_pre8.0/release/$0 [last]


code:
#!/bin/bash
[% c("var/set_default_env") -%]
distdir=/var/tmp/dist/[% project %]
mkdir -p $distdir
tar -C /var/tmp/dist -xf [% c('input_files_by_name/cmake') %]
export PATH="/var/tmp/dist/cmake/bin:$PATH"
tar -C /var/tmp/dist -xf [% c('input_files_by_name/ninja') %]
export PATH=/var/tmp/dist/ninja:$PATH
tar -C /var/tmp/dist -xf [% c('input_files_by_name/previous_rust') %]
cd /var/tmp/dist/rust-[% c('var/previous_version') %]-x86_64-unknown-linux-gnu
./install.sh --prefix=$distdir-rust-old
export PATH="$distdir-rust-old/bin:$PATH"

[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %]
[% IF c("var/linux") -%]
  [% pc('python', 'var/setup', { python_tarfile => c('input_files_by_name/python') }) %]
[% END -%]

[% IF c("var/osx") %]
  # We need to clear `CC` and `LDFLAGS` as they are used for the host platform
  # (i.e. Linux).
  unset CC
  unset LDFLAGS

  mkdir $distdir/helper
  # We need to adapt our CFLAGS and make sure our flags are passed down to all
  # dependencies. Using `CFLAGS_x86_apple-darwin` did not do the trick, so resort
  # to a wrapper script.
  cat > $distdir/helper/x86_64-apple-darwin-clang << 'EOF'
#!/bin/sh
BASEDIR=/var/tmp/dist/macosx-toolchain
$BASEDIR/cctools/bin/x86_64-apple-darwin-clang -target x86_64-apple-darwin -B $BASEDIR/cctools/bin -isysroot $sysrootdir -Wl,-syslibroot,$sysrootdir -Wl,-dead_strip -Wl,-pie "$@"
EOF

  chmod +x $distdir/helper/x86_64-apple-darwin-clang
  export PATH=$distdir/helper:$PATH
[% END %]

cd $rootdir
mkdir /var/tmp/build
tar -C /var/tmp/build -xf  [% c('input_files_by_name/rust') %]
cd /var/tmp/build/rustc-[% c('version') %]-src

[% IF ! c("var/android") -%]
  # Patches for fixing:
  #  https://github.com/rust-lang/rust/issues/86436
  #  https://github.com/rust-lang/rust/pull/86568
  #  https://github.com/rust-lang/rust/issues/86999
  # This can be removed when updating to >= 1.54.0.
  patch -p1 < $rootdir/fix-build-1.53.0.patch
[% END -%]

mkdir build
cd build
../configure --prefix=$distdir --disable-docs --disable-compiler-docs [% c("var/configure_opt") %]

make -j[% c("num_procs") %]
make install
cd /var/tmp/dist
[% c('tar', {
        tar_src => [ project ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
        }) %]

path: projects/rust/build


code:
# vim: filetype=yaml sw=2
filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz'
version: '[% c("var/current_version") %]'
container:
  use_container: 1

var:
  current_version: 1.53.0
  previous_version: 1.52.0

targets:
  android:
    var:
      current_version: 1.59.0
      previous_version: 1.58.1
      arch_deps:
        - libssl-dev
        - pkg-config
        - zlib1g-dev
      configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --target=x86_64-unknown-linux-gnu,armv7-linux-androideabi,thumbv7neon-linux-androideabi,aarch64-linux-android,i686-linux-android,x86_64-linux-android --set=target.armv7-linux-androideabi.cc=armv7a-linux-androideabi16-clang --set=target.armv7-linux-androideabi.ar=armv7a-linux-androideabi-ar --set=target.thumbv7neon-linux-androideabi.cc=armv7a-linux-androideabi16-clang --set=target.thumbv7neon-linux-androideabi.ar=armv7a-linux-androideabi-ar --set=target.aarch64-linux-android.cc=aarch64-linux-android21-clang --set=target.aarch64-linux-android.ar=aarch64-linux-android-ar --set=target.i686-linux-android.cc=i686-linux-android16-clang --set=target.i686-linux-android.ar=i686-linux-android-ar --set=target.x86_64-linux-android.cc=x86_64-linux-android21-clang --set=target.x86_64-linux-android.ar=x86_64-linux-android-ar

  linux:
    var:
      deps:
        - libc6-dev-i386
        - lib32stdc++6
        - build-essential
        - python
        - automake
        - libssl-dev
        - pkg-config
        - hardening-wrapper
      # We use
      # `--enable-local-rust` to avoid downloading the required compiler during
      # build time
      #
      # `--enable-vendor` to avoid downloading crates during build time and just
      # use the ones which are shipped with the source
      #
      # `--enable-extended` to build not only rustc but cargo as well
      #
      # `--enable-llvm-static-stdcpp` to take a libstdc++ on Jessie into account
      # which is too old and if used gives undefined reference errors
      #
      # `--release-channel=stable` to just include stable features in the
      # compiler
      #
      # `--sysconfdir=etc` to avoid install failures as |make install| wants to
      # write to /etc otherwise
      #
      # the `target` triple to explicitly specify the architecture and platform
      # for the compiler/std lib. Ideally, it should not be needed unless one is
      # cross-compiling, but compiling `alloc_jemalloc` fails without that in a
      # 32bit container. "--host=x86_64-unknown-linux-gnu" is used in its
      # configure script in this case.
      # `--set=` to explicitly specify the C compiler. We need to compile the
      # bundled LLVM and it wants to use `cc`. However, we don't have that in
      # our compiled GCC resulting in weird errors due to C and C++ compiler
      # version mismatch. We avoid that with this configure option.
      configure_opt: --enable-local-rust --enable-vendor --enable-extended --enable-llvm-static-stdcpp --release-channel=stable --sysconfdir=etc --target=x86_64-unknown-linux-gnu,i686-unknown-linux-gnu --set=target.x86_64-unknown-linux-gnu.cc=gcc --set=target.i686-unknown-linux-gnu.cc=gcc

  osx-x86_64:
    var:
      arch_deps:
        - libssl-dev
        - pkg-config
        - zlib1g-dev
      configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --target=x86_64-unknown-linux-gnu,x86_64-apple-darwin --set=target.x86_64-apple-darwin.cc=x86_64-apple-darwin-clang

  windows:
    var:
      arch_deps:
        - libssl-dev
        - pkg-config
        - zlib1g-dev
      configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --target=x86_64-unknown-linux-gnu,[% c("arch") %]-pc-windows-gnu

input_files:
  - project: container-image
  - project: cmake
    name: cmake
  - project: ninja
    name: ninja
  - project: '[% c("var/compiler") %]'
    name: '[% c("var/compiler") %]'
  - URL: 'https://static.rust-lang.org/dist/rustc-[% c("var/current_version") %]-src.tar.gz'
    name: rust
    sig_ext: asc
    file_gpg_id: 1
    gpg_keyring: rust.gpg
  - URL: 'https://static.rust-lang.org/dist/rust-[% c("var/previous_version") %]-x86_64-unknown-linux-gnu.tar.xz'
    name: previous_rust
    sig_ext: asc
    file_gpg_id: 1
    gpg_keyring: rust.gpg
  - project: python
    name: python
    enable: '[% c("var/linux") %]'

    # Fix for https://github.com/rust-lang/rust/issues/86436
    # Taken from https://github.com/rust-lang/rust/pull/86568 (merged it 1.54.0)
  - filename: fix-build-1.53.0.patch
    enable: '[% ! c("var/android") %]'

path: projects/rust/config


code:
commit 601d24810e89efd42f7cd69d4a7ccecd4e35364d
Author: Eric Huss <eric@huss.org>
Date:   Tue Jun 22 22:10:25 2021 -0700

    Don't dist miri on stable or beta.

diff --git a/src/bootstrap/dist.rs b/src/bootstrap/dist.rs
index 71ed0af4a7c..e0c33f73577 100644
--- a/src/bootstrap/dist.rs
+++ b/src/bootstrap/dist.rs
@@ -1171,6 +1171,9 @@ impl Step for Miri {
     }

     fn run(self, builder: &Builder<'_>) -> Option<GeneratedTarball> {
+        if !builder.build.unstable_features() {
+            return None;
+        }
         let compiler = self.compiler;
         let target = self.target;
         assert!(builder.config.extended);

commit 6aa79a34d87252deaae11e75663e5740a22f14ea
Author: Eric Huss <eric@huss.org>
Date:   Wed Jun 23 07:03:42 2021 -0700

    Comment and include rust-analyzer.

diff --git a/src/bootstrap/dist.rs b/src/bootstrap/dist.rs
index e0c33f73577..19895baf08f 100644
--- a/src/bootstrap/dist.rs
+++ b/src/bootstrap/dist.rs
@@ -1072,6 +1072,12 @@ impl Step for RustAnalyzer {
     }

     fn run(self, builder: &Builder<'_>) -> Option<GeneratedTarball> {
+        // This prevents rust-analyzer from being built for "dist" or "install"
+        // on the stable/beta channels. It is a nightly-only tool and should
+        // not be included.
+        if !builder.build.unstable_features() {
+            return None;
+        }
         let compiler = self.compiler;
         let target = self.target;
         assert!(builder.config.extended);
@@ -1171,6 +1177,9 @@ impl Step for Miri {
     }

     fn run(self, builder: &Builder<'_>) -> Option<GeneratedTarball> {
+        // This prevents miri from being built for "dist" or "install"
+        // on the stable/beta channels. It is a nightly-only tool and should
+        // not be included.
         if !builder.build.unstable_features() {
             return None;
         }

   Disable rust-analyzer

diff --git a/src/bootstrap/builder.rs b/src/bootstrap/builder.rs
index cff1ec843ff..3767b0387a0 100644
--- a/src/bootstrap/builder.rs
+++ b/src/bootstrap/builder.rs
@@ -482,7 +482,6 @@ impl<'a> Builder<'a> {
                 install::Std,
                 install::Cargo,
                 install::Rls,
-                install::RustAnalyzer,
                 install::Rustfmt,
                 install::RustDemangler,
                 install::Clippy,
diff --git a/src/bootstrap/install.rs b/src/bootstrap/install.rs
index 13ee909afd5..a38fc9e95eb 100644
--- a/src/bootstrap/install.rs
+++ b/src/bootstrap/install.rs
@@ -164,12 +164,6 @@ install!((self, builder, _config),
             );
         }
     };
-    RustAnalyzer, "rust-analyzer", Self::should_build(_config), only_hosts: true, {
-        let tarball = builder
-            .ensure(dist::RustAnalyzer { compiler: self.compiler, target: self.target })
-            .expect("missing rust-analyzer");
-        install_sh(builder, "rust-analyzer", self.compiler.stage, Some(self.target), &tarball);
-    };
     Clippy, "clippy", Self::should_build(_config), only_hosts: true, {
         let tarball = builder.ensure(dist::Clippy { compiler: self.compiler, target: self.target });
         install_sh(builder, "clippy", self.compiler.stage, Some(self.target), &tarball);


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/dchest/siphash.git
git_hash: 34f201214d993633bb24f418ba11736ab8b55aa7
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/dchest/siphash

input_files:
  - project: container-image
  - name: go
    project: go

path: projects/siphash/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]

tar xvf [% project %]-[% c('version') %].tar.gz

mkdir -p /var/tmp/dist/
cd /var/tmp/dist/

cp -a $rootdir/[% project %]*/[% project %].py ./[% project %].py

[% c('tar', {
        tar_src => '.',
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
        }) %]

path: projects/six/build


code:
# vim: filetype=yaml sw=2
version: 1.12.0
git_url: https://github.com/benjaminp/six.git
git_hash: d927b9e27617abca8dbf4d66cc9265ebbde261d6
# TODO: This Git repo doesn't use GPG sigs.  We should pester them about that.
filename: "[% project %]-[% c('version') %]-[% c('var/build_id') %].tar.gz"
container:
  use_container: 1
input_files:
  - project: container-image

path: projects/six/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/xtaci/smux
git_hash: c6969d8a76874342611f4b544d05b1590f1a76b1 # v1.5.12
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: github.com/xtaci/smux

input_files:
  - project: container-image
  - name: go
    project: go

path: projects/smux/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]
[% pc('go', 'var/setup', { go_tarfile => c('input_files_by_name/go') }) %]
distdir=/var/tmp/dist/[% project %]
[% c("var/set_PTDIR_DOCSDIR") -%]
mkdir -p $PTDIR $DOCSDIR

[% IF c("var/android") -%]
  [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %]
  # We need to explicitly set CGO_ENABLED with Go 1.13.x as the Android build
  # breaks otherwise.
  export CGO_ENABLED=1
[% END -%]

tar -C /var/tmp/dist -xf [% c('input_files_by_name/goxtext') %]
tar -C /var/tmp/dist -xf [% c('input_files_by_name/goptlib') %]
tar -C /var/tmp/dist -xf [% c('input_files_by_name/pion-webrtc') %]
tar -C /var/tmp/dist -xf [% c('input_files_by_name/kcp-go') %]
tar -C /var/tmp/dist -xf [% c('input_files_by_name/smux') %]

mkdir -p /var/tmp/build
tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz
cd /var/tmp/build/[% project %]-[% c('version') %]

mkdir -p "$GOPATH/src/git.torproject.org/pluggable-transports/snowflake.git"
ln -sf "$PWD" "$GOPATH/src/git.torproject.org/pluggable-transports/snowflake.git/v2"
# Fix gopath location of versioned dependencies
ln -sf "$GOPATH/src/github.com/pion/webrtc" "$GOPATH/src/github.com/pion/webrtc/v2"
ln -sf "$GOPATH/src/github.com/pion/sdp" "$GOPATH/src/github.com/pion/sdp/v2"
ln -sf "$GOPATH/src/github.com/xtaci/kcp-go" "$GOPATH/src/github.com/xtaci/kcp-go/v5"

cd client
go build -ldflags '-s'
cp -a client[% IF c("var/windows") %].exe[% END %] $PTDIR/snowflake-client[% IF c("var/windows") %].exe[% END %]

cd ..
cp -a README.md $DOCSDIR

cd $distdir
[% c('tar', {
        tar_src => [ '.' ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
    }) %]

path: projects/snowflake/build