debian/README

+riseup-vpn
+-----------
+
+Initial debianization of bitmask-vpn repo. This is a native package for
+riseup-vpn, branded clients will use a template based on that one.
+
+ -- kali kaneko <kali@leap.se>  Tue, 09 Feb 2021 20:26:52 +0100

debian/README.Debian

+riseup-vpn for Debian
+--------------------
+
+<possible notes regarding this package - if none, delete this file>
+
+ -- Kali Kaneko <kali@leap.se>  Tue, 09 Feb 2021 20:26:52 +0100

debian/changelog

+riseup-vpn (0.21.11) hirsute; urgency=medium
+
+  * Release 0.21.11
+
+ -- Kali Kaneko (leap communications) <kali@leap.se>  Tue, 22 Jun 2021 18:26:53 +0200
+
+riseup-vpn (0.21.2.6) groovy; urgency=medium
+
+  * Initial Release.
+
+ -- kali kaneko (leap communications) <kali@leap.se>  Tue, 09 Feb 2021 20:26:52 +0100

debian/control

+Source: riseup-vpn
+Section: net
+Priority: extra
+Maintainer: LEAP Encryption Access Project <debian@leap.se>
+Build-Depends: debhelper-compat (= 12), golang-go (>= 2:1.9), make (>=3.80), pkg-config, g++ (>= 4:4.6.3), git,
+        qt5-qmake, qttools5-dev-tools, qtbase5-dev, libqt5qml5, libqt5quick5, qtdeclarative5-dev
+Standards-Version: 4.4.1
+Homepage: https://0xacab.org/leap/bitmask-vpn
+#Vcs-Browser: https://0xacab.org/leap/bitmask-vpn
+#Vcs-Git: https://0xacab.org/leap/bitmask-vpn.git
+
+Package: riseup-vpn
+Architecture: any
+Enhances: openvpn
+Depends: ${misc:Depends}, libqt5core5a, libqt5gui5 | libqt5gui5-gles,
+        libqt5qml5, libqt5widgets5, libstdc++6,
+        qml-module-qtquick2, qml-module-qtquick-controls2, qml-module-qtquick-dialogs,
+        qml-module-qtquick-extras, qml-module-qt-labs-platform,
+        openvpn, policykit-1-gnome | polkit-1-auth-agent, python3, iptables
+Description: Easy, fast, and secure VPN service from riseup.net.
+ .
+ The service does not require a user account, keep logs, or track you in any
+ way. The service is paid for entirely by donations from users.

debian/copyright

+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: riseup-vpn
+Upstream-Contact: <preferred name and address to reach the upstream project>
+Source: <url://example.com>
+
+Files: *
+Copyright: <years> <put author's name and email here>
+           <years> <likewise for another author>
+License: GPL-3.0+
+
+Files: debian/*
+Copyright: 2021 Kali Kaneko <kali@leap.se>
+License: GPL-3.0+
+
+License: GPL-3.0+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+ .
+ This package is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
+ .
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <https://www.gnu.org/licenses/>.
+ .
+ On Debian systems, the complete text of the GNU General
+ Public License version 3 can be found in "/usr/share/common-licenses/GPL-3".
+
+# Please also look if there are files or directories which have a
+# different copyright/license attached and list them here.
+# Please avoid picking licenses with terms that are more restrictive than the
+# packaged work, as it may make Debian's contributions unacceptable upstream.
+#
+# If you need, there are some extra license texts available in two places:
+#   /usr/share/debhelper/dh_make/licenses/
+#   /usr/share/common-licenses/

debian/rules

+#!/usr/bin/make -f
+export DH_VERBOSE = 1
+export VERBOSE = 1
+
+export DH_OPTIONS
+export GO111MODULE=on
+export GOCACHE=/tmp/gocache
+
+export DH_GOPKG = 0xacab.org/leap/bitmask-vpn
+
+export APPNAME = riseup-vpn
+
+ifeq ($(DEB_HOST_ARCH), i386)
+        export GOARCH := 386
+else ifeq ($(DEB_HOST_ARCH), amd64)
+        export GOARCH := amd64
+else ifeq ($(DEB_HOST_ARCH), armhf)
+        export GOARCH := arm
+else ifeq ($(DEB_HOST_ARCH), arm64)
+        export GOARCH := arm64
+endif
+
+
+# see FEATURE AREAS in dpkg-buildflags(1)
+#export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+
+# see ENVIRONMENT in dpkg-buildflags(1)
+# package maintainers to append CFLAGS
+#export DEB_CFLAGS_MAINT_APPEND  = -Wall -pedantic
+# package maintainers to append LDFLAGS
+#export DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed
+
+%:
+	dh $@
+
+override_dh_auto_test:
+	#FIXME tests try to contact riseup api, need to be mocked
+	#make -j4 test
+
+override_dh_auto_build:
+	make build
+
+override_dh_install:
+	mkdir -p $(CURDIR)/debian/${APPNAME}/usr/bin
+	mkdir -p $(CURDIR)/debian/${APPNAME}/usr/sbin
+	cp $(CURDIR)/helpers/bitmask-root $(CURDIR)/debian/${APPNAME}/usr/sbin/
+	mkdir -p $(CURDIR)/debian/${APPNAME}/usr/share/polkit-1/actions
+	cp $(CURDIR)/helpers/se.leap.bitmask.policy $(CURDIR)/debian/${APPNAME}/usr/share/polkit-1/actions
+	cp build/qt/release/${APPNAME} $(CURDIR)/debian/${APPNAME}/usr/bin/${APPNAME}
+	strip $(CURDIR)/debian/${APPNAME}/usr/bin/${APPNAME}
+	dh_install
+
+override_dh_dwz:
+	echo "skipping dh_dwz"

debian/source/format

+3.0 (native)

debian/source/options

+tar-ignore=".git/*"
+tar-ignore="staging_dir/*"
+tar-ignore="build/*"
+tar-ignore="deploy/*"
+tar-ignore="\.*"
+tar-ignore="cmd/*"

docker/0001-build-fix-build-on-ubuntu-23.04-with-qt6.4.patch

+From 82e3eda5709f1f8dd6bdb898a3c6b71a41cc4e62 Mon Sep 17 00:00:00 2001
+From: jkito <belter@riseup.net>
+Date: Sun, 25 Aug 2024 17:18:10 +0530
+Subject: [PATCH] build: use qt5compat qml module to build on qt6.4 for ubuntu
+ and debian
+
+---
+ bitmask.pro                    |  2 +-
+ gui/components/ErrorBox.qml    |  2 +-
+ gui/components/Footer.qml      | 14 ++++++--------
+ gui/components/Home.qml        |  2 +-
+ gui/components/InitErrors.qml  |  2 +-
+ gui/components/Locations.qml   |  7 +++----
+ gui/components/MotdBox.qml     |  2 +-
+ gui/components/Preferences.qml |  4 ++--
+ gui/components/SignalIcon.qml  |  7 +++----
+ gui/components/Splash.qml      |  2 +-
+ gui/components/StatusBox.qml   |  2 +-
+ 11 files changed, 21 insertions(+), 25 deletions(-)
+
+diff --git a/bitmask.pro b/bitmask.pro
+index bbeacb12..58ba5f2f 100644
+--- a/bitmask.pro
++++ b/bitmask.pro
+@@ -1,8 +1,8 @@
+ TARGET = $$TARGET
+ 
+ QT += quickcontrols2 svg
+-CONFIG += qt staticlib
+ CONFIG += c++17 strict_c++
++CONFIG += qt staticlib core5compat
+ CONFIG += qtquickcompiler
+ 
+ RELEASE = $$RELEASE
+diff --git a/gui/components/ErrorBox.qml b/gui/components/ErrorBox.qml
+index 5667ed9d..ef8f58fb 100644
+--- a/gui/components/ErrorBox.qml
++++ b/gui/components/ErrorBox.qml
+@@ -1,6 +1,6 @@
+ import QtQuick
+ import QtQuick.Controls
+-import QtQuick.Effects
++import Qt5Compat.GraphicalEffects
+ import "../themes/themes.js" as Theme
+ 
+ Item {
+diff --git a/gui/components/Footer.qml b/gui/components/Footer.qml
+index d534f96a..9df6db62 100644
+--- a/gui/components/Footer.qml
++++ b/gui/components/Footer.qml
+@@ -2,7 +2,7 @@ import QtQuick
+ import QtQuick.Controls
+ import QtQuick.Controls.Material
+ import QtQuick.Layouts
+-import QtQuick.Effects
++import Qt5Compat.GraphicalEffects
+ import "../themes/themes.js" as Theme
+ 
+ ToolBar {
+@@ -49,7 +49,7 @@ ToolBar {
+         }
+ 
+         Image {
+-            id: lightning
++            id: lightning 
+             smooth: true
+             visible: ctx != undefined & root.selectedGateway == "auto"
+             width: 16
+@@ -61,11 +61,10 @@ ToolBar {
+                 verticalCenter: gwButton.verticalCenter
+             }
+         }
+-        MultiEffect {
++        ColorOverlay{
+             anchors.fill: lightning
+             source: lightning
+-            colorizationColor: getLocationColor()
+-            colorization: 1.0
++            color: getLocationColor()
+             antialiasing: true
+         }
+ 
+@@ -123,11 +122,10 @@ ToolBar {
+                 rightMargin: 20
+             }
+         }
+-        MultiEffect {
++        ColorOverlay{
+             anchors.fill: gwQuality
+             source: gwQuality
+-            colorizationColor: getSignalColor()
+-            colorization: 1.0
++            color: getSignalColor()
+             antialiasing: false
+         }
+     }
+diff --git a/gui/components/Home.qml b/gui/components/Home.qml
+index f3bea85a..7830f46d 100644
+--- a/gui/components/Home.qml
++++ b/gui/components/Home.qml
+@@ -1,6 +1,6 @@
+ import QtQuick
+ import QtQuick.Controls
+-import QtQuick.Effects
++import Qt5Compat.GraphicalEffects
+ 
+ Page {
+     StatusBox {
+diff --git a/gui/components/InitErrors.qml b/gui/components/InitErrors.qml
+index aaf9897b..10b4755c 100644
+--- a/gui/components/InitErrors.qml
++++ b/gui/components/InitErrors.qml
+@@ -1,6 +1,6 @@
+ import QtQuick
+ import QtQuick.Controls
+-import QtQuick.Effects
++import Qt5Compat.GraphicalEffects
+ 
+ ErrorBox {
+ 
+diff --git a/gui/components/Locations.qml b/gui/components/Locations.qml
+index 2a188738..6228a58c 100644
+--- a/gui/components/Locations.qml
++++ b/gui/components/Locations.qml
+@@ -1,7 +1,7 @@
+ import QtQuick
+ import QtQuick.Controls
+ import QtQuick.Layouts
+-import QtQuick.Effects
++import Qt5Compat.GraphicalEffects
+ 
+ import "../themes/themes.js" as Theme
+ 
+@@ -81,11 +81,10 @@ ThemedPage {
+                         //verticalCenterOffset: 3
+                     }
+                 }
+-                MultiEffect {
++                ColorOverlay{
+                     anchors.fill: lightning
+                     source: lightning
+-                    colorizationColor: "black"
+-                    colorization: 1.0
++                    color: "black"
+                     antialiasing: true
+                 }
+             }
+diff --git a/gui/components/MotdBox.qml b/gui/components/MotdBox.qml
+index 2c8cdb8b..7b851c0c 100644
+--- a/gui/components/MotdBox.qml
++++ b/gui/components/MotdBox.qml
+@@ -1,6 +1,6 @@
+ import QtQuick
+ import QtQuick.Controls
+-import QtQuick.Effects
++import Qt5Compat.GraphicalEffects
+ import "../themes/themes.js" as Theme
+ 
+ Item {
+diff --git a/gui/components/Preferences.qml b/gui/components/Preferences.qml
+index d8ed6587..a0b6bba6 100644
+--- a/gui/components/Preferences.qml
++++ b/gui/components/Preferences.qml
+@@ -2,8 +2,8 @@ import QtQuick
+ import QtQuick.Controls
+ import QtQuick.Layouts
+ import QtQuick.Controls.Material
+-import QtQuick.Effects
+-import QtCore
++import Qt5Compat.GraphicalEffects
++import Qt.labs.settings
+ 
+ import "../themes/themes.js" as Theme
+ 
+diff --git a/gui/components/SignalIcon.qml b/gui/components/SignalIcon.qml
+index 8747f054..38a23710 100644
+--- a/gui/components/SignalIcon.qml
++++ b/gui/components/SignalIcon.qml
+@@ -1,7 +1,7 @@
+ import QtQuick
+ import QtQuick.Controls
+ import QtQuick.Layouts
+-import QtQuick.Effects
++import Qt5Compat.GraphicalEffects
+ 
+ import "../themes/themes.js" as Theme
+ 
+@@ -41,11 +41,10 @@ Item {
+             ]
+         }
+     }
+-    MultiEffect {
++    ColorOverlay{
+         anchors.fill: icon
+         source: icon
+-        colorizationColor: getQualityColor()
+-        colorization: 1.0
++        color: getQualityColor()
+         antialiasing: true
+     }
+ 
+diff --git a/gui/components/Splash.qml b/gui/components/Splash.qml
+index c9351804..d18cc3ba 100644
+--- a/gui/components/Splash.qml
++++ b/gui/components/Splash.qml
+@@ -1,6 +1,6 @@
+ import QtQuick
+ import QtQuick.Controls
+-import QtQuick.Effects
++import Qt5Compat.GraphicalEffects
+ import "../themes/themes.js" as Theme
+ 
+ Page {
+diff --git a/gui/components/StatusBox.qml b/gui/components/StatusBox.qml
+index d17c2fe0..24a1f8f2 100644
+--- a/gui/components/StatusBox.qml
++++ b/gui/components/StatusBox.qml
+@@ -1,6 +1,6 @@
+ import QtQuick
+ import QtQuick.Controls
+-import QtQuick.Effects
++import Qt5Compat.GraphicalEffects
+ import QtQuick.Layouts
+ import QtQuick.Templates as T
+ import QtQuick.Controls.impl
+-- 
+2.46.0
+

docker/Dockerfile

-# An image to build and package the Bitmask Lite (RiseupVPN and other branded builds)
-# (c) LEAP Encryption Access Project 2018-2019
+# An image to build and package the BitmaskVPN (RiseupVPN and other branded builds)
+# (c) LEAP Encryption Access Project 2018-2021
 
-# we start with 18.04 (bionic) to match the core18 used in the snap
-# but we will have to install a couple of extras on top...
-FROM ubuntu:20.04 as builder
+FROM ubuntu:24.04 as builder
 
 MAINTAINER LEAP Encryption Access Project <info@leap.se>
+ARG GO_VERSION=1.22
 LABEL Description="An image to build Bitmask Lite" Vendor="LEAP" Version="1.2"
 ENV OSXSDK_SHA256="631b4144c6bf75bf7a4d480d685a9b5bda10ee8d03dbf0db829391e2ef858789" \
-    PATH="$PATH:/osxcross/target/bin:/usr/lib/go-1.14/bin"
+    PATH="$PATH:/osxcross/target/bin:/usr/lib/go-${GO_VERSION}/bin" \
+    QMAKE=qmake6
 
 ARG DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get upgrade --yes && \
@@ -18,7 +18,7 @@ RUN apt-get update && apt-get upgrade --yes && \
             git curl wget \
             libappindicator3-dev libgtk-3-dev \
             webkit2gtk-4.0 \
-            mingw-w64 upx-ucl python snapd \
+            mingw-w64 upx-ucl python3 snapd \
             unzip sudo locales \
             devscripts fakeroot debhelper \
             clang llvm-dev libxml2-dev uuid-dev \
@@ -26,60 +26,58 @@ RUN apt-get update && apt-get upgrade --yes && \
             xz-utils bzip2 gzip sed cpio libbz2-dev \
             software-properties-common dh-golang \
             jq \
-            squashfs-tools \
-            qtbase5-dev qttools5-dev-tools qt5-qmake g++ qtdeclarative5-dev qt5-default \
-            golang-1.14-go golang-go golang-golang-x-tools-dev && \
+            squashfs-tools libgl-dev \
+            qml-module-qtquick-controls2 libqt6qml6 libqt6svg6-dev qt6-l10n-tools \
+            qt6-tools-dev qt6-tools-dev-tools qt6-base-dev qt6-base-dev-tools \
+            qt6-declarative-dev qt6-declarative-dev-tools \
+            qml6-module-qt5compat-graphicaleffects libqt6core5compat6 libqt6core5compat6-dev \
+            golang golang-${GO_VERSION}-go golang-golang-x-tools-dev && \
     rm -r /var/lib/apt/lists/*
 
+RUN ln -s $(qmake6 -query "QT_INSTALL_BINS")/lrelease /usr/local/bin/lrelease
+
 # osx cross compiling
-RUN git clone https://github.com/tpoechtrager/osxcross && \
-    cd osxcross/tarballs && \
-    wget https://s3.dockerproject.org/darwin/v2/MacOSX10.10.sdk.tar.xz && \
-    echo "${OSXSDK_SHA256} *MacOSX10.10.sdk.tar.xz" | sha256sum -c - && \
-    cd .. && UNATTENDED=1 ./build.sh && \
-    ln -s /osxcross/target/SDK/MacOSX10.10.sdk/usr/include/objc/NSObjCRuntime.h /osxcross/target/SDK/MacOSX10.10.sdk/usr/include/objc/NSObjcRuntime.h
+#RUN git clone https://github.com/tpoechtrager/osxcross && \
+#    cd osxcross/tarballs && \
+#    wget https://s3.dockerproject.org/darwin/v2/MacOSX10.10.sdk.tar.xz && \
+#    echo "${OSXSDK_SHA256} *MacOSX10.10.sdk.tar.xz" | sha256sum -c - && \
+#    cd .. && UNATTENDED=1 ./build.sh && \
+#    ln -s /osxcross/target/SDK/MacOSX10.10.sdk/usr/include/objc/NSObjCRuntime.h /osxcross/target/SDK/MacOSX10.10.sdk/usr/include/objc/NSObjcRuntime.h
 
 # bomutils (for osx packaging)
-RUN git clone https://github.com/hogliux/bomutils && \
-    cd bomutils && make && sudo make install
+#RUN git clone https://github.com/hogliux/bomutils && \
+#    cd bomutils && make && sudo make install
 
 # xar (for osx packaging)
-RUN git clone https://github.com/VantaInc/xar && \
-    cd xar/xar && \
-    ./autogen.sh && ./configure && \
-    make && sudo make install
+#RUN git clone https://github.com/VantaInc/xar && \
+#    cd xar/xar && \
+#    ./autogen.sh && ./configure && \
+#    make && sudo make install
 
 # Grab the core18 and core20 snap (which snapcraft uses as a base) from the stable channel
 # and unpack it in the proper place, to speed up snapcraft builds in the containers.
-RUN curl -L $(curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/core18' | jq '.download_url' -r) --output core18.snap
-RUN mkdir -p /snap/core18
-RUN unsquashfs -d /snap/core18/current core18.snap
-RUN curl -L $(curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/core20' | jq '.download_url' -r) --output core20.snap
-RUN mkdir -p /snap/core20
-RUN unsquashfs -d /snap/core20/current core20.snap
+# RUN curl -L $(curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/core18' | jq '.download_url' -r) --output core18.snap
+# RUN mkdir -p /snap/core18
+# RUN unsquashfs -d /snap/core18/current core18.snap
+# RUN curl -L $(curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/core20' | jq '.download_url' -r) --output core20.snap
+# RUN mkdir -p /snap/core20
+# RUN unsquashfs -d /snap/core20/current core20.snap
 
 # Grab the snapcraft snap from the stable channel and unpack it in the proper
 # place.
-RUN curl -L $(curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/snapcraft?channel=stable' | jq '.download_url' -r) --output snapcraft.snap
-RUN mkdir -p /snap/snapcraft
-RUN unsquashfs -d /snap/snapcraft/current snapcraft.snap
+# RUN curl -L $(curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/snapcraft?channel=stable' | jq '.download_url' -r) --output snapcraft.snap
+# RUN mkdir -p /snap/snapcraft
+# RUN unsquashfs -d /snap/snapcraft/current snapcraft.snap
 
 
 # Create a snapcraft runner (TODO: move version detection to the core of
 # snapcraft).
-RUN mkdir -p /snap/bin
-RUN echo "#!/bin/sh" > /snap/bin/snapcraft
-RUN snap_version="$(awk '/^version:/{print $2}' /snap/snapcraft/current/meta/snap.yaml)" && echo "export SNAP_VERSION=\"$snap_version\"" >> /snap/bin/snapcraft
-RUN echo 'exec "$SNAP/usr/bin/python3" "$SNAP/bin/snapcraft" "$@"' >> /snap/bin/snapcraft
-RUN chmod +x /snap/bin/snapcraft
-RUN ln -s /snap/bin/snapcraft /bin/
-
-# cache go modules
-RUN rm -rf /gomods && mkdir -p /gomods/packages
-WORKDIR /gomods
-COPY mods/go.* /gomods/
-COPY mods/packages/ /gomods/packages/
-RUN go mod download
+# RUN mkdir -p /snap/bin
+# RUN echo "#!/bin/sh" > /snap/bin/snapcraft
+# RUN snap_version="$(awk '/^version:/{print $2}' /snap/snapcraft/current/meta/snap.yaml)" && echo "export SNAP_VERSION=\"$snap_version\"" >> /snap/bin/snapcraft
+# RUN echo 'exec "$SNAP/usr/bin/python3" "$SNAP/bin/snapcraft" "$@"' >> /snap/bin/snapcraft
+# RUN chmod +x /snap/bin/snapcraft
+# RUN ln -s /snap/bin/snapcraft /bin/
 
 COPY builder.sh /
 

docker/builder.sh

@@ -6,7 +6,7 @@ export DESTDIR="${HOSTDIR}"/deploy/
 rm -rf "${GUESTDIR}"
 cp -r "${HOSTDIR}" "${GUESTDIR}"
 cd "${GUESTDIR}"
-make prepare
+make vendor
 case $TYPE in
     snap)
         echo "[+] Building SNAP"

docs/Makefile

-# Minimal makefile for Sphinx documentation
-#
-
-# You can set these variables from the command line.
-SPHINXOPTS    =
-SPHINXBUILD   = sphinx-build
-SOURCEDIR     = .
-BUILDDIR      = _build
-
-# Put it first so that "make" without argument is like "make help".
-help:
-	@$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
-
-.PHONY: help Makefile
-
-# Catch-all target: route all unknown targets to Sphinx using the new
-# "make mode" option.  $(O) is meant as a shortcut for $(SPHINXOPTS).
-%: Makefile
-	@$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
\ No newline at end of file

docs/build-osx.rst

+osx build
+=============
+
+Cheat-sheet
+------------------
+
+tl;dr:
+
+.. code:: bash
+
+  export RELEASE=yes
+  export OSXAPPPASS=my-apple-app-pass
+  make clean && make vendor && make build
+  make installer
+  make sign_installer
+  make notarize_installer
+  make notarize_staple
+  make create_dmg
+
+Pre-requisites
+-------------------
+
+* You will need a full Xcode installation (cli tools that homebrew install are not enough).
+* Manually Install the Qt Installer Framework and place it in your path https://download.qt.io/official_releases/qt-installer-framework/4.0.1/
+* git, make, gpg, golang, qt5. You can get them all with homebrew by doing:
+
+.. code::bash
+
+  make depends
+
+Sign the release
+-------------------
+
+In recent osx releases, it's not ok to just sign the installers anymore. You
+have to sign and then notarize with their service. here are some notes that use
+ad-hoc targets in the main makefile, but we should keep an eye on any future
+integration of this process in the more or less official Qt tools (QTIFW).
+
+First, we build the regular installer (use RELEASE=yes to do a codesign step
+with macqtdeploy, note that this increases build time considerably):
+
+.. code:: bash
+
+  make build
+  RELEASE=yes make installer
+  make sign_installer
+
+Now we export the app-specific password and we proceed to notarization. If you
+don't know what is this pass, you can create one in your Apple developer
+account. Contact their friendly support for more info, but don't expect they
+understand you do not really own any Apple Hardware. Sense of humor is not
+universal.
+
+Security -> App-specific passwords -> Generate
+If you need to revoke these tokens, click on 'view history'.
+
+https://appleid.apple.com/account/manage
+
+According to https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow:
+
+To avoid including your password as cleartext in a script, you can provide a
+reference to a keychain item, as shown in the previous example. This assumes
+the keychain holds a keychain item named AC_PASSWORD with an account value
+matching the username AC_USERNAME.
+
+.. code:: bash
+
+  export OSXAPPPASS=my-apple-app-pass
+  make notarize_installer
+
+Between the output of the last command, you will get a Request UUID. You should pass that request uid in the appropriate 
+environment variable to check the status of the notarization process. Obviously, since the recent changes in Apple policies,
+you need to be in posession of a valid membership
+
+.. code:: bash
+
+  altool[5281:91963] No errors uploading 'build/installer/RiseupVPN-installer-0.20.4-175-gee4eb90.zip'.
+  RequestUUID = fe9a4324-bdcb-4c52-b857-f089dc904695
+  
+  OSXMORDORUID=fe9a4324-bdcb-4c52-b857-f089dc904695 make notarize_check
+  xcrun altool --notarization-info fe9a4324-bdcb-4c52-b857-f089dc904695 -u "info@leap.se" -p my-apple-app-pass
+  2020-12-11 22:21:59.940 altool[5787:96428] No errors getting notarization info.
+  
+     RequestUUID: fe9a4324-bdcb-4c52-b857-f089dc904695
+            Date: 2020-12-11 21:13:10 +0000
+          Status: success
+      LogFileURL: https://osxapps-ssl.itunes.apple.com/itunes-assets/Enigma114/v4/0f/c9/1e/0fc91e64-2c9f-74e5-3cf6-96b8f3bf7170/developer_log.json?accessKey=1607916119_6680812212684569509_nLlPw6tYxTSiWZfFTb0atP9zZ3CEGDfW0btWV51xhjWHiCFqBt%2BneXd5Vp40eQCSx8e1W5PYCIe2db7JGbhoTeJsYxl7UmYssRvYpTxYJl8z90uwB9jkbS1fsd7niaAn%2BQs7xHdv%2BB9jaKQI8LJ%2BwYY8RPq1QaeCJxBIdeG44DY%3D
+     Status Code: 0
+  Status Message: Package Approved
+
+If everything is ok, now you can finish the process, stapling the notarization info and creating the dmg.
+
+.. code:: bash
+
+  make notarize_staple
+  make create_dmg
+
+If everything went well, you should have a .dmg for your release under the `deploy` folder.
+
+.. code:: bash
+
+  created: /Users/admin/leap/bitmask-vpn/deploy/RiseupVPN-0.20.4-175-gee4eb90.dmg
+
+Setting up OSX from qemu
+------------------------
+
+Check https://github.com/kholia/OSX-KVM
+
+Compiling in old OSX versions
+-----------------------------
+
+You can download old versions of Xcode from https://developer.apple.com/download/more/
+
+Version table:
+
+* High Sierra: Xcode 10.1

docs/build-ppa.md

+# PPA How to
+
+LEAP team maintains a [ppa repository](https://launchpad.net/~leapcodes) for the clients, pacakges are built for latest two LTS releases of ubuntu
+
+## Pre-requisites
+
+Ensure that all the build dependencies are already installed, you can use `make depends` on most ubuntu and debian version to have the machine
+ready to build `bitmask-vpn` debian packages
+
+If `make depends` do not work, it is useful to have the `devscripts` and `equivs` packages installed, these are needed later for building
+the source package and installing build dependencies.
+
+PPA expects a signed source package, we have to build this package and then upload to PPA the changes file using the [`dput`](https://manpages.ubuntu.com/manpages/xenial/man1/dput.1.html) tool.
+
+Please refer to official [PPA documentation](https://help.launchpad.net/Packaging/PPA) for how to create an account and add SSH and GPG keys to be able to upload.
+
+## Build signed source package
+
+### Prepare the debian package from templates
+
+```
+$ export PROVIDER=riseup # can be riseup, bitmask or calyx
+$ make vendor
+$ BUILD_RELEASE=yes make prepare_deb
+```
+
+> **NOTE**: The above commands will generate a debian directory in `build/riseup/debian` the control file created there can be used to build a dependencies package
+
+* If build depends are not yet installed, build a dependencies package with all the build and runtime dependencies of `bitmask-vpn`:
+
+```
+$ cd build/riseup/debian
+$ mk-build-deps control
+$ apt-get install -f ./riseup-vpn-build-deps_0.24.8_all.deb
+```
+
+* Add changes to changelog by copying the entries from the `CHANGELOG` file at the root of the repo
+
+```
+# example changelog file for 0.24.8 might look like
+$ cd build/riseup/build/riseup-vpn_0.24.8/
+$ cat debian/changelog
+riseup-vpn (0.24.8~noble) noble; urgency=medium
+  * Reduces the size of splash screen image
+  * Disable obfs4 and kcp checkbox in preferences for riseup
+  * Removes duplicate languages in the language picker in preferences
+  * Language picker in preferences shows languages sorted alphabetically
+  * 0.24.8 ubuntu noble release
+
+ -- LEAP Encryption Access Project <debian@leap.se>  Thu, 05 Sep 2024 03:06:54 +0800
+
+riseup-vpn (0.24.8-6-g92db03c4) unstable; urgency=medium
+
+  * Initial package.
+
+ -- LEAP Encryption Access Project  <debian@leap.se>  Mon, 29 Jul 2019 10:00:00 +0100
+
+```
+
+* Bump native dot-version, change release
+
+```
+$ cd build/riseup/build/riseup-vpn_0.24.8
+# to add a new entry for version 0.24.8 to the changelog file and update the release
+$ dch -b -v 0.24.8~noble -D "noble" -m "riseup-vpn release 0.24.8"
+```
+
+> **NOTE:** The source tarball's name as set by the `make preapre_deb` step will not match the version we set in the changelog file, since
+for PPAs we need to append the distribution name to the version, e.g to build `0.24.8` for `noble` the version is `0.24.8~noble`
+> More details about versioning ppa can be found in the PPA docs [versioning section](https://help.launchpad.net/Packaging/PPA/BuildingASourcePackage#versioning)
+
+* We need to rename the source tarball to match the version we set in the `changelog` file:
+
+```
+$ cd build/riseup/build
+$ mv riseup-vpn_0.24.8.orig.tar.gz riseup-vpn_0.24.8~noble.orig.tar.gz
+```
+
+### Build signed source package
+
+```
+$ cd build/riseup/build/riseup-vpn_0.24.8
+$ debuild -S -k=<key_id_for_signing>
+```
+
+### Upload changes file
+
+```
+$ cd build/riseup/build
+$ dput ppa:leapcodes/ppa riseup-vpn_0.24.8~noble_source.changes
+```

docs/build-snap-canonical.rst

+git integration
+===============
+
+All seems to be more smooth with the "new" (ahem) github integration (once things *are* working).
+
+Some tips:
+
+- We've got different repos. `riseup-vpn-snap` is the *snap* repo. Import code from upstream, just merge it with `-X theirs`
+- If the snap doesn't change, just use `make bump_snap` for upgrading the version from git (TODO we could write this also into the hardcoded version).
+- Otherwise, just do `make vendor` and import the snapcraft.yaml generated from the template.
+
+
+local builds
+------------
+multipass is the recommended way, but canonical does use lxd so at times some paths etc change.
+For your own sanity:
+
+- get a zfs pool on a fast device, and get yourself acquainted with lxd to use that pool.
+- don't get too frustrated with networking + lxd. restarting any iptables in your host (if using bridges) usually helps.
+- you can use `make local_snap` to use your local lxd infra. it launches with
+  `--debug`, so you'll be dropped into a local shell to see what the fuck the
+  manual build of Qt is complaining about.
+
+
+existential helpline
+--------------------
+* don't despair. we've all been there.
+* snapcraft forum is useful.
+* all tech is crap: don't think that you'll be happy reimplementing the whole
+  app in electron or whatnot. just don't. enjoy life while you can.
+* https://forum.snapcraft.io/t/the-sorry-state-of-snapping-qt5-apps/22809
+* https://github.com/mozilla-mobile/mozilla-vpn-client/blob/main/scripts/qt5_compile.sh
+
+if you have some time
+---------------------
+* look into a `clang` build. qt builds fine, but last time I tried there was
+  some incompatible version (?) that didn't let the qmake build finish.
+

docs/contribution-ideas.md

+# I have time, how can I help?
+
+## Packaging
+
+* Look into `AppImage` + https://github.com/probonopd/linuxdeployqt.
+  We've not considered that option too much in the past, but it might give us
+  a decent, self-contained alternative to snap etc.
+ 
+## Linux
+
+* Revamp vpn helper architecture: there're problems, of course, but we can try
+  to isolate the client gui from the vpn helper itself (and "ship it" as
+  a binary under the single bundle, as I do now with bitmak-root). An idea
+  that's been floating around for a long time is to recycle the helper
+  interface, and have a long-lived privileged helper that does the vpn
+  connection using openvpn3 libr.
+
+  elijah was initially supporting a short-lived helper (what we have right now
+  with bitmask-root), but perhaps the integration can be done right with pkexec
+  or otherwise (separate users in linux etc). This has the additional advantage
+  of allowing us to do a very early startup, and not to depend so much on
+  pkexec + ubuntu's quirks (portability!).
+
+# Other discrete projects
+
+* Secure, automated upgrade mechanism (look at TUF and the Qt Updater Framework).
+* Log viewer / log sender
+* VPN Traffic panel (statistics, ip, gw health, graph for upload/download speeds)
+* Migrate codebase to Qt6
+* Reduce the size of custom static builds
+* Apple + Windows stores
+* Convert snap to use a qt5 base (so that updates are kept small).
+* Provider-agnostic bitmask.
+* Private bridges mechanism.
+* QR-bootstrap