.gitattributes

+/pkg/config/version/version.go export-subst

.github/workflows/nightly.yaml

+name: 'mac and windows nightly build'
+
+# **What it does**: Generate unsigned macOS app and installer artifacts.
+# **Why we have it**: To build nightlies.
+# **Who does it impact**: Release/test.
+
+on:
+  workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+      provider_name:
+        description: 'The name of the providers branding that needs to be applied to the GUI app'
+        required: true
+        default: 'riseup'
+        type: choice
+        options:
+          - riseup
+          - calyx
+          - floatdemo
+          - demolib
+
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: '0 1 * * *'
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+jobs:
+  build-win:
+    defaults:
+      run:
+        shell: C:\msys64\usr\bin\bash.exe -e -o pipefail {0}
+    runs-on:
+      - windows-2019
+    steps:
+      - name: Setup Golang 1.22
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.22'
+      - name: Install build dependencies from chocolatey
+        run: choco install sigcheck aqt wget curl
+      - run: choco install qt-installer-framework --version 4.7.0
+      - run: git config --global core.autocrlf input
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Install Qt6 SDK using aqt
+        run: cd $USERPROFILE && aqt install-qt windows desktop 6.6.2 win64_mingw
+      - name: Build app
+        env:
+          PROVIDER: riseup
+        run: |
+          export PATH=$(cygpath $USERPROFILE/6.6.2/mingw_64/bin):$(cygpath $SYSTEMDRIVE/Qt/QtIFW-4.7.0/bin):$PATH
+          export PATH=$(cygpath $SYSTEMDRIVE/msys64/mingw64/bin):$(cygpath $SYSTEMDRIVE/msys64/usr/bin):$PATH
+          make vendor
+          make build
+          make installer
+      - name: Setup tmate session
+        if: ${{ failure() }}
+        uses: mxschmitt/action-tmate@v3
+      - name: Upload build/qt/release/riseup-vpn.exe
+        uses: actions/upload-artifact@v4
+        with:
+          name: riseup-vpn-exe-${{ github.sha }}
+          path: build/qt/release/riseup-vpn.exe
+      - name: Upload build/installer/RiseupVPN-installer-*.exe
+        uses: actions/upload-artifact@v4
+        with:
+          name: riseup-vpn-installer-${{ github.sha }}
+          path: build/installer/*.exe
+
+  build-mac:
+    strategy:
+      matrix:
+        os:
+          - macOS-13
+          - macOS-12
+          # - macOS-14 is broken becuase of missing openvpn build
+    runs-on:
+    - ${{ matrix.os }}
+    steps:
+      - name: Setup Golang 1.22
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.22'
+      - run: go version
+      - name: Install build dependencies from brew
+        run: brew install make create-dmg
+      - name: Install aqt installer
+        run: pipx install aqtinstall
+      - name: Setup Qt6 using aqt
+        run: aqt install-qt mac desktop 6.6.2 clang_64 -O ~/Qt6
+      - name: Install Qt installer framework
+        run: >
+          cd /tmp &&
+          curl -LO https://download.qt.io/official_releases/qt-installer-framework/4.7.0/QtInstallerFramework-macOS-x64-4.7.0.dmg &&
+          hdiutil attach QtInstallerFramework-macOS-x64-4.7.0.dmg &&
+          cd /Volumes/QtInstallerFramework-macOS-x64-4.7.0/QtInstallerFramework-macOS-x64-4.7.0.app/Contents/MacOS &&
+          ./QtInstallerFramework-macOS-x64-4.7.0 in --da -c --al
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-tags: true
+      - name: Build macOS installer
+        run: |
+          export PATH=~/Qt6/6.6.2/macos/bin:~/Qt/QtIFW-4.7.0/bin:$PATH
+          export PROVIDER=riseup
+          make vendor
+          make build
+          make installer
+      - name: Setup tmate session
+        if: ${{ failure() }}
+        uses: mxschmitt/action-tmate@v3
+      - name: Upload build/qt/release/riseup-vpn.app
+        uses: actions/upload-artifact@v4
+        with:
+          name: riseup-vpn-app-${{ github.sha }}-${{ matrix.os }}
+          path: build/installer/*.app

.gitignore

+__pycache__
+.mypy_cache  
+build
+dist
+deploy
+staging_dir
 /bitmask-vpn
 cmd/bitmask-vpn/bitmask-vpn
 /bitmask-helper
 cmd/bitmask-helper/bitmask-helper
 /bitmask-connect
 cmd/bitmask-connect/bitmask-connect
+gui/i18n/*.qm
+gui/providers/providers.json
+/snap
 
 locales/*/out.gotext.json
 tools/transifex/transifex
 
+branding/assets/default
+lib/*
+qtbuild/*
+providers/assets
+
+debian/files
+
 .*.swp
 *.exe
+
+# IDE
+.idea
+.vs
+
+# Arch Linux package
+ArchLinux/src
+ArchLinux/pkg
+ArchLinux/bitmask-vpn
+ArchLinux/*.tar.zst

.gitlab-ci.yml

 ---
 stages:
+  - lint
   - build
-
-variables:
-  GOPATH: /go
-  APP_PATH: /go/src/0xacab.org/leap/bitmask-vpn
+  - package
 
 build_test:
-  image: 0xacab.org:4567/leap/docker/bitmask-systray:latest
+  image: registry.0xacab.org/jkito/bitmask-vpn:latest
   stage: build
   script:
-    - mkdir -p /go/src/0xacab.org/leap/
-    - ln -s "$(pwd)" ${APP_PATH}
-    - cd ${APP_PATH}
-    - make get
     - make test
-    - make build_bitmaskd
-    - make build
+    - patch -p1 < docker/*.patch
+    # TODO missing xcb package in the docker image. investigate what to install to run minimal tests.
+    # - make test_ui
+    - PROVIDER=bitmask && make vendor && make build
   tags:
     - linux
   artifacts:
     paths:
-      - 'bitmask-vpn'
-      - 'bitmask-helper'
-      - 'bitmask-connect'
-    expire_in: 1 month
-
-win_installer:
- image: 0xacab.org:4567/leap/docker/bitmask-systray:latest
- stage: build
- script:
-   - mkdir -p /go/src/0xacab.org/leap/
-   - ln -s "$(pwd)" ${APP_PATH}
-   - cd ${APP_PATH}
+      - 'build/qt/release'
+    expire_in: 1 week
 
-   # we need to manually patch w32 until they merge #81
-   - mkdir -p /go/src/github.com/AllenDang/
-   - cd /go/src/github.com/AllenDang/
-   - git clone https://github.com/AllenDang/w32
-   - cd w32
-   - curl https://downloads.leap.se/thirdparty/w32.patch | patch -p1 -N
-
-   - cd ${APP_PATH}
+lint:
+  image: golangci/golangci-lint:v1.59-alpine
+  stage: build
+  script:
+    - golangci-lint run --timeout=5m
+  tags:
+    - linux
 
-   - git clone https://0xacab.org/leap/riseup_vpn
-   - cd riseup_vpn
-   - make openvpn_cross_win
-   - make build_cross_win
-   - mv dist/RiseupVPN-*.exe ..
- tags:
-   - linux
- artifacts:
-   name: installer_win_$CI_COMMIT_REF_NAME
-   paths:
-     - RiseupVPN-*.exe
-   expire_in: 1 month
+build_macos:
+  stage: build
+  script:
+    - export PROVIDER=riseup
+    - make vendor
+    - make -j4 build
+    - make installer
+  tags:
+    - macos
+  artifacts:
+    paths:
+      - 'build/installer/*.app'
+    expire_in: 1 week
 
-snap:
- image: 0xacab.org:4567/leap/docker/bitmask-systray:latest
- stage: build
- script:
-   - mkdir -p /go/src/0xacab.org/leap/
-   - ln -s "$(pwd)" ${APP_PATH}
+build_Arch_Linux_package:
+  image: archlinux
+  stage: package
+  before_script:
+    - "pacman -Suy base-devel --noconfirm"
+    - "useradd non_root"
+    - "echo 'non_root ALL=NOPASSWD: ALL' >> /etc/sudoers"
+    - "mkdir -p /home/non_root/build"
+    - "cp -r . /home/non_root/build"
+    - "chown -R non_root:non_root /home/non_root"
+  script:
+    # makepkg does not run as root, but it needs sudo to install dependencies
+    - "cd /home/non_root/build && sudo -u non_root make package_arch"
+    - "cd /home/non_root/build && pacman -U ArchLinux/*tar.zst --noconfirm"
+    # artifacts must be relative to the working directory (e.g. /builds/leap/bitmask-vpn)
+    - "cp /home/non_root/build/ArchLinux/*.tar.zst $CI_PROJECT_DIR"
+  artifacts:
+    paths:
+      - '*.tar.zst'
+    expire_in: 1 week
+  tags:
+    - linux
 
-   - git clone https://0xacab.org/leap/riseup_vpn /riseup_vpn
-   - cd /riseup_vpn
-   - sed -i 's/https:\/\/0xacab.org\/leap\/bitmask-vpn.*$/\/go\/src\/0xacab.org\/leap\/bitmask-vpn/' snap/snapcraft.yaml
-   - sed -i 's/git clone.*$//' snap/version.sh
-   - sed -i 's/git -C bitmask-vpn/git -C \/go\/src\/0xacab.org\/leap\/bitmask-vpn/' snap/version.sh
-   - snapcraft snap
-   - mv riseup-vpn*.snap ${APP_PATH}
- tags:
-   - linux
- artifacts:
-   name: snap_$CI_COMMIT_REF_NAME
-   paths:
-     - riseup-vpn*.snap
-   expire_in: 1 month
+build_debian12_package:
+  stage: package
+  # we use backports because we need go1.22
+  image: debian:bookworm-backports
+  before_script:
+    - "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -q -y make sudo"
+    - "make depends"
+    - "DEBIAN_FRONTEND=noninteractive apt-get install -y -q golang-1.22"
+    - "update-alternatives --install /usr/bin/go go /usr/lib/go-1.22/bin/go 0"
+    - 'ln -s $(qmake6 -query "QT_INSTALL_BINS")/lrelease /usr/local/bin/lrelease'
+  script:
+    - "PROVIDER=bitmask make vendor"
+    - "PROVIDER=bitmask QMAKE=qmake6 make package_deb"
+    - "make clean"
+    - "PROVIDER=riseup make vendor"
+    - "PROVIDER=riseup QMAKE=qmake6 make package_deb"
+  after_script:
+    - "mv deploy/*.deb build/riseup/build"
+  artifacts:
+    paths:
+      - "build/riseup/build/"
+    expire_in: 1 week
+  tags:
+    - linux
 
-osx_installer:
-  stage: build
-  allow_failure: true
-  variables:
-      GOPATH: /tmp/go/
-      APP_PATH: /tmp/go/src/0xacab.org/leap/bitmask-systray
+build_ubuntu22_package:
+  stage: package
+  image: ubuntu:22.04
+  before_script:
+    - "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -q -y software-properties-common make sudo"
+    - "add-apt-repository ppa:longsleep/golang-backports -y"
+    - "DEBIAN_FRONTEND=noninteractive apt-get install -y -q golang-go"
+    - "make depends"
+    - 'ln -s $(qmake6 -query "QT_INSTALL_BINS")/lrelease /usr/local/bin/lrelease'
   script:
-    - git clone https://0xacab.org/leap/riseup_vpn
-    - cd riseup_vpn
-    - make openvpn_osx
-    - make build_osx
+    - "PROVIDER=bitmask make vendor"
+    - "PROVIDER=bitmask QMAKE=qmake6 make package_deb"
+    - "make clean"
+    - "PROVIDER=riseup make vendor"
+    - "PROVIDER=riseup QMAKE=qmake6 make package_deb"
+  after_script:
+    - "mv deploy/*.deb build/riseup/build"
+  artifacts:
+    paths:
+      - "build/riseup/build/"
+    expire_in: 1 week
   tags:
-    - yosemite
-    - osx
+    - linux
+
+build_ubuntu24_package:
+  stage: package
+  image: ubuntu:24.04
+  before_script:
+    - "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -q -y make sudo"
+    - "make depends"
+    - 'ln -s $(qmake6 -query "QT_INSTALL_BINS")/lrelease /usr/local/bin/lrelease'
+  script:
+    - "PROVIDER=bitmask make vendor"
+    - "PROVIDER=bitmask QMAKE=qmake6 make package_deb"
+    - "make clean"
+    - "PROVIDER=riseup make vendor"
+    - "PROVIDER=riseup QMAKE=qmake6 make package_deb"
+  after_script:
+    - "mv deploy/*.deb build/riseup/build"
   artifacts:
-    name: installer_osx_$CI_COMMIT_REF_NAME
     paths:
-      - riseup_vpn/dist/RiseupVPN-*.pkg
-    expire_in: 1 month
+      - "build/riseup/build/"
+    expire_in: 1 week
+  tags:
+    - linux

.golangci.yaml

+issues:
+  exclude-use-default: true
+  exclude-dirs-use-default: true
+  exclude-files:
+    - ".*\\.cpp$"
+    - ".*\\.h$"
+    - ".*\\.sh$"
+    - ".*\\.py$"
+    - ".*\\.qml$"
+  exclude-dirs:
+    - "gui"
+linters:
+  disable-all: true
+  enable:
+    - errcheck
+    - gosimple
+    - ineffassign
+    - govet
+    - unused
+    - gofmt
+

.tx/config

+[main]
+host = https://rest.api.transifex.com
+
+lang_map = fa_IR: fa, kn_IN: kn
+
+[o:otf:p:bitmask:r:bitmask-desktop]
+source_file = gui/i18n/base.ts
+type = QT
+resource_name = LEAP Desktop VPN
+file_filter = gui/i18n/main_<lang>.ts
+minimum_perc = 80

AUTHORS

+Ruben Pollan <meskio@sindominio.net>
+Kali Kaneko <kali@leap.se>
+micah <micah@riseup.net>
+elijah <elijah@riseup.net>
+kwadronaut <kwadronaut@puscii.nl>
+Micah Anderson <micah@riseup.net>
+Natalie Eskinazi <n.l.eskinazi@gmail.com>
+Pj4NJFIVsq <n3k0@riseup.net>
+t h <t@h>

ArchLinux/PKGBUILD

+# Maintainer: Pea <peanut2 [aaaaat] systemli [dooot] org>
+
+pkgname=bitmask-vpn-git
+pkgrel=1
+pkgdesc="Bitmask is an open source application to provide easy and secure encrypted communication with a VPN"
+pkgver=0.24.6.rc.1.r10.g4ee5fba
+arch=("x86_64")
+license=("GPL-3.0-only")
+url="https://0xacab.org/leap/bitmask-vpn"
+conflicts=('riseup-vpn' 'riseup-vpn-git')
+
+#source=("git+$url.git")
+source=("bitmask-vpn::git+file://$(pwd)/../")
+sha256sums=('SKIP')
+
+# qt6-tools has /usr/lib/qt6/bin/lrelease
+makedepends=('git' 'make' 'go' 'qt6-tools')
+depends=('qt6-base' 'qt6-declarative' 'qt6-svg' 'openvpn' 'python' 'lxsession' 'iptables')
+
+pkgver() {
+  cd bitmask-vpn
+  git describe --long --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
+}
+
+prepare() {
+  cd bitmask-vpn
+  export GOCACHE="$srcdir/GOCACHE"
+  PROVIDER=bitmask make vendor
+}
+
+
+build() {
+  cd bitmask-vpn
+  export GOCACHE="$srcdir/GOCACHE"
+  export CGO_CPPFLAGS="${CPPFLAGS}"
+  export CGO_CFLAGS="${CFLAGS}"
+  export CGO_CXXFLAGS="${CXXFLAGS}"
+  export CGO_LDFLAGS="${LDFLAGS}"
+  export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
+
+  export PROVIDER=bitmask
+  export QMAKE=qmake6
+  export LRELEASE=/usr/lib/qt6/bin/lrelease
+  make build -j $(nproc)
+}
+
+check() {
+  cd bitmask-vpn
+  export GOCACHE="$srcdir/GOCACHE"
+  CI="dont run integration tests as they are broken" make test
+}
+
+package() {
+  cd bitmask-vpn
+
+  install -Dm755 build/qt/release/bitmask-vpn "$pkgdir/usr/bin/bitmask-vpn"
+  install -Dm755 helpers/bitmask-root "$pkgdir/usr/bin/bitmask-root"
+  install -Dm644 helpers/se.leap.bitmask.policy "$pkgdir/usr/share/polkit-1/actions/se.leap.bitmask.policy"
+
+  install -Dm644 build/bitmask/debian/bitmask-vpn.desktop "$pkgdir/usr/share/applications/bitmask-vpn.desktop"
+  install -Dm644 build/bitmask/debian/icons/scalable/bitmask-vpn.png  "$pkgdir/usr/share/icons/hicolor/128x128/apps/bitmask-vpn.png"
+}

CHANGELOG

+development
+===========
+- ...
+
+0.24.10
+=======
+- ui: use NumberAnimation for state change animation
+- update obfsvpn go module to v1.3.1-0.20241121155258-e6b06efc4456
+- [README] Print how to start bitmask-vpn after building it
+- [management] Add tests for parsing port of a management message
+- Log port of connected OpenVPN gateway
+- [management] Improve error handling in *StateEvent.parts()
+- show error message when app already running
+- remove use of deprecated ioutil module
+- fix crash during start when helper not installed
+- ovpn: don't redeclare status variable
+- ovpn: stop openvpn from management interface
+- Add introducer to storage before using it when supplied via env
+- Initialize and close bitmask-core storage
+- Improve error handling when checking downloaded pem cert
+- Update calls to DoGeolocationLookup after API change
+- Update to latest bitmask-core (commit 0812b9aadf98)
+- enable setting introducer url using env variable
+- chore: replace ioutil with io module
+- Strip port of menshen host before resolving with logDnsLookup
+- update l10n
+- create 0.24.10-rc.2 release
+- installer: get uid and gid only for macos
+- Update urls in provider config for bitmask provider
+- installer: get uid and gid only for macos
+- Update urls in provider config for bitmask provider
+- helper: use unix socket for local api
+- change obfsvpn version to v1.1.0
+- Do geolocation lookup
+- Add STUNServers countryCodeLookupURL fields to provider config (geolocation lookup)
+- [config] Clean code (move CaCert to global var list)
+- [menshen] Use NewConfigFromURL instead of NewConfig
+- Update bitmask-core dependency
+- Replace which with command -v
+- Update obfsvpn to v1.3.0
+- [bitmask-root] Don't redirect port 53 traffic of vpn gateways
+- [bitmask-root] Don't return generator in get_gateways
+- Fix log message that logs whitelisted gateway ip in firewall
+- config: enable UDP for openvpn by default
+- docs: add instructions for deb source package and uploading to ppa
+- deb: add intermediate makefile target to prepare deb package
+- Add python3 build dependency in control template
+- Update debian changelog template
+- deb: update patch for deb package to build with qt6.4
+- build: donot rename built app binary
+- build: pass in PROVIDER env variable to getparam script
+- installer: name helper launchd service based on app name
+- qmake: pass RELEASE variable to qmake invocation
+- build: use RELEASE_DIR for path to release build dir
+- qmake: configure for release builds when env RELEASE is yes
+- ci: donot manually apply patch in debian package jobs
+- ci: add gitlab ci job for building on macos
+- build: update openvpn build script to work on arm64 host
+- [Makefile] Don't overwrite QMAKE env when calling build.sh
+- [Makefile] Fix racecondition in Makefile
+- [Makefile] Remove install_go target
+- [Makefile] Add default target allinone (clean/vendor/build)
+- [Makefile] Use unlink only on Windows for make clean
+- Remove gui/providers/providers.json from git repo
+- ci: Remove debian job. Not needed anymore
+- ci: rename arch CI job to build_Arch_Linux_package
+- ci: build deb packages for Debian 12, Ubuntu 22.04 and Ubuntu 24.04
+- ci: Fix CI fail "toolchain not available"
+- ci: remove ineffective chmod from build step of macOS job
+
+0.24.8
+======
+- Reduces the size of splash screen image
+- Disable obfs4 and kcp checkbox in preferences for riseup
+- Removes duplicate languages in the language picker in preferences
+- Language picker in preferences shows languages sorted alphabetically
+- Updates translation files
+- Adds region to language selections menu when available
+- Improves UI responsiveness when connect or disconnect fails
+- Disable automatic openvpn connection during app start
+- Fixes a local privilege escalation security bug when using "--install-helpers"
+- Change bitmask branded app name to Bitmask from BitmaskVPN
+- Fixes bug where MOTD message box was not shown for RiseupVPN
+- Show bridge icon when KCP transport is selected
+- Show license page during installation
+- Uninstalls previous version before installing current version
+- Adds accessibility hints to connection button
+- Exposes KCP support in the UI
+- Adds new bitmask-vpn package for Arch Linux
+- Fixes a bug preventing use of the app by non-admin users on windows
+- Fixes a bug on macOS preventing users from manual location selection
+- Fixes a bug where the app's close routine was called twice
+- Fixes a bug where log file was not closed while quitting the app
+- Fixes a bug where the correct app name was not shown in installer error messages
+- Updates to latest obfsvpn
+- Updates to latest bitmask-core
+- Updates translation files
+- Adds missing iptables dependency to ubuntu package
+
+0.24.6-rc.1
+======
+- Adds better debug and informational logs
+- Partially implement menshen V5 API
+- Partially implements the new Bitmask and Riseup designs
+- Addition of PPA for ubuntu numbat
+- Adds timeout for http connections
+- Adds error checking to various places in the code
+
+0.24.5
+======
+- fix missing dependencies on .deb package
+- Shorten too long strings in translations
+- Fix bitmask branded windows UI and remove riseup crow from about
+- Connection status text width trimmed to be inside parent container
+- Bitmask branded desktop build pointing to demo instance of lillypad
+- Add Supported OS's to the readme
+- Update the debian package to build using Qt6
+- Update GUI to Qt6
+- Fix bitmask-helper install script for macOS and windows
+
+
+0.21.11
+=======
+- Complete UI revamp
+- Do not fail if ipv6 is disabled (GNU/Linux)
+- UDP support
+- Obfs4 support
+- Experimental snowflake support for bootstrap (not exposed in UI yet)
+- Disable autostart on first run
+- Provider "message of the day"
+- primitive version check for windows, osx.
+- #569 avoid installing in custom paths to mitigate security issue in windows
+
+
+0.21.6
+======
+
+- First iteration of the gateway selector.
+- Allow to select obfs4 gateways (bridges) to bypass censorship.
+- Ability to define explicitely allowed addresses for local networks.
+- Make the donate dialog less intrusive (#470)
+- Updated translations. New locales: greek, farsi, hungarian, dutch, polish and uyghur.

CMakeLists.txt

+cmake_minimum_required(VERSION 3.16)
+project(bitmask VERSION 1.0 LANGUAGES CXX)
+
+set(CMAKE_INCLUDE_CURRENT_DIR ON)
+
+find_package(QT NAMES Qt5 Qt6 REQUIRED)
+find_package(Qt${QT_VERSION_MAJOR} REQUIRED COMPONENTS Core Gui Qml Quick QuickControls2 Svg Widgets LinguistTools)
+
+find_library(LIB_TO_INCLUDE goshim lib)
+#qt_standard_project_setup()
+set(CMAKE_AUTOMOC ON)
+set(CMAKE_AUTOUIC ON)
+
+qt_add_executable(bitmask WIN32 MACOSX_BUNDLE
+    gui/handlers.cpp gui/handlers.h
+    gui/main.cpp
+    gui/qjsonmodel.cpp gui/qjsonmodel.h
+    lib/libgoshim.h
+)
+qt_add_qml_module(bitmask
+    URI bitmask
+    VERSION ${PROJECT_VERSION}
+    QML_FILES
+        gui/main.qml
+        gui/themes/themes.js
+        gui/themes/theme-riseup.js
+        gui/themes/Riseup.qml
+        gui/themes/theme-calyx.js
+        gui/themes/Calyx.qml
+        gui/themes/ThemeObject.qml
+        gui/components/MainView.qml
+        gui/components/ThemedPage.qml
+        gui/components/Splash.qml
+        gui/components/FadeBehavior.qml
+        gui/components/Home.qml
+        gui/components/Header.qml
+        gui/components/Footer.qml
+        gui/components/About.qml
+        gui/components/MaterialRadioButton.qml
+        gui/components/MaterialRadioIndicator.qml
+        gui/components/WrappedRadioButton.qml
+        gui/components/MaterialCheckBox.qml
+        gui/components/StatusBox.qml
+        gui/components/Systray.qml
+        gui/components/Help.qml
+        gui/components/Locations.qml
+        gui/components/SignalIcon.qml
+        gui/components/Preferences.qml
+        gui/components/BoldLabel.qml
+        gui/components/LightLabel.qml
+        gui/components/VPNButtonBase.qml
+        gui/components/VPNMouseArea.qml
+        gui/components/VerticalSpacer.qml
+        gui/components/Icon.qml
+        gui/components/MaterialButton.qml
+        gui/components/VPNState.qml
+        gui/components/InitErrors.qml
+        gui/components/ErrorBox.qml
+        gui/components/MotdBox.qml
+        gui/components/NavigationDrawer.qml
+    RESOURCES
+        gui/qtquickcontrols2.conf
+        gui/resources/icon-noshield.svg
+        gui/resources/location.svg
+        gui/resources/settings.svg
+        gui/resources/power.svg
+        gui/resources/language.svg
+        gui/resources/lightning.svg
+        gui/resources/close.svg
+        gui/resources/donate.svg
+        gui/resources/tools.svg
+        gui/resources/help.svg
+        gui/resources/about.svg
+        gui/resources/bridge.svg
+        gui/resources/gear-fill.svg
+        gui/resources/reception-0.svg
+        gui/resources/reception-2.svg
+        gui/resources/reception-4.svg
+        gui/resources/reception-0@24.svg
+        gui/resources/reception-4@24.svg
+        gui/resources/arrow-left.svg
+        gui/resources/globe.svg
+        gui/resources/spy.gif
+        gui/resources/quit.svg
+        gui/resources/alert.svg
+        gui/resources/angle-right.svg
+        gui/resources/snowflake.svg
+        gui/resources/ravens.svg
+        gui/resources/ravens.gif
+        gui/resources/riseup-icon.svg
+        gui/resources/calyx/calyx-shield-green.png
+        gui/resources/calyx/calyx-hand.png
+        gui/resources/calyx/calyx-red-shield.png
+        gui/resources/calyx/calyx-yellow-shield.png
+        gui/resources/fonts/Poppins-Regular.ttf
+        gui/resources/fonts/Poppins-Bold.ttf
+        gui/resources/fonts/Montserrat-SemiBold.ttf
+        gui/resources/fonts/Roboto-Regular.ttf
+        gui/resources/fonts/Roboto-Bold.ttf
+        gui/assets/icon/png/black/vpn_off.png
+        gui/assets/icon/png/black/vpn_on.png
+        gui/assets/icon/png/black/vpn_wait_0.png
+        gui/assets/icon/png/black/vpn_wait_1.png
+        gui/assets/icon/png/black/vpn_wait_2.png
+        gui/assets/icon/png/black/vpn_wait_3.png
+        gui/assets/icon/png/white/vpn_off.png
+        gui/assets/icon/png/white/vpn_on.png
+        gui/assets/icon/png/white/vpn_wait_0.png
+        gui/assets/icon/png/white/vpn_wait_1.png
+        gui/assets/icon/png/white/vpn_wait_2.png
+        gui/assets/icon/png/white/vpn_wait_3.png
+        gui/assets/img/bird.jpg
+        gui/providers/providers.json
+    NO_RESOURCE_TARGET_PATH
+    OUTPUT_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/release
+)
+set_source_files_properties("gui/providers/providers.json"
+    PROPERTIES QT_RESOURCE_ALIAS "providers.json"
+)
+set_source_files_properties("gui/resources/fonts/Montserrat-SemiBold.ttf"
+    PROPERTIES QT_RESOURCE_ALIAS "monserrat-bold.ttf"
+)
+set_source_files_properties("gui/resources/fonts/Poppins-Bold.ttf"
+    PROPERTIES QT_RESOURCE_ALIAS "poppins-bold.ttf"
+)
+set_source_files_properties("gui/resources/fonts/Poppins-Regular.ttf"
+    PROPERTIES QT_RESOURCE_ALIAS "poppins-regular.ttf"
+)
+set_source_files_properties("gui/resources/fonts/Roboto-Bold.ttf"
+    PROPERTIES QT_RESOURCE_ALIAS "roboto-bold.ttf"
+)
+set_source_files_properties("gui/resources/fonts/Roboto-Regular.ttf"
+    PROPERTIES QT_RESOURCE_ALIAS "roboto.ttf"
+)
+
+# Avoid collision between executable name and QML module directory (QTBUG-98568).
+if(NOT WIN32 AND NOT APPLE)
+    set_property(TARGET bitmask PROPERTY OUTPUT_NAME bitmask_app)
+endif()
+
+target_compile_definitions(bitmask PRIVATE
+    QT_DEPRECATED_WARNINGS
+)
+
+target_link_libraries(bitmask PRIVATE
+    # Remove: L../../lib
+    Qt::Core
+    Qt::Gui
+    Qt::Qml
+    Qt::Quick
+    Qt::QuickControls2
+    Qt::Svg
+    Qt::Widgets
+    ${LIB_TO_INCLUDE}
+    pthread
+)
+
+
+# Resources:
+set_source_files_properties("providers/riseup/assets/icon.svg"
+    PROPERTIES QT_RESOURCE_ALIAS "icon.svg"
+)
+set(vendor_resource_files
+    "providers/riseup/assets/icon.svg"
+)
+
+qt_add_resources(bitmask "vendor"
+    PREFIX
+        "/vendor/"
+    BASE
+        "providers/riseup"
+    FILES
+        ${vendor_resource_files}
+)
+
+qt_add_translations(bitmask TS_FILES
+    gui/i18n/base.ts
+    gui/i18n/main_de.ts
+    gui/i18n/main_el.ts
+    gui/i18n/main_es_ES.ts
+    gui/i18n/main_es-rAR.ts
+    gui/i18n/main_es.ts
+    gui/i18n/main_et.ts
+    gui/i18n/main_fa_IR.ts
+    gui/i18n/main_fi.ts
+    gui/i18n/main_fr.ts
+    gui/i18n/main_hu.ts
+    gui/i18n/main_it.ts
+    gui/i18n/main_lt.ts
+    gui/i18n/main_nl.ts
+    gui/i18n/main_pl.ts
+    gui/i18n/main_pt-rBR.ts
+    gui/i18n/main_ru.ts
+    gui/i18n/main_th.ts
+    gui/i18n/main_tr.ts
+    gui/i18n/main_ug.ts
+    gui/i18n/main_zh-rTW.ts
+    gui/i18n/main_zh.ts
+)
+
+if(MACOS)
+    target_link_libraries(bitmask PRIVATE
+        "-framework CoreFoundation"
+        "-framework Security"
+    )
+endif()
+
+install(TARGETS bitmask
+    BUNDLE DESTINATION .
+    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
+)
+
+qt_generate_deploy_qml_app_script(
+    TARGET bitmask
+    FILENAME_VARIABLE deploy_script
+    NO_UNSUPPORTED_PLATFORM_ERROR
+    DEPLOY_USER_QML_MODULES_ON_UNSUPPORTED_PLATFORM
+    MACOS_BUNDLE_POST_BUILD
+)
+install(SCRIPT ${deploy_script})

Makefile

-.PHONY: all get build build_bitmaskd icon locales generate_locales clean
+#########################################################################
+# Multiplatform build and packaging recipes for BitmaskVPN
+# (c) LEAP Encryption Access Project, 2019-2021
+#########################################################################
 
-TAGS ?= gtk_3_18
+.PHONY: all get build icon locales generate_locales clean check_qtifw HAS-qtifw relink_vendor fmt
 
-all: icon locales get build
+XBUILD ?= no
+RELEASE ?= no
+QMAKE ?= qmake
+LRELEASE ?= lrelease
+SKIP_CACHECK ?= no
+VENDOR_PATH ?= providers
+APPNAME ?= $(shell VENDOR_PATH=${VENDOR_PATH} PROVIDER=${PROVIDER} branding/scripts/getparam appname | tail -n 1)
+TARGET ?= $(shell VENDOR_PATH=${VENDOR_PATH} PROVIDER=${PROVIDER} branding/scripts/getparam binname | tail -n 1)
+PROVIDER ?= $(shell grep ^'provider =' ${VENDOR_PATH}/vendor.conf | cut -d '=' -f 2 | cut -d ',' -f 1 | tr -d "[:space:]")
+VERSION ?= $(shell git describe 2> /dev/null)
+ifeq ($(VERSION),)
+    VERSION := "unknown"
+endif
+WINCERTPASS ?= pass
+OSXAPPPASS  ?= pass
+OSXMORDORUID ?= uid
 
-get:
-	go get -tags $(TAGS) ./...
-	go get -tags "$(TAGS) bitmaskd" ./...
+# go paths
+GOPATH = $(shell go env GOPATH)
+TARGET_GOLIB=lib/libgoshim.a
+SOURCE_GOLIB=gui/backend.go
+SOURCE_DIRS_GO = pkg cmd gui
 
-build: $(foreach path,$(wildcard cmd/*),build_$(patsubst cmd/%,%,$(path)))
+# detect OS
+UNAME = $(shell uname -s)
+ifeq ($(OS), Windows_NT)
+PLATFORM = windows
+else
+PLATFORM ?= $(shell echo ${UNAME} | awk "{print tolower(\$$0)}")
+endif
 
-build_%:
-	go build -tags $(TAGS) -ldflags "-X main.version=`git describe --tags`" -o $* ./cmd/$*
+QTBUILD = build/qt
+INSTALLER = build/installer
 
-test:
-	go test -tags "integration $(TAGS)" ./...
+# See https://stackoverflow.com/a/65120256 if you have problems validating the cert.
+OSX_CERT="Apple Distribution: LEAP Encryption Access Project"
+
+MACDEPLOYQT_OPTS = -appstore-compliant -always-overwrite -codesign="${OSX_CERT}"
+
+ifeq ($(PLATFORM), darwin)
+INST_ROOT =${INSTALLER}/packages/bitmaskvpn/data/
+INST_DATA = ${INST_ROOT}/${APPNAME}.app/
+else
+INST_DATA = ${INSTALLER}/packages/bitmaskvpn/data/
+endif
+
+SCRIPTS = branding/scripts
+TEMPLATES = branding/templates
+
+OPENVPN_WINDOWS_INSTALLER = https://build.openvpn.net/downloads/releases/OpenVPN-2.6.6-I001-amd64.msi
+
+ifeq ($(PLATFORM), linux)
+HAS_QTIFW :=
+else
+HAS_QTIFW := $(shell command -v binarycreator)
+endif
+OPENVPN_BIN = "$(HOME)/openvpn_build/sbin/$(shell grep OPENVPN branding/thirdparty/openvpn/build_openvpn.sh | head -n 1 | cut -d = -f 2 | tr -d '"')"
+
+
+#########################################################################
+# go build
+#########################################################################
+
+.PHONY: allinone
+allinone: clean vendor build
+
+depends:
+	-@${MAKE} depends$(UNAME)
+
+dependsLinux:
+	# install build dependencies (from branding/templates/debian/control-template)
+	@sudo apt-get install -y golang make pkg-config g++ git libqt6svg6-dev qt6-tools-dev qt6-tools-dev-tools qt6-base-dev libqt6qml6 qt6-declarative-dev dh-golang libgl-dev qt6-declarative-dev-tools qt6-l10n-tools
+	# install runtime dependencies (from branding/templates/debian/control-template)
+	@sudo apt-get install -y libqt6core6 libqt6gui6 libqt6qml6 libqt6widgets6 libstdc++6 libqt6svg6 qml6-module-qtquick qml6-module-qtquick-controls qml6-module-qtquick-dialogs qml6-module-qtquick-layouts qml6-module-qtqml-workerscript qml6-module-qtquick-templates qml6-module-qt-labs-settings qml6-module-qtquick-window qml6-module-qt-labs-platform qml6-module-qtcore qml6-module-qt5compat-graphicaleffects openvpn policykit-1-gnome python3 iptables
+	# needed to build debian package
+	@sudo apt-get install -y devscripts fakeroot
+	@${MAKE} -C docker deps
+	@# debian needs also: snap install snapcraft --classic; snap install  multipass --beta --classic
+
+dependsDarwin:
+	@brew install git golang make qt5
+	#@brew install --default-names gnu-sed
+	@brew link qt5
+
+dependsCYGWIN_NT-10.0:
+	@echo
+	@echo "==================================WARNING=================================="
+	@echo "You need to install all dependencies manually, please see README.md!"
+	@echo "==================================WARNING=================================="
+	@echo
+
+ifeq ($(PLATFORM), darwin)
+EXTRA_FLAGS = MACOSX_DEPLOYMENT_TARGET=10.10 GOOS=darwin CC=clang
+else
+EXTRA_FLAGS =
+endif
+
+ifeq ($(PLATFORM), windows)
+EXTRA_GO_LDFLAGS = "-H=windowsgui"
+endif
+
+ifeq ($(PLATFORM), windows)
+PKGFILES = $(wildcard "pkg/*") # syntax err in windows with find
+else
+PKGFILES = $(shell find pkg -type f -name '*.go')
+endif
+
+lib/%.a: $(PKGFILES)
+	@XBUILD=no CC=${CC} VENDOR_PATH=${VENDOR_PATH} CXX=${CXX} MAKE=${MAKE} AR=${AR} LD=${LD} VERSION=${VERSION} ./gui/build.sh --just-golib
+
+# FIXME move platform detection above! no place to uname here, just use $PLATFORM
+#
+MINGGW =
+ifeq ($(UNAME), MINGW64_NT-10.0)
+MINGW = yes
+endif
+ifeq ($(UNAME), MINGW64_NT-10.0-19042)
+MINGW = yes
+endif
+
+relink_vendor:
+	@echo "============RELINK VENDOR============="
+	@echo "PLATFORM: ${PLATFORM} (${UNAME})"
+	@echo "VENDOR_PATH: ${VENDOR_PATH}"
+	@echo "PROVIDER: ${PROVIDER}"
+ifeq ($(PLATFORM), windows)
+	@rm -rf providers/assets
+ifeq ($(VENDOR_PATH), providers)
+	@cp -r providers/${PROVIDER}/assets providers/assets || true
+endif # end windows
+else # not windows: linux/osx
+ifeq ($(VENDOR_PATH), providers)
+	@-unlink providers/assets
+	@ln -s ${PROVIDER}/assets providers/assets || true
+endif
+endif
+	@echo "============RELINK VENDOR============="
 
-build_bitmaskd:
-	go build -tags "$(TAGS) bitmaskd" -ldflags "-X main.version=`git describe --tags`" ./cmd/*
+build_golib: lib/libgoshim.a
 
-build_win:
-	powershell -Command '$$version=git describe --tags; go build -ldflags "-H windowsgui -X main.version=$$version" ./cmd/*'
+build_gui: build_golib relink_vendor
+	@echo "==============BUILD GUI==============="
+	@echo "TARGET: ${TARGET}"
+	@echo "VENDOR_PATH: ${VENDOR_PATH}"
+	@XBUILD=no CC=${CC} CXX=${CXX} MAKE=${MAKE} AR=${AR} LD=${LD} LRELEASE=${LRELEASE} TARGET=${TARGET} VENDOR_PATH=${VENDOR_PATH} APPNAME=${APPNAME} gui/build.sh --skip-golib
+	@echo "============BUILD GUI================="
+
+build: build_helper build_gui
+
+build_helper:
+ifeq ($(PLATFORM), darwin)
+	# no helper needed for linux, we use polkit/bitmask-root
+	# no helper needed for windows, use openvpn interective service
+	@echo "=============BUILDER HELPER==========="
+	@echo "PLATFORM: ${PLATFORM}"
+	@echo "APPNAME: ${APPNAME}"
+	@echo "VERSION: ${VERSION}"
+	@echo "EXTRA_GO_LDFLAGS: ${EXTRA_GO_LDFLAGS}"
+	@mkdir -p build/bin/${PLATFORM}
+	@go build -o build/bin/${PLATFORM}/bitmask-helper -ldflags "-X main.AppName=${APPNAME} -X main.Version=${VERSION} ${EXTRA_GO_LDFLAGS}" ./cmd/bitmask-helper/
+	@echo "===========BUILDER HELPER============="
+endif
+
+build_openvpn:
+	@[ -f $(OPENVPN_BIN) ] && echo "OpenVPN already built at" $(OPENVPN_BIN) || ./branding/thirdparty/openvpn/build_openvpn.sh
+
+dosign:
+ifeq (${PLATFORM}, windows)
+	"c:\windows\system32\rcedit.exe" ${QTBUILD}/release/${TARGET}.exe --set-file-version ${VERSION}
+	"c:\windows\system32\rcedit.exe" ${QTBUILD}/release/${TARGET}.exe --set-product-version ${VERSION}
+	"c:\windows\system32\rcedit.exe" ${QTBUILD}/release/${TARGET}.exe --set-version-string CompanyName "LEAP Encryption Access Project"
+	"c:\windows\system32\rcedit.exe" ${QTBUILD}/release/${TARGET}.exe --set-version-string FileDescription "${APPNAME}"
+	"c:\windows\system32\signtool.exe" sign -debug -f "z:\leap\LEAP.pfx" -p ${WINCERTPASS} ${QTBUILD}/release/${TARGET}.exe
+endif
+
+checksign:
+ifeq (${PLATFORM}, windows)
+ifeq (${RELEASE}, yes)
+	@sigcheck.exe ${QTBUILD}/release/${TARGET}.exe
+endif
+endif
+
+installer: check_qtifw checksign
+	@mkdir -p ${INST_DATA}
+	@cp -r ${TEMPLATES}/qtinstaller/packages ${INSTALLER}
+	@cp LICENSE ${INSTALLER}/packages/bitmaskvpn/meta/LICENSE.txt
+	@cp -r ${TEMPLATES}/qtinstaller/installer.pro ${INSTALLER}
+	@cp -r ${TEMPLATES}/qtinstaller/config ${INSTALLER}
+	@cp ${VENDOR_PATH}/assets/icon.ico ${INSTALLER}/config/installer-icon.ico
+	@cp ${VENDOR_PATH}/assets/icon.icns ${INSTALLER}/config/installer-icon.icns
+	@cp ${VENDOR_PATH}/assets/installer-logo.png ${INSTALLER}/config/installer-logo.png
+ifeq (${PLATFORM}, darwin)
+	@mkdir -p ${INST_DATA}/helper
+	@VERSION=${VERSION} VENDOR_PATH=${VENDOR_PATH} ${SCRIPTS}/gen-qtinstaller osx ${INSTALLER}
+	@cp "${TEMPLATES}/osx/bitmask.pf.conf" ${INST_DATA}helper/bitmask.pf.conf
+	@cp "${TEMPLATES}/osx/client.up.sh" ${INST_DATA}/
+	@cp "${TEMPLATES}/osx/client.down.sh" ${INST_DATA}/
+	@go build -ldflags='-w -s' -o "${INST_ROOT}/post-install" "${TEMPLATES}/qtinstaller/osx-data/post-install.go"
+	@[ -f $(OPENVPN_BIN) ] && echo "OpenVPN already built at" $(OPENVPN_BIN) || ./branding/thirdparty/openvpn/build_openvpn.sh
+	@cp $(OPENVPN_BIN) ${INST_DATA}/openvpn.leap
+	@cp build/bin/${PLATFORM}/bitmask-helper ${INST_DATA}/
+ifeq (${RELEASE}, yes)
+	@echo "[+] Running macdeployqt (release mode)"
+	@macdeployqt ${QTBUILD}/release/${PROVIDER}-vpn.app -qmldir=gui/components ${MACDEPLOYQT_OPTS}
+else
+	@echo "[+] Running macdeployqt (debug mode)"
+	@macdeployqt ${QTBUILD}/release/${PROVIDER}-vpn.app -qmldir=gui/components
+endif
+	@cp -r "${QTBUILD}/release/${TARGET}.app"/ ${INST_DATA}/
+endif
+ifeq (${PLATFORM}, windows)
+	@wget ${OPENVPN_WINDOWS_INSTALLER} -O ${INST_DATA}/openvpn-installer.msi
+	@VERSION=${VERSION} VENDOR_PATH=${VENDOR_PATH} ${SCRIPTS}/gen-qtinstaller windows ${INSTALLER}
+ifeq (${VENDOR_PATH}, providers)
+	@cp ${VENDOR_PATH}/${PROVIDER}/assets/icon.ico ${INST_DATA}/icon.ico
+else
+	@cp ${VENDOR_PATH}/assets/icon.ico ${INST_DATA}/icon.ico
+endif
+	@cp ${QTBUILD}/release/${TARGET}.exe ${INST_DATA}${TARGET}.exe
+ifeq (${RELEASE}, yes)
+	@windeployqt --qmldir gui/components ${INST_DATA}${TARGET}.exe
+else
+	@windeployqt --qmldir gui/components ${INST_DATA}${TARGET}.exe
+endif
+	# XXX this is a workaround for missing libs after windeployqt ---
+	@cp $(shell cygpath $(shell ${QMAKE} -query 'QT_INSTALL_BINS'))/libgcc_s_seh-1.dll ${INST_DATA}
+	@cp $(shell cygpath $(shell ${QMAKE} -query 'QT_INSTALL_BINS'))/libstdc++-6.dll ${INST_DATA}
+	@cp $(shell cygpath $(shell ${QMAKE} -query 'QT_INSTALL_BINS'))/libwinpthread-1.dll ${INST_DATA}
+	@cp -r $(shell cygpath $(shell ${QMAKE} -query 'QT_INSTALL_QML')) ${INST_DATA}
+endif
+ifeq (${PLATFORM}, linux)
+	@VERSION=${VERSION} ${SCRIPTS}/gen-qtinstaller linux ${INSTALLER}
+endif
+	@echo "[+] All templates, binaries and libraries copied to build/installer."
+	@echo "[+] Now building the installer."
+	@cd build/installer && ${QMAKE} VENDOR_PATH=${VENDOR_PATH} INSTALLER=${APPNAME}-installer-${VERSION} && ${MAKE}
+
+sign_installer:
+ifeq (${PLATFORM}, windows)
+	# TODO add flag to skip signing for regular builds
+	"c:\windows\system32\signtool.exe" sign -f "z:\leap\LEAP.pfx" -p ${WINCERTPASS} build/installer/${APPNAME}-installer-${VERSION}.exe
+endif
+ifeq (${PLATFORM}, darwin)
+	gsed -i "s/com.yourcompany.installerbase/se.leap.bitmask.${TARGET}/g" build/installer/${APPNAME}-installer-${VERSION}.app/Contents/Info.plist
+	codesign -s ${OSX_CERT} --options "runtime" build/installer/${APPNAME}-installer-${VERSION}.app
+	ditto -ck --rsrc --sequesterRsrc build/installer/${APPNAME}-installer-${VERSION}.app build/installer/${APPNAME}-installer-${VERSION}.zip
+endif
+
+notarize_all:
+	APPNAME=${APPNAME} VERSION=${VERSION} TARGET=${TARGET} OSXAPPPASS=${OSXAPPPASS} branding/scripts/osx-stapler.sh
+
+# --------------------
+# TODO test and remove
+
+notarize_installer:
+# courtesy of https://skyronic.com/2019/07/app-notarization-for-qt-applications/
+ifeq (${PLATFORM}, darwin)
+	xcrun altool --notarize-app -t osx -f build/installer/${APPNAME}-installer-${VERSION}.zip --primary-bundle-id="se.leap.bitmask.${TARGET}" -u "info@leap.se" -p ${OSXAPPPASS}
+endif
+
+notarize_check:
+ifeq (${PLATFORM}, darwin)
+	xcrun altool --notarization-info ${OSXMORDORUID} -u "info@leap.se" -p ${OSXAPPPASS}
+endif
+
+notarize_staple:
+ifeq (${PLATFORM}, darwin)
+	xcrun stapler staple build/installer/${APPNAME}-installer-${VERSION}.app
+endif
+
+create_dmg:
+ifeq (${PLATFORM}, darwin)
+	@create-dmg deploy/${APPNAME}-${VERSION}.dmg build/installer/${APPNAME}-installer-${VERSION}.app
+endif
+# --------------------
+
+
+
+check_qtifw:
+ifdef HAS_QTIFW
+	@echo "[+] Found QTIFW"
+else
+	$(error "[!] Cannot find QTIFW. Please install it and add it to your PATH")
+endif
 
 clean:
-	make -C icon clean
-	rm bitmask-vpn
+	@rm -rf lib/*
+	@rm -rf build/
+ifeq ($(PLATFORM), windows)
+	# Need to use unlink on Windows for permission reasons
+	@-unlink branding/assets/default
+else
+	@rm -rf branding/assets/default
+endif
+	@cd ArchLinux && rm -rf bitmask-vpn pkg src *.tar.zst
 
-icon:
-	make -C icon
 
-get_deps:
-	sudo apt install libgtk-3-dev libappindicator3-dev golang pkg-config
+########################################################################
+# tests
+#########################################################################
 
+qmllint:
+	@qmllint gui/*.qml
+	@qmllint gui/components/*.qml
 
-LANGS ?= $(foreach path,$(wildcard locales/*),$(patsubst locales/%,%,$(path)))
-empty :=
-space := $(empty) $(empty)
-lang_list := $(subst $(space),,$(foreach lang,$(LANGS),$(lang),))
+qmlfmt:
+	# needs https://github.com/jesperhh/qmlfmt in your path
+	@qmlfmt -w gui/qml/*.qml
 
-locales: $(foreach lang,$(LANGS),get_$(lang)) cmd/bitmask-vpn/catalog.go
+test:
+	@go test -tags "integration $(TAGS)" ./pkg/...
 
-generate_locales:
-	gotext extract ./pkg/systray ./pkg/bitmask
-	make -C tools/transifex
+fmt:
+	@gofmt -s -w $(SOURCE_DIRS_GO)
+
+.PHONY: lint
+lint:
+	golangci-lint run  --timeout=5m
+
+test_ui: build_golib
+	@${QMAKE} -o tests/Makefile test.pro
+	@${MAKE} -C tests clean
+	@${MAKE} -C tests
+ifeq ($(PLATFORM), windows)
+	@./tests/build/test_ui.exe
+else
+	@./tests/build/test_ui
+endif
+
+
+#########################################################################
+# packaging templates
+#########################################################################
+
+bump_snap:
+	@sed -i 's/^version:.*$$/version: ${VERSION}/' snap/snapcraft.yaml
+	@sed -i 's/^.*echo .*version.txt$$/        echo ${VERSION} > $$SNAPCRAFT_PRIME\/snap\/version.txt/' snap/snapcraft.yaml
+
+local_snap:
+	# just to be able to debug stuff locally in the same way as it's really built @canonical
+	# but multipass is the way to go, nowadays
+	@snapcraft --debug --use-lxd
+
+vendor_init:
+	@VENDOR_PATH=${VENDOR_PATH} ./branding/scripts/init
+
+vendor_check:
+	@VENDOR_PATH=${VENDOR_PATH} ./branding/scripts/check ${PROVIDER}
+ifeq (${SKIP_CACHECK}, no)
+	@VENDOR_PATH=${VENDOR_PATH} ${SCRIPTS}/check-ca-crt ${PROVIDER}
+endif
+
+vendor: gen_providers_json prepare_templates gen_pkg_snap gen_pkg_deb
+
+gen_providers_json:
+	@VENDOR_PATH=${VENDOR_PATH} branding/scripts/gen-providers-json gui/providers/providers.json
+
+prepare_templates: tgz
+	@mkdir -p build/${PROVIDER}/bin/ deploy
+	@cp ${TEMPLATES}/makefile/Makefile build/${PROVIDER}/Makefile
+	@VERSION=${VERSION} VENDOR_PATH=${VENDOR_PATH} ${SCRIPTS}/generate-vendor-make build/${PROVIDER}/vendor.mk
+
+TGZ_NAME = bitmask-vpn_${VERSION}-src
+TGZ_PATH = ./build/${TGZ_NAME}
+tgz:
+	@mkdir -p $(TGZ_PATH)
+	git archive HEAD | tar -x -C $(TGZ_PATH)
+	@cd build/ && tar czf bitmask-vpn_$(VERSION).tgz ${TGZ_NAME} && cd ..
+	@rm -rf $(TGZ_PATH)
+
+
+gen_pkg_deb:
+ifeq (${PLATFORM}, linux)
+	@mkdir -p build/${PROVIDER}/
+	@cp -r ${TEMPLATES}/debian build/${PROVIDER}
+	@VERSION=${VERSION} VENDOR_PATH=${VENDOR_PATH} ${SCRIPTS}/generate-debian build/${PROVIDER}/debian/data.json
+ifeq (${VENDOR_PATH}, providers)
+	@mkdir -p build/${PROVIDER}/debian/icons/scalable && cp ${VENDOR_PATH}/${PROVIDER}/assets/icon.png build/${PROVIDER}/debian/icons/scalable/${TARGET}.png
+else
+	@mkdir -p build/${PROVIDER}/debian/icons/scalable && cp ${VENDOR_PATH}/assets/icon.png build/${PROVIDER}/debian/icons/scalable/${TARGET}.png
+endif
+	@cd build/${PROVIDER}/debian && python3 generate.py
+	@cd build/${PROVIDER}/debian && rm app.desktop-template changelog-template rules-template control-template generate.py data.json && chmod +x rules
+	@cd build/${PROVIDER}/debian && mv app.desktop ${TARGET}.desktop && mv app.install ${TARGET}.install && rm -f app.install-template && \
+	rm -rf source/include-binaries-template
+endif
+
+gen_pkg_snap:
+ifeq (${PLATFORM}, linux)
+	@mkdir -p build/${PROVIDER}
+	@cp -r ${TEMPLATES}/snap build/${PROVIDER}
+	@VERSION=${VERSION} VENDOR_PATH=${VENDOR_PATH} ${SCRIPTS}/generate-snap build/${PROVIDER}/snap/data.json
+	@cp pkg/pickle/helpers/se.leap.bitmask.snap.policy build/${PROVIDER}/snap/local/pre/
+	@cp pkg/pickle/helpers/bitmask-root build/${PROVIDER}/snap/local/pre/
+	@cd build/${PROVIDER}/snap && python3 generate.py
+	@rm build/${PROVIDER}/snap/data.json build/${PROVIDER}/snap/snapcraft-template.yaml
+	@mkdir -p build/${PROVIDER}/snap/gui
+ifeq (${VENDOR_PATH}, providers)
+	@cp ${VENDOR_PATH}/${PROVIDER}/assets/icon.svg build/${PROVIDER}/snap/gui/icon.svg
+	@cp ${VENDOR_PATH}/${PROVIDER}/assets/icon.png build/${PROVIDER}/snap/gui/${PROVIDER}-vpn.png
+else
+	@cp ${VENDOR_PATH}/assets/icon.svg build/${PROVIDER}/snap/gui/icon.svg
+	@cp ${VENDOR_PATH}/assets/icon.png build/${PROVIDER}/snap/gui/${PROVIDER}-vpn.png
+endif
+	@rm build/${PROVIDER}/snap/generate.py
+endif
+
+
+#########################################################################
+# packaging action
+#########################################################################
+run:
+	./build/qt/release/riseup-vpn
 
-locales/%/out.gotext.json: pkg/systray/systray.go pkg/systray/notificator.go pkg/bitmask/standalone.go pkg/bitmask/bitmaskd.go
-	gotext extract -lang=$* ./pkg/systray ./pkg/bitmask
+builder_image:
+	@${MAKE} -C docker build
 
-cmd/bitmask-vpn/catalog.go: $(foreach lang,$(LANGS),locales/$(lang)/messages.gotext.json)
-	gotext update -lang=$(lang_list) -out cmd/bitmask-vpn/catalog.go ./pkg/systray ./pkg/bitmask
+packages: package_deb package_snap package_osx package_win
+
+package_win_release: build dosign installer sign_installer
+
+package_win: build installer
+
+package_snap_in_docker:
+	@${MAKE} -C docker package_snap
+
+package_snap:
+	@-unlink snap
+	@cp build/${PROVIDER}/snap/local/${TARGET}.desktop build/${PROVIDER}/snap/gui/
+	@ln -s build/${PROVIDER}/snap snap
+	@${MAKE} -C build/${PROVIDER} pkg_snap
+
+prepare_deb:
+	@${MAKE} -C build/${PROVIDER} prepare_deb
+
+package_deb:
+	@${MAKE} -C build/${PROVIDER} pkg_deb
+
+package_arch:
+	grep -q "Arch Linux" /etc/os-release || (echo "Arch Linux system is required to build the Arch Linux package" && exit 1)
+	# at least the makepkg binary is mandatory, makepkg is part pacman package
+	(cd ArchLinux && makepkg --syncdeps --noconfirm)
+
+sign_artifact:
+	@find ${FILE} -type f -not -name "*.asc" -print0 | xargs -0 -n1 -I{} sha256sum -b "{}" | sed 's/*deploy\///' > ${FILE}.sha256
+	@gpg --clear-sign --armor ${FILE}.sha256
+
+upload_artifact:
+	scp ${FILE} downloads.leap.se:./
+	scp ${FILE}.sha256.asc downloads.leap.se:./
+
+
+#########################################################################
+# icons & locales
+#########################################################################
+
+icon:
+	@${MAKE} -C icon
+
+
+LANGS ?= $(foreach path,$(wildcard gui/i18n/main_*.ts),$(patsubst gui/i18n/main_%.ts,%,$(path)))
+
+locales: $(foreach lang,$(LANGS),get_$(lang))
+
+generate_locales:
+	@lupdate bitmask.pro
 
 get_%:
-	make -C tools/transifex build
-	curl -L -X GET --user "api:${API_TOKEN}" "https://www.transifex.com/api/2/project/bitmask/resource/RiseupVPN/translation/${subst -,_,$*}/?file" | tools/transifex/transifex t2g locales/$*/
+	@curl -L -X GET --user "api:${API_TOKEN}" "https://www.transifex.com/api/2/project/bitmask/resource/bitmask-desktop/translation/${subst -,_,$*}/?file" > gui/i18n/main_$*.ts

README.md

-Install it
-----------
+# Bitmask - Desktop client
+
+## Supported operating systems
+
+**Bitmask** needs the following minimum versions of supported operating systems:
+
+### On Windows
+
+**Bitmask** has been tested to work on windows 10 and 11 it might not work on earlier version of windows.
+
+### On MacOS
+
+- **Bitmask** has been tested to work on last three releases of MacOS (Monteray, Ventura and Sonoma)
+- **Bitmask** currently needs rossetta to be enable to work on Apple hardware (M1, M2)
+
+### On Linux
+
+- **Bitmask** has been tested to work on the latest version of Debian, Ubuntu, Fedora and Arch Linux
+- Packages are only available for Ubuntu, Debian and Arch Linux
+
+## Install
+
+## Build
+
+Clone this repo, install dependencies and build the application. Dependencies assume debian packages, or homebrew for osx. For Windows OS see corresponding section below. For other systems try manually, or send us a patch. bitmask-vpn can be branded for a specific provider by specifying the env variable PROVIDER during the build process; we currently support three providers: riseup, calyx, and bitmask. To create a client branded for 'riseup', run:
 
-Install dependencies:
 ```
-  # apt install libgtk-3-dev libappindicator3-dev golang pkg-config
+git clone git@0xacab.org:leap/bitmask-vpn.git && cd bitmask-vpn
+sudo make depends  # do not use sudo in osx 
+PROVIDER=riseup make vendor
+make build
+sudo build/qt/release/riseup-vpn --install-helpers # on Linux and Mac
+LOG_LEVEL=TRACE build/qt/release/riseup-vpn
 ```
 
-Build the systray:
+With `--install-helpers` the `bitmask-root` helper gets copied to `/usr/sbin`.
+
+# Ubuntu
+
+If you're using Ubuntu, you can use [leapcodes ppa](https://launchpad.net/~leapcodes/+archive/ubuntu/riseup-vpn).
+
 ```
-  $ git clone 0xacab.org/leap/bitmask-vpn
-  $ cd bitmask-systray
-  $ go get .
-  $ go build
+sudo add-apt-repository ppa:leapcodes/riseup-vpn
+sudo apt update
+sudo apt install riseup-vpn
 ```
 
-To be able to build the assets you'll need:
+# Debian
+
+The package is available as "riseup-vpn" in Debian Bookworm, albeit at an older version. To get the same, you could run:
+
 ```
-  $ go get -u golang.org/x/text/cmd/gotext github.com/cratonica/2goarray
+sudo apt install riseup-vpn
 ```
 
-OSX
-----------
-Using homebrew:
+The latest version is available for Debian Bookworm via backports. See the [offcial page](https://backports.debian.org/Instructions/) for instructions on how to set it up. If you are using Debian Testing/Unstable, riseup-vpn's latest version is available there as well.
+
+If you're using an older version of Debian, then we do not have a package for the same. However, if you really desire a debian package you can build your own for the time being:
 
 ```
-  $ brew install golang zmq pkg-config
-  $ brew install --default-names gnu-sed
-  $ git clone 0xacab.org/leap/bitmask-vpn
-  $ cd bitmask-systray
-  $ go get .
-  $ go build
+debuild -us -uc
+sudo dpkg -i ../riseup-vpn*.deb
+```
 
+You can also run 
+```
+PROVIDER=riseup make vendor
+PROVIDER=riseup QMAKE=qmake6 make package_deb
 ```
+Then install the built package with `apt install -f ./deploy/*.deb`.
+
+
+# Arch Linux
+
+There are two AUR packages for Arch Linux. There is [riseup-vpn-git](https://aur.archlinux.org/packages/riseup-vpn-git) that tracks main branch, so expect some instabilities (early birds catch the bugs they say, and we're thankful for that). There is also [riseup-vpn](https://aur.archlinux.org/packages/riseup-vpn) with the latest stable release.
 
-Linux
-----------
-Building the systray in linux will produce some `-Wdeprecated-declarations` warnings, like that:
 ```
-cgo-gcc-prolog: In function ‘_cgo_3f9f61f961c9_Cfunc_gtk_font_button_get_font_name’:
-cgo-gcc-prolog:5455:2: warning: ‘gtk_font_button_get_font_name’ is deprecated [-Wdeprecated-declarations]
-In file included from /usr/include/gtk-3.0/gtk/gtk.h:106:0,
-                 from ../../../go/src/github.com/gotk3/gotk3/gtk/gtk.go:48:
-/usr/include/gtk-3.0/gtk/gtkfontbutton.h:96:23: note: declared here
- const gchar *         gtk_font_button_get_font_name  (GtkFontButton *font_button);
-                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+yay riseup-vpn
 ```
-They are expected and don't produce any problem on the systray.
 
+## Snap
 
-Run it
--------------
-The default build is a standalone systray. It still requires a helper and openvpn installed to work. For linux the helper is
-[bitmask-root](https://0xacab.org/leap/bitmask-dev/blob/master/src/leap/bitmask/vpn/helpers/linux/bitmask-root)
-for windows and OSX there is [a helper written in go](https://0xacab.org/leap/riseup_vpn/tree/master/helper).
+There is also a package in the [Snap store](https://snapcraft.io/riseup-vpn).
 
-To build and run it:
 ```
-  $ go build
-  $ ./bitmask-systray
+sudo snap install riseup-vpn
 ```
 
+## Build
+
+Clone this repo, install dependencies and build the application. Dependencies assume debian packages, or homebrew for osx. For Windows OS see corresponding section below. For other systems try manually, or send us a patch. bitmask-vpn can be branded for a specific provider by specifying the env variable PROVIDER during the build process; we currently support three providers: riseup, calyx, and bitmask. To create a client branded for 'riseup', run:
 
-Bitmaskd
--------------
-Is also posible to compile the systray to use bitmask as backend:
 ```
-  $ go build -tags bitmaskd
+git clone git@0xacab.org:leap/bitmask-vpn.git && cd bitmask-vpn
+sudo make depends  # do not use sudo in osx 
+PROVIDER=riseup make vendor
+make build
 ```
 
-In that case bitmask-systray assumes that you already have bitmaskd running. Run bitmask and the systray:
+To build you need at least go 1.22.
+
+## Test
+
+You can run some tests too.
+
 ```
-  $ bitmaskd
-  $ ./bitmask-systray
+sudo apt install qml-module-qttest
+make test
+make test_ui
 ```
 
+## Windows
+As for now app can be build on Win OS using `Cygwin` terminal.
 
-i18n
-----
+#### Precondition
+You need to have installed and added to your user PATH (mentioned version tested in Win10):
+1) Go (>= go1.20)
+2) QT (>= Qt6.6)
+3) QtIFW (>= QtIFW-4.0.0)
+4) Cygwin64 (>= 2.905 64 bit)
+5) Using Cygwin `Package Select` window install `python3` and `make` packages. 
 
-Generate `locales/*` files:
+**Note:** for \#5 you don't need to add packages to PATH they will available in `cygwin` after installation.
+
+#### Get Source
 ```
-  $ make generate_locales LANGS="sjn tlh"
+git clone git@0xacab.org:leap/bitmask-vpn.git && cd bitmask-vpn
 ```
 
-Edit the `locales/*/out.gotext.json` translations into `locales/*/messages.gotext.json`.
+#### Build
+Build script uses a symbolic link in one of the stages. Unfortunately Cygwin can't create native symlink from local non   
+admin user due to windows security restriction. To avoid this issue we need to call next target from cygwin terminal as   
+Administrator. This need to be done only once. 
+```bash
+make relink_vendor
+```
 
-To rebuild the locales:
+After `relink_vendor` use this to build the app:
+```bash
+make build
 ```
-  $ make locales
+After successful build application will be available at: `build/qt/release/riseup-vpn.exe`
+
+#### Test
+
+To run tests:
+
+```bash
+make test
+make test_ui
 ```
 
+## Logging
+
+Log files:
+Linux: `~/.config/leap/systray.log`
+Windows: `%LocalAppData%\leap\systray.log  `
+Mac: `~/Library/Preferences/leap/systray.log`
+
+Log levels can be set via environment variable (`LOG_LEVEL=TRACE`, `LOG_LEVEL=DEBUG`, default log level is `INFO`). The cpp/qml part logs to stderr if env `DEBUG=1` is set. If `OPENVPN_LOG_TO_FILE=1` is set, the OpenVPN process writes its logs to [os.TempDir()](https://pkg.go.dev/os#TempDir)/leap-vpn.log. The verbosity of OpenVPN can be specified with env `OPENVPN_VERBOSITY` (sets `--verb`).
+
+Translations
+------------
+
+We use [transifex](https://www.transifex.com/otf/bitmask/bitmask-desktop/) to coordinate translations. Any help is welcome!
+
+
+Bugs? Crashes? UI feedback? Any other suggestions or complains?
+---------------------------------------------------------------
 
-Report an issue
--------------------
+When you are willing to [report an issue](https://0xacab.org/leap/bitmask-vpn/-/issues) please
+use the search tool first. if you cannot find your issue, please make sure to
+include the following information:
 
-When you report an issue include the following information:
-* what you expected to see
-* what you got
-* the version of the program. You can check the version on the about page.
+* the platform you're using and the installation method.
+* the version of the program. You can check the version on the "about" menu.
+* what you expected to see.
+* what you got instead.
 * the logs of the program. The location of the logs depends on the OS:
-  * linux: `/home/<your user>/.config/leap/bitmaskd.log` & `/home/<your user>/.config/leap/systray.log`
+  * gnu/linux: `/home/<your user>/.config/leap/systray.log`
   * OSX: `/Users/<your user>/Library/Preferences/leap/systray.log`, `/Applications/RiseupVPN.app/Contents/helper/helper.log` & `/Applications/RiseupVPN.app/Contents/helper/openvpn.log`
   * windows: `C:\Users\<your user>\AppData\Local\leap\systray.log`, `C:\Program Files\RiseupVPN\helper.log` & `C:\Program Files\RiseupVPN\openvp.log`

bitmask.pro

+TARGET = $$TARGET
+
+QT += quickcontrols2 svg
+CONFIG += qt staticlib
+CONFIG += c++17 strict_c++
+CONFIG += qtquickcompiler
+
+RELEASE = $$RELEASE
+
+equals(RELEASE, "yes") {
+    message("[qmake] doing release build")
+    CONFIG += release
+    # debug_and_release is default on windows
+    # and needs to be explicitly disabled
+    win32:CONFIG -= debug_and_release
+} else {
+    message("[qmake] doing debug build")
+    CONFIG += force_debug_info
+    CONFIG += debug_and_release
+}
+
+windows:CONFIG -= console
+lessThan(QT_MAJOR_VERSION, 5): error("requires Qt 5")
+QMAKE_MACOSX_DEPLOYMENT_TARGET = 12
+QMAKE_TARGET_BUNDLE_PREFIX = se.leap
+QMAKE_BUNDLE = $$TARGET
+
+# The following define makes your compiler emit warnings if you use
+# any feature of Qt which as been marked deprecated (the exact warnings
+# depend on your compiler). Please consult the documentation of the
+# deprecated API in order to know how to port your code away from it.
+DEFINES += QT_DEPRECATED_WARNINGS
+
+!defined(VENDOR_PATH, var):VENDOR_PATH="providers/riseup"
+
+message("[qmake] VENDOR_PATH: $$VENDOR_PATH")
+
+RESOURCES += gui/gui.qrc
+RESOURCES += $$VENDOR_PATH/vendor.qrc
+
+ICON = $$VENDOR_PATH/icon.png
+
+macx {
+    ICON = $$VENDOR_PATH/assets/icon.icns
+    LIBS += -framework Security -framework CoreFoundation -lresolv
+}
+win32 {
+    RC_ICONS = $$VENDOR_PATH/assets/icon.ico
+}
+
+QT += qml widgets quick
+
+SOURCES += \
+    gui/main.cpp \
+    gui/qjsonmodel.cpp \
+    gui/handlers.cpp
+
+
+HEADERS += \
+    gui/handlers.h \
+    gui/qjsonmodel.h \
+    lib/libgoshim.h
+
+# we build from build/qt
+LIBS += -L../../lib -lgoshim -lpthread
+
+DESTDIR = release
+OBJECTS_DIR = release/.obj
+MOC_DIR = release/.moc
+RCC_DIR = release/.rcc
+UI_DIR = release/.ui
+
+Release:DESTDIR = release
+Release:OBJECTS_DIR = release/.obj
+Release:MOC_DIR = release/.moc
+Release:RCC_DIR = release/.rcc
+Release:UI_DIR = release/.ui
+
+Debug:DESTDIR = debug
+Debug:OBJECTS_DIR = debug/.obj
+Debug:MOC_DIR = debug/.moc
+Debug:RCC_DIR = debug/.rcc
+Debug:UI_DIR = debug/.ui
+
+DISTFILES += \
+    README.md
+
+CONFIG += lrelease embed_translations
+
+TRANSLATIONS += $$files(gui/i18n/*.ts, true)
+RESOURCES += $$files(gui/i18n/*.qm, true)
+
+# see https://stackoverflow.com/questions/5960192/qml-qt-openurlexternally#5960581
+# Needed for bringing browser from background to foreground using
+# QDesktopServices: https://bugreports.qt.io/browse/QTBUG-8336
+TARGET.CAPABILITY += SwEvent

branding/motd-cli/.gitignore

+motd-cli

branding/motd-cli/README.md

+MOTD (message of the day)
+=========================
+
+This is a stub until a more sophisticated motd mechanism can be implemented in
+the future, with better platform integration.
+
+Providers can opt-in to the motd feature (only riseup is using it at the moment).
+
+If motd is enabled for a given provider, the client will attempt to fetch
+the motd.json file from a well-known URL, and will display the first valid
+message on the splash screen.
+
+The structure of the `motd.json` file is like follows:
+
+```
+{
+    "motd": [{
+        "begin":    "01 Nov 21 00:00 -0700",
+        "end":      "31 Jan 22 00:00 -0700",
+        "type":     "daily",
+        "platform": "all",
+        "urgency":  "normal",
+        "text": [
+          { "lang": "en",
+            "str": "This is a <a href='https://leap.se'>test!</a>"},
+          { "lang": "es",
+            "str": "Esto es una <a href='https://leap.se'>pruebita!</a>"}
+        ]}
+    ]
+}
+```
+
+Valid values are: 
+
+* Begin, End are date strings, in the format: "01 Jan 21 00:00:00 -0700".
+* Type: "once" for a one-shot message, "daily" for a message that is displayed daily during the specified duration.
+* Platform: one of "windows", "osx", "snap", "linux", or "all".
+* Urgency: either "normal" or "critical".
+
+The text message can contain links.
+
+You can use the `motd-cli` tool in this folder to parse and validate the json:
+
+```
+go build
+❯ ./motd-cli
+file: motd-example.json
+count: 1
+
+Message 1 ✓
+-----------
+Type: daily ✓
+Platform: all ✓
+Urgency: normal ✓
+Languages: 2 ✓
+```
+
+Use `motd-cli -url https://example.com/motd.json` to validate a remote file.
+
+Notes: I'm considering adding an explicit layer of verification of the motd
+payload. Please comment on
+[#554](https://0xacab.org/leap/bitmask-vpn/-/issues/554) if you have an opinion
+on this.

branding/motd-cli/main.go

+package main
+
+import (
+	"flag"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"path/filepath"
+
+	"0xacab.org/leap/bitmask-vpn/pkg/motd"
+)
+
+const OK = "✓"
+const WRONG = "☓"
+
+func main() {
+	file := flag.String("file", "", "file to validate")
+	url := flag.String("url", "", "url to validate")
+	flag.Parse()
+
+	f := *file
+	u := *url
+
+	var m motd.Messages
+	var err error
+
+	if u != "" {
+		fmt.Println("url:", u)
+		f = downloadToTempFile(u)
+	} else {
+		if f == "" {
+			f = filepath.Join("../../pkg/motd/", motd.ExampleFile)
+		}
+		fmt.Println("file:", f)
+	}
+	m, err = motd.ParseFile(f)
+	if err != nil {
+		panic(err)
+	}
+	fmt.Printf("count: %v\n", m.Length())
+	fmt.Println()
+	for i, msg := range m.Messages {
+		fmt.Printf("Message %d %v\n-----------\n", i+1, mark(msg.IsValid()))
+		fmt.Printf("Type: %s %v\n", msg.Type, mark(msg.IsValidType()))
+		fmt.Printf("Platform: %s %v\n", msg.Platform, mark(msg.IsValidPlatform()))
+		fmt.Printf("Urgency: %s %v\n", msg.Urgency, mark(msg.IsValidUrgency()))
+		fmt.Printf("Languages: %d %v\n", len(msg.Text), mark(msg.HasLocalizedText()))
+		for _, t := range msg.Text {
+			fmt.Printf(t.Str)
+		}
+		if !msg.IsValid() {
+			os.Exit(1)
+		}
+	}
+}
+
+func downloadToTempFile(url string) string {
+	resp, err := http.Get(url)
+	if err != nil {
+		panic(err)
+	}
+	defer resp.Body.Close()
+
+	out, err := ioutil.TempFile("/tmp/", "motd-linter")
+	if err != nil {
+		panic(err)
+	}
+	defer out.Close()
+
+	_, _ = io.Copy(out, resp.Body)
+	fmt.Println("File downloaded to", out.Name())
+	return out.Name()
+}
+
+func mark(val bool) string {
+	if val {
+		return OK
+	} else {
+		return WRONG
+	}
+}

branding/motd-cli/motd.json

+{
+    "motd": [{
+        "begin":    "01 Nov 21 00:00 -0700",
+        "end":      "31 Jan 22 00:00 -0700",
+        "type":     "daily",
+        "platform": "all",
+        "urgency":  "normal",
+        "text": [
+          { "lang": "en",
+            "str": "%20___________%0A%3C%20RiseupVPN%20%3E%0A%20-----------%0A%20%20%20%20%20%20%20%20%5C%20%20%20%5E__%5E%0A%20%20%20%20%20%20%20%20%20%5C%20%20%28oo%29%5C_______%0A%20%20%20%20%20%20%20%20%20%20%20%20%28__%29%5C%20%20%20%20%20%20%20%29%5C%2F%5C%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7C%7C----w%20%7C%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7C%7C%20%20%20%20%20%7C%7C"},
+          { "lang": "es",
+            "str": "¡Gracias por usar RiseupVPN! Por favor reportanos <a href='https://0xacab.org/leap/bitmask-vpn'>cualquier bug o petición</a>."}
+        ]}
+    ]
+}

branding/scripts/ASSETS_REQUIRED

+icon.svg
+icon.ico
+icon.icns

branding/scripts/TODO

+-[ ] sanity check scrit
+-[ ] assets convertion script