Compare revisions

4fd7c1a9 · 035cf4ef · 4c87c1a5 · a3a74d2e · f3d6cc6b · 5a8bee2c
--- a/.gitattributes
+++ b/.gitattributes
+/pkg/config/version/version.go export-subst
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
+name: 'mac and windows nightly build'
+# **What it does**: Generate unsigned macOS app and installer artifacts.
+# **Why we have it**: To build nightlies.
+# **Who does it impact**: Release/test.
+on:
+  workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+      provider_name:
+        description: 'The name of the providers branding that needs to be applied to the GUI app'
+        required: true
+        default: 'riseup'
+        type: choice
+        options:
+          - riseup
+          - calyx
+          - floatdemo
+          - demolib
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: '0 1 * * *'
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
+  cancel-in-progress: true
+jobs:
+  build-win:
+    defaults:
+      run:
+        shell: C:\msys64\usr\bin\bash.exe -e -o pipefail {0}
+    runs-on:
+      - windows-2019
+    steps:
+      - name: Setup Golang 1.22
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.22'
+      - name: Install build dependencies from chocolatey
+        run: choco install sigcheck aqt wget curl
+      - run: choco install qt-installer-framework --version 4.7.0
+      - run: git config --global core.autocrlf input
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Install Qt6 SDK using aqt
+        run: cd $USERPROFILE && aqt install-qt windows desktop 6.6.2 win64_mingw
+      - name: Build app
+        env:
+          PROVIDER: riseup
+        run: |
+          export PATH=$(cygpath $USERPROFILE/6.6.2/mingw_64/bin):$(cygpath $SYSTEMDRIVE/Qt/QtIFW-4.7.0/bin):$PATH
+          export PATH=$(cygpath $SYSTEMDRIVE/msys64/mingw64/bin):$(cygpath $SYSTEMDRIVE/msys64/usr/bin):$PATH
+          make vendor
+          make build
+          make installer
+      - name: Setup tmate session
+        if: ${{ failure() }}
+        uses: mxschmitt/action-tmate@v3
+      - name: Upload build/qt/release/riseup-vpn.exe
+        uses: actions/upload-artifact@v4
+        with:
+          name: riseup-vpn-exe-${{ github.sha }}
+          path: build/qt/release/riseup-vpn.exe
+      - name: Upload build/installer/RiseupVPN-installer-*.exe
+        uses: actions/upload-artifact@v4
+        with:
+          name: riseup-vpn-installer-${{ github.sha }}
+          path: build/installer/*.exe
+  build-mac:
+    strategy:
+      matrix:
+        os:
+          - macOS-13
+          - macOS-12
+          # - macOS-14 is broken becuase of missing openvpn build
+    runs-on:
+    - ${{ matrix.os }}
+    steps:
+      - name: Setup Golang 1.22
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.22'
+      - run: go version
+      - name: Install build dependencies from brew
+        run: brew install make create-dmg
+      - name: Install aqt installer
+        run: pipx install aqtinstall
+      - name: Setup Qt6 using aqt
+        run: aqt install-qt mac desktop 6.6.2 clang_64 -O ~/Qt6
+      - name: Install Qt installer framework
+        run: >
+          cd /tmp &&
+          curl -LO https://download.qt.io/official_releases/qt-installer-framework/4.7.0/QtInstallerFramework-macOS-x64-4.7.0.dmg &&
+          hdiutil attach QtInstallerFramework-macOS-x64-4.7.0.dmg &&
+          cd /Volumes/QtInstallerFramework-macOS-x64-4.7.0/QtInstallerFramework-macOS-x64-4.7.0.app/Contents/MacOS &&
+          ./QtInstallerFramework-macOS-x64-4.7.0 in --da -c --al
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-tags: true
+      - name: Build macOS installer
+        run: |
+          export PATH=~/Qt6/6.6.2/macos/bin:~/Qt/QtIFW-4.7.0/bin:$PATH
+          export PROVIDER=riseup
+          make vendor
+          make build
+          make installer
+      - name: Setup tmate session
+        if: ${{ failure() }}
+        uses: mxschmitt/action-tmate@v3
+      - name: Upload build/qt/release/riseup-vpn.app
+        uses: actions/upload-artifact@v4
+        with:
+          name: riseup-vpn-app-${{ github.sha }}-${{ matrix.os }}
+          path: build/installer/*.app
--- a/.gitignore
+++ b/.gitignore
@@ -11,6 +11,7 @@ cmd/bitmask-helper/bitmask-helper
 /bitmask-connect
 cmd/bitmask-connect/bitmask-connect
 gui/i18n/*.qm
+gui/providers/providers.json
 /snap
 locales/*/out.gotext.json
@@ -29,3 +30,9 @@ debian/files
 # IDE
 .idea
 .vs
+# Arch Linux package
+ArchLinux/src
+ArchLinux/pkg
+ArchLinux/bitmask-vpn
+ArchLinux/*.tar.zst
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
 ---
 stages:
+  - lint
  - build
-  - push
+  - package
-  - debian
-  - vendor
 build_test:
-  image: registry.0xacab.org/leap/bitmask-vpn:latest
+  image: registry.0xacab.org/jkito/bitmask-vpn:latest
  stage: build
  script:
-    - make generate
    - make test
+    - patch -p1 < docker/*.patch
    # TODO missing xcb package in the docker image. investigate what to install to run minimal tests.
    # - make test_ui
-    - make build
+    - PROVIDER=bitmask && make vendor && make build
  tags:
    - linux
  artifacts:
    paths:
-      - 'qtbuild/release/riseup-vpn'
+      - 'build/qt/release'
-    expire_in: 1 month
+    expire_in: 1 week
-# branded_push:
+lint:
-#   image: registry.0xacab.org/leap/bitmask-vpn:latest
+  image: golangci/golangci-lint:v1.59-alpine
-#   stage: push
+  stage: build
-#   only:
+  script:
-#       - master
+    - golangci-lint run --timeout=5m
-#   script:
+  tags:
-#     # install the command-line openssh client to manage private keys
+    - linux
-#     - apt install -y openssh-client
-#     # activate the ssh-agent
+build_macos:
-#     - eval $(ssh-agent -s)
+  stage: build
-#     # load the private key, which is accessed vi a gitlab CI secret environment variable
+  script:
-#     # We're using tr to fix line endings which makes ed25519 keys work
+    - export PROVIDER=riseup
-#     # without extra base64 encoding.
+    - make vendor
-#     - ssh-add <(echo "$RISEUP_VPN_PACKAGE_SSH_KEY")
+    - make -j4 build
-#     - mkdir -p ~/.ssh
+    - make installer
-#     # ensure that ssh will trust a new host, instead of asking
+  tags:
-#     - echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config
+    - macos
-#     # we also need to configure name and email for git user
+  artifacts:
-#     - git config user.name "Gitlab CI"
+    paths:
-#     - git config user.email "gitlabci@0xacab.org"
+      - 'build/installer/*.app'
-#     # Add the remote repository and push to it - sometimes it already exists, and it causes the pipeline to fail, so we only add if its not already there
+    expire_in: 1 week
-#     - git remote -v |grep -q riseup-vpn || git remote add riseup-vpn git@0xacab.org:leap/riseup-vpn_package.git
-#     - git push --force riseup-vpn HEAD:incoming
+build_Arch_Linux_package:
+  image: archlinux
+  stage: package
+  before_script:
+    - "pacman -Suy base-devel --noconfirm"
+    - "useradd non_root"
+    - "echo 'non_root ALL=NOPASSWD: ALL' >> /etc/sudoers"
+    - "mkdir -p /home/non_root/build"
+    - "cp -r . /home/non_root/build"
+    - "chown -R non_root:non_root /home/non_root"
+  script:
+    # makepkg does not run as root, but it needs sudo to install dependencies
+    - "cd /home/non_root/build && sudo -u non_root make package_arch"
+    - "cd /home/non_root/build && pacman -U ArchLinux/*tar.zst --noconfirm"
+    # artifacts must be relative to the working directory (e.g. /builds/leap/bitmask-vpn)
+    - "cp /home/non_root/build/ArchLinux/*.tar.zst $CI_PROJECT_DIR"
+  artifacts:
+    paths:
+      - '*.tar.zst'
+    expire_in: 1 week
+  tags:
+    - linux
-# trigger_deb:
+build_debian12_package:
-#   image: registry.0xacab.org/leap/buster_amd64:latest
+  stage: package
-#   stage: trigger
+  # we use backports because we need go1.22
-#   script:
+  image: debian:bookworm-backports
-#     - echo "Triggering CI pipeline on https://0xacab.org/leap/riseup-vpn_package/pipelines"
+  before_script:
-#     - "curl -X POST -F token=$RISEUP_VPN_DEB_TRIGGER_TOKEN -F ref=master https://0xacab.org/api/v4/projects/1916/trigger/pipeline"
+    - "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -q -y make sudo"
+    - "make depends"
+    - "DEBIAN_FRONTEND=noninteractive apt-get install -y -q golang-1.22"
+    - "update-alternatives --install /usr/bin/go go /usr/lib/go-1.22/bin/go 0"
+    - 'ln -s $(qmake6 -query "QT_INSTALL_BINS")/lrelease /usr/local/bin/lrelease'
+  script:
+    - "PROVIDER=bitmask make vendor"
+    - "PROVIDER=bitmask QMAKE=qmake6 make package_deb"
+    - "make clean"
+    - "PROVIDER=riseup make vendor"
+    - "PROVIDER=riseup QMAKE=qmake6 make package_deb"
+  after_script:
+    - "mv deploy/*.deb build/riseup/build"
+  artifacts:
+    paths:
+      - "build/riseup/build/"
+    expire_in: 1 week
+  tags:
+    - linux
-debian:
+build_ubuntu22_package:
-  # TODO use a buster builder image, but upgrade golang version for compatibility
+  stage: package
-  image: registry.0xacab.org/leap/bitmask-vpn:latest
+  image: ubuntu:22.04
-  stage: debian
+  before_script:
+    - "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -q -y software-properties-common make sudo"
+    - "add-apt-repository ppa:longsleep/golang-backports -y"
+    - "DEBIAN_FRONTEND=noninteractive apt-get install -y -q golang-go"
+    - "make depends"
+    - 'ln -s $(qmake6 -query "QT_INSTALL_BINS")/lrelease /usr/local/bin/lrelease'
  script:
-    - 'PROVIDER="riseup" make vendor && rm -rf .build && mkdir -p .build && rm -f *.deb && cp -dR * .build/. && cd .build && debuild -us -uc'
+    - "PROVIDER=bitmask make vendor"
+    - "PROVIDER=bitmask QMAKE=qmake6 make package_deb"
+    - "make clean"
+    - "PROVIDER=riseup make vendor"
+    - "PROVIDER=riseup QMAKE=qmake6 make package_deb"
+  after_script:
+    - "mv deploy/*.deb build/riseup/build"
  artifacts:
    paths:
-      - '*.deb'
+      - "build/riseup/build/"
+    expire_in: 1 week
+  tags:
+    - linux
-vendorize:
+build_ubuntu24_package:
-  image: registry.0xacab.org/leap/bitmask-vpn:latest
+  stage: package
-  stage: vendor
+  image: ubuntu:24.04
+  before_script:
+    - "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -q -y make sudo"
+    - "make depends"
+    - 'ln -s $(qmake6 -query "QT_INSTALL_BINS")/lrelease /usr/local/bin/lrelease'
  script:
-    #- TODO build_all_providers script can be rescued when we achieve to bring back xbuild for win/osx.
+    - "PROVIDER=bitmask make vendor"
-    # For now it only makes sense to build the snap.
+    - "PROVIDER=bitmask QMAKE=qmake6 make package_deb"
-    #- 'PROVIDERS="riseup calyx" make build_all_providers'
+    - "make clean"
-    - 'PROVIDER="riseup" make vendor && make package_snap'
+    - "PROVIDER=riseup make vendor"
+    - "PROVIDER=riseup QMAKE=qmake6 make package_deb"
+  after_script:
+    - "mv deploy/*.deb build/riseup/build"
  artifacts:
-    name: installers-$CI_COMMIT_REF_NAME
    paths:
-      - 'deploy/*.snap'
+      - "build/riseup/build/"
-#       - 'deploy/RiseupVPN-*.exe'
+    expire_in: 1 week
-#       - 'deploy/RiseupVPN-*.pkg'
+  tags:
-#       - 'deploy/riseup-vpn_*.deb'
+    - linux
-#       - 'deploy/CalyxVPN-*.exe'
-#       - 'deploy/CalyxVPN-*.pkg'
-#       - 'deploy/calyx-vpn_*.deb'
-    expire_in: 1 month
--- a/.golangci.yaml
+++ b/.golangci.yaml
+issues:
+  exclude-use-default: true
+  exclude-dirs-use-default: true
+  exclude-files:
+    - ".*\\.cpp$"
+    - ".*\\.h$"
+    - ".*\\.sh$"
+    - ".*\\.py$"
+    - ".*\\.qml$"
+  exclude-dirs:
+    - "gui"
+linters:
+  disable-all: true
+  enable:
+    - errcheck
+    - gosimple
+    - ineffassign
+    - govet
+    - unused
+    - gofmt
--- a/.tx/config
+++ b/.tx/config
+[main]
+host = https://rest.api.transifex.com
+lang_map = fa_IR: fa, kn_IN: kn
+[o:otf:p:bitmask:r:bitmask-desktop]
+source_file = gui/i18n/base.ts
+type = QT
+resource_name = LEAP Desktop VPN
+file_filter = gui/i18n/main_<lang>.ts
+minimum_perc = 80
--- a/ArchLinux/PKGBUILD
+++ b/ArchLinux/PKGBUILD
+# Maintainer: Pea <peanut2 [aaaaat] systemli [dooot] org>
+pkgname=bitmask-vpn-git
+pkgrel=1
+pkgdesc="Bitmask is an open source application to provide easy and secure encrypted communication with a VPN"
+pkgver=0.24.6.rc.1.r10.g4ee5fba
+arch=("x86_64")
+license=("GPL-3.0-only")
+url="https://0xacab.org/leap/bitmask-vpn"
+conflicts=('riseup-vpn' 'riseup-vpn-git')
+#source=("git+$url.git")
+source=("bitmask-vpn::git+file://$(pwd)/../")
+sha256sums=('SKIP')
+# qt6-tools has /usr/lib/qt6/bin/lrelease
+makedepends=('git' 'make' 'go' 'qt6-tools')
+depends=('qt6-base' 'qt6-declarative' 'qt6-svg' 'openvpn' 'python' 'lxsession' 'iptables')
+pkgver() {
+  cd bitmask-vpn
+  git describe --long --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
+}
+prepare() {
+  cd bitmask-vpn
+  export GOCACHE="$srcdir/GOCACHE"
+  PROVIDER=bitmask make vendor
+}
+build() {
+  cd bitmask-vpn
+  export GOCACHE="$srcdir/GOCACHE"
+  export CGO_CPPFLAGS="${CPPFLAGS}"
+  export CGO_CFLAGS="${CFLAGS}"
+  export CGO_CXXFLAGS="${CXXFLAGS}"
+  export CGO_LDFLAGS="${LDFLAGS}"
+  export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
+  export PROVIDER=bitmask
+  export QMAKE=qmake6
+  export LRELEASE=/usr/lib/qt6/bin/lrelease
+  make build -j $(nproc)
+}
+check() {
+  cd bitmask-vpn
+  export GOCACHE="$srcdir/GOCACHE"
+  CI="dont run integration tests as they are broken" make test
+}
+package() {
+  cd bitmask-vpn
+  install -Dm755 build/qt/release/bitmask-vpn "$pkgdir/usr/bin/bitmask-vpn"
+  install -Dm755 helpers/bitmask-root "$pkgdir/usr/bin/bitmask-root"
+  install -Dm644 helpers/se.leap.bitmask.policy "$pkgdir/usr/share/polkit-1/actions/se.leap.bitmask.policy"
+  install -Dm644 build/bitmask/debian/bitmask-vpn.desktop "$pkgdir/usr/share/applications/bitmask-vpn.desktop"
+  install -Dm644 build/bitmask/debian/icons/scalable/bitmask-vpn.png  "$pkgdir/usr/share/icons/hicolor/128x128/apps/bitmask-vpn.png"
+}
--- a/CHANGELOG
+++ b/CHANGELOG
+development
+===========
+- ...
+0.24.10
+=======
+- ui: use NumberAnimation for state change animation
+- update obfsvpn go module to v1.3.1-0.20241121155258-e6b06efc4456
+- [README] Print how to start bitmask-vpn after building it
+- [management] Add tests for parsing port of a management message
+- Log port of connected OpenVPN gateway
+- [management] Improve error handling in *StateEvent.parts()
+- show error message when app already running
+- remove use of deprecated ioutil module
+- fix crash during start when helper not installed
+- ovpn: don't redeclare status variable
+- ovpn: stop openvpn from management interface
+- Add introducer to storage before using it when supplied via env
+- Initialize and close bitmask-core storage
+- Improve error handling when checking downloaded pem cert
+- Update calls to DoGeolocationLookup after API change
+- Update to latest bitmask-core (commit 0812b9aadf98)
+- enable setting introducer url using env variable
+- chore: replace ioutil with io module
+- Strip port of menshen host before resolving with logDnsLookup
+- update l10n
+- create 0.24.10-rc.2 release
+- installer: get uid and gid only for macos
+- Update urls in provider config for bitmask provider
+- installer: get uid and gid only for macos
+- Update urls in provider config for bitmask provider
+- helper: use unix socket for local api
+- change obfsvpn version to v1.1.0
+- Do geolocation lookup
+- Add STUNServers countryCodeLookupURL fields to provider config (geolocation lookup)
+- [config] Clean code (move CaCert to global var list)
+- [menshen] Use NewConfigFromURL instead of NewConfig
+- Update bitmask-core dependency
+- Replace which with command -v
+- Update obfsvpn to v1.3.0
+- [bitmask-root] Don't redirect port 53 traffic of vpn gateways
+- [bitmask-root] Don't return generator in get_gateways
+- Fix log message that logs whitelisted gateway ip in firewall
+- config: enable UDP for openvpn by default
+- docs: add instructions for deb source package and uploading to ppa
+- deb: add intermediate makefile target to prepare deb package
+- Add python3 build dependency in control template
+- Update debian changelog template
+- deb: update patch for deb package to build with qt6.4
+- build: donot rename built app binary
+- build: pass in PROVIDER env variable to getparam script
+- installer: name helper launchd service based on app name
+- qmake: pass RELEASE variable to qmake invocation
+- build: use RELEASE_DIR for path to release build dir
+- qmake: configure for release builds when env RELEASE is yes
+- ci: donot manually apply patch in debian package jobs
+- ci: add gitlab ci job for building on macos
+- build: update openvpn build script to work on arm64 host
+- [Makefile] Don't overwrite QMAKE env when calling build.sh
+- [Makefile] Fix racecondition in Makefile
+- [Makefile] Remove install_go target
+- [Makefile] Add default target allinone (clean/vendor/build)
+- [Makefile] Use unlink only on Windows for make clean
+- Remove gui/providers/providers.json from git repo
+- ci: Remove debian job. Not needed anymore
+- ci: rename arch CI job to build_Arch_Linux_package
+- ci: build deb packages for Debian 12, Ubuntu 22.04 and Ubuntu 24.04
+- ci: Fix CI fail "toolchain not available"
+- ci: remove ineffective chmod from build step of macOS job
+0.24.8
+======
+- Reduces the size of splash screen image
+- Disable obfs4 and kcp checkbox in preferences for riseup
+- Removes duplicate languages in the language picker in preferences
+- Language picker in preferences shows languages sorted alphabetically
+- Updates translation files
+- Adds region to language selections menu when available
+- Improves UI responsiveness when connect or disconnect fails
+- Disable automatic openvpn connection during app start
+- Fixes a local privilege escalation security bug when using "--install-helpers"
+- Change bitmask branded app name to Bitmask from BitmaskVPN
+- Fixes bug where MOTD message box was not shown for RiseupVPN
+- Show bridge icon when KCP transport is selected
+- Show license page during installation
+- Uninstalls previous version before installing current version
+- Adds accessibility hints to connection button
+- Exposes KCP support in the UI
+- Adds new bitmask-vpn package for Arch Linux
+- Fixes a bug preventing use of the app by non-admin users on windows
+- Fixes a bug on macOS preventing users from manual location selection
+- Fixes a bug where the app's close routine was called twice
+- Fixes a bug where log file was not closed while quitting the app
+- Fixes a bug where the correct app name was not shown in installer error messages
+- Updates to latest obfsvpn
+- Updates to latest bitmask-core
+- Updates translation files
+- Adds missing iptables dependency to ubuntu package
+0.24.6-rc.1
+======
+- Adds better debug and informational logs
+- Partially implement menshen V5 API
+- Partially implements the new Bitmask and Riseup designs
+- Addition of PPA for ubuntu numbat
+- Adds timeout for http connections
+- Adds error checking to various places in the code
+0.24.5
+======
+- fix missing dependencies on .deb package
+- Shorten too long strings in translations
+- Fix bitmask branded windows UI and remove riseup crow from about
+- Connection status text width trimmed to be inside parent container
+- Bitmask branded desktop build pointing to demo instance of lillypad
+- Add Supported OS's to the readme
+- Update the debian package to build using Qt6
+- Update GUI to Qt6
+- Fix bitmask-helper install script for macOS and windows
 0.21.11
 =======
- Do not fail if ipv6 is disabled (GNU/Linux)
 - Complete UI revamp
+- Do not fail if ipv6 is disabled (GNU/Linux)
 - UDP support
 - Obfs4 support
- Experimental snowflake support for bootstrap
+- Experimental snowflake support for bootstrap (not exposed in UI yet)
- Disable autostart
+- Disable autostart on first run
+- Provider "message of the day"
+- primitive version check for windows, osx.
+- #569 avoid installing in custom paths to mitigate security issue in windows
 0.21.6

--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+cmake_minimum_required(VERSION 3.16)
+project(bitmask VERSION 1.0 LANGUAGES CXX)
+set(CMAKE_INCLUDE_CURRENT_DIR ON)
+find_package(QT NAMES Qt5 Qt6 REQUIRED)
+find_package(Qt${QT_VERSION_MAJOR} REQUIRED COMPONENTS Core Gui Qml Quick QuickControls2 Svg Widgets LinguistTools)
+find_library(LIB_TO_INCLUDE goshim lib)
+#qt_standard_project_setup()
+set(CMAKE_AUTOMOC ON)
+set(CMAKE_AUTOUIC ON)
+qt_add_executable(bitmask WIN32 MACOSX_BUNDLE
+    gui/handlers.cpp gui/handlers.h
+    gui/main.cpp
+    gui/qjsonmodel.cpp gui/qjsonmodel.h
+    lib/libgoshim.h
+)
+qt_add_qml_module(bitmask
+    URI bitmask
+    VERSION ${PROJECT_VERSION}
+    QML_FILES
+        gui/main.qml
+        gui/themes/themes.js
+        gui/themes/theme-riseup.js
+        gui/themes/Riseup.qml
+        gui/themes/theme-calyx.js
+        gui/themes/Calyx.qml
+        gui/themes/ThemeObject.qml
+        gui/components/MainView.qml
+        gui/components/ThemedPage.qml
+        gui/components/Splash.qml
+        gui/components/FadeBehavior.qml
+        gui/components/Home.qml
+        gui/components/Header.qml
+        gui/components/Footer.qml
+        gui/components/About.qml
+        gui/components/MaterialRadioButton.qml
+        gui/components/MaterialRadioIndicator.qml
+        gui/components/WrappedRadioButton.qml
+        gui/components/MaterialCheckBox.qml
+        gui/components/StatusBox.qml
+        gui/components/Systray.qml
+        gui/components/Help.qml
+        gui/components/Locations.qml
+        gui/components/SignalIcon.qml
+        gui/components/Preferences.qml
+        gui/components/BoldLabel.qml
+        gui/components/LightLabel.qml
+        gui/components/VPNButtonBase.qml
+        gui/components/VPNMouseArea.qml
+        gui/components/VerticalSpacer.qml
+        gui/components/Icon.qml
+        gui/components/MaterialButton.qml
+        gui/components/VPNState.qml
+        gui/components/InitErrors.qml
+        gui/components/ErrorBox.qml
+        gui/components/MotdBox.qml
+        gui/components/NavigationDrawer.qml
+    RESOURCES
+        gui/qtquickcontrols2.conf
+        gui/resources/icon-noshield.svg
+        gui/resources/location.svg
+        gui/resources/settings.svg
+        gui/resources/power.svg
+        gui/resources/language.svg
+        gui/resources/lightning.svg
+        gui/resources/close.svg
+        gui/resources/donate.svg
+        gui/resources/tools.svg
+        gui/resources/help.svg
+        gui/resources/about.svg
+        gui/resources/bridge.svg
+        gui/resources/gear-fill.svg
+        gui/resources/reception-0.svg
+        gui/resources/reception-2.svg
+        gui/resources/reception-4.svg
+        gui/resources/reception-0@24.svg
+        gui/resources/reception-4@24.svg
+        gui/resources/arrow-left.svg
+        gui/resources/globe.svg
+        gui/resources/spy.gif
+        gui/resources/quit.svg
+        gui/resources/alert.svg
+        gui/resources/angle-right.svg
+        gui/resources/snowflake.svg
+        gui/resources/ravens.svg
+        gui/resources/ravens.gif
+        gui/resources/riseup-icon.svg
+        gui/resources/calyx/calyx-shield-green.png
+        gui/resources/calyx/calyx-hand.png
+        gui/resources/calyx/calyx-red-shield.png
+        gui/resources/calyx/calyx-yellow-shield.png
+        gui/resources/fonts/Poppins-Regular.ttf
+        gui/resources/fonts/Poppins-Bold.ttf
+        gui/resources/fonts/Montserrat-SemiBold.ttf
+        gui/resources/fonts/Roboto-Regular.ttf
+        gui/resources/fonts/Roboto-Bold.ttf
+        gui/assets/icon/png/black/vpn_off.png
+        gui/assets/icon/png/black/vpn_on.png
+        gui/assets/icon/png/black/vpn_wait_0.png
+        gui/assets/icon/png/black/vpn_wait_1.png
+        gui/assets/icon/png/black/vpn_wait_2.png
+        gui/assets/icon/png/black/vpn_wait_3.png
+        gui/assets/icon/png/white/vpn_off.png
+        gui/assets/icon/png/white/vpn_on.png
+        gui/assets/icon/png/white/vpn_wait_0.png
+        gui/assets/icon/png/white/vpn_wait_1.png
+        gui/assets/icon/png/white/vpn_wait_2.png
+        gui/assets/icon/png/white/vpn_wait_3.png
+        gui/assets/img/bird.jpg
+        gui/providers/providers.json
+    NO_RESOURCE_TARGET_PATH
+    OUTPUT_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/release
+)
+set_source_files_properties("gui/providers/providers.json"
+    PROPERTIES QT_RESOURCE_ALIAS "providers.json"
+)
+set_source_files_properties("gui/resources/fonts/Montserrat-SemiBold.ttf"
+    PROPERTIES QT_RESOURCE_ALIAS "monserrat-bold.ttf"
+)
+set_source_files_properties("gui/resources/fonts/Poppins-Bold.ttf"
+    PROPERTIES QT_RESOURCE_ALIAS "poppins-bold.ttf"
+)
+set_source_files_properties("gui/resources/fonts/Poppins-Regular.ttf"
+    PROPERTIES QT_RESOURCE_ALIAS "poppins-regular.ttf"
+)
+set_source_files_properties("gui/resources/fonts/Roboto-Bold.ttf"
+    PROPERTIES QT_RESOURCE_ALIAS "roboto-bold.ttf"
+)
+set_source_files_properties("gui/resources/fonts/Roboto-Regular.ttf"
+    PROPERTIES QT_RESOURCE_ALIAS "roboto.ttf"
+)
+# Avoid collision between executable name and QML module directory (QTBUG-98568).
+if(NOT WIN32 AND NOT APPLE)
+    set_property(TARGET bitmask PROPERTY OUTPUT_NAME bitmask_app)
+endif()
+target_compile_definitions(bitmask PRIVATE
+    QT_DEPRECATED_WARNINGS
+)
+target_link_libraries(bitmask PRIVATE
+    # Remove: L../../lib
+    Qt::Core
+    Qt::Gui
+    Qt::Qml
+    Qt::Quick
+    Qt::QuickControls2
+    Qt::Svg
+    Qt::Widgets
+    ${LIB_TO_INCLUDE}
+    pthread
+)
+# Resources:
+set_source_files_properties("providers/riseup/assets/icon.svg"
+    PROPERTIES QT_RESOURCE_ALIAS "icon.svg"
+)
+set(vendor_resource_files
+    "providers/riseup/assets/icon.svg"
+)
+qt_add_resources(bitmask "vendor"
+    PREFIX
+        "/vendor/"
+    BASE
+        "providers/riseup"
+    FILES
+        ${vendor_resource_files}
+)
+qt_add_translations(bitmask TS_FILES
+    gui/i18n/base.ts
+    gui/i18n/main_de.ts
+    gui/i18n/main_el.ts
+    gui/i18n/main_es_ES.ts
+    gui/i18n/main_es-rAR.ts
+    gui/i18n/main_es.ts
+    gui/i18n/main_et.ts
+    gui/i18n/main_fa_IR.ts
+    gui/i18n/main_fi.ts
+    gui/i18n/main_fr.ts
+    gui/i18n/main_hu.ts
+    gui/i18n/main_it.ts
+    gui/i18n/main_lt.ts
+    gui/i18n/main_nl.ts
+    gui/i18n/main_pl.ts
+    gui/i18n/main_pt-rBR.ts
+    gui/i18n/main_ru.ts
+    gui/i18n/main_th.ts
+    gui/i18n/main_tr.ts
+    gui/i18n/main_ug.ts
+    gui/i18n/main_zh-rTW.ts
+    gui/i18n/main_zh.ts
+)
+if(MACOS)
+    target_link_libraries(bitmask PRIVATE
+        "-framework CoreFoundation"
+        "-framework Security"
+    )
+endif()
+install(TARGETS bitmask
+    BUNDLE DESTINATION .
+    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
+)
+qt_generate_deploy_qml_app_script(
+    TARGET bitmask
+    FILENAME_VARIABLE deploy_script
+    NO_UNSUPPORTED_PLATFORM_ERROR
+    DEPLOY_USER_QML_MODULES_ON_UNSUPPORTED_PLATFORM
+    MACOS_BUNDLE_POST_BUILD
+)
+install(SCRIPT ${deploy_script})
--- a/Makefile
+++ b/Makefile
@@ -3,7 +3,7 @@
 # (c) LEAP Encryption Access Project, 2019-2021
 #########################################################################
-.PHONY: all get build icon locales generate_locales clean check_qtifw HAS-qtifw relink_vendor
+.PHONY: all get build icon locales generate_locales clean check_qtifw HAS-qtifw relink_vendor fmt
 XBUILD ?= no
 RELEASE ?= no
@@ -11,8 +11,8 @@ QMAKE ?= qmake
 LRELEASE ?= lrelease
 SKIP_CACHECK ?= no
 VENDOR_PATH ?= providers
-APPNAME ?= $(shell VENDOR_PATH=${VENDOR_PATH} branding/scripts/getparam appname | tail -n 1)
+APPNAME ?= $(shell VENDOR_PATH=${VENDOR_PATH} PROVIDER=${PROVIDER} branding/scripts/getparam appname | tail -n 1)
-TARGET ?= $(shell VENDOR_PATH=${VENDOR_PATH} branding/scripts/getparam binname | tail -n 1)
+TARGET ?= $(shell VENDOR_PATH=${VENDOR_PATH} PROVIDER=${PROVIDER} branding/scripts/getparam binname | tail -n 1)
 PROVIDER ?= $(shell grep ^'provider =' ${VENDOR_PATH}/vendor.conf | cut -d '=' -f 2 | cut -d ',' -f 1 | tr -d "[:space:]")
 VERSION ?= $(shell git describe 2> /dev/null)
 ifeq ($(VERSION),)
@@ -26,6 +26,7 @@ OSXMORDORUID ?= uid
 GOPATH = $(shell go env GOPATH)
 TARGET_GOLIB=lib/libgoshim.a
 SOURCE_GOLIB=gui/backend.go
+SOURCE_DIRS_GO = pkg cmd gui
 # detect OS
 UNAME = $(shell uname -s)
@@ -37,7 +38,10 @@ endif
 QTBUILD = build/qt
 INSTALLER = build/installer
-OSX_CERT="Developer ID Application: LEAP Encryption Access Project"
+# See https://stackoverflow.com/a/65120256 if you have problems validating the cert.
+OSX_CERT="Apple Distribution: LEAP Encryption Access Project"
 MACDEPLOYQT_OPTS = -appstore-compliant -always-overwrite -codesign="${OSX_CERT}"
 ifeq ($(PLATFORM), darwin)
@@ -50,12 +54,12 @@ endif
 SCRIPTS = branding/scripts
 TEMPLATES = branding/templates
-TAP_WINDOWS = https://build.openvpn.net/downloads/releases/tap-windows-9.24.2-I601-Win10.exe 
+OPENVPN_WINDOWS_INSTALLER = https://build.openvpn.net/downloads/releases/OpenVPN-2.6.6-I001-amd64.msi
-ifeq ($(PLATFORM), windows)
+ifeq ($(PLATFORM), linux)
-HAS_QTIFW := $(shell which binarycreator.exe)
+HAS_QTIFW :=
 else
-HAS_QTIFW := $(shell PATH=$(PATH) which binarycreator)
+HAS_QTIFW := $(shell command -v binarycreator)
 endif
 OPENVPN_BIN = "$(HOME)/openvpn_build/sbin/$(shell grep OPENVPN branding/thirdparty/openvpn/build_openvpn.sh | head -n 1 | cut -d = -f 2 | tr -d '"')"
@@ -64,18 +68,19 @@ OPENVPN_BIN = "$(HOME)/openvpn_build/sbin/$(shell grep OPENVPN branding/thirdpar
 # go build
 #########################################################################
-install_go:
+.PHONY: allinone
-	# the version of go in bionic is too old. let's get something newer from a ppa.
+allinone: clean vendor build
-	@sudo apt install software-properties-common
-	@sudo add-apt-repository ppa:longsleep/golang-backports
-	@sudo apt-get update
-	@sudo apt-get install golang-go
 depends:
 	-@${MAKE} depends$(UNAME)
 dependsLinux:
-	@sudo apt install golang pkg-config dh-golang golang-golang-x-text-dev cmake devscripts fakeroot debhelper curl g++ qt5-qmake qttools5-dev-tools qtdeclarative5-dev qml-module-qtquick-controls2 libqt5qml5 qtdeclarative5-dev qtquickcontrols2-5-dev libqt5svg5-dev qml-module-qt-labs-platform qml-module-qtquick-extras qml-module-qtquick-dialogs
+	# install build dependencies (from branding/templates/debian/control-template)
+	@sudo apt-get install -y golang make pkg-config g++ git libqt6svg6-dev qt6-tools-dev qt6-tools-dev-tools qt6-base-dev libqt6qml6 qt6-declarative-dev dh-golang libgl-dev qt6-declarative-dev-tools qt6-l10n-tools
+	# install runtime dependencies (from branding/templates/debian/control-template)
+	@sudo apt-get install -y libqt6core6 libqt6gui6 libqt6qml6 libqt6widgets6 libstdc++6 libqt6svg6 qml6-module-qtquick qml6-module-qtquick-controls qml6-module-qtquick-dialogs qml6-module-qtquick-layouts qml6-module-qtqml-workerscript qml6-module-qtquick-templates qml6-module-qt-labs-settings qml6-module-qtquick-window qml6-module-qt-labs-platform qml6-module-qtcore qml6-module-qt5compat-graphicaleffects openvpn policykit-1-gnome python3 iptables
+	# needed to build debian package
+	@sudo apt-get install -y devscripts fakeroot
 	@${MAKE} -C docker deps
 	@# debian needs also: snap install snapcraft --classic; snap install  multipass --beta --classic
@@ -102,13 +107,23 @@ EXTRA_GO_LDFLAGS = "-H=windowsgui"
 endif
 ifeq ($(PLATFORM), windows)
-PKGFILES = $(wildcard "pkg/*") # syntax err in windows with find 
+PKGFILES = $(wildcard "pkg/*") # syntax err in windows with find
 else
 PKGFILES = $(shell find pkg -type f -name '*.go')
 endif
 lib/%.a: $(PKGFILES)
-	@XBUILD=no CC=${CC} CXX=${CXX} MAKE=${MAKE} AR=${AR} LD=${LD} ./gui/build.sh --just-golib
+	@XBUILD=no CC=${CC} VENDOR_PATH=${VENDOR_PATH} CXX=${CXX} MAKE=${MAKE} AR=${AR} LD=${LD} VERSION=${VERSION} ./gui/build.sh --just-golib
+# FIXME move platform detection above! no place to uname here, just use $PLATFORM
+#
+MINGGW =
+ifeq ($(UNAME), MINGW64_NT-10.0)
+MINGW = yes
+endif
+ifeq ($(UNAME), MINGW64_NT-10.0-19042)
+MINGW = yes
+endif
 relink_vendor:
 	@echo "============RELINK VENDOR============="
@@ -116,22 +131,16 @@ relink_vendor:
 	@echo "VENDOR_PATH: ${VENDOR_PATH}"
 	@echo "PROVIDER: ${PROVIDER}"
 ifeq ($(PLATFORM), windows)
-	@rm -rf providers/assets || true
+	@rm -rf providers/assets
-ifeq ($(UNAME), MINGW64_NT-10.0)
 ifeq ($(VENDOR_PATH), providers)
 	@cp -r providers/${PROVIDER}/assets providers/assets || true
-endif
+endif # end windows
-endif # end mingw
-ifeq ($(UNAME), CYGWIN_NT-10.0)
-	@[ -L providers/assets ] || (CYGWIN=winsymlinks:nativestrict ln -s ${PROVIDER}/assets providers/assets)
-endif # end cygwin
 else # not windows: linux/osx
 ifeq ($(VENDOR_PATH), providers)
-	@unlink providers/assets || true
+	@-unlink providers/assets
 	@ln -s ${PROVIDER}/assets providers/assets || true
 endif
 endif
 	@echo "============RELINK VENDOR============="
 build_golib: lib/libgoshim.a
@@ -140,15 +149,15 @@ build_gui: build_golib relink_vendor
 	@echo "==============BUILD GUI==============="
 	@echo "TARGET: ${TARGET}"
 	@echo "VENDOR_PATH: ${VENDOR_PATH}"
-	@XBUILD=no CC=${CC} CXX=${CXX} MAKE=${MAKE} AR=${AR} LD=${LD} QMAKE=${QMAKE} LRELEASE=${LRELEASE} TARGET=${TARGET} VENDOR_PATH=${VENDOR_PATH} APPNAME=${APPNAME} gui/build.sh --skip-golib
+	@XBUILD=no CC=${CC} CXX=${CXX} MAKE=${MAKE} AR=${AR} LD=${LD} LRELEASE=${LRELEASE} TARGET=${TARGET} VENDOR_PATH=${VENDOR_PATH} APPNAME=${APPNAME} gui/build.sh --skip-golib
 	@echo "============BUILD GUI================="
 build: build_helper build_gui
 build_helper:
-ifeq ($(PLATFORM), linux)
+ifeq ($(PLATFORM), darwin)
-# no helper needed for linux, we use polkit/bitmask-root
+	# no helper needed for linux, we use polkit/bitmask-root
-else
+	# no helper needed for windows, use openvpn interective service
 	@echo "=============BUILDER HELPER==========="
 	@echo "PLATFORM: ${PLATFORM}"
 	@echo "APPNAME: ${APPNAME}"
@@ -169,25 +178,19 @@ ifeq (${PLATFORM}, windows)
 	"c:\windows\system32\rcedit.exe" ${QTBUILD}/release/${TARGET}.exe --set-version-string CompanyName "LEAP Encryption Access Project"
 	"c:\windows\system32\rcedit.exe" ${QTBUILD}/release/${TARGET}.exe --set-version-string FileDescription "${APPNAME}"
 	"c:\windows\system32\signtool.exe" sign -debug -f "z:\leap\LEAP.pfx" -p ${WINCERTPASS} ${QTBUILD}/release/${TARGET}.exe
-	cp build/bin/${PLATFORM}/bitmask-helper build/bin/${PLATFORM}/bitmask-helper.exe
-	"c:\windows\system32\rcedit.exe" build/bin/${PLATFORM}/bitmask-helper.exe --set-file-version ${VERSION}
-	"c:\windows\system32\rcedit.exe" build/bin/${PLATFORM}/bitmask-helper.exe --set-product-version ${VERSION}
-	"c:\windows\system32\rcedit.exe" build/bin/${PLATFORM}/bitmask-helper.exe --set-version-string ProductName "bitmask-helper-v2"
-	"c:\windows\system32\rcedit.exe" build/bin/${PLATFORM}/bitmask-helper.exe --set-version-string CompanyName "LEAP Encryption Access Project"
-	"c:\windows\system32\rcedit.exe" build/bin/${PLATFORM}/bitmask-helper.exe --set-version-string FileDescription "Administrative helper for ${APPNAME}"
-	"c:\windows\system32\signtool.exe" sign -debug -f "z:\leap\LEAP.pfx" -p ${WINCERTPASS} build/bin/${PLATFORM}/bitmask-helper.exe
 endif
 checksign:
 ifeq (${PLATFORM}, windows)
-	@"c:\windows\system32\sigcheck.exe" ${QTBUILD}/release/${TARGET}.exe
+ifeq (${RELEASE}, yes)
-	@"c:\windows\system32\sigcheck.exe" build/bin/${PLATFORM}/bitmask-helper.exe
+	@sigcheck.exe ${QTBUILD}/release/${TARGET}.exe
-	@"c:\windows\system32\sigcheck.exe" "/c/Program Files/OpenVPN/bin/openvpn.exe"
+endif
 endif
 installer: check_qtifw checksign
 	@mkdir -p ${INST_DATA}
 	@cp -r ${TEMPLATES}/qtinstaller/packages ${INSTALLER}
+	@cp LICENSE ${INSTALLER}/packages/bitmaskvpn/meta/LICENSE.txt
 	@cp -r ${TEMPLATES}/qtinstaller/installer.pro ${INSTALLER}
 	@cp -r ${TEMPLATES}/qtinstaller/config ${INSTALLER}
 	@cp ${VENDOR_PATH}/assets/icon.ico ${INSTALLER}/config/installer-icon.ico
@@ -199,9 +202,8 @@ ifeq (${PLATFORM}, darwin)
 	@cp "${TEMPLATES}/osx/bitmask.pf.conf" ${INST_DATA}helper/bitmask.pf.conf
 	@cp "${TEMPLATES}/osx/client.up.sh" ${INST_DATA}/
 	@cp "${TEMPLATES}/osx/client.down.sh" ${INST_DATA}/
-	@cp "${TEMPLATES}/qtinstaller/osx-data/post-install.py" ${INST_ROOT}/
+	@go build -ldflags='-w -s' -o "${INST_ROOT}/post-install" "${TEMPLATES}/qtinstaller/osx-data/post-install.go"
-	@cp "${TEMPLATES}/qtinstaller/osx-data/uninstall.py" ${INST_ROOT}/
+	@[ -f $(OPENVPN_BIN) ] && echo "OpenVPN already built at" $(OPENVPN_BIN) || ./branding/thirdparty/openvpn/build_openvpn.sh
-	@cp "${TEMPLATES}/qtinstaller/osx-data/se.leap.bitmask-helper.plist" ${INST_DATA}
 	@cp $(OPENVPN_BIN) ${INST_DATA}/openvpn.leap
 	@cp build/bin/${PLATFORM}/bitmask-helper ${INST_DATA}/
 ifeq (${RELEASE}, yes)
@@ -214,26 +216,24 @@ endif
 	@cp -r "${QTBUILD}/release/${TARGET}.app"/ ${INST_DATA}/
 endif
 ifeq (${PLATFORM}, windows)
+	@wget ${OPENVPN_WINDOWS_INSTALLER} -O ${INST_DATA}/openvpn-installer.msi
 	@VERSION=${VERSION} VENDOR_PATH=${VENDOR_PATH} ${SCRIPTS}/gen-qtinstaller windows ${INSTALLER}
-	@cp build/bin/${PLATFORM}/bitmask-helper.exe ${INST_DATA}helper.exe
 ifeq (${VENDOR_PATH}, providers)
 	@cp ${VENDOR_PATH}/${PROVIDER}/assets/icon.ico ${INST_DATA}/icon.ico
 else
 	@cp ${VENDOR_PATH}/assets/icon.ico ${INST_DATA}/icon.ico
 endif
 	@cp ${QTBUILD}/release/${TARGET}.exe ${INST_DATA}${TARGET}.exe
-	# FIXME get the signed binaries with curl from openvpn downloads page.
-	@cp "/c/Program Files/OpenVPN/bin/openvpn.exe" ${INST_DATA}
-	@cp "/c/Program Files/OpenVPN/bin/"*.dll ${INST_DATA}
 ifeq (${RELEASE}, yes)
-	#@windeployqt --release --qmldir gui/qml ${INST_DATA}${TARGET}.exe
+	@windeployqt --qmldir gui/components ${INST_DATA}${TARGET}.exe
-	#FIXME -- cannot find platform plugin
-	@windeployqt --qmldir gui/qml ${INST_DATA}${TARGET}.exe
 else
-	@windeployqt --qmldir gui/qml ${INST_DATA}${TARGET}.exe
+	@windeployqt --qmldir gui/components ${INST_DATA}${TARGET}.exe
 endif
-	# TODO stage it to shave some time
+	# XXX this is a workaround for missing libs after windeployqt ---
-	@wget ${TAP_WINDOWS} -O ${INST_DATA}/tap-windows.exe
+	@cp $(shell cygpath $(shell ${QMAKE} -query 'QT_INSTALL_BINS'))/libgcc_s_seh-1.dll ${INST_DATA}
+	@cp $(shell cygpath $(shell ${QMAKE} -query 'QT_INSTALL_BINS'))/libstdc++-6.dll ${INST_DATA}
+	@cp $(shell cygpath $(shell ${QMAKE} -query 'QT_INSTALL_BINS'))/libwinpthread-1.dll ${INST_DATA}
+	@cp -r $(shell cygpath $(shell ${QMAKE} -query 'QT_INSTALL_QML')) ${INST_DATA}
 endif
 ifeq (${PLATFORM}, linux)
 	@VERSION=${VERSION} ${SCRIPTS}/gen-qtinstaller linux ${INSTALLER}
@@ -293,7 +293,13 @@ endif
 clean:
 	@rm -rf lib/*
 	@rm -rf build/
-	@unlink branding/assets/default || true
+ifeq ($(PLATFORM), windows)
+	# Need to use unlink on Windows for permission reasons
+	@-unlink branding/assets/default
+else
+	@rm -rf branding/assets/default
+endif
+	@cd ArchLinux && rm -rf bitmask-vpn pkg src *.tar.zst
 ########################################################################
@@ -311,6 +317,13 @@ qmlfmt:
 test:
 	@go test -tags "integration $(TAGS)" ./pkg/...
+fmt:
+	@gofmt -s -w $(SOURCE_DIRS_GO)
+.PHONY: lint
+lint:
+	golangci-lint run  --timeout=5m
 test_ui: build_golib
 	@${QMAKE} -o tests/Makefile test.pro
 	@${MAKE} -C tests clean
@@ -326,6 +339,15 @@ endif
 # packaging templates
 #########################################################################
+bump_snap:
+	@sed -i 's/^version:.*$$/version: ${VERSION}/' snap/snapcraft.yaml
+	@sed -i 's/^.*echo .*version.txt$$/        echo ${VERSION} > $$SNAPCRAFT_PRIME\/snap\/version.txt/' snap/snapcraft.yaml
+local_snap:
+	# just to be able to debug stuff locally in the same way as it's really built @canonical
+	# but multipass is the way to go, nowadays
+	@snapcraft --debug --use-lxd
 vendor_init:
 	@VENDOR_PATH=${VENDOR_PATH} ./branding/scripts/init
@@ -340,43 +362,43 @@ vendor: gen_providers_json prepare_templates gen_pkg_snap gen_pkg_deb
 gen_providers_json:
 	@VENDOR_PATH=${VENDOR_PATH} branding/scripts/gen-providers-json gui/providers/providers.json
-prepare_templates: generate tgz
+prepare_templates: tgz
 	@mkdir -p build/${PROVIDER}/bin/ deploy
 	@cp ${TEMPLATES}/makefile/Makefile build/${PROVIDER}/Makefile
 	@VERSION=${VERSION} VENDOR_PATH=${VENDOR_PATH} ${SCRIPTS}/generate-vendor-make build/${PROVIDER}/vendor.mk
-generate:
-	@go generate gui/backend.go
-	@go generate pkg/config/version/genver/gen.go
 TGZ_NAME = bitmask-vpn_${VERSION}-src
-TGZ_PATH = $(shell pwd)/build/${TGZ_NAME}
+TGZ_PATH = ./build/${TGZ_NAME}
 tgz:
 	@mkdir -p $(TGZ_PATH)
 	git archive HEAD | tar -x -C $(TGZ_PATH)
-	@cd build/ && tar czf bitmask-vpn_$(VERSION).tgz ${TGZ_NAME}
+	@cd build/ && tar czf bitmask-vpn_$(VERSION).tgz ${TGZ_NAME} && cd ..
 	@rm -rf $(TGZ_PATH)
 gen_pkg_deb:
 ifeq (${PLATFORM}, linux)
+	@mkdir -p build/${PROVIDER}/
 	@cp -r ${TEMPLATES}/debian build/${PROVIDER}
 	@VERSION=${VERSION} VENDOR_PATH=${VENDOR_PATH} ${SCRIPTS}/generate-debian build/${PROVIDER}/debian/data.json
 ifeq (${VENDOR_PATH}, providers)
-	@mkdir -p build/${PROVIDER}/debian/icons/scalable && cp ${VENDOR_PATH}/${PROVIDER}/assets/icon.svg build/${PROVIDER}/debian/icons/scalable/icon.svg
+	@mkdir -p build/${PROVIDER}/debian/icons/scalable && cp ${VENDOR_PATH}/${PROVIDER}/assets/icon.png build/${PROVIDER}/debian/icons/scalable/${TARGET}.png
 else
-	@mkdir -p build/${PROVIDER}/debian/icons/scalable && cp ${VENDOR_PATH}/assets/icon.svg build/${PROVIDER}/debian/icons/scalable/icon.svg
+	@mkdir -p build/${PROVIDER}/debian/icons/scalable && cp ${VENDOR_PATH}/assets/icon.png build/${PROVIDER}/debian/icons/scalable/${TARGET}.png
 endif
 	@cd build/${PROVIDER}/debian && python3 generate.py
 	@cd build/${PROVIDER}/debian && rm app.desktop-template changelog-template rules-template control-template generate.py data.json && chmod +x rules
+	@cd build/${PROVIDER}/debian && mv app.desktop ${TARGET}.desktop && mv app.install ${TARGET}.install && rm -f app.install-template && \
+	rm -rf source/include-binaries-template
 endif
 gen_pkg_snap:
 ifeq (${PLATFORM}, linux)
+	@mkdir -p build/${PROVIDER}
 	@cp -r ${TEMPLATES}/snap build/${PROVIDER}
 	@VERSION=${VERSION} VENDOR_PATH=${VENDOR_PATH} ${SCRIPTS}/generate-snap build/${PROVIDER}/snap/data.json
-	@cp helpers/se.leap.bitmask.snap.policy build/${PROVIDER}/snap/local/pre/
+	@cp pkg/pickle/helpers/se.leap.bitmask.snap.policy build/${PROVIDER}/snap/local/pre/
-	@cp helpers/bitmask-root build/${PROVIDER}/snap/local/pre/
+	@cp pkg/pickle/helpers/bitmask-root build/${PROVIDER}/snap/local/pre/
 	@cd build/${PROVIDER}/snap && python3 generate.py
 	@rm build/${PROVIDER}/snap/data.json build/${PROVIDER}/snap/snapcraft-template.yaml
 	@mkdir -p build/${PROVIDER}/snap/gui
@@ -410,14 +432,22 @@ package_snap_in_docker:
 	@${MAKE} -C docker package_snap
 package_snap:
-	@unlink snap || true
+	@-unlink snap
 	@cp build/${PROVIDER}/snap/local/${TARGET}.desktop build/${PROVIDER}/snap/gui/
 	@ln -s build/${PROVIDER}/snap snap
 	@${MAKE} -C build/${PROVIDER} pkg_snap
+prepare_deb:
+	@${MAKE} -C build/${PROVIDER} prepare_deb
 package_deb:
 	@${MAKE} -C build/${PROVIDER} pkg_deb
+package_arch:
+	grep -q "Arch Linux" /etc/os-release || (echo "Arch Linux system is required to build the Arch Linux package" && exit 1)
+	# at least the makepkg binary is mandatory, makepkg is part pacman package
+	(cd ArchLinux && makepkg --syncdeps --noconfirm)
 sign_artifact:
 	@find ${FILE} -type f -not -name "*.asc" -print0 | xargs -0 -n1 -I{} sha256sum -b "{}" | sed 's/*deploy\///' > ${FILE}.sha256
 	@gpg --clear-sign --armor ${FILE}.sha256
@@ -443,4 +473,4 @@ generate_locales:
 	@lupdate bitmask.pro
 get_%:
-	@curl -L -X GET --user "api:${API_TOKEN}" "https://www.transifex.com/api/2/project/bitmask/resource/bitmask-vpn/translation/${subst -,_,$*}/?file" > gui/i18n/main_$*.ts
+	@curl -L -X GET --user "api:${API_TOKEN}" "https://www.transifex.com/api/2/project/bitmask/resource/bitmask-desktop/translation/${subst -,_,$*}/?file" > gui/i18n/main_$*.ts
--- a/README.md
+++ b/README.md
-## Install 
+# Bitmask - Desktop client
-# snap
+## Supported operating systems
-```
+**Bitmask** needs the following minimum versions of supported operating systems:
-sudo snap install riseup-vpn --classic
-```
+### On Windows
+**Bitmask** has been tested to work on windows 10 and 11 it might not work on earlier version of windows.
+### On MacOS
+- **Bitmask** has been tested to work on last three releases of MacOS (Monteray, Ventura and Sonoma)
+- **Bitmask** currently needs rossetta to be enable to work on Apple hardware (M1, M2)
+### On Linux
-You can track beta channel, where we push versions to test:
+- **Bitmask** has been tested to work on the latest version of Debian, Ubuntu, Fedora and Arch Linux
+- Packages are only available for Ubuntu, Debian and Arch Linux
+## Install
+## Build
+Clone this repo, install dependencies and build the application. Dependencies assume debian packages, or homebrew for osx. For Windows OS see corresponding section below. For other systems try manually, or send us a patch. bitmask-vpn can be branded for a specific provider by specifying the env variable PROVIDER during the build process; we currently support three providers: riseup, calyx, and bitmask. To create a client branded for 'riseup', run:
 ```
-sudo snap install riseup-vpn --classic --beta
+git clone git@0xacab.org:leap/bitmask-vpn.git && cd bitmask-vpn
+sudo make depends  # do not use sudo in osx 
+PROVIDER=riseup make vendor
+make build
+sudo build/qt/release/riseup-vpn --install-helpers # on Linux and Mac
+LOG_LEVEL=TRACE build/qt/release/riseup-vpn
 ```
-<iframe
+With `--install-helpers` the `bitmask-root` helper gets copied to `/usr/sbin`.
-src="https://snapcraft.io/riseup-vpn/embedded?button=white&channels=true"
-frameborder="0" width="100%" height="380px" style="border: 1px solid #CCC;
-border-radius: 2px;"></iframe>
-# arch
+# Ubuntu
-[There's a package in AUR](https://aur.archlinux.org/packages/riseup-vpn-git) that tracks main branch, so expect some instabilities (early birds catch the bugs they say, and we're thankful for that)
+If you're using Ubuntu, you can use [leapcodes ppa](https://launchpad.net/~leapcodes/+archive/ubuntu/riseup-vpn).
 ```
-yaourt -Sy riseup-vpn-git
+sudo add-apt-repository ppa:leapcodes/riseup-vpn
+sudo apt update
+sudo apt install riseup-vpn
 ```
-# gentoo
+# Debian
-An ebuild is available in Gentoo's [main repository](https://packages.gentoo.org/packages/net-vpn/riseup-vpn).
+The package is available as "riseup-vpn" in Debian Bookworm, albeit at an older version. To get the same, you could run:
 ```
-emerge riseup-vpn
+sudo apt install riseup-vpn
 ```
-# deb
+The latest version is available for Debian Bookworm via backports. See the [offcial page](https://backports.debian.org/Instructions/) for instructions on how to set it up. If you are using Debian Testing/Unstable, riseup-vpn's latest version is available there as well.
-We haven't updated deb.leap.se repo yet 😞 (see #466), but if you *really* desire a debian
+If you're using an older version of Debian, then we do not have a package for the same. However, if you really desire a debian package you can build your own for the time being:
-package you can build your own for the time being:
 ```
 debuild -us -uc
 sudo dpkg -i ../riseup-vpn*.deb
 ```
-If you're using ubuntu, you can use [kali's ppa](https://launchpad.net/~kalikaneko/+archive/ubuntu/ppa).
+You can also run 
+```
+PROVIDER=riseup make vendor
+PROVIDER=riseup QMAKE=qmake6 make package_deb
+```
+Then install the built package with `apt install -f ./deploy/*.deb`.
-## Build
-Clone this repo, install dependencies and build the application. Dependencies
+# Arch Linux
-assume debian packages, or homebrew for osx. For Windows OS see corresponding section below. For other systems try
-manually, or send us a patch.
+There are two AUR packages for Arch Linux. There is [riseup-vpn-git](https://aur.archlinux.org/packages/riseup-vpn-git) that tracks main branch, so expect some instabilities (early birds catch the bugs they say, and we're thankful for that). There is also [riseup-vpn](https://aur.archlinux.org/packages/riseup-vpn) with the latest stable release.
 ```
-  git clone git@0xacab.org:leap/bitmask-vpn.git && cd bitmask-vpn
+yay riseup-vpn
-  sudo make depends  # do not use sudo in osx 
-  make build
 ```
-You need at least go 1.11. 
+## Snap
-If you have Ubuntu Bionic/18.04, the package in the repositories is too old. To resolve this, you can do `make install_go`. Do not do this if you have a later version.
+There is also a package in the [Snap store](https://snapcraft.io/riseup-vpn).
-For other situations, have a look at https://github.com/golang/go/wiki#working-with-go
+```
+sudo snap install riseup-vpn
+```
+## Build
+Clone this repo, install dependencies and build the application. Dependencies assume debian packages, or homebrew for osx. For Windows OS see corresponding section below. For other systems try manually, or send us a patch. bitmask-vpn can be branded for a specific provider by specifying the env variable PROVIDER during the build process; we currently support three providers: riseup, calyx, and bitmask. To create a client branded for 'riseup', run:
+```
+git clone git@0xacab.org:leap/bitmask-vpn.git && cd bitmask-vpn
+sudo make depends  # do not use sudo in osx 
+PROVIDER=riseup make vendor
+make build
+```
+To build you need at least go 1.22.
 ## Test
 You can run some tests too.
 ```
-  sudo apt install qml-module-qttest
+sudo apt install qml-module-qttest
-  make test
+make test
-  make test_ui
+make test_ui
 ```
 ## Windows
@@ -78,8 +114,8 @@ As for now app can be build on Win OS using `Cygwin` terminal.
 #### Precondition
 You need to have installed and added to your user PATH (mentioned version tested in Win10):
-1) Go (>= go1.15.4)
+1) Go (>= go1.20)
-2) QT (>= Qt5.12.9)
+2) QT (>= Qt6.6)
 3) QtIFW (>= QtIFW-4.0.0)
 4) Cygwin64 (>= 2.905 64 bit)
 5) Using Cygwin `Package Select` window install `python3` and `make` packages. 
@@ -88,7 +124,7 @@ You need to have installed and added to your user PATH (mentioned version tested
 #### Get Source
 ```
-    git clone git@0xacab.org:leap/bitmask-vpn.git && cd bitmask-vpn
+git clone git@0xacab.org:leap/bitmask-vpn.git && cd bitmask-vpn
 ```
 #### Build
@@ -96,12 +132,12 @@ Build script uses a symbolic link in one of the stages. Unfortunately Cygwin can
 admin user due to windows security restriction. To avoid this issue we need to call next target from cygwin terminal as   
 Administrator. This need to be done only once. 
 ```bash
-    make relink_vendor
+make relink_vendor
 ```
 After `relink_vendor` use this to build the app:
 ```bash
-    make build
+make build
 ```
 After successful build application will be available at: `build/qt/release/riseup-vpn.exe`
@@ -110,14 +146,23 @@ After successful build application will be available at: `build/qt/release/riseu
 To run tests:
 ```bash
-    make test
+make test
-    make test_ui
+make test_ui
 ```
+## Logging
+Log files:
+Linux: `~/.config/leap/systray.log`
+Windows: `%LocalAppData%\leap\systray.log  `
+Mac: `~/Library/Preferences/leap/systray.log`
+Log levels can be set via environment variable (`LOG_LEVEL=TRACE`, `LOG_LEVEL=DEBUG`, default log level is `INFO`). The cpp/qml part logs to stderr if env `DEBUG=1` is set. If `OPENVPN_LOG_TO_FILE=1` is set, the OpenVPN process writes its logs to [os.TempDir()](https://pkg.go.dev/os#TempDir)/leap-vpn.log. The verbosity of OpenVPN can be specified with env `OPENVPN_VERBOSITY` (sets `--verb`).
 Translations
 ------------
-We use [transifex](https://www.transifex.com/otf/bitmask/RiseupVPN/) to coordinate translations. Any help is welcome!
+We use [transifex](https://www.transifex.com/otf/bitmask/bitmask-desktop/) to coordinate translations. Any help is welcome!
 Bugs? Crashes? UI feedback? Any other suggestions or complains?

--- a/bitmask.pro
+++ b/bitmask.pro
-#TARGET = $$BINARY_NAME
+TARGET = $$TARGET
 QT += quickcontrols2 svg
-CONFIG += c++11
 CONFIG += qt staticlib
+CONFIG += c++17 strict_c++
 CONFIG += qtquickcompiler
-CONFIG+=force_debug_info
-CONFIG+=debug_and_release
+RELEASE = $$RELEASE
-#CONFIG+=release
+equals(RELEASE, "yes") {
+    message("[qmake] doing release build")
+    CONFIG += release
+    # debug_and_release is default on windows
+    # and needs to be explicitly disabled
+    win32:CONFIG -= debug_and_release
+} else {
+    message("[qmake] doing debug build")
+    CONFIG += force_debug_info
+    CONFIG += debug_and_release
+}
 windows:CONFIG -= console
-unix:DEBUG:CONFIG += debug
 lessThan(QT_MAJOR_VERSION, 5): error("requires Qt 5")
-QMAKE_MACOSX_DEPLOYMENT_TARGET = 10.11
+QMAKE_MACOSX_DEPLOYMENT_TARGET = 12
 QMAKE_TARGET_BUNDLE_PREFIX = se.leap
 QMAKE_BUNDLE = $$TARGET
@@ -31,7 +42,7 @@ ICON = $$VENDOR_PATH/icon.png
 macx {
    ICON = $$VENDOR_PATH/assets/icon.icns
-    LIBS += -framework Security -framework CoreFoundation
+    LIBS += -framework Security -framework CoreFoundation -lresolv
 }
 win32 {
    RC_ICONS = $$VENDOR_PATH/assets/icon.ico

--- a/branding/scripts/gen-providers-json
+++ b/branding/scripts/gen-providers-json
@@ -29,6 +29,7 @@ def generateProvidersJSON(configPath, outputJSONPath):
        providerData = getProviderData(p, config)
        addCaData(providerData, configPath)
        providers['providers'].append(providerData)
+    os.makedirs(os.path.dirname(outputJSONPath), exist_ok=True)
    with open(outputJSONPath, 'w', encoding='utf-8') as f:
        json.dump(providers, f, ensure_ascii=False, indent=4)

--- a/branding/scripts/gen-qtinstaller
+++ b/branding/scripts/gen-qtinstaller
@@ -27,7 +27,7 @@ OS_CONFIG = {
 """,
    'windows': """
    <!-- windows -->
-    <TargetDir>@ApplicationsDir@/$APPNAME</TargetDir>
+    <TargetDir>c:/Program Files (x86)/$APPNAME</TargetDir>
    <StartMenuDir>$APPNAME</StartMenuDir>
    <RunProgram>@TargetDir@/$BINNAME.exe</RunProgram>

--- a/branding/scripts/init
+++ b/branding/scripts/init
@@ -114,6 +114,7 @@ binaryName          = {provider}-vpn
 providerURL         = https://{providerURL}
 auth                = anon
 apiURL              = https://api.{providerURL}/
+apiVersion          = 3
 caURL               = https://{providerURL}/ca.crt
 infoURL             = https://{providerURL}/vpn

--- a/branding/scripts/provider.py
+++ b/branding/scripts/provider.py
@@ -19,18 +19,32 @@ def getProviderData(provider, config):
        c = config[provider]
    except Exception:
        raise ValueError('Cannot find provider')
    d = dict()
    keys = ('name', 'applicationName', 'binaryName', 'auth', 'authEmptyPass',
            'providerURL', 'tosURL', 'helpURL',
            'askForDonations', 'donateURL', 'apiURL',
-            'geolocationAPI', 'caCertString')
+            'apiVersion', 'geolocationAPI', 'caCertString',
+            'STUNServers', 'countryCodeLookupURL')
    boolValues = ['askForDonations', 'authEmptyPass']
+    intValues = ['apiVersion', ]
+    listValues = ['STUNServers']
    for value in keys:
+        if value not in c:
+            continue
        d[value] = c.get(value)
        if value in boolValues:
            d[value] = bool(d[value])
+        elif value in intValues:
+            d[value] = int(d[value])
+        elif value in listValues:
+            if d[value].strip() == "":
+                d[value] = []
+            else:
+                d[value] = d[value].split(",")
+                # remove spaces
+                d[value] = [x.strip() for x in d[value]]
    d['timeStamp'] = '{:%Y-%m-%d %H:%M:%S}'.format(
        datetime.datetime.now())

--- a/branding/templates/debian/app.desktop-template
+++ b/branding/templates/debian/app.desktop-template
@@ -7,7 +7,7 @@ Comment[es]=VPN Facil de ${name}
 Comment[de]=Easy VPN by ${name}
 Exec=${binaryName} %U
 Terminal=false
-Icon=icon
+Icon=${binaryName}
 Categories=Network;Application;
 StartupNotify=true
 X-AppInstall-Package=${binaryName}

--- a/branding/templates/debian/app.install-template
+++ b/branding/templates/debian/app.install-template
+debian/${binaryName}.desktop usr/share/applications
+debian/icons/scalable/${binaryName}.png usr/share/icons/hicolor/256x256/apps
--- a/branding/templates/debian/changelog-template
+++ b/branding/templates/debian/changelog-template
 ${binaryName} (${version}) unstable; urgency=medium
-  * Initial package.
+  * Reduces the size of splash screen image
+  * Disable obfs4 and kcp checkbox in preferences for riseup
+  * Removes duplicate languages in the language picker in preferences
+  * Language picker in preferences shows languages sorted alphabetically
+  * Updates translation files
+  * Adds region to language selections menu when available
+  * Improves UI responsiveness when connect or disconnect fails
+  * Disable automatic openvpn connection during app start
+  * Fixes a local privilege escalation security bug when using "--install-helpers"
+  * Change bitmask branded app name to Bitmask from BitmaskVPN
+  * Fixes bug where MOTD message box was not shown for RiseupVPN
+  * Show bridge icon when KCP transport is selected
+  * Show license page during installation
+  * Uninstalls previous version before installing current version
+  * Adds accessibility hints to connection button
+  * Exposes KCP support in the UI
+  * Adds new bitmask-vpn package for Arch Linux
+  * Fixes a bug preventing use of the app by non-admin users on windows
+  * Fixes a bug on macOS preventing users from manual location selection
+  * Fixes a bug where the app's close routine was called twice
+  * Fixes a bug where log file was not closed while quitting the app
+  * Fixes a bug where the correct app name was not shown in installer error messages
+  * Updates to latest obfsvpn
+  * Updates to latest bitmask-core
+  * Updates translation files
+  * Adds missing iptables dependency to ubuntu package
- -- LEAP Encryption Access Project  <debian@leap.se>  Mon, 29 Jul 2019 10:00:00 +0100
+ -- LEAP Encryption Access Project  <debian@leap.se>  Fri, 04 Oct 2024 09:16:36 +0200
+riseup-vpn (0.24.5-3-geb2df9a~noble) noble; urgency=medium
+  * fixes missing dependencies on .deb package
+  * Shorten too long strings in translations
+  * Connection status text width trimmed to be inside parent container
+  * Update GUI to Qt6
+  * Fixes a bug where after using obfs4 it was impossible to gracefully close the app
+ -- LEAP Encryption Access Project <debian@leap.se>  Sun, 19 May 2024 11:54:54 +0530
--- a/branding/templates/debian/control-template
+++ b/branding/templates/debian/control-template
 Source: ${binaryName}
 Section: net
-Priority: extra
+Priority: optional
 Maintainer: LEAP Encryption Access Project <debian@leap.se>
-Build-Depends: debhelper-compat (= 12), golang-go (>= 2:1.9), make (>=3.80), pkg-config, g++ (>= 4:4.6.3), git,
+Build-Depends: debhelper-compat (= 12), golang (>= 1.22), make (>=3.80), pkg-config, g++ (>= 4:4.6.3), git,
-        qt5-qmake, qttools5-dev-tools, qtbase5-dev, libqt5qml5, libqt5quick5, qtdeclarative5-dev
+        libqt6svg6-dev, qt6-tools-dev, qt6-tools-dev-tools, qt6-base-dev, libqt6qml6, qt6-declarative-dev,
+        dh-golang, libgl-dev, qt6-declarative-dev-tools, qt6-l10n-tools, python3
 Standards-Version: 4.4.1
 Homepage: https://0xacab.org/leap/bitmask-vpn
@@ -11,14 +12,15 @@ Package: ${binaryName}
 Architecture: any
 Multi-Arch: foreign
 Enhances: openvpn
-Depends: ${misc:Depends}, libqt5core5a, libqt5gui5 | libqt5gui5-gles,
+Depends: ${misc:Depends}, ${shlibs:Depends}, libqt6core6, libqt6gui6, libqt6qml6, libqt6widgets6, libstdc++6,
-        libqt5qml5, libqt5widgets5, libstdc++6,
+        libqt6svg6, qml6-module-qtquick, qml6-module-qtquick-controls, qml6-module-qtquick-dialogs,
-        qml-module-qtquick2, qml-module-qtquick-controls2, qml-module-qtquick-dialogs,
+        qml6-module-qtquick-layouts, qml6-module-qtqml-workerscript, qml6-module-qtquick-templates, qml6-module-qt-labs-settings,
-        qml-module-qtquick-extras, qml-module-qt-labs-platform,
+        qml6-module-qtquick-window, qml6-module-qt-labs-platform, qml6-module-qtcore, qml6-module-qt5compat-graphicaleffects,
-        openvpn, policykit-1-gnome | polkit-1-auth-agent, python3
+        openvpn, policykit-1-gnome | polkit-1-auth-agent, python3, iptables
 Description: Easy, fast, and secure VPN service from ${name}.
 This package is a custom build of the new Bitmask VPN client, preconfigured
 to use the ${providerURL} provider.
 .
 The service does not require a user account, keep logs, or track you in any
 way. The service is paid for entirely by donations from users.
No results found