this must be run from the Makefile.
it also needs recent changes to bitmask-vpn, including the removal of
golang.org/x/text and others from the vendor.