Commit graph

123 commits

Author SHA1 Message Date
ivk
c5d0faabe5 [build, desktop] Enable code integrity & other hardening via fuses
Hardening reduces attack surface and also prevents abusing the app as
a shell for malware.

Close #9622
2025-09-23 15:05:46 +02:00
hrb-hub
f5b2b0d5f3 Use app name as executableName for linux build only
According to the electron-builder docs, executableName defaults to the
productName when not specified. However, in reality it was actually
using the app name as default for the linux build, which is a bug that
got patched recently, see:
https://github.com/electron-userland/electron-builder/issues/8766

Because we relied on this bug and on executableName defaulting to app
name for the linux build, we explicitly set it to appName for all
builds, see: f81fddd, but this caused an executableName change on MacOS.

Close #9389
2025-08-04 13:34:21 +02:00
nig
f81fdddb64
[build] fix executable name for desktop client 2025-07-24 14:06:23 +02:00
ivk
c4768ae09f [build] Fix macOS universal build again
Fix more generic x64ArchFiles that covers the actual path after building
the app, something like
Contents/Resources/app.asar.unpacked/desktop/node-mimimi.darwin-arm64.node
2025-07-21 12:00:58 +02:00
ivk
26b5b4dca4 [build] Fix macOS universal build again
Specify x64ArchFiles to allow separate binaries in the app.
2025-07-21 10:36:54 +02:00
ivk
9406f28068 [build] Fix macOS universal build
Do not merge arch specific binaries into the same archive.

Co-authored-by: hrb-hub <hrb-hub@users.noreply.github.com>
2025-07-18 18:06:04 +02:00
ivk
aa303023ef [build] Fix Windows signing options
Co-authored-by: hrb-hub <hrb-hub@users.noreply.github.com>
2025-07-18 16:06:03 +02:00
ivk
62a6dd4eca Update dependencies
Update terser to support new undici

Fix invalid desktop build settings
2025-07-18 10:01:00 +02:00
ivk
2ed48135a8
Replace esbuild with Rolldown
- switch desktop build to esm
 - convert mithril to esm
 - run worker as esm module
 - fix dependency from DesktopAlarmScheduler to calendar app
 - switch napi-rs cli to 3.0
 - fix mimimi imports
 - remove hacky method on generated dispatcher
 - refactor native rollup plugins

 Co-authored-by: bir <bir@tutao.de>
2025-01-13 10:05:18 +01:00
ivk
a42907e55a [build] Add type checking to buildSrc
It isn't invoked automatically anywhere but the editors should pick it
up and it can also be run manually.

It also fixes few little issues, e.g. getPrebuiltNativeModuleForWindows
was getting called with the right arguments.
2024-08-06 16:00:04 +02:00
ivk
1eb34134a6 [desktop] Change productName to Tuta Desktop 2024-02-26 12:52:05 +00:00
ivk
3bf53aa5c2 [ci] Use cached better-sqlite3 in github actions 2023-12-01 12:41:55 +01:00
jat
38a70be346 Fix desktop script building both x86_64 and arm64 at the same time
Added a new flag `-a` which allows the developer to set the architecture
of the built client. It causes an error when an unsupported combination
of platform & architecture is used. By default, it uses the architecture
the installed node binary uses.
2023-11-27 13:37:36 +00:00
nig
5105fbebd6 update better-sqlite3 to include arm64 target 2023-11-27 13:37:36 +00:00
nig
ac3805bb6e [desktop] don't reuse wasm instantiation logic for node process
this duplicates some code but makes the rest of the code way simpler

#3853
fix 4bd975f65a60c504f44afd912c8c61474ee4bb36
2023-11-27 13:28:50 +01:00
arm
b58f43ffc0 Change application name, #5960 2023-11-06 15:16:57 +01:00
nig
e60e78c9c4 move dist build to just ./build 2023-10-18 12:12:10 +02:00
nig
09cbcdb4e6 enable credentials migration from the old to the new domain
two ways this can happen:
* starting on old domain
* starting on new domain

in each case, the starting tab opens the other domain in a new
tab to then use window.postMessage to transfer the credentials.
2023-10-18 12:12:10 +02:00
nig
1adc36e08e [build] vendor electron-updater
* according to rollups type definitions, the output option property is
 ignored by rollup.rollup, so it moved to bundle.write
* we don't use commonjs deps in the desktop bundle anymore, so the
  commonjs plugin can go away from DesktopBuilder

[build] remove some unnecessary rollup plugins

[build] unify the native plugins

[build] vendor keytar

[build] vendor better-sqlite3 deps and restrict module resolution

it's now checked in and can be updated with buildSrc/updateLibs.js

close #4213
2023-08-30 16:38:00 +02:00
nig
978d9780c2 fix linter errors for missing node: protocol
close #4367
2023-05-05 11:29:09 +02:00
nig
4e2a54890c update electron & electron-updater 2023-03-27 12:03:28 +00:00
nig
870099bef8 revert electron-updater update
we can't use this version on MacOS because electron-builder
does not manage to install it.

fix c184f8919d
2023-02-27 10:55:42 +00:00
nig
c184f8919d upgrade electron & electron-updater
* electron-updater now includes our fix for the EPIPE problem on linux
* electron 23+ no longer supports win 7 and 8 which are eol since jan
2023-02-24 13:55:46 +00:00
nig
db8b445e72 [desktop] electron-updater 6.0.0-alpha.6 2023-01-30 11:39:36 +01:00
nig
7cba629cb6 [desktop] use a nonbroken electron-updater version on each platform
5.3.0 couldn't handle windows machines with a restricted powershell.
6.0.0 fixed that, but the alpha that's currently available does not
work on linux because it's opening the child process wrong.
2023-01-30 10:20:44 +01:00
ivk
50b23ebd1b Run prettier on the whole project 2022-12-27 16:08:23 +01:00
nig
ca185d1a46 sign dlls for the windows apps
close #4830
2022-12-19 16:58:48 +01:00
nig
fbc2697cb1 [maintenance] remove node-forge dependency
node-forge is a pure JS crypto library that was used during the build
process to sign the clients and at runtime to verify the signature
before downloading the updated client:
* check the update manifest on the server, if the version is higher
  than installed:
* get the sha512 digest and signature from the manifest and verify the
  signature (node-forge only requires the digest, not the data)
  if it matches:
* download the update and let electron-updater do its thing

with this change, we have to download the update first because node
crypto requires the data to verify the signature (digest is calculated
internally). In case the signature doesn't match, we delete the
downloaded file and stop polling for updates for this run.

forge was also used to get a private key for signing out of a
self-signed cert in development environments. from now on, this is done
by providing PEM encoded private and public keys.

close #3832
2022-12-19 15:13:59 +01:00
nig
e1d48c4f6c [android/ci] build and use android-database-sqlcipher
* add new jenkinsfile for building loadable sqlcipher aar
* use it as a dependency if it's in the app-android/libs dir

close #4294
2022-08-04 10:38:22 +02:00
ivk
df135ee95d [desktop] Pass webAssetsPath instead of desktophtml 2022-07-21 16:13:32 +02:00
nig
47cb490714 resolve problems after rebase
mainly making the OfflineIndicatorViewModel init more async because
it's running into an uninitialized locator when initialized during
header construction.

#3815
2022-05-17 09:11:15 +02:00
ivk
6980c847cb
[build] Changes after review 2022-05-10 17:56:48 +02:00
ivk
3f7c080055
[build] esbuild for dev build 2022-05-10 17:53:21 +02:00
ivk
b0066f98ef
[build, desktop] Fix building better-sqlite3 on Windows, fix #4089
- Fix unpacking .node file form .asar
 - Update to correct build of better_sqlite3
 - Fix passing correct path to better_sqlite3
2022-05-05 18:00:59 +02:00
ivk
350d522533 [build] Fixes for admin client
1. Change getVersion() in nativeLibraryProvider to handle curious
`npm list` behavior.
2. Reorganize rollup plugins so that admin client can import our helper
plugins without importing rollup plugins from node_modules. This makes
it more resilient when we link against local tutanota-3 (libs hoisted
to upper level will not be found across the symlink).
3. Change LaunchHtml to not rely on mithril for the same reason.
2022-03-08 12:00:01 +01:00
jom
591554aa51 [build] Build better-sqlite3 on windows during Jenkins CI
This commit not only sets up the build for windows on jenkins,
it also consolidates how we get prebuilt binaries for native modules i.e. keytar and better-sqlite3
and generally has some refactorings
2022-03-07 10:26:06 +01:00
ivk
d54be5a7c2 [build] Change keytar to be compiled on demand
Compiling keytar in postinstall is problematic because we need node-gyp
to successfully finish installation. Because of that it is hard to
depend on tutanota-3 (e.g. in admin client).

Doing this on demand avoids the issue.
2022-02-22 14:31:28 +01:00
sas
7cb4828c56 Introduce persistent cache for desktop, close #3823 2022-02-15 09:54:54 +01:00
nig
99b650f3ec [desktop] include mapirs.dll in the windows build 2021-10-12 11:08:16 +02:00
nig
40a51cb8ec [desktop] add spell checking, close #1069
adds spell check & correction capabilities to the context menu,
including the ability to change the checked language.

dictionaries are pulled from <updateUrl>/../dictionaries/ except
for custom builds. in that case, the downloader is pointed to
mail.tutanota.com/desktop/dictionaries/

the dist.js build script gained a --get-dicts flag, which will
result in the dictionaries released with the used electron version being
downloaded from

https://github.com/electron/electron/releases/
download/v${version}/hunspell_dictionaries.zip

and extracted into a directory next to the given --out-dir
or build/dist/dictionaries during the build.

should the build not create .deb packages, the dicts
will end up next to the desktop installers since the
local tutadb will serve them from there.
2021-05-27 13:14:30 +02:00
nig
f90e3f80ab add possibility to use self-signed cert for desktop update signatures
to create these signatures, run the dist script with the environment
variable DEBUG_SIGN set to a directory containing a self-signed code
signing cert file test.p12

close #2918
2021-05-25 14:11:47 +02:00
thp
ff2ca4a340 Build keytar on our own. Fix #2582 2021-05-25 13:47:06 +02:00
nig
7713acba0d [desktop] review build and electron config 2021-03-31 16:35:38 +02:00
jom
09da39cdc9 give option to disable auto updates when installing on windows, close #2736
This is achieved by deleting app-update.yml after unpackaging, which already automatically disables auto updates
2021-02-25 19:09:35 +01:00
nig
f6bdcd9bb8 [desktop] enable context isolation for all BrowserWindows
The preload script required some access to the window object of the renderer
thread to implement browser functionality that's missing in a BrowserWindow.
This prevented use of the contextI isolation option.

This commit moves that functionality from the preload script to either the main
thread or the web app so we can enable context isolation.

* mouse wheel zoom was moved to the main thread, listening to the new
 zoom-changed event on WebContents (ApplicationWindow.js)
* url reveal on hover was split into a main part listening on update-target-url
 on WebContent (ApplicationWindow.js) and a new NativeWrapperCommand to fill in
 the url element
* the fix for MacOS navigation history when trying to navigate a text box with
 cmd+arrows moved to WindowFacade.js
* the SearchPageOverlay now fixes the non-detection of focus change itself
* unregistering the window on unload moved to ApplicationWindow.js, detecting
 a reload in the did-start-navigation handler
* the fix for the nonfunctional window focus was removed since it works in current
 electron versions

all windows now use the same ipc channel, the IPC component uses the Event sender
to route responses back to the correct window, removing the need to set up
the channel with the window id
2021-02-15 11:30:56 +01:00
ivk
7c55e411de
[build] Fix file naming. Roll back nameCache changes for terser 2021-01-29 13:56:41 +01:00
ivk
5541fa7633
[build] Rename winsigner.js to winsigner.cjs to fix the build 2021-01-28 14:11:23 +01:00
ivk
f1b24a3a35
[build] Fix desktop builder 2021-01-22 14:55:40 +01:00
ivk
79f3fff51a
Use Rollup & Nollup for build 2021-01-22 12:23:22 +01:00
nig
5681b0fe39 [desktop] fix inconsistent StartupWMClass without changing AppId
electron ignores the "StartupWMClass" and just uses the name property set in the electron package.json,
so we use it for the WMClass as well.

fix #2328
2020-11-12 12:50:34 +01:00