set update from amnezia.org (#108 )

* set update from amnezia.org * add update config to windows7 build * set version to 2.0.2
fix h values highlight
2026-07-03 14:05:10 +02:00 · 2026-06-26 14:48:32 +08:00 · 2026-06-25 14:41:49 +02:00 · 2026-06-22 14:38:12 +07:00
9 changed files with 343 additions and 8 deletions
@@ -0,0 +1,26 @@
+name: build7
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build7:
+    runs-on: windows-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+
+      - name: run build
+        run: build7.bat
+        shell: cmd
+
+      - name: run installer build
+        run: installer/build7.bat
+        shell: cmd
+
+      - name: upload installer artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: installer artifacts
+          path: installer/dist/**
+          retention-days: 7
@@ -0,0 +1,64 @@
+name: release7
+
+on:
+  workflow_dispatch:
+
+jobs:
+  release7:
+    runs-on: windows-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+
+      - name: prepare version
+        id: get_version
+        run: |
+          VERSION=$(grep 'Number = "' version/version.go | sed 's/.*Number = "\(.*\)"/\1/')
+          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: prepare sign
+        env:
+          SIGN_PFX_BASE64: ${{ secrets.SIGN_PFX_BASE64 }}
+          SIGN_BAT_BASE64: ${{ secrets.SIGN_BAT_BASE64 }}
+        run: |
+          echo $SIGN_PFX_BASE64 | base64 --decode > sign.pfx
+          echo $SIGN_BAT_BASE64 | base64 --decode > sign.bat
+        shell: bash
+
+      - name: prepare installer sign
+        env:
+          SIGN_PFX_BASE64: ${{ secrets.SIGN_PFX_BASE64 }}
+          SIGN_BAT_BASE64: ${{ secrets.SIGN_BAT_BASE64 }}
+        run: |
+          echo $SIGN_PFX_BASE64 | base64 --decode > installer/sign.pfx
+          echo $SIGN_BAT_BASE64 | base64 --decode > installer/sign.bat
+        shell: bash
+
+      - name: prepare signtool
+        run: |
+          $signtoolExe = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin" -Recurse -Filter signtool.exe | Where-Object { $_.DirectoryName -match "\\x64$" } | Select-Object -First 1
+          $signtoolPath = $signtoolExe.DirectoryName
+          echo "Adding $signtoolPath to PATH"
+          echo "$signtoolPath" >> $env:GITHUB_PATH
+        shell: pwsh
+  
+      - name: run build
+        run: build7.bat
+        shell: cmd
+
+      - name: run installer build
+        run: installer/build7.bat
+        shell: cmd
+
+      - name: prepare release
+        id: get_release_tag
+        uses: robinraju/release-downloader@v1
+        with:
+          latest: true
+
+      - name: update release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: installer/dist/**
+          tag_name: ${{steps.get_release_tag.outputs.tag_name}}
@@ -0,0 +1,59 @@
+name: sign-build7
+
+on:
+  workflow_dispatch:
+
+jobs:
+  sign-build7:
+    runs-on: windows-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+
+      - name: prepare version
+        id: get_version
+        run: |
+          VERSION=$(grep 'Number = "' version/version.go | sed 's/.*Number = "\(.*\)"/\1/')
+          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: prepare sign
+        env:
+          SIGN_PFX_BASE64: ${{ secrets.SIGN_PFX_BASE64 }}
+          SIGN_BAT_BASE64: ${{ secrets.SIGN_BAT_BASE64 }}
+        run: |
+          echo $SIGN_PFX_BASE64 | base64 --decode > sign.pfx
+          echo $SIGN_BAT_BASE64 | base64 --decode > sign.bat
+        shell: bash
+
+      - name: prepare installer sign
+        env:
+          SIGN_PFX_BASE64: ${{ secrets.SIGN_PFX_BASE64 }}
+          SIGN_BAT_BASE64: ${{ secrets.SIGN_BAT_BASE64 }}
+        run: |
+          echo $SIGN_PFX_BASE64 | base64 --decode > installer/sign.pfx
+          echo $SIGN_BAT_BASE64 | base64 --decode > installer/sign.bat
+        shell: bash
+
+      - name: prepare signtool
+        run: |
+          $signtoolExe = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin" -Recurse -Filter signtool.exe | Where-Object { $_.DirectoryName -match "\\x64$" } | Select-Object -First 1
+          $signtoolPath = $signtoolExe.DirectoryName
+          echo "Adding $signtoolPath to PATH"
+          echo "$signtoolPath" >> $env:GITHUB_PATH
+        shell: pwsh
+
+      - name: run build
+        run: build7.bat
+        shell: cmd
+
+      - name: run installer build
+        run: installer/build7.bat
+        shell: cmd
+
+      - name: upload installer artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: installer artifacts
+          path: installer/dist/**
+          retention-days: 7
@@ -0,0 +1,91 @@
+@echo off
+rem SPDX-License-Identifier: MIT
+rem Copyright (C) 2019-2022 WireGuard LLC. All Rights Reserved.
+
+setlocal enabledelayedexpansion
+set BUILDDIR=%~dp0
+set PATH=%BUILDDIR%.deps\llvm-mingw-20231128-ucrt-x86_64\bin;%BUILDDIR%.deps\go-legacy-win7\bin;%BUILDDIR%.deps;%PATH%
+set PATHEXT=.exe
+cd /d %BUILDDIR% || exit /b 1
+
+if exist .deps\prepared goto :render
+:installdeps
+	rmdir /s /q .deps 2> NUL
+	mkdir .deps || goto :error
+	cd .deps || goto :error
+	call :download go-legacy-win7.zip https://github.com/thongtech/go-legacy-win7/releases/download/v1.24.4-1/go-legacy-win7-1.24.4-1.windows_amd64.zip 321a11edf2083434ba95562fb5592e3159907a25396478e5aef5b018d657ac24 || goto :error
+	call :download llvm-mingw-20231128-ucrt-x86_64.zip https://github.com/mstorsjo/llvm-mingw/releases/download/20231128/llvm-mingw-20231128-ucrt-x86_64.zip 7a344dafa6942de2c1f4643b3eb5c5ce5317fbab671a887e4d39f326b331798f || goto :error
+	rem Mirror of https://imagemagick.org/download/binaries/ImageMagick-7.0.8-42-portable-Q16-x64.zip
+	call :download imagemagick.zip https://download.wireguard.com/windows-toolchain/distfiles/ImageMagick-7.0.8-42-portable-Q16-x64.zip 584e069f56456ce7dde40220948ff9568ac810688c892c5dfb7f6db902aa05aa "convert.exe colors.xml delegates.xml" || goto :error
+	rem Mirror of https://sourceforge.net/projects/ezwinports/files/make-4.2.1-without-guile-w32-bin.zip
+	call :download make.zip https://download.wireguard.com/windows-toolchain/distfiles/make-4.2.1-without-guile-w32-bin.zip 30641be9602712be76212b99df7209f4f8f518ba764cf564262bc9d6e4047cc7 "--strip-components 1 bin" || goto :error
+	call :download amneziawg-tools.zip https://github.com/amnezia-vpn/amneziawg-tools/archive/v1.0.20250903.zip 086e0597906fd720ed83991716e77a8794ab750b9ccff8f153c7c05073d0b40c "--exclude wg-quick --strip-components 1" || goto :error
+	call :download wintun.zip https://www.wintun.net/builds/wintun-0.14.1.zip 07c256185d6ee3652e09fa55c0b673e2624b565e02c4b9091c79ca7d2f24ef51 || goto :error
+	copy /y NUL prepared > NUL || goto :error
+	cd .. || goto :error
+
+:render
+	echo [+] Rendering icons
+	for %%a in ("ui\icon\*.svg") do convert -background none "%%~fa" -define icon:auto-resize="256,192,128,96,64,48,40,32,24,20,16" -compress zip "%%~dpna.ico" || goto :error
+
+:build
+	git apply windows7-update.patch
+	for /f "tokens=3" %%a in ('findstr /r "Number.*=.*[0-9.]*" .\version\version.go') do set WIREGUARD_VERSION=%%a
+	set WIREGUARD_VERSION=%WIREGUARD_VERSION:"=%
+	for /f "tokens=1-4" %%a in ("%WIREGUARD_VERSION:.= % 0 0 0") do set WIREGUARD_VERSION_ARRAY=%%a,%%b,%%c,%%d
+	set GOOS=windows
+	set GOARM=7
+	set GOPATH=%BUILDDIR%.deps\gopath
+	set GOROOT=%BUILDDIR%.deps\go-legacy-win7
+	if "%GoGenerate%"=="yes" (
+		echo [+] Regenerating files
+		go generate ./... || exit /b 1
+	)
+	call :build_plat x86 i686 386 || goto :error
+	call :build_plat amd64 x86_64 amd64 || goto :error
+	call :build_plat arm64 aarch64 arm64 || goto :error
+
+:sign
+	if exist .\sign.bat call .\sign.bat
+	if "%SigningProvider%"=="" goto :success
+	if "%TimestampServer%"=="" goto :success
+	echo [+] Signing
+	signtool sign %SigningProvider% /fd sha256 /tr "%TimestampServer%" /td sha256 /d WireGuard x86\amneziawg.exe x86\awg.exe amd64\amneziawg.exe amd64\awg.exe arm64\amneziawg.exe arm64\awg.exe || goto :error
+
+:success
+	echo [+] Success. Launch amneziawg.exe.
+	exit /b 0
+
+:download
+	echo [+] Downloading %1
+	curl -#fLo %1 %2 || exit /b 1
+	echo [+] Verifying %1
+	for /f %%a in ('CertUtil -hashfile %1 SHA256 ^| findstr /r "^[0-9a-f]*$"') do if not "%%a"=="%~3" exit /b 1
+	echo [+] Extracting %1
+	tar -xf %1 %~4 || exit /b 1
+	echo [+] Cleaning up %1
+	del %1 || exit /b 1
+	goto :eof
+
+:build_plat
+	set GOARCH=%~3
+	mkdir %1 >NUL 2>&1
+	echo [+] Assembling resources %1
+	%~2-w64-mingw32-windres -DWIREGUARD_VERSION_ARRAY=%WIREGUARD_VERSION_ARRAY% -DWIREGUARD_VERSION_STR=%WIREGUARD_VERSION% -i resources.rc -o "resources_%~3.syso" -O coff -c 65001 || exit /b %errorlevel%
+	echo [+] Building program %1
+	go build -tags load_wgnt_from_rsrc -ldflags="-H windowsgui -s -w" -trimpath -buildvcs=false -v -o "%~1\amneziawg.exe" || exit /b 1
+	if not exist "%~1\awg.exe" (
+		echo [+] Building command line tools %1
+		del .deps\src\*.exe .deps\src\*.o .deps\src\wincompat\*.o .deps\src\wincompat\*.lib 2> NUL
+		set LDFLAGS=-s
+		make --no-print-directory -C .deps\src PLATFORM=windows CC=%~2-w64-mingw32-gcc WINDRES=%~2-w64-mingw32-windres V=1 RUNSTATEDIR= SYSTEMDUNITDIR= -j%NUMBER_OF_PROCESSORS% || exit /b 1
+		move /Y .deps\src\wg.exe "%~1\awg.exe" > NUL || exit /b 1
+	)
+	if not exist "%~1\wintun.dll" (
+		copy /Y ".deps\wintun\bin\%~1\wintun.dll" "%~1\wintun.dll" > NUL || exit /b 1
+	)
+	goto :eof
+
+:error
+	echo [-] Failed with error #%errorlevel%.
+	cmd /c exit %errorlevel%
@@ -0,0 +1,76 @@
+@echo off
+rem SPDX-License-Identifier: MIT
+rem Copyright (C) 2019-2022 WireGuard LLC. All Rights Reserved.
+
+setlocal
+set PATHEXT=.exe
+set BUILDDIR=%~dp0
+cd /d %BUILDDIR% || exit /b 1
+
+for /f "tokens=3" %%a in ('findstr /r "Number.*=.*[0-9.]*" ..\version\version.go') do set WIREGUARD_VERSION=%%a
+set WIREGUARD_VERSION=%WIREGUARD_VERSION:"=%
+
+set WIX_CANDLE_FLAGS=-nologo -dWIREGUARD_VERSION="%WIREGUARD_VERSION%"
+set WIX_LIGHT_FLAGS=-nologo -spdb
+set WIX_LIGHT_FLAGS=%WIX_LIGHT_FLAGS% -sice:ICE39
+set WIX_LIGHT_FLAGS=%WIX_LIGHT_FLAGS% -sice:ICE61
+set WIX_LIGHT_FLAGS=%WIX_LIGHT_FLAGS% -sice:ICE03
+
+if exist .deps\prepared goto :build
+:installdeps
+	rmdir /s /q .deps 2> NUL
+	mkdir .deps || goto :error
+	cd .deps || goto :error
+	call :download wix-binaries.zip https://github.com/wixtoolset/wix3/releases/download/wix3141rtm/wix314-binaries.zip 6ac824e1642d6f7277d0ed7ea09411a508f6116ba6fae0aa5f2c7daa2ff43d31 || goto :error
+	echo [+] Extracting wix-binaries.zip
+	mkdir wix\bin || goto :error
+	tar -xf wix-binaries.zip -C wix\bin || goto :error
+	echo [+] Cleaning up wix-binaries.zip
+	del wix-binaries.zip || goto :error
+	copy /y NUL prepared > NUL || goto :error
+	cd .. || goto :error
+
+:build
+	if exist ..\sign.bat call ..\sign.bat
+	set PATH=%BUILDDIR%..\.deps\llvm-mingw-20231128-ucrt-x86_64\bin;%PATH%
+	set WIX=%BUILDDIR%.deps\wix\
+	set CFLAGS=-O3 -Wall -std=gnu11 -DWINVER=0x0601 -D_WIN32_WINNT=0x0601 -municode -DUNICODE -D_UNICODE -DNDEBUG
+	set LDFLAGS=-shared -s -Wl,--kill-at -Wl,--major-os-version=6 -Wl,--minor-os-version=1 -Wl,--major-subsystem-version=6 -Wl,--minor-subsystem-version=1 -Wl,--tsaware -Wl,--dynamicbase -Wl,--nxcompat -Wl,--export-all-symbols
+	set LDLIBS=-lmsi -lole32 -lshlwapi -lshell32 -luuid -lntdll
+	call :msi x86 i686 x86 || goto :error
+	call :msi amd64 x86_64 x64 || goto :error
+	call :msi arm64 aarch64 arm64 || goto :error
+	if "%SigningProvider%"=="" goto :success
+	if "%TimestampServer%"=="" goto :success
+	echo [+] Signing
+	signtool sign %SigningProvider% /fd sha256 /tr "%TimestampServer%" /td sha256 /d "AmneziaWG Setup" "dist\amneziawg-*-windows7-%WIREGUARD_VERSION%.msi" || goto :error
+
+:success
+	echo [+] Success.
+	exit /b 0
+
+:download
+	echo [+] Downloading %1
+	curl -#fLo %1 %2 || exit /b 1
+	echo [+] Verifying %1
+	for /f %%a in ('CertUtil -hashfile %1 SHA256 ^| findstr /r "^[0-9a-f]*$"') do if not "%%a"=="%~3" exit /b 1
+	goto :eof
+
+:msi
+	set CC=%~2-w64-mingw32-gcc
+	if not exist "%~1" mkdir "%~1"
+	echo [+] Compiling %1
+	%CC% %CFLAGS% %LDFLAGS% -o "%~1\customactions.dll" customactions.c %LDLIBS% || exit /b 1
+	if "%SigningProvider%"=="" goto :skipsign
+	if "%TimestampServer%"=="" goto :skipsign
+	echo [+] Signing %1
+	signtool sign %SigningProvider% /fd sha256 /tr "%TimestampServer%" /td sha256 /d "AmneziaWG Setup Custom Actions" "%~1\customactions.dll" || exit /b 1
+:skipsign
+	"%WIX%bin\candle" %WIX_CANDLE_FLAGS% -dWIREGUARD_PLATFORM="%~1" -out "%~1\wireguard.wixobj" -arch %3 wireguard.wxs || exit /b %errorlevel%
+	echo [+] Linking %1
+	"%WIX%bin\light" %WIX_LIGHT_FLAGS% -out "dist\amneziawg-%~1-windows7-%WIREGUARD_VERSION%.msi" "%~1\wireguard.wixobj" || exit /b %errorlevel%
+	goto :eof
+
+:error
+	echo [-] Failed with error #%errorlevel%.
+	cmd /c exit %errorlevel%
@@ -271,6 +271,10 @@ func (s stringSpan) isValidUint(supportHex bool, min, max uint64) bool {
 	return val <= max && val >= min
 }

+func (s stringSpan) isValidUint32() bool {
+	return s.isValidUint(false, 0, 4_294_967_295)
+}
+
 func (s stringSpan) isValidPort() bool {
 	return s.isValidUint(false, 0, 65535)
 }
@@ -383,13 +387,13 @@ func (s stringSpan) isValidHField() bool {
 		if *s.at(i) == '-' {
 			first := stringSpan{s.s, i}
 			second := stringSpan{s.at(i + 1), s.len - i - 1}
-			if first.isValidUint(false, 0, 2_147_483_647) && second.isValidUint(false, 0, 2_147_483_647) {
+			if first.isValidUint32() && second.isValidUint32() {
 				return true
 			}
 			return false
 		}
 	}
-	return s.isValidUint(false, 0, 2_147_483_647)
+	return s.isValidUint32()
 }

 func (s stringSpan) isValidIField() bool {
@@ -6,12 +6,12 @@
 package updater

 const (
-	releasePublicKeyBase64 = "RWRNqGKtBXftKTKPpBPGDMe8jHLnFQ0EdRy8Wg0apV6vTDFLAODD83G4"
-	updateServerHost       = "download.wireguard.com"
+	releasePublicKeyBase64 = "RWTIu7lL938k14FQAOYx3R4MaIKLv6CmaxBI3G8zV7tbjpmqFY38l2r3"
+	updateServerHost       = "updates.amnezia.org"
 	updateServerPort       = 443
 	updateServerUseHttps   = true
-	latestVersionPath      = "/windows-client/latest.sig"
-	msiPath                = "/windows-client/%s"
-	msiArchPrefix          = "wireguard-%s-"
+	latestVersionPath      = "/amneziawg/windows-client/latest.sig"
+	msiPath                = "/amneziawg/windows-client/%s"
+	msiArchPrefix          = "amneziawg-%s-"
 	msiSuffix              = ".msi"
 )
@@ -6,5 +6,5 @@
 package version

 const (
-	Number = "2.0.1"
+	Number = "2.0.2"
 )
@@ -0,0 +1,15 @@
+diff --git a/updater/constants.go b/updater/constants.go
+index de2572e..6d9d2d8 100644
+--- a/updater/constants.go
+++ b/updater/constants.go
+@@ -10,8 +10,8 @@ const (
+ 	updateServerHost       = "updates.amnezia.org"
+ 	updateServerPort       = 443
+ 	updateServerUseHttps   = true
+-	latestVersionPath      = "/amneziawg/windows-client/latest.sig"
+	latestVersionPath      = "/amneziawg/windows-client/latest-windows7.sig"
+ 	msiPath                = "/amneziawg/windows-client/%s"
+-	msiArchPrefix          = "amneziawg-%s-"
+	msiArchPrefix          = "amneziawg-%s-windows7-"
+ 	msiSuffix              = ".msi"
+ )
Author	SHA1	Message	Date
Roman Zakharchuk	e628cbd609	set update from amnezia.org (#108 ) * set update from amnezia.org * add update config to windows7 build * set version to 2.0.2	2026-06-26 14:48:32 +08:00
Roman Zakharchuk	c9740b17ad	fix h values highlight	2026-06-25 14:41:49 +02:00
Roman Zakharchuk	d4498cf46a	win7 build scripts (#86 )	2026-06-22 14:38:12 +07:00