coder/scripts/build_go.sh

#!/usr/bin/env bash

# This script builds a single Go binary of Coder with the given parameters.
#
# Usage: ./build_go.sh [--version 1.2.3-devel+abcdef] [--os linux] [--arch amd64] [--output path/to/output] [--slim] [--agpl] [--boringcrypto]
#
# Defaults to linux:amd64 with slim disabled, but can be controlled with GOOS,
# GOARCH and CODER_SLIM_BUILD=1. If no version is specified, defaults to the
# version from ./version.sh.
#
# GOARM can be controlled by suffixing any arm architecture (i.e. arm or arm64)
# with "vX" (e.g. "v7", "v8").
#
# Unless overridden via --output, the built binary will be dropped in
# "$repo_root/build/coder_$version_$os_$arch" (with a ".exe" suffix for windows
# builds) and the absolute path to the binary will be printed to stdout on
# completion.
#
# If the --sign-darwin parameter is specified and the OS is darwin, the output
# binary will be signed using ./sign_darwin.sh. Read that file for more details
# on the requirements.
#
# If the --sign-gpg parameter is specified, the output binary will be signed using ./sign_with_gpg.sh.
# Read that file for more details on the requirements.
#
# If the --agpl parameter is specified, builds only the AGPL-licensed code (no
# Coder enterprise features).
#
# If the --boringcrypto parameter is specified, builds use boringcrypto instead of
# the standard go crypto libraries.
#
set -euo pipefail
# shellcheck source=scripts/lib.sh
source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"

version=""
os="${GOOS:-linux}"
arch="${GOARCH:-amd64}"
output_path=""
slim="${CODER_SLIM_BUILD:-0}"
agpl="${CODER_BUILD_AGPL:-0}"
sign_darwin="${CODER_SIGN_DARWIN:-0}"
sign_windows="${CODER_SIGN_WINDOWS:-0}"
sign_gpg="${CODER_SIGN_GPG:-0}"
boringcrypto=${CODER_BUILD_BORINGCRYPTO:-0}
windows_resources="${CODER_WINDOWS_RESOURCES:-0}"
debug=0
develop_in_coder="${DEVELOP_IN_CODER:-0}"

bin_ident="com.coder.cli"

args="$(getopt -o "" -l version:,os:,arch:,output:,slim,agpl,sign-darwin,sign-windows,boringcrypto,windows-resources,debug -- "$@")"
eval set -- "$args"
while true; do
	case "$1" in
	--version)
		version="$2"
		shift 2
		;;
	--os)
		os="$2"
		shift 2
		;;
	--arch)
		arch="$2"
		shift 2
		;;
	--output)
		mkdir -p "$(dirname "$2")"
		output_path="$(realpath "$2")"
		shift 2
		;;
	--slim)
		slim=1
		shift
		;;
	--agpl)
		agpl=1
		shift
		;;
	--sign-darwin)
		sign_darwin=1
		shift
		;;
	--sign-windows)
		sign_windows=1
		shift
		;;
	--sign-gpg)
		sign_gpg=1
		shift
		;;
	--boringcrypto)
		boringcrypto=1
		shift
		;;
	--windows-resources)
		windows_resources=1
		shift
		;;
	--debug)
		debug=1
		shift
		;;
	--)
		shift
		break
		;;
	*)
		error "Unrecognized option: $1"
		;;
	esac
done

cdroot

# Remove the "v" prefix.
version="${version#v}"
if [[ "$version" == "" ]]; then
	version="$(execrelative ./version.sh)"
fi

# Check dependencies
dependencies go
if [[ "$sign_darwin" == 1 ]]; then
	dependencies rcodesign
	requiredenvs AC_CERTIFICATE_FILE AC_CERTIFICATE_PASSWORD_FILE
fi
if [[ "$sign_windows" == 1 ]]; then
	dependencies java
	requiredenvs JSIGN_PATH EV_KEYSTORE EV_KEY EV_CERTIFICATE_PATH EV_TSA_URL GCLOUD_ACCESS_TOKEN
fi
if [[ "$windows_resources" == 1 ]]; then
	dependencies go-winres
fi

ldflags=(
	-X "'github.com/coder/coder/v2/buildinfo.tag=$version'"
)
# Disable deubgger information if not building a binary for debuggers.
if [[ "$debug" == 0 ]]; then
	ldflags+=(-s -w)
fi

if [[ "$develop_in_coder" == 1 ]]; then
	echo "INFO : Overriding codersdk.SessionTokenCookie as we are developing inside a Coder workspace."
	ldflags+=(
		-X "'github.com/coder/coder/v2/codersdk.SessionTokenCookie=dev_coder_session_token'"
	)
fi

# We use ts_omit_aws here because on Linux it prevents Tailscale from importing
# github.com/aws/aws-sdk-go-v2/aws, which adds 7 MB to the binary.
TS_EXTRA_SMALL="ts_omit_aws,ts_omit_bird,ts_omit_tap,ts_omit_kube"
if [[ "$slim" == 1 ]]; then
	build_args+=(-tags "slim,$TS_EXTRA_SMALL")
else
	build_args+=(-tags "embed,$TS_EXTRA_SMALL")
fi
if [[ "$agpl" == 1 ]]; then
	# We don't use a tag to control AGPL because we don't want code to depend on
	# a flag to control AGPL vs. enterprise behavior.
	ldflags+=(-X "'github.com/coder/coder/v2/buildinfo.agpl=true'")
fi
cgo=0
build_args+=(-ldflags "${ldflags[*]}")

# Disable optimizations if building a binary for debuggers.
if [[ "$debug" == 1 ]]; then
	build_args+=(-gcflags "all=-N -l")
fi

# Compute default output path.
if [[ "$output_path" == "" ]]; then
	mkdir -p "build"
	output_path="build/coder_${version}_${os}_${arch}"
	if [[ "$os" == "windows" ]]; then
		output_path+=".exe"
	fi
	output_path="$(realpath "$output_path")"
fi
build_args+=(-o "$output_path")

# Determine GOARM.
arm_version=""
if [[ "$arch" == "arm" ]]; then
	arm_version="7"
elif [[ "$arch" == "armv"* ]] || [[ "$arch" == "arm64v"* ]]; then
	arm_version="${arch//*v/}"

	# Remove the v* suffix.
	arch="${arch//v*/}"
fi

cmd_path="./enterprise/cmd/coder"
if [[ "$agpl" == 1 ]]; then
	cmd_path="./cmd/coder"
fi

goexp=""
if [[ "$boringcrypto" == 1 ]]; then
	cgo=1
	goexp="boringcrypto"
fi

# On Windows, we use go-winres to embed the resources into the binary.
if [[ "$windows_resources" == 1 ]] && [[ "$os" == "windows" ]]; then
	# Convert the version to a format that Windows understands.
	# Remove any trailing data after a "+" or "-".
	version_windows=$version
	version_windows="${version_windows%+*}"
	version_windows="${version_windows%-*}"
	# If there wasn't any extra data, add a .0 to the version. Otherwise, add
	# a .1 to the version to signify that this is not a release build so it can
	# be distinguished from a release build.
	non_release_build=0
	if [[ "$version_windows" == "$version" ]]; then
		version_windows+=".0"
	else
		version_windows+=".1"
		non_release_build=1
	fi

	if [[ ! "$version_windows" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-1]$ ]]; then
		error "Computed invalid windows version format: $version_windows"
	fi

	# File description changes based on slimness, AGPL status, and architecture.
	file_description="Coder"
	if [[ "$agpl" == 1 ]]; then
		file_description+=" AGPL"
	fi
	if [[ "$slim" == 1 ]]; then
		file_description+=" CLI"
	fi
	if [[ "$non_release_build" == 1 ]]; then
		file_description+=" (development build)"
	fi

	# Because this writes to a file with the OS and arch in the filename, we
	# don't support concurrent builds for the same OS and arch (irregardless of
	# slimness or AGPL status).
	#
	# This is fine since we only embed resources during dogfood and release
	# builds, which use make (which will build all slim targets in parallel,
	# then all non-slim targets in parallel).
	expected_rsrc_file="./buildinfo/resources/resources_windows_${arch}.syso"
	if [[ -f "$expected_rsrc_file" ]]; then
		rm "$expected_rsrc_file"
	fi
	touch "$expected_rsrc_file"

	pushd ./buildinfo/resources
	GOARCH="$arch" go-winres simply \
		--arch "$arch" \
		--out "resources" \
		--product-version "$version_windows" \
		--file-version "$version_windows" \
		--manifest "cli" \
		--file-description "$file_description" \
		--product-name "Coder" \
		--copyright "Copyright $(date +%Y) Coder Technologies Inc." \
		--original-filename "coder.exe" \
		--icon ../../scripts/win-installer/coder.ico
	popd

	if [[ ! -f "$expected_rsrc_file" ]]; then
		error "Failed to generate $expected_rsrc_file"
	fi
fi

set +e
GOEXPERIMENT="$goexp" CGO_ENABLED="$cgo" GOOS="$os" GOARCH="$arch" GOARM="$arm_version" \
	go build \
	"${build_args[@]}" \
	"$cmd_path" 1>&2
exit_code=$?
set -e

# Clean up the resources file if it was generated.
if [[ "$windows_resources" == 1 ]] && [[ "$os" == "windows" ]]; then
	rm "$expected_rsrc_file"
fi

if [[ "$exit_code" != 0 ]]; then
	exit "$exit_code"
fi

# If we did embed resources, verify that they were included.
if [[ "$windows_resources" == 1 ]] && [[ "$os" == "windows" ]]; then
	winres_dir=$(mktemp -d)
	if ! go-winres extract --dir "$winres_dir" "$output_path" 1>&2; then
		rm -rf "$winres_dir"
		error "Compiled binary does not contain embedded resources"
	fi
	# If go-winres didn't return an error, it means it did find embedded
	# resources.
	rm -rf "$winres_dir"
fi

if [[ "$sign_darwin" == 1 ]] && [[ "$os" == "darwin" ]]; then
	execrelative ./sign_darwin.sh "$output_path" "$bin_ident" 1>&2
fi

if [[ "$sign_windows" == 1 ]] && [[ "$os" == "windows" ]]; then
	execrelative ./sign_windows.sh "$output_path" 1>&2
fi

# Platform agnostic signing
if [[ "$sign_gpg" == 1 ]]; then
	execrelative ./sign_with_gpg.sh "$output_path" 1>&2
fi

echo "$output_path"