Cleans up Windows completely (#464)

Signed-off-by: Takeshi Yoneda <t.y.mathetake@gmail.com>

Author: mathetake

.gitattributes

@@ -1,4 +1,3 @@
-# prevents windows runners from failing on lint
 * text eol=lf
 
 *.ico binary

.github/workflows/Dockerfile

@@ -5,7 +5,7 @@
 # this allows passwordless `sudo` for RPM and Debian testing.
 #
 # `make e2e` requires make and go, but `CGO=0` means gcc isn't needed. Ubuntu
-# installs more packages, notably windows, for the `check` and `dist` targets.
+# installs more packages for the `check` and `dist` targets.
 # To run RPM tests on CentOS, you must build them first on Ubuntu.
 #
 # This build is intended for use in a matrix, testing all major Linux platforms
@@ -57,12 +57,11 @@ ARG arch_lc=arm64
 
 FROM base-${TARGETARCH}
 
-# CentOS runs e2e, but can't run dist as Windows packages are not available.
 # While it is possible to build osslsigncode on CentOS, msitools can't due to
 # missing libgcab1-devel package. The workaround is to `make dist` with Ubuntu.
 ARG centos_packages="make sudo"
 # Ubuntu runs check, dist, and e2e, so needs more packages.
-ARG ubuntu_packages="make sudo curl git zip wixl msitools osslsigncode"
+ARG ubuntu_packages="make sudo curl git zip osslsigncode"
 RUN if [ -f /etc/centos-release ]; then \
     # Use Dandified YUM on CentOS >=8.
     dnf="dnf -qy" && ${dnf} install ${centos_packages} && ${dnf} clean all; \

.github/workflows/commit.yaml

@@ -9,15 +9,11 @@ on:
     tags: ''
     branches: master
     # ignore docs as they are built with Netlify. Ignore travis-related changes, too.
-    # func-e.wxs is used for the Windows Installer, so tested with msi.yaml
     paths-ignore:
       - '**/*.md'
       - 'site/**'
       - 'netlify.toml'
       - '.travis.yml'
-      - 'packaging/msi/*'
-      - 'packaging/icon@48w.ico'
-      - '.github/workflows/msi.yaml'
   pull_request:  # We also run tests on pull requests targeted at the master branch.
     branches: master
     paths-ignore:

.github/workflows/packaging.yaml

@@ -36,21 +36,8 @@ defaults:
 jobs:
   packaging:
     name: "Test packaging build (${{ matrix.os }})"
-    runs-on: windows-2022
-    strategy:
-      fail-fast: false  # don't fail fast as sometimes failures are operating system specific
-
+    runs-on: ubuntu-latest
     steps:
-      - name: "Setup msitools, wixtoolset, osslsigncode"
-        run: |
-          choco install osslsigncode -y
-          choco install zip -y
-          echo "$WIX\\bin" >> $GITHUB_PATH
-          echo "${HOME}\\osslsigncode" >> $GITHUB_PATH
-
-        env:  # `gh` requires auth even on public releases
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
       - name: "Checkout"
         uses: actions/checkout@v4
 
@@ -62,17 +49,9 @@ jobs:
           key: test-${{ runner.os }}-go-${{ hashFiles('go.mod', 'go.sum', 'Tools.mk') }}
           restore-keys: test-${{ runner.os }}-go-
 
-      - name: "Build packages (Windows Installer, Debian, RPM)"
+      - name: "Build packages (Installer, Debian, RPM)"
         run: make dist
 
-      # This tests the manifest via yamllint because validation via winget requires too much setup.
-      # See https://github.com/microsoft/winget-cli/issues/754#issuecomment-896475895
-      - name: "Test winget manifest generation"
-        run: |
-          ./packaging/msi/winget_manifest.sh > Tetrate.func-e.yaml
-          yamllint -sd '{extends: default, rules: {line-length: disable}}' Tetrate.func-e.yaml
-
-
       # In order to share the built artifacts in the subsequent tests, we use cache instead of actions/upload-artifacts.
       # The reason is that upload-artifacts are not globally consistent and sometimes pre_release_test won't be able to
       # find the artifacts uploaded here. See https://github.com/actions/upload-artifact/issues/21 for more context.
@@ -97,7 +76,7 @@ jobs:
     strategy:
       fail-fast: false # don't fail fast as sometimes failures are arch/OS specific
       matrix:
-        os: [ubuntu-22.04, macos-12, windows-2022]
+        os: [ubuntu-latest, macos-latest]
 
     steps:
     - uses: actions/checkout@v4
@@ -112,13 +91,6 @@ jobs:
         path:
           dist/
 
-    # This only checks the installer when built on Windows as it is simpler than switching OS.
-    # refreshenv is from choco, and lets you reload ENV variables (used here for PATH).
-    - name: "Test Windows Installer (Windows)"
-      if: runner.os == 'Windows'
-      run: call packaging\msi\verify_msi.cmd
-      shell: cmd
-
     - name: "Test Debian package"
       if: runner.os == 'Linux'
       run: packaging/nfpm/verify_deb.sh

.github/workflows/release.yaml

@@ -15,37 +15,17 @@ defaults:
 jobs:
   func-e:
     name: "Release `func-e` CLI"
-    runs-on: windows-2022
+    runs-on: ubuntu-latest
 
     steps:
       - name: "Checkout"
         uses: actions/checkout@v4
         with:  # fetch all history for all tags and branches (needed for changelog)
           fetch-depth: 0
 
-      # windows-2022 is missing osslsigncode (no issue, yet)
-      - name: "Install osslsigncode, infozip; setup wix"
-        run: |
-          choco install osslsigncode -y
-          choco install zip -y
-          echo "C:\Program Files (x86)\WiX Toolset v3.11\bin" >> $GITHUB_PATH
-
-      - name: Download Windows code signing certificate
-        env:
-          WINDOWS_CODESIGN_P12_BASE64: ${{ secrets.WINDOWS_CODESIGN_P12_BASE64 }}
-        run: | # On the fork PRs, our org secret is not visible.
-          if [ $WINDOWS_CODESIGN_P12_BASE64 ]; then
-            echo $WINDOWS_CODESIGN_P12_BASE64 | base64 --decode > windows-certificate.p12
-            echo "WINDOWS_CODESIGN_P12=windows-certificate.p12" >> $GITHUB_ENV
-          fi
-        shell: bash
-
       - name: "Make release assets (test)"
         if: github.event_name != 'push' || !contains(github.ref, 'refs/tags/')
-        run: | # On the fork PRs, our org secret is not visible. We unset the required env so that `make dist` uses default self-signed cert.
-          if [ $WINDOWS_CODESIGN_P12 ]; then
-            export WINDOWS_CODESIGN_PASSWORD=${{ secrets.WINDOWS_CODESIGN_PASSWORD }}
-          fi
+        run: |
           VERSION=${GITHUB_REF#refs/tags/v}
           make dist VERSION=$VERSION
           echo "VERSION=${VERSION}" >> $GITHUB_ENV
@@ -54,10 +34,7 @@ jobs:
       - name: "Make release assets"
         # Triggers only on tag creation.
         if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
-        run: | # On the fork PRs, our org secret is not visible. We unset the required env so that `make dist` uses default self-signed cert.
-          if [ $WINDOWS_CODESIGN_P12 ]; then
-            export WINDOWS_CODESIGN_PASSWORD=${{ secrets.WINDOWS_CODESIGN_PASSWORD }}
-          fi
+        run: |
           VERSION=${GITHUB_REF#refs/tags/v}
           make dist VERSION=$VERSION
           echo "VERSION=${VERSION}" >> $GITHUB_ENV
@@ -82,15 +59,10 @@ jobs:
     strategy:
       matrix:
         include:
-          - os: ubuntu-20.04  # Hard-coding an LTS means maintenance, but only once each 2 years!
+          - os: ubuntu-latest
             pattern: '*linux_amd64.tar.gz'
-          - os: macos-12
+          - os: macos-latest
             pattern: '*darwin_amd64.tar.gz'
-          - os: windows-2022
-            pattern: '*windows_amd64.*'
-            unzip: | # the above downloads both the zip and msi, stash the msi name
-              printf "::set-output name=msi::%s\n" *.msi
-              unzip -o *.zip && rm *.zip
 
     steps:
       - name: "Checkout"
@@ -107,17 +79,6 @@ jobs:
       - name: "Run e2e tests using draft `func-e` binary"
         run: E2E_FUNC_E_PATH=. make e2e
 
-      # This only checks the installer when built on Windows as it is simpler than switching OS.
-      # refreshenv is from choco, and lets you reload ENV variables (used here for PATH).
-      - name: "Test Windows Installer (Windows)"
-        if: runner.os == 'Windows'
-        run: |  # delete func-e.exe which was just tested, so it doesn't taint the tests
-          del func-e.exe
-          call packaging\msi\verify_msi.cmd
-        shell: cmd
-        env:  # use the stashed msi name instead of parsing it
-          MSI_FILE: ${{ steps.download.outputs.msi }}
-
       - name: "Test Debian package"
         if: runner.os == 'Linux'
         run: |

.gitignore

@@ -3,13 +3,8 @@
 /build/
 /dist/
 
-# intermediate files used to create Windows Installer (func-e.msi)
-func-e.wixobj
-
 # possible when testing
 /func-e
-/func-e.exe
-/func-e.msi
 /Tetrate.func-e.yaml
 /manifests/
 

DEVELOPER.md

@@ -49,6 +49,3 @@ make dist
 The contents will be in the 'dist/' folder and include the same files as a
 [release](https://github.com/tetratelabs/func-e/releases) would, except
 signatures would not be the same as production.
-
-Note: this step requires prerequisites for Windows packaging to work. Look at
-[msi.yaml](.github/workflows/msi.yaml) for what's needed per-platform.

Makefile

@@ -29,11 +29,6 @@ ifndef goroot
 $(error could not determine GOROOT)
 endif
 
-# Ensure POSIX-style GOROOT even in Windows, to support PATH updates in bash.
-ifdef COMSPEC
-goroot := $(shell cygpath $(goroot))
-endif
-
 # We must ensure `go` executes with GOROOT and PATH variables exported:
 # * GOROOT ensures versions don't conflict with /usr/local/go or c:\Go
 # * PATH ensures tools like golint can fork and execute the correct go binary.
@@ -94,9 +89,7 @@ e2e: $(E2E_FUNC_E_PATH)/func-e$(goexe) ## Run all end-to-end tests
 	@printf "$(ansi_format_bright)" e2e "ok"
 
 linux_platforms       := linux_amd64 linux_arm64
-non_windows_platforms := darwin_amd64 darwin_arm64 $(linux_platforms)
-# TODO: arm64 on Windows https://github.com/envoyproxy/envoy/issues/17572
-windows_platforms     := windows_amd64
+all_platforms         := darwin_amd64 darwin_arm64 $(linux_platforms)
 
 # Make 3.81 doesn't support '**' globbing: Set explicitly instead of recursion.
 all_sources   := $(wildcard *.go */*.go */*/*.go */*/*/*.go */*/*/*.go */*/*/*/*.go)
@@ -117,11 +110,6 @@ dist/func-e_$(VERSION)_%.tar.gz: build/func-e_%/func-e
 	@tar -C $(<D) -cpzf $@ $(<F)
 	@printf "$(ansi_format_bright)" tar.gz "ok"
 
-build/func-e_%/func-e.exe: $(main_sources)
-ifeq ($(OS),Windows_NT) 
-	$(call go-build,$@,$<)
-endif
-
 dist/func-e_$(VERSION)_%.zip: build/func-e_%/func-e.exe.signed
 	@printf "$(ansi_format_dark)" zip "zipping $@"
 	@mkdir -p $(@D)
@@ -161,34 +149,21 @@ msi-arch     = $(if $(findstring amd64,$1),x64,arm64)
 # Default to a dummy version, which is always lower than a real release
 msi_version := $(VERSION:dev=0.0.1)
 
-# This builds the Windows installer (MSI) using platform-dependent WIX commands.
-dist/func-e_$(VERSION)_%.msi: build/func-e_%/func-e.exe.signed
-ifeq ($(OS),Windows_NT)  # Windows 10 etc use https://wixtoolset.org
-	@printf "$(ansi_format_dark)" msi "building $@"
-	@mkdir -p $(@D)
-	@candle -nologo -arch $(call msi-arch,$@) -dVersion=$(msi_version) -dBin=$(<:.signed=) packaging/msi/func-e.wxs
-	@light -nologo func-e.wixobj -o $@ -spdb
-	@rm func-e.wixobj
-	$(call codesign,$@)
-	@printf "$(ansi_format_bright)" msi "ok"
-endif
-
-# Archives are tar.gz, except in the case of Windows, which uses zip.
-non_windows_archives  := $(non_windows_platforms:%=dist/func-e_$(VERSION)_%.tar.gz)
-windows_archives      := $(windows_platforms:%=dist/func-e_$(VERSION)_%.zip) $(windows_platforms:%=dist/func-e_$(VERSION)_%.msi)
-archives  := $(non_windows_platforms:%=dist/func-e_$(VERSION)_%.tar.gz) $(windows_platforms:%=dist/func-e_$(VERSION)_%.zip)
+# Archives are tar.gz,
+all_archives  := $(all_platforms:%=dist/func-e_$(VERSION)_%.tar.gz)
+archives  := $(all_platforms:%=dist/func-e_$(VERSION)_%.tar.gz)
 checksums := dist/func-e_$(VERSION)_checksums.txt
 
 # Darwin doesn't have sha256sum. See https://github.com/actions/virtual-environments/issues/90
 sha256sum := $(if $(findstring darwin,$(goos)),shasum -a 256,sha256sum)
-$(checksums): $(non_windows_archives) $(if $(findstring Windows_NT,$(OS)),$(windows_archives),)
+$(checksums): $(all_archives)
 	@printf "$(ansi_format_dark)" sha256sum "generating $@"
 	@$(sha256sum) $^ > $@
 	@printf "$(ansi_format_bright)" sha256sum "ok"
 
 # dist generates the assets that attach to a release
 # Ex. https://github.com/tetratelabs/func-e/releases/tag/v$(VERSION)
-dist: $(non_windows_archives) $(if $(findstring Windows_NT,$(OS)),$(windows_archives),) $(checksums) ## Generate release assets
+dist: $(all_archives) $(checksums) ## Generate release assets
 
 clean: ## Ensure a clean build
 	@printf "$(ansi_format_dark)" clean "deleting temporary files"
@@ -241,14 +216,9 @@ site: ## Serve website content
 	@git submodule update
 	@cd site && $(go) run $(hugo) server --minify --disableFastRender --baseURL localhost:1313 --cleanDestinationDir -D
 
-# this makes a marker file ending in .signed to avoid repeatedly calling codesign
-%.signed: %
-	$(call codesign,$<)
-	@touch $@
-
 # define macros for multi-platform builds. these parse the filename being built
 go-arch = $(if $(findstring amd64,$1),amd64,arm64)
-go-os   = $(if $(findstring .exe,$1),windows,$(if $(findstring linux,$1),linux,darwin))
+go-os   = $(if $(findstring linux,$1),linux,darwin)
 define go-build
 	@printf "$(ansi_format_dark)" build "building $1"
 	@# $(go:go=) removes the trailing 'go', so we can insert cross-build variables
@@ -264,23 +234,3 @@ define nfpm-pkg
 	@$(go) run $(nfpm) pkg -f $1 --packager $2 --target $3
 	@printf "$(ansi_format_bright)" nfpm "ok"
 endef
-
-# This requires osslsigncode package (apt or brew) or latest windows release from mtrojnar/osslsigncode
-#
-# Default is self-signed while production should be a Digicert signing key
-#
-# Ex.
-# ```bash
-# keytool -genkey -alias func-e -storetype PKCS12 -keyalg RSA -keysize 2048 -storepass func-e-bunch \
-# -keystore func-e.p12 -dname "O=func-e,CN=func-e.io" -validity 3650
-# ```
-WINDOWS_CODESIGN_P12      ?= packaging/msi/func-e.p12
-WINDOWS_CODESIGN_PASSWORD ?= func-e-bunch
-define codesign
-	@printf "$(ansi_format_dark)" codesign "signing $1"
-	@osslsigncode sign -h sha256 -pkcs12 ${WINDOWS_CODESIGN_P12} -pass "${WINDOWS_CODESIGN_PASSWORD}" \
-	-n "func-e makes running Envoy® easy" -i https://func-e.io -t http://timestamp.digicert.com \
-	$(if $(findstring msi,$(1)),-add-msi-dse) -in $1 -out $1-signed
-	@mv $1-signed $1
-	@printf "$(ansi_format_bright)" codesign "ok"
-endef

e2e/README.md

@@ -5,7 +5,7 @@ This directory holds the end-to-end tests for `func-e`.
 By default, end-to-end (e2e) tests verify a `func-e` binary built from [main.go](../main.go).
 
 ## Using native go commands:
-End-to-end tests default to look for `func-e` (or `func-e.exe` in Windows), in the project root (current directory).
+End-to-end tests default to look for `func-e`, in the project root (current directory).
 
 ```bash
 go build --ldflags '-s -w' .

e2e/func-e_run_test.go

@@ -42,7 +42,7 @@ var (
 	staticFilesystemConfig  []byte
 	adminAddressPathPattern = regexp.MustCompile(`--admin-address-path ([^ ]+)`)
 	envoyStartedLine        = "starting main dispatch loop"
-	// minRunArgs is the minimal config needed to run Envoy 1.18+, non-windows <1.18 need access_log_path: '/dev/stdout'
+	// minRunArgs is the minimal config needed to run Envoy 1.18+.
 	minRunArgs = []string{"run", "--config-yaml", "admin: {address: {socket_address: {address: '127.0.0.1', port_value: 0}}}"}
 )