chore: apply customizations on 2026.5.1

Author: github-actions[bot]

.github/workflows/check.yaml

@@ -24,19 +24,13 @@ else
 	DEB_PACKAGE_NAME := $(BINARY_NAME)
 endif
 
-# Use git in windows since we don't have access to the `date` tool
-ifeq ($(TARGET_OS), windows)
-	DATE := $(shell git log -1 --format="%ad" --date=format-local:'%Y-%m-%dT%H:%M UTC' -- RELEASE_NOTES)
-else
-	DATE := $(shell date -u -r RELEASE_NOTES '+%Y-%m-%d-%H:%M UTC')
-endif
-
+DATE          := $(shell date -u -r RELEASE_NOTES '+%Y-%m-%d-%H%M UTC')
 VERSION_FLAGS := -X "main.Version=$(VERSION)" -X "main.BuildTime=$(DATE)"
 ifdef PACKAGE_MANAGER
 	VERSION_FLAGS := $(VERSION_FLAGS) -X "github.com/cloudflare/cloudflared/cmd/cloudflared/updater.BuiltForPackageManager=$(PACKAGE_MANAGER)"
 endif
 
-ifdef CONTAINER_BUILD
+ifdef CONTAINER_BUILD 
 	VERSION_FLAGS := $(VERSION_FLAGS) -X "github.com/cloudflare/cloudflared/metrics.Runtime=virtual"
 endif
 
@@ -62,6 +56,8 @@ PACKAGE_DIR    := $(CURDIR)/packaging
 PREFIX         := /usr
 INSTALL_BINDIR := $(PREFIX)/bin/
 INSTALL_MANDIR := $(PREFIX)/share/man/man1/
+CF_GO_PATH     := /tmp/go
+PATH           := $(CF_GO_PATH)/bin:$(PATH)
 
 LOCAL_ARCH ?= $(shell uname -m)
 ifneq ($(GOARCH),)
@@ -70,8 +66,6 @@ else ifeq ($(LOCAL_ARCH),x86_64)
     TARGET_ARCH ?= amd64
 else ifeq ($(LOCAL_ARCH),amd64)
     TARGET_ARCH ?= amd64
-else ifeq ($(LOCAL_ARCH),386)
-    TARGET_ARCH ?= 386
 else ifeq ($(LOCAL_ARCH),i686)
     TARGET_ARCH ?= amd64
 else ifeq ($(shell echo $(LOCAL_ARCH) | head -c 5),armv8)
@@ -97,6 +91,8 @@ else ifeq ($(LOCAL_OS),windows)
     TARGET_OS ?= windows
 else ifeq ($(LOCAL_OS),freebsd)
     TARGET_OS ?= freebsd
+else ifeq ($(LOCAL_OS),netbsd)
+    TARGET_OS ?= netbsd
 else ifeq ($(LOCAL_OS),openbsd)
     TARGET_OS ?= openbsd
 else
@@ -119,7 +115,7 @@ ifneq ($(TARGET_ARM), )
 	ARM_COMMAND := GOARM=$(TARGET_ARM)
 endif
 
-ifeq ($(TARGET_ARM), 7)
+ifeq ($(TARGET_ARM), 7) 
 	PACKAGE_ARCH := armhf
 else
 	PACKAGE_ARCH := $(TARGET_ARCH)
@@ -128,19 +124,13 @@ endif
 #for FIPS compliance, FPM defaults to MD5.
 RPM_DIGEST := --rpm-digest sha256
 
-GO_TEST_LOG_OUTPUT = /tmp/gotest.log
-
 .PHONY: all
 all: cloudflared test
 
 .PHONY: clean
 clean:
 	go clean
 
-.PHONY: vulncheck
-vulncheck:
-	@./.ci/scripts/vuln-check.sh
-
 .PHONY: cloudflared
 cloudflared:
 ifeq ($(FIPS), true)
@@ -162,9 +152,11 @@ generate-docker-version:
 
 .PHONY: test
 test: vet
-	$Q go test -json -v -mod=vendor -race $(LDFLAGS) ./... 2>&1 | tee $(GO_TEST_LOG_OUTPUT)
-ifneq ($(FIPS), true)
-	@go run -mod=readonly github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@latest -input $(GO_TEST_LOG_OUTPUT)
+ifndef CI
+	go test -v -mod=vendor -race $(LDFLAGS) ./...
+else
+	@mkdir -p .cover
+	go test -v -mod=vendor -race $(LDFLAGS) -coverprofile=".cover/c.out" ./...
 endif
 
 .PHONY: cover
@@ -182,17 +174,26 @@ fuzz:
 	@go test -fuzz=FuzzIPDecoder -fuzztime=600s ./packet
 	@go test -fuzz=FuzzICMPDecoder -fuzztime=600s ./packet
 	@go test -fuzz=FuzzSessionWrite -fuzztime=600s ./quic/v3
-	@go test -fuzz=FuzzSessionRead -fuzztime=600s ./quic/v3
+	@go test -fuzz=FuzzSessionServe -fuzztime=600s ./quic/v3
 	@go test -fuzz=FuzzRegistrationDatagram -fuzztime=600s ./quic/v3
 	@go test -fuzz=FuzzPayloadDatagram -fuzztime=600s ./quic/v3
 	@go test -fuzz=FuzzRegistrationResponseDatagram -fuzztime=600s ./quic/v3
 	@go test -fuzz=FuzzNewIdentity -fuzztime=600s ./tracing
 	@go test -fuzz=FuzzNewAccessValidator -fuzztime=600s ./validation
 
+.PHONY: install-go
+install-go:
+	rm -rf ${CF_GO_PATH}
+	./.teamcity/install-cloudflare-go.sh
+
+.PHONY: cleanup-go
+cleanup-go:
+	rm -rf ${CF_GO_PATH}
+
 cloudflared.1: cloudflared_man_template
 	sed -e 's/\$${VERSION}/$(VERSION)/; s/\$${DATE}/$(DATE)/' cloudflared_man_template > cloudflared.1
 
-install: cloudflared cloudflared.1
+install: install-go cloudflared cloudflared.1 cleanup-go
 	mkdir -p $(DESTDIR)$(INSTALL_BINDIR) $(DESTDIR)$(INSTALL_MANDIR)
 	install -m755 cloudflared $(DESTDIR)$(INSTALL_BINDIR)/cloudflared
 	install -m644 cloudflared.1 $(DESTDIR)$(INSTALL_MANDIR)/cloudflared.1
@@ -221,6 +222,10 @@ cloudflared-deb: cloudflared cloudflared.1
 cloudflared-rpm: cloudflared cloudflared.1
 	$(call build_package,rpm)
 
+.PHONY: cloudflared-pkg
+cloudflared-pkg: cloudflared cloudflared.1
+	$(call build_package,osxpkg)
+
 .PHONY: cloudflared-msi
 cloudflared-msi:
 	wixl --define Version=$(VERSION) --define Path=$(EXECUTABLE_PATH) --output cloudflared-$(VERSION)-$(TARGET_ARCH).msi cloudflared.wxs
@@ -231,18 +236,13 @@ github-release-dryrun:
 
 .PHONY: github-release
 github-release:
-	python3 github_release.py --path $(PWD)/artifacts/ --release-version $(VERSION)
+	python3 github_release.py --path $(PWD)/built_artifacts --release-version $(VERSION)
 	python3 github_message.py --release-version $(VERSION)
 
 .PHONY: r2-linux-release
 r2-linux-release:
 	python3 ./release_pkgs.py
 
-.PHONY: r2-next-linux-release
-# Publishes to a separate R2 repository during GPG key rollover, using dual-key signing.
-r2-next-linux-release:
-	python3 ./release_pkgs.py --upload-repo-file
-
 .PHONY: capnp
 capnp:
 	which capnp  # https://capnproto.org/install.html
@@ -251,7 +251,7 @@ capnp:
 
 .PHONY: vet
 vet:
-	$Q go vet -mod=vendor github.com/cloudflare/cloudflared/...
+	go vet -mod=vendor github.com/cloudflare/cloudflared/...
 
 .PHONY: fmt
 fmt:
@@ -260,38 +260,12 @@ fmt:
 
 .PHONY: fmt-check
 fmt-check:
-	@./.ci/scripts/fmt-check.sh
+	@./fmt-check.sh
 
 .PHONY: lint
 lint:
 	@golangci-lint run
 
 .PHONY: mocks
 mocks:
-	go generate mocks/mockgen.go
-
-.PHONY: ci-build
-ci-build:
-	@GOOS=linux GOARCH=amd64 $(MAKE) cloudflared
-	@mkdir -p artifacts
-	@mv cloudflared artifacts/cloudflared
-
-.PHONY: ci-fips-build
-ci-fips-build:
-	@FIPS=true GOOS=linux GOARCH=amd64 $(MAKE) cloudflared
-	@mkdir -p artifacts
-	@mv cloudflared artifacts/cloudflared
-
-.PHONY: ci-test
-ci-test: fmt-check lint test
-	@go run -mod=readonly github.com/jstemmer/go-junit-report/v2@latest -in $(GO_TEST_LOG_OUTPUT) -parser gojson -out report.xml -set-exit-code
-
-.PHONY: ci-fips-test
-ci-fips-test:
-	@FIPS=true $(MAKE) ci-test
-
-.PHONY: install-hooks
-install-hooks:
-	git config core.hooksPath .githooks
-	@echo "Git hooks installed from .githooks/"
-	@echo "Pre-push hook will run: make fmt-check lint test"
+	go generate mocks/mockgen.go

.github/workflows/semgrep.yml

@@ -52,26 +52,44 @@ func serverRegistrationErrorFromRPC(err error) ServerRegisterTunnelError {
 	}
 }
 
-type ControlStreamError struct{}
+type ControlStreamError struct {
+	Cause error
+}
 
 var _ error = &ControlStreamError{}
 
 func (e *ControlStreamError) Error() string {
 	return "control stream encountered a failure while serving"
 }
 
-type StreamListenerError struct{}
+func (e *ControlStreamError) Unwrap() error {
+	return e.Cause
+}
+
+type StreamListenerError struct {
+	Cause error
+}
 
 var _ error = &StreamListenerError{}
 
 func (e *StreamListenerError) Error() string {
 	return "accept stream listener encountered a failure while serving"
 }
 
-type DatagramManagerError struct{}
+func (e *StreamListenerError) Unwrap() error {
+	return e.Cause
+}
+
+type DatagramManagerError struct {
+	Cause error
+}
 
 var _ error = &DatagramManagerError{}
 
 func (e *DatagramManagerError) Error() string {
 	return "datagram manager encountered a failure while serving"
 }
+
+func (e *DatagramManagerError) Unwrap() error {
+	return e.Cause
+}

Makefile

@@ -120,23 +120,23 @@ func (q *quicConnection) Serve(ctx context.Context) error {
 		if err != nil {
 			q.logger.Error().Err(err).Msg("failed to serve the control stream")
 		}
-		return &ControlStreamError{}
+		return &ControlStreamError{Cause: err}
 	})
 	// Start the accept stream loop routine
 	errGroup.Go(func() error {
 		err := q.acceptStream(ctx)
 		if err != nil {
 			q.logger.Error().Err(err).Msg("failed to accept incoming stream requests")
 		}
-		return &StreamListenerError{}
+		return &StreamListenerError{Cause: err}
 	})
 	// Start the datagram handler routine
 	errGroup.Go(func() error {
 		err := q.datagramHandler.Serve(ctx)
 		if err != nil {
 			q.logger.Error().Err(err).Msg("failed to run the datagram handler")
 		}
-		return &DatagramManagerError{}
+		return &DatagramManagerError{Cause: err}
 	})
 
 	return errGroup.Wait()

connection/errors.go

@@ -1,4 +1,4 @@
-//go:build darwin || linux
+//go:build darwin || linux || freebsd || openbsd || netbsd
 
 package diagnostic
 

connection/quic_connection.go

@@ -1,4 +1,4 @@
-//go:build darwin || linux
+//go:build darwin || linux || freebsd || openbsd || netbsd
 
 package diagnostic_test