Rust backend/CLI replacement (previously Go)

.cargo/config.toml

@@ -0,0 +1,57 @@
+# Cross-compilation toolchain wiring for the release targets.
+#
+# These settings only take effect when building the named `--target`, so a
+# normal host build (`cargo build`, tests, the default host triple) is
+# completely unaffected. We cross-compile natively with `cargo build --target …`
+# (no `cargo-zigbuild`). `ring` (the rustls crypto backend) compiles C + assembly
+# via its build script, so each target needs a matching C cross-compiler
+# (`CC_*`/`AR_*` below), not just a linker.
+#
+# All toolchains are apt-installable on Debian/Ubuntu (no third-party downloads):
+#   x86_64-unknown-linux-musl       musl-tools                → musl-gcc
+#   aarch64-unknown-linux-musl      gcc-aarch64-linux-gnu     → aarch64-linux-gnu-gcc
+#   armv7-unknown-linux-musleabihf  gcc-arm-linux-gnueabihf   → arm-linux-gnueabihf-gcc
+#   x86_64-pc-windows-gnu           gcc-mingw-w64-x86-64      → x86_64-w64-mingw32-gcc
+#
+# The ARM linux targets use the GNU cross-gcc only as the link driver / to
+# compile ring's C; Rust's `*-linux-musl` target supplies the static musl libc
+# itself (self-contained, crt-static by default), so the output is a fully
+# static musl binary that runs on bare Alpine — no aarch64/armv7 *musl* gcc
+# (e.g. the flaky musl.cc toolchains) is required.
+
+[target.x86_64-unknown-linux-musl]
+linker = "musl-gcc"
+
+[target.aarch64-unknown-linux-musl]
+linker = "aarch64-linux-gnu-gcc"
+
+[target.armv7-unknown-linux-musleabihf]
+linker = "arm-linux-gnueabihf-gcc"
+
+[target.x86_64-pc-windows-gnu]
+linker = "x86_64-w64-mingw32-gcc"
+
+# FreeBSD has no apt cross-gcc, so we cross with clang + a FreeBSD base sysroot
+# (extracted to /opt/freebsd-sysroot — see _build.yml). clang is the
+# link driver (with lld); the sysroot supplies FreeBSD's libc/crt + headers.
+[target.x86_64-unknown-freebsd]
+linker = "clang"
+rustflags = [
+    "-Clink-arg=--target=x86_64-unknown-freebsd",
+    "-Clink-arg=--sysroot=/opt/freebsd-sysroot",
+    "-Clink-arg=-fuse-ld=lld",
+]
+
+# C cross-compilers for `ring`'s build script (the `cc` crate reads `CC_<triple>`
+# / `AR_<triple>`). Only consulted when building the corresponding target.
+[env]
+CC_x86_64_unknown_linux_musl = "musl-gcc"
+CC_aarch64_unknown_linux_musl = "aarch64-linux-gnu-gcc"
+AR_aarch64_unknown_linux_musl = "aarch64-linux-gnu-ar"
+CC_armv7_unknown_linux_musleabihf = "arm-linux-gnueabihf-gcc"
+AR_armv7_unknown_linux_musleabihf = "arm-linux-gnueabihf-ar"
+CC_x86_64_pc_windows_gnu = "x86_64-w64-mingw32-gcc"
+# FreeBSD: clang targets it directly given the sysroot (ring's C build).
+CC_x86_64_unknown_freebsd = "clang"
+AR_x86_64_unknown_freebsd = "llvm-ar"
+CFLAGS_x86_64_unknown_freebsd = "--target=x86_64-unknown-freebsd --sysroot=/opt/freebsd-sysroot"

.dockerignore

@@ -0,0 +1,8 @@
+# Keep the Docker build context small. `.git` is intentionally NOT ignored:
+# the build regenerates `public_version.ts` via `git describe`. The pre-built
+# `silverbullet-<arch>` binaries (used by Dockerfile.ci) are also NOT ignored.
+target/
+.cargo-target/
+node_modules/
+dist/
+*.log

.github/workflows/_build.yml

@@ -0,0 +1,234 @@
+name: Build (reusable)
+
+on:
+  workflow_call:
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  # sccache caches compiled objects across Cargo.lock changes (rust-cache alone
+  # invalidates fully on dep changes). Valuable here: each job compiles several
+  # release targets.
+  SCCACHE_GHA_ENABLED: "true"
+  RUSTC_WRAPPER: sccache
+
+jobs:
+  build-linux:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Setup repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Setup Rust (linux musl + windows-gnu + freebsd targets)
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-unknown-linux-musl,aarch64-unknown-linux-musl,armv7-unknown-linux-musleabihf,x86_64-pc-windows-gnu,x86_64-unknown-freebsd
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: linux-cross
+
+      - name: Setup sccache
+        uses: mozilla-actions/sccache-action@v0.0.10
+
+      # GHA Cache occasionally returns Azure edge errors; if the sccache daemon
+      # can't reach the backend it refuses to start, failing every rustc call.
+      # Probe once and disable for this job on outage — a slow build beats a
+      # failed release.
+      - name: Probe sccache backend, disable on outage
+        shell: bash
+        run: |
+          if sccache --start-server; then
+            echo "sccache backend reachable"
+          else
+            echo "::warning::sccache backend unreachable — disabling for this job"
+            echo "RUSTC_WRAPPER=" >> "$GITHUB_ENV"
+            echo "SCCACHE_GHA_ENABLED=false" >> "$GITHUB_ENV"
+          fi
+
+      - name: Install cross-toolchains
+        run: |
+          sudo apt-get update
+          # apt-only C cross-compilers; Rust supplies the static musl libc itself.
+          # clang/lld/llvm are for the FreeBSD cross-build (no apt freebsd gcc).
+          # (linker/CC wiring lives in .cargo/config.toml)
+          sudo apt-get install -y musl-tools gcc-aarch64-linux-gnu \
+                                  gcc-arm-linux-gnueabihf gcc-mingw-w64-x86-64 \
+                                  clang lld llvm
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Build linux/windows binaries (compile once → raw + zips)
+        run: make build-linux-ci
+
+      - name: Build FreeBSD sb CLI (experimental — best effort)
+        # FreeBSD cross is fiddly (clang + sysroot). The sysroot fetch AND the
+        # build live together here under continue-on-error, AFTER the main build,
+        # so nothing FreeBSD-related can ever block the release. The sb-freebsd
+        # zip is added only when this whole step succeeds.
+        continue-on-error: true
+        run: |
+          sudo mkdir -p /opt/freebsd-sysroot
+          VER=$(curl -fsSL https://download.freebsd.org/releases/amd64/ \
+            | grep -oE '[0-9]+\.[0-9]+-RELEASE' | sort -V | uniq | tail -1)
+          echo "Latest FreeBSD release: $VER"
+          curl -fsSL "https://download.freebsd.org/releases/amd64/$VER/base.txz" \
+            | sudo tar -xJf - -C /opt/freebsd-sysroot ./lib ./usr/lib ./usr/include
+          make build-cli-releases-freebsd
+
+      - name: Upload release zips (linux/windows/freebsd)
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-zips-linux
+          path: |
+            silverbullet-server-*.zip
+            sb-*.zip
+          if-no-files-found: error
+
+      - name: Upload raw docker binaries
+        uses: actions/upload-artifact@v4
+        with:
+          name: docker-binaries
+          path: |
+            silverbullet-amd64
+            silverbullet-arm64
+            silverbullet-arm
+          if-no-files-found: error
+
+  build-macos:
+    runs-on: macos-latest
+    steps:
+      - name: Setup repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: macos
+
+      - name: Setup sccache
+        uses: mozilla-actions/sccache-action@v0.0.10
+
+      - name: Probe sccache backend, disable on outage
+        shell: bash
+        run: |
+          if sccache --start-server; then
+            echo "sccache backend reachable"
+          else
+            echo "::warning::sccache backend unreachable — disabling for this job"
+            echo "RUSTC_WRAPPER=" >> "$GITHUB_ENV"
+            echo "SCCACHE_GHA_ENABLED=false" >> "$GITHUB_ENV"
+          fi
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Build server + CLI release archives (darwin x2)
+        run: |
+          make build-server-releases-macos
+          make build-cli-releases-rust-macos
+
+      - name: Import certificate into keychain
+        env:
+          APPLE_CERTIFICATE_P12_BASE64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          echo "$APPLE_CERTIFICATE_P12_BASE64" | base64 --decode > certificate.p12
+
+          KEYCHAIN_PATH="$RUNNER_TEMP/signing.keychain-db"
+          KEYCHAIN_PASSWORD="$(openssl rand -hex 20)"
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+
+          security import certificate.p12 \
+            -P "$APPLE_CERTIFICATE_PASSWORD" \
+            -A \
+            -t cert \
+            -f pkcs12 \
+            -k "$KEYCHAIN_PATH"
+
+          security list-keychain -d user -s "$KEYCHAIN_PATH"
+
+          security set-key-partition-list -S apple-tool:,apple:,codesign: \
+            -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+
+          rm certificate.p12
+
+      - name: Sign and notarize macOS binaries
+        env:
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_KEY_ISSUER_ID: ${{ secrets.APPLE_API_KEY_ISSUER_ID }}
+          APPLE_API_KEY_P8_BASE64: ${{ secrets.APPLE_API_KEY_P8_BASE64 }}
+        run: |
+          mkdir -p "$HOME/private_keys"
+          echo "$APPLE_API_KEY_P8_BASE64" | base64 --decode \
+            > "$HOME/private_keys/AuthKey_${APPLE_API_KEY_ID}.p8"
+
+          IDENTITY="Developer ID Application: Zef Hemel ($APPLE_TEAM_ID)"
+
+          # Both the server and the `sb` CLI darwin archives.
+          for zip_file in *-darwin-*.zip; do
+            echo "=== Processing $zip_file ==="
+            zip_file="$(pwd)/$zip_file"
+
+            WORK_DIR=$(mktemp -d)
+            unzip -o "$zip_file" -d "$WORK_DIR"
+            BINARY=$(ls "$WORK_DIR")
+
+            codesign --force --options runtime \
+              --sign "$IDENTITY" \
+              --timestamp \
+              "$WORK_DIR/$BINARY"
+
+            codesign --verify --verbose "$WORK_DIR/$BINARY"
+
+            NOTARIZE_ZIP="$WORK_DIR/notarize.zip"
+            ditto -c -k --keepParent "$WORK_DIR/$BINARY" "$NOTARIZE_ZIP"
+
+            xcrun notarytool submit "$NOTARIZE_ZIP" \
+              --key "$HOME/private_keys/AuthKey_${APPLE_API_KEY_ID}.p8" \
+              --key-id "$APPLE_API_KEY_ID" \
+              --issuer "$APPLE_API_KEY_ISSUER_ID" \
+              --wait --timeout 10m
+
+            rm "$zip_file"
+            (cd "$WORK_DIR" && zip "$zip_file" "$BINARY")
+
+            rm -rf "$WORK_DIR"
+          done
+
+          rm -rf "$HOME/private_keys"
+
+      - name: Clean up keychain
+        if: always()
+        run: |
+          security delete-keychain "$RUNNER_TEMP/signing.keychain-db" 2>/dev/null || true
+
+      - name: Upload macOS release zips
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-zips-macos
+          path: |
+            silverbullet-server-darwin-*.zip
+            sb-darwin-*.zip
+          if-no-files-found: error