Merge pull request #2581 from freeacetone/ci-release

CI release

.github/workflows/build-deb.yml

@@ -14,21 +14,26 @@ on:
     - libi2pd_client/**
     - Makefile
     - Makefile.linux
-    tags:
-    - '*'
   pull_request:
     branches:
     - '*'
+  workflow_call:
 
 jobs:
   build:
-    name: ${{ matrix.dist }}
-    runs-on: ubuntu-latest
+    name: ${{ matrix.dist }} ${{ matrix.arch }}
+    runs-on: ${{ matrix.runner }}
 
     strategy:
       fail-fast: false
       matrix:
-        dist: ['bookworm','trixie']
+        dist: ['trixie']
+        arch: ['amd64', 'arm64']
+        include:
+        - arch: amd64
+          runner: ubuntu-latest
+        - arch: arm64
+          runner: ubuntu-24.04-arm
 
     steps:
     - name: Checkout
@@ -41,22 +46,20 @@ jobs:
       uses: prompt/actions-commit-hash@v3.0.0
 
     - name: Build package
-      env:
-        MAKEFLAGS: "TORRENTS=N"
       uses: jtdor/build-deb-action@v1
       with:
         docker-image: debian:${{ matrix.dist }}-slim
         buildpackage-opts: --build=binary --no-sign
-        before-build-hook: debchange --controlmaint --local "+${{ steps.commit.outputs.short }}~${{ matrix.dist }}" -b --distribution ${{ matrix.dist }} "CI build"
+        before-build-hook: debchange --controlmaint --local "${{ startsWith(github.ref, 'refs/tags/') && matrix.dist || format('+{0}~{1}', steps.commit.outputs.short, matrix.dist) }}" -b --distribution ${{ matrix.dist }} "CI build"
         extra-build-deps: devscripts git
     - name: Upload package
       uses: actions/upload-artifact@v4
       with:
-        name: i2pd_${{ matrix.dist }}
+        name: i2pd_${{ matrix.dist }}_${{ matrix.arch }}
         path: debian/artifacts/i2pd_*.deb
 
     - name: Upload debugging symbols
       uses: actions/upload-artifact@v4
       with:
-        name: i2pd-dbgsym_${{ matrix.dist }}
+        name: i2pd-dbgsym_${{ matrix.dist }}_${{ matrix.arch }}
         path: debian/artifacts/i2pd-dbgsym_*.deb

.github/workflows/build-freebsd.yml

@@ -14,37 +14,54 @@ on:
     - libi2pd_client/**
     - Makefile
     - Makefile.bsd
-    tags:
-    - '*'
+    - contrib/static/build-freebsd.sh
   pull_request:
     branches:
     - '*'
+  workflow_call:
 
 jobs:
   build:
     runs-on: ubuntu-latest
-    name: with UPnP
+    name: FreeBSD ${{ matrix.release }} static
+
+    strategy:
+      fail-fast: false
+      matrix:
+        release: ['14.4', '15.0']
 
     steps:
     - name: Checkout
       uses: actions/checkout@v4
 
-    - name: Test in FreeBSD
-      id: test
+    - name: Build in FreeBSD
       uses: vmactions/freebsd-vm@v1
       with:
+        release: ${{ matrix.release }}
         usesh: true
-        mem: 2048
+        mem: 4096
         sync: rsync
         copyback: true
-        prepare: pkg install -y devel/cmake devel/gmake devel/boost-libs security/openssl net/miniupnpc
+        prepare: |
+          sed -i '' 's|/quarterly"|/latest"|' /etc/pkg/FreeBSD.conf
+          pkg update -f
+          pkg install -y devel/cmake devel/gmake perl5 devel/boost-libs net/miniupnpc
         run: |
-          cd build
-          cmake -DWITH_UPNP=ON -DCMAKE_BUILD_TYPE=Release .
-          gmake -j2
+          set -e
+          sh contrib/static/build-freebsd.sh
+          file build/i2pd | grep 'statically linked'
+          build/i2pd --version
+          build/i2pd --version | grep -E '^OpenSSL (3\.([5-9]|[1-9][0-9])|[4-9])\.'
+          build/i2pd --version | grep -E '^Boost version 1\.(8[1-9]|9[0-9])\.'
+          mkdir /tmp/datadir
+          build/i2pd --datadir=/tmp/datadir --log=file --logfile=/tmp/datadir/i2pd.log --loglevel=info &
+          sleep 15
+          kill -0 $!
+          grep 'Daemon: Starting NetDB' /tmp/datadir/i2pd.log
+          kill -9 $!
 
     - name: Upload artifacts
       uses: actions/upload-artifact@v4
       with:
-        name: i2pd-freebsd
+        name: i2pd-freebsd-${{ matrix.release }}
         path: build/i2pd

.github/workflows/build-macos.yml

@@ -6,48 +6,94 @@ on:
     - '*'
     paths:
     - .github/workflows/build-macos.yml
+    - contrib/static/build-macos.sh
     - daemon/**
     - i18n/**
     - libi2pd/**
     - libi2pd_client/**
     - Makefile
     - Makefile.homebrew
-    tags:
-    - '*'
   pull_request:
     branches:
     - '*'
+  workflow_call:
 
 jobs:
   build:
-    name: Build on ${{ matrix.target-name }}
-    runs-on: ${{ matrix.target }}
+    name: Build ${{ matrix.name }}
+    runs-on: ${{ matrix.runner }}
 
     strategy:
-      fail-fast: true
+      fail-fast: false
       matrix:
-        include:
-          - target: macos-15
-            target-name: ARM64
-          - target: macos-15-intel
-            target-name: Intel x86_64
+        # the universal binary needs cross-compilation, so it is built for releases only
+        include: ${{ fromJSON(github.ref_type == 'tag' && '[{"name":"universal","runner":"macos-15","archs":"arm64 x86_64"}]' || '[{"name":"arm64","runner":"macos-15","archs":"arm64"},{"name":"x86_64","runner":"macos-15-intel","archs":"x86_64"}]') }}
+
+    env:
+      ARCHS: ${{ matrix.archs }}
 
     steps:
     - name: Checkout
       uses: actions/checkout@v4
 
-    - name: Install required formulae
-      run: |
-        find /usr/local/bin -lname '*/Library/Frameworks/Python.framework/*' -delete
-        brew update
-        brew install boost miniupnpc openssl@3.5
-
-    - name: List installed formulae
-      run: brew list
-
     - name: Build application
-      run: make HOMEBREW=1 USE_UPNP=yes USE_STATIC=yes PREFIX=$GITHUB_WORKSPACE/output -j3
+      run: sh contrib/static/build-macos.sh
 
-    - name: Print binary linking
-      run: otool -L i2pd
-    
+    - name: Check binary
+      run: |
+        for arch in $ARCHS; do lipo -archs i2pd | grep -w $arch; done
+        otool -L i2pd
+        test -z "$(otool -L i2pd | grep -E '^[[:space:]]' | grep -vE '^[[:space:]]+(/usr/lib/|/System/Library/)')"
+        vtool -show-build i2pd | grep -E 'architecture|minos|sdk'
+        set -- $ARCHS
+        test "$(vtool -show-build i2pd | grep -c 'minos 12\.0$')" = $#
+        ./i2pd --version
+        ./i2pd --version | grep -E '^OpenSSL (3\.([5-9]|[1-9][0-9])|[4-9])\.'
+        ./i2pd --version | grep -E '^Boost version 1\.(8[1-9]|9[0-9])\.'
+
+    - name: Run
+      run: |
+        mkdir datadir
+        ./i2pd --datadir=datadir --log=file --logfile=datadir/i2pd.log --loglevel=info &
+        sleep 15
+        kill -0 $!
+        grep 'Daemon: Starting NetDB' datadir/i2pd.log
+        kill -9 $!
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: i2pd-macos-${{ matrix.name }}
+        path: i2pd
+
+  test:
+    name: Run universal binary on ${{ matrix.target-name }}
+    if: github.ref_type == 'tag'
+    needs: build
+    runs-on: ${{ matrix.target }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: macos-14
+            target-name: macOS 14 ARM64
+          - target: macos-15-intel
+            target-name: macOS 15 Intel x86_64
+
+    steps:
+    - name: Download binary
+      uses: actions/download-artifact@v4
+      with:
+        name: i2pd-macos-universal
+
+    - name: Run
+      run: |
+        chmod +x i2pd
+        ./i2pd --version
+        mkdir datadir
+        ./i2pd --datadir=datadir --log=file --logfile=datadir/i2pd.log --loglevel=info &
+        sleep 15
+        kill -0 $!
+        grep 'Daemon: Starting NetDB' datadir/i2pd.log
+        kill -9 $!

.github/workflows/build-static.yml

@@ -0,0 +1,120 @@
+name: Build static binaries
+
+on:
+  push:
+    branches:
+    - '*'
+    paths:
+    - .github/workflows/build-static.yml
+    - contrib/**
+    - daemon/**
+    - debian/**
+    - i18n/**
+    - libi2pd/**
+    - libi2pd_client/**
+    - Makefile
+    - Makefile.linux
+  pull_request:
+    branches:
+    - '*'
+  workflow_call:
+
+jobs:
+  build:
+    name: musl ${{ matrix.arch }}
+    runs-on: ${{ matrix.arch == 'aarch64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # armhf and s390x run under QEMU, so they are built for releases only
+        arch: ${{ fromJSON(github.ref_type == 'tag' && '["x86_64", "aarch64", "x86", "armhf", "s390x"]' || '["x86_64", "aarch64", "x86"]') }}
+
+    env:
+      PLATFORM: ${{ fromJSON('{"x86_64":"linux/amd64","aarch64":"linux/arm64","x86":"linux/386","armhf":"linux/arm/v6","s390x":"linux/s390x"}')[matrix.arch] }}
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Set up QEMU
+      if: ${{ matrix.arch == 'armhf' || matrix.arch == 's390x' }}
+      uses: docker/setup-qemu-action@v3
+
+    - name: Build in Alpine
+      run: docker run --rm --platform $PLATFORM -v "$PWD":/src -w /src alpine:3.22 ${{ matrix.arch == 'x86' && 'linux32' || '' }} sh contrib/static/build-musl.sh
+
+    - name: Check binary
+      run: |
+        file i2pd | grep 'statically linked'
+        readelf -d i2pd | grep 'There is no dynamic section'
+        ./i2pd --version
+        ./i2pd --version | grep -E '^OpenSSL (3\.([5-9]|[1-9][0-9])|[4-9])\.'
+        ./i2pd --version | grep -E '^Boost version 1\.(8[1-9]|9[0-9])\.'
+
+    - name: Run
+      run: |
+        mkdir datadir
+        ./i2pd --datadir=datadir --log=file --logfile=datadir/i2pd.log --loglevel=info &
+        sleep 15
+        kill -0 $!
+        grep 'Daemon: Starting NetDB' datadir/i2pd.log
+        kill -9 $!
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: i2pd-static-${{ matrix.arch }}
+        path: i2pd
+
+  package:
+    name: deb and rpm packages
+    needs: build
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Download binaries
+      uses: actions/download-artifact@v4
+      with:
+        pattern: i2pd-static-*
+        path: bin
+
+    - name: Set package version
+      run: |
+        if [ "$GITHUB_REF_TYPE" = tag ]; then
+          echo "VERSION=$GITHUB_REF_NAME" >> $GITHUB_ENV
+          echo "RPM_VERSION=$GITHUB_REF_NAME" >> $GITHUB_ENV
+          echo "RPM_RELEASE=1" >> $GITHUB_ENV
+        else
+          base=$(sed -nE 's/^#define I2PD_VERSION_(MAJOR|MINOR|MICRO) ([0-9]+)$/\2/p' libi2pd/version.h | paste -sd.)
+          rev=git$(git log -1 --format=%cd --date=format:%Y%m%d).$(git rev-parse --short=7 HEAD)
+          echo "VERSION=$base+$rev" >> $GITHUB_ENV
+          echo "RPM_VERSION=$base" >> $GITHUB_ENV
+          echo "RPM_RELEASE=0.$rev" >> $GITHUB_ENV
+        fi
+
+    - name: Build deb packages
+      run: docker run --rm -e VERSION -v "$PWD":/src -w /src debian:bookworm sh contrib/static/package.sh deb bin out
+
+    - name: Build rpm packages
+      run: docker run --rm -e VERSION -e RPM_VERSION -e RPM_RELEASE -v "$PWD":/src -w /src rockylinux:9 sh contrib/static/package.sh rpm bin out
+
+    - name: Test packages
+      run: |
+        for img in debian:trixie ubuntu:24.04; do
+          docker run --rm -e DEBIAN_FRONTEND=noninteractive -v "$PWD/out":/o $img sh -ec \
+            'apt-get update -qq; apt-get install -y -qq /o/*_linux-all_amd64.deb; dpkg -V i2pd; i2pd --version; apt-get purge -y -qq i2pd'
+        done
+        for img in rockylinux:9 fedora:latest; do
+          docker run --rm -v "$PWD/out":/o $img sh -ec \
+            'dnf -q -y install /o/*_linux-all_x86_64.rpm; rpm -V i2pd; i2pd --version; dnf -q -y remove i2pd'
+        done
+
+    - name: Upload packages
+      uses: actions/upload-artifact@v4
+      with:
+        name: i2pd-linux-all
+        path: out/*

.github/workflows/build-windows.yml

@@ -15,11 +15,10 @@ on:
     - Win32/**
     - Makefile
     - Makefile.mingw
-    tags:
-    - '*'
   pull_request:
     branches:
     - '*'
+  workflow_call:
 
 defaults:
   run:
@@ -28,16 +27,17 @@ defaults:
 jobs:
   build:
     name: ${{ matrix.arch }}
-    runs-on: windows-latest
+    runs-on: ${{ matrix.os }}
 
     strategy:
       fail-fast: false
       matrix:
         include: [
-          { msystem: UCRT64, arch: ucrt-x86_64, arch_short: x64-ucrt, compiler: gcc },
-          { msystem: CLANG64, arch: clang-x86_64, arch_short: x64-clang, compiler: clang },
-          { msystem: MINGW64, arch: x86_64, arch_short: x64, compiler: gcc },
-          # { msystem: MINGW32, arch: i686, arch_short: x86, compiler: gcc }
+          { msystem: UCRT64, arch: ucrt-x86_64, arch_short: x64-ucrt, compiler: gcc, os: windows-latest },
+          { msystem: CLANG64, arch: clang-x86_64, arch_short: x64-clang, compiler: clang, os: windows-latest },
+          { msystem: MINGW64, arch: x86_64, arch_short: x64, compiler: gcc, os: windows-latest },
+          { msystem: MINGW32, arch: i686, arch_short: x86, compiler: gcc, os: windows-latest },
+          { msystem: CLANGARM64, arch: clang-aarch64, arch_short: arm64, compiler: clang, os: windows-11-arm }
         ]
 
     steps:
@@ -50,11 +50,43 @@ jobs:
       uses: msys2/setup-msys2@v2
       with:
         msystem: ${{ matrix.msystem }}
-        install: base-devel git mingw-w64-${{ matrix.arch }}-${{ matrix.compiler }} mingw-w64-${{ matrix.arch }}-boost mingw-w64-${{ matrix.arch }}-openssl mingw-w64-${{ matrix.arch }}-miniupnpc
+        install: >-
+          base-devel git mingw-w64-${{ matrix.arch }}-${{ matrix.compiler }} mingw-w64-${{ matrix.arch }}-openssl
+          ${{ matrix.msystem == 'MINGW32' && 'mingw-w64-i686-cmake mingw-w64-i686-ninja' || format('mingw-w64-{0}-boost mingw-w64-{0}-miniupnpc', matrix.arch) }}
         update: true
 
+    # MSYS2 no longer ships Boost and miniupnpc for i686
+    - name: Build Boost and miniupnpc
+      if: ${{ matrix.msystem == 'MINGW32' }}
+      env:
+        BOOST_VERSION: 1.92.0
+        BOOST_SHA256: ea7b982002cc9dfbe59b0b217b206f470dc75f3de0bb2973d844118934d82411
+        MINIUPNPC_VERSION: 2.3.3
+        MINIUPNPC_SHA256: d52a0afa614ad6c088cc9ddff1ae7d29c8c595ac5fdd321170a05f41e634bd1a
+      run: |
+        set -e
+        curl -fsSL -o boost.tar.xz https://github.com/boostorg/boost/releases/download/boost-$BOOST_VERSION/boost-$BOOST_VERSION-b2-nodocs.tar.xz
+        echo "$BOOST_SHA256  boost.tar.xz" | sha256sum -c -
+        tar xJf boost.tar.xz
+        cd boost-$BOOST_VERSION
+        ./bootstrap.sh --with-toolset=gcc
+        ./b2 -j4 toolset=gcc target-os=windows threadapi=win32 address-model=32 architecture=x86 \
+          link=static threading=multi variant=release --layout=system \
+          --with-filesystem --with-program_options --with-json --with-url stage
+        cp -r boost $MINGW_PREFIX/include/
+        # Makefile.mingw links the MSYS2 library names with the -mt suffix
+        for lib in filesystem program_options json url; do cp stage/lib/libboost_$lib.a $MINGW_PREFIX/lib/libboost_$lib-mt.a; done
+        cd ..
+        curl -fsSL -o miniupnpc.tar.gz https://github.com/miniupnp/miniupnp/releases/download/miniupnpc_${MINIUPNPC_VERSION//./_}/miniupnpc-$MINIUPNPC_VERSION.tar.gz
+        echo "$MINIUPNPC_SHA256  miniupnpc.tar.gz" | sha256sum -c -
+        tar xzf miniupnpc.tar.gz
+        cmake -S miniupnpc-$MINIUPNPC_VERSION -B miniupnpc-build -G Ninja -DCMAKE_INSTALL_PREFIX=$MINGW_PREFIX \
+          -DUPNPC_BUILD_SHARED=OFF -DUPNPC_BUILD_TESTS=OFF -DUPNPC_BUILD_SAMPLE=OFF
+        cmake --build miniupnpc-build
+        cmake --install miniupnpc-build
+
     - name: Install additional clang packages
-      if: ${{ matrix.msystem == 'CLANG64' }}
+      if: ${{ matrix.compiler == 'clang' }}
       run: pacman --noconfirm -S mingw-w64-${{ matrix.arch }}-gcc-compat
 
     - name: Build application
@@ -70,16 +102,16 @@ jobs:
 
   build-cmake:
     name: CMake ${{ matrix.arch }}
-    runs-on: windows-latest
+    runs-on: ${{ matrix.os }}
 
     strategy:
       fail-fast: false
       matrix:
         include: [
-          { msystem: UCRT64, arch: ucrt-x86_64, arch_short: x64-ucrt, compiler: gcc },
-          { msystem: CLANG64, arch: clang-x86_64, arch_short: x64-clang, compiler: clang },
-          { msystem: MINGW64, arch: x86_64, arch_short: x64, compiler: gcc },
-          # { msystem: MINGW32, arch: i686, arch_short: x86, compiler: gcc }
+          { msystem: UCRT64, arch: ucrt-x86_64, arch_short: x64-ucrt, compiler: gcc, os: windows-latest },
+          { msystem: CLANG64, arch: clang-x86_64, arch_short: x64-clang, compiler: clang, os: windows-latest },
+          { msystem: MINGW64, arch: x86_64, arch_short: x64, compiler: gcc, os: windows-latest },
+          { msystem: CLANGARM64, arch: clang-aarch64, arch_short: arm64, compiler: clang, os: windows-11-arm }
         ]
 
     steps:
@@ -108,7 +140,6 @@ jobs:
         path: build/i2pd.exe
 
   build-xp:
-    if: false
     name: XP
     runs-on: windows-latest
 
@@ -125,62 +156,57 @@ jobs:
       uses: msys2/setup-msys2@v2
       with:
         msystem: MINGW32
-        install: base-devel git mingw-w64-i686-gcc mingw-w64-i686-boost mingw-w64-i686-openssl mingw-w64-i686-miniupnpc
+        install: base-devel git mingw-w64-i686-gcc mingw-w64-i686-openssl mingw-w64-i686-cmake mingw-w64-i686-ninja
         cache: true
         update: true
 
-    - name: Clone MinGW packages repository and revert boost to 1.85.0
-      run: |
-        git clone https://github.com/msys2/MINGW-packages
-        cd MINGW-packages
-        git checkout 4cbb366edf2f268ac3146174b40ce38604646fc5 mingw-w64-boost
-        cd mingw-w64-boost
-        sed -i 's/boostorg.jfrog.io\/artifactory\/main/archives.boost.io/' PKGBUILD
+    - name: Clone MinGW packages repository
+      run: git clone https://github.com/msys2/MINGW-packages
 
     # headers
     - name: Get headers package version
       id:  version-headers
       run: |
-        echo "version=$(pacman -Si mingw-w64-i686-headers-git | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
+        echo "version=$(pacman -Si mingw-w64-i686-headers | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
     - name: Cache headers package
       uses: actions/cache@v4
       id: cache-headers
       with:
-        path: MINGW-packages/mingw-w64-headers-git/*.zst
+        path: MINGW-packages/mingw-w64-headers/*.zst
         key: winxp-headers-${{ steps.version-headers.outputs.version }}
     - name: Build WinXP-capable headers package
       if: steps.cache-headers.outputs.cache-hit != 'true'
       run: |
-        cd MINGW-packages/mingw-w64-headers-git
+        cd MINGW-packages/mingw-w64-headers
         sed -i 's/0x601/0x501/' PKGBUILD
         MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
     - name: Install headers package
-      run: pacman --noconfirm -U MINGW-packages/mingw-w64-headers-git/mingw-w64-i686-*-any.pkg.tar.zst
+      run: pacman --noconfirm -U MINGW-packages/mingw-w64-headers/mingw-w64-i686-*-any.pkg.tar.zst
 
     # CRT
     - name: Get crt package version
       id:  version-crt
       run: |
-        echo "version=$(pacman -Si mingw-w64-i686-crt-git | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
+        echo "version=$(pacman -Si mingw-w64-i686-crt | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
     - name: Cache crt package
       uses: actions/cache@v4
       id: cache-crt
       with:
-        path: MINGW-packages/mingw-w64-crt-git/*.zst
+        path: MINGW-packages/mingw-w64-crt/*.zst
         key: winxp-crt-${{ steps.version-crt.outputs.version }}
     - name: Build WinXP-capable crt package
       if: steps.cache-crt.outputs.cache-hit != 'true'
       run: |
-        cd MINGW-packages/mingw-w64-crt-git
+        cd MINGW-packages/mingw-w64-crt
         MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
     - name: Install crt package
-      run: pacman --noconfirm -U MINGW-packages/mingw-w64-crt-git/mingw-w64-i686-*-any.pkg.tar.zst
+      run: pacman --noconfirm -U MINGW-packages/mingw-w64-crt/mingw-w64-i686-*-any.pkg.tar.zst
 
     # winpthreads
     - name: Get winpthreads package version
       id:  version-winpthreads
       run: |
-        echo "version=$(pacman -Si mingw-w64-i686-winpthreads-git | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
+        echo "version=$(pacman -Si mingw-w64-i686-winpthreads | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
     - name: Cache winpthreads package
       uses: actions/cache@v4
       id: cache-winpthreads
@@ -205,42 +231,54 @@ jobs:
       id: cache-openssl
       with:
         path: MINGW-packages/mingw-w64-openssl/*.zst
-        key: winxp-openssl-${{ steps.version-openssl.outputs.version }}
+        key: winxp-openssl-${{ steps.version-openssl.outputs.version }}-no-uplink
     - name: Build WinXP-capable openssl package
       if: steps.cache-openssl.outputs.cache-hit != 'true'
       run: |
+        set -e
         cd MINGW-packages/mingw-w64-openssl
+        # ms/uplink.c imports msvcrt.dll!wcscpy_s, which Windows XP does not have
+        sed -i 's/^    shared \\$/    shared no-uplink \\/' PKGBUILD
+        grep -q '^    shared no-uplink \\$' PKGBUILD
         curl https://openssl-library.org/source/pubkeys.asc | gpg --import
         MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
     - name: Install openssl package
       run: pacman --noconfirm -U MINGW-packages/mingw-w64-openssl/mingw-w64-i686-*-any.pkg.tar.zst
 
     # Boost
-    #- name: Get boost package version
-    #  id:  version-boost
-    #  run: |
-    #    echo "version=$(pacman -Si mingw-w64-i686-boost | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
-    - name: Cache boost package
-      uses: actions/cache@v4
-      id: cache-boost
-      with:
-        path: MINGW-packages/mingw-w64-boost/*.zst
-        key: winxp-boost-1.85.0+crt-${{ steps.version-headers.outputs.version }}+ossl-${{ steps.version-openssl.outputs.version }}
-    - name: Build WinXP-capable boost package
-      if: steps.cache-boost.outputs.cache-hit != 'true'
+    - name: Build Boost and miniupnpc
+      env:
+        BOOST_VERSION: 1.85.0
+        BOOST_SHA256: be0d91732d5b0cc6fbb275c7939974457e79b54d6f07ce2e3dfdd68bef883b0b
+        MINIUPNPC_VERSION: 2.3.3
+        MINIUPNPC_SHA256: d52a0afa614ad6c088cc9ddff1ae7d29c8c595ac5fdd321170a05f41e634bd1a
       run: |
-        cd MINGW-packages/mingw-w64-boost
-        MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
-    - name: Remove boost packages
-      run: pacman --noconfirm -R mingw-w64-i686-boost mingw-w64-i686-boost-libs
-    - name: Install boost package
-      run: pacman --noconfirm -U MINGW-packages/mingw-w64-boost/mingw-w64-i686-*-any.pkg.tar.zst
+        set -e
+        curl -fsSL -o boost.tar.gz https://archives.boost.io/release/$BOOST_VERSION/source/boost_${BOOST_VERSION//./_}.tar.gz
+        echo "$BOOST_SHA256  boost.tar.gz" | sha256sum -c -
+        tar xzf boost.tar.gz
+        cd boost_${BOOST_VERSION//./_}
+        ./bootstrap.sh --with-toolset=gcc
+        ./b2 -j4 toolset=gcc target-os=windows threadapi=win32 address-model=32 architecture=x86 \
+          link=static threading=multi variant=release --layout=system \
+          --with-filesystem --with-program_options --with-json --with-url stage
+        cp -r boost $MINGW_PREFIX/include/
+        for lib in filesystem program_options json url; do cp stage/lib/libboost_$lib.a $MINGW_PREFIX/lib/libboost_$lib-mt.a; done
+        cd ..
+        curl -fsSL -o miniupnpc.tar.gz https://github.com/miniupnp/miniupnp/releases/download/miniupnpc_${MINIUPNPC_VERSION//./_}/miniupnpc-$MINIUPNPC_VERSION.tar.gz
+        echo "$MINIUPNPC_SHA256  miniupnpc.tar.gz" | sha256sum -c -
+        tar xzf miniupnpc.tar.gz
+        cmake -S miniupnpc-$MINIUPNPC_VERSION -B miniupnpc-build -G Ninja -DCMAKE_INSTALL_PREFIX=$MINGW_PREFIX \
+          -DUPNPC_BUILD_SHARED=OFF -DUPNPC_BUILD_TESTS=OFF -DUPNPC_BUILD_SAMPLE=OFF
+        cmake --build miniupnpc-build
+        cmake --install miniupnpc-build
 
     # Building i2pd
     - name: Build application
       run: |
         mkdir -p obj/Win32 obj/libi2pd obj/libi2pd_client obj/daemon
         make USE_UPNP=yes DEBUG=no USE_GIT_VERSION=yes USE_WINXP_FLAGS=yes -j3
+        if objdump -p i2pd.exe | grep -w wcscpy_s; then exit 1; fi
     - name: Upload artifacts
       uses: actions/upload-artifact@v4
       with:

.github/workflows/release.yml

@@ -0,0 +1,101 @@
+name: Release
+
+on:
+  push:
+    tags:
+    - '*'
+
+jobs:
+  windows:
+    uses: ./.github/workflows/build-windows.yml
+
+  macos:
+    uses: ./.github/workflows/build-macos.yml
+
+  linux:
+    uses: ./.github/workflows/build-static.yml
+
+  debian:
+    uses: ./.github/workflows/build-deb.yml
+
+  freebsd:
+    uses: ./.github/workflows/build-freebsd.yml
+
+  installer:
+    name: Windows installer
+    needs: windows
+    runs-on: windows-latest
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Download binaries
+      uses: actions/download-artifact@v4
+      with:
+        pattern: i2pd-*.exe
+        path: artifacts
+
+    - name: Build installer
+      shell: pwsh
+      run: |
+        choco install innosetup -y --no-progress
+        Copy-Item artifacts/i2pd-x86.exe/i2pd.exe i2pd_x32.exe
+        Copy-Item artifacts/i2pd-x64.exe/i2pd.exe i2pd_x64.exe
+        Copy-Item artifacts/i2pd-xp.exe/i2pd.exe i2pd_xp.exe
+        & "${env:ProgramFiles(x86)}\Inno Setup 6\ISCC.exe" "/dI2Pd_TextVer=$env:GITHUB_REF_NAME" "/dI2Pd_Ver=$env:GITHUB_REF_NAME.0" build\win_installer.iss
+
+    - name: Upload installer
+      uses: actions/upload-artifact@v4
+      with:
+        name: i2pd-installer
+        path: build/setup_i2pd_v*.exe
+
+  release:
+    name: Release
+    needs: [windows, macos, linux, debian, freebsd, installer]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Download artifacts
+      uses: actions/download-artifact@v4
+      with:
+        path: artifacts
+
+    - name: Prepare release files
+      run: |
+        sudo apt-get update -qq
+        sudo apt-get install -y -qq dos2unix
+        TAG=$GITHUB_REF_NAME
+        mkdir release
+        echo "To use configs and certificates, move all files and certificates folder from contrib directory here." > README.txt
+        unix2dos -q contrib/i2pd.conf contrib/tunnels.conf contrib/tunnels.d/* contrib/webconsole/style.css
+        for build in x64:win64 x86:win32 xp:winxp arm64:winarm64; do
+          cp artifacts/i2pd-${build%%:*}.exe/i2pd.exe i2pd.exe
+          zip -qr9 release/i2pd_${TAG}_${build#*:}_mingw.zip i2pd.exe README.txt \
+            contrib/i2pd.conf contrib/tunnels.conf contrib/certificates contrib/tunnels.d contrib/webconsole
+        done
+        chmod +x artifacts/i2pd-macos-universal/i2pd
+        tar -czf release/i2pd_${TAG}_osx.tar.gz -C artifacts/i2pd-macos-universal i2pd
+        for dir in artifacts/i2pd-freebsd-*; do
+          chmod +x $dir/i2pd
+          rel=${dir##*-}
+          tar -czf release/i2pd_${TAG}_freebsd${rel%%.*}_amd64.tar.gz -C $dir i2pd
+        done
+        cp artifacts/i2pd-installer/setup_i2pd_v*.exe release/
+        cp artifacts/i2pd-linux-all/* release/
+        cp artifacts/i2pd_trixie_*/i2pd_*.deb release/
+        cd release
+        sha512sum -b * > SHA512SUMS
+        ls -l
+
+    - name: Publish release
+      uses: softprops/action-gh-release@v2
+      with:
+        files: release/*
+        fail_on_unmatched_files: true

Makefile.bsd

@@ -4,7 +4,7 @@ DEFINES = -D_GLIBCXX_USE_NANOSLEEP=1
 ifneq ($(TORRENTS),yes)
 	DEFINES += -DNO_TORRENTS
 endif
-INCFLAGS = -I/usr/include/ -I/usr/local/include/
+INCFLAGS = -I/usr/local/include/
 LDFLAGS = ${LD_DEBUG} -Wl,-rpath,/usr/local/lib -L/usr/local/lib
 LDLIBS = -lssl -lcrypto -lz -lpthread -lboost_program_options
 ifeq ($(TORRENTS),yes)

Makefile.mingw

@@ -3,9 +3,14 @@ USE_WIN32_APP := yes
 
 WINDRES = windres
 
-CXXFLAGS := $(CXX_DEBUG) -fPIC -msse
+CXXFLAGS := $(CXX_DEBUG) -fPIC
 INCFLAGS := -I$(DAEMON_SRC_DIR) -IWin32
-LDFLAGS := ${LD_DEBUG} -static -fPIC -msse
+LDFLAGS := ${LD_DEBUG} -static -fPIC
+
+ifeq (,$(findstring aarch64,$(SYS)))
+	CXXFLAGS += -msse
+	LDFLAGS += -msse
+endif
 
 NEEDED_CXXFLAGS += -std=c++23
 

contrib/static/build-freebsd.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# Fully static i2pd for FreeBSD, run from the source tree with the cmake, gmake, perl5, boost-libs and miniupnpc packages
+set -e
+
+OPENSSL_VERSION=3.5.8
+JOBS=4
+
+SRC=$(pwd)
+WORK=${TMPDIR:-/tmp}/i2pd-freebsd
+mkdir -p "$WORK"
+cd "$WORK"
+
+OPENSSL=openssl-$OPENSSL_VERSION
+fetch -q https://github.com/openssl/openssl/releases/download/$OPENSSL/$OPENSSL.tar.gz
+fetch -q https://github.com/openssl/openssl/releases/download/$OPENSSL/$OPENSSL.tar.gz.sha256
+[ "$(sha256 -q $OPENSSL.tar.gz)" = "$(cut -d' ' -f1 $OPENSSL.tar.gz.sha256)" ]
+tar xzf $OPENSSL.tar.gz
+cd $OPENSSL
+# no-autoload-config: a static binary must not read the host's openssl.cnf
+./Configure --prefix="$WORK/openssl" --libdir=lib --openssldir=/nonexistent \
+	no-autoload-config no-shared no-module no-dso no-engine no-tests no-docs
+gmake -j$JOBS build_libs
+gmake install_dev
+
+cd "$SRC/build"
+cmake -DWITH_STATIC=ON -DWITH_UPNP=ON -DCMAKE_BUILD_TYPE=Release -DOPENSSL_ROOT_DIR="$WORK/openssl" .
+gmake -j$JOBS
+strip i2pd

contrib/static/build-macos.sh

@@ -0,0 +1,72 @@
+#!/bin/sh
+# i2pd for macOS, universal unless ARCHS is set, with OpenSSL, Boost and miniupnpc built from source and linked statically
+set -e
+
+OPENSSL_VERSION=3.5.8
+BOOST_VERSION=1.92.0
+BOOST_SHA256=ea7b982002cc9dfbe59b0b217b206f470dc75f3de0bb2973d844118934d82411
+MINIUPNPC_VERSION=2.3.3
+MINIUPNPC_SHA256=d52a0afa614ad6c088cc9ddff1ae7d29c8c595ac5fdd321170a05f41e634bd1a
+ARCHS=${ARCHS:-"arm64 x86_64"}
+JOBS=4
+export MACOSX_DEPLOYMENT_TARGET=12.0
+
+SRC=$(pwd)
+WORK=${TMPDIR:-/tmp}/i2pd-macos
+mkdir -p "$WORK"
+cd "$WORK"
+
+fetch() {
+	curl -fsSL -o "$3" "$1"
+	echo "$2  $3" | shasum -a 256 -c -
+}
+
+OPENSSL=openssl-$OPENSSL_VERSION
+curl -fsSLO https://github.com/openssl/openssl/releases/download/$OPENSSL/$OPENSSL.tar.gz
+curl -fsSLO https://github.com/openssl/openssl/releases/download/$OPENSSL/$OPENSSL.tar.gz.sha256
+echo "$(cut -d' ' -f1 $OPENSSL.tar.gz.sha256)  $OPENSSL.tar.gz" | shasum -a 256 -c -
+fetch https://github.com/boostorg/boost/releases/download/boost-$BOOST_VERSION/boost-$BOOST_VERSION-b2-nodocs.tar.xz $BOOST_SHA256 boost.tar.xz
+fetch https://github.com/miniupnp/miniupnp/releases/download/miniupnpc_$(echo $MINIUPNPC_VERSION | tr . _)/miniupnpc-$MINIUPNPC_VERSION.tar.gz $MINIUPNPC_SHA256 miniupnpc.tar.gz
+tar xzf $OPENSSL.tar.gz
+tar xJf boost.tar.xz
+tar xzf miniupnpc.tar.gz
+(cd boost-$BOOST_VERSION && ./bootstrap.sh)
+
+for ARCH in $ARCHS; do
+	PREFIX=$WORK/$ARCH
+	(
+		cd $OPENSSL
+		make distclean >/dev/null 2>&1 || true
+		# no-autoload-config: a static binary must not read the host's openssl.cnf
+		./Configure darwin64-$ARCH-cc --prefix=$PREFIX --libdir=lib --openssldir=/nonexistent \
+			no-autoload-config no-shared no-module no-dso no-engine no-tests no-docs
+		make -j$JOBS build_libs
+		make install_dev
+	)
+	(
+		cd boost-$BOOST_VERSION
+		./b2 -j$JOBS --build-dir=$WORK/boost-build-$ARCH --prefix=$PREFIX \
+			--with-program_options --with-json --with-url link=static variant=release \
+			cxxflags="-arch $ARCH" linkflags="-arch $ARCH" install
+	)
+	cmake -S miniupnpc-$MINIUPNPC_VERSION -B miniupnpc-build-$ARCH -DCMAKE_OSX_ARCHITECTURES=$ARCH \
+		-DCMAKE_INSTALL_PREFIX=$PREFIX -DUPNPC_BUILD_SHARED=OFF -DUPNPC_BUILD_TESTS=OFF -DUPNPC_BUILD_SAMPLE=OFF
+	cmake --build miniupnpc-build-$ARCH -j $JOBS
+	cmake --install miniupnpc-build-$ARCH
+	(
+		cd "$SRC"
+		make clean >/dev/null
+		make -j$JOBS HOMEBREW=1 USE_STATIC=yes USE_UPNP=yes DEBUG=no CXX="clang++ -arch $ARCH" \
+			SSLROOT=$PREFIX BOOSTROOT=$PREFIX UPNPROOT=$PREFIX i2pd
+		mv i2pd i2pd-$ARCH
+	)
+done
+
+cd "$SRC"
+set -- $ARCHS
+if [ $# -eq 1 ]; then
+	mv i2pd-$1 i2pd
+else
+	lipo -create -output i2pd $(printf 'i2pd-%s ' "$@")
+	for ARCH in "$@"; do rm i2pd-$ARCH; done
+fi

contrib/static/build-musl.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+# Fully static i2pd, run from the source tree inside an Alpine container
+set -e
+
+OPENSSL_VERSION=3.5.8
+JOBS=4
+
+apk add --no-cache build-base perl linux-headers boost-dev boost-static zlib-dev zlib-static miniupnpc-dev
+
+SRC=$(pwd)
+cd /tmp
+OPENSSL=openssl-$OPENSSL_VERSION
+wget -q https://github.com/openssl/openssl/releases/download/$OPENSSL/$OPENSSL.tar.gz
+wget -q https://github.com/openssl/openssl/releases/download/$OPENSSL/$OPENSSL.tar.gz.sha256
+echo "$(cut -d' ' -f1 $OPENSSL.tar.gz.sha256)  $OPENSSL.tar.gz" | sha256sum -c -
+tar xzf $OPENSSL.tar.gz
+cd $OPENSSL
+# no-autoload-config: a static binary must not read the host's openssl.cnf
+./Configure --prefix=/usr --libdir=lib --openssldir=/nonexistent \
+	no-autoload-config no-shared no-module no-dso no-engine no-tests no-docs
+make -j$JOBS
+make install_sw
+
+cd "$SRC"
+# USE_STATIC looks for archives in /usr/lib/$(SYS) and does not pass -static
+make -j$JOBS DEBUG=no USE_STATIC=yes USE_UPNP=yes LIBDIR=/usr/lib LDFLAGS=-static i2pd
+strip i2pd

contrib/static/debian/control

@@ -0,0 +1,17 @@
+Source: i2pd
+Section: net
+Priority: optional
+Maintainer: r4sas <r4sas@i2pmail.org>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.5.1
+Homepage: https://i2pd.website/
+Rules-Requires-Root: binary-targets
+
+Package: i2pd
+Architecture: amd64 arm64 armhf i386 s390x
+Depends: adduser, ${misc:Depends}
+Description: Full-featured C++ implementation of I2P client (static build)
+ I2P (Invisible Internet Protocol) is a universal anonymous network layer.
+ .
+ This package ships a fully static binary (musl, bundled OpenSSL, Boost,
+ zlib and miniupnpc) that does not depend on the distribution release.

contrib/static/debian/copyright-bundled

@@ -0,0 +1,9 @@
+
+Files: usr/bin/i2pd
+Comment: The binary statically links the following third-party components.
+ OpenSSL - Apache-2.0
+ Boost (program_options, json, url) - BSL-1.0
+ zlib - Zlib
+ miniupnpc - BSD-3-Clause
+ musl - MIT
+ libstdc++ and libgcc - GPL-3.0+ with GCC Runtime Library Exception

contrib/static/debian/i2pd.docs

@@ -0,0 +1,2 @@
+src/README.md
+src/ChangeLog

contrib/static/debian/i2pd.links

@@ -0,0 +1,4 @@
+etc/i2pd/i2pd.conf var/lib/i2pd/i2pd.conf
+etc/i2pd/tunnels.conf var/lib/i2pd/tunnels.conf
+etc/i2pd/tunnels.conf.d var/lib/i2pd/tunnels.d
+usr/share/i2pd/certificates var/lib/i2pd/certificates

contrib/static/debian/i2pd.lintian-overrides

@@ -0,0 +1,2 @@
+i2pd: embedded-library
+i2pd: statically-linked-binary

contrib/static/debian/i2pd.manpages

@@ -0,0 +1 @@
+src/debian/i2pd.1

contrib/static/debian/i2pd.postinst

@@ -0,0 +1,47 @@
+#!/bin/sh
+set -e
+
+LOGFILE='/var/log/i2pd/i2pd.log'
+I2PDHOME='/var/lib/i2pd'
+I2PDUSER='i2pd'
+
+case "$1" in
+  configure|reconfigure)
+    # Older versions of adduser created the home directory.
+    # The version of adduser in Debian unstable does not.
+    # Create user and group as a system user.
+    if getent passwd $I2PDUSER > /dev/null 2>&1; then
+      groupadd -f $I2PDUSER || true
+    else
+      adduser --system --quiet --group --home $I2PDHOME $I2PDUSER
+    fi
+
+    mkdir -p -m0750 /var/log/i2pd
+    chown -f ${I2PDUSER}:adm /var/log/i2pd
+    touch $LOGFILE
+    chmod 640 $LOGFILE
+    chown -f ${I2PDUSER}:adm $LOGFILE
+    mkdir -p $I2PDHOME
+    chown -f -P ${I2PDUSER}:${I2PDUSER} ${I2PDHOME}
+    chmod 0700 $I2PDHOME
+  ;;
+  abort-upgrade|abort-remove|abort-deconfigure)
+    echo "Aborting upgrade"
+    exit 0
+  ;;
+  *)
+    echo "postinst called with unknown argument '$1'" >&2
+    exit 0
+  ;;
+esac
+
+#DEBHELPER#
+
+if [ "$1" = "configure" ] && [ -x /etc/init.d/i2pd ]; then
+  update-rc.d i2pd defaults >/dev/null
+  if [ ! -d /run/systemd/system ]; then
+    invoke-rc.d i2pd restart || true
+  fi
+fi
+
+exit 0

contrib/static/debian/i2pd.postrm

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -e
+
+if [ "$1" = "purge" ]; then
+	update-rc.d i2pd remove >/dev/null || true
+	rm -f /etc/default/i2pd
+	rm -rf /etc/i2pd
+	rm -rf /var/lib/i2pd
+	rm -rf /var/log/i2pd
+	rm -rf /run/i2pd
+fi
+
+#DEBHELPER#
+
+exit 0

contrib/static/debian/i2pd.prerm

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -e
+
+if [ ! -d /run/systemd/system ] && [ -x /etc/init.d/i2pd ]; then
+  case "$1" in
+    remove|upgrade|deconfigure) invoke-rc.d i2pd stop || true ;;
+  esac
+fi
+
+#DEBHELPER#
+
+exit 0

contrib/static/debian/rules

@@ -0,0 +1,28 @@
+#!/usr/bin/make -f
+include /usr/share/dpkg/architecture.mk
+
+PKG := debian/i2pd
+
+%:
+	dh $@
+
+override_dh_auto_build override_dh_auto_test override_dh_auto_clean override_dh_auto_configure:
+
+override_dh_auto_install:
+	install -D -m 0755 bin/i2pd-$(DEB_HOST_ARCH) $(PKG)/usr/bin/i2pd
+	install -D -m 0644 src/contrib/i2pd.conf $(PKG)/etc/i2pd/i2pd.conf
+	install -D -m 0644 src/contrib/tunnels.conf $(PKG)/etc/i2pd/tunnels.conf
+	install -D -m 0644 src/contrib/subscriptions.txt $(PKG)/etc/i2pd/subscriptions.txt
+	install -D -m 0644 src/contrib/tunnels.d/README $(PKG)/etc/i2pd/tunnels.conf.d/README
+	install -d $(PKG)/usr/share/i2pd
+	cp -r src/contrib/certificates $(PKG)/usr/share/i2pd/
+
+override_dh_strip override_dh_dwz override_dh_shlibdeps override_dh_makeshlibs:
+
+override_dh_builddeb:
+	dh_builddeb -- -Zxz
+
+# generated invoke-rc.d --skip-systemd-native needs init-system-helpers >= 1.54,
+# which Ubuntu 18.04 lacks; the maintainer scripts handle sysvinit themselves
+override_dh_installinit:
+	dh_installinit --no-scripts

contrib/static/debian/source/format

@@ -0,0 +1 @@
+3.0 (native)

contrib/static/i2pd.spec

@@ -0,0 +1,84 @@
+%global debug_package %{nil}
+%global __os_install_post %{nil}
+%global _build_id_links none
+# xz payload and sha256 digests: readable by rpm 4.11 (CentOS 7) and newer
+%define _binary_payload w9.xzdio
+%define _source_payload w9.xzdio
+%define _binary_filedigest_algorithm 8
+%define _source_filedigest_algorithm 8
+
+Name:           i2pd
+Version:        %{ver}
+Release:        %{rel}
+Summary:        I2P router written in C++ (static build)
+License:        BSD-3-Clause
+URL:            https://i2pd.website/
+Source0:        i2pd-%{_target_cpu}
+Requires(pre):  /usr/sbin/useradd
+Requires(pre):  /usr/sbin/groupadd
+Requires(pre):  /usr/bin/getent
+
+%description
+I2P router written in C++. Fully static binary (musl, bundled OpenSSL,
+Boost, zlib and miniupnpc) that does not depend on the distribution release.
+
+%prep
+%build
+
+%install
+S=%{srcdir}
+install -D -m 755 %{SOURCE0} %{buildroot}/usr/bin/i2pd
+install -d -m 755 %{buildroot}/usr/share/i2pd
+install -d -m 700 %{buildroot}/var/lib/i2pd
+install -d -m 700 %{buildroot}/var/log/i2pd
+install -D -m 644 $S/contrib/i2pd.conf %{buildroot}/etc/i2pd/i2pd.conf
+install -D -m 644 $S/contrib/subscriptions.txt %{buildroot}/etc/i2pd/subscriptions.txt
+install -D -m 644 $S/contrib/tunnels.conf %{buildroot}/etc/i2pd/tunnels.conf
+install -D -m 644 $S/contrib/tunnels.d/README %{buildroot}/etc/i2pd/tunnels.conf.d/README
+install -D -m 644 $S/contrib/i2pd.logrotate %{buildroot}/etc/logrotate.d/i2pd
+install -D -m 644 $S/contrib/i2pd.service %{buildroot}/usr/lib/systemd/system/i2pd.service
+install -D -m 644 $S/debian/i2pd.1 %{buildroot}/usr/share/man/man1/i2pd.1
+install -D -m 644 $S/LICENSE %{buildroot}/usr/share/licenses/i2pd/LICENSE
+cp -r $S/contrib/certificates %{buildroot}/usr/share/i2pd/certificates
+ln -s /usr/share/i2pd/certificates %{buildroot}/var/lib/i2pd/certificates
+
+%pre
+getent group i2pd >/dev/null || groupadd -r i2pd
+getent passwd i2pd >/dev/null || \
+  useradd -r -g i2pd -s /sbin/nologin -d /var/lib/i2pd -c 'I2P Service' i2pd
+exit 0
+
+%post
+systemctl daemon-reload >/dev/null 2>&1 || :
+if [ $1 -eq 1 ]; then
+  systemctl preset i2pd.service >/dev/null 2>&1 || :
+fi
+
+%preun
+if [ $1 -eq 0 ]; then
+  systemctl --no-reload disable --now i2pd.service >/dev/null 2>&1 || :
+fi
+
+%postun
+systemctl daemon-reload >/dev/null 2>&1 || :
+if [ $1 -ge 1 ]; then
+  systemctl try-restart i2pd.service >/dev/null 2>&1 || :
+fi
+
+%files
+%license /usr/share/licenses/i2pd/LICENSE
+/usr/bin/i2pd
+%dir /etc/i2pd
+%config(noreplace) /etc/i2pd/i2pd.conf
+%config(noreplace) /etc/i2pd/tunnels.conf
+%config(noreplace) /etc/i2pd/subscriptions.txt
+%dir /etc/i2pd/tunnels.conf.d
+%doc /etc/i2pd/tunnels.conf.d/README
+%config(noreplace) /etc/logrotate.d/i2pd
+/usr/lib/systemd/system/i2pd.service
+/usr/share/man/man1/i2pd.1*
+/usr/share/i2pd
+%dir %attr(0700,i2pd,i2pd) /var/lib/i2pd
+/var/lib/i2pd/certificates
+%dir %attr(0700,i2pd,i2pd) /var/log/i2pd
+

contrib/static/package.sh

@@ -0,0 +1,53 @@
+#!/bin/sh
+# Packages the static binaries present in BIN/i2pd-static-<arch>/i2pd, run inside debian (deb) or rocky/fedora (rpm)
+# usage: package.sh deb|rpm BIN OUT, with VERSION (deb), RPM_VERSION and RPM_RELEASE in the environment
+set -e
+
+FORMAT=$1
+BIN=$(realpath "$2")
+mkdir -p "$3"
+OUT=$(realpath "$3")
+SRC=$(cd "$(dirname "$0")/../.." && pwd)
+# alpine:deb:rpm architecture names
+ARCHS="x86_64:amd64:x86_64 aarch64:arm64:aarch64 armhf:armhf:armv7hl x86:i386:i686 s390x:s390x:s390x"
+WORK=$(mktemp -d)
+
+if [ "$FORMAT" = deb ]; then
+	apt-get update -qq
+	DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends debhelper dpkg-dev lintian >/dev/null
+	PKG=$WORK/pkg
+	mkdir -p $PKG/bin
+	cp -r "$SRC/contrib/static/debian" $PKG/debian
+	cat "$SRC/debian/copyright" $PKG/debian/copyright-bundled > $PKG/debian/copyright
+	rm $PKG/debian/copyright-bundled
+	cp "$SRC/contrib/i2pd.service" $PKG/debian/i2pd.service
+	cp "$SRC/contrib/debian/i2pd.tmpfile" $PKG/debian/i2pd.tmpfiles
+	cp "$SRC/contrib/i2pd.logrotate" $PKG/debian/i2pd.logrotate
+	cp "$SRC/debian/i2pd.init" $PKG/debian/i2pd.init
+	cp "$SRC/debian/i2pd.default" $PKG/debian/i2pd.default
+	ln -s "$SRC" $PKG/src
+	printf 'i2pd (%s-1) stable; urgency=medium\n\n  * Static build.\n\n -- %s  %s\n' \
+		"$VERSION" "$(sed -n 's/^Maintainer: //p' $PKG/debian/control)" "$(date -R)" > $PKG/debian/changelog
+	for a in $ARCHS; do
+		alpine=${a%%:*}; rest=${a#*:}; deb=${rest%%:*}
+		[ -f "$BIN/i2pd-static-$alpine/i2pd" ] || continue
+		install -m 755 "$BIN/i2pd-static-$alpine/i2pd" $PKG/bin/i2pd-$deb
+		(cd $PKG && dpkg-buildpackage -b -us -uc -a$deb -d)
+		mv $WORK/i2pd_$VERSION-1_$deb.deb "$OUT/i2pd_${VERSION}_linux-all_$deb.deb"
+	done
+	lintian --fail-on error "$OUT/i2pd_${VERSION}_linux-all_amd64.deb"
+elif [ "$FORMAT" = rpm ]; then
+	dnf -q -y install rpm-build >/dev/null
+	mkdir -p $WORK/sources
+	for a in $ARCHS; do
+		alpine=${a%%:*}; rpm=${a##*:}
+		[ -f "$BIN/i2pd-static-$alpine/i2pd" ] || continue
+		install -m 755 "$BIN/i2pd-static-$alpine/i2pd" $WORK/sources/i2pd-$rpm
+		rpmbuild -bb --target $rpm -D "ver $RPM_VERSION" -D "rel $RPM_RELEASE" -D "srcdir $SRC" \
+			-D "_topdir $WORK/rpmbuild" -D "_sourcedir $WORK/sources" -D "_rpmdir $WORK/rpms" "$SRC/contrib/static/i2pd.spec"
+		mv $WORK/rpms/$rpm/i2pd-$RPM_VERSION-$RPM_RELEASE.$rpm.rpm "$OUT/i2pd_${VERSION}_linux-all_$rpm.rpm"
+	done
+else
+	echo "usage: $0 deb|rpm BIN OUT" >&2
+	exit 1
+fi

debian/control

@@ -2,7 +2,7 @@ Source: i2pd
 Section: net
 Priority: optional
 Maintainer: r4sas <r4sas@i2pmail.org>
-Build-Depends: debhelper (>= 12~), libboost-program-options-dev (>= 1.46), libminiupnpc-dev, libssl-dev, zlib1g-dev
+Build-Depends: debhelper (>= 12~), libboost-program-options-dev (>= 1.46), libboost-json-dev (>= 1.81), libboost-url-dev (>= 1.81), libminiupnpc-dev, libssl-dev (>= 3.5), zlib1g-dev
 Standards-Version: 4.3.0
 Homepage: http://i2pd.website/
 Vcs-Git: git://github.com/PurpleI2P/i2pd.git