From 73a028d4641293f4eebbab75c9d3bdea9864a262 Mon Sep 17 00:00:00 2001
From: acetone <63557806+freeacetone@users.noreply.github.com>
Date: Fri, 2 Oct 2026 03:52:56 -0400
Subject: [PATCH 01/12] add static musl build

---
 .github/workflows/build-static.yml | 64 ++++++++++++++++++++++++++++++
 contrib/static/build-musl.sh       | 27 +++++++++++++
 2 files changed, 91 insertions(+)
 create mode 100644 .github/workflows/build-static.yml
 create mode 100755 contrib/static/build-musl.sh

diff --git a/.github/workflows/build-static.yml b/.github/workflows/build-static.yml
new file mode 100644
index 00000000..fc5f3f61
--- /dev/null
+++ b/.github/workflows/build-static.yml
@@ -0,0 +1,64 @@
+name: Build static binaries
+
+on:
+  push:
+    branches:
+    - '*'
+    paths:
+    - .github/workflows/build-static.yml
+    - contrib/static/**
+    - daemon/**
+    - i18n/**
+    - libi2pd/**
+    - libi2pd_client/**
+    - Makefile
+    - Makefile.linux
+    tags:
+    - '*'
+  pull_request:
+    branches:
+    - '*'
+
+jobs:
+  build:
+    name: musl ${{ matrix.arch }}
+    runs-on: ${{ matrix.runner }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - arch: x86_64
+          runner: ubuntu-latest
+        - arch: aarch64
+          runner: ubuntu-24.04-arm
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Build in Alpine
+      run: docker run --rm -v "$PWD":/src -w /src alpine:3.22 sh contrib/static/build-musl.sh
+
+    - name: Check binary
+      run: |
+        file i2pd | grep 'statically linked'
+        readelf -d i2pd | grep 'There is no dynamic section'
+        ./i2pd --version
+        ./i2pd --version | grep -E '^OpenSSL (3\.([5-9]|[1-9][0-9])|[4-9])\.'
+        ./i2pd --version | grep -E '^Boost version 1\.(8[1-9]|9[0-9])\.'
+
+    - name: Run
+      run: |
+        mkdir datadir
+        ./i2pd --datadir=datadir --log=file --logfile=datadir/i2pd.log --loglevel=info &
+        sleep 15
+        kill -0 $!
+        grep 'Daemon: Starting NetDB' datadir/i2pd.log
+        kill -9 $!
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: i2pd-static-${{ matrix.arch }}
+        path: i2pd
diff --git a/contrib/static/build-musl.sh b/contrib/static/build-musl.sh
new file mode 100755
index 00000000..95bfe5fd
--- /dev/null
+++ b/contrib/static/build-musl.sh
@@ -0,0 +1,27 @@
+#!/bin/sh
+# Fully static i2pd, run from the source tree inside an Alpine container
+set -e
+
+OPENSSL_VERSION=3.5.8
+JOBS=4
+
+apk add --no-cache build-base perl linux-headers boost-dev boost-static zlib-dev zlib-static miniupnpc-dev
+
+SRC=$(pwd)
+cd /tmp
+OPENSSL=openssl-$OPENSSL_VERSION
+wget -q https://github.com/openssl/openssl/releases/download/$OPENSSL/$OPENSSL.tar.gz
+wget -q https://github.com/openssl/openssl/releases/download/$OPENSSL/$OPENSSL.tar.gz.sha256
+echo "$(cut -d' ' -f1 $OPENSSL.tar.gz.sha256)  $OPENSSL.tar.gz" | sha256sum -c -
+tar xzf $OPENSSL.tar.gz
+cd $OPENSSL
+# no-autoload-config: a static binary must not read the host's openssl.cnf
+./Configure --prefix=/usr --libdir=lib --openssldir=/nonexistent \
+	no-autoload-config no-shared no-module no-dso no-engine no-tests no-docs
+make -j$JOBS
+make install_sw
+
+cd "$SRC"
+# USE_STATIC looks for archives in /usr/lib/$(SYS) and does not pass -static
+make -j$JOBS DEBUG=no USE_STATIC=yes USE_UPNP=yes LIBDIR=/usr/lib LDFLAGS=-static i2pd
+strip i2pd

From b1514d2fe415fe53367989ee9dd127020a5f5722 Mon Sep 17 00:00:00 2001
From: acetone <63557806+freeacetone@users.noreply.github.com>
Date: Fri, 2 Oct 2026 04:36:41 -0400
Subject: [PATCH 02/12] build static deb and rpm packages for all architectures

---
 .github/workflows/build-static.yml           | 78 +++++++++++++++++-
 contrib/static/debian/control                | 17 ++++
 contrib/static/debian/copyright-bundled      |  9 +++
 contrib/static/debian/i2pd.docs              |  2 +
 contrib/static/debian/i2pd.links             |  4 +
 contrib/static/debian/i2pd.lintian-overrides |  2 +
 contrib/static/debian/i2pd.manpages          |  1 +
 contrib/static/debian/i2pd.postinst          | 47 +++++++++++
 contrib/static/debian/i2pd.postrm            | 15 ++++
 contrib/static/debian/i2pd.prerm             | 12 +++
 contrib/static/debian/rules                  | 28 +++++++
 contrib/static/debian/source/format          |  1 +
 contrib/static/i2pd.spec                     | 84 ++++++++++++++++++++
 contrib/static/package.sh                    | 51 ++++++++++++
 14 files changed, 347 insertions(+), 4 deletions(-)
 create mode 100644 contrib/static/debian/control
 create mode 100644 contrib/static/debian/copyright-bundled
 create mode 100644 contrib/static/debian/i2pd.docs
 create mode 100644 contrib/static/debian/i2pd.links
 create mode 100644 contrib/static/debian/i2pd.lintian-overrides
 create mode 100644 contrib/static/debian/i2pd.manpages
 create mode 100644 contrib/static/debian/i2pd.postinst
 create mode 100644 contrib/static/debian/i2pd.postrm
 create mode 100644 contrib/static/debian/i2pd.prerm
 create mode 100755 contrib/static/debian/rules
 create mode 100644 contrib/static/debian/source/format
 create mode 100644 contrib/static/i2pd.spec
 create mode 100755 contrib/static/package.sh

diff --git a/.github/workflows/build-static.yml b/.github/workflows/build-static.yml
index fc5f3f61..8e8bd8a4 100644
--- a/.github/workflows/build-static.yml
+++ b/.github/workflows/build-static.yml
@@ -6,18 +6,18 @@ on:
     - '*'
     paths:
     - .github/workflows/build-static.yml
-    - contrib/static/**
+    - contrib/**
     - daemon/**
+    - debian/**
     - i18n/**
     - libi2pd/**
     - libi2pd_client/**
     - Makefile
     - Makefile.linux
-    tags:
-    - '*'
   pull_request:
     branches:
     - '*'
+  workflow_call:
 
 jobs:
   build:
@@ -30,15 +30,33 @@ jobs:
         include:
         - arch: x86_64
           runner: ubuntu-latest
+          platform: linux/amd64
         - arch: aarch64
           runner: ubuntu-24.04-arm
+          platform: linux/arm64
+        - arch: armhf
+          runner: ubuntu-latest
+          platform: linux/arm/v6
+          qemu: true
+        - arch: x86
+          runner: ubuntu-latest
+          platform: linux/386
+          setarch: linux32
+        - arch: s390x
+          runner: ubuntu-latest
+          platform: linux/s390x
+          qemu: true
 
     steps:
     - name: Checkout
       uses: actions/checkout@v4
 
+    - name: Set up QEMU
+      if: ${{ matrix.qemu }}
+      uses: docker/setup-qemu-action@v3
+
     - name: Build in Alpine
-      run: docker run --rm -v "$PWD":/src -w /src alpine:3.22 sh contrib/static/build-musl.sh
+      run: docker run --rm --platform ${{ matrix.platform }} -v "$PWD":/src -w /src alpine:3.22 ${{ matrix.setarch }} sh contrib/static/build-musl.sh
 
     - name: Check binary
       run: |
@@ -62,3 +80,55 @@ jobs:
       with:
         name: i2pd-static-${{ matrix.arch }}
         path: i2pd
+
+  package:
+    name: deb and rpm packages
+    needs: build
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Download binaries
+      uses: actions/download-artifact@v4
+      with:
+        pattern: i2pd-static-*
+        path: bin
+
+    - name: Set package version
+      run: |
+        if [ "$GITHUB_REF_TYPE" = tag ]; then
+          echo "VERSION=$GITHUB_REF_NAME" >> $GITHUB_ENV
+          echo "RPM_VERSION=$GITHUB_REF_NAME" >> $GITHUB_ENV
+          echo "RPM_RELEASE=1" >> $GITHUB_ENV
+        else
+          base=$(sed -nE 's/^#define I2PD_VERSION_(MAJOR|MINOR|MICRO) ([0-9]+)$/\2/p' libi2pd/version.h | paste -sd.)
+          rev=git$(git log -1 --format=%cd --date=format:%Y%m%d).$(git rev-parse --short=7 HEAD)
+          echo "VERSION=$base+$rev" >> $GITHUB_ENV
+          echo "RPM_VERSION=$base" >> $GITHUB_ENV
+          echo "RPM_RELEASE=0.$rev" >> $GITHUB_ENV
+        fi
+
+    - name: Build deb packages
+      run: docker run --rm -e VERSION -v "$PWD":/src -w /src debian:bookworm sh contrib/static/package.sh deb bin out
+
+    - name: Build rpm packages
+      run: docker run --rm -e VERSION -e RPM_VERSION -e RPM_RELEASE -v "$PWD":/src -w /src rockylinux:9 sh contrib/static/package.sh rpm bin out
+
+    - name: Test packages
+      run: |
+        for img in debian:trixie ubuntu:24.04; do
+          docker run --rm -e DEBIAN_FRONTEND=noninteractive -v "$PWD/out":/o $img sh -ec \
+            'apt-get update -qq; apt-get install -y -qq /o/*_linux-all_amd64.deb; dpkg -V i2pd; i2pd --version; apt-get purge -y -qq i2pd'
+        done
+        for img in rockylinux:9 fedora:latest; do
+          docker run --rm -v "$PWD/out":/o $img sh -ec \
+            'dnf -q -y install /o/*_linux-all_x86_64.rpm; rpm -V i2pd; i2pd --version; dnf -q -y remove i2pd'
+        done
+
+    - name: Upload packages
+      uses: actions/upload-artifact@v4
+      with:
+        name: i2pd-linux-all
+        path: out/*
diff --git a/contrib/static/debian/control b/contrib/static/debian/control
new file mode 100644
index 00000000..6d469ebf
--- /dev/null
+++ b/contrib/static/debian/control
@@ -0,0 +1,17 @@
+Source: i2pd
+Section: net
+Priority: optional
+Maintainer: r4sas <r4sas@i2pmail.org>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.5.1
+Homepage: https://i2pd.website/
+Rules-Requires-Root: binary-targets
+
+Package: i2pd
+Architecture: amd64 arm64 armhf i386 s390x
+Depends: adduser, ${misc:Depends}
+Description: Full-featured C++ implementation of I2P client (static build)
+ I2P (Invisible Internet Protocol) is a universal anonymous network layer.
+ .
+ This package ships a fully static binary (musl, bundled OpenSSL, Boost,
+ zlib and miniupnpc) that does not depend on the distribution release.
diff --git a/contrib/static/debian/copyright-bundled b/contrib/static/debian/copyright-bundled
new file mode 100644
index 00000000..aea773bc
--- /dev/null
+++ b/contrib/static/debian/copyright-bundled
@@ -0,0 +1,9 @@
+
+Files: usr/bin/i2pd
+Comment: The binary statically links the following third-party components.
+ OpenSSL - Apache-2.0
+ Boost (program_options, json, url) - BSL-1.0
+ zlib - Zlib
+ miniupnpc - BSD-3-Clause
+ musl - MIT
+ libstdc++ and libgcc - GPL-3.0+ with GCC Runtime Library Exception
diff --git a/contrib/static/debian/i2pd.docs b/contrib/static/debian/i2pd.docs
new file mode 100644
index 00000000..6498e8de
--- /dev/null
+++ b/contrib/static/debian/i2pd.docs
@@ -0,0 +1,2 @@
+src/README.md
+src/ChangeLog
diff --git a/contrib/static/debian/i2pd.links b/contrib/static/debian/i2pd.links
new file mode 100644
index 00000000..16558791
--- /dev/null
+++ b/contrib/static/debian/i2pd.links
@@ -0,0 +1,4 @@
+etc/i2pd/i2pd.conf var/lib/i2pd/i2pd.conf
+etc/i2pd/tunnels.conf var/lib/i2pd/tunnels.conf
+etc/i2pd/tunnels.conf.d var/lib/i2pd/tunnels.d
+usr/share/i2pd/certificates var/lib/i2pd/certificates
diff --git a/contrib/static/debian/i2pd.lintian-overrides b/contrib/static/debian/i2pd.lintian-overrides
new file mode 100644
index 00000000..5a37b0da
--- /dev/null
+++ b/contrib/static/debian/i2pd.lintian-overrides
@@ -0,0 +1,2 @@
+i2pd: embedded-library
+i2pd: statically-linked-binary
diff --git a/contrib/static/debian/i2pd.manpages b/contrib/static/debian/i2pd.manpages
new file mode 100644
index 00000000..b82d209d
--- /dev/null
+++ b/contrib/static/debian/i2pd.manpages
@@ -0,0 +1 @@
+src/debian/i2pd.1
diff --git a/contrib/static/debian/i2pd.postinst b/contrib/static/debian/i2pd.postinst
new file mode 100644
index 00000000..475f5ddb
--- /dev/null
+++ b/contrib/static/debian/i2pd.postinst
@@ -0,0 +1,47 @@
+#!/bin/sh
+set -e
+
+LOGFILE='/var/log/i2pd/i2pd.log'
+I2PDHOME='/var/lib/i2pd'
+I2PDUSER='i2pd'
+
+case "$1" in
+  configure|reconfigure)
+    # Older versions of adduser created the home directory.
+    # The version of adduser in Debian unstable does not.
+    # Create user and group as a system user.
+    if getent passwd $I2PDUSER > /dev/null 2>&1; then
+      groupadd -f $I2PDUSER || true
+    else
+      adduser --system --quiet --group --home $I2PDHOME $I2PDUSER
+    fi
+
+    mkdir -p -m0750 /var/log/i2pd
+    chown -f ${I2PDUSER}:adm /var/log/i2pd
+    touch $LOGFILE
+    chmod 640 $LOGFILE
+    chown -f ${I2PDUSER}:adm $LOGFILE
+    mkdir -p $I2PDHOME
+    chown -f -P ${I2PDUSER}:${I2PDUSER} ${I2PDHOME}
+    chmod 0700 $I2PDHOME
+  ;;
+  abort-upgrade|abort-remove|abort-deconfigure)
+    echo "Aborting upgrade"
+    exit 0
+  ;;
+  *)
+    echo "postinst called with unknown argument '$1'" >&2
+    exit 0
+  ;;
+esac
+
+#DEBHELPER#
+
+if [ "$1" = "configure" ] && [ -x /etc/init.d/i2pd ]; then
+  update-rc.d i2pd defaults >/dev/null
+  if [ ! -d /run/systemd/system ]; then
+    invoke-rc.d i2pd restart || true
+  fi
+fi
+
+exit 0
diff --git a/contrib/static/debian/i2pd.postrm b/contrib/static/debian/i2pd.postrm
new file mode 100644
index 00000000..951a1331
--- /dev/null
+++ b/contrib/static/debian/i2pd.postrm
@@ -0,0 +1,15 @@
+#!/bin/sh
+set -e
+
+if [ "$1" = "purge" ]; then
+	update-rc.d i2pd remove >/dev/null || true
+	rm -f /etc/default/i2pd
+	rm -rf /etc/i2pd
+	rm -rf /var/lib/i2pd
+	rm -rf /var/log/i2pd
+	rm -rf /run/i2pd
+fi
+
+#DEBHELPER#
+
+exit 0
diff --git a/contrib/static/debian/i2pd.prerm b/contrib/static/debian/i2pd.prerm
new file mode 100644
index 00000000..6c29f5fe
--- /dev/null
+++ b/contrib/static/debian/i2pd.prerm
@@ -0,0 +1,12 @@
+#!/bin/sh
+set -e
+
+if [ ! -d /run/systemd/system ] && [ -x /etc/init.d/i2pd ]; then
+  case "$1" in
+    remove|upgrade|deconfigure) invoke-rc.d i2pd stop || true ;;
+  esac
+fi
+
+#DEBHELPER#
+
+exit 0
diff --git a/contrib/static/debian/rules b/contrib/static/debian/rules
new file mode 100755
index 00000000..52d16b6f
--- /dev/null
+++ b/contrib/static/debian/rules
@@ -0,0 +1,28 @@
+#!/usr/bin/make -f
+include /usr/share/dpkg/architecture.mk
+
+PKG := debian/i2pd
+
+%:
+	dh $@
+
+override_dh_auto_build override_dh_auto_test override_dh_auto_clean override_dh_auto_configure:
+
+override_dh_auto_install:
+	install -D -m 0755 bin/i2pd-$(DEB_HOST_ARCH) $(PKG)/usr/bin/i2pd
+	install -D -m 0644 src/contrib/i2pd.conf $(PKG)/etc/i2pd/i2pd.conf
+	install -D -m 0644 src/contrib/tunnels.conf $(PKG)/etc/i2pd/tunnels.conf
+	install -D -m 0644 src/contrib/subscriptions.txt $(PKG)/etc/i2pd/subscriptions.txt
+	install -D -m 0644 src/contrib/tunnels.d/README $(PKG)/etc/i2pd/tunnels.conf.d/README
+	install -d $(PKG)/usr/share/i2pd
+	cp -r src/contrib/certificates $(PKG)/usr/share/i2pd/
+
+override_dh_strip override_dh_dwz override_dh_shlibdeps override_dh_makeshlibs:
+
+override_dh_builddeb:
+	dh_builddeb -- -Zxz
+
+# generated invoke-rc.d --skip-systemd-native needs init-system-helpers >= 1.54,
+# which Ubuntu 18.04 lacks; the maintainer scripts handle sysvinit themselves
+override_dh_installinit:
+	dh_installinit --no-scripts
diff --git a/contrib/static/debian/source/format b/contrib/static/debian/source/format
new file mode 100644
index 00000000..89ae9db8
--- /dev/null
+++ b/contrib/static/debian/source/format
@@ -0,0 +1 @@
+3.0 (native)
diff --git a/contrib/static/i2pd.spec b/contrib/static/i2pd.spec
new file mode 100644
index 00000000..9142541b
--- /dev/null
+++ b/contrib/static/i2pd.spec
@@ -0,0 +1,84 @@
+%global debug_package %{nil}
+%global __os_install_post %{nil}
+%global _build_id_links none
+# xz payload and sha256 digests: readable by rpm 4.11 (CentOS 7) and newer
+%define _binary_payload w9.xzdio
+%define _source_payload w9.xzdio
+%define _binary_filedigest_algorithm 8
+%define _source_filedigest_algorithm 8
+
+Name:           i2pd
+Version:        %{ver}
+Release:        %{rel}
+Summary:        I2P router written in C++ (static build)
+License:        BSD-3-Clause
+URL:            https://i2pd.website/
+Source0:        i2pd-%{_target_cpu}
+Requires(pre):  /usr/sbin/useradd
+Requires(pre):  /usr/sbin/groupadd
+Requires(pre):  /usr/bin/getent
+
+%description
+I2P router written in C++. Fully static binary (musl, bundled OpenSSL,
+Boost, zlib and miniupnpc) that does not depend on the distribution release.
+
+%prep
+%build
+
+%install
+S=%{srcdir}
+install -D -m 755 %{SOURCE0} %{buildroot}/usr/bin/i2pd
+install -d -m 755 %{buildroot}/usr/share/i2pd
+install -d -m 700 %{buildroot}/var/lib/i2pd
+install -d -m 700 %{buildroot}/var/log/i2pd
+install -D -m 644 $S/contrib/i2pd.conf %{buildroot}/etc/i2pd/i2pd.conf
+install -D -m 644 $S/contrib/subscriptions.txt %{buildroot}/etc/i2pd/subscriptions.txt
+install -D -m 644 $S/contrib/tunnels.conf %{buildroot}/etc/i2pd/tunnels.conf
+install -D -m 644 $S/contrib/tunnels.d/README %{buildroot}/etc/i2pd/tunnels.conf.d/README
+install -D -m 644 $S/contrib/i2pd.logrotate %{buildroot}/etc/logrotate.d/i2pd
+install -D -m 644 $S/contrib/i2pd.service %{buildroot}/usr/lib/systemd/system/i2pd.service
+install -D -m 644 $S/debian/i2pd.1 %{buildroot}/usr/share/man/man1/i2pd.1
+install -D -m 644 $S/LICENSE %{buildroot}/usr/share/licenses/i2pd/LICENSE
+cp -r $S/contrib/certificates %{buildroot}/usr/share/i2pd/certificates
+ln -s /usr/share/i2pd/certificates %{buildroot}/var/lib/i2pd/certificates
+
+%pre
+getent group i2pd >/dev/null || groupadd -r i2pd
+getent passwd i2pd >/dev/null || \
+  useradd -r -g i2pd -s /sbin/nologin -d /var/lib/i2pd -c 'I2P Service' i2pd
+exit 0
+
+%post
+systemctl daemon-reload >/dev/null 2>&1 || :
+if [ $1 -eq 1 ]; then
+  systemctl preset i2pd.service >/dev/null 2>&1 || :
+fi
+
+%preun
+if [ $1 -eq 0 ]; then
+  systemctl --no-reload disable --now i2pd.service >/dev/null 2>&1 || :
+fi
+
+%postun
+systemctl daemon-reload >/dev/null 2>&1 || :
+if [ $1 -ge 1 ]; then
+  systemctl try-restart i2pd.service >/dev/null 2>&1 || :
+fi
+
+%files
+%license /usr/share/licenses/i2pd/LICENSE
+/usr/bin/i2pd
+%dir /etc/i2pd
+%config(noreplace) /etc/i2pd/i2pd.conf
+%config(noreplace) /etc/i2pd/tunnels.conf
+%config(noreplace) /etc/i2pd/subscriptions.txt
+%dir /etc/i2pd/tunnels.conf.d
+%doc /etc/i2pd/tunnels.conf.d/README
+%config(noreplace) /etc/logrotate.d/i2pd
+/usr/lib/systemd/system/i2pd.service
+/usr/share/man/man1/i2pd.1*
+/usr/share/i2pd
+%dir %attr(0700,i2pd,i2pd) /var/lib/i2pd
+/var/lib/i2pd/certificates
+%dir %attr(0700,i2pd,i2pd) /var/log/i2pd
+
diff --git a/contrib/static/package.sh b/contrib/static/package.sh
new file mode 100755
index 00000000..a3992770
--- /dev/null
+++ b/contrib/static/package.sh
@@ -0,0 +1,51 @@
+#!/bin/sh
+# Packages static binaries from BIN/i2pd-static-<arch>/i2pd, run inside debian (deb) or rocky/fedora (rpm)
+# usage: package.sh deb|rpm BIN OUT, with VERSION (deb), RPM_VERSION and RPM_RELEASE in the environment
+set -e
+
+FORMAT=$1
+BIN=$(realpath "$2")
+mkdir -p "$3"
+OUT=$(realpath "$3")
+SRC=$(cd "$(dirname "$0")/../.." && pwd)
+# alpine:deb:rpm architecture names
+ARCHS="x86_64:amd64:x86_64 aarch64:arm64:aarch64 armhf:armhf:armv7hl x86:i386:i686 s390x:s390x:s390x"
+WORK=$(mktemp -d)
+
+if [ "$FORMAT" = deb ]; then
+	apt-get update -qq
+	DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends debhelper dpkg-dev lintian >/dev/null
+	PKG=$WORK/pkg
+	mkdir -p $PKG/bin
+	cp -r "$SRC/contrib/static/debian" $PKG/debian
+	cat "$SRC/debian/copyright" $PKG/debian/copyright-bundled > $PKG/debian/copyright
+	rm $PKG/debian/copyright-bundled
+	cp "$SRC/contrib/i2pd.service" $PKG/debian/i2pd.service
+	cp "$SRC/contrib/debian/i2pd.tmpfile" $PKG/debian/i2pd.tmpfiles
+	cp "$SRC/contrib/i2pd.logrotate" $PKG/debian/i2pd.logrotate
+	cp "$SRC/debian/i2pd.init" $PKG/debian/i2pd.init
+	cp "$SRC/debian/i2pd.default" $PKG/debian/i2pd.default
+	ln -s "$SRC" $PKG/src
+	printf 'i2pd (%s-1) stable; urgency=medium\n\n  * Static build.\n\n -- %s  %s\n' \
+		"$VERSION" "$(sed -n 's/^Maintainer: //p' $PKG/debian/control)" "$(date -R)" > $PKG/debian/changelog
+	for a in $ARCHS; do
+		alpine=${a%%:*}; rest=${a#*:}; deb=${rest%%:*}
+		install -m 755 "$BIN/i2pd-static-$alpine/i2pd" $PKG/bin/i2pd-$deb
+		(cd $PKG && dpkg-buildpackage -b -us -uc -a$deb -d)
+		mv $WORK/i2pd_$VERSION-1_$deb.deb "$OUT/i2pd_${VERSION}_linux-all_$deb.deb"
+	done
+	lintian --fail-on error "$OUT/i2pd_${VERSION}_linux-all_amd64.deb"
+elif [ "$FORMAT" = rpm ]; then
+	dnf -q -y install rpm-build >/dev/null
+	mkdir -p $WORK/sources
+	for a in $ARCHS; do
+		alpine=${a%%:*}; rpm=${a##*:}
+		install -m 755 "$BIN/i2pd-static-$alpine/i2pd" $WORK/sources/i2pd-$rpm
+		rpmbuild -bb --target $rpm -D "ver $RPM_VERSION" -D "rel $RPM_RELEASE" -D "srcdir $SRC" \
+			-D "_topdir $WORK/rpmbuild" -D "_sourcedir $WORK/sources" -D "_rpmdir $WORK/rpms" "$SRC/contrib/static/i2pd.spec"
+		mv $WORK/rpms/$rpm/i2pd-$RPM_VERSION-$RPM_RELEASE.$rpm.rpm "$OUT/i2pd_${VERSION}_linux-all_$rpm.rpm"
+	done
+else
+	echo "usage: $0 deb|rpm BIN OUT" >&2
+	exit 1
+fi

From 6c6fe44faab7f3bdb2d083813560260c447badf9 Mon Sep 17 00:00:00 2001
From: acetone <63557806+freeacetone@users.noreply.github.com>
Date: Fri, 2 Oct 2026 04:36:41 -0400
Subject: [PATCH 03/12] build universal macOS binary with bundled libraries

---
 .github/workflows/build-macos.yml | 79 +++++++++++++++++++++----------
 contrib/static/build-macos.sh     | 67 ++++++++++++++++++++++++++
 2 files changed, 120 insertions(+), 26 deletions(-)
 create mode 100755 contrib/static/build-macos.sh

diff --git a/.github/workflows/build-macos.yml b/.github/workflows/build-macos.yml
index a1aeec95..9b239d7e 100644
--- a/.github/workflows/build-macos.yml
+++ b/.github/workflows/build-macos.yml
@@ -6,48 +6,75 @@ on:
     - '*'
     paths:
     - .github/workflows/build-macos.yml
+    - contrib/static/build-macos.sh
     - daemon/**
     - i18n/**
     - libi2pd/**
     - libi2pd_client/**
     - Makefile
     - Makefile.homebrew
-    tags:
-    - '*'
   pull_request:
     branches:
     - '*'
+  workflow_call:
 
 jobs:
   build:
-    name: Build on ${{ matrix.target-name }}
-    runs-on: ${{ matrix.target }}
-
-    strategy:
-      fail-fast: true
-      matrix:
-        include:
-          - target: macos-15
-            target-name: ARM64
-          - target: macos-15-intel
-            target-name: Intel x86_64
+    name: Build universal binary
+    runs-on: macos-15
 
     steps:
     - name: Checkout
       uses: actions/checkout@v4
 
-    - name: Install required formulae
-      run: |
-        find /usr/local/bin -lname '*/Library/Frameworks/Python.framework/*' -delete
-        brew update
-        brew install boost miniupnpc openssl@3.5
-
-    - name: List installed formulae
-      run: brew list
-
     - name: Build application
-      run: make HOMEBREW=1 USE_UPNP=yes USE_STATIC=yes PREFIX=$GITHUB_WORKSPACE/output -j3
+      run: sh contrib/static/build-macos.sh
 
-    - name: Print binary linking
-      run: otool -L i2pd
-    
+    - name: Check binary
+      run: |
+        lipo -archs i2pd | grep -w arm64
+        lipo -archs i2pd | grep -w x86_64
+        otool -L i2pd
+        test -z "$(otool -L i2pd | grep -E '^[[:space:]]' | grep -vE '^[[:space:]]+(/usr/lib/|/System/Library/)')"
+        vtool -show-build i2pd | grep -E 'architecture|minos|sdk'
+        test "$(vtool -show-build i2pd | grep -c 'minos 12\.0$')" = 2
+        ./i2pd --version
+        ./i2pd --version | grep -E '^OpenSSL (3\.([5-9]|[1-9][0-9])|[4-9])\.'
+        ./i2pd --version | grep -E '^Boost version 1\.(8[1-9]|9[0-9])\.'
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: i2pd-macos
+        path: i2pd
+
+  test:
+    name: Run on ${{ matrix.target-name }}
+    needs: build
+    runs-on: ${{ matrix.target }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: macos-14
+            target-name: macOS 14 ARM64
+          - target: macos-15-intel
+            target-name: macOS 15 Intel x86_64
+
+    steps:
+    - name: Download binary
+      uses: actions/download-artifact@v4
+      with:
+        name: i2pd-macos
+
+    - name: Run
+      run: |
+        chmod +x i2pd
+        ./i2pd --version
+        mkdir datadir
+        ./i2pd --datadir=datadir --log=file --logfile=datadir/i2pd.log --loglevel=info &
+        sleep 15
+        kill -0 $!
+        grep 'Daemon: Starting NetDB' datadir/i2pd.log
+        kill -9 $!
diff --git a/contrib/static/build-macos.sh b/contrib/static/build-macos.sh
new file mode 100755
index 00000000..f07fe6ee
--- /dev/null
+++ b/contrib/static/build-macos.sh
@@ -0,0 +1,67 @@
+#!/bin/sh
+# Universal i2pd for macOS with OpenSSL, Boost and miniupnpc built from source and linked statically
+set -e
+
+OPENSSL_VERSION=3.5.8
+BOOST_VERSION=1.92.0
+BOOST_SHA256=ea7b982002cc9dfbe59b0b217b206f470dc75f3de0bb2973d844118934d82411
+MINIUPNPC_VERSION=2.3.3
+MINIUPNPC_SHA256=d52a0afa614ad6c088cc9ddff1ae7d29c8c595ac5fdd321170a05f41e634bd1a
+ARCHS="arm64 x86_64"
+JOBS=4
+export MACOSX_DEPLOYMENT_TARGET=12.0
+
+SRC=$(pwd)
+WORK=${TMPDIR:-/tmp}/i2pd-macos
+mkdir -p "$WORK"
+cd "$WORK"
+
+fetch() {
+	curl -fsSL -o "$3" "$1"
+	echo "$2  $3" | shasum -a 256 -c -
+}
+
+OPENSSL=openssl-$OPENSSL_VERSION
+curl -fsSLO https://github.com/openssl/openssl/releases/download/$OPENSSL/$OPENSSL.tar.gz
+curl -fsSLO https://github.com/openssl/openssl/releases/download/$OPENSSL/$OPENSSL.tar.gz.sha256
+echo "$(cut -d' ' -f1 $OPENSSL.tar.gz.sha256)  $OPENSSL.tar.gz" | shasum -a 256 -c -
+fetch https://github.com/boostorg/boost/releases/download/boost-$BOOST_VERSION/boost-$BOOST_VERSION-b2-nodocs.tar.xz $BOOST_SHA256 boost.tar.xz
+fetch https://github.com/miniupnp/miniupnp/releases/download/miniupnpc_$(echo $MINIUPNPC_VERSION | tr . _)/miniupnpc-$MINIUPNPC_VERSION.tar.gz $MINIUPNPC_SHA256 miniupnpc.tar.gz
+tar xzf $OPENSSL.tar.gz
+tar xJf boost.tar.xz
+tar xzf miniupnpc.tar.gz
+(cd boost-$BOOST_VERSION && ./bootstrap.sh)
+
+for ARCH in $ARCHS; do
+	PREFIX=$WORK/$ARCH
+	(
+		cd $OPENSSL
+		make distclean >/dev/null 2>&1 || true
+		# no-autoload-config: a static binary must not read the host's openssl.cnf
+		./Configure darwin64-$ARCH-cc --prefix=$PREFIX --libdir=lib --openssldir=/nonexistent \
+			no-autoload-config no-shared no-module no-dso no-engine no-tests no-docs
+		make -j$JOBS build_libs
+		make install_dev
+	)
+	(
+		cd boost-$BOOST_VERSION
+		./b2 -j$JOBS --build-dir=$WORK/boost-build-$ARCH --prefix=$PREFIX \
+			--with-program_options --with-json --with-url link=static variant=release \
+			cxxflags="-arch $ARCH" linkflags="-arch $ARCH" install
+	)
+	cmake -S miniupnpc-$MINIUPNPC_VERSION -B miniupnpc-build-$ARCH -DCMAKE_OSX_ARCHITECTURES=$ARCH \
+		-DCMAKE_INSTALL_PREFIX=$PREFIX -DUPNPC_BUILD_SHARED=OFF -DUPNPC_BUILD_TESTS=OFF -DUPNPC_BUILD_SAMPLE=OFF
+	cmake --build miniupnpc-build-$ARCH -j $JOBS
+	cmake --install miniupnpc-build-$ARCH
+	(
+		cd "$SRC"
+		make clean >/dev/null
+		make -j$JOBS HOMEBREW=1 USE_STATIC=yes USE_UPNP=yes DEBUG=no CXX="clang++ -arch $ARCH" \
+			SSLROOT=$PREFIX BOOSTROOT=$PREFIX UPNPROOT=$PREFIX i2pd
+		mv i2pd i2pd-$ARCH
+	)
+done
+
+cd "$SRC"
+lipo -create -output i2pd i2pd-arm64 i2pd-x86_64
+rm i2pd-arm64 i2pd-x86_64

From 35705eb9016a595a36910059f5bacbf8842d313c Mon Sep 17 00:00:00 2001
From: acetone <63557806+freeacetone@users.noreply.github.com>
Date: Fri, 2 Oct 2026 04:36:41 -0400
Subject: [PATCH 04/12] build Windows ARM64, x86 and XP in CI

---
 .github/workflows/build-windows.yml | 133 +++++++++++++++++-----------
 Makefile.mingw                      |   9 +-
 2 files changed, 90 insertions(+), 52 deletions(-)

diff --git a/.github/workflows/build-windows.yml b/.github/workflows/build-windows.yml
index 62421ab3..0a071d5f 100644
--- a/.github/workflows/build-windows.yml
+++ b/.github/workflows/build-windows.yml
@@ -15,11 +15,10 @@ on:
     - Win32/**
     - Makefile
     - Makefile.mingw
-    tags:
-    - '*'
   pull_request:
     branches:
     - '*'
+  workflow_call:
 
 defaults:
   run:
@@ -28,16 +27,17 @@ defaults:
 jobs:
   build:
     name: ${{ matrix.arch }}
-    runs-on: windows-latest
+    runs-on: ${{ matrix.os }}
 
     strategy:
       fail-fast: false
       matrix:
         include: [
-          { msystem: UCRT64, arch: ucrt-x86_64, arch_short: x64-ucrt, compiler: gcc },
-          { msystem: CLANG64, arch: clang-x86_64, arch_short: x64-clang, compiler: clang },
-          { msystem: MINGW64, arch: x86_64, arch_short: x64, compiler: gcc },
-          # { msystem: MINGW32, arch: i686, arch_short: x86, compiler: gcc }
+          { msystem: UCRT64, arch: ucrt-x86_64, arch_short: x64-ucrt, compiler: gcc, os: windows-latest },
+          { msystem: CLANG64, arch: clang-x86_64, arch_short: x64-clang, compiler: clang, os: windows-latest },
+          { msystem: MINGW64, arch: x86_64, arch_short: x64, compiler: gcc, os: windows-latest },
+          { msystem: MINGW32, arch: i686, arch_short: x86, compiler: gcc, os: windows-latest },
+          { msystem: CLANGARM64, arch: clang-aarch64, arch_short: arm64, compiler: clang, os: windows-11-arm }
         ]
 
     steps:
@@ -50,11 +50,43 @@ jobs:
       uses: msys2/setup-msys2@v2
       with:
         msystem: ${{ matrix.msystem }}
-        install: base-devel git mingw-w64-${{ matrix.arch }}-${{ matrix.compiler }} mingw-w64-${{ matrix.arch }}-boost mingw-w64-${{ matrix.arch }}-openssl mingw-w64-${{ matrix.arch }}-miniupnpc
+        install: >-
+          base-devel git mingw-w64-${{ matrix.arch }}-${{ matrix.compiler }} mingw-w64-${{ matrix.arch }}-openssl
+          ${{ matrix.msystem == 'MINGW32' && 'mingw-w64-i686-cmake mingw-w64-i686-ninja' || format('mingw-w64-{0}-boost mingw-w64-{0}-miniupnpc', matrix.arch) }}
         update: true
 
+    # MSYS2 no longer ships Boost and miniupnpc for i686
+    - name: Build Boost and miniupnpc
+      if: ${{ matrix.msystem == 'MINGW32' }}
+      env:
+        BOOST_VERSION: 1.92.0
+        BOOST_SHA256: ea7b982002cc9dfbe59b0b217b206f470dc75f3de0bb2973d844118934d82411
+        MINIUPNPC_VERSION: 2.3.3
+        MINIUPNPC_SHA256: d52a0afa614ad6c088cc9ddff1ae7d29c8c595ac5fdd321170a05f41e634bd1a
+      run: |
+        set -e
+        curl -fsSL -o boost.tar.xz https://github.com/boostorg/boost/releases/download/boost-$BOOST_VERSION/boost-$BOOST_VERSION-b2-nodocs.tar.xz
+        echo "$BOOST_SHA256  boost.tar.xz" | sha256sum -c -
+        tar xJf boost.tar.xz
+        cd boost-$BOOST_VERSION
+        ./bootstrap.sh --with-toolset=gcc
+        ./b2 -j4 toolset=gcc target-os=windows threadapi=win32 address-model=32 architecture=x86 \
+          link=static threading=multi variant=release --layout=system \
+          --with-filesystem --with-program_options --with-json --with-url stage
+        cp -r boost $MINGW_PREFIX/include/
+        # Makefile.mingw links the MSYS2 library names with the -mt suffix
+        for lib in filesystem program_options json url; do cp stage/lib/libboost_$lib.a $MINGW_PREFIX/lib/libboost_$lib-mt.a; done
+        cd ..
+        curl -fsSL -o miniupnpc.tar.gz https://github.com/miniupnp/miniupnp/releases/download/miniupnpc_${MINIUPNPC_VERSION//./_}/miniupnpc-$MINIUPNPC_VERSION.tar.gz
+        echo "$MINIUPNPC_SHA256  miniupnpc.tar.gz" | sha256sum -c -
+        tar xzf miniupnpc.tar.gz
+        cmake -S miniupnpc-$MINIUPNPC_VERSION -B miniupnpc-build -G Ninja -DCMAKE_INSTALL_PREFIX=$MINGW_PREFIX \
+          -DUPNPC_BUILD_SHARED=OFF -DUPNPC_BUILD_TESTS=OFF -DUPNPC_BUILD_SAMPLE=OFF
+        cmake --build miniupnpc-build
+        cmake --install miniupnpc-build
+
     - name: Install additional clang packages
-      if: ${{ matrix.msystem == 'CLANG64' }}
+      if: ${{ matrix.compiler == 'clang' }}
       run: pacman --noconfirm -S mingw-w64-${{ matrix.arch }}-gcc-compat
 
     - name: Build application
@@ -70,16 +102,16 @@ jobs:
 
   build-cmake:
     name: CMake ${{ matrix.arch }}
-    runs-on: windows-latest
+    runs-on: ${{ matrix.os }}
 
     strategy:
       fail-fast: false
       matrix:
         include: [
-          { msystem: UCRT64, arch: ucrt-x86_64, arch_short: x64-ucrt, compiler: gcc },
-          { msystem: CLANG64, arch: clang-x86_64, arch_short: x64-clang, compiler: clang },
-          { msystem: MINGW64, arch: x86_64, arch_short: x64, compiler: gcc },
-          # { msystem: MINGW32, arch: i686, arch_short: x86, compiler: gcc }
+          { msystem: UCRT64, arch: ucrt-x86_64, arch_short: x64-ucrt, compiler: gcc, os: windows-latest },
+          { msystem: CLANG64, arch: clang-x86_64, arch_short: x64-clang, compiler: clang, os: windows-latest },
+          { msystem: MINGW64, arch: x86_64, arch_short: x64, compiler: gcc, os: windows-latest },
+          { msystem: CLANGARM64, arch: clang-aarch64, arch_short: arm64, compiler: clang, os: windows-11-arm }
         ]
 
     steps:
@@ -108,7 +140,6 @@ jobs:
         path: build/i2pd.exe
 
   build-xp:
-    if: false
     name: XP
     runs-on: windows-latest
 
@@ -125,62 +156,57 @@ jobs:
       uses: msys2/setup-msys2@v2
       with:
         msystem: MINGW32
-        install: base-devel git mingw-w64-i686-gcc mingw-w64-i686-boost mingw-w64-i686-openssl mingw-w64-i686-miniupnpc
+        install: base-devel git mingw-w64-i686-gcc mingw-w64-i686-openssl mingw-w64-i686-cmake mingw-w64-i686-ninja
         cache: true
         update: true
 
-    - name: Clone MinGW packages repository and revert boost to 1.85.0
-      run: |
-        git clone https://github.com/msys2/MINGW-packages
-        cd MINGW-packages
-        git checkout 4cbb366edf2f268ac3146174b40ce38604646fc5 mingw-w64-boost
-        cd mingw-w64-boost
-        sed -i 's/boostorg.jfrog.io\/artifactory\/main/archives.boost.io/' PKGBUILD
+    - name: Clone MinGW packages repository
+      run: git clone https://github.com/msys2/MINGW-packages
 
     # headers
     - name: Get headers package version
       id:  version-headers
       run: |
-        echo "version=$(pacman -Si mingw-w64-i686-headers-git | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
+        echo "version=$(pacman -Si mingw-w64-i686-headers | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
     - name: Cache headers package
       uses: actions/cache@v4
       id: cache-headers
       with:
-        path: MINGW-packages/mingw-w64-headers-git/*.zst
+        path: MINGW-packages/mingw-w64-headers/*.zst
         key: winxp-headers-${{ steps.version-headers.outputs.version }}
     - name: Build WinXP-capable headers package
       if: steps.cache-headers.outputs.cache-hit != 'true'
       run: |
-        cd MINGW-packages/mingw-w64-headers-git
+        cd MINGW-packages/mingw-w64-headers
         sed -i 's/0x601/0x501/' PKGBUILD
         MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
     - name: Install headers package
-      run: pacman --noconfirm -U MINGW-packages/mingw-w64-headers-git/mingw-w64-i686-*-any.pkg.tar.zst
+      run: pacman --noconfirm -U MINGW-packages/mingw-w64-headers/mingw-w64-i686-*-any.pkg.tar.zst
 
     # CRT
     - name: Get crt package version
       id:  version-crt
       run: |
-        echo "version=$(pacman -Si mingw-w64-i686-crt-git | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
+        echo "version=$(pacman -Si mingw-w64-i686-crt | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
     - name: Cache crt package
       uses: actions/cache@v4
       id: cache-crt
       with:
-        path: MINGW-packages/mingw-w64-crt-git/*.zst
+        path: MINGW-packages/mingw-w64-crt/*.zst
         key: winxp-crt-${{ steps.version-crt.outputs.version }}
     - name: Build WinXP-capable crt package
       if: steps.cache-crt.outputs.cache-hit != 'true'
       run: |
-        cd MINGW-packages/mingw-w64-crt-git
+        cd MINGW-packages/mingw-w64-crt
         MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
     - name: Install crt package
-      run: pacman --noconfirm -U MINGW-packages/mingw-w64-crt-git/mingw-w64-i686-*-any.pkg.tar.zst
+      run: pacman --noconfirm -U MINGW-packages/mingw-w64-crt/mingw-w64-i686-*-any.pkg.tar.zst
 
     # winpthreads
     - name: Get winpthreads package version
       id:  version-winpthreads
       run: |
-        echo "version=$(pacman -Si mingw-w64-i686-winpthreads-git | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
+        echo "version=$(pacman -Si mingw-w64-i686-winpthreads | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
     - name: Cache winpthreads package
       uses: actions/cache@v4
       id: cache-winpthreads
@@ -216,25 +242,32 @@ jobs:
       run: pacman --noconfirm -U MINGW-packages/mingw-w64-openssl/mingw-w64-i686-*-any.pkg.tar.zst
 
     # Boost
-    #- name: Get boost package version
-    #  id:  version-boost
-    #  run: |
-    #    echo "version=$(pacman -Si mingw-w64-i686-boost | grep -Po '^Version\s*: \K.+')" >> $GITHUB_OUTPUT
-    - name: Cache boost package
-      uses: actions/cache@v4
-      id: cache-boost
-      with:
-        path: MINGW-packages/mingw-w64-boost/*.zst
-        key: winxp-boost-1.85.0+crt-${{ steps.version-headers.outputs.version }}+ossl-${{ steps.version-openssl.outputs.version }}
-    - name: Build WinXP-capable boost package
-      if: steps.cache-boost.outputs.cache-hit != 'true'
+    - name: Build Boost and miniupnpc
+      env:
+        BOOST_VERSION: 1.85.0
+        BOOST_SHA256: be0d91732d5b0cc6fbb275c7939974457e79b54d6f07ce2e3dfdd68bef883b0b
+        MINIUPNPC_VERSION: 2.3.3
+        MINIUPNPC_SHA256: d52a0afa614ad6c088cc9ddff1ae7d29c8c595ac5fdd321170a05f41e634bd1a
       run: |
-        cd MINGW-packages/mingw-w64-boost
-        MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
-    - name: Remove boost packages
-      run: pacman --noconfirm -R mingw-w64-i686-boost mingw-w64-i686-boost-libs
-    - name: Install boost package
-      run: pacman --noconfirm -U MINGW-packages/mingw-w64-boost/mingw-w64-i686-*-any.pkg.tar.zst
+        set -e
+        curl -fsSL -o boost.tar.gz https://archives.boost.io/release/$BOOST_VERSION/source/boost_${BOOST_VERSION//./_}.tar.gz
+        echo "$BOOST_SHA256  boost.tar.gz" | sha256sum -c -
+        tar xzf boost.tar.gz
+        cd boost_${BOOST_VERSION//./_}
+        ./bootstrap.sh --with-toolset=gcc
+        ./b2 -j4 toolset=gcc target-os=windows threadapi=win32 address-model=32 architecture=x86 \
+          link=static threading=multi variant=release --layout=system \
+          --with-filesystem --with-program_options --with-json --with-url stage
+        cp -r boost $MINGW_PREFIX/include/
+        for lib in filesystem program_options json url; do cp stage/lib/libboost_$lib.a $MINGW_PREFIX/lib/libboost_$lib-mt.a; done
+        cd ..
+        curl -fsSL -o miniupnpc.tar.gz https://github.com/miniupnp/miniupnp/releases/download/miniupnpc_${MINIUPNPC_VERSION//./_}/miniupnpc-$MINIUPNPC_VERSION.tar.gz
+        echo "$MINIUPNPC_SHA256  miniupnpc.tar.gz" | sha256sum -c -
+        tar xzf miniupnpc.tar.gz
+        cmake -S miniupnpc-$MINIUPNPC_VERSION -B miniupnpc-build -G Ninja -DCMAKE_INSTALL_PREFIX=$MINGW_PREFIX \
+          -DUPNPC_BUILD_SHARED=OFF -DUPNPC_BUILD_TESTS=OFF -DUPNPC_BUILD_SAMPLE=OFF
+        cmake --build miniupnpc-build
+        cmake --install miniupnpc-build
 
     # Building i2pd
     - name: Build application
diff --git a/Makefile.mingw b/Makefile.mingw
index 282a8f42..95783f6a 100644
--- a/Makefile.mingw
+++ b/Makefile.mingw
@@ -3,9 +3,14 @@ USE_WIN32_APP := yes
 
 WINDRES = windres
 
-CXXFLAGS := $(CXX_DEBUG) -fPIC -msse
+CXXFLAGS := $(CXX_DEBUG) -fPIC
 INCFLAGS := -I$(DAEMON_SRC_DIR) -IWin32
-LDFLAGS := ${LD_DEBUG} -static -fPIC -msse
+LDFLAGS := ${LD_DEBUG} -static -fPIC
+
+ifeq (,$(findstring aarch64,$(SYS)))
+	CXXFLAGS += -msse
+	LDFLAGS += -msse
+endif
 
 NEEDED_CXXFLAGS += -std=c++23
 

From d6aa07fb300cd80846517e71997638ed148a6a97 Mon Sep 17 00:00:00 2001
From: acetone <63557806+freeacetone@users.noreply.github.com>
Date: Fri, 2 Oct 2026 04:36:41 -0400
Subject: [PATCH 05/12] build FreeBSD with OpenSSL and Boost from ports

---
 .github/workflows/build-freebsd.yml | 21 +++++++++++++++++----
 Makefile.bsd                        |  2 +-
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build-freebsd.yml b/.github/workflows/build-freebsd.yml
index a4a7566a..2ad20f2a 100644
--- a/.github/workflows/build-freebsd.yml
+++ b/.github/workflows/build-freebsd.yml
@@ -23,7 +23,12 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
-    name: with UPnP
+    name: FreeBSD ${{ matrix.release }} with UPnP
+
+    strategy:
+      fail-fast: false
+      matrix:
+        release: ['14.4', '15.0']
 
     steps:
     - name: Checkout
@@ -33,18 +38,26 @@ jobs:
       id: test
       uses: vmactions/freebsd-vm@v1
       with:
+        release: ${{ matrix.release }}
         usesh: true
         mem: 2048
         sync: rsync
         copyback: true
-        prepare: pkg install -y devel/cmake devel/gmake devel/boost-libs security/openssl net/miniupnpc
+        prepare: |
+          sed -i '' 's|/quarterly"|/latest"|' /etc/pkg/FreeBSD.conf
+          pkg update -f
+          pkg install -y devel/cmake devel/gmake devel/boost-libs security/openssl35 net/miniupnpc
         run: |
+          set -e
           cd build
-          cmake -DWITH_UPNP=ON -DCMAKE_BUILD_TYPE=Release .
+          cmake -DWITH_UPNP=ON -DCMAKE_BUILD_TYPE=Release -DOPENSSL_ROOT_DIR=/usr/local .
           gmake -j2
+          ./i2pd --version
+          ./i2pd --version | grep -E '^OpenSSL (3\.([5-9]|[1-9][0-9])|[4-9])\.'
+          ./i2pd --version | grep -E '^Boost version 1\.(8[1-9]|9[0-9])\.'
 
     - name: Upload artifacts
       uses: actions/upload-artifact@v4
       with:
-        name: i2pd-freebsd
+        name: i2pd-freebsd-${{ matrix.release }}
         path: build/i2pd
diff --git a/Makefile.bsd b/Makefile.bsd
index 818aa6b7..35eb08d6 100644
--- a/Makefile.bsd
+++ b/Makefile.bsd
@@ -4,7 +4,7 @@ DEFINES = -D_GLIBCXX_USE_NANOSLEEP=1
 ifneq ($(TORRENTS),yes)
 	DEFINES += -DNO_TORRENTS
 endif
-INCFLAGS = -I/usr/include/ -I/usr/local/include/
+INCFLAGS = -I/usr/local/include/
 LDFLAGS = ${LD_DEBUG} -Wl,-rpath,/usr/local/lib -L/usr/local/lib
 LDLIBS = -lssl -lcrypto -lz -lpthread -lboost_program_options
 ifeq ($(TORRENTS),yes)

From c304f1c86fdfd6bc959e7e1d5fb1e153943907b5 Mon Sep 17 00:00:00 2001
From: acetone <63557806+freeacetone@users.noreply.github.com>
Date: Fri, 2 Oct 2026 04:36:41 -0400
Subject: [PATCH 06/12] build Debian 13 package with torrents

---
 .github/workflows/build-deb.yml | 23 +++++++++++++----------
 debian/control                  |  2 +-
 2 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml
index 299c95a5..b7b30409 100644
--- a/.github/workflows/build-deb.yml
+++ b/.github/workflows/build-deb.yml
@@ -14,21 +14,26 @@ on:
     - libi2pd_client/**
     - Makefile
     - Makefile.linux
-    tags:
-    - '*'
   pull_request:
     branches:
     - '*'
+  workflow_call:
 
 jobs:
   build:
-    name: ${{ matrix.dist }}
-    runs-on: ubuntu-latest
+    name: ${{ matrix.dist }} ${{ matrix.arch }}
+    runs-on: ${{ matrix.runner }}
 
     strategy:
       fail-fast: false
       matrix:
-        dist: ['bookworm','trixie']
+        dist: ['trixie']
+        arch: ['amd64', 'arm64']
+        include:
+        - arch: amd64
+          runner: ubuntu-latest
+        - arch: arm64
+          runner: ubuntu-24.04-arm
 
     steps:
     - name: Checkout
@@ -41,22 +46,20 @@ jobs:
       uses: prompt/actions-commit-hash@v3.0.0
 
     - name: Build package
-      env:
-        MAKEFLAGS: "TORRENTS=N"
       uses: jtdor/build-deb-action@v1
       with:
         docker-image: debian:${{ matrix.dist }}-slim
         buildpackage-opts: --build=binary --no-sign
-        before-build-hook: debchange --controlmaint --local "+${{ steps.commit.outputs.short }}~${{ matrix.dist }}" -b --distribution ${{ matrix.dist }} "CI build"
+        before-build-hook: debchange --controlmaint --local "${{ startsWith(github.ref, 'refs/tags/') && matrix.dist || format('+{0}~{1}', steps.commit.outputs.short, matrix.dist) }}" -b --distribution ${{ matrix.dist }} "CI build"
         extra-build-deps: devscripts git
     - name: Upload package
       uses: actions/upload-artifact@v4
       with:
-        name: i2pd_${{ matrix.dist }}
+        name: i2pd_${{ matrix.dist }}_${{ matrix.arch }}
         path: debian/artifacts/i2pd_*.deb
 
     - name: Upload debugging symbols
       uses: actions/upload-artifact@v4
       with:
-        name: i2pd-dbgsym_${{ matrix.dist }}
+        name: i2pd-dbgsym_${{ matrix.dist }}_${{ matrix.arch }}
         path: debian/artifacts/i2pd-dbgsym_*.deb
diff --git a/debian/control b/debian/control
index 5508236b..a74c98a3 100644
--- a/debian/control
+++ b/debian/control
@@ -2,7 +2,7 @@ Source: i2pd
 Section: net
 Priority: optional
 Maintainer: r4sas <r4sas@i2pmail.org>
-Build-Depends: debhelper (>= 12~), libboost-program-options-dev (>= 1.46), libminiupnpc-dev, libssl-dev, zlib1g-dev
+Build-Depends: debhelper (>= 12~), libboost-program-options-dev (>= 1.46), libboost-json-dev (>= 1.81), libboost-url-dev (>= 1.81), libminiupnpc-dev, libssl-dev (>= 3.5), zlib1g-dev
 Standards-Version: 4.3.0
 Homepage: http://i2pd.website/
 Vcs-Git: git://github.com/PurpleI2P/i2pd.git

From d9488ab4e62aff5fa55ab55585745aa4ec6cde2b Mon Sep 17 00:00:00 2001
From: acetone <63557806+freeacetone@users.noreply.github.com>
Date: Fri, 2 Oct 2026 04:36:42 -0400
Subject: [PATCH 07/12] draft release on tag

---
 .github/workflows/release.yml | 63 +++++++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..7f658f42
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,63 @@
+name: Release
+
+on:
+  push:
+    tags:
+    - '*'
+
+jobs:
+  windows:
+    uses: ./.github/workflows/build-windows.yml
+
+  macos:
+    uses: ./.github/workflows/build-macos.yml
+
+  linux:
+    uses: ./.github/workflows/build-static.yml
+
+  debian:
+    uses: ./.github/workflows/build-deb.yml
+
+  release:
+    name: Draft release
+    needs: [windows, macos, linux, debian]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Download artifacts
+      uses: actions/download-artifact@v4
+      with:
+        path: artifacts
+
+    - name: Prepare release files
+      run: |
+        sudo apt-get update -qq
+        sudo apt-get install -y -qq dos2unix
+        TAG=$GITHUB_REF_NAME
+        mkdir release
+        echo "To use configs and certificates, move all files and certificates folder from contrib directory here." > README.txt
+        unix2dos -q contrib/i2pd.conf contrib/tunnels.conf contrib/tunnels.d/* contrib/webconsole/style.css
+        for build in x64:win64 x86:win32 xp:winxp arm64:winarm64; do
+          cp artifacts/i2pd-${build%%:*}.exe/i2pd.exe i2pd.exe
+          zip -qr9 release/i2pd_${TAG}_${build#*:}_mingw.zip i2pd.exe README.txt \
+            contrib/i2pd.conf contrib/tunnels.conf contrib/certificates contrib/tunnels.d contrib/webconsole
+        done
+        chmod +x artifacts/i2pd-macos/i2pd
+        tar -czf release/i2pd_${TAG}_osx.tar.gz -C artifacts/i2pd-macos i2pd
+        cp artifacts/i2pd-linux-all/* release/
+        cp artifacts/i2pd_trixie_*/i2pd_*.deb release/
+        cd release
+        sha512sum -b * > SHA512SUMS
+        ls -l
+
+    - name: Create draft release
+      uses: softprops/action-gh-release@v2
+      with:
+        draft: true
+        files: release/*
+        fail_on_unmatched_files: true

From a2c38f86e6885e2066c520bf585e03f8232a3888 Mon Sep 17 00:00:00 2001
From: acetone <63557806+freeacetone@users.noreply.github.com>
Date: Fri, 2 Oct 2026 09:35:53 -0400
Subject: [PATCH 08/12] build OpenSSL for Windows XP without uplink

---
 .github/workflows/build-windows.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-windows.yml b/.github/workflows/build-windows.yml
index 0a071d5f..d2d1ddab 100644
--- a/.github/workflows/build-windows.yml
+++ b/.github/workflows/build-windows.yml
@@ -231,11 +231,15 @@ jobs:
       id: cache-openssl
       with:
         path: MINGW-packages/mingw-w64-openssl/*.zst
-        key: winxp-openssl-${{ steps.version-openssl.outputs.version }}
+        key: winxp-openssl-${{ steps.version-openssl.outputs.version }}-no-uplink
     - name: Build WinXP-capable openssl package
       if: steps.cache-openssl.outputs.cache-hit != 'true'
       run: |
+        set -e
         cd MINGW-packages/mingw-w64-openssl
+        # ms/uplink.c imports msvcrt.dll!wcscpy_s, which Windows XP does not have
+        sed -i 's/^    shared \\$/    shared no-uplink \\/' PKGBUILD
+        grep -q '^    shared no-uplink \\$' PKGBUILD
         curl https://openssl-library.org/source/pubkeys.asc | gpg --import
         MINGW_ARCH=mingw32 makepkg-mingw -sCLf --noconfirm --nocheck
     - name: Install openssl package
@@ -274,6 +278,7 @@ jobs:
       run: |
         mkdir -p obj/Win32 obj/libi2pd obj/libi2pd_client obj/daemon
         make USE_UPNP=yes DEBUG=no USE_GIT_VERSION=yes USE_WINXP_FLAGS=yes -j3
+        if objdump -p i2pd.exe | grep -w wcscpy_s; then exit 1; fi
     - name: Upload artifacts
       uses: actions/upload-artifact@v4
       with:

From 4bf05e2e35cac3b4310512367ccfcca0023d9fdc Mon Sep 17 00:00:00 2001
From: acetone <63557806+freeacetone@users.noreply.github.com>
Date: Fri, 2 Oct 2026 13:16:31 -0400
Subject: [PATCH 09/12] build static FreeBSD binaries for release

---
 .github/workflows/build-freebsd.yml | 30 ++++++++++++++++-------------
 .github/workflows/release.yml       | 10 +++++++++-
 contrib/static/build-freebsd.sh     | 28 +++++++++++++++++++++++++++
 3 files changed, 54 insertions(+), 14 deletions(-)
 create mode 100755 contrib/static/build-freebsd.sh

diff --git a/.github/workflows/build-freebsd.yml b/.github/workflows/build-freebsd.yml
index 2ad20f2a..77d90139 100644
--- a/.github/workflows/build-freebsd.yml
+++ b/.github/workflows/build-freebsd.yml
@@ -14,16 +14,16 @@ on:
     - libi2pd_client/**
     - Makefile
     - Makefile.bsd
-    tags:
-    - '*'
+    - contrib/static/build-freebsd.sh
   pull_request:
     branches:
     - '*'
+  workflow_call:
 
 jobs:
   build:
     runs-on: ubuntu-latest
-    name: FreeBSD ${{ matrix.release }} with UPnP
+    name: FreeBSD ${{ matrix.release }} static
 
     strategy:
       fail-fast: false
@@ -34,27 +34,31 @@ jobs:
     - name: Checkout
       uses: actions/checkout@v4
 
-    - name: Test in FreeBSD
-      id: test
+    - name: Build in FreeBSD
       uses: vmactions/freebsd-vm@v1
       with:
         release: ${{ matrix.release }}
         usesh: true
-        mem: 2048
+        mem: 4096
         sync: rsync
         copyback: true
         prepare: |
           sed -i '' 's|/quarterly"|/latest"|' /etc/pkg/FreeBSD.conf
           pkg update -f
-          pkg install -y devel/cmake devel/gmake devel/boost-libs security/openssl35 net/miniupnpc
+          pkg install -y devel/cmake devel/gmake perl5 devel/boost-libs net/miniupnpc
         run: |
           set -e
-          cd build
-          cmake -DWITH_UPNP=ON -DCMAKE_BUILD_TYPE=Release -DOPENSSL_ROOT_DIR=/usr/local .
-          gmake -j2
-          ./i2pd --version
-          ./i2pd --version | grep -E '^OpenSSL (3\.([5-9]|[1-9][0-9])|[4-9])\.'
-          ./i2pd --version | grep -E '^Boost version 1\.(8[1-9]|9[0-9])\.'
+          sh contrib/static/build-freebsd.sh
+          file build/i2pd | grep 'statically linked'
+          build/i2pd --version
+          build/i2pd --version | grep -E '^OpenSSL (3\.([5-9]|[1-9][0-9])|[4-9])\.'
+          build/i2pd --version | grep -E '^Boost version 1\.(8[1-9]|9[0-9])\.'
+          mkdir /tmp/datadir
+          build/i2pd --datadir=/tmp/datadir --log=file --logfile=/tmp/datadir/i2pd.log --loglevel=info &
+          sleep 15
+          kill -0 $!
+          grep 'Daemon: Starting NetDB' /tmp/datadir/i2pd.log
+          kill -9 $!
 
     - name: Upload artifacts
       uses: actions/upload-artifact@v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7f658f42..f1bf28e2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,9 +18,12 @@ jobs:
   debian:
     uses: ./.github/workflows/build-deb.yml
 
+  freebsd:
+    uses: ./.github/workflows/build-freebsd.yml
+
   release:
     name: Draft release
-    needs: [windows, macos, linux, debian]
+    needs: [windows, macos, linux, debian, freebsd]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -49,6 +52,11 @@ jobs:
         done
         chmod +x artifacts/i2pd-macos/i2pd
         tar -czf release/i2pd_${TAG}_osx.tar.gz -C artifacts/i2pd-macos i2pd
+        for dir in artifacts/i2pd-freebsd-*; do
+          chmod +x $dir/i2pd
+          rel=${dir##*-}
+          tar -czf release/i2pd_${TAG}_freebsd${rel%%.*}_amd64.tar.gz -C $dir i2pd
+        done
         cp artifacts/i2pd-linux-all/* release/
         cp artifacts/i2pd_trixie_*/i2pd_*.deb release/
         cd release
diff --git a/contrib/static/build-freebsd.sh b/contrib/static/build-freebsd.sh
new file mode 100755
index 00000000..90fe7859
--- /dev/null
+++ b/contrib/static/build-freebsd.sh
@@ -0,0 +1,28 @@
+#!/bin/sh
+# Fully static i2pd for FreeBSD, run from the source tree with the cmake, gmake, perl5, boost-libs and miniupnpc packages
+set -e
+
+OPENSSL_VERSION=3.5.8
+JOBS=4
+
+SRC=$(pwd)
+WORK=${TMPDIR:-/tmp}/i2pd-freebsd
+mkdir -p "$WORK"
+cd "$WORK"
+
+OPENSSL=openssl-$OPENSSL_VERSION
+fetch -q https://github.com/openssl/openssl/releases/download/$OPENSSL/$OPENSSL.tar.gz
+fetch -q https://github.com/openssl/openssl/releases/download/$OPENSSL/$OPENSSL.tar.gz.sha256
+[ "$(sha256 -q $OPENSSL.tar.gz)" = "$(cut -d' ' -f1 $OPENSSL.tar.gz.sha256)" ]
+tar xzf $OPENSSL.tar.gz
+cd $OPENSSL
+# no-autoload-config: a static binary must not read the host's openssl.cnf
+./Configure --prefix="$WORK/openssl" --libdir=lib --openssldir=/nonexistent \
+	no-autoload-config no-shared no-module no-dso no-engine no-tests no-docs
+gmake -j$JOBS build_libs
+gmake install_dev
+
+cd "$SRC/build"
+cmake -DWITH_STATIC=ON -DWITH_UPNP=ON -DCMAKE_BUILD_TYPE=Release -DOPENSSL_ROOT_DIR="$WORK/openssl" .
+gmake -j$JOBS
+strip i2pd

From 296481f213c7e8aa57544ed015e581f891786e56 Mon Sep 17 00:00:00 2001
From: acetone <63557806+freeacetone@users.noreply.github.com>
Date: Fri, 2 Oct 2026 13:16:31 -0400
Subject: [PATCH 10/12] build Windows installer on release

---
 .github/workflows/release.yml | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f1bf28e2..921864b1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,9 +21,39 @@ jobs:
   freebsd:
     uses: ./.github/workflows/build-freebsd.yml
 
+  installer:
+    name: Windows installer
+    needs: windows
+    runs-on: windows-latest
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Download binaries
+      uses: actions/download-artifact@v4
+      with:
+        pattern: i2pd-*.exe
+        path: artifacts
+
+    - name: Build installer
+      shell: pwsh
+      run: |
+        choco install innosetup -y --no-progress
+        Copy-Item artifacts/i2pd-x86.exe/i2pd.exe i2pd_x32.exe
+        Copy-Item artifacts/i2pd-x64.exe/i2pd.exe i2pd_x64.exe
+        Copy-Item artifacts/i2pd-xp.exe/i2pd.exe i2pd_xp.exe
+        & "${env:ProgramFiles(x86)}\Inno Setup 6\ISCC.exe" "/dI2Pd_TextVer=$env:GITHUB_REF_NAME" "/dI2Pd_Ver=$env:GITHUB_REF_NAME.0" build\win_installer.iss
+
+    - name: Upload installer
+      uses: actions/upload-artifact@v4
+      with:
+        name: i2pd-installer
+        path: build/setup_i2pd_v*.exe
+
   release:
     name: Draft release
-    needs: [windows, macos, linux, debian, freebsd]
+    needs: [windows, macos, linux, debian, freebsd, installer]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -57,6 +87,7 @@ jobs:
           rel=${dir##*-}
           tar -czf release/i2pd_${TAG}_freebsd${rel%%.*}_amd64.tar.gz -C $dir i2pd
         done
+        cp artifacts/i2pd-installer/setup_i2pd_v*.exe release/
         cp artifacts/i2pd-linux-all/* release/
         cp artifacts/i2pd_trixie_*/i2pd_*.deb release/
         cd release

From 70c3f0611a731307c1cc15af7fcb3cfa88fca8a4 Mon Sep 17 00:00:00 2001
From: acetone <63557806+freeacetone@users.noreply.github.com>
Date: Fri, 2 Oct 2026 15:44:04 -0400
Subject: [PATCH 11/12] build cross-compiled and emulated targets for releases
 only

---
 .github/workflows/build-macos.yml  | 35 +++++++++++++++++++++++-------
 .github/workflows/build-static.yml | 30 +++++++------------------
 .github/workflows/release.yml      |  4 ++--
 contrib/static/build-macos.sh      | 13 +++++++----
 contrib/static/package.sh          |  4 +++-
 5 files changed, 49 insertions(+), 37 deletions(-)

diff --git a/.github/workflows/build-macos.yml b/.github/workflows/build-macos.yml
index 9b239d7e..4d1f78aa 100644
--- a/.github/workflows/build-macos.yml
+++ b/.github/workflows/build-macos.yml
@@ -20,8 +20,17 @@ on:
 
 jobs:
   build:
-    name: Build universal binary
-    runs-on: macos-15
+    name: Build ${{ matrix.name }}
+    runs-on: ${{ matrix.runner }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # the universal binary needs cross-compilation, so it is built for releases only
+        include: ${{ fromJSON(github.ref_type == 'tag' && '[{"name":"universal","runner":"macos-15","archs":"arm64 x86_64"}]' || '[{"name":"arm64","runner":"macos-15","archs":"arm64"},{"name":"x86_64","runner":"macos-15-intel","archs":"x86_64"}]') }}
+
+    env:
+      ARCHS: ${{ matrix.archs }}
 
     steps:
     - name: Checkout
@@ -32,24 +41,34 @@ jobs:
 
     - name: Check binary
       run: |
-        lipo -archs i2pd | grep -w arm64
-        lipo -archs i2pd | grep -w x86_64
+        for arch in $ARCHS; do lipo -archs i2pd | grep -w $arch; done
         otool -L i2pd
         test -z "$(otool -L i2pd | grep -E '^[[:space:]]' | grep -vE '^[[:space:]]+(/usr/lib/|/System/Library/)')"
         vtool -show-build i2pd | grep -E 'architecture|minos|sdk'
-        test "$(vtool -show-build i2pd | grep -c 'minos 12\.0$')" = 2
+        set -- $ARCHS
+        test "$(vtool -show-build i2pd | grep -c 'minos 12\.0$')" = $#
         ./i2pd --version
         ./i2pd --version | grep -E '^OpenSSL (3\.([5-9]|[1-9][0-9])|[4-9])\.'
         ./i2pd --version | grep -E '^Boost version 1\.(8[1-9]|9[0-9])\.'
 
+    - name: Run
+      run: |
+        mkdir datadir
+        ./i2pd --datadir=datadir --log=file --logfile=datadir/i2pd.log --loglevel=info &
+        sleep 15
+        kill -0 $!
+        grep 'Daemon: Starting NetDB' datadir/i2pd.log
+        kill -9 $!
+
     - name: Upload artifacts
       uses: actions/upload-artifact@v4
       with:
-        name: i2pd-macos
+        name: i2pd-macos-${{ matrix.name }}
         path: i2pd
 
   test:
-    name: Run on ${{ matrix.target-name }}
+    name: Run universal binary on ${{ matrix.target-name }}
+    if: github.ref_type == 'tag'
     needs: build
     runs-on: ${{ matrix.target }}
 
@@ -66,7 +85,7 @@ jobs:
     - name: Download binary
       uses: actions/download-artifact@v4
       with:
-        name: i2pd-macos
+        name: i2pd-macos-universal
 
     - name: Run
       run: |
diff --git a/.github/workflows/build-static.yml b/.github/workflows/build-static.yml
index 8e8bd8a4..efd83347 100644
--- a/.github/workflows/build-static.yml
+++ b/.github/workflows/build-static.yml
@@ -22,41 +22,27 @@ on:
 jobs:
   build:
     name: musl ${{ matrix.arch }}
-    runs-on: ${{ matrix.runner }}
+    runs-on: ${{ matrix.arch == 'aarch64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
 
     strategy:
       fail-fast: false
       matrix:
-        include:
-        - arch: x86_64
-          runner: ubuntu-latest
-          platform: linux/amd64
-        - arch: aarch64
-          runner: ubuntu-24.04-arm
-          platform: linux/arm64
-        - arch: armhf
-          runner: ubuntu-latest
-          platform: linux/arm/v6
-          qemu: true
-        - arch: x86
-          runner: ubuntu-latest
-          platform: linux/386
-          setarch: linux32
-        - arch: s390x
-          runner: ubuntu-latest
-          platform: linux/s390x
-          qemu: true
+        # armhf and s390x run under QEMU, so they are built for releases only
+        arch: ${{ fromJSON(github.ref_type == 'tag' && '["x86_64", "aarch64", "x86", "armhf", "s390x"]' || '["x86_64", "aarch64", "x86"]') }}
+
+    env:
+      PLATFORM: ${{ fromJSON('{"x86_64":"linux/amd64","aarch64":"linux/arm64","x86":"linux/386","armhf":"linux/arm/v6","s390x":"linux/s390x"}')[matrix.arch] }}
 
     steps:
     - name: Checkout
       uses: actions/checkout@v4
 
     - name: Set up QEMU
-      if: ${{ matrix.qemu }}
+      if: ${{ matrix.arch == 'armhf' || matrix.arch == 's390x' }}
       uses: docker/setup-qemu-action@v3
 
     - name: Build in Alpine
-      run: docker run --rm --platform ${{ matrix.platform }} -v "$PWD":/src -w /src alpine:3.22 ${{ matrix.setarch }} sh contrib/static/build-musl.sh
+      run: docker run --rm --platform $PLATFORM -v "$PWD":/src -w /src alpine:3.22 ${{ matrix.arch == 'x86' && 'linux32' || '' }} sh contrib/static/build-musl.sh
 
     - name: Check binary
       run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 921864b1..be6e4a50 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -80,8 +80,8 @@ jobs:
           zip -qr9 release/i2pd_${TAG}_${build#*:}_mingw.zip i2pd.exe README.txt \
             contrib/i2pd.conf contrib/tunnels.conf contrib/certificates contrib/tunnels.d contrib/webconsole
         done
-        chmod +x artifacts/i2pd-macos/i2pd
-        tar -czf release/i2pd_${TAG}_osx.tar.gz -C artifacts/i2pd-macos i2pd
+        chmod +x artifacts/i2pd-macos-universal/i2pd
+        tar -czf release/i2pd_${TAG}_osx.tar.gz -C artifacts/i2pd-macos-universal i2pd
         for dir in artifacts/i2pd-freebsd-*; do
           chmod +x $dir/i2pd
           rel=${dir##*-}
diff --git a/contrib/static/build-macos.sh b/contrib/static/build-macos.sh
index f07fe6ee..c2cf5dd4 100755
--- a/contrib/static/build-macos.sh
+++ b/contrib/static/build-macos.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
-# Universal i2pd for macOS with OpenSSL, Boost and miniupnpc built from source and linked statically
+# i2pd for macOS, universal unless ARCHS is set, with OpenSSL, Boost and miniupnpc built from source and linked statically
 set -e
 
 OPENSSL_VERSION=3.5.8
@@ -7,7 +7,7 @@ BOOST_VERSION=1.92.0
 BOOST_SHA256=ea7b982002cc9dfbe59b0b217b206f470dc75f3de0bb2973d844118934d82411
 MINIUPNPC_VERSION=2.3.3
 MINIUPNPC_SHA256=d52a0afa614ad6c088cc9ddff1ae7d29c8c595ac5fdd321170a05f41e634bd1a
-ARCHS="arm64 x86_64"
+ARCHS=${ARCHS:-"arm64 x86_64"}
 JOBS=4
 export MACOSX_DEPLOYMENT_TARGET=12.0
 
@@ -63,5 +63,10 @@ for ARCH in $ARCHS; do
 done
 
 cd "$SRC"
-lipo -create -output i2pd i2pd-arm64 i2pd-x86_64
-rm i2pd-arm64 i2pd-x86_64
+set -- $ARCHS
+if [ $# -eq 1 ]; then
+	mv i2pd-$1 i2pd
+else
+	lipo -create -output i2pd $(printf 'i2pd-%s ' "$@")
+	for ARCH in "$@"; do rm i2pd-$ARCH; done
+fi
diff --git a/contrib/static/package.sh b/contrib/static/package.sh
index a3992770..4ad7d06d 100755
--- a/contrib/static/package.sh
+++ b/contrib/static/package.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
-# Packages static binaries from BIN/i2pd-static-<arch>/i2pd, run inside debian (deb) or rocky/fedora (rpm)
+# Packages the static binaries present in BIN/i2pd-static-<arch>/i2pd, run inside debian (deb) or rocky/fedora (rpm)
 # usage: package.sh deb|rpm BIN OUT, with VERSION (deb), RPM_VERSION and RPM_RELEASE in the environment
 set -e
 
@@ -30,6 +30,7 @@ if [ "$FORMAT" = deb ]; then
 		"$VERSION" "$(sed -n 's/^Maintainer: //p' $PKG/debian/control)" "$(date -R)" > $PKG/debian/changelog
 	for a in $ARCHS; do
 		alpine=${a%%:*}; rest=${a#*:}; deb=${rest%%:*}
+		[ -f "$BIN/i2pd-static-$alpine/i2pd" ] || continue
 		install -m 755 "$BIN/i2pd-static-$alpine/i2pd" $PKG/bin/i2pd-$deb
 		(cd $PKG && dpkg-buildpackage -b -us -uc -a$deb -d)
 		mv $WORK/i2pd_$VERSION-1_$deb.deb "$OUT/i2pd_${VERSION}_linux-all_$deb.deb"
@@ -40,6 +41,7 @@ elif [ "$FORMAT" = rpm ]; then
 	mkdir -p $WORK/sources
 	for a in $ARCHS; do
 		alpine=${a%%:*}; rpm=${a##*:}
+		[ -f "$BIN/i2pd-static-$alpine/i2pd" ] || continue
 		install -m 755 "$BIN/i2pd-static-$alpine/i2pd" $WORK/sources/i2pd-$rpm
 		rpmbuild -bb --target $rpm -D "ver $RPM_VERSION" -D "rel $RPM_RELEASE" -D "srcdir $SRC" \
 			-D "_topdir $WORK/rpmbuild" -D "_sourcedir $WORK/sources" -D "_rpmdir $WORK/rpms" "$SRC/contrib/static/i2pd.spec"

From 6c018793bb179f80154678255ba051e6ae59e320 Mon Sep 17 00:00:00 2001
From: acetone <63557806+freeacetone@users.noreply.github.com>
Date: Fri, 2 Oct 2026 15:44:04 -0400
Subject: [PATCH 12/12] publish release without draft

---
 .github/workflows/release.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index be6e4a50..b424335c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -52,7 +52,7 @@ jobs:
         path: build/setup_i2pd_v*.exe
 
   release:
-    name: Draft release
+    name: Release
     needs: [windows, macos, linux, debian, freebsd, installer]
     runs-on: ubuntu-latest
     permissions:
@@ -94,9 +94,8 @@ jobs:
         sha512sum -b * > SHA512SUMS
         ls -l
 
-    - name: Create draft release
+    - name: Publish release
       uses: softprops/action-gh-release@v2
       with:
-        draft: true
         files: release/*
         fail_on_unmatched_files: true