all: resync with master

scripts/make/build-release.sh

@@ -83,11 +83,15 @@ if [ "$sign" -eq '1' ]
 then
 	gpg_key_passphrase="${GPG_KEY_PASSPHRASE:?please set GPG_KEY_PASSPHRASE or unset SIGN}"
 	gpg_key="${GPG_KEY:?please set GPG_KEY or unset SIGN}"
+	signer_api_key="${SIGNER_API_KEY:?please set SIGNER_API_KEY or unset SIGN}"
+	deploy_script_path="${DEPLOY_SCRIPT_PATH:?please set DEPLOY_SCRIPT_PATH or unset SIGN}"
 else
 	gpg_key_passphrase=''
 	gpg_key=''
+	signer_api_key=''
+	deploy_script_path=''
 fi
-readonly gpg_key_passphrase gpg_key
+readonly gpg_key_passphrase gpg_key signer_api_key deploy_script_path
 
 # The default distribution files directory is dist.
 dist="${DIST_DIR:-dist}"
@@ -141,6 +145,7 @@ linux    mips64    -   softfloat
 linux    mips64le  -   softfloat
 linux    mipsle    -   softfloat
 linux    ppc64le   -   -
+linux    riscv64   -   -
 openbsd  amd64     -   -
 openbsd  arm64     -   -
 windows  386       -   -
@@ -148,6 +153,50 @@ windows  amd64     -   -
 windows  arm64     -   -"
 readonly platforms
 
+# Function sign signs the specified build as intended by the target operating
+# system.
+sign() {
+	# Only sign if needed.
+	if [ "$sign" -ne '1' ]
+	then
+		return
+	fi
+
+	# Get the arguments.  Here and below, use the "sign_" prefix for all
+	# variables local to function sign.
+	sign_os="$1"
+	sign_bin_path="$2"
+
+	if [ "$sign_os" != 'windows' ]
+	then
+		gpg\
+			--default-key "$gpg_key"\
+			--detach-sig\
+			--passphrase "$gpg_key_passphrase"\
+			--pinentry-mode loopback\
+			-q\
+			"$sign_bin_path"\
+			;
+
+		return
+	# TODO(e.burkov):  Enable for all releases.
+	elif [ "$channel" != 'beta' ]
+	then
+		return
+	fi
+
+	signed_bin_path="${sign_bin_path}.signed"
+
+	env\
+		INPUT_FILE="$sign_bin_path"\
+		OUTPUT_FILE="$signed_bin_path"\
+		SIGNER_API_KEY="$signer_api_key"\
+		"$deploy_script_path" sign-executable\
+		;
+
+	mv "$signed_bin_path" "$sign_bin_path"
+}
+
 # Function build builds the release for one platform.  It builds a binary and an
 # archive.
 build() {
@@ -188,17 +237,7 @@ build() {
 
 	log "$build_output"
 
-	if [ "$sign" -eq '1' ]
-	then
-		gpg\
-			--default-key "$gpg_key"\
-			--detach-sig\
-			--passphrase "$gpg_key_passphrase"\
-			--pinentry-mode loopback\
-			-q\
-			"$build_output"\
-			;
-	fi
+	sign "$os" "$build_output"
 
 	# Prepare the build directory for archiving.
 	cp ./CHANGELOG.md ./LICENSE.txt ./README.md "$build_dir"

scripts/make/go-build.sh

@@ -91,6 +91,7 @@ elif [ "${GOMIPS:-}" != '' ]
 then
 	ldflags="${ldflags} -X ${version_pkg}.gomips=${GOMIPS}"
 fi
+readonly ldflags
 
 # Allow users to limit the build's parallelism.
 parallelism="${PARALLELISM:-}"
@@ -143,7 +144,7 @@ then
 fi
 
 "$go" build\
-	--ldflags "$ldflags"\
+	--ldflags="$ldflags"\
 	"$race_flags"\
 	"$tags_flags"\
 	--trimpath\

scripts/make/go-lint.sh

@@ -3,7 +3,7 @@
 # This comment is used to simplify checking local copies of the script.  Bump
 # this number every time a significant change is made to this script.
 #
-# AdGuard-Project-Version: 5
+# AdGuard-Project-Version: 8
 
 verbose="${VERBOSE:-0}"
 readonly verbose
@@ -35,9 +35,12 @@ set -f -u
 # blocklist_imports is a simple check against unwanted packages.  The following
 # packages are banned:
 #
-#   *  Packages errors and log are replaced by our own packages in the
+#   *  Package errors is replaced by our own package in the
 #      github.com/AdguardTeam/golibs module.
 #
+#   *  Packages golang.org/x/exp/slices and golang.org/x/net/context have been
+#      moved into stdlib.
+#
 #   *  Package io/ioutil is soft-deprecated.
 #
 #   *  Package reflect is often an overkill, and for deep comparisons there are
@@ -51,10 +54,6 @@ set -f -u
 #
 #   *  Package unsafe is… unsafe.
 #
-#   *  Package golang.org/x/exp/slices has been moved into stdlib.
-#
-#   *  Package golang.org/x/net/context has been moved into stdlib.
-#
 # Currently, the only standard exception are files generated from protobuf
 # schemas, which use package reflect.  If your project needs more exceptions,
 # add and document them.
@@ -62,17 +61,17 @@ set -f -u
 # TODO(a.garipov): Add golibs/log.
 #
 # TODO(a.garipov): Add deprecated package golang.org/x/exp/maps once all
-# projects switch to Go 1.22.
+# projects switch to Go 1.23.
 blocklist_imports() {
 	git grep\
 		-e '[[:space:]]"errors"$'\
+		-e '[[:space:]]"golang.org/x/exp/slices"$'\
+		-e '[[:space:]]"golang.org/x/net/context"$'\
 		-e '[[:space:]]"io/ioutil"$'\
 		-e '[[:space:]]"log"$'\
 		-e '[[:space:]]"reflect"$'\
 		-e '[[:space:]]"sort"$'\
 		-e '[[:space:]]"unsafe"$'\
-		-e '[[:space:]]"golang.org/x/exp/slices"$'\
-		-e '[[:space:]]"golang.org/x/net/context"$'\
 		-n\
 		-- '*.go'\
 		':!*.pb.go'\
@@ -105,6 +104,7 @@ underscores() {
 			-e '_bsd.go'\
 			-e '_darwin.go'\
 			-e '_freebsd.go'\
+			-e '_generate.go'\
 			-e '_linux.go'\
 			-e '_next.go'\
 			-e '_openbsd.go'\
@@ -140,7 +140,7 @@ run_linter -e gofumpt --extra -e -l .
 
 # TODO(a.garipov): golint is deprecated, find a suitable replacement.
 
-run_linter "$GO" vet ./...
+run_linter "${GO:-go}" vet ./...
 
 run_linter govulncheck ./...
 
@@ -212,8 +212,6 @@ git ls-files -- 'Makefile' '*.conf' '*.go' '*.mod' '*.sh' '*.yaml' '*.yml'\
 	| xargs misspell --error\
 	| sed -e 's/^/misspell: /'
 
-run_linter looppointer ./...
-
 run_linter nilness ./...
 
 # TODO(a.garipov): Enable for all.
@@ -246,9 +244,9 @@ run_linter fieldalignment \
 run_linter -e shadow --strict ./...
 
 # TODO(a.garipov): Enable for all.
-run_linter gosec --quiet\
+# TODO(e.burkov):  Re-enable G115.
+run_linter gosec --exclude G115 --quiet\
 	./internal/aghalg/\
-	./internal/aghchan/\
 	./internal/aghhttp/\
 	./internal/aghnet/\
 	./internal/aghos/\

scripts/make/go-tools.sh

@@ -3,7 +3,7 @@
 # This comment is used to simplify checking local copies of the script.  Bump
 # this number every time a significant change is made to this script.
 #
-# AdGuard-Project-Version: 3
+# AdGuard-Project-Version: 4
 
 verbose="${VERBOSE:-0}"
 readonly verbose
@@ -42,7 +42,6 @@ rm -f\
 	bin/gosec\
 	bin/govulncheck\
 	bin/ineffassign\
-	bin/looppointer\
 	bin/misspell\
 	bin/nilness\
 	bin/shadow\
@@ -66,7 +65,6 @@ env\
 	github.com/golangci/misspell/cmd/misspell\
 	github.com/gordonklaus/ineffassign\
 	github.com/kisielk/errcheck\
-	github.com/kyoh86/looppointer/cmd/looppointer\
 	github.com/securego/gosec/v2/cmd/gosec\
 	github.com/uudashr/gocognit/cmd/gocognit\
 	golang.org/x/tools/go/analysis/passes/fieldalignment/cmd/fieldalignment\

scripts/make/go-upd-tools.sh

@@ -3,7 +3,7 @@
 # This comment is used to simplify checking local copies of the script.  Bump
 # this number every time a significant change is made to this script.
 #
-# AdGuard-Project-Version: 1
+# AdGuard-Project-Version: 2
 
 verbose="${VERBOSE:-0}"
 readonly verbose
@@ -29,5 +29,6 @@ go="${GO:-go}"
 readonly go
 
 cd ./internal/tools/
-"$go" get -u
+
+"$go" get -u "$x_flags"
 "$go" mod tidy

scripts/make/md-lint.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+# This comment is used to simplify checking local copies of the script.  Bump
+# this number every time a remarkable change is made to this script.
+#
+# AdGuard-Project-Version: 2
+
+verbose="${VERBOSE:-0}"
+readonly verbose
+
+set -e -f -u
+
+if [ "$verbose" -gt '0' ]
+then
+	set -x
+fi
+
+# NOTE: Adjust for your project.
+# markdownlint\
+# 	./README.md\
+# 	;
+
+# TODO(e.burkov):  Lint markdown documents within this project.

scripts/make/sh-lint.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+
+# This comment is used to simplify checking local copies of the script.  Bump
+# this number every time a remarkable change is made to this script.
+#
+# AdGuard-Project-Version: 2
+
+verbose="${VERBOSE:-0}"
+readonly verbose
+
+# Don't use -f, because we use globs in this script.
+set -e -u
+
+if [ "$verbose" -gt '0' ]
+then
+	set -x
+fi
+
+# NOTE: Adjust for your project.
+#
+# TODO(e.burkov):  Add build-docker.sh, build-release.sh and install.sh.
+shellcheck -e 'SC2250' -f 'gcc' -o 'all' -x --\
+	./scripts/hooks/*\
+	./scripts/snap/*\
+	./scripts/make/clean.sh\
+	./scripts/make/go-bench.sh\
+	./scripts/make/go-build.sh\
+	./scripts/make/go-deps.sh\
+	./scripts/make/go-fuzz.sh\
+	./scripts/make/go-lint.sh\
+	./scripts/make/go-test.sh\
+	./scripts/make/go-tools.sh\
+	./scripts/make/go-upd-tools.sh\
+	./scripts/make/helper.sh\
+	./scripts/make/md-lint.sh\
+	./scripts/make/sh-lint.sh\
+	./scripts/make/txt-lint.sh\
+	./scripts/make/version.sh\
+	;