# Make targets:

#

# all : builds all binaries in development mode

# full : builds all binaries for PRODUCTION use

# release: prepares a release tarball

# clean : removes all build artifacts

# test : runs tests

.DEFAULT_GOAL := all

# To update the Teleport version, update VERSION variable:

# Naming convention:

# Stable releases: "1.0.0"

# Pre-releases: "1.0.0-alpha.1", "1.0.0-beta.2", "1.0.0-rc.3"

# Master/dev branch: "1.0.0-dev"

VERSION=19.0.0-prealpha.2

DOCKER_IMAGE ?= teleport

# This directory will be the real path of the directory of the first Makefile in the list.

MAKE_DIR := $(dir $(realpath $(firstword $(MAKEFILE_LIST))))

# If set to 1, webassets are not built.

WEBASSETS_SKIP_BUILD ?= 0

# These are standard autotools variables, don't change them please

ifneq ("$(wildcard /bin/bash)","")

SHELL := /bin/bash -o pipefail

endif

BUILDDIR ?= build

BINDIR ?= /usr/local/bin

DATADIR ?= /usr/local/share/teleport

ADDFLAGS ?=

PWD ?= $(shell pwd)

TELEPORT_DEBUG ?= false

GITTAG=v$(VERSION)

CGOFLAG ?= CGO_ENABLED=1

KUSTOMIZE_NO_DYNAMIC_PLUGIN ?= kustomize_disable_go_plugin_support

KUBECTL_VERSION := $(shell go list -m -f '{{.Version}}' k8s.io/kubectl | sed 's/v0/v1/')

KUBECTL_SETVERSION := -X k8s.io/component-base/version.gitVersion=$(KUBECTL_VERSION)

# RELEASE_DIR is where the release artifacts (tarballs, pacakges, etc) are put. It

# should be an absolute directory as it is used by e/Makefile too, from the e/ directory.

RELEASE_DIR := $(CURDIR)/$(BUILDDIR)/artifacts

GO_LDFLAGS ?= -w -s $(KUBECTL_SETVERSION)

# Appending new conditional settings for community build type

# When TELEPORT_DEBUG is true, set flags to produce

# debugger-friendly builds.

ifeq ("$(TELEPORT_DEBUG)","true")

BUILDFLAGS ?= $(ADDFLAGS) -gcflags=all="-N -l" -buildvcs=false

BUILDFLAGS_TBOT ?= $(ADDFLAGS) -gcflags=all="-N -l" -buildvcs=false

BUILDFLAGS_TELEPORT_UPDATE ?= $(ADDFLAGS) -gcflags=all="-N -l" -buildvcs=false

else

BUILDFLAGS ?= $(ADDFLAGS) -ldflags '$(GO_LDFLAGS)' -trimpath -buildvcs=false

BUILDFLAGS_TBOT ?= $(ADDFLAGS) -ldflags '$(GO_LDFLAGS)' -trimpath -buildvcs=false

BUILDFLAGS_TELEPORT_UPDATE ?= $(ADDFLAGS) -ldflags '$(GO_LDFLAGS)' -trimpath -buildvcs=false

endif

GO_ENV_OS := $(shell go env GOOS)

OS ?= $(GO_ENV_OS)

GO_ENV_ARCH := $(shell go env GOARCH)

ARCH ?= $(GO_ENV_ARCH)

FIPS ?=

RELEASE = teleport-$(GITTAG)-$(OS)-$(ARCH)-bin

RELEASE_TOOLS = teleport-tools-$(GITTAG)-$(OS)-$(ARCH)-bin

RELEASE_UPDATE = teleport-update-$(GITTAG)-$(OS)-$(ARCH)-bin

# If we're building inside the cross-compiling buildbox, include the

# cross compilation definitions so we select the correct compilers and

# libraries.

ifeq ($(BUILDBOX_MODE),cross)

include build.assets/buildbox/cross-compile.mk

endif

# Include common makefile shared between OSS and Ent.

include common.mk

# FIPS support must be requested at build time.

FIPS_MESSAGE := without-FIPS-support

ifneq ("$(FIPS)","")

FIPS_TAG := fips

FIPS_MESSAGE := with-FIPS-support

RELEASE = teleport-$(GITTAG)-$(OS)-$(ARCH)-fips-bin

GOEXPERIMENT = boringcrypto

export GOEXPERIMENT

ifeq ($(BUILDBOX_MODE),cross)

# We need to set CGO_ENABLED=0 when building rdpclient as the build of

# boring-sys builds and runs a Go program as part of its integrity testing.

# (https://github.com/google/boringssl/blob/master/crypto/fipsmodule/FIPS.md#integrity-testing)

# If CGO_ENABLED=1, this fails for odd reasons (it tries to use the cross

# assembler to build ASM for the host).

# It also needs to know the cross-compiler sysroot to properly cross-compile.

RDPCLIENT_ENV = CGO_ENABLED=0 BORING_BSSL_FIPS_SYSROOT=$(CROSSTOOLNG_SYSROOT)

endif

endif

# Look for the PAM header "security/pam_appl.h" to determine if we should

# enable PAM support in teleport. A native build will have it in /usr/include.

# Darwin has it in /usr/local/include (SIP prevents us from modifying/creating

# it in /usr/include), and the ng buildbox has it in one of the

# $(C_INCLUDE_PATH) paths.

PAM_HEADER_CANDIDATES := $(subst :, ,$(C_INCLUDE_PATH)) /usr/local/include /usr/include

PAM_MESSAGE := without-PAM-support

ifneq (,$(wildcard $(addsuffix /security/pam_appl.h,$(PAM_HEADER_CANDIDATES))))

PAM_TAG := pam

PAM_MESSAGE := with-PAM-support

endif

# darwin universal (Intel + Apple Silicon combined) binary support

RELEASE_darwin_arm64 = $(RELEASE_DIR)/teleport-$(GITTAG)-darwin-arm64-bin.tar.gz

RELEASE_darwin_amd64 = $(RELEASE_DIR)/teleport-$(GITTAG)-darwin-amd64-bin.tar.gz

BUILDDIR_arm64 = $(BUILDDIR)/arm64

BUILDDIR_amd64 = $(BUILDDIR)/amd64

# TARBINS is the path of the binaries in the release tarballs

TARBINS = $(addprefix teleport/,$(BINS))

# Check if rust and cargo are installed before compiling

CHECK_CARGO := $(shell cargo --version 2>/dev/null)

CHECK_RUST := $(shell rustc --version 2>/dev/null)

RUST_TARGET_ARCH ?= $(CARGO_TARGET_$(OS)_$(ARCH))

CARGO_TARGET_darwin_amd64 := x86_64-apple-darwin

CARGO_TARGET_darwin_arm64 := aarch64-apple-darwin

CARGO_TARGET_linux_arm := arm-unknown-linux-gnueabihf

CARGO_TARGET_linux_arm64 := aarch64-unknown-linux-gnu

CARGO_TARGET_linux_386 := i686-unknown-linux-gnu

CARGO_TARGET_linux_amd64 := x86_64-unknown-linux-gnu

CARGO_TARGET_windows_amd64 := x86_64-pc-windows-gnu

CARGO_TARGET := --target=$(RUST_TARGET_ARCH)

CARGO_WASM_TARGET := wasm32-unknown-unknown

# If set to 1, then we don't build the desktop access RDP client

# or the RDP decoder for tsh.

RDPCLIENT_SKIP_BUILD ?= 0

# Enable Rust RDP support?

with_rdpclient := no

RDPCLIENT_MESSAGE := without-Windows-RDP-client

ifeq ($(RDPCLIENT_SKIP_BUILD),0)

ifneq ($(CHECK_RUST),)

ifneq ($(CHECK_CARGO),)

is_fips_on_arm64 := no

ifneq ("$(FIPS)","")

ifeq ("$(ARCH)","arm64")

is_fips_on_arm64 := yes

endif

endif

# Do not build RDP client on 32-bit ARM or 386, or for FIPS builds on arm64.

ifneq ("$(ARCH)","arm")

ifneq ("$(ARCH)","386")

ifneq ("$(is_fips_on_arm64)","yes")

with_rdpclient := yes

RDPCLIENT_MESSAGE := with-Windows-RDP-client

RDPCLIENT_TAG := desktop_access_rdp

TSH_RDP_DECODER_TAG := rust_rdp_decoder

endif

endif

endif

endif

endif

endif

# Set C_ARCH for building libfido2 and dependencies. ARCH is the Go

# architecture which uses different names for architectures than C

# uses. Export it for the build.assets/build-fido2-macos.sh script.

C_ARCH_amd64 = x86_64

C_ARCH = $(or $(C_ARCH_$(ARCH)),$(ARCH))

export C_ARCH

# Enable libfido2 for testing?

# Eagerly enable if we detect the package, we want to test as much as possible.

ifeq ("$(shell pkg-config libfido2 2>/dev/null; echo $$?)", "0")

LIBFIDO2_TEST_TAG := libfido2

ifeq ($(FIDO2),)

FIDO2 ?= dynamic

endif

endif

# Build tsh against libfido2?

# FIDO2=yes and FIDO2=static enable static libfido2 builds.

# FIDO2=dynamic enables dynamic libfido2 builds.

LIBFIDO2_MESSAGE := without-libfido2

ifneq (, $(filter $(FIDO2), yes static))

LIBFIDO2_MESSAGE := with-libfido2

LIBFIDO2_BUILD_TAG := libfido2 libfido2static

else ifeq ("$(FIDO2)", "dynamic")

LIBFIDO2_MESSAGE := with-libfido2

LIBFIDO2_BUILD_TAG := libfido2

endif

# Enable Touch ID builds?

# Only build if TOUCHID=yes to avoid issues when cross-compiling to 'darwin'

# from other systems.

TOUCHID_MESSAGE := without-Touch-ID

ifeq ("$(TOUCHID)", "yes")

TOUCHID_MESSAGE := with-Touch-ID

TOUCHID_TAG := touchid

endif

# Enable VNet daemon?

# With VNETDAEMON=yes, tsh uses a Launch Daemon to start VNet.

# This requires a signed and bundled tsh.

VNETDAEMON_MESSAGE := without-VNet-daemon

ifeq ("$(VNETDAEMON)", "yes")

VNETDAEMON_MESSAGE := with-VNet-daemon

VNETDAEMON_TAG := vnetdaemon

endif

# Enable PIV test packages for testing.

# This test tag should never be used for builds/releases, only tests.

PIV_TEST_TAG := pivtest

# enable PIV package for linting.

PIV_LINT_TAG := piv

# Build teleport/api with PIV? This requires the libpcsclite library for linux.

#

# PIV=yes and PIV=static enable static piv builds. This is used by the build

# process to link a static library of libpcsclite for piv-go to connect to.

#

# PIV=dynamic enables dynamic piv builds. This can be used for local

# builds and runs utilizing a dynamic libpcsclite library - `apt get install libpcsclite-dev`

PIV_MESSAGE := without-PIV-support

ifneq (, $(filter $(PIV), yes static dynamic))

PIV_MESSAGE := with-PIV-support

PIV_BUILD_TAG := piv

ifneq ("$(PIV)", "dynamic")

# Link static pcsc libary. By default, piv-go will look for the dynamic library.

# https://github.com/go-piv/piv-go/blob/master/piv/pcsc_unix.go#L23

STATIC_LIBS += -lpcsclite

STATIC_LIBS_TSH += -lpcsclite

endif

endif

SESSIONHELPER_EMBED_TAG :=

SESSIONHELPER_MESSAGE := without-session-helper

ifeq ($(OS),linux)

SESSIONHELPER_EMBED_TAG = sessionhelper_embed

SESSIONHELPER_MESSAGE := with-session-helper

endif

# Reproducible builds are only available on select targets, and only when OS=linux.

REPRODUCIBLE ?=

ifneq ("$(OS)","linux")

REPRODUCIBLE = no

endif

# On Windows only build tsh. On all other platforms build teleport, tctl,

# and tsh.

BINS_default = teleport tctl tsh tbot fdpass-teleport teleport-update

BINS_darwin = teleport tctl tsh tbot fdpass-teleport

BINS_windows = tsh tctl

BINS = $(or $(BINS_$(OS)),$(BINS_default))

BINARIES = $(addprefix $(BUILDDIR)/,$(BINS))

UPDATE_BINARIES = $(addprefix $(BUILDDIR)/,teleport-update)

# Joins elements of the list in arg 2 with the given separator.

# 1. Element separator.

# 2. The list.

EMPTY :=

SPACE := $(EMPTY) $(EMPTY)

join-with = $(subst $(SPACE),$1,$(strip $2))

# Separate TAG messages into comma-separated WITH and WITHOUT lists for readability.

COMMA := ,

MESSAGES := $(PAM_MESSAGE) $(FIPS_MESSAGE) $(BPF_MESSAGE) $(RDPCLIENT_MESSAGE) $(LIBFIDO2_MESSAGE) $(TOUCHID_MESSAGE) $(PIV_MESSAGE) $(VNETDAEMON_MESSAGE) $(SESSIONHELPER_MESSAGE)

WITH := $(subst -," ",$(call join-with,$(COMMA) ,$(subst with-,,$(filter with-%,$(MESSAGES)))))

WITHOUT := $(subst -," ",$(call join-with,$(COMMA) ,$(subst without-,,$(filter without-%,$(MESSAGES)))))

RELEASE_MESSAGE := "Building with GOOS=$(OS) GOARCH=$(ARCH) REPRODUCIBLE=$(REPRODUCIBLE) and with $(WITH) and without $(WITHOUT)."

# On platforms that support reproducible builds, ensure the archive is created in a reproducible manner.

TAR_FLAGS ?=

ifeq ("$(REPRODUCIBLE)","yes")

TAR_FLAGS = --sort=name --owner=root:0 --group=root:0 --mtime='UTC 2015-03-02' --format=gnu

endif

VERSRC = gitref.go api/version.go

KUBECONFIG ?=

TEST_KUBE ?=

export

# This unexport statement is required for make to work with the `-e` flag.

# With -e, the first Makefile sets HELMJANITOR=$$(go tool ...),

# passes HELMJANITOR=$(go tool) to the child make process.

# Because of the `-e` flag it takes precedence over the child's make definition

# of HELMJANITOR and breaks environment variable expansion.

# To avoid breaking other parts of the release pipeline, the easiest fix is to

# unexport HELMJANITOR so the child uses the definition from its Makefile.

unexport HELMJANITOR

export KUBECONFIG

export TEST_KUBE

TEST_LOG_DIR ?= ${abspath ./test-logs}

# Set CGOFLAG and BUILDFLAGS as needed for the OS/ARCH.

ifeq ("$(OS)","linux")

ifeq ("$(ARCH)","arm64")

ifneq ($(BUILDBOX_MODE),cross)

ifeq (,$(IS_NATIVE_BUILD))

CGOFLAG += CC=aarch64-linux-gnu-gcc

endif

endif

else ifeq ("$(ARCH)","arm")

CGOFLAG = CGO_ENABLED=1

# ARM builds need to specify the correct C compiler

ifneq ($(BUILDBOX_MODE),cross)

ifeq (,$(IS_NATIVE_BUILD))

CC=arm-linux-gnueabihf-gcc

endif

endif

# Add -debugtramp=2 to work around 24 bit CALL/JMP instruction offset.

# Add "-extldflags -Wl,--long-plt" to avoid ld assertion failure on large binaries

GO_LDFLAGS += -extldflags=-Wl,--long-plt -debugtramp=2

endif

endif # OS == linux

ifeq ("$(OS)-$(ARCH)","darwin-arm64")

# Temporary link flags due to changes in Apple's linker

# https://github.com/golang/go/issues/67854

GO_LDFLAGS += -extldflags=-ld_classic

endif

# Windows requires extra parameters to cross-compile with CGO.

ifeq ("$(OS)","windows")

ARCH ?= amd64

ifneq ("$(ARCH)","amd64")

$(error "Building for windows requires ARCH=amd64")

endif

CGOFLAG = CGO_ENABLED=1 CC=x86_64-w64-mingw32-gcc CXX=x86_64-w64-mingw32-g++

BUILDFLAGS = $(ADDFLAGS) -ldflags '-w -s $(KUBECTL_SETVERSION)' -trimpath -buildvcs=false

BUILDFLAGS_TBOT = $(ADDFLAGS) -ldflags '-w -s $(KUBECTL_SETVERSION)' -trimpath -buildvcs=false

BUILDFLAGS_TELEPORT_UPDATE = $(ADDFLAGS) -ldflags '-w -s $(KUBECTL_SETVERSION)' -trimpath -buildvcs=false

endif

ifeq ("$(OS)","darwin")

# Set the minimum version for macOS builds for Go, Rust and Xcode builds.

# (as of Go 1.25 we require macOS 12)

MINIMUM_SUPPORTED_MACOS_VERSION = 12.0

MACOSX_VERSION_MIN_FLAG = -mmacosx-version-min=$(MINIMUM_SUPPORTED_MACOS_VERSION)

# Go

CGOFLAG = CGO_ENABLED=1 CGO_CFLAGS=$(MACOSX_VERSION_MIN_FLAG)

# Xcode and rust and Go linking

MACOSX_DEPLOYMENT_TARGET = $(MINIMUM_SUPPORTED_MACOS_VERSION)

export MACOSX_DEPLOYMENT_TARGET

endif

CGOFLAG_TSH ?= $(CGOFLAG)

# Map ARCH into the architecture flag for electron-builder if they

# are different to the Go $(ARCH) we use as an input.

ELECTRON_BUILDER_ARCH_amd64 = x64

ELECTRON_BUILDER_ARCH = $(or $(ELECTRON_BUILDER_ARCH_$(ARCH)),$(ARCH))

#

# 'make all' builds all 4 executables and places them in the current directory.

#

# NOTE: Works the same as `make`. Left for legacy reasons.

.PHONY: all

all: version

@echo "---> Building OSS binaries."

$(MAKE) $(BINARIES)

#

# make binaries builds all binaries defined in the BINARIES environment variable

#

.PHONY: binaries

binaries: $(BINARIES)

# Appending new conditional settings for community build type for tools.

ifeq ("$(GITHUB_REPOSITORY_OWNER)","gravitational")

# TELEPORT_LDFLAGS and TOOLS_LDFLAGS if appended will overwrite the previous LDFLAGS set in the BUILDFLAGS.

# This is done here to prevent any changes to the (BUI)LDFLAGS passed to the other binaries

TELEPORT_LDFLAGS ?= -ldflags '$(GO_LDFLAGS) -X github.com/gravitational/teleport/lib/modules.teleportBuildType=community'

TOOLS_LDFLAGS ?= -ldflags '$(GO_LDFLAGS) $(KUBECTL_SETVERSION) -X github.com/gravitational/teleport/lib/modules.teleportBuildType=community'

endif

# By making these 3 targets below (tsh, tctl and teleport) PHONY we are solving

# several problems:

# * Build will rely on go build internal caching https://golang.org/doc/go1.10 at all times

# * Manual change detection was broken on a large dependency tree

# If you are considering changing this behavior, please consult with dev team first

#

# NOTE: Any changes to the `tctl` build here must be copied to `build.assets/windows/build.ps1`

# until we can use this Makefile for native Windows builds.

.PHONY: $(BUILDDIR)/tctl

$(BUILDDIR)/tctl:

@if [[ "$(OS)" != "windows" && -z "$(LIBFIDO2_BUILD_TAG)" ]]; then \

echo 'Warning: Building tctl without libfido2. Install libfido2 to have access to MFA.' >&2; \

fi

GOOS=$(OS) GOARCH=$(ARCH) $(CGOFLAG) go build -tags "grpcnotrace $(PAM_TAG) $(FIPS_TAG) $(LIBFIDO2_BUILD_TAG) $(TOUCHID_TAG) $(PIV_BUILD_TAG) $(KUSTOMIZE_NO_DYNAMIC_PLUGIN)" -o $(BUILDDIR)/tctl $(BUILDFLAGS) $(TOOLS_LDFLAGS) ./tool/tctl

.PHONY: $(BUILDDIR)/teleport

$(BUILDDIR)/teleport: ensure-webassets rdpclient session/reexec/embed/sessionhelper

GOOS=$(OS) GOARCH=$(ARCH) $(CGOFLAG) go build -tags "grpcnotrace webassets_embed $(PAM_TAG) $(FIPS_TAG) $(BPF_TAG) $(SESSIONHELPER_EMBED_TAG) $(WEBASSETS_TAG) $(RDPCLIENT_TAG) $(PIV_BUILD_TAG) $(KUSTOMIZE_NO_DYNAMIC_PLUGIN)" -o $(BUILDDIR)/teleport $(BUILDFLAGS) $(TELEPORT_LDFLAGS) ./tool/teleport

.PHONY: $(BUILDDIR)/sessionhelper

$(BUILDDIR)/sessionhelper:

ifneq ($(SESSIONHELPER_EMBED_TAG),)

GOOS=$(OS) GOARCH=$(ARCH) $(CGOFLAG) go -C session build -buildvcs=false -tags "$(PAM_TAG) $(FIPS_TAG) $(BPF_TAG) gravitational_trace.nocrypto" -o '$(abspath $(BUILDDIR)/sessionhelper)' $(BUILDFLAGS) ./cmd/sessionhelper

endif

.PHONY: session/reexec/embed/sessionhelper

session/reexec/embed/sessionhelper: $(BUILDDIR)/sessionhelper

ifneq ($(SESSIONHELPER_EMBED_TAG),)

mkdir -p session/reexec/embed

gzip -9 -n < '$(BUILDDIR)/sessionhelper' > 'session/reexec/embed/sessionhelper_$(OS)_$(ARCH).gz'

endif

# NOTE: Any changes to the `tsh` build here must be copied to `build.assets/windows/build.ps1`

# until we can use this Makefile for native Windows builds.

.PHONY: $(BUILDDIR)/tsh

$(BUILDDIR)/tsh: rdpdecoder

@if [[ "$(OS)" != "windows" && -z "$(LIBFIDO2_BUILD_TAG)" ]]; then \

echo 'Warning: Building tsh without libfido2. Install libfido2 to have access to MFA.' >&2; \

fi

GOOS=$(OS) GOARCH=$(ARCH) $(CGOFLAG_TSH) go build -tags "grpcnotrace $(FIPS_TAG) $(LIBFIDO2_BUILD_TAG) $(TOUCHID_TAG) $(PIV_BUILD_TAG) $(VNETDAEMON_TAG) $(TSH_RDP_DECODER_TAG) $(KUSTOMIZE_NO_DYNAMIC_PLUGIN)" -o $(BUILDDIR)/tsh $(BUILDFLAGS) $(TOOLS_LDFLAGS) ./tool/tsh

.PHONY: $(BUILDDIR)/tbot

# tbot is CGO-less by default except on Windows because lib/client/terminal/ wants CGO on this OS

# We force cgo to be disabled, else the compiler might decide to enable it.

$(BUILDDIR)/tbot: TBOT_CGO_FLAGS ?= $(if $(filter windows,$(OS)),$(CGOFLAG),CGO_ENABLED=0)

$(BUILDDIR)/tbot:

GOOS=$(OS) GOARCH=$(ARCH) $(TBOT_CGO_FLAGS) go build -tags "grpcnotrace $(FIPS_TAG) $(KUSTOMIZE_NO_DYNAMIC_PLUGIN)" -o $(BUILDDIR)/tbot $(BUILDFLAGS_TBOT) $(TOOLS_LDFLAGS) ./tool/tbot

.PHONY: $(BUILDDIR)/teleport-update

$(BUILDDIR)/teleport-update:

GOOS=$(OS) GOARCH=$(ARCH) CGO_ENABLED=0 go build -tags "grpcnotrace" -o $(BUILDDIR)/teleport-update $(BUILDFLAGS_TELEPORT_UPDATE) $(TOOLS_LDFLAGS) ./tool/teleport-update

TELEPORT_ARGS ?= start

.PHONY: teleport-hot-reload

teleport-hot-reload:

CompileDaemon \

--graceful-kill=true \

--exclude-dir=".git" \

--exclude-dir="build" \

--exclude-dir="e/build" \

--exclude-dir="e/web/*/node_modules" \

--exclude-dir="node_modules" \

--exclude-dir="target" \

--exclude-dir="web/packages/*/node_modules" \

--color \

--log-prefix=false \

--build="make $(BUILDDIR)/teleport" \

--command="$(BUILDDIR)/teleport $(TELEPORT_ARGS)"

.PHONY: $(BUILDDIR)/fdpass-teleport

$(BUILDDIR)/fdpass-teleport:

cd tool/fdpass-teleport && cargo build --release --locked $(CARGO_TARGET)

install tool/fdpass-teleport/target/$(RUST_TARGET_ARCH)/release/fdpass-teleport $(BUILDDIR)/

.PHONY: tsh-app

tsh-app: TSH_APP_BUNDLE = $(BUILDDIR)/tsh.app

tsh-app: TSH_APP_ENTITLEMENTS = build.assets/macos/$(TSH_SKELETON)/$(TSH_SKELETON).entitlements

tsh-app:

cp -rf "build.assets/macos/$(TSH_SKELETON)/tsh.app/" "$(TSH_APP_BUNDLE)/"

mkdir -p "$(TSH_APP_BUNDLE)/Contents/MacOS/"

cp "$(BUILDDIR)/tsh" "$(TSH_APP_BUNDLE)/Contents/MacOS/."

$(NOTARIZE_TSH_APP)

.PHONY: tctl-app

tctl-app: TCTL_APP_BUNDLE = $(BUILDDIR)/tctl.app

tctl-app: TCTL_APP_ENTITLEMENTS = build.assets/macos/$(TCTL_SKELETON)/$(TCTL_SKELETON).entitlements

tctl-app:

cp -rf "build.assets/macos/$(TCTL_SKELETON)/tctl.app/" "$(TCTL_APP_BUNDLE)/"

mkdir -p "$(TCTL_APP_BUNDLE)/Contents/MacOS/"

cp "$(BUILDDIR)/tctl" "$(TCTL_APP_BUNDLE)/Contents/MacOS/."

$(NOTARIZE_TCTL_APP)

# BPF tests will not work in a docker container and so should not be

# run in CI for now.

.PHONY: test-bpf

test-bpf:

mkdir -p _test

gcc ./lib/srv/testdata/bpf_rodata_args.c -o _test/bpf_rodata_args

go test -c -tags bpf,pam -o _test/libsrv.test ./lib/srv

# ignore non bpf-related tests

sudo TELEPORT_BPF_TEST=1 _test/libsrv.test -test.run=TestBPF

# BPF support (IF ENABLED)

# Requires clang 14+

#

# Enable target only if /usr/include/linux/bpf.h exists and clang is installed.

# This is a requirement for building BPF bytecode.

.PHONY: bpf-bytecode

bpf-bytecode:

@if [ ! -f /usr/include/linux/bpf.h -o ! -f /usr/include/bpf/bpf_helpers.h ]; then \

echo "libbpf-dev is required to build BPF bytecode"; \

exit 1; \

fi

@if ! command clang --version >/dev/null 2>&1; then \

echo "clang is required to build BPF bytecode"; \

exit 1; \

fi

go generate ./lib/bpf/

# bpf-up-to-date checks if the generated BPF bytecode is up to date.

.PHONY: bpf-up-to-date

bpf-up-to-date: must-start-clean/host bpf-bytecode

@if ! git diff --quiet; then \

./build.assets/please-run.sh "bpf bytecode" "make -C build.assets bpf-bytecode"; \

exit 1; \

fi

# Generate vmlinux.h based on the installed kernel

.PHONY: update-vmlinux-h

update-vmlinux-h:

bpftool btf dump file /sys/kernel/btf/vmlinux format c >bpf/vmlinux.h

RDPCLIENT_SKIP_CARGO ?= 0

.PHONY: rdpclient

rdpclient: rustup-toolchain-warning

ifeq ("$(with_rdpclient)", "yes")

ifneq ($(RDPCLIENT_SKIP_CARGO),1)

$(RDPCLIENT_ENV) \

cargo build -p rdp-client $(if $(FIPS),--features=fips) --release --locked $(CARGO_TARGET)

else

@echo "Skipping rdp-client cargo build (RDPCLIENT_SKIP_CARGO=1)"

endif

endif

.PHONY: rdpdecoder

rdpdecoder: rustup-toolchain-warning

ifeq ("$(with_rdpclient)", "yes")

$(RDPCLIENT_ENV) \

cargo build -p rdp-decoder --release --locked $(CARGO_TARGET)

endif

define ironrdp_package_json

{

"name": "ironrdp",

"version": "0.1.0",

"module": "ironrdp.js",

"types": "ironrdp.d.ts",

"files": ["ironrdp_bg.wasm","ironrdp.js","ironrdp.d.ts"],

"sideEffects": ["./snippets/*"]

}

endef

export ironrdp_package_json

IRONRDP_SKIP_BUILD ?= 0

.PHONY: build-ironrdp-wasm

build-ironrdp-wasm: ironrdp = web/packages/shared/libs/ironrdp

ifeq ($(IRONRDP_SKIP_BUILD),1)

build-ironrdp-wasm:

@echo "Skipping ironrdp WASM build (IRONRDP_SKIP_BUILD=1)"

else

build-ironrdp-wasm: ensure-wasm-deps

RUSTFLAGS='--cfg getrandom_backend="wasm_js"' cargo build --package ironrdp --lib --target $(CARGO_WASM_TARGET) --release

wasm-opt target/$(CARGO_WASM_TARGET)/release/ironrdp.wasm -o target/$(CARGO_WASM_TARGET)/release/ironrdp.wasm -O

wasm-bindgen target/$(CARGO_WASM_TARGET)/release/ironrdp.wasm --out-dir $(ironrdp)/pkg --typescript --target web

printenv ironrdp_package_json > $(ironrdp)/pkg/package.json

endif

# Build libfido2 and dependencies for MacOS. Uses exported C_ARCH variable defined earlier.

.PHONY: build-fido2

build-fido2:

./build.assets/build-fido2-macos.sh build

.PHONY: print-fido2-pkg-path

print-fido2-pkg-path:

@./build.assets/build-fido2-macos.sh pkg_config_path

#

# make full - Builds Teleport binaries with the built-in web assets and

# places them into $(BUILDDIR). On Windows, this target is skipped because

# only tsh and tctl are built.

#

.PHONY:full

full: WEBASSETS_SKIP_BUILD = 0

full: ensure-webassets

ifneq ("$(OS)", "windows")

export WEBASSETS_SKIP_BUILD=0

$(MAKE) all

endif

#

# make full-ent - Builds Teleport enterprise binaries

#

.PHONY: full-ent

full-ent: ensure-webassets-e

ifneq ("$(OS)", "windows")

@if [ -f e/Makefile ]; then $(MAKE) -C e full; fi

endif

#

# make clean - Removes all build artifacts.

#

.PHONY: clean

clean: clean-ui clean-build

.PHONY: clean-build

clean-build:

@echo "---> Cleaning up OSS build artifacts."

rm -rf $(BUILDDIR)

rm -rf ./session/reexec/embed

-cargo clean

-go clean -cache

rm -f *.gz

rm -f *.zip

rm -f gitref.go

rm -rf build.assets/tooling/bin

# Clean up wasm build artifacts

rm -rf web/packages/shared/libs/ironrdp/pkg/

.PHONY: clean-ui

clean-ui:

rm -rf webassets/*

rm -rf build.assets/.cache/ts

rm -rf web/packages/teleterm/build

find . -type d -name node_modules -prune -exec rm -rf {} \;

.PHONY: clean-ent

clean-ent:

$(MAKE) -C e clean

# RELEASE_DIR is where release artifact files are put, such as tarballs, packages, etc.

$(RELEASE_DIR):

mkdir -p $@

#

# make release - Produces a binary release tarball.

#

.PHONY: release

release:

@echo "---> OSS $(RELEASE_MESSAGE)"

ifeq ("$(OS)", "windows")

$(MAKE) --no-print-directory release-windows

else ifeq ("$(OS)", "darwin")

$(MAKE) --no-print-directory release-darwin

else

$(MAKE) --no-print-directory release-unix

endif

.PHONY: release-ent

release-ent:

$(MAKE) -C e release

# These are aliases used to make build commands uniform.

.PHONY: release-amd64

release-amd64:

$(MAKE) release ARCH=amd64

.PHONY: release-386

release-386:

$(MAKE) release ARCH=386

.PHONY: release-arm

release-arm:

$(MAKE) release ARCH=arm

.PHONY: release-arm64

release-arm64:

$(MAKE) release ARCH=arm64

#

# make build-archive - Packages the results of a build into a release tarball

#

.PHONY: build-archive

ifeq ("$(OS)","darwin")

build-archive: INSTALL_SCRIPT=build.assets/macos/install

else

build-archive: INSTALL_SCRIPT=build.assets/install

endif

build-archive: | $(RELEASE_DIR)

@echo "---> Creating OSS release archive."

mkdir teleport

cp -rf $(BINARIES) \

examples \

"$(INSTALL_SCRIPT)" \

README.md \

CHANGELOG.md \

build.assets/LICENSE-community \

teleport/

# add SELinux install script for Linux archives

$(if $(filter linux,$(OS)), \

cp assets/install-scripts/install-selinux.sh teleport/ \

)

echo $(GITTAG) > teleport/VERSION

tar $(TAR_FLAGS) -c teleport | gzip -n > $(RELEASE).tar.gz

cp $(RELEASE).tar.gz $(RELEASE_DIR)

# linux-amd64 generates a centos7-compatible archive. Make a copy with the -centos7 label,

# for the releases page. We should probably drop that at some point.

$(if $(filter linux-amd64,$(OS)-$(ARCH)), \

cp $(RELEASE).tar.gz $(RELEASE_DIR)/$(subst amd64,amd64-centos7,$(RELEASE)).tar.gz \

)

rm -rf teleport

@echo "---> Created $(RELEASE).tar.gz."

.PHONY: build-update-archive

build-update-archive: | $(RELEASE_DIR)

@echo "---> Creating OSS update release archive."

mkdir -p teleport

cp -rf $(UPDATE_BINARIES) \

CHANGELOG.md \

build.assets/LICENSE-community \

teleport/

echo $(GITTAG) > teleport/VERSION

tar $(TAR_FLAGS) -c teleport | gzip -n > $(RELEASE_UPDATE).tar.gz

cp $(RELEASE_UPDATE).tar.gz $(RELEASE_DIR)

# linux-amd64 generates a centos7-compatible archive. Make a copy with the -centos7 label,

# for the releases page. We should probably drop that at some point.

$(if $(filter linux-amd64,$(OS)-$(ARCH)), \

cp $(RELEASE_UPDATE).tar.gz $(RELEASE_DIR)/$(subst amd64,amd64-centos7,$(RELEASE_UPDATE)).tar.gz \

)

rm -rf teleport

@echo "---> Created $(RELEASE_UPDATE).tar.gz."

#

# make release-unix - Produces binary release tarballs for both OSS and

# Enterprise editions, containing teleport, tctl, tbot and tsh.

#

.PHONY: release-unix

release-unix: clean full build-archive build-update-archive

@if [ -f e/Makefile ]; then $(MAKE) -C e release; fi

# release-unix-preserving-webassets cleans just the build and not the UI

# allowing webassets to be built in a prior step before building the release.

.PHONY: release-unix-preserving-webassets

release-unix-preserving-webassets: clean-build full build-archive build-update-archive

@if [ -f e/Makefile ]; then $(MAKE) -C e release; fi

include darwin-signing.mk

.PHONY: release-darwin-unsigned

release-darwin-unsigned: RELEASE:=$(RELEASE)-unsigned

release-darwin-unsigned: full build-archive

SIGNED_BINARIES := $(BINARIES:%tsh=%tsh.app)

SIGNED_BINARIES := $(SIGNED_BINARIES:%tctl=%tctl.app)

.PHONY: release-darwin

ifneq ($(ARCH),universal)

release-darwin: release-darwin-unsigned

$(NOTARIZE_BINARIES)

$(MAKE) tsh-app tctl-app

$(MAKE) build-archive BINARIES="$(SIGNED_BINARIES)"

@if [ -f e/Makefile ]; then $(MAKE) -C e release; fi

else

# release-darwin for ARCH == universal does not build binaries, but instead

# combines previously-built binaries. For this, it depends on the ARM64 and

# AMD64 signed tarballs being built into $(RELEASE_DIR). The dependencies

# expressed here will not make that happen as this is typically done on CI

# where these two tarballs are built in separate pipelines, and copied in for

# the universal build.

#

# For local manual runs, create these tarballs with:

# make ARCH=arm64 release-darwin

# make ARCH=amd64 release-darwin

# Ensure you have the rust toolchains for these installed by running

# make ARCH=arm64 rustup-install-target-toolchain

# make ARCH=amd64 rustup-install-target-toolchain

release-darwin: TARBINS := $(TARBINS:%tsh=%tsh.app)

release-darwin: TARBINS := $(TARBINS:%tctl=%tctl.app)

release-darwin: $(RELEASE_darwin_arm64) $(RELEASE_darwin_amd64)

mkdir -p $(BUILDDIR_arm64) $(BUILDDIR_amd64)

tar -C $(BUILDDIR_arm64) -xzf $(RELEASE_darwin_arm64) --strip-components=1 $(TARBINS)

tar -C $(BUILDDIR_amd64) -xzf $(RELEASE_darwin_amd64) --strip-components=1 $(TARBINS)

lipo -create -output $(BUILDDIR)/teleport $(BUILDDIR_arm64)/teleport $(BUILDDIR_amd64)/teleport

lipo -create -output $(BUILDDIR)/tbot $(BUILDDIR_arm64)/tbot $(BUILDDIR_amd64)/tbot

lipo -create -output $(BUILDDIR)/fdpass-teleport $(BUILDDIR_arm64)/fdpass-teleport $(BUILDDIR_amd64)/fdpass-teleport

lipo -create -output $(BUILDDIR)/tsh \

$(BUILDDIR_arm64)/tsh.app/Contents/MacOS/tsh \

$(BUILDDIR_amd64)/tsh.app/Contents/MacOS/tsh

lipo -create -output $(BUILDDIR)/tctl \

$(BUILDDIR_arm64)/tctl.app/Contents/MacOS/tctl \

$(BUILDDIR_amd64)/tctl.app/Contents/MacOS/tctl

$(NOTARIZE_BINARIES)

$(MAKE) tsh-app tctl-app

$(MAKE) ARCH=universal build-archive BINARIES="$(SIGNED_BINARIES)"

@if [ -f e/Makefile ]; then $(MAKE) -C e release; fi

endif

#

# make release-windows-unsigned - Produces a binary release archive containing tsh and tctl.

#

.PHONY: release-windows-unsigned

release-windows-unsigned: clean all

@echo "---> Creating OSS release archive."

mkdir teleport

cp -rf $(BUILDDIR)/* \

README.md \

CHANGELOG.md \

teleport/

mv teleport/tsh teleport/tsh-unsigned.exe

mv teleport/tctl teleport/tctl-unsigned.exe

echo $(GITTAG) > teleport/VERSION

zip -9 -y -r -q $(RELEASE)-unsigned.zip teleport/

rm -rf teleport/

@echo "---> Created $(RELEASE)-unsigned.zip."

#

# make release-windows - Produces an archive containing a signed release of

# tsh.exe and tctl.exe

#

.PHONY: release-windows

release-windows: release-windows-unsigned

@if [ ! -f "windows-signing-cert.pfx" ]; then \

echo "windows-signing-cert.pfx is missing or invalid, cannot create signed archive."; \

exit 1; \

fi

rm -rf teleport

@echo "---> Extracting $(RELEASE)-unsigned.zip"

unzip $(RELEASE)-unsigned.zip

@echo "---> Signing Windows tsh binary."

@osslsigncode sign \

-pkcs12 "windows-signing-cert.pfx" \

-n "Teleport" \

-i https://goteleport.com \

-t http://timestamp.digicert.com \

-h sha2 \

-in teleport/tsh-unsigned.exe \

-out teleport/tsh.exe; \

success=$$?; \

rm -f teleport/tsh-unsigned.exe; \

if [ "$${success}" -ne 0 ]; then \

echo "Failed to sign tsh.exe, aborting."; \

exit 1; \

fi

echo "---> Signing Windows tctl binary."

@osslsigncode sign \

-pkcs12 "windows-signing-cert.pfx" \

-n "Teleport" \

-i https://goteleport.com \

-t http://timestamp.digicert.com \

-h sha2 \

-in teleport/tctl-unsigned.exe \

-out teleport/tctl.exe; \

success=$$?; \

rm -f teleport/tctl-unsigned.exe; \

if [ "$${success}" -ne 0 ]; then \

echo "Failed to sign tctl.exe, aborting."; \

exit 1; \

fi

zip -9 -y -r -q $(RELEASE).zip teleport/

rm -rf teleport/

@echo "---> Created $(RELEASE).zip."

#

# make release-connect produces a release package of Teleport Connect.

# It is used only for MacOS releases. Windows releases do not use this

# Makefile. Linux uses the `teleterm` target in build.assets/Makefile.

#

# Either CONNECT_TSH_BIN_PATH or CONNECT_TSH_APP_PATH environment variable

# should be defined for the `pnpm package-term` command to succeed. CI sets

# this appropriately depending on whether a push build is running, or a

# proper release (a proper release needs the APP_PATH as that points to

# the complete signed package). See web/packages/teleterm/README.md for

# details.

.PHONY: release-connect

release-connect: | $(RELEASE_DIR)

pnpm install --frozen-lockfile

pnpm build-term

pnpm package-term -c.extraMetadata.version=$(VERSION) --$(ELECTRON_BUILDER_ARCH)

# Only copy proper builds with tsh.app to $(RELEASE_DIR)

# Drop -universal "arch" from dmg and zip name when copying to $(RELEASE_DIR)

if [ -n "$$CONNECT_TSH_APP_PATH" ]; then \

DMG_TARGET_NAME="Teleport Connect-$(VERSION)-$(ARCH).dmg"; \

ZIP_TARGET_NAME="Teleport Connect-$(VERSION)-$(ARCH)-mac.zip"; \

if [ "$(ARCH)" = 'universal' ]; then \

DMG_TARGET_NAME="$${DMG_TARGET_NAME/-universal/}"; \

ZIP_TARGET_NAME="$${ZIP_TARGET_NAME/-universal/}"; \

fi; \

cp web/packages/teleterm/build/release/"Teleport Connect-$(VERSION)-$(ELECTRON_BUILDER_ARCH).dmg" "$(RELEASE_DIR)/$${DMG_TARGET_NAME}"; \

cp web/packages/teleterm/build/release/"Teleport Connect-$(VERSION)-$(ELECTRON_BUILDER_ARCH)-mac.zip" "$(RELEASE_DIR)/$${ZIP_TARGET_NAME}"; \

fi

#

# Remove trailing whitespace in all markdown files under docs/.

#

# Note: this runs in a busybox container to avoid incompatibilities between

# linux and macos CLI tools.

#

.PHONY: docs-fix-whitespace

docs-fix-whitespace:

docker run --rm -v $(PWD):/teleport busybox \

find /teleport/docs/ -type f -name '*.md' -exec sed -E -i 's/\s+$$//g' '{}' \;

#

# Test docs for trailing whitespace and broken links

#

.PHONY: docs-test

docs-test: docs-test-whitespace

#

# Check for trailing whitespace in all markdown files under docs/

#

.PHONY: docs-test-whitespace

docs-test-whitespace:

if find docs/ -type f -name '*.md' | xargs grep -E '\s+$$'; then \

echo "trailing whitespace found in docs/ (see above)"; \

echo "run 'make docs-fix-whitespace' to fix it"; \

exit 1; \

fi

#

# Builds some tooling for filtering and displaying test progress/output/etc

#

# Deprecated: Use gotestsum instead.

TOOLINGDIR := ${abspath ./build.assets/tooling}

RENDER_TESTS := $(TOOLINGDIR)/bin/render-tests

$(RENDER_TESTS): $(wildcard $(TOOLINGDIR)/cmd/render-tests/*.go)

cd $(TOOLINGDIR) && go build -o "$@" ./cmd/render-tests

DIFF_TEST := $(TOOLINGDIR)/bin/difftest

$(DIFF_TEST): $(wildcard $(TOOLINGDIR)/cmd/difftest/*.go)

cd $(TOOLINGDIR) && go build -o "$@" ./cmd/difftest

BENCHFIND := $(TOOLINGDIR)/bin/benchfind

$(BENCHFIND): $(wildcard $(TOOLINGDIR)/cmd/benchfind/*.go)

cd $(TOOLINGDIR) && go build -o "$@" ./cmd/benchfind

RERUN := $(TOOLINGDIR)/bin/rerun

$(RERUN): $(wildcard $(TOOLINGDIR)/cmd/rerun/*.go)

cd $(TOOLINGDIR) && go build -o "$@" ./cmd/rerun

#

# Runs all Go/shell tests, called by CI/CD.

#

.PHONY: test

test: test-helm test-sh test-api test-go test-rust test-operator test-terraform-provider

$(TEST_LOG_DIR):

mkdir -p $(TEST_LOG_DIR)

.PHONY: helmunit/installed

helmunit/installed:

@if ! helm unittest -h >/dev/null; then \

echo 'Helm unittest plugin is required to test Helm charts. Run `helm plugin install https://github.com/quintush/helm-unittest --version 0.2.11` to install it'; \

exit 1; \

fi

# The CI environment is responsible for setting HELM_PLUGINS to a directory where

# quintish/helm-unittest is installed.

#

# Github Actions build uses /workspace as homedir and Helm can't pick up plugins by default there,

# so override the plugin location via environemnt variable when running in CI. Github Actions provide CI=true

# environment variable.

.PHONY: test-helm

test-helm: helmunit/installed

$(HELMJANITOR) test

.PHONY: test-helm-update-snapshots

test-helm-update-snapshots: helmunit/installed

$(HELMJANITOR) test --update-snapshots

#

# Runs all Go tests except integration, called by CI/CD.

#

.PHONY: test-go

test-go: test-go-unit test-go-touch-id test-go-vnet-daemon test-go-tsh test-go-chaos

#

# Runs a test to ensure no environment variable leak into build binaries.

# This is typically done as part of the bloat test in CI, but this

# target exists for local testing.

#

.PHONY: test-env-leakage

test-env-leakage:

$(eval export BUILD_SECRET=FAKE_SECRET)

$(MAKE) full

failed=0; \

for binary in $(BINARIES); do \

if strings $$binary | grep -q 'FAKE_SECRET'; then \

echo "Error: $$binary contains FAKE_SECRET"; \

failed=1; \

fi; \

done; \

if [ $$failed -eq 1 ]; then \

echo "Environment leak failure"; \

exit 1; \

else \

echo "No environment leak, PASS"; \

fi

# Runs test prepare steps