summaryrefslogtreecommitdiffhomepage
path: root/Makefile
AgeCommit message (Collapse)AuthorFilesLines
2026-04-13ssh/tailssh: speed up SSH integration testsBrad Fitzpatrick1-4/+6
Parallelize the SSH integration tests across OS targets and reduce per-container overhead: - CI: use GitHub Actions matrix strategy to run all 4 OS containers (ubuntu:focal, ubuntu:jammy, ubuntu:noble, alpine:latest) in parallel instead of sequentially (~4x wall-clock improvement) - Makefile: run docker builds in parallel for local dev too - Dockerfile: consolidate ~20 separate RUN commands into 5 (one per test phase), eliminating Docker layer overhead. Combine test binary invocations where no state mutation is needed between them. Fix a bug where TestDoDropPrivileges was silently not being run (was passed as a second positional arg to -test.run instead of using regex alternation). - TestMain: replace tail -F + 2s sleep with synchronous log read, eliminating 2s overhead per test binary invocation. Set debugTest once in TestMain instead of redundantly in each test function. - session.read(): close channel on EOF so non-shell tests return immediately instead of waiting for the 1s silence timeout. Updates #19244 Change-Id: I2cc8588964fbce0dd7b654fb94e7ff33440b8584 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-10-01Makefile, cmd/*/depaware.txt: split out vendor packages explicitlyBrad Fitzpatrick1-8/+8
depaware was merging golang.org/x/foo and std's vendor/golang.org/x/foo packages (which could both be in the binary!), leading to confusing output, especially when I was working on eliminating duplicate packages imported under different names. This makes the depaware output longer and grosser, but doesn't hide reality from us. Updates #17305 Change-Id: I21cc3418014e127f6c1a81caf4e84213ce84ab57 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-29feature/featuretags, Makefile: fix bug with CLI build tag and depaware, add ↵Brad Fitzpatrick1-0/+4
variant When I added dependency support to featuretag, I broke the handling of the non-omit build tags (as used by the "box" support for bundling the CLI into tailscaled). That then affected depaware. The depaware-minbox.txt this whole time recently has not included the CLI. So fix that, and also add a new depaware variant that's only the daemon, without the CLI. Updates #12614 Updates #17139 Change-Id: I4a4591942aa8c66ad8e3242052e3d9baa42902ca Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-26Makefile, cmd/tailscaled: add minimal tailscale+cli binary depawareBrad Fitzpatrick1-1/+5
Updates #12614 Change-Id: I593ed30f620556c6503d80c0ccbbe242567fd5cf Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-08-19.github/Makefile/flake: update nix flake support (#16636)Mike O'Driscoll1-1/+2
Cleanup nix support, make flake easier to read with nix-systems. This also harmonizes with golinks flake setup and reduces an input dependency by 1. Update deps test to ensure the vendor hash stays harmonized with go.mod. Update make tidy to ensure vendor hash stays current. Overlay the current version of golang, tailscale runs recent releases faster than nixpkgs can update them into the unstable branch. Updates #16637 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2025-08-05.github/workflows: enforce github action version pinning (#16768)Andrew Lytvynov1-0/+4
Use https://github.com/stacklok/frizbee via the new `go tool` support from Go 1.24. Updates https://github.com/tailscale/corp/issues/31017 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-08-01Makefile: sort make commands and fix printing newlinesWill Norris1-2/+4
Updates #cleanup Change-Id: Ia101a4a3005adb9118051b3416f5a64a4a45987d Signed-off-by: Will Norris <will@tailscale.com>
2025-08-01Makefile: 'generate' target (#16746)mzbenami1-0/+4
Signed-off-by: Michael Ben-Ami <mzb@tailscale.com>
2025-07-16ssh/tailssh: fix path of "true" on Darwin (#16569)M. J. Fromberger1-2/+2
This is a follow-up to #15351, which fixed the test for Linux but not for Darwin, which stores its "true" executable in /usr/bin instead of /bin. Try both paths when not running on Windows. In addition, disable CGo in the integration test build, which was causing the linker to fail. These tests do not need CGo, and it appears we had some version skew with the base image on the runners. In addition, in error cases the recover step of the permissions check was spuriously panicking and masking the "real" failure reason. Don't do that check when a command was not produced. Updates #15350 Change-Id: Icd91517f45c90f7554310ebf1c888cdfd109f43a Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-07-09cmd/{k8s-operator,k8s-proxy}: add kube-apiserver ProxyGroup type (#16266)Tom Proctor1-24/+24
Adds a new k8s-proxy command to convert operator's in-process proxy to a separately deployable type of ProxyGroup: kube-apiserver. k8s-proxy reads in a new config file written by the operator, modelled on tailscaled's conffile but with some modifications to ensure multiple versions of the config can co-exist within a file. This should make it much easier to support reading that config file from a Kube Secret with a stable file name. To avoid needing to give the operator ClusterRole{,Binding} permissions, the helm chart now optionally deploys a new static ServiceAccount for the API Server proxy to use if in auth mode. Proxies deployed by kube-apiserver ProxyGroups currently work the same as the operator's in-process proxy. They do not yet leverage Tailscale Services for presenting a single HA DNS name. Updates #13358 Change-Id: Ib6ead69b2173c5e1929f3c13fb48a9a5362195d8 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-06-17.github/workflows: remove redundant work between staticcheck jobsBrad Fitzpatrick1-1/+1
Make the OS-specific staticcheck jobs only test stuff that's specialized for that OS. Do that using a new ./tool/listpkgs program that's a fancy 'go list' with more filtering flags. Updates tailscale/corp#28679 Change-Id: I790be2e3a0b42b105bd39f68c4b20e217a26de60 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-06-03cmd/tsidp: add Docker image building support (#16078)Raj Singh1-2/+12
- Add tsidp target to build_docker.sh for standard Tailscale image builds - Add publishdevtsidp Makefile target for development image publishing - Remove Dockerfile, using standard build process - Include tsidp in depaware dependency tracking - Update README with comprehensive Docker usage examples This enables tsidp to be built and published like other Tailscale components (tailscale/tailscale, tailscale/k8s-operator, tailscale/k8s-nameserver). Fixes #16077 Signed-off-by: Raj Singh <raj@tailscale.com>
2025-05-07tsnet: add android & iOS results to depawareBrad Fitzpatrick1-2/+4
Updates #12614 Change-Id: Icd21deb754e7073871eeb34edadd41c167ec5984 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-07Makefile: add tsnet to depawareBrad Fitzpatrick1-2/+4
Updates #12614 Change-Id: Iff30bc457efcc96f60b563195b213cbc4dccc349 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-26go.mod: bump depaware, add --internal flag to stop hiding internal packagesBrad Fitzpatrick1-2/+2
The hiding of internal packages has hidden things I wanted to see a few times now. Stop hiding them. This makes depaware.txt output a bit longer, but not too much. Plus we only really look at it with diffs & greps anyway; it's not like anybody reads the whole thing. Updates #12614 Change-Id: I868c89eeeddcaaab63e82371651003629bc9bda8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-12-12ssh/tailssh: remove unused public key supportBrad Fitzpatrick1-1/+0
When we first made Tailscale SSH, we assumed people would want public key support soon after. Turns out that hasn't been the case; people love the Tailscale identity authentication and check mode. In light of CVE-2024-45337, just remove all our public key code to not distract people, and to make the code smaller. We can always get it back from git if needed. Updates tailscale/corp#25131 Updates golang/go#70779 Co-authored-by: Percy Wegmann <percy@tailscale.com> Change-Id: I87a6e79c2215158766a81942227a18b247333c22 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-11-29Makefile,./build_docker.sh: update kube operator image build target name ↵Irbe Krumina1-1/+1
(#14251) Updates tailscale/corp#24540 Updates tailscale/tailscale#12914 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-08-21ssh/tailssh: fix SSH on busybox systemsPercy Wegmann1-1/+2
This involved the following: 1. Pass the su command path as first of args in call to unix.Exec to make sure that busybox sees the correct program name. Busybox is a single executable userspace that implements various core userspace commands in a single binary. You'll see it used via symlinking, so that for example /bin/su symlinks to /bin/busybox. Busybox knows that you're trying to execute /bin/su because argv[0] is '/bin/su'. When we called unix.Exec, we weren't including the program name for argv[0], which caused busybox to fail with 'applet not found', meaning that it didn't know which command it was supposed to run. 2. Tell su to whitelist the SSH_AUTH_SOCK environment variable in order to support ssh agent forwarding. 3. Run integration tests on alpine, which uses busybox. 4. Increment CurrentCapabilityVersion to allow turning on SSH V2 behavior from control. Fixes #12849 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-07-08cmd/k8s-operator: add depaware.txtMaisem Ali1-0/+2
Updates #12742 Signed-off-by: Maisem Ali <maisem@tailscale.com>
2024-06-20ssh/tailssh: replace incubator process with su instead of running su as childPercy Wegmann1-2/+2
This allows the SSH_AUTH_SOCK environment variable to work inside of su and agent forwarding to succeed. Fixes #12467 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-05-29ssh/tailssh: fall back to using su when no TTY available on LinuxPercy Wegmann1-4/+1
This allows pam authentication to run for ssh sessions, triggering automation like pam_mkhomedir. Updates #11854 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-05-01ssh/tailssh: add integration testPercy Wegmann1-0/+12
Updates tailscale/corp#11854 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2024-04-30cmd/{k8s-nameserver,k8s-operator},k8s-operator: add a kube nameserver, make ↵Irbe Krumina1-0/+8
operator deploy it (#11919) * cmd/k8s-nameserver,k8s-operator: add a nameserver that can resolve ts.net DNS names in cluster. Adds a simple nameserver that can respond to A record queries for ts.net DNS names. It can respond to queries from in-memory records, populated from a ConfigMap mounted at /config. It dynamically updates its records as the ConfigMap contents changes. It will respond with NXDOMAIN to queries for any other record types (AAAA to be implemented in the future). It can respond to queries over UDP or TCP. It runs a miekg/dns DNS server with a single registered handler for ts.net domain names. Queries for other domain names will be refused. The intended use of this is: 1) to allow non-tailnet cluster workloads to talk to HTTPS tailnet services exposed via Tailscale operator egress over HTTPS 2) to allow non-tailnet cluster workloads to talk to workloads in the same cluster that have been exposed to tailnet over their MagicDNS names but on their cluster IPs. DNSConfig CRD can be used to configure the operator to deploy kube nameserver (./cmd/k8s-nameserver) to cluster. Updates tailscale/tailscale#10499 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-04-15Makefile: fix default SYNO_ARCH in MakefileBrad Fitzpatrick1-1/+1
It was broken with the move to dist in 32e0ba5e68 which doesn't accept amd64 anymore. Updates #cleanup Change-Id: Iaaaba2d73c6a09a226934fe8e5c18b16731ee7a6 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2024-04-08Revert "cmd/{k8s-nameserver,k8s-operator},k8s-operator: add a kube ↵Irbe Krumina1-8/+0
nameserver, make operator deploy it (#11017)" (#11669) Temporarily reverting this PR to avoid releasing half finished featue. This reverts commit 9e2f58f8461b32d5970f2680beda13153196ce46. Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-03-27cmd/{k8s-nameserver,k8s-operator},k8s-operator: add a kube nameserver, make ↵Irbe Krumina1-0/+8
operator deploy it (#11017) * cmd/k8s-nameserver,k8s-operator: add a nameserver that can resolve ts.net DNS names in cluster. Adds a simple nameserver that can respond to A record queries for ts.net DNS names. It can respond to queries from in-memory records, populated from a ConfigMap mounted at /config. It dynamically updates its records as the ConfigMap contents changes. It will respond with NXDOMAIN to queries for any other record types (AAAA to be implemented in the future). It can respond to queries over UDP or TCP. It runs a miekg/dns DNS server with a single registered handler for ts.net domain names. Queries for other domain names will be refused. The intended use of this is: 1) to allow non-tailnet cluster workloads to talk to HTTPS tailnet services exposed via Tailscale operator egress over HTTPS 2) to allow non-tailnet cluster workloads to talk to workloads in the same cluster that have been exposed to tailnet over their MagicDNS names but on their cluster IPs. Updates tailscale/tailscale#10499 Signed-off-by: Irbe Krumina <irbe@tailscale.com> * cmd/k8s-operator/deploy/crds,k8s-operator: add DNSConfig CustomResource Definition DNSConfig CRD can be used to configure the operator to deploy kube nameserver (./cmd/k8s-nameserver) to cluster. Signed-off-by: Irbe Krumina <irbe@tailscale.com> * cmd/k8s-operator,k8s-operator: optionally reconcile nameserver resources Adds a new reconciler that reconciles DNSConfig resources. If a DNSConfig is deployed to cluster, the reconciler creates kube nameserver resources. This reconciler is only responsible for creating nameserver resources and not for populating nameserver's records. Signed-off-by: Irbe Krumina <irbe@tailscale.com> * cmd/{k8s-operator,k8s-nameserver}: generate DNSConfig CRD for charts, append to static manifests Signed-off-by: Irbe Krumina <irbe@tailscale.com> --------- Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-01-10Makefile,build_docker.sh: allow to configure target platform. (#10806)Irbe Krumina1-2/+4
Build dev tailscale and k8s-operator images for linux/amd64 only by default, make it possible to configure target build platform via PLATFORM var. Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2024-01-08cmd/{derper,stund},net/stunserver: add standalone stun serverJames Tucker1-2/+4
Add a standalone server for STUN that can be hosted independently of the derper, and factor that back into the derper. Fixes #8434 Closes #8435 Closes #10745 Signed-off-by: James Tucker <james@tailscale.com>
2023-12-14cmd/k8s-operator: operator can create subnetrouter (#9505)Irbe Krumina1-0/+15
* k8s-operator,cmd/k8s-operator,Makefile,scripts,.github/workflows: add Connector kube CRD. Connector CRD allows users to configure the Tailscale Kubernetes operator to deploy a subnet router to expose cluster CIDRs or other CIDRs available from within the cluster to their tailnet. Also adds various CRD related machinery to generate CRD YAML, deep copy implementations etc. Engineers will now have to run 'make kube-generate-all` after changing kube files to ensure that all generated files are up to date. * cmd/k8s-operator,k8s-operator: reconcile Connector resources Reconcile Connector resources, create/delete subnetrouter resources in response to changes to Connector(s). Connector reconciler will not be started unless ENABLE_CONNECTOR env var is set to true. This means that users who don't want to use the alpha Connector custom resource don't have to install the Connector CRD to their cluster. For users who do want to use it the flow is: - install the CRD - install the operator (via Helm chart or using static manifests). For Helm users set .values.enableConnector to true, for static manifest users, set ENABLE_CONNECTOR to true in the static manifest. Updates tailscale/tailscale#502 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2023-12-07ci: run 'go vet' in golangci-lint; fix errors in testsAndrew Dunham1-0/+3
Updates #cleanup Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: Ice78fc907bad24c1de749a1595e212ef2db4b8bb
2023-09-19Makefile: make it possibe to pass a custom tag when building dev images (#9461)Irbe Krumina1-2/+3
Updates #cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2023-08-24all: adjust some build tags for plan9Brad Fitzpatrick1-0/+3
I'm not saying it works, but it compiles. Updates #5794 Change-Id: I2f3c99732e67fe57a05edb25b758d083417f083e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2023-05-29release/dist/synology: build synology packages with cmd/distDavid Anderson1-3/+2
Updates #8217 Signed-off-by: David Anderson <danderson@tailscale.com>
2023-02-16Makefile: add help text to MakefileWill Norris1-20/+25
https://rosszurowski.com/log/2022/makefiles#self-documenting-makefiles Signed-off-by: Will Norris <will@tailscale.com>
2023-02-01all: update to Go 1.20, use strings.CutPrefix/Suffix instead of our forkBrad Fitzpatrick1-2/+6
Updates #7123 Updates #5309 Change-Id: I90bcd87a2fb85a91834a0dd4be6e03db08438672 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-12-13Makefile: add a target for doing dev builds of the k8s operator.David Anderson1-1/+11
Updates #502. Signed-off-by: David Anderson <danderson@tailscale.com>
2022-12-11feat(build): add support on Loongnix-Server (loong64) (#6233)缘生1-0/+3
Makefile, .github/workflow: add tests, targets for GOARCH=loong64 (Loongnix) Signed-off-by: ysicing <i@ysicing.me>
2022-10-21Makefile: add publishdevimage targetMaisem Ali1-0/+6
This builds and publishes the tailscale container image for dev testing. Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-08-15Makefile: add target for wasm and make it part of checkMaisem Ali1-1/+4
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-08-05cmd/derper: add depaware.txtDavid Crawshaw1-4/+8
Signed-off-by: David Crawshaw <crawshaw@tailscale.com>
2022-08-02all: require Go 1.19Brad Fitzpatrick1-1/+1
Updates #5210 Change-Id: I2e950b4776636b4ea89b6566b60e4a87596a3a43 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-21Makefile: add tidy targetBrad Fitzpatrick1-0/+3
Change-Id: I6cd3a6837f9ddfd283f57378465dcefa4d0ada47 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2022-03-18Makefile: use ./tool/go everywhereMaisem Ali1-9/+9
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2022-01-21Makefile: update make spk target to use the new go spk builderMaisem Ali1-4/+10
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2021-12-06Makefile: add spk and pushspk targets for iterative Synology developmentBrad Fitzpatrick1-0/+8
Change-Id: I97319d14917aa2b00ff72a7b73b3db79ea8392b7 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-11-22build_docker.sh: use github.com/tailscale/mkctr instead of dockerMaisem Ali1-2/+1
Signed-off-by: Maisem Ali <maisem@tailscale.com>
2021-11-03Add multiarch image make targetMangirdas1-0/+6
Updates #3112 Signed-off-by: Mangirdas <mangirdas@judeikis.lt>
2021-08-18Makefile: add a linux/arm checkBrad Fitzpatrick1-1/+4
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-03-01wgengine/netstack: fix 32-bit build broken from prior commitBrad Fitzpatrick1-1/+4
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2021-02-27wgengine: unify NewUserspaceEngine, NewUserspaceEngineAdvancedBrad Fitzpatrick1-1/+4
Also rename EngineConfig to Config to avoid wgengine.EngineConfig stutter. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.