duh

Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>

.buildkite/pipeline.yaml

@@ -1,8 +0,0 @@
-steps:
-  - label: ":eslint: Lint"
-    command:
-      - "yarn install"
-      - "yarn lint"
-    plugins:
-      - docker#v3.0.1:
-          image: "node:10"

.eslintrc-hak.js

@@ -0,0 +1,22 @@
+module.exports = {
+    plugins: ["matrix-org"],
+    extends: [".eslintrc.js"],
+    parserOptions: {
+        project: ["hak/tsconfig.json"],
+    },
+    overrides: [
+        {
+            files: ["hak/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+    ],
+};

.eslintrc-scripts.js

@@ -0,0 +1,22 @@
+module.exports = {
+    plugins: ["matrix-org"],
+    extends: [".eslintrc.js"],
+    parserOptions: {
+        project: ["scripts/tsconfig.json"],
+    },
+    overrides: [
+        {
+            files: ["scripts/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+    ],
+};

.eslintrc-test.js

@@ -0,0 +1,22 @@
+module.exports = {
+    plugins: ["matrix-org"],
+    extends: [".eslintrc.js"],
+    parserOptions: {
+        project: ["playwright/tsconfig.json"],
+    },
+    overrides: [
+        {
+            files: ["playwright/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+    ],
+};

.eslintrc.js

@@ -1,6 +1,9 @@
 module.exports = {
+    plugins: ["matrix-org"],
+    extends: ["plugin:matrix-org/javascript"],
     parserOptions: {
-        ecmaVersion: 8,
+        ecmaVersion: 2021,
+        project: ["tsconfig.json"],
     },
     env: {
         es6: true,
@@ -8,15 +11,27 @@ module.exports = {
         // we also have some browser code (ie. the preload script)
         browser: true,
     },
-    extends: ["matrix-org"],
+    // NOTE: These rules are frozen and new rules should not be added here.
+    // New changes belong in https://github.com/matrix-org/eslint-plugin-matrix-org/
     rules: {
-        // js-sdk uses a babel rule which we can't use because we
-        // don't use babel, so remove it & put the original back
-        "babel/no-invalid-this": "off",
-        "no-invalid-this": "error",
         "quotes": "off",
         "indent": "off",
         "prefer-promise-reject-errors": "off",
         "no-async-promise-executor": "off",
-    }
-}
+    },
+    overrides: [
+        {
+            files: ["src/**/*.ts"],
+            extends: ["plugin:matrix-org/typescript"],
+            rules: {
+                // Things we do that break the ideal style
+                "prefer-promise-reject-errors": "off",
+                "quotes": "off",
+
+                "@typescript-eslint/no-explicit-any": "off",
+                // We're okay with assertion errors when we ask for them
+                "@typescript-eslint/no-non-null-assertion": "off",
+            },
+        },
+    ],
+};

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+*                         @element-hq/element-web-reviewers
+/.github/workflows/**     @element-hq/element-web-team
+/package.json             @element-hq/element-web-team
+/yarn.lock                @element-hq/element-web-team
+/src/i18n/strings

.github/ISSUE_TEMPLATE/bug-desktop.yml

@@ -0,0 +1,76 @@
+name: Bug report for the Element desktop app (not in a browser)
+description: File a bug report if you are using the desktop Element application.
+labels: [T-Defect]
+body:
+    - type: markdown
+      attributes:
+          value: |
+              Thanks for taking the time to fill out this bug report!
+
+              Please report security issues by email to security@matrix.org
+    - type: textarea
+      id: reproduction-steps
+      attributes:
+          label: Steps to reproduce
+          description: Please attach screenshots, videos or logs if you can.
+          placeholder: Tell us what you see!
+          value: |
+              1. Where are you starting? What can you see?
+              2. What do you click?
+              3. More steps…
+      validations:
+          required: true
+    - type: textarea
+      id: result
+      attributes:
+          label: Outcome
+          placeholder: Tell us what went wrong
+          value: |
+              #### What did you expect?
+
+              #### What happened instead?
+      validations:
+          required: true
+    - type: input
+      id: os
+      attributes:
+          label: Operating system
+          placeholder: Windows, macOS, Ubuntu, Arch Linux…
+      validations:
+          required: false
+    - type: input
+      id: version
+      attributes:
+          label: Application version
+          description: You can find the version information in Settings -> Help & About.
+          placeholder: e.g. Element version 1.7.34, olm version 3.2.3
+      validations:
+          required: false
+    - type: input
+      id: source
+      attributes:
+          label: How did you install the app?
+          description: Where did you install the app from? Please give a link or a description.
+          placeholder: e.g. From https://element.io/get-started
+      validations:
+          required: false
+    - type: input
+      id: homeserver
+      attributes:
+          label: Homeserver
+          description: |
+              Which server is your account registered on? If it is a local or non-public homeserver, please tell us what is the homeserver implementation (ex: Synapse/Dendrite/etc.) and the version.
+          placeholder: e.g. matrix.org or Synapse 1.50.0rc1
+      validations:
+          required: false
+    - type: dropdown
+      id: rageshake
+      attributes:
+          label: Will you send logs?
+          description: |
+              Did you know that you can send a /rageshake command from your application to submit logs for this issue? Trigger the defect, then type `/rageshake` into the message input area followed by a description of the problem and send the command. You will be able to add a link to this defect report and submit anonymous logs to the developers.
+          options:
+              - "Yes"
+              - "No"
+      validations:
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/enhancement.yml

@@ -0,0 +1,36 @@
+name: Enhancement request
+description: Do you have a suggestion or feature request?
+labels: [T-Enhancement]
+body:
+    - type: markdown
+      attributes:
+          value: |
+              Thank you for taking the time to propose an enhancement to an existing feature. If you would like to propose a new feature or a major cross-platform change, please [start a discussion here](https://github.com/vector-im/element-meta/discussions/new?category=ideas).
+    - type: textarea
+      id: usecase
+      attributes:
+          label: Your use case
+          description: What would you like to be able to do? Please feel welcome to include screenshots or mock ups.
+          placeholder: Tell us what you would like to do!
+          value: |
+              #### What would you like to do?
+
+              #### Why would you like to do it?
+
+              #### How would you like to achieve it?
+      validations:
+          required: true
+    - type: textarea
+      id: alternative
+      attributes:
+          label: Have you considered any alternatives?
+          placeholder: A clear and concise description of any alternative solutions or features you've considered.
+      validations:
+          required: false
+    - type: textarea
+      id: additional-context
+      attributes:
+          label: Additional context
+          placeholder: Is there anything else you'd like to add?
+      validations:
+          required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,13 @@
+<!-- Thanks for submitting a PR! Please ensure the following requirements are met in order for us to review your PR -->
+
+## Checklist
+
+-   [ ] Ensure your code works with manual testing
+-   [ ] Linter and other CI checks pass
+-   [ ] Sign-off given on the changes (see [CONTRIBUTING.md](https://github.com/vector-im/element-desktop/blob/develop/CONTRIBUTING.md))
+
+<!--
+If you would like to specify text for the changelog entry other than your PR title, add the following:
+
+Notes: Add super cool feature
+-->

.github/labels.yml

@@ -0,0 +1,31 @@
+- name: "A-Install"
+  color: "72A447"
+- name: "A-Seshat"
+  color: "8262BE"
+- name: "A-Update"
+  color: "17BE67"
+- name: "Story"
+  description: "A change to the product that generates user value on its own. Unit of delivery."
+  color: "0BAC47"
+- name: "X-Breaking-Change"
+  color: "ff7979"
+- name: "Z-Arch"
+  color: "D601BE"
+- name: "Z-ARM"
+  color: "5DEC5B"
+- name: "Z-Flatpak"
+  color: "0CA856"
+- name: "Z-Linux"
+  color: "7B4A9C"
+- name: "Z-macOS"
+  color: "500605"
+- name: "Z-Official"
+  color: "1D2B20"
+- name: "Z-Snap"
+  color: "29CD95"
+- name: "Z-Suse"
+  color: "79D07B"
+- name: "Z-Wayland"
+  color: "94C519"
+- name: "Z-Windows"
+  color: "0632DE"

.github/release-drafter.yml

@@ -0,0 +1 @@
+_extends: element-hq/element-web

.github/renovate.json

@@ -0,0 +1,4 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": ["github>matrix-org/renovate-config-element-web"]
+}

.github/workflows/backport.yml

@@ -0,0 +1,30 @@
+name: Backport
+on:
+    pull_request_target:
+        types:
+            - closed
+            - labeled
+        branches:
+            - develop
+
+jobs:
+    backport:
+        name: Backport
+        runs-on: ubuntu-latest
+        # Only react to merged PRs for security reasons.
+        # See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target.
+        if: >
+            github.event.pull_request.merged
+            && (
+              github.event.action == 'closed'
+              || (
+                github.event.action == 'labeled'
+                && contains(github.event.label.name, 'backport')
+              )
+            )
+        steps:
+            - uses: tibdex/backport@9565281eda0731b1d20c4025c43339fb0a23812e # v2
+              with:
+                  labels_template: "<%= JSON.stringify([...labels, 'X-Release-Blocker']) %>"
+                  # We can't use GITHUB_TOKEN here or CI won't run on the new PR
+                  github_token: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/build_and_deploy.yaml

@@ -0,0 +1,244 @@
+name: Build and Deploy
+on:
+    # Nightly build
+    schedule:
+        - cron: "0 9 * * *"
+    # Release build
+    release:
+        types: [published]
+    # Manual nightly & release
+    workflow_dispatch:
+        inputs:
+            mode:
+                description: What type of build to trigger. Release builds MUST be ran from the `master` branch.
+                required: true
+                default: nightly
+                type: choice
+                options:
+                    - nightly
+                    - release
+            macos:
+                description: Build macOS
+                required: true
+                type: boolean
+                default: true
+            windows:
+                description: Build Windows
+                required: true
+                type: boolean
+                default: true
+            linux:
+                description: Build Linux
+                required: true
+                type: boolean
+                default: true
+            deploy:
+                description: Deploy artifacts
+                required: true
+                type: boolean
+                default: true
+run-name: Element ${{ inputs.mode != 'release' && github.event_name != 'release' && 'Nightly' || 'Desktop' }}
+concurrency: ${{ github.workflow }}
+env:
+    R2_BUCKET: ${{ vars.R2_BUCKET }}
+jobs:
+    prepare:
+        uses: ./.github/workflows/build_prepare.yaml
+        with:
+            config: element.io/${{ inputs.mode || (github.event_name == 'release' && 'release') || 'nightly' }}
+            version: ${{ (inputs.mode != 'release' && github.event_name != 'release') && 'develop' || '' }}
+            nightly: ${{ inputs.mode != 'release' && github.event_name != 'release' }}
+            deploy: ${{ inputs.deploy || (github.event_name != 'workflow_dispatch' && github.event.release.prerelease != true) }}
+        secrets:
+            CF_R2_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+            CF_R2_TOKEN: ${{ secrets.CF_R2_TOKEN }}
+
+    windows:
+        if: github.event_name != 'workflow_dispatch' || inputs.windows
+        needs: prepare
+        name: Windows ${{ matrix.arch }}
+        strategy:
+            matrix:
+                arch: [ia32, x64]
+        uses: ./.github/workflows/build_windows.yaml
+        secrets: inherit
+        with:
+            sign: true
+            arch: ${{ matrix.arch }}
+            version: ${{ needs.prepare.outputs.nightly-version }}
+
+    macos:
+        if: github.event_name != 'workflow_dispatch' || inputs.macos
+        needs: prepare
+        name: macOS
+        uses: ./.github/workflows/build_macos.yaml
+        secrets: inherit
+        with:
+            sign: true
+            base-url: https://packages.element.io/${{ needs.prepare.outputs.packages-dir }}
+            version: ${{ needs.prepare.outputs.nightly-version }}
+
+    linux:
+        if: github.event_name != 'workflow_dispatch' || inputs.linux
+        needs: prepare
+        name: Linux ${{ matrix.arch }} (sqlcipher ${{ matrix.sqlcipher }})
+        strategy:
+            matrix:
+                arch: [amd64, arm64]
+                sqlcipher: [system, static]
+                exclude:
+                    - arch: arm64
+                      sqlcipher: static
+        uses: ./.github/workflows/build_linux.yaml
+        with:
+            arch: ${{ matrix.arch }}
+            config: ${{ needs.prepare.outputs.config }}
+            sqlcipher: ${{ matrix.sqlcipher }}
+            version: ${{ needs.prepare.outputs.nightly-version }}
+
+    deploy:
+        needs:
+            - prepare
+            - macos
+            - linux
+            - windows
+        runs-on: ubuntu-latest
+        name: ${{ needs.prepare.outputs.deploy && 'Deploy' || 'Deploy (dry-run)' }}
+        if: always() && !failure() && !cancelled()
+        environment: ${{ needs.prepare.outputs.deploy && 'packages.element.io' || '' }}
+        steps:
+            - name: Download artifacts
+              uses: actions/download-artifact@v4
+
+            - name: Prepare artifacts for deployment
+              run: |
+                  # Windows
+                  for arch in x64 ia32 arm64
+                  do
+                      if [ -d "win-$arch" ]; then
+                          mkdir -p packages.element.io/{install,update}/win32/$arch
+                          mv win-$arch/squirrel-windows*/*.exe "packages.element.io/install/win32/$arch/"
+                          mv win-$arch/squirrel-windows*/*.nupkg "packages.element.io/update/win32/$arch/"
+                          mv win-$arch/squirrel-windows*/RELEASES "packages.element.io/update/win32/$arch/"
+                      fi
+                  done
+
+                  # macOS
+                  if [ -d macos ]; then
+                      mkdir -p packages.element.io/{install,update}/macos
+                      mv macos/*.dmg packages.element.io/install/macos/
+                      mv macos/*-mac.zip packages.element.io/update/macos/
+                      mv macos/*.json packages.element.io/update/macos/
+                  fi
+
+                  # Linux
+                  if [ -d linux-amd64-sqlcipher-static ]; then
+                      mkdir -p packages.element.io/install/linux/glibc-x86-64
+                      mv linux-amd64-sqlcipher-static/*.tar.gz packages.element.io/install/linux/glibc-x86-64
+                  fi
+
+            # We don't wish to store the installer for every nightly ever, so we only keep the latest
+            - name: "[Nightly] Strip version from installer file"
+              if: needs.prepare.outputs.nightly-version != ''
+              run: |
+                  # Windows
+                  for arch in x64 ia32 arm64
+                  do
+                      [ -d "win-$arch" ] && mv packages.element.io/install/win32/$arch/{*,"Element Nightly Setup"}.exe
+                  done
+
+                  # macOS
+                  [ -d macos ] && mv packages.element.io/install/macos/{*,"Element Nightly"}.dmg
+
+                  # Linux
+                  [ -d linux-amd64-sqlcipher-static ] && mv packages.element.io/install/linux/glibc-x86-64/{*,element-desktop-nightly}.tar.gz
+
+            - name: "[Release] Prepare release latest symlink"
+              if: needs.prepare.outputs.nightly-version == ''
+              run: |
+                  # Windows
+                  for arch in x64 ia32 arm64
+                  do
+                      if [ -d "win-$arch" ]; then
+                          pushd packages.element.io/install/win32/$arch
+                          ln -s "$(find . -type f -iname "*.exe" | xargs -0 -n1 -- basename)" "Element Setup.exe"
+                          popd
+                      fi
+                  done
+
+                  # macOS
+                  if [ -d macos ]; then
+                      pushd packages.element.io/install/macos
+                      ln -s "$(find . -type f -iname "*.dmg" | xargs -0 -n1 -- basename)" "Element.dmg"
+                      popd
+                  fi
+
+                  # Linux
+                  if [ -d linux-amd64-sqlcipher-static ]; then
+                      pushd packages.element.io/install/linux/glibc-x86-64
+                      ln -s "$(find . -type f -iname "*.tar.gz" | xargs -0 -n1 -- basename)" "element-desktop.tar.gz"
+                      popd
+                  fi
+
+            - name: Stash packages.element.io
+              if: ${{ !needs.prepare.outputs.deploy }}
+              uses: actions/upload-artifact@v4
+              with:
+                  name: packages.element.io
+                  path: packages.element.io
+
+            - name: Deploy artifacts
+              if: needs.prepare.outputs.deploy
+              run: |
+                  aws s3 cp --recursive packages.element.io/ s3://$R2_BUCKET/$DEPLOYMENT_DIR --endpoint-url $R2_URL --region auto
+              env:
+                  AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
+                  R2_URL: ${{ vars.CF_R2_S3_API }}
+                  DEPLOYMENT_DIR: ${{ needs.prepare.outputs.packages-dir }}
+
+            - name: Notify packages.element.io of new files
+              if: needs.prepare.outputs.deploy
+              uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570 # v2
+              with:
+                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  repository: element-hq/packages.element.io
+                  event-type: packages-index
+
+            - name: Find debs
+              id: deb
+              if: needs.linux.result == 'success'
+              run: |
+                  for arch in amd64 arm64
+                  do
+                      echo "$arch=$(ls linux-$arch-sqlcipher-system/*.deb | tail -n1)" >> $GITHUB_OUTPUT
+                  done
+
+            - name: Stash debs
+              if: ${{ !needs.prepare.outputs.deploy && needs.linux.result == 'success' }}
+              uses: actions/upload-artifact@v4
+              with:
+                  name: debs
+                  path: |
+                      ${{ steps.deb.outputs.amd64 }}
+                      ${{ steps.deb.outputs.arm64 }}
+
+            - name: Publish amd64 deb to packages.element.io
+              uses: element-hq/packages.element.io@master
+              if: needs.prepare.outputs.deploy && needs.linux.result == 'success'
+              with:
+                  file: ${{ steps.deb.outputs.amd64 }}
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  bucket-api: ${{ vars.CF_R2_S3_API }}
+                  bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  bucket-access-key: ${{ secrets.CF_R2_TOKEN }}
+
+            - name: Publish arm64 deb to packages.element.io
+              uses: element-hq/packages.element.io@master
+              if: needs.prepare.outputs.deploy && needs.linux.result == 'success'
+              with:
+                  file: ${{ steps.deb.outputs.arm64 }}
+                  github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  bucket-api: ${{ vars.CF_R2_S3_API }}
+                  bucket-key-id: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  bucket-access-key: ${{ secrets.CF_R2_TOKEN }}

.github/workflows/build_and_test.yaml

@@ -0,0 +1,178 @@
+name: Build and Test
+on:
+    pull_request: {}
+    push:
+        branches: [develop, staging, master]
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+jobs:
+    fetch:
+        uses: ./.github/workflows/build_prepare.yaml
+        with:
+            config: ${{ github.event.pull_request.base.ref == 'develop' && 'element.io/nightly' || 'element.io/release' }}
+            version: ${{ github.event.pull_request.base.ref == 'develop' && 'develop' || '' }}
+
+    windows:
+        needs: fetch
+        name: Windows
+        uses: ./.github/workflows/build_windows.yaml
+        strategy:
+            matrix:
+                arch: [x64, ia32]
+        with:
+            arch: ${{ matrix.arch }}
+
+    # This allows core contributors to test changes to the dockerbuild image within a pull request
+    linux_docker:
+        name: Linux docker
+        runs-on: ubuntu-latest
+        if: github.event_name == 'pull_request'
+        outputs:
+            docker-image: ${{ steps.docker.outputs.image }}
+        permissions:
+            contents: read
+            packages: write
+        env:
+            REGISTRY: ghcr.io
+            IMAGE_NAME: ${{ github.repository }}-dockerbuild-pr
+        steps:
+            - uses: actions/checkout@v4
+
+            - name: "Get modified files"
+              id: changed_files
+              uses: tj-actions/changed-files@716b1e13042866565e00e85fd4ec490e186c4a2f # v41
+              with:
+                  files: |
+                      dockerbuild/**
+            - name: Log in to the Container registry
+              if: steps.changed_files.outputs.any_modified == 'true'
+              uses: docker/login-action@3d58c274f17dffee475a5520cbe67f0a882c4dbb
+              with:
+                  registry: ${{ env.REGISTRY }}
+                  username: ${{ github.actor }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - id: docker
+              if: steps.changed_files.outputs.any_modified == 'true'
+              run: |
+                  echo "image=$IMAGE:$PR" >> $GITHUB_OUTPUT
+              env:
+                  IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+                  PR: ${{ github.event.pull_request.number }}
+
+            - name: Build and push Docker image
+              if: steps.changed_files.outputs.any_modified == 'true'
+              uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5
+              with:
+                  context: dockerbuild
+                  push: true
+                  tags: ${{ steps.docker.outputs.image }}
+
+    linux:
+        needs:
+            - fetch
+            - linux_docker
+        name: "Linux (${{ matrix.arch }}) (sqlcipher: ${{ matrix.sqlcipher }})"
+        uses: ./.github/workflows/build_linux.yaml
+        strategy:
+            matrix:
+                sqlcipher: [system, static]
+                arch: [amd64, arm64]
+                exclude:
+                    # FIXME: This combination yields a broken Seshat at this time
+                    # Errors at launch with `undefined symbol: PKCS5_PBKDF2_HMAC
+                    - arch: arm64
+                      sqlcipher: static
+        with:
+            config: ${{ github.event.pull_request.base.ref == 'develop' && 'element.io/nightly' || 'element.io/release' }}
+            sqlcipher: ${{ matrix.sqlcipher }}
+            docker-image: ${{ needs.linux_docker.outputs.docker-image }}
+            arch: ${{ matrix.arch }}
+
+    macos:
+        needs: fetch
+        name: macOS
+        uses: ./.github/workflows/build_macos.yaml
+
+    test:
+        needs:
+            - macos
+            - linux
+            - windows
+        strategy:
+            matrix:
+                include:
+                    - name: macOS Universal
+                      os: macos
+                      artifact: macos
+                      executable: "/Users/runner/Applications/Element.app/Contents/MacOS/Element"
+                      # We need to mount the DMG and copy the app to the Applications folder as a mounted DMG is
+                      # read-only and thus would not allow us to override the fuses as is required for Playwright.
+                      prepare_cmd: |
+                          hdiutil attach ./dist/*.dmg -mountpoint /Volumes/Element &&
+                          rsync -a /Volumes/Element/Element.app ~/Applications/ &&
+                          hdiutil detach /Volumes/Element
+                    - name: "Linux (amd64) (sqlcipher: system)"
+                      os: ubuntu
+                      artifact: linux-amd64-sqlcipher-system
+                      executable: "/opt/Element/element-desktop"
+                      prepare_cmd: "sudo apt install ./dist/*.deb"
+                    - name: "Linux (amd64) (sqlcipher: static)"
+                      os: ubuntu
+                      artifact: linux-amd64-sqlcipher-static
+                      executable: "/opt/Element/element-desktop"
+                      prepare_cmd: "sudo apt install ./dist/*.deb"
+                    - name: Windows (x86)
+                      os: windows
+                      artifact: win-ia32
+                      executable: "./dist/win-ia32-unpacked/Element.exe"
+                    - name: Windows (x64)
+                      os: windows
+                      artifact: win-x64
+                      executable: "./dist/win-unpacked/Element.exe"
+        name: Test ${{ matrix.name }}
+        runs-on: ${{ matrix.os }}-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: package.json
+                  cache: "yarn"
+
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - uses: actions/download-artifact@v4
+              with:
+                  name: ${{ matrix.artifact }}
+                  path: dist
+
+            - name: Prepare for tests
+              run: ${{ matrix.prepare_cmd }}
+              if: matrix.prepare_cmd
+
+            # We previously disabled the `EnableNodeCliInspectArguments` fuse, but Playwright requires
+            # it to be enabled to test Electron apps, so turn it back on.
+            - name: Set EnableNodeCliInspectArguments fuse enabled
+              run: $RUN_AS npx @electron/fuses write --app ${{ matrix.executable }} EnableNodeCliInspectArguments=on
+              shell: bash
+              env:
+                  # We need sudo on Linux as it is installed in /opt/
+                  RUN_AS: ${{ runner.os == 'Linux' && 'sudo' || '' }}
+
+            - name: Run tests
+              uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1
+              timeout-minutes: 5
+              with:
+                  run: "yarn test ${{ runner.os != 'Linux' && '--ignore-snapshots' || '' }}"
+              env:
+                  ELEMENT_DESKTOP_EXECUTABLE: ${{ matrix.executable }}
+
+            - name: Upload HTML report
+              uses: actions/upload-artifact@v4
+              with:
+                  name: ${{ matrix.artifact }}-test
+                  path: playwright-report
+                  retention-days: 14

.github/workflows/build_linux.yaml

@@ -0,0 +1,151 @@
+# This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
+# Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
+# the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
+on:
+    workflow_call:
+        inputs:
+            arch:
+                type: string
+                required: true
+                description: "The architecture to build for, one of 'amd64' | 'arm64'"
+            config:
+                type: string
+                required: true
+                description: "The config directory to use"
+            version:
+                type: string
+                required: false
+                description: "Version string to override the one in package.json, used for non-release builds"
+            sqlcipher:
+                type: string
+                required: true
+                description: "How to link sqlcipher, one of 'system' | 'static'"
+            docker-image:
+                type: string
+                required: false
+                description: "The docker image to use for the build, defaults to ghcr.io/element-hq/element-desktop-dockerbuild"
+jobs:
+    build:
+        runs-on: ubuntu-latest
+        container:
+            image: ${{ inputs.docker-image || format('ghcr.io/element-hq/element-desktop-dockerbuild:{0}', github.ref_name == 'master' && 'master' || 'develop') }}
+        defaults:
+            run:
+                shell: bash
+        steps:
+            - uses: kanga333/variable-mapper@master
+              id: config
+              with:
+                  key: "${{ inputs.arch }}"
+                  export_to: output
+                  map: |
+                      {
+                        "amd64": {
+                          "target": "x86_64-unknown-linux-gnu",
+                          "arch": "x86-64"
+                        },
+                        "arm64": {
+                          "target": "aarch64-unknown-linux-gnu",
+                          "arch": "aarch64",
+                          "build-args": "--arm64"
+                        }
+                      }
+
+            - uses: actions/checkout@v4
+
+            - uses: actions/download-artifact@v4
+              with:
+                  name: webapp
+
+            - name: Cache .hak
+              id: cache
+              uses: actions/cache@v3
+              with:
+                  key: ${{ runner.os }}-${{ inputs.docker-image || github.ref_name }}-${{ inputs.sqlcipher }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion') }}
+                  path: |
+                      ./.hak
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: package.json
+                  cache: "yarn"
+              env:
+                  # Workaround for https://github.com/actions/setup-node/issues/317
+                  FORCE_COLOR: 0
+
+            # Does not need branch matching as only analyses this layer
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - name: Prepare for static sqlcipher build
+              if: inputs.sqlcipher == 'static'
+              run: |
+                  echo "SQLCIPHER_BUNDLED=1" >> $GITHUB_ENV
+
+            # Ideally the docker image would be ready for cross-compilation but libsqlcipher-dev is not Multi-Arch compatible
+            # https://unix.stackexchange.com/a/349359
+            - name: Prepare for cross compilation
+              if: steps.cache.outputs.cache-hit != 'true' && inputs.arch == 'arm64'
+              run: |
+                  set -x
+                  dpkg --add-architecture arm64
+                  apt-get -qq update
+                  apt-get -qq install --no-install-recommends crossbuild-essential-arm64 libsqlcipher-dev:arm64 libssl-dev:arm64 libsecret-1-dev:arm64
+                  rustup target add aarch64-unknown-linux-gnu
+                  mv dockerbuild/aarch64/.cargo .
+                  cat dockerbuild/aarch64/.env >> $GITHUB_ENV
+
+            - name: Build Natives
+              if: steps.cache.outputs.cache-hit != 'true'
+              run: "yarn build:native --target ${{ steps.config.outputs.target }}"
+
+            - name: "[Nightly] Resolve version"
+              if: inputs.version != ''
+              run: |
+                  echo "ED_NIGHTLY=${{ inputs.version }}" >> $GITHUB_ENV
+
+            - name: Generate debian files and arguments
+              run: |
+                  if [ -f changelog.Debian ]; then
+                      echo "ED_DEBIAN_CHANGELOG=changelog.Debian" >> $GITHUB_ENV
+                  fi
+
+            - name: Build App
+              run: |
+                  yarn build --publish never -l ${{ steps.config.outputs.build-args }}
+
+            - name: Check native libraries
+              run: |
+                  set -x
+                  shopt -s globstar
+
+                  FILES=$(file dist/**/*.node)
+                  echo "$FILES"
+
+                  if [ grep -v "$ARCH" ]; then
+                      exit 1
+                  fi
+
+                  LIBS=$(readelf -d dist/**/*.node | grep NEEDED)
+                  echo "$LIBS"
+
+                  set +x
+                  assert_contains_string() { [[ "$1" == *"$2"* ]]; }
+                  ! assert_contains_string "$LIBS" "libcrypto.so.1.1"
+                  if [ "$SQLCIPHER_BUNDLED" == "1" ]; then
+                      ! assert_contains_string "$LIBS" "libsqlcipher.so.0"
+                  else
+                      assert_contains_string "$LIBS" "libsqlcipher.so.0"
+                  fi
+              env:
+                  ARCH: ${{ steps.config.outputs.arch }}
+
+            # We exclude *-unpacked as it loses permissions and the tarball contains it with correct permissions
+            - name: Upload Artifacts
+              uses: actions/upload-artifact@v4
+              with:
+                  name: linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
+                  path: |
+                      dist
+                      !dist/*-unpacked/**
+                  retention-days: 1

.github/workflows/build_macos.yaml

@@ -0,0 +1,138 @@
+# This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
+# Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
+# the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
+on:
+    workflow_call:
+        secrets:
+            APPLE_ID:
+                required: false
+            APPLE_ID_PASSWORD:
+                required: false
+            APPLE_TEAM_ID:
+                required: false
+            APPLE_CSC_KEY_PASSWORD:
+                required: false
+            APPLE_CSC_LINK:
+                required: false
+        inputs:
+            version:
+                type: string
+                required: false
+                description: "Version string to override the one in package.json, used for non-release builds"
+            sign:
+                type: string
+                required: false
+                description: "Whether to sign & notarise the build, requires 'packages.element.io' environment"
+            base-url:
+                type: string
+                required: false
+                description: "The URL to which the output will be deployed."
+jobs:
+    build:
+        runs-on: macos-latest
+        environment: ${{ inputs.sign && 'packages.element.io' || '' }}
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/download-artifact@v4
+              with:
+                  name: webapp
+
+            - name: Cache .hak
+              id: cache
+              uses: actions/cache@v3
+              with:
+                  key: ${{ runner.os }}-${{ hashFiles('hakHash', 'electronVersion') }}
+                  path: |
+                      ./.hak
+
+            - name: Install Rust
+              if: steps.cache.outputs.cache-hit != 'true'
+              run: |
+                  rustup toolchain install stable --profile minimal --no-self-update
+                  rustup default stable
+                  rustup target add aarch64-apple-darwin
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: package.json
+                  cache: "yarn"
+
+            # Does not need branch matching as only analyses this layer
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - name: Build Natives
+              if: steps.cache.outputs.cache-hit != 'true'
+              run: |
+                  # Python 3.12 drops distutils which keytar relies on
+                  pip3 install setuptools
+                  yarn build:native:universal
+
+            - name: "[Nightly] Resolve version"
+              if: inputs.version != ''
+              run: |
+                  echo "ED_NIGHTLY=${{ inputs.version }}" >> $GITHUB_ENV
+
+            # We split these because electron-builder gets upset if we set CSC_LINK even to an empty string
+            - name: "[Signed] Build App"
+              if: inputs.sign != ''
+              run: |
+                  yarn build:universal --publish never
+              env:
+                  ED_NOTARYTOOL_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+                  APPLE_ID: ${{ secrets.APPLE_ID }}
+                  APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
+                  CSC_KEY_PASSWORD: ${{ secrets.APPLE_CSC_KEY_PASSWORD }}
+                  CSC_LINK: ${{ secrets.APPLE_CSC_LINK }}
+
+            - name: Check app was signed & notarised successfully
+              if: inputs.sign != ''
+              run: |
+                  hdiutil attach dist/*.dmg -mountpoint /Volumes/Element
+                  codesign -dv --verbose=4 /Volumes/Element/*.app
+                  spctl -a -vvv -t install /Volumes/Element/*.app
+                  hdiutil detach /Volumes/Element
+
+            - name: "[Unsigned] Build App"
+              if: inputs.sign == ''
+              run: |
+                  yarn build:universal --publish never
+              env:
+                  CSC_IDENTITY_AUTO_DISCOVERY: false
+
+            - name: Generate releases.json
+              if: inputs.base-url
+              run: |
+                  PKG_JSON_VERSION=$(cat package.json | jq -r .version)
+                  LATEST=$(find dist -type f -iname "*-mac.zip" | xargs -0 -n1 -- basename)
+                  # Encode spaces in the URL as Squirrel.Mac complains about bad JSON otherwise
+                  URL="${{ inputs.base-url }}/update/macos/${LATEST// /%20}"
+
+                  jq -n --arg version "${VERSION:-$PKG_JSON_VERSION}" --arg url "$URL" '
+                    {
+                      currentRelease: $version,
+                      releases: [{
+                        version: $version,
+                        updateTo: {
+                          version: $version,
+                          url: $url,
+                        },
+                      }],
+                    }
+                  ' > dist/releases.json
+                  jq -n --arg url "$URL" '
+                    { url: $url }
+                  ' > dist/releases-legacy.json
+              env:
+                  VERSION: ${{ inputs.version }}
+
+            # We exclude mac-universal as the unpacked app takes forever to upload and zip and dmg already contains it
+            - name: Upload Artifacts
+              uses: actions/upload-artifact@v4
+              with:
+                  name: macos
+                  path: |
+                      dist
+                      !dist/mac-universal/**
+                  retention-days: 1

.github/workflows/build_prepare.yaml

@@ -0,0 +1,150 @@
+# This action helps perform common actions before the build_* actions are started in parallel.
+on:
+    workflow_call:
+        inputs:
+            config:
+                type: string
+                required: true
+                description: "The config directory to use"
+            version:
+                type: string
+                required: false
+                description: "The version tag to fetch, or 'develop', will pick automatically if not passed"
+            nightly:
+                type: boolean
+                required: false
+                default: false
+                description: "Whether the build is a Nightly and to calculate the version strings new builds should use"
+            deploy:
+                type: boolean
+                required: false
+                default: false
+                description: "Whether the build should be deployed to production"
+        secrets:
+            # Required if `nightly` is set
+            CF_R2_ACCESS_KEY_ID:
+                required: false
+            # Required if `nightly` is set
+            CF_R2_TOKEN:
+                required: false
+        outputs:
+            nightly-version:
+                description: "The version string the next Nightly should use, only output for nightly"
+                value: ${{ jobs.prepare.outputs.nightly-version }}
+            packages-dir:
+                description: "The directory non-deb packages for this run should live in within packages.element.io"
+                value: ${{ inputs.nightly && 'nightly' || 'desktop' }}
+            # These are just simple pass-throughs of the input to simplify reuse of complex inline conditions
+            config:
+                description: "The relative path to the config file for this run"
+                value: ${{ inputs.config }}
+            deploy:
+                description: "The relative path to the config file for this run"
+                value: ${{ inputs.deploy }}
+jobs:
+    prepare:
+        name: Prepare
+        environment: ${{ inputs.nightly && 'packages.element.io' || '' }}
+        runs-on: ubuntu-latest
+        outputs:
+            nightly-version: ${{ steps.versions.outputs.nightly }}
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: package.json
+                  cache: "yarn"
+
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - name: Fetch Element Web
+              run: yarn run fetch --noverify -d ${{ inputs.config }} ${{ inputs.version }}
+
+            # We split this out to save the build_* scripts having to do it to make use of `hashFiles` in the cache action
+            - name: Generate cache hash files
+              run: |
+                  yarn run --silent electron --version > electronVersion
+                  cat package.json | jq -c .hakDependencies | sha1sum > hakHash
+                  find hak -type f -print0 | xargs -0 sha1sum >> hakHash
+                  find scripts/hak -type f -print0 | xargs -0 sha1sum >> hakHash
+
+            - name: "[Nightly] Calculate version"
+              id: versions
+              if: inputs.nightly
+              run: |
+                  # Find all latest Nightly versions
+                  aws s3 cp s3://$R2_BUCKET/nightly/update/macos/releases.json - --endpoint-url $R2_URL --region auto | jq -r .currentRelease >> VERSIONS
+                  aws s3 cp s3://$R2_BUCKET/debian/dists/default/main/binary-amd64/Packages - --endpoint-url $R2_URL --region auto | grep "Package: element-nightly" -A 50 | grep Version -m1 | sed -n 's/Version: //p' >> VERSIONS
+                  aws s3 cp s3://$R2_BUCKET/debian/dists/default/main/binary-arm64/Packages - --endpoint-url $R2_URL --region auto | grep "Package: element-nightly" -A 50 | grep Version -m1 | sed -n 's/Version: //p' >> VERSIONS
+                  aws s3 cp s3://$R2_BUCKET/nightly/update/win32/x64/RELEASES - --endpoint-url $R2_URL --region auto | awk '{print $2}' | cut -d "-" -f 5 | cut -c 8- >> VERSIONS
+                  aws s3 cp s3://$R2_BUCKET/nightly/update/win32/ia32/RELEASES - --endpoint-url $R2_URL --region auto | awk '{print $2}' | cut -d "-" -f 5 | cut -c 8- >> VERSIONS
+
+                  # Pick the greatest one
+                  VERSION=$(cat VERSIONS | sort -uf | tail -n1)
+                  echo "Found latest nightly version $VERSION"
+                  # Increment it
+                  echo "nightly=$(scripts/generate-nightly-version.ts --latest $VERSION)" >> $GITHUB_OUTPUT
+              env:
+                  AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+                  AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_TOKEN }}
+                  R2_BUCKET: ${{ vars.R2_BUCKET }}
+                  R2_URL: ${{ vars.CF_R2_S3_API }}
+
+            - name: Check version
+              id: package
+              run: |
+                  echo "version=$(cat package.json | jq -r .version)" >> $GITHUB_OUTPUT
+
+            - name: "[Release] Fetch release"
+              id: release
+              if: ${{ !inputs.nightly && inputs.version != 'develop' }}
+              uses: cardinalby/git-get-release-action@cedef2faf69cb7c55b285bad07688d04430b7ada # v1
+              env:
+                  GITHUB_TOKEN: ${{ github.token }}
+              with:
+                  tag: v${{ steps.package.outputs.version }}
+
+            - name: "[Release] Write changelog"
+              if: ${{ !inputs.nightly && inputs.version != 'develop' }}
+              run: |
+                  TIME=$(date -d "$PUBLISHED_AT" -R)
+                  echo "element-desktop ($VERSION) default; urgency=medium" >> changelog.Debian
+                  echo "$BODY" | sed 's/^##/\n  */g;s/^\*/  */g' | perl -pe 's/\[.+?]\((.+?)\)/\1/g' >> changelog.Debian
+                  echo "" >> changelog.Debian
+                  echo " -- $ACTOR <support@element.io>  $TIME" >> changelog.Debian
+              env:
+                  ACTOR: ${{ github.actor }}
+                  VERSION: v${{ steps.package.outputs.version }}
+                  BODY: ${{ steps.release.outputs.body }}
+                  PUBLISHED_AT: ${{ steps.release.outputs.published_at }}
+
+            - name: "[Nightly] Write summary"
+              if: inputs.nightly
+              run: |
+                  BUNDLE_HASH=$(npx asar l webapp.asar | grep /bundles/ | head -n 1 | sed 's|.*/||')
+                  WEBAPP_VERSION=$(./scripts/get-version.ts)
+                  WEB_VERSION=${WEBAPP_VERSION:0:12}
+                  REACT_VERSION=${WEBAPP_VERSION:19:12}
+                  JS_VERSION=${WEBAPP_VERSION:35:12}
+
+                  echo "### Nightly build ${{ steps.versions.outputs.nightly }}" >> $GITHUB_STEP_SUMMARY
+                  echo "" >> $GITHUB_STEP_SUMMARY
+                  echo "| Component   | Version |" >> $GITHUB_STEP_SUMMARY
+                  echo "| ----------- | ------- |" >> $GITHUB_STEP_SUMMARY
+                  echo "| Bundle Hash | $BUNDLE_HASH |" >> $GITHUB_STEP_SUMMARY
+                  echo "| Element Web | [$WEB_VERSION](https://github.com/element-hq/element-web/commit/$WEB_VERSION) |" >> $GITHUB_STEP_SUMMARY
+                  echo "| React SDK   | [$REACT_VERSION](https://github.com/matrix-org/matrix-react-sdk/commit/$REACT_VERSION) |" >> $GITHUB_STEP_SUMMARY
+                  echo "| JS SDK      | [$JS_VERSION](https://github.com/matrix-org/matrix-js-sdk/commit/$JS_VERSION) |" >> $GITHUB_STEP_SUMMARY
+
+            - uses: actions/upload-artifact@v4
+              with:
+                  name: webapp
+                  retention-days: 1
+                  path: |
+                      webapp.asar
+                      package.json
+                      electronVersion
+                      hakHash
+                      changelog.Debian

.github/workflows/build_windows.yaml

@@ -0,0 +1,173 @@
+# This workflow relies on actions/cache to store the hak dependency artifacts as they take a long time to build
+# Due to this extra care must be taken to only ever run all build_* scripts against the same branch to ensure
+# the correct cache scoping, and additional care must be taken to not run untrusted actions on the develop branch.
+on:
+    workflow_call:
+        secrets:
+            ESIGNER_USER_NAME:
+                required: false
+            ESIGNER_USER_PASSWORD:
+                required: false
+            ESIGNER_USER_TOTP:
+                required: false
+        inputs:
+            arch:
+                type: string
+                required: true
+                description: "The architecture to build for, one of 'x64' | 'ia32' | 'arm64'"
+            version:
+                type: string
+                required: false
+                description: "Version string to override the one in package.json, used for non-release builds"
+            sign:
+                type: string
+                required: false
+                description: "Whether to sign & notarise the build, requires 'packages.element.io' environment"
+jobs:
+    build:
+        runs-on: windows-latest
+        environment: ${{ inputs.sign && 'packages.element.io' || '' }}
+        env:
+            SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.22000.0/x86/signtool.exe"
+        steps:
+            - uses: kanga333/variable-mapper@3681b75f5c6c00162721168fb91ab74925eaebcb
+              id: config
+              with:
+                  key: "${{ inputs.arch }}"
+                  export_to: output
+                  map: |
+                      {
+                        "x64": {
+                          "target": "x86_64-pc-windows-msvc"
+                        },
+                        "arm64": {
+                          "target": "aarch64-pc-windows-msvc",
+                          "build-args": "--arm64",
+                          "arch": "amd64_arm64"
+                        },
+                        "ia32": {
+                          "target": "i686-pc-windows-msvc",
+                          "build-args": "--ia32",
+                          "arch": "x86"
+                        }
+                      }
+
+            - uses: actions/checkout@v4
+
+            - uses: actions/download-artifact@v4
+              with:
+                  name: webapp
+
+            - name: Cache .hak
+              id: cache
+              uses: actions/cache@v3
+              with:
+                  key: ${{ runner.os }}-${{ inputs.arch }}-${{ hashFiles('hakHash', 'electronVersion') }}
+                  path: |
+                      ./.hak
+
+            - name: Set up build tools
+              uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
+              with:
+                  arch: ${{ steps.config.outputs.arch || inputs.arch }}
+
+            # ActiveTCL package on choco is from 2015,
+            # this one is newer but includes more than we need
+            - name: Choco install tclsh
+              if: steps.cache.outputs.cache-hit != 'true'
+              shell: pwsh
+              run: |
+                  choco install -y magicsplat-tcl-tk --no-progress
+                  echo "${HOME}/AppData/Local/Apps/Tcl86/bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+
+            - name: Choco install NetWide Assembler
+              if: steps.cache.outputs.cache-hit != 'true'
+              shell: pwsh
+              run: |
+                  choco install -y nasm --no-progress
+                  echo "C:/Program Files/NASM" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+
+            - name: Install Rust
+              if: steps.cache.outputs.cache-hit != 'true'
+              run: |
+                  rustup toolchain install stable --profile minimal --no-self-update
+                  rustup default stable
+                  rustup target add ${{ steps.config.outputs.target }}
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: package.json
+                  cache: "yarn"
+
+            # Does not need branch matching as only analyses this layer
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - name: Build Natives
+              if: steps.cache.outputs.cache-hit != 'true'
+              run: |
+                  refreshenv
+                  yarn build:native --target ${{ steps.config.outputs.target }}
+
+            - name: Install and configure eSigner CKA
+              if: inputs.sign
+              run: |
+                  Set-StrictMode -Version 'Latest'
+
+                  # Download
+                  Invoke-WebRequest -OutFile eSigner_CKA.exe "https://packages.element.io/tools/SSL.COM%20eSigner%20CKA_1.0.4-build-20230221_signed.exe"
+
+                  # Install
+                  New-Item -ItemType Directory -Force -Path "$env:INSTALL_DIR"
+                  ./eSigner_CKA.exe /CURRENTUSER /VERYSILENT /SUPPRESSMSGBOXES /DIR="${{ env.INSTALL_DIR }}" | Out-Null
+
+                  # Disable logger
+                  $LogConfig = Get-Content -Path ${{ env.INSTALL_DIR }}/log4net.config
+                  $LogConfig[0] = '<log4net threshold="OFF">'
+                  $LogConfig | Set-Content -Path ${{ env.INSTALL_DIR }}/log4net.config
+
+                  # Configure
+                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe config -mode product -user "${{ secrets.ESIGNER_USER_NAME }}" -pass "${{ secrets.ESIGNER_USER_PASSWORD }}" -totp "${{ secrets.ESIGNER_USER_TOTP }}" -key "${{ env.MASTER_KEY_FILE }}" -r
+                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe unload
+                  ${{ env.INSTALL_DIR }}/eSignerCKATool.exe load
+
+                  # Find certificate
+                  $CodeSigningCert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Select-Object -First 1
+                  echo Certificate: $CodeSigningCert
+
+                  # Extract thumbprint and subject name
+                  $Thumbprint = $CodeSigningCert.Thumbprint
+                  $SubjectName = ($CodeSigningCert.Subject -replace ", ?", "`n" | ConvertFrom-StringData).CN
+
+                  echo "ED_SIGNTOOL_THUMBPRINT=$Thumbprint" >> $env:GITHUB_ENV
+                  echo "ED_SIGNTOOL_SUBJECT_NAME=$SubjectName" >> $env:GITHUB_ENV
+              env:
+                  INSTALL_DIR: C:\Users\runneradmin\eSignerCKA
+                  MASTER_KEY_FILE: C:\Users\runneradmin\eSignerCKA\master.key
+
+            - name: "[Nightly] Resolve version"
+              if: inputs.version != ''
+              shell: bash
+              run: |
+                  echo "ED_NIGHTLY=${{ inputs.version }}" >> $GITHUB_ENV
+
+            # XXX: For whatever reason if we use `yarn build ...` it freezes, but splitting it into parts it is fine
+            - run: yarn run build:ts
+            - run: yarn run build:res
+
+            - name: Build App
+              run: |
+                  yarn electron-builder --publish never -w ${{ steps.config.outputs.build-args }}
+
+            - name: Check app was signed successfully
+              if: inputs.sign != ''
+              run: |
+                  . "$env:SIGNTOOL_PATH" verify /pa (get-item ./dist/squirrel-windows*/*.exe)
+
+            - name: Upload Artifacts
+              uses: actions/upload-artifact@v4
+              with:
+                  name: win-${{ inputs.arch }}
+                  path: |
+                      dist
+                  retention-days: 1

.github/workflows/dockerbuild.yaml

@@ -0,0 +1,43 @@
+name: Dockerbuild
+on:
+    workflow_dispatch: {}
+    push:
+        branches: [master, develop]
+        paths:
+            - "dockerbuild/**"
+concurrency: ${{ github.workflow }}-${{ github.ref_name }}
+env:
+    REGISTRY: ghcr.io
+    IMAGE_NAME: ${{ github.repository }}-dockerbuild
+jobs:
+    build:
+        name: Docker Build
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            packages: write
+        steps:
+            - uses: actions/checkout@v4
+
+            - name: Log in to the Container registry
+              uses: docker/login-action@3d58c274f17dffee475a5520cbe67f0a882c4dbb
+              with:
+                  registry: ${{ env.REGISTRY }}
+                  username: ${{ github.actor }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Extract metadata for Docker
+              id: meta
+              uses: docker/metadata-action@31cebacef4805868f9ce9a0cb03ee36c32df2ac4
+              with:
+                  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+                  tags: |
+                      type=ref,event=branch
+
+            - name: Build and push Docker image
+              uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5
+              with:
+                  context: dockerbuild
+                  push: true
+                  tags: ${{ steps.meta.outputs.tags }}
+                  labels: ${{ steps.meta.outputs.labels }}

.github/workflows/localazy_download.yaml

@@ -0,0 +1,10 @@
+name: Localazy Download
+on:
+    workflow_dispatch: {}
+    schedule:
+        - cron: "0 6 * * 1,3,5" # Every Monday, Wednesday and Friday at 6am UTC
+jobs:
+    download:
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@main
+        secrets:
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/localazy_upload.yaml

@@ -0,0 +1,11 @@
+name: Localazy Upload
+on:
+    push:
+        branches: [develop]
+        paths:
+            - "src/i18n/strings/en_EN.json"
+jobs:
+    upload:
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@main
+        secrets:
+            LOCALAZY_WRITE_KEY: ${{ secrets.LOCALAZY_WRITE_KEY }}

.github/workflows/pull_request.yaml

@@ -0,0 +1,9 @@
+name: Pull Request
+on:
+    pull_request_target:
+        types: [opened, edited, labeled, unlabeled, synchronize]
+jobs:
+    action:
+        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop
+        secrets:
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/release-drafter.yml

@@ -0,0 +1,21 @@
+name: Release Drafter
+on:
+    push:
+        branches: [staging]
+    workflow_dispatch:
+        inputs:
+            previous-version:
+                description: What release to use as a base for release note purposes
+                required: false
+                type: string
+concurrency: ${{ github.workflow }}
+jobs:
+    draft:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: release-drafter/release-drafter@e64b19c4c46173209ed9f2e5a2f4ca7de89a0e86 # v5
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+              with:
+                  disable-autolabeler: true
+                  previous-version: ${{ inputs.previous-version }}

.github/workflows/release-gitflow.yml

@@ -0,0 +1,11 @@
+# Gitflow merge-back master->develop
+name: Merge master -> develop
+on:
+    push:
+        branches: [master]
+concurrency: ${{ github.repository }}-${{ github.workflow }}
+jobs:
+    merge:
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop
+        secrets:
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,25 @@
+name: Release Process
+on:
+    workflow_dispatch:
+        inputs:
+            mode:
+                description: What type of release
+                required: true
+                default: rc
+                type: choice
+                options:
+                    - rc
+                    - final
+concurrency: ${{ github.workflow }}
+jobs:
+    release:
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop
+        secrets:
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
+            GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+            GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+        with:
+            final: ${{ inputs.mode == 'final' }}
+            include-changes: element-hq/element-web@$VERSION
+            gpg-fingerprint: ${{ vars.GPG_FINGERPRINT }}
+            expected-asset-count: 1

.github/workflows/static_analysis.yaml

@@ -0,0 +1,80 @@
+name: Static Analysis
+on:
+    pull_request: {}
+    push:
+        branches: [develop, master]
+jobs:
+    ts_lint:
+        name: "Typescript Syntax Check"
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: package.json
+                  cache: "yarn"
+
+            # Does not need branch matching as only analyses this layer
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - name: Typecheck
+              run: "yarn run lint:types"
+
+    i18n_lint:
+        name: "i18n Check"
+        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@main
+
+    js_lint:
+        name: "ESLint"
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: package.json
+                  cache: "yarn"
+
+            # Does not need branch matching as only analyses this layer
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - name: Run Linter
+              run: "yarn run lint:js"
+
+    workflow_lint:
+        name: "Workflow Lint"
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: package.json
+                  cache: "yarn"
+
+            # Does not need branch matching as only analyses this layer
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - name: Run Linter
+              run: "yarn lint:workflows"
+
+    analyse_dead_code:
+        name: "Analyse Dead Code"
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/setup-node@v4
+              with:
+                  node-version-file: package.json
+                  cache: "yarn"
+
+            - name: Install Deps
+              run: "yarn install --frozen-lockfile"
+
+            - name: Run linter
+              run: "yarn run lint:knip"

.github/workflows/sync-labels.yml

@@ -0,0 +1,21 @@
+name: Sync labels
+on:
+    workflow_dispatch: {}
+    schedule:
+        - cron: "0 2 * * *" # 2am every day
+    push:
+        branches:
+            - develop
+        paths:
+            - .github/labels.yml
+jobs:
+    sync-labels:
+        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@develop
+        with:
+            LABELS: |
+                element-hq/element-web
+                .github/labels.yml
+            DELETE: true
+            WET: true
+        secrets:
+            ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/triage-labelled.yml

@@ -0,0 +1,10 @@
+name: Move labelled issues to correct projects
+
+on:
+    issues:
+        types: [labeled]
+
+jobs:
+    call-triage-labelled:
+        uses: element-hq/element-web/.github/workflows/triage-labelled.yml@develop
+        secrets: inherit

.gitignore

@@ -1,12 +1,19 @@
 /dist
+/lib
 /webapp
 /webapp.asar
 /packages
 /deploys
-/node_modules
-/docker_node_modules
+node_modules/
 /pkg/control
 /.hak
 /.yarnrc
 /docker
 /.npmrc
+.vscode
+.vscode/
+/test_artifacts/
+/coverage/
+yarn-error.log
+/hak/**/*.js
+/scripts/hak/**/*.js

.prettierignore

@@ -0,0 +1,21 @@
+/build/
+/dockerbuild/
+/lib/
+/node_modules/
+/packages.elememt.io/
+/webapp
+/src/i18n/strings
+/CHANGELOG.md
+/package-lock.json
+/yarn.lock
+/playwright/html-report
+/playwright/test-results
+
+**/.idea
+.vscode
+.vscode/
+.tmp
+.env
+/coverage
+/.npmrc
+/*.log

.prettierrc.js

@@ -0,0 +1 @@
+module.exports = require("eslint-plugin-matrix-org/.prettierrc.js");

README.md

@@ -1,18 +1,24 @@
-Element Desktop
-===============
+![Build](https://github.com/vector-im/element-desktop/actions/workflows/build.yaml/badge.svg)
+![Static Analysis](https://github.com/vector-im/element-desktop/actions/workflows/static_analysis.yaml/badge.svg)
+[![Localazy](https://img.shields.io/endpoint?url=https%3A%2F%2Fconnect.localazy.com%2Fstatus%2Felement-web%2Fdata%3Fcontent%3Dall%26title%3Dlocalazy%26logo%3Dtrue)](https://localazy.com/p/element-web)
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=element-desktop&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=element-desktop)
+[![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=element-desktop&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=element-desktop)
+[![Bugs](https://sonarcloud.io/api/project_badges/measure?project=element-desktop&metric=bugs)](https://sonarcloud.io/summary/new_code?id=element-desktop)
+
+# Element Desktop
 
 Element Desktop is a Matrix client for desktop platforms with Element Web at its core.
 
-First Steps
-===========
+# First Steps
+
 Before you do anything else, fetch the dependencies:
 
 ```
 yarn install
 ```
 
-Fetching Element
-================
+# Fetching Element
+
 Since this package is just the Electron wrapper for Element Web, it doesn't contain any of the Element Web code,
 so the first step is to get a working copy of Element Web. There are a few ways of doing this:
 
@@ -20,28 +26,31 @@ so the first step is to get a working copy of Element Web. There are a few ways
 # Fetch the prebuilt release Element package from the element-web GitHub releases page. The version
 # fetched will be the same as the local element-desktop package.
 # We're explicitly asking for no config, so the packaged Element will have no config.json.
-yarn run fetch --noverify --cfgdir ''
+yarn run fetch --noverify --cfgdir ""
 ```
 
 ...or if you'd like to use GPG to verify the downloaded package:
+
 ```
 # Fetch the Element public key from the element.io web server over a secure connection and import
 # it into your local GPG keychain (you'll need GPG installed). You only need to to do this
 # once.
 yarn run fetch --importkey
 # Fetch the package and verify the signature
-yarn run fetch --cfgdir ''
+yarn run fetch --cfgdir ""
 ```
 
 ...or either of the above, but fetching a specific version of Element:
+
 ```
 # Fetch the prebuilt release Element package from the element-web GitHub releases page. The version
 # fetched will be the same as the local element-desktop package.
-yarn run fetch --noverify --cfgdir '' v1.5.6
+yarn run fetch --noverify --cfgdir "" v1.5.6
 ```
 
 If you only want to run the app locally and don't need to build packages, you can
 provide the `webapp` directory directly:
+
 ```
 # Assuming you've checked out and built a copy of element-web in ../element-web
 ln -s ../element-web/webapp ./
@@ -49,62 +58,48 @@ ln -s ../element-web/webapp ./
 
 [TODO: add support for fetching develop builds, arbitrary URLs and arbitrary paths]
 
+# Building
 
-Building
-========
-Now you have a copy of Element, you're ready to build packages. If you'd just like to
-run Element locally, skip to the next section.
+## Native Build
 
-If you'd like to build the native modules (for searching in encrypted rooms and
-secure storage), do this first. This will take 10 minutes or so, and will
-require a number of native tools to be installed, depending on your OS (eg.
-rust, tcl, make/nmake). If you don't need these features, you can skip this
-step.
-```
-yarn run build:native
-```
+TODO: List native pre-requisites
 
-On Windows, this will automatically determine the architecture to build for based
-on the environment (ie. set up by vcvarsall.bat).
+Optionally, [build the native modules](https://github.com/vector-im/element-desktop/blob/develop/docs/native-node-modules.md),
+which include support for searching in encrypted rooms and secure storage. Skipping this step is fine, you just won't have those features.
 
-Now you can build the package:
+Then, run
 
 ```
 yarn run build
 ```
+
 This will do a couple of things:
- * Run the `setversion` script to set the local package version to match whatever
-   version of Element you installed above.
- * Run electron-builder to build a package. The package built will match the operating system
-   you're running the build process on.
 
-If you're on Windows, you can choose to build specifically for 32 or 64 bit:
-```
-yarn run build32
-```
-or
-```
-yarn run build64
-```
+-   Run the `setversion` script to set the local package version to match whatever
+    version of Element you installed above.
+-   Run electron-builder to build a package. The package built will match the operating system
+    you're running the build process on.
 
-This build step will not build any native modules.
+## Docker
+
+Alternatively, you can also build using docker, which will always produce the linux package:
 
-You can also build using docker, which will always produce the linux package:
 ```
 # Run this once to make the docker image
 yarn run docker:setup
 
 yarn run docker:install
 # if you want to build the native modules (this will take a while)
-yarn run docker:buildnative
+yarn run docker:build:native
 yarn run docker:build
 ```
 
 After running, the packages should be in `dist/`.
 
-Starting
-========
+# Starting
+
 If you'd just like to run the electron app locally for development:
+
 ```
 # Install electron - we don't normally need electron itself as it's provided
 # by electron-builder when building packages
@@ -112,21 +107,22 @@ yarn add electron
 yarn start
 ```
 
-Config
-======
+# Config
+
 If you'd like the packaged Element to have a configuration file, you can create a
 config directory and place `config.json` in there, then specify this directory
 with the `--cfgdir` option to `yarn run fetch`, eg:
+
 ```
 mkdir myconfig
 cp /path/to/my/config.json myconfig/
 yarn run fetch --cfgdir myconfig
 ```
+
 The config dir for the official Element app is in `element.io`. If you use this,
 your app will auto-update itself using builds from element.io.
 
-Profiles
-========
+# Profiles
 
 To run multiple instances of the desktop app for different accounts, you can
 launch the executable with the `--profile` argument followed by a unique
@@ -136,21 +132,25 @@ not interfere with the default one.
 Alternatively, a custom location for the profile data can be specified using the
 `--profile-dir` flag followed by the desired path.
 
-User-specified config.json
-==========================
+# User-specified config.json
 
-+ `%APPDATA%\$NAME\config.json` on Windows
-+ `$XDG_CONFIG_HOME\$NAME\config.json` or `~/.config/$NAME/config.json` on Linux
-+ `~/Library/Application Support/$NAME/config.json` on macOS
+-   `%APPDATA%\$NAME\config.json` on Windows
+-   `$XDG_CONFIG_HOME/$NAME/config.json` or `~/.config/$NAME/config.json` on Linux
+-   `~/Library/Application Support/$NAME/config.json` on macOS
 
 In the paths above, `$NAME` is typically `Element`, unless you use `--profile
 $PROFILE` in which case it becomes `Element-$PROFILE`, or it is using one of
 the above created by a pre-1.7 install, in which case it will be `Riot` or
 `Riot-$PROFILE`.
 
-Report bugs & give feedback
-==========================
+# Translations
+
+To add a new translation, head to the [translating doc](https://github.com/vector-im/element-web/blob/develop/docs/translating.md).
+
+For a developer guide, see the [translating dev doc](https://github.com/vector-im/element-web/blob/develop/docs/translating-dev.md).
+
+# Report bugs & give feedback
 
 If you run into any bugs or have feedback you'd like to share, please let us know on GitHub.
 
-To help avoid duplicate issues, please [view existing issues](https://github.com/vector-im/element-web/issues?q=is%3Aopen+is%3Aissue+sort%3Areactions-%2B1-desc) first (and add a +1) or [create a new issue](https://github.com/vector-im/element-web/issues/new/choose) if you can't find it.  Please note that this issue tracker is associated with the [element-web](https://github.com/vector-im/element-web) repo, but is also applied to the code in this repo as well.
+To help avoid duplicate issues, please [view existing issues](https://github.com/vector-im/element-web/issues?q=is%3Aopen+is%3Aissue+sort%3Areactions-%2B1-desc) first (and add a +1) or [create a new issue](https://github.com/vector-im/element-web/issues/new/choose) if you can't find it. Please note that this issue tracker is associated with the [element-web](https://github.com/vector-im/element-web) repo, but is also applied to the code in this repo as well.

babel.config.js

@@ -0,0 +1,3 @@
+module.exports = {
+    presets: [["@babel/preset-env", { targets: { node: "current" } }], "@babel/preset-typescript"],
+};

build/rebrand_stub/rebrand_stub.c

@@ -1,51 +0,0 @@
-#include <windows.h>
-#include <stdio.h>
-#include <string.h>
-#include <tchar.h>
-
-/*
- * This just runs 'Element.exe' with the same args as
- * this process was invoked with. This gets around the fact that
- * squirrel always tries to run an executable with the same name,
- * so fails to restart if the app's name has changed.
- */
-void _tmain( int argc, TCHAR *argv[] )
-{
-    LPSTR myCmdLine = GetCommandLineA();
-    char cmdLine[32767];
-
-    LPSTR cmdLinePos = cmdLine;
-    LPSTR toRun = "\"Element.exe\" ";
-    strncpy(cmdLinePos, toRun, strlen(toRun));
-    cmdLinePos += strlen(toRun);
-
-    if (myCmdLine[0] == '"') ++myCmdLine;
-    myCmdLine += strlen(argv[0]);
-    if (myCmdLine[0] == '"') ++myCmdLine;
-    if (myCmdLine[0] == ' ') ++myCmdLine;
-
-    strncpy(cmdLinePos, myCmdLine, (cmdLine + 32767) - cmdLinePos);
-
-    STARTUPINFO si;
-    PROCESS_INFORMATION pi;
-
-    ZeroMemory(&si, sizeof(si));
-    si.cb = sizeof(si);
-    ZeroMemory(&pi, sizeof(pi));
-
-    if (!CreateProcess(NULL,
-        cmdLine,        // Command line
-        NULL,           // Process handle not inheritable
-        NULL,           // Thread handle not inheritable
-        FALSE,          // Set handle inheritance to FALSE
-        0,              // No creation flags
-        NULL,           // Use parent's environment block
-        NULL,           // Use parent's starting directory 
-        &si,            // Pointer to STARTUPINFO structure
-        &pi )           // Pointer to PROCESS_INFORMATION structure
-    ) 
-    {
-        printf("CreateProcess failed (%d).\n", GetLastError());
-        return;
-    }
-}

dockerbuild/Dockerfile

@@ -1,19 +1,23 @@
-FROM buildpack-deps:xenial-curl
+# Docker image to facilitate building Element Desktop with native bits using a glibc version with broader compatibility
+FROM buildpack-deps:buster-curl
 
 ENV DEBIAN_FRONTEND noninteractive
 
-RUN curl -L https://yarnpkg.com/latest.tar.gz | tar xvz && mv yarn-* /yarn && ln -s /yarn/bin/yarn /usr/bin/yarn
+RUN curl --proto "=https" -L https://yarnpkg.com/latest.tar.gz | tar xvz && mv yarn-* /yarn && ln -s /yarn/bin/yarn /usr/bin/yarn
 RUN apt-get -qq update && apt-get -qq dist-upgrade && \
   # add repo for git-lfs
   curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash && \
   # git ssh for using as docker image on CircleCI
   # python for node-gyp
   # rpm is required for FPM to build rpm package
-  # libsecret-1-dev and libgnome-keyring-dev are required even for prebuild keytar
-  apt-get -qq install --no-install-recommends qtbase5-dev bsdtar build-essential autoconf libssl-dev gcc-multilib g++-multilib lzip rpm python libcurl3 git git-lfs ssh unzip \
-  libsecret-1-dev libgnome-keyring-dev \
+  # tclsh is required for building SQLite as part of SQLCipher
+  # libsecret-1-dev is required even for prebuild keytar
+  apt-get -qq install --no-install-recommends qtbase5-dev bsdtar build-essential autoconf libssl-dev gcc-multilib g++-multilib lzip rpm python libcurl4 git git-lfs ssh unzip tcl \
+  libsecret-1-dev \
   libopenjp2-tools \
-  # Used by Seshat
+  # Used by github actions \
+  jq grep file \
+  # Used by seshat (when not SQLCIPHER_STATIC) \
   libsqlcipher-dev && \
   # git-lfs
   git lfs install && \
@@ -30,10 +34,10 @@ ENV LC_ALL C.UTF-8
 
 ENV DEBUG_COLORS true
 ENV FORCE_COLOR true
-ENV NODE_VERSION 12.16.1
+ENV NODE_VERSION 16.18.1
 
 # this package is used for snapcraft and we should not clear apt list - to avoid apt-get update during snap build
-RUN curl -L https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-x64.tar.gz | tar xz -C /usr/local --strip-components=1 && \
+RUN curl --proto "=https" -L https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-x64.tar.gz | tar xz -C /usr/local --strip-components=1 && \
   unlink /usr/local/CHANGELOG.md && unlink /usr/local/LICENSE && unlink /usr/local/README.md && \
   # https://github.com/npm/npm/issues/4531
   npm config set unsafe-perm true

dockerbuild/aarch64/.cargo/config.toml

@@ -0,0 +1,3 @@
+[target.aarch64-unknown-linux-gnu]
+linker = "aarch64-linux-gnu-gcc"
+rustflags = ["-L/usr/lib/aarch64-linux-gnu"]

dockerbuild/aarch64/.env

@@ -0,0 +1,11 @@
+AS=/usr/bin/aarch64-linux-gnu-as
+STRIP=/usr/bin/aarch64-linux-gnu-strip
+AR=/usr/bin/aarch64-linux-gnu-ar
+CC=/usr/bin/aarch64-linux-gnu-gcc
+CPP=/usr/bin/aarch64-linux-gnu-cpp
+CXX=/usr/bin/aarch64-linux-gnu-g++
+LD=/usr/bin/aarch64-linux-gnu-ld
+FC=/usr/bin/aarch64-linux-gnu-gfortran
+PKG_CONFIG_PATH=/usr/lib/aarch64-linux-gnu/pkgconfig
+CFLAGS=-L/usr/lib/aarch64-linux-gnu
+RUSTFLAGS=-L/usr/lib/aarch64-linux-gnu

docs/SUMMARY.md

@@ -0,0 +1,17 @@
+# Summary
+
+-   [Introduction](../README.md)
+
+# Build
+
+-   [Native Node modules](native-node-modules.md)
+-   [Windows requirements](windows-requirements.md)
+
+# Distribution
+
+-   [Updates](updates.md)
+-   [Packaging](packaging.md)
+
+# Setup
+
+-   [Config](config.md)

docs/config.md

@@ -0,0 +1,15 @@
+# Configuration
+
+All Element Web options documented [here](https://github.com/vector-im/element-web/blob/develop/docs/config.md) can be used as well as the following:
+
+---
+
+The app contains a configuration file specified at build time using [these instructions](https://github.com/vector-im/element-desktop/#config).
+This config can be overwritten by the end using by creating a `config.json` file at the paths described [here](https://github.com/vector-im/element-desktop/#user-specified-configjson).
+
+After changing the config, the app will need to be exited fully (including via the task tray) and re-started.
+
+---
+
+1. `update_base_url`: Specifies the URL of the update server, see [document](https://github.com/vector-im/element-desktop/blob/develop/docs/updates.md).
+2. `web_base_url`: Specifies the Element Web URL when performing actions such as popout widget. Defaults to `https://app.element.io/`.

docs/native-node-modules.md

@@ -0,0 +1,157 @@
+# Native Node Modules
+
+For some features, the desktop version of Element can make use of native Node
+modules. These allow Element to integrate with the desktop in ways that a browser
+cannot.
+
+While native modules enable powerful new features, they must be complied for
+each operating system. For official Element releases, we will always build these
+modules from source to ensure we can trust the compiled output. In the future,
+we may offer a pre-compiled path for those who want to use these features in a
+custom build of Element without installing the various build tools required.
+
+The process is automated by [vector-im/element-builder](https://github.com/vector-im/element-builder)
+when releasing.
+
+## Building
+
+Install the pre-requisites for your system:
+
+-   [Windows pre-requisites](https://github.com/vector-im/element-desktop/blob/develop/docs/windows-requirements.md)
+-   Linux: TODO
+-   OS X: TODO
+
+Then optionally, [add seshat and dependencies to support search in E2E rooms](#adding-seshat-for-search-in-e2e-encrypted-rooms).
+
+Then, to build for an architecture selected automatically based on your system (recommended), run:
+
+```
+yarn run build:native
+```
+
+If you need to build for a specific architecture, see [here](#compiling-for-specific-architectures).
+
+## Adding Seshat for search in E2E encrypted rooms
+
+Seshat is a native Node module that adds support for local event indexing and
+full text search in E2E encrypted rooms.
+
+Since Seshat is written in Rust, the Rust compiler and related tools need to be
+installed before installing Seshat itself. To install Rust please consult the
+official Rust [documentation](https://www.rust-lang.org/tools/install).
+
+Seshat also depends on the SQLCipher library to store its data in encrypted form
+on disk. You'll need to install it via your OS package manager.
+
+After installing the Rust compiler and SQLCipher, Seshat support can be added
+using yarn at the root of this project:
+
+    yarn add matrix-seshat
+
+You will have to rebuild the native libraries against electron's version
+of node rather than your system node, using the `electron-build-env` tool.
+This is also needed to when pulling in changes to Seshat using `yarn link`.
+
+    yarn add electron-build-env
+
+Recompiling Seshat itself can be done like so:
+
+    yarn run electron-build-env -- --electron 6.1.1 -- neon build matrix-seshat --release
+
+Please make sure to include all the `--` as well as the `--release` command line
+switch at the end. Modify your electron version accordingly depending on the
+version that is installed on your system.
+
+After this is done the Electron version of Element can be run from the main folder
+as usual using:
+
+    yarn start
+
+### Statically linking libsqlcipher
+
+On Windows & macOS we always statically link libsqlcipher for it is not generally available.
+On Linux by default we will use a system package, on debian & ubuntu this is `libsqlcipher0`,
+but this is problematic for some other packages, and we found that it may crashes for unknown reasons.
+By including `SQLCIPHER_BUNDLED=1` in the build environment, the build scripts will fully statically
+link sqlcipher, including a static build of OpenSSL.
+
+More info can be found at https://github.com/matrix-org/seshat/issues/102
+and https://github.com/vector-im/element-web/issues/20926.
+
+## Compiling for specific architectures
+
+### macOS
+
+On macOS, you can build universal native modules too:
+
+```
+yarn run build:native:universal
+```
+
+...or you can build for a specific architecture:
+
+```
+yarn run build:native --target x86_64-apple-darwin
+```
+
+or
+
+```
+yarn run build:native --target aarch64-apple-darwin
+```
+
+You'll then need to create a built bundle with the same architecture.
+To bundle a universal build for macOS, run:
+
+```
+yarn run build:universal
+```
+
+### Windows
+
+If you're on Windows, you can choose to build specifically for 32 or 64 bit:
+
+```
+yarn run build:32
+```
+
+or
+
+```
+yarn run build:64
+```
+
+### Cross compiling
+
+Compiling a module for a particular operating system (Linux/macOS/Windows) needs
+to be done on that operating system. Cross-compiling from a host OS for a different
+target OS may be possible, but we don't support this flow with Element dependencies
+at this time.
+
+### Switching between architectures
+
+The native module build system keeps the different architectures
+separate, so you can keep native modules for several architectures at the same
+time and switch which are active using a `yarn run hak copy` command, passing
+the appropriate architectures. This will error if you haven't yet built those
+architectures. eg:
+
+```
+yarn run build:native --target x86_64-apple-darwin
+# We've now built & linked into place native modules for Intel
+yarn run build:native --target aarch64-apple-darwin
+# We've now built Apple Silicon modules too, and linked them into place as the active ones
+
+yarn run hak copy --target x86_64-apple-darwin
+# We've now switched back to our Intel modules
+yarn run hak copy --target x86_64-apple-darwin --target aarch64-apple-darwin
+# Now our native modules are universal x86_64+aarch64 binaries
+```
+
+The current set of native modules are stored in `.hak/hakModules`,
+so you can use this to check what architecture is currently in place, eg:
+
+```
+$ lipo -info .hak/hakModules/keytar/build/Release/keytar.node
+Architectures in the fat file: .hak/hakModules/keytar/build/Release/keytar.node are: x86_64 arm64
+```

docs/packaging.md

@@ -0,0 +1,60 @@
+## Packaging nightlies
+
+Element Desktop nightly builds are build automatically by the [Github Actions workflow](https://github.com/vector-im/element-desktop/blob/develop/.github/workflows/build_and_deploy.yaml).
+The schedule is currently set for once a day at 9am UTC. It will deploy to packages.element.io upon completion.
+
+## Triggering a manual nightly build
+
+Simply go to https://github.com/vector-im/element-desktop/actions/workflows/build_and_deploy.yaml
+
+1. Click `Run workflow`
+1. Feel free to make changes to the checkboxes depending on the circumstances
+1. Click the green `Run workflow`
+
+## Packaging releases
+
+**Don't do this for RCs! We don't build Element Desktop for RCs.**
+
+For releasing Element Desktop, we assume the following prerequisites:
+
+-   a tag of `element-desktop` repo with the Element Desktop version to be released set in `package.json`.
+-   an Element Web tarball published to GitHub with a matching version number.
+
+**Both of these are done automatically when you run the release automation.**
+
+Once those are ready, the **manual** release build can be manually invoked using https://github.com/vector-im/element-desktop/actions/workflows/build_and_deploy.yaml
+
+1. Click `Run workflow`
+1. Specify the `master` branch
+1. Switch type to release
+1. Click the green `Run workflow`
+
+### More detail on the github actions
+
+We moved to Github Actions for the following reasons:
+
+1. Removing single point of failure
+2. Improving reliability
+3. Unblocking the packaging on a single individual
+4. Improving parallelism
+
+The Windows builds are signed by SSL.com using their Cloud Key Adapter for eSigner.
+This allows us to use Microsoft's signtool to interface with eSigner and send them a hash of the exe along with
+credentials in exchange for a signed certificate which we attach onto all the relevant files.
+
+The Apple builds are signed using standard code signing means and then notarised to appease GateKeeper.
+
+The Linux builds are distributed via a signed reprepro repository.
+
+The packages.element.io site is a public Cloudflare R2 bucket which is deployed to solely from Github Actions.
+The main bucket in R2 is `packages-element-io` which is a direct mapping of packages.element.io,
+we have a workflow which generates the index.html files there to imitate a public index which Cloudflare does not currently support.
+The reprepro database lives in `packages-element-io-db`.
+There is an additional pair of buckets of same name but appended with `-test` which can be used for testing,
+these land on https://packages-element-io-test.element.io/.
+
+### Debian/Ubuntu Distributions
+
+We used to add a new distribution to match each Debian and Ubuntu release. As of April 2020, we have created a `default` distribution that everyone can use (since the packages have never differed by distribution anyway).
+
+The distribution configuration lives in https://github.com/vector-im/packages.element.io/blob/master/debian/conf/distributions as a canonical source.

docs/updates.md

@@ -0,0 +1,15 @@
+The Desktop app is capable of self-updating on macOS and Windows.
+The update server base url is configurable as `update_base_url` in config.json and can be served by a static file host,
+CDN or object storage.
+
+Currently all packaging & deployment is handled by [Github actions](https://github.com/vector-im/element-desktop/blob/develop/.github/workflows/build_and_deploy.yaml)
+
+# Windows
+
+On Windows the update mechanism used is [Squirrel.Windows](https://github.com/Squirrel/Squirrel.Windows)
+and can be served by any compatible Squirrel server, such as https://github.com/Tiliq/squirrel-server
+
+# macOS
+
+On macOS the update mechanism used is [Squirrel.Mac](https://github.com/Squirrel/Squirrel.Mac)
+using the newer JSON format as documented [here](https://github.com/Squirrel/Squirrel.Mac#update-file-json-format).

docs/windows-requirements.md

@@ -0,0 +1,38 @@
+# Windows
+
+## Requirements to build native modules
+
+We rely on Github Actions `windows-latest` plus a few extra utilities as per [the workflow](https://github.com/vector-im/element-desktop/blob/develop/.github/workflows/build_windows.yaml).
+
+If you want to build native modules, make sure that the following tools are installed on your system.
+
+-   [Git for Windows](https://git-scm.com/download/win)
+-   [Node 16](https://nodejs.org)
+-   [Python 3](https://www.python.org/downloads/) (if you type 'python' into command prompt it will offer to install it from the windows store)
+-   [Strawberry Perl](https://strawberryperl.com/)
+-   [Rustup](https://rustup.rs/)
+-   [NASM](https://www.nasm.us/)
+-   [Build Tools for Visual Studio 2019](https://visualstudio.microsoft.com/downloads/#build-tools-for-visual-studio-2019) with the following configuration:
+    -   On the Workloads tab:
+        -   Desktop & Mobile -> C++ build tools
+    -   On the Individual components tab:
+        -   MSVC VS 2019 C++ build tools
+        -   Windows 10 SDK (latest version available)
+        -   C++ CMake tools for Windows
+
+Once installed make sure all those utilities are accessible in your `PATH`.
+
+If you want to be able to build x86 targets from an x64 host install the right toolchain:
+
+```cmd
+rustup toolchain install stable-i686-pc-windows-msvc
+rustup target add i686-pc-windows-msvc
+```
+
+In order to load all the C++ utilities installed by Visual Studio you can run the following in a terminal window.
+
+```
+call "C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\VC\Auxiliary\Build\vcvarsall.bat" amd64
+```
+
+You can replace `amd64` with `x86` depending on your CPU architecture.

electron-builder.js

@@ -0,0 +1,216 @@
+const os = require("os");
+const fs = require("fs");
+const path = require("path");
+const Arch = require("electron-builder").Arch;
+const { flipFuses, FuseVersion, FuseV1Options } = require("@electron/fuses");
+
+// Typescript conversion blocked on https://github.com/electron-userland/electron-builder/issues/7775
+
+/**
+ * This script has different outputs depending on your os platform.
+ *
+ * On Windows:
+ *  Prefixes the nightly version with `0.0.1-nightly.` as it breaks if it is not semver
+ *  Passes $ED_SIGNTOOL_THUMBPRINT and $ED_SIGNTOOL_SUBJECT_NAME to
+ *      build.win.signingHashAlgorithms and build.win.certificateSubjectName respectively if specified.
+ *
+ * On macOS:
+ *   Passes $ED_NOTARYTOOL_TEAM_ID to build.mac.notarize.notarize if specified
+ *
+ * On Linux:
+ *  Replaces spaces in the product name with dashes as spaces in paths can cause issues
+ *  Removes libsqlcipher0 recommended dependency if env SQLCIPHER_BUNDLED is asserted.
+ *  Passes $ED_DEBIAN_CHANGELOG to build.deb.fpm if specified
+ */
+
+const NIGHTLY_APP_ID = "im.riot.nightly";
+const NIGHTLY_DEB_NAME = "element-nightly";
+
+const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+
+/**
+ * @type {import('electron-builder').Configuration}
+ * @see https://www.electron.build/configuration/configuration
+ */
+const config = {
+    appId: "im.riot.app",
+    asarUnpack: "**/*.node",
+    afterPack: async (context) => {
+        if (context.electronPlatformName !== "darwin" || context.arch === Arch.universal) {
+            // Burn in electron fuses for proactive security hardening.
+            // On macOS, we only do this for the universal package, as the constituent arm64 and amd64 packages are embedded within.
+            const ext = {
+                darwin: ".app",
+                win32: ".exe",
+                linux: "",
+            }[context.electronPlatformName];
+
+            let executableName = context.packager.appInfo.productFilename;
+            if (context.electronPlatformName === "linux") {
+                // Linux uses the package name as the executable name
+                executableName = context.packager.appInfo.name;
+            }
+
+            const electronBinaryPath = path.join(context.appOutDir, `${executableName}${ext}`);
+            console.log(`Flipping fuses for: ${electronBinaryPath}`);
+
+            await flipFuses(electronBinaryPath, {
+                version: FuseVersion.V1,
+                resetAdHocDarwinSignature: context.electronPlatformName === "darwin" && context.arch === Arch.universal,
+
+                [FuseV1Options.EnableCookieEncryption]: true,
+                [FuseV1Options.OnlyLoadAppFromAsar]: true,
+
+                [FuseV1Options.RunAsNode]: false,
+                [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
+                [FuseV1Options.EnableNodeCliInspectArguments]: false,
+
+                // Mac app crashes on arm for us when `LoadBrowserProcessSpecificV8Snapshot` is enabled
+                [FuseV1Options.LoadBrowserProcessSpecificV8Snapshot]: false,
+                // https://github.com/electron/fuses/issues/7
+                [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: false,
+            });
+        }
+    },
+    files: [
+        "package.json",
+        {
+            from: ".hak/hakModules",
+            to: "node_modules",
+        },
+        "lib/**",
+    ],
+    extraResources: [
+        {
+            from: "res/img",
+            to: "img",
+        },
+        "webapp.asar",
+    ],
+    extraMetadata: {
+        name: pkg.name,
+        productName: pkg.productName,
+        description: pkg.description,
+    },
+    linux: {
+        target: ["tar.gz", "deb"],
+        category: "Network;InstantMessaging;Chat",
+        maintainer: "support@element.io",
+        icon: "build/icons",
+        desktop: {
+            MimeType: "x-scheme-handler/element",
+        },
+    },
+    deb: {
+        packageCategory: "net",
+        depends: [
+            "libgtk-3-0",
+            "libnotify4",
+            "libnss3",
+            "libxss1",
+            "libxtst6",
+            "xdg-utils",
+            "libatspi2.0-0",
+            "libuuid1",
+            "libsecret-1-0",
+            "libasound2",
+            "libgbm1",
+            "libc6 (>= 2.28)",
+        ],
+        recommends: ["libsqlcipher0", "element-io-archive-keyring"],
+        fpm: [
+            "--deb-field",
+            "Replaces: riot-desktop (<< 1.7.0), riot-web (<< 1.7.0)",
+            "--deb-field",
+            "Breaks: riot-desktop (<< 1.7.0), riot-web (<< 1.7.0)",
+        ],
+    },
+    mac: {
+        category: "public.app-category.social-networking",
+        darkModeSupport: true,
+        hardenedRuntime: true,
+        gatekeeperAssess: true,
+        entitlements: "./build/entitlements.mac.plist",
+        icon: "build/icons/icon.icns",
+    },
+    win: {
+        target: ["squirrel"],
+        signingHashAlgorithms: ["sha256"],
+        icon: "build/icons/icon.ico",
+    },
+    directories: {
+        output: "dist",
+    },
+    protocols: [
+        {
+            name: "element",
+            schemes: ["element"],
+        },
+    ],
+};
+
+/**
+ * Allow specifying windows signing cert via env vars
+ * @param {string} process.env.ED_SIGNTOOL_SUBJECT_NAME
+ * @param {string} process.env.ED_SIGNTOOL_THUMBPRINT
+ */
+if (process.env.ED_SIGNTOOL_SUBJECT_NAME && process.env.ED_SIGNTOOL_THUMBPRINT) {
+    config.win.certificateSubjectName = process.env.ED_SIGNTOOL_SUBJECT_NAME;
+    config.win.certificateSha1 = process.env.ED_SIGNTOOL_THUMBPRINT;
+}
+
+/**
+ * Allow specifying macOS notary team id via env var
+ * @param {string} process.env.ED_NOTARYTOOL_TEAM_ID
+ */
+if (process.env.ED_NOTARYTOOL_TEAM_ID) {
+    config.mac.notarize = {
+        teamId: process.env.ED_NOTARYTOOL_TEAM_ID,
+    };
+}
+
+/**
+ * Allow specifying nightly version via env var
+ * @param {string} process.env.ED_NIGHTLY
+ */
+if (process.env.ED_NIGHTLY) {
+    config.deb.fpm = []; // Clear the fpm as the breaks deb fields don't apply to nightly
+
+    config.appId = NIGHTLY_APP_ID;
+    config.extraMetadata.productName += " Nightly";
+    config.extraMetadata.name += "-nightly";
+    config.extraMetadata.description += " (nightly unstable build)";
+    config.deb.fpm.push("--name", NIGHTLY_DEB_NAME);
+
+    let version = process.env.ED_NIGHTLY;
+    if (os.platform() === "win32") {
+        // The windows packager relies on parsing this as semver, so we have to make it look like one.
+        // This will give our update packages really stupid names, but we probably can't change that either
+        // because squirrel windows parses them for the version too. We don't really care: nobody sees them.
+        // We just give the installer a static name, so you'll just see this in the 'about' dialog.
+        // Turns out if you use 0.0.0 here it makes Squirrel windows crash, so we use 0.0.1.
+        version = "0.0.1-nightly." + version;
+    }
+    config.extraMetadata.version = version;
+}
+
+if (os.platform() === "linux") {
+    // Electron crashes on debian if there's a space in the path.
+    // https://github.com/vector-im/element-web/issues/13171
+    config.extraMetadata.productName = config.extraMetadata.productName.replace(/ /g, "-");
+
+    /**
+     * Allow specifying deb changelog via env var
+     * @param {string} process.env.ED_DEB_CHANGELOG
+     */
+    if (process.env.ED_DEBIAN_CHANGELOG) {
+        config.deb.fpm.push(`--deb-changelog=${process.env.ED_DEBIAN_CHANGELOG}`);
+    }
+
+    if (process.env.SQLCIPHER_BUNDLED) {
+        // Remove sqlcipher dependency when using bundled
+        config.deb.recommends = config.deb.recommends?.filter((d) => d !== "libsqlcipher0");
+    }
+}
+
+exports.default = config;

element.io/nightly/config.json

@@ -1,9 +1,17 @@
 {
-    "update_base_url": "https://packages.riot.im/nightly/update/",
+    "update_base_url": "https://packages.element.io/nightly/update/",
     "default_server_name": "matrix.org",
+    "default_server_config": {
+        "m.homeserver": {
+            "base_url": "https://matrix-client.matrix.org"
+        },
+        "m.identity_server": {
+            "base_url": "https://vector.im"
+        }
+    },
     "brand": "Element Nightly",
-    "integrations_ui_url": "https://scalar-staging.vector.im/",
-    "integrations_rest_url": "https://scalar-staging.vector.im/api",
+    "integrations_ui_url": "https://scalar.vector.im/",
+    "integrations_rest_url": "https://scalar.vector.im/api",
     "integrations_widgets_urls": [
         "https://scalar.vector.im/_matrix/integrations/v1",
         "https://scalar.vector.im/api",
@@ -11,22 +19,11 @@
         "https://scalar-staging.vector.im/api",
         "https://scalar-staging.riot.im/scalar/api"
     ],
-    "hosting_signup_link": "https://element.io/matrix-services?utm_source=element-web&utm_medium=web",
     "bug_report_endpoint_url": "https://element.io/bugreports/submit",
-    "showLabsSettings": true,
-    "piwik": {
-        "url": "https://piwik.riot.im/",
-        "siteId": 1,
-        "policyUrl": "https://element.io/cookie-policy"
-    },
-    "countly": {
-        "url": "https://try.count.ly",
-        "appKey": "8abf1ee15646bc884556b82e5053857904264b66"
-    },
-    "roomDirectory": {
-        "servers": [
-            "matrix.org"
-        ]
+    "uisi_autorageshake_app": "element-auto-uisi",
+    "show_labs_settings": true,
+    "room_directory": {
+        "servers": ["matrix.org", "gitter.im", "libera.chat"]
     },
     "enable_presence_by_hs_url": {
         "https://matrix.org": false,
@@ -41,5 +38,22 @@
             "url": "https://element.io/cookie-policy",
             "text": "Cookie Policy"
         }
-    ]
+    ],
+    "sentry": {
+        "dsn": "https://029a0eb289f942508ae0fb17935bd8c5@sentry.matrix.org/6",
+        "environment": "nightly"
+    },
+    "posthog": {
+        "project_api_key": "phc_Jzsm6DTm6V2705zeU5dcNvQDlonOR68XvX2sh1sEOHO",
+        "api_host": "https://posthog.element.io"
+    },
+    "privacy_policy_url": "https://element.io/cookie-policy",
+    "features": {
+        "feature_spotlight": true,
+        "feature_video_rooms": true
+    },
+    "element_call": {
+        "url": "https://call.element.dev"
+    },
+    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
 }

element.io/nightly/control.template

@@ -1,11 +0,0 @@
-Package: element-nightly
-License: Apache-2.0
-Vendor: support@element.io
-Architecture: amd64
-Maintainer: support@element.io
-Depends: libgtk-3-0, libnotify4, libnss3, libxss1, libxtst6, xdg-utils, libatspi2.0-0, libuuid1, libappindicator3-1, libsecret-1-0, libsqlcipher0
-Section: net
-Priority: extra
-Homepage: https://element.io/
-Description: 
- riot.im A feature-rich client for Matrix.org (nightly unstable build).

element.io/nightly/riot-nightly_2020071502_all/DEBIAN/control

@@ -1,9 +0,0 @@
-Package: riot-nightly
-Version: 2020071502
-Depends: element-nightly
-Maintainer: packages@element.io
-Architecture: all
-Priority: optional
-Section: oldlibs
-Description: transitional package
- This is a transitional package. It can safely be removed.

element.io/release/conf_distributions

@@ -1,81 +0,0 @@
-Origin: riot.im
-Codename: default
-Architectures: amd64 i386 source
-Components: main
-SignWith: D7B0B66941D01538
-Tracking: minimal
-
-Origin: riot.im
-Suite: oldoldstable
-Codename: jessie
-Architectures: amd64 i386 source
-Components: main
-SignWith: D7B0B66941D01538
-Tracking: minimal
-
-Origin: riot.im
-Suite: oldstable
-Codename: stretch
-Architectures: amd64 i386 source
-Components: main
-SignWith: D7B0B66941D01538
-Tracking: minimal
-
-Origin: riot.im
-Suite: stable
-Codename: buster
-Architectures: amd64 i386 source
-Components: main
-SignWith: D7B0B66941D01538
-Tracking: minimal
-
-Origin: riot.im
-Suite: testing
-Codename: bullseye
-Architectures: amd64 i386 source
-Components: main
-SignWith: D7B0B66941D01538
-Tracking: minimal
-
-Origin: riot.im
-Suite: unstable
-Codename: sid
-Architectures: amd64 i386 source
-Components: main
-SignWith: D7B0B66941D01538
-Tracking: minimal
-
-Origin: riot.im
-Codename: xenial
-Architectures: amd64 i386 source
-Components: main
-SignWith: D7B0B66941D01538
-Tracking: minimal
-
-Origin: riot.im
-Codename: bionic
-Architectures: amd64 i386 source
-Components: main
-SignWith: D7B0B66941D01538
-Tracking: minimal
-
-Origin: riot.im
-Codename: cosmic
-Architectures: amd64 i386 source
-Components: main
-SignWith: D7B0B66941D01538
-Tracking: minimal
-
-Origin: riot.im
-Codename: disco
-Architectures: amd64 i386 source
-Components: main
-SignWith: D7B0B66941D01538
-Tracking: minimal
-
-Origin: riot.im
-Codename: eoan
-Architectures: amd64 i386 source
-Components: main
-SignWith: D7B0B66941D01538
-Tracking: minimal

element.io/release/config.json

@@ -1,6 +1,14 @@
 {
-    "update_base_url": "https://packages.riot.im/desktop/update/",
+    "update_base_url": "https://packages.element.io/desktop/update/",
     "default_server_name": "matrix.org",
+    "default_server_config": {
+        "m.homeserver": {
+            "base_url": "https://matrix-client.matrix.org"
+        },
+        "m.identity_server": {
+            "base_url": "https://vector.im"
+        }
+    },
     "brand": "Element",
     "integrations_ui_url": "https://scalar.vector.im/",
     "integrations_rest_url": "https://scalar.vector.im/api",
@@ -11,19 +19,12 @@
         "https://scalar-staging.vector.im/api",
         "https://scalar-staging.riot.im/scalar/api"
     ],
-    "hosting_signup_link": "https://element.io/matrix-services?utm_source=element-web&utm_medium=web",
     "bug_report_endpoint_url": "https://element.io/bugreports/submit",
-    "roomDirectory": {
-        "servers": [
-            "matrix.org"
-        ]
-    },
-    "showLabsSettings": false,
-    "piwik": {
-        "url": "https://piwik.riot.im/",
-        "siteId": 1,
-        "policyUrl": "https://element.io/cookie-policy"
+    "uisi_autorageshake_app": "element-auto-uisi",
+    "room_directory": {
+        "servers": ["matrix.org", "gitter.im", "libera.chat"]
     },
+    "show_labs_settings": false,
     "enable_presence_by_hs_url": {
         "https://matrix.org": false,
         "https://matrix-client.matrix.org": false
@@ -37,5 +38,11 @@
             "url": "https://element.io/cookie-policy",
             "text": "Cookie Policy"
         }
-    ]
+    ],
+    "posthog": {
+        "project_api_key": "phc_Jzsm6DTm6V2705zeU5dcNvQDlonOR68XvX2sh1sEOHO",
+        "api_host": "https://posthog.element.io"
+    },
+    "privacy_policy_url": "https://element.io/cookie-policy",
+    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
 }

element.io/release/control.template

@@ -1,13 +0,0 @@
-Package: element-desktop
-License: Apache-2.0
-Vendor: support@element.io
-Architecture: amd64
-Maintainer: support@element.io
-Depends: libgtk-3-0, libnotify4, libnss3, libxss1, libxtst6, xdg-utils, libatspi2.0-0, libuuid1, libappindicator3-1, libsecret-1-0, libsqlcipher0
-Replaces: riot-desktop (<< 1.7.0), riot-web (<< 1.7.0)
-Breaks: riot-desktop (<< 1.7.0), riot-web (<< 1.7.0)
-Section: net
-Priority: extra
-Homepage: https://element.io/
-Description: 
-  A feature-rich client for Matrix.org

element.io/release/riot-desktop_1.7.0_all/DEBIAN/control

@@ -1,9 +0,0 @@
-Package: riot-desktop
-Version: 1.7.0
-Depends: element-desktop
-Maintainer: packages@element.io
-Architecture: all
-Priority: optional
-Section: oldlibs
-Description: transitional package
- This is a transitional package. It can safely be removed.

hak/keytar/build.ts

@@ -14,28 +14,27 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-const path = require('path');
-const childProcess = require('child_process');
+import path from "path";
+import childProcess from "child_process";
 
-module.exports = async function(hakEnv, moduleInfo) {
-    await buildKeytar(hakEnv, moduleInfo);
-};
+import HakEnv from "../../scripts/hak/hakEnv";
+import { DependencyInfo } from "../../scripts/hak/dep";
 
-async function buildKeytar(hakEnv, moduleInfo) {
+export default async function buildKeytar(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
     const env = hakEnv.makeGypEnv();
 
     console.log("Running yarn with env", env);
-    await new Promise((resolve, reject) => {
+    await new Promise<void>((resolve, reject) => {
         const proc = childProcess.spawn(
-            path.join(moduleInfo.nodeModuleBinDir, 'node-gyp' + (hakEnv.isWin() ? '.cmd' : '')),
-            ['rebuild'],
+            path.join(moduleInfo.nodeModuleBinDir, "node-gyp" + (hakEnv.isWin() ? ".cmd" : "")),
+            ["rebuild", "--arch", hakEnv.getTargetArch()],
             {
                 cwd: moduleInfo.moduleBuildDir,
                 env,
-                stdio: 'inherit',
+                stdio: "inherit",
             },
         );
-        proc.on('exit', (code) => {
+        proc.on("exit", (code) => {
             code ? reject(code) : resolve();
         });
     });

hak/keytar/check.ts

@@ -14,17 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-const childProcess = require('child_process');
+import childProcess from "child_process";
 
-module.exports = async function(hakEnv, moduleInfo) {
-    const tools = [['python', '--version']]; // node-gyp uses python for reasons beyond comprehension
+import HakEnv from "../../scripts/hak/hakEnv";
+import { DependencyInfo } from "../../scripts/hak/dep";
+
+export default async function (hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    const tools = [["python", "--version"]]; // node-gyp uses python for reasons beyond comprehension
 
     for (const tool of tools) {
-        await new Promise((resolve, reject) => {
+        await new Promise<void>((resolve, reject) => {
             const proc = childProcess.spawn(tool[0], tool.slice(1), {
-                stdio: ['ignore'],
+                stdio: ["ignore"],
             });
-            proc.on('exit', (code) => {
+            proc.on("exit", (code) => {
                 if (code !== 0) {
                     reject("Can't find " + tool);
                 } else {
@@ -33,4 +36,4 @@ module.exports = async function(hakEnv, moduleInfo) {
             });
         });
     }
-};
+}

hak/keytar/hak.json

@@ -1,7 +1,7 @@
 {
     "scripts": {
-        "check": "check.js",
-        "build": "build.js"
+        "check": "check.ts",
+        "build": "build.ts"
     },
     "copy": "build/Release/keytar.node",
     "dependencies": {

hak/matrix-seshat/build.js

@@ -1,269 +0,0 @@
-/*
-Copyright 2020 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-const path = require('path');
-const childProcess = require('child_process');
-
-const mkdirp = require('mkdirp');
-const fsExtra = require('fs-extra');
-
-module.exports = async function(hakEnv, moduleInfo) {
-    if (hakEnv.isWin()) {
-        await buildOpenSslWin(hakEnv, moduleInfo);
-        await buildSqlCipherWin(hakEnv, moduleInfo);
-    } else if (hakEnv.isMac()) {
-        await buildSqlCipherUnix(hakEnv, moduleInfo);
-    }
-    await buildMatrixSeshat(hakEnv, moduleInfo);
-};
-
-async function buildOpenSslWin(hakEnv, moduleInfo) {
-    const version = moduleInfo.cfg.dependencies.openssl;
-    const openSslDir = path.join(moduleInfo.moduleDotHakDir, `openssl-${version}`);
-
-    const openSslArch = hakEnv.arch === 'x64' ? 'VC-WIN64A' : 'VC-WIN32';
-
-    console.log("Building openssl in " + openSslDir);
-    await new Promise((resolve, reject) => {
-        const proc = childProcess.spawn(
-            'perl',
-            [
-                'Configure',
-                '--prefix=' + moduleInfo.depPrefix,
-                 // sqlcipher only uses about a tiny part of openssl. We link statically
-                 // so will only pull in the symbols we use, but we may as well turn off
-                 // as much as possible to save on build time.
-                'no-afalgeng',
-                'no-capieng',
-                'no-cms',
-                'no-ct',
-                'no-deprecated',
-                'no-dgram',
-                'no-dso',
-                'no-ec',
-                'no-ec2m',
-                'no-gost',
-                'no-nextprotoneg',
-                'no-ocsp',
-                'no-sock',
-                'no-srp',
-                'no-srtp',
-                'no-tests',
-                'no-ssl',
-                'no-tls',
-                'no-dtls',
-                'no-shared',
-                'no-aria',
-                'no-camellia',
-                'no-cast',
-                'no-chacha',
-                'no-cmac',
-                'no-des',
-                'no-dh',
-                'no-dsa',
-                'no-ecdh',
-                'no-ecdsa',
-                'no-idea',
-                'no-md4',
-                'no-mdc2',
-                'no-ocb',
-                'no-poly1305',
-                'no-rc2',
-                'no-rc4',
-                'no-rmd160',
-                'no-scrypt',
-                'no-seed',
-                'no-siphash',
-                'no-sm2',
-                'no-sm3',
-                'no-sm4',
-                'no-whirlpool',
-                openSslArch,
-            ],
-            {
-                cwd: openSslDir,
-                stdio: 'inherit',
-            },
-        );
-        proc.on('exit', (code) => {
-            code ? reject(code) : resolve();
-        });
-    });
-
-    await new Promise((resolve, reject) => {
-        const proc = childProcess.spawn(
-            'nmake',
-            ['build_libs'],
-            {
-                cwd: openSslDir,
-                stdio: 'inherit',
-            },
-        );
-        proc.on('exit', (code) => {
-            code ? reject(code) : resolve();
-        });
-    });
-
-    await new Promise((resolve, reject) => {
-        const proc = childProcess.spawn(
-            'nmake',
-            ['install_dev'],
-            {
-                cwd: openSslDir,
-                stdio: 'inherit',
-            },
-        );
-        proc.on('exit', (code) => {
-            code ? reject(code) : resolve();
-        });
-    });
-}
-
-async function buildSqlCipherWin(hakEnv, moduleInfo) {
-    const version = moduleInfo.cfg.dependencies.sqlcipher;
-    const sqlCipherDir = path.join(moduleInfo.moduleDotHakDir, `sqlcipher-${version}`);
-    const buildDir = path.join(sqlCipherDir, 'bld');
-
-    await mkdirp(buildDir);
-
-    await new Promise((resolve, reject) => {
-        const proc = childProcess.spawn(
-            'nmake',
-            ['/f', path.join('..', 'Makefile.msc'), 'libsqlite3.lib', 'TOP=..'],
-            {
-                cwd: buildDir,
-                stdio: 'inherit',
-                env: Object.assign({}, process.env, {
-                    CCOPTS: "-DSQLITE_HAS_CODEC -I" + path.join(moduleInfo.depPrefix, 'include'),
-                    LTLIBPATHS: "/LIBPATH:" + path.join(moduleInfo.depPrefix, 'lib'),
-                    LTLIBS: "libcrypto.lib",
-                }),
-            },
-        );
-        proc.on('exit', (code) => {
-            code ? reject(code) : resolve();
-        });
-    });
-
-    await fsExtra.copy(
-        path.join(buildDir, 'libsqlite3.lib'),
-        path.join(moduleInfo.depPrefix, 'lib', 'sqlcipher.lib'),
-    );
-
-    await fsExtra.copy(
-        path.join(buildDir, 'sqlite3.h'),
-        path.join(moduleInfo.depPrefix, 'include', 'sqlcipher.h'),
-    );
-}
-
-async function buildSqlCipherUnix(hakEnv, moduleInfo) {
-    const version = moduleInfo.cfg.dependencies.sqlcipher;
-    const sqlCipherDir = path.join(moduleInfo.moduleDotHakDir, `sqlcipher-${version}`);
-
-    const args = [
-        '--prefix=' + moduleInfo.depPrefix + '',
-        '--enable-tempstore=yes',
-        '--enable-shared=no',
-    ];
-
-    if (hakEnv.isMac()) {
-        args.push('--with-crypto-lib=commoncrypto');
-    }
-    args.push('CFLAGS=-DSQLITE_HAS_CODEC');
-    if (hakEnv.isMac()) {
-        args.push('LDFLAGS=-framework Security -framework Foundation');
-    }
-
-    await new Promise((resolve, reject) => {
-        const proc = childProcess.spawn(
-            path.join(sqlCipherDir, 'configure'),
-            args,
-            {
-                cwd: sqlCipherDir,
-                stdio: 'inherit',
-            },
-        );
-        proc.on('exit', (code) => {
-            code ? reject(code) : resolve();
-        });
-    });
-
-    await new Promise((resolve, reject) => {
-        const proc = childProcess.spawn(
-            'make',
-            [],
-            {
-                cwd: sqlCipherDir,
-                stdio: 'inherit',
-            },
-        );
-        proc.on('exit', (code) => {
-            code ? reject(code) : resolve();
-        });
-    });
-
-    await new Promise((resolve, reject) => {
-        const proc = childProcess.spawn(
-            'make',
-            ['install'],
-            {
-                cwd: sqlCipherDir,
-                stdio: 'inherit',
-            },
-        );
-        proc.on('exit', (code) => {
-            code ? reject(code) : resolve();
-        });
-    });
-}
-
-async function buildMatrixSeshat(hakEnv, moduleInfo) {
-    const env = hakEnv.makeGypEnv();
-
-    if (!hakEnv.isLinux()) {
-        Object.assign(env, {
-            SQLCIPHER_STATIC: 1,
-            SQLCIPHER_LIB_DIR: path.join(moduleInfo.depPrefix, 'lib'),
-            SQLCIPHER_INCLUDE_DIR: path.join(moduleInfo.depPrefix, 'include'),
-        });
-    }
-
-    if (hakEnv.isWin()) {
-        env.RUSTFLAGS = '-Ctarget-feature=+crt-static -Clink-args=libcrypto.lib';
-        // Note that in general, you can specify targets in Rust without having to have
-        // the matching toolchain, however for this, cargo gets confused when building
-        // the build scripts since they run on the host, but vcvarsall.bat sets the c
-        // compiler in the path to be the one for the target, so we just use the matching
-        // toolchain for the target architecture which makes everything happy.
-        env.RUSTUP_TOOLCHAIN = hakEnv.arch == 'x64' ? 'stable-x86_64-pc-windows-msvc' : 'stable-i686-pc-windows-msvc';
-    }
-
-    console.log("Running neon with env", env);
-    await new Promise((resolve, reject) => {
-        const proc = childProcess.spawn(
-            path.join(moduleInfo.nodeModuleBinDir, 'neon' + (hakEnv.isWin() ? '.cmd' : '')),
-            ['build', '--release'],
-            {
-                cwd: moduleInfo.moduleBuildDir,
-                env,
-                stdio: 'inherit',
-            },
-        );
-        proc.on('exit', (code) => {
-            code ? reject(code) : resolve();
-        });
-    });
-}

hak/matrix-seshat/build.ts

@@ -0,0 +1,56 @@
+/*
+Copyright 2020-2021 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import childProcess from "child_process";
+
+import HakEnv from "../../scripts/hak/hakEnv";
+import { DependencyInfo } from "../../scripts/hak/dep";
+
+export default async function (hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    const env = hakEnv.makeGypEnv();
+
+    if (!hakEnv.isHost()) {
+        env.CARGO_BUILD_TARGET = hakEnv.getTargetId();
+    }
+
+    console.log("Running yarn install");
+    await new Promise<void>((resolve, reject) => {
+        const proc = childProcess.spawn("yarn" + (hakEnv.isWin() ? ".cmd" : ""), ["install"], {
+            cwd: moduleInfo.moduleBuildDir,
+            env,
+            shell: true,
+            stdio: "inherit",
+        });
+        proc.on("exit", (code) => {
+            code ? reject(code) : resolve();
+        });
+    });
+
+    const buildTarget = hakEnv.wantsStaticSqlCipher() ? "build-bundled" : "build";
+
+    console.log("Running yarn build");
+    await new Promise<void>((resolve, reject) => {
+        const proc = childProcess.spawn("yarn" + (hakEnv.isWin() ? ".cmd" : ""), ["run", buildTarget], {
+            cwd: moduleInfo.moduleBuildDir,
+            env,
+            shell: true,
+            stdio: "inherit",
+        });
+        proc.on("exit", (code) => {
+            code ? reject(code) : resolve();
+        });
+    });
+}

hak/matrix-seshat/check.js

@@ -1,60 +0,0 @@
-/*
-Copyright 2020 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-const childProcess = require('child_process');
-
-module.exports = async function(hakEnv, moduleInfo) {
-    // of course tcl doesn't have a --version
-    if (!hakEnv.isLinux()) {
-        await new Promise((resolve, reject) => {
-            const proc = childProcess.spawn('tclsh', [], {
-                stdio: ['pipe', 'ignore', 'ignore'],
-            });
-            proc.on('exit', (code) => {
-                if (code !== 0) {
-                    reject("Can't find tclsh - have you installed TCL?");
-                } else {
-                    resolve();
-                }
-            });
-            proc.stdin.end();
-        });
-    }
-
-    const tools = [['python', '--version']]; // node-gyp uses python for reasons beyond comprehension
-    if (hakEnv.isWin()) {
-        tools.push(['perl', '--version']); // for openssl configure
-        tools.push(['patch', '--version']); // to patch sqlcipher Makefile.msc
-        tools.push(['nmake', '/?']);
-    } else {
-        tools.push(['make', '--version']);
-    }
-
-    for (const tool of tools) {
-        await new Promise((resolve, reject) => {
-            const proc = childProcess.spawn(tool[0], tool.slice(1), {
-                stdio: ['ignore'],
-            });
-            proc.on('exit', (code) => {
-                if (code !== 0) {
-                    reject("Can't find " + tool);
-                } else {
-                    resolve();
-                }
-            });
-        });
-    }
-};

hak/matrix-seshat/check.ts

@@ -0,0 +1,76 @@
+/*
+Copyright 2020-2021 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import childProcess from "child_process";
+import fsProm from "fs/promises";
+
+import HakEnv from "../../scripts/hak/hakEnv";
+import { DependencyInfo } from "../../scripts/hak/dep";
+
+export default async function (hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    const tools = [
+        ["rustc", "--version"],
+        ["python", "--version"], // node-gyp uses python for reasons beyond comprehension
+    ];
+    if (hakEnv.isWin()) {
+        tools.push(["perl", "--version"]); // for openssl configure
+        tools.push(["nasm", "-v"]); // for openssl building
+        tools.push(["patch", "--version"]); // to patch sqlcipher Makefile.msc
+        tools.push(["nmake", "/?"]);
+    } else {
+        tools.push(["make", "--version"]);
+    }
+
+    for (const tool of tools) {
+        await new Promise<void>((resolve, reject) => {
+            const proc = childProcess.spawn(tool[0], tool.slice(1), {
+                stdio: ["ignore"],
+            });
+            proc.on("exit", (code) => {
+                if (code !== 0) {
+                    reject("Can't find " + tool);
+                } else {
+                    resolve();
+                }
+            });
+        });
+    }
+
+    // Ensure Rust target exists (nb. we avoid depending on rustup)
+    await new Promise((resolve, reject) => {
+        const rustc = childProcess.execFile(
+            "rustc",
+            ["--target", hakEnv.getTargetId(), "--emit=obj", "-o", "tmp", "-"],
+            (err, out) => {
+                if (err) {
+                    reject(
+                        "rustc can't build for target " +
+                            hakEnv.getTargetId() +
+                            ": ensure target is installed via `rustup target add " +
+                            hakEnv.getTargetId() +
+                            "` " +
+                            "or your package manager if not using `rustup`",
+                    );
+                }
+                fsProm.unlink("tmp").then(resolve);
+            },
+        );
+        rustc.stdin!.write("fn main() {}");
+        rustc.stdout!.pipe(process.stdout);
+        rustc.stderr!.pipe(process.stderr);
+        rustc.stdin!.end();
+    });
+}

hak/matrix-seshat/fetchDeps.js

@@ -1,129 +0,0 @@
-/*
-Copyright 2020 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-const path = require('path');
-const childProcess = require('child_process');
-
-const fs = require('fs');
-const fsProm = require('fs').promises;
-const needle = require('needle');
-const tar = require('tar');
-
-module.exports = async function(hakEnv, moduleInfo) {
-    if (!hakEnv.isLinux()) {
-        await getSqlCipher(hakEnv, moduleInfo);
-    }
-
-    if (hakEnv.isWin()) {
-        await getOpenSsl(hakEnv, moduleInfo);
-    }
-};
-
-async function getSqlCipher(hakEnv, moduleInfo) {
-    const version = moduleInfo.cfg.dependencies.sqlcipher;
-    const sqlCipherDir = path.join(moduleInfo.moduleDotHakDir, `sqlcipher-${version}`);
-
-    let haveSqlcipher;
-    try {
-        await fsProm.stat(sqlCipherDir);
-        haveSqlcipher = true;
-    } catch (e) {
-        haveSqlcipher = false;
-    }
-
-    if (haveSqlcipher) return;
-
-    const sqlCipherTarball = path.join(moduleInfo.moduleDotHakDir, `sqlcipher-${version}.tar.gz`);
-    let haveSqlcipherTar;
-    try {
-        await fsProm.stat(sqlCipherTarball);
-        haveSqlcipherTar = true;
-    } catch (e) {
-        haveSqlcipherTar = false;
-    }
-    if (!haveSqlcipherTar) {
-        const bob = needle('get', `https://github.com/sqlcipher/sqlcipher/archive/v${version}.tar.gz`, {
-            follow: 10,
-            output: sqlCipherTarball,
-        });
-        await bob;
-    }
-
-    await tar.x({
-        file: sqlCipherTarball,
-        cwd: moduleInfo.moduleDotHakDir,
-    });
-
-    if (hakEnv.isWin()) {
-        // On Windows, we need to patch the makefile because it forces TEMP_STORE to
-        // default to files (1) but the README specifically says you '*must*' set it
-        // set it to 2 (default to memory).
-        const patchFile = path.join(moduleInfo.moduleHakDir, `sqlcipher-${version}-win.patch`);
-
-        await new Promise((resolve, reject) => {
-        const readStream = fs.createReadStream(patchFile);
-
-            const proc = childProcess.spawn(
-                'patch',
-                ['-p1'],
-                {
-                    cwd: sqlCipherDir,
-                    stdio: ['pipe', 'inherit', 'inherit'],
-                },
-            );
-            proc.on('exit', (code) => {
-                code ? reject(code) : resolve();
-            });
-            readStream.pipe(proc.stdin);
-        });
-    }
-}
-
-async function getOpenSsl(hakEnv, moduleInfo) {
-    const version = moduleInfo.cfg.dependencies.openssl;
-    const openSslDir = path.join(moduleInfo.moduleDotHakDir, `openssl-${version}`);
-
-    let haveOpenSsl;
-    try {
-        await fsProm.stat(openSslDir);
-        haveOpenSsl = true;
-    } catch (e) {
-        haveOpenSsl = false;
-    }
-
-    if (haveOpenSsl) return;
-
-    const openSslTarball = path.join(moduleInfo.moduleDotHakDir, `openssl-${version}.tar.gz`);
-    let haveOpenSslTar;
-    try {
-        await fsProm.stat(openSslTarball);
-        haveOpenSslTar = true;
-    } catch (e) {
-        haveOpenSslTar = false;
-    }
-    if (!haveOpenSslTar) {
-        await needle('get', `https://www.openssl.org/source/openssl-${version}.tar.gz`, {
-            follow: 10,
-            output: openSslTarball,
-        });
-    }
-
-    console.log("extracting " + openSslTarball + " in " + moduleInfo.moduleDotHakDir);
-    await tar.x({
-        file: openSslTarball,
-        cwd: moduleInfo.moduleDotHakDir,
-    });
-}

hak/matrix-seshat/hak.json

@@ -1,13 +1,7 @@
 {
     "scripts": {
-        "check": "check.js",
-        "fetchDeps": "fetchDeps.js",
-        "build": "build.js"
+        "check": "check.ts",
+        "build": "build.ts"
     },
-    "prune": "native",
-    "copy": "native/index.node",
-    "dependencies": {
-        "openssl": "1.1.1f",
-        "sqlcipher": "4.3.0"
-    }
+    "copy": "index.node"
 }

hak/matrix-seshat/sqlcipher-4.3.0-win.patch

@@ -1,14 +0,0 @@
-diff -Nur sqlcipher-4.3.0-orig/Makefile.msc sqlcipher-4.3.0-mod/Makefile.msc
---- sqlcipher-4.3.0-orig/Makefile.msc	2019-12-20 16:40:26.000000000 +0000
-+++ sqlcipher-4.3.0-mod/Makefile.msc	2020-02-14 11:31:39.000000000 +0000
-@@ -985,8 +985,8 @@
- # default to file, 2 to default to memory, and 3 to force temporary
- # tables to always be in memory.
- #
--TCC = $(TCC) -DSQLITE_TEMP_STORE=1
--RCC = $(RCC) -DSQLITE_TEMP_STORE=1
-+TCC = $(TCC) -DSQLITE_TEMP_STORE=2
-+RCC = $(RCC) -DSQLITE_TEMP_STORE=2
- 
- # Enable/disable loadable extensions, and other optional features
- # based on configuration. (-DSQLITE_OMIT*, -DSQLITE_ENABLE*).

hak/tsconfig.json

@@ -0,0 +1,14 @@
+{
+    "compilerOptions": {
+        "moduleResolution": "node",
+        "esModuleInterop": true,
+        "target": "es2016",
+        "sourceMap": false,
+        "strict": true,
+        "lib": ["es2020"],
+    },
+    "include": ["../scripts/@types/*.d.ts", "./**/*.ts"],
+    "ts-node": {
+        "transpileOnly": true,
+    },
+}

knip.ts

@@ -0,0 +1,16 @@
+import { KnipConfig } from "knip";
+
+export default {
+    entry: ["src/electron-main.ts", "src/preload.ts", "electron-builder.js", ".eslintrc-*.js", "scripts/**", "hak/**"],
+    project: ["**/*.{js,ts}"],
+    ignoreDependencies: [
+        // Brought in via hak scripts
+        "keytar",
+        "matrix-seshat",
+        // Needed by `electron-builder`
+        "electron-builder-squirrel-windows",
+        // Required for `action-validator`
+        "@action-validator/*",
+    ],
+    ignoreBinaries: ["jq", "scripts/in-docker.sh"],
+} satisfies KnipConfig;

localazy.json

@@ -0,0 +1,37 @@
+{
+    "readKey": "a7688614897667993891-866e2615b0a22e6ccef56aea9b10e815efa3e1296752a7a30bd9925f1a8f33e7",
+
+    "upload": {
+        "type": "json",
+        "keySeparator": "|",
+        "deprecate": "file",
+        "features": ["plural_object", "filter_untranslated"],
+        "files": [
+            {
+                "pattern": "src/i18n/strings/en_EN.json",
+                "file": "element-desktop.json",
+                "lang": "inherited"
+            },
+            {
+                "group": "existing",
+                "pattern": "src/i18n/strings/*.json",
+                "file": "element-desktop.json",
+                "excludes": ["src/i18n/strings/en_EN.json"],
+                "lang": "${autodetectLang}"
+            }
+        ]
+    },
+
+    "download": {
+        "files": [
+            {
+                "conditions": "equals: ${file}, element-desktop.json",
+                "output": "src/i18n/strings/${langLsrUnderscore}.json"
+            }
+        ],
+        "includeSourceLang": "${includeSourceLang|false}",
+        "langAliases": {
+            "en": "en-EN"
+        }
+    }
+}

package.json

@@ -1,113 +1,128 @@
 {
-  "name": "element-desktop",
-  "productName": "Element",
-  "main": "src/electron-main.js",
-  "version": "1.7.14",
-  "description": "A feature-rich client for Matrix.org",
-  "author": "Element",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/vector-im/riot-desktop"
-  },
-  "license": "Apache-2.0",
-  "files": [],
-  "scripts": {
-    "mkdirs": "mkdirp packages deploys",
-    "fetch": "yarn run mkdirs && node scripts/fetch-package.js",
-    "asar-webapp": "asar p webapp webapp.asar",
-    "start": "electron .",
-    "lint": "eslint src/ scripts/ hak/",
-    "build:native": "yarn run hak",
-    "build32": "electron-builder --ia32",
-    "build64": "electron-builder --x64",
-    "build": "electron-builder",
-    "docker:setup": "docker build -t riot-desktop-dockerbuild dockerbuild",
-    "docker:build:native": "scripts/in-docker.sh yarn run hak",
-    "docker:build": "scripts/in-docker.sh yarn run build",
-    "docker:install": "scripts/in-docker.sh yarn install",
-    "debrepo": "scripts/mkrepo.sh",
-    "clean": "rimraf webapp.asar dist packages deploys",
-    "hak": "node scripts/hak/index.js"
-  },
-  "dependencies": {
-    "auto-launch": "^5.0.1",
-    "electron-store": "^2.0.0",
-    "electron-window-state": "^4.1.0",
-    "minimist": "^1.2.3",
-    "png-to-ico": "^2.1.0",
-    "request": "^2.88.2"
-  },
-  "devDependencies": {
-    "asar": "^2.0.1",
-    "electron-builder": "^22.7.0",
-    "electron-builder-squirrel-windows": "^22.7.0",
-    "electron-devtools-installer": "^2.2.4",
-    "electron-notarize": "^0.2.0",
-    "eslint": "7.3.1",
-    "eslint-config-matrix-org": "^0.1.2",
-    "find-npm-prefix": "^1.0.2",
-    "fs-extra": "^8.1.0",
-    "glob": "^7.1.6",
-    "mkdirp": "^1.0.3",
-    "needle": "^2.5.0",
-    "node-pre-gyp": "^0.15.0",
-    "npm": "^6.14.6",
-    "rimraf": "^3.0.2",
-    "semver": "^7.1.3",
-    "tar": "^6.0.1"
-  },
-  "hakDependencies": {
-    "matrix-seshat": "^2.2.1",
-    "keytar": "^5.6.0"
-  },
-  "build": {
-    "appId": "im.riot.app",
-    "electronVersion": "10.1.3",
-    "files": [
-      "package.json",
-      {
-        "from": ".hak/hakModules",
-        "to": "node_modules"
-      },
-      "src/**"
-    ],
-    "extraResources": [
-      {
-        "from": "res/img",
-        "to": "img"
-      },
-      "webapp.asar"
-    ],
-    "linux": {
-      "target": "deb",
-      "category": "Network;InstantMessaging;Chat",
-      "maintainer": "support@element.io",
-      "desktop": {
-        "StartupWMClass": "element"
-      }
+    "name": "element-desktop",
+    "productName": "Element",
+    "main": "lib/electron-main.js",
+    "version": "1.11.54",
+    "description": "A feature-rich client for Matrix.org",
+    "author": "Element",
+    "homepage": "https://element.io",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/vector-im/element-desktop"
     },
-    "mac": {
-      "category": "public.app-category.social-networking",
-      "darkModeSupport": true
+    "license": "Apache-2.0",
+    "files": [],
+    "engines": {
+        "node": ">=18.0.0"
     },
-    "win": {
-      "target": {
-        "target": "squirrel"
-      },
-      "sign": "scripts/electron_winSign"
+    "scripts": {
+        "i18n": "matrix-gen-i18n && yarn i18n:sort && yarn i18n:lint",
+        "i18n:sort": "jq --sort-keys '.' src/i18n/strings/en_EN.json > src/i18n/strings/en_EN.json.tmp && mv src/i18n/strings/en_EN.json.tmp src/i18n/strings/en_EN.json",
+        "i18n:lint": "prettier --log-level=silent  --write src/i18n/strings/ --ignore-path /dev/null",
+        "i18n:diff": "cp src/i18n/strings/en_EN.json src/i18n/strings/en_EN_orig.json && yarn i18n && matrix-compare-i18n-files src/i18n/strings/en_EN_orig.json src/i18n/strings/en_EN.json",
+        "mkdirs": "mkdirp packages deploys",
+        "fetch": "yarn run mkdirs && ts-node scripts/fetch-package.ts",
+        "asar-webapp": "asar p webapp webapp.asar",
+        "start": "yarn run build:ts && yarn run build:res && electron .",
+        "lint": "yarn lint:types && yarn lint:js && yarn lint:workflows",
+        "lint:js": "yarn lint:js:src && yarn lint:js:test && yarn lint:js:scripts && yarn lint:js:hak && prettier --check .",
+        "lint:js:src": "eslint --max-warnings 0 src",
+        "lint:js:test": "eslint --max-warnings 0 --config .eslintrc-test.js playwright",
+        "lint:js:scripts": "eslint --max-warnings 0 --config .eslintrc-scripts.js scripts",
+        "lint:js:hak": "eslint --max-warnings 0 --config .eslintrc-hak.js hak",
+        "lint:js-fix": "yarn lint:js-fix:src &&yarn lint:js-fix:test && yarn lint:js-fix:scripts && yarn lint:js-fix:hak && prettier --log-level=warn --write .",
+        "lint:js-fix:src": "eslint --fix --max-warnings 0 src",
+        "lint:js-fix:test": "eslint --fix --max-warnings 0 --config .eslintrc-test.js playwright",
+        "lint:js-fix:scripts": "eslint --fix --max-warnings 0 --config .eslintrc-scripts.js scripts",
+        "lint:js-fix:hak": "eslint --fix --max-warnings 0 --config .eslintrc-hak.js hak",
+        "lint:types": "yarn lint:types:src && yarn lint:types:test && yarn lint:types:scripts && yarn lint:types:hak",
+        "lint:types:src": "tsc --noEmit",
+        "lint:types:test": "tsc --noEmit -p playwright/tsconfig.json",
+        "lint:types:scripts": "tsc --noEmit -p scripts/tsconfig.json",
+        "lint:types:hak": "tsc --noEmit -p hak/tsconfig.json",
+        "lint:workflows": "find .github/workflows -type f \\( -iname '*.yaml' -o -iname '*.yml' \\) | xargs -I {} sh -c 'echo \"Linting {}\"; action-validator \"{}\"'",
+        "lint:knip": "knip",
+        "build:native": "yarn run hak",
+        "build:native:universal": "yarn run hak --target x86_64-apple-darwin fetchandbuild && yarn run hak --target aarch64-apple-darwin fetchandbuild && yarn run hak --target x86_64-apple-darwin --target aarch64-apple-darwin copyandlink",
+        "build:32": "yarn run build:ts && yarn run build:res && electron-builder --ia32",
+        "build:64": "yarn run build:ts && yarn run build:res && electron-builder --x64",
+        "build:universal": "yarn run build:ts && yarn run build:res && electron-builder --universal",
+        "build": "yarn run build:ts && yarn run build:res && electron-builder",
+        "build:ts": "tsc",
+        "build:res": "ts-node scripts/copy-res.ts",
+        "docker:setup": "docker build --platform linux/amd64 -t element-desktop-dockerbuild dockerbuild",
+        "docker:build:native": "scripts/in-docker.sh yarn run hak",
+        "docker:build": "scripts/in-docker.sh yarn run build",
+        "docker:install": "scripts/in-docker.sh yarn install",
+        "clean": "rimraf webapp.asar dist packages deploys lib",
+        "hak": "ts-node scripts/hak/index.ts",
+        "test": "playwright test",
+        "test:open": "yarn test --ui",
+        "test:screenshots:build": "docker build playwright -t element-desktop-playwright --platform linux/amd64",
+        "test:screenshots:run": "docker run --rm --network host -v $(pwd):/work/element-desktop -v /var/run/docker.sock:/var/run/docker.sock --platform linux/amd64 -it element-desktop-playwright"
     },
-    "directories": {
-      "output": "dist"
+    "dependencies": {
+        "@sentry/electron": "^4.3.0",
+        "auto-launch": "^5.0.5",
+        "counterpart": "^0.18.6",
+        "electron-clear-data": "^1.0.5",
+        "electron-store": "^8.0.2",
+        "electron-window-state": "^5.0.3",
+        "minimist": "^1.2.6",
+        "node-fetch": "^2",
+        "png-to-ico": "^2.1.1",
+        "uuid": "^9.0.0"
     },
-    "afterPack": "scripts/electron_afterPack",
-    "afterSign": "scripts/electron_afterSign",
-    "protocols": [
-      {
-        "name": "element",
-        "schemes": [
-          "element"
-        ]
-      }
-    ]
-  }
+    "devDependencies": {
+        "@action-validator/cli": "^0.5.3",
+        "@action-validator/core": "^0.5.3",
+        "@babel/core": "^7.18.10",
+        "@babel/preset-env": "^7.18.10",
+        "@babel/preset-typescript": "^7.18.6",
+        "@electron/asar": "^3.2.3",
+        "@electron/fuses": "^1.7.0",
+        "@playwright/test": "1.40.1",
+        "@types/auto-launch": "^5.0.1",
+        "@types/counterpart": "^0.18.1",
+        "@types/minimist": "^1.2.1",
+        "@types/mkdirp": "^1.0.2",
+        "@types/node": "18.19.8",
+        "@types/pacote": "^11.1.1",
+        "@types/tar": "^6.1.3",
+        "@types/uuid": "^9.0.2",
+        "@typescript-eslint/eslint-plugin": "^6.0.0",
+        "@typescript-eslint/parser": "^6.0.0",
+        "app-builder-lib": "24.11.0",
+        "chokidar": "^3.5.2",
+        "detect-libc": "^2.0.0",
+        "electron": "^28.0.0",
+        "electron-builder": "24.9.1",
+        "electron-builder-squirrel-windows": "24.11.0",
+        "electron-devtools-installer": "^3.2.0",
+        "eslint": "^8.26.0",
+        "eslint-config-google": "^0.14.0",
+        "eslint-config-prettier": "^9.0.0",
+        "eslint-plugin-import": "^2.25.4",
+        "eslint-plugin-matrix-org": "^1.0.0",
+        "eslint-plugin-unicorn": "^50.0.0",
+        "find-npm-prefix": "^1.0.2",
+        "glob": "^10.0.0",
+        "knip": "^4.0.1",
+        "matrix-web-i18n": "^3.1.3",
+        "mkdirp": "^3.0.0",
+        "node-pre-gyp": "^0.17.0",
+        "pacote": "^17.0.0",
+        "prettier": "^3.0.0",
+        "rimraf": "^5.0.0",
+        "tar": "^6.1.2",
+        "ts-node": "^10.9.1",
+        "typescript": "5.3.3"
+    },
+    "hakDependencies": {
+        "matrix-seshat": "^3.0.1",
+        "keytar": "^7.9.0"
+    },
+    "resolutions": {
+        "@types/node": "18.19.8"
+    }
 }

playwright.config.ts

@@ -0,0 +1,33 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { defineConfig } from "@playwright/test";
+
+export default defineConfig({
+    use: {
+        viewport: { width: 1280, height: 720 },
+        video: "retain-on-failure",
+        trace: "on-first-retry",
+    },
+    testDir: "playwright/e2e",
+    outputDir: "playwright/test-results",
+    workers: 1,
+    retries: process.env.CI ? 2 : 0,
+    reporter: [["html", { outputFolder: "playwright/html-report" }]],
+    snapshotDir: "playwright/snapshots",
+    snapshotPathTemplate: "{snapshotDir}/{testFilePath}/{arg}-{platform}{ext}",
+    timeout: 10 * 1000,
+});

playwright/.gitignore

@@ -0,0 +1,5 @@
+/test-results/
+/html-report/
+# Only commit snapshots from Linux
+/snapshots/**/*.png
+!/snapshots/**/*-linux.png

playwright/Dockerfile

@@ -0,0 +1,10 @@
+FROM mcr.microsoft.com/playwright:v1.41.0-jammy
+
+WORKDIR /work/element-desktop
+
+RUN apt-get update && apt-get -y install xvfb
+
+USER 1000:1000
+
+COPY docker-entrypoint.sh /opt/docker-entrypoint.sh
+ENTRYPOINT ["bash", "/opt/docker-entrypoint.sh"]

playwright/docker-entrypoint.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+
+echo "Starting Xvfb"
+Xvfb :99 -ac &
+sleep 2
+
+export DISPLAY=:99
+
+npx playwright test --update-snapshots --reporter line $1

playwright/e2e/launch/launch.spec.ts

@@ -0,0 +1,26 @@
+/*
+Copyright 2022 - 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { test, expect } from "../../element-desktop-test";
+
+test.describe("App launch", () => {
+    test("should launch and render the welcome view successfully", async ({ page }) => {
+        await page.locator("#matrixchat").waitFor();
+        await page.locator(".mx_Welcome").waitFor();
+        await expect(page).toHaveURL("vector://vector/webapp/#/welcome");
+        await expect(page).toHaveScreenshot();
+    });
+});

playwright/element-desktop-test.ts

@@ -0,0 +1,57 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { _electron as electron, test as base, expect as baseExpect, type ElectronApplication } from "@playwright/test";
+import fs from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+
+export const test = base.extend<{ app: ElectronApplication; tmpDir: string }>({
+    // eslint-disable-next-line no-empty-pattern
+    tmpDir: async ({}, use) => {
+        const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "element-desktop-tests-"));
+        console.log("Using temp profile directory: ", tmpDir);
+        await use(tmpDir);
+        await fs.rm(tmpDir, { recursive: true });
+    },
+    app: async ({ tmpDir }, use) => {
+        const args = ["--profile-dir", tmpDir];
+
+        const executablePath = process.env["ELEMENT_DESKTOP_EXECUTABLE"];
+        if (!executablePath) {
+            // Unpackaged mode testing
+            args.unshift("./lib/electron-main.js");
+        }
+
+        const app = await electron.launch({
+            env: process.env,
+            executablePath,
+            args,
+        });
+
+        await app.firstWindow();
+        await use(app);
+    },
+    page: async ({ app }, use) => {
+        const window = await app.firstWindow();
+        await use(window);
+        await app.close().catch((e) => {
+            console.error(e);
+        });
+    },
+});
+
+export const expect = baseExpect;

playwright/tsconfig.json

@@ -0,0 +1,11 @@
+{
+    "compilerOptions": {
+        "resolveJsonModule": true,
+        "moduleResolution": "node",
+        "esModuleInterop": true,
+        "target": "es2017",
+        "module": "es2022",
+        "lib": ["ESNext", "es2021", "dom"],
+    },
+    "include": ["**/*.ts"],
+}

release.sh

@@ -1,12 +1,9 @@
 #!/bin/bash
 #
 # Script to perform a release of element-desktop.
-#
-# Requires githib-changelog-generator; to install, do 
-#   pip install git+https://github.com/matrix-org/github-changelog-generator.git
 
 set -e
 
-cd `dirname $0`
+cd "$(dirname "$0")"
 
-./node_modules/matrix-js-sdk/release.sh -n -z "$@"
+./node_modules/matrix-js-sdk/release.sh "$@"

release_config.yaml

@@ -1 +1,7 @@
 signing_id: releases@riot.im
+subprojects:
+    element-web:
+        includeByDefault: true
+        # Because element-web is not in our dependencies, but the versions
+        # follow those of this project (well, vice-versa really)
+        mirrorVersion: true

scripts/@types/find-npm-prefix.d.ts

@@ -1,5 +1,5 @@
 /*
-Copyright 2018, 2019 New Vector Ltd
+Copyright 2022 New Vector Ltd
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,7 +14,6 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-const { ipcRenderer } = require('electron');
-
-// expose ipcRenderer to the renderer process
-window.ipcRenderer = ipcRenderer;
+declare module "find-npm-prefix" {
+    export default function findPrefix(dir: string): Promise<string>;
+}

scripts/@types/node-pre-gyp.d.ts

@@ -0,0 +1,20 @@
+/*
+Copyright 2022 New Vector Ltd
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+declare module "node-pre-gyp/lib/util/versioning" {
+    // eslint-disable-next-line @typescript-eslint/naming-convention
+    export function get_runtime_abi(runtime: string, version: string): string;
+}

scripts/ci/install-deps.sh

@@ -1,5 +0,0 @@
-#!/bin/bash
-
-set -ex
-
-yarn install $@

scripts/copy-res.ts

@@ -0,0 +1,81 @@
+#!/usr/bin/env -S npx ts-node
+
+// copies resources into the lib directory.
+
+import parseArgs from "minimist";
+import * as chokidar from "chokidar";
+import * as path from "path";
+import * as fs from "fs";
+
+const argv = parseArgs(process.argv.slice(2), {});
+
+const watch = argv.w;
+const verbose = argv.v;
+
+function errCheck(err?: Error): void {
+    if (err) {
+        console.error(err.message);
+        process.exit(1);
+    }
+}
+
+const I18N_BASE_PATH = "src/i18n/strings/";
+const INCLUDE_LANGS = fs.readdirSync(I18N_BASE_PATH).filter((fn) => fn.endsWith(".json"));
+
+// Ensure lib, lib/i18n and lib/i18n/strings all exist
+fs.mkdirSync("lib/i18n/strings", { recursive: true });
+
+type Translations = Record<string, Record<string, string> | string>;
+
+function genLangFile(file: string, dest: string): void {
+    const translations: Translations = {};
+    [file].forEach(function (f) {
+        if (fs.existsSync(f)) {
+            try {
+                Object.assign(translations, JSON.parse(fs.readFileSync(f).toString()));
+            } catch (e) {
+                console.error("Failed: " + f, e);
+                throw e;
+            }
+        }
+    });
+
+    const json = JSON.stringify(translations, null, 4);
+    const filename = path.basename(file);
+
+    fs.writeFileSync(dest + filename, json);
+    if (verbose) {
+        console.log("Generated language file: " + filename);
+    }
+}
+
+/*
+ watch the input files for a given language,
+ regenerate the file, and regenerating languages.json with the new filename
+ */
+function watchLanguage(file: string, dest: string): void {
+    // XXX: Use a debounce because for some reason if we read the language
+    // file immediately after the FS event is received, the file contents
+    // appears empty. Possibly https://github.com/nodejs/node/issues/6112
+    let makeLangDebouncer: NodeJS.Timeout | undefined;
+    const makeLang = (): void => {
+        if (makeLangDebouncer) {
+            clearTimeout(makeLangDebouncer);
+        }
+        makeLangDebouncer = setTimeout(() => {
+            genLangFile(file, dest);
+        }, 500);
+    };
+
+    chokidar.watch(file).on("add", makeLang).on("change", makeLang).on("error", errCheck);
+}
+
+// language resources
+const I18N_DEST = "lib/i18n/strings/";
+INCLUDE_LANGS.forEach((file): void => {
+    genLangFile(I18N_BASE_PATH + file, I18N_DEST);
+}, {});
+
+if (watch) {
+    INCLUDE_LANGS.forEach((file) => watchLanguage(I18N_BASE_PATH + file, I18N_DEST));
+}

scripts/electron_afterPack.js

@@ -1,15 +0,0 @@
-const fsProm = require('fs').promises;
-const path = require('path');
-
-exports.default = async function(context) {
-    const { electronPlatformName, appOutDir } = context;
-
-    // Squirrel windows will try to relaunch the app using an executable of the same name as
-    // before in the new version, so will fail if the executable is now called something else.
-    // We add a fake Riot.exe that it can run which runs the real one.
-    // This also gets signed automatically, presumably because electron-build just looks for all
-    // exe files and signs them all...
-    if (electronPlatformName === 'win32') {
-        await fsProm.copyFile('build/rebrand_stub/rebrand_stub.exe', path.join(appOutDir, "Riot.exe"));
-    }
-};

scripts/electron_afterSign.js

@@ -1,29 +0,0 @@
-const { notarize } = require('electron-notarize');
-
-exports.default = async function(context) {
-    const { electronPlatformName, appOutDir } = context;
-    const appId = context.packager.info.appInfo.id;
-
-    if (electronPlatformName === 'darwin') {
-        const appName = context.packager.appInfo.productFilename;
-        // We get the password from keychain. The keychain stores
-        // user IDs too, but apparently altool can't get the user ID
-        // from the keychain, so we need to get it from the environment.
-        const userId = process.env.NOTARIZE_APPLE_ID;
-        if (userId === undefined) {
-            console.log("*************************************");
-            console.log("*   NOTARIZE_APPLE_ID is not set.   *");
-            console.log("* This build will NOT be notarised. *");
-            console.log("*************************************");
-            return;
-        }
-
-        console.log("Notarising macOS app. This may be some time.");
-        return await notarize({
-            appBundleId: appId,
-            appPath: `${appOutDir}/${appName}.app`,
-            appleId: userId,
-            appleIdPassword: '@keychain:NOTARIZE_CREDS',
-        });
-    }
-};

scripts/electron_winSign.js

@@ -1,74 +0,0 @@
-const { execFile } = require('child_process');
-
-// Loosely based on computeSignToolArgs from app-builder-lib/src/codeSign/windowsCodeSign.ts
-function computeSignToolArgs(options, keyContainer) {
-    const args = [];
-
-    if (process.env.ELECTRON_BUILDER_OFFLINE !== "true") {
-        const timestampingServiceUrl = options.options.timeStampServer || "http://timestamp.digicert.com";
-        args.push(
-            options.isNest || options.hash === "sha256" ? "/tr" : "/t",
-            options.isNest || options.hash === "sha256" ? (
-                options.options.rfc3161TimeStampServer || "http://timestamp.comodoca.com/rfc3161"
-            ) : timestampingServiceUrl,
-        );
-    }
-
-    args.push('/kc', keyContainer);
-    // To use the hardware token (this should probably be less hardcoded)
-    args.push('/csp', 'eToken Base Cryptographic Provider');
-    // The certificate file. Somehow this appears to be the only way to specify
-    // the cert that works. If you specify the subject name or hash, it will
-    // say it can't associate the private key to the certificate.
-    // TODO: Find a way to pass this through from the electron-builder config
-    // so we don't have to hard-code this here
-    // fwiw https://stackoverflow.com/questions/17927895/automate-extended-validation-ev-code-signing
-    // is about the most useful resource on automating code signing...
-    args.push('/f', 'element.io\\New_Vector_Ltd.pem');
-
-    if (options.hash !== "sha1") {
-        args.push("/fd", options.hash);
-        if (process.env.ELECTRON_BUILDER_OFFLINE !== "true") {
-            args.push("/td", "sha256");
-        }
-    }
-
-    // msi does not support dual-signing
-    if (options.isNest) {
-      args.push("/as");
-    }
-
-    // https://github.com/electron-userland/electron-builder/issues/2875#issuecomment-387233610
-    args.push("/debug");
-    // must be last argument
-    args.push(options.path);
-
-    return args;
-}
-
-exports.default = async function(options) {
-    const keyContainer = process.env.SIGNING_KEY_CONTAINER;
-    if (keyContainer === undefined) {
-        console.warn(
-            "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n" +
-            "! Skipping Windows signing.          !\n" +
-            "! SIGNING_KEY_CONTAINER not defined. !\n" +
-            "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!",
-        );
-        return;
-    }
-
-    return new Promise((resolve, reject) => {
-        const args = ['sign'].concat(computeSignToolArgs(options, keyContainer));
-
-        execFile('signtool', args, {}, (error, stdout) => {
-            if (error) {
-                console.error("signtool failed with code " + error);
-                reject("signtool failed with code " + error);
-                console.log(stdout);
-            } else {
-                resolve();
-            }
-        });
-    });
-};

scripts/fetch-package.js

@@ -1,292 +0,0 @@
-#!/usr/bin/env node
-
-const process = require('process');
-const path = require('path');
-const fs = require('fs');
-const fsPromises = require('fs').promises;
-const childProcess = require('child_process');
-const tar = require('tar');
-const asar = require('asar');
-const needle = require('needle');
-
-const riotDesktopPackageJson = require('../package.json');
-
-const PUB_KEY_URL = "https://packages.riot.im/riot-release-key.asc";
-const PACKAGE_URL_PREFIX = "https://github.com/vector-im/element-web/releases/download/";
-const ASAR_PATH = 'webapp.asar';
-
-const {setPackageVersion, setDebVersion} = require('./set-version.js');
-
-async function getLatestDevelopUrl(bkToken) {
-    const buildsResult = await needle('get',
-        "https://api.buildkite.com/v2/organizations/matrix-dot-org/pipelines/element-web/builds",
-        {
-            branch: 'develop',
-            state: 'passed',
-            per_page: 1,
-        },
-        {
-            headers: {
-                authorization: "Bearer " + bkToken,
-            },
-        },
-    );
-    const latestBuild = buildsResult.body[0];
-    console.log("Latest build is " + latestBuild.number);
-    let artifactUrl;
-    for (const job of latestBuild.jobs) {
-        // Strip any colon-form emoji from the build name
-        if (job.name && job.name.replace(/:\w*:\s*/, '') === 'Package') {
-            artifactUrl = job.artifacts_url;
-            break;
-        }
-    }
-    if (artifactUrl === undefined) {
-        throw new Error("Couldn't find artifact URL - has the name of the package job changed?");
-    }
-
-    const artifactsResult = await needle('get', artifactUrl, {},
-        {
-            headers: {
-                authorization: "Bearer " + bkToken,
-            },
-        },
-    );
-    let dlUrl;
-    let dlFilename;
-    for (const artifact of artifactsResult.body) {
-        if (artifact.filename && /^riot-.*\.tar.gz$/.test(artifact.filename)) {
-            dlUrl = artifact.download_url;
-            dlFilename = artifact.filename;
-            break;
-        }
-    }
-    if (dlUrl === undefined) {
-        throw new Error("Couldn't find artifact download URL - has the artifact filename changed?");
-    }
-    console.log("Fetching artifact URL...");
-    const dlResult = await needle('get', dlUrl, {},
-        {
-            headers: {
-                authorization: "Bearer " + bkToken,
-            },
-            // This URL will give us a Location header, but will also give us
-            // a JSON object with the direct URL. We'll take the URL and pass it
-            // back, then we can easily support specifying a URL directly.
-            follow_max: 0,
-        },
-    );
-    return [dlFilename, dlResult.body.url];
-}
-
-async function downloadToFile(url, filename) {
-    console.log("Downloading " + url + "...");
-
-    try {
-        await needle('get', url, null,
-            {
-                follow_max: 5,
-                output: filename,
-            },
-        );
-    } catch (e) {
-        try {
-            await fsPromises.unlink(filename);
-        } catch (_) {}
-        throw e;
-    }
-}
-
-async function verifyFile(filename) {
-    return new Promise((resolve, reject) => {
-        childProcess.execFile('gpg', ['--verify', filename + '.asc', filename], (error) => {
-            if (error) {
-                reject(error);
-            } else {
-                resolve();
-            }
-        });
-    });
-}
-
-async function main() {
-    let verify = true;
-    let importkey = false;
-    let pkgDir = 'packages';
-    let deployDir = 'deploys';
-    let cfgDir;
-    let targetVersion;
-    let filename;
-    let url;
-    let setVersion = false;
-
-    while (process.argv.length > 2) {
-        switch (process.argv[2]) {
-            case '--noverify':
-                verify = false;
-                break;
-            case '--importkey':
-                importkey = true;
-                break;
-            case '--packages':
-                process.argv.shift();
-                pkgDir = process.argv[2];
-                break;
-            case '--deploys':
-                process.argv.shift();
-                deployDir = process.argv[2];
-                break;
-            case '--cfgdir':
-            case '-d':
-                process.argv.shift();
-                cfgDir = process.argv[2];
-                break;
-            default:
-                targetVersion = process.argv[2];
-        }
-        process.argv.shift();
-    }
-
-    if (targetVersion === undefined) {
-        targetVersion = 'v' + riotDesktopPackageJson.version;
-        filename = 'riot-' + targetVersion + '.tar.gz';
-        url = PACKAGE_URL_PREFIX + targetVersion + '/' + filename;
-    } else if (targetVersion === 'develop') {
-        const buildKiteApiKey = process.env.BUILDKITE_API_KEY;
-        if (buildKiteApiKey === undefined) {
-            console.log("Set BUILDKITE_API_KEY to fetch latest develop version");
-            console.log(
-                "Sorry - Buildkite's API requires authentication to access builds, " +
-                "even if those builds are accessible on the web with no auth.",
-            );
-            process.exit(1);
-        }
-        [filename, url] = await getLatestDevelopUrl(buildKiteApiKey);
-        verify = false; // develop builds aren't signed
-    } else {
-        filename = 'riot-' + targetVersion + '.tar.gz';
-        url = PACKAGE_URL_PREFIX + targetVersion + '/' + filename;
-        setVersion = true;
-    }
-
-    const haveGpg = await new Promise((resolve) => {
-        childProcess.execFile('gpg', ['--version'], (error) => {
-            resolve(!error);
-        });
-    });
-
-    if (importkey) {
-        if (!haveGpg) {
-            console.log("Can't import key without working GPG binary: install GPG and try again");
-            return 1;
-        }
-
-        await new Promise((resolve) => {
-            const gpgProc = childProcess.execFile('gpg', ['--import'], (error) => {
-                if (error) {
-                    console.log("Failed to import key", error);
-                } else {
-                    console.log("Key imported!");
-                }
-                resolve(!error);
-            });
-            needle.get(PUB_KEY_URL).pipe(gpgProc.stdin);
-        });
-        return 0;
-    }
-
-    if (cfgDir === undefined) {
-        console.log("No config directory set");
-        console.log("Specify a config directory with --cfgdir or -d");
-        console.log("To build with no config (and no auto-update), pass the empty string (-d '')");
-        return 1;
-    }
-
-    if (verify && !haveGpg) {
-        console.log("No working GPG binary: install GPG or pass --noverify to skip verification");
-        return 1;
-    }
-
-    let haveDeploy = false;
-    const expectedDeployDir = path.join(deployDir, path.basename(filename).replace(/\.tar\.gz/, ''));
-    try {
-        await fs.opendir(expectedDeployDir);
-        console.log(expectedDeployDir + "already exists");
-        haveDeploy = true;
-    } catch (e) {
-    }
-
-    if (!haveDeploy) {
-        const outPath = path.join(pkgDir, filename);
-        try {
-            await fsPromises.stat(outPath);
-            console.log("Already have " + filename + ": not redownloading");
-        } catch (e) {
-            try {
-                await downloadToFile(url, outPath);
-            } catch (e) {
-                console.log("Failed to download " + url, e);
-                return 1;
-            }
-        }
-
-        if (verify) {
-            try {
-                await fsPromises.stat(outPath+'.asc');
-                console.log("Already have " + filename + ".asc: not redownloading");
-            } catch (e) {
-                try {
-                    await downloadToFile(url + '.asc', outPath + '.asc');
-                } catch (e) {
-                    console.log("Failed to download " + url, e);
-                    return 1;
-                }
-            }
-
-            try {
-                await verifyFile(outPath);
-                console.log(outPath + " downloaded and verified");
-            } catch (e) {
-                console.log("Signature verification failed!", e);
-                return 1;
-            }
-        } else {
-            console.log(outPath + " downloaded but NOT verified");
-        }
-
-        await tar.x({
-            file: outPath,
-            cwd: deployDir,
-        });
-    }
-
-    try {
-        await fsPromises.stat(ASAR_PATH);
-        console.log(ASAR_PATH + " already present: removing");
-        await fsPromises.unlink(ASAR_PATH);
-    } catch (e) {
-    }
-
-    if (cfgDir.length) {
-        const configJsonSource = path.join(cfgDir, 'config.json');
-        const configJsonDest = path.join(expectedDeployDir, 'config.json');
-        console.log(configJsonSource + ' -> ' + configJsonDest);
-        await fsPromises.copyFile(configJsonSource, configJsonDest);
-    } else {
-        console.log("Skipping config file");
-    }
-
-    console.log("Pack " + expectedDeployDir + " -> " + ASAR_PATH);
-    await asar.createPackage(expectedDeployDir, ASAR_PATH);
-
-    if (setVersion) {
-        const semVer = targetVersion.slice(1);
-        console.log("Updating version to " + semVer);
-        await setPackageVersion(semVer);
-        await setDebVersion(semVer);
-    }
-
-    console.log("Done!");
-}
-
-main().then((ret) => process.exit(ret)).catch(e => process.exit(1));

scripts/fetch-package.ts

@@ -0,0 +1,237 @@
+#!/usr/bin/env -S npx ts-node --resolveJsonModule
+
+import * as path from "path";
+import { createWriteStream, promises as fs } from "fs";
+import * as childProcess from "child_process";
+import tar from "tar";
+import * as asar from "@electron/asar";
+import fetch from "node-fetch";
+import { promises as stream } from "stream";
+
+import riotDesktopPackageJson from "../package.json";
+import { setPackageVersion } from "./set-version";
+
+const PUB_KEY_URL = "https://packages.riot.im/element-release-key.asc";
+const PACKAGE_URL_PREFIX = "https://github.com/element-hq/element-web/releases/download/";
+const DEVELOP_TGZ_URL = "https://develop.element.io/develop.tar.gz";
+const ASAR_PATH = "webapp.asar";
+
+async function downloadToFile(url: string, filename: string): Promise<void> {
+    console.log("Downloading " + url + "...");
+
+    try {
+        const resp = await fetch(url);
+        if (!resp.ok) throw new Error(`unexpected response ${resp.statusText}`);
+        if (!resp.body) throw new Error(`unexpected response has no body ${resp.statusText}`);
+        await stream.pipeline(resp.body, createWriteStream(filename));
+    } catch (e) {
+        console.error(e);
+        try {
+            await fs.unlink(filename);
+        } catch (_) {}
+        throw e;
+    }
+}
+
+async function verifyFile(filename: string): Promise<void> {
+    return new Promise<void>((resolve, reject) => {
+        childProcess.execFile("gpg", ["--verify", filename + ".asc", filename], (error) => {
+            if (error) {
+                reject(error);
+            } else {
+                resolve();
+            }
+        });
+    });
+}
+
+async function main(): Promise<number | undefined> {
+    let verify = true;
+    let importkey = false;
+    let pkgDir = "packages";
+    let deployDir = "deploys";
+    let cfgDir: string | undefined;
+    let targetVersion: string | undefined;
+    let filename: string | undefined;
+    let url: string | undefined;
+    let setVersion = false;
+
+    while (process.argv.length > 2) {
+        switch (process.argv[2]) {
+            case "--noverify":
+                verify = false;
+                break;
+            case "--importkey":
+                importkey = true;
+                break;
+            case "--packages":
+                process.argv.shift();
+                pkgDir = process.argv[2];
+                break;
+            case "--deploys":
+                process.argv.shift();
+                deployDir = process.argv[2];
+                break;
+            case "--cfgdir":
+            case "-d":
+                process.argv.shift();
+                cfgDir = process.argv[2];
+                break;
+            default:
+                targetVersion = process.argv[2];
+        }
+        process.argv.shift();
+    }
+
+    if (targetVersion === undefined) {
+        targetVersion = "v" + riotDesktopPackageJson.version;
+    } else if (targetVersion !== "develop") {
+        setVersion = true; // version was specified
+    }
+
+    if (targetVersion === "develop") {
+        filename = "develop.tar.gz";
+        url = DEVELOP_TGZ_URL;
+        verify = false; // develop builds aren't signed
+    } else if (targetVersion.includes("://")) {
+        filename = targetVersion.substring(targetVersion.lastIndexOf("/") + 1);
+        url = targetVersion;
+        verify = false; // manually verified
+    } else {
+        filename = `element-${targetVersion}.tar.gz`;
+        url = PACKAGE_URL_PREFIX + targetVersion + "/" + filename;
+    }
+
+    const haveGpg = await new Promise<boolean>((resolve) => {
+        childProcess.execFile("gpg", ["--version"], (error) => {
+            resolve(!error);
+        });
+    });
+
+    if (importkey) {
+        if (!haveGpg) {
+            console.log("Can't import key without working GPG binary: install GPG and try again");
+            return 1;
+        }
+
+        await new Promise<boolean>((resolve) => {
+            const gpgProc = childProcess.execFile("gpg", ["--import"], (error) => {
+                if (error) {
+                    console.log("Failed to import key", error);
+                } else {
+                    console.log("Key imported!");
+                }
+                resolve(!error);
+            });
+            fetch(PUB_KEY_URL).then((resp) => {
+                stream.pipeline(resp.body, gpgProc.stdin!);
+            });
+        });
+        return 0;
+    }
+
+    if (cfgDir === undefined) {
+        console.log("No config directory set");
+        console.log("Specify a config directory with --cfgdir or -d");
+        console.log("To build with no config (and no auto-update), pass the empty string (-d '')");
+        return 1;
+    }
+
+    if (verify && !haveGpg) {
+        console.log("No working GPG binary: install GPG or pass --noverify to skip verification");
+        return 1;
+    }
+
+    let haveDeploy = false;
+    let expectedDeployDir = path.join(deployDir, path.basename(filename).replace(/\.tar\.gz/, ""));
+    try {
+        await fs.opendir(expectedDeployDir);
+        console.log(expectedDeployDir + "already exists");
+        haveDeploy = true;
+    } catch (e) {}
+
+    if (!haveDeploy) {
+        const outPath = path.join(pkgDir, filename);
+        try {
+            await fs.stat(outPath);
+            console.log("Already have " + filename + ": not redownloading");
+        } catch (e) {
+            try {
+                await downloadToFile(url, outPath);
+            } catch (e) {
+                console.log("Failed to download " + url, e);
+                return 1;
+            }
+        }
+
+        if (verify) {
+            try {
+                await fs.stat(outPath + ".asc");
+                console.log("Already have " + filename + ".asc: not redownloading");
+            } catch (e) {
+                try {
+                    await downloadToFile(url + ".asc", outPath + ".asc");
+                } catch (e) {
+                    console.log("Failed to download " + url, e);
+                    return 1;
+                }
+            }
+
+            try {
+                await verifyFile(outPath);
+                console.log(outPath + " downloaded and verified");
+            } catch (e) {
+                console.log("Signature verification failed!", e);
+                return 1;
+            }
+        } else {
+            console.log(outPath + " downloaded but NOT verified");
+        }
+
+        await tar.x({
+            file: outPath,
+            cwd: deployDir,
+            onentry: (entry) => {
+                // Find the appropriate extraction path, only needed for `develop` where the dir name is unknown
+                if (entry.type === "Directory" && !path.join(deployDir, entry.path).startsWith(expectedDeployDir)) {
+                    expectedDeployDir = path.join(deployDir, entry.path);
+                }
+            },
+        });
+    }
+
+    try {
+        await fs.stat(ASAR_PATH);
+        console.log(ASAR_PATH + " already present: removing");
+        await fs.unlink(ASAR_PATH);
+    } catch (e) {}
+
+    if (cfgDir.length) {
+        const configJsonSource = path.join(cfgDir, "config.json");
+        const configJsonDest = path.join(expectedDeployDir, "config.json");
+        console.log(configJsonSource + " -> " + configJsonDest);
+        await fs.copyFile(configJsonSource, configJsonDest);
+    } else {
+        console.log("Skipping config file");
+    }
+
+    console.log("Pack " + expectedDeployDir + " -> " + ASAR_PATH);
+    await asar.createPackage(expectedDeployDir, ASAR_PATH);
+
+    if (setVersion) {
+        const semVer = (await fs.readFile(path.join(expectedDeployDir, "version"), "utf-8")).trim();
+        console.log("Updating version to " + semVer);
+        await setPackageVersion(semVer);
+    }
+
+    console.log("Done!");
+}
+
+main()
+    .then((ret) => {
+        process.exit(ret);
+    })
+    .catch((e) => {
+        console.error(e);
+        process.exit(1);
+    });

scripts/fetchdep.sh

@@ -17,7 +17,8 @@ clone() {
     if [ -n "$branch" ]
     then
         echo "Trying to use $org/$repo#$branch"
-        git clone git://github.com/$org/$repo.git $repo --branch "$branch" --depth 1 && exit 0
+        # Disable auth prompts: https://serverfault.com/a/665959
+        GIT_TERMINAL_PROMPT=0 git clone https://github.com/$org/$repo.git $repo --branch "$branch" --depth 1 && exit 0
     fi
 }
 

scripts/generate-nightly-version.ts

@@ -0,0 +1,41 @@
+#!/usr/bin/env -S npx ts-node
+
+/**
+ * Script to generate incremental Nightly build versions, based on the latest Nightly build version of that kind.
+ * The version format is YYYYMMDDNN where NN is in case we need to do multiple versions in a day.
+ *
+ * NB. on windows, squirrel will try to parse the version number parts, including this string, into 32-bit integers,
+ * which is fine as long as we only add two digits to the end...
+ */
+
+import parseArgs from "minimist";
+
+const argv = parseArgs<{
+    latest?: string;
+}>(process.argv.slice(2), {
+    string: ["latest"],
+});
+
+function parseVersion(version: string): [Date, number] {
+    const year = parseInt(version.slice(0, 4), 10);
+    const month = parseInt(version.slice(4, 6), 10);
+    const day = parseInt(version.slice(6, 8), 10);
+    const num = parseInt(version.slice(8, 10), 10);
+    return [new Date(year, month - 1, day), num];
+}
+
+const [latestDate, latestNum] = argv.latest ? parseVersion(argv.latest) : [];
+
+const now = new Date();
+const month = (now.getMonth() + 1).toString().padStart(2, "0");
+const date = now.getDate().toString().padStart(2, "0");
+let buildNum = 1;
+if (latestDate && new Date(latestDate).getDate().toString().padStart(2, "0") === date) {
+    buildNum = latestNum! + 1;
+}
+
+if (buildNum > 99) {
+    throw new Error("Maximum number of Nightlies exceeded on this day.");
+}
+
+console.log(now.getFullYear() + month + date + buildNum.toString().padStart(2, "0"));

scripts/get-version.ts

@@ -0,0 +1,25 @@
+#!/usr/bin/env -S npx ts-node
+
+/*
+ * Checks for the presence of a webapp, inspects its version and prints it
+ */
+
+import { versionFromAsar } from "./set-version";
+
+async function main(): Promise<number> {
+    const version = await versionFromAsar();
+    console.log(version);
+
+    return 0;
+}
+
+if (require.main === module) {
+    main()
+        .then((ret) => {
+            process.exit(ret);
+        })
+        .catch((e) => {
+            console.error(e);
+            process.exit(1);
+        });
+}

scripts/hak/README.md

@@ -1,40 +1,40 @@
-hak
-===
+# hak
 
 This tool builds native dependencies for element-desktop. Here follows some very minimal
 documentation for it.
 
 Goals:
- * Must build compiled native node modules in a shippable state
-   (ie. only dynamically linked against libraries that will be on the
-   target system, all unnecessary files removed).
- * Must be able to build any native module, no matter what build system
-   it uses (electron-rebuild is supposed to do this job but only works
-   for modules that use gyp).
+
+-   Must build compiled native node modules in a shippable state
+    (ie. only dynamically linked against libraries that will be on the
+    target system, all unnecessary files removed).
+-   Must be able to build any native module, no matter what build system
+    it uses (electron-rebuild is supposed to do this job but only works
+    for modules that use gyp).
 
 It's also loosely designed to be a general tool and agnostic to what it's
 actually building. It's used here to build modules for the electron app
 but should work equally well for building modules for normal node.
 
-Running
-=======
+# Running
+
 Hak is invoked with a command and a dependency, eg. `yarn run hak fetch matrix-seshat`.
 If no dependencies are given, hak runs the command on all dependencies.
 
-Files
-=====
+# Files
+
 There are a lot of files involved:
 
- * scripts/hak/... - The tool itself
- * hak/[dependency] - Files provided by the app that tell hak how to build each of its native dependencies.
-       Contains a hak.json file and also some script files, each of which must be referenced in hak.json.
- * .hak/ - Files generated by hak in the course of doing its job. Includes the dependency module itself and
-       any of the native dependency's native dependencies.
- * .hak/[dependency]/build - An extracted copy of the dependency's node module used to build it.
- * .hak/[dependency]/out - Another extracted copy of the dependency, this one contains only what will be shipped.
+-   scripts/hak/... - The tool itself
+-   hak/[dependency] - Files provided by the app that tell hak how to build each of its native dependencies.
+    Contains a hak.json file and also some script files, each of which must be referenced in hak.json.
+-   .hak/ - Files generated by hak in the course of doing its job. Includes the dependency module itself and
+    any of the native dependency's native dependencies.
+-   .hak/[dependency]/build - An extracted copy of the dependency's node module used to build it.
+-   .hak/[dependency]/out - Another extracted copy of the dependency, this one contains only what will be shipped.
+
+# Workings
 
-Workings
-========
 Hak works around native node modules that try to fetch or build their native component in
 the npm 'install' phase - modules that do this will typically end up with native components
 targeted to the build platform and the node that npm/yarn is using, which is no good for an
@@ -49,33 +49,33 @@ This also means that the dependencies cannot be listed in `dependencies` or
 try to fetch their native parts. Instead, they are listed in `hakDependencies` which
 hak reads to install them for you.
 
-Hak will *not* install dependencies for the copy of the module it links into your
+Hak will _not_ install dependencies for the copy of the module it links into your
 project, so if your native module has javascript dependencies that are actually needed at
 runtime (and not just to fetch / build the native parts), it won't work.
 
 Hak will generate a `.yarnrc` in the project directory to set the link directory to its
 own in the .hak directory (unless one already exists, in which case this is your problem).
 
-Lifecycle
-=========
-Hak is divided into lifecycle stages, in order:
- * fetch - Download and extract the source of the dependency
- * link - Link the copy of the dependency into your node_modules directory
- * fetchDeps - Fetch & extract any native dependencies required to build the module.
- * build - The Good Stuff. Configure and build any native dependencies, then the module itself.
- * copy - Copy the built artifact from the module build directory to the module output directory.
+# Lifecycle
+
+Hak is divided into lifecycle stages, in order:
+
+-   fetch - Download and extract the source of the dependency
+-   link - Link the copy of the dependency into your node_modules directory
+-   build - The Good Stuff. Configure and build any native dependencies, then the module itself.
+-   copy - Copy the built artifact from the module build directory to the module output directory.
+
+# hak.json
 
-hak.json
-========
 The scripts section contains scripts used for lifecycle stages that need them (fetch, fetchDeps, build).
 It also contains 'prune' and 'copy' which are globs of files to delete from the output module directory
 and copy over from the module build directory to the output module directory, respectively.
 
-Shortcomings
-============
+# Shortcomings
+
 Hak doesn't know about dependencies between lifecycle stages, ie. it doesn't know that you need to
 'fetch' and 'fetchDeps' before you can 'build', etc. You get to run each individually, and remember
 the right order.
 
-There is also a *lot* of duplication in the command execution: we should abstract away
+There is also a _lot_ of duplication in the command execution: we should abstract away
 some of the boilerplate required to run commands & so forth.

scripts/hak/build.ts

@@ -14,8 +14,9 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-async function build(hakEnv, moduleInfo) {
+import { DependencyInfo } from "./dep";
+import HakEnv from "./hakEnv";
+
+export default async function build(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
     await moduleInfo.scripts.build(hakEnv, moduleInfo);
 }
-
-module.exports = build;

scripts/hak/check.ts

@@ -14,10 +14,11 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-async function check(hakEnv, moduleInfo) {
+import { DependencyInfo } from "./dep";
+import HakEnv from "./hakEnv";
+
+export default async function check(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
     if (moduleInfo.scripts.check) {
         await moduleInfo.scripts.check(hakEnv, moduleInfo);
     }
 }
-
-module.exports = check;

scripts/hak/clean.js

@@ -1,53 +0,0 @@
-/*
-Copyright 2020 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-const path = require('path');
-
-const rimraf = require('rimraf');
-
-async function clean(hakEnv, moduleInfo) {
-    await new Promise((resolve, reject) => {
-        rimraf(moduleInfo.moduleDotHakDir, (err) => {
-            if (err) {
-                reject(err);
-            } else {
-                resolve();
-            }
-        });
-    });
-
-    await new Promise((resolve, reject) => {
-        rimraf(path.join(hakEnv.dotHakDir, 'links', moduleInfo.name), (err) => {
-            if (err) {
-                reject(err);
-            } else {
-                resolve();
-            }
-        });
-    });
-
-    await new Promise((resolve, reject) => {
-        rimraf(path.join(hakEnv.projectRoot, 'node_modules', moduleInfo.name), (err) => {
-            if (err) {
-                reject(err);
-            } else {
-                resolve();
-            }
-        });
-    });
-}
-
-module.exports = clean;

scripts/hak/clean.ts

@@ -0,0 +1,27 @@
+/*
+Copyright 2020 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import path from "path";
+import { rimraf } from "rimraf";
+
+import { DependencyInfo } from "./dep";
+import HakEnv from "./hakEnv";
+
+export default async function clean(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    await rimraf(moduleInfo.moduleDotHakDir);
+    await rimraf(path.join(hakEnv.dotHakDir, "links", moduleInfo.name));
+    await rimraf(path.join(hakEnv.projectRoot, "node_modules", moduleInfo.name));
+}

scripts/hak/copy.js

@@ -1,67 +0,0 @@
-/*
-Copyright 2020 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-const path = require('path');
-const fsProm = require('fs').promises;
-
-const rimraf = require('rimraf');
-const glob = require('glob');
-const mkdirp = require('mkdirp');
-
-async function copy(hakEnv, moduleInfo) {
-    if (moduleInfo.cfg.prune) {
-        console.log("Removing " + moduleInfo.cfg.prune + " from " + moduleInfo.moduleOutDir);
-        // rimraf doesn't have a 'cwd' option: it always uses process.cwd()
-        // (and if you set glob.cwd it just breaks because it can't find the files)
-        const oldCwd = process.cwd();
-        try {
-            process.chdir(moduleInfo.moduleOutDir);
-            await new Promise((resolve, reject) => {
-                rimraf(moduleInfo.cfg.prune, {}, err => {
-                    err ? reject(err) : resolve();
-                });
-            });
-        } finally {
-            process.chdir(oldCwd);
-        }
-    }
-
-    if (moduleInfo.cfg.copy) {
-        console.log(
-            "Copying " + moduleInfo.cfg.prune + " from " +
-            moduleInfo.moduleOutDir + " to " + moduleInfo.moduleOutDir,
-        );
-        const files = await new Promise(async (resolve, reject) => {
-            glob(moduleInfo.cfg.copy, {
-                nosort: true,
-                silent: true,
-                cwd: moduleInfo.moduleBuildDir,
-            }, (err, files) => {
-                err ? reject(err) : resolve(files);
-            });
-        });
-        for (const f of files) {
-            console.log("\t" + f);
-            const src = path.join(moduleInfo.moduleBuildDir, f);
-            const dst = path.join(moduleInfo.moduleOutDir, f);
-
-            await mkdirp(path.dirname(dst));
-            await fsProm.copyFile(src, dst);
-        }
-    }
-}
-
-module.exports = copy;

scripts/hak/copy.ts

@@ -0,0 +1,85 @@
+/*
+Copyright 2020-2021 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import path from "path";
+import fsProm from "fs/promises";
+import childProcess from "child_process";
+import { rimraf } from "rimraf";
+import { glob } from "glob";
+import { mkdirp } from "mkdirp";
+
+import HakEnv from "./hakEnv";
+import { DependencyInfo } from "./dep";
+
+export default async function copy(hakEnv: HakEnv, moduleInfo: DependencyInfo): Promise<void> {
+    if (moduleInfo.cfg.prune) {
+        console.log("Removing " + moduleInfo.cfg.prune + " from " + moduleInfo.moduleOutDir);
+        // rimraf doesn't have a 'cwd' option: it always uses process.cwd()
+        // (and if you set glob.cwd it just breaks because it can't find the files)
+        const oldCwd = process.cwd();
+        try {
+            await mkdirp(moduleInfo.moduleOutDir);
+            process.chdir(moduleInfo.moduleOutDir);
+            await rimraf(moduleInfo.cfg.prune);
+        } finally {
+            process.chdir(oldCwd);
+        }
+    }
+
+    if (moduleInfo.cfg.copy) {
+        // If there are multiple moduleBuildDirs, singular moduleBuildDir
+        // is the same as moduleBuildDirs[0], so we're just listing the contents
+        // of the first one.
+        const files = await glob(moduleInfo.cfg.copy, {
+            cwd: moduleInfo.moduleBuildDir,
+        });
+
+        if (moduleInfo.moduleBuildDirs.length > 1) {
+            if (!hakEnv.isMac()) {
+                console.error(
+                    "You asked me to copy multiple targets but I've only been taught " + "how to do that on macOS.",
+                );
+                throw new Error("Can't copy multiple targets on this platform");
+            }
+
+            for (const f of files) {
+                const components = moduleInfo.moduleBuildDirs.map((dir) => path.join(dir, f));
+                const dst = path.join(moduleInfo.moduleOutDir, f);
+
+                await mkdirp(path.dirname(dst));
+                await new Promise<void>((resolve, reject) => {
+                    childProcess.execFile("lipo", ["-create", "-output", dst, ...components], (err) => {
+                        if (err) {
+                            reject(err);
+                        } else {
+                            resolve();
+                        }
+                    });
+                });
+            }
+        } else {
+            console.log("Copying files from " + moduleInfo.moduleBuildDir + " to " + moduleInfo.moduleOutDir);
+            for (const f of files) {
+                console.log("\t" + f);
+                const src = path.join(moduleInfo.moduleBuildDir, f);
+                const dst = path.join(moduleInfo.moduleOutDir, f);
+
+                await mkdirp(path.dirname(dst));
+                await fsProm.copyFile(src, dst);
+            }
+        }
+    }
+}

scripts/hak/dep.ts

@@ -0,0 +1,32 @@
+/*
+Copyright 2021 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import HakEnv from "./hakEnv";
+
+export interface DependencyInfo {
+    name: string;
+    version: string;
+    cfg: Record<string, any>;
+    moduleHakDir: string;
+    moduleDotHakDir: string;
+    moduleTargetDotHakDir: string;
+    moduleBuildDir: string;
+    moduleBuildDirs: string[];
+    moduleOutDir: string;
+    nodeModuleBinDir: string;
+    depPrefix: string;
+    scripts: Record<string, (hakEnv: HakEnv, moduleInfo: DependencyInfo) => Promise<void>>;
+}

scripts/hak/fetch.js

@@ -1,125 +0,0 @@
-/*
-Copyright 2020 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-const path = require('path');
-const url = require('url');
-const fsProm = require('fs').promises;
-const childProcess = require('child_process');
-
-const npm = require('npm');
-const semver = require('semver');
-const needle = require('needle');
-const mkdirp = require('mkdirp');
-const tar = require('tar');
-
-async function fetch(hakEnv, moduleInfo) {
-    let haveModuleBuildDir;
-    try {
-        const stats = await fsProm.stat(moduleInfo.moduleBuildDir);
-        haveModuleBuildDir = stats.isDirectory();
-    } catch (e) {
-        haveModuleBuildDir = false;
-    }
-
-    if (haveModuleBuildDir) return;
-
-    await new Promise((resolve) => {
-        npm.load({'loglevel': 'silent'}, resolve);
-    });
-
-    console.log("Fetching " + moduleInfo.name + " at version " + moduleInfo.version);
-    const versions = await new Promise((resolve, reject) => {
-        npm.view([
-            moduleInfo.name + '@' + moduleInfo.version,
-            'dist.tarball',
-            (err, versions) => {
-                if (err) {
-                    reject(err);
-                } else {
-                    resolve(versions);
-                }
-            },
-        ]);
-    });
-
-    const orderedVersions = Object.keys(versions);
-    semver.sort(orderedVersions);
-
-    console.log("Resolved version " + orderedVersions[0] + " for " + moduleInfo.name);
-
-    const tarballUrl = versions[orderedVersions[0]]['dist.tarball'];
-
-    await mkdirp(moduleInfo.moduleDotHakDir);
-
-    const parsedUrl = url.parse(tarballUrl);
-    const tarballFile = path.join(moduleInfo.moduleDotHakDir, path.basename(parsedUrl.path));
-
-    let haveTarball;
-    try {
-        await fsProm.stat(tarballFile);
-        haveTarball = true;
-    } catch (e) {
-        haveTarball = false;
-    }
-    if (!haveTarball) {
-        console.log("Downloading " + tarballUrl);
-        await needle('get', tarballUrl, { output: tarballFile });
-    } else {
-        console.log(tarballFile + " already exists.");
-    }
-
-    await mkdirp(moduleInfo.moduleBuildDir);
-
-    await tar.x({
-        file: tarballFile,
-        cwd: moduleInfo.moduleBuildDir,
-        strip: 1,
-    });
-
-    console.log("Running yarn install in " + moduleInfo.moduleBuildDir);
-    await new Promise((resolve, reject) => {
-        const proc = childProcess.spawn(
-            hakEnv.isWin() ? 'yarn.cmd' : 'yarn',
-            ['install', '--ignore-scripts'],
-            {
-                stdio: 'inherit',
-                cwd: moduleInfo.moduleBuildDir,
-            },
-        );
-        proc.on('exit', code => {
-            code ? reject(code) : resolve();
-        });
-    });
-
-    // also extract another copy to the output directory at this point
-    // nb. we do not yarn install in the output copy: we could install in
-    // production mode to get only runtime dependencies and not devDependencies,
-    // but usually native modules come with dependencies that are needed for
-    // building/fetching the native modules (eg. node-pre-gyp) rather than
-    // actually used at runtime: we do not want to bundle these into our app.
-    // We therefore just install no dependencies at all, and accept that any
-    // actual runtime dependencies will have to be added to the main app's
-    // dependencies. We can't tell what dependencies are real runtime deps
-    // and which are just used for native module building.
-    await mkdirp(moduleInfo.moduleOutDir);
-    await tar.x({
-        file: tarballFile,
-        cwd: moduleInfo.moduleOutDir,
-        strip: 1,
-    });
-}
-
-module.exports = fetch;