fix: Dockerfile to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-ALPINE322-BUSYBOX-14091698
- https://snyk.io/vuln/SNYK-ALPINE322-BUSYBOX-14091698
- https://snyk.io/vuln/SNYK-ALPINE322-BUSYBOX-14091698
- https://snyk.io/vuln/SNYK-ALPINE322-BUSYBOX-14091701
- https://snyk.io/vuln/SNYK-ALPINE322-BUSYBOX-14091701

.github/workflows/cicd.yaml

@@ -0,0 +1,172 @@
+name: CI/CD for Psiphon Docker
+
+on:
+  # Poll upstream Psiphon releases periodically (real builds)
+  schedule:
+    - cron: "0 */6 * * *"  # every 6 hours
+
+  # Manual runs, with an option to do a dry run (no push)
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Dry run (build but DO NOT push to Docker Hub)"
+        required: false
+        default: "true"
+        type: choice
+        options:
+          - "true"
+          - "false"
+
+permissions:
+  contents: read
+
+env:
+  DOCKERHUB_REPO: swarupsengupta2007/psiphon
+  TARGET_PLATFORMS: linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU (for multi-arch)
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Determine dry-run mode
+        id: dryrun
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ github.event.inputs.dry_run }}" = "true" ]; then
+            echo "dry_run=true" >> "$GITHUB_OUTPUT"
+            echo "Running in DRY-RUN mode (no push to Docker Hub)."
+          else
+            echo "dry_run=false" >> "$GITHUB_OUTPUT"
+            echo "Running in NORMAL mode (will push to Docker Hub if needed)."
+          fi
+
+      - name: Get latest psiphon-tunnel-core release & Go version
+        id: psiphon
+        run: |
+          API_URL="https://api.github.com/repos/Psiphon-Labs/psiphon-tunnel-core/releases/latest"
+
+          echo "Fetching latest release from ${API_URL}"
+          RESPONSE=$(curl -fsSL "$API_URL")
+
+          LATEST_TAG=$(echo "$RESPONSE" | jq -r '.tag_name')
+          if [ -z "$LATEST_TAG" ] || [ "$LATEST_TAG" = "null" ]; then
+            echo "Failed to fetch latest tag from Psiphon-Labs/psiphon-tunnel-core"
+            exit 1
+          fi
+
+          VERSION=${LATEST_TAG#v}
+
+          echo "Latest upstream tag: $LATEST_TAG"
+          echo "Normalized version (without v): $VERSION"
+
+          GO_MOD_URL="https://raw.githubusercontent.com/Psiphon-Labs/psiphon-tunnel-core/${LATEST_TAG}/go.mod"
+          echo "Fetching go.mod from: $GO_MOD_URL"
+
+          curl -fsSL "$GO_MOD_URL" -o /tmp/go.mod
+
+          GO_VERSION=$(awk '/^go [0-9]+\.[0-9]+/ {print $2; exit}' /tmp/go.mod)
+          if [ -z "$GO_VERSION" ]; then
+            echo "Could not determine Go version from go.mod; contents:"
+            cat /tmp/go.mod
+            exit 1
+          fi
+
+          echo "Detected Go version from go.mod: $GO_VERSION"
+
+          echo "latest_tag=$LATEST_TAG" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "go_version=$GO_VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Check if this Psiphon version tag already exists on Docker Hub
+        id: check
+        env:
+          DOCKERHUB_REPO: ${{ env.DOCKERHUB_REPO }}
+          VERSION: ${{ steps.psiphon.outputs.version }}
+        run: |
+          echo "Checking if ${DOCKERHUB_REPO}:${VERSION} exists on Docker Hub..."
+
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+            "https://hub.docker.com/v2/repositories/${DOCKERHUB_REPO}/tags/${VERSION}/")
+
+          echo "HTTP status from Docker Hub: $STATUS"
+
+          if [ "$STATUS" -eq 200 ]; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "Image tag ${DOCKERHUB_REPO}:${VERSION} already exists on Docker Hub."
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+            echo "Image tag ${DOCKERHUB_REPO}:${VERSION} does not exist yet."
+          fi
+
+      - name: Build and (maybe) push multi-arch image
+        # In dry-run: always build (even if tag exists), but do NOT push.
+        # In normal mode: only build if tag does not exist, and push.
+        if: steps.dryrun.outputs.dry_run == 'true' || steps.check.outputs.exists != 'true'
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: ${{ env.TARGET_PLATFORMS }}
+          push: ${{ steps.dryrun.outputs.dry_run != 'true' }}
+          tags: |
+            ${{ env.DOCKERHUB_REPO }}:${{ steps.psiphon.outputs.version }}
+            ${{ env.DOCKERHUB_REPO }}:latest
+          build-args: |
+            TARGETS= ${{ env.TARGET_PLATFORMS }}
+            GO_VERSION=${{ steps.psiphon.outputs.go_version }}
+            PSIPHON_VERSION=${{ steps.psiphon.outputs.version }}
+
+      - name: Summary of run (dry-run vs real)
+        if: always()
+        env:
+          DOCKERHUB_REPO: ${{ env.DOCKERHUB_REPO }}
+          VERSION: ${{ steps.psiphon.outputs.version }}
+          LATEST_TAG: ${{ steps.psiphon.outputs.latest_tag }}
+          GO_VERSION: ${{ steps.psiphon.outputs.go_version }}
+          DRY_RUN: ${{ steps.dryrun.outputs.dry_run }}
+          EXISTS: ${{ steps.check.outputs.exists }}
+          TARGET_PLATFORMS: ${{ env.TARGET_PLATFORMS }}
+        run: |
+          echo "================= CI SUMMARY ================="
+          echo "Upstream Psiphon tag:     ${LATEST_TAG}"
+          echo "Normalized version:       ${VERSION}"
+          echo "Go toolchain version:     ${GO_VERSION}"
+          echo "Target platforms:         ${TARGET_PLATFORMS}"
+          echo "Dry-run mode:             ${DRY_RUN}"
+          echo "Tag existed on DockerHub: ${EXISTS}"
+          echo "Image tags considered:    ${DOCKERHUB_REPO}:${VERSION}, ${DOCKERHUB_REPO}:latest"
+
+          if [ "$DRY_RUN" = "true" ]; then
+            echo ""
+            echo "Result: DRY-RUN"
+            echo " - Image was BUILT locally on the runner."
+            echo " - Image was NOT pushed to Docker Hub."
+          else
+            if [ "$EXISTS" = "true" ]; then
+              echo ""
+              echo "Result: SKIPPED PUSH"
+              echo " - Image tag already existed on Docker Hub."
+              echo " - No new image was built/pushed."
+            else
+              echo ""
+              echo "Result: REAL BUILD & PUSH"
+              echo " - Multi-arch image was built."
+              echo " - Pushed: ${DOCKERHUB_REPO}:${VERSION} and :latest"
+            fi
+          fi
+          echo "==============================================="

Dockerfile

@@ -1,40 +1,43 @@
 ARG BUILDPLATFORM=$BUILDPLATFORM
-FROM --platform=$BUILDPLATFORM golang:1.18 AS psiphon_builder
+ARG GO_VERSION=1.24.1
+FROM --platform=$BUILDPLATFORM golang:$GO_VERSION AS psiphon_builder
 WORKDIR /go
 LABEL stage=builder
-ARG VERSION=2.0.23
-ARG BUILDOS
-ARG BUILDARCH
 ARG TARGETS
-ENV DIR=/go/src/github.com/Psiphon-Labs/psiphon-tunnel-core \
+ARG PSIPHON_VERSION
-		GO111MODULE=off \
+ADD build.sh latest_version.sh /go/
-		CGO_ENABLED=0
+RUN <<__SCRIPT__
-SHELL ["/bin/bash", "-c"]
+ARGS=""
-RUN TARGET_PALTFORMS=${TARGETS:-"$BUILDOS/$BUILDARCH"} &&                                                    \
+if [ -n "${TARGETS}" ]; then
-    mkdir -p ${DIR}                                                                                       && \
+	ARGS="${ARGS} --targets ${TARGETS}"
-		curl -sL https://github.com/Psiphon-Labs/psiphon-tunnel-core/archive/refs/tags/v${VERSION}.tar.gz |      \
+fi
-		tar xz -C ${DIR} --strip-components=1                                                                 && \
+if [ -n "${PSIPHON_VERSION}" ]; then
-		(IFS=','; for PLATFORM in $TARGET_PALTFORMS;                                                             \
+	ARGS="${ARGS} --version ${PSIPHON_VERSION}"
-		do                                                                                                       \
+fi
-			OS=${PLATFORM%%/*}                                                                                  && \
+/go/build.sh ${ARGS}
-			ARCH=${PLATFORM#*/}                                                                                 && \
+__SCRIPT__
-			ARCH=${ARCH%/*}                                                                                     && \
-			VERSION=${PLATFORM##*/}                                                                             && \
-			TARGETVARIANT=${VERSION/$ARCH/}                                                                     && \
-			VERSION=${TARGETVER/v/}                                                                             && \
-			GOOS=${OS} GOARCH=${ARCH} go install -a -tags netgo                                                    \
-			-ldflags '-w -extldflags "-static"'                                                                    \
-			github.com/Psiphon-Labs/psiphon-tunnel-core/ConsoleClient                                           && \
-			BINARY=$(find /go/bin/* -name "ConsoleClient*")                                                     && \
-			mv ${BINARY} /go/psiphon_${OS}_${ARCH}_${TARGETVARIANT};                                               \
-		done)
 
-FROM swarupsengupta2007/alpine-s6:3.16.0
+FROM alpine:3.23.2
 ARG TARGETOS
 ARG TARGETARCH
 ARG TARGETVARIANT
-COPY base/ /
+RUN --mount=type=bind,from=psiphon_builder,source=/go/dist,target=/tmp/psiphon \
-COPY psiphon.config ${DEF_DEFAULTS}
+    --mount=type=bind,source=./assets,target=/tmp/assets \
-COPY --from=psiphon_builder /go/psiphon_${TARGETOS}_${TARGETARCH}_${TARGETVARIANT} ${DEF_APP}/psiphon
+	<<__SCRIPT__
-EXPOSE 8080 1080
+    apk add --no-cache tini
-VOLUME /config
+	cp /tmp/assets/start-psiphon /usr/local/bin/start-psiphon
+	cp /tmp/assets/healthcheck /usr/local/bin/healthcheck
+	mkdir -p /etc/psiphon
+	cp /tmp/assets/psiphon.config /etc/psiphon/psiphon.config
+	if [ -z "${TARGETVARIANT}" ]; then
+		cp /tmp/psiphon/psiphon_${TARGETOS}_${TARGETARCH} /usr/local/bin/psiphon
+	else
+		cp /tmp/psiphon/psiphon_${TARGETOS}_${TARGETARCH}_${TARGETVARIANT} /usr/local/bin/psiphon
+	fi
+	chmod +x /usr/local/bin/start-psiphon 
+	chmod +x /usr/local/bin/healthcheck
+	chmod +x /usr/local/bin/psiphon
+__SCRIPT__
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["/usr/local/bin/start-psiphon"]
+HEALTHCHECK --interval=30s --timeout=5s --start-period=2m --retries=3 CMD healthcheck

README.md

@@ -3,11 +3,10 @@
 Docker image for Psiphon
 
 Psiphon is an Internet censorship circumvention system. <br>
-This docker image runs the ConsoleClient from the [psiphon-tunnel-core](https://github.com/Psiphon-Labs/psiphon-tunnel-core "psiphon-tunnel-core").
+This Docker image runs the ConsoleClient from the [psiphon-tunnel-core](https://github.com/Psiphon-Labs/psiphon-tunnel-core "psiphon-tunnel-core").
 
-> This build uses `docker buildx` plugin with `docker-container` driver. <br>
+> This build uses the `docker buildx` plugin with the `docker-container` driver. <br>
 > Docker image available at [swarupsengupta2007/psiphon](https://hub.docker.com/r/swarupsengupta2007/psiphon "swarupsengupta2007/psiphon"). <br>
-> This is built on base image from [swarupsengupta2007/apine-s6-docker](https://github.com/swarupsengupta2007/alpine-s6-docker "swarupsengupta2007/apine-s6-docker")
 
 ```bash
 # Clone this repo
@@ -16,9 +15,9 @@ git clone https://github.com/swarupsengupta2007/psiphon-docker
 
 # Building<br>
 
-1. Ensure buildx is enabled for docker
+1. Ensure buildx is enabled for Docker
 2. Create a builder instance for multi-arch
-3. Build docker image for current platform or multi-arch
+3. Build Docker image for current platform or multi-arch
 ```bash
 # choose target platforms
 TARGETS="linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6"
@@ -26,19 +25,22 @@ TARGETS="linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6"
 # Create a builder instance if it doesn't exist
 docker buildx create --name cross-platform --platform ${TARGETS} --use 
 
-# Build for current platform and load to docker image
+# Build for the current platform and load to Docker image
 docker buildx build -t <your_tag> . --load
 
-# build for multi-arch and push to registry
+# If not already done, install the required cross-platform emulators
-docker buildx build --build-arg TARGETS=${TARGETS} -t <your_username>/<your_tag> \
+docker run --privileged --rm tonistiigi/binfmt --install all
---platform ${TARGETS} . --push
+
+# run the script, this will build the image for the current platform and load it to Docker
+./make.bash --load
 ```
 
 Build-args available
-|build-arg|default|Description|
+|build-arg|Description|Default|
 |--|--|--|
-|VERSION|2.0.23|psiphon-tunnel-core release version|
+|VERSION|psiphon-tunnel-core release version|latest|
-|TARGETS|\<BUIDLOS\>/\<BUILDARCH\>|Targets for cross-compilation for the build stage|
+|TARGETS|\<BUIDLOS\>/\<BUILDARCH\> (Targets for cross-compilation for the build stage)|current platform|
+|GO_VERSION|Go version to use for building the psiphon-tunnel-core binary|1.22.7|
 ---
 
 # Usage
@@ -53,6 +55,10 @@ services:
     environment:
       - PUID=1000
       - PGID=1000
+      - HTTP_PORT=8080
+      - SOCKS_PORT=1080
+      - DEVICE_REGION=IN
+      - EGRESS_REGION=SG
     volumes:
       - /path/to/psiphon/config:/config
     ports:
@@ -68,19 +74,30 @@ docker run -d                                  \
     --restart=unless-stopped                   \
     -p 8080:8080                               \
     -p 1080:1080                               \
+    -e HTTP_PORT=8080                          \
+    -e SOCKS_PORT=1080                         \
+    -e DEVICE_REGION=IN                        \
+    -e EGRESS_REGION=SG                        \
     -v /home/swarup/psiphon/config/:/config    \
     swarupsengupta2007/psiphon
 ```
 
-The following Environment var are available<br>
+The following Environment var are available (only applicable when running for the first time with no psiphon.config in the mounted config directory)<br>
 |ENV variable|Description|Default|
 |--|--|--|
 |PUID|The UID for psiphon process|1000|
 |PGID|The GID for psiphon process|1000|
+|HTTP_PORT|The HTTP proxy port|8080|
+|SOCKS_PORT|The SOCKS proxy port|1080|
+|DEVICE_REGION|The device region for Psiphon client|IN|
+|EGRESS_REGION|The egress region for Psiphon client|SG|
 
-Following ports and volumes are available 
+# Configuration
-|Option|switch|Description|Default|
+The Psiphon client configuration is stored in the mounted config directory. /config must be mounted and writable by the psiphon process. <br>
-|--|--|--|--|
+
-|HTTP PORT|-p <host_port>:8080|http proxy port|8080|
+# Healthcheck
-|SOCKS PORT|-p <host_port>:1080|socks proxy port|1080|
+The container has a healthcheck script that checks if the Psiphon client is running and healthy. <br>
-|VOLUME|-v /path/to/config:/config|The container storage|/config|
+You can check the health status of the container using the following command:
+```bash
+docker inspect --format='{{json .State.Health}}' psiphon
+```

assets/healthcheck

@@ -0,0 +1,12 @@
+#/bin/sh
+
+if [ ! -d /config ]; then
+    exit 1
+fi
+
+if [ ! -f /config/psiphon.config ]; then
+    exit 1
+else
+    HTTP_PORT=$(sed -n -E 's/.*"LocalHttpProxyPort"[[:space:]]*:[[:space:]]*([0-9]+).*/\1/p' /config/psiphon.config)
+    netstat -ltn | grep ${HTTP_PORT} || exit 1
+fi

assets/psiphon.config

@@ -1,6 +1,7 @@
 {
   "DataRootDirectory": "/config/",
   "DeviceRegion": "IN",
+  "EgressRegion": "SG",
   "MigrateDataStoreDirectory": "/config",
   "ListenInterface": "any",
   "LocalHttpProxyPort": 8080,

assets/start-psiphon

@@ -0,0 +1,46 @@
+#!/bin/sh
+
+if [ ! -d /config ]; then
+    echo "/config directory not mounted, exiting..."
+    exit 1
+fi
+
+if [ ! -f /config/psiphon.config ]; then
+    cp /etc/psiphon/psiphon.config /config/psiphon.config
+    if [ -n "${HTTP_PORT}" ]; then
+       sed -i -E 's/"LocalHttpProxyPort"[[:space:]]*:[[:space:]]*[0-9]+/"LocalHttpProxyPort": '${HTTP_PORT}'/' /config/psiphon.config
+    fi
+    if [ -n "${SOCKS_PORT}" ]; then
+        sed -i -E 's/"LocalSocksProxyPort"[[:space:]]*:[[:space:]]*[0-9]+/"LocalSocksProxyPort": '${SOCKS_PORT}'/' /config/psiphon.config
+    fi
+    if [ -n "${DEVICE_REGION}" ]; then
+        sed -i -E 's/"DeviceRegion"[[:space:]]*:[[:space:]]*"[^"]*"/"DeviceRegion": "'${DEVICE_REGION}'"/' /config/psiphon.config
+    fi
+    if [ -n "${EGRESS_REGION}" ]; then
+        sed -i -E 's/"EgressRegion"[[:space:]]*:[[:space:]]*"[^"]*"/"EgressRegion": "'${EGRESS_REGION}'"/' /config/psiphon.config
+    fi
+fi
+
+id psiphon > /dev/null 2>&1
+if [ $? -ne 0 ]; then
+    adduser -DH psiphon psiphon
+fi
+
+UID=$(id -u psiphon)
+GID=$(id -g psiphon)
+
+PUID=${PUID:-${UID}}
+PGID=${PGID:-${GID}}
+
+if [ "${PUID}" != "${UID}" ] || [ "${PGID}" != "${GID}" ]; then
+    deluser psiphon >/dev/null 2>&1 || true
+    delgroup psiphon >/dev/null 2>&1 || true
+    addgroup -g ${PGID} psiphon
+    adduser -DH -u ${PUID} -G psiphon psiphon
+fi
+
+chown -R psiphon:psiphon /config
+
+su -s /bin/sh psiphon <<EOF
+psiphon -config /config/psiphon.config
+EOF

base/etc/services.d/psiphon/run

@@ -1,7 +0,0 @@
-#!/usr/bin/with-contenv sh
-
-[[ ! -f ${DEF_CONFIG}/psiphon.config ]] && cp ${DEF_DEFAULTS}/psiphon.config ${DEF_CONFIG}/
-
-chown -R ${DEF_USER}:${DEF_USER} ${DEF_CONFIG}
-
-exec s6-setuidgid ${DEF_USER} ${DEF_APP}/psiphon -config ${DEF_CONFIG}/psiphon.config

build.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+IFS=$'\n\t'
+
+GO=${GO:-go}
+PSIPHON_VERSION=""
+TARGETS=""
+
+function help_message() {
+	echo "Usage: $0 [OPTIONS] <psiphon_version>"
+	echo "Options:"
+	echo "  --targets <targets>    Comma-separated list of target platforms (default: current platform)"
+	echo "  --version <version>    Psiphon version to build (default: latest)"
+	exit ${1:-1}
+}
+
+while [[ $# -gt 0 ]]; do
+	case $1 in
+		--help|-h)
+			help_message 0
+			;;
+		--targets=*)
+			TARGETS="${1#*=}"
+			shift
+			;;
+		-t | --targets)
+			TARGETS="${2}"
+			shift 2
+			;;
+		--version=*)
+			PSIPHON_VERSION="${1#*=}"
+			shift
+			;;
+		-v | --version)
+			PSIPHON_VERSION="${2}"
+			shift 2
+			;;
+		*)
+			echo "Unknown option: $1"
+			help_message
+			;;
+	esac
+done
+
+MYPATH=$(dirname "$(readlink -f "$0")")
+source "${MYPATH}/latest_version.sh"
+
+if [[ -z "${PSIPHON_VERSION}" ]]; then
+	PSIPHON_VERSION=$(get_latest_version)
+else
+	if ! validate_version_format "${PSIPHON_VERSION}"; then
+		echo "Invalid Psiphon version format. Please use 'X.Y.Z' or 'vX.Y.Z' format."
+		exit 1
+	fi
+fi
+
+PSIPHON_VERSION=$(normalize_version "${PSIPHON_VERSION}")
+ALL_TARGETS="linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6,windows/amd64,windows/386,darwin/amd64,darwin/arm64"
+CURRENT_TARGET="$(go env GOOS)/$(go env GOARCH)"
+TARGETS=${TARGETS:-"current"}
+
+TARGETS=$(decipher_targets "${TARGETS}")
+TARGETS=${TARGETS%$'\n'}
+IFS=' ' TARGETS=(${TARGETS//,/ })
+
+BUILD_DIR=$(pwd)/tmp_build_$$
+rm -rf "${BUILD_DIR}"
+mkdir -p "${BUILD_DIR}"
+trap 'rm -rf "${BUILD_DIR}"' EXIT
+
+BIN_DIR="$(pwd)/dist"
+rm -rf "${BIN_DIR}"
+mkdir -p "${BIN_DIR}"
+
+curl -sL https://github.com/Psiphon-Labs/psiphon-tunnel-core/archive/refs/tags/${PSIPHON_VERSION}.tar.gz | tar xz --strip-components=1 -C "${BUILD_DIR}"
+pushd "${BUILD_DIR}/ConsoleClient" > /dev/null
+
+export CGO_ENABLED=0
+
+for PLATFORM in "${TARGETS[@]}"
+do
+       echo "Building for ${PLATFORM}..."
+       IFS='/' read -r OS ARCH VARIANT <<< "${PLATFORM}"
+       export GOOS=${OS}
+       export GOARCH=${ARCH}
+       if [[ -n "${VARIANT}" ]]; then
+	       export GOARM=${VARIANT#v}
+       fi
+       GOEXT=""
+       if [[ "${OS}" == "windows" ]]; then
+	       GOEXT=".exe"
+       fi
+       ${GO} build -a -tags netgo -ldflags "-s -w -extldflags '-static'" -o "${BIN_DIR}/psiphon_${PLATFORM//\//_}${GOEXT}"
+       unset GOOS GOARCH GOARM
+done
+
+popd > /dev/null

latest_version.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+IFS=$'\n\t'
+
+# This file can only be sourced, not executed directly.
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    echo "This script is intended to be sourced, not executed directly." >&2
+    exit 1
+fi
+
+function validate_version_format() {
+    local v="$1"
+    [[ "${v}" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]]
+}
+
+function get_latest_version() {
+    local json version
+    json="$(curl -fsSL https://api.github.com/repos/Psiphon-Labs/psiphon-tunnel-core/releases/latest)"
+    if command -v jq >/dev/null 2>&1; then
+        version="$(printf '%s' "${json}" | jq -r .tag_name)"
+    else
+        version="$(printf '%s' "${json}" \
+            | grep -m1 '"tag_name":' \
+            | sed -E 's/.*"tag_name": ?"([^"]+)".*/\1/')"
+    fi
+
+    if ! validate_version_format "${version}"; then
+        echo "I tried to get the latest version of Psiphon without jq but it didn't work." >&2 
+        echo "Please install jq or specify the version manually." >&2
+        exit 1
+    fi
+
+    printf '%s\n' "${version}"
+}
+
+function normalize_version() {
+    local v="$1"
+    if [[ "${v}" =~ ^v ]]; then
+        echo "${v}"
+    else
+        echo "v${v}"
+    fi
+}
+
+function get_supported_targets() {
+    echo "linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6"
+}
+
+function get_current_target() {
+    echo "$(go env GOOS)/$(go env GOARCH)"
+}
+
+function decipher_targets() {
+    local targets="$1"
+    if [[ "${targets}" == "current" ]]; then
+        echo "$(get_current_target)"
+    elif [[ "${targets}" == "all" ]]; then
+        echo "$(get_supported_targets)"
+    else
+        echo "${targets}"
+    fi
+}

make.bash

@@ -1,11 +1,143 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
-TARGETS="linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6"
+set -euo pipefail
-VERSION=2.0.29
+IFS=$'\n\t'
 
-sudo docker buildx build \
+MYPATH=$(dirname "$(readlink -f "$0")")
-				--build-arg TARGETS=${TARGETS} \
+source "${MYPATH}/latest_version.sh"
-				--build-arg VERSION=${VERSION} \
+
-				-t swarupsengupta2007/psiphon:${VERSION} \
+function help_message() {
-				-t swarupsengupta2007/psiphon:latest \
+	echo "Usage: $0 [OPTIONS]"
-				--platform ${TARGETS} . $1
+	echo "Options:"
+	echo "  --targets, -t <targets>      Comma-separated list of target platforms (default: current, use 'all' for all supported targets)"
+	echo "  --version, -v <version>      Psiphon version to build (default: latest available)"
+	echo "  --go, -g <version>           Go version to use (default: 1.22.7)"
+	echo "  --nodockerhub		     Don't push image to docker.io"
+	echo "  --noghcr		     Don't push image to gchr.io"
+	echo "  --load                       Load the built image into local Docker (cannot be used with --push)"
+	echo "  --push                       Push the built image to Docker Hub (cannot be used with --load)"
+	echo "  --supported-targets          Show supported targets and exit"
+	echo "  --current-target             Show current target platform and exit"
+	echo "  --help, -h                   Show this help message and exit"
+	exit ${1:-1}
+}
+
+EXTRA_BUILD_ARGS=""
+VERSION=""
+PUSH_DOCKERHUB=1
+PUSH_GHCR=1
+
+while [[ $# -gt 0 ]]; do
+	case "$1" in
+		--help|-h)
+			help_message 0
+			;;
+		--targets=*)
+			TARGETS="${1#*=}"
+			shift
+			;;
+		-t | --targets)
+			TARGETS="$2"
+			shift 2
+			;;
+		--version=*)
+			VERSION="${1#*=}"
+			shift
+			;;
+		-v | --version)
+			VERSION="$2"
+			shift 2
+			;;
+		--go=*)
+			GO_VERSION="${1#*=}"
+			shift
+			;;
+		-g | --go)
+			GO_VERSION="$2"
+			shift 2
+			;;
+		--nodockerhub)
+			PUSH_DOCKERHUB=0
+			shift
+			;;
+		--noghcr)
+			PUSH_GHCR=0
+			shift
+			;;
+		--supported-targets)
+			echo "Supported targets: $(get_supported_targets)"
+			exit 0
+			;;
+		--current-target)
+			echo "Current target: $(get_current_target)"
+			exit 0
+			;;
+		-l | --load)
+			if [[ -n ${EXTRA_BUILD_ARGS} && ${EXTRA_BUILD_ARGS} == *"--push"* ]]; then
+				echo "Error: --load and --push cannot be used together." >&2
+				exit 1
+			fi
+			EXTRA_BUILD_ARGS="--load"
+			shift
+			;;
+		-p | --push)
+			if [[ -n ${EXTRA_BUILD_ARGS} && ${EXTRA_BUILD_ARGS} == *"--load"* ]]; then
+				echo "Error: --load and --push cannot be used together." >&2
+				exit 1
+			fi
+			EXTRA_BUILD_ARGS="--push"
+			shift
+			;;
+		*)
+			echo "Error: Unknown option '$1'" >&2
+			help_message
+			;;
+	esac
+done
+
+if [[ "${PUSH_GHCR}" == "0" && "${PUSH_DOCKERHUB}" == "0" && "${EXTRA_BUILD_ARGS}" == "--push" ]]; then
+	echo "Cannot disable both ghcr and dockerhub with --push"
+	help_message
+fi
+
+TARGETS=${TARGETS:-"current"}
+GO_VERSION=${GO_VERSION:-1.22.7}
+
+MYPATH=$(dirname "$(readlink -f "$0")")
+source "${MYPATH}/latest_version.sh"
+
+DOCKER_BUILD_ARGS=()
+
+if [[ -n "${TARGETS}" ]]; then
+	DOCKER_BUILD_ARGS+=(--build-arg TARGETS=${TARGETS})
+fi
+if [[ -z "${VERSION}" ]]; then
+	VERSION=$(get_latest_version)
+fi
+if [[ -n "${VERSION}" ]]; then
+	VERSION=$(normalize_version "${VERSION}")
+	DOCKER_BUILD_ARGS+=(--build-arg PSIPHON_VERSION=${VERSION})
+fi
+if [[ -n "${GO_VERSION}" ]]; then
+	DOCKER_BUILD_ARGS+=(--build-arg GO_VERSION=${GO_VERSION})
+fi
+
+DECIPHERED_TARGETS=$(decipher_targets "${TARGETS}")
+
+TAGS=()
+
+if [[ "${PUSH_DOCKERHUB}" == "1" ]]; then
+	TAGS+=(-t swarupsengupta2007/psiphon:"${VERSION#v}")
+	TAGS+=(-t swarupsengupta2007/psiphon:latest)
+fi
+
+if [[ "${PUSH_GHCR}" == "1" ]]; then
+	TAGS+=(-t ghcr.io/swarupsengupta2007/psiphon:"${VERSION#v}")
+	TAGS+=(-t ghcr.io/swarupsengupta2007/psiphon:latest)
+fi
+
+echo docker buildx build \
+				"${DOCKER_BUILD_ARGS[@]}" \
+				"${TAGS[@]}" \
+				--platform "${DECIPHERED_TARGETS}" . \
+				${EXTRA_BUILD_ARGS}