Merge tag 'v1.14.0'

cmd/internal/app_store_connect/main.go

@@ -19,8 +19,11 @@ import (
 func main() {
 	ctx := context.Background()
 	switch os.Args[1] {
-	case "next_macos_project_version":
-		err := fetchMacOSVersion(ctx)
+	case "next_project_version":
+		if len(os.Args) < 3 {
+			log.Fatal("platform required: ios, macos, or tvos")
+		}
+		err := fetchNextProjectVersion(ctx, os.Args[2])
 		if err != nil {
 			log.Fatal(err)
 		}
@@ -50,8 +53,8 @@ func main() {
 }
 
 const (
-	appID   = "6673731168"
-	groupID = "5c5f3b78-b7a0-40c0-bcad-e6ef87bbefda"
+	appID   = "6785326793"
+	groupID = "39f9ebdc-05d4-421f-9595-dae71df227c4"
 )
 
 func createClient(expireDuration time.Duration) *asc.Client {
@@ -66,36 +69,49 @@ func createClient(expireDuration time.Duration) *asc.Client {
 	return asc.NewClient(tokenConfig.Client())
 }
 
-func fetchMacOSVersion(ctx context.Context) error {
+func fetchNextProjectVersion(ctx context.Context, platformName string) error {
+	var platform asc.Platform
+	switch platformName {
+	case "ios":
+		platform = asc.PlatformIOS
+	case "macos":
+		platform = asc.PlatformMACOS
+	case "tvos":
+		platform = asc.PlatformTVOS
+	default:
+		return E.New("unknown platform: ", platformName)
+	}
+
+	query := &asc.ListBuildsQuery{
+		FilterApp:                       []string{appID},
+		FilterPreReleaseVersionPlatform: []string{string(platform)},
+		Limit:                           200,
+	}
+	if platform != asc.PlatformMACOS {
+		tagVersion, err := build_shared.ReadTagVersion()
+		if err != nil {
+			return err
+		}
+		query.FilterPreReleaseVersionVersion = []string{build_shared.TestFlightVersion(tagVersion)}
+	}
+
 	client := createClient(time.Minute)
-	versions, _, err := client.Apps.ListAppStoreVersionsForApp(ctx, appID, &asc.ListAppStoreVersionsQuery{
-		FilterPlatform: []string{"MAC_OS"},
-	})
+	builds, _, err := client.Builds.ListBuilds(ctx, query)
 	if err != nil {
 		return err
 	}
-	var versionID string
-findVersion:
-	for _, version := range versions.Data {
-		switch *version.Attributes.AppStoreState {
-		case asc.AppStoreVersionStateReadyForSale,
-			asc.AppStoreVersionStatePendingDeveloperRelease:
-			versionID = version.ID
-			break findVersion
+	nextProjectVersion := 1
+	var projectVersion int
+	for _, build := range builds.Data {
+		projectVersion, err = strconv.Atoi(*build.Attributes.Version)
+		if err != nil {
+			return E.Cause(err, "parse version code")
+		}
+		if projectVersion >= nextProjectVersion {
+			nextProjectVersion = projectVersion + 1
 		}
 	}
-	if versionID == "" {
-		return E.New("no version found")
-	}
-	latestBuild, _, err := client.Builds.GetBuildForAppStoreVersion(ctx, versionID, &asc.GetBuildForAppStoreVersionQuery{})
-	if err != nil {
-		return err
-	}
-	versionInt, err := strconv.Atoi(*latestBuild.Data.Attributes.Version)
-	if err != nil {
-		return E.Cause(err, "parse version code")
-	}
-	os.Stdout.WriteString(F.ToString(versionInt+1, "\n"))
+	os.Stdout.WriteString(F.ToString(nextProjectVersion, "\n"))
 	return nil
 }
 

cmd/internal/build_boxdd/main.go

@@ -0,0 +1,236 @@
+package main
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"flag"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strings"
+
+	"github.com/sagernet/sing-box/cmd/internal/build_shared"
+	"github.com/sagernet/sing-box/common/windivert"
+	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing-usbip/driverassets"
+	E "github.com/sagernet/sing/common/exceptions"
+)
+
+var (
+	debugEnabled bool
+	outputPath   string
+	target       string
+)
+
+func init() {
+	flag.BoolVar(&debugEnabled, "debug", false, "enable debug")
+	flag.StringVar(&outputPath, "output", "", "output path")
+	flag.StringVar(&target, "target", runtime.GOOS+"/"+runtime.GOARCH, "target platform")
+}
+
+func main() {
+	flag.Parse()
+	err := build()
+	if err != nil {
+		log.Fatal(err)
+	}
+}
+
+func build() error {
+	targetParts := strings.Split(target, "/")
+	if len(targetParts) != 2 || targetParts[0] == "" || targetParts[1] == "" {
+		return E.New("invalid target: ", target)
+	}
+	operatingSystem := targetParts[0]
+	architecture := targetParts[1]
+	if outputPath == "" {
+		outputPath = "sing-box-daemon"
+		if operatingSystem == "windows" {
+			outputPath += ".exe"
+		}
+	}
+	absoluteOutputPath, err := filepath.Abs(outputPath)
+	if err != nil {
+		return E.Cause(err, "resolve output path")
+	}
+	err = os.MkdirAll(filepath.Dir(absoluteOutputPath), 0o755)
+	if err != nil {
+		return E.Cause(err, "create output directory")
+	}
+	version, err := build_shared.ReadTag()
+	if err != nil {
+		return E.Cause(err, "read version")
+	}
+	cgoEnabled := operatingSystem != "windows" && os.Getenv("CC") != ""
+	tags, err := buildTags(operatingSystem, architecture, cgoEnabled)
+	if err != nil {
+		return err
+	}
+	arguments := []string{
+		"build",
+		"-v",
+		"-trimpath",
+		"-buildvcs=false",
+		"-tags", strings.Join(tags, ","),
+		"-ldflags", build_shared.LinkerFlags(version, debugEnabled),
+		"-o", absoluteOutputPath,
+	}
+	if operatingSystem == "windows" && architecture == "386" {
+		arguments = append(arguments, "-gcflags=net=-l")
+	}
+	arguments = append(arguments, "./experimental/boxdd")
+	command := exec.Command("go", arguments...)
+	cgoEnabledValue := "0"
+	if cgoEnabled {
+		cgoEnabledValue = "1"
+	}
+	command.Env = append(os.Environ(),
+		"CGO_ENABLED="+cgoEnabledValue,
+		"GOOS="+operatingSystem,
+		"GOARCH="+architecture,
+		"GOTOOLCHAIN=local",
+	)
+	command.Stdout = os.Stdout
+	command.Stderr = os.Stderr
+	err = command.Run()
+	if err != nil {
+		return E.Cause(err, "build sing-box daemon")
+	}
+	if operatingSystem == "windows" {
+		err = stageWinDivertDriver(architecture, filepath.Dir(absoluteOutputPath))
+		if err != nil {
+			return err
+		}
+		err = stageUSBIPDrivers(architecture, filepath.Dir(absoluteOutputPath))
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func stageUSBIPDrivers(architecture string, outputDirectory string) error {
+	driverPackages := []struct {
+		assets   map[string]driverassets.Package
+		assetDir string
+	}{
+		{driverassets.VBoxUSB, filepath.Join("internal", "vboxusb", "assets")},
+		{driverassets.VHCI, filepath.Join("internal", "usbipvhci", "assets")},
+	}
+	var moduleDirectory string
+	for _, driverPackage := range driverPackages {
+		staged := driverPackage.assets[architecture]
+		for _, architecturePackage := range driverPackage.assets {
+			for _, file := range architecturePackage.Files {
+				if slices.ContainsFunc(staged.Files, func(stagedFile driverassets.File) bool {
+					return stagedFile.Name == file.Name
+				}) {
+					continue
+				}
+				err := os.Remove(filepath.Join(outputDirectory, file.Name))
+				if err != nil && !os.IsNotExist(err) {
+					return E.Cause(err, "remove stale ", file.Name)
+				}
+			}
+		}
+		if len(staged.Files) == 0 {
+			continue
+		}
+		if moduleDirectory == "" {
+			listOutput, err := exec.Command("go", "list", "-m", "-f", "{{.Dir}}", "github.com/sagernet/sing-usbip").Output()
+			if err != nil {
+				return E.Cause(err, "locate sing-usbip module directory")
+			}
+			moduleDirectory = strings.TrimSpace(string(listOutput))
+		}
+		for _, file := range staged.Files {
+			content, err := os.ReadFile(filepath.Join(moduleDirectory, driverPackage.assetDir, architecture, file.Name))
+			if err != nil {
+				return E.Cause(err, "read ", file.Name)
+			}
+			checksum := sha256.Sum256(content)
+			if hex.EncodeToString(checksum[:]) != file.SHA256 {
+				return E.New(file.Name, " does not match the digest declared in sing-usbip/driverassets")
+			}
+			targetPath := filepath.Join(outputDirectory, file.Name)
+			stagedContent, err := os.ReadFile(targetPath)
+			if err == nil && bytes.Equal(stagedContent, content) {
+				continue
+			}
+			err = os.WriteFile(targetPath, content, 0o644)
+			if err != nil {
+				return E.Cause(err, "write ", file.Name)
+			}
+		}
+	}
+	return nil
+}
+
+func stageWinDivertDriver(architecture string, outputDirectory string) error {
+	var assetName, assetDigest string
+	switch architecture {
+	case "amd64":
+		assetName, assetDigest = windivert.Asset64Name, windivert.Asset64SHA256
+	case "386":
+		assetName, assetDigest = windivert.Asset32Name, windivert.Asset32SHA256
+	}
+	for _, name := range []string{windivert.Asset64Name, windivert.Asset32Name} {
+		if name == assetName {
+			continue
+		}
+		err := os.Remove(filepath.Join(outputDirectory, name))
+		if err != nil && !os.IsNotExist(err) {
+			return E.Cause(err, "remove stale ", name)
+		}
+	}
+	if assetName == "" {
+		return nil
+	}
+	assetDirectory := filepath.Join("common", "windivert", "assets")
+	content, err := os.ReadFile(filepath.Join(assetDirectory, assetName))
+	if err != nil {
+		return E.Cause(err, "read ", assetName)
+	}
+	checksum := sha256.Sum256(content)
+	if hex.EncodeToString(checksum[:]) != assetDigest {
+		return E.New(assetName, " does not match the digest declared in common/windivert")
+	}
+	targetPath := filepath.Join(outputDirectory, assetName)
+	staged, err := os.ReadFile(targetPath)
+	if err == nil && bytes.Equal(staged, content) {
+		return nil
+	}
+	err = os.WriteFile(targetPath, content, 0o644)
+	if err != nil {
+		return E.Cause(err, "write ", assetName)
+	}
+	return nil
+}
+
+func buildTags(operatingSystem string, architecture string, cgoEnabled bool) ([]string, error) {
+	tagsFile := "release/DEFAULT_BUILD_TAGS"
+	if operatingSystem == "windows" {
+		if architecture == "386" {
+			tagsFile = "release/DEFAULT_BUILD_TAGS_OTHERS"
+		} else {
+			tagsFile = "release/DEFAULT_BUILD_TAGS_WINDOWS"
+		}
+	} else if !cgoEnabled {
+		tagsFile = "release/DEFAULT_BUILD_TAGS_OTHERS"
+	}
+	content, err := os.ReadFile(tagsFile)
+	if err != nil {
+		return nil, E.Cause(err, "read build tags")
+	}
+	tags := strings.Split(strings.TrimSpace(string(content)), ",")
+	if operatingSystem == "windows" {
+		tags = append(tags, "with_external_windivert", "with_external_usbip_drivers")
+	}
+	if debugEnabled {
+		tags = append(tags, "debug")
+	}
+	return tags, nil
+}

cmd/internal/build_libbox/main.go

@@ -60,10 +60,10 @@ func init() {
 	if err != nil {
 		currentTag = "unknown"
 	}
-	sharedFlags = append(sharedFlags, "-ldflags", "-X github.com/sagernet/sing-box/constant.Version="+currentTag+" -X internal/godebug.defaultGODEBUG=multipathtcp=0 -s -w -buildid=  -checklinkname=0")
-	debugFlags = append(debugFlags, "-ldflags", "-X github.com/sagernet/sing-box/constant.Version="+currentTag+" -X internal/godebug.defaultGODEBUG=multipathtcp=0 -checklinkname=0")
+	sharedFlags = append(sharedFlags, "-ldflags", build_shared.LinkerFlags(currentTag, false))
+	debugFlags = append(debugFlags, "-ldflags", build_shared.LinkerFlags(currentTag, true))
 
-	sharedTags = append(sharedTags, "with_gvisor", "with_quic", "with_wireguard", "with_masque", "with_mtproxy", "with_trusttunnel", "with_call", "with_sudoku", "with_utls", "with_naive_outbound", "with_clash_api", "badlinkname", "tfogo_checklinkname0")
+	sharedTags = append(sharedTags, "with_gvisor", "with_quic", "with_wireguard", "with_masque", "with_mtproxy", "with_trusttunnel", "with_call", "with_sudoku", "with_utls", "with_naive_outbound", "with_clash_api", "with_usbip", "with_openvpn", "with_openconnect", "badlinkname", "tfogo_checklinkname0")
 	darwinTags = append(darwinTags, "with_dhcp", "grpcnotrace")
 	// memcTags = append(memcTags, "with_tailscale")
 	sharedTags = append(sharedTags, "with_tailscale", "ts_omit_logtail", "ts_omit_ssh", "ts_omit_drive", "ts_omit_taildrop", "ts_omit_webclient", "ts_omit_doctor", "ts_omit_capture", "ts_omit_kube", "ts_omit_aws", "ts_omit_synology", "ts_omit_bird")
@@ -163,14 +163,14 @@ func buildAndroid() {
 
 	bindTarget := getAndroidBindTarget()
 
-	// Build main variant (SDK 23)
+	// Build main variant (SDK 24)
 	mainTags := append([]string{}, sharedTags...)
 	// mainTags = append(mainTags, memcTags...)
 	if debugEnabled {
 		mainTags = append(mainTags, debugTags...)
 	}
 	buildAndroidVariant(AndroidBuildConfig{
-		AndroidAPI: 23,
+		AndroidAPI: 24,
 		OutputName: "libbox.aar",
 		Tags:       mainTags,
 	}, bindTarget)
@@ -204,6 +204,9 @@ func buildApple() {
 		"-target", bindTarget,
 		"-libname=box",
 		"-tags-not-macos=with_low_memory",
+		"-iosversion=15.0",
+		"-macosversion=13.0",
+		"-tvosversion=17.0",
 	}
 	//if !withTailscale {
 	//	args = append(args, "-tags-macos="+strings.Join(memcTags, ","))

cmd/internal/build_shared/flags.go

@@ -0,0 +1,15 @@
+package build_shared
+
+import "strings"
+
+func LinkerFlags(version string, debug bool) string {
+	flags := []string{
+		"-X github.com/sagernet/sing-box/constant.Version=" + version,
+		"-X runtime.godebugDefault=multipathtcp=0,tlssha1=1",
+		"-checklinkname=0",
+	}
+	if !debug {
+		flags = append(flags, "-s", "-w", "-buildid=")
+	}
+	return strings.Join(flags, " ")
+}

cmd/internal/build_shared/tag.go

@@ -3,6 +3,7 @@ package build_shared
 import (
 	"github.com/sagernet/sing-box/common/badversion"
 	"github.com/sagernet/sing/common"
+	F "github.com/sagernet/sing/common/format"
 	"github.com/sagernet/sing/common/shell"
 )
 
@@ -36,3 +37,7 @@ func ReadTagVersion() (badversion.Version, error) {
 	}
 	return version, nil
 }
+
+func TestFlightVersion(version badversion.Version) string {
+	return F.ToString(version.Major, ".", version.Minor, ".10")
+}

cmd/internal/update_apple_version/main.go

@@ -8,16 +8,21 @@ import (
 	"strings"
 
 	"github.com/sagernet/sing-box/cmd/internal/build_shared"
+	"github.com/sagernet/sing-box/common/badversion"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing/common"
 
 	"howett.net/plist"
 )
 
-var flagRunInCI bool
+var (
+	flagRunInCI    bool
+	flagTestFlight bool
+)
 
 func init() {
 	flag.BoolVar(&flagRunInCI, "ci", false, "Run in CI")
+	flag.BoolVar(&flagTestFlight, "testflight", false, "Override the App Store marketing version with the version reserved for TestFlight")
 }
 
 func main() {
@@ -40,19 +45,39 @@ func main() {
 	common.Must(decoder.Decode(&project))
 	objectsMap := project["objects"].(map[string]any)
 	projectContent := string(common.Must1(os.ReadFile("sing-box.xcodeproj/project.pbxproj")))
-	newContent, updated0 := findAndReplace(objectsMap, projectContent, []string{"io.nekohasekai.sfavt"}, newVersion.VersionString())
-	newContent, updated1 := findAndReplace(objectsMap, newContent, []string{"io.nekohasekai.sfavt.standalone", "io.nekohasekai.sfavt.system"}, newVersion.String())
-	if updated0 || updated1 {
-		log.Info("updated version to ", newVersion.VersionString(), " (", newVersion.String(), ")")
-	}
-	var updated2 bool
-	if macProjectVersion := os.Getenv("MACOS_PROJECT_VERSION"); macProjectVersion != "" {
-		newContent, updated2 = findAndReplaceProjectVersion(objectsMap, newContent, []string{"SFM"}, macProjectVersion)
-		if updated2 {
-			log.Info("updated macos project version to ", macProjectVersion)
+	newContent := projectContent
+	var marketingVersionUpdated bool
+	if flagTestFlight {
+		testFlightVersion := build_shared.TestFlightVersion(newVersion)
+		newContent, marketingVersionUpdated = findAndReplace(objectsMap, newContent, []string{"io.nekohasekai.sfamt"}, testFlightVersion)
+		if marketingVersionUpdated {
+			log.Info("updated App Store version to ", testFlightVersion)
 		}
 	}
-	if updated0 || updated1 || updated2 {
+	var standaloneVersionUpdated bool
+	newContent, standaloneVersionUpdated = findAndReplace(objectsMap, newContent, []string{"io.nekohasekai.sfamt.standalone", "io.nekohasekai.sfamt.system"}, newVersion.String())
+	if standaloneVersionUpdated {
+		marketingVersionUpdated = true
+		log.Info("updated version to ", newVersion.String())
+	}
+	var projectVersionUpdated bool
+	for environmentName, directory := range map[string]string{
+		"IOS_PROJECT_VERSION":   "SFI",
+		"MACOS_PROJECT_VERSION": "SFM",
+		"TVOS_PROJECT_VERSION":  "SFT",
+	} {
+		projectVersion := os.Getenv(environmentName)
+		if projectVersion == "" {
+			continue
+		}
+		var updated bool
+		newContent, updated = findAndReplaceProjectVersion(objectsMap, newContent, []string{directory}, projectVersion)
+		if updated {
+			projectVersionUpdated = true
+			log.Info("updated ", directory, " project version to ", projectVersion)
+		}
+	}
+	if marketingVersionUpdated || projectVersionUpdated {
 		common.Must(os.WriteFile("sing-box.xcodeproj/project.pbxproj", []byte(newContent), 0o644))
 	}
 }
@@ -76,11 +101,20 @@ func findAndReplace(objectsMap map[string]any, projectContent string, bundleIDLi
 			continue
 		}
 		updated = true
-		projectContent = projectContent[:versionStart] + "\"" + newVersion + "\"" + projectContent[versionEnd:]
+		projectContent = projectContent[:versionStart] + formatProjectVersion(newVersion) + projectContent[versionEnd:]
 	}
 	return projectContent, updated
 }
 
+// Xcode serializes a version without quotes unless it contains a pre-release
+// part; always quoting makes Xcode rewrite the value on the next save.
+func formatProjectVersion(version string) string {
+	if badversion.Parse(version).PreReleaseIdentifier == "" {
+		return version
+	}
+	return "\"" + version + "\""
+}
+
 func findAndReplaceProjectVersion(objectsMap map[string]any, projectContent string, directoryList []string, newVersion string) (string, bool) {
 	objectKeyList := findObjectKeyByDirectory(objectsMap, directoryList)
 	var updated bool

cmd/internal/update_certificates/main.go

@@ -43,11 +43,8 @@ func updateMozillaIncludedRootCAs() error {
 
 package certificate
 
-import "crypto/x509"
-
-func newMozillaIncluded() *x509.CertPool {
-	pool := x509.NewCertPool()
-`)
+func mozillaIncludedPEM() string {
+	return ` + "`")
 	for {
 		record, err := reader.Read()
 		if err == io.EOF {
@@ -58,17 +55,14 @@ func newMozillaIncluded() *x509.CertPool {
 		if record[geoIndex] == "China" {
 			continue
 		}
-		generated.WriteString("\n	// ")
+		cert := strings.Trim(record[certIndex], "'")
+		generated.WriteString("\n// ")
 		generated.WriteString(record[nameIndex])
 		generated.WriteString("\n")
-		generated.WriteString("	pool.AppendCertsFromPEM([]byte(`")
-		cert := record[certIndex]
-		// Remove single quotes
-		cert = cert[1 : len(cert)-1]
 		generated.WriteString(cert)
-		generated.WriteString("`))\n")
+		generated.WriteString("\n")
 	}
-	generated.WriteString("\treturn pool\n}\n")
+	generated.WriteString("`\n}\n")
 	return os.WriteFile("common/certificate/mozilla.go", []byte(generated.String()), 0o644)
 }
 
@@ -127,11 +121,8 @@ func updateChromeIncludedRootCAs() error {
 
 package certificate
 
-import "crypto/x509"
-
-func newChromeIncluded() *x509.CertPool {
-	pool := x509.NewCertPool()
-`)
+func chromeIncludedPEM() string {
+	return ` + "`")
 	for {
 		record, err := reader.Read()
 		if err == io.EOF {
@@ -145,18 +136,13 @@ func newChromeIncluded() *x509.CertPool {
 		if chinaFingerprints[record[fingerprintIndex]] {
 			continue
 		}
-		generated.WriteString("\n	// ")
+		cert := strings.Trim(record[certIndex], "'")
+		generated.WriteString("\n// ")
 		generated.WriteString(record[subjectIndex])
 		generated.WriteString("\n")
-		generated.WriteString("	pool.AppendCertsFromPEM([]byte(`")
-		cert := record[certIndex]
-		// Remove single quotes if present
-		if len(cert) > 0 && cert[0] == '\'' {
-			cert = cert[1 : len(cert)-1]
-		}
 		generated.WriteString(cert)
-		generated.WriteString("`))\n")
+		generated.WriteString("\n")
 	}
-	generated.WriteString("\treturn pool\n}\n")
+	generated.WriteString("`\n}\n")
 	return os.WriteFile("common/certificate/chrome.go", []byte(generated.String()), 0o644)
 }

cmd/internal/update_desktop_version/main.go

@@ -0,0 +1,66 @@
+package main
+
+import (
+	"encoding/json"
+	"flag"
+	"os"
+	"path/filepath"
+	"runtime"
+
+	"github.com/sagernet/sing-box/cmd/internal/build_shared"
+	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing/common"
+)
+
+var (
+	flagRunInCI    bool
+	flagRunNightly bool
+)
+
+type versionMetadata struct {
+	Version   string `json:"version"`
+	GoVersion string `json:"go_version"`
+}
+
+func init() {
+	flag.BoolVar(&flagRunInCI, "ci", false, "Run in CI")
+	flag.BoolVar(&flagRunNightly, "nightly", false, "Run nightly")
+}
+
+func main() {
+	flag.Parse()
+	newVersion := common.Must1(build_shared.ReadTag())
+	desktopPath := "../sing-box-for-desktop"
+	if flagRunInCI {
+		desktopPath = "clients/desktop"
+	}
+	desktopPath = common.Must1(filepath.Abs(desktopPath))
+	versionPath := filepath.Join(desktopPath, "version.json")
+	versionFile := common.Must1(os.Open(versionPath))
+	var metadata versionMetadata
+	common.Must(json.NewDecoder(versionFile).Decode(&metadata))
+	common.Must(versionFile.Close())
+	newGoVersion := runtime.Version()
+	versionUpdated := metadata.Version != newVersion
+	goVersionUpdated := metadata.GoVersion != newGoVersion
+	if !(versionUpdated || goVersionUpdated) {
+		log.Info("version not changed")
+		return
+	}
+	if versionUpdated {
+		log.Info("updated version from ", metadata.Version, " to ", newVersion)
+	}
+	if goVersionUpdated {
+		log.Info("updated Go version from ", metadata.GoVersion, " to ", newGoVersion)
+	}
+	if flagRunInCI && !flagRunNightly {
+		log.Fatal("version changed, commit changes first.")
+	}
+	metadata.Version = newVersion
+	metadata.GoVersion = newGoVersion
+	outputFile := common.Must1(os.Create(versionPath))
+	encoder := json.NewEncoder(outputFile)
+	encoder.SetIndent("", "  ")
+	common.Must(encoder.Encode(metadata))
+	common.Must(outputFile.Close())
+}