Skip to content

Commit ffbe825

Browse files
nekohasekainekohasekai
committed
release: Unify default build tags and linker flags into shared files
Move hardcoded build tags and ldflags from Makefile, Dockerfile, CI workflows, and local build scripts into canonical files under release/: - release/DEFAULT_BUILD_TAGS (Linux common archs, Darwin, Android) - release/DEFAULT_BUILD_TAGS_WINDOWS (includes with_purego) - release/DEFAULT_BUILD_TAGS_OTHERS (no with_naive_outbound) - release/LDFLAGS (shared linker flags)
1 parent 2eec658 commit ffbe825

13 files changed

Lines changed: 114 additions & 33 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 26 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -207,23 +207,27 @@ jobs:
207207
- name: Set build tags
208208
run: |
209209
set -xeuo pipefail
210-
TAGS='with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,badlinkname,tfogo_checklinkname0'
211210
if [[ "${{ matrix.naive }}" == "true" ]]; then
212-
TAGS="${TAGS},with_naive_outbound"
211+
TAGS=$(cat release/DEFAULT_BUILD_TAGS)
212+
else
213+
TAGS=$(cat release/DEFAULT_BUILD_TAGS_OTHERS)
213214
fi
214215
if [[ "${{ matrix.variant }}" == "purego" ]]; then
215216
TAGS="${TAGS},with_purego"
216217
elif [[ "${{ matrix.variant }}" == "musl" ]]; then
217218
TAGS="${TAGS},with_musl"
218219
fi
219220
echo "BUILD_TAGS=${TAGS}" >> "${GITHUB_ENV}"
221+
- name: Set shared ldflags
222+
run: |
223+
echo "LDFLAGS_SHARED=$(cat release/LDFLAGS)" >> "${GITHUB_ENV}"
220224
- name: Build (purego)
221225
if: matrix.variant == 'purego'
222226
run: |
223227
set -xeuo pipefail
224228
mkdir -p dist
225229
go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
226-
-ldflags '-s -buildid= -X github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }} -X internal/godebug.defaultGODEBUG=multipathtcp=0 -checklinkname=0' \
230+
-ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
227231
./cmd/sing-box
228232
env:
229233
CGO_ENABLED: "0"
@@ -245,7 +249,7 @@ jobs:
245249
set -xeuo pipefail
246250
mkdir -p dist
247251
go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
248-
-ldflags '-s -buildid= -X github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }} -X internal/godebug.defaultGODEBUG=multipathtcp=0 -checklinkname=0' \
252+
-ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
249253
./cmd/sing-box
250254
env:
251255
CGO_ENABLED: "1"
@@ -262,7 +266,7 @@ jobs:
262266
set -xeuo pipefail
263267
mkdir -p dist
264268
go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
265-
-ldflags '-s -buildid= -X github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }} -X internal/godebug.defaultGODEBUG=multipathtcp=0 -checklinkname=0' \
269+
-ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
266270
./cmd/sing-box
267271
env:
268272
CGO_ENABLED: "1"
@@ -279,7 +283,7 @@ jobs:
279283
set -xeuo pipefail
280284
mkdir -p dist
281285
go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
282-
-ldflags '-s -buildid= -X github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }} -X internal/godebug.defaultGODEBUG=multipathtcp=0 -checklinkname=0' \
286+
-ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
283287
./cmd/sing-box
284288
env:
285289
CGO_ENABLED: "0"
@@ -299,7 +303,7 @@ jobs:
299303
export CXX="${CC}++"
300304
mkdir -p dist
301305
GOOS=$BUILD_GOOS GOARCH=$BUILD_GOARCH build go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
302-
-ldflags '-s -buildid= -X github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }} -X internal/godebug.defaultGODEBUG=multipathtcp=0 -checklinkname=0' \
306+
-ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
303307
./cmd/sing-box
304308
env:
305309
CGO_ENABLED: "1"
@@ -452,17 +456,21 @@ jobs:
452456
- name: Set build tags
453457
run: |
454458
set -xeuo pipefail
455-
TAGS='with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,badlinkname,tfogo_checklinkname0'
456459
if [[ "${{ matrix.legacy_go124 }}" != "true" ]]; then
457-
TAGS="${TAGS},with_naive_outbound"
460+
TAGS=$(cat release/DEFAULT_BUILD_TAGS)
461+
else
462+
TAGS=$(cat release/DEFAULT_BUILD_TAGS_OTHERS)
458463
fi
459464
echo "BUILD_TAGS=${TAGS}" >> "${GITHUB_ENV}"
465+
- name: Set shared ldflags
466+
run: |
467+
echo "LDFLAGS_SHARED=$(cat release/LDFLAGS)" >> "${GITHUB_ENV}"
460468
- name: Build
461469
run: |
462470
set -xeuo pipefail
463471
mkdir -p dist
464472
go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
465-
-ldflags '-s -buildid= -X github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }} -X internal/godebug.defaultGODEBUG=multipathtcp=0 -checklinkname=0' \
473+
-ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
466474
./cmd/sing-box
467475
env:
468476
CGO_ENABLED: "1"
@@ -520,9 +528,11 @@ jobs:
520528
- name: Build
521529
if: matrix.naive
522530
run: |
531+
$TAGS = Get-Content release/DEFAULT_BUILD_TAGS_WINDOWS
532+
$LDFLAGS_SHARED = Get-Content release/LDFLAGS
523533
mkdir -p dist
524-
go build -v -trimpath -o dist/sing-box.exe -tags "with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_naive_outbound,with_purego,badlinkname,tfogo_checklinkname0" `
525-
-ldflags "-s -buildid= -X github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }} -X internal/godebug.defaultGODEBUG=multipathtcp=0 -checklinkname=0" `
534+
go build -v -trimpath -o dist/sing-box.exe -tags "$TAGS" `
535+
-ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' $LDFLAGS_SHARED -s -w -buildid=" `
526536
./cmd/sing-box
527537
env:
528538
CGO_ENABLED: "0"
@@ -532,9 +542,11 @@ jobs:
532542
- name: Build
533543
if: ${{ !matrix.naive }}
534544
run: |
545+
$TAGS = Get-Content release/DEFAULT_BUILD_TAGS_OTHERS
546+
$LDFLAGS_SHARED = Get-Content release/LDFLAGS
535547
mkdir -p dist
536-
go build -v -trimpath -o dist/sing-box.exe -tags "with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,badlinkname,tfogo_checklinkname0" `
537-
-ldflags "-s -buildid= -X github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }} -X internal/godebug.defaultGODEBUG=multipathtcp=0 -checklinkname=0" `
548+
go build -v -trimpath -o dist/sing-box.exe -tags "$TAGS" `
549+
-ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' $LDFLAGS_SHARED -s -w -buildid=" `
538550
./cmd/sing-box
539551
env:
540552
CGO_ENABLED: "0"

‎.github/workflows/docker.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -104,17 +104,21 @@ jobs:
104104
- name: Set build tags
105105
run: |
106106
set -xeuo pipefail
107-
TAGS='with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,badlinkname,tfogo_checklinkname0'
108107
if [[ "${{ matrix.naive }}" == "true" ]]; then
109-
TAGS="${TAGS},with_naive_outbound,with_musl"
108+
TAGS="$(cat release/DEFAULT_BUILD_TAGS),with_musl"
109+
else
110+
TAGS=$(cat release/DEFAULT_BUILD_TAGS_OTHERS)
110111
fi
111112
echo "BUILD_TAGS=${TAGS}" >> "${GITHUB_ENV}"
113+
- name: Set shared ldflags
114+
run: |
115+
echo "LDFLAGS_SHARED=$(cat release/LDFLAGS)" >> "${GITHUB_ENV}"
112116
- name: Build (naive)
113117
if: matrix.naive
114118
run: |
115119
set -xeuo pipefail
116120
go build -v -trimpath -o sing-box -tags "${BUILD_TAGS}" \
117-
-ldflags "-X \"github.com/sagernet/sing-box/constant.Version=${VERSION}\" -X 'internal/godebug.defaultGODEBUG=multipathtcp=0' -s -w -buildid= -checklinkname=0" \
121+
-ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${VERSION}' ${LDFLAGS_SHARED} -s -w -buildid=" \
118122
./cmd/sing-box
119123
env:
120124
CGO_ENABLED: "1"
@@ -127,7 +131,7 @@ jobs:
127131
run: |
128132
set -xeuo pipefail
129133
go build -v -trimpath -o sing-box -tags "${BUILD_TAGS}" \
130-
-ldflags "-X \"github.com/sagernet/sing-box/constant.Version=${VERSION}\" -X 'internal/godebug.defaultGODEBUG=multipathtcp=0' -s -w -buildid= -checklinkname=0" \
134+
-ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${VERSION}' ${LDFLAGS_SHARED} -s -w -buildid=" \
131135
./cmd/sing-box
132136
env:
133137
CGO_ENABLED: "0"

‎.github/workflows/linux.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -125,18 +125,22 @@ jobs:
125125
- name: Set build tags
126126
run: |
127127
set -xeuo pipefail
128-
TAGS='with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,badlinkname,tfogo_checklinkname0'
129128
if [[ "${{ matrix.naive }}" == "true" ]]; then
130-
TAGS="${TAGS},with_naive_outbound,with_musl"
129+
TAGS="$(cat release/DEFAULT_BUILD_TAGS),with_musl"
130+
else
131+
TAGS=$(cat release/DEFAULT_BUILD_TAGS_OTHERS)
131132
fi
132133
echo "BUILD_TAGS=${TAGS}" >> "${GITHUB_ENV}"
134+
- name: Set shared ldflags
135+
run: |
136+
echo "LDFLAGS_SHARED=$(cat release/LDFLAGS)" >> "${GITHUB_ENV}"
133137
- name: Build (naive)
134138
if: matrix.naive
135139
run: |
136140
set -xeuo pipefail
137141
mkdir -p dist
138142
go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
139-
-ldflags '-s -buildid= -X github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }} -X internal/godebug.defaultGODEBUG=multipathtcp=0 -checklinkname=0' \
143+
-ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
140144
./cmd/sing-box
141145
env:
142146
CGO_ENABLED: "1"
@@ -152,7 +156,7 @@ jobs:
152156
set -xeuo pipefail
153157
mkdir -p dist
154158
go build -v -trimpath -o dist/sing-box -tags "${BUILD_TAGS}" \
155-
-ldflags '-s -buildid= -X github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }} -X internal/godebug.defaultGODEBUG=multipathtcp=0 -checklinkname=0' \
159+
-ldflags "-X 'github.com/sagernet/sing-box/constant.Version=${{ needs.calculate_version.outputs.version }}' ${LDFLAGS_SHARED} -s -w -buildid=" \
156160
./cmd/sing-box
157161
env:
158162
CGO_ENABLED: "0"

‎.golangci.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,11 @@ run:
99
- with_utls
1010
- with_acme
1111
- with_clash_api
12+
- with_tailscale
13+
- with_ccm
14+
- with_ocm
15+
- badlinkname
16+
- tfogo_checklinkname0
1217
linters:
1318
default: none
1419
enable:

‎Dockerfile‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,11 @@ RUN set -ex \
1212
&& apk add git build-base \
1313
&& export COMMIT=$(git rev-parse --short HEAD) \
1414
&& export VERSION=$(go run ./cmd/internal/read_tag) \
15-
&& go build -v -trimpath -tags \
16-
"with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,badlinkname,tfogo_checklinkname0" \
15+
&& export TAGS=$(cat release/DEFAULT_BUILD_TAGS_OTHERS) \
16+
&& export LDFLAGS_SHARED=$(cat release/LDFLAGS) \
17+
&& go build -v -trimpath -tags "$TAGS" \
1718
-o /go/bin/sing-box \
18-
-ldflags "-X \"github.com/sagernet/sing-box/constant.Version=$VERSION\" -X 'internal/godebug.defaultGODEBUG=multipathtcp=0' -s -w -buildid= -checklinkname=0" \
19+
-ldflags "-X \"github.com/sagernet/sing-box/constant.Version=$VERSION\" $LDFLAGS_SHARED -s -w -buildid=" \
1920
./cmd/sing-box
2021
FROM --platform=$TARGETPLATFORM alpine AS dist
2122
LABEL maintainer="nekohasekai <contact-git@sekai.icu>"

‎Makefile‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
NAME = sing-box
22
COMMIT = $(shell git rev-parse --short HEAD)
3-
TAGS ?= with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,badlinkname,tfogo_checklinkname0
3+
TAGS ?= $(shell cat release/DEFAULT_BUILD_TAGS)
44

55
GOHOSTOS = $(shell go env GOHOSTOS)
66
GOHOSTARCH = $(shell go env GOHOSTARCH)
77
VERSION=$(shell CGO_ENABLED=0 GOOS=$(GOHOSTOS) GOARCH=$(GOHOSTARCH) go run github.com/sagernet/sing-box/cmd/internal/read_tag@latest)
88

9-
PARAMS = -v -trimpath -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=$(VERSION)' -X 'internal/godebug.defaultGODEBUG=multipathtcp=0' -s -w -buildid= -checklinkname=0"
9+
LDFLAGS_SHARED = $(shell cat release/LDFLAGS)
10+
PARAMS = -v -trimpath -ldflags "-X 'github.com/sagernet/sing-box/constant.Version=$(VERSION)' $(LDFLAGS_SHARED) -s -w -buildid="
1011
MAIN_PARAMS = $(PARAMS) -tags "$(TAGS)"
1112
MAIN = ./cmd/sing-box
1213
PREFIX ?= $(shell go env GOPATH)

‎docs/installation/build-from-source.md‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,11 +57,35 @@ go build -tags "tag_a tag_b" ./cmd/sing-box
5757
| `with_v2ray_api` | :material-close:️ | Build with V2Ray API support, see [Experimental](/configuration/experimental#v2ray-api-fields). |
5858
| `with_gvisor` | :material-check: | Build with gVisor support, see [Tun inbound](/configuration/inbound/tun#stack) and [WireGuard outbound](/configuration/outbound/wireguard#system_interface). |
5959
| `with_embedded_tor` (CGO required) | :material-close:️ | Build with embedded Tor support, see [Tor outbound](/configuration/outbound/tor/). |
60-
| `with_tailscale` | :material-check: | Build with Tailscale support, see [Tailscale endpoint](/configuration/endpoint/tailscale) |
61-
| `with_naive_outbound` | :material-close:️ | Build with NaiveProxy outbound support, see [NaiveProxy outbound](/configuration/outbound/naive/). |
60+
| `with_tailscale` | :material-check: | Build with Tailscale support, see [Tailscale endpoint](/configuration/endpoint/tailscale). |
61+
| `with_ccm` | :material-check: | Build with Claude Code Multiplexer service support. |
62+
| `with_ocm` | :material-check: | Build with OpenAI Codex Multiplexer service support. |
63+
| `with_naive_outbound` | :material-check: | Build with NaiveProxy outbound support, see [NaiveProxy outbound](/configuration/outbound/naive/). |
64+
| `badlinkname` | :material-check: | Enable `go:linkname` access to internal standard library functions. Required because the Go standard library does not expose many low-level APIs needed by this project, and reimplementing them externally is impractical. Used for kTLS (kernel TLS offload) and raw TLS record manipulation. |
65+
| `tfogo_checklinkname0` | :material-check: | Companion to `badlinkname`. Go 1.23+ enforces `go:linkname` restrictions via the linker; this tag signals the build uses `-checklinkname=0` to bypass that enforcement. |
6266

6367
It is not recommended to change the default build tag list unless you really know what you are adding.
6468

69+
## :material-wrench: Linker Flags
70+
71+
The following `-ldflags` are used in official builds:
72+
73+
| Flag | Description |
74+
|-------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
75+
| `-X 'internal/godebug.defaultGODEBUG=multipathtcp=0'` | Go 1.24 enabled Multipath TCP for listeners by default (`multipathtcp=2`). This may cause errors on low-level sockets, and sing-box has its own MPTCP control (`tcp_multi_path` option). This flag disables the Go default. |
76+
| `-checklinkname=0` | Go 1.23+ linker rejects unauthorized `go:linkname` usage. This flag disables the check, required together with the `badlinkname` build tag. |
77+
78+
## :material-package-variant: For Downstream Packagers
79+
80+
The default build tag lists and linker flags are available as files in the repository for downstream packagers to reference directly:
81+
82+
| File | Description |
83+
|------|-------------|
84+
| `release/DEFAULT_BUILD_TAGS` | Default for Linux (common architectures), Darwin, and Android. |
85+
| `release/DEFAULT_BUILD_TAGS_WINDOWS` | Default for Windows (includes `with_purego`). |
86+
| `release/DEFAULT_BUILD_TAGS_OTHERS` | Default for other platforms (no `with_naive_outbound`). |
87+
| `release/LDFLAGS` | Required linker flags (see above). |
88+
6589
## :material-layers: with_naive_outbound
6690

6791
NaiveProxy outbound requires special build configurations depending on your target platform.

0 commit comments

Comments
 (0)