diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..510f1c8 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,19 @@ +# Keep LF in the working tree on every platform. +# +# Git already stores these as LF, but with core.autocrlf=true a Windows checkout +# converts them to CRLF, and gofmt then reports every single .go file as +# unformatted even though the content is byte-identical to its own output. That +# makes the `gofmt -l` gate in .github/workflows/go.yml impossible to reproduce +# locally on Windows: it passes on the Linux runner and fails on the contributor's +# machine, for no real reason. +*.go text eol=lf +*.mod text eol=lf +*.sum text eol=lf +*.md text eol=lf +*.yml text eol=lf +*.json text eol=lf + +# Binary, never touch. +*.png binary +*.exe binary +*.svg text eol=lf diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..37bcfb0 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,72 @@ +name: Release + +# Attach binaries to a release when its tag is pushed. +# +# release-0.2 shipped with no assets at all while every release before it carried +# a Linux and a Windows binary, and the README tells people to download one. This +# job removes the manual step that was forgotten. +on: + push: + tags: + - 'release-*' + # Lets an existing tag be re-published without moving it, e.g. after fixing + # this workflow. + workflow_dispatch: + inputs: + tag: + description: 'Existing release-* tag to build and attach assets to' + required: true + +permissions: + contents: write + +jobs: + release: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + # workflow_dispatch checks out the default branch, so the requested tag + # has to be named explicitly. + ref: ${{ github.event.inputs.tag || github.ref }} + fetch-depth: 0 + + - name: Set up Go + uses: actions/setup-go@v5 + with: + go-version-file: go.mod + cache: true + + # Never attach binaries built from a tree that does not pass. The stealth + # harness is opt-in (it needs a browser and the network), so it stays + # skipped here; everything else runs offline. + - name: Vet + run: go vet ./... + + - name: Test + run: go test -race ./... + + - name: Build + env: + CGO_ENABLED: 0 + run: | + mkdir -p dist + # Names match the assets on every release up to 0.1.0, so existing + # download links and scripts keep working. + GOOS=linux GOARCH=amd64 go build -trimpath -ldflags="-s -w" -o dist/wappaGo_linux_x64 + GOOS=windows GOARCH=amd64 go build -trimpath -ldflags="-s -w" -o dist/wappaGo_win_x64.exe + GOOS=darwin GOARCH=arm64 go build -trimpath -ldflags="-s -w" -o dist/wappaGo_darwin_arm64 + ls -lh dist + + - name: Attach to the release + env: + GH_TOKEN: ${{ github.token }} + TAG: ${{ github.event.inputs.tag || github.ref_name }} + run: | + # The release is normally created by hand before the tag is pushed; + # create it only if it is missing, so a hand-written body is never + # overwritten. + if ! gh release view "$TAG" >/dev/null 2>&1; then + gh release create "$TAG" --title "$TAG" --generate-notes + fi + gh release upload "$TAG" dist/* --clobber diff --git a/README.md b/README.md index 04b6292..05b2e89 100644 --- a/README.md +++ b/README.md @@ -2,8 +2,8 @@

- - + +

@@ -34,7 +34,25 @@ or go install github.com/EasyRecon/wappaGo@latest ``` -**Note :** _wappaGo requires Chrome to be present on the system_ +Building from source needs **Go 1.26** or newer. + +## Requirements + +- **Chrome** installed on the system. +- **A display.** Chrome runs headed by default, because headless reports a fake + 800x600 screen and brands its own User-Agent. On a desktop this is already the + case; on a server, run wappaGo under a virtual display: + + ```bash + xvfb-run -a --server-args="-screen 0 1920x1080x24" ./wappaGo < domain.txt + ``` + + Pass `-headless` instead if you would rather not install one — it works, it is + just easier to fingerprint. Without a display and without `-headless`, Chrome + will not start and wappaGo tells you so. +- **Outbound HTTPS to `raw.githubusercontent.com`**, to fetch the technology + fingerprints at startup. A failure here is fatal rather than silently scanning + with an empty database. # Usage