diff --git a/.github/SECURITY.md b/.github/SECURITY.md new file mode 100644 index 00000000..654a583d --- /dev/null +++ b/.github/SECURITY.md @@ -0,0 +1,28 @@ +# Security Policy + +[简体中文](SECURITY.zh-CN.md) | English + +## Supported Versions + +Security updates are provided for the latest EasyTier release. Before reporting a vulnerability, please verify it against the latest release or the current `main` branch when practical. + +| Version | Supported | +| --- | --- | +| Latest release | Yes | +| Older releases | No | + +## Reporting a Vulnerability + +Please report suspected vulnerabilities through GitHub's [private vulnerability reporting form](https://github.com/EasyTier/EasyTier/security/advisories/new). + +Do not disclose the vulnerability in a public issue, discussion, or pull request. A useful report should include: + +- the affected EasyTier version or commit; +- the affected platform and relevant configuration, with secrets removed; +- a description of the vulnerability and its potential impact; +- reproducible steps or a minimal proof of concept; and +- any known mitigations or workarounds. + +The maintainers will assess the report and coordinate remediation and disclosure through the private advisory. Please allow reasonable time for a fix before publishing details. + +When investigating, avoid accessing or modifying other users' data, disrupting services, or violating applicable laws. diff --git a/.github/SECURITY.zh-CN.md b/.github/SECURITY.zh-CN.md new file mode 100644 index 00000000..8ea111c0 --- /dev/null +++ b/.github/SECURITY.zh-CN.md @@ -0,0 +1,28 @@ +# 安全策略 + +简体中文 | [English](SECURITY.md) + +## 支持的版本 + +EasyTier 仅为最新正式版本提供安全更新。报告漏洞前，请尽可能在最新正式版本或当前 `main` 分支上确认问题仍然存在。 + +| 版本 | 是否支持 | +| --- | --- | +| 最新正式版本 | 是 | +| 更早版本 | 否 | + +## 报告安全漏洞 + +请通过 GitHub 的[私有漏洞报告表单](https://github.com/EasyTier/EasyTier/security/advisories/new)报告疑似安全漏洞。 + +请勿在公开 Issue、Discussion 或 Pull Request 中披露漏洞。一份有效的报告应包括： + +- 受影响的 EasyTier 版本或提交； +- 受影响的平台和相关配置，请移除其中的密钥等敏感信息； +- 漏洞说明及其潜在影响； +- 可复现的步骤或最小概念验证； +- 已知的缓解措施或临时解决方案。 + +维护者将评估报告，并通过私有安全公告协调修复和披露。请在公开漏洞详情前为修复预留合理时间。 + +调查漏洞时，请勿访问或修改其他用户的数据、干扰服务或违反适用的法律法规。 diff --git a/.github/workflows/core.yml b/.github/workflows/core.yml index a50ed9c6..dd65ea6b 100644 --- a/.github/workflows/core.yml +++ b/.github/workflows/core.yml @@ -22,22 +22,46 @@ defaults: jobs: pre_job: - # continue-on-error: true # Uncomment once integration is finished runs-on: ubuntu-latest if: github.event_name != 'pull_request' || !github.event.pull_request.draft - # Map a step output to a job output + env: + RELEVANT_PATHS: >- + ["Cargo.toml", "Cargo.lock", "rust-toolchain.toml", ".cargo/**", + "pnpm-lock.yaml", "pnpm-workspace.yaml", "package.json", "easytier/**", + "easytier-core/**", "easytier-proto/**", "easytier-rpc-build/**", + "easytier-web/**", "easytier-contrib/easytier-magisk/**", + ".github/workflows/core.yml", ".github/actions/**"] outputs: - # do not skip push on branch starts with releases/ - should_skip: ${{ steps.skip_check.outputs.should_skip == 'true' && !startsWith(github.ref_name, 'releases/') }} + # Release builds must run even if they only change release metadata. + should_skip: >- + ${{ + ( + steps.skip_check.outputs.should_skip == 'true' || + ( + github.event_name == 'pull_request' && + steps.path_filter.outputs.relevant != 'true' + ) + ) && + !startsWith(github.ref_name, 'releases/') + }} steps: - id: skip_check uses: fkirc/skip-duplicate-actions@v5 with: - # All of these options are optional, so you can remove them if you are happy with the defaults concurrent_skipping: 'same_content_newer' skip_after_successful_duplicate: 'true' cancel_others: 'true' - paths: '["Cargo.toml", "Cargo.lock", "easytier/**", "easytier-core/**", "easytier-proto/**", ".github/workflows/core.yml", ".github/actions/**", "easytier-web/**"]' + paths: ${{ env.RELEVANT_PATHS }} + + - id: path_filter + if: >- + github.event_name == 'pull_request' && + steps.skip_check.outputs.should_skip != 'true' + uses: dorny/paths-filter@v4 + with: + filters: | + relevant: ${{ env.RELEVANT_PATHS }} + build_web: runs-on: ubuntu-latest needs: pre_job diff --git a/.github/workflows/gui.yml b/.github/workflows/gui.yml index b053139b..e07ccc0a 100644 --- a/.github/workflows/gui.yml +++ b/.github/workflows/gui.yml @@ -21,21 +21,47 @@ defaults: jobs: pre_job: - # continue-on-error: true # Uncomment once integration is finished runs-on: ubuntu-latest if: github.event_name != 'pull_request' || !github.event.pull_request.draft - # Map a step output to a job output + env: + RELEVANT_PATHS: >- + ["Cargo.toml", "Cargo.lock", "rust-toolchain.toml", ".cargo/**", + "pnpm-lock.yaml", "pnpm-workspace.yaml", "package.json", "easytier/**", + "easytier-core/**", "easytier-proto/**", "easytier-rpc-build/**", + "easytier-gui/**", "tauri-plugin-vpnservice/**", + "easytier-web/frontend-lib/**", ".github/workflows/gui.yml", + ".github/actions/**"] outputs: - should_skip: ${{ steps.skip_check.outputs.should_skip == 'true' && !startsWith(github.ref_name, 'releases/') }} + # Release builds must run even if they only change release metadata. + should_skip: >- + ${{ + ( + steps.skip_check.outputs.should_skip == 'true' || + ( + github.event_name == 'pull_request' && + steps.path_filter.outputs.relevant != 'true' + ) + ) && + !startsWith(github.ref_name, 'releases/') + }} steps: - id: skip_check uses: fkirc/skip-duplicate-actions@v5 with: - # All of these options are optional, so you can remove them if you are happy with the defaults concurrent_skipping: 'same_content_newer' skip_after_successful_duplicate: 'true' cancel_others: 'true' - paths: '["Cargo.toml", "Cargo.lock", "easytier/**", "easytier-core/**", "easytier-gui/**", ".github/workflows/gui.yml", ".github/actions/**", "easytier-web/frontend-lib/**"]' + paths: ${{ env.RELEVANT_PATHS }} + + - id: path_filter + if: >- + github.event_name == 'pull_request' && + steps.skip_check.outputs.should_skip != 'true' + uses: dorny/paths-filter@v4 + with: + filters: | + relevant: ${{ env.RELEVANT_PATHS }} + build-gui: strategy: fail-fast: true diff --git a/.github/workflows/mobile.yml b/.github/workflows/mobile.yml index 1eb5a069..aa785b6f 100644 --- a/.github/workflows/mobile.yml +++ b/.github/workflows/mobile.yml @@ -21,21 +21,47 @@ defaults: jobs: pre_job: - # continue-on-error: true # Uncomment once integration is finished runs-on: ubuntu-latest if: github.event_name != 'pull_request' || !github.event.pull_request.draft - # Map a step output to a job output + env: + RELEVANT_PATHS: >- + ["Cargo.toml", "Cargo.lock", "rust-toolchain.toml", ".cargo/**", + "pnpm-lock.yaml", "pnpm-workspace.yaml", "package.json", "easytier/**", + "easytier-core/**", "easytier-proto/**", "easytier-rpc-build/**", + "easytier-gui/**", "tauri-plugin-vpnservice/**", + "easytier-web/frontend-lib/**", ".github/workflows/mobile.yml", + ".github/actions/**"] outputs: - should_skip: ${{ steps.skip_check.outputs.should_skip == 'true' && !startsWith(github.ref_name, 'releases/') }} + # Release builds must run even if they only change release metadata. + should_skip: >- + ${{ + ( + steps.skip_check.outputs.should_skip == 'true' || + ( + github.event_name == 'pull_request' && + steps.path_filter.outputs.relevant != 'true' + ) + ) && + !startsWith(github.ref_name, 'releases/') + }} steps: - id: skip_check uses: fkirc/skip-duplicate-actions@v5 with: - # All of these options are optional, so you can remove them if you are happy with the defaults concurrent_skipping: 'same_content_newer' skip_after_successful_duplicate: 'true' cancel_others: 'true' - paths: '["Cargo.toml", "Cargo.lock", "easytier/**", "easytier-core/**", "easytier-gui/**", "tauri-plugin-vpnservice/**", ".github/workflows/mobile.yml", ".github/actions/**"]' + paths: ${{ env.RELEVANT_PATHS }} + + - id: path_filter + if: >- + github.event_name == 'pull_request' && + steps.skip_check.outputs.should_skip != 'true' + uses: dorny/paths-filter@v4 + with: + filters: | + relevant: ${{ env.RELEVANT_PATHS }} + build-mobile: strategy: fail-fast: true diff --git a/.github/workflows/ohos.yml b/.github/workflows/ohos.yml index 9a4a5db5..6d5eacee 100644 --- a/.github/workflows/ohos.yml +++ b/.github/workflows/ohos.yml @@ -9,6 +9,18 @@ on: pull_request: branches: [develop, main, "ohos/**"] types: [opened, synchronize, reopened, ready_for_review] + paths: + - "Cargo.toml" + - "Cargo.lock" + - "rust-toolchain.toml" + - ".cargo/**" + - "easytier/**" + - "easytier-core/**" + - "easytier-proto/**" + - "easytier-rpc-build/**" + - "easytier-contrib/easytier-ohrs/**" + - ".github/workflows/ohos.yml" + - ".github/actions/**" workflow_dispatch: inputs: publish: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a6713565..19388d28 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -22,19 +22,40 @@ defaults: jobs: pre_job: - # continue-on-error: true # Uncomment once integration is finished runs-on: ubuntu-latest - # Map a step output to a job output + env: + RELEVANT_PATHS: >- + ["Cargo.toml", "Cargo.lock", "rust-toolchain.toml", ".cargo/**", + "pnpm-lock.yaml", "pnpm-workspace.yaml", "package.json", "easytier/**", + "easytier-core/**", "easytier-proto/**", "easytier-rpc-build/**", + "easytier-web/**", "easytier-gui/src-tauri/**", + "tauri-plugin-vpnservice/**", "easytier-contrib/**", + ".github/workflows/test.yml", ".github/actions/**"] outputs: - should_skip: ${{ steps.skip_check.outputs.should_skip }} + should_skip: >- + ${{ + steps.skip_check.outputs.should_skip == 'true' || + ( + github.event_name == 'pull_request' && + steps.path_filter.outputs.relevant != 'true' + ) + }} steps: - id: skip_check uses: fkirc/skip-duplicate-actions@v5 with: - # All of these options are optional, so you can remove them if you are happy with the defaults concurrent_skipping: 'never' skip_after_successful_duplicate: 'true' - paths: '["Cargo.toml", "Cargo.lock", "easytier/**", "easytier-core/**", "easytier-proto/**", "easytier-web/**", "easytier-gui/src-tauri/**", "easytier-contrib/**", ".github/workflows/test.yml", ".github/actions/**"]' + paths: ${{ env.RELEVANT_PATHS }} + + - id: path_filter + if: >- + github.event_name == 'pull_request' && + steps.skip_check.outputs.should_skip != 'true' + uses: dorny/paths-filter@v4 + with: + filters: | + relevant: ${{ env.RELEVANT_PATHS }} check: name: Run linters & check diff --git a/README.md b/README.md index 9754b6bc..7acfdc68 100644 --- a/README.md +++ b/README.md @@ -300,6 +300,12 @@ sudo easytier-core --network-name mysharednode --network-secret mysharednode EasyTier is released under the [LGPL-3.0](https://github.com/EasyTier/EasyTier/blob/main/LICENSE). +## Responsible Use + +Use EasyTier only for lawful purposes and in compliance with applicable laws +and regulations. You are responsible for ensuring that you are authorized to +connect to and administer the networks and devices involved. + ## Sponsor CDN acceleration and security protection for this project are sponsored by Tencent EdgeOne. diff --git a/README_CN.md b/README_CN.md index 2e2011ee..5898da21 100644 --- a/README_CN.md +++ b/README_CN.md @@ -299,6 +299,10 @@ sudo easytier-core --network-name mysharednode --network-secret mysharednode EasyTier 在 [LGPL-3.0](https://github.com/EasyTier/EasyTier/blob/main/LICENSE) 许可下发布。 +## 使用规范 + +请仅将 EasyTier 用于合法用途，并遵守适用的法律法规。使用者有责任确保其已获授权连接和管理相关网络与设备。 + ## 赞助 本项目的 CDN 加速和安全防护由腾讯云 EdgeOne 赞助。