Release lightway in rust

.cargo/config.toml

@@ -0,0 +1,3 @@
+[target.aarch64-unknown-linux-gnu]
+linker = "aarch64-linux-gnu-gcc"
+runner = ["qemu-aarch64-static"] # use qemu user emulation for cargo run and test

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Global rule:
+* @xvpn/core-vpn-developers

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,26 @@
+<!--- Provide a general summary of your changes in the Title above -->
+
+## Description
+<!--- Describe your changes in detail -->
+
+## Motivation and Context
+<!--- Why is this change required? What problem does it solve? -->
+<!--- If it fixes an open issue, please link to the issue here. -->
+
+## How Has This Been Tested?
+<!--- Please describe in detail how you tested your changes. -->
+<!--- Include details of your testing environment, the tests you ran to -->
+<!--- see how your change affects other areas of the code, etc. -->
+
+## Types of changes
+<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to change)
+
+## Checklist:
+<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
+<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
+- [ ] My change requires a change to the documentation.
+- [ ] I have updated the documentation accordingly.
+- [ ] The correct base branch is being used, if not `main`

.github/workflows/ci.yaml

@@ -0,0 +1,147 @@
+# .github/workflows/ci.yml
+name: CI
+on:
+  # Running CI on all commits on all branches (implicitly covers pull request too)
+  push:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress:  ${{ github.ref_name != 'main' }}
+
+jobs:
+  ci:
+    needs: [earthly, e2e, coverage]
+    runs-on: ubuntu-latest
+    steps:
+      - shell: bash
+        run: |
+          echo "Build success"
+  earthly:
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [test, test-arm64, build, build-arm64, fmt, lint, check-dependencies]
+    runs-on: ubuntu-latest
+    env:
+      EARTHLY_TOKEN: "${{ secrets.EARTHLY_TOKEN }}"
+      FORCE_COLOR: 1
+    steps:
+      - uses: earthly/actions-setup@v1
+        with:
+          version: ~v0.8
+      - uses: actions/checkout@v4
+      - name: Run +${{ matrix.target }} on Earthly satellite
+        run: earthly --ci --org expressvpn --satellite lightway +${{ matrix.target }}
+  e2e:
+    runs-on: ubuntu-latest
+    env:
+      EARTHLY_TOKEN: "${{ secrets.EARTHLY_TOKEN }}"
+      FORCE_COLOR: 1
+    strategy:
+      fail-fast: false
+      matrix:
+        distro: [bookworm]
+    steps:
+      - uses: earthly/actions-setup@v1
+        with:
+          version: ~v0.8
+      - uses: actions/checkout@v4
+      - name: Run +e2e on Earthly satellite
+        run: earthly --ci --org expressvpn --satellite lightway --allow-privileged +e2e --debian ${{ matrix.distro }}
+  coverage:
+    runs-on: ubuntu-latest
+    env:
+      EARTHLY_TOKEN: "${{ secrets.EARTHLY_TOKEN }}"
+      FORCE_COLOR: 1
+    steps:
+      - uses: earthly/actions-setup@v1
+        with:
+          version: ~v0.8
+      - uses: actions/checkout@v4
+      - name: Run +coverage on Earthly satellite
+        id: coverage
+        run: |
+          earthly --ci --org expressvpn --satellite lightway --artifact +coverage/* output/
+
+          cat output/summary.txt
+
+          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
+          echo "summary<<$EOF"    >> "$GITHUB_OUTPUT"
+          cat output/summary.txt  >> "$GITHUB_OUTPUT"
+          echo ""                 >> "$GITHUB_OUTPUT"
+          echo "$EOF"             >> "$GITHUB_OUTPUT"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: coverage
+          path: output/html
+          if-no-files-found: error
+      - name: Check coverage
+        id: coverage-check
+        run: |
+          REGIONS_SOFT_THRESHOLD=50
+          REGIONS_HARD_THRESHOLD=40
+          LINES_SOFT_THRESHOLD=60
+          LINES_HARD_THRESHOLD=50
+
+          regions_coverage=$(jq '.data[].totals.regions.percent | floor' output/coverage.json)
+          lines_coverage=$(jq '.data[].totals.lines.percent | floor' output/coverage.json)
+
+          echo "Regions: $regions_coverage% (soft: $REGIONS_SOFT_THRESHOLD%, hard: $REGIONS_HARD_THRESHOLD%)"
+          echo "Lines: $lines_coverage% (soft: $LINES_SOFT_THRESHOLD%, hard: $LINES_HARD_THRESHOLD%)"
+
+          FAILED=false
+
+          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
+          echo "text<<$EOF" >> "$GITHUB_OUTPUT"
+
+          if [[ $regions_coverage -lt $REGIONS_HARD_THRESHOLD ]] ; then
+              echo ":x: Region coverage $regions_coverage% below hard threshold $REGIONS_HARD_THRESHOLD%" >> "$GITHUB_OUTPUT"
+              FAILED=true
+          elif [[ $regions_coverage -lt $REGIONS_SOFT_THRESHOLD ]] ; then
+              echo ":warning: Region coverage $regions_coverage% below soft threshold $REGIONS_SOFT_THRESHOLD%" >> "$GITHUB_OUTPUT"
+          else
+              echo ":white_check_mark: Region coverage $regions_coverage% passes" >> "$GITHUB_OUTPUT"
+          fi
+
+          if [[ $lines_coverage -lt $LINES_HARD_THRESHOLD ]] ; then
+              echo ":x: Line coverage $lines_coverage% below hard threshold $LINES_HARD_THRESHOLD%" >> "$GITHUB_OUTPUT"
+              FAILED=true
+          elif [[ $lines_coverage -lt $LINES_SOFT_THRESHOLD ]] ; then
+              echo ":warning: Line coverage $lines_coverage% below soft threshold $LINES_SOFT_THRESHOLD%" >> "$GITHUB_OUTPUT"
+          else
+              echo ":white_check_mark: Line coverage $lines_coverage% passes" >> "$GITHUB_OUTPUT"
+          fi
+
+          echo "$EOF" >> "$GITHUB_OUTPUT"
+
+          echo "Setting output: failed: $FAILED"
+          echo "failed=$FAILED" >> "$GITHUB_OUTPUT"
+
+      - uses: jwalton/gh-find-current-pr@v1
+        id: find-pr
+        with:
+          state: open
+      - name: Find Coverage Comment
+        if: steps.find-pr.outputs.number
+        uses: peter-evans/find-comment@v3
+        id: coverage-comment
+        with:
+          issue-number: ${{ steps.find-pr.outputs.number }}
+          comment-author: 'github-actions[bot]'
+          body-includes: 'Code coverage summary'
+      - name: Create or update comment
+        if: steps.find-pr.outputs.number
+        uses: peter-evans/create-or-update-comment@v4
+        with:
+          comment-id: ${{ steps.coverage-comment.outputs.comment-id }}
+          issue-number: ${{ steps.find-pr.outputs.number }}
+          body: |
+            [Code coverage summary](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for ${{ github.sha }}:
+            ```
+            ${{ steps.coverage.outputs.summary }}
+            ```
+            ${{ steps.coverage-check.outputs.text }}
+          edit-mode: replace
+      - name: Coverage check fails
+        if: steps.coverage-check.outputs.failed == 'true'
+        run: exit 1

.github/workflows/nightly-cargo-deny.yaml

@@ -0,0 +1,12 @@
+name: Nightly `cargo deny` checks
+on:
+  schedule:
+    - cron:  '36 3 * * *'
+  workflow_dispatch:
+
+jobs:
+  cargo-deny:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: EmbarkStudios/cargo-deny-action@v1

.github/workflows/nightly-rust-update-check.yaml

@@ -0,0 +1,41 @@
+name: Nightly Rust release checks
+on:
+  workflow_dispatch:
+
+jobs:
+  check-for-updated-rust:
+    runs-on: ubuntu-latest
+    environment: expressvpn_iat_automation_githubiatuser_gpg_key
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Import GPG Key
+      uses: crazy-max/ghaction-import-gpg@v6
+      with:
+        gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+        passphrase: ${{ secrets.GPG_PASSPHRASE }}
+        git_user_signingkey: true
+        git_commit_gpgsign: true
+
+    - name: Check for Rust update
+      id: check-version
+      run: |
+        rustup install stable
+        stable=$(rustup run stable rustc -V | sed -E -e 's/^rustc ([0-9\.]+) \(.*\)$/\1/g')
+        echo "Latest stable rust is ${stable}"
+
+        echo rust="$stable" >> "$GITHUB_OUTPUT"
+
+    - name: Update Rust version in Earthfile
+      run: sed -i -E 's/^(\s*FROM rust):(:?[0-9\.]+)(-.+)?$/\1:${{ steps.check-version.outputs.rust }}\3/g' Earthfile
+
+    - uses: peter-evans/create-pull-request@v6
+      with:
+        token: ${{ secrets.SERVICE_ACCOUNT_PAT }}
+        delete-branch: true
+        committer: ExpressVPN Automation Bot <143369453+expressvpn-iat-bot@users.noreply.github.com>
+        author: ExpressVPN Automation Bot <143369453+expressvpn-iat-bot@users.noreply.github.com>
+        commit-message: "[auto] Update Rust toolchain to ${{ steps.check-version.outputs.rust }}"
+        branch: gha/rust-toolchain-update
+        title: "[auto] Update Rust toolchain to ${{ steps.check-version.outputs.rust }}"
+        body: "Changelog: https://releases.rs/docs/${{ steps.check-version.outputs.rust }}/"

.github/workflows/weekly-cargo-update.yaml

@@ -0,0 +1,112 @@
+name: Weekly `cargo update`
+on:
+  workflow_dispatch:
+
+jobs:
+  cargo-update:
+    runs-on: ubuntu-latest
+    environment: expressvpn_iat_automation_githubiatuser_gpg_key
+    steps:
+    - uses: actions/checkout@v4
+    - name: Import GPG Key
+      uses: crazy-max/ghaction-import-gpg@v6
+      with:
+        gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+        passphrase: ${{ secrets.GPG_PASSPHRASE }}
+        git_user_signingkey: true
+        git_commit_gpgsign: true
+
+    - uses: Swatinem/rust-cache@v2
+    - run: rustup show
+
+    # Updates indirect and direct dependencies according to semver
+    # constraints from `*/Cargo.toml`.
+    - name: Update cargo dependencies
+      id: update
+      run: |
+        cargo update 2>&1 | tee /tmp/update.log
+
+        title="[auto] Update cargo dependencies"
+        body=$(
+            echo '```console'
+            echo '$ cargo update'
+            cat /tmp/update.log
+            echo '```'
+        )
+
+        # Outputs:
+        # ... PR title
+        echo PRTITLE="$title" >> "$GITHUB_OUTPUT"
+
+        # ... PR body
+        EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
+        echo "PRBODY<<$EOF" >> "$GITHUB_OUTPUT"
+        echo "$body"        >> "$GITHUB_OUTPUT"
+        echo "$EOF"         >> "$GITHUB_OUTPUT"
+
+        # ... commit message
+        EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
+        echo "COMMITMSG<<$EOF" >> "$GITHUB_OUTPUT"
+        echo "$title"          >> "$GITHUB_OUTPUT"
+        echo ""                >> "$GITHUB_OUTPUT"
+        echo "$body"           >> "$GITHUB_OUTPUT"
+        echo "$EOF"            >> "$GITHUB_OUTPUT"
+
+    - uses: peter-evans/create-pull-request@v6
+      id: pr
+      with:
+        token: ${{ secrets.SERVICE_ACCOUNT_PAT }}
+        delete-branch: true
+        committer: ExpressVPN Automation Bot <143369453+expressvpn-iat-bot@users.noreply.github.com>
+        author: ExpressVPN Automation Bot <143369453+expressvpn-iat-bot@users.noreply.github.com>
+        commit-message: ${{ steps.update.outputs.COMMITMSG }}
+        branch: gha/cargo-update
+        title: ${{ steps.update.outputs.PRTITLE }}
+        body: ${{ steps.update.outputs.PRBODY }}
+
+    - run: cargo install --locked cargo-outdated
+
+    # Checks for dependencies which can be upgraded but require a
+    # semver bump in `*/Cargo.toml`. Will fail if there are available
+    # updates.
+    - name: Check for outdated dependencies
+      id: outdated-check
+      shell: bash
+      run: |
+        git checkout ${{ steps.pr.outputs.pull-request-head-sha }}
+
+        failed=false
+
+        EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
+        echo "comment<<$EOF" >> "$GITHUB_OUTPUT"
+
+        if ! cargo outdated --root-deps-only --exit-code 1 | tee /tmp/workspace-outdated.log ; then
+            echo "Workspace dependencies are out of date"
+            failed=true
+
+            echo '# Workspace Outdated Dependencies'               >> "$GITHUB_OUTPUT"
+            echo '```console'                                      >> "$GITHUB_OUTPUT"
+            echo '$ cargo outdated --root-deps-only --exit-code 1' >> "$GITHUB_OUTPUT"
+            cat /tmp/workspace-outdated.log                        >> "$GITHUB_OUTPUT"
+            echo '```'                                             >> "$GITHUB_OUTPUT"
+        fi
+
+        echo "$EOF" >> "$GITHUB_OUTPUT"
+
+        echo "Setting output: failed: $failed"
+        echo "failed=$failed" >> "$GITHUB_OUTPUT"
+
+    # If there was no PR then there is nowhere to put a comment,
+    # given a weekly update cadence it's 99% likely there will be a
+    # comment.
+    - name: Outdated dependencies comment
+      if: steps.pr.outputs.pull-request-number && steps.outdated-check.outputs.failed == 'true'
+      uses: peter-evans/create-or-update-comment@v4
+      with:
+        issue-number: ${{ steps.pr.outputs.pull-request-number }}
+        body: ${{ steps.outdated-check.outputs.comment }}
+        edit-mode: replace
+
+    - name: Outdated check fails
+      if: steps.outdated-check.outputs.failed == 'true'
+      run: exit 1

.gitignore

@@ -0,0 +1 @@
+/target/

CODE_OF_CONDUCT.adoc

@@ -0,0 +1,22 @@
+= Contributor Code of Conduct
+
+As contributors and maintainers of this project, and in the interest of fostering an open and welcoming community, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities.
+
+We are committed to making participation in this project a harassment-free experience for everyone, regardless of level of experience, gender, gender identity and expression, sexual orientation, disability, personal appearance, body size, race, ethnicity, age, religion, or nationality.
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery
+* Personal attacks
+* Trolling or insulting/derogatory comments
+* Public or private harassment
+* Publishing others' private information, such as physical or electronic addresses, without explicit permission
+* Other unethical or unprofessional conduct.
+
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct. By adopting this Code of Conduct, project maintainers commit themselves to fairly and consistently applying these principles to every aspect of managing this project.
+
+This code of conduct applies both within project spaces and in public spaces when an individual is representing the project or its community.
+
+Instances of abusive, harassing, or otherwise unacceptable behavior in ExpressVPN may be reported by contacting ExpressVPN via opensource-conduct@expressvpn.com.
+
+This Code of Conduct is adapted from the Contributor Covenant (http://contributor-covenant.org), version 1.2.0, available at http://contributor-covenant.org/version/1/2/0/