Table of Contents
- Project structure
- Building natively on *NIX
- Cross-compiling on *NIX ("generic" subdir)
- Creating a NSIS installer ("windows-nsis" subdir)
- Building natively on Windows using the MSVC toolchain ("msvc" subdir)
- Building TAP-Windows
- Making the release builds of OpenVPN
- External links
Look here for details.
Building natively on *NIX
Building natively on *NIX has not changed much, you can still use roughly the same process as before. If building from Git sources, first do a
$ autoreconf -vi
If building from a release tarball, you can skip the above step. To configure, build and install OpenVPN, use these commands:
$ ./configure <configure-options> $ make $ make install
In most cases, you'd use something like this:
If you're using password authentication, you may be interested in support for password stored in (properly protected!) files:
$ ./configure --enable-password-save
Or, if you want to use smart cards and such, you should use
$ ./configure --enable-pkcs11
Cross-compiling on *NIX ("generic" subdir)
Content moved here.
Checking out openvpn-build repository
Check out the openvpn-build subproject using Git:
$ git clone https://github.com/OpenVPN/openvpn-build.git
Then go to the generic directory:
$ cd openvpn-build/generic
Customizing the build
To customize the build options, refer to build.vars, it contains the defaults for building, most settings can be customized by setting environment variable before executing the build script.
If you want to use your own, local sources (e.g. for OpenSSL or OpenVPN), put them in sources directory, so that the generic buildsystem knows not to download them from a remote site. The cached tarballs will be used even if they're of a different version than what would be downloaded. This is useful for building custom version.
Building OpenVPN and it's dependencies
The ./build command fetches all the dependencies, builds them and builds OpenVPN. To build a native binary:
$ IMAGEROOT=`pwd`/image-native ./build
To build for Windows 32bit on Linux 64bit:
$ IMAGEROOT=`pwd`/image-win32 CHOST=i686-w64-mingw32 \ CBUILD=x86_64-pc-linux-gnu ./build
To build for Windows 64bit on Linux 64bit:
$ IMAGEROOT=`pwd`/image-win64 CHOST=x86_64-w64-mingw32 \ CBUILD=x86_64-pc-linux-gnu ./build
To build for Arm on Linux 64bit:
$ IMAGEROOT=`pwd`/image-arm CHOST=arm-linux-gnueabi \ CBUILD=x86_64-pc-linux-gnu ./build
Building dependencies only
To build only dependencies (helpful for developers):
$ DO_ONLY_DEPS=1 IMAGEROOT=`pwd`/deps-win32 CHOST=i686-w64-mingw32 \ CBUILD=x86_64-pc-linux-gnu ./build
For typical OpenVPN installations you'll most likely want to use something like this:
$ DEP=location of the dependencies $ ./configure host=... \ CFLAGS="-I$DEP/include" LDFLAGS="-L$DEB/lib" \ --enable-pkcs11 \ PKCS11_HELPER_CFLAGS=" " PKCS11_HELPER_LIBS="-lpkcs11-helper"
If you want to start from scratch, do
$ cd openvpn-build/generic $ rm -f sources/* $ rm -rf image-*
Creating a NSIS installer ("windows-nsis" subdir)
Building and packaging
You can use the scripts in openvpn-build/windows-nsis to create a NSIS installer for Windows. The scripts use the generic build system to build OpenVPN and it's dependencies (e.g. lzo, openssl), and use osslsigncode for signing the resulting binaries, if requested.
NSIS must be available on system. If installed not in path or standard location set MAKENSIS environment variable. Same goes for OSSLSIGNCODE.
First check out openvpn-build as described here. Check build-complete.vars for variables which you can set in the shell to point the build-complete script to the correct dependency packages (easy-rsa and tap-windows). If you're building a snapshot, ensure that OPENVPN_VERSION in version.m4 (in Git) matches that in ../generic/build.vars; also make sure other variables in that file are correct.
Then, if you want to build an (unsigned) installer, do the following:
$ cd openvpn-build/windows-nsis $ ./build-snapshot
NOTE: Ensure that OPENVPN_VERSION is set to what version.m4 says.
If you want to build a signed snapshot installer (with all included libraries and executables signed) use something like this instead:
$ ./build-snapshot --sign --sign-pkcs12=signingkey.p12 --sign-pkcs12-pass=yourpassphrase --sign-timestamp="http://timestamp.domain.com"
If you're doing a release build, use build-complete instead:
$ ./build-complete --sign --sign-pkcs12=signingkey.p12 --sign-pkcs12-pass=yourpassphrase --sign-timestamp="http://timestamp.domain.com"
Refer to ./build-complete --help and build-snapshot for more options.
NOTE: To make sure fresh tarballs are used, empty ./sources directory before building.
Packaging without building
Building OpenVPN and it's dependencies takes time, so if you're only making changes to openvpn.nsi you should only rebuild the Windows installers:
makensis -DARCH=x86_64\ -DVERSION_STRING=2.3_master-I001_master\ -DOPENVPN_ROOT=tmp\\installer\\openvpn\ -DTAP_WINDOWS_INSTALLER=tmp\\tap-windows-9.9.2.exe\ -DSPECIAL_BUILD\ -DUSE_TAP_WINDOWS\ -DEASYRSA_ROOT=tmp\\installer\\easy-rsa\ -DUSE_EASYRSA\ -DUSE_OPENVPN_GUI\ -DOUTPUT=./openvpn-test.exe\ -DPACKAGE_NAME=OpenVPN openvpn.nsi
Make sure the variables match your latest complete build.
Building natively on Windows using the MSVC toolchain ("msvc" subdir)
Content moved here.
Content moved here.
The osslsigncode tool is used to sign OpenVPN installer, libraries and executables. SignTool is used to sign the TAP-drivers. Official OpenVPN releases will be signed with OpenVPN Technologies, Inc. code signing keys. However, it's fairly easy to build a custom version of OpenVPN and sign it with your own code-signing keys.
Installation instructions for osslsigncode are available here.
Making the release builds of OpenVPN
We've now described building the various components of OpenVPN in isolation. In this chapter we put all of it together.
Building signed Windows installers and executables
Building Windows executables and installers is one of the most painful parts of OpenVPN release process due to code-signing requirements etc. To generate universally useful installers you need the following:
- Code-signing (=SPC) certificates
- Kernel-mode code-signing certificate
- CA's cross-certificate for kernel-mode code-signing
- User-mode code-signing certificate (a.k.a. Microsoft Authenticode certificate)
- A Windows build computer (for building and signing tap-windows)
- *NIX build computer (for building and signing everything else)
- Lots of patience
The build process is fairly straightforward:
- Get the SPC certificates from a CA
- Copy the kernel-mode and cross-certificates to the Windows build computer
- Copy the user-mode code-signing certificate to the *NIX build computer
- Generate an easy-rsa tarball and put it on a webserver
- Generate an openvpn-gui tarball (unless one has been generated for you):
- Optionally, build tap-windows and put the latest installer on a webserver
- Setup openvpn-build/generic/build.vars to suit your needs:
- dependency locations
- build flags
- Setup openvpn-build/windows-nsis/build-complete.vars to suit your needs:
- easy-rsa tarball location
- tap-windows installer location
- Ensure your mingw-w64 installation is up-to-date and/or patched
- Build the whole thing using openvpn-build/windows-nsis/build-complete
- NOTE: build-snapshot is meant for building snapshots, not release packages
See corresponding sections for more detailed documentation.
Official OpenVPN Git repositories
Unofficial Git repositores