@tsplc/build 0.0.0-stage → 0.2.0

package/docker/Dockerfile

@@ -0,0 +1,173 @@
+# Build with --platform=linux/amd64; CODESYS and its CLR are x86-64.
+ARG SETUP_BASE=base
+ARG SETUP_PLATFORM=linux/amd64
+ARG INSTALLER_SOURCE=installer-download
+FROM oven/bun:1.4.3 AS bun
+
+FROM ubuntu:24.04 AS tools
+ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 LC_ALL=C.UTF-8 \
+    WINEDEBUG=-all WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS=--disable-gpu
+RUN dpkg --add-architecture i386 && apt-get -o Acquire::Retries=3 update && apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
+    ca-certificates curl gnupg xvfb xauth cabextract unzip p7zip-full \
+    gcc gcc-mingw-w64-x86-64-posix python3 msitools util-linux fonts-liberation \
+    && mkdir -p /etc/apt/keyrings \
+    && curl -fsSL https://dl.winehq.org/wine-builds/winehq.key | gpg --dearmor -o /etc/apt/keyrings/winehq.gpg \
+    && printf '%s\n' 'deb [signed-by=/etc/apt/keyrings/winehq.gpg] https://dl.winehq.org/wine-builds/ubuntu/ noble main' > /etc/apt/sources.list.d/winehq.list \
+    && rm -rf /var/lib/apt/lists/*
+# 11.19 includes the Wine fix for page alignment under QEMU/Rosetta (Wine bug 58084).
+# Pin every Wine package: apt otherwise resolves the dependencies to the newest release.
+RUN apt-get -o Acquire::Retries=3 update && apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
+       winehq-devel=11.19~noble-1 wine-devel=11.19~noble-1 wine-devel-amd64=11.19~noble-1 wine-devel-i386:i386=11.19~noble-1 \
+    && curl -fsSL https://raw.githubusercontent.com/Winetricks/winetricks/20260125/src/winetricks -o /usr/local/bin/winetricks \
+    && chmod +x /usr/local/bin/winetricks && rm -rf /var/lib/apt/lists/*
+COPY --from=bun /usr/local/bin/bun /usr/local/bin/bun
+RUN userdel ubuntu && useradd --create-home --uid 1000 builder \
+    && mkdir /opt/wine-template /home/builder/.cache \
+    && chown builder:builder /opt/wine-template /home/builder/.cache
+FROM tools AS base
+COPY docker/install/decode.c docker/install/helper-launcher.c /opt/codesys-install/
+RUN gcc -shared -fPIC -nostdlib -Wl,--no-undefined -O2 /opt/codesys-install/decode.c -o /opt/codesys-install/decode.so \
+    && x86_64-w64-mingw32-gcc -municode -Wall -Wextra -O2 -static \
+       /opt/codesys-install/helper-launcher.c -o /opt/codesys-install/CoreInstallerSupport.exe
+
+# ARM setup uses FEX for 32-bit prerequisites that fault under Rosetta.
+# Compilation is verified later under AMD64 Wine; FEX runs only setup.
+FROM --platform=${SETUP_PLATFORM} ubuntu:24.04 AS arm-setup
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apt-get -o Acquire::Retries=3 update \
+    && apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
+       software-properties-common xvfb xauth cabextract unzip curl util-linux \
+    && add-apt-repository -y ppa:fex-emu/fex \
+    && apt-get -o Acquire::Retries=3 update \
+    && apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
+       fex-emu-armv8.2=2610-1~n gcc python3 msitools p7zip-full fonts-liberation \
+    && rm -rf /var/lib/apt/lists/*
+COPY --from=base /usr /opt/fex-rootfs/usr
+COPY --from=base /lib /opt/fex-rootfs/lib
+COPY --from=base /lib64 /opt/fex-rootfs/lib64
+COPY --from=base /bin /opt/fex-rootfs/bin
+COPY --from=base /sbin /opt/fex-rootfs/sbin
+COPY --from=base /etc /opt/fex-rootfs/etc
+COPY --from=base /opt/wine-devel /opt/fex-rootfs/opt/wine-devel
+COPY --from=base /usr/local/bin/winetricks /usr/local/bin/winetricks
+COPY --from=base /opt/codesys-install /opt/codesys-install
+ENV FEX_ROOTFS=/opt/fex-rootfs WINEDLLPATH=/opt/fex-rootfs/opt/wine-devel/lib/wine \
+    WINE64=wine LANG=C.UTF-8 LC_ALL=C.UTF-8 WINEDEBUG=-all
+RUN rm -f /opt/fex-rootfs/etc/resolv.conf /opt/fex-rootfs/etc/hosts /opt/fex-rootfs/etc/hostname \
+    && ln -s /opt/fex-rootfs/opt/wine-devel /opt/wine-devel \
+    && printf '#!/bin/sh\nexec FEX /opt/wine-devel/bin/wine "$@"\n' > /usr/local/bin/wine \
+    && printf '#!/bin/sh\nexec FEX /opt/wine-devel/bin/wineserver "$@"\n' > /usr/local/bin/wineserver \
+    && chmod +x /usr/local/bin/wine /usr/local/bin/wineserver \
+    && gcc -shared -fPIC -nostdlib -Wl,--no-undefined -O2 /opt/codesys-install/decode.c -o /opt/codesys-install/decode.so \
+    && userdel ubuntu && useradd --create-home --uid 1000 builder \
+    && mkdir /opt/wine-template /home/builder/.cache \
+    && chown builder:builder /opt/wine-template /home/builder/.cache
+
+FROM scratch AS installer-download
+# The archive URL serves this exact release without Store credentials.
+ADD --chmod=0644 --checksum=sha256:06f8abceffffbeb23edbc909e0f06133b47d6708bf66799b5699bc08daa01c19 \
+    https://store-archive.codesys.com/ftp_download/3S/CODESYS/300000/3.5.22.30/CODESYS%2064%203.5.22.30.exe /codesys.exe
+
+FROM scratch AS linux-sl-package
+# Builds can target Control for Linux SL; only its device description is installed.
+ADD --chmod=0644 --checksum=sha256:c34d1d9293f23c92e0130a2a9c61da1500892c6023006b85c0dcdba102b29f9a \
+    https://store-archive.codesys.com/ftp_download/3S/LinuxSL/2302000005/4.22.0.0/CODESYS%20Control%20for%20Linux%20SL%204.22.0.0.package /linux-sl.package
+
+FROM ${SETUP_BASE} AS installer-local
+RUN --mount=type=bind,from=installer,source=codesys.exe,target=/tmp/codesys.exe \
+    echo '06f8abceffffbeb23edbc909e0f06133b47d6708bf66799b5699bc08daa01c19  /tmp/codesys.exe' | sha256sum --check - \
+    && cp /tmp/codesys.exe /codesys.exe && chmod 644 /codesys.exe
+
+FROM ${INSTALLER_SOURCE} AS installer-file
+
+FROM ${SETUP_BASE} AS linux-sl-device
+RUN --mount=type=bind,from=linux-sl-package,source=/linux-sl.package,target=/tmp/linux-sl.package \
+    unzip -j -d /linux-sl-device /tmp/linux-sl.package \
+      'Devices/AddOns/CODESYS Control for Linux SL/linux/4.22.0.0/*'
+
+FROM ${SETUP_BASE} AS init
+RUN arch=$(dpkg --print-architecture) \
+    && curl -fsSL --retry 3 "https://github.com/krallin/tini/releases/download/v0.19.0/tini-$arch" -o "/tmp/tini-$arch" \
+    && curl -fsSL --retry 3 "https://github.com/krallin/tini/releases/download/v0.19.0/tini-$arch.sha256sum" -o /tmp/tini.sha256sum \
+    && (cd /tmp && sha256sum -c tini.sha256sum) \
+    && install -m 755 "/tmp/tini-$arch" /usr/local/bin/tini
+
+FROM base AS runtime-init
+RUN curl -fsSL --retry 3 'https://github.com/krallin/tini/releases/download/v0.19.0/tini-amd64' -o /tmp/tini-amd64 \
+    && curl -fsSL --retry 3 'https://github.com/krallin/tini/releases/download/v0.19.0/tini-amd64.sha256sum' -o /tmp/tini.sha256sum \
+    && (cd /tmp && sha256sum -c tini.sha256sum) \
+    && install -m 755 /tmp/tini-amd64 /usr/local/bin/tini
+
+FROM ${SETUP_BASE} AS prerequisites
+COPY docker/install/prerequisites.sh /opt/codesys-install/prerequisites.sh
+USER builder
+ENV WINEPREFIX=/opt/wine-template HOME=/home/builder WINEARCH=win64
+RUN --mount=type=bind,from=installer,source=winetricks,target=/tmp/download-cache \
+    --mount=type=cache,id=codesys-winetricks-20260125,target=/home/builder/.cache/winetricks,uid=1000,gid=1000 \
+    cp -Rn /tmp/download-cache/. /home/builder/.cache/winetricks/ \
+    && xvfb-run -a /opt/codesys-install/prerequisites.sh
+
+FROM prerequisites AS webview
+RUN curl --fail --location --retry 3 --connect-timeout 30 --max-time 600 \
+      'https://go.microsoft.com/fwlink/p/?LinkId=2124701' -o /tmp/webview2.exe \
+    && xvfb-run -a timeout --foreground 10m wine /tmp/webview2.exe /silent /install \
+    && wineserver -k && wineserver -w && rm /tmp/webview2.exe
+
+FROM webview AS core
+COPY --chmod=755 docker/install/core.sh docker/install/extract.py /opt/codesys-install/
+RUN --mount=type=bind,from=installer-file,source=/codesys.exe,target=/tmp/codesys.exe \
+    xvfb-run -a /opt/codesys-install/core.sh /tmp/codesys.exe
+
+FROM core AS installed
+COPY --from=init /usr/local/bin/tini /usr/local/bin/tini
+COPY docker/install/install.sh /opt/codesys-install/
+# Wine starts orphaned helpers; BuildKit RUN needs the same reaping as docker run --init.
+RUN tini -s -g -- xvfb-run -a /opt/codesys-install/install.sh
+
+# Build the Wine-only signal adapter independently of the expensive setup cache.
+FROM base AS wine-signal-compat
+RUN apt-get -o Acquire::Retries=3 update \
+    && apt-get -o Acquire::Retries=3 install -y --no-install-recommends libc6-dev \
+    && rm -rf /var/lib/apt/lists/*
+COPY docker/install/wine-signal /opt/codesys-install/wine-signal
+RUN /opt/codesys-install/wine-signal/build.sh /opt/tsplc-wine-compat
+
+# Only the installed prefix leaves setup. After observed managed faults under FEX,
+# the compiler uses AMD64 Wine without setup's FEX wrappers, rootfs or environment.
+FROM base AS builder
+COPY --from=installed --chown=builder:builder /opt/wine-template /opt/wine-template
+COPY --from=wine-signal-compat /opt/tsplc-wine-compat /opt/tsplc-wine-compat
+COPY --chmod=755 docker/install/wine-signal/wine /usr/local/bin/wine
+USER root
+COPY docker/install/wine-ncrypt /opt/codesys-install/wine-ncrypt
+RUN python3 /opt/codesys-install/wine-ncrypt/enable-oaep.py \
+    /opt/wine-devel/lib/wine/x86_64-windows/ncrypt.dll \
+    /opt/wine-template/drive_c/windows/system32/ncrypt.dll
+COPY --chmod=755 docker/install/verify.sh /opt/codesys-install/verify.sh
+COPY --from=runtime-init /usr/local/bin/tini /usr/local/bin/tini
+# Verification imports the controller descriptions; changing it keeps the package install cached.
+COPY --chown=builder:builder docker/install/verify.py /opt/wine-template/drive_c/verify.py
+COPY --chown=builder:builder docker/install/device /opt/wine-template/drive_c/codesys-device
+COPY --from=linux-sl-device --chown=builder:builder /linux-sl-device /opt/wine-template/drive_c/codesys-device-linux-sl
+USER builder
+ENV WINEPREFIX=/opt/wine-template HOME=/home/builder WINEARCH=win64
+RUN tini -s -g -- xvfb-run -a /opt/codesys-install/verify.sh
+USER root
+WORKDIR /opt/codesys-build
+COPY package.json ./
+RUN bun install --production \
+    && mkdir -p /node_modules/@tsplc \
+    && ln -s /opt/codesys-build /node_modules/@tsplc/build
+COPY shared-config /opt/tsplc-config
+RUN ln -s /opt/codesys-build/node_modules /opt/tsplc-config/node_modules
+RUN ln -s /opt/tsplc-config /node_modules/@tsplc/config
+COPY src ./src
+RUN bun build src/index.ts --target=node --packages=external --outdir dist
+COPY python ./python
+COPY docker/entrypoint.sh docker/runner.ts docker/config.ts ./docker/
+RUN chmod +x docker/entrypoint.sh
+ENV WINEPREFIX=/tmp/codesys-wine HOME=/tmp/codesys-home WINEARCH=win64 \
+    WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS=--disable-gpu
+WORKDIR /workspace
+ENTRYPOINT ["/opt/codesys-build/docker/entrypoint.sh"]
+CMD ["--help"]

package/docker/Dockerfile.dockerignore

@@ -0,0 +1,18 @@
+**
+!package.json
+!bun.lock
+!src
+!src/**
+src/**/*.test.ts
+src/__tests__
+!python
+!python/build.py
+!python/worker.py
+!python/codesys_online.py
+!python/codesys_login.py
+!docker
+!docker/**
+docker/.installer
+
+!shared-config
+!shared-config/**

package/docker/Dockerfile.source

@@ -0,0 +1,15 @@
+# Refresh tsPLC code without reinstalling an already verified vendor compiler.
+ARG BUILDER_IMAGE=tsplc-build:latest
+FROM ${BUILDER_IMAGE}
+USER root
+WORKDIR /opt/codesys-build
+COPY src /opt/codesys-build/src
+COPY python /opt/codesys-build/python
+COPY docker/runner.ts docker/entrypoint.sh docker/config.ts /opt/codesys-build/docker/
+COPY runtime /opt/codesys-build/runtime
+COPY shared-config /opt/tsplc-config
+RUN bun build src/index.ts --target=node --packages=external --outdir dist \
+    && chmod +x /opt/codesys-build/docker/entrypoint.sh
+WORKDIR /workspace
+ENTRYPOINT ["/opt/codesys-build/docker/entrypoint.sh"]
+CMD ["--help"]

package/docker/build-image

@@ -0,0 +1,38 @@
+#!/bin/sh
+set -eu
+installer=
+installer_source=installer-download
+if [ "$#" -gt 1 ]; then
+    echo 'Usage: docker/build-image [ /path/to/CODESYS-64-3.5.22.30.exe ]' >&2
+    echo 'Downloads the official installer automatically when no file is supplied.' >&2
+    exit 2
+fi
+if [ "$#" -eq 1 ]; then
+    installer=$1
+    installer_source=installer-local
+    test -f "$installer" || { echo "Installer not found: $installer" >&2; exit 1; }
+fi
+root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+context=$(mktemp -d)
+source_context=
+trap 'rm -rf "$context"; if [ -n "$source_context" ]; then rm -rf "$source_context"; fi' EXIT HUP INT TERM
+if [ -n "$installer" ]; then
+    cp "$installer" "$context/codesys.exe"
+fi
+mkdir "$context/winetricks"
+if [ -n "${CODESYS_WINETRICKS_CACHE:-}" ]; then
+    test -d "$CODESYS_WINETRICKS_CACHE" || { echo 'CODESYS_WINETRICKS_CACHE must be a directory.' >&2; exit 1; }
+    cp -R "$CODESYS_WINETRICKS_CACHE/." "$context/winetricks/"
+fi
+case $(docker info --format '{{.OSType}}/{{.Architecture}}') in
+    linux/aarch64|linux/arm64) setup_base=arm-setup; setup_platform=linux/arm64 ;;
+    linux/x86_64|linux/amd64) setup_base=base; setup_platform=linux/amd64 ;;
+    *) echo 'The builder requires a Linux Docker server on ARM64 or AMD64.' >&2; exit 1 ;;
+esac
+source_context=$(bun -e 'import { pathToFileURL } from "node:url"; const { prepareDockerContext } = await import(pathToFileURL(process.argv[1]).href); console.log(await prepareDockerContext());' "$root/src/docker-context.ts")
+# FEX handles ARM setup's 32-bit prerequisites; the compiler runtime stays AMD64.
+docker build --platform linux/amd64 \
+    --build-arg "SETUP_BASE=$setup_base" --build-arg "SETUP_PLATFORM=$setup_platform" \
+    --build-arg "INSTALLER_SOURCE=$installer_source" --progress plain \
+    --build-context "installer=$context" \
+    -f "$source_context/docker/Dockerfile" -t "${CODESYS_BUILD_IMAGE:-tsplc-build:latest}" "$source_context"

package/docker/codesys-build

@@ -0,0 +1,5 @@
+#!/bin/sh
+set -eu
+# Keep the shell entrypoint on the same shared config and artifact protocol.
+root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+exec bun "$root/src/cli.ts" "$@"

package/docker/config.ts

@@ -0,0 +1,8 @@
+import { resolveConfig, type ResolvedConfig } from "../src/config.ts";
+
+/** Only the Docker entrypoint disables dispatch after validating its request. */
+export function resolveContainerConfig(input: unknown, configFile: string): ResolvedConfig {
+  const config = resolveConfig(input, configFile);
+  if (config.codesys.wine) config.codesys.wine.debug = "-all,err+seh";
+  return { ...config, docker: undefined };
+}

package/docker/control-linux-sl/Dockerfile

@@ -0,0 +1,38 @@
+# CODESYS Control for Linux SL, the line controller's runtime. CODESYS ships it only as an
+# amd64 package, so this image lays it out like the Virtual Control image tsPLC deploys to.
+FROM debian:12-slim AS package
+RUN apt-get update && apt-get install -y --no-install-recommends unzip
+ADD --checksum=sha256:c34d1d9293f23c92e0130a2a9c61da1500892c6023006b85c0dcdba102b29f9a \
+    https://store-archive.codesys.com/ftp_download/3S/LinuxSL/2302000005/4.22.0.0/CODESYS%20Control%20for%20Linux%20SL%204.22.0.0.package /linux-sl.package
+RUN unzip -j /linux-sl.package 'Delivery/linux/codesyscontrol_linux_4.22.0.0_amd64.deb' -d /deb \
+    && dpkg-deb -x /deb/codesyscontrol_linux_4.22.0.0_amd64.deb /runtime
+
+FROM debian:12-slim
+COPY --from=package /runtime/etc/codesyscontrol /etc/codesyscontrol
+COPY --from=package /runtime/opt/codesys /opt/codesys
+COPY --from=package /runtime/var/opt/codesys /var/opt/codesys
+COPY --from=package /runtime/var/opt/codesyscontrolapi /var/opt/codesyscontrolapi
+# No CodeMeter daemon runs here, so don't wait 60 s for one; the runtime starts in demo mode (about 2 hours).
+RUN groupadd codesyscontrolapi && sed -i \
+      -e 's|^FileReference.1=.*|FileReference.1=/conf/codesyscontrol/CODESYSControl_User.cfg|' \
+      -e 's|^InitLicenseFile.0=.*|EnableNetLicenses=1\nInstallCmActContainer=-1\nInstallLegacyCmActContainer=-1\nTimeoutWaitForCmRuntime=1|' \
+      /etc/codesyscontrol/CODESYSControl.cfg
+COPY <<'EOF' /opt/codesys/scripts/startup.sh
+#!/bin/sh
+set -eu
+if [ ! -f /conf/codesyscontrol/.docker_initialized ]; then
+	cp /etc/codesyscontrol/CODESYSControl.cfg /etc/codesyscontrol/CODESYSControl_User.cfg /conf/codesyscontrol/
+	touch /conf/codesyscontrol/.docker_initialized
+fi
+if [ ! -f /data/codesyscontrol/.docker_initialized ]; then
+	cp -a /var/opt/codesys/. /data/codesyscontrol/
+	touch /data/codesyscontrol/.docker_initialized
+fi
+cd /data/codesyscontrol
+exec /opt/codesys/bin/codesyscontrol.bin /conf/codesyscontrol/CODESYSControl.cfg
+EOF
+RUN chmod +x /opt/codesys/scripts/startup.sh
+ENV LD_LIBRARY_PATH=/opt/codesys/lib
+VOLUME /conf/codesyscontrol /data/codesyscontrol
+EXPOSE 4840 11740
+ENTRYPOINT ["/opt/codesys/scripts/startup.sh"]

package/docker/edge-gateway/Dockerfile

@@ -0,0 +1,17 @@
+# CODESYS Edge Gateway for Linux: the gateway the builder container logs in to a controller
+# through. Its container config logs to stdout; it keeps no state worth a volume.
+FROM debian:12-slim AS package
+RUN apt-get update && apt-get install -y --no-install-recommends unzip
+ADD --checksum=sha256:1fdce370441cffd2849d68f075a197e1830998e875f6f239fb625b96b94a6f28 \
+    https://store-archive.codesys.com/ftp_download/3S/EdgeGatewayLinux/000120/4.22.0.0/CODESYS%20Edge%20Gateway%20for%20Linux%204.22.0.0.package /edge.package
+RUN unzip -j /edge.package 'Delivery/edgeamd64/codesysedge_edgeamd64_4.22.0.0_amd64.deb' -d /deb \
+    && dpkg-deb -x /deb/codesysedge_edgeamd64_4.22.0.0_amd64.deb /gateway
+
+FROM debian:12-slim
+COPY --from=package /gateway/etc/codesysedge /etc/codesysedge
+COPY --from=package /gateway/opt/codesysedge /opt/codesysedge
+COPY --from=package /gateway/var/opt/codesysedge /var/opt/codesysedge
+ENV LD_LIBRARY_PATH=/opt/codesysedge/lib
+WORKDIR /var/opt/codesysedge
+EXPOSE 1217
+ENTRYPOINT ["/opt/codesysedge/bin/codesysedge.bin", "/etc/codesysedge/GatewayvControl.cfg"]

package/docker/entrypoint.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+mkdir -p "$HOME"
+if [ "$#" -eq 0 ] || [ "$1" = '--help' ] || [ "$1" = '-h' ]; then
+    exec bun /opt/codesys-build/docker/runner.ts "$@"
+fi
+# Every job gets its own writable prefix. The installed image is immutable and
+# arbitrary host UIDs can write their build artifacts without root-owned files.
+cp -R --no-preserve=ownership /opt/wine-template "$WINEPREFIX"
+exec xvfb-run -a bun /opt/codesys-build/docker/runner.ts "$@"

package/docker/install/NOTICE.md

@@ -0,0 +1,21 @@
+The installer extractor (`extract.py`, `decode.c`), package metadata adapter
+(`helper-launcher.c`), and Linux ARM64 device description come from
+https://github.com/livingforjesus/codesys-macos-install-guide at commit
+1c6337991e68e4dbcdc89e43035e230aa600e5d2. The extractor is adapted for Linux
+and takes explicit input/output paths. The adapter is unchanged.
+On Linux, the bundled add-ons are extracted from the MSI's `ISSetupFile`
+streams; `msiextract` only exposes the regular installed files.
+
+CODESYS and Microsoft prerequisites retain their vendor licenses. The official
+CODESYS installer is downloaded from the official CODESYS archive during image
+creation and checked against the pinned SHA-256 of the tested installer. An
+optional local copy must match the same checksum. No installer or installed IDE
+is included in this source repository. The device description is for CODESYS
+Virtual Control for Linux ARM64 SL 4.22.0.0, matching the supplied example.
+The CODESYS Control for Linux SL 4.22.0.0 device description is extracted
+during image creation from its official package, downloaded from the same
+archive and checked against a pinned SHA-256; no part of it is included here.
+
+Wine 11.19's NCrypt OAEP forwarding repair, original component source,
+equivalent source patch and LGPL license are in `wine-ncrypt/`.
+This provider repair leaves the original CODESYS and .NET assemblies unchanged.

package/docker/install/core.sh

@@ -0,0 +1,36 @@
+#!/bin/sh
+set -eu
+work=/tmp/codesys-setup
+common="$WINEPREFIX/drive_c/CODESYS-3.5.22.30/CODESYS/Common"
+python3 /opt/codesys-install/extract.py "$1" "$work"
+msi="$work/CODESYS 64 3.5.22.30.msi"
+test -f "$msi"
+set +e
+timeout --foreground 20m wine msiexec /i "$msi" /qn /norestart \
+    'INSTALLDIR=C:\CODESYS-3.5.22.30' \
+    'ADDLOCAL=Basic,CODESYS,CDS_Exe_x64,Compatibility,OEMCustomization_CDS,Only_x64,SubFeature' \
+    CDS_INSTALL_SERVICES=0 CDS_INSTALL_NOPACK=1 AgreeToLicense=Yes CDSAgreeToReadMe=Yes \
+    '/L*v' 'C:\codesys-core-install.log'
+status=$?
+set -e
+if [ "$status" -ne 0 ]; then
+    echo "CODESYS MSI exited with status $status"
+    python3 - "$WINEPREFIX/drive_c/codesys-core-install.log" <<'PY'
+import pathlib, sys
+data = pathlib.Path(sys.argv[1]).read_bytes()
+text = data.decode('utf-16') if data.startswith(b'\xff\xfe') else data.decode(errors='replace')
+lines = text.splitlines()
+print('\n'.join(lines[:25]))
+for index, line in enumerate(lines):
+    if 'Return value 3' in line or 'Return value 0' in line or 'Error ' in line:
+        print('\n'.join(lines[max(0, index - 20):index + 2]))
+PY
+    exit 1
+fi
+test -f "$common/CODESYS.exe"
+mv "$common/CoreInstallerSupport.exe" "$common/CoreInstallerSupport.exe.wine-original"
+mv "$common/CoreInstallerSupport.exe.config" "$common/CoreInstallerSupport.exe.config.wine-original"
+cp /opt/codesys-install/CoreInstallerSupport.exe "$common/CoreInstallerSupport.exe"
+cp "$common/CoreInstallerSupport2.exe.config" "$common/CoreInstallerSupport.exe.config"
+wineserver -k
+wineserver -w

package/docker/install/decode.c

@@ -0,0 +1,12 @@
+#include <stddef.h>
+
+/* InstallShield swaps each byte's nibbles, XORs the name-derived key byte,
+   then inverts the bits. The repeated key sequence restarts every 1024 bytes. */
+void decode(unsigned char *data, size_t data_length, const unsigned char *key, size_t key_length) {
+    for (size_t index = 0; index < data_length; index++) {
+        const unsigned char byte = data[index];
+        const unsigned char swapped_nibbles = (unsigned char)((byte << 4) | (byte >> 4));
+        const unsigned char key_byte = key[(index % 1024) % key_length];
+        data[index] = (unsigned char)~(key_byte ^ swapped_nibbles);
+    }
+}