Release 2026.1.2

This reverts commit 789a9b110d.

.ci/image/Dockerfile

@@ -13,12 +13,13 @@ RUN apt-get update && \
         python3-pip \
         python3-setuptools \
         python3-venv \
-        # libmsi and libgcab are libraries the wixl binary depends on.
-        libmsi-dev \
-        libgcab-dev \
-        # deb and rpm build tools
-        rubygem-fpm \
+        # tool to create msi packages
+        wixl \
+        # install ruby and rpm which are required to install fpm package builder
         rpm \
+        ruby \
+        ruby-dev \
+        rubygems \
         # create deb and rpm repository files
         reprepro \
         createrepo-c \
@@ -26,9 +27,13 @@ RUN apt-get update && \
         gcc-aarch64-linux-gnu \
         libc6-dev-arm64-cross && \
     rm -rf /var/lib/apt/lists/* && \
-    # Install wixl
-    curl -o /usr/local/bin/wixl -L https://pkg.cloudflare.com/binaries/wixl && \
-    chmod a+x /usr/local/bin/wixl && \
+    # Install fpm gem
+    gem install fpm --no-document && \
+    # Initialize rpm repository, SQL Lite DB
+    mkdir -p /var/lib/rpm && \
+    rpm --initdb && \
+    chmod -R 777 /var/lib/rpm && \
+    # Create work directory
     mkdir -p opt
 
 WORKDIR /opt

.ci/scripts/component-tests.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-set -e -o pipefail
+set -e -u -o pipefail
 
 # Fetch cloudflared from the artifacts folder
 mv ./artifacts/cloudflared ./cloudflared

.ci/scripts/fmt-check.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-set -e -o pipefail
+set -e -u -o pipefail
 
 OUTPUT=$(go run -mod=readonly golang.org/x/tools/cmd/goimports@v0.30.0 -l -d -local github.com/cloudflare/cloudflared $(go list -mod=vendor -f '{{.Dir}}' -a ./... | fgrep -v tunnelrpc))
 

.ci/scripts/github-push.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-set -e -o pipefail
+set -e -u -o pipefail
 
 BRANCH="master"
 TMP_PATH="$PWD/tmp"

.ci/scripts/linux/build-packages-fips.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+set -e -u -o pipefail
 VERSION=$(git describe --tags --always --match "[0-9][0-9][0-9][0-9].*.*")
 echo $VERSION
 

.ci/scripts/linux/build-packages.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+set -e -u -o pipefail
 
 # Check if architecture argument is provided
 if [ $# -eq 0 ]; then

.ci/scripts/package-windows.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set -e -u -o pipefail
+
 python3 -m venv env
 . env/bin/activate
 pip install pynacl==1.4.0 pygithub==1.55

.ci/scripts/release-target.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-set -e -o pipefail
+set -e -u -o pipefail
 
 # Check if a make target is provided as an argument
 if [ $# -eq 0 ]; then
@@ -14,5 +14,5 @@ python3 -m venv venv
 source venv/bin/activate
 
 # Our release scripts are written in python, so we should install their dependecies here.
-pip install pynacl==1.4.0 pygithub==1.55 boto3==1.22.9 python-gnupg==0.4.9
+pip install pynacl==1.4.0 pygithub==1.55 boto3==1.42.30 python-gnupg==0.4.9
 make $MAKE_TARGET

.ci/scripts/vuln-check.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-set -e
+set -e -u
 
 # Define the file to store the list of vulnerabilities to ignore.
 IGNORE_FILE=".vulnignore"

.ci/windows.gitlab-ci.yml

@@ -56,7 +56,7 @@ windows-load-env-variables:
       vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/secret/key_vault_secret@kv
       file: false
     KEY_VAULT_CERTIFICATE:
-      vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/certificate_v2/key_vault_certificate@kv
+      vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/certificate/key_vault_certificate@kv
       file: false
   artifacts:
     access: 'none'

.gitignore

@@ -18,3 +18,4 @@ ssh_server_tests/.env
 /.cover
 built_artifacts/
 component-tests/.venv
+/artifacts

RELEASE_NOTES

@@ -1,3 +1,13 @@
+2026.1.2
+- 2026-01-23 Revert "TUN-9863: Update pipelines to use cloudflared EV Certificate"
+- 2026-01-21 Revert "TUN-9886 notarize cloudflared"
+- 2025-12-12 TUN-9886 notarize cloudflared
+
+2026.1.1
+- 2026-01-19 fix: Update boto3 to run on trixie
+- 2026-01-19 fix: Fix wixl bundling tool for windows msi packages
+- 2026-01-19 fix: rpm bundling and rpm key import
+
 2026.1.0
 - 2026-01-13 TUN-10162: Update go to 1.24.11 and Debian distroless to debian13
 - 2025-11-21 Replace jira.cfops.it with jira.cfdata.org in connection/http2_test.go