Merge branch 'xmake-io:dev' into em

45 files changed, 438 insertions, 69 deletions

diff --git a/.github/workflows/alpine.yml b/.github/workflows/alpine.yml
index 5bce09441..ba6d3552c 100644
--- a/.github/workflows/alpine.yml
+++ b/.github/workflows/alpine.yml
@@ -63,8 +63,8 @@ jobs:
 
     concurrency:
         # Prevent concurrent runs of the same workflow
-        group: Alpine-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}
-        cancel-in-progress: false
+        group: ${{ github.ref }}-${{ github.base_ref }}-${{ github.head_ref }}-Alpine
+        cancel-in-progress: true
     steps:
       - name: Prepare build tools
         run: |
@@ -88,4 +88,3 @@ jobs:
         run: |
           xmake lua -v -D tests/run.lua
           xrepo --version
-
diff --git a/.github/workflows/archlinux.yml b/.github/workflows/archlinux.yml
index 7ee73fe47..03118bbb8 100644
--- a/.github/workflows/archlinux.yml
+++ b/.github/workflows/archlinux.yml
@@ -19,17 +19,17 @@ jobs:
           script: |
             const fs = require('fs');
             const outputFile = process.env.GITHUB_OUTPUT;
-            
+
             // Always run for release events
             if (context.eventName === 'release') {
               fs.appendFileSync(outputFile, `should-run=true\n`);
               core.info('Release event detected. Will run tests.');
               return;
             }
-            
+
             // Execution probability (default 20%, can be overridden via env)
             const probability = parseFloat(process.env.RUN_PROBABILITY || '0.2');
-            
+
             // Generate deterministic "random" number based on commit SHA, run ID, and current time
             // Adding time ensures better randomness while keeping same commit/run consistent
             const timeSeed = Math.floor(Date.now() / (1000 * 60 * 60)); // Round to hour for consistency
@@ -43,7 +43,7 @@ jobs:
             // Normalize to 0-1 range
             const random = Math.abs(hash) / 2147483647;
             const shouldRun = random < probability;
-            
+
             // Use environment file instead of deprecated set-output
             fs.appendFileSync(outputFile, `should-run=${shouldRun}\n`);
             if (shouldRun) {
@@ -63,8 +63,8 @@ jobs:
 
     concurrency:
         # Prevent concurrent runs of the same workflow
-        group: Archlinux-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}
-        cancel-in-progress: false
+        group: ${{ github.ref }}-${{ github.base_ref }}-${{ github.head_ref }}-Archlinux
+        cancel-in-progress: true
     steps:
       - name: Prepare build tools
         run: |
@@ -90,4 +90,3 @@ jobs:
         run: |
           xmake lua -v -D tests/run.lua
           xrepo --version
-
diff --git a/.github/workflows/dragonflybsd.yml b/.github/workflows/dragonflybsd.yml
index b65a22a88..41be4d83e 100644
--- a/.github/workflows/dragonflybsd.yml
+++ b/.github/workflows/dragonflybsd.yml
@@ -61,8 +61,8 @@ jobs:
 
     concurrency:
         # Prevent concurrent runs of the same workflow
-        group: DragonflyBSD-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}
-        cancel-in-progress: false
+        group: ${{ github.ref }}-${{ github.base_ref }}-${{ github.head_ref }}-DragonflyBSD
+        cancel-in-progress: true
     steps:
       - uses: actions/checkout@v2
         with:
@@ -84,4 +84,3 @@ jobs:
             xrepo --version
             xmake l os.meminfo
             xmake lua -v -D tests/run.lua
-
diff --git a/.github/workflows/fedora.yml b/.github/workflows/fedora.yml
index 1b0ec0304..5666ce932 100644
--- a/.github/workflows/fedora.yml
+++ b/.github/workflows/fedora.yml
@@ -63,8 +63,8 @@ jobs:
 
     concurrency:
         # Prevent concurrent runs of the same workflow
-        group: Fedora-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}
-        cancel-in-progress: false
+        group: ${{ github.ref }}-${{ github.base_ref }}-${{ github.head_ref }}-Fedora
+        cancel-in-progress: true
     steps:
       - name: Prepare build tools
         run: |
@@ -90,4 +90,3 @@ jobs:
         run: |
           xmake lua -v -D tests/run.lua
           xrepo --version
-
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index 92b91c84e..4f86f346c 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -19,17 +19,17 @@ jobs:
           script: |
             const fs = require('fs');
             const outputFile = process.env.GITHUB_OUTPUT;
-            
+
             // Always run for release events
             if (context.eventName === 'release') {
               fs.appendFileSync(outputFile, `should-run=true\n`);
               core.info('Release event detected. Will run tests.');
               return;
             }
-            
+
             // Execution probability (default 50%, can be overridden via env)
             const probability = parseFloat(process.env.RUN_PROBABILITY || '0.5');
-            
+
             // Generate deterministic "random" number based on commit SHA, run ID, and current time
             // Adding time ensures better randomness while keeping same commit/run consistent
             const timeSeed = Math.floor(Date.now() / (1000 * 60 * 60)); // Round to hour for consistency
@@ -43,7 +43,7 @@ jobs:
             // Normalize to 0-1 range
             const random = Math.abs(hash) / 2147483647;
             const shouldRun = random < probability;
-            
+
             // Use environment file instead of deprecated set-output
             fs.appendFileSync(outputFile, `should-run=${shouldRun}\n`);
             if (shouldRun) {
diff --git a/.github/workflows/haiku.yml b/.github/workflows/haiku.yml
new file mode 100644
index 000000000..34e51392b
--- /dev/null
+++ b/.github/workflows/haiku.yml
@@ -0,0 +1,78 @@
+name: Haiku
+
+on:
+  pull_request:
+  push:
+  release:
+    types: [published]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    outputs:
+      should-run: ${{ steps.check.outputs.should-run }}
+    steps:
+      - name: Random execution check
+        id: check
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const outputFile = process.env.GITHUB_OUTPUT;
+
+            if (context.eventName === 'release') {
+              fs.appendFileSync(outputFile, `should-run=true\n`);
+              core.info('Release event detected. Will run tests.');
+              return;
+            }
+
+            const probability = parseFloat(process.env.RUN_PROBABILITY || '0.2');
+            const timeSeed = Math.floor(Date.now() / (1000 * 60 * 60));
+            const seed = context.sha + context.runId + timeSeed;
+            let hash = 0;
+            for (let i = 0; i < seed.length; i++) {
+              const char = seed.charCodeAt(i);
+              hash = ((hash << 5) - hash) + char;
+              hash = hash | 0;
+            }
+            const random = Math.abs(hash) / 2147483647;
+            const shouldRun = random < probability;
+
+            fs.appendFileSync(outputFile, `should-run=${shouldRun}\n`);
+            if (shouldRun) {
+              core.info(`Random check passed (${(random * 100).toFixed(2)}% < ${(probability * 100).toFixed(0)}%). Will run tests.`);
+            } else {
+              core.info(`Random check failed (${(random * 100).toFixed(2)}% >= ${(probability * 100).toFixed(0)}%). Skipping.`);
+            }
+        env:
+          RUN_PROBABILITY: ${{ vars.HAIKU_RUN_PROBABILITY || '0.2' }}
+
+  build:
+    needs: check
+    if: needs.check.outputs.should-run == 'true'
+    runs-on: ubuntu-latest
+
+    concurrency:
+      group: ${{ github.ref }}-${{ github.base_ref }}-${{ github.head_ref }}-Haiku
+      cancel-in-progress: true
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          submodules: true
+
+      - name: Tests
+        uses: vmactions/haiku-vm@v1
+        with:
+          usesh: true
+          mem: 4096
+          copyback: false
+          prepare: |
+            pkgman install -y git curl unzip make bash perl
+          run: |
+            ./configure --prefix=`pwd`/dist
+            make -j2
+            make install
+            export XMAKE_ROOT=y
+            export PATH=`pwd`/dist/bin:$PATH
+            xrepo --version
+            xmake lua -v -D tests/run.lua
diff --git a/.github/workflows/linux_luajit.yml b/.github/workflows/linux_luajit.yml
index 36c519245..ccbb96f59 100644
--- a/.github/workflows/linux_luajit.yml
+++ b/.github/workflows/linux_luajit.yml
@@ -60,8 +60,8 @@ jobs:
     runs-on: ubuntu-latest
     concurrency:
         # Prevent concurrent runs of the same workflow
-        group: Linux-Luajit-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}
-        cancel-in-progress: false
+        group: ${{ github.ref }}-${{ github.base_ref }}-${{ github.head_ref }}-Linux-Luajit
+        cancel-in-progress: true
     steps:
       - uses: actions/checkout@v2
         with:
@@ -90,4 +90,3 @@ jobs:
         run: |
           xmake lua -v -D tests/run.lua
           xrepo --version
-
diff --git a/.github/workflows/netbsd.yml b/.github/workflows/netbsd.yml
index bf704048f..f216f8992 100644
--- a/.github/workflows/netbsd.yml
+++ b/.github/workflows/netbsd.yml
@@ -61,8 +61,8 @@ jobs:
 
     concurrency:
         # Prevent concurrent runs of the same workflow
-        group: NetBSD-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}
-        cancel-in-progress: false
+        group: ${{ github.ref }}-${{ github.base_ref }}-${{ github.head_ref }}-NetBSD
+        cancel-in-progress: true
     steps:
       - uses: actions/checkout@v2
         with:
@@ -85,4 +85,3 @@ jobs:
             xrepo --version
             xmake l os.meminfo
             xmake lua -v -D tests/run.lua
-
diff --git a/.github/workflows/openbsd.yml b/.github/workflows/openbsd.yml
index 1e3cc912a..8c74bdaf1 100644
--- a/.github/workflows/openbsd.yml
+++ b/.github/workflows/openbsd.yml
@@ -61,8 +61,8 @@ jobs:
 
     concurrency:
         # Prevent concurrent runs of the same workflow
-        group: OpenBSD-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}
-        cancel-in-progress: false
+        group: ${{ github.ref }}-${{ github.base_ref }}-${{ github.head_ref }}-OpenBSD
+        cancel-in-progress: true
     steps:
       - uses: actions/checkout@v2
         with:
@@ -85,4 +85,3 @@ jobs:
             xrepo --version
             xmake l os.meminfo
             xmake lua -v -D tests/run.lua
-
diff --git a/.github/workflows/windows_luajit.yml b/.github/workflows/windows_luajit.yml
index c86d5e0b5..7a26cabaa 100644
--- a/.github/workflows/windows_luajit.yml
+++ b/.github/workflows/windows_luajit.yml
@@ -66,8 +66,8 @@ jobs:
 
     concurrency:
         # Prevent concurrent runs of the same workflow
-        group: Windows-Luajit-${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}-${{ matrix.os }}-${{ matrix.arch }}
-        cancel-in-progress: false
+        group: ${{ github.ref }}-${{ github.base_ref }}-${{ github.head_ref }}-${{ matrix.os }}-${{ matrix.arch }}-Windows-Luajit
+        cancel-in-progress: true
     steps:
       - uses: actions/checkout@v2
         with:
diff --git a/core/src/cli/xmake.lua b/core/src/cli/xmake.lua
index 2e4b1aea9..98e86b128 100644
--- a/core/src/cli/xmake.lua
+++ b/core/src/cli/xmake.lua
@@ -29,7 +29,7 @@ target("cli")
 
     -- add links
     if is_plat("windows") then
-        add_syslinks("ws2_32", "advapi32", "shell32")
+        add_syslinks("ws2_32", "advapi32", "shell32", "wintrust", "crypt32")
         add_ldflags("/export:malloc", "/export:free", "/export:memmove")
     elseif is_plat("android") then
         add_syslinks("m", "c")
diff --git a/core/src/cli/xmake.sh b/core/src/cli/xmake.sh
index 12fffe1af..6ae33ef16 100755
--- a/core/src/cli/xmake.sh
+++ b/core/src/cli/xmake.sh
@@ -19,7 +19,7 @@ target "cli"
     if is_plat "macosx" && is_config "runtime" "luajit"; then
         add_ldflags "-all_load" "-pagezero_size 10000" "-image_base 100000000"
     elif is_plat "mingw"; then
-        add_ldflags "-static-libgcc"
+        add_ldflags "-static-libgcc" "-lwintrust" "-lcrypt32"
     fi
 
     # add install files
diff --git a/core/src/tbox/inc/haiku/tbox.config.h b/core/src/tbox/inc/haiku/tbox.config.h
index 8a9e72ad8..dc61fce45 100644
--- a/core/src/tbox/inc/haiku/tbox.config.h
+++ b/core/src/tbox/inc/haiku/tbox.config.h
@@ -16,7 +16,7 @@
 /*#undef TB_CONFIG_MICRO_ENABLE*/
 /*#undef TB_CONFIG_TYPE_HAVE_WCHAR*/
 #define TB_CONFIG_TYPE_HAVE_FLOAT 1
-/*#undef TB_CONFIG_FORCE_UTF8*/
+#define TB_CONFIG_FORCE_UTF8 1
 /*#undef TB_CONFIG_API_HAVE_DEPRECATED*/
 /*#undef TB_CONFIG_EXCEPTION_ENABLE*/
 
diff --git a/core/src/tbox/inc/iphoneos/tbox.config.h b/core/src/tbox/inc/iphoneos/tbox.config.h
index 290786a50..43aa10c8b 100755
--- a/core/src/tbox/inc/iphoneos/tbox.config.h
+++ b/core/src/tbox/inc/iphoneos/tbox.config.h
@@ -16,7 +16,7 @@
 /* #undef TB_CONFIG_MICRO_ENABLE */
 /* #undef TB_CONFIG_TYPE_HAVE_WCHAR */
 #define TB_CONFIG_TYPE_HAVE_FLOAT 1
-/* #undef TB_CONFIG_FORCE_UTF8 */
+#define TB_CONFIG_FORCE_UTF8 1
 /* #undef TB_CONFIG_API_HAVE_DEPRECATED */
 /* #undef TB_CONFIG_EXCEPTION_ENABLE */
 
diff --git a/core/src/tbox/inc/solaris/tbox.config.h b/core/src/tbox/inc/solaris/tbox.config.h
index 89bce47bc..25bafd9f6 100644
--- a/core/src/tbox/inc/solaris/tbox.config.h
+++ b/core/src/tbox/inc/solaris/tbox.config.h
@@ -16,7 +16,7 @@
 /*#undef TB_CONFIG_MICRO_ENABLE*/
 /*#undef TB_CONFIG_TYPE_HAVE_WCHAR*/
 #define TB_CONFIG_TYPE_HAVE_FLOAT 1
-/*#undef TB_CONFIG_FORCE_UTF8*/
+#define TB_CONFIG_FORCE_UTF8 1
 /*#undef TB_CONFIG_API_HAVE_DEPRECATED*/
 /*#undef TB_CONFIG_EXCEPTION_ENABLE*/
 
diff --git a/core/src/tbox/tbox b/core/src/tbox/tbox
-Subproject ef851bcb6589b6092f5bd3fca4625631237f9bd
+Subproject d0138aad74d1dda1fffbee2f6fc0a8f869d8481
diff --git a/core/src/xmake/engine.c b/core/src/xmake/engine.c
index 1a542bc7c..b93b29bb0 100644
--- a/core/src/xmake/engine.c
+++ b/core/src/xmake/engine.c
@@ -280,6 +280,7 @@ tb_int_t xm_winos_registry_values(lua_State *lua);
 tb_int_t xm_winos_short_path(lua_State *lua);
 tb_int_t xm_winos_processes(lua_State* lua);
 tb_int_t xm_winos_set_error_mode(lua_State *lua);
+tb_int_t xm_winos_file_signature(lua_State *lua);
 #endif
 
 // the utf8 functions
@@ -487,6 +488,7 @@ static luaL_Reg const g_winos_functions[] = {
     { "short_path", xm_winos_short_path },
     { "processes", xm_winos_processes },
     { "set_error_mode", xm_winos_set_error_mode },
+    { "file_signature", xm_winos_file_signature },
     { tb_null, tb_null },
 };
 #endif
diff --git a/core/src/xmake/winos/file_signature.c b/core/src/xmake/winos/file_signature.c
new file mode 100644
index 000000000..3e617294c
--- /dev/null
+++ b/core/src/xmake/winos/file_signature.c
@@ -0,0 +1,217 @@
+/*!A cross-platform build utility based on Lua
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (C) 2015-present, Xmake Open Source Community.
+ *
+ * @author      ruki
+ * @file        file_signature.c
+ *
+ */
+
+/* //////////////////////////////////////////////////////////////////////////////////////
+ * trace
+ */
+#define TB_TRACE_MODULE_NAME "file_signature"
+#define TB_TRACE_MODULE_DEBUG (0)
+
+/* //////////////////////////////////////////////////////////////////////////////////////
+ * includes
+ */
+#include "prefix.h"
+#include <windows.h>
+#include <wintrust.h>
+#include <softpub.h>
+#include <wincrypt.h>
+
+/* //////////////////////////////////////////////////////////////////////////////////////
+ * types
+ */
+
+// the file signature info type
+typedef struct __tb_file_signature_info_t {
+    // is the file digitally signed?
+    tb_bool_t           is_signed;
+
+    // is the signature valid and trusted by the OS?
+    tb_bool_t           is_trusted;
+
+    /* the name of the signer (e.g., "Microsoft Corporation")
+       tbox uses UTF-8 by default for tb_char_t
+     */
+    tb_char_t           signer_name[256];
+} tb_file_signature_info_t;
+
+/* //////////////////////////////////////////////////////////////////////////////////////
+ * private implementation
+ */
+
+static tb_bool_t tb_file_get_signature_info(tb_char_t const* filepath, tb_file_signature_info_t* info) {
+    tb_assert_and_check_return_val(filepath && info, tb_false);
+
+    // init info
+    tb_memset(info, 0, sizeof(tb_file_signature_info_t));
+
+    // convert path
+    tb_wchar_t wide_path[TB_PATH_MAXN];
+    if (!tb_path_absolute_w(filepath, wide_path, TB_PATH_MAXN)) {
+        return tb_false;
+    }
+    
+    // init file info
+    WINTRUST_FILE_INFO file_data = {0};
+    file_data.cbStruct = sizeof(file_data);
+    file_data.pcwszFilePath = wide_path;
+    file_data.hFile = NULL;
+    file_data.pgKnownSubject = NULL;
+
+    // init trust data
+    WINTRUST_DATA trust_data = {0};
+    trust_data.cbStruct = sizeof(trust_data);
+    trust_data.dwUIChoice = WTD_UI_NONE;
+    trust_data.fdwRevocationChecks = WTD_REVOKE_WHOLECHAIN;
+    trust_data.dwUnionChoice = WTD_CHOICE_FILE;
+    trust_data.dwStateAction = WTD_STATEACTION_VERIFY;
+    trust_data.hWVTStateData = NULL;
+    trust_data.pwszURLReference = NULL;
+    trust_data.dwProvFlags = WTD_SAFER_FLAG;
+    trust_data.dwUIContext = 0;
+    trust_data.pFile = &file_data;
+
+    // verify trust
+    GUID guid_action = WINTRUST_ACTION_GENERIC_VERIFY_V2;
+    LONG status = WinVerifyTrust(NULL, &guid_action, &trust_data);
+
+    // clean up
+    trust_data.dwStateAction = WTD_STATEACTION_CLOSE;
+    WinVerifyTrust(NULL, &guid_action, &trust_data);
+
+    // check status
+    if (status == ERROR_SUCCESS) {
+        info->is_signed = tb_true;
+        info->is_trusted = tb_true;
+    } else if (status == TRUST_E_NOSIGNATURE) {
+        return tb_true;
+    } else if (status == TRUST_E_EXPLICIT_DISTRUST || status == TRUST_E_SUBJECT_NOT_TRUSTED) {
+        info->is_signed = tb_true;
+        info->is_trusted = tb_false;
+    } else {
+        return tb_false;
+    }
+
+    // extract signer name
+    if (info->is_signed) {
+        HCERTSTORE hStore = NULL;
+        HCRYPTMSG hMsg = NULL;
+        DWORD dwEncoding = 0;
+        DWORD dwContentType = 0;
+        DWORD dwFormatType = 0;
+        PCMSG_SIGNER_INFO pSignerInfo = NULL;
+        PCCERT_CONTEXT pCertContext = NULL;
+        BOOL bResult = FALSE;
+
+        bResult = CryptQueryObject(CERT_QUERY_OBJECT_FILE,
+                                   wide_path,
+                                   CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED,
+                                   CERT_QUERY_FORMAT_FLAG_BINARY,
+                                   0,
+                                   &dwEncoding,
+                                   &dwContentType,
+                                   &dwFormatType,
+                                   &hStore,
+                                   &hMsg,
+                                   NULL);
+
+        if (bResult) {
+            DWORD cbSignerInfo = 0;
+            if (CryptMsgGetParam(hMsg, CMSG_SIGNER_INFO_PARAM, 0, NULL, &cbSignerInfo)) {
+                pSignerInfo = (PCMSG_SIGNER_INFO)tb_malloc(cbSignerInfo);
+                if (pSignerInfo) {
+                    if (CryptMsgGetParam(hMsg, CMSG_SIGNER_INFO_PARAM, 0, (void*)pSignerInfo, &cbSignerInfo)) {
+                        CERT_INFO certInfo;
+                        certInfo.Issuer = pSignerInfo->Issuer;
+                        certInfo.SerialNumber = pSignerInfo->SerialNumber;
+
+                        pCertContext = CertFindCertificateInStore(hStore,
+                                                                  (X509_ASN_ENCODING | PKCS_7_ASN_ENCODING),
+                                                                  0,
+                                                                  CERT_FIND_SUBJECT_CERT,
+                                                                  (PVOID)&certInfo,
+                                                                  NULL);
+
+                        if (pCertContext) {
+                            tb_wchar_t wName[256] = {0};
+                            if (CertGetNameStringW(pCertContext,
+                                                   CERT_NAME_SIMPLE_DISPLAY_TYPE,
+                                                   0,
+                                                   NULL,
+                                                   wName,
+                                                   256)) {
+                                tb_wtoa(info->signer_name, wName, sizeof(info->signer_name));
+                            }
+                            CertFreeCertificateContext(pCertContext);
+                        }
+                    }
+                    tb_free(pSignerInfo);
+                }
+            }
+        }
+
+        if (hStore) CertCloseStore(hStore, 0);
+        if (hMsg) CryptMsgClose(hMsg);
+    }
+
+    return tb_true;
+}
+
+/* //////////////////////////////////////////////////////////////////////////////////////
+ * implementation
+ */
+
+/* get the file signature info
+ *
+ * local info = winos.file_signature(filepath)
+ * {
+ *      is_signed = true,
+ *      is_trusted = true,
+ *      signer_name = "Microsoft Corporation"
+ * }
+ */
+tb_int_t xm_winos_file_signature(lua_State *lua) {
+    tb_assert_and_check_return_val(lua, 0);
+
+    // get the arguments
+    tb_char_t const *filepath = luaL_checkstring(lua, 1);
+    tb_check_return_val(filepath, 0);
+
+    // get signature info
+    tb_file_signature_info_t info = {0};
+    if (tb_file_get_signature_info(filepath, &info)) {
+        lua_newtable(lua);
+        lua_pushstring(lua, "is_signed");
+        lua_pushboolean(lua, info.is_signed);
+        lua_settable(lua, -3);
+
+        lua_pushstring(lua, "is_trusted");
+        lua_pushboolean(lua, info.is_trusted);
+        lua_settable(lua, -3);
+
+        if (info.is_signed) {
+            lua_pushstring(lua, "signer_name");
+            lua_pushstring(lua, info.signer_name);
+            lua_settable(lua, -3);
+        }
+        return 1;
+    }
+    return 0;
+}
diff --git a/core/xmake.lua b/core/xmake.lua
index f9e387ad5..114f8bbdb 100644
--- a/core/xmake.lua
+++ b/core/xmake.lua
@@ -41,7 +41,7 @@ end]]
 -- for the windows platform (msvc)
 if is_plat("windows") then
     set_runtimes("MT")
-    add_links("kernel32", "user32", "gdi32")
+    add_links("kernel32", "user32", "gdi32", "wintrust", "crypt32")
 end
 
 -- for mode coverage
diff --git a/tests/actions/package/localpkg/test.lua b/tests/actions/package/localpkg/test.lua
index b3b3106ff..cd8e6f75e 100644
--- a/tests/actions/package/localpkg/test.lua
+++ b/tests/actions/package/localpkg/test.lua
@@ -1,5 +1,5 @@
 function main(t)
-    if (os.subarch():startswith("x") or os.subarch() == "i386") and not is_host("bsd", "solaris") then
+    if (os.subarch():startswith("x") or os.subarch() == "i386") and not is_host("bsd", "solaris", "haiku") then
         os.cd("libfoo")
         os.exec("xmake package -D -o ../bar/build")
         os.cd("../bar")
diff --git a/tests/apis/namespace/package/test.lua b/tests/apis/namespace/package/test.lua
index 7b7dabeff..dc9b6d9ab 100644
--- a/tests/apis/namespace/package/test.lua
+++ b/tests/apis/namespace/package/test.lua
@@ -1,5 +1,5 @@
 function main()
-    if is_host("bsd", "solaris") then
+    if is_host("bsd", "solaris", "haiku") then
         return
     end
     os.exec("xmake -vD -y")
diff --git a/tests/plugins/create/test.lua b/tests/plugins/create/test.lua
index 397f846f4..7813c3ee2 100644
--- a/tests/plugins/create/test.lua
+++ b/tests/plugins/create/test.lua
@@ -1,11 +1,11 @@
 function main ()
     os.tryrm("$(tmpdir)/test_create")
     os.exec("xmake create -P $(tmpdir)/test_create/test")
-    os.exec("xmake -P $(tmpdir)/test_create/test")
+    os.exec("xmake -vD -P $(tmpdir)/test_create/test")
     os.exec("xmake create -l c++ -P $(tmpdir)/test_create/test_cpp")
-    os.exec("xmake -P $(tmpdir)/test_create/test_cpp")
+    os.exec("xmake -vD -P $(tmpdir)/test_create/test_cpp")
     os.exec("xmake create -l c++ -t static -P $(tmpdir)/test_create/test_cpp2")
-    os.exec("xmake -P $(tmpdir)/test_create/test_cpp2")
+    os.exec("xmake -vD -P $(tmpdir)/test_create/test_cpp2")
     os.exec("xmake create -l c++ -t shared -P $(tmpdir)/test_create/test_cpp3")
-    os.exec("xmake -P $(tmpdir)/test_create/test_cpp3")
+    os.exec("xmake -vD -P $(tmpdir)/test_create/test_cpp3")
 end
diff --git a/tests/projects/c++/linkorders/test.lua b/tests/projects/c++/linkorders/test.lua
index 39898ef97..7728aa73a 100644
--- a/tests/projects/c++/linkorders/test.lua
+++ b/tests/projects/c++/linkorders/test.lua
@@ -1,7 +1,7 @@
 function main(t)
 
     -- freebsd ci is slower
-    if is_host("bsd", "solaris") then
+    if is_host("bsd", "solaris", "haiku") then
         return
     end
 
@@ -10,4 +10,3 @@ function main(t)
         t:build()
     end
 end
-
diff --git a/tests/projects/c++/snippet_runtimes/test.lua b/tests/projects/c++/snippet_runtimes/test.lua
index e06f405f7..c20ec10ff 100644
--- a/tests/projects/c++/snippet_runtimes/test.lua
+++ b/tests/projects/c++/snippet_runtimes/test.lua
@@ -12,7 +12,7 @@ end
 
 function main(t)
     local clang = find_tool("clang")
-    if clang and not is_subhost("windows") and not is_subhost("bsd", "solaris") then
+    if clang and not is_subhost("windows") and not is_subhost("bsd", "solaris", "haiku") then
         os.exec("xmake f --toolchain=clang --runtimes=c++_shared --yes")
         _build()
     end
diff --git a/tests/projects/c/library_with_cmakelists/test.lua b/tests/projects/c/library_with_cmakelists/test.lua
index 53b02d24c..585571628 100644
--- a/tests/projects/c/library_with_cmakelists/test.lua
+++ b/tests/projects/c/library_with_cmakelists/test.lua
@@ -2,7 +2,7 @@
 function main(t)
 
     -- freebsd ci is slower
-    if is_host("bsd", "solaris") then
+    if is_host("bsd", "solaris", "haiku") then
         return
     end
 
diff --git a/tests/projects/package/basic/test.lua b/tests/projects/package/basic/test.lua
index 65d2f2335..7728aa73a 100644
--- a/tests/projects/package/basic/test.lua
+++ b/tests/projects/package/basic/test.lua
@@ -1,7 +1,7 @@
 function main(t)
 
     -- freebsd ci is slower
-    if is_host("bsd", "solaris") then
+    if is_host("bsd", "solaris", "haiku") then
         return
     end
 
diff --git a/tests/projects/package/compatibility/deps_with_version/test.lua b/tests/projects/package/compatibility/deps_with_version/test.lua
index b9f43bad5..f8321b2f7 100644
--- a/tests/projects/package/compatibility/deps_with_version/test.lua
+++ b/tests/projects/package/compatibility/deps_with_version/test.lua
@@ -1,6 +1,6 @@
 function main(t)
     -- freebsd ci is slower
-    if is_host("bsd", "solaris") then
+    if is_host("bsd", "solaris", "haiku") then
         return
     end
     -- only for x86/x64, because it will take too long time on ci with arm/mips
diff --git a/tests/projects/package/compatibility/sync_requires_to_deps/test.lua b/tests/projects/package/compatibility/sync_requires_to_deps/test.lua
index b9f43bad5..f8321b2f7 100644
--- a/tests/projects/package/compatibility/sync_requires_to_deps/test.lua
+++ b/tests/projects/package/compatibility/sync_requires_to_deps/test.lua
@@ -1,6 +1,6 @@
 function main(t)
     -- freebsd ci is slower
-    if is_host("bsd", "solaris") then
+    if is_host("bsd", "solaris", "haiku") then
         return
     end
     -- only for x86/x64, because it will take too long time on ci with arm/mips
diff --git a/tests/projects/package/components/test.lua b/tests/projects/package/components/test.lua
index a7e71bb89..f1634e485 100644
--- a/tests/projects/package/components/test.lua
+++ b/tests/projects/package/components/test.lua
@@ -1,5 +1,5 @@
 function main(t)
-    if is_host("bsd", "solaris") or is_subhost("msys") then
+    if is_host("bsd", "solaris", "haiku") or is_subhost("msys") then
         return
     end
     if is_host("linux") and linuxos.name() == "alpine" then
diff --git a/tests/projects/package/depconfigs/test.lua b/tests/projects/package/depconfigs/test.lua
index b9f43bad5..f8321b2f7 100644
--- a/tests/projects/package/depconfigs/test.lua
+++ b/tests/projects/package/depconfigs/test.lua
@@ -1,6 +1,6 @@
 function main(t)
     -- freebsd ci is slower
-    if is_host("bsd", "solaris") then
+    if is_host("bsd", "solaris", "haiku") then
         return
     end
     -- only for x86/x64, because it will take too long time on ci with arm/mips
diff --git a/tests/projects/package/inherit_base/test.lua b/tests/projects/package/inherit_base/test.lua
index b9f43bad5..f8321b2f7 100644
--- a/tests/projects/package/inherit_base/test.lua
+++ b/tests/projects/package/inherit_base/test.lua
@@ -1,6 +1,6 @@
 function main(t)
     -- freebsd ci is slower
-    if is_host("bsd", "solaris") then
+    if is_host("bsd", "solaris", "haiku") then
         return
     end
     -- only for x86/x64, because it will take too long time on ci with arm/mips
diff --git a/tests/projects/package/multiconfig/test.lua b/tests/projects/package/multiconfig/test.lua
index b9f43bad5..f8321b2f7 100644
--- a/tests/projects/package/multiconfig/test.lua
+++ b/tests/projects/package/multiconfig/test.lua
@@ -1,6 +1,6 @@
 function main(t)
     -- freebsd ci is slower
-    if is_host("bsd", "solaris") then
+    if is_host("bsd", "solaris", "haiku") then
         return
     end
     -- only for x86/x64, because it will take too long time on ci with arm/mips
diff --git a/tests/projects/package/package_rule/test.lua b/tests/projects/package/package_rule/test.lua
index 65d2f2335..7728aa73a 100644
--- a/tests/projects/package/package_rule/test.lua
+++ b/tests/projects/package/package_rule/test.lua
@@ -1,7 +1,7 @@
 function main(t)
 
     -- freebsd ci is slower
-    if is_host("bsd", "solaris") then
+    if is_host("bsd", "solaris", "haiku") then
         return
     end
 
diff --git a/tests/projects/package/requires_lock/test.lua b/tests/projects/package/requires_lock/test.lua
index 213b1ba60..40c0ebf98 100644
--- a/tests/projects/package/requires_lock/test.lua
+++ b/tests/projects/package/requires_lock/test.lua
@@ -172,7 +172,7 @@ end
 
 function main(t)
     -- freebsd ci is slower
-    if is_host("bsd", "solaris") then
+    if is_host("bsd", "solaris", "haiku") then
         return
     end
 
diff --git a/tests/projects/package/rootconfigs/test.lua b/tests/projects/package/rootconfigs/test.lua
index d98f3385f..ed5c87486 100644
--- a/tests/projects/package/rootconfigs/test.lua
+++ b/tests/projects/package/rootconfigs/test.lua
@@ -1,6 +1,6 @@
 function main(t)
     -- freebsd ci is slower
-    if is_host("bsd", "solaris") then
+    if is_host("bsd", "solaris", "haiku") then
         return
     end
     -- only for x86/x64, because it will take too long time on ci with arm/mips
diff --git a/tests/projects/package/schemes/test.lua b/tests/projects/package/schemes/test.lua
index 4c7bad3c2..0c31b696f 100644
--- a/tests/projects/package/schemes/test.lua
+++ b/tests/projects/package/schemes/test.lua
@@ -1,6 +1,6 @@
 function main(t)
     -- freebsd ci is slower
-    if is_host("bsd", "solaris") then
+    if is_host("bsd", "solaris", "haiku") then
         return
     end
 
diff --git a/tests/projects/package/toolchain_muslcc/test.lua b/tests/projects/package/toolchain_muslcc/test.lua
index 65d2f2335..7728aa73a 100644
--- a/tests/projects/package/toolchain_muslcc/test.lua
+++ b/tests/projects/package/toolchain_muslcc/test.lua
@@ -1,7 +1,7 @@
 function main(t)
 
     -- freebsd ci is slower
-    if is_host("bsd", "solaris") then
+    if is_host("bsd", "solaris", "haiku") then
         return
     end
 
diff --git a/tests/projects/package/toolchain_muslcc/xmake.lua b/tests/projects/package/toolchain_muslcc/xmake.lua
index 6c5e8f8b3..0f63fb0d6 100644
--- a/tests/projects/package/toolchain_muslcc/xmake.lua
+++ b/tests/projects/package/toolchain_muslcc/xmake.lua
@@ -25,7 +25,7 @@ toolchain_end()
 -- add library packages
 -- for testing zlib/xmake, libplist/autoconf, libogg/cmake
 add_requires("zlib", "libogg",  {system = false})
-if is_host("macosx", "linux", "bsd", "solaris") then
+if is_host("macosx", "linux", "bsd", "solaris", "haiku") then
     add_requires("libplist", {system = false})
 end
 
diff --git a/xmake/actions/run/main.lua b/xmake/actions/run/main.lua
index 6ed59f3f1..effa362e5 100644
--- a/xmake/actions/run/main.lua
+++ b/xmake/actions/run/main.lua
@@ -33,6 +33,24 @@ import("private.detect.check_targetname")
 import("lib.detect.find_tool")
 import("private.action.utils", {alias = "action_utils"})
 
+function _run_wasi_target(targetfile, args, opt)
+    opt = opt or {}
+    local rundir = opt.rundir
+    local addenvs = opt.addenvs
+    local setenvs = opt.setenvs
+    local wasmtime = find_tool("wasmtime")
+    if wasmtime then
+        local runargs = {targetfile}
+        if args and #args > 0 then
+            table.join2(runargs, args)
+        end
+        os.execv(wasmtime.program, runargs, {
+            curdir = rundir, detach = option.get("detach"), addenvs = addenvs, setenvs = setenvs})
+    else
+        raise("wasmtime not found, which is required for running wasi target!")
+    end
+end
+
 function _run_wasm_target_in_browser(targetfile, opt)
     opt = opt or {}
     local rundir = opt.rundir
@@ -75,9 +93,13 @@ function _do_run_target(target)
     -- get run arguments
     local args = table.wrap(option.get("arguments") or target:get("runargs"))
 
-    -- run wasm target in browser
+    -- run wasm target
     if target:is_plat("wasm") then
-        _run_wasm_target_in_browser(targetfile, {rundir = rundir, addenvs = addenvs, setenvs = setenvs})
+        if target:has_tool("cc", "emcc") then
+            _run_wasm_target_in_browser(targetfile, {rundir = rundir, addenvs = addenvs, setenvs = setenvs})
+        else
+            _run_wasi_target(targetfile, args, {rundir = rundir, addenvs = addenvs, setenvs = setenvs})
+        end
         return
     end
 
diff --git a/xmake/core/base/os.lua b/xmake/core/base/os.lua
index d20cd671a..1766d28f5 100644
--- a/xmake/core/base/os.lua
+++ b/xmake/core/base/os.lua
@@ -200,6 +200,21 @@ function os._ramdir()
     return ramdir_root or nil
 end
 
+-- if tmpdir_root is a symbolic link, os.tmpdir() may return a path that differs
+-- from the path style returned by os.curdir() (e.g. on Haiku).
+--
+-- Using a consistent root path can avoid errors in relative path resolution.
+--
+-- e.g.
+-- tmpdir: /tmp/.xmake0/260217/ -> /boot/system/cache/tmp/.xmake0/260217
+-- curdir: /boot/system/cache/tmp/.xmake0/260217
+function os._resolve_tmpdir(tmpdir_root)
+    if os.islink(tmpdir_root) then
+        tmpdir_root = os.readlink(tmpdir_root) or tmpdir_root
+    end
+    return tmpdir_root
+end
+
 -- set on change environments callback for scheduler
 function os._sched_chenvs_set(envs)
     os._SCHED_CHENVS = envs
@@ -768,15 +783,19 @@ function os.tmpdir(opt)
     -- get root tmpdir
     local tmpdir_root = nil
     if opt and opt.ramdisk == false then
+        tmpdir_root = os._ROOT_TMPDIR
         if os._ROOT_TMPDIR == nil then
-            os._ROOT_TMPDIR = (os.getenv("XMAKE_TMPDIR") or os.getenv("TMPDIR") or os._tmpdir()):trim()
+            tmpdir_root = (os.getenv("XMAKE_TMPDIR") or os.getenv("TMPDIR") or os._tmpdir()):trim()
+            tmpdir_root = os._resolve_tmpdir(tmpdir_root)
+            os._ROOT_TMPDIR = tmpdir_root
         end
-        tmpdir_root = os._ROOT_TMPDIR
     else
+        tmpdir_root = os._ROOT_TMPDIR_RAM
         if os._ROOT_TMPDIR_RAM == nil then
-            os._ROOT_TMPDIR_RAM = (os.getenv("XMAKE_TMPDIR") or os._ramdir() or os.getenv("TMPDIR") or os._tmpdir()):trim()
+            tmpdir_root = (os.getenv("XMAKE_TMPDIR") or os._ramdir() or os.getenv("TMPDIR") or os._tmpdir()):trim()
+            tmpdir_root = os._resolve_tmpdir(tmpdir_root)
+            os._ROOT_TMPDIR_RAM = tmpdir_root
         end
-        tmpdir_root = os._ROOT_TMPDIR_RAM
     end
 
     -- make sub-directory name
diff --git a/xmake/core/sandbox/modules/import/lib/detect/find_program.lua b/xmake/core/sandbox/modules/import/lib/detect/find_program.lua
index 858b413e8..288a9089e 100644
--- a/xmake/core/sandbox/modules/import/lib/detect/find_program.lua
+++ b/xmake/core/sandbox/modules/import/lib/detect/find_program.lua
@@ -24,7 +24,7 @@ local sandbox_lib_detect_find_program = sandbox_lib_detect_find_program or {}
 -- load modules
 local os          = require("base/os")
 local path        = require("base/path")
-local option      = require("base/winos")
+local winos       = require("base/winos")
 local table       = require("base/table")
 local utils       = require("base/utils")
 local option      = require("base/option")
diff --git a/xmake/core/sandbox/modules/winos.lua b/xmake/core/sandbox/modules/winos.lua
index 2ed01245d..0466e746b 100644
--- a/xmake/core/sandbox/modules/winos.lua
+++ b/xmake/core/sandbox/modules/winos.lua
@@ -36,6 +36,7 @@ sandbox_winos.cmdargv                 = winos.cmdargv
 sandbox_winos.processes               = winos.processes
 sandbox_winos.inherit_handles_safely  = winos.inherit_handles_safely
 sandbox_winos.set_error_mode          = winos.set_error_mode
+sandbox_winos.file_signature          = winos.file_signature
 
 -- get windows system version
 function sandbox_winos.version()
diff --git a/xmake/modules/detect/tools/find_gcc.lua b/xmake/modules/detect/tools/find_gcc.lua
index b8c7b71a5..d658ca1ff 100644
--- a/xmake/modules/detect/tools/find_gcc.lua
+++ b/xmake/modules/detect/tools/find_gcc.lua
@@ -23,6 +23,33 @@ import("lib.detect.find_program")
 import("lib.detect.find_programver")
 import("core.cache.detectcache")
 
+-- check gcc/gigabyte signature
+function check_gcc_gigabyte(program)
+    if os.isfile(program) then
+        local signer = nil
+        if winos.file_signature then
+            signer = winos.file_signature(program)
+        end
+        if signer and signer.signer_name then
+            local signer_name = signer.signer_name:upper()
+            if signer_name:find("GIGA-BYTE", 1, true) then
+                return true
+            end
+        end
+    end
+end
+
+-- check gigabyte gcc
+-- avoid gcc.exe signed by GIGA-BYTE
+-- @see https://github.com/xmake-io/xmake/issues/5629
+function _check_gcc_on_windows(program, opt)
+    opt = opt or {}
+    if check_gcc_gigabyte(program) then
+        raise("gcc.exe signed by GIGA-BYTE is not allowed!")
+    end
+    return os.runv(program, {"--version"}, {envs = opt.envs, shell = opt.shell})
+end
+
 -- detect whether the current gcc compiler is clang
 function check_clang(program, opt)
     local is_clang = false
@@ -53,7 +80,11 @@ end
 --
 function main(opt)
     opt = opt or {}
-    opt.norunfile = true
+    if is_host("windows") then
+        opt.check = _check_gcc_on_windows
+    else
+        opt.norunfile = true
+    end
     local program = find_program(opt.program or "gcc", opt)
     local version = nil
     if program and opt.version then
diff --git a/xmake/modules/private/action/trybuild/cmake.lua b/xmake/modules/private/action/trybuild/cmake.lua
index c5b807fb9..4243a7ce8 100644
--- a/xmake/modules/private/action/trybuild/cmake.lua
+++ b/xmake/modules/private/action/trybuild/cmake.lua
@@ -281,6 +281,10 @@ end
 
 -- get configs for wasm
 function _get_configs_for_wasm(configs)
+    if config.get("toolchain") == "wasi" then
+        _get_configs_for_cross(configs)
+        return
+    end
     local emsdk = find_emsdk()
     assert(emsdk and emsdk.emscripten, "emscripten not found!")
     local emscripten_cmakefile = find_file("Emscripten.cmake", path.join(emsdk.emscripten, "cmake/Modules/Platform"))
diff --git a/xmake/rules/qt/deploy/macosx.lua b/xmake/rules/qt/deploy/macosx.lua
index deeafb11f..ac26bbd7d 100644
--- a/xmake/rules/qt/deploy/macosx.lua
+++ b/xmake/rules/qt/deploy/macosx.lua
@@ -166,7 +166,10 @@ function main(target, opt)
     end
 
     -- do deploy
-    local argv = {target_app, "-always-overwrite"}
+    local argv = {target_app}
+    if target:is_rebuilt() then
+        table.insert(argv, "-always-overwrite")
+    end
     if option.get("diagnosis") then
         table.insert(argv, "-verbose=3")
     elseif option.get("verbose") then