Skip to content

Building From Source

Jump to bottom
Max Ivankovsky edited this page Aug 12, 2026 · 1 revision

Building From Source

CloakDLP is MIT-licensed and fully open source. This page covers building it yourself, whether to modify it, audit it, or just avoid running someone else's binary.

Prerequisites

  • Windows (the agent uses Win32 APIs directly; this isn't cross-platform)
  • .NET 10 SDK (desktop agent and tray notifier)
  • Node.js (console frontend)
  • Python 3.10+ (console backend)
  • The WiX Toolset v5 CLI, for building the MSI: 
    dotnet tool install --global wix --version 5.0.2
wix extension add --global WixToolset.UI.wixext/5.0.2
wix extension add --global WixToolset.Util.wixext/5.0.2
    (Pinned to v5 deliberately: v7+ requires accepting a paid "Open Source Maintenance Fee" EULA; v5 doesn't.)

One-time backend setup

cd console-backend
python -m venv .venv
.venv\Scripts\python.exe -m pip install -r requirements.txt

Building the full installer

.\installer\build.ps1

This does everything: static-exports the console frontend, packages the console backend as a standalone exe (PyInstaller), publishes the agent and tray notifier as self-contained exes, downloads WinSW to wrap the console as a real Windows service, zips the browser extension source, and builds installer\out\CloakDLP-Setup.msi with WiX. Output is unsigned unless you have your own SignPath (or other) signing credentials configured; see installer/sign.ps1.

Running components individually, for development

Console backend (from console-backend, with the venv active):

.venv\Scripts\python.exe -m uvicorn app.main:app --host 127.0.0.1 --port 8123

Console frontend, against that backend (from console-frontend):

npm install
npm run dev

Desktop agent, interactively (from agent/CloakDlp.Agent):

dotnet run -- monitor

This watches clipboard, print, and network channels and prints what it finds to the console, useful for testing detection without installing anything. dotnet run -- scan <file> does a one-shot file-channel scan instead.

Continuous Integration

Every push to main and every pull request runs the full build above on GitHub Actions (.github/workflows/build.yml): builds the installer, validates the resulting MSI, and smoke-tests a real install and uninstall on a clean Windows VM. It's the same pipeline used to produce signed releases, so a build that passes CI is built the same way a real release is.

Repository layout

Path What's there
console-backend/ Policy API, incident ingestion, WebSocket live feed (FastAPI)
console-frontend/ Web console (Next.js)
agent/CloakDlp.Agent/ Desktop endpoint agent (C#/.NET)
agent/CloakDlp.Tray/ Per-user tray notifier + clipboard detection
browser-extension/ Manifest V3 extension source
installer/ WiX MSI packaging + build scripts

Clone this wiki locally