Skip to content

Commit af3b28a

Browse files
alessfgalessfg
committed
Update stable NGINX to 1.26.0
* And update stable Alpine to 3.19, stable Debian to bookworm, and stable NJS to 0.8.4 * Simplify repo/GPG key management
1 parent 80d437d commit af3b28a

File tree

18 files changed

+124
-225
lines changed

18 files changed

+124
-225
lines changed

‎.github/workflows/debian-mainline.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
- name: Parse Debian version
2929
id: distro_version
3030
run: |
31-
echo "release=$(cat update.sh | grep -m4 '\[mainline\]=' | tail -n1 | cut -d"'" -f2)" >> "$GITHUB_OUTPUT"
31+
echo "release=$(cat update.sh | grep -m5 '\[mainline\]=' | tail -n1 | cut -d"'" -f2)" >> "$GITHUB_OUTPUT"
3232
3333
core:
3434
name: Build Debian NGINX mainline Docker image
@@ -110,8 +110,8 @@ jobs:
110110
id: build
111111
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
112112
with:
113-
platforms: linux/amd64, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
114113
# platforms: linux/amd64, linux/arm/v5, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
114+
platforms: linux/amd64, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
115115
context: "{{ defaultContext }}:mainline/debian"
116116
labels: ${{ steps.meta.outputs.labels }}
117117
annotations: ${{ steps.meta.outputs.annotations }}
@@ -229,8 +229,8 @@ jobs:
229229
id: build
230230
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
231231
with:
232-
platforms: linux/amd64, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
233232
# platforms: linux/amd64, linux/arm/v5, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
233+
platforms: linux/amd64, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
234234
context: "{{ defaultContext }}:mainline/debian-perl"
235235
labels: ${{ steps.meta.outputs.labels }}
236236
annotations: ${{ steps.meta.outputs.annotations }}

‎.github/workflows/debian-stable.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
- name: Parse Alpine version
2929
id: distro_version
3030
run: |
31-
echo "release=$(cat update.sh | grep -m4 '\[stable\]=' | tail -n1 | cut -d"'" -f2)" >> "$GITHUB_OUTPUT"
31+
echo "release=$(cat update.sh | grep -m5 '\[stable\]=' | tail -n1 | cut -d"'" -f2)" >> "$GITHUB_OUTPUT"
3232
3333
core:
3434
name: Build Debian NGINX stable Docker image
@@ -106,7 +106,8 @@ jobs:
106106
id: build
107107
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
108108
with:
109-
platforms: linux/amd64, linux/arm/v5, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
109+
# platforms: linux/amd64, linux/arm/v5, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
110+
platforms: linux/amd64, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
110111
context: "{{ defaultContext }}:stable/debian"
111112
labels: ${{ steps.meta.outputs.labels }}
112113
annotations: ${{ steps.meta.outputs.annotations }}
@@ -216,7 +217,8 @@ jobs:
216217
id: build
217218
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
218219
with:
219-
platforms: linux/amd64, linux/arm/v5, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
220+
# platforms: linux/amd64, linux/arm/v5, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
221+
platforms: linux/amd64, linux/arm/v7, linux/arm64, linux/386, linux/mips64le, linux/ppc64le, linux/s390x
220222
context: "{{ defaultContext }}:stable/debian-perl"
221223
labels: ${{ steps.meta.outputs.labels }}
222224
annotations: ${{ steps.meta.outputs.annotations }}

‎Dockerfile-alpine-perl.template‎

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -16,17 +16,7 @@ RUN set -x \
1616
&& case "$apkArch" in \
1717
x86_64|aarch64) \
1818
# arches officially built by upstream
19-
set -x \
20-
&& KEY_SHA512="e09fa32f0a0eab2b879ccbbc4d0e4fb9751486eedda75e35fac65802cc9faa266425edf83e261137a2f4d16281ce2c1a5f4502930fe75154723da014214f0655" \
21-
&& wget -O /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub \
22-
&& if echo "$KEY_SHA512 */tmp/nginx_signing.rsa.pub" | sha512sum -c -; then \
23-
echo "key verification succeeded!"; \
24-
mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/; \
25-
else \
26-
echo "key verification failed!"; \
27-
exit 1; \
28-
fi \
29-
&& apk add -X "%%PACKAGEREPO%%v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \
19+
apk add -X "%%PACKAGEREPO%%v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \
3020
;; \
3121
*) \
3222
# we're on an architecture upstream doesn't officially build for
@@ -72,8 +62,7 @@ RUN set -x \
7262
# remove checksum deps
7363
&& apk del --no-network .checksum-deps \
7464
# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
75-
&& if [ -f "$tempDir" ]; then rm -rf "$tempDir"; fi \
76-
&& if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
77-
&& if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi
65+
&& if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
66+
&& if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi
7867

7968
USER $UID

‎Dockerfile-alpine-slim.template‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -77,9 +77,8 @@ RUN set -x \
7777
# remove checksum deps
7878
&& apk del --no-network .checksum-deps \
7979
# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
80-
&& if [ -f "$tempDir" ]; then rm -rf "$tempDir"; fi \
81-
&& if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
82-
&& if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
80+
&& if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
81+
&& if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
8382
# Bring in gettext so we can get `envsubst`, then throw
8483
# the rest away. To do this, we need to install `gettext`
8584
# then move `envsubst` out of the way so `gettext` can

‎Dockerfile-alpine.template‎

Lines changed: 4 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ ARG IMAGE=nginxinc/nginx-unprivileged:%%NGINX_VERSION%%-alpine-slim
22
FROM $IMAGE
33

44
ENV NJS_VERSION %%NJS_VERSION%%
5+
ENV NJS_RELEASE %%NJS_RELEASE%%
56

67
ARG UID=101
78
ARG GID=101
@@ -18,17 +19,7 @@ RUN set -x \
1819
&& case "$apkArch" in \
1920
x86_64|aarch64) \
2021
# arches officially built by upstream
21-
set -x \
22-
&& KEY_SHA512="e09fa32f0a0eab2b879ccbbc4d0e4fb9751486eedda75e35fac65802cc9faa266425edf83e261137a2f4d16281ce2c1a5f4502930fe75154723da014214f0655" \
23-
&& wget -O /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub \
24-
&& if echo "$KEY_SHA512 */tmp/nginx_signing.rsa.pub" | sha512sum -c -; then \
25-
echo "key verification succeeded!"; \
26-
mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/; \
27-
else \
28-
echo "key verification failed!"; \
29-
exit 1; \
30-
fi \
31-
&& apk add -X "%%PACKAGEREPO%%v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \
22+
apk add -X "%%PACKAGEREPO%%v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \
3223
;; \
3324
*) \
3425
# we're on an architecture upstream doesn't officially build for
@@ -77,9 +68,8 @@ RUN set -x \
7768
# remove checksum deps
7869
&& apk del --no-network .checksum-deps \
7970
# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
80-
&& if [ -f "$tempDir" ]; then rm -rf "$tempDir"; fi \
81-
&& if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
82-
&& if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
71+
&& if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
72+
&& if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
8373
# Bring in curl and ca-certificates to make registering on DNS SD easier
8474
&& apk add --no-cache curl ca-certificates
8575

‎Dockerfile-debian-perl.template‎

Lines changed: 3 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -6,26 +6,9 @@ ARG GID=101
66

77
USER root
88

9-
RUN set -x \
10-
&& apt-get update \
11-
&& apt-get install --no-install-recommends --no-install-suggests -y gnupg1 ca-certificates \
12-
&& \
13-
NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62; \
14-
NGINX_GPGKEY_PATH=/usr/share/keyrings/nginx-archive-keyring.gpg; \
15-
export GNUPGHOME="$(mktemp -d)"; \
16-
found=''; \
17-
for server in \
18-
hkp://keyserver.ubuntu.com:80 \
19-
pgp.mit.edu \
20-
; do \
21-
echo "Fetching GPG key $NGINX_GPGKEY from $server"; \
22-
gpg1 --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$NGINX_GPGKEY" && found=yes && break; \
23-
done; \
24-
test -z "$found" && echo >&2 "error: failed to fetch GPG key $NGINX_GPGKEY" && exit 1; \
25-
gpg1 --export "$NGINX_GPGKEY" > "$NGINX_GPGKEY_PATH" ; \
26-
rm -rf "$GNUPGHOME"; \
27-
apt-get remove --purge --auto-remove -y gnupg1 && rm -rf /var/lib/apt/lists/* \
28-
&& dpkgArch="$(dpkg --print-architecture)" \
9+
RUN set -x; \
10+
NGINX_GPGKEY_PATH=/etc/apt/keyrings/nginx-archive-keyring.gpg; \
11+
dpkgArch="$(dpkg --print-architecture)" \
2912
&& nginxPackages="%%PACKAGES%%
3013
" \
3114
&& case "$dpkgArch" in \

‎Dockerfile-debian.template‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ LABEL maintainer="NGINX Docker Maintainers <[email protected]>"
55

66
ENV NGINX_VERSION %%NGINX_VERSION%%
77
ENV NJS_VERSION %%NJS_VERSION%%
8+
ENV NJS_RELEASE %%NJS_RELEASE%%
89
ENV PKG_RELEASE %%PKG_RELEASE%%
910

1011
ARG UID=101
@@ -18,7 +19,7 @@ RUN set -x \
1819
&& apt-get install --no-install-recommends --no-install-suggests -y gnupg1 ca-certificates \
1920
&& \
2021
NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62; \
21-
NGINX_GPGKEY_PATH=/usr/share/keyrings/nginx-archive-keyring.gpg; \
22+
NGINX_GPGKEY_PATH=/etc/apt/keyrings/nginx-archive-keyring.gpg; \
2223
export GNUPGHOME="$(mktemp -d)"; \
2324
found=''; \
2425
for server in \

‎mainline/alpine-perl/Dockerfile‎

Lines changed: 9 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -19,25 +19,15 @@ RUN set -x \
1919
nginx-module-geoip=${NGINX_VERSION}-r${PKG_RELEASE} \
2020
nginx-module-image-filter=${NGINX_VERSION}-r${PKG_RELEASE} \
2121
nginx-module-perl=${NGINX_VERSION}-r${PKG_RELEASE} \
22-
nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${PKG_RELEASE} \
22+
nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} \
2323
" \
2424
# install prerequisites for public key and pkg-oss checks
2525
&& apk add --no-cache --virtual .checksum-deps \
2626
openssl \
2727
&& case "$apkArch" in \
2828
x86_64|aarch64) \
2929
# arches officially built by upstream
30-
set -x \
31-
&& KEY_SHA512="e09fa32f0a0eab2b879ccbbc4d0e4fb9751486eedda75e35fac65802cc9faa266425edf83e261137a2f4d16281ce2c1a5f4502930fe75154723da014214f0655" \
32-
&& wget -O /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub \
33-
&& if echo "$KEY_SHA512 */tmp/nginx_signing.rsa.pub" | sha512sum -c -; then \
34-
echo "key verification succeeded!"; \
35-
mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/; \
36-
else \
37-
echo "key verification failed!"; \
38-
exit 1; \
39-
fi \
40-
&& apk add -X "https://nginx.org/packages/mainline/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \
30+
apk add -X "https://nginx.org/packages/mainline/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" --no-cache $nginxPackages \
4131
;; \
4232
*) \
4333
# we're on an architecture upstream doesn't officially build for
@@ -60,16 +50,16 @@ RUN set -x \
6050
&& su nobody -s /bin/sh -c " \
6151
export HOME=${tempDir} \
6252
&& cd ${tempDir} \
63-
&& curl -f -O https://hg.nginx.org/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
64-
&& PKGOSSCHECKSUM=\"74000f32ab250be492a8ae4d408cd63a4c422f4f0af84689973a2844fceeb8a3e7e12b04d7c6dac0f993d7102d920a5f60e6f49be23ce4093f48a8eb1ae36ce5 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
65-
&& if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
53+
&& curl -f -O https://hg.nginx.org/pkg-oss/archive/93ac6e194ad0.tar.gz \
54+
&& PKGOSSCHECKSUM=\"d56d10fbc6a1774e0a000b4322c5f847f8dfdcc3035b21cfd2a4a417ecce46939f39ff39ab865689b60cf6486c3da132aa5a88fa56edaad13d90715affe2daf0 *93ac6e194ad0.tar.gz\" \
55+
&& if [ \"\$(openssl sha512 -r 93ac6e194ad0.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
6656
echo \"pkg-oss tarball checksum verification succeeded!\"; \
6757
else \
6858
echo \"pkg-oss tarball checksum verification failed!\"; \
6959
exit 1; \
7060
fi \
71-
&& tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
72-
&& cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \
61+
&& tar xzvf 93ac6e194ad0.tar.gz \
62+
&& cd pkg-oss-93ac6e194ad0 \
7363
&& cd alpine \
7464
&& make module-perl \
7565
&& apk index -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \
@@ -83,8 +73,7 @@ RUN set -x \
8373
# remove checksum deps
8474
&& apk del --no-network .checksum-deps \
8575
# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
86-
&& if [ -f "$tempDir" ]; then rm -rf "$tempDir"; fi \
87-
&& if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
88-
&& if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi
76+
&& if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
77+
&& if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi
8978

9079
USER $UID

‎mainline/alpine-slim/Dockerfile‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -60,16 +60,16 @@ RUN set -x \
6060
&& su nobody -s /bin/sh -c " \
6161
export HOME=${tempDir} \
6262
&& cd ${tempDir} \
63-
&& curl -f -O https://hg.nginx.org/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
64-
&& PKGOSSCHECKSUM=\"74000f32ab250be492a8ae4d408cd63a4c422f4f0af84689973a2844fceeb8a3e7e12b04d7c6dac0f993d7102d920a5f60e6f49be23ce4093f48a8eb1ae36ce5 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
65-
&& if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
63+
&& curl -f -O https://hg.nginx.org/pkg-oss/archive/93ac6e194ad0.tar.gz \
64+
&& PKGOSSCHECKSUM=\"d56d10fbc6a1774e0a000b4322c5f847f8dfdcc3035b21cfd2a4a417ecce46939f39ff39ab865689b60cf6486c3da132aa5a88fa56edaad13d90715affe2daf0 *93ac6e194ad0.tar.gz\" \
65+
&& if [ \"\$(openssl sha512 -r 93ac6e194ad0.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
6666
echo \"pkg-oss tarball checksum verification succeeded!\"; \
6767
else \
6868
echo \"pkg-oss tarball checksum verification failed!\"; \
6969
exit 1; \
7070
fi \
71-
&& tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
72-
&& cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \
71+
&& tar xzvf 93ac6e194ad0.tar.gz \
72+
&& cd pkg-oss-93ac6e194ad0 \
7373
&& cd alpine \
7474
&& make base \
7575
&& apk index -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \
@@ -83,9 +83,8 @@ RUN set -x \
8383
# remove checksum deps
8484
&& apk del --no-network .checksum-deps \
8585
# if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
86-
&& if [ -f "$tempDir" ]; then rm -rf "$tempDir"; fi \
87-
&& if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
88-
&& if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
86+
&& if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
87+
&& if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
8988
# Bring in gettext so we can get `envsubst`, then throw
9089
# the rest away. To do this, we need to install `gettext`
9190
# then move `envsubst` out of the way so `gettext` can

0 commit comments

Comments
 (0)