From 949146ecf58b7691ad42ab3f19f1cef071faa926 Mon Sep 17 00:00:00 2001 From: Teddi Date: Mon, 8 Jun 2026 10:28:20 +0100 Subject: [PATCH 01/11] Bump various nginx versions --- .github/workflows/build-master.yml | 2 +- .github/workflows/build-pull-request.yml | 2 +- Dockerfile | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-master.yml b/.github/workflows/build-master.yml index 367ce2c..b0c0e93 100644 --- a/.github/workflows/build-master.yml +++ b/.github/workflows/build-master.yml @@ -16,7 +16,7 @@ jobs: strategy: matrix: - version: [1.22.1, 1.24.0, 1.26.3, 1.28.1, 1.30.1, 1.31.0] + version: [1.22.1, 1.24.0, 1.26.3, 1.28.3, 1.30.2, 1.31.1] steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/build-pull-request.yml b/.github/workflows/build-pull-request.yml index ef11a71..f7acb91 100644 --- a/.github/workflows/build-pull-request.yml +++ b/.github/workflows/build-pull-request.yml @@ -10,7 +10,7 @@ jobs: strategy: matrix: - version: [1.22.1, 1.24.0, 1.26.3, 1.28.1, 1.30.1, 1.31.0] + version: [1.22.1, 1.24.0, 1.26.3, 1.28.3, 1.30.2, 1.31.1] steps: - uses: actions/checkout@v6 diff --git a/Dockerfile b/Dockerfile index 8222c9e..24e6e5a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ FROM alpine:3.21 as build -ARG version=1.30.1 +ARG version=1.30.2 ARG opensslversion=3.5.6 ARG zlibversion=1.3.2 From d7f8f16306e31f877ff0c40fd838d22cc31d776d Mon Sep 17 00:00:00 2001 From: Teddi Date: Mon, 8 Jun 2026 10:48:01 +0100 Subject: [PATCH 02/11] Split zlib into own step --- Dockerfile | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index 24e6e5a..bf3f846 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,9 +13,13 @@ RUN wget https://nginx.org/download/nginx-${version}.tar.gz && \ wget https://github.com/openresty/headers-more-nginx-module/archive/master.zip && \ unzip master.zip && \ wget https://github.com/openssl/openssl/releases/download/openssl-${opensslversion}/openssl-${opensslversion}.tar.gz && \ - tar -xf openssl-${opensslversion}.tar.gz && \ - wget https://www.zlib.net/zlib-${zlibversion}.tar.gz && \ - tar -xf zlib-${zlibversion}.tar.gz + tar -xf openssl-${opensslversion}.tar.gz + +RUN wget --tries=5 --retry-connrefused --waitretry=5 --timeout=30 \ + --user-agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/120 Safari/537.36" \ + -O zlib-${zlibversion}.tar.gz \ + https://www.zlib.net/zlib-${zlibversion}.tar.gz && \ + tar -xf zlib-${zlibversion}.tar.gz WORKDIR /nginx-${version} RUN ./configure --with-cc-opt="-static -static-libgcc" \ From 741b535e8f9c8b116e4a01466f82ea0a21c2225f Mon Sep 17 00:00:00 2001 From: Teddi Date: Mon, 8 Jun 2026 10:50:24 +0100 Subject: [PATCH 03/11] Bump container, add curl --- Dockerfile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index bf3f846..96134c9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,10 +1,10 @@ -FROM alpine:3.21 as build +FROM alpine:3.23 AS build ARG version=1.30.2 ARG opensslversion=3.5.6 ARG zlibversion=1.3.2 -RUN apk add --no-cache unzip bash gcc make pcre build-base pcre-dev perl-dev linux-headers +RUN apk add --no-cache unzip bash gcc make pcre build-base pcre-dev perl-dev linux-headers curl RUN wget https://nginx.org/download/nginx-${version}.tar.gz && \ tar -xf nginx-${version}.tar.gz && \ @@ -15,9 +15,9 @@ RUN wget https://nginx.org/download/nginx-${version}.tar.gz && \ wget https://github.com/openssl/openssl/releases/download/openssl-${opensslversion}/openssl-${opensslversion}.tar.gz && \ tar -xf openssl-${opensslversion}.tar.gz -RUN wget --tries=5 --retry-connrefused --waitretry=5 --timeout=30 \ - --user-agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/120 Safari/537.36" \ - -O zlib-${zlibversion}.tar.gz \ +RUN curl -fL --retry 5 --retry-delay 5 --connect-timeout 30 \ + -A "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/120 Safari/537.36" \ + -o zlib-${zlibversion}.tar.gz \ https://www.zlib.net/zlib-${zlibversion}.tar.gz && \ tar -xf zlib-${zlibversion}.tar.gz From 7a87591004a2644ab5881961d85ab6dcf8875112 Mon Sep 17 00:00:00 2001 From: Teddi Date: Mon, 8 Jun 2026 10:58:23 +0100 Subject: [PATCH 04/11] Bump to pcre2 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 96134c9..d0de189 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ ARG version=1.30.2 ARG opensslversion=3.5.6 ARG zlibversion=1.3.2 -RUN apk add --no-cache unzip bash gcc make pcre build-base pcre-dev perl-dev linux-headers curl +RUN apk add --no-cache unzip bash gcc make pcre2 build-base pcre2-dev perl-dev linux-headers curl RUN wget https://nginx.org/download/nginx-${version}.tar.gz && \ tar -xf nginx-${version}.tar.gz && \ From 337832da0b1b079a223cc84eca2eb677194445ed Mon Sep 17 00:00:00 2001 From: Teddi Date: Mon, 8 Jun 2026 11:01:36 +0100 Subject: [PATCH 05/11] see if it accepts static --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index d0de189..1a81e4b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ ARG version=1.30.2 ARG opensslversion=3.5.6 ARG zlibversion=1.3.2 -RUN apk add --no-cache unzip bash gcc make pcre2 build-base pcre2-dev perl-dev linux-headers curl +RUN apk add --no-cache unzip bash gcc make pcre2 build-base pcre2-dev pcre2-static perl-dev linux-headers curl RUN wget https://nginx.org/download/nginx-${version}.tar.gz && \ tar -xf nginx-${version}.tar.gz && \ From d8d46590cc99144f492e9c2f4ddedb99b6602e2f Mon Sep 17 00:00:00 2001 From: Teddi Date: Mon, 8 Jun 2026 11:05:03 +0100 Subject: [PATCH 06/11] randomize UAs --- Dockerfile | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 1a81e4b..dc20b31 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,8 +15,16 @@ RUN wget https://nginx.org/download/nginx-${version}.tar.gz && \ wget https://github.com/openssl/openssl/releases/download/openssl-${opensslversion}/openssl-${opensslversion}.tar.gz && \ tar -xf openssl-${opensslversion}.tar.gz -RUN curl -fL --retry 5 --retry-delay 5 --connect-timeout 30 \ - -A "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/120 Safari/537.36" \ +RUN case $((RANDOM % 5)) in \ + 0) UA='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/137.0.0.0 Safari/537.36' ;; \ + 1) UA='Mozilla/5.0 (Macintosh; Intel Mac OS X 15_5) AppleWebKit/605.1.15 Version/18.5 Safari/605.1.15' ;; \ + 2) UA='Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/137.0.0.0 Safari/537.36' ;; \ + 3) UA='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0' ;; \ + *) UA='Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' ;; \ + esac && \ + echo "Using User-Agent: $UA" && \ + curl -fL --retry 5 --retry-delay 5 --connect-timeout 30 \ + -A "$UA" \ -o zlib-${zlibversion}.tar.gz \ https://www.zlib.net/zlib-${zlibversion}.tar.gz && \ tar -xf zlib-${zlibversion}.tar.gz From f6f8d86d7fb7160332cfca4acf417b69cacbadc7 Mon Sep 17 00:00:00 2001 From: Teddi Date: Tue, 9 Jun 2026 20:39:01 +0100 Subject: [PATCH 07/11] works locally, lets see if it's playing nicer today --- Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index dc20b31..f3850e2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ ARG version=1.30.2 ARG opensslversion=3.5.6 ARG zlibversion=1.3.2 -RUN apk add --no-cache unzip bash gcc make pcre2 build-base pcre2-dev pcre2-static perl-dev linux-headers curl +RUN apk add --no-cache unzip bash gcc make pcre2 build-base pcre2-dev pcre2-static perl-dev linux-headers curl RUN wget https://nginx.org/download/nginx-${version}.tar.gz && \ tar -xf nginx-${version}.tar.gz && \ @@ -15,6 +15,7 @@ RUN wget https://nginx.org/download/nginx-${version}.tar.gz && \ wget https://github.com/openssl/openssl/releases/download/openssl-${opensslversion}/openssl-${opensslversion}.tar.gz && \ tar -xf openssl-${opensslversion}.tar.gz +# Do this to deal with ZLib randomly giving us a 415 response, which seems to be some sort of jank rate limiting on their end. RUN case $((RANDOM % 5)) in \ 0) UA='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/137.0.0.0 Safari/537.36' ;; \ 1) UA='Mozilla/5.0 (Macintosh; Intel Mac OS X 15_5) AppleWebKit/605.1.15 Version/18.5 Safari/605.1.15' ;; \ From 3ac7329d39f446300f70f805d524a255dfd3c647 Mon Sep 17 00:00:00 2001 From: Teddi Date: Tue, 9 Jun 2026 20:47:39 +0100 Subject: [PATCH 08/11] swap to fetching zlib from github --- Dockerfile | 17 ++--------------- 1 file changed, 2 insertions(+), 15 deletions(-) diff --git a/Dockerfile b/Dockerfile index f3850e2..c099195 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,21 +13,8 @@ RUN wget https://nginx.org/download/nginx-${version}.tar.gz && \ wget https://github.com/openresty/headers-more-nginx-module/archive/master.zip && \ unzip master.zip && \ wget https://github.com/openssl/openssl/releases/download/openssl-${opensslversion}/openssl-${opensslversion}.tar.gz && \ - tar -xf openssl-${opensslversion}.tar.gz - -# Do this to deal with ZLib randomly giving us a 415 response, which seems to be some sort of jank rate limiting on their end. -RUN case $((RANDOM % 5)) in \ - 0) UA='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/137.0.0.0 Safari/537.36' ;; \ - 1) UA='Mozilla/5.0 (Macintosh; Intel Mac OS X 15_5) AppleWebKit/605.1.15 Version/18.5 Safari/605.1.15' ;; \ - 2) UA='Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/137.0.0.0 Safari/537.36' ;; \ - 3) UA='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0' ;; \ - *) UA='Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' ;; \ - esac && \ - echo "Using User-Agent: $UA" && \ - curl -fL --retry 5 --retry-delay 5 --connect-timeout 30 \ - -A "$UA" \ - -o zlib-${zlibversion}.tar.gz \ - https://www.zlib.net/zlib-${zlibversion}.tar.gz && \ + tar -xf openssl-${opensslversion}.tar.gz && \ + wget https://github.com/madler/zlib/releases/download/v${zlibversion}/zlib-${zlibversion}.tar.gz && \ tar -xf zlib-${zlibversion}.tar.gz WORKDIR /nginx-${version} From 615b688538c257777b5c9d39f8986c132404e16e Mon Sep 17 00:00:00 2001 From: Teddi Date: Tue, 9 Jun 2026 21:38:32 +0100 Subject: [PATCH 09/11] remove older versions --- .github/workflows/build-master.yml | 2 +- .github/workflows/build-pull-request.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-master.yml b/.github/workflows/build-master.yml index b0c0e93..7bd10a9 100644 --- a/.github/workflows/build-master.yml +++ b/.github/workflows/build-master.yml @@ -16,7 +16,7 @@ jobs: strategy: matrix: - version: [1.22.1, 1.24.0, 1.26.3, 1.28.3, 1.30.2, 1.31.1] + version: [1.26.3, 1.28.3, 1.30.2, 1.31.1] steps: - uses: actions/checkout@v6 diff --git a/.github/workflows/build-pull-request.yml b/.github/workflows/build-pull-request.yml index f7acb91..29c8d01 100644 --- a/.github/workflows/build-pull-request.yml +++ b/.github/workflows/build-pull-request.yml @@ -10,7 +10,7 @@ jobs: strategy: matrix: - version: [1.22.1, 1.24.0, 1.26.3, 1.28.3, 1.30.2, 1.31.1] + version: [1.26.3, 1.28.3, 1.30.2, 1.31.1] steps: - uses: actions/checkout@v6 From f990687bb833ff03eda08e69c7f7bcca21ba9e92 Mon Sep 17 00:00:00 2001 From: Teddi Date: Tue, 9 Jun 2026 21:56:54 +0100 Subject: [PATCH 10/11] Have the dockerfile attempt to work out if / when we suppress the warning as error --- .github/workflows/build-pull-request.yml | 2 +- Dockerfile | 9 +++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-pull-request.yml b/.github/workflows/build-pull-request.yml index 29c8d01..f7acb91 100644 --- a/.github/workflows/build-pull-request.yml +++ b/.github/workflows/build-pull-request.yml @@ -10,7 +10,7 @@ jobs: strategy: matrix: - version: [1.26.3, 1.28.3, 1.30.2, 1.31.1] + version: [1.22.1, 1.24.0, 1.26.3, 1.28.3, 1.30.2, 1.31.1] steps: - uses: actions/checkout@v6 diff --git a/Dockerfile b/Dockerfile index c099195..14ab60a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -18,7 +18,12 @@ RUN wget https://nginx.org/download/nginx-${version}.tar.gz && \ tar -xf zlib-${zlibversion}.tar.gz WORKDIR /nginx-${version} -RUN ./configure --with-cc-opt="-static -static-libgcc" \ + +RUN extra_cc_opt=""; \ + if [ "$(printf '%s\n' "$version" "1.28.3" | sort -V | head -n1)" = "$version" ] && [ "$version" != "1.28.3" ]; then \ + extra_cc_opt="-Wno-error=unterminated-string-initialization"; \ + fi; \ + ./configure --with-cc-opt="-static -static-libgcc ${extra_cc_opt}" \ --with-ld-opt="-static" \ --with-zlib=../zlib-${zlibversion} \ --add-module=/ngx_http_substitutions_filter_module-master \ @@ -46,7 +51,7 @@ RUN ./configure --with-cc-opt="-static -static-libgcc" \ --with-http_auth_request_module \ --with-http_addition_module \ --with-http_sub_module \ - --with-openssl=../openssl-${opensslversion} + --with-openssl=../openssl-${opensslversion} RUN make install From 4ec5fc8cf212ea977b90752ebe524be9c2f9d3da Mon Sep 17 00:00:00 2001 From: Teddi Date: Tue, 9 Jun 2026 22:07:41 +0100 Subject: [PATCH 11/11] restore main --- .github/workflows/build-master.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-master.yml b/.github/workflows/build-master.yml index 7bd10a9..b0c0e93 100644 --- a/.github/workflows/build-master.yml +++ b/.github/workflows/build-master.yml @@ -16,7 +16,7 @@ jobs: strategy: matrix: - version: [1.26.3, 1.28.3, 1.30.2, 1.31.1] + version: [1.22.1, 1.24.0, 1.26.3, 1.28.3, 1.30.2, 1.31.1] steps: - uses: actions/checkout@v6