From 64d0955f965d9a61c4257e324974415a67353d48 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 18 May 2026 17:58:58 +0000 Subject: [PATCH 1/7] fix: harden nginx module install checks in bash and powershell scripts Agent-Logs-Url: https://github.com/Stensel8/Scripts/sessions/f86082a0-fc16-4ec5-9bef-081e6bae05ab Co-authored-by: Stensel8 <102481635+Stensel8@users.noreply.github.com> --- nginx/nginx_installer.ps1 | 38 +++++++++++++++++++++++++++++++++----- nginx/nginx_installer.sh | 22 ++++++++++++++++++++-- 2 files changed, 53 insertions(+), 7 deletions(-) diff --git a/nginx/nginx_installer.ps1 b/nginx/nginx_installer.ps1 index d1d79d7..47d3f9f 100644 --- a/nginx/nginx_installer.ps1 +++ b/nginx/nginx_installer.ps1 @@ -192,7 +192,8 @@ function Install-Dependencies { & dnf install -y -q gcc gcc-c++ make pcre2-devel zlib-devel libzstd-devel curl perl cargo pkgconf-pkg-config clang gawk cmake 2>&1 | Out-Null } 'pacman' { - if (-not (& pacman -Sy --noconfirm --needed base-devel pcre2 zstd curl clang gawk cmake pkgconf 2>&1 | Out-Null)) { + & pacman -Sy --noconfirm --needed base-devel pcre2 zstd curl clang gawk cmake pkgconf 2>&1 | Out-Null + if ($LASTEXITCODE -ne 0) { Write-Log WARN "pacman install failed, will try rustup for cargo. Note: zlib is not required (zlib-ng-compat provides it)." } } @@ -761,10 +762,37 @@ function Install-Nginx { } # Install dynamic modules - Copy-Item "$Script:BUILD_DIR/nginx/objs/*.so" -Destination $Script:NGINX_MODULES_PATH -Force - if ($LASTEXITCODE -ne 0) { Stop-Script "Failed to copy NGINX modules" } - Copy-Item "$Script:BUILD_DIR/nginx-acme/objs/ngx_http_acme_module.so" -Destination $Script:NGINX_MODULES_PATH -Force - if ($LASTEXITCODE -ne 0) { Stop-Script "Failed to copy ACME module" } + $nginxModules = Get-ChildItem -Path "$Script:BUILD_DIR/nginx/objs" -Filter '*.so' -File -ErrorAction SilentlyContinue + if (-not $nginxModules) { + Stop-Script "No NGINX dynamic modules found in $Script:BUILD_DIR/nginx/objs" + } + try { + Copy-Item -Path $nginxModules.FullName -Destination $Script:NGINX_MODULES_PATH -Force -ErrorAction Stop + } catch { + Stop-Script "Failed to copy NGINX modules: $($_.Exception.Message)" + } + + $acmeModule = "$Script:BUILD_DIR/nginx-acme/objs/ngx_http_acme_module.so" + if (-not (Test-Path $acmeModule)) { + Stop-Script "ACME module not found: $acmeModule" + } + try { + Copy-Item -Path $acmeModule -Destination $Script:NGINX_MODULES_PATH -Force -ErrorAction Stop + } catch { + Stop-Script "Failed to copy ACME module: $($_.Exception.Message)" + } + + $requiredModules = @( + 'ngx_http_zstd_filter_module.so', + 'ngx_http_zstd_static_module.so', + 'ngx_http_headers_more_filter_module.so', + 'ngx_http_acme_module.so' + ) + foreach ($module in $requiredModules) { + if (-not (Test-Path (Join-Path $Script:NGINX_MODULES_PATH $module))) { + Stop-Script "Required module missing after install: $module" + } + } # Install configuration files Install-HtmlFiles diff --git a/nginx/nginx_installer.sh b/nginx/nginx_installer.sh index a8b5dc2..19ae437 100755 --- a/nginx/nginx_installer.sh +++ b/nginx/nginx_installer.sh @@ -694,8 +694,26 @@ Install-Nginx() { fi # Install dynamic modules - cp objs/*.so "${NGINX_MODULES_PATH}/" 2>/dev/null || true - cp "$BUILD_DIR/nginx-acme/objs/ngx_http_acme_module.so" "${NGINX_MODULES_PATH}/" 2>/dev/null || true + local nginx_module_files=(objs/*.so) + if [[ ${#nginx_module_files[@]} -eq 0 || ! -e "${nginx_module_files[0]}" ]]; then + Stop-Script "No NGINX dynamic modules found in $BUILD_DIR/nginx/objs" + fi + cp "${nginx_module_files[@]}" "${NGINX_MODULES_PATH}/" || Stop-Script "Failed to copy NGINX modules" + + local acme_module="$BUILD_DIR/nginx-acme/objs/ngx_http_acme_module.so" + [[ -f "$acme_module" ]] || Stop-Script "ACME module not found: $acme_module" + cp "$acme_module" "${NGINX_MODULES_PATH}/" || Stop-Script "Failed to copy ACME module" + + local required_modules=( + ngx_http_zstd_filter_module.so + ngx_http_zstd_static_module.so + ngx_http_headers_more_filter_module.so + ngx_http_acme_module.so + ) + local module + for module in "${required_modules[@]}"; do + [[ -f "${NGINX_MODULES_PATH}/${module}" ]] || Stop-Script "Required module missing after install: ${module}" + done # Install configuration files Install-HtmlFiles From 666b051d2587a1acb52af933e9dd01c2fd9eae6a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 18 May 2026 17:59:43 +0000 Subject: [PATCH 2/7] chore: simplify bash dynamic module glob check Agent-Logs-Url: https://github.com/Stensel8/Scripts/sessions/f86082a0-fc16-4ec5-9bef-081e6bae05ab Co-authored-by: Stensel8 <102481635+Stensel8@users.noreply.github.com> --- nginx/nginx_installer.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nginx/nginx_installer.sh b/nginx/nginx_installer.sh index 19ae437..92cabf6 100755 --- a/nginx/nginx_installer.sh +++ b/nginx/nginx_installer.sh @@ -695,7 +695,7 @@ Install-Nginx() { # Install dynamic modules local nginx_module_files=(objs/*.so) - if [[ ${#nginx_module_files[@]} -eq 0 || ! -e "${nginx_module_files[0]}" ]]; then + if [[ ! -e "${nginx_module_files[0]}" ]]; then Stop-Script "No NGINX dynamic modules found in $BUILD_DIR/nginx/objs" fi cp "${nginx_module_files[@]}" "${NGINX_MODULES_PATH}/" || Stop-Script "Failed to copy NGINX modules" From 6c105572878bbd12b93d98e3110131e88744274c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 18 May 2026 18:08:13 +0000 Subject: [PATCH 3/7] refactor: centralize nginx checksum recalculation logic Agent-Logs-Url: https://github.com/Stensel8/Scripts/sessions/d90af641-3257-4c7c-9f20-b3cf821e5c0a Co-authored-by: Stensel8 <102481635+Stensel8@users.noreply.github.com> --- .github/scripts/update-nginx-checksums.sh | 249 +++++++++++-------- .github/workflows/update-nginx-checksums.yml | 87 +------ 2 files changed, 150 insertions(+), 186 deletions(-) diff --git a/.github/scripts/update-nginx-checksums.sh b/.github/scripts/update-nginx-checksums.sh index 60f542e..11df985 100755 --- a/.github/scripts/update-nginx-checksums.sh +++ b/.github/scripts/update-nginx-checksums.sh @@ -1,9 +1,10 @@ #!/usr/bin/env bash # -# Helper script to calculate and update SHA256 checksums for NGINX dependencies -# This script downloads the dependencies and updates the checksums in installer files +# Recalculate and optionally apply SHA256 checksums for nginx installer dependencies. # -# Usage: ./update-nginx-checksums.sh [nginx_version] [openssl_version] [pcre2_version] [zlib_version] +# Usage: +# .github/scripts/update-nginx-checksums.sh +# .github/scripts/update-nginx-checksums.sh --apply # set -euo pipefail @@ -19,121 +20,161 @@ log_success() { echo -e "${GREEN}[✓]${NC} $1"; } log_error() { echo -e "${RED}[✗]${NC} $1" >&2; } log_warn() { echo -e "${YELLOW}[!]${NC} $1"; } -# Get versions from arguments or read from installer files -NGINX_VERSION="${1:-$(grep -oP 'NGINX_VERSION="\K[^"]+' nginx/nginx_installer.sh)}" -OPENSSL_VERSION="${2:-$(grep -oP 'OPENSSL_VERSION="\K[^"]+' nginx/nginx_installer.sh)}" -PCRE2_VERSION="${3:-$(grep -oP 'PCRE2_VERSION="\K[^"]+' nginx/nginx_installer.sh)}" -ZLIB_VERSION="${4:-$(grep -oP 'ZLIB_VERSION="\K[^"]+' nginx/nginx_installer.sh)}" - -log_info "Versions to check:" -echo " NGINX: $NGINX_VERSION" -echo " OpenSSL: $OPENSSL_VERSION" -echo " PCRE2: $PCRE2_VERSION" -echo " Zlib: $ZLIB_VERSION" +usage() { + cat <<'EOF' +Usage: update-nginx-checksums.sh [--apply] + +Options: + --apply Apply calculated checksums to nginx/nginx_installer.sh and nginx/nginx_installer.ps1 without prompting + -h, --help Show this help +EOF +} + +APPLY=false +while [[ $# -gt 0 ]]; do + case "$1" in + --apply) + APPLY=true + shift + ;; + -h|--help) + usage + exit 0 + ;; + *) + log_error "Unknown argument: $1" + usage + exit 1 + ;; + esac +done + +REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" +readonly REPO_ROOT +readonly BASH_INSTALLER="$REPO_ROOT/nginx/nginx_installer.sh" +readonly PS_INSTALLER="$REPO_ROOT/nginx/nginx_installer.ps1" + +cd "$REPO_ROOT" + +read_sh_var() { + local key=$1 + sed -n "s/^${key}=\"\\([^\"]*\\)\"$/\\1/p" "$BASH_INSTALLER" | head -n1 +} + +update_bash_var() { + local key=$1 + local value=$2 + sed -i "s/^${key}=\"[^\"]*\"$/${key}=\"${value}\"/" "$BASH_INSTALLER" +} + +update_ps_var() { + local key=$1 + local value=$2 + sed -i "s#^\\(\\\$Script:${key}[[:space:]]*=[[:space:]]*'\\)[^']*'#\\1${value}'#" "$PS_INSTALLER" +} + +download_and_hash() { + local url=$1 + local file=$2 + curl -fsSL "$url" -o "$file" + sha256sum "$file" | awk '{print $1}' +} + +NGINX_VERSION="$(read_sh_var NGINX_VERSION)" +OPENSSL_VERSION="$(read_sh_var OPENSSL_VERSION)" +PCRE2_VERSION="$(read_sh_var PCRE2_VERSION)" +ZLIB_VERSION="$(read_sh_var ZLIB_VERSION)" +HEADERS_MORE_VERSION="$(read_sh_var HEADERS_MORE_VERSION)" +ZSTD_MODULE_VERSION="$(read_sh_var ZSTD_MODULE_VERSION)" +ACME_MODULE_VERSION="$(read_sh_var ACME_MODULE_VERSION)" + +required_values=( + "$NGINX_VERSION" + "$OPENSSL_VERSION" + "$PCRE2_VERSION" + "$ZLIB_VERSION" + "$HEADERS_MORE_VERSION" + "$ZSTD_MODULE_VERSION" + "$ACME_MODULE_VERSION" +) +for value in "${required_values[@]}"; do + [[ -n "$value" ]] || { log_error "Failed to read one or more versions from $BASH_INSTALLER"; exit 1; } +done + +log_info "Versions to recalculate:" +echo " NGINX: $NGINX_VERSION" +echo " OpenSSL: $OPENSSL_VERSION" +echo " PCRE2: $PCRE2_VERSION" +echo " Zlib: $ZLIB_VERSION" +echo " headers-more: $HEADERS_MORE_VERSION" +echo " zstd-module: $ZSTD_MODULE_VERSION" +echo " nginx-acme: $ACME_MODULE_VERSION" echo -# Create temp directory TEMP_DIR=$(mktemp -d) trap 'rm -rf -- "$TEMP_DIR"' EXIT - cd "$TEMP_DIR" -# Download and calculate checksums -log_info "Downloading NGINX $NGINX_VERSION..." -if wget -q "https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz"; then - NGINX_SHA256=$(sha256sum "nginx-${NGINX_VERSION}.tar.gz" | awk '{print $1}') - log_success "NGINX SHA256: $NGINX_SHA256" -else - log_error "Failed to download NGINX $NGINX_VERSION" - NGINX_SHA256="" -fi - -log_info "Downloading OpenSSL $OPENSSL_VERSION..." -if wget -q "https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz"; then - OPENSSL_SHA256=$(sha256sum "openssl-${OPENSSL_VERSION}.tar.gz" | awk '{print $1}') - log_success "OpenSSL SHA256: $OPENSSL_SHA256" -else - log_error "Failed to download OpenSSL $OPENSSL_VERSION" - OPENSSL_SHA256="" -fi - -log_info "Downloading PCRE2 $PCRE2_VERSION..." -if wget -q "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${PCRE2_VERSION}/pcre2-${PCRE2_VERSION}.tar.gz"; then - PCRE2_SHA256=$(sha256sum "pcre2-${PCRE2_VERSION}.tar.gz" | awk '{print $1}') - log_success "PCRE2 SHA256: $PCRE2_SHA256" -else - log_error "Failed to download PCRE2 $PCRE2_VERSION" - PCRE2_SHA256="" -fi - -log_info "Downloading Zlib $ZLIB_VERSION..." -if wget -q "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz"; then - ZLIB_SHA256=$(sha256sum "zlib-${ZLIB_VERSION}.tar.gz" | awk '{print $1}') - log_success "Zlib SHA256: $ZLIB_SHA256" -else - log_error "Failed to download Zlib $ZLIB_VERSION" - ZLIB_SHA256="" -fi - -echo -log_info "SHA256 Checksums:" -echo "====================" -[ -n "$NGINX_SHA256" ] && echo "NGINX: $NGINX_SHA256" -[ -n "$OPENSSL_SHA256" ] && echo "OpenSSL: $OPENSSL_SHA256" -[ -n "$PCRE2_SHA256" ] && echo "PCRE2: $PCRE2_SHA256" -[ -n "$ZLIB_SHA256" ] && echo "Zlib: $ZLIB_SHA256" -echo +log_info "Downloading and hashing release tarballs..." -# Ask if user wants to update the files -read -rp "Update installer files with these checksums? [y/N] " response -if [[ "$response" =~ ^[Yy]$ ]]; then - cd "$OLDPWD" +NGINX_SHA256="$(download_and_hash "https://github.com/nginx/nginx/releases/download/release-${NGINX_VERSION}/nginx-${NGINX_VERSION}.tar.gz" "nginx.tar.gz")" +log_success "NGINX_SHA256: $NGINX_SHA256" - # Update Bash installer - if [ -n "$NGINX_SHA256" ]; then - sed -i "s/NGINX_SHA256=\"[^\"]*\"/NGINX_SHA256=\"$NGINX_SHA256\"/" nginx/nginx_installer.sh - log_success "Updated NGINX SHA256 in nginx_installer.sh" - fi +OPENSSL_SHA256="$(download_and_hash "https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz" "openssl.tar.gz")" +log_success "OPENSSL_SHA256: $OPENSSL_SHA256" - if [ -n "$OPENSSL_SHA256" ]; then - sed -i "s/OPENSSL_SHA256=\"[^\"]*\"/OPENSSL_SHA256=\"$OPENSSL_SHA256\"/" nginx/nginx_installer.sh - log_success "Updated OpenSSL SHA256 in nginx_installer.sh" - fi +PCRE2_SHA256="$(download_and_hash "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${PCRE2_VERSION}/pcre2-${PCRE2_VERSION}.tar.gz" "pcre2.tar.gz")" +log_success "PCRE2_SHA256: $PCRE2_SHA256" - if [ -n "$PCRE2_SHA256" ]; then - sed -i "s/PCRE2_SHA256=\"[^\"]*\"/PCRE2_SHA256=\"$PCRE2_SHA256\"/" nginx/nginx_installer.sh - log_success "Updated PCRE2 SHA256 in nginx_installer.sh" - fi +ZLIB_SHA256="$(download_and_hash "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" "zlib.tar.gz")" +log_success "ZLIB_SHA256: $ZLIB_SHA256" - if [ -n "$ZLIB_SHA256" ]; then - sed -i "s/ZLIB_SHA256=\"[^\"]*\"/ZLIB_SHA256=\"$ZLIB_SHA256\"/" nginx/nginx_installer.sh - log_success "Updated Zlib SHA256 in nginx_installer.sh" - fi +HEADERS_MORE_SHA256="$(download_and_hash "https://github.com/openresty/headers-more-nginx-module/archive/refs/tags/v${HEADERS_MORE_VERSION}.tar.gz" "headers-more.tar.gz")" +log_success "HEADERS_MORE_SHA256: $HEADERS_MORE_SHA256" - # Update PowerShell installer ($Script:VAR = '...' met single quotes) - if [ -n "$NGINX_SHA256" ]; then - sed -i "s/\(\\\$Script:NGINX_SHA256\s*=\s*'\)[^']*'/\1$NGINX_SHA256'/" nginx/nginx_installer.ps1 - log_success "Updated NGINX SHA256 in nginx_installer.ps1" - fi +ZSTD_MODULE_SHA256="$(download_and_hash "https://github.com/tokers/zstd-nginx-module/archive/refs/tags/${ZSTD_MODULE_VERSION}.tar.gz" "zstd-module.tar.gz")" +log_success "ZSTD_MODULE_SHA256: $ZSTD_MODULE_SHA256" - if [ -n "$OPENSSL_SHA256" ]; then - sed -i "s/\(\\\$Script:OPENSSL_SHA256\s*=\s*'\)[^']*'/\1$OPENSSL_SHA256'/" nginx/nginx_installer.ps1 - log_success "Updated OpenSSL SHA256 in nginx_installer.ps1" - fi +ACME_MODULE_SHA256="$(download_and_hash "https://github.com/nginx/nginx-acme/releases/download/v${ACME_MODULE_VERSION}/nginx-acme-${ACME_MODULE_VERSION}.tar.gz" "nginx-acme.tar.gz")" +log_success "ACME_MODULE_SHA256: $ACME_MODULE_SHA256" - if [ -n "$PCRE2_SHA256" ]; then - sed -i "s/\(\\\$Script:PCRE2_SHA256\s*=\s*'\)[^']*'/\1$PCRE2_SHA256'/" nginx/nginx_installer.ps1 - log_success "Updated PCRE2 SHA256 in nginx_installer.ps1" - fi +echo +log_info "Calculated checksums:" +echo " NGINX_SHA256: $NGINX_SHA256" +echo " OPENSSL_SHA256: $OPENSSL_SHA256" +echo " PCRE2_SHA256: $PCRE2_SHA256" +echo " ZLIB_SHA256: $ZLIB_SHA256" +echo " HEADERS_MORE_SHA256: $HEADERS_MORE_SHA256" +echo " ZSTD_MODULE_SHA256: $ZSTD_MODULE_SHA256" +echo " ACME_MODULE_SHA256: $ACME_MODULE_SHA256" +echo - if [ -n "$ZLIB_SHA256" ]; then - sed -i "s/\(\\\$Script:ZLIB_SHA256\s*=\s*'\)[^']*'/\1$ZLIB_SHA256'/" nginx/nginx_installer.ps1 - log_success "Updated Zlib SHA256 in nginx_installer.ps1" +if [[ "$APPLY" != true ]]; then + read -rp "Apply these checksums to installer files? [y/N] " response + if [[ ! "$response" =~ ^[Yy]$ ]]; then + log_info "No changes made" + exit 0 fi - - echo - log_success "All checksums updated in installer files!" - log_info "Review the changes with: git diff nginx/" -else - log_info "No changes made to installer files" fi + +cd "$REPO_ROOT" + +update_bash_var NGINX_SHA256 "$NGINX_SHA256" +update_bash_var OPENSSL_SHA256 "$OPENSSL_SHA256" +update_bash_var PCRE2_SHA256 "$PCRE2_SHA256" +update_bash_var ZLIB_SHA256 "$ZLIB_SHA256" +update_bash_var HEADERS_MORE_SHA256 "$HEADERS_MORE_SHA256" +update_bash_var ZSTD_MODULE_SHA256 "$ZSTD_MODULE_SHA256" +update_bash_var ACME_MODULE_SHA256 "$ACME_MODULE_SHA256" + +update_ps_var NGINX_SHA256 "$NGINX_SHA256" +update_ps_var OPENSSL_SHA256 "$OPENSSL_SHA256" +update_ps_var PCRE2_SHA256 "$PCRE2_SHA256" +update_ps_var ZLIB_SHA256 "$ZLIB_SHA256" +update_ps_var HEADERS_MORE_SHA256 "$HEADERS_MORE_SHA256" +update_ps_var ZSTD_MODULE_SHA256 "$ZSTD_MODULE_SHA256" +update_ps_var ACME_MODULE_SHA256 "$ACME_MODULE_SHA256" + +log_success "Updated checksums in:" +echo " - nginx/nginx_installer.sh" +echo " - nginx/nginx_installer.ps1" diff --git a/.github/workflows/update-nginx-checksums.yml b/.github/workflows/update-nginx-checksums.yml index 5fbb4c1..2b3406e 100644 --- a/.github/workflows/update-nginx-checksums.yml +++ b/.github/workflows/update-nginx-checksums.yml @@ -5,6 +5,7 @@ name: Update nginx SHA256 checksums on: pull_request: + types: [opened, synchronize, reopened] branches: [main] paths: - 'nginx/nginx_installer.sh' @@ -17,7 +18,7 @@ jobs: update-checksums: name: Recalculate SHA256 checksums runs-on: ubuntu-latest - if: startsWith(github.head_ref, 'renovate/') + if: startsWith(github.head_ref, 'renovate/') && github.actor == 'renovate[bot]' steps: - name: Checkout PR branch uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 @@ -25,88 +26,10 @@ jobs: ref: ${{ github.head_ref }} token: ${{ secrets.GITHUB_TOKEN }} - - name: Read versions from bash installer - id: versions + - name: Recalculate and apply checksums run: | - echo "nginx=$(grep -oP 'NGINX_VERSION="\K[^"]+' nginx/nginx_installer.sh)" >> $GITHUB_OUTPUT - echo "openssl=$(grep -oP 'OPENSSL_VERSION="\K[^"]+' nginx/nginx_installer.sh)" >> $GITHUB_OUTPUT - echo "pcre2=$(grep -oP 'PCRE2_VERSION="\K[^"]+' nginx/nginx_installer.sh)" >> $GITHUB_OUTPUT - echo "zlib=$(grep -oP 'ZLIB_VERSION="\K[^"]+' nginx/nginx_installer.sh)" >> $GITHUB_OUTPUT - echo "headers_more=$(grep -oP 'HEADERS_MORE_VERSION="\K[^"]+' nginx/nginx_installer.sh)" >> $GITHUB_OUTPUT - echo "zstd=$(grep -oP 'ZSTD_MODULE_VERSION="\K[^"]+' nginx/nginx_installer.sh)" >> $GITHUB_OUTPUT - echo "acme=$(grep -oP 'ACME_MODULE_VERSION="\K[^"]+' nginx/nginx_installer.sh)" >> $GITHUB_OUTPUT - - - name: Download tarballs and calculate SHA256 - id: checksums - run: | - set -euo pipefail - TMPDIR=$(mktemp -d) - cd "$TMPDIR" - - download_and_hash() { - local url="$1" file="$2" - if ! wget -q "$url" -O "$file"; then - echo "ERROR: Failed to download $url" >&2 - exit 1 - fi - sha256sum "$file" | awk '{print $1}' - } - - NGINX_SHA=$(download_and_hash \ - "https://github.com/nginx/nginx/releases/download/release-${{ steps.versions.outputs.nginx }}/nginx-${{ steps.versions.outputs.nginx }}.tar.gz" \ - "nginx.tar.gz") - - OPENSSL_SHA=$(download_and_hash \ - "https://github.com/openssl/openssl/releases/download/openssl-${{ steps.versions.outputs.openssl }}/openssl-${{ steps.versions.outputs.openssl }}.tar.gz" \ - "openssl.tar.gz") - - PCRE2_SHA=$(download_and_hash \ - "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${{ steps.versions.outputs.pcre2 }}/pcre2-${{ steps.versions.outputs.pcre2 }}.tar.gz" \ - "pcre2.tar.gz") - - ZLIB_SHA=$(download_and_hash \ - "https://github.com/madler/zlib/releases/download/v${{ steps.versions.outputs.zlib }}/zlib-${{ steps.versions.outputs.zlib }}.tar.gz" \ - "zlib.tar.gz") - - HEADERS_MORE_SHA=$(download_and_hash \ - "https://github.com/openresty/headers-more-nginx-module/archive/refs/tags/v${{ steps.versions.outputs.headers_more }}.tar.gz" \ - "headers-more.tar.gz") - - ZSTD_SHA=$(download_and_hash \ - "https://github.com/tokers/zstd-nginx-module/archive/refs/tags/${{ steps.versions.outputs.zstd }}.tar.gz" \ - "zstd.tar.gz") - - ACME_SHA=$(download_and_hash \ - "https://github.com/nginx/nginx-acme/releases/download/v${{ steps.versions.outputs.acme }}/nginx-acme-${{ steps.versions.outputs.acme }}.tar.gz" \ - "acme.tar.gz") - - echo "nginx=$NGINX_SHA" >> $GITHUB_OUTPUT - echo "openssl=$OPENSSL_SHA" >> $GITHUB_OUTPUT - echo "pcre2=$PCRE2_SHA" >> $GITHUB_OUTPUT - echo "zlib=$ZLIB_SHA" >> $GITHUB_OUTPUT - echo "headers_more=$HEADERS_MORE_SHA" >> $GITHUB_OUTPUT - echo "zstd=$ZSTD_SHA" >> $GITHUB_OUTPUT - echo "acme=$ACME_SHA" >> $GITHUB_OUTPUT - - - name: Update checksums in bash installer - run: | - sed -i "s/NGINX_SHA256=\"[^\"]*\"/NGINX_SHA256=\"${{ steps.checksums.outputs.nginx }}\"/" nginx/nginx_installer.sh - sed -i "s/OPENSSL_SHA256=\"[^\"]*\"/OPENSSL_SHA256=\"${{ steps.checksums.outputs.openssl }}\"/" nginx/nginx_installer.sh - sed -i "s/PCRE2_SHA256=\"[^\"]*\"/PCRE2_SHA256=\"${{ steps.checksums.outputs.pcre2 }}\"/" nginx/nginx_installer.sh - sed -i "s/ZLIB_SHA256=\"[^\"]*\"/ZLIB_SHA256=\"${{ steps.checksums.outputs.zlib }}\"/" nginx/nginx_installer.sh - sed -i "s/HEADERS_MORE_SHA256=\"[^\"]*\"/HEADERS_MORE_SHA256=\"${{ steps.checksums.outputs.headers_more }}\"/" nginx/nginx_installer.sh - sed -i "s/ZSTD_MODULE_SHA256=\"[^\"]*\"/ZSTD_MODULE_SHA256=\"${{ steps.checksums.outputs.zstd }}\"/" nginx/nginx_installer.sh - sed -i "s/ACME_MODULE_SHA256=\"[^\"]*\"/ACME_MODULE_SHA256=\"${{ steps.checksums.outputs.acme }}\"/" nginx/nginx_installer.sh - - - name: Update checksums in PowerShell installer - run: | - sed -i "s/\(\$Script:NGINX_SHA256\s*=\s*'\)[^']*'/\1${{ steps.checksums.outputs.nginx }}'/" nginx/nginx_installer.ps1 - sed -i "s/\(\$Script:OPENSSL_SHA256\s*=\s*'\)[^']*'/\1${{ steps.checksums.outputs.openssl }}'/" nginx/nginx_installer.ps1 - sed -i "s/\(\$Script:PCRE2_SHA256\s*=\s*'\)[^']*'/\1${{ steps.checksums.outputs.pcre2 }}'/" nginx/nginx_installer.ps1 - sed -i "s/\(\$Script:ZLIB_SHA256\s*=\s*'\)[^']*'/\1${{ steps.checksums.outputs.zlib }}'/" nginx/nginx_installer.ps1 - sed -i "s/\(\$Script:HEADERS_MORE_SHA256\s*=\s*'\)[^']*'/\1${{ steps.checksums.outputs.headers_more }}'/" nginx/nginx_installer.ps1 - sed -i "s/\(\$Script:ZSTD_MODULE_SHA256\s*=\s*'\)[^']*'/\1${{ steps.checksums.outputs.zstd }}'/" nginx/nginx_installer.ps1 - sed -i "s/\(\$Script:ACME_MODULE_SHA256\s*=\s*'\)[^']*'/\1${{ steps.checksums.outputs.acme }}'/" nginx/nginx_installer.ps1 + chmod +x .github/scripts/update-nginx-checksums.sh + .github/scripts/update-nginx-checksums.sh --apply - name: Commit updated checksums run: | From 0a5bc527b339f5aac7256684779f3489c6bd9900 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 18 May 2026 18:08:48 +0000 Subject: [PATCH 4/7] fix: improve workflow script discovery and reduce checksum workflow noise Agent-Logs-Url: https://github.com/Stensel8/Scripts/sessions/d90af641-3257-4c7c-9f20-b3cf821e5c0a Co-authored-by: Stensel8 <102481635+Stensel8@users.noreply.github.com> --- .github/workflows/validate-scripts.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/validate-scripts.yml b/.github/workflows/validate-scripts.yml index 1a1ebc3..97d9b84 100644 --- a/.github/workflows/validate-scripts.yml +++ b/.github/workflows/validate-scripts.yml @@ -36,7 +36,10 @@ jobs: id: find-scripts run: | # Find all .sh files, excluding third-party directories - find . -type f -name "*.sh" ! -path "./TLS-tools/testssl.sh-*" > bash_scripts.txt + find . -type f -name "*.sh" \ + ! -path "./TLS-tools/testssl.sh/*" \ + ! -path "./TLS-tools/testssl.sh" \ + > bash_scripts.txt cat bash_scripts.txt - name: Validate bash syntax From ff08b38dd317401f8ede374430b5e1683aefdb89 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 18 May 2026 18:09:42 +0000 Subject: [PATCH 5/7] fix: address workflow and bash glob review feedback Agent-Logs-Url: https://github.com/Stensel8/Scripts/sessions/d90af641-3257-4c7c-9f20-b3cf821e5c0a Co-authored-by: Stensel8 <102481635+Stensel8@users.noreply.github.com> --- .github/workflows/validate-scripts.yml | 1 - nginx/nginx_installer.sh | 4 +++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/validate-scripts.yml b/.github/workflows/validate-scripts.yml index 97d9b84..360a89b 100644 --- a/.github/workflows/validate-scripts.yml +++ b/.github/workflows/validate-scripts.yml @@ -38,7 +38,6 @@ jobs: # Find all .sh files, excluding third-party directories find . -type f -name "*.sh" \ ! -path "./TLS-tools/testssl.sh/*" \ - ! -path "./TLS-tools/testssl.sh" \ > bash_scripts.txt cat bash_scripts.txt diff --git a/nginx/nginx_installer.sh b/nginx/nginx_installer.sh index 92cabf6..8de42a4 100755 --- a/nginx/nginx_installer.sh +++ b/nginx/nginx_installer.sh @@ -694,8 +694,10 @@ Install-Nginx() { fi # Install dynamic modules + shopt -s nullglob local nginx_module_files=(objs/*.so) - if [[ ! -e "${nginx_module_files[0]}" ]]; then + shopt -u nullglob + if [[ ${#nginx_module_files[@]} -eq 0 ]]; then Stop-Script "No NGINX dynamic modules found in $BUILD_DIR/nginx/objs" fi cp "${nginx_module_files[@]}" "${NGINX_MODULES_PATH}/" || Stop-Script "Failed to copy NGINX modules" From 557d96bc2515ff84b24459dd4a5d1327cbbb59c5 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 18 May 2026 18:10:48 +0000 Subject: [PATCH 6/7] fix: finalize workflow exclusion and pacman exit handling Agent-Logs-Url: https://github.com/Stensel8/Scripts/sessions/d90af641-3257-4c7c-9f20-b3cf821e5c0a Co-authored-by: Stensel8 <102481635+Stensel8@users.noreply.github.com> --- .github/workflows/validate-scripts.yml | 2 +- nginx/nginx_installer.ps1 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/validate-scripts.yml b/.github/workflows/validate-scripts.yml index 360a89b..c65b71b 100644 --- a/.github/workflows/validate-scripts.yml +++ b/.github/workflows/validate-scripts.yml @@ -37,7 +37,7 @@ jobs: run: | # Find all .sh files, excluding third-party directories find . -type f -name "*.sh" \ - ! -path "./TLS-tools/testssl.sh/*" \ + ! -path "./TLS-tools/testssl.sh*" \ > bash_scripts.txt cat bash_scripts.txt diff --git a/nginx/nginx_installer.ps1 b/nginx/nginx_installer.ps1 index 47d3f9f..56cb51b 100644 --- a/nginx/nginx_installer.ps1 +++ b/nginx/nginx_installer.ps1 @@ -192,7 +192,7 @@ function Install-Dependencies { & dnf install -y -q gcc gcc-c++ make pcre2-devel zlib-devel libzstd-devel curl perl cargo pkgconf-pkg-config clang gawk cmake 2>&1 | Out-Null } 'pacman' { - & pacman -Sy --noconfirm --needed base-devel pcre2 zstd curl clang gawk cmake pkgconf 2>&1 | Out-Null + & pacman -Sy --noconfirm --needed base-devel pcre2 zstd curl clang gawk cmake pkgconf *> $null if ($LASTEXITCODE -ne 0) { Write-Log WARN "pacman install failed, will try rustup for cargo. Note: zlib is not required (zlib-ng-compat provides it)." } From 8b013db3cd0a276dddd6cf8ae4ffeccc998aa059 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 18 May 2026 18:11:46 +0000 Subject: [PATCH 7/7] fix: harden module glob and pacman exit handling Agent-Logs-Url: https://github.com/Stensel8/Scripts/sessions/d90af641-3257-4c7c-9f20-b3cf821e5c0a Co-authored-by: Stensel8 <102481635+Stensel8@users.noreply.github.com> --- .github/workflows/validate-scripts.yml | 3 ++- nginx/nginx_installer.ps1 | 5 +++-- nginx/nginx_installer.sh | 9 ++++++--- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/.github/workflows/validate-scripts.yml b/.github/workflows/validate-scripts.yml index c65b71b..97d9b84 100644 --- a/.github/workflows/validate-scripts.yml +++ b/.github/workflows/validate-scripts.yml @@ -37,7 +37,8 @@ jobs: run: | # Find all .sh files, excluding third-party directories find . -type f -name "*.sh" \ - ! -path "./TLS-tools/testssl.sh*" \ + ! -path "./TLS-tools/testssl.sh/*" \ + ! -path "./TLS-tools/testssl.sh" \ > bash_scripts.txt cat bash_scripts.txt diff --git a/nginx/nginx_installer.ps1 b/nginx/nginx_installer.ps1 index 56cb51b..7c65c3e 100644 --- a/nginx/nginx_installer.ps1 +++ b/nginx/nginx_installer.ps1 @@ -192,8 +192,9 @@ function Install-Dependencies { & dnf install -y -q gcc gcc-c++ make pcre2-devel zlib-devel libzstd-devel curl perl cargo pkgconf-pkg-config clang gawk cmake 2>&1 | Out-Null } 'pacman' { - & pacman -Sy --noconfirm --needed base-devel pcre2 zstd curl clang gawk cmake pkgconf *> $null - if ($LASTEXITCODE -ne 0) { + $null = & pacman -Sy --noconfirm --needed base-devel pcre2 zstd curl clang gawk cmake pkgconf 2>&1 + $pacmanExit = $LASTEXITCODE + if ($pacmanExit -ne 0) { Write-Log WARN "pacman install failed, will try rustup for cargo. Note: zlib is not required (zlib-ng-compat provides it)." } } diff --git a/nginx/nginx_installer.sh b/nginx/nginx_installer.sh index 8de42a4..6cac221 100755 --- a/nginx/nginx_installer.sh +++ b/nginx/nginx_installer.sh @@ -694,9 +694,12 @@ Install-Nginx() { fi # Install dynamic modules - shopt -s nullglob - local nginx_module_files=(objs/*.so) - shopt -u nullglob + local nginx_module_files=() + local module_file + while IFS= read -r module_file; do + nginx_module_files+=("$module_file") + done < <(compgen -G 'objs/*.so' || true) + if [[ ${#nginx_module_files[@]} -eq 0 ]]; then Stop-Script "No NGINX dynamic modules found in $BUILD_DIR/nginx/objs" fi