Makefile

#               __                     __
# .-----.-----.|__|.-----.--.--.______|  |.--.--.---.-.
# |     |  _  ||  ||     |_   _|______|  ||  |  |  _  |
# |__|__|___  ||__||__|__|__.__|      |__||_____|___._|
#       |_____|
#
# Copyright (c) 2025 Fabio Cicerchia. https://fabiocicerchia.it. MIT License
# Repo: https://github.com/fabiocicerchia/nginx-lua

PAGER:=
DOCKERFILE_CHANGES=$(shell (git fetch origin main > /dev/null; git diff-tree --no-commit-id --name-only -r origin/main) | egrep "(nginx|src)/" | wc -l | tr -d ' ')
SKIP=NO
ifeq ($(DOCKERFILE_CHANGES), 0)
	SKIP=YES
endif
ifeq ($(FORCE), YES)
	SKIP=NO
endif

BUILD_CMD:=./bin/docker-build.py
PUSH_CMD:=./bin/docker-push.py
BUNDLE_CMD:=./bin/docker-bundle.py
TEST_CMD:=./bin/test.sh
SEC_CMD:=./bin/test-security.sh
META_CMD:=./bin/docker-metadata.py
DISTROS=almalinux alpine amazonlinux debian fedora ubuntu

GH_USERNAME=fabiocicerchia
GH_CLI_NAME=ghr_v0.16.2_linux_amd64
GH_CLI_TARBALL=https://github.com/tcnksm/ghr/releases/download/v0.16.2/$(GH_CLI_NAME).tar.gz
GH_CLI_SHA256=084ed9819dff71ea77f77a3071a643b6d1cbe5d2ab57bb5f56bb23de17189cd0
NGINX_UPSTREAM_URL=https://github.com/nginx/docker-nginx
NGINX_UPSTREAM_RAW_FILES=https://raw.githubusercontent.com/nginx/docker-nginx

PREVIOUS_TAG=$(shell git ls-remote --tags 2>&1 | awk '{print $$2}' | sort -r | head -n 1 | cut -d "/" -f3)
TAG_VER=$(shell date +'v1.%Y%m%d.%H%M%S')

# One release per nginx track, tagged with the exact nginx version (e.g. v1.30.3, v1.31.2).

SUPPORTED_NGINX_VER_MAINLINE=$(shell cat supported_versions | grep nginx_mainline | cut -d= -f2)
SUPPORTED_NGINX_VER_STABLE=$(shell cat supported_versions | grep nginx_stable | cut -d= -f2)
UPSTREAM_NGINX_VER_MAINLINE=$(shell curl -s https://api.github.com/repos/nginx/docker-nginx/tags | grep '"name"' | head -n 1 | cut -d '"' -f 4)

amd64_distros=$(addprefix amd64-, $(DISTROS))
arm64_distros=$(addprefix arm64-, $(DISTROS))
build_targets_amd64=$(addprefix build-, $(amd64_distros))
build_targets_arm64=$(addprefix build-, $(arm64_distros))
dockertest_targets_amd64=$(addprefix docker-test-, $(amd64_distros))
dockertest_targets_arm64=$(addprefix docker-test-, $(arm64_distros))
build_targets=${build_targets_amd64} ${build_targets_arm64}
package_targets_amd64=$(addprefix package-, $(amd64_distros))
package_targets_arm64=$(addprefix package-, $(arm64_distros))
package_targets=${package_targets_amd64} ${package_targets_arm64}
packagetest_targets_amd64=$(addprefix package-test-, $(amd64_distros))
packagetest_targets_arm64=$(addprefix package-test-, $(arm64_distros))

test_targets=${dockertest_targets_amd64} ${dockertest_targets_arm64}
push_targets=$(addprefix push-, $(DISTROS))

bundle_targets=$(addprefix bundle-, $(DISTROS))
security_targets=$(addprefix test-security-, $(DISTROS))
minimal_targets=$(addprefix build-minimal-, $(DISTROS))

.PHONY: changelog
.SILENT: help changelog
default: help

################################################################################
##@ GENERIC
################################################################################

all: build-all test-all push-all ## build, test and push everything

################################################################################
# HELP
################################################################################

help: ## prints this help
	echo "              __                     __ "
	echo ".-----.-----.|__|.-----.--.--.______|  |.--.--.---.-."
	echo "|     |  _  ||  ||     |_   _|______|  ||  |  |  _  |"
	echo "|__|__|___  ||__||__|__|__.__|      |__||_____|___._|"
	echo "      |_____|"
	echo ""
	echo "Copyright (c) 2025 Fabio Cicerchia. https://fabiocicerchia.it. MIT License"
	echo "Repo: https://github.com/$(GH_USERNAME)/nginx-lua"
	echo ""
	@gawk 'function fix_value(value, str) { \
		padding=sprintf("%50s",""); \
		ret=gensub("([^ ]+)", "\\1"padding"\n ", "g", "  "value); \
		ret=gensub("(^|\n)(.{53}) *", "\\1\\2\033[0m"str"  \033[36m", "g", ret); \
		ret=substr(ret, 3, length(ret)-16-length(str)); \
		return ret; \
	} \
	BEGIN { \
		FS = ":.*##"; \
		printf "Use: make \033[36m<target>\033[0m\n"; \
	} /^\$$?\(?[a-zA-Z0-9_-]+\)?:.*?##/ { \
		gsub("\\$$\\(build_targets\\)",              fix_value("$(build_targets)", $$2),              $$1); \
		gsub("\\$$\\(build_targets_amd64\\)",        fix_value("$(build_targets_amd64)", $$2),        $$1); \
		gsub("\\$$\\(build_targets_arm64\\)",        fix_value("$(build_targets_arm64)", $$2),        $$1); \
		gsub("\\$$\\(package_targets\\)",            fix_value("$(package_targets)", $$2),            $$1); \
		gsub("\\$$\\(package_targets_amd64\\)",      fix_value("$(package_targets_amd64)", $$2),      $$1); \
		gsub("\\$$\\(package_targets_arm64\\)",      fix_value("$(package_targets_arm64)", $$2),      $$1); \
		gsub("\\$$\\(packagetest_targets\\)",        fix_value("$(packagetest_targets)", $$2),        $$1); \
		gsub("\\$$\\(packagetest_targets_amd64\\)",  fix_value("$(packagetest_targets_amd64)", $$2),  $$1); \
		gsub("\\$$\\(packagetest_targets_arm64\\)",  fix_value("$(packagetest_targets_arm64)", $$2),  $$1); \
		gsub("\\$$\\(minimal_targets\\)",            fix_value("$(minimal_targets)", $$2),            $$1); \
		gsub("\\$$\\(test_targets\\)",               fix_value("$(test_targets)", $$2),               $$1); \
		gsub("\\$$\\(security_targets\\)",           fix_value("$(security_targets)", $$2),           $$1); \
		gsub("\\$$\\(push_targets\\)",               fix_value("$(push_targets)", $$2),               $$1); \
		gsub("\\$$\\(bundle_targets\\)",             fix_value("$(bundle_targets)", $$2),             $$1); \
		printf "  \033[36m%-50s\033[0m %s\n", $$1, $$2 \
	} /^##@/ { \
		printf "\n\033[1m%s\033[0m\n", substr($$0, 5) \
	}' $(MAKEFILE_LIST)

################################################################################
##@ BUILD
################################################################################

build-all: build-amd64 build-arm64 ## build all dockerfiles
build-amd64: $(build_targets_amd64) ## build all distros in amd64 arch
build-arm64: $(build_targets_arm64) ## build all distros in arm64/v8 arch

$(build_targets_amd64): ## build one distro in amd64 arch
	TASK=$(@) $(MAKE) build-single

$(build_targets_arm64): ## build one distro in arm64/v8 arch
	TASK=$(@) $(MAKE) build-single

build-single: generate-dockerfiles
ifeq ($(SKIP), YES)
	echo "SKIPPING $@"
	return
endif
	ARCH=$(shell echo $$TASK | cut -d"-" -f2); \
	DISTRO=$(shell echo $$TASK | cut -d"-" -f3); \
	echo "BUILDING $$DISTRO"; \
	export DOCKER_CLI_EXPERIMENTAL=enabled; \
	$(BUILD_CMD) "$$DISTRO" "$$ARCH"

################################################################################
##@ TESTING
################################################################################

test-all: $(test_targets) ## test all docker images

$(test_targets): ## test one docker image
ifeq ($(SKIP), YES)
	echo "SKIPPING $@"
	return
endif
	ARCH=$(shell echo $(@) | sed -r 's/docker-test-(amd64|arm64v8)-.*/\1/'); \
	DISTRO=$(shell echo $(@) | sed -r 's/docker-test-(amd64|arm64v8)-//'); \
	echo "TESTING $$DISTRO"; \
	$(TEST_CMD) "$$DISTRO" "$$ARCH" "" "docker"

test-security: $(security_targets) ## test security all docker images

$(security_targets): ## test security one docker images
ifeq ($(SKIP), YES)
	echo "SKIPPING $@"
	return
endif
	DISTRO=$(subst test-security-,,$(@)); \
	echo "SECURITY $$DISTRO"; \
	$(SEC_CMD) "$$DISTRO"

################################################################################
##@ PUSH
################################################################################

push-all: $(push_targets) ## push all docker images to docker hub

$(push_targets): ## push one docker images to docker hub
ifeq ($(SKIP), YES)
	echo "SKIPPING $@"
	return
endif
	DISTRO=$(subst push-,,$(@)); \
	echo "PUSHING $$DISTRO"; \
	$(PUSH_CMD) "$$DISTRO"

cleanup-docker-images: ## delete temporary per-arch tags (-amd64, -arm64v8) from Docker Hub
	./bin/cleanup-docker-images.py

################################################################################
##@ BUNDLE
################################################################################

$(bundle_targets): ## bundle multiple docker images into one
ifeq ($(SKIP), YES)
	echo "SKIPPING $@"
	return
endif
	DISTRO=$(subst bundle-,,$(@)); \
	echo "BUNDLING $$DISTRO"; \
	$(BUNDLE_CMD) "$$DISTRO"

################################################################################
##@ DEPENDENCIES
################################################################################
# Ref: https://www.stereolabs.com/docs/docker/building-arm-container-on-x86/
qemu:
	docker buildx create --name multiarch --use
	sudo apt-get update
	sudo apt-get install --force-yes qemu binfmt-support qemu-user-static # Install the qemu packages
	docker run --rm --privileged multiarch/qemu-user-static --reset -p yes # This step will execute the registering scripts

################################################################################
##@ PACKAGE
################################################################################

packages: $(package_targets_amd64) $(package_targets_arm64) ## creating the system package .apk (Alpine), .deb (Debian-like), .rpm (RHEL-like)

$(package_targets_amd64): ## creating the system package in amd64 arch
	ARCH=amd64 DISTRO=$(subst package-amd64-,,$(@)) $(MAKE) .package-base

$(package_targets_arm64): ## creating the system package in arm64/v8 arch
	ARCH=arm64v8 DISTRO=$(subst package-arm64-,,$(@)) $(MAKE) .package-base

.package-base:
	./bin/package-base-nginx.sh "$(DISTRO)" "$(SUPPORTED_NGINX_VER_MAINLINE)" "$(ARCH)"
	./bin/package-base-nginx.sh "$(DISTRO)" "$(SUPPORTED_NGINX_VER_STABLE)" "$(ARCH)"

package-test: $(packagetest_targets_amd64) $(packagetest_targets_arm64) ## testing installation of the system package .apk (Alpine), .deb (Debian-like), .rpm (RHEL-like)

$(packagetest_targets_amd64): ## testing the system package in amd64 arch
	ARCH=amd64 DISTRO=$(subst package-test-amd64-,,$(@)) $(MAKE) .package-test-base

$(packagetest_targets_arm64): ## testing the system package in arm64/v8 arch
	ARCH=arm64v8 DISTRO=$(subst package-test-arm64-,,$(@)) $(MAKE) .package-test-base

.package-test-base:
	./bin/package-test-base.sh "$(DISTRO)" "$(SUPPORTED_NGINX_VER_MAINLINE)" "$(ARCH)"
	./bin/package-test-base.sh "$(DISTRO)" "$(SUPPORTED_NGINX_VER_STABLE)" "$(ARCH)"

################################################################################
##@ UTILITIES
################################################################################
auto-update: generate-supported-versions pull-nginx-entrypoints generate-deps-env generate-dockerfiles generate-fossa-deps update-readme update-tags ## auto update supported versions, dockerfiles, fossa deps and tags

.setup_gitrepo:
	git config user.name "$(GH_USERNAME)"
	git config user.email "$(GH_USERNAME)@users.noreply.github.com"
	git remote set-url --push origin "https://x-access-token:${GITHUB_TOKEN}@github.com/$(GH_USERNAME)/nginx-lua.git"

auto-update-and-commit: .setup_gitrepo auto-update
	git add supported_versions nginx/ src/ docs/TAGS.md README.md fossa-deps.yml || true; \
	CHANGES=$$(git status --porcelain | wc -l | tr -d ' '); \
	if [ "$$CHANGES" = "0" ]; then \
		exit 1; \
	fi; \
	BRANCH_NAME="auto-update/$$(date +%Y%m%d-%H%M%S)"; \
	git checkout -b "$$BRANCH_NAME"; \
	git commit -m "Automated updates"; \
	git push -u origin "$$BRANCH_NAME"; \
	gh pr create \
		--title "Automated dependency updates" \
		--body "Automated PR created by CI pipeline.$$'\n\n'This PR contains updated supported versions, Dockerfiles, tags, and README." \
		--base main \
		--head "$$BRANCH_NAME"

auto-commit-metadata: .setup_gitrepo generate-metadata
	git add docs/metadata/ || true; \
	CHANGES=$$(git status --porcelain | wc -l | tr -d ' '); \
	if [ "$$CHANGES" = "0" ]; then \
		exit 1; \
	fi; \
	BRANCH_NAME="auto-metadata/$$(date +%Y%m%d-%H%M%S)"; \
	git checkout -b "$$BRANCH_NAME"; \
	git commit -m "[ci skip] Automated metadata"; \
	git push -u origin "$$BRANCH_NAME"; \
	gh pr create \
		--title "[ci skip] Automated metadata update" \
		--body "Automated PR created by CI pipeline.$$'\n\n'This PR contains updated Docker image metadata." \
		--base main \
		--head "$$BRANCH_NAME"

release: ## create a github release per nginx track (stable + mainline), each tagged with its exact nginx version
	# Download ghr with verified checksum (pinned to v0.16.2)
	./bin/download-and-verify.sh "$(GH_CLI_TARBALL)" "$(GH_CLI_NAME).tar.gz" "$(GH_CLI_SHA256)"
	tar xvzf $(GH_CLI_NAME).tar.gz
	for NGINX_VER in $(SUPPORTED_NGINX_VER_STABLE) $(SUPPORTED_NGINX_VER_MAINLINE); do \
		TAG="v$$NGINX_VER"; \
		if git ls-remote --tags origin "refs/tags/$$TAG" | grep -q "refs/tags/$$TAG$$"; then \
			echo "=== $$TAG already released, skipping ==="; \
			continue; \
		fi; \
		mkdir -p dist && rm -rf dist/Dockerfile* dist/SHA256SUMS; \
		cp Dockerfile dist/; \
		tail -n -6 supported_versions | tr '=' '/' | sed "s_^_nginx/$${NGINX_VER}/_" | while read FOLDER; do \
			if [ -d "$$FOLDER" ]; then \
				DOCKERFILE=$$(find $$FOLDER -name "Dockerfile"); \
				DEST="dist/$$(echo $$DOCKERFILE | sed 's_nginx/\(.*\)/\(.*\)/\(.*\)/\(Dockerfile.*\)_\4-nginx\1-\2\3_')"; \
				cp $$DOCKERFILE $$DEST; \
			fi; \
		done; \
		cd dist && for f in *~*; do [ -e "$$f" ] && mv "$$f" "$$(echo $$f | tr '~' '.')"; done; cd ..; \
		echo "=== Release artifacts ($$TAG) ==="; \
		ls -lah dist/; \
		cd dist && sha256sum * > SHA256SUMS && cd ..; \
		./$(GH_CLI_NAME)/ghr -b "$$(printf '%q' $$($(MAKE) --no-print-directory changelog TAG_VER=$$TAG))" "$$TAG" dist; \
		rm -rf dist; \
	done

generate-supported-versions: ## generate supported_versions file
	./bin/generate-supported-versions.py

generate-dockerfiles: ## generate all dockerfiles
	./bin/generate-dockerfiles.py

generate-deps-env: ## generate .env for dependencies
	./bin/generate-deps-env.py | tee ./src/.env.dist

generate-fossa-deps: ## regenerate fossa-deps.yml from src/.env.dist
	./bin/generate-fossa-deps.py

ENTRYPOINT_FILES=src/10-listen-on-ipv6-by-default.sh src/15-local-resolvers.envsh src/20-envsubst-on-templates.sh src/30-tune-worker-processes.sh src/docker-entrypoint.sh
ENTRYPOINT_CHECKSUMS=src/entrypoint-checksums.sha256

pull-nginx-entrypoints: ## retrieves the official entrypoint files (from mainline)
	@# Verify existing entrypoint integrity before replacing (detect tampering)
	@if [ -f "$(ENTRYPOINT_CHECKSUMS)" ]; then \
		echo "=== Verifying existing entrypoint checksums ===" ; \
		if ! sha256sum -c "$(ENTRYPOINT_CHECKSUMS)"; then \
			echo "ERROR: Entrypoint files have been tampered with since last update"; \
			exit 1; \
		fi; \
		echo "=== Existing checksums OK ===" ; \
	fi
	@# Require a tagged release - never fall back to master/main to prevent supply chain attacks
	HTTP_CODE=$$(curl --write-out '%{http_code}' --silent --output /dev/null $(NGINX_UPSTREAM_URL)/releases/tag/$(UPSTREAM_NGINX_VER_MAINLINE)); \
	if [ "$$HTTP_CODE" != "200" ]; then \
		echo "ERROR: Upstream tag $(UPSTREAM_NGINX_VER_MAINLINE) not found (HTTP $$HTTP_CODE). Refusing to fall back to master."; \
		exit 1; \
	fi; \
	USE_VERSION=$(UPSTREAM_NGINX_VER_MAINLINE); \
	ENTRYPOINT_BASE="$(NGINX_UPSTREAM_RAW_FILES)/$${USE_VERSION}/entrypoint"; \
	./bin/download-and-verify.sh "$${ENTRYPOINT_BASE}/10-listen-on-ipv6-by-default.sh" src/10-listen-on-ipv6-by-default.sh; \
	./bin/download-and-verify.sh "$${ENTRYPOINT_BASE}/15-local-resolvers.envsh"        src/15-local-resolvers.envsh; \
	./bin/download-and-verify.sh "$${ENTRYPOINT_BASE}/20-envsubst-on-templates.sh"     src/20-envsubst-on-templates.sh; \
	./bin/download-and-verify.sh "$${ENTRYPOINT_BASE}/30-tune-worker-processes.sh"     src/30-tune-worker-processes.sh; \
	./bin/download-and-verify.sh "$${ENTRYPOINT_BASE}/docker-entrypoint.sh"            src/docker-entrypoint.sh; \
	patch src/docker-entrypoint.sh src/docker-entrypoint.sh.patch
	@# Generate checksums of final (post-patch) entrypoint files
	sha256sum $(ENTRYPOINT_FILES) > $(ENTRYPOINT_CHECKSUMS)
	@echo "=== Entrypoint checksums written to $(ENTRYPOINT_CHECKSUMS) ==="

generate-metadata: ## generate metadata for all OS docker images
	echo $(DISTROS) | xargs -n1 $(META_CMD)

update-tags: ## update docker tags file
	./bin/generate_tags.py | tee docs/TAGS.md

update-readme: ## update supported docker tags in readme
	./bin/update-readme.sh

benchmark: ## benchmark (wip)
	./bin/benchmark.sh

scan-image: ## scan a docker image for vulnerabilities (usage: make scan-image IMAGE=fabiocicerchia/nginx-lua:latest)
	./bin/scan-vulnerabilities.sh "$(IMAGE)" "CRITICAL" "1"

sign-image: ## sign a docker image and attach SBOM (usage: make sign-image IMAGE=fabiocicerchia/nginx-lua:1.29.7-alpine3.23.3-amd64)
	./bin/sign-image.sh "$(IMAGE)"

sign-manifest: ## sign a multi-arch manifest list and attach per-platform SBOMs (usage: make sign-manifest IMAGE=fabiocicerchia/nginx-lua:latest)
	./bin/sign-manifest.sh "$(IMAGE)"

verify-image: ## verify a docker image signature and SBOM (usage: make verify-image IMAGE=fabiocicerchia/nginx-lua:latest)
	./bin/verify-image.sh "$(IMAGE)"

changelog: ## generate a changelog since previous tag
	./bin/generate-changelog.sh "$(GH_USERNAME)" "$(PREVIOUS_TAG)" "$(TAG_VER)"