Skip to content

Commit 5578ca2

Browse files
denjidenji
committed
Update to BoringSSL snapshot release 0.20260211.0
- optimize workflow with matrix strategy and conditional QEMU - fix GPG signature verification by adding actual signing key - replace hg.nginx.org clone with github mirror for njs
1 parent 2631558 commit 5578ca2

12 files changed

Lines changed: 1357 additions & 590 deletions

‎.github/workflows/docker-image.yml‎

Lines changed: 119 additions & 179 deletions
Original file line numberDiff line numberDiff line change
@@ -1,207 +1,147 @@
1-
name: Docker Image CI
1+
name: Docker Image CI (BoringSSL)
22

33
on:
44
push:
55
branches: [ main ]
66
paths-ignore:
77
- 'README.md'
88

9+
env:
10+
GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/nginx-boringssl
11+
DHUB_IMAGE: docker.io/denji/nginx-boringssl
12+
913
jobs:
10-
build-host-amd64v4:
11-
runs-on: ubuntu-latest
12-
steps:
13-
- name: Check Out Repo
14-
uses: actions/checkout@v4
15-
- name: Login to DockerHub
16-
uses: docker/login-action@v3
17-
with:
18-
username: ${{ secrets.DOCKERHUB_USERNAME }}
19-
password: ${{ secrets.DOCKERHUB_TOKEN }}
20-
- name: Build and push mainline/alpine (Linux x86_64-v4)
21-
uses: docker/build-push-action@v5
22-
with:
23-
context: ./
24-
file: mainline-alpine.Dockerfile
25-
push: true
26-
tags: docker.io/denji/nginx-boringssl:mainline-alpine
27-
cache-from: type=registry,ref=docker.io/denji/nginx-boringssl:mainline-alpine
28-
cache-to: type=inline
29-
- name: Build and push stable/alpine (Linux x86_64-v4)
30-
uses: docker/build-push-action@v5
31-
with:
32-
context: ./
33-
file: stable-alpine.Dockerfile
34-
push: true
35-
tags: docker.io/denji/nginx-boringssl:stable-alpine
36-
cache-from: type=registry,ref=docker.io/denji/nginx-boringssl:stable-alpine
37-
cache-to: type=inline
38-
build-qemu-arm64:
39-
runs-on: ubuntu-latest
14+
build:
15+
runs-on: ${{ matrix.runner }}
16+
strategy:
17+
fail-fast: false
18+
matrix:
19+
include:
20+
# --- native runners (no QEMU) ---
21+
- { platforms: linux/amd64, build_dir: mainline, dockerfile: Dockerfile, tag: mainline-amd64-alpine, runner: ubuntu-latest }
22+
- { platforms: linux/arm64, build_dir: mainline, dockerfile: Dockerfile, tag: mainline-aarch64-alpine, runner: ubuntu-24.04-arm }
23+
- { platforms: linux/amd64, build_dir: stable, dockerfile: Dockerfile, tag: stable-amd64-alpine, runner: ubuntu-latest }
24+
- { platforms: linux/arm64, build_dir: stable, dockerfile: Dockerfile, tag: stable-aarch64-alpine, runner: ubuntu-24.04-arm }
25+
26+
# --- QEMU on arm64 runner ---
27+
# arm/v7 and arm/v6: kernel compat layer (no TCG at all)
28+
- { platforms: linux/arm/v7, build_dir: mainline, dockerfile: Dockerfile, tag: mainline-armv7-alpine, runner: ubuntu-24.04-arm }
29+
- { platforms: linux/arm/v6, build_dir: mainline, dockerfile: Dockerfile, tag: mainline-armv6-alpine, runner: ubuntu-24.04-arm }
30+
- { platforms: linux/ppc64le, build_dir: mainline, dockerfile: Dockerfile, tag: mainline-ppc64le-alpine, runner: ubuntu-24.04-arm }
31+
- { platforms: linux/riscv64, build_dir: mainline, dockerfile: Dockerfile, tag: mainline-riscv64-alpine, runner: ubuntu-24.04-arm }
32+
- { platforms: linux/loong64, build_dir: mainline, dockerfile: Dockerfile.loongarch64, tag: mainline-loong64-alpine, runner: ubuntu-24.04-arm }
33+
#- { platforms: linux/mips64le, build_dir: mainline, dockerfile: Dockerfile.mips64le, tag: mainline-mips64le-alpine, runner: ubuntu-24.04-arm }
34+
- { platforms: linux/arm/v7, build_dir: stable, dockerfile: Dockerfile, tag: stable-armv7-alpine, runner: ubuntu-24.04-arm }
35+
- { platforms: linux/arm/v6, build_dir: stable, dockerfile: Dockerfile, tag: stable-armv6-alpine, runner: ubuntu-24.04-arm }
36+
- { platforms: linux/ppc64le, build_dir: stable, dockerfile: Dockerfile, tag: stable-ppc64le-alpine, runner: ubuntu-24.04-arm }
37+
- { platforms: linux/riscv64, build_dir: stable, dockerfile: Dockerfile, tag: stable-riscv64-alpine, runner: ubuntu-24.04-arm }
38+
- { platforms: linux/loong64, build_dir: stable, dockerfile: Dockerfile.loongarch64, tag: stable-loong64-alpine, runner: ubuntu-24.04-arm }
39+
#- { platforms: linux/mips64le, build_dir: stable, dockerfile: Dockerfile.mips64le, tag: stable-mips64le-alpine, runner: ubuntu-24.04-arm }
40+
41+
# --- QEMU on x86 runner ---
42+
# s390x: strong memory model (TSO-like) → needs x86 host for MTTCG
43+
# Pinned to ubuntu-22.04: QEMU segfault regression in ubuntu-24.04 >= 20250202.1.0
44+
# Track: https://github.com/actions/runner-images/issues/11662
45+
#- { platforms: linux/s390x, build_dir: mainline, dockerfile: Dockerfile, tag: mainline-s390x-alpine, runner: ubuntu-22.04 }
46+
#- { platforms: linux/s390x, build_dir: stable, dockerfile: Dockerfile, tag: stable-s390x-alpine, runner: ubuntu-22.04 }
47+
48+
permissions:
49+
contents: read
50+
packages: write
51+
4052
steps:
4153
- name: Check Out Repo
42-
uses: actions/checkout@v4
54+
uses: actions/checkout@v6
55+
4356
- name: Set up QEMU
57+
if: matrix.platforms != 'linux/amd64' && matrix.platforms != 'linux/arm64'
4458
uses: docker/setup-qemu-action@v3
59+
with:
60+
# qemu-v9.2.0-51+ required for loong64 support
61+
image: tonistiigi/binfmt:qemu-v10.1.3-60
62+
4563
- name: Set up Docker Buildx
4664
uses: docker/setup-buildx-action@v3
65+
66+
- name: Login to GHCR
67+
uses: docker/login-action@v3
68+
with:
69+
registry: ghcr.io
70+
username: ${{ github.actor }}
71+
password: ${{ secrets.GITHUB_TOKEN }}
72+
4773
- name: Login to DockerHub
4874
uses: docker/login-action@v3
4975
with:
5076
username: ${{ secrets.DOCKERHUB_USERNAME }}
5177
password: ${{ secrets.DOCKERHUB_TOKEN }}
52-
- name: Build and push mainline/alpine (Linux AArch64 - ARMv8)
53-
uses: docker/build-push-action@v5
54-
with:
55-
context: ./
56-
file: mainline-alpine.Dockerfile
57-
platforms: linux/arm64
58-
push: true
59-
tags: docker.io/denji/nginx-boringssl:mainline-aarch64-alpine
60-
cache-from: type=registry,ref=docker.io/denji/nginx-boringssl:mainline-aarch64-alpine
61-
cache-to: type=inline
62-
- name: Build and push stable/alpine (Linux AArch64 - ARMv8)
63-
uses: docker/build-push-action@v5
78+
79+
- name: Build and push ${{ matrix.tag }}
80+
uses: docker/build-push-action@v6
6481
with:
65-
context: ./
66-
file: stable-alpine.Dockerfile
67-
platforms: linux/arm64
82+
context: ${{ matrix.build_dir }}
83+
file: ${{ matrix.build_dir }}/${{ matrix.dockerfile }}
84+
platforms: ${{ matrix.platforms }}
6885
push: true
69-
tags: docker.io/denji/nginx-boringssl:stable-aarch64-alpine
70-
cache-from: type=registry,ref=docker.io/denji/nginx-boringssl:stable-aarch64-alpine
71-
cache-to: type=inline
72-
build-qemu-armv7:
86+
tags: |
87+
${{ env.GHCR_IMAGE }}:${{ matrix.tag }}
88+
${{ env.DHUB_IMAGE }}:${{ matrix.tag }}
89+
#cache-from: type=registry,ref=${{ env.GHCR_IMAGE }}:cache-${{ matrix.tag }}
90+
#cache-to: type=registry,ref=${{ env.GHCR_IMAGE }}:cache-${{ matrix.tag }},mode=max
91+
cache-from: type=gha,scope=${{ matrix.tag }}
92+
cache-to: type=gha,mode=max,scope=${{ matrix.tag }}
93+
94+
merge:
7395
runs-on: ubuntu-latest
96+
needs: build
97+
permissions:
98+
contents: read
99+
packages: write
74100
steps:
75-
- name: Check Out Repo
76-
uses: actions/checkout@v4
77-
- name: Set up QEMU
78-
uses: docker/setup-qemu-action@v3
79-
- name: Set up Docker Buildx
80-
uses: docker/setup-buildx-action@v3
101+
- name: Login to GHCR
102+
uses: docker/login-action@v3
103+
with:
104+
registry: ghcr.io
105+
username: ${{ github.actor }}
106+
password: ${{ secrets.GITHUB_TOKEN }}
107+
81108
- name: Login to DockerHub
82109
uses: docker/login-action@v3
83110
with:
84111
username: ${{ secrets.DOCKERHUB_USERNAME }}
85112
password: ${{ secrets.DOCKERHUB_TOKEN }}
86-
- name: Build and push mainline/alpine (Linux ARMv7 - 32-bit)
87-
uses: docker/build-push-action@v5
88-
with:
89-
context: ./
90-
file: mainline-alpine.Dockerfile
91-
platforms: linux/arm/v7
92-
push: true
93-
tags: docker.io/denji/nginx-boringssl:mainline-armv7-alpine
94-
cache-from: type=registry,ref=docker.io/denji/nginx-boringssl:mainline-armv7-alpine
95-
cache-to: type=inline
96-
- name: Build and push stable/alpine (Linux ARMv7 - 32-bit)
97-
uses: docker/build-push-action@v5
98-
with:
99-
context: ./
100-
file: stable-alpine.Dockerfile
101-
platforms: linux/arm/v7
102-
push: true
103-
tags: docker.io/denji/nginx-boringssl:stable-armv7-alpine
104-
cache-from: type=registry,ref=docker.io/denji/nginx-boringssl:stable-armv7-alpine
105-
cache-to: type=inline
106-
#build-qemu-armhf:
107-
# runs-on: ubuntu-latest
108-
# steps:
109-
# - name: Check Out Repo
110-
# uses: actions/checkout@v4
111-
# - name: Set up QEMU
112-
# uses: docker/setup-qemu-action@v3
113-
# - name: Set up Docker Buildx
114-
# uses: docker/setup-buildx-action@v3
115-
# - name: Login to DockerHub
116-
# uses: docker/login-action@v3
117-
# with:
118-
# username: ${{ secrets.DOCKERHUB_USERNAME }}
119-
# password: ${{ secrets.DOCKERHUB_TOKEN }}
120-
# - name: Build and push mainline/alpine (Linux armhf - 32-bit hard-float ABI ARMv6)
121-
# uses: docker/build-push-action@v5
122-
# with:
123-
# context: ./
124-
# file: mainline-alpine.Dockerfile
125-
# platforms: linux/arm/v6
126-
# push: true
127-
# tags: docker.io/denji/nginx-boringssl:mainline-armhf-alpine
128-
# cache-from: type=registry,ref=docker.io/denji/nginx-boringssl:mainline-armhf-alpine
129-
# cache-to: type=inline
130-
# - name: Build and push stable/alpine (Linux armhf - 32-bit hard-float ABI ARMv6)
131-
# uses: docker/build-push-action@v5
132-
# with:
133-
# context: ./
134-
# file: stable-alpine.Dockerfile
135-
# platforms: linux/arm/v6
136-
# push: true
137-
# tags: docker.io/denji/nginx-boringssl:stable-armhf-alpine
138-
# cache-from: type=registry,ref=docker.io/denji/nginx-boringssl:stable-armhf-alpine
139-
# cache-to: type=inline
140-
#build-qemu-s390x:
141-
# runs-on: ubuntu-latest
142-
# steps:
143-
# - name: Check Out Repo
144-
# uses: actions/checkout@v4
145-
# - name: Set up QEMU
146-
# uses: docker/setup-qemu-action@v3
147-
# - name: Set up Docker Buildx
148-
# uses: docker/setup-buildx-action@v3
149-
# - name: Login to DockerHub
150-
# uses: docker/login-action@v3
151-
# with:
152-
# username: ${{ secrets.DOCKERHUB_USERNAME }}
153-
# password: ${{ secrets.DOCKERHUB_TOKEN }}
154-
# - name: Build and push mainline/alpine (Linux s390x - IBM System Z Based)
155-
# uses: docker/build-push-action@v5
156-
# with:
157-
# context: ./
158-
# file: mainline-alpine.Dockerfile
159-
# platforms: linux/s390x
160-
# push: true
161-
# tags: docker.io/denji/nginx-boringssl:mainline-s390x-alpine
162-
# cache-from: type=registry,ref=docker.io/denji/nginx-boringssl:mainline-s390x-alpine
163-
# cache-to: type=inline
164-
# - name: Build and push stable/alpine (Linux s390x - IBM System Z Based)
165-
# uses: docker/build-push-action@v5
166-
# with:
167-
# context: ./
168-
# file: stable-alpine.Dockerfile
169-
# platforms: linux/s390x
170-
# push: true
171-
# tags: docker.io/denji/nginx-boringssl:stable-s390x-alpine
172-
# cache-from: type=registry,ref=docker.io/denji/nginx-boringssl:stable-s390x-alpine
173-
# cache-to: type=inline
174-
#build-qemu-ppc64le:
175-
# runs-on: ubuntu-latest
176-
# steps:
177-
# - name: Check Out Repo
178-
# uses: actions/checkout@v4
179-
# - name: Set up QEMU
180-
# uses: docker/setup-qemu-action@v3
181-
# - name: Set up Docker Buildx
182-
# uses: docker/setup-buildx-action@v3
183-
# - name: Login to DockerHub
184-
# uses: docker/login-action@v3
185-
# with:
186-
# username: ${{ secrets.DOCKERHUB_USERNAME }}
187-
# password: ${{ secrets.DOCKERHUB_TOKEN }}
188-
# - name: Build and push mainline/alpine (Linux ppc64le - 64-bit PowerPC little-endian)
189-
# uses: docker/build-push-action@v5
190-
# with:
191-
# context: ./
192-
# file: mainline-alpine.Dockerfile
193-
# platforms: linux/ppc64le
194-
# push: true
195-
# tags: docker.io/denji/nginx-boringssl:mainline-ppc64le-alpine
196-
# cache-from: type=registry,ref=docker.io/denji/nginx-boringssl:mainline-ppc64le-alpine
197-
# cache-to: type=inline
198-
# - name: Build and push stable/alpine (Linux ppc64le - 64-bit PowerPC little-endian)
199-
# uses: docker/build-push-action@v5
200-
# with:
201-
# context: ./
202-
# file: stable-alpine.Dockerfile
203-
# platforms: linux/ppc64le
204-
# push: true
205-
# tags: docker.io/denji/nginx-boringssl:stable-ppc64le-alpine
206-
# cache-from: type=registry,ref=docker.io/denji/nginx-boringssl:stable-ppc64le-alpine
207-
# cache-to: type=inline
113+
114+
- name: Set up Docker Buildx
115+
uses: docker/setup-buildx-action@v3
116+
117+
- name: Merge and push mainline-alpine manifest
118+
run: |
119+
docker buildx imagetools create -t ${{ env.GHCR_IMAGE }}:mainline-alpine \
120+
${{ env.GHCR_IMAGE }}:mainline-amd64-alpine \
121+
${{ env.GHCR_IMAGE }}:mainline-aarch64-alpine \
122+
${{ env.GHCR_IMAGE }}:mainline-armv7-alpine \
123+
${{ env.GHCR_IMAGE }}:mainline-armv6-alpine \
124+
${{ env.GHCR_IMAGE }}:mainline-ppc64le-alpine \
125+
${{ env.GHCR_IMAGE }}:mainline-riscv64-alpine \
126+
${{ env.GHCR_IMAGE }}:mainline-loong64-alpine
127+
# ${{ env.GHCR_IMAGE }}:mainline-s390x-alpine
128+
# ${{ env.GHCR_IMAGE }}:mainline-mips64le-alpine
129+
130+
docker buildx imagetools create -t ${{ env.DHUB_IMAGE }}:mainline-alpine \
131+
${{ env.GHCR_IMAGE }}:mainline-alpine
132+
133+
- name: Merge and push stable-alpine manifest
134+
run: |
135+
docker buildx imagetools create -t ${{ env.GHCR_IMAGE }}:stable-alpine \
136+
${{ env.GHCR_IMAGE }}:stable-amd64-alpine \
137+
${{ env.GHCR_IMAGE }}:stable-aarch64-alpine \
138+
${{ env.GHCR_IMAGE }}:stable-armv7-alpine \
139+
${{ env.GHCR_IMAGE }}:stable-armv6-alpine \
140+
${{ env.GHCR_IMAGE }}:stable-ppc64le-alpine \
141+
${{ env.GHCR_IMAGE }}:stable-riscv64-alpine \
142+
${{ env.GHCR_IMAGE }}:stable-loong64-alpine
143+
# ${{ env.GHCR_IMAGE }}:stable-s390x-alpine
144+
# ${{ env.GHCR_IMAGE }}:stable-mips64le-alpine
145+
146+
docker buildx imagetools create -t ${{ env.DHUB_IMAGE }}:stable-alpine \
147+
${{ env.GHCR_IMAGE }}:stable-alpine

0 commit comments

Comments
 (0)