nginx: mainline=1.29.8, stable=1.28.3

https://nginx.org/en/security_advisories.html
https://nginx.org/en/CHANGES
https://nginx.org/en/CHANGES-1.28

Author: denji

mainline/Dockerfile

@@ -1,6 +1,6 @@
 FROM alpine:latest
 
-ENV NGINX_VERSION=1.29.5
+ENV NGINX_VERSION=1.29.8
 ENV LIBRESSL_VERSION=4.2.1
 
 # -----------------------------------------------------------------------------
@@ -108,33 +108,27 @@ RUN set -eux \
     && GPG_KEYS="43387825DDB1BB97EC36BA5D007C8D7C15D87369 A1EB079B8D3EB92B4EBD3139663AF51BD5E4D8D5" \
     && GNUPGHOME="$(mktemp -d)" \
     && export GNUPGHOME \
-    && found="" \
     && for server in \
            hkps://keys.openpgp.org \
            hkps://keyserver.ubuntu.com \
            hkp://ha.pool.sks-keyservers.net:80 \
            hkp://pgp.mit.edu:80 \
        ; do \
            echo "Fetching nginx GPG keys from ${server}"; \
-           for key in ${GPG_KEYS}; do \
-               gpg --keyserver "${server}" \
-                   --keyserver-options timeout=10 \
-                   --recv-keys "${key}" 2>/dev/null \
-               && found=yes \
-               || true; \
-           done; \
-           test "${found}" = yes && break || true; \
+           gpg --keyserver "${server}" \
+               --keyserver-options timeout=10 \
+               --recv-keys ${GPG_KEYS} 2>/dev/null \
+           && break || true; \
+       done \
+    \
+    # -- GPG: per-key fallback — always import NGINX key directly -------------
+    && curl -fsSL https://nginx.org/keys/nginx_signing.key | gpg --import \
+    \
+    # -- GPG: verify every required key is present in the keyring -------------
+    && for key in ${GPG_KEYS}; do \
+           gpg --list-keys "${key}" > /dev/null 2>&1 \
+           || { echo >&2 "ERROR: GPG key ${key} could not be fetched"; exit 1; }; \
        done \
-    && if [ -z "${found}" ]; then \
-           echo "Falling back to nginx.org key download"; \
-           curl -fsSL https://nginx.org/keys/nginx_signing.key -o nginx_signing.key \
-           && gpg --import nginx_signing.key \
-           && found=yes \
-           || true; \
-           rm -f nginx_signing.key; \
-       fi \
-    && test "${found}" = yes \
-       || { echo >&2 "ERROR: failed to fetch nginx GPG keys"; exit 1; } \
     \
     # -- Verify signatures -----------------------------------------------------
     && { gpg --batch --verify nginx.tar.gz.asc nginx.tar.gz \

mainline/Dockerfile.loongarch64

@@ -1,6 +1,6 @@
 FROM --platform=linux/loong64 loongarch64/alpine:3.21
 
-ENV NGINX_VERSION=1.29.5
+ENV NGINX_VERSION=1.29.8
 ENV LIBRESSL_VERSION=4.2.1
 
 # -----------------------------------------------------------------------------
@@ -108,33 +108,27 @@ RUN set -eux \
     && GPG_KEYS="43387825DDB1BB97EC36BA5D007C8D7C15D87369 A1EB079B8D3EB92B4EBD3139663AF51BD5E4D8D5" \
     && GNUPGHOME="$(mktemp -d)" \
     && export GNUPGHOME \
-    && found="" \
     && for server in \
            hkps://keys.openpgp.org \
            hkps://keyserver.ubuntu.com \
            hkp://ha.pool.sks-keyservers.net:80 \
            hkp://pgp.mit.edu:80 \
        ; do \
            echo "Fetching nginx GPG keys from ${server}"; \
-           for key in ${GPG_KEYS}; do \
-               gpg --keyserver "${server}" \
-                   --keyserver-options timeout=10 \
-                   --recv-keys "${key}" 2>/dev/null \
-               && found=yes \
-               || true; \
-           done; \
-           test "${found}" = yes && break || true; \
+           gpg --keyserver "${server}" \
+               --keyserver-options timeout=10 \
+               --recv-keys ${GPG_KEYS} 2>/dev/null \
+           && break || true; \
+       done \
+    \
+    # -- GPG: per-key fallback — always import NGINX key directly -------------
+    && curl -fsSL https://nginx.org/keys/nginx_signing.key | gpg --import \
+    \
+    # -- GPG: verify every required key is present in the keyring -------------
+    && for key in ${GPG_KEYS}; do \
+           gpg --list-keys "${key}" > /dev/null 2>&1 \
+           || { echo >&2 "ERROR: GPG key ${key} could not be fetched"; exit 1; }; \
        done \
-    && if [ -z "${found}" ]; then \
-           echo "Falling back to nginx.org key download"; \
-           curl -fsSL https://nginx.org/keys/nginx_signing.key -o nginx_signing.key \
-           && gpg --import nginx_signing.key \
-           && found=yes \
-           || true; \
-           rm -f nginx_signing.key; \
-       fi \
-    && test "${found}" = yes \
-       || { echo >&2 "ERROR: failed to fetch nginx GPG keys"; exit 1; } \
     \
     # -- Verify signatures -----------------------------------------------------
     && { gpg --batch --verify nginx.tar.gz.asc nginx.tar.gz \

mainline/Dockerfile.mips64le

@@ -1,6 +1,6 @@
 FROM --platform=linux/mips64le alpine:3.14
 
-ENV NGINX_VERSION=1.29.5
+ENV NGINX_VERSION=1.29.8
 ENV LIBRESSL_VERSION=4.2.1
 
 # -----------------------------------------------------------------------------
@@ -108,33 +108,27 @@ RUN set -eux \
     && GPG_KEYS="43387825DDB1BB97EC36BA5D007C8D7C15D87369 A1EB079B8D3EB92B4EBD3139663AF51BD5E4D8D5" \
     && GNUPGHOME="$(mktemp -d)" \
     && export GNUPGHOME \
-    && found="" \
     && for server in \
            hkps://keys.openpgp.org \
            hkps://keyserver.ubuntu.com \
            hkp://ha.pool.sks-keyservers.net:80 \
            hkp://pgp.mit.edu:80 \
        ; do \
            echo "Fetching nginx GPG keys from ${server}"; \
-           for key in ${GPG_KEYS}; do \
-               gpg --keyserver "${server}" \
-                   --keyserver-options timeout=10 \
-                   --recv-keys "${key}" 2>/dev/null \
-               && found=yes \
-               || true; \
-           done; \
-           test "${found}" = yes && break || true; \
+           gpg --keyserver "${server}" \
+               --keyserver-options timeout=10 \
+               --recv-keys ${GPG_KEYS} 2>/dev/null \
+           && break || true; \
+       done \
+    \
+    # -- GPG: per-key fallback — always import NGINX key directly -------------
+    && curl -fsSL https://nginx.org/keys/nginx_signing.key | gpg --import \
+    \
+    # -- GPG: verify every required key is present in the keyring -------------
+    && for key in ${GPG_KEYS}; do \
+           gpg --list-keys "${key}" > /dev/null 2>&1 \
+           || { echo >&2 "ERROR: GPG key ${key} could not be fetched"; exit 1; }; \
        done \
-    && if [ -z "${found}" ]; then \
-           echo "Falling back to nginx.org key download"; \
-           curl -fsSL https://nginx.org/keys/nginx_signing.key -o nginx_signing.key \
-           && gpg --import nginx_signing.key \
-           && found=yes \
-           || true; \
-           rm -f nginx_signing.key; \
-       fi \
-    && test "${found}" = yes \
-       || { echo >&2 "ERROR: failed to fetch nginx GPG keys"; exit 1; } \
     \
     # -- Verify signatures -----------------------------------------------------
     && { gpg --batch --verify nginx.tar.gz.asc nginx.tar.gz \

stable/Dockerfile

@@ -1,6 +1,6 @@
 FROM alpine:latest
 
-ENV NGINX_VERSION=1.28.2
+ENV NGINX_VERSION=1.28.3
 ENV LIBRESSL_VERSION=4.2.1
 
 # -----------------------------------------------------------------------------
@@ -108,33 +108,27 @@ RUN set -eux \
     && GPG_KEYS="43387825DDB1BB97EC36BA5D007C8D7C15D87369 A1EB079B8D3EB92B4EBD3139663AF51BD5E4D8D5" \
     && GNUPGHOME="$(mktemp -d)" \
     && export GNUPGHOME \
-    && found="" \
     && for server in \
            hkps://keys.openpgp.org \
            hkps://keyserver.ubuntu.com \
            hkp://ha.pool.sks-keyservers.net:80 \
            hkp://pgp.mit.edu:80 \
        ; do \
            echo "Fetching nginx GPG keys from ${server}"; \
-           for key in ${GPG_KEYS}; do \
-               gpg --keyserver "${server}" \
-                   --keyserver-options timeout=10 \
-                   --recv-keys "${key}" 2>/dev/null \
-               && found=yes \
-               || true; \
-           done; \
-           test "${found}" = yes && break || true; \
+           gpg --keyserver "${server}" \
+               --keyserver-options timeout=10 \
+               --recv-keys ${GPG_KEYS} 2>/dev/null \
+           && break || true; \
+       done \
+    \
+    # -- GPG: per-key fallback — always import NGINX key directly -------------
+    && curl -fsSL https://nginx.org/keys/nginx_signing.key | gpg --import \
+    \
+    # -- GPG: verify every required key is present in the keyring -------------
+    && for key in ${GPG_KEYS}; do \
+           gpg --list-keys "${key}" > /dev/null 2>&1 \
+           || { echo >&2 "ERROR: GPG key ${key} could not be fetched"; exit 1; }; \
        done \
-    && if [ -z "${found}" ]; then \
-           echo "Falling back to nginx.org key download"; \
-           curl -fsSL https://nginx.org/keys/nginx_signing.key -o nginx_signing.key \
-           && gpg --import nginx_signing.key \
-           && found=yes \
-           || true; \
-           rm -f nginx_signing.key; \
-       fi \
-    && test "${found}" = yes \
-       || { echo >&2 "ERROR: failed to fetch nginx GPG keys"; exit 1; } \
     \
     # -- Verify signatures -----------------------------------------------------
     && { gpg --batch --verify nginx.tar.gz.asc nginx.tar.gz \

stable/Dockerfile.loongarch64

@@ -1,6 +1,6 @@
 FROM --platform=linux/loong64 loongarch64/alpine:3.21
 
-ENV NGINX_VERSION=1.28.2
+ENV NGINX_VERSION=1.28.3
 ENV LIBRESSL_VERSION=4.2.1
 
 # -----------------------------------------------------------------------------
@@ -108,33 +108,27 @@ RUN set -eux \
     && GPG_KEYS="43387825DDB1BB97EC36BA5D007C8D7C15D87369 A1EB079B8D3EB92B4EBD3139663AF51BD5E4D8D5" \
     && GNUPGHOME="$(mktemp -d)" \
     && export GNUPGHOME \
-    && found="" \
     && for server in \
            hkps://keys.openpgp.org \
            hkps://keyserver.ubuntu.com \
            hkp://ha.pool.sks-keyservers.net:80 \
            hkp://pgp.mit.edu:80 \
        ; do \
            echo "Fetching nginx GPG keys from ${server}"; \
-           for key in ${GPG_KEYS}; do \
-               gpg --keyserver "${server}" \
-                   --keyserver-options timeout=10 \
-                   --recv-keys "${key}" 2>/dev/null \
-               && found=yes \
-               || true; \
-           done; \
-           test "${found}" = yes && break || true; \
+           gpg --keyserver "${server}" \
+               --keyserver-options timeout=10 \
+               --recv-keys ${GPG_KEYS} 2>/dev/null \
+           && break || true; \
+       done \
+    \
+    # -- GPG: per-key fallback — always import NGINX key directly -------------
+    && curl -fsSL https://nginx.org/keys/nginx_signing.key | gpg --import \
+    \
+    # -- GPG: verify every required key is present in the keyring -------------
+    && for key in ${GPG_KEYS}; do \
+           gpg --list-keys "${key}" > /dev/null 2>&1 \
+           || { echo >&2 "ERROR: GPG key ${key} could not be fetched"; exit 1; }; \
        done \
-    && if [ -z "${found}" ]; then \
-           echo "Falling back to nginx.org key download"; \
-           curl -fsSL https://nginx.org/keys/nginx_signing.key -o nginx_signing.key \
-           && gpg --import nginx_signing.key \
-           && found=yes \
-           || true; \
-           rm -f nginx_signing.key; \
-       fi \
-    && test "${found}" = yes \
-       || { echo >&2 "ERROR: failed to fetch nginx GPG keys"; exit 1; } \
     \
     # -- Verify signatures -----------------------------------------------------
     && { gpg --batch --verify nginx.tar.gz.asc nginx.tar.gz \

stable/Dockerfile.mips64le

@@ -1,6 +1,6 @@
 FROM --platform=linux/mips64le alpine:3.14
 
-ENV NGINX_VERSION=1.28.2
+ENV NGINX_VERSION=1.28.3
 ENV LIBRESSL_VERSION=4.2.1
 
 # -----------------------------------------------------------------------------
@@ -108,33 +108,27 @@ RUN set -eux \
     && GPG_KEYS="43387825DDB1BB97EC36BA5D007C8D7C15D87369 A1EB079B8D3EB92B4EBD3139663AF51BD5E4D8D5" \
     && GNUPGHOME="$(mktemp -d)" \
     && export GNUPGHOME \
-    && found="" \
     && for server in \
            hkps://keys.openpgp.org \
            hkps://keyserver.ubuntu.com \
            hkp://ha.pool.sks-keyservers.net:80 \
            hkp://pgp.mit.edu:80 \
        ; do \
            echo "Fetching nginx GPG keys from ${server}"; \
-           for key in ${GPG_KEYS}; do \
-               gpg --keyserver "${server}" \
-                   --keyserver-options timeout=10 \
-                   --recv-keys "${key}" 2>/dev/null \
-               && found=yes \
-               || true; \
-           done; \
-           test "${found}" = yes && break || true; \
+           gpg --keyserver "${server}" \
+               --keyserver-options timeout=10 \
+               --recv-keys ${GPG_KEYS} 2>/dev/null \
+           && break || true; \
+       done \
+    \
+    # -- GPG: per-key fallback — always import NGINX key directly -------------
+    && curl -fsSL https://nginx.org/keys/nginx_signing.key | gpg --import \
+    \
+    # -- GPG: verify every required key is present in the keyring -------------
+    && for key in ${GPG_KEYS}; do \
+           gpg --list-keys "${key}" > /dev/null 2>&1 \
+           || { echo >&2 "ERROR: GPG key ${key} could not be fetched"; exit 1; }; \
        done \
-    && if [ -z "${found}" ]; then \
-           echo "Falling back to nginx.org key download"; \
-           curl -fsSL https://nginx.org/keys/nginx_signing.key -o nginx_signing.key \
-           && gpg --import nginx_signing.key \
-           && found=yes \
-           || true; \
-           rm -f nginx_signing.key; \
-       fi \
-    && test "${found}" = yes \
-       || { echo >&2 "ERROR: failed to fetch nginx GPG keys"; exit 1; } \
     \
     # -- Verify signatures -----------------------------------------------------
     && { gpg --batch --verify nginx.tar.gz.asc nginx.tar.gz \