Merge pull request #716 from infosiftr/more-github

Upgrade to `git ls-remote` for openssl releases
docker-library · Jul 31, 2024 · bcdd23c · bcdd23c
2 parents 4fb9e46 + fc362c9
commit bcdd23c
Show file tree

Hide file tree

Showing 9 changed files with 25 additions and 16 deletions.
diff --git a/3.12/alpine/Dockerfile b/3.12/alpine/Dockerfile
diff --git a/3.12/ubuntu/Dockerfile b/3.12/ubuntu/Dockerfile
diff --git a/3.13/alpine/Dockerfile b/3.13/alpine/Dockerfile
diff --git a/3.13/ubuntu/Dockerfile b/3.13/ubuntu/Dockerfile
diff --git a/4.0-rc/alpine/Dockerfile b/4.0-rc/alpine/Dockerfile
diff --git a/4.0-rc/ubuntu/Dockerfile b/4.0-rc/ubuntu/Dockerfile
diff --git a/Dockerfile-alpine.template b/Dockerfile-alpine.template
@@ -84,7 +84,7 @@ RUN set -eux; \
 # /usr/local/src doesn't exist in Alpine by default
 	mkdir -p /usr/local/src; \
 	\
-	OPENSSL_SOURCE_URL="https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz"; \
+	OPENSSL_SOURCE_URL="https://github.com/openssl/openssl/releases/download/openssl-$OPENSSL_VERSION/openssl-$OPENSSL_VERSION.tar.gz"; \
 	OPENSSL_PATH="/usr/local/src/openssl-$OPENSSL_VERSION"; \
 	OPENSSL_CONFIG_DIR="$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl"; \
 	\

diff --git a/Dockerfile-ubuntu.template b/Dockerfile-ubuntu.template
@@ -84,7 +84,7 @@ ENV OPENSSL_INSTALL_PATH_PREFIX /opt/openssl
 # gnupg: Required to verify OpenSSL artefacts
 # libncurses5-dev: Required for Erlang/OTP new shell & observer_cli - https://github.com/zhongwencool/observer_cli
 RUN set -eux; \
-	OPENSSL_SOURCE_URL="https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz"; \
+	OPENSSL_SOURCE_URL="https://github.com/openssl/openssl/releases/download/openssl-$OPENSSL_VERSION/openssl-$OPENSSL_VERSION.tar.gz"; \
 	OPENSSL_PATH="/usr/local/src/openssl-$OPENSSL_VERSION"; \
 	OPENSSL_CONFIG_DIR="$OPENSSL_INSTALL_PATH_PREFIX/etc/ssl"; \
 	\

diff --git a/versions.sh b/versions.sh
@@ -123,18 +123,27 @@ for version in "${versions[@]}"; do
 	export otpVersion otpSourceSha256
 
 	opensslMajor="${opensslMajors[$rcVersion]}"
-	opensslVersion="$(
-		wget -qO- 'https://www.openssl.org/source/' \
-			| grep -oE 'href="openssl-'"$opensslMajor"'[^"]+[.]tar[.]gz"' \
-			| sed -e 's/^href="openssl-//' -e 's/[.]tar[.]gz"//' \
-			| sort -uV \
-			| tail -1
-	)"
+	# grab versions from upstream and ignore any alpha/beta releases
+	opensslVersions=( $(
+	git ls-remote --tags https://github.com/openssl/openssl.git \
+			"refs/tags/openssl-$opensslMajor.*"\
+			| cut -d'/' -f3- \
+			| cut -d'^' -f1 \
+			| cut -d- -f2- \
+			| grep -vE -- '-[A-Za-z]+' \
+			| sort -urV
+	) )
+	opensslVersion=
+	for possibleVersion in "${opensslVersions[@]}"; do
+		if opensslSourceSha256="$(wget -qO- "https://github.com/openssl/openssl/releases/download/openssl-$possibleVersion/openssl-$possibleVersion.tar.gz.sha256")"; then
+			opensslVersion="$possibleVersion"
+			break
+		fi
+	done
 	if [ -z "$opensslVersion" ]; then
 		echo >&2 "warning: failed to get OpenSSL version for '$version' ($fullVersion); skipping"
 		continue
 	fi
-	opensslSourceSha256="$(wget -qO- "https://www.openssl.org/source/openssl-$opensslVersion.tar.gz.sha256")"
 	export opensslVersion opensslSourceSha256
 
 	# OpenSSL 3.0.5's sha256 file starts with a single space 😬