Skip to content

Commit ac4cabb

Browse files
dzuelkedzuelke
authored
Update to Nginx 1.26, link against system images, strip nginx binary. (#122)
* clean up configure options list handling * Link against system PCRE Absolutely no need to compile this ourselves. Because we have always built a custom libpcre3 (v8.x) and not the more modern PCRE2 (v10.x), we are enforcing usage of the old version for now. This is to ensure that existing configs with regexes continue to work, as PCRE2 is more aggressive in its pattern validation. To give a simple example, `/[\w-.]+/` now throws "Compilation failed: invalid range in character class at offset 3", and the `-` needs to be escaped, or moved to the end of the character class. * Link against system zlib * various little bash hardenings * Strip nginx binary We only need debug symbols in the nginx-debug variant. Together with the slight improvement from the now system-linked PCRE and zlib, this helps a lot with overall size. Before: % ls -la nginx-heroku-2*.tgz -rw-r--r-- 1 dzuelke staff 5638356 May 17 13:50 nginx-heroku-20.tgz -rw-r--r-- 1 dzuelke staff 4559004 May 17 13:50 nginx-heroku-22.tgz % tar tzvf nginx-heroku-20.tgz -rw-r--r-- 0 root root 5349 Feb 21 01:58 ./mime.types -rwxr-xr-x 0 root root 6705408 Feb 21 01:58 ./nginx -rwxr-xr-x 0 root root 6870296 Feb 21 01:58 ./nginx-debug % tar tzvf nginx-heroku-22.tgz -rw-r--r-- 0 root root 5349 Feb 21 02:00 ./mime.types -rwxr-xr-x 0 root root 4937400 Feb 21 02:00 ./nginx -rwxr-xr-x 0 root root 5094584 Feb 21 02:00 ./nginx-debug After: % ls -la nginx-heroku-2*.tgz -rw-r--r-- 1 dzuelke staff 3181649 May 17 13:51 nginx-heroku-20.tgz -rw-r--r-- 1 dzuelke staff 2638964 May 17 13:51 nginx-heroku-22.tgz % tar tzvf nginx-heroku-20.tgz -rw-r--r-- 0 root root 5349 May 17 13:30 ./mime.types -rwxr-xr-x 0 root root 973624 May 17 13:30 ./nginx -rwxr-xr-x 0 root root 6746392 May 17 13:30 ./nginx-debug % tar tzvf nginx-heroku-22.tgz -rw-r--r-- 0 root root 5349 May 17 13:30 ./mime.types -rwxr-xr-x 0 root root 973592 May 17 13:30 ./nginx -rwxr-xr-x 0 root root 4974032 May 17 13:30 ./nginx-debug * Update nginx to 1.26.0 (latest stable) Also update headers-more-nginx-module to the latest 0.37 and pin nginx-uuid4-module to specific commit SHA
1 parent ad3be4d commit ac4cabb

File tree

4 files changed

+38
-40
lines changed

4 files changed

+38
-40
lines changed

‎changelog.md

+4-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
88
### Changes
99
- [heroku-18] Removed
1010
- Add documentation for migrating from heroku-community/static buildpack
11-
- Update zlib from 1.2.13 to 1.3.1
11+
- Link against system libpcre3
12+
- Link against system zlib
13+
- Update nginx to 1.26.0
14+
- Update headers-more-nginx-module to 0.37
1215

1316
## [1.10] - 2023-06-13
1417
### Changes

‎nginx-heroku-20.tgz

-2.34 MB
Binary file not shown.

‎nginx-heroku-22.tgz

-1.83 MB
Binary file not shown.

‎scripts/build_nginx

+34-39
Original file line numberDiff line numberDiff line change
@@ -4,73 +4,68 @@
44
# image. More information on the Heroku Stack can be found
55
# at https://devcenter.heroku.com/articles/stack
66

7-
NGINX_VERSION=${NGINX_VERSION-1.25.1}
8-
PCRE_VERSION=${PCRE_VERSION-8.45}
9-
HEADERS_MORE_VERSION=${HEADERS_MORE_VERSION-0.34}
10-
ZLIB_VERSION=${ZLIB_VERSION-1.3.1}
11-
UUID4_VERSION=${UUID4_VERSION-master}
7+
# fail hard
8+
set -o pipefail
9+
# fail harder
10+
set -eu
11+
12+
NGINX_VERSION=${NGINX_VERSION-1.26.0}
13+
HEADERS_MORE_VERSION=${HEADERS_MORE_VERSION-0.37}
14+
UUID4_VERSION=${UUID4_VERSION-f8f7ff44e6a8c6cf75232ae4b63d011f2f3b34c1}
1215

1316
nginx_tarball_url=https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz
14-
pcre_tarball_url=https://ftp.exim.org/pub/pcre/pcre-${PCRE_VERSION}.tar.gz
1517
headers_more_nginx_module_url=https://github.com/openresty/headers-more-nginx-module/archive/v${HEADERS_MORE_VERSION}.tar.gz
1618
uuid4_url=https://github.com/cybozu/nginx-uuid4-module/archive/${UUID4_VERSION}.tar.gz
17-
zlib_url=http://zlib.net/zlib-${ZLIB_VERSION}.tar.gz
1819

1920
temp_dir=$(mktemp -d /tmp/nginx.XXXXXXXXXX)
2021

21-
cd $temp_dir
22-
echo "Temp dir: $temp_dir"
22+
trap popd EXIT
23+
pushd "$temp_dir"
2324

2425
echo "Downloading $nginx_tarball_url"
25-
curl -L $nginx_tarball_url | tar xzv
26-
27-
echo "Downloading $pcre_tarball_url"
28-
(cd nginx-${NGINX_VERSION} && curl -L $pcre_tarball_url | tar xvz )
26+
curl -sSL "$nginx_tarball_url" | tar xzv
2927

3028
echo "Downloading $headers_more_nginx_module_url"
31-
(cd nginx-${NGINX_VERSION} && curl -L $headers_more_nginx_module_url | tar xvz )
32-
33-
echo "Downloading $zlib_url"
34-
(cd nginx-${NGINX_VERSION} && curl -L $zlib_url | tar xvz )
29+
curl -sSL "$headers_more_nginx_module_url" | tar xvz -C "nginx-${NGINX_VERSION}"
3530

3631
echo "Downloading $uuid4_url"
37-
(cd nginx-${NGINX_VERSION} && curl -L $uuid4_url | tar xvz )
32+
curl -sSL "$uuid4_url" | tar xvz -C "nginx-${NGINX_VERSION}"
33+
34+
configure_opts=(
35+
--with-pcre
36+
--without-pcre2
37+
--with-http_gzip_static_module
38+
--with-http_realip_module
39+
--with-http_ssl_module
40+
--add-module="${temp_dir}/nginx-${NGINX_VERSION}/headers-more-nginx-module-${HEADERS_MORE_VERSION}"
41+
--add-module="${temp_dir}/nginx-${NGINX_VERSION}/nginx-uuid4-module-${UUID4_VERSION}"
42+
)
3843

3944
# This will build `nginx`
4045
(
41-
cd nginx-${NGINX_VERSION}
46+
cd "nginx-${NGINX_VERSION}"
4247
./configure \
43-
--with-pcre=pcre-${PCRE_VERSION} \
44-
--with-zlib=zlib-${ZLIB_VERSION} \
45-
--with-http_gzip_static_module \
46-
--with-http_realip_module \
47-
--with-http_ssl_module \
4848
--prefix=/tmp/nginx \
49-
--add-module=${temp_dir}/nginx-${NGINX_VERSION}/headers-more-nginx-module-${HEADERS_MORE_VERSION} \
50-
--add-module=${temp_dir}/nginx-${NGINX_VERSION}/nginx-uuid4-module-${UUID4_VERSION}
49+
"${configure_opts[@]}"
5150
make install
51+
# strip binary (but not the nginx-debug variant further down)
52+
find /tmp/nginx -type f \( -executable -o -name '*.a' \) -exec sh -c "file -i '{}' | grep -Eq 'application/x-(archive|(pie-)?executable|sharedlib); charset=binary'" \; -print | xargs strip --strip-unneeded
5253
)
5354

5455
# This will build `nginx-debug`
5556
(
56-
cd nginx-${NGINX_VERSION}
57+
cd "nginx-${NGINX_VERSION}"
5758
./configure \
5859
--with-debug \
59-
--with-pcre=pcre-${PCRE_VERSION} \
60-
--with-zlib=zlib-${ZLIB_VERSION} \
61-
--with-http_gzip_static_module \
62-
--with-http_realip_module \
63-
--with-http_ssl_module \
6460
--prefix=/tmp/nginx-debug \
65-
--add-module=${temp_dir}/nginx-${NGINX_VERSION}/headers-more-nginx-module-${HEADERS_MORE_VERSION} \
66-
--add-module=${temp_dir}/nginx-${NGINX_VERSION}/nginx-uuid4-module-${UUID4_VERSION}
61+
"${configure_opts[@]}"
6762
make install
6863
)
6964

7065
release_dir=$(mktemp -d /tmp/nginx.XXXXXXXXXX)
7166

72-
cp /tmp/nginx/sbin/nginx $release_dir/nginx
73-
cp /tmp/nginx-debug/sbin/nginx $release_dir/nginx-debug
74-
cp /tmp/nginx/conf/mime.types $release_dir/mime.types
75-
tar -zcvf /tmp/nginx-"${STACK}".tgz -C $release_dir .
76-
cp /tmp/nginx-"${STACK}".tgz $1
67+
cp /tmp/nginx/sbin/nginx "$release_dir/nginx"
68+
cp /tmp/nginx-debug/sbin/nginx "$release_dir/nginx-debug"
69+
cp /tmp/nginx/conf/mime.types "$release_dir/mime.types"
70+
tar -zcvf /tmp/nginx-"${STACK}".tgz -C "$release_dir" .
71+
cp /tmp/nginx-"${STACK}".tgz "$1"

0 commit comments

Comments
 (0)