Bot Updating Package Versions

fix zerossl cert revocation

.github/workflows/external_trigger.yml

@@ -12,17 +12,20 @@ jobs:
       - name: External Trigger
         if: github.ref == 'refs/heads/master'
         run: |
+          printf "# External trigger for docker-swag\n\n" >> $GITHUB_STEP_SUMMARY
           if [ -n "${{ secrets.PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER }}" ]; then
-            echo "**** Github secret PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER is set; skipping trigger. ****"
+            echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
-            echo "Github secret \`PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER\` is set; skipping trigger." >> $GITHUB_STEP_SUMMARY
+            echo "> Github secret \`PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER\` is set; skipping trigger." >> $GITHUB_STEP_SUMMARY
             exit 0
           fi
-          echo "**** External trigger running off of master branch. To disable this trigger, set a Github secret named \"PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER\". ****"
+          echo "> [!NOTE]" >> $GITHUB_STEP_SUMMARY
-          echo "External trigger running off of master branch. To disable this trigger, set a Github secret named \`PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER\`" >> $GITHUB_STEP_SUMMARY
+          echo "> External trigger running off of master branch. To disable this trigger, set a Github secret named \`PAUSE_EXTERNAL_TRIGGER_SWAG_MASTER\`" >> $GITHUB_STEP_SUMMARY
-          echo "**** Retrieving external version ****"
+          printf "\n## Retrieving external version\n\n" >> $GITHUB_STEP_SUMMARY
           EXT_RELEASE=$(curl -sL "https://pypi.python.org/pypi/certbot/json" |jq -r '. | .info.version')
+          echo "Type is \`pip_version\`" >> $GITHUB_STEP_SUMMARY
           if [ -z "${EXT_RELEASE}" ] || [ "${EXT_RELEASE}" == "null" ]; then
-            echo "**** Can't retrieve external version, exiting ****"
+            echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+            echo "> Can't retrieve external version, exiting" >> $GITHUB_STEP_SUMMARY
             FAILURE_REASON="Can't retrieve external version for swag branch master"
             GHA_TRIGGER_URL="https://github.com/linuxserver/docker-swag/actions/runs/${{ github.run_id }}"
             curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 16711680,
@@ -31,9 +34,8 @@ jobs:
             exit 1
           fi
           EXT_RELEASE=$(echo ${EXT_RELEASE} | sed 's/[~,%@+;:/]//g')
-          echo "**** External version: ${EXT_RELEASE} ****"
+          echo "External version: \`${EXT_RELEASE}\`" >> $GITHUB_STEP_SUMMARY
-          echo "External version: ${EXT_RELEASE}" >> $GITHUB_STEP_SUMMARY
+          echo "Retrieving last pushed version" >> $GITHUB_STEP_SUMMARY
-          echo "**** Retrieving last pushed version ****"
           image="linuxserver/swag"
           tag="latest"
           token=$(curl -sX GET \
@@ -60,37 +62,34 @@ jobs:
           IMAGE_RELEASE=$(echo ${image_info} | jq -r '.Labels.build_version' | awk '{print $3}')
           IMAGE_VERSION=$(echo ${IMAGE_RELEASE} | awk -F'-ls' '{print $1}')
           if [ -z "${IMAGE_VERSION}" ]; then
-            echo "**** Can't retrieve last pushed version, exiting ****"
+            echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+            echo "Can't retrieve last pushed version, exiting" >> $GITHUB_STEP_SUMMARY
             FAILURE_REASON="Can't retrieve last pushed version for swag tag latest"
             curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 16711680,
               "description": "**Trigger Failed** \n**Reason:** '"${FAILURE_REASON}"' \n"}],
               "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
             exit 1
           fi
-          echo "**** Last pushed version: ${IMAGE_VERSION} ****"
+          echo "Last pushed version: \`${IMAGE_VERSION}\`" >> $GITHUB_STEP_SUMMARY
-          echo "Last pushed version: ${IMAGE_VERSION}" >> $GITHUB_STEP_SUMMARY
           if [ "${EXT_RELEASE}" == "${IMAGE_VERSION}" ]; then
-            echo "**** Version ${EXT_RELEASE} already pushed, exiting ****"
+            echo "Version \`${EXT_RELEASE}\` already pushed, exiting" >> $GITHUB_STEP_SUMMARY
-            echo "Version ${EXT_RELEASE} already pushed, exiting" >> $GITHUB_STEP_SUMMARY
             exit 0
           elif [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/lastBuild/api/json | jq -r '.building') == "true" ]; then
-            echo "**** New version ${EXT_RELEASE} found; but there already seems to be an active build on Jenkins; exiting ****"
+            echo "New version \`${EXT_RELEASE}\` found; but there already seems to be an active build on Jenkins; exiting" >> $GITHUB_STEP_SUMMARY
-            echo "New version ${EXT_RELEASE} found; but there already seems to be an active build on Jenkins; exiting" >> $GITHUB_STEP_SUMMARY
             exit 0
           else
-            echo "**** New version ${EXT_RELEASE} found; old version was ${IMAGE_VERSION}. Triggering new build ****"
+            printf "\n## Trigger new build\n\n" >> $GITHUB_STEP_SUMMARY
-            echo "New version ${EXT_RELEASE} found; old version was ${IMAGE_VERSION}. Triggering new build" >> $GITHUB_STEP_SUMMARY
+            echo "New version \`${EXT_RELEASE}\` found; old version was \`${IMAGE_VERSION}\`. Triggering new build" >> $GITHUB_STEP_SUMMARY
             response=$(curl -iX POST \
               https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/buildWithParameters?PACKAGE_CHECK=false \
               --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
-            echo "**** Jenkins job queue url: ${response%$'\r'} ****"
+            echo "Jenkins [job queue url](${response%$'\r'})" >> $GITHUB_STEP_SUMMARY
-            echo "**** Sleeping 10 seconds until job starts ****"
+            echo "Sleeping 10 seconds until job starts" >> $GITHUB_STEP_SUMMARY
             sleep 10
             buildurl=$(curl -s "${response%$'\r'}api/json" | jq -r '.executable.url')
             buildurl="${buildurl%$'\r'}"
-            echo "**** Jenkins job build url: ${buildurl} ****"
+            echo "Jenkins job [build url](${buildurl})" >> $GITHUB_STEP_SUMMARY
-            echo "Jenkins job build url: ${buildurl}" >> $GITHUB_STEP_SUMMARY
+            echo "Attempting to change the Jenkins job description" >> $GITHUB_STEP_SUMMARY
-            echo "**** Attempting to change the Jenkins job description ****"
             curl -iX POST \
               "${buildurl}submitDescription" \
               --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \

.github/workflows/external_trigger_scheduler.yml

@@ -15,31 +15,31 @@ jobs:
 
       - name: External Trigger Scheduler
         run: |
-          echo "**** Branches found: ****"
+          printf "# External trigger scheduler for docker-swag\n\n" >> $GITHUB_STEP_SUMMARY
-          git for-each-ref --format='%(refname:short)' refs/remotes
+          printf "Found the branches:\n\n%s\n" "$(git for-each-ref --format='- %(refname:lstrip=3)' refs/remotes)" >> $GITHUB_STEP_SUMMARY
-          for br in $(git for-each-ref --format='%(refname:short)' refs/remotes)
+          for br in $(git for-each-ref --format='%(refname:lstrip=3)' refs/remotes)
           do
-            br=$(echo "$br" | sed 's|origin/||g')
+            if [[ "${br}" == "HEAD" ]]; then
-            echo "**** Evaluating branch ${br} ****"
+              printf "\nSkipping %s.\n" ${br} >> $GITHUB_STEP_SUMMARY
+              continue
+            fi
+            printf "\n## Evaluating \`%s\`\n\n" ${br} >> $GITHUB_STEP_SUMMARY
             ls_jenkins_vars=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/jenkins-vars.yml)
             ls_branch=$(echo "${ls_jenkins_vars}" | yq -r '.ls_branch')
             ls_trigger=$(echo "${ls_jenkins_vars}" | yq -r '.external_type')
             if [[ "${br}" == "${ls_branch}" ]] && [[ "${ls_trigger}" != "os" ]]; then
-              echo "**** Branch ${br} appears to be live and trigger is not os; checking workflow. ****"
+              echo "Branch appears to be live and trigger is not os; checking workflow." >> $GITHUB_STEP_SUMMARY
               if curl -sfX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/.github/workflows/external_trigger.yml > /dev/null 2>&1; then
-                echo "**** Workflow exists. Triggering external trigger workflow for branch ${br} ****."
+                echo "Triggering external trigger workflow for branch." >> $GITHUB_STEP_SUMMARY
-                echo "Triggering external trigger workflow for branch ${br}" >> $GITHUB_STEP_SUMMARY
                 curl -iX POST \
                   -H "Authorization: token ${{ secrets.CR_PAT }}" \
                   -H "Accept: application/vnd.github.v3+json" \
                   -d "{\"ref\":\"refs/heads/${br}\"}" \
                   https://api.github.com/repos/linuxserver/docker-swag/actions/workflows/external_trigger.yml/dispatches
               else
-                echo "**** Workflow doesn't exist; skipping trigger. ****"
+                echo "Skipping branch due to no external trigger workflow present." >> $GITHUB_STEP_SUMMARY
-                echo "Skipping branch ${br} due to no external trigger workflow present." >> $GITHUB_STEP_SUMMARY
               fi
             else
-              echo "**** ${br} is either a dev branch, or has no external version; skipping trigger. ****"
+              echo "Skipping branch due to being detected as dev branch or having no external version." >> $GITHUB_STEP_SUMMARY
-              echo "Skipping branch ${br} due to being detected as dev branch or having no external version." >> $GITHUB_STEP_SUMMARY
             fi
           done

.github/workflows/package_trigger.yml

@@ -12,29 +12,29 @@ jobs:
       - name: Package Trigger
         if: github.ref == 'refs/heads/master'
         run: |
+          printf "# Package trigger for docker-swag\n\n" >> $GITHUB_STEP_SUMMARY
           if [ -n "${{ secrets.PAUSE_PACKAGE_TRIGGER_SWAG_MASTER }}" ]; then
-            echo "**** Github secret PAUSE_PACKAGE_TRIGGER_SWAG_MASTER is set; skipping trigger. ****"
+            echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
-            echo "Github secret \`PAUSE_PACKAGE_TRIGGER_SWAG_MASTER\` is set; skipping trigger." >> $GITHUB_STEP_SUMMARY
+            echo "> Github secret \`PAUSE_PACKAGE_TRIGGER_SWAG_MASTER\` is set; skipping trigger." >> $GITHUB_STEP_SUMMARY
             exit 0
           fi
           if [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/lastBuild/api/json | jq -r '.building') == "true" ]; then
-            echo "**** There already seems to be an active build on Jenkins; skipping package trigger ****"
+            echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
-            echo "There already seems to be an active build on Jenkins; skipping package trigger" >> $GITHUB_STEP_SUMMARY
+            echo "> There already seems to be an active build on Jenkins; skipping package trigger" >> $GITHUB_STEP_SUMMARY
             exit 0
           fi
-          echo "**** Package trigger running off of master branch. To disable, set a Github secret named \"PAUSE_PACKAGE_TRIGGER_SWAG_MASTER\". ****"
+          echo "> [!NOTE]" >> $GITHUB_STEP_SUMMARY
-          echo "Package trigger running off of master branch. To disable, set a Github secret named \`PAUSE_PACKAGE_TRIGGER_SWAG_MASTER\`" >> $GITHUB_STEP_SUMMARY
+          echo "> Package trigger running off of master branch. To disable, set a Github secret named \`PAUSE_PACKAGE_TRIGGER_SWAG_MASTER\`" >> $GITHUB_STEP_SUMMARY
           response=$(curl -iX POST \
             https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/buildWithParameters?PACKAGE_CHECK=true \
             --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
-          echo "**** Jenkins job queue url: ${response%$'\r'} ****"
+          echo "Jenkins [job queue url](${response%$'\r'})" >> $GITHUB_STEP_SUMMARY
-          echo "**** Sleeping 10 seconds until job starts ****"
+          echo "Sleeping 10 seconds until job starts" >> $GITHUB_STEP_SUMMARY
           sleep 10
           buildurl=$(curl -s "${response%$'\r'}api/json" | jq -r '.executable.url')
           buildurl="${buildurl%$'\r'}"
-          echo "**** Jenkins job build url: ${buildurl} ****"
+          echo "Jenkins job [build url](${buildurl})" >> $GITHUB_STEP_SUMMARY
-          echo "Jenkins job build url: ${buildurl}" >> $GITHUB_STEP_SUMMARY
+          echo "Attempting to change the Jenkins job description" >> $GITHUB_STEP_SUMMARY
-          echo "**** Attempting to change the Jenkins job description ****"
           curl -iX POST \
             "${buildurl}submitDescription" \
             --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \

.github/workflows/package_trigger_scheduler.yml

@@ -15,17 +15,19 @@ jobs:
 
       - name: Package Trigger Scheduler
         run: |
-          echo "**** Branches found: ****"
+          printf "# Package trigger scheduler for docker-swag\n\n" >> $GITHUB_STEP_SUMMARY
-          git for-each-ref --format='%(refname:short)' refs/remotes
+          printf "Found the branches:\n\n%s\n" "$(git for-each-ref --format='- %(refname:lstrip=3)' refs/remotes)" >> $GITHUB_STEP_SUMMARY
-          for br in $(git for-each-ref --format='%(refname:short)' refs/remotes)
+          for br in $(git for-each-ref --format='%(refname:lstrip=3)' refs/remotes)
           do
-            br=$(echo "$br" | sed 's|origin/||g')
+            if [[ "${br}" == "HEAD" ]]; then
-            echo "**** Evaluating branch ${br} ****"
+              printf "\nSkipping %s.\n" ${br} >> $GITHUB_STEP_SUMMARY
+              continue
+            fi
+            printf "\n## Evaluating \`%s\`\n\n" ${br} >> $GITHUB_STEP_SUMMARY
             ls_branch=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/jenkins-vars.yml | yq -r '.ls_branch')
             if [ "${br}" == "${ls_branch}" ]; then
-              echo "**** Branch ${br} appears to be live; checking workflow. ****"
+              echo "Branch appears to be live; checking workflow." >> $GITHUB_STEP_SUMMARY
               if curl -sfX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/.github/workflows/package_trigger.yml > /dev/null 2>&1; then
-                echo "**** Workflow exists. Triggering package trigger workflow for branch ${br}. ****"
                 echo "Triggering package trigger workflow for branch ${br}" >> $GITHUB_STEP_SUMMARY
                 triggered_branches="${triggered_branches}${br} "
                 curl -iX POST \
@@ -35,11 +37,9 @@ jobs:
                   https://api.github.com/repos/linuxserver/docker-swag/actions/workflows/package_trigger.yml/dispatches
                 sleep 30
               else
-                echo "**** Workflow doesn't exist; skipping trigger. ****"
                 echo "Skipping branch ${br} due to no package trigger workflow present." >> $GITHUB_STEP_SUMMARY
               fi
             else
-              echo "**** ${br} appears to be a dev branch; skipping trigger. ****"
               echo "Skipping branch ${br} due to being detected as dev branch." >> $GITHUB_STEP_SUMMARY
             fi
           done

Jenkinsfile

@@ -17,6 +17,8 @@ pipeline {
     GITLAB_TOKEN=credentials('b6f0f1dd-6952-4cf6-95d1-9c06380283f0')
     GITLAB_NAMESPACE=credentials('gitlab-namespace-id')
     DOCKERHUB_TOKEN=credentials('docker-hub-ci-pat')
+    QUAYIO_API_TOKEN=credentials('quayio-repo-api-token')
+    GIT_SIGNING_KEY=credentials('484fbca6-9a4f-455e-b9e3-97ac98785f5f')
     EXT_PIP = 'certbot'
     BUILD_VERSION_ARG = 'CERTBOT_VERSION'
     LS_USER = 'linuxserver'
@@ -37,9 +39,23 @@ pipeline {
     CI_WEBPATH=''
   }
   stages {
+    stage("Set git config"){
+      steps{
+        sh '''#!/bin/bash
+              cat ${GIT_SIGNING_KEY} > /config/.ssh/id_sign
+              chmod 600 /config/.ssh/id_sign
+              ssh-keygen -y -f /config/.ssh/id_sign > /config/.ssh/id_sign.pub
+              echo "Using $(ssh-keygen -lf /config/.ssh/id_sign) to sign commits"
+              git config --global gpg.format ssh
+              git config --global user.signingkey /config/.ssh/id_sign
+              git config --global commit.gpgsign true
+        '''
+      }
+    }
     // Setup all the basic environment variables needed for the build
     stage("Set ENV Variables base"){
       steps{
+        echo "Running on node: ${NODE_NAME}"
         sh '''#! /bin/bash
               containers=$(docker ps -aq)
               if [[ -n "${containers}" ]]; then
@@ -381,9 +397,9 @@ pipeline {
                 echo "Updating Unraid template"
                 cd ${TEMPDIR}/unraid/templates/
                 GH_TEMPLATES_DEFAULT_BRANCH=$(git remote show origin | grep "HEAD branch:" | sed 's|.*HEAD branch: ||')
-                if grep -wq "${CONTAINER_NAME}" ${TEMPDIR}/unraid/templates/unraid/ignore.list && [[ -f ${TEMPDIR}/unraid/templates/unraid/deprecated/${CONTAINER_NAME}.xml ]]; then
+                if grep -wq "^${CONTAINER_NAME}$" ${TEMPDIR}/unraid/templates/unraid/ignore.list && [[ -f ${TEMPDIR}/unraid/templates/unraid/deprecated/${CONTAINER_NAME}.xml ]]; then
                   echo "Image is on the ignore list, and already in the deprecation folder."
-                elif grep -wq "${CONTAINER_NAME}" ${TEMPDIR}/unraid/templates/unraid/ignore.list; then
+                elif grep -wq "^${CONTAINER_NAME}$" ${TEMPDIR}/unraid/templates/unraid/ignore.list; then
                   echo "Image is on the ignore list, marking Unraid template as deprecated"
                   cp ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml ${TEMPDIR}/unraid/templates/unraid/
                   git add -u unraid/${CONTAINER_NAME}.xml
@@ -476,10 +492,10 @@ pipeline {
       }
     }
     /* #######################
-           GitLab Mirroring
+       GitLab Mirroring and Quay.io Repo Visibility
        ####################### */
-    // Ping into Gitlab to mirror this repo and have a registry endpoint
+    // Ping into Gitlab to mirror this repo and have a registry endpoint & mark this repo on Quay.io as public
-    stage("GitLab Mirror"){
+    stage("GitLab Mirror and Quay.io Visibility"){
       when {
         environment name: 'EXIT_STATUS', value: ''
       }
@@ -495,6 +511,8 @@ pipeline {
             "visibility":"public"}' '''
         sh '''curl -H "Private-Token: ${GITLAB_TOKEN}" -X PUT "https://gitlab.com/api/v4/projects/Linuxserver.io%2F${LS_REPO}" \
           -d "mirror=true&import_url=https://github.com/linuxserver/${LS_REPO}.git" '''
+        sh '''curl -H "Content-Type: application/json" -H "Authorization: Bearer ${QUAYIO_API_TOKEN}" -X POST "https://quay.io/api/v1/repository${QUAYIMAGE/quay.io/}/changevisibility" \
+          -d '{"visibility":"public"}' ||: '''
       } 
     }
     /* ###############
@@ -589,7 +607,7 @@ pipeline {
               --provenance=false --sbom=false \
               --build-arg ${BUILD_VERSION_ARG}=${EXT_RELEASE} --build-arg VERSION=\"${VERSION_TAG}\" --build-arg BUILD_DATE=${GITHUB_DATE} ."
             sh "docker tag ${IMAGE}:arm64v8-${META_TAG} ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}"
-            retry(5) {
+            retry_backoff(5,5) {
               sh "docker push ghcr.io/linuxserver/lsiodev-buildcache:arm64v8-${COMMIT_SHA}-${BUILD_NUMBER}"
             }
             sh '''#! /bin/bash
@@ -745,7 +763,7 @@ pipeline {
             passwordVariable: 'QUAYPASS'
           ]
         ]) {
-          retry(5) {
+          retry_backoff(5,5) {
             sh '''#! /bin/bash
                   set -e
                   echo $DOCKERHUB_TOKEN | docker login -u linuxserverci --password-stdin
@@ -763,7 +781,7 @@ pipeline {
                     docker push ${PUSHIMAGE}:${META_TAG}
                     docker push ${PUSHIMAGE}:${EXT_RELEASE_TAG}
                     if [ -n "${SEMVER}" ]; then
-                     docker push ${PUSHIMAGE}:${SEMVER}
+                      docker push ${PUSHIMAGE}:${SEMVER}
                     fi
                   done
                '''
@@ -786,7 +804,7 @@ pipeline {
             passwordVariable: 'QUAYPASS'
           ]
         ]) {
-          retry(5) {
+          retry_backoff(5,5) {
             sh '''#! /bin/bash
                   set -e
                   echo $DOCKERHUB_TOKEN | docker login -u linuxserverci --password-stdin
@@ -849,7 +867,7 @@ pipeline {
              "object": "'${COMMIT_SHA}'",\
              "message": "Tagging Release '${EXT_RELEASE_CLEAN}'-ls'${LS_TAG_NUMBER}' to master",\
              "type": "commit",\
-             "tagger": {"name": "LinuxServer Jenkins","email": "jenkins@linuxserver.io","date": "'${GITHUB_DATE}'"}}' '''
+             "tagger": {"name": "LinuxServer-CI","email": "ci@linuxserver.io","date": "'${GITHUB_DATE}'"}}' '''
         echo "Pushing New release for Tag"
         sh '''#! /bin/bash
               echo "Updating PIP version of ${EXT_PIP} to ${EXT_RELEASE_CLEAN}" > releasebody.json
@@ -981,6 +999,13 @@ EOF
      ###################### */
   post {
     always {
+      sh '''#!/bin/bash
+            rm -rf /config/.ssh/id_sign
+            rm -rf /config/.ssh/id_sign.pub
+            git config --global --unset gpg.format
+            git config --global --unset user.signingkey
+            git config --global --unset commit.gpgsign
+        '''
       script{
         if (env.EXIT_STATUS == "ABORTED"){
           sh 'echo "build aborted"'
@@ -1010,3 +1035,20 @@ EOF
     }
   }
 }
+
+def retry_backoff(int max_attempts, int power_base, Closure c) {
+  int n = 0
+  while (n < max_attempts) {
+    try {
+      c()
+      return
+    } catch (err) {
+      if ((n + 1) >= max_attempts) {
+        throw err
+      }
+      sleep(power_base ** n)
+      n++
+    }
+  }
+  return
+}

README.md

@@ -400,6 +400,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **30.08.24:** - Fix zerossl cert revocation.
 * **24.07.14:** - Rebase to Alpine 3.20. Remove deprecated Google Domains certbot plugin. Existing users should update their nginx confs to avoid http2 deprecation warnings.
 * **01.07.24:** - Fall back to iptables-legacy if iptables doesn't work.
 * **23.03.24:** - Fix perms on the generated `priv-fullchain-bundle.pem`.

package_versions.txt

@@ -21,8 +21,8 @@ azure-mgmt-dns                  8.1.0                  python
 backports-tarfile               1.2.0                  python                   
 bash                            5.2.26-r0              apk                      
 beautifulsoup4                  4.12.3                 python                   
-boto3                           1.34.158               python                   
+boto3                           1.35.10                python                   
-botocore                        1.34.158               python                   
+botocore                        1.35.10                python                   
 brotli-libs                     1.1.0-r2               apk                      
 bs4                             0.0.2                  python                   
 busybox                         1.36.1-r29             apk                      
@@ -31,7 +31,7 @@ c-ares                          1.28.1-r0              apk
 c-client                        2007f-r15              apk                      
 ca-certificates                 20240705-r0            apk                      
 ca-certificates-bundle          20240705-r0            apk                      
-cachetools                      5.4.0                  python                   
+cachetools                      5.5.0                  python                   
 catatonit                       0.2.0-r0               apk                      
 certbot                         2.11.0                 python                   
 certbot-dns-acmedns             0.1.0                  python                   
@@ -77,11 +77,11 @@ certbot-dns-standalone          1.1                    python
 certbot-dns-transip             0.5.2                  python                   
 certbot-dns-vultr               1.1.0                  python                   
 certbot-plugin-gandi            1.5.0                  python                   
-certifi                         2024.7.4               python                   
+certifi                         2024.8.30              python                   
 cffi                            1.17.0                 python                   
 charset-normalizer              3.3.2                  python                   
 cloudflare                      2.19.4                 python                   
-composer                        2.7.7                  binary                   
+composer                        2.7.8                  binary                   
 configargparse                  1.7                    python                   
 configobj                       5.0.8                  python                   
 coreutils                       9.5-r1                 apk                      
@@ -91,7 +91,7 @@ coreutils-sha512sum             9.5-r1                 apk
 cryptography                    43.0.0                 python                   
 curl                            8.9.0-r0               apk                      
 distro                          1.9.0                  python                   
-dns-lexicon                     3.17.0                 python                   
+dns-lexicon                     3.18.0                 python                   
 dnslib                          0.9.25                 python                   
 dnspython                       2.6.1                  python                   
 domeneshop                      0.4.4                  python                   
@@ -115,11 +115,11 @@ gnupg-keyboxd                   2.4.5-r0               apk
 gnupg-utils                     2.4.5-r0               apk                      
 gnupg-wks-client                2.4.5-r0               apk                      
 gnutls                          3.8.5-r0               apk                      
-google-api-core                 2.19.1                 python                   
+google-api-core                 2.19.2                 python                   
-google-api-python-client        2.140.0                python                   
+google-api-python-client        2.143.0                python                   
-google-auth                     2.33.0                 python                   
+google-auth                     2.34.0                 python                   
 google-auth-httplib2            0.2.0                  python                   
-googleapis-common-protos        1.63.2                 python                   
+googleapis-common-protos        1.65.0                 python                   
 gpg                             2.4.5-r0               apk                      
 gpg-agent                       2.4.5-r0               apk                      
 gpg-wks-server                  2.4.5-r0               apk                      
@@ -128,7 +128,7 @@ gpgv                            2.4.5-r0               apk
 httplib2                        0.22.0                 python                   
 icu-data-en                     74.2-r0                apk                      
 icu-libs                        74.2-r0                apk                      
-idna                            3.7                    python                   
+idna                            3.8                    python                   
 importlib-metadata              8.0.0                  python                   
 importlib-resources             6.4.0                  python                   
 inflect                         7.3.1                  python                   
@@ -142,7 +142,7 @@ jmespath                        1.0.1                  python
 josepy                          1.14.0                 python                   
 jq                              1.7.1-r0               apk                      
 jsonlines                       4.0.0                  python                   
-jsonpickle                      3.2.2                  python                   
+jsonpickle                      3.3.0                  python                   
 libacl                          2.3.2-r0               apk                      
 libassuan                       2.5.7-r0               apk                      
 libattr                         2.5.2-r0               apk                      
@@ -205,7 +205,7 @@ libzip                          1.10.1-r0              apk
 linux-pam                       1.6.0-r0               apk                      
 logrotate                       3.21.0-r1              apk                      
 loopialib                       0.2.0                  python                   
-lxml                            5.2.2                  python                   
+lxml                            5.3.0                  python                   
 lz4-libs                        1.9.4-r5               apk                      
 memcached                       1.6.27-r0              apk                      
 mock                            5.1.0                  python                   
@@ -221,29 +221,28 @@ ncurses-terminfo-base           6.4_p20240420-r0       apk
 netcat-openbsd                  1.226-r0               apk                      
 nettle                          3.9.1-r0               apk                      
 nghttp2-libs                    1.62.1-r0              apk                      
-nginx                           1.26.1-r0              apk                      
+nginx                           1.26.2-r0              apk                      
-nginx-mod-devel-kit             1.26.1-r0              apk                      
+nginx-mod-devel-kit             1.26.2-r0              apk                      
-nginx-mod-http-brotli           1.26.1-r0              apk                      
+nginx-mod-http-brotli           1.26.2-r0              apk                      
-nginx-mod-http-dav-ext          1.26.1-r0              apk                      
+nginx-mod-http-dav-ext          1.26.2-r0              apk                      
-nginx-mod-http-echo             1.26.1-r0              apk                      
+nginx-mod-http-echo             1.26.2-r0              apk                      
-nginx-mod-http-fancyindex       1.26.1-r0              apk                      
+nginx-mod-http-fancyindex       1.26.2-r0              apk                      
-nginx-mod-http-geoip2           1.26.1-r0              apk                      
+nginx-mod-http-geoip2           1.26.2-r0              apk                      
-nginx-mod-http-headers-more     1.26.1-r0              apk                      
+nginx-mod-http-headers-more     1.26.2-r0              apk                      
-nginx-mod-http-image-filter     1.26.1-r0              apk                      
+nginx-mod-http-image-filter     1.26.2-r0              apk                      
-nginx-mod-http-perl             1.26.1-r0              apk                      
+nginx-mod-http-perl             1.26.2-r0              apk                      
-nginx-mod-http-redis2           1.26.1-r0              apk                      
+nginx-mod-http-redis2           1.26.2-r0              apk                      
-nginx-mod-http-set-misc         1.26.1-r0              apk                      
+nginx-mod-http-set-misc         1.26.2-r0              apk                      
-nginx-mod-http-upload-progress  1.26.1-r0              apk                      
+nginx-mod-http-upload-progress  1.26.2-r0              apk                      
-nginx-mod-http-xslt-filter      1.26.1-r0              apk                      
+nginx-mod-http-xslt-filter      1.26.2-r0              apk                      
-nginx-mod-mail                  1.26.1-r0              apk                      
+nginx-mod-mail                  1.26.2-r0              apk                      
-nginx-mod-rtmp                  1.26.1-r0              apk                      
+nginx-mod-rtmp                  1.26.2-r0              apk                      
-nginx-mod-stream                1.26.1-r0              apk                      
+nginx-mod-stream                1.26.2-r0              apk                      
-nginx-mod-stream-geoip2         1.26.1-r0              apk                      
+nginx-mod-stream-geoip2         1.26.2-r0              apk                      
-nginx-vim                       1.26.1-r0              apk                      
+nginx-vim                       1.26.2-r0              apk                      
 npth                            1.6-r4                 apk                      
 oniguruma                       6.9.9-r0               apk                      
 openssl                         3.3.1-r3               apk                      
-ordered-set                     4.1.0                  python                   
 p11-kit                         0.25.3-r0              apk                      
 packaging                       24.1                   python                   
 parsedatetime                   2.6                    python                   
@@ -309,24 +308,24 @@ popt                            1.19-r3                apk
 portalocker                     2.10.1                 python                   
 procps-ng                       4.0.4-r0               apk                      
 proto-plus                      1.24.0                 python                   
-protobuf                        5.27.3                 python                   
+protobuf                        5.28.0                 python                   
 pyacmedns                       0.4                    python                   
 pyasn1                          0.6.0                  python                   
 pyasn1-modules                  0.4.0                  python                   
-pyc                             3.12.3-r1              apk                      
+pyc                             3.12.3-r2              apk                      
 pycparser                       2.22                   python                   
 pyjwt                           2.9.0                  python                   
 pynamecheap                     0.0.3                  python                   
 pyopenssl                       24.2.1                 python                   
 pyotp                           2.9.0                  python                   
-pyparsing                       3.1.2                  python                   
+pyparsing                       3.1.4                  python                   
 pyrfc3339                       1.1                    python                   
 python-dateutil                 2.9.0.post0            python                   
 python-digitalocean             1.17.0                 python                   
 python-transip                  0.6.0                  python                   
-python3                         3.12.3-r1              apk                      
+python3                         3.12.3-r2              apk                      
-python3-pyc                     3.12.3-r1              apk                      
+python3-pyc                     3.12.3-r2              apk                      
-python3-pycache-pyc0            3.12.3-r1              apk                      
+python3-pycache-pyc0            3.12.3-r2              apk                      
 pytz                            2024.1                 python                   
 pyyaml                          6.0.2                  python                   
 readline                        8.2.10-r0              apk                      
@@ -336,11 +335,11 @@ requests-mock                   1.12.1                 python
 rsa                             4.9                    python                   
 s3transfer                      0.10.2                 python                   
 scanelf                         1.3.7-r2               apk                      
-setuptools                      72.1.0                 python                   
+setuptools                      74.1.0                 python                   
 shadow                          4.15.1-r0              apk                      
 six                             1.16.0                 python                   
 skalibs                         2.14.1.1-r0            apk                      
-soupsieve                       2.5                    python                   
+soupsieve                       2.6                    python                   
 sqlite-libs                     3.45.3-r1              apk                      
 ssl_client                      1.36.1-r29             apk                      
 tiff                            4.6.0t-r0              apk                      
@@ -359,5 +358,5 @@ whois                           5.5.23-r0              apk
 xz-libs                         5.6.2-r0               apk                      
 zipp                            3.19.2                 python                   
 zlib                            1.3.1-r1               apk                      
-zope-interface                  7.0.1                  python                   
+zope-interface                  7.0.3                  python                   
 zstd-libs                       1.5.6-r0               apk                      

readme-vars.yml

@@ -140,6 +140,7 @@ app_setup_block: |
 
 # changelog
 changelogs:
+  - { date: "30.08.24:", desc: "Fix zerossl cert revocation." }
   - { date: "24.07.14:", desc: "Rebase to Alpine 3.20. Remove deprecated Google Domains certbot plugin. Existing users should update their nginx confs to avoid http2 deprecation warnings."}
   - { date: "01.07.24:", desc: "Fall back to iptables-legacy if iptables doesn't work." }
   - { date: "23.03.24:", desc: "Fix perms on the generated `priv-fullchain-bundle.pem`." }

root/etc/s6-overlay/s6-rc.d/init-certbot-config/run

@@ -189,24 +189,15 @@ if [[ ! "${URL}" = "${ORIGURL}" ]] ||
     [[ ! "${STAGING}" = "${ORIGSTAGING}" ]] ||
     [[ ! "${CERTPROVIDER}" = "${ORIGCERTPROVIDER}" ]]; then
     echo "Different validation parameters entered than what was used before. Revoking and deleting existing certificate, and an updated one will be created"
-    if [[ "${ORIGCERTPROVIDER}" = "zerossl" ]] && [[ -n "${ORIGEMAIL}" ]]; then
+    if [[ "${ORIGCERTPROVIDER}" = "zerossl" ]]; then
         REV_ACMESERVER=("https://acme.zerossl.com/v2/DV90")
-        REV_ZEROSSL_EAB_KID=$(awk -F "=" '/eab-kid/ {print $2}' "/config/etc/letsencrypt/renewal/${ORIGDOMAIN}.conf" | tr -d ' ')
-        REV_ZEROSSL_EAB_HMAC_KEY=$(awk -F "=" '/eab-hmac-key/ {print $2}' "/config/etc/letsencrypt/renewal/${ORIGDOMAIN}.conf" | tr -d ' ')
-        if [[ -z "${REV_ZEROSSL_EAB_KID}" ]] || [[ -z "${REV_ZEROSSL_EAB_HMAC_KEY}" ]]; then
-            REV_ZEROSSL_EAB_KID=$(awk -F "=" '/eab-kid/ {print $2}' /config/etc/letsencrypt/cli.ini | tr -d ' ')
-            REV_ZEROSSL_EAB_HMAC_KEY=$(awk -F "=" '/eab-hmac-key/ {print $2}' /config/etc/letsencrypt/cli.ini | tr -d ' ')
-        fi
-        if [[ -n "${REV_ZEROSSL_EAB_KID}" ]] && [[ -n "${REV_ZEROSSL_EAB_HMAC_KEY}" ]]; then
-            REV_ACMESERVER+=("--eab-kid" "${REV_ZEROSSL_EAB_KID}" "--eab-hmac-key" "${REV_ZEROSSL_EAB_HMAC_KEY}")
-        fi
     elif [[ "${ORIGSTAGING}" = "true" ]]; then
         REV_ACMESERVER=("https://acme-staging-v02.api.letsencrypt.org/directory")
     else
         REV_ACMESERVER=("https://acme-v02.api.letsencrypt.org/directory")
     fi
     if [[ -f /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem ]]; then
-        certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem --server "${REV_ACMESERVER[@]}" || true
+        certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem --key-path /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/privkey.pem --server "${REV_ACMESERVER[@]}" || true
     else
         certbot revoke --non-interactive --cert-name "${ORIGDOMAIN}" --server "${REV_ACMESERVER[@]}" || true
     fi