Merge pull request 'Add --check-updates to report newer package versions' (#9) from check-updates into free

Reviewed-on: #9

README.md

@@ -34,6 +34,7 @@ By default only the build steps are printed and all output goes to a log file in
 - `-r DIR` build root, `-j N` parallel jobs, `-l FILE` log file, `-c` run `make clean` first
 - `--no-brotli`, `--no-zstd`, `--no-geoip2`, `--no-headers`, `--no-ktls`, `--no-debug`
 - `--asm` build OpenSSL with its assembly optimizations (AES-NI etc.); the default is `no-asm`
+- `--check-updates` look up the newest version of each versioned package and show it in the build steps and final summary, e.g. `openssl-3.6.5 (cached - update available v3.6.6, newest v4.1.0)`. The build still uses your pinned versions. Modules tracked by git (GeoIP2, Brotli, Zstd) are always pulled, so they aren't checked.
 - Versions can be set from the environment: `V_NGINX=1.31.6 V_QSSL=3.6.5 ./freenginx.sh`
 
 If a step fails, the script stops and prints the end of the log.

freenginx.sh

@@ -20,6 +20,7 @@ set -Eeuo pipefail
 : "${LOG:=}"           # default: $BUILDROOT/build-<version>-<timestamp>.log
 : "${VERBOSITY:=1}"    # 0 = quiet, 1 = steps only, 2 = everything
 : "${CLEAN:=0}"
+: "${CHECK_UPDATES:=0}"
 
 ### Optional features (1 = on, 0 = off)
 : "${USE_BROTLI:=1}"
@@ -45,6 +46,9 @@ Usage: ${0##*/} [options]
   --no-brotli | --no-zstd | --no-geoip2 | --no-headers | --no-ktls | --no-debug
             disable an optional feature
   --asm     build OpenSSL with assembly optimizations (default: no-asm)
+  --check-updates
+            look up the newest version of each versioned package and show it
+            in the build steps and summary; a failed lookup never stops the build
   -h        show this help
 
 Versions come from the top of the script or the environment:
@@ -68,6 +72,7 @@ while [ $# -gt 0 ]; do
     --no-ktls)    USE_KTLS=0 ;;
     --no-debug)   USE_DEBUG=0 ;;
     --asm)        USE_ASM=1 ;;
+    --check-updates) CHECK_UPDATES=1 ;;
     -h|--help) usage; exit 0 ;;
     *) echo "Unknown option: $1" >&2; usage >&2; exit 1 ;;
   esac
@@ -92,10 +97,38 @@ on_error() {
 }
 
 ### Helpers
-fetch() { # url dir: download and extract into $BUILDROOT unless dir already exists
+updates=()
+newer() { [ "$1" != "$2" ] && [ "$(printf '%s\n' "$1" "$2" | sort -V | tail -n 1)" = "$1" ]; }
+
+check_update() { # dir repo tag-prefix: set $note from upstream's stable tags, record it for the summary
+  note=
+  if [ "$CHECK_UPDATES" != 1 ]; then return 0; fi
+  # ponytail: assumes a release pin; a prerelease pin like 4.2.0-beta1 gets no notice
+  local cur=${1##*-} tags v patch= top=
+  # git rather than the GitHub API: no rate limit. No prompting, so a moved repo can't hang the build.
+  if tags=$(GIT_TERMINAL_PROMPT=0 timeout 20 git ls-remote --tags --refs "$2" 2>>"$LOG"); then
+    # At most three components: drops prereleases (-beta1) and zlib dev tags (1.3.1.2).
+    for v in $(sed -En "s|.*refs/tags/$3([0-9]+(\.[0-9]+){0,2})$|\1|p" <<<"$tags" | sort -V); do
+      top=$v
+      case $v in "${cur%.*}".*) patch=$v ;; esac
+    done
+  fi
+  if [ -z "$top" ]; then
+    note="update check failed"
+  elif newer "$patch" "$cur"; then
+    note="update available v$patch"
+    if newer "$top" "$patch"; then note+=", newest v$top"; fi
+  elif newer "$top" "$cur"; then
+    note="update available v$top"
+  fi
+  if [ -n "$note" ]; then updates+=("$1: $note"); fi
+}
+
+fetch() { # url dir repo tag-prefix: download and extract into $BUILDROOT unless dir already exists
   local url=$1 dir=$2 file=${1##*/}
-  if [ -d "$dir" ]; then step "$dir (cached)"; return 0; fi
-  step "Downloading $dir"
+  check_update "$dir" "$3" "$4"
+  if [ -d "$dir" ]; then step "$dir (cached${note:+ - $note})"; return 0; fi
+  step "Downloading $dir${note:+ ($note)}"
   run curl -fsSL -o "$file" "$url"
   case $file in
     *.zip) run unzip -q "$file" ;;
@@ -131,11 +164,15 @@ build_brotli() {
 }
 
 install_maxmind() { # system-wide, skipped when pkg-config already reports $V_MAXM
-  local dir=libmaxminddb-$V_MAXM have
+  local dir=libmaxminddb-$V_MAXM repo=https://github.com/maxmind/libmaxminddb have
   have=$(pkg-config --modversion libmaxminddb 2>/dev/null || true)
-  if [ "$have" = "$V_MAXM" ]; then step "libmaxminddb $have already installed"; return 0; fi
+  if [ "$have" = "$V_MAXM" ]; then
+    check_update "$dir" "$repo" ""
+    step "libmaxminddb $have already installed${note:+ ($note)}"
+    return 0
+  fi
   log "pkg-config reports libmaxminddb '${have:-none}', want $V_MAXM"
-  fetch "https://github.com/maxmind/libmaxminddb/releases/download/$V_MAXM/$dir.tar.gz" "$dir"
+  fetch "$repo/releases/download/$V_MAXM/$dir.tar.gz" "$dir" "$repo" ""
   step "Installing $dir system-wide (sudo)"
   cd "$dir"
   run ./configure
@@ -174,13 +211,13 @@ for t in curl tar unzip git cmake make cc pkg-config; do command -v "$t" >/dev/n
 if [ ${#missing[@]} -gt 0 ]; then echo "Missing required tools: ${missing[*]}" >&2; exit 1; fi
 
 step "freenginx $V_NGINX in $BUILDROOT (log: $LOG)"
-set | grep -E '^(V_[A-Z]+|USE_[A-Z0-9]+|JOBS|BUILDROOT|VERBOSITY|CLEAN)=' >>"$LOG"
+set | grep -E '^(V_[A-Z]+|USE_[A-Z0-9]+|JOBS|BUILDROOT|VERBOSITY|CLEAN|CHECK_UPDATES)=' >>"$LOG"
 
 ### Sources
-fetch "https://www.zlib.net/zlib-$V_ZLIB.tar.gz" "zlib-$V_ZLIB"
-fetch "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-$V_PCRE/pcre2-$V_PCRE.tar.gz" "pcre2-$V_PCRE"
-fetch "https://github.com/openssl/openssl/releases/download/openssl-$V_QSSL/openssl-$V_QSSL.tar.gz" "openssl-$V_QSSL"
-fetch "https://github.com/freenginx/nginx/archive/refs/tags/release-$V_NGINX.tar.gz" "nginx-release-$V_NGINX"
+fetch "https://www.zlib.net/zlib-$V_ZLIB.tar.gz" "zlib-$V_ZLIB" https://github.com/madler/zlib v
+fetch "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-$V_PCRE/pcre2-$V_PCRE.tar.gz" "pcre2-$V_PCRE" https://github.com/PCRE2Project/pcre2 pcre2-
+fetch "https://github.com/openssl/openssl/releases/download/openssl-$V_QSSL/openssl-$V_QSSL.tar.gz" "openssl-$V_QSSL" https://github.com/openssl/openssl openssl-
+fetch "https://github.com/freenginx/nginx/archive/refs/tags/release-$V_NGINX.tar.gz" "nginx-release-$V_NGINX" https://github.com/freenginx/nginx release-
 
 ### Optional modules (BUILD_INFO order matches the old hardcoded string)
 info=() mods=()
@@ -200,7 +237,7 @@ if [ "$USE_ZSTD" = 1 ]; then
 fi
 info+=(H3)
 if [ "$USE_HEADERS" = 1 ]; then
-  fetch "https://github.com/openresty/headers-more-nginx-module/archive/refs/tags/v$V_HEAD.zip" "headers-more-nginx-module-$V_HEAD"
+  fetch "https://github.com/openresty/headers-more-nginx-module/archive/refs/tags/v$V_HEAD.zip" "headers-more-nginx-module-$V_HEAD" https://github.com/openresty/headers-more-nginx-module v
   info+=(Headers-More); mods+=(--add-module=../headers-more-nginx-module-$V_HEAD)
 fi
 info+=(Quantum)
@@ -273,4 +310,9 @@ run make -j "$JOBS"
   echo "Log:     $LOG"
   echo "Install: cd $SRC && sudo make install"
   printf 'Total compile time: %dm %02ds\n' $((SECONDS / 60)) $((SECONDS % 60))
+  if [ ${#updates[@]} -gt 0 ]; then
+    echo
+    echo "Updates:"
+    printf '  %s\n' "${updates[@]}"
+  fi
 } | tee -a "$LOG"

test-check-updates.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Self-check for check_update in freenginx.sh. Needs no network: bash test-check-updates.sh
+set -u
+eval "$(sed -n '/^newer()/p; /^check_update()/,/^}/p' "$(dirname "$0")/freenginx.sh")"
+
+CHECK_UPDATES=1 LOG=/dev/null fails=0 updates=()
+timeout() { shift; "$@"; }
+git() { printf 'abc\trefs/tags/%s\n' "${fixture[@]}"; }
+
+t() { # expected-note dir tag-prefix tags...
+  local want=$1 dir=$2 prefix=$3; shift 3
+  fixture=("$@")
+  check_update "$dir" repo "$prefix"
+  if [ "$note" != "$want" ]; then echo "FAIL $dir [$*]: got '$note', want '$want'"; fails=$((fails + 1)); fi
+}
+
+t "update available v3.6.6, newest v4.1.0" openssl-3.6.5 openssl- openssl-3.6.5 openssl-3.6.6 openssl-4.1.0
+t "update available v3.6.6"                openssl-3.6.5 openssl- openssl-3.6.5 openssl-3.6.6
+t "update available v4.1.0"                openssl-3.6.6 openssl- openssl-3.6.6 openssl-4.1.0
+t ""                                       openssl-4.0.3 openssl- openssl-4.0.3 openssl-4.1.0-beta2
+t "update available v1.9.10"               nginx-release-1.9.9 release- release-1.9.9 release-1.9.10
+t "update available v11.3.9"               openssl-1.3.5 openssl- openssl-1.3.5 openssl-11.3.9
+t ""                                       zlib-1.3.2 v v1.3.1.2 v1.3.2 v1.3.2.1
+t ""                                       libmaxminddb-1.14.1 "" 1.14.1 not-a-version
+t "update check failed"                    openssl-3.6.5 openssl- unrelated-tag
+
+[ "${updates[0]}" = "openssl-3.6.5: update available v3.6.6, newest v4.1.0" ] || { echo "FAIL summary: ${updates[0]}"; fails=$((fails + 1)); }
+
+timeout() { return 124; }
+t "update check failed" openssl-3.6.5 openssl- openssl-3.6.6
+
+CHECK_UPDATES=0
+t "" openssl-3.6.5 openssl- openssl-3.6.6
+
+[ "$fails" = 0 ] && echo "ok"
+exit "$fails"