`njs` updates are not propagated from `pkg-oss` branches during module builds

[gnought]

Bug Overview

In building nginx modules using modules/ directory, the build process explicitly fetches a tagged branch of nginx/pkg-oss.

docker-nginx/modules/Dockerfile.alpine

Line 22 in d19b677

&& git clone -b ${NGINX_VERSION}-${PKG_RELEASE} https://github.com/nginx/pkg-oss/ \

This pins to a specific Nginx release, but a recent critical CVE fix for njs (commit: nginx/pkg-oss@9d879d5) landed on the master branch only, but it doesn't appear in the tagged branch.

any thought how to ensure the build of nginx modules are up-to-date to avoid the situtation in the future?

Expected Behavior

Supposedly the njs version should be get updated and follow the master branch even it is not back-ported to tagged branches.

Steps to Reproduce the Bug

just build the Dockerfile in modules/ directory

Environment Details

• Version/release of Docker and method of installation (e.g. Docker Desktop / Docker Server)
• Version of the Docker NGINX image or specific commit: [e.g. 1.4.3/commit hash]
• Target deployment platform: [e.g. OpenShift/Kubernetes/Docker Compose/local cluster/etc...]
• Target OS: [e.g. RHEL 9/Ubuntu 24.04/etc...]

Additional Context

No response

[thresheek]

Hi @gnought,

Yeah it's a known issue with the approach. We cant really use anything other than the tag since we have a chance of producing non-compatible builds if nginx versions diverge.

However specifically for this case, why would you need modules/ build for njs? It's already included in the images we ship.

[gnought]

Since I build user-defined modules into nginx image. @thresheek

docker-nginx/modules/Dockerfile.alpine

Lines 26 to 48 in d19b677

	echo "Building $module for nginx-$NGINX_VERSION"; \
	if [ -d /modules/$module ]; then \
	echo "Building $module from user-supplied sources"; \
	# check if module sources file is there and not empty
	if [ ! -s /modules/$module/source ]; then \
	echo "No source file for $module in modules/$module/source, exiting"; \
	exit 1; \
	fi; \
	# some modules require build dependencies
	if [ -f /modules/$module/build-deps ]; then \
	echo "Installing $module build dependencies"; \
	apk update && apk add $(cat /modules/$module/build-deps | xargs); \
	fi; \
	# if a module has a build dependency that is not in a distro, provide a
	# shell script to fetch/build/install those
	# note that shared libraries produced as a result of this script will
	# not be copied from the builder image to the main one so build static
	if [ -x /modules/$module/prebuild ]; then \
	echo "Running prebuild script for $module"; \
	/modules/$module/prebuild; \
	fi; \
	/pkg-oss/build_module.sh -v $NGINX_VERSION -f -y -o /tmp/packages -n $module $(cat /modules/$module/source); \
	BUILT_MODULES="$BUILT_MODULES $(echo $module | tr '[A-Z]' '[a-z]' | tr -d '[/_\-\.\t ]')"; \