archipelagoandClaude Opus 5
cbfda30579
Demo images / Build & push demo images (push) Failing after 2m22s
The app store offered "update to 2.3.9" on a node already running 2.4.2 — the release that fixes an actively exploited 2FA bypass. Taking it would have rolled the node back onto the vulnerable version. Root cause: available_update_for_images compared tags for inequality only. Same repo + different tag meant "update available", with no ordering. Every version claim upstream of it can go stale — the signed catalog, a legacy catalog entry, the image-versions.sh baseline pin — and any one of them lagging turned into a backwards Update button. Guard added: when both tags parse as dotted-numeric versions, a lower pinned version is never offered. Tags that cannot be ordered (RELEASE.2024-11-07…, 14-vectorchord0.4.3) keep the previous behaviour rather than silently losing updates. This makes stale data fail safe, which matters more than any single pin being correct. Four sources still named 2.3.9, three of them able to act on it: - releases/app-catalog.json — a LEGACY `btcpay` entry, distinct from `btcpay-server`, carrying a concrete 2.3.9 image. catalog_primary_image treats that as authoritative, so this is what drove the button. Fixed, but held back from this commit: it needs re-signing. - scripts/image-versions.sh — the baseline pin used when the catalog does not cover an app. - stacks.rs — the legacy BTCPay installer, twice. The fallback install path would have deployed 2.3.9 outright. - neode-ui curatedApps/marketplaceData and public/catalog.json — the store's displayed version, hardcoded rather than read from the catalog, which is why it still showed 2.3.9 after the update landed. Audited every other installer for the same shape. The remaining literals are the immich stack, which currently agrees with its manifests; hits in set_config.rs and app_catalog.rs are test fixtures. To keep it that way, scripts/check-installer-image-pins.py asserts that any installer literal naming the same repository as an app manifest carries the same tag, and runs blocking in CI. Verified it catches a simulated revert to 2.3.9. Tests: 13/13 in image_versions including the exact BTCPay case, a genuine upgrade still offered, equal versions silent, prerelease suffixes ordered on their numbers, and opaque tags unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
132 lines
5.5 KiB
Bash
132 lines
5.5 KiB
Bash
#!/bin/bash
|
|
# Container image versions — single source of truth
|
|
# Source this file from all scripts that create containers
|
|
#
|
|
# Usage: source /opt/archipelago/image-versions.sh 2>/dev/null || true
|
|
# source "$(dirname "$0")/image-versions.sh" 2>/dev/null || true
|
|
#
|
|
# Tags MUST match what's actually in the registry at source.archipelago-foundation.org/lfg2025/
|
|
# Run: podman images --format '{{.Repository}}:{{.Tag}}' | grep 'source.archipelago-foundation.org' | sort
|
|
# to verify against the registry.
|
|
|
|
# Archipelago app registries (primary + fallback)
|
|
ARCHY_REGISTRY="source.archipelago-foundation.org/lfg2025"
|
|
# No fallback registry: the old tx1138 registry host was retired (2026-06-13); empty disables the fallback path.
|
|
ARCHY_REGISTRY_FALLBACK=""
|
|
|
|
# Bitcoin stack
|
|
BITCOIN_KNOTS_IMAGE="$ARCHY_REGISTRY/bitcoin-knots:latest"
|
|
LND_IMAGE="$ARCHY_REGISTRY/lnd:v0.18.4-beta"
|
|
ELECTRUMX_IMAGE="$ARCHY_REGISTRY/electrumx:v1.18.0"
|
|
|
|
# Mempool stack
|
|
MEMPOOL_BACKEND_IMAGE="$ARCHY_REGISTRY/mempool-backend:v3.0.0"
|
|
MEMPOOL_WEB_IMAGE="$ARCHY_REGISTRY/mempool-frontend:v3.0.1"
|
|
MARIADB_IMAGE="$ARCHY_REGISTRY/mariadb:11.4.10"
|
|
|
|
# BTCPay
|
|
BTCPAY_IMAGE="docker.io/btcpayserver/btcpayserver:2.4.2"
|
|
NBXPLORER_IMAGE="$ARCHY_REGISTRY/nbxplorer:2.6.0"
|
|
POSTGRES_IMAGE="$ARCHY_REGISTRY/postgres:15.17"
|
|
BTCPAY_POSTGRES_IMAGE="$ARCHY_REGISTRY/postgres:15.17"
|
|
|
|
# Apps
|
|
HOMEASSISTANT_IMAGE="$ARCHY_REGISTRY/home-assistant:2026.7.3"
|
|
GRAFANA_IMAGE="$ARCHY_REGISTRY/grafana:10.2.0"
|
|
UPTIME_KUMA_IMAGE="$ARCHY_REGISTRY/uptime-kuma:1"
|
|
JELLYFIN_IMAGE="$ARCHY_REGISTRY/jellyfin:10.8.13"
|
|
PHOTOPRISM_IMAGE="$ARCHY_REGISTRY/photoprism:240915"
|
|
OLLAMA_IMAGE="$ARCHY_REGISTRY/ollama:latest"
|
|
VAULTWARDEN_IMAGE="$ARCHY_REGISTRY/vaultwarden:1.30.0-alpine"
|
|
NEXTCLOUD_IMAGE="$ARCHY_REGISTRY/nextcloud:29"
|
|
SEARXNG_IMAGE="$ARCHY_REGISTRY/searxng:latest"
|
|
# OnlyOffice removed — incompatible with rootless Podman (internal postgres/rabbitmq fail)
|
|
# Replaced by CryptPad (single Node.js process, e2e encrypted)
|
|
CRYPTPAD_IMAGE="$ARCHY_REGISTRY/cryptpad:2024.12.0"
|
|
FILEBROWSER_IMAGE="$ARCHY_REGISTRY/filebrowser:v2.27.0"
|
|
NPM_IMAGE="$ARCHY_REGISTRY/nginx-proxy-manager:latest"
|
|
# 2.39.1 is what the fleet has actually been running via the moving :latest
|
|
# tag, and it is the version that wrote their databases. Pinning back to
|
|
# 2.19.4 (2 years older) made Portainer refuse to start the moment a
|
|
# container was recreated: "database schema version does not align with the
|
|
# server version" — it migrates a DB forward, never backward. Pinned
|
|
# forward and published as a concrete tag so this is reproducible.
|
|
PORTAINER_IMAGE="$ARCHY_REGISTRY/portainer:2.39.1"
|
|
|
|
# Networking
|
|
TAILSCALE_IMAGE="$ARCHY_REGISTRY/tailscale:stable"
|
|
NETBIRD_DASHBOARD_IMAGE="docker.io/netbirdio/dashboard:v2.38.0"
|
|
NETBIRD_SERVER_IMAGE="docker.io/netbirdio/netbird-server:0.71.2"
|
|
NETBIRD_PROXY_IMAGE="docker.io/library/nginx:1.27-alpine"
|
|
ALPINE_TOR_IMAGE="$ARCHY_REGISTRY/alpine-tor:0.4.8.13"
|
|
ADGUARDHOME_IMAGE="$ARCHY_REGISTRY/adguardhome:v0.107.55"
|
|
|
|
# Fedimint
|
|
FEDIMINT_IMAGE="$ARCHY_REGISTRY/fedimintd:v0.10.0"
|
|
FEDIMINT_GATEWAY_IMAGE="$ARCHY_REGISTRY/gatewayd:v0.10.0"
|
|
# fmcd = Fedimint client daemon (iroh-capable, fedimint-client 0.8.2). Built
|
|
# from minmoto/fmcd. Bundled on the ISO in BOTH modes (full CONTAINER_IMAGES
|
|
# list and the unbundled core bundle) and auto-created by first-boot as a
|
|
# baseline app so ecash works offline out of the box.
|
|
# See docs/dual-ecash-design.md.
|
|
FMCD_IMAGE="$ARCHY_REGISTRY/fmcd:0.8.1"
|
|
|
|
# Ark (bark)
|
|
# barkd = Ark wallet daemon, packaged from the pinned upstream release binary
|
|
# (apps/barkd/Dockerfile). Signet-only default config; keep the tag in
|
|
# lockstep with core/archipelago/src/wallet/ark_client.rs REST shapes. Not in
|
|
# the bundled CONTAINER_IMAGES list — install via the barkd app manifest.
|
|
BARKD_IMAGE="$ARCHY_REGISTRY/barkd:0.3.0"
|
|
|
|
# Media
|
|
REDIS_IMAGE="$ARCHY_REGISTRY/redis:7.4.8"
|
|
|
|
# Valkey (general purpose)
|
|
VALKEY_IMAGE="$ARCHY_REGISTRY/valkey:8.1.6"
|
|
|
|
# Nostr
|
|
NOSTR_RS_RELAY_IMAGE="$ARCHY_REGISTRY/nostr-rs-relay:0.9.0"
|
|
STRFRY_IMAGE="$ARCHY_REGISTRY/strfry:1.0.4"
|
|
NOSTR_VPN_IMAGE="$ARCHY_REGISTRY/nostr-vpn:v0.3.7"
|
|
NOSTR_VPN_UI_IMAGE="$ARCHY_REGISTRY/nostr-vpn-ui:latest"
|
|
FIPS_IMAGE="$ARCHY_REGISTRY/fips:v0.1.0"
|
|
FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:1.7.123-alpha"
|
|
|
|
# AI / Routing
|
|
ROUTSTR_IMAGE="$ARCHY_REGISTRY/routstr:v0.4.3"
|
|
|
|
# Community / Gaming
|
|
BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.2.11"
|
|
|
|
# IndeedHub stack
|
|
INDEEDHUB_IMAGE="$ARCHY_REGISTRY/indeedhub:1.0.0"
|
|
INDEEDHUB_API_IMAGE="$ARCHY_REGISTRY/indeedhub-api:1.0.0"
|
|
INDEEDHUB_FFMPEG_IMAGE="$ARCHY_REGISTRY/indeedhub-ffmpeg:1.0.0"
|
|
MINIO_IMAGE="$ARCHY_REGISTRY/minio:RELEASE.2024-11-07T00-52-20Z"
|
|
INDEEDHUB_POSTGRES_IMAGE="$ARCHY_REGISTRY/postgres:16.13-alpine"
|
|
INDEEDHUB_REDIS_IMAGE="$ARCHY_REGISTRY/redis:7.4.8-alpine"
|
|
|
|
# Gitea (Git + Container Registry)
|
|
GITEA_IMAGE="docker.io/gitea/gitea:1.23"
|
|
|
|
# DWN (Decentralized Web Node)
|
|
|
|
# Immich stack
|
|
IMMICH_POSTGRES_IMAGE="$ARCHY_REGISTRY/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0"
|
|
IMMICH_SERVER_IMAGE="$ARCHY_REGISTRY/immich-server:release"
|
|
|
|
# Penpot stack
|
|
PENPOT_POSTGRES_IMAGE="$ARCHY_REGISTRY/postgres:15"
|
|
PENPOT_VALKEY_IMAGE="$ARCHY_REGISTRY/valkey:8.1"
|
|
PENPOT_BACKEND_IMAGE="$ARCHY_REGISTRY/penpot-backend:2.4"
|
|
PENPOT_EXPORTER_IMAGE="$ARCHY_REGISTRY/penpot-exporter:2.4"
|
|
PENPOT_FRONTEND_IMAGE="$ARCHY_REGISTRY/penpot-frontend:2.4"
|
|
|
|
# Custom UI containers (built from docker/ dirs, pushed to registry)
|
|
BITCOIN_UI_IMAGE="$ARCHY_REGISTRY/bitcoin-ui:1.7.123-alpha"
|
|
LND_UI_IMAGE="$ARCHY_REGISTRY/lnd-ui:1.7.123-alpha"
|
|
ELECTRS_UI_IMAGE="$ARCHY_REGISTRY/electrs-ui:1.7.123-alpha"
|
|
|
|
# Base images
|
|
NGINX_ALPINE_IMAGE="$ARCHY_REGISTRY/nginx:1.27.4-alpine"
|