Skip to content

Commit 89ac5d2

Browse files
PDowneyPDowney
authored
Nginx Compile Change
The Cloudflare Zlib fork no longer appears to be actively maintained and currently suffers from a security vulnerability. This change updates the Nginx build to use the latest version of Zlib, which includes the necessary security fixes. Additionally, it removes the dependency on the Cloudflare fork, simplifying our build process and ensuring we are using a well-maintained library. https://www.sentinelone.com/vulnerability-database/cve-2023-6992/
1 parent 4bfb563 commit 89ac5d2

5 files changed

Lines changed: 72 additions & 19 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,52 @@ All notable changes to EngineScript will be documented in this file.
44

55
Changes are organized by date, with the most recent changes listed first.
66

7+
## 2026-02-18
8+
9+
### ⚡ NGINX JETPACK BOOST DELIVERY COMPATIBILITY
10+
11+
- **Jetpack Boost static delivery fallback fix**: Added a dedicated Nginx location for `/wp-content/boost-cache/static/*.css|*.js` that uses `try_files` with fallback to `/index.php?$args`.
12+
- Existing concatenated files continue to be served directly by Nginx.
13+
- Missing concatenated files now route through WordPress instead of returning an Nginx-native 404.
14+
- Restores compatibility with Jetpack Boost enhanced delivery detection that relies on WordPress `is_404()` behavior in `wp-content` paths.
15+
- **Generic CSS/JS location clarified**: Added inline guidance noting why `try_files` is intentionally not enabled in the general `\.(css|js)` location to preserve fast native 404 handling for non-Jetpack asset misses.
16+
- **FastCGI/PHP timeout alignment**: Tuned request timeout chain to reduce premature 504 responses and unnecessary long-running worker overlap.
17+
- Updated Nginx `fastcgi_read_timeout` from `120s` to `130s`.
18+
- Updated PHP-FPM `request_terminate_timeout` from `300s` to `125s`.
19+
- Kept PHP `max_execution_time` at `120` as the baseline script limit.
20+
- **try_files simplification for endpoint-specific rules**: Removed unnecessary `$uri/` directory checks where URL patterns are file/endpoint specific.
21+
- Updated Jetpack Boost static fallback in `static-files.conf` to `try_files $uri /index.php?$args;`.
22+
- Updated `wp-json` fallback in `wp-secure.conf` to `try_files $uri /index.php?$args;`.
23+
- **Nginx zlib source migration**: Switched active Nginx build path from Cloudflare zlib fork to official zlib source.
24+
- Updated `nginx-compile.sh` to use `--with-zlib="/usr/src/zlib-${ZLIB_VER}"` for both HTTP/2 and HTTP/3 builds.
25+
- Disabled Cloudflare zlib clone/configure flow in `zlib-install.sh` by commenting it out (kept for future re-enable).
26+
- Updated Nginx install/upgrade script messaging from "Cloudflare Zlib" to "zlib".
27+
28+
## 2025-01-21
29+
30+
### ⚙️ PHP VERSION SELECTION
31+
32+
- **PHP 8.5 Default**: Default PHP version changed from 8.4 to 8.5
33+
- **Version Override System**: New `PHP_VERSION_OVERRIDE` variable in install options allows selecting PHP 8.4 or 8.3
34+
- **KEEP_OLD_PHP Removed**: Old PHP version is always removed during upgrades; use "Switch PHP Version" menu to change versions
35+
- **Switch PHP Version Menu**: New interactive option in Update Software menu lets users switch between PHP 8.3, 8.4, and 8.5
36+
- **resolve_php_version()**: New shared function validates version override and applies it at script startup
37+
- **Dynamic Package Blocking**: `package-block.sh` now dynamically blocks all PHP versions except the selected one
38+
- **Opcache Handling**: `php-install.sh` and `php-update.sh` conditionally skip `php-opcache` package for PHP 8.5+ (built-in)
39+
- **php-update.sh Rewrite**: Complete rewrite — auto-detects currently installed PHP version, version-agnostic upgrade logic, no hardcoded versions
40+
41+
### 🐛 BUG FIXES
42+
43+
- **alias-debug.sh**: Fixed hardcoded `php8.3-fpm` service name; now uses `${PHP_VER}` dynamically
44+
- **enginescript-common.sh**: Updated `restart_php_fpm()` version array to include PHP 8.5
45+
46+
### 🔒 SECURITY IMPROVEMENTS
47+
48+
- **HIGH_SECURITY_SSL TLS Enhancement**: When `HIGH_SECURITY_SSL=1` is configured, TLS 1.1 is now disabled in nginx
49+
- SSL protocols reduced from `TLSv1.1 TLSv1.2 TLSv1.3` to `TLSv1.2 TLSv1.3`
50+
- Applied during nginx installation via nginx-misc.sh
51+
- Improves security posture for high-security environments by removing deprecated TLS 1.1 support
52+
753
## 2025-11-17
854

955
### 🌐 NEW FEATURE: External Services Monitoring

‎scripts/install/nginx/nginx-compile.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ if [[ "${INSTALL_HTTP3}" == "1" ]];
131131
--with-threads \
132132
--with-pcre="/usr/src/pcre2-${PCRE2_VER}" \
133133
--with-pcre-jit \
134-
--with-zlib=/usr/src/zlib-cf \
134+
--with-zlib="/usr/src/zlib-${ZLIB_VER}" \
135135
--with-zlib-opt=-fPIC \
136136
--with-http_ssl_module \
137137
--with-http_v2_module \
@@ -178,7 +178,7 @@ if [[ "${INSTALL_HTTP3}" == "1" ]];
178178
--with-threads \
179179
--with-pcre="/usr/src/pcre2-${PCRE2_VER}" \
180180
--with-pcre-jit \
181-
--with-zlib=/usr/src/zlib-cf \
181+
--with-zlib="/usr/src/zlib-${ZLIB_VER}" \
182182
--with-zlib-opt=-fPIC \
183183
--with-http_ssl_module \
184184
--with-http_v2_module \

‎scripts/install/nginx/nginx-install.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,10 @@ debug_pause "Nginx Source Downloads"
2828
print_last_errors
2929
debug_pause "Brotli"
3030

31-
# Retrieve Latest Cloudflare Zlib
31+
# Retrieve Latest zlib
3232
/usr/local/bin/enginescript/scripts/install/zlib/zlib-install.sh 2>> /tmp/enginescript_install_errors.log
3333
print_last_errors
34-
debug_pause "Cloudflare Zlib"
34+
debug_pause "zlib"
3535

3636
# Retrieve Latest PCRE2
3737
/usr/local/bin/enginescript/scripts/install/pcre/pcre-install.sh 2>> /tmp/enginescript_install_errors.log

‎scripts/install/zlib/zlib-install.sh‎

Lines changed: 20 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -21,19 +21,18 @@ source /usr/local/bin/enginescript/scripts/functions/shared/enginescript-common.
2121
# Return to /usr/src
2222
cd /usr/src
2323

24-
# Cloudflare zlib Download
25-
# Remove existing Zlib-CF directory if it exists
26-
if [[ -d "/usr/src/zlib-cf" ]]; then
27-
rm -rf "/usr/src/zlib-cf"
28-
fi
29-
30-
# Clone Zlib-CF
31-
git clone --depth 1 https://github.com/cloudflare/zlib.git -b gcc.amd64 "/usr/src/zlib-cf"
32-
cd "/usr/src/zlib-cf"
33-
sudo ./configure --prefix=path \
34-
--static \
35-
--64
36-
make -f Makefile.in distclean
24+
# Cloudflare zlib fork (disabled)
25+
# Disabled due to security and maintenance concerns. Keep this block for future re-enable if upstream status improves.
26+
#if [[ -d "/usr/src/zlib-cf" ]]; then
27+
# rm -rf "/usr/src/zlib-cf"
28+
#fi
29+
#
30+
#git clone --depth 1 https://github.com/cloudflare/zlib.git -b gcc.amd64 "/usr/src/zlib-cf"
31+
#cd "/usr/src/zlib-cf"
32+
#sudo ./configure --prefix=path \
33+
# --static \
34+
# --64
35+
#make -f Makefile.in distclean
3736

3837
#make
3938
#make test
@@ -53,6 +52,14 @@ make -f Makefile.in distclean
5352
#ldconfig
5453

5554
# Official zlib Download
55+
# Remove existing official zlib source directory and tarball if they exist
56+
if [[ -d "/usr/src/zlib-${ZLIB_VER}" ]]; then
57+
rm -rf "/usr/src/zlib-${ZLIB_VER}"
58+
fi
59+
if [[ -f "/usr/src/zlib-${ZLIB_VER}.tar.gz" ]]; then
60+
rm -f "/usr/src/zlib-${ZLIB_VER}.tar.gz"
61+
fi
62+
5663
wget -O "/usr/src/zlib-${ZLIB_VER}.tar.gz" "https://github.com/madler/zlib/archive/refs/tags/v${ZLIB_VER}.tar.gz"
5764
tar -xzf "/usr/src/zlib-${ZLIB_VER}.tar.gz"
5865

‎scripts/update/nginx-update.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,10 +40,10 @@ debug_pause "Brotli"
4040
print_last_errors
4141
debug_pause "OpenSSL"
4242

43-
# Retrieve Latest Cloudflare Zlib
43+
# Retrieve Latest zlib
4444
/usr/local/bin/enginescript/scripts/install/zlib/zlib-install.sh 2>> /tmp/enginescript_install_errors.log
4545
print_last_errors
46-
debug_pause "Cloudflare Zlib"
46+
debug_pause "zlib"
4747

4848
# Retrieve Latest PCRE2
4949
/usr/local/bin/enginescript/scripts/install/pcre/pcre-install.sh 2>> /tmp/enginescript_install_errors.log

0 commit comments

Comments
 (0)