Merge pull request #7 from swarupsengupta2007/snyk-fix-0914fd877d8e6d55785455ac01875627

[Snyk] Security upgrade alpine from 3.22.1 to 3.23.3

.github/workflows/cicd.yaml

@@ -0,0 +1,172 @@
+name: CI/CD for Psiphon Docker
+
+on:
+  # Poll upstream Psiphon releases periodically (real builds)
+  schedule:
+    - cron: "0 */6 * * *"  # every 6 hours
+
+  # Manual runs, with an option to do a dry run (no push)
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Dry run (build but DO NOT push to Docker Hub)"
+        required: false
+        default: "true"
+        type: choice
+        options:
+          - "true"
+          - "false"
+
+permissions:
+  contents: read
+
+env:
+  DOCKERHUB_REPO: swarupsengupta2007/psiphon
+  TARGET_PLATFORMS: linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU (for multi-arch)
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Determine dry-run mode
+        id: dryrun
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ github.event.inputs.dry_run }}" = "true" ]; then
+            echo "dry_run=true" >> "$GITHUB_OUTPUT"
+            echo "Running in DRY-RUN mode (no push to Docker Hub)."
+          else
+            echo "dry_run=false" >> "$GITHUB_OUTPUT"
+            echo "Running in NORMAL mode (will push to Docker Hub if needed)."
+          fi
+
+      - name: Get latest psiphon-tunnel-core release & Go version
+        id: psiphon
+        run: |
+          API_URL="https://api.github.com/repos/Psiphon-Labs/psiphon-tunnel-core/releases/latest"
+
+          echo "Fetching latest release from ${API_URL}"
+          RESPONSE=$(curl -fsSL "$API_URL")
+
+          LATEST_TAG=$(echo "$RESPONSE" | jq -r '.tag_name')
+          if [ -z "$LATEST_TAG" ] || [ "$LATEST_TAG" = "null" ]; then
+            echo "Failed to fetch latest tag from Psiphon-Labs/psiphon-tunnel-core"
+            exit 1
+          fi
+
+          VERSION=${LATEST_TAG#v}
+
+          echo "Latest upstream tag: $LATEST_TAG"
+          echo "Normalized version (without v): $VERSION"
+
+          GO_MOD_URL="https://raw.githubusercontent.com/Psiphon-Labs/psiphon-tunnel-core/${LATEST_TAG}/go.mod"
+          echo "Fetching go.mod from: $GO_MOD_URL"
+
+          curl -fsSL "$GO_MOD_URL" -o /tmp/go.mod
+
+          GO_VERSION=$(awk '/^go [0-9]+\.[0-9]+/ {print $2; exit}' /tmp/go.mod)
+          if [ -z "$GO_VERSION" ]; then
+            echo "Could not determine Go version from go.mod; contents:"
+            cat /tmp/go.mod
+            exit 1
+          fi
+
+          echo "Detected Go version from go.mod: $GO_VERSION"
+
+          echo "latest_tag=$LATEST_TAG" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "go_version=$GO_VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Check if this Psiphon version tag already exists on Docker Hub
+        id: check
+        env:
+          DOCKERHUB_REPO: ${{ env.DOCKERHUB_REPO }}
+          VERSION: ${{ steps.psiphon.outputs.version }}
+        run: |
+          echo "Checking if ${DOCKERHUB_REPO}:${VERSION} exists on Docker Hub..."
+
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+            "https://hub.docker.com/v2/repositories/${DOCKERHUB_REPO}/tags/${VERSION}/")
+
+          echo "HTTP status from Docker Hub: $STATUS"
+
+          if [ "$STATUS" -eq 200 ]; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "Image tag ${DOCKERHUB_REPO}:${VERSION} already exists on Docker Hub."
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+            echo "Image tag ${DOCKERHUB_REPO}:${VERSION} does not exist yet."
+          fi
+
+      - name: Build and (maybe) push multi-arch image
+        # In dry-run: always build (even if tag exists), but do NOT push.
+        # In normal mode: only build if tag does not exist, and push.
+        if: steps.dryrun.outputs.dry_run == 'true' || steps.check.outputs.exists != 'true'
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: ${{ env.TARGET_PLATFORMS }}
+          push: ${{ steps.dryrun.outputs.dry_run != 'true' }}
+          tags: |
+            ${{ env.DOCKERHUB_REPO }}:${{ steps.psiphon.outputs.version }}
+            ${{ env.DOCKERHUB_REPO }}:latest
+          build-args: |
+            TARGETS= ${{ env.TARGET_PLATFORMS }}
+            GO_VERSION=${{ steps.psiphon.outputs.go_version }}
+            PSIPHON_VERSION=${{ steps.psiphon.outputs.version }}
+
+      - name: Summary of run (dry-run vs real)
+        if: always()
+        env:
+          DOCKERHUB_REPO: ${{ env.DOCKERHUB_REPO }}
+          VERSION: ${{ steps.psiphon.outputs.version }}
+          LATEST_TAG: ${{ steps.psiphon.outputs.latest_tag }}
+          GO_VERSION: ${{ steps.psiphon.outputs.go_version }}
+          DRY_RUN: ${{ steps.dryrun.outputs.dry_run }}
+          EXISTS: ${{ steps.check.outputs.exists }}
+          TARGET_PLATFORMS: ${{ env.TARGET_PLATFORMS }}
+        run: |
+          echo "================= CI SUMMARY ================="
+          echo "Upstream Psiphon tag:     ${LATEST_TAG}"
+          echo "Normalized version:       ${VERSION}"
+          echo "Go toolchain version:     ${GO_VERSION}"
+          echo "Target platforms:         ${TARGET_PLATFORMS}"
+          echo "Dry-run mode:             ${DRY_RUN}"
+          echo "Tag existed on DockerHub: ${EXISTS}"
+          echo "Image tags considered:    ${DOCKERHUB_REPO}:${VERSION}, ${DOCKERHUB_REPO}:latest"
+
+          if [ "$DRY_RUN" = "true" ]; then
+            echo ""
+            echo "Result: DRY-RUN"
+            echo " - Image was BUILT locally on the runner."
+            echo " - Image was NOT pushed to Docker Hub."
+          else
+            if [ "$EXISTS" = "true" ]; then
+              echo ""
+              echo "Result: SKIPPED PUSH"
+              echo " - Image tag already existed on Docker Hub."
+              echo " - No new image was built/pushed."
+            else
+              echo ""
+              echo "Result: REAL BUILD & PUSH"
+              echo " - Multi-arch image was built."
+              echo " - Pushed: ${DOCKERHUB_REPO}:${VERSION} and :latest"
+            fi
+          fi
+          echo "==============================================="

Dockerfile

@@ -17,7 +17,7 @@ fi
 /go/build.sh ${ARGS}
 __SCRIPT__
 
-FROM alpine:3.22.1
+FROM alpine:3.23.3
 ARG TARGETOS
 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -26,7 +26,7 @@ RUN --mount=type=bind,from=psiphon_builder,source=/go/dist,target=/tmp/psiphon \
 	<<__SCRIPT__
     apk add --no-cache tini
 	cp /tmp/assets/start-psiphon /usr/local/bin/start-psiphon
-	cp /tmp/assets/healtcheck /usr/local/bin/healtcheck
+	cp /tmp/assets/healthcheck /usr/local/bin/healthcheck
 	mkdir -p /etc/psiphon
 	cp /tmp/assets/psiphon.config /etc/psiphon/psiphon.config
 	if [ -z "${TARGETVARIANT}" ]; then
@@ -35,9 +35,9 @@ RUN --mount=type=bind,from=psiphon_builder,source=/go/dist,target=/tmp/psiphon \
 		cp /tmp/psiphon/psiphon_${TARGETOS}_${TARGETARCH}_${TARGETVARIANT} /usr/local/bin/psiphon
 	fi
 	chmod +x /usr/local/bin/start-psiphon 
-	chmod +x /usr/local/bin/healtcheck
+	chmod +x /usr/local/bin/healthcheck
 	chmod +x /usr/local/bin/psiphon
 __SCRIPT__
 ENTRYPOINT ["/sbin/tini", "--"]
 CMD ["/usr/local/bin/start-psiphon"]
-HEALTHCHECK --interval=30s --timeout=5s --start-period=2m --retries=3 CMD healtcheck
+HEALTHCHECK --interval=30s --timeout=5s --start-period=2m --retries=3 CMD healthcheck

README.md

@@ -3,9 +3,9 @@
 Docker image for Psiphon
 
 Psiphon is an Internet censorship circumvention system. <br>
-This docker image runs the ConsoleClient from the [psiphon-tunnel-core](https://github.com/Psiphon-Labs/psiphon-tunnel-core "psiphon-tunnel-core").
+This Docker image runs the ConsoleClient from the [psiphon-tunnel-core](https://github.com/Psiphon-Labs/psiphon-tunnel-core "psiphon-tunnel-core").
 
-> This build uses `docker buildx` plugin with `docker-container` driver. <br>
+> This build uses the `docker buildx` plugin with the `docker-container` driver. <br>
 > Docker image available at [swarupsengupta2007/psiphon](https://hub.docker.com/r/swarupsengupta2007/psiphon "swarupsengupta2007/psiphon"). <br>
 
 ```bash
@@ -15,9 +15,9 @@ git clone https://github.com/swarupsengupta2007/psiphon-docker
 
 # Building<br>
 
-1. Ensure buildx is enabled for docker
+1. Ensure buildx is enabled for Docker
 2. Create a builder instance for multi-arch
-3. Build docker image for current platform or multi-arch
+3. Build Docker image for current platform or multi-arch
 ```bash
 # choose target platforms
 TARGETS="linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6"
@@ -25,13 +25,13 @@ TARGETS="linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6"
 # Create a builder instance if it doesn't exist
 docker buildx create --name cross-platform --platform ${TARGETS} --use 
 
-# Build for current platform and load to docker image
+# Build for the current platform and load to Docker image
 docker buildx build -t <your_tag> . --load
 
 # If not already done, install the required cross-platform emulators
 docker run --privileged --rm tonistiigi/binfmt --install all
 
-# run the script, this will build the image for current platform and load it to docker
+# run the script, this will build the image for the current platform and load it to Docker
 ./make.bash --load
 ```
 
@@ -82,21 +82,21 @@ docker run -d                                  \
     swarupsengupta2007/psiphon
 ```
 
-The following Environment var are available (only applicable when running for the first tome with no psiphon.config in the mounted config directory)<br>
+The following Environment var are available (only applicable when running for the first time with no psiphon.config in the mounted config directory)<br>
 |ENV variable|Description|Default|
 |--|--|--|
 |PUID|The UID for psiphon process|1000|
 |PGID|The GID for psiphon process|1000|
 |HTTP_PORT|The HTTP proxy port|8080|
 |SOCKS_PORT|The SOCKS proxy port|1080|
-|DEVICE_REGION|The device region for psiphon client|IN|
+|DEVICE_REGION|The device region for Psiphon client|IN|
-|EGRESS_REGION|The egress region for psiphon client|SG|
+|EGRESS_REGION|The egress region for Psiphon client|SG|
 
 # Configuration
-The psiphon client configuration is stored in the mounted config directory. /config must be mounted and writable by the psiphon process. <br>
+The Psiphon client configuration is stored in the mounted config directory. /config must be mounted and writable by the psiphon process. <br>
 
 # Healthcheck
-The container has a healthcheck script that checks if the psiphon client is running and healthy. <br>
+The container has a healthcheck script that checks if the Psiphon client is running and healthy. <br>
 You can check the health status of the container using the following command:
 ```bash
 docker inspect --format='{{json .State.Health}}' psiphon

assets/start-psiphon

@@ -19,6 +19,9 @@ if [ ! -f /config/psiphon.config ]; then
     if [ -n "${EGRESS_REGION}" ]; then
         sed -i -E 's/"EgressRegion"[[:space:]]*:[[:space:]]*"[^"]*"/"EgressRegion": "'${EGRESS_REGION}'"/' /config/psiphon.config
     fi
+    if [ -n "${UPSTREAM_PROXY}" ]; then
+        sed -i -E 's|"UpstreamProxyUrl"[[:space:]]*:[[:space:]]*"[^"]*"|"UpstreamProxyUrl": "'${UPSTREAM_PROXY}'"|' /config/psiphon.config
+    fi
 fi
 
 id psiphon > /dev/null 2>&1
@@ -43,4 +46,4 @@ chown -R psiphon:psiphon /config
 
 su -s /bin/sh psiphon <<EOF
 psiphon -config /config/psiphon.config
-EOF
+EOF

build.sh

@@ -61,7 +61,8 @@ CURRENT_TARGET="$(go env GOOS)/$(go env GOARCH)"
 TARGETS=${TARGETS:-"current"}
 
 TARGETS=$(decipher_targets "${TARGETS}")
-TARGETS=${TARGETS//,/ }
+TARGETS=${TARGETS%$'\n'}
+IFS=' ' TARGETS=(${TARGETS//,/ })
 
 BUILD_DIR=$(pwd)/tmp_build_$$
 rm -rf "${BUILD_DIR}"
@@ -77,21 +78,21 @@ pushd "${BUILD_DIR}/ConsoleClient" > /dev/null
 
 export CGO_ENABLED=0
 
-for PLATFORM in ${TARGETS}
+for PLATFORM in "${TARGETS[@]}"
 do
-	IFS='/' read -r OS ARCH VARIANT <<< "${PLATFORM}"
+       echo "Building for ${PLATFORM}..."
-	
+       IFS='/' read -r OS ARCH VARIANT <<< "${PLATFORM}"
-	export GOOS=${OS}
+       export GOOS=${OS}
-	export GOARCH=${ARCH}
+       export GOARCH=${ARCH}
-	if [[ -n "${VARIANT}" ]]; then
+       if [[ -n "${VARIANT}" ]]; then
-		export GOARM=${VARIANT#v}
+	       export GOARM=${VARIANT#v}
-	fi
+       fi
-	GOEXT=""
+       GOEXT=""
-	if [[ "${OS}" == "windows" ]]; then
+       if [[ "${OS}" == "windows" ]]; then
-		GOEXT=".exe"
+	       GOEXT=".exe"
-	fi
+       fi
-	${GO} build -a -tags netgo -ldflags "-s -w -extldflags '-static'" -o "${BIN_DIR}/psiphon_${PLATFORM//\//_}${GOEXT}"
+       ${GO} build -a -tags netgo -ldflags "-s -w -extldflags '-static'" -o "${BIN_DIR}/psiphon_${PLATFORM//\//_}${GOEXT}"
-	unset GOOS GOARCH GOARM
+       unset GOOS GOARCH GOARM
 done
 
 popd > /dev/null

make.bash

@@ -3,19 +3,29 @@
 set -euo pipefail
 IFS=$'\n\t'
 
+MYPATH=$(dirname "$(readlink -f "$0")")
+source "${MYPATH}/latest_version.sh"
+
 function help_message() {
 	echo "Usage: $0 [OPTIONS]"
 	echo "Options:"
 	echo "  --targets, -t <targets>      Comma-separated list of target platforms (default: current, use 'all' for all supported targets)"
-	echo "  --version, -v <version>      Psiphon version to build (default: 2.0.32)"
+	echo "  --version, -v <version>      Psiphon version to build (default: latest available)"
 	echo "  --go, -g <version>           Go version to use (default: 1.22.7)"
-	echo "  --help, -h                   Show this help message and exit"
+	echo "  --nodockerhub		     Don't push image to docker.io"
+	echo "  --noghcr		     Don't push image to gchr.io"
+	echo "  --load                       Load the built image into local Docker (cannot be used with --push)"
+	echo "  --push                       Push the built image to Docker Hub (cannot be used with --load)"
 	echo "  --supported-targets          Show supported targets and exit"
+	echo "  --current-target             Show current target platform and exit"
+	echo "  --help, -h                   Show this help message and exit"
 	exit ${1:-1}
 }
 
 EXTRA_BUILD_ARGS=""
 VERSION=""
+PUSH_DOCKERHUB=1
+PUSH_GHCR=1
 
 while [[ $# -gt 0 ]]; do
 	case "$1" in
@@ -46,6 +56,14 @@ while [[ $# -gt 0 ]]; do
 			GO_VERSION="$2"
 			shift 2
 			;;
+		--nodockerhub)
+			PUSH_DOCKERHUB=0
+			shift
+			;;
+		--noghcr)
+			PUSH_GHCR=0
+			shift
+			;;
 		--supported-targets)
 			echo "Supported targets: $(get_supported_targets)"
 			exit 0
@@ -77,6 +95,11 @@ while [[ $# -gt 0 ]]; do
 	esac
 done
 
+if [[ "${PUSH_GHCR}" == "0" && "${PUSH_DOCKERHUB}" == "0" && "${EXTRA_BUILD_ARGS}" == "--push" ]]; then
+	echo "Cannot disable both ghcr and dockerhub with --push"
+	help_message
+fi
+
 TARGETS=${TARGETS:-"current"}
 GO_VERSION=${GO_VERSION:-1.22.7}
 
@@ -101,9 +124,20 @@ fi
 
 DECIPHERED_TARGETS=$(decipher_targets "${TARGETS}")
 
-docker buildx build \
+TAGS=()
+
+if [[ "${PUSH_DOCKERHUB}" == "1" ]]; then
+	TAGS+=(-t swarupsengupta2007/psiphon:"${VERSION#v}")
+	TAGS+=(-t swarupsengupta2007/psiphon:latest)
+fi
+
+if [[ "${PUSH_GHCR}" == "1" ]]; then
+	TAGS+=(-t ghcr.io/swarupsengupta2007/psiphon:"${VERSION#v}")
+	TAGS+=(-t ghcr.io/swarupsengupta2007/psiphon:latest)
+fi
+
+echo docker buildx build \
 				"${DOCKER_BUILD_ARGS[@]}" \
-				-t swarupsengupta2007/psiphon:"${VERSION#v}" \
+				"${TAGS[@]}" \
-				-t swarupsengupta2007/psiphon:latest \
 				--platform "${DECIPHERED_TARGETS}" . \
 				${EXTRA_BUILD_ARGS}