ftp.pcre.org FTP site is no longer available

[woodgear]

docker-openresty/alpine/Dockerfile

Line 125 in 76de475

&& curl -fSL https://ftp.pcre.org/pub/pcre/pcre-${RESTY_PCRE_VERSION}.tar.gz -o pcre-${RESTY_PCRE_VERSION}.tar.gz \

https://www.pcre.org/#:~:text=note%20that%20the%20former%20ftp.pcre.org%20ftp%20site%20is%20no%20longer%20available

[neomantra]

Thank you for bringing this to my attention. The PCRE website says to download from GitHub, but they only have the source code and releases for PCRE2. Upstream OpenResty requires PCRE1, so that is something I cannot change...

So there is no stable place to download the PCRE1 source code. I do not want to download from random SourceForge mirrors -- the URL for that is unstable (the DNS name can change) and untrusted.

One option is to use the system PCRE packages instead. For Alpine, that seems to be at 8.44. For Ubuntu/Debian, that seems to be at 8.39.

Another option is to ask the upstream PCRE devs to put PCRE1 releases on GitHub. But, perhaps this move was made to force people to use PCRE2.

I am interested in seeing what the OpenResty devs do about this.

[dndx]

@neomantra Could you give #194 a test? On our build using the SourceForge mirror fixed the issues (and is recommended by pcre.org homepage).

[neomantra]

@dndx OK, I was actually about to push the "use system libraries" approach. It is consistent with the OpenResty documentation.

But, if upstream OpenResty is going to use SourceForge mirrors then I'll do that approach. Can you please confirm this?

I'll test #194 in the meantime -- changing the URL is simpler and continues to give users control of the exact PCRE version.

[neomantra]

That worked fine and that SourceForge link is reliable. When I was using the SourceForge website, it kept sending me to random mirrors. Thanks again!

[MatthewVernon]

PCRE1 is obsolete and doesn't get any updates any more, you should really be using PCRE2 now.

[neomantra]

@MatthewVernon These images use whatever upstream OpenResty uses... when they've moved to and tested PCRE2, then these images will use it.

[vinh-nguyen-mesoneer]

Although the PR was merged, I would like to give my improvement, it's better to include the SHA-256 for the PCRE1 package, so that we could verify the downloaded package.

[neomantra]

@vinhnguyen-ubitec Thanks for the suggestion, I just made that change and pushed it.

[dndx]

PCRE1 is obsolete and doesn't get any updates any more, you should really be using PCRE2 now.

I don't think Nginx supports PCRE2 yet, so that's the biggest reason why OpenResty is still on PCRE1.