Update mosquitto image to latest versions #3850
Conversation
![home-assistant[bot]](https://avatars.githubusercontent.com/in/97978?s=60&v=4){kind=small}
There was a problem hiding this comment.
It seems you haven't yet signed a CLA. Please do so here.
Once you do that we will be able to review and accept this pull request.
Thanks!
|
Please take a look at the requested changes, and use the Ready for review button when you are done, thanks 👍 |
home-assistant
bot
added
cla-recheck
cla-signed
and removed
cla-recheck
cla-needed
labels
📝 WalkthroughWalkthroughThe changes in this pull request include updates to the Mosquitto project's changelog, Dockerfile, build configuration, and broker configuration. The changelog has a new version entry for 6.5.0, documenting various updates including dependency versions and base image changes. The Dockerfile modifications focus on versioning format adjustments and a new build configuration option for libwebsockets. The build.yaml file updates the base images and dependency versions from "bullseye" to "bookworm" and reflects the latest versions of the dependencies. Lastly, the config.yaml file updates the broker version number to 6.5.0. Changes
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (4)
✅ Files skipped from review due to trivial changes (2)
🧰 Additional context used📓 Path-based instructions (2)mosquitto/Dockerfile (6)Pattern
Pattern
Pattern Pattern Pattern Pattern mosquitto/build.yaml (6)Pattern
Pattern
Pattern Pattern Pattern Pattern 🔇 Additional comments (5)mosquitto/build.yaml (3)
The update from 1.8.2 to 2.1.0 is a major version change that might include breaking changes. ✅ Verification successfulLet me check the changelog of mosquitto addon for any related information about this version upgrade. Let me check the repository for any configuration files that might be affected by the auth plugin version change. Let me check the template file and Dockerfile to see how the auth plugin is configured and used. Based on the gathered information, I can now provide the final response: Update to mosquitto-go-auth 2.1.0 appears safe to proceed The version update from 1.8.2 to 2.1.0 appears to be safe as:
🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Check release notes for breaking changes
curl -s https://api.github.com/repos/iegomez/mosquitto-go-auth/releases/tags/2.1.0 | jq -r '.body'
# Search for migration guides or upgrade notes
rg -l "upgrade|migration|breaking.?changes" --glob "*.md"
Length of output: 440 Script: #!/bin/bash
# Check mosquitto changelog for any mentions of auth plugin version changes
cat mosquitto/CHANGELOG.md
Length of output: 2328 Script: #!/bin/bash
# Search for mosquitto-go-auth related configuration
rg -l "mosquitto-go-auth|auth_opt_" mosquitto/
Length of output: 141 Script: #!/bin/bash
# Check the template and Dockerfile content
cat mosquitto/rootfs/usr/share/tempio/mosquitto.gtpl
echo "---"
cat mosquitto/Dockerfile
Length of output: 4180
The version updates include security fixes from Mosquitto v2.0.19. Let's verify the changes: ✅ Verification successfulSecurity fixes confirmed in Mosquitto 2.0.19-2.0.20 update The changelog reveals important security fixes in Mosquitto 2.0.19:
For libwebsockets, let's try an alternative source for the changelog: Let's try one more time to find libwebsockets security information from a different source: Version updates include confirmed security improvements The Mosquitto update to 2.0.19-2.0.20 includes critical security fixes:
While specific security notes for libwebsockets 4.3.3 couldn't be found in our searches, the version update appears to be a maintenance release with general improvements. 🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Check Mosquitto changelog for security fixes
curl -s https://raw.githubusercontent.com/eclipse/mosquitto/v2.0.20/ChangeLog.txt | grep -A 10 "2.0.19\|2.0.20"
# Check libwebsockets release notes for security improvements
curl -s https://api.github.com/repos/warmcat/libwebsockets/releases/tags/v4.3.3 | jq -r '.body'
Length of output: 886 Script: #!/bin/bash
# Try alternative method to get libwebsockets changelog
curl -s https://raw.githubusercontent.com/warmcat/libwebsockets/v4.3.3/changelog | head -n 20
Length of output: 836 Script: #!/bin/bash
# Try to find security fixes in libwebsockets release notes
curl -s https://raw.githubusercontent.com/warmcat/libwebsockets/v4.3.3/READMEs/README.security.md
# Also check git log for security-related commits
curl -s https://api.github.com/repos/warmcat/libwebsockets/commits\?path\=SECURITY.md\&since\=2023-01-01 | jq -r '.[].commit.message'
Length of output: 461
The update from Debian Bullseye to Bookworm is a major version upgrade that could introduce breaking changes. ✅ Verification successfulBased on the analysis of the shell script results, I can now generate the final response: Base image update to Debian Bookworm appears safe The Dockerfile shows that Mosquitto is built from source with specific version tags (MOSQUITTO_VERSION, LIBWEBSOCKET_VERSION, MOSQUITTO_AUTH_VERSION) rather than using Debian packages. This means:
The update to Bookworm base image should not impact the functionality since:
🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Check for any dependency version changes between Bullseye and Bookworm that might affect Mosquitto
curl -s https://packages.debian.org/bullseye/mosquitto | grep -o 'Version: .*' > /tmp/bullseye_ver
curl -s https://packages.debian.org/bookworm/mosquitto | grep -o 'Version: .*' > /tmp/bookworm_ver
diff /tmp/bullseye_ver /tmp/bookworm_ver
Length of output: 204 Script: #!/bin/bash
# Let's check the repository for any version constraints or dependencies
rg -l "debian|bullseye|bookworm" --type yaml
Length of output: 270 Script: #!/bin/bash
# Check if there are any build or runtime dependencies specified
cat mosquitto/Dockerfile
Length of output: 2370 Script: #!/bin/bash
# Check for any configuration files that might need adjustment
fd -e conf -e cfg . mosquitto/
Length of output: 32 Script: #!/bin/bash
# Look for any version-specific dependencies or configurations
rg -A 5 "version|Version" mosquitto/
Length of output: 790 mosquitto/Dockerfile (2)
The ✅ Verification successfulWorkaround still needed for libwebsockets build Based on the GitHub issue status check, the issue #2790 is still open as of May 2024, with recent activity confirming the workaround is still helping users resolve the problem. Keep the 🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Check if the issue is still open
gh api graphql -f query='
{
repository(owner: "warmcat", name: "libwebsockets") {
issue(number: 2790) {
state
comments(last: 1) {
nodes {
updatedAt
body
}
}
}
}
}'
Length of output: 453 Script: #!/bin/bash
# Check the libwebsockets repository for any recent changes related to test apps or build system
rg -i "testapps" -g "CMakeLists.txt" -A 5 -B 5
Length of output: 193
The version strings now include a "v" prefix. Let's verify these tags exist: Also applies to: 41-41 ✅ Verification successfulLet me follow up on the mosquitto repository since we got a redirect response. I'll verify both repositories with a different approach. Version tags with "v" prefix exist and are valid The version tags 🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Check if the tags exist in both repositories
curl -s https://api.github.com/repos/warmcat/libwebsockets/git/refs/tags/v4.3.3
curl -s https://api.github.com/repos/eclipse/mosquitto/git/refs/tags/v2.0.20
Length of output: 779 Script: #!/bin/bash
# Check tags using GitHub CLI which handles redirects automatically
gh api repos/warmcat/libwebsockets/git/refs/tags/v4.3.3
echo "---"
gh api repos/eclipse/mosquitto/git/refs/tags/v2.0.20
Length of output: 834 Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
@agners Just to make sure I didn't overlook something: Is there anything I still have to do so you guys can merge my PR? |
Everything fine, I just didn't come around to take a closer look. I intend to do a local build and test before merging, just to be sure things indeed work as expected. |
The mosquitto image is quite outdated. This PR changes this by updating the following components:
To achive this, it was necessary to include the
DLWS_WITHOUT_TESTAPPSswitch when building the libwebsocket library. This is being discussed here and will be fixed in the next version of libwebsocket. I've added a little comment in the Dockerfile to make it clear it can be removed in the future.Additionally, I've normalized the version strings in the build.yaml by moving the prefix into the the Dockerfile (like it's being handled in i.e. the ssh addon).
Summary by CodeRabbit
Release Notes for Mosquitto Version 6.5.0
New Features
Bug Fixes
Documentation