images/nginx: upgrade nginx 1.27.1 → 1.30.1 (security)

[samudm98]

Summary

This PR upgrades the nginx base image from nginx/1.27.1 to nginx/1.30.1 to address known security vulnerabilities present in older nginx versions. Since the upstream kubernetes/ingress-nginx project is no longer actively maintained, this fork takes ownership of the upgrade.

The cluster currently runs an ingress-nginx controller that packages nginx/1.21.6, which contains known CVEs. This change targets nginx/1.30.1, the latest stable release (as of May 2026).

---

Commits

1. images/nginx: bump nginx base image to v2.3.0 (nginx 1.30.1)

Updates images/nginx/rootfs/build.sh and images/nginx/TAG:

Variable	Before	After	Reason
NGINX_VERSION	1.27.1	1.30.1	Security upgrade
nginx tarball SHA256	66dc708...	99765000...	Updated checksum
NJS_VERSION	0.9.0	0.9.9	Latest stable (2026-05-19), compatible with nginx 1.30.x
LUA_NGX_VERSION	v0.10.28	v0.10.29	Latest stable, nginx 1.30.x compatible
LUA_STREAM_NGX_VERSION	v0.0.16	v0.0.17	Latest stable
LUA_RESTY_CORE	v0.1.31	v0.1.32	Required by lua-nginx-module v0.10.29
images/nginx/TAG	v2.2.9	v2.3.0	New image tag

2. images/nginx: rename and drop patches for nginx 1.30.1

• Renamed all 34 patches from *nginx-1.27.1* → *nginx-1.30.1*.
  Patch content is unchanged — all 34 patches were verified with patch --dry-run -p1 against the nginx 1.30.1 source tree and apply cleanly with zero rejected hunks.

• Deleted 28_nginx-1.27.1-CVE-2025-23419.patch:
  This patch was a backport of the fix for CVE-2025-23419 (insufficient SNI check in TLSv1.3 virtual server handling, allows session reuse across virtual servers to bypass client certificate verification) into nginx 1.27.1. The vulnerability was officially fixed upstream in nginx 1.27.4 and is therefore already present in nginx 1.30.1. Keeping this patch would introduce conflicting code in ngx_http_request.c and ngx_stream_ssl_module.c.

3. build: align with forkline improvements for nginx 1.30.1

Adds retry logic with gzip integrity validation to the get_src() function in build.sh. Downloads are retried up to 3 times if the fetched file fails gzip -t validation (truncated/corrupt download), with an explicit error and non-zero exit on final failure. This improves build reliability in flaky network environments.

---

Security context

The following CVEs are fixed between nginx 1.21.6 (current cluster version) and nginx 1.30.1:

CVE	Fixed in	Description
CVE-2025-23419	nginx 1.27.4	SNI/TLSv1.3 session reuse across virtual servers bypasses client cert verification
Multiple	nginx 1.23–1.30	Various HTTP/2, proxy, and resolver fixes across the 1.22–1.30 release series

---

Verification

The nginx 1.30.1 image was built and verified locally:

$ docker run --rm nginx-test:v2.3.0 nginx -v
nginx version: nginx/1.30.1

$ docker run --rm nginx-test:v2.3.0 ls /etc/nginx/modules/
ngx_http_auth_digest_module.so
ngx_http_brotli_filter_module.so
ngx_http_brotli_static_module.so
ngx_http_geoip2_module.so
ngx_http_js_module.so
ngx_http_modsecurity_module.so
ngx_stream_geoip2_module.so
ngx_stream_js_module.so
otel_ngx_module.so

All 9 dynamic modules compiled and present. All compilation flags (HTTP/2, HTTP/3, stream, SSL, Lua, OpenTelemetry) confirmed via nginx -V.

Note on local amd64 build: Building linux/amd64 locally on Apple Silicon (aarch64 Docker host) triggers a GCC internal error (segfault in lj_opt_mem.c) due to QEMU emulation overhead during LuaJIT compilation. This is a known emulation limitation and does not affect CI builds on native x86_64 runners (GitHub Actions). The linux/arm64 build completes successfully on the local host.

---

Test plan

• CI image build passes for linux/amd64 on GitHub Actions
• CI image build passes for linux/arm64 and linux/arm
• Controller image build (rootfs/Dockerfile) succeeds using the new nginx base image
• nginx -v in the final controller image reports nginx/1.30.1
• Existing CI test suite passes (make test_all equivalent in the ingress-nginx CI)
• Update NGINX_BASE file with the digest of the newly published image

🤖 Generated with Claude Code