Manual merge to main, remote hands for Wouter

Author: bwbroersma

.devcontainer/devcontainer.json

@@ -0,0 +1,9 @@
+{
+  // "image": "ghcr.io/internetstandards/tools:latest",
+  "dockerFile": "${localWorkspaceFolder}/docker/Dockerfile",
+  "target": "tools",
+  "context": "${localWorkspaceFolder}/",
+  "options": ["--platform=linux/amd64"],
+  "workspaceMount": "source=${localWorkspaceFolder},target=/source,type=bind,consistency=cached",
+  "workspaceFolder": "/source"
+}

.github/workflows/docker.yml

@@ -19,11 +19,12 @@ env:
   # should be used to transfer images between jobs. Forked and dependabot builds don't
   # have permission to push to registry.
   use_registry: ${{ ! (github.event_name == 'pull_request' && (github.event.pull_request.head.repo.full_name != github.repository || startsWith(github.head_ref, 'dependabot/'))) }}
+  COMPOSE_VERSION: 2.40.3
 
 jobs:
   # builds all docker images in parallel
   build-docker:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     strategy:
       matrix:
@@ -34,9 +35,9 @@ jobs:
           - image: unbound
             dockerfile: docker/Dockerfile
             target: unbound
-          - image: linttest
+          - image: tools
             dockerfile: docker/Dockerfile
-            target: linttest
+            target: tools
           - image: test-runner
             dockerfile: docker/test-runner.Dockerfile
             target:
@@ -51,7 +52,8 @@ jobs:
             target:
 
     outputs:
-      internetnl_version: ${{ steps.get_version.outputs.internetnl_version }}
+      release: ${{ steps.get_version.outputs.release }}
+      scm_version: ${{ steps.get_version.outputs.scm_version }}
 
     steps:
       - name: Debug info
@@ -83,10 +85,14 @@ jobs:
         id: get_version
         run: |
           pip -q install setuptools_scm
-          # '+' and '/' is not supported in Docker Image tags
+          # determine version number from Git information
           scm_version=$(echo 'from setuptools_scm import get_version; print(get_version(version_scheme="release-branch-semver"))' | python)
           branch_version_suffix=${GITHUB_HEAD_REF:+-$GITHUB_HEAD_REF}
-          echo "internetnl_version=$scm_version$branch_version_suffix" | tr '+' '-'| tr '/' '-' | tee -a "$GITHUB_OUTPUT"
+          # release is the version used for the docker image tag
+          # '+' and '/' is not supported in Docker Image tags, so replace those from the SCM version with '-'
+          echo "release=$scm_version$branch_version_suffix" | tr '+' '-'| tr '/' '-' | tee -a "$GITHUB_OUTPUT"
+          # scm_version is valid PEP 440 and used as SETUPTOOLS_SCM_PRETEND_VERSION in Docker builds
+          echo "scm_version=$scm_version$branch_version_suffix" | tee -a "$GITHUB_OUTPUT"
           # generate docker image tag used for PR specific caching and PR specific auto deploy
           echo "github_ref_name_slug=${{github.ref_name}}" | tr '+' '-'| tr '/' '-' | tee -a "$GITHUB_OUTPUT"
 
@@ -123,7 +129,7 @@ jobs:
           # tag image with current setuptools_scm generated version
           # and tag with PR source branch (eg: feature-x)
           tags: |
-            ${{ env.DOCKER_REGISTRY }}/${{ matrix.image }}:${{ steps.get_version.outputs.internetnl_version }}
+            ${{ env.DOCKER_REGISTRY }}/${{ matrix.image }}:${{ steps.get_version.outputs.release }}
             ${{ env.DOCKER_REGISTRY }}/${{ matrix.image }}:${{ steps.get_version.outputs.github_ref_name_slug }}
           # use latest build from main, or image previously build by this PR for caching
           cache-from: |
@@ -135,7 +141,8 @@ jobs:
           # pass in version information
           build-args: |
             BUILDKIT_INLINE_CACHE=1
-            RELEASE=${{ steps.get_version.outputs.internetnl_version }}
+            SCM_VERSION=${{ steps.get_version.outputs.scm_version }}
+            RELEASE=${{ steps.get_version.outputs.release }}
 
       - name: Build ${{ matrix.image }} (for main)
         # build for pushes to the main branch
@@ -150,7 +157,7 @@ jobs:
           # tag image with current setuptools_scm generated version
           # and tag with current branch name (eg: main)
           tags: |
-            ${{ env.DOCKER_REGISTRY }}/${{ matrix.image }}:${{ steps.get_version.outputs.internetnl_version }}
+            ${{ env.DOCKER_REGISTRY }}/${{ matrix.image }}:${{ steps.get_version.outputs.release }}
             ${{ env.DOCKER_REGISTRY }}/${{ matrix.image }}:main
           # use latest build from main for caching
           cache-from: |
@@ -161,7 +168,8 @@ jobs:
           # pass in version information
           build-args: |
             BUILDKIT_INLINE_CACHE=1
-            RELEASE=${{ steps.get_version.outputs.internetnl_version }}
+            SCM_VERSION=${{ steps.get_version.outputs.scm_version }}
+            RELEASE=${{ steps.get_version.outputs.release }}
 
       - name: Build ${{ matrix.image }} (for release)
         # build for tagged releases
@@ -175,7 +183,7 @@ jobs:
           target: ${{ matrix.target }}
           # tag image with current setuptools_scm generated version and tag 'latest'
           tags: |
-            ${{ env.DOCKER_REGISTRY }}/${{ matrix.image }}:${{ steps.get_version.outputs.internetnl_version }}
+            ${{ env.DOCKER_REGISTRY }}/${{ matrix.image }}:${{ steps.get_version.outputs.release }}
             ${{ env.DOCKER_REGISTRY }}/${{ matrix.image }}:latest
           # use latest build from main for caching
           cache-from: |
@@ -186,7 +194,8 @@ jobs:
           # pass in version information
           build-args: |
             BUILDKIT_INLINE_CACHE=1
-            RELEASE=${{ steps.get_version.outputs.internetnl_version }}
+            SCM_VERSION=${{ steps.get_version.outputs.scm_version }}
+            RELEASE=${{ steps.get_version.outputs.release }}
 
       - name: Build ${{ matrix.image }} (for forked PR's or dependabot)
         # build for forked PR's that don't have permissions to push to the container registry or dependabot PR's
@@ -200,7 +209,7 @@ jobs:
           target: ${{ matrix.target }}
           # tag image with current setuptools_scm generated version
           tags: |
-            ${{ env.DOCKER_REGISTRY }}/${{ matrix.image }}:${{ steps.get_version.outputs.internetnl_version }}
+            ${{ env.DOCKER_REGISTRY }}/${{ matrix.image }}:${{ steps.get_version.outputs.release }}
           # use latest build from main for caching
           cache-from: |
             ${{ env.DOCKER_REGISTRY }}/${{ matrix.image }}:main
@@ -209,12 +218,13 @@ jobs:
           # makes build images better usable as cache by allowing individual layers to be pulled from cache
           # pass in version information
           build-args: |
-            RELEASE=${{ steps.get_version.outputs.internetnl_version }}
+            SCM_VERSION=${{ steps.get_version.outputs.scm_version }}
+            RELEASE=${{ steps.get_version.outputs.release }}
 
       - name: Save image to disk (for forked PR's or dependabot)
         # trigger only for forked PR's that don't have permissions to push to the container registry
         if: ${{ env.use_registry == 'false' }}
-        run: docker save ${{ env.DOCKER_REGISTRY }}/${{ matrix.image }}:${{ steps.get_version.outputs.internetnl_version }} | gzip > "${{ matrix.image }}.tar.gz"
+        run: docker save ${{ env.DOCKER_REGISTRY }}/${{ matrix.image }}:${{ steps.get_version.outputs.release }} | gzip > "${{ matrix.image }}.tar.gz"
 
       - name: Upload image as build artifact (for forked PR's or dependabot)
         # trigger only for forked PR's that don't have permissions to push to the container registry
@@ -227,7 +237,7 @@ jobs:
           retention-days: 1
 
   docs:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     needs: [build-docker]
     steps:
       - name: Branch deployment docs
@@ -242,7 +252,7 @@ jobs:
                 --volume /opt/Internet.nl:/opt/Internet.nl \\
                 --network none \\
                 --env DOCKER_REGISTRY=${{ env.DOCKER_REGISTRY }} \\
-                ${{ env.DOCKER_REGISTRY }}/util:${{ needs.build-docker.outputs.internetnl_version }} \\
+                ${{ env.DOCKER_REGISTRY }}/util:${{ needs.build-docker.outputs.release }} \\
                 /deploy.sh
           EOF
 
@@ -253,7 +263,7 @@ jobs:
 
     env:
       # used in `compose.yaml` files to determine version of images to pull
-      RELEASE: "${{ needs.build-docker.outputs.internetnl_version }}"
+      RELEASE: "${{ needs.build-docker.outputs.release }}"
       PY_COLORS: "1"
 
     steps:
@@ -272,7 +282,7 @@ jobs:
           sudo apt-get update
 
           # upgrade Docker
-          sudo apt install --upgrade docker-ce docker-compose-plugin=2.33.0\*
+          sudo apt install --upgrade docker-ce docker-compose-plugin=$COMPOSE_VERSION\*
 
       - name: Debug info
         run: |
@@ -374,11 +384,11 @@ jobs:
   lintcheck:
     name: lint/check
     needs: [build-docker]
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     env:
       # used in `compose.yaml` files to determine version of images to pull
-      RELEASE: "${{ needs.build-docker.outputs.internetnl_version }}"
+      RELEASE: "${{ needs.build-docker.outputs.release }}"
 
     steps:
       - name: Debug info
@@ -433,7 +443,7 @@ jobs:
 
     env:
       # used in `compose.yaml` files to determine version of images to pull
-      RELEASE: "${{ needs.build-docker.outputs.internetnl_version }}"
+      RELEASE: "${{ needs.build-docker.outputs.release }}"
       PY_COLORS: "1"
 
     steps:
@@ -452,7 +462,7 @@ jobs:
           sudo apt-get update
 
           # upgrade Docker
-          sudo apt install --upgrade docker-ce docker-compose-plugin=2.33.0\*
+          sudo apt install --upgrade docker-ce docker-compose-plugin=$COMPOSE_VERSION\*
 
       - name: Debug info
         run: |
@@ -521,7 +531,7 @@ jobs:
 
     env:
       # used in `compose.yaml` files to determine version of images to pull
-      RELEASE: "${{ needs.build-docker.outputs.internetnl_version }}"
+      RELEASE: "${{ needs.build-docker.outputs.release }}"
 
     steps:
       - name: Install specific Docker/Compose versions that are known to work
@@ -539,7 +549,7 @@ jobs:
           sudo apt-get update
 
           # upgrade Docker
-          sudo apt install --upgrade docker-ce docker-compose-plugin=2.33.0\*
+          sudo apt install --upgrade docker-ce docker-compose-plugin=$COMPOSE_VERSION\*
 
       - name: Debug info
         run: |
@@ -638,7 +648,7 @@ jobs:
 
     env:
       # used in `compose.yaml` files to determine version of images to pull
-      RELEASE: "${{ needs.build-docker.outputs.internetnl_version }}"
+      RELEASE: "${{ needs.build-docker.outputs.release }}"
       PY_COLORS: "1"
 
     steps:
@@ -657,7 +667,7 @@ jobs:
           sudo apt-get update
 
           # upgrade Docker
-          sudo apt install --upgrade docker-ce docker-compose-plugin=2.33.0\*
+          sudo apt install --upgrade docker-ce docker-compose-plugin=$COMPOSE_VERSION\*
 
       - name: Debug info
         run: |
@@ -725,7 +735,7 @@ jobs:
 
       - name: Collect Docker Compose logs
         if: always()
-        run: make logs-all-dump env=test > docker-compose.log
+        run: make logs-all-dump env=batch-test > docker-compose.log
 
       - uses: test-summary/action@v2.3
         with:

.gitignore

@@ -27,7 +27,7 @@ __pycache__
 *.log
 *.pid
 /tests/.pytest_cache/
-/node_modules
+Internet.nl.egg-info/
 
 # Pycharm defaults
 .idea

.gitmodules

@@ -1,12 +1,3 @@
 [submodule "vendor/unbound"]
 	path = vendor/unbound
 	url = https://github.com/internetstandards/unbound.git
-[submodule "vendor/nassl"]
-	path = vendor/nassl
-	url = https://github.com/internetstandards/nassl.git
-[submodule "vendor/openssl-1.0.2e"]
-	path = vendor/openssl-1.0.2e
-	url = https://github.com/PeterMosmans/openssl.git
-[submodule "vendor/openssl-master"]
-	path = vendor/openssl-master
-	url = https://github.com/openssl/openssl.git

.well-known/security.txt

@@ -1,6 +1,8 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA512
 
+Hash: SHA512
+
 # Canonical URLs
 Canonical: https://internet.nl/.well-known/security.txt
 Canonical: https://www.internet.nl/.well-known/security.txt
@@ -28,20 +30,21 @@ Encryption: https://internet.nl/static/question@internet.nl_0x45028563.asc
 # Our security policy
 Policy: https://internet.nl/disclosure/
 
-Expires: 2026-09-25T00:00:00Z
+Expires: 2027-04-10T00:00:00Z
 -----BEGIN PGP SIGNATURE-----
 
-iQIzBAEBCgAdFiEErLeIKUx+ErrpIoxg2JThX0UChWMFAmjWfAcACgkQ2JThX0UC
-hWNptw/8ChAXXJcowrTy5y0xYw2YPx0a26M/bTBIZ2TsH0ewmhOHJEOXK9S1V6+I
-oszXGBmm9fUDEXlMC7+f1QfXWXt8Xh1OVd9HOTqVvQ4lmb2XbefGuR6hFuHaveEx
-Ac5nVVpkxwUzBJOQ0idK3bA+cLdosx6JEMPQoKWVPceaTake3TckQ22TEHBRro5z
-i7FAdEfqCjMT1r682cjNa95Q2gj7To06SmU4f/+0O2sjA64FVpOGRjC/Ka5YolZ6
-xLnnHQGz3FuQnKKVSF29l2RnbtNiL9Arr9xUekY8RoO7c7t7/Hwslp/lyYBHWHUZ
-3eeh4bkLgbfLICsjFWhQjU5uHp92ObMF+2N55d4C2oZp+o5C6BfdXW5nACLBreOV
-AjIUpzn59qpRPwV8dni6qzE0+BodIp6yAzBynXoCFoc7+mRK4Njtsr5Ci8Mz7Y2R
-7iBkor6xHmEssyJi2tCWSuZlQUcKx/JKRAKZI3yIOQab7lqfB8cLXogaEgtpAt1U
-8miL7wxKONyJM5bYOcf7UmpQutvRIWB3ZKtw/b0V8i/HCl7IzpyRASgwGbi93cqD
-EQw6/W5v4AtqoktNdxvWKyi+3NORfBdYHkCnLDGWtMMJpbW17iD4RVg866ode0Sv
-ukBLiBbSZTIJjv9294oKjRgKnZgy9PZ1+6bxLjmBl8k9XQJrQ18=
-=LFEm
+iQJiBAEBCgBMFiEErLeIKUx+ErrpIoxg2JThX0UChWMFAmniJ8wbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzEhx2cmFhZ0BpbnRlcm5ldC5ubAAKCRDYlOFfRQKF
+YzrhD/9e3YMNFNWG4mviKceBABcJzEnuIqzC98f4dv+1rE4NCfrSJBWSFdqJqtsJ
+q5C34/Ny93PpuzhKB49FWZaASarmf7sBvWkwIVnOGY8BLLUT64XxPAOB8GCa2Lzl
+92KRWm3idBvsP4ovh/rdwuEl/pTuCFj4fUNGeK1gJdnE/b9hn2Hc8ozlNXPINYhE
+mcfZrw8Ez2XrJ3iJZ2yvRyui/btJGo0b912eb94g0uI1bQszOt7hq3Ah8I4DagHK
+yNPrJ/en9M4hyZepz/4I3Qzxtwrv4SloMwcF1fYn7ZyWY47OlQILrqauGzzLAXH4
+UT8c09LKEapc5ISNrq5MYnn6jMSIR78rLkcd37KVpeU9wKD/anDbSfa3++pT5M+A
+mYhTNh8CyU9FZD/f3Ux7R6RTPPCytiAocas5HC5NmPhc8vEx0TZ2J2l8uZorBwri
+46A2+4AaVCIo/QYl4yWpjt/734Om4wegmOdUTMMW6o39sxQLvjGs0JfwwhTbUdLc
+OeYRV4WOQRexxOxEQi28uLt0UOp/kuBHVmvMKSUQgxfykHMn7lIZgfuiFavNge28
+ofXtxLP+0vRR2oJusb47yIAerLUUQmPt12pqI3awn2qgHOpb8zmrBMS3mC0j1+VI
+EtSsBnMpBqJBqCzG2odFkSy/7cip8ybwchSVfJQ+Zrmf80bcUQ==
+=zDK4
 -----END PGP SIGNATURE-----