From 4fc0f9815d59a0d6680aa06d1bfabd183a139185 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Mon, 26 Oct 2026 10:05:50 +0100
Subject: [PATCH 1/2] fix(docker): build brotli 1.2.1 on bookworm

Bookworm ships libbrotli 1.0.9, but cbrotli v1.2.1 needs the 1.1 shared
dictionary API, so every bookworm image failed to build. Build brotli
1.2.1 from source when the distro version is too old and ship it in the
runner, which also gives PHP's curl the CVE-2026-111497 fix.
---
 Dockerfile | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 33009fa70a..47e4d4421c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -83,6 +83,26 @@ RUN apt-get update && \
 	&& \
 	apt-get clean
 
+# Bookworm ships libbrotli 1.0.9, cbrotli needs >= 1.1 and 1.2.1 fixes CVE-2026-111497
+ARG BROTLI_VERSION=1.2.1
+ARG BROTLI_SHA256=98d35d11a78dc453aebb7d10c3748f3f73ff78c8267c0dc697b8631f67bf7e8f
+WORKDIR /usr/local/src/brotli
+RUN <<'EOF'
+set -e
+if pkg-config --atleast-version=1.1 libbrotlienc; then
+	exit 0
+fi
+curl -fsSL -o brotli.tar.gz "https://github.com/google/brotli/archive/refs/tags/v${BROTLI_VERSION}.tar.gz"
+echo "${BROTLI_SHA256}  brotli.tar.gz" | sha256sum -c -
+tar xzf brotli.tar.gz --strip-components 1
+cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF
+cmake --build build
+cmake --install build
+# Multiarch dirs sort before libc.conf on arm64, arm and i386, so the distro libbrotli would win
+echo /usr/local/lib > /etc/ld.so.conf.d/000-brotli.conf
+ldconfig
+EOF
+
 # Install e-dant/watcher (necessary for file watching)
 WORKDIR /usr/local/src/watcher
 RUN --mount=type=secret,id=github-token <<'EOF'
@@ -137,11 +157,12 @@ FROM common AS runner
 
 ENV GODEBUG=cgocheck=0
 
-# copy watcher shared library
-COPY --from=builder /usr/local/lib/libwatcher* /usr/local/lib/
+# copy watcher and brotli (bookworm only) shared libraries
+COPY --from=builder /usr/local/lib/libwatcher* /usr/local/lib/libbrotli* /usr/local/lib/
 # fix for the file watcher on arm
 RUN apt-get install -y --no-install-recommends libstdc++6 && \
 	apt-get clean && \
+	if [ -e /usr/local/lib/libbrotlicommon.so.1 ]; then echo /usr/local/lib > /etc/ld.so.conf.d/000-brotli.conf; fi && \
 	ldconfig && \
 	# Remove files with non-deterministic content (embedded timestamps and mtimes) to keep image digests reproducible
 	rm -rf /var/log/apt /var/log/dpkg.log /var/log/alternatives.log /var/cache/ldconfig/aux-cache

From a11a364fdc1c142493951ca67aa84fa0bfd0fdc8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= <kevin@dunglas.fr>
Date: Mon, 26 Oct 2026 10:54:30 +0100
Subject: [PATCH 2/2] fix(docker): inline the brotli version and mark the build
 as temporary

---
 Dockerfile | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 47e4d4421c..a5f7afd6ef 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -83,17 +83,15 @@ RUN apt-get update && \
 	&& \
 	apt-get clean
 
-# Bookworm ships libbrotli 1.0.9, cbrotli needs >= 1.1 and 1.2.1 fixes CVE-2026-111497
-ARG BROTLI_VERSION=1.2.1
-ARG BROTLI_SHA256=98d35d11a78dc453aebb7d10c3748f3f73ff78c8267c0dc697b8631f67bf7e8f
+# TODO: temporary, remove with Bookworm (and in the runner): it ships libbrotli 1.0.9, cbrotli needs >= 1.1 and 1.2.1 fixes CVE-2026-111497
 WORKDIR /usr/local/src/brotli
 RUN <<'EOF'
 set -e
 if pkg-config --atleast-version=1.1 libbrotlienc; then
 	exit 0
 fi
-curl -fsSL -o brotli.tar.gz "https://github.com/google/brotli/archive/refs/tags/v${BROTLI_VERSION}.tar.gz"
-echo "${BROTLI_SHA256}  brotli.tar.gz" | sha256sum -c -
+curl -fsSL -o brotli.tar.gz https://github.com/google/brotli/archive/refs/tags/v1.2.1.tar.gz
+echo "98d35d11a78dc453aebb7d10c3748f3f73ff78c8267c0dc697b8631f67bf7e8f  brotli.tar.gz" | sha256sum -c -
 tar xzf brotli.tar.gz --strip-components 1
 cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF
 cmake --build build
@@ -157,7 +155,7 @@ FROM common AS runner
 
 ENV GODEBUG=cgocheck=0
 
-# copy watcher and brotli (bookworm only) shared libraries
+# copy watcher and brotli (Bookworm only, temporary) shared libraries
 COPY --from=builder /usr/local/lib/libwatcher* /usr/local/lib/libbrotli* /usr/local/lib/
 # fix for the file watcher on arm
 RUN apt-get install -y --no-install-recommends libstdc++6 && \