chore: update Nextcloud and Alpine Linux

.github/workflows/build.yml

@@ -3,7 +3,7 @@ name: build
 on:
   workflow_dispatch:
   push:
-    branches: [ master ]
+    branches: [ version-24 ]
   schedule:
     # Build the image regularly (each Friday)
     - cron: '23 04 * * 5'
@@ -53,7 +53,6 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
-            latest
             ${{ env.FULL_VERSION }}
             ${{ env.MAJOR_VERSION }}
 

Dockerfile

@@ -1,17 +1,17 @@
 # -------------- Build-time variables --------------
-ARG NEXTCLOUD_VERSION=25.0.3
+ARG NEXTCLOUD_VERSION=24.0.12
 ARG PHP_VERSION=8.1
 ARG NGINX_VERSION=1.22
 
-ARG ALPINE_VERSION=3.16
+ARG ALPINE_VERSION=3.17
 ARG HARDENED_MALLOC_VERSION=11
 ARG SNUFFLEUPAGUS_VERSION=0.8.3
 
 ARG UID=1000
 ARG GID=1000
 
-# nextcloud-25.0.3.tar.bz2
+# nextcloud-24.0.12.tar.bz2
-ARG SHA256_SUM="4b2b1423736ef92469096fe24f61c24cad87a34e07c1c7a81b385d3ea25c00ec"
+ARG SHA256_SUM="2f093bdf7d34faf38d22f38a5e11f3aee32746ff4add3df17c790b9b36390836"
 
 # Nextcloud Security <security@nextcloud.com> (D75899B9A724937A)
 ARG GPG_FINGERPRINT="2880 6A87 8AE4 23A2 8372  792E D758 99B9 A724 937A"

README.md

@@ -58,8 +58,8 @@ Verifying the signature isn't a requirement, and might not be as seamless as usi
 ## Tags
 
 - `latest` : latest Nextcloud version
-- `x` : latest Nextcloud x.x (e.g. `25`)
+- `x` : latest Nextcloud x.x (e.g. `24`)
-- `x.x.x` : Nextcloud x.x.x (e.g. `25.0.0`)
+- `x.x.x` : Nextcloud x.x.x (e.g. `24.0.0`)
 
 You can always have a glance [here](https://github.com/users/hoellen/packages/container/package/nextcloud).
 Only the **latest stable version** will be maintained by myself.

SECURITY.md

@@ -7,10 +7,9 @@ and will receive the minor version updates and security patches.
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 25. x   | :white_check_mark: |
 | 24. x   | :white_check_mark: |
-| 23. x   | :negative_squared_cross_mark: |
+| 23. x   | :white_check_mark: |
-| 22. x   | :negative_squared_cross_mark: |
+| 22. x   | :white_check_mark: |
 
 Please update to the latest version available. Major migrations are always tested before being pushed.
 

rootfs/usr/local/etc/php/snuffleupagus/nextcloud-php8.rules

@@ -34,18 +34,16 @@ sp.sloppy_comparison.enable();
 # https://snuffleupagus.readthedocs.io/features.html#protection-against-cross-site-request-forgery
 sp.cookie.name("PHPSESSID").samesite("lax");
 
-# Nextcloud whitelist (tested with Nextcloud 25.0.0)
+# Nextcloud whitelist (tested with Nextcloud 24.0.0)
 sp.disable_function.function("function_exists").param("function").value("proc_open").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow();
-sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/private/legacy/OC_Helper.php").allow();
-sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/public/Util.php").allow();
 sp.disable_function.function("proc_open").filename("/nextcloud/3rdparty/symfony/console/Terminal.php").allow();
 sp.disable_function.function("ini_set").param("option").value_r("display_errors").filename("/nextcloud/lib/base.php").allow();
 sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/3rdparty/bantu/ini-get-wrapper/src/IniGetWrapper.php").allow();
+sp.disable_function.function("function_exists").param("function").value("exec").filename("/nextcloud/lib/private/legacy/OC_Helper.php").allow();
 sp.disable_function.function("ini_get").param("option").value_r("suhosin").filename("/nextcloud/3rdparty/bantu/ini-get-wrapper/src/IniGetWrapper.php").allow();
 sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/apps2/twofactor_webauthn/vendor/symfony/process/ExecutableFinder.php").allow();
 sp.disable_function.function("ini_get").param("option").value("open_basedir").filename("/nextcloud/3rdparty/symfony/process/ExecutableFinder.php").allow();
 sp.disable_function.function("ini_get").param("option").value("allow_url_fopen").filename("/nextcloud/3rdparty/guzzlehttp/guzzle/src/Utils.php").allow();
-sp.disable_function.function("exec").param("command").value("apachectl -M | grep mpm").filename("/nextcloud/apps2/spreed/lib/Settings/Admin/AdminSettings.php").allow();
 
 # Harden the `chmod` function (0777 (oct = 511, 0666 = 438)
 sp.disable_function.function("chmod").param("permissions").value("438").drop();