rtuszik/photon-docker 2.5.0

v2.5.0

on GitHub

This release makes automatic updates more resilient: failed updates now retry with an increasing delay that persists
across restarts. The container also checks file permissions at startup instead of failing partway through, and
downloads are more robust against bad partial responses from mirrors. Sequential updates now remove the old index
before downloading, so they need less free disk space. It also removes trust in the eMudhra emSign ECC Root CA G3
following the eMudhra intermediate CA compromise.

Features

• Retry failed updates with exponential backoff (2h, 4h, 8h, ... up to 24h), persisted across container restarts by @rtuszik
• Exit at startup with a clear error when running as a non-root user and the data directory is not writable by @rtuszik
• Warn when PUID/PGID are set while running as a non-root user, since they are ignored in that mode by @rtuszik

Fixes

• Install ca-certificates in the runtime image and update CA trust stores to drop emSign ECC Root CA G3 after the
  eMudhra intermediate CA key compromise by @rtuszik
• Remove the existing index before downloading during SEQUENTIAL updates, and count the space it frees in the disk
  space check by @rtuszik
• Validate partial download responses and file sizes when resuming downloads by @rtuszik in #386
• Accept case-insensitive range units in partial download responses by @rtuszik
• Treat a failed mirror check as a failed update attempt instead of silently assuming no update is needed by @rtuszik
• Write update state atomically and clear the retry counter after a successful update by @rtuszik
• Handle the system clock moving backwards without stalling scheduled updates by @rtuszik
• Refuse to change file ownership at startup if the photon user is missing from the image by @rtuszik

Documentation

• Document running as a non-root user, update retry delays, and the Photon 1.3.0 metric rename
  (jetty_server_requests_seconds* → http_server_requests_seconds*) by @rtuszik

Dependencies & CI

• Update base image to Eclipse Temurin 21.0.12 by @koalabot-rt[bot] in #377
• Update uv, apprise (security), requests, tqdm, prek, ruff, BetterLeaks, zizmor, and Renovate pre-commit hooks by @koalabot-rt[bot]
• Update GitHub Actions dependencies (setup-uv v10, Docker actions, release-drafter, pytest-coverage-comment) by @koalabot-rt[bot]
• Run the full integration test against a non-root container by @rtuszik
• Strengthen importer, update pipeline, and scheduler tests by @rtuszik
• Disable digest pinning for the example docker-compose.yml by @rtuszik

Full Changelog: 2.4.0...2.5.0

Photon release notes (1.3.0)