Derive all build timestamps from BUILDDATE

The build date stored in version.h is now the single time source for a release. Each package workflow converts it to SOURCE_DATE_EPOCH and passes that into the build containers, the debian changelog entry is stamped from it rather than from the build clock, and rpmbuild is told to use it as the build time and to clamp file mtimes to it. rpm also records the build host, which is a container id and therefore differs on every run, so pin it as well - otherwise the timestamps alone do not make the package reproducible. Rebuilding the same commit now produces byte identical packages, verified for both formats by building twice and comparing checksums. In the version workflow the clock is read exactly once, when a new build date is minted. YEAR3PROXY is derived from the build date instead of being read separately, so the two cannot straddle a year boundary and a re-run in a later year no longer rewrites version.h.
Regenerate version files from RELEASE in a workflow
2026-09-29 16:55:51 +08:00 · 2026-08-22 13:53:29 +03:00 · 2026-08-22 13:34:35 +03:00 · 2026-08-22 12:09:25 +03:00 · 2026-08-22 11:31:11 +03:00 · 2026-08-22 11:30:37 +03:00
13 changed files with 304 additions and 173 deletions
--- a/.github/workflows/build-rpm-arm64.yml
+++ b/.github/workflows/build-rpm-arm64.yml
@ -26,7 +26,11 @@ jobs:
      run: |
       pwd
       echo "RELEASE=$(cat RELEASE)" >> $GITHUB_ENV
-       echo "VERSION=$(date +%y%m%d%H%M%S)" >> $GITHUB_ENV
+       BUILDDATE=$(sed -n 's/^#define BUILDDATE "\(.*\)"$/\1/p' src/version.h)
+       [ -n "$BUILDDATE" ] || BUILDDATE=$(date -u +%y%m%d%H%M%S)
+       echo "VERSION=$BUILDDATE" >> $GITHUB_ENV
+       SOURCE_DATE_EPOCH=$(date -u -d "20${BUILDDATE:0:2}-${BUILDDATE:2:2}-${BUILDDATE:4:2} ${BUILDDATE:6:2}:${BUILDDATE:8:2}:${BUILDDATE:10:2}" +%s)
+       echo "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH" >> $GITHUB_ENV
    - name: echo env
      run: echo "release $RELEASE version $VERSION"
    - name: Linux libraries
@ -43,11 +47,37 @@ jobs:
       cp ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/debian/3proxy_$RELEASE.orig.tar.gz
    - name: rpmbuild
      run: |
-       ret=`pwd`
+       mkdir -p rpmout
+       for EL in 8 9 10; do
+         docker run --rm \
+           -v "$HOME/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz:/src.tar.gz:ro" \
+           -v "$PWD/scripts/rh/3proxy.spec:/3proxy.spec:ro" \
+           -v "$PWD/rpmout:/out" \
+           -e RELEASE="$RELEASE" -e HOSTUID="$(id -u)" -e HOSTGID="$(id -g)" \
+           -e SOURCE_DATE_EPOCH="$SOURCE_DATE_EPOCH" \
+           "almalinux:$EL" bash -c '
+             set -e
+             dnf -y install rpm-build gcc make openssl-devel pcre2-devel pam-devel tar gzip
+             mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
+             cp /src.tar.gz ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz
+             ln -sf ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/rpmbuild/SOURCES/$RELEASE.tar.gz
+             cp /3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec
             cd ~/rpmbuild/SPECS
-       rpmbuild -ba 3proxy-$RELEASE.spec
-       cd $ret
-       mv ~/rpmbuild/RPMS/aarch64/3proxy-$RELEASE-1.aarch64.rpm 3proxy-$RELEASE.arm64.rpm
+             rpmbuild -ba \
+               --define "use_source_date_epoch_as_buildtime 1" \
+               --define "clamp_mtime_to_source_date_epoch 1" \
+               --define "_buildhost 3proxy.org" \
+               3proxy-$RELEASE.spec
+             cp ~/rpmbuild/RPMS/*/*.rpm /out/
+             chown "$HOSTUID:$HOSTGID" /out/*.rpm || chmod 0666 /out/*.rpm'
+       done
+       for f in rpmout/*.rpm; do
+         dist=$(rpm -qp --qf '%{RELEASE}' "$f" | sed 's/^1\.//')
+         arch=$(rpm -qp --qf '%{ARCH}' "$f")
+         mv "$f" "3proxy-$RELEASE.$dist.$arch.rpm"
+       done
+       rmdir rpmout
+       ls -l *.rpm
    - name: Get artifact rpm
      uses: actions/upload-artifact@v7
      with:
@ -55,18 +85,26 @@ jobs:
       path: "*.rpm"
    - name: debbuild
      run: |
-        ret=`pwd`
-        cd ~/debian/
+        docker run --rm \
+          -v "$HOME/debian:/debian" \
+          -e RELEASE="$RELEASE" -e VERSION="$VERSION" \
+          -e SOURCE_DATE_EPOCH="$SOURCE_DATE_EPOCH" \
+          ubuntu:22.04 bash -c '
+            set -e
+            export DEBIAN_FRONTEND=noninteractive
+            apt-get update
+            apt-get install -y build-essential debhelper fakeroot libssl-dev libpcre2-dev libpam0g-dev
+            cd /debian
            tar xzf 3proxy_$RELEASE.orig.tar.gz
            cd 3proxy-$RELEASE
-        echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium" >debian/changelog
-        echo " " >>debian/changelog
-        echo "  *3proxy $RELEASE build" >>debian/changelog
-        echo " " >>debian/changelog
-        echo " -- z3APA3A <3apa3a@3proxy.org>  "`date "+%a, %d %b %Y %H:%M:%S %z"` >>debian/changelog
-        echo "">>debian/changelog
-        dpkg-buildpackage
-        cd $ret
+            { echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium"
+              echo " "
+              echo "  *3proxy $RELEASE build"
+              echo " "
+              echo " -- z3APA3A <3apa3a@3proxy.org>  $(date -R -u -d @$SOURCE_DATE_EPOCH)"
+              echo ""
+            } > debian/changelog
+            dpkg-buildpackage'
        cp ~/debian/3proxy_$RELEASE-"$VERSION"_arm64.deb ./3proxy-$RELEASE.arm64.deb
    - name: Get artifact deb
      uses: actions/upload-artifact@v7
--- a/.github/workflows/build-rpm-armhf.yml
+++ b/.github/workflows/build-rpm-armhf.yml
@ -1,4 +1,4 @@
-name: RPM/DEB build armhf
+name: DEB build armhf

 on:
  release:
@ -26,35 +26,12 @@ jobs:
      run: |
       pwd
       echo "RELEASE=$(cat RELEASE)" >> $GITHUB_ENV
-       echo "VERSION=$(date +%y%m%d%H%M%S)" >> $GITHUB_ENV
-    - name: Linux libraries
-      run: |
-       sudo apt update
-       sudo dpkg --add-architecture armhf
-       echo "Types: deb" > ~/ubuntu.sources
-       echo "URIs: http://archive.ubuntu.com/ubuntu/" >> ~/ubuntu.sources 
-       echo "Suites: noble noble-updates noble-backports" >> ~/ubuntu.sources 
-       echo "Components: main restricted universe multiverse" >> ~/ubuntu.sources 
-       echo "Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" >> ~/ubuntu.sources 
-       echo "Architectures: amd64" >> ~/ubuntu.sources 
-       echo "" >> ~/ubuntu.sources 
-       echo "Types: deb" >> ~/ubuntu.sources 
-       echo "URIs: http://security.ubuntu.com/ubuntu/" >> ~/ubuntu.sources 
-       echo "Suites: noble-security" >> ~/ubuntu.sources 
-       echo "Components: main restricted universe multiverse" >> ~/ubuntu.sources 
-       echo "Architectures: amd64" >> ~/ubuntu.sources 
-       echo "Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" >> ~/ubuntu.sources 
-       echo "" >> ~/ubuntu.sources 
-       echo "Types: deb" >>~/ubuntu.sources 
-       echo "URIs: http://ports.ubuntu.com/ubuntu-ports/" >>~/ubuntu.sources
-       echo "Suites: noble noble-updates" >>~/ubuntu.sources
-       echo "Components: main restricted universe multiverse" >>~/ubuntu.sources
-       echo "Architectures: armhf" >>~/ubuntu.sources
-       echo "Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" >>~/ubuntu.sources
-       sudo cp ~/ubuntu.sources /etc/apt/sources.list.d/ubuntu.sources
-       sudo apt update
-       sudo apt install libssl3t64:armhf openssl:armhf libssl-dev:armhf libpam0g:armhf libpam0g-dev:armhf libpcre2-dev:armhf rpm crossbuild-essential-armhf build-essential debhelper
-    - name: configure rpm env
+       BUILDDATE=$(sed -n 's/^#define BUILDDATE "\(.*\)"$/\1/p' src/version.h)
+       [ -n "$BUILDDATE" ] || BUILDDATE=$(date -u +%y%m%d%H%M%S)
+       echo "VERSION=$BUILDDATE" >> $GITHUB_ENV
+       SOURCE_DATE_EPOCH=$(date -u -d "20${BUILDDATE:0:2}-${BUILDDATE:2:2}-${BUILDDATE:4:2} ${BUILDDATE:6:2}:${BUILDDATE:8:2}:${BUILDDATE:10:2}" +%s)
+       echo "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH" >> $GITHUB_ENV
+    - name: configure deb env
      run: |
       mkdir ~/debian
       mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
@ -62,44 +39,37 @@ jobs:
       ln -s ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/rpmbuild/SOURCES/$RELEASE.tar.gz
       cp scripts/rh/3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec
       cp ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/debian/3proxy_$RELEASE.orig.tar.gz
-    - name: rpmbuild
-      run: |
-       ret=`pwd`
-       cd ~/rpmbuild/SPECS
-       PATH=/usr/arm-linux-gnueabihf/bin:$PATH
-       export PATH=$PATH
-       CC=arm-linux-gnueabihf-gcc
-       export CC=$CC
-       export RPATH=/usr/arm-linux-gnueabihf/lib:$RPATH
-       export LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib:$LD_LIBRARY_PATH
-       rpmbuild -ba --define "PAMLIB pam0g" --define "_arch arm" --define "cross yes" --target=arm-linux-gnueabihf 3proxy-$RELEASE.spec
-       cd $ret
-       mv ~/rpmbuild/RPMS/arm/3proxy-$RELEASE-1.arm.rpm 3proxy-$RELEASE.arm.rpm
-    - name: Get artifact rpm
-      uses: actions/upload-artifact@v7
-      with:
-       name: "3proxy-${{ env.RELEASE }}-arm.rpm"
-       path: "*.rpm"
    - name: debbuild
      run: |
-        ret=`pwd`
-        cd ~/debian/
+        docker run --rm \
+          -v "$HOME/debian:/debian" \
+          -e RELEASE="$RELEASE" -e VERSION="$VERSION" \
+          -e SOURCE_DATE_EPOCH="$SOURCE_DATE_EPOCH" \
+          ubuntu:22.04 bash -c '
+            set -e
+            export DEBIAN_FRONTEND=noninteractive
+            dpkg --add-architecture armhf
+            sed -i "s|^deb |deb [arch=amd64] |" /etc/apt/sources.list
+            { echo "deb [arch=armhf] http://ports.ubuntu.com/ubuntu-ports jammy main restricted universe multiverse"
+              echo "deb [arch=armhf] http://ports.ubuntu.com/ubuntu-ports jammy-updates main restricted universe multiverse"
+            } >> /etc/apt/sources.list
+            apt-get update
+            apt-get install -y crossbuild-essential-armhf build-essential debhelper fakeroot \
+                               libssl-dev:armhf libpcre2-dev:armhf libpam0g-dev:armhf
+            cd /debian
            tar xzf 3proxy_$RELEASE.orig.tar.gz
            cd 3proxy-$RELEASE
-        echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium" >debian/changelog
-        echo " " >>debian/changelog
-        echo "  *3proxy $RELEASE build" >>debian/changelog
-        echo " " >>debian/changelog
-        echo " -- z3APA3A <3apa3a@3proxy.org>  "`date "+%a, %d %b %Y %H:%M:%S %z"` >>debian/changelog
-        echo "">>debian/changelog
-        PATH=/usr/arm-linux-gnueabihf/bin:$PATH
-        export PATH=$PATH
-        CC=arm-linux-gnueabihf-gcc
-        export CC=$CC
-        export RPATH=/usr/arm-linux-gnueabihf/lib:$RPATH
+            { echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium"
+              echo " "
+              echo "  *3proxy $RELEASE build"
+              echo " "
+              echo " -- z3APA3A <3apa3a@3proxy.org>  $(date -R -u -d @$SOURCE_DATE_EPOCH)"
+              echo ""
+            } > debian/changelog
+            export PATH=/usr/arm-linux-gnueabihf/bin:$PATH
+            export CC=arm-linux-gnueabihf-gcc
            export LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib:$LD_LIBRARY_PATH
-        dpkg-buildpackage
-        cd $ret
+            dpkg-buildpackage'
        cp ~/debian/3proxy_$RELEASE-"$VERSION"_armhf.deb ./3proxy-$RELEASE.arm.deb
    - name: Get artifact deb
      uses: actions/upload-artifact@v7
@ -123,45 +93,12 @@ jobs:
       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
           -u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt
       rm -f /tmp/prime.txt
-    - name: Sign rpm
-      if: github.event_name == 'release'
-      env:
-       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-      run: |
-       GPGBIN=$(command -v gpg)
-       if [ -z "$GPGBIN" ]; then echo "gpg not found"; exit 1; fi
-       umask 077
-       printf '%s' "$GPG_PASSPHRASE" > /tmp/gpgpass
-       echo test > /tmp/signtest
-       gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \
-           -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest
-       echo "key can sign"
-       { echo "%_gpg_name $GPG_KEYID"
-         echo "%__gpg $GPGBIN"
-         echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}'
-       } > ~/.rpmmacros
-       rpm --addsign *.rpm
-       rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig
-       for f in *.rpm; do
-         sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null)
-         case "$sig" in ""|"(none)")
-           sig=$(rpm -qp --qf '%{DSAHEADER:pgpsig}' "$f" 2>/dev/null) ;;
-         esac
-         case "$sig" in ""|"(none)")
-           echo "$f is not signed"
-           echo "--- rpm version ---"; rpm --version
-           echo "--- sign cmd ---"; rpm --eval '%{__gpg_sign_cmd}'
-           echo "--- secret keys ---"; gpg --list-secret-keys --with-colons | grep -E '^(sec|ssb):' || true
-           exit 1 ;;
-         esac
-         echo "$f: $sig"
-       done
    - name: Checksums and detached signatures
      if: github.event_name == 'release'
      env:
       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
      run: |
-       sha256sum *.rpm *.deb > SHA256SUMS-arm
+       sha256sum *.deb > SHA256SUMS-arm
       for f in *.deb SHA256SUMS-arm; do
         gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
             -u "$GPG_KEYID" --armor --detach-sign "$f"
@ -173,11 +110,10 @@ jobs:
      uses: actions/attest-build-provenance@v2
      with:
        subject-path: |
-          *.rpm
          *.deb
    - name: Upload to release
      if: github.event_name == 'release'
      env:
       GH_TOKEN: ${{ github.token }}
       TAG: ${{ github.event.release.tag_name }}
-      run: gh release upload "$TAG" *.rpm *.deb *.deb.asc SHA256SUMS-arm SHA256SUMS-arm.asc
+      run: gh release upload "$TAG" *.deb *.deb.asc SHA256SUMS-arm SHA256SUMS-arm.asc
--- a/.github/workflows/build-rpm-x86-64.yml
+++ b/.github/workflows/build-rpm-x86-64.yml
@ -26,7 +26,11 @@ jobs:
      run: |
       pwd
       echo "RELEASE=$(cat RELEASE)" >> $GITHUB_ENV
-       echo "VERSION=$(date +%y%m%d%H%M%S)" >> $GITHUB_ENV
+       BUILDDATE=$(sed -n 's/^#define BUILDDATE "\(.*\)"$/\1/p' src/version.h)
+       [ -n "$BUILDDATE" ] || BUILDDATE=$(date -u +%y%m%d%H%M%S)
+       echo "VERSION=$BUILDDATE" >> $GITHUB_ENV
+       SOURCE_DATE_EPOCH=$(date -u -d "20${BUILDDATE:0:2}-${BUILDDATE:2:2}-${BUILDDATE:4:2} ${BUILDDATE:6:2}:${BUILDDATE:8:2}:${BUILDDATE:10:2}" +%s)
+       echo "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH" >> $GITHUB_ENV
    - name: echo env
      run: echo "release $RELEASE version $VERSION"
    - name: Linux libraries
@ -43,11 +47,37 @@ jobs:
       cp ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/debian/3proxy_$RELEASE.orig.tar.gz
    - name: rpmbuild
      run: |
-       ret=`pwd`
+       mkdir -p rpmout
+       for EL in 8 9 10; do
+         docker run --rm \
+           -v "$HOME/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz:/src.tar.gz:ro" \
+           -v "$PWD/scripts/rh/3proxy.spec:/3proxy.spec:ro" \
+           -v "$PWD/rpmout:/out" \
+           -e RELEASE="$RELEASE" -e HOSTUID="$(id -u)" -e HOSTGID="$(id -g)" \
+           -e SOURCE_DATE_EPOCH="$SOURCE_DATE_EPOCH" \
+           "almalinux:$EL" bash -c '
+             set -e
+             dnf -y install rpm-build gcc make openssl-devel pcre2-devel pam-devel tar gzip
+             mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
+             cp /src.tar.gz ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz
+             ln -sf ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/rpmbuild/SOURCES/$RELEASE.tar.gz
+             cp /3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec
             cd ~/rpmbuild/SPECS
-       rpmbuild -ba 3proxy-$RELEASE.spec
-       cd $ret
-       mv ~/rpmbuild/RPMS/x86_64/3proxy-$RELEASE-1.x86_64.rpm 3proxy-$RELEASE.x86_64.rpm
+             rpmbuild -ba \
+               --define "use_source_date_epoch_as_buildtime 1" \
+               --define "clamp_mtime_to_source_date_epoch 1" \
+               --define "_buildhost 3proxy.org" \
+               3proxy-$RELEASE.spec
+             cp ~/rpmbuild/RPMS/*/*.rpm /out/
+             chown "$HOSTUID:$HOSTGID" /out/*.rpm || chmod 0666 /out/*.rpm'
+       done
+       for f in rpmout/*.rpm; do
+         dist=$(rpm -qp --qf '%{RELEASE}' "$f" | sed 's/^1\.//')
+         arch=$(rpm -qp --qf '%{ARCH}' "$f")
+         mv "$f" "3proxy-$RELEASE.$dist.$arch.rpm"
+       done
+       rmdir rpmout
+       ls -l *.rpm
    - name: Get artifact rpm
      uses: actions/upload-artifact@v7
      with:
@ -55,18 +85,26 @@ jobs:
       path: "*.rpm"
    - name: debbuild
      run: |
-        ret=`pwd`
-        cd ~/debian/
+        docker run --rm \
+          -v "$HOME/debian:/debian" \
+          -e RELEASE="$RELEASE" -e VERSION="$VERSION" \
+          -e SOURCE_DATE_EPOCH="$SOURCE_DATE_EPOCH" \
+          ubuntu:22.04 bash -c '
+            set -e
+            export DEBIAN_FRONTEND=noninteractive
+            apt-get update
+            apt-get install -y build-essential debhelper fakeroot libssl-dev libpcre2-dev libpam0g-dev
+            cd /debian
            tar xzf 3proxy_$RELEASE.orig.tar.gz
            cd 3proxy-$RELEASE
-        echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium" >debian/changelog
-        echo " " >>debian/changelog
-        echo "  *3proxy $RELEASE build" >>debian/changelog
-        echo " " >>debian/changelog
-        echo " -- z3APA3A <3apa3a@3proxy.org>  "`date "+%a, %d %b %Y %H:%M:%S %z"` >>debian/changelog
-        echo "">>debian/changelog
-        dpkg-buildpackage
-        cd $ret
+            { echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium"
+              echo " "
+              echo "  *3proxy $RELEASE build"
+              echo " "
+              echo " -- z3APA3A <3apa3a@3proxy.org>  $(date -R -u -d @$SOURCE_DATE_EPOCH)"
+              echo ""
+            } > debian/changelog
+            dpkg-buildpackage'
        cp ~/debian/3proxy_$RELEASE-"$VERSION"_amd64.deb ./3proxy-$RELEASE.x86_64.deb
    - name: Get artifact deb
      uses: actions/upload-artifact@v7
--- a/.github/workflows/update-version.yml
+++ b/.github/workflows/update-version.yml
@ -0,0 +1,94 @@
+name: Update version files
+
+on:
+  push:
+    paths:
+      - RELEASE
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  version:
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v7
+
+    - name: Regenerate version files
+      run: |
+       RELEASE=$(tr -d ' \t\r\n' < RELEASE)
+       if [ -z "$RELEASE" ]; then echo "RELEASE is empty"; exit 1; fi
+       MAJOR=$(echo "$RELEASE" | cut -d . -f 1)
+       SUBMAJOR=$(echo "$RELEASE" | cut -d . -f 2)
+       MINOR=$(echo "$RELEASE" | cut -d . -f 3)
+       SUBMINOR=$(echo "$RELEASE" | cut -d . -f 4)
+       [ -n "$SUBMAJOR" ] || SUBMAJOR=0
+       [ -n "$MINOR" ] || MINOR=0
+       [ -n "$SUBMINOR" ] || SUBMINOR=0
+
+       # The build date is minted once per release and then carried in
+       # version.h, so that rebuilding the same commit yields the same
+       # version string and the same package names.
+       OLDRELEASE=$(sed -n 's/^#define VERSION "3proxy-\(.*\)"$/\1/p' src/version.h 2>/dev/null)
+       OLDBUILDDATE=$(sed -n 's/^#define BUILDDATE "\(.*\)"$/\1/p' src/version.h 2>/dev/null)
+       if [ "$OLDRELEASE" = "$RELEASE" ] && [ -n "$OLDBUILDDATE" ]; then
+         BUILDDATE="$OLDBUILDDATE"
+       else
+         BUILDDATE=$(date -u +%y%m%d%H%M%S)
+       fi
+       echo "release $RELEASE -> $MAJOR $SUBMAJOR $MINOR $SUBMINOR, build date $BUILDDATE"
+       SOURCE_DATE_EPOCH=$(date -u -d "20${BUILDDATE:0:2}-${BUILDDATE:2:2}-${BUILDDATE:4:2} ${BUILDDATE:6:2}:${BUILDDATE:8:2}:${BUILDDATE:10:2}" +%s)
+       YEAR=$(date -u -d @$SOURCE_DATE_EPOCH +%Y)
+
+       DEBVERSION=$(head -1 debian/changelog | cut -d "(" -f 2 | cut -d ")" -f 1)
+       if [ "$DEBVERSION" != "$RELEASE-1" ]; then
+         mv debian/changelog debian/changelog.old
+         { echo "3proxy ($RELEASE-1) buster; urgency=medium"
+           echo ""
+           echo "  *3proxy $RELEASE initial build"
+           echo ""
+           echo " -- z3APA3A <3apa3a@3proxy.org>  $(date -R -u -d @$SOURCE_DATE_EPOCH)"
+           echo ""
+           cat debian/changelog.old
+         } > debian/changelog
+         rm -f debian/changelog.old
+       fi
+
+       mv scripts/rh/3proxy.spec scripts/rh/3proxy.spec.old
+       { echo "Name:           3proxy"
+         echo "Version:        $RELEASE"
+         echo "Release:        1%{?dist}"
+         tail --lines=+4 scripts/rh/3proxy.spec.old
+       } > scripts/rh/3proxy.spec
+       rm -f scripts/rh/3proxy.spec.old
+
+       { echo "#ifndef VERSION"
+         echo "#define VERSION \"3proxy-$RELEASE\""
+         echo "#endif"
+         echo "#ifndef BUILDDATE"
+         echo "#define BUILDDATE \"$BUILDDATE\""
+         echo "#endif"
+         echo "#define MAJOR3PROXY $MAJOR"
+         echo "#define SUBMAJOR3PROXY $SUBMAJOR"
+         echo "#define MINOR3PROXY $MINOR"
+         echo "#define SUBMINOR3PROXY $SUBMINOR"
+         echo "#define RELEASE3PROXY \"3proxy-$RELEASE(\" BUILDDATE \")\\0\""
+         echo "#ifndef YEAR3PROXY"
+         echo "#define YEAR3PROXY \"$YEAR\""
+         echo "#endif"
+       } > src/version.h
+
+    - name: Commit
+      run: |
+       if [ -z "$(git status --porcelain debian/changelog scripts/rh/3proxy.spec src/version.h)" ]; then
+         echo "version files already up to date"
+         exit 0
+       fi
+       git config user.name "github-actions[bot]"
+       git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+       git add debian/changelog scripts/rh/3proxy.spec src/version.h
+       git commit -m "Update version files for $(tr -d ' \t\r\n' < RELEASE)"
+       git push
--- a/3proxy-release-key-ed25519.asc
+++ b/3proxy-release-key-ed25519.asc
@ -1,10 +0,0 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
-
-mDMEaogJthYJKwYBBAHaRw8BAQdA8rZ4l90kTOSrlosP0yyeX6jFGfiFFizawjS0
-vyQnmu60KjNwcm94eSByZWxlYXNlIHNpZ25pbmcgPDNwcm94eUAzcHJveHkub3Jn
-PoivBBMWCgBXFiEEvHxfo3tIuOfF5ScUw2JYsMbAg6oFAmqICbYbFIAAAAAABAAO
-bWFudTIsMi41KzEuMTIsMCwzAhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheA
-AAoJEMNiWLDGwIOqBHIA/iRus5VEqL+v6nYQ+GDLDUZJzMfFcnDBI+BOOhiESnTp
-AP4s3uvhigRcdutxkYwSXBlJ+7wE1yZeuUmjPoJXvgNaDw==
-=Ngp2
-----END PGP PUBLIC KEY BLOCK-----
--- a/Makefile.FreeBSD
+++ b/Makefile.FreeBSD
@ -52,14 +52,14 @@ ifeq ($(LIBSTATIC), true)
    STATIC_SUFFIX = -Wl,-Bdynamic
    ZLIB = -lz -lzstd
 endif
-WOLFSSL_CHECK ?= $(shell echo "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestwssl testwssl.o $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
+WOLFSSL_CHECK ?= $(shell printf "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestwssl testwssl.o $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
 ifeq ($(WOLFSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX)
    CFLAGS += -DWITH_SSL -DWITH_WOLFSSL
    SSL_OBJS = ssllib$(OBJSUFFICS) ssl$(OBJSUFFICS)
    ZLIB :=
 else
-OPENSSL_CHECK ?= $(shell echo "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestssl testssl.o $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl  $(STATIC_SUFFIX) 2>/dev/null && rm testssl testssl.o && echo true||echo false)
+OPENSSL_CHECK ?= $(shell printf "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestssl testssl.o $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl  $(STATIC_SUFFIX) 2>/dev/null && rm testssl testssl.o && echo true||echo false)
 ifeq ($(OPENSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) $(ZLIB) -l crypto -l ssl $(STATIC_SUFFIX)
    CFLAGS += -DWITH_SSL
@ -68,13 +68,13 @@ else
    ZLIB :=
 endif
 endif
-PCRE_CHECK ?= $(shell echo "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) -lpcre2-8 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
+PCRE_CHECK ?= $(shell printf "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) -lpcre2-8 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
 ifeq ($(PCRE_CHECK), true)
    CFLAGS += -DWITH_PCRE
    PCRE_OBJS = pcre$(OBJSUFFICS)
    PCRE_LIBS = $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX)
 endif
-PAM_CHECK ?= $(shell echo "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpam.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testpam testpam.o -lpam 2>/dev/null && rm testpam testpam.o && echo true||echo false)
+PAM_CHECK ?= $(shell printf "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpam.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testpam testpam.o -lpam 2>/dev/null && rm testpam testpam.o && echo true||echo false)
 ifeq ($(PAM_CHECK), true)
    PLUGINS += PamAuth
 endif
--- a/Makefile.Linux
+++ b/Makefile.Linux
@ -60,14 +60,14 @@ ifeq ($(LIBSTATIC), true)
    ZLIB = -lz -lzstd
 endif

-WOLFSSL_CHECK ?= $(shell echo "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestwssl testwssl.o $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
+WOLFSSL_CHECK ?= $(shell printf "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestwssl testwssl.o $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
 ifeq ($(WOLFSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX)
    CFLAGS += -DWITH_SSL -DWITH_WOLFSSL
    SSL_OBJS = ssllib$(OBJSUFFICS) ssl$(OBJSUFFICS)
    ZLIB :=
 else
-OPENSSL_CHECK ?= $(shell echo "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestssl testssl.o $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl  $(STATIC_SUFFIX) 2>/dev/null && rm testssl testssl.o && echo true||echo false)
+OPENSSL_CHECK ?= $(shell printf "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestssl testssl.o $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl  $(STATIC_SUFFIX) 2>/dev/null && rm testssl testssl.o && echo true||echo false)
 ifeq ($(OPENSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl $(STATIC_SUFFIX)
    CFLAGS += -DWITH_SSL
@ -76,13 +76,13 @@ else
    ZLIB :=
 endif
 endif
-PCRE_CHECK ?= $(shell echo "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX) 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
+PCRE_CHECK ?= $(shell printf "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX) 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
 ifeq ($(PCRE_CHECK), true)
    CFLAGS += -DWITH_PCRE
    PCRE_OBJS = pcre$(OBJSUFFICS)
    PCRE_LIBS = $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX)
 endif
-PAM_CHECK ?= $(shell echo "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpam.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testpam testpam.o -lpam 2>/dev/null && rm testpam testpam.o && echo true||echo false)
+PAM_CHECK ?= $(shell printf "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpam.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testpam testpam.o -lpam 2>/dev/null && rm testpam testpam.o && echo true||echo false)
 ifeq ($(PAM_CHECK), true)
    PLUGINS += PamAuth
 endif
--- a/Makefile.Solaris
+++ b/Makefile.Solaris
@ -31,20 +31,20 @@ COMPATLIBS =
 MAKEFILE = Makefile.Solaris
 PLUGINS = StringsPlugin TrafficPlugin TransparentPlugin FilePlugin

-WOLFSSL_CHECK = $(shell echo "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testwssl testwssl.o -lwolfssl 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
+WOLFSSL_CHECK = $(shell printf "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testwssl testwssl.o -lwolfssl 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
 ifeq ($(WOLFSSL_CHECK), true)
    LIBS += -lwolfssl
    CFLAGS += -DWITH_SSL -DWITH_WOLFSSL
    SSL_OBJS = ssllib$(OBJSUFFICS) ssl$(OBJSUFFICS)
 else
-OPENSSL_CHECK = $(shell echo "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testssl testssl.o -lcrypto -lssl 2>/dev/null && rm testssl testssl.o && echo true||echo false)
+OPENSSL_CHECK = $(shell printf "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testssl testssl.o -lcrypto -lssl 2>/dev/null && rm testssl testssl.o && echo true||echo false)
 ifeq ($(OPENSSL_CHECK), true)
    LIBS += -l crypto -l ssl
    CFLAGS += -DWITH_SSL
    SSL_OBJS = ssllib$(OBJSUFFICS) ssl$(OBJSUFFICS)
 endif
 endif
-PCRE_CHECK = $(shell echo "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) -Wl,-Bstatic -lpcre2-8 -Wl,-Bdynamic 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
+PCRE_CHECK = $(shell printf "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) -Wl,-Bstatic -lpcre2-8 -Wl,-Bdynamic 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
 ifeq ($(PCRE_CHECK), true)
    CFLAGS += -DWITH_PCRE
    PCRE_OBJS = pcre$(OBJSUFFICS)
--- a/Makefile.unix
+++ b/Makefile.unix
@ -54,14 +54,14 @@ ifeq ($(LIBSTATIC), true)
    STATIC_SUFFIX = -Wl,-Bdynamic
    ZLIB = -lz -lzstd
 endif
-WOLFSSL_CHECK ?= $(shell echo "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestwssl testwssl.o $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
+WOLFSSL_CHECK ?= $(shell printf "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestwssl testwssl.o $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
 ifeq ($(WOLFSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX)
    CFLAGS += -DWITH_SSL -DWITH_WOLFSSL
    SSL_OBJS = ssllib$(OBJSUFFICS) ssl$(OBJSUFFICS)
    ZLIB :=
 else
-OPENSSL_CHECK ?= $(shell echo "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestssl testssl.o $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl  $(STATIC_SUFFIX) 2>/dev/null && rm testssl testssl.o && echo true||echo false)
+OPENSSL_CHECK ?= $(shell printf "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestssl testssl.o $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl  $(STATIC_SUFFIX) 2>/dev/null && rm testssl testssl.o && echo true||echo false)
 ifeq ($(OPENSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl $(STATIC_SUFFIX)
    CFLAGS += -DWITH_SSL
@ -70,13 +70,13 @@ else
    ZLIB :=
 endif
 endif
-PCRE_CHECK ?= $(shell echo "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX) 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
+PCRE_CHECK ?= $(shell printf "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX) 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
 ifeq ($(PCRE_CHECK), true)
    CFLAGS += -DWITH_PCRE
    PCRE_OBJS = pcre$(OBJSUFFICS)
    PCRE_LIBS = $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX)
 endif
-PAM_CHECK ?= $(shell echo "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpam.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testpam testpam.o -lpam 2>/dev/null && rm testpam testpam.o && echo true||echo false)
+PAM_CHECK ?= $(shell printf "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpam.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testpam testpam.o -lpam 2>/dev/null && rm testpam testpam.o && echo true||echo false)
 ifeq ($(PAM_CHECK), true)
    PLUGINS += PamAuth
 endif
--- a/Makefile.win
+++ b/Makefile.win
@ -47,14 +47,14 @@ ifeq ($(LIBSTATIC), true)
    STATIC_SUFFIX = -Wl,-Bdynamic
    ZLIB = -lz
 endif
-WOLFSSL_CHECK = $(shell echo "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) -o testwssl - 2>/dev/null && rm testwssl && echo true||echo false)
+WOLFSSL_CHECK = $(shell printf "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) -o testwssl - 2>/dev/null && rm testwssl && echo true||echo false)
 ifeq ($(WOLFSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) -lws2_32
    CFLAGS += -DWITH_SSL -DWITH_WOLFSSL
    SSL_OBJS = ssllib$(OBJSUFFICS) ssl$(OBJSUFFICS)
    ZLIB :=
 else
-OPENSSL_CHECK = $(shell echo "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) $(STATIC_PREFIX) $(ZLIB) -l crypto -l ssl $(STATIC_SUFFIX) -o testssl - 2>/dev/null && rm testssl && echo true||echo false)
+OPENSSL_CHECK = $(shell printf "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) $(STATIC_PREFIX) $(ZLIB) -l crypto -l ssl $(STATIC_SUFFIX) -o testssl - 2>/dev/null && rm testssl && echo true||echo false)
 ifeq ($(OPENSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) $(ZLIB) -l crypto -l ssl $(STATIC_SUFFIX) -lcrypt32
    CFLAGS += -DWITH_SSL
@ -63,11 +63,11 @@ else
    ZLIB :=
 endif
 endif
-PAM_CHECK = $(shell echo "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) -l pam -o testpam - 2>/dev/null && rm testpam && echo true||echo false)
+PAM_CHECK = $(shell printf "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) -l pam -o testpam - 2>/dev/null && rm testpam && echo true||echo false)
 ifeq ($(PAM_CHECK), true)
    PLUGINS += PamAuth
 endif
-PCRE_CHECK = $(shell echo "\#define PCRE2_CODE_UNIT_WIDTH 8\\n#include <pcre2.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX) -o testpcre - 2>/dev/null && rm testpcre && echo true||echo false)
+PCRE_CHECK = $(shell printf "\#define PCRE2_CODE_UNIT_WIDTH 8\\n#include <pcre2.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX) -o testpcre - 2>/dev/null && rm testpcre && echo true||echo false)
 ifeq ($(PCRE_CHECK), true)
    CFLAGS += -DWITH_PCRE
    PCRE_OBJS = pcre$(OBJSUFFICS)
--- a/README.md
+++ b/README.md
@ -14,6 +14,44 @@

 https://github.com/3proxy/3proxy/releases

+### Package repository (apt / dnf)
+
+Signed apt and dnf repositories are published at https://3proxy.org/repo/ in
+two channels: `lts` (0.9 branch) and `current` (master).
+
+Debian 12 and Ubuntu 22.04 or newer:
+
+```
+sudo curl -fsSL https://3proxy.org/repo/3proxy-release-key.asc \
+     -o /usr/share/keyrings/3proxy.asc
+sudo tee /etc/apt/sources.list.d/3proxy.sources <<EOF
+Types: deb
+URIs: https://3proxy.org/repo/deb
+Suites: lts
+Components: main
+Signed-By: /usr/share/keyrings/3proxy.asc
+EOF
+sudo apt update && sudo apt install 3proxy
+```
+
+AlmaLinux, RHEL, Rocky and CentOS Stream 8, 9 and 10:
+
+```
+sudo tee /etc/yum.repos.d/3proxy.repo <<EOF
+[3proxy]
+name=3proxy
+baseurl=https://3proxy.org/repo/rpm/lts/el\$releasever/\$basearch/
+enabled=1
+gpgcheck=1
+repo_gpgcheck=1
+gpgkey=https://3proxy.org/repo/3proxy-release-key.asc
+EOF
+sudo dnf install 3proxy
+```
+
+Both the packages and the repository metadata are signed. See
+https://3proxy.org/repo/ for the `current` channel and for release key details.
+
 ### Docker images

 https://hub.docker.com/r/3proxy/3proxy
--- a/SECURITY.md
+++ b/SECURITY.md
@ -33,12 +33,6 @@ Import it once:
 gpg --import 3proxy-release-key.asc
 ```

-Releases up to and including 0.9.9 were signed with an Ed25519 key, kept as
-`3proxy-release-key-ed25519.asc` for verifying those older files. Note that
-rpm 4.14 and earlier (RHEL/CentOS 8 and older) cannot import an Ed25519 key
-and will report `SIGNATURES NOT OK`; use the RSA key and 0.9.9.1 or later on
-those systems.
-
 Checksums and the checksum file signature:

 ```
--- a/scripts/rh/3proxy.spec
+++ b/scripts/rh/3proxy.spec
@ -9,6 +9,9 @@ Prefix:         %{_prefix}
 Packager: 	z3APA3A
 Source:		https://github.com/%{packager}/%{name}/archive/%{version}.tar.gz

+%global debug_package %{nil}
+%global __requires_exclude ^/(usr/)?bin/3proxy$
+
 %description
 3proxy is lightweight yet powerful proxy server
Author	SHA1	Message	Date
Vladimir Dubrovin	754ba7115a	Derive all build timestamps from BUILDDATE Some checks failed C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled Details C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled Details C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Has been cancelled Details The build date stored in version.h is now the single time source for a release. Each package workflow converts it to SOURCE_DATE_EPOCH and passes that into the build containers, the debian changelog entry is stamped from it rather than from the build clock, and rpmbuild is told to use it as the build time and to clamp file mtimes to it. rpm also records the build host, which is a container id and therefore differs on every run, so pin it as well - otherwise the timestamps alone do not make the package reproducible. Rebuilding the same commit now produces byte identical packages, verified for both formats by building twice and comparing checksums. In the version workflow the clock is read exactly once, when a new build date is minted. YEAR3PROXY is derived from the build date instead of being read separately, so the two cannot straddle a year boundary and a re-run in a later year no longer rewrites version.h.	2026-08-22 13:53:29 +03:00
Vladimir Dubrovin	ff77d222e4	Regenerate version files from RELEASE in a workflow The version files were derived from RELEASE by a script kept outside this repository, so bumping RELEASE and updating src/version.h, the spec version and debian/changelog were separate manual steps. Do it in a workflow triggered by a change to RELEASE. It writes the same content the external script produced, verified byte for byte against the current tree. The build date is now minted once, when RELEASE changes, and stored in version.h rather than taken from the clock of whichever build is running. The package workflows read it from there, so rebuilding a commit produces the same version string and the same package file names. Re-running the workflow without a RELEASE change keeps the existing build date and makes no commit.	2026-08-22 13:34:35 +03:00
Vladimir Dubrovin	da99424eac	Fix rpm signing: hand the built packages back to the runner user The rpm build runs in a container as root, so the packages arrived in the workspace owned by root. Renaming them still worked, since that only needs write permission on the directory, but rpm --addsign rewrites the file in place and failed: error: 3proxy-0.9.9.0.el9.x86_64.rpm: open failed: Permission denied Restore the invoking user's ownership before leaving the container, falling back to a mode change where the container cannot chown, as under a rootless container runtime.	2026-08-22 12:09:25 +03:00
Vladimir Dubrovin	95eb9f2a9f	README: widen the documented deb coverage to Debian 12 and Ubuntu 22.04	2026-08-22 11:31:11 +03:00
Vladimir Dubrovin	8fba7ffc40	Build deb packages in an Ubuntu 22.04 container dpkg-buildpackage ran on the runner itself, so the packages inherited its ABI. On ubuntu-latest that means glibc 2.38 and libssl3t64, which restricts the packages to Ubuntu 24.04 and newer - Debian 12, Debian 13 and Ubuntu 22.04 cannot install them. Nothing in the source needs glibc 2.38. The floor comes from the build host: gcc 13 with glibc 2.38 redirects sscanf and strtol to __isoc23_ variants, and arc4random arrived in glibc 2.36. Build in an Ubuntu 22.04 container instead. That lowers the dependencies to libc6 (>= 2.34) and libssl3, and libssl3t64 declares Provides: libssl3, so one package covers Ubuntu 22.04 and later as well as Debian 12 and later. Verified by installing on all four. The armhf cross build moves into the same container, keeping the cross toolchain on PATH so that install -s uses the ARM strip rather than the host one.	2026-08-22 11:30:37 +03:00
Vladimir Dubrovin	b19e310956	Document the package repository in README	2026-08-22 11:13:20 +03:00
Vladimir Dubrovin	34722c031f	Drop the Ed25519 release key No published release was ever signed with it - signing was introduced after 0.9.9 - so it verifies nothing and only adds a second key for users to reason about.	2026-08-22 10:39:06 +03:00
Vladimir Dubrovin	6c9c4d51aa	Build rpm packages against Enterprise Linux, not Ubuntu rpmbuild ran directly on the Ubuntu runner, so the packages carried Ubuntu's ABI: glibc 2.38, libssl.so.3 and libpcre2-8. No RPM distribution can satisfy that - RHEL 9 has glibc 2.34, RHEL 8 has 2.28 and OpenSSL 1.1 - so the rpms were installable nowhere. Build them in AlmaLinux 8, 9 and 10 containers instead, covering supported AlmaLinux and CentOS Stream releases. Release: 1%{?dist} already in the spec now expands, so the packages are named el8, el9 and el10 and can coexist. Two spec changes are needed for a build outside Ubuntu: debug_package is disabled. Enterprise Linux enables debuginfo extraction by default while Ubuntu's rpm does not; the build produces no debug sources, so rpmbuild aborted on an empty debugsourcefiles.list. /bin/3proxy is excluded from automatic requires. The installed configuration file is executable and begins with #!/bin/3proxy, so rpm generates a dependency on it. rpm 4.16 and later canonicalise that to /usr/bin/3proxy while %files declares /bin/3proxy, leaving a dependency that can never be satisfied and making the package uninstallable on el9 and el10. Enterprise Linux has no 32-bit ARM, so the armhf workflow now builds only the deb package.	2026-08-22 10:39:05 +03:00
Vladimir Dubrovin	a3605b8289	Fix library detection under shells whose echo does not expand escapes The OpenSSL, wolfSSL, PCRE2 and PAM probes built their test program with echo "...\n...". make runs recipes through /bin/sh, which is dash on Debian and Ubuntu, where the builtin echo expands \n. On distributions where /bin/sh is bash - every RPM based distribution, and macOS - it does not, so the probe compiled #include <openssl/ssl.h>n int main(){return 0;} which is not valid C. Every probe therefore failed and the build silently dropped TLS, PCRE2 and PAM support with no diagnostic. Use printf, which expands escapes the same way everywhere.	2026-08-22 10:39:05 +03:00