From 6e8a87c793c64059fff16f17b216781f1180e90a Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Mon, 7 Sep 2026 18:46:17 +0200 Subject: [PATCH 1/7] Moved PHP 8.1-8.4 images to Debian bookworm Debian 11 (bullseye) reached end of LTS on 2026-08-31. Its packages are being removed from deb.debian.org while the indexes still advertise them, so apt-get install fails with sporadic 404s. php:8.1-8.4-fpm-bookworm exist, so these images can simply move to Debian 12. libicu67 is bullseye-only and becomes libicu72; every other package in the list keeps its name. Co-Authored-By: Claude Opus 5 --- php/Dockerfile-8.1 | 4 ++-- php/Dockerfile-8.2 | 4 ++-- php/Dockerfile-8.3 | 4 ++-- php/Dockerfile-8.4 | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/php/Dockerfile-8.1 b/php/Dockerfile-8.1 index fcb25df..4d068f7 100644 --- a/php/Dockerfile-8.1 +++ b/php/Dockerfile-8.1 @@ -1,4 +1,4 @@ -FROM php:8.1-fpm-bullseye +FROM php:8.1-fpm-bookworm # Container containing php-fpm and php-cli to run and interact with Ibexa DXP @@ -19,7 +19,7 @@ RUN apt-get update -q -y \ libxpm4 \ libpng16-16 \ # intl - libicu67 \ + libicu72 \ # xslt libxslt1.1 \ # memcached diff --git a/php/Dockerfile-8.2 b/php/Dockerfile-8.2 index bcd5876..3ed5af6 100644 --- a/php/Dockerfile-8.2 +++ b/php/Dockerfile-8.2 @@ -1,4 +1,4 @@ -FROM php:8.2-fpm-bullseye +FROM php:8.2-fpm-bookworm # Container containing php-fpm and php-cli to run and interact with Ibexa DXP @@ -19,7 +19,7 @@ RUN apt-get update -q -y \ libxpm4 \ libpng16-16 \ # intl - libicu67 \ + libicu72 \ # xslt libxslt1.1 \ # memcached diff --git a/php/Dockerfile-8.3 b/php/Dockerfile-8.3 index 38259ab..04443d9 100644 --- a/php/Dockerfile-8.3 +++ b/php/Dockerfile-8.3 @@ -1,4 +1,4 @@ -FROM php:8.3-fpm-bullseye +FROM php:8.3-fpm-bookworm # Container containing php-fpm and php-cli to run and interact with Ibexa DXP @@ -19,7 +19,7 @@ RUN apt-get update -q -y \ libxpm4 \ libpng16-16 \ # intl - libicu67 \ + libicu72 \ # xslt libxslt1.1 \ # memcached diff --git a/php/Dockerfile-8.4 b/php/Dockerfile-8.4 index 51913d1..4226951 100644 --- a/php/Dockerfile-8.4 +++ b/php/Dockerfile-8.4 @@ -1,4 +1,4 @@ -FROM php:8.4-fpm-bullseye +FROM php:8.4-fpm-bookworm # Container containing php-fpm and php-cli to run and interact with Ibexa DXP @@ -19,7 +19,7 @@ RUN apt-get update -q -y \ libxpm4 \ libpng16-16 \ # intl - libicu67 \ + libicu72 \ # xslt libxslt1.1 \ # memcached From 282d8ae9df9da07c3b38f8160a2b6ab028d13848 Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Mon, 7 Sep 2026 18:46:17 +0200 Subject: [PATCH 2/7] Pinned PHP 7.3, 7.4 and 8.0 images to a Debian snapshot Same bullseye end-of-LTS breakage as the bookworm move, but there are no php:7.3, 7.4 or 8.0 bookworm variants, so these three have to stay on Debian 11. Point apt at snapshot.debian.org, taken a few days before the EOL, and disable the Valid-Until check that the snapshot Release files no longer pass. The official PHP images ship these very lines commented out in /etc/apt/sources.list. archive.debian.org would be the nicer target, but it only carries bullseye main so far - bullseye-security is not there yet. Co-Authored-By: Claude Opus 5 --- php/Dockerfile-7.3 | 17 +++++++++++++++++ php/Dockerfile-7.4 | 17 +++++++++++++++++ php/Dockerfile-8.0 | 17 +++++++++++++++++ 3 files changed, 51 insertions(+) diff --git a/php/Dockerfile-7.3 b/php/Dockerfile-7.3 index 26e9519..f9dfda5 100644 --- a/php/Dockerfile-7.3 +++ b/php/Dockerfile-7.3 @@ -9,6 +9,23 @@ FROM php:7.3-fpm-bullseye # Set defaults for variables used by run.sh ENV COMPOSER_HOME=/root/.composer +# Debian 11 (bullseye) reached end of LTS on 2026-08-31. Its packages are being +# removed from deb.debian.org while the indexes still advertise them, so a plain +# apt-get install fails with sporadic 404s. There is no bookworm variant of this +# PHP version, so pin apt to a snapshot taken before the EOL instead. +# Can be dropped once bullseye-security is available on archive.debian.org. +ARG DEBIAN_SNAPSHOT=20260828T000000Z +RUN set -xe \ + && printf '%s\n' \ + "deb http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main" \ + "deb http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye-updates main" \ + "deb http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT} bullseye-security main" \ + > /etc/apt/sources.list \ + && printf '%s\n' \ + 'Acquire::Check-Valid-Until "false";' \ + 'Acquire::Retries "5";' \ + > /etc/apt/apt.conf.d/99-debian-snapshot + # Get packages that we need in container RUN apt-get update -q -y \ && apt-get install -q -y --no-install-recommends \ diff --git a/php/Dockerfile-7.4 b/php/Dockerfile-7.4 index 66302e7..1bc2c1f 100644 --- a/php/Dockerfile-7.4 +++ b/php/Dockerfile-7.4 @@ -9,6 +9,23 @@ FROM php:7.4-fpm-bullseye # Set defaults for variables used by run.sh ENV COMPOSER_HOME=/root/.composer +# Debian 11 (bullseye) reached end of LTS on 2026-08-31. Its packages are being +# removed from deb.debian.org while the indexes still advertise them, so a plain +# apt-get install fails with sporadic 404s. There is no bookworm variant of this +# PHP version, so pin apt to a snapshot taken before the EOL instead. +# Can be dropped once bullseye-security is available on archive.debian.org. +ARG DEBIAN_SNAPSHOT=20260828T000000Z +RUN set -xe \ + && printf '%s\n' \ + "deb http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main" \ + "deb http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye-updates main" \ + "deb http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT} bullseye-security main" \ + > /etc/apt/sources.list \ + && printf '%s\n' \ + 'Acquire::Check-Valid-Until "false";' \ + 'Acquire::Retries "5";' \ + > /etc/apt/apt.conf.d/99-debian-snapshot + # Get packages that we need in container RUN apt-get update -q -y \ && apt-get install -q -y --no-install-recommends \ diff --git a/php/Dockerfile-8.0 b/php/Dockerfile-8.0 index cebcc2e..779f67c 100644 --- a/php/Dockerfile-8.0 +++ b/php/Dockerfile-8.0 @@ -5,6 +5,23 @@ FROM php:8.0-fpm-bullseye # Set defaults for variables used by run.sh ENV COMPOSER_HOME=/root/.composer +# Debian 11 (bullseye) reached end of LTS on 2026-08-31. Its packages are being +# removed from deb.debian.org while the indexes still advertise them, so a plain +# apt-get install fails with sporadic 404s. There is no bookworm variant of this +# PHP version, so pin apt to a snapshot taken before the EOL instead. +# Can be dropped once bullseye-security is available on archive.debian.org. +ARG DEBIAN_SNAPSHOT=20260828T000000Z +RUN set -xe \ + && printf '%s\n' \ + "deb http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main" \ + "deb http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye-updates main" \ + "deb http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT} bullseye-security main" \ + > /etc/apt/sources.list \ + && printf '%s\n' \ + 'Acquire::Check-Valid-Until "false";' \ + 'Acquire::Retries "5";' \ + > /etc/apt/apt.conf.d/99-debian-snapshot + # Get packages that we need in container RUN apt-get update -q -y \ && apt-get install -q -y --no-install-recommends \ From 3f00445f2fadbf224ea0f93059e6e9476b939d02 Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Mon, 7 Sep 2026 18:46:17 +0200 Subject: [PATCH 3/7] Moved Varnish 7 image to varnish:7.4 with matching varnish-modules varnish:7.1 is bullseye based, so it broke the same way. varnish:7.4 is the first 7.x tag built on bookworm. varnish-modules releases map 1:1 onto Varnish minors, so bumping the base image alone is not enough - 0.20.0 fails to compile against 7.4 in vmod_header. 0.23.0 is the matching release. Co-Authored-By: Claude Opus 5 --- docker/Dockerfile-varnish7 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/Dockerfile-varnish7 b/docker/Dockerfile-varnish7 index 78a1148..d929d9d 100644 --- a/docker/Dockerfile-varnish7 +++ b/docker/Dockerfile-varnish7 @@ -1,4 +1,4 @@ -FROM varnish:7.1 +FROM varnish:7.4 # set the user to root, and install build dependencies USER root @@ -7,7 +7,7 @@ RUN set -e; \ apt-get -y install $VMOD_DEPS /pkgs/*.deb; \ \ # install one, possibly multiple vmods - install-vmod https://github.com/varnish/varnish-modules/releases/download/0.20.0/varnish-modules-0.20.0.tar.gz; \ + install-vmod https://github.com/varnish/varnish-modules/releases/download/0.23.0/varnish-modules-0.23.0.tar.gz; \ \ # clean up and set the user back to varnish rm -rf /var/lib/apt/lists/* From d4e6ec118c5d80387ea39c7c29f291ee1ce4a795 Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Tue, 8 Sep 2026 11:05:56 +0200 Subject: [PATCH 4/7] Switched the Debian snapshot repositories to https SonarCloud flagged the snapshot sources as clear-text (docker:S5332). ca-certificates ships in the php base images already, so apt can reach snapshot.debian.org over https without an extra bootstrap step. Co-Authored-By: Claude Opus 5 --- php/Dockerfile-7.3 | 6 +++--- php/Dockerfile-7.4 | 6 +++--- php/Dockerfile-8.0 | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/php/Dockerfile-7.3 b/php/Dockerfile-7.3 index f9dfda5..4981a24 100644 --- a/php/Dockerfile-7.3 +++ b/php/Dockerfile-7.3 @@ -17,9 +17,9 @@ ENV COMPOSER_HOME=/root/.composer ARG DEBIAN_SNAPSHOT=20260828T000000Z RUN set -xe \ && printf '%s\n' \ - "deb http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main" \ - "deb http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye-updates main" \ - "deb http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT} bullseye-security main" \ + "deb https://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main" \ + "deb https://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye-updates main" \ + "deb https://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT} bullseye-security main" \ > /etc/apt/sources.list \ && printf '%s\n' \ 'Acquire::Check-Valid-Until "false";' \ diff --git a/php/Dockerfile-7.4 b/php/Dockerfile-7.4 index 1bc2c1f..c7091a5 100644 --- a/php/Dockerfile-7.4 +++ b/php/Dockerfile-7.4 @@ -17,9 +17,9 @@ ENV COMPOSER_HOME=/root/.composer ARG DEBIAN_SNAPSHOT=20260828T000000Z RUN set -xe \ && printf '%s\n' \ - "deb http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main" \ - "deb http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye-updates main" \ - "deb http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT} bullseye-security main" \ + "deb https://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main" \ + "deb https://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye-updates main" \ + "deb https://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT} bullseye-security main" \ > /etc/apt/sources.list \ && printf '%s\n' \ 'Acquire::Check-Valid-Until "false";' \ diff --git a/php/Dockerfile-8.0 b/php/Dockerfile-8.0 index 779f67c..f61605a 100644 --- a/php/Dockerfile-8.0 +++ b/php/Dockerfile-8.0 @@ -13,9 +13,9 @@ ENV COMPOSER_HOME=/root/.composer ARG DEBIAN_SNAPSHOT=20260828T000000Z RUN set -xe \ && printf '%s\n' \ - "deb http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main" \ - "deb http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye-updates main" \ - "deb http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT} bullseye-security main" \ + "deb https://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main" \ + "deb https://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye-updates main" \ + "deb https://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT} bullseye-security main" \ > /etc/apt/sources.list \ && printf '%s\n' \ 'Acquire::Check-Valid-Until "false";' \ From 9a0efdaf573f81656336512288034e707ad28ccb Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Tue, 8 Sep 2026 11:45:15 +0200 Subject: [PATCH 5/7] Merged the Debian snapshot setup into the package install instruction SonarCloud docker:S7031. Rewriting sources.list is only meaningful for the apt-get that follows it, so the two belong in one instruction. RUN count per file is now the same as before the snapshot pin was added. Co-Authored-By: Claude Opus 5 --- php/Dockerfile-7.3 | 8 ++++---- php/Dockerfile-7.4 | 8 ++++---- php/Dockerfile-8.0 | 8 ++++---- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/php/Dockerfile-7.3 b/php/Dockerfile-7.3 index 4981a24..a791278 100644 --- a/php/Dockerfile-7.3 +++ b/php/Dockerfile-7.3 @@ -15,6 +15,8 @@ ENV COMPOSER_HOME=/root/.composer # PHP version, so pin apt to a snapshot taken before the EOL instead. # Can be dropped once bullseye-security is available on archive.debian.org. ARG DEBIAN_SNAPSHOT=20260828T000000Z + +# Get packages that we need in container RUN set -xe \ && printf '%s\n' \ "deb https://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main" \ @@ -24,10 +26,8 @@ RUN set -xe \ && printf '%s\n' \ 'Acquire::Check-Valid-Until "false";' \ 'Acquire::Retries "5";' \ - > /etc/apt/apt.conf.d/99-debian-snapshot - -# Get packages that we need in container -RUN apt-get update -q -y \ + > /etc/apt/apt.conf.d/99-debian-snapshot \ + && apt-get update -q -y \ && apt-get install -q -y --no-install-recommends \ ca-certificates \ curl \ diff --git a/php/Dockerfile-7.4 b/php/Dockerfile-7.4 index c7091a5..04eda82 100644 --- a/php/Dockerfile-7.4 +++ b/php/Dockerfile-7.4 @@ -15,6 +15,8 @@ ENV COMPOSER_HOME=/root/.composer # PHP version, so pin apt to a snapshot taken before the EOL instead. # Can be dropped once bullseye-security is available on archive.debian.org. ARG DEBIAN_SNAPSHOT=20260828T000000Z + +# Get packages that we need in container RUN set -xe \ && printf '%s\n' \ "deb https://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main" \ @@ -24,10 +26,8 @@ RUN set -xe \ && printf '%s\n' \ 'Acquire::Check-Valid-Until "false";' \ 'Acquire::Retries "5";' \ - > /etc/apt/apt.conf.d/99-debian-snapshot - -# Get packages that we need in container -RUN apt-get update -q -y \ + > /etc/apt/apt.conf.d/99-debian-snapshot \ + && apt-get update -q -y \ && apt-get install -q -y --no-install-recommends \ ca-certificates \ curl \ diff --git a/php/Dockerfile-8.0 b/php/Dockerfile-8.0 index f61605a..304448a 100644 --- a/php/Dockerfile-8.0 +++ b/php/Dockerfile-8.0 @@ -11,6 +11,8 @@ ENV COMPOSER_HOME=/root/.composer # PHP version, so pin apt to a snapshot taken before the EOL instead. # Can be dropped once bullseye-security is available on archive.debian.org. ARG DEBIAN_SNAPSHOT=20260828T000000Z + +# Get packages that we need in container RUN set -xe \ && printf '%s\n' \ "deb https://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main" \ @@ -20,10 +22,8 @@ RUN set -xe \ && printf '%s\n' \ 'Acquire::Check-Valid-Until "false";' \ 'Acquire::Retries "5";' \ - > /etc/apt/apt.conf.d/99-debian-snapshot - -# Get packages that we need in container -RUN apt-get update -q -y \ + > /etc/apt/apt.conf.d/99-debian-snapshot \ + && apt-get update -q -y \ && apt-get install -q -y --no-install-recommends \ ca-certificates \ curl \ From 6c1f3e006b969e5170995f38db8cda764b4d9048 Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Tue, 8 Sep 2026 12:08:29 +0200 Subject: [PATCH 6/7] Authenticated Composer against GitHub in the image test step The Test image step passed no credentials, so Composer inside the container reached github.com anonymously and failed whenever the shared runner IP was rate limited: In AuthHelper.php line 152: Could not authenticate against github.com Generates an App token and forwards it as COMPOSER_AUTH into the container, since that is where composer actually runs - a host-side composer config would not reach it. Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yaml | 7 +++++++ bin/ci/test.sh | 1 + 2 files changed, 8 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 265198d..476fbae 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -51,12 +51,19 @@ jobs: - uses: actions/checkout@v7 - name: Build image run: bin/ci/build.sh ${{ matrix.php }} ${{ matrix.node }} + - name: Generate token + id: generate_token + uses: actions/create-github-app-token@v3 + with: + client-id: ${{ secrets.AUTOMATION_CLIENT_ID }} + private-key: ${{ secrets.AUTOMATION_CLIENT_SECRET }} - name: Test image run: bin/ci/test.sh continue-on-error: ${{ inputs.force != '' }} env: TEST_CMD: "vendor/bin/behat -v --profile=browser --suite=admin-ui --tags=@richtext --config=behat_ibexa_oss.yaml" PRODUCT_VERSION: ${{ matrix.product-version }} + COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ steps.generate_token.outputs.token }}"}}' - name: Log in to the Container registry uses: docker/login-action@v4 with: diff --git a/bin/ci/test.sh b/bin/ci/test.sh index ce5122f..5328e57 100755 --- a/bin/ci/test.sh +++ b/bin/ci/test.sh @@ -39,6 +39,7 @@ if [ "$REUSE_VOLUME" = "0" ]; then printf "\nBuilding on ibexa_php:latest, composer will implicit check requirements\n" docker run -i --rm \ -e APP_ENV \ + -e COMPOSER_AUTH \ -e PHP_INI_ENV_memory_limit=3G \ -v $(pwd)/volumes/ezplatform:/var/www \ -v $COMPOSER_HOME:/root/.composer \ From 2b14eb62f925f821d095741ab51cf87a6fc7490d Mon Sep 17 00:00:00 2001 From: KamilSznajdrowicz Date: Mon, 7 Sep 2026 15:08:25 +0200 Subject: [PATCH 7/7] Moved Varnish image to Debian 12 (bookworm) Debian 11 (bullseye) reached end of LTS on 2026-08-31, and its archive is now being decommissioned. `deb.debian.org` and `security.debian.org` still publish the bullseye package indexes, but individual `.deb` files are already disappearing from the pools, so `apt-get install` fails with a 404 mid-build: E: Failed to fetch .../g/gnupg2/gpgsm_2.2.27-2+deb11u3_amd64.deb 404 Not Found E: Failed to fetch .../g/gnupg2/gnupg_2.2.27-2+deb11u3_all.deb 404 Not Found Unable to install GPG! ... Repository installation aborted. This breaks the `varnish` leg of Browser tests in every product repository that uses `doc/docker/varnish.yml`. The 404s come and go depending on which Fastly node the runner hits, so re-running the job is a lottery rather than a fix. Varnish 6.0 LTS is unchanged - `varnish`/`varnish-dev` 6.0.12 are published for bookworm as well, so only the base OS moves here. Verified locally (`docker build --platform linux/amd64`): - the packagecloud script installs GPG and the Varnish repo without 404s - all build dependencies resolve on bookworm - `varnish-modules` 0.15.0 still compiles, `libvmod_xkey.so` is installed - resulting image reports Debian 12 with `varnish 6.0.12-1~bookworm` The same change is needed on 5.0 and 6.0, where the file is identical. Co-Authored-By: Claude Opus 5 (1M context) --- docker/Dockerfile-varnish | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docker/Dockerfile-varnish b/docker/Dockerfile-varnish index ea56bcb..c9599b2 100644 --- a/docker/Dockerfile-varnish +++ b/docker/Dockerfile-varnish @@ -1,4 +1,4 @@ -FROM debian:bullseye-slim +FROM debian:bookworm-slim ENV VARNISH_MALLOC_SIZE="256M" \ DEBIAN_FRONTEND=noninteractive @@ -21,7 +21,7 @@ RUN set -xe \ pkg-config \ python3-docutils \ sphinx-common \ - varnish-dev=6.0.12-1~bullseye \ + varnish-dev=6.0.12-1~bookworm \ " \ # Update apt and get dependencies && apt-get update -q -y \ @@ -29,7 +29,7 @@ RUN set -xe \ \ # Get official Varnish package && curl -s ${PACKAGECLOUD_URL} | bash \ - && apt-get install -q -y --allow-unauthenticated --no-install-recommends varnish=6.0.12-1~bullseye $buildDeps \ + && apt-get install -q -y --allow-unauthenticated --no-install-recommends varnish=6.0.12-1~bookworm $buildDeps \ \ # Install varnish modules && curl -A "Docker" -o /tmp/varnish-modules.tar.gz -D - -L -s https://github.com/varnish/varnish-modules/archive/refs/tags/${VARNISH_MODULES_VERSION}.tar.gz \