From f92bfe820531395f2f06d866ef53aa0d74dce1b9 Mon Sep 17 00:00:00 2001
From: Rich Braun <richb@instantlinux.net>
Date: Mon, 10 Aug 2026 21:05:18 -0700
Subject: [PATCH 1/9] SYS-696_update_cleanup

---
 .gitlab-ci.yml                        | 50 +++++++++++++--------------
 .image-gitlab-ci.yml                  |  6 +++-
 images/data-sync/helm/Chart.yaml      |  2 +-
 images/data-sync/helm/values.yaml     |  1 +
 images/dovecot/helm/Chart.yaml        |  4 +--
 images/git-pull/add_tags              |  2 ++
 images/mythtv-backend/helm/Chart.yaml |  4 +--
 images/postfix-python/helm/Chart.yaml |  4 +--
 images/proftpd/Dockerfile             |  2 +-
 images/proftpd/helm/Chart.yaml        |  4 +--
 images/spamassassin/Dockerfile        | 10 +++---
 images/spamassassin/helm/Chart.yaml   |  4 +--
 lib/build/Makefile.docker_image       | 18 +++++++---
 13 files changed, 64 insertions(+), 47 deletions(-)
 create mode 100755 images/git-pull/add_tags

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 1d496e81..9989171d 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2,32 +2,32 @@
 
 stages:
   - prepare
-  - git-dump
-  - blacklist
-  - data-sync
-  - ddclient
-  - dhcpd-dns-pxe
-  - dovecot
-  - ez-ipupdate
-  - git-pull
-  - haproxy-keepalived
-  - mariadb-galera
-  - mysqldump
-  - mythtv-backend
-  - nagios
-  - nagiosql
-  - nut-upsd
-  - openldap
-  - postfix
-  - postfix-python
-  - proftpd
-  - rsyslogd
-  - samba
-  - samba-dc
+  # - git-dump
+  # - blacklist
+  # - data-sync
+  # - ddclient
+  # - dhcpd-dns-pxe
+  # - dovecot
+  # - ez-ipupdate
+  # - git-pull
+  # - haproxy-keepalived
+  # - mariadb-galera
+  # - mysqldump
+  # - mythtv-backend
+  # - nagios
+  # - nagiosql
+  # - nut-upsd
+  # - openldap
+  # - postfix
+  # - postfix-python
+  # - proftpd
+  # - rsyslogd
+  # - samba
+  # - samba-dc
   - spamassassin
-  - udp-nginx-proxy
-  - vsftpd
-  - weewx
+  # - udp-nginx-proxy
+  # - vsftpd
+  # - weewx
 workflow:
   rules:
   - { if: $CI_COMMIT_TAG =~ /^chart-.*/, when: never }
diff --git a/.image-gitlab-ci.yml b/.image-gitlab-ci.yml
index 366b3116..75500a7f 100644
--- a/.image-gitlab-ci.yml
+++ b/.image-gitlab-ci.yml
@@ -63,13 +63,17 @@ security_scan_trivy:
     TRIVY_PKG_TYPES: os,library
   script:
   - export TAG=bld_$CI_PIPELINE_IID_${CI_COMMIT_SHORT_SHA}
+  # Trivy alerts on unfixed vulnerabilities in debian images
+  - if [ $IMAGE = blacklist ] || [ $IMAGE = spamassassin ]; then \
+      IGN_FLAG=--ignore-unfixed; \
+    fi
   - trivy clean --all
   - trivy image --download-db-only --no-progress
   - trivy image "${REGISTRY}/${IMAGE}:${TAG}" --severity LOW,MEDIUM
       --exit-code 0 --format table --output medium-vulns.txt
   - cat medium-vulns.txt
   - echo $TRIVY_IGNORE | tr , "\n" | tee .trivyignore
-  - trivy image "${REGISTRY}/${IMAGE}:${TAG}"
+  - trivy image $IGN_FLAG "${REGISTRY}/${IMAGE}:${TAG}"
   cache:
     paths: [ .trivycache ]
   interruptible: true
diff --git a/images/data-sync/helm/Chart.yaml b/images/data-sync/helm/Chart.yaml
index 4ac7b18d..1cface8f 100644
--- a/images/data-sync/helm/Chart.yaml
+++ b/images/data-sync/helm/Chart.yaml
@@ -5,7 +5,7 @@ home: https://github.com/instantlinux/docker-tools
 sources:
 - https://github.com/instantlinux/docker-tools
 type: application
-version: 0.1.17
+version: 0.1.18
 appVersion: "2.54.0-4.14.3-r0"
 dependencies:
 - name: chartlib
diff --git a/images/data-sync/helm/values.yaml b/images/data-sync/helm/values.yaml
index d30f5f3f..ff6314d7 100644
--- a/images/data-sync/helm/values.yaml
+++ b/images/data-sync/helm/values.yaml
@@ -117,6 +117,7 @@ configmap:
       ignore = Path data-sync/share/openldap/data/lock.mdb
       ignore = Path data-sync/share/snappymail/data/_default_/cache
       ignore = Path data-sync/dos
+      ignore = Path data-sync/headscale/db.sqlite-shm
       ignore = Path data-sync/home/*/.kube/cache
       ignore = Path data-sync/jira/home/analytics-logs
       ignore = Path data-sync/jira/home/log/automation-jira-performance.csv
diff --git a/images/dovecot/helm/Chart.yaml b/images/dovecot/helm/Chart.yaml
index 8622ba7a..6510d5ad 100644
--- a/images/dovecot/helm/Chart.yaml
+++ b/images/dovecot/helm/Chart.yaml
@@ -6,8 +6,8 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/vdukhovni/dovecot
 type: application
-version: 0.1.15
-appVersion: "2.4.3-r2"
+version: 0.1.16
+appVersion: "2.4.4-r0"
 dependencies:
 - name: chartlib
   version: 0.1.8
diff --git a/images/git-pull/add_tags b/images/git-pull/add_tags
new file mode 100755
index 00000000..ff9ebf1d
--- /dev/null
+++ b/images/git-pull/add_tags
@@ -0,0 +1,2 @@
+#!/bin/sh
+echo $(grep "ARG .*_VERSION" Dockerfile | cut -d= -f 2)
diff --git a/images/mythtv-backend/helm/Chart.yaml b/images/mythtv-backend/helm/Chart.yaml
index 58512d64..6ed63e4b 100644
--- a/images/mythtv-backend/helm/Chart.yaml
+++ b/images/mythtv-backend/helm/Chart.yaml
@@ -6,8 +6,8 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/mythtv/mythtv
 type: application
-version: 0.1.21
-appVersion: "36.0-fixes.202607020123.7153bb6e34"
+version: 0.1.22
+appVersion: "36.0-fixes.202608010335.0d263282c8"
 dependencies:
 - name: chartlib
   version: 0.1.8
diff --git a/images/postfix-python/helm/Chart.yaml b/images/postfix-python/helm/Chart.yaml
index bc98eefb..e823b410 100644
--- a/images/postfix-python/helm/Chart.yaml
+++ b/images/postfix-python/helm/Chart.yaml
@@ -6,8 +6,8 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/vdukhovni/postfix
 type: application
-version: 0.1.23
-appVersion: "3.11.4-r0"
+version: 0.1.24
+appVersion: "3.11.5-r0"
 dependencies:
 - name: chartlib
   version: 0.1.8
diff --git a/images/proftpd/Dockerfile b/images/proftpd/Dockerfile
index cd7102f5..90348460 100644
--- a/images/proftpd/Dockerfile
+++ b/images/proftpd/Dockerfile
@@ -9,7 +9,7 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
     org.label-schema.vcs-ref=$VCS_REF \
     org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools
 
-ARG PROFTPD_VERSION=1.3.9c-r1
+ARG PROFTPD_VERSION=1.3.9c-r0
 
 ENV ALLOW_OVERWRITE=on \
     ANONYMOUS_DISABLE=off \
diff --git a/images/proftpd/helm/Chart.yaml b/images/proftpd/helm/Chart.yaml
index 8f060b8c..39813574 100644
--- a/images/proftpd/helm/Chart.yaml
+++ b/images/proftpd/helm/Chart.yaml
@@ -6,8 +6,8 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/proftpd/proftpd
 type: application
-version: 0.1.14
-appVersion: "1.3.9b-r1"
+version: 0.1.15
+appVersion: "1.3.9c-r0"
 dependencies:
 - name: chartlib
   version: 0.1.8
diff --git a/images/spamassassin/Dockerfile b/images/spamassassin/Dockerfile
index 18874bc5..d9ff4ab8 100644
--- a/images/spamassassin/Dockerfile
+++ b/images/spamassassin/Dockerfile
@@ -1,4 +1,4 @@
-FROM debian:trixie-slim
+FROM ubuntu:resolute
 ARG BUILD_DATE
 ARG VCS_REF
 LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
@@ -17,7 +17,7 @@ ENV DEBIAN_FRONTEND=noninteractive \
     PYZOR_SITE=public.pyzor.org:24441
 
 ARG DCC_VERSION=2.3.169
-ARG SPAMD_VERSION=4.0.1-5
+ARG SPAMD_VERSION=4.0.2-3
 ARG DCC_SHA=3447e655476ac742942daf25fc217236da456dd0f82b7117661b9a70484b7bf6
 ARG SPAMD_UID=2022
 
@@ -42,9 +42,9 @@ RUN apt-get -yq update && apt-get -y upgrade && \
      /etc/razor/razor-agent.conf && \
     sed -i 's/DCCIFD_ENABLE=off/DCCIFD_ENABLE=on/' /var/dcc/dcc_conf && \
     sed -i '/^#\s*loadplugin .\+::DCC/s/^#\s*//g' /etc/spamassassin/v310.pre && \
-    apt-get purge -yq binutils libldap-2.5-0 linux-libc-dev libmilter-dev make && \
-    apt-get -yq autoremove && \
-    apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/log/*
+    apt-get purge -yq binutils libc6-dev linux-libc-dev libmilter-dev make && \
+    apt-get -yq autoremove && apt-get clean && \
+    rm -rf /var/cache/debconf/* /var/lib/apt/lists/* /tmp/* /var/log/*
 
 COPY entrypoint.sh /root/
 VOLUME ["/var/lib/spamassassin", "/var/log"]
diff --git a/images/spamassassin/helm/Chart.yaml b/images/spamassassin/helm/Chart.yaml
index d208e5b7..5e1f3c9f 100644
--- a/images/spamassassin/helm/Chart.yaml
+++ b/images/spamassassin/helm/Chart.yaml
@@ -6,8 +6,8 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://svn.apache.org/viewvc/spamassassin
 type: application
-version: 0.1.4
-appVersion: "4.0.1-5"
+version: 0.1.5
+appVersion: "4.0.2-3"
 dependencies:
 - name: chartlib
   version: 0.1.8
diff --git a/lib/build/Makefile.docker_image b/lib/build/Makefile.docker_image
index 51592c79..7c2351b1 100644
--- a/lib/build/Makefile.docker_image
+++ b/lib/build/Makefile.docker_image
@@ -69,11 +69,21 @@ promote_image: $(HOME)/.docker/cli-plugins/docker-buildx
 	  --push --file Dockerfile . \
 	  --build-arg=VCS_REF=$(CI_COMMIT_SHA) \
 	  --build-arg=BUILD_DATE=$(shell date +%Y-%m-%dT%H:%M:%SZ)
-	-if [ -x hooks/post_build ]; then sh hooks/post_build; fi
 
-	# TODO update dockerhub README if/when that is supported,
-	# see https://github.com/docker/hub-feedback/issues/1927
-	# and https://github.com/docker/hub-feedback/issues/2127
+	# update dockerhub README
+	[ -s /usr/bin/jq ] || apk add jq
+	@JSON=$(jq -n --arg pwd "$DOCKER_TOKEN" --arg user "$USER_LOGIN" \
+	  '{username: $user, password: $pwd}')
+	@JWT=$(curl -s -H "Content-Type: application/json" -X POST \
+	  -d "$JSON" https://hub.docker.com/v2/users/login/ |jq -r .token)
+        # Build JSON payload securely and send PATCH request
+        # jq --arg escapes special characters / newlines in markdown text
+        RESP=$(jq -n --arg desc "$(<README.md)" '{"full_description": $desc}' | \
+          curl -s -o /dev/null -w "%{http_code}" -X PATCH \
+          -H "Content-Type: application/json" \
+          -H "Authorization: JWT $JWT_TOKEN" \
+          -d @- https://hub.docker.com/v2/repositories/$(IMAGE_REPO)/
+	[ "$RESPONSE_CODE" -eq 200 ] || exit 1
 
 flake8: test_requirements
 	@echo "Running flake8 code analysis"

From 3d4bc8756213e8149b39407d1c018619bbd9f41b Mon Sep 17 00:00:00 2001
From: Rich Braun <richb@instantlinux.net>
Date: Mon, 10 Aug 2026 21:43:39 -0700
Subject: [PATCH 2/9] SYS-696 wip

---
 .gitlab-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 9989171d..2f4ad7b6 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2,7 +2,7 @@
 
 stages:
   - prepare
-  # - git-dump
+  - git-dump
   # - blacklist
   # - data-sync
   # - ddclient

From f4d075e5cd9413fbe19c0f4c4c24f7c0242370f6 Mon Sep 17 00:00:00 2001
From: Rich Braun <richb@instantlinux.net>
Date: Mon, 10 Aug 2026 21:45:38 -0700
Subject: [PATCH 3/9] SYS-696 wip

---
 .gitlab-ci.yml | 384 ++++++++++++++++++++++++-------------------------
 1 file changed, 192 insertions(+), 192 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 2f4ad7b6..9c78d714 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -64,194 +64,194 @@ smoketest:
     # TODO figure out a way to collect all child pipeline results
     strategy: depend
 
-blacklist:
-  stage: blacklist
-  trigger:
-    include:
-    - artifact: .child-blacklist.yml
-      job: prepare
-  only:
-    changes: [ images/blacklist/**, lib/**, .image-gitlab-ci.yml ]
+# blacklist:
+#   stage: blacklist
+#   trigger:
+#     include:
+#     - artifact: .child-blacklist.yml
+#       job: prepare
+#   only:
+#     changes: [ images/blacklist/**, lib/**, .image-gitlab-ci.yml ]
 
-data-sync:
-  stage: data-sync
-  trigger:
-    include:
-    - artifact: .child-data-sync.yml
-      job: prepare
-  only:
-    changes: [ images/data-sync/**, lib/**, .image-gitlab-ci.yml ]
+# data-sync:
+#   stage: data-sync
+#   trigger:
+#     include:
+#     - artifact: .child-data-sync.yml
+#       job: prepare
+#   only:
+#     changes: [ images/data-sync/**, lib/**, .image-gitlab-ci.yml ]
 
-ddclient:
-  stage: ddclient
-  trigger:
-    include:
-    - artifact: .child-ddclient.yml
-      job: prepare
-  only:
-    changes: [ images/ddclient/**, lib/**, .image-gitlab-ci.yml ]
+# ddclient:
+#   stage: ddclient
+#   trigger:
+#     include:
+#     - artifact: .child-ddclient.yml
+#       job: prepare
+#   only:
+#     changes: [ images/ddclient/**, lib/**, .image-gitlab-ci.yml ]
 
-dhcpd-dns-pxe:
-  stage: dhcpd-dns-pxe
-  trigger:
-    include:
-    - artifact: .child-dhcpd-dns-pxe.yml
-      job: prepare
-  only:
-    changes: [ images/dhcpd-dns-pxe/**, lib/**, .image-gitlab-ci.yml ]
+# dhcpd-dns-pxe:
+#   stage: dhcpd-dns-pxe
+#   trigger:
+#     include:
+#     - artifact: .child-dhcpd-dns-pxe.yml
+#       job: prepare
+#   only:
+#     changes: [ images/dhcpd-dns-pxe/**, lib/**, .image-gitlab-ci.yml ]
 
-dovecot:
-  stage: dovecot
-  trigger:
-    include:
-    - artifact: .child-dovecot.yml
-      job: prepare
-  only:
-    changes: [ images/dovecot/**, lib/**, .image-gitlab-ci.yml ]
+# dovecot:
+#   stage: dovecot
+#   trigger:
+#     include:
+#     - artifact: .child-dovecot.yml
+#       job: prepare
+#   only:
+#     changes: [ images/dovecot/**, lib/**, .image-gitlab-ci.yml ]
 
-ez-ipupdate:
-  stage: ez-ipupdate
-  trigger:
-    include:
-    - artifact: .child-ez-ipupdate.yml
-      job: prepare
-  only:
-    changes: [ images/ez-ipupdate/**, lib/**, .image-gitlab-ci.yml ]
+# ez-ipupdate:
+#   stage: ez-ipupdate
+#   trigger:
+#     include:
+#     - artifact: .child-ez-ipupdate.yml
+#       job: prepare
+#   only:
+#     changes: [ images/ez-ipupdate/**, lib/**, .image-gitlab-ci.yml ]
 
-git-pull:
-  stage: git-pull
-  trigger:
-    include:
-    - artifact: .child-git-pull.yml
-      job: prepare
-  only:
-    changes: [ images/git-pull/**, lib/**, .image-gitlab-ci.yml ]
+# git-pull:
+#   stage: git-pull
+#   trigger:
+#     include:
+#     - artifact: .child-git-pull.yml
+#       job: prepare
+#   only:
+#     changes: [ images/git-pull/**, lib/**, .image-gitlab-ci.yml ]
 
-haproxy-keepalived:
-  stage: haproxy-keepalived
-  trigger:
-    include:
-    - artifact: .child-haproxy-keepalived.yml
-      job: prepare
-  only:
-    changes: [ images/haproxy-keepalived/**, lib/**, .image-gitlab-ci.yml ]
+# haproxy-keepalived:
+#   stage: haproxy-keepalived
+#   trigger:
+#     include:
+#     - artifact: .child-haproxy-keepalived.yml
+#       job: prepare
+#   only:
+#     changes: [ images/haproxy-keepalived/**, lib/**, .image-gitlab-ci.yml ]
 
-mariadb-galera:
-  stage: mariadb-galera
-  trigger:
-    include:
-    - artifact: .child-mariadb-galera.yml
-      job: prepare
-  only:
-    changes: [ images/mariadb-galera/**, lib/**, .image-gitlab-ci.yml ]
+# mariadb-galera:
+#   stage: mariadb-galera
+#   trigger:
+#     include:
+#     - artifact: .child-mariadb-galera.yml
+#       job: prepare
+#   only:
+#     changes: [ images/mariadb-galera/**, lib/**, .image-gitlab-ci.yml ]
 
-mysqldump:
-  stage: mysqldump
-  trigger:
-    include:
-    - artifact: .child-mysqldump.yml
-      job: prepare
-  only:
-    changes: [ images/mysqldump/**, lib/**, .image-gitlab-ci.yml ]
+# mysqldump:
+#   stage: mysqldump
+#   trigger:
+#     include:
+#     - artifact: .child-mysqldump.yml
+#       job: prepare
+#   only:
+#     changes: [ images/mysqldump/**, lib/**, .image-gitlab-ci.yml ]
 
-mythtv-backend:
-  stage: mythtv-backend
-  trigger:
-    include:
-    - artifact: .child-mythtv-backend.yml
-      job: prepare
-  only:
-    changes: [ images/mythtv-backend/**, lib/**, .image-gitlab-ci.yml ]
+# mythtv-backend:
+#   stage: mythtv-backend
+#   trigger:
+#     include:
+#     - artifact: .child-mythtv-backend.yml
+#       job: prepare
+#   only:
+#     changes: [ images/mythtv-backend/**, lib/**, .image-gitlab-ci.yml ]
 
-nagios:
-  stage: nagios
-  trigger:
-    include:
-    - artifact: .child-nagios.yml
-      job: prepare
-  only:
-    changes: [ images/nagios/**, lib/**, .image-gitlab-ci.yml ]
+# nagios:
+#   stage: nagios
+#   trigger:
+#     include:
+#     - artifact: .child-nagios.yml
+#       job: prepare
+#   only:
+#     changes: [ images/nagios/**, lib/**, .image-gitlab-ci.yml ]
 
-nagiosql:
-  stage: nagiosql
-  trigger:
-    include:
-    - artifact: .child-nagiosql.yml
-      job: prepare
-  only:
-    changes: [ images/nagiosql/**, lib/**, .image-gitlab-ci.yml ]
+# nagiosql:
+#   stage: nagiosql
+#   trigger:
+#     include:
+#     - artifact: .child-nagiosql.yml
+#       job: prepare
+#   only:
+#     changes: [ images/nagiosql/**, lib/**, .image-gitlab-ci.yml ]
 
-nut-upsd:
-  stage: nut-upsd
-  trigger:
-    include:
-    - artifact: .child-nut-upsd.yml
-      job: prepare
-  only:
-    changes: [ images/nut-upsd/**, lib/**, .image-gitlab-ci.yml ]
+# nut-upsd:
+#   stage: nut-upsd
+#   trigger:
+#     include:
+#     - artifact: .child-nut-upsd.yml
+#       job: prepare
+#   only:
+#     changes: [ images/nut-upsd/**, lib/**, .image-gitlab-ci.yml ]
 
-postfix:
-  stage: postfix
-  trigger:
-    include:
-    - artifact: .child-postfix.yml
-      job: prepare
-  only:
-    changes: [ images/postfix/**, lib/**, .image-gitlab-ci.yml ]
+# postfix:
+#   stage: postfix
+#   trigger:
+#     include:
+#     - artifact: .child-postfix.yml
+#       job: prepare
+#   only:
+#     changes: [ images/postfix/**, lib/**, .image-gitlab-ci.yml ]
 
-openldap:
-  stage: openldap
-  trigger:
-    include:
-    - artifact: .child-openldap.yml
-      job: prepare
-  only:
-    changes: [ images/openldap/**, lib/**, .image-gitlab-ci.yml ]
+# openldap:
+#   stage: openldap
+#   trigger:
+#     include:
+#     - artifact: .child-openldap.yml
+#       job: prepare
+#   only:
+#     changes: [ images/openldap/**, lib/**, .image-gitlab-ci.yml ]
 
-postfix-python:
-  stage: postfix-python
-  trigger:
-    include:
-    - artifact: .child-postfix-python.yml
-      job: prepare
-  only:
-    changes: [ images/postfix-python/**, lib/**, .image-gitlab-ci.yml ]
+# postfix-python:
+#   stage: postfix-python
+#   trigger:
+#     include:
+#     - artifact: .child-postfix-python.yml
+#       job: prepare
+#   only:
+#     changes: [ images/postfix-python/**, lib/**, .image-gitlab-ci.yml ]
 
-proftpd:
-  stage: proftpd
-  trigger:
-    include:
-    - artifact: .child-proftpd.yml
-      job: prepare
-  only:
-    changes: [ images/proftpd/**, lib/**, .image-gitlab-ci.yml ]
+# proftpd:
+#   stage: proftpd
+#   trigger:
+#     include:
+#     - artifact: .child-proftpd.yml
+#       job: prepare
+#   only:
+#     changes: [ images/proftpd/**, lib/**, .image-gitlab-ci.yml ]
 
-rsyslogd:
-  stage: rsyslogd
-  trigger:
-    include:
-    - artifact: .child-rsyslogd.yml
-      job: prepare
-  only:
-    changes: [ images/rsyslogd/**, lib/**, .image-gitlab-ci.yml ]
+# rsyslogd:
+#   stage: rsyslogd
+#   trigger:
+#     include:
+#     - artifact: .child-rsyslogd.yml
+#       job: prepare
+#   only:
+#     changes: [ images/rsyslogd/**, lib/**, .image-gitlab-ci.yml ]
 
-samba:
-  stage: samba
-  trigger:
-    include:
-    - artifact: .child-samba.yml
-      job: prepare
-  only:
-    changes: [ images/samba/**, lib/**, .image-gitlab-ci.yml ]
+# samba:
+#   stage: samba
+#   trigger:
+#     include:
+#     - artifact: .child-samba.yml
+#       job: prepare
+#   only:
+#     changes: [ images/samba/**, lib/**, .image-gitlab-ci.yml ]
 
-samba-dc:
-  stage: samba-dc
-  trigger:
-    include:
-    - artifact: .child-samba-dc.yml
-      job: prepare
-  only:
-    changes: [ images/samba-dc/**, lib/**, .image-gitlab-ci.yml ]
+# samba-dc:
+#   stage: samba-dc
+#   trigger:
+#     include:
+#     - artifact: .child-samba-dc.yml
+#       job: prepare
+#   only:
+#     changes: [ images/samba-dc/**, lib/**, .image-gitlab-ci.yml ]
 
 spamassassin:
   stage: spamassassin
@@ -262,29 +262,29 @@ spamassassin:
   only:
     changes: [ images/spamassassin/**, lib/**, .image-gitlab-ci.yml ]
 
-udp-nginx-proxy:
-  stage: udp-nginx-proxy
-  trigger:
-    include:
-    - artifact: .child-udp-nginx-proxy.yml
-      job: prepare
-  only:
-    changes: [ images/udp-nginx-proxy/**, lib/**, .image-gitlab-ci.yml ]
+# udp-nginx-proxy:
+#   stage: udp-nginx-proxy
+#   trigger:
+#     include:
+#     - artifact: .child-udp-nginx-proxy.yml
+#       job: prepare
+#   only:
+#     changes: [ images/udp-nginx-proxy/**, lib/**, .image-gitlab-ci.yml ]
 
-vsftpd:
-  stage: vsftpd
-  trigger:
-    include:
-    - artifact: .child-vsftpd.yml
-      job: prepare
-  only:
-    changes: [ images/vsftpd/**, lib/**, .image-gitlab-ci.yml ]
+# vsftpd:
+#   stage: vsftpd
+#   trigger:
+#     include:
+#     - artifact: .child-vsftpd.yml
+#       job: prepare
+#   only:
+#     changes: [ images/vsftpd/**, lib/**, .image-gitlab-ci.yml ]
 
-weewx:
-  stage: weewx
-  trigger:
-    include:
-    - artifact: .child-weewx.yml
-      job: prepare
-  only:
-    changes: [ images/weewx/**, lib/**, .image-gitlab-ci.yml ]
+# weewx:
+#   stage: weewx
+#   trigger:
+#     include:
+#     - artifact: .child-weewx.yml
+#       job: prepare
+#   only:
+#     changes: [ images/weewx/**, lib/**, .image-gitlab-ci.yml ]

From 08b1ab97ac5721f6dfd5b0bf2392d2a9680c8039 Mon Sep 17 00:00:00 2001
From: Rich Braun <richb@instantlinux.net>
Date: Mon, 10 Aug 2026 21:48:28 -0700
Subject: [PATCH 4/9] SYS-696 wip

---
 .gitlab-ci.yml                  |  4 ++--
 lib/build/Makefile.docker_image | 14 +++++++-------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 9c78d714..46cb3789 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -259,8 +259,8 @@ spamassassin:
     include:
     - artifact: .child-spamassassin.yml
       job: prepare
-  only:
-    changes: [ images/spamassassin/**, lib/**, .image-gitlab-ci.yml ]
+  # only:
+  #   changes: [ images/spamassassin/**, lib/**, .image-gitlab-ci.yml ]
 
 # udp-nginx-proxy:
 #   stage: udp-nginx-proxy
diff --git a/lib/build/Makefile.docker_image b/lib/build/Makefile.docker_image
index 7c2351b1..19edf85e 100644
--- a/lib/build/Makefile.docker_image
+++ b/lib/build/Makefile.docker_image
@@ -76,13 +76,13 @@ promote_image: $(HOME)/.docker/cli-plugins/docker-buildx
 	  '{username: $user, password: $pwd}')
 	@JWT=$(curl -s -H "Content-Type: application/json" -X POST \
 	  -d "$JSON" https://hub.docker.com/v2/users/login/ |jq -r .token)
-        # Build JSON payload securely and send PATCH request
-        # jq --arg escapes special characters / newlines in markdown text
-        RESP=$(jq -n --arg desc "$(<README.md)" '{"full_description": $desc}' | \
-          curl -s -o /dev/null -w "%{http_code}" -X PATCH \
-          -H "Content-Type: application/json" \
-          -H "Authorization: JWT $JWT_TOKEN" \
-          -d @- https://hub.docker.com/v2/repositories/$(IMAGE_REPO)/
+	# Build JSON payload securely and send PATCH request
+	# jq --arg escapes special characters / newlines in markdown text
+	RESP=$(jq -n --arg desc "$(<README.md)" '{"full_description": $desc}' | \
+	  curl -s -o /dev/null -w "%{http_code}" -X PATCH \
+	  -H "Content-Type: application/json" \
+	  -H "Authorization: JWT $JWT_TOKEN" \
+	  -d @- https://hub.docker.com/v2/repositories/$(IMAGE_REPO)/
 	[ "$RESPONSE_CODE" -eq 200 ] || exit 1
 
 flake8: test_requirements

From 6ccc5564db9f3277af277de39436a30747bf8dcf Mon Sep 17 00:00:00 2001
From: Rich Braun <richb@instantlinux.net>
Date: Mon, 10 Aug 2026 21:55:44 -0700
Subject: [PATCH 5/9] SYS-696 wip

---
 .image-gitlab-ci.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.image-gitlab-ci.yml b/.image-gitlab-ci.yml
index 75500a7f..75903245 100644
--- a/.image-gitlab-ci.yml
+++ b/.image-gitlab-ci.yml
@@ -64,8 +64,9 @@ security_scan_trivy:
   script:
   - export TAG=bld_$CI_PIPELINE_IID_${CI_COMMIT_SHORT_SHA}
   # Trivy alerts on unfixed vulnerabilities in debian images
-  - if [ $IMAGE = blacklist ] || [ $IMAGE = spamassassin ]; then \
-      IGN_FLAG=--ignore-unfixed; \
+  - >
+    if [ $IMAGE = blacklist ] || [ $IMAGE = spamassassin ]; then
+      IGN_FLAG=--ignore-unfixed;
     fi
   - trivy clean --all
   - trivy image --download-db-only --no-progress

From cc4ccccff8047b846edb1dc4fd310a509851de0f Mon Sep 17 00:00:00 2001
From: Rich Braun <richb@instantlinux.net>
Date: Mon, 10 Aug 2026 22:32:08 -0700
Subject: [PATCH 6/9] SYS-696 wip

---
 .gitlab-ci.yml       | 16 ++++++++--------
 .image-gitlab-ci.yml |  2 +-
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 46cb3789..2752a81e 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -3,7 +3,7 @@
 stages:
   - prepare
   - git-dump
-  # - blacklist
+  - blacklist
   # - data-sync
   # - ddclient
   # - dhcpd-dns-pxe
@@ -33,7 +33,7 @@ workflow:
   - { if: $CI_COMMIT_TAG =~ /^chart-.*/, when: never }
   - when: always
 
-image: docker:29.1.2
+image: docker:29.7.2
 
 prepare:
   stage: prepare
@@ -64,12 +64,12 @@ smoketest:
     # TODO figure out a way to collect all child pipeline results
     strategy: depend
 
-# blacklist:
-#   stage: blacklist
-#   trigger:
-#     include:
-#     - artifact: .child-blacklist.yml
-#       job: prepare
+blacklist:
+  stage: blacklist
+  trigger:
+    include:
+    - artifact: .child-blacklist.yml
+      job: prepare
 #   only:
 #     changes: [ images/blacklist/**, lib/**, .image-gitlab-ci.yml ]
 
diff --git a/.image-gitlab-ci.yml b/.image-gitlab-ci.yml
index 75903245..8e92b2c1 100644
--- a/.image-gitlab-ci.yml
+++ b/.image-gitlab-ci.yml
@@ -13,7 +13,7 @@ stages:
   - Security Scan
   - Promote Image
 
-image: docker:29.7.1
+image: docker:29.7.2
 
 .registry_template: &registry_login
   before_script:

From b0acbdd892c295bf622bae61152fe8950d857039 Mon Sep 17 00:00:00 2001
From: Rich Braun <richb@instantlinux.net>
Date: Mon, 10 Aug 2026 22:51:21 -0700
Subject: [PATCH 7/9] SYS-696 wip

---
 .image-gitlab-ci.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.image-gitlab-ci.yml b/.image-gitlab-ci.yml
index 8e92b2c1..eec5913c 100644
--- a/.image-gitlab-ci.yml
+++ b/.image-gitlab-ci.yml
@@ -49,7 +49,6 @@ security_scan_trivy:
     TRIVY_EXIT_CODE: 1
     TRIVY_FORMAT: json
     TRIVY_IGNORE: >-
-      CVE-2023-31484,CVE-2023-45853,
       CVE-2023-52425,CVE-2024-8176,
       CVE-2025-9900,
       CVE-2026-0861,CVE-2025-8194,CVE-2025-13699,
@@ -66,7 +65,7 @@ security_scan_trivy:
   # Trivy alerts on unfixed vulnerabilities in debian images
   - >
     if [ $IMAGE = blacklist ] || [ $IMAGE = spamassassin ]; then
-      IGN_FLAG=--ignore-unfixed;
+      IGN_FLAG=--ignore-unfixed ;
     fi
   - trivy clean --all
   - trivy image --download-db-only --no-progress

From 24d542cf954e906e609471c4527b55bc1d6b87fc Mon Sep 17 00:00:00 2001
From: Rich Braun <richb@instantlinux.net>
Date: Mon, 10 Aug 2026 23:06:42 -0700
Subject: [PATCH 8/9] SYS-696 wip

---
 lib/build/Makefile.docker_image | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/build/Makefile.docker_image b/lib/build/Makefile.docker_image
index 19edf85e..d3be9446 100644
--- a/lib/build/Makefile.docker_image
+++ b/lib/build/Makefile.docker_image
@@ -41,7 +41,9 @@ ifeq ($(IMAGE),$(filter $(IMAGE),python-builder python-wsgi))
   PLATFORMS = linux/amd64,linux/arm64
 endif
 ifeq ($(IMAGE),spamassassin)
-  PLATFORMS = linux/amd64,linux/arm64
+  PLATFORMS = linux/amd64
+  # TODO restore arm64 when this error gets fixed:
+  # /usr/bin/tar: dcc-2.3.169/dcc.html.in: Cannot open: Function not implemented
 endif
 
 analysis: flake8

From 8ebac31d34e4e95582f98447c7425dab839082bc Mon Sep 17 00:00:00 2001
From: Rich Braun <richb@instantlinux.net>
Date: Tue, 11 Aug 2026 06:30:14 -0700
Subject: [PATCH 9/9] SYS-696 wip

---
 .gitlab-ci.yml       | 422 +++++++++++++++++++++----------------------
 .image-gitlab-ci.yml |   5 -
 2 files changed, 211 insertions(+), 216 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 2752a81e..e2b8dbfb 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,30 +4,30 @@ stages:
   - prepare
   - git-dump
   - blacklist
-  # - data-sync
-  # - ddclient
-  # - dhcpd-dns-pxe
-  # - dovecot
-  # - ez-ipupdate
-  # - git-pull
-  # - haproxy-keepalived
-  # - mariadb-galera
-  # - mysqldump
-  # - mythtv-backend
-  # - nagios
-  # - nagiosql
-  # - nut-upsd
-  # - openldap
-  # - postfix
-  # - postfix-python
-  # - proftpd
-  # - rsyslogd
-  # - samba
-  # - samba-dc
+  - data-sync
+  - ddclient
+  - dhcpd-dns-pxe
+  - dovecot
+  - ez-ipupdate
+  - git-pull
+  - haproxy-keepalived
+  - mariadb-galera
+  - mysqldump
+  - mythtv-backend
+  - nagios
+  - nagiosql
+  - nut-upsd
+  - openldap
+  - postfix
+  - postfix-python
+  - proftpd
+  - rsyslogd
+  - samba
+  - samba-dc
   - spamassassin
-  # - udp-nginx-proxy
-  # - vsftpd
-  # - weewx
+  - udp-nginx-proxy
+  - vsftpd
+  - weewx
 workflow:
   rules:
   - { if: $CI_COMMIT_TAG =~ /^chart-.*/, when: never }
@@ -70,188 +70,188 @@ blacklist:
     include:
     - artifact: .child-blacklist.yml
       job: prepare
-#   only:
-#     changes: [ images/blacklist/**, lib/**, .image-gitlab-ci.yml ]
+  only:
+    changes: [ images/blacklist/**, lib/**, .image-gitlab-ci.yml ]
 
-# data-sync:
-#   stage: data-sync
-#   trigger:
-#     include:
-#     - artifact: .child-data-sync.yml
-#       job: prepare
-#   only:
-#     changes: [ images/data-sync/**, lib/**, .image-gitlab-ci.yml ]
+data-sync:
+  stage: data-sync
+  trigger:
+    include:
+    - artifact: .child-data-sync.yml
+      job: prepare
+  only:
+    changes: [ images/data-sync/**, lib/**, .image-gitlab-ci.yml ]
 
-# ddclient:
-#   stage: ddclient
-#   trigger:
-#     include:
-#     - artifact: .child-ddclient.yml
-#       job: prepare
-#   only:
-#     changes: [ images/ddclient/**, lib/**, .image-gitlab-ci.yml ]
+ddclient:
+  stage: ddclient
+  trigger:
+    include:
+    - artifact: .child-ddclient.yml
+      job: prepare
+  only:
+    changes: [ images/ddclient/**, lib/**, .image-gitlab-ci.yml ]
 
-# dhcpd-dns-pxe:
-#   stage: dhcpd-dns-pxe
-#   trigger:
-#     include:
-#     - artifact: .child-dhcpd-dns-pxe.yml
-#       job: prepare
-#   only:
-#     changes: [ images/dhcpd-dns-pxe/**, lib/**, .image-gitlab-ci.yml ]
+dhcpd-dns-pxe:
+  stage: dhcpd-dns-pxe
+  trigger:
+    include:
+    - artifact: .child-dhcpd-dns-pxe.yml
+      job: prepare
+  only:
+    changes: [ images/dhcpd-dns-pxe/**, lib/**, .image-gitlab-ci.yml ]
 
-# dovecot:
-#   stage: dovecot
-#   trigger:
-#     include:
-#     - artifact: .child-dovecot.yml
-#       job: prepare
-#   only:
-#     changes: [ images/dovecot/**, lib/**, .image-gitlab-ci.yml ]
+dovecot:
+  stage: dovecot
+  trigger:
+    include:
+    - artifact: .child-dovecot.yml
+      job: prepare
+  only:
+    changes: [ images/dovecot/**, lib/**, .image-gitlab-ci.yml ]
 
-# ez-ipupdate:
-#   stage: ez-ipupdate
-#   trigger:
-#     include:
-#     - artifact: .child-ez-ipupdate.yml
-#       job: prepare
-#   only:
-#     changes: [ images/ez-ipupdate/**, lib/**, .image-gitlab-ci.yml ]
+ez-ipupdate:
+  stage: ez-ipupdate
+  trigger:
+    include:
+    - artifact: .child-ez-ipupdate.yml
+      job: prepare
+  only:
+    changes: [ images/ez-ipupdate/**, lib/**, .image-gitlab-ci.yml ]
 
-# git-pull:
-#   stage: git-pull
-#   trigger:
-#     include:
-#     - artifact: .child-git-pull.yml
-#       job: prepare
-#   only:
-#     changes: [ images/git-pull/**, lib/**, .image-gitlab-ci.yml ]
+git-pull:
+  stage: git-pull
+  trigger:
+    include:
+    - artifact: .child-git-pull.yml
+      job: prepare
+  only:
+    changes: [ images/git-pull/**, lib/**, .image-gitlab-ci.yml ]
 
-# haproxy-keepalived:
-#   stage: haproxy-keepalived
-#   trigger:
-#     include:
-#     - artifact: .child-haproxy-keepalived.yml
-#       job: prepare
-#   only:
-#     changes: [ images/haproxy-keepalived/**, lib/**, .image-gitlab-ci.yml ]
+haproxy-keepalived:
+  stage: haproxy-keepalived
+  trigger:
+    include:
+    - artifact: .child-haproxy-keepalived.yml
+      job: prepare
+  only:
+    changes: [ images/haproxy-keepalived/**, lib/**, .image-gitlab-ci.yml ]
 
-# mariadb-galera:
-#   stage: mariadb-galera
-#   trigger:
-#     include:
-#     - artifact: .child-mariadb-galera.yml
-#       job: prepare
-#   only:
-#     changes: [ images/mariadb-galera/**, lib/**, .image-gitlab-ci.yml ]
+mariadb-galera:
+  stage: mariadb-galera
+  trigger:
+    include:
+    - artifact: .child-mariadb-galera.yml
+      job: prepare
+  only:
+    changes: [ images/mariadb-galera/**, lib/**, .image-gitlab-ci.yml ]
 
-# mysqldump:
-#   stage: mysqldump
-#   trigger:
-#     include:
-#     - artifact: .child-mysqldump.yml
-#       job: prepare
-#   only:
-#     changes: [ images/mysqldump/**, lib/**, .image-gitlab-ci.yml ]
+mysqldump:
+  stage: mysqldump
+  trigger:
+    include:
+    - artifact: .child-mysqldump.yml
+      job: prepare
+  only:
+    changes: [ images/mysqldump/**, lib/**, .image-gitlab-ci.yml ]
 
-# mythtv-backend:
-#   stage: mythtv-backend
-#   trigger:
-#     include:
-#     - artifact: .child-mythtv-backend.yml
-#       job: prepare
-#   only:
-#     changes: [ images/mythtv-backend/**, lib/**, .image-gitlab-ci.yml ]
+mythtv-backend:
+  stage: mythtv-backend
+  trigger:
+    include:
+    - artifact: .child-mythtv-backend.yml
+      job: prepare
+  only:
+    changes: [ images/mythtv-backend/**, lib/**, .image-gitlab-ci.yml ]
 
-# nagios:
-#   stage: nagios
-#   trigger:
-#     include:
-#     - artifact: .child-nagios.yml
-#       job: prepare
-#   only:
-#     changes: [ images/nagios/**, lib/**, .image-gitlab-ci.yml ]
+nagios:
+  stage: nagios
+  trigger:
+    include:
+    - artifact: .child-nagios.yml
+      job: prepare
+  only:
+    changes: [ images/nagios/**, lib/**, .image-gitlab-ci.yml ]
 
-# nagiosql:
-#   stage: nagiosql
-#   trigger:
-#     include:
-#     - artifact: .child-nagiosql.yml
-#       job: prepare
-#   only:
-#     changes: [ images/nagiosql/**, lib/**, .image-gitlab-ci.yml ]
+nagiosql:
+  stage: nagiosql
+  trigger:
+    include:
+    - artifact: .child-nagiosql.yml
+      job: prepare
+  only:
+    changes: [ images/nagiosql/**, lib/**, .image-gitlab-ci.yml ]
 
-# nut-upsd:
-#   stage: nut-upsd
-#   trigger:
-#     include:
-#     - artifact: .child-nut-upsd.yml
-#       job: prepare
-#   only:
-#     changes: [ images/nut-upsd/**, lib/**, .image-gitlab-ci.yml ]
+nut-upsd:
+  stage: nut-upsd
+  trigger:
+    include:
+    - artifact: .child-nut-upsd.yml
+      job: prepare
+  only:
+    changes: [ images/nut-upsd/**, lib/**, .image-gitlab-ci.yml ]
 
-# postfix:
-#   stage: postfix
-#   trigger:
-#     include:
-#     - artifact: .child-postfix.yml
-#       job: prepare
-#   only:
-#     changes: [ images/postfix/**, lib/**, .image-gitlab-ci.yml ]
+postfix:
+  stage: postfix
+  trigger:
+    include:
+    - artifact: .child-postfix.yml
+      job: prepare
+  only:
+    changes: [ images/postfix/**, lib/**, .image-gitlab-ci.yml ]
 
-# openldap:
-#   stage: openldap
-#   trigger:
-#     include:
-#     - artifact: .child-openldap.yml
-#       job: prepare
-#   only:
-#     changes: [ images/openldap/**, lib/**, .image-gitlab-ci.yml ]
+openldap:
+  stage: openldap
+  trigger:
+    include:
+    - artifact: .child-openldap.yml
+      job: prepare
+  only:
+    changes: [ images/openldap/**, lib/**, .image-gitlab-ci.yml ]
 
-# postfix-python:
-#   stage: postfix-python
-#   trigger:
-#     include:
-#     - artifact: .child-postfix-python.yml
-#       job: prepare
-#   only:
-#     changes: [ images/postfix-python/**, lib/**, .image-gitlab-ci.yml ]
+postfix-python:
+  stage: postfix-python
+  trigger:
+    include:
+    - artifact: .child-postfix-python.yml
+      job: prepare
+  only:
+    changes: [ images/postfix-python/**, lib/**, .image-gitlab-ci.yml ]
 
-# proftpd:
-#   stage: proftpd
-#   trigger:
-#     include:
-#     - artifact: .child-proftpd.yml
-#       job: prepare
-#   only:
-#     changes: [ images/proftpd/**, lib/**, .image-gitlab-ci.yml ]
+proftpd:
+  stage: proftpd
+  trigger:
+    include:
+    - artifact: .child-proftpd.yml
+      job: prepare
+  only:
+    changes: [ images/proftpd/**, lib/**, .image-gitlab-ci.yml ]
 
-# rsyslogd:
-#   stage: rsyslogd
-#   trigger:
-#     include:
-#     - artifact: .child-rsyslogd.yml
-#       job: prepare
-#   only:
-#     changes: [ images/rsyslogd/**, lib/**, .image-gitlab-ci.yml ]
+rsyslogd:
+  stage: rsyslogd
+  trigger:
+    include:
+    - artifact: .child-rsyslogd.yml
+      job: prepare
+  only:
+    changes: [ images/rsyslogd/**, lib/**, .image-gitlab-ci.yml ]
 
-# samba:
-#   stage: samba
-#   trigger:
-#     include:
-#     - artifact: .child-samba.yml
-#       job: prepare
-#   only:
-#     changes: [ images/samba/**, lib/**, .image-gitlab-ci.yml ]
+samba:
+  stage: samba
+  trigger:
+    include:
+    - artifact: .child-samba.yml
+      job: prepare
+  only:
+    changes: [ images/samba/**, lib/**, .image-gitlab-ci.yml ]
 
-# samba-dc:
-#   stage: samba-dc
-#   trigger:
-#     include:
-#     - artifact: .child-samba-dc.yml
-#       job: prepare
-#   only:
-#     changes: [ images/samba-dc/**, lib/**, .image-gitlab-ci.yml ]
+samba-dc:
+  stage: samba-dc
+  trigger:
+    include:
+    - artifact: .child-samba-dc.yml
+      job: prepare
+  only:
+    changes: [ images/samba-dc/**, lib/**, .image-gitlab-ci.yml ]
 
 spamassassin:
   stage: spamassassin
@@ -259,32 +259,32 @@ spamassassin:
     include:
     - artifact: .child-spamassassin.yml
       job: prepare
-  # only:
-  #   changes: [ images/spamassassin/**, lib/**, .image-gitlab-ci.yml ]
+  only:
+    changes: [ images/spamassassin/**, lib/**, .image-gitlab-ci.yml ]
 
-# udp-nginx-proxy:
-#   stage: udp-nginx-proxy
-#   trigger:
-#     include:
-#     - artifact: .child-udp-nginx-proxy.yml
-#       job: prepare
-#   only:
-#     changes: [ images/udp-nginx-proxy/**, lib/**, .image-gitlab-ci.yml ]
+udp-nginx-proxy:
+  stage: udp-nginx-proxy
+  trigger:
+    include:
+    - artifact: .child-udp-nginx-proxy.yml
+      job: prepare
+  only:
+    changes: [ images/udp-nginx-proxy/**, lib/**, .image-gitlab-ci.yml ]
 
-# vsftpd:
-#   stage: vsftpd
-#   trigger:
-#     include:
-#     - artifact: .child-vsftpd.yml
-#       job: prepare
-#   only:
-#     changes: [ images/vsftpd/**, lib/**, .image-gitlab-ci.yml ]
+vsftpd:
+  stage: vsftpd
+  trigger:
+    include:
+    - artifact: .child-vsftpd.yml
+      job: prepare
+  only:
+    changes: [ images/vsftpd/**, lib/**, .image-gitlab-ci.yml ]
 
-# weewx:
-#   stage: weewx
-#   trigger:
-#     include:
-#     - artifact: .child-weewx.yml
-#       job: prepare
-#   only:
-#     changes: [ images/weewx/**, lib/**, .image-gitlab-ci.yml ]
+weewx:
+  stage: weewx
+  trigger:
+    include:
+    - artifact: .child-weewx.yml
+      job: prepare
+  only:
+    changes: [ images/weewx/**, lib/**, .image-gitlab-ci.yml ]
diff --git a/.image-gitlab-ci.yml b/.image-gitlab-ci.yml
index eec5913c..0c2e2939 100644
--- a/.image-gitlab-ci.yml
+++ b/.image-gitlab-ci.yml
@@ -51,12 +51,7 @@ security_scan_trivy:
     TRIVY_IGNORE: >-
       CVE-2023-52425,CVE-2024-8176,
       CVE-2025-9900,
-      CVE-2026-0861,CVE-2025-8194,CVE-2025-13699,
-      CVE-2025-13836,CVE-2025-40914
-      # Above two rows are for spamassassin under debian trixie
       # CVE-2025-9900 is for mythtv-backend
-      # Below are for blacklist image, there's a won't-fix note for zlib1g
-      # CVE-2023-31484,CVE-2023-45853
     TRIVY_OUTPUT: gl-container-scanning-report.json
     TRIVY_SEVERITY: HIGH,CRITICAL
     TRIVY_PKG_TYPES: os,library