国产服务器操作系统编译nginx生成rpm包

2026 年 5 月 13 日，F5 和安全研究员 depthfirst 公布了一个 Nginx ngx_http_rewrite_module 模块中的堆缓冲区溢出漏洞，编号 CVE-2026-42945，被命名为"NGINX Rift"。攻击者只需发送一个精心构造的 HTTP 请求，就能在未认证的情况下执行任意代码或导致服务崩溃。修改该漏洞需要更新nginx的版本到1.30.2以上版本。

由于作者维护了几百个nginx实例，操作系统相对比较固定，基本都是OpenEuler2203，OpenEuler2403，UOSV20， KylinosV10这几个固定版本的系统，则可以将nginx编译生成nginx的rpm包，将打包的nginx软件分发到服务器上执行升级命令即可，这样节省了大量的编译时间

因此本文主要介绍基于UOS V20 1070A系统编译nginx1.30.2生成rpm包

一、安装编译环境

dnf -y install gcc gcc-c++ make cmake zlib zlib-devel openssl openssl-devel pcre-devel vim net-tools man wget tar

二、 准备软件包构建环境

安装构建依赖

# 安装构建rpm包依赖dnf install -y rpm-build rpmdevtools# 初始化构建目录结构rpmdev-setuptree

目录结构

rpmbuild/├── BUILD├── BUILDROOT├── RPMS│   └── x86_64├── SOURCES│   ├── nginx-1.30.2.tar.gz│   └── nginx.service├── SPECS│   └── nginx.spec└── SRPMS

三、准备构建文件

准备nginx编译构建文件

cat  > rpmbuild/SPECS/nginx.spec << EOFName:       nginxVersion:    1.30.2Release:    0%{?dist}Summary:    omstackLicense:    GPLURL:        http://www.omfox.cnSource0:    nginx-1.30.2.tar.gzSource1:    nginx.serviceBuildRequires:  gettext%descriptionGarena omstack-build .%prep%setup -q%build ./configure  --prefix=/etc/nginx  --sbin-path=/usr/sbin/  --modules-path=/usr/lib/nginx/modules  --conf-path=/etc/nginx/nginx.conf  --error-log-path=/var/log/nginx/error.log  --http-log-path=/var/log/nginx/access.log  --pid-path=/var/run/nginx.pid  --lock-path=/var/run/nginx.lock  --http-client-body-temp-path=/var/cache/nginx/client_temp  --http-proxy-temp-path=/var/cache/nginx/proxy_temp  --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp  --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp  --http-scgi-temp-path=/var/cache/nginx/scgi_temp  --with-compat  --with-threads  --with-http_addition_module  --with-http_auth_request_module  --with-http_dav_module  --add-module=/opt/src/nginx-rtmp-module  --with-http_flv_module --with-http_gunzip_module  --with-http_gzip_static_module  --with-http_mp4_module  --with-http_random_index_module  --with-http_realip_module  --with-http_secure_link_module  --with-http_slice_module  --with-http_ssl_module  --with-openssl=/opt/src/openssl-3.0.30  --with-http_stub_status_module  --with-http_sub_module  --with-http_v2_module  --with-mail  --with-mail_ssl_module  --with-stream  --with-stream_realip_module  --with-stream_ssl_module  --with-stream_ssl_preread_module  --with-cc-opt='-static -static-libgcc'  --with-ld-opt=-static make %{?_smp_mflags}%installrm -rf %{buildroot}mkdir -p %{buildroot}/etc/nginxmkdir -p %{buildroot}/usr/sbinmkdir -p %{buildroot}/var/log/nginxmkdir -p %{buildroot}/var/cache/nginx/{client_temp,proxy_temp,fastcgi_temp,uwsgi_temp,scgi_temp}mkdir -p %{buildroot}/etc/nginx/{conf.d,sites-enabled}mkdir -p %{buildroot}/usr/share/nginx/htmlmake install DESTDIR=%{buildroot}install -D -m 0644 %{SOURCE1} %{buildroot}/%{_unitdir}/nginx.service%postmkdir -p /var/log/nginxmkdir -p /var/cache/nginx/{client_temp,proxy_temp,astcgi_temp,uwsgi_temp,scgi_temp}mkdir -p /etc/nginx/{conf.d,sites-enabled}mkdir -p /usr/share/nginx/html/%preunsystemctl --quiet is-active  && systemctl stop  >/dev/null || :%postun/usr/sbin/userdel  >/dev/null 2>&1 || :%files%defattr(-,root,root,-)/etc/nginx/fastcgi.conf/etc/nginx/fastcgi.conf.default/etc/nginx/fastcgi_params/etc/nginx/fastcgi_params.default/etc/nginx/html/50x.html/etc/nginx/html/index.html/etc/nginx/koi-utf/etc/nginx/koi-win/etc/nginx/mime.types/etc/nginx/mime.types.default/etc/nginx/nginx.conf/etc/nginx/nginx.conf.default/etc/nginx/scgi_params/etc/nginx/scgi_params.default/etc/nginx/uwsgi_params/etc/nginx/uwsgi_params.default/etc/nginx/win-utf/usr/sbin/nginx%{_unitdir}/nginx.service%changelog* Wed May 20 2026 omstack <[email protected]> - 1.30.2- Initial release of Nginx 1.30.2 for ARM64 with static OpenSSL 3.0.20  EOF

添加 systemd方式管理

cat  > rpmbuild/SOURCES/nginx.service <<EOF[Unit]Description= - high performance web serverDocumentation=http://nginx.org/en/docs/After=network-online.target remote-fs.target nss-lookup.targetWants=network-online.target[Service]Type=forkingPIDFile=/var/run/nginx.pidUser=rootExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.confExecReload=/bin/kill -s HUP $MAINPIDExecStop=/bin/kill -s TERM $MAINPID[Install]WantedBy=multi-user.targetEOF

准备nginx编译源码包

wget  https://nginx.org/download/nginx-1.30.2.tar.gz -O  $HOME/rpmbuild/SOURCES/nginx-1.30.2.tar.gzmkdir -p /opt/src/wget "https://release-assets.githubusercontent.com/github-production-release-asset/7634677/bc462459-fa7e-49c8-ac75-d5b1e6815328?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-05-22T04%3A52%3A52Z&rscd=attachment%3B+filename%3Dopenssl-3.0.20.tar.gz&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-05-22T03%3A52%3A04Z&sks=b&skv=2018-11-09&sig=jC5XGMKptToXNxO7ewNdqA%2BggQx4EnGdG796LE5l6b8%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc3OTQyMzkwOSwibmJmIjoxNzc5NDIyMTA5LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.AljDjwz9q-AQGSJZjPNuFjsjPq5Rl8Uo5JftwEPZukY&response-content-disposition=attachment%3B%20filename%3Dopenssl-3.0.20.tar.gz&response-content-type=application%2Foctet-stream"  -O /opt/src/openssl-3.0.20.tar.gz

四、构建RPM包

cd /root/rpmbuild/SPECSrpmbuild -bb nginx.spec

五、获取rpm包

编译后的rpm包位于${HOME}/rpmbuild/RPMS/x86_64 目录下。

注意： 尽量在相同内核版本的操作系统中安装，可以避免因glibc或者其他系统依赖差别过大导致的安装胡总启动报错。