Ubuntu编译Nginx生成deb包

2026 年 5 月 13 日，F5 和安全研究员 depthfirst 公布了一个 Nginx ngx_http_rewrite_module 模块中的堆缓冲区溢出漏洞，编号 CVE-2026-42945，被命名为"NGINX Rift"。攻击者只需发送一个精心构造的 HTTP 请求，就能在未认证的情况下执行任意代码或导致服务崩溃。修改该漏洞需要更新nginx的版本到1.30.2以上版本。

由于作者维护了几百个nginx实例，操作系统相对比较固定，基本都是Ubuntu18，Ubuntu22，Openeuler24，UOSV20， KylinosV10这几个固定版本的系统，则可以将nginx编译生成nginx的deb包或者rpm包，将打包的nginx软件分发到服务器上执行升级命令即可，这样节省了大量的编译时间

因此本文主要介绍基于Ubuntu系统编译nginx1.30.2生成deb包

一、编译环境准备

安装deb构建工具，编译依赖等基础环境

sudo apt update 
sudo apt install -y build-essential devscripts debhelper libssl-dev libpcre3-dev zlib1g-dev

二、编译目录文件准备

创建编译工作目录和所需要的文件

mkdir ~/nginx-build/ 
wget https://nginx.org/download/nginx-1.30.2.tar.gz
tar -zxvf nginx-1.30.2.tar.gz
cd nginx-1.30.2
mkdir debian
# changelog 记录版本变更信息
touch debian/changelog
# compat  debhelper 兼容版本（新版本通常改为 `debhelper-compat`）
touch debian/compat
# control 包描述、依赖、维护者等核心信息
touch debian/control
# copyright 软件版权和许可证
touch debian/copyright
# Debian 打包构建脚本（类似 Makefile）
touch debian/rules
# postinst 安装后执行脚本
touch debian/postinst
# prerm 卸载前执行脚本
touch debian/prerm

三、填写编译控制文件内容

# debhelper 兼容版本（新版本通常改为 `debhelper-compat`）
echo "10" > debian/compat

# 版本变更信息
cat > debian/changelog << 'EOF'
nginx (1.30.2-0) unstable; urgency=medium

  * Custom build with RTMP module

 -- cinn <omstack@163.com>  Wed, 22 Apr 2026 16:00:00 +0800
EOF

# 包描述、依赖、维护者等核心信息
cat > debian/control << 'EOF'
Source: nginx
Section: httpd
Priority: optional
Maintainer: Your Name <your@email.com>
Build-Depends: debhelper (>= 10), libssl-dev, libpcre3-dev, zlib1g-dev
Standards-Version: 4.5.0

Package: nginx-rtmp
Architecture: any
Depends: ${shlibs:Depends}, ${misc:Depends}, adduser, lsb-base
Conflicts: nginx, nginx-full, nginx-light
Description: Nginx web server with RTMP module
 This is a custom build of Nginx 1.30.2 including the RTMP module.
EOF

# 软件版权和许可证
cat > debian/copyright << 'EOF'
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: nginx
Source: http://nginx.org/

Files: *
Copyright: (c) 2002-20264 Igor Sysoev
License: BSD-2-clause
EOF

# Debian 打包构建脚本（类似 Makefile）
# override_dh_auto_configur部分编译参数根据需要修改

cat >  debian/rules << 'EOF'
#!/usr/bin/make -f

RTMP_MODULE_DIR = nginx-rtmp-module

%:
	dh $@

override_dh_auto_configure:
	./configure \
		--prefix=/etc/nginx \
		--sbin-path=/usr/sbin/nginx \
		--modules-path=/usr/lib/nginx/modules \
		--conf-path=/etc/nginx/nginx.conf \
		--error-log-path=/var/log/nginx/error.log \
		--http-log-path=/var/log/nginx/access.log \
		--pid-path=/var/run/nginx.pid \
		--lock-path=/var/run/nginx.lock \
		--http-client-body-temp-path=/var/cache/nginx/client_temp \
		--http-proxy-temp-path=/var/cache/nginx/proxy_temp \
		--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
		--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
		--http-scgi-temp-path=/var/cache/nginx/scgi_temp \
		--with-compat \
		--with-threads \
		--with-http_addition_module \
		--with-http_auth_request_module \
		--with-http_dav_module \
		--with-http_flv_module \
		--with-http_gunzip_module \
		--with-http_gzip_static_module \
		--with-http_mp4_module \
		--with-http_random_index_module \
		--with-http_realip_module \
		--with-http_secure_link_module \
		--with-http_slice_module \
		--with-http_ssl_module \
		--with-http_stub_status_module \
		--with-http_sub_module \
		--with-http_v2_module \
		--with-mail \
		--with-mail_ssl_module \
		--with-stream \
		--with-stream_realip_module \
		--with-stream_ssl_module \
		--with-stream_ssl_preread_module
EOF

# 安装后执行脚本
cat > debian/postinst << 'EOF'
#!/bin/bash
set -e

case "$1" in
    configure)
        mkdir -p /var/cache/nginx/client_temp
        mkdir -p /var/cache/nginx/proxy_temp
        mkdir -p /var/cache/nginx/fastcgi_temp
        mkdir -p /var/cache/nginx/uwsgi_temp
        mkdir -p /var/cache/nginx/scgi_temp
        mkdir -p /var/log/nginx
        mkdir -p /var/lib/nginx/body
        mkdir -p /etc/nginx/sites-enabled
        mkdir -p /etc/nginx/forbid
        mkdir -p /etc/nginx/custom
        mkdir -p /etc/nginx/conf.d
        
        systemctl daemon-reload
        systemctl enable nginx
        systemctl start nginx || true
        ;;
esac
exit 0
EOF

# 卸载前执行的脚本
cat > debian/prerm << 'EOF'
#!/bin/bash
set -e

case "$1" in
    remove|upgrade|deconfigure)
        if [ -f /var/run/nginx.pid ]; then
            systemctl stop nginx || true
        fi
        ;;
esac
exit 0
EOF

# 构建阶段需要执行的步骤，指定“把哪些文件安装到包里的哪个目录”
cat >debian/install<<EOF
debian/nginx.service lib/systemd/system/
EOF

# 需要提前创建的目录
cat >debian/dirs<<EOF
etc/nginx
var/log/nginx
var/lib/nginx/body
var/cache/nginx
run
lib/systemd/system
EOF

四、准备systemd控制文件

cat > debian/nginx.service << EOF
[Unit]
Description=nginx - high performance web server
Documentation=http://nginx.org/en/docs/
After=network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target

[Service]
Type=forking
PIDFile=/var/run/nginx.pid
ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s TERM $MAINPID
LimitNOFILE=65535:65535


[Install]
WantedBy=multi-user.target

EOF

五、编译生成deb包

# 给对应的文件执行权限。
chmod +x debian/rules debian/postinst debian/prerm

# 构建deb包
dpkg-buildpackage -us -uc -b
# -us: 不签名源码包
# -uc: 不签名变更文件
# -b: 仅构建二进制包