nextcloud · theCalcaholic · Jul 25, 2026 · Jul 25, 2026 · Jul 25, 2026 · Jul 26, 2026
diff --git a/.github/workflows/build-lxd.yml b/.github/workflows/build-lxd.yml
@@ -43,7 +43,7 @@ jobs:
           if [[ "${LXD_ARCH}" == "arm64" ]]
           then
             LXC_CMD="incus"
-            RUNNER_LABEL="ubuntu-20.04-arm64"
+            RUNNER_LABEL="ubuntu-26.04-arm64"
             echo "lxd_extra_profile=network" | tee -a "$GITHUB_OUTPUT"
           else
             LXC_CMD="incus"
@@ -71,10 +71,11 @@ jobs:
         with:
           ref: "${{ env.VERSION }}"
       - name: Setup incus
-        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-20.04-arm64' }}
+        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-26.04-arm64' }}
         run: |
           sudo apt-get update
-          sudo apt-get install -y incus qemu-system incus-tools
+          sudo apt-get install -y incus qemu-system
+          sudo apt-get install -y incus-tools || sudo apt-get install -y incus-extra
           sudo iptables -I DOCKER-USER -i incusbr0 -j ACCEPT
           sudo iptables -I DOCKER-USER -o incusbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
           sudo incus admin init --auto
@@ -147,7 +148,7 @@ jobs:
           echo "VERSION=$version" >> "$GITHUB_ENV"
           echo "previous_version=${version}" >> $GITHUB_OUTPUT
       - name: Setup incus
-        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-20.04-arm64' }}
+        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-26.04-arm64' }}
         run: |
           sudo apt-get update
           sudo apt-get install -y incus qemu-system incus-tools
@@ -199,7 +200,7 @@ jobs:
         with:
           ref: "${{ env.VERSION }}"
       - name: Setup incus
-        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-20.04-arm64' }}
+        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-26.04-arm64' }}
         run: |
           sudo apt-get update
           sudo apt-get install -y incus qemu-system incus-tools
@@ -254,7 +255,7 @@ jobs:
           . ./build/buildlib.sh
           sudo "$LXC" delete -q -f ncp || true
           sudo "$LXC" image import -q "./${ARTIFACT_FILE?}" --alias "ncp/test" || true
-          LXC_ARGS=(-p default)
+          LXC_ARGS=(-p default -c security.nesting=true)
           [[ -z "$LXD_EXTRA_PROFILE" ]] || LXC_ARGS+=(-p "$LXD_EXTRA_PROFILE")
           systemd-run --user --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/test" ncp || \
           sudo systemd-run --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/test" ncp
@@ -270,9 +271,10 @@ jobs:
           set -x
           export GECKODRIVER_PATH="$GECKODRIVER_PATH"
           export FF_BINARY_PATH="$(which firefox)"
+          python="$(dirname "$PWD")/.venv/bin/python"
           sudo "$LXC" exec ncp -- /usr/local/bin/ncc config:system:set overwrite.cli.url --value "https://nextcloudpi.local"
           sudo "$LXC" exec ncp -- bash -c 'tail -f /var/log/ncp.log' |& awk '{ print "NCP::" $0 }' &
-          ../.venv/bin/python activation_tests.py -t 300 --no-gui "nextcloudpi.local" 443 4443 || {
+          "$python" activation_tests.py -t 300 --no-gui "nextcloudpi.local" 443 4443 || {
             echo "Activation test failed!"
             echo "Geckodriver logs:"
             tail -n 20 geckodriver.log >&2 || true
@@ -285,7 +287,7 @@ jobs:
             sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
             exit 1
           }
-          ../.venv/bin/python nextcloud_tests.py --no-gui --skip-release-check "nextcloudpi.local" 443 4443 || {
+          "$python" nextcloud_tests.py --no-gui --skip-release-check "nextcloudpi.local" 443 4443 || {
             echo "Nextcloud test failed!"
             echo "Geckodriver logs:"
             tail -n 20 geckodriver.log >&2 || true
@@ -298,7 +300,7 @@ jobs:
             sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
             exit 1
           }
-          USE_INCUS="$USE_INCUS" ../.venv/bin/python system_tests.py --non-interactive --skip-update-test || {
+          USE_INCUS="$USE_INCUS" "$python" system_tests.py --non-interactive --skip-update-test || {
             echo "System test failed!"
             exit 1
           }
@@ -379,8 +381,9 @@ jobs:
           sudo "$LXC" exec ncp -- bash -c 'tail -f /var/log/ncp.log' |& awk '{ print "NCP::" $0 }' &
           export GECKODRIVER_PATH="$GECKODRIVER_PATH"
           export FF_BINARY_PATH="$(which firefox)"
+          python="$(dirname "$PWD")/.venv/bin/python"
 
-          USE_INCUS="$USE_INCUS" ../.venv/bin/python system_tests.py --skip-update-test --non-interactive || {
+          USE_INCUS="$USE_INCUS" "$python" system_tests.py --skip-update-test --non-interactive || {
             echo "System test failed!"
             echo "ncp.log: "
             sudo "$LXC" exec ncp -- bash -c "tail -n20 /var/log/ncp.log" || true
@@ -390,7 +393,7 @@ jobs:
             sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
             exit 1
           }
-          ../.venv/bin/python nextcloud_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
+          "$python" nextcloud_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
             echo "Nextcloud test failed!"
             echo "Geckodriver logs:"
             tail -n 20 geckodriver.log >&2 || true
@@ -418,7 +421,7 @@ jobs:
       USE_INCUS: "${{ needs.determine-runner.outputs.lxc_cmd == 'incus' && 'yes' || 'no' }}"
     steps:
       - name: Setup incus
-        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-20.04-arm64' }}
+        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-26.04-arm64' }}
         run: |
           sudo apt-get update
           sudo apt-get install -y incus qemu-system incus-tools
@@ -474,7 +477,7 @@ jobs:
           . ./build/buildlib.sh
           sudo "$LXC" delete -q -f ncp || true
           sudo "$LXC" image import -q "./ncp.tar.gz" --alias "ncp/update" || true
-          LXC_ARGS=(-p default)
+          LXC_ARGS=(-p default -c security.nesting=true)
           [[ -z "$LXD_EXTRA_PROFILE" ]] || LXC_ARGS+=(-p "$LXD_EXTRA_PROFILE")
           systemd-run --user --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/update" ncp || \
           sudo systemd-run --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/update" ncp
@@ -493,7 +496,8 @@ jobs:
           export FF_BINARY_PATH="$(which firefox)"
           sudo "$LXC" exec ncp -- /usr/local/bin/ncc config:system:set overwrite.cli.url --value "https://nextcloudpi.local"
           sudo "$LXC" exec ncp -- bash -c 'tail -f /var/log/ncp.log' |& awk '{ print "NCP::" $0 }' &
-          ../.venv/bin/python activation_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
+          python="$(dirname "$PWD")/.venv/bin/python"
+          "$python" activation_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
             echo "Activation test failed!"
             echo "Geckodriver logs:"
             tail -n 20 geckodriver.log >&2 || true
@@ -506,7 +510,7 @@ jobs:
             sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
             exit 1
           }
-          ../.venv/bin/python nextcloud_tests.py --skip-release-check --no-gui "nextcloudpi.local" 443 4443 || {
+          "$python" nextcloud_tests.py --skip-release-check --no-gui "nextcloudpi.local" 443 4443 || {
             echo "Nextcloud test failed!"
             echo "Geckodriver logs:"
             tail -n 20 geckodriver.log >&2 || true
@@ -519,7 +523,7 @@ jobs:
             sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
             exit 1
           }
-          USE_INCUS="$USE_INCUS"  ../.venv/bin/python system_tests.py --non-interactive --skip-update-test || {
+          USE_INCUS="$USE_INCUS"  "$python" system_tests.py --non-interactive --skip-update-test || {
             echo "System test failed!"
             echo "ncp.log: "
             sudo "$LXC" exec ncp -- bash -c "tail -n20 /var/log/ncp.log" || true
@@ -547,7 +551,7 @@ jobs:
           echo "Running update to ${VERSION}"
 
           current_nc_version="$(sudo "$LXC" exec ncp -- ncc status | grep "version:" | awk '{ print $3 }')"
-          latest_nc_version="33.0.3"
+          latest_nc_version="33.0.2"
 
           sudo "$LXC" exec ncp -- bash -c "DBG=x ncp-update ${UPDATE_ARGS[*]}"
           sudo "$LXC" exec ncp -- /usr/local/bin/ncc status
@@ -599,8 +603,9 @@ jobs:
           sudo "$LXC" exec ncp -- bash -c 'tail -f /var/log/ncp.log' |& awk '{ print "NCP::" $0 }' &
           export GECKODRIVER_PATH="$GECKODRIVER_PATH"
           export FF_BINARY_PATH="$(which firefox)"
+          python="$(dirname "$PWD")/.venv/bin/python"
 
-          USE_INCUS="$USE_INCUS" ../.venv/bin/python system_tests.py --skip-update-test --non-interactive || {
+          USE_INCUS="$USE_INCUS" "$python" system_tests.py --skip-update-test --non-interactive || {
             echo "System test failed!"
             echo "ncp.log: "
             sudo "$LXC" exec ncp -- bash -c "tail -n20 /var/log/ncp.log" || true
@@ -610,7 +615,7 @@ jobs:
             sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
             exit 1
           }
-          ../.venv/bin/python nextcloud_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
+          "$python" nextcloud_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
             echo "Nextcloud test failed!"
             echo "Geckodriver logs:"
             tail -n 20 geckodriver.log >&2 || true
@@ -695,8 +700,9 @@ jobs:
           sudo "$LXC" exec ncp -- bash -c 'tail -f /var/log/ncp.log' |& awk '{ print "NCP::" $0 }' &
           export GECKODRIVER_PATH="$GECKODRIVER_PATH"
           export FF_BINARY_PATH="$(which firefox)"
+          python="$(dirname "$PWD")/.venv/bin/python"
 
-          USE_INCUS="$USE_INCUS" ../.venv/bin/python system_tests.py --skip-update-test --non-interactive || {
+          USE_INCUS="$USE_INCUS" "$python" system_tests.py --skip-update-test --non-interactive || {
             echo "System test failed!"
             echo "ncp.log: "
             sudo "$LXC" exec ncp -- bash -c "tail -n20 /var/log/ncp.log" || true
@@ -706,7 +712,7 @@ jobs:
             sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
             exit 1
           }
-          ../.venv/bin/python nextcloud_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
+          "$python" nextcloud_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
             echo "Nextcloud test failed!"
             echo "Geckodriver logs:"
             tail -n 20 geckodriver.log >&2 || true
@@ -739,7 +745,7 @@ jobs:
         with:
           ref: "${{ env.VERSION }}"
       - name: Setup incus
-        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-20.04-arm64' }}
+        if: ${{ needs.determine-runner.outputs.runner_label != 'ubuntu-26.04-arm64' }}
         run: |
           sudo apt-get update
           sudo apt-get install -y incus qemu-system incus-tools
@@ -794,7 +800,7 @@ jobs:
           . ./build/buildlib.sh
           sudo "$LXC" delete -q -f ncp || true
           sudo "$LXC" image import -q "./${ARTIFACT_FILE?}" --alias "ncp/test" || true
-          LXC_ARGS=(-p default)
+          LXC_ARGS=(-p default -c security.nesting=true)
           [[ -z "$LXD_EXTRA_PROFILE" ]] || LXC_ARGS+=(-p "$LXD_EXTRA_PROFILE")
           systemd-run --user --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/test" ncp || \
           sudo systemd-run --scope -p "Delegate=yes" "$LXC" launch -q "${LXC_ARGS[@]}" "ncp/test" ncp
@@ -812,7 +818,9 @@ jobs:
           export FF_BINARY_PATH="$(which firefox)"
           sudo "$LXC" exec ncp -- bash -c 'tail -f /var/log/ncp.log' |& awk '{ print "NCP::" $0 }' &
           sudo "$LXC" exec ncp -- bash -c 'ncc config:system:get overwrite.cli.url'
-          ../.venv/bin/python activation_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
+          python="$(dirname "$PWD")/.venv/bin/python"
+
+          "$python" activation_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
             echo "Activation test failed!"
             echo "Geckodriver logs:"
             tail -n 20 geckodriver.log >&2 || true
@@ -826,7 +834,7 @@ jobs:
             exit 1
           }
           sudo "$LXC" exec ncp -- bash -c 'ncc config:system:get overwrite.cli.url'
-          ../.venv/bin/python nextcloud_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
+          "$python" nextcloud_tests.py --no-gui "nextcloudpi.local" 443 4443 || {
             echo "Nextcloud test failed!"
             echo "Geckodriver logs:"
             tail -n 20 geckodriver.log >&2 || true
@@ -837,9 +845,11 @@ jobs:
             echo "nextcloud log: "
             datadir="$(sudo "$LXC" exec ncp -- ncc config:system:get datadirectory)"
             sudo "$LXC" exec ncp -- cat "$datadir/nextcloud.log" || true
+            echo "opcache.interned_strings_buffer:"
+            sudo "$LXC" exec ncp -- bash -c 'grep -R opcache.interned_strings_buffer /etc/php/*/fpm/conf.d/'
             exit 1
           }
-          USE_INCUS="$USE_INCUS" ../.venv/bin/python system_tests.py --non-interactive || {
+          USE_INCUS="$USE_INCUS" "$python" system_tests.py --non-interactive || {
             echo "System test failed!"
             exit 1
           }

diff --git a/.github/workflows/build-sd-images.yml b/.github/workflows/build-sd-images.yml
@@ -122,7 +122,7 @@ jobs:
 
   test:
     needs: build
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04-arm64
     env:
       VERSION: "${{ inputs.git_ref }}"
       ARTIFACT_ID: ${{ needs.build.outputs.artifact_name }}
@@ -136,16 +136,16 @@ jobs:
       run:
         shell: bash
     steps:
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+#      - name: Set up QEMU
+#        uses: docker/setup-qemu-action@v3
       - name: Disable apparmor
         run: |
           sudo systemctl disable apparmor
       - name: Checkout code
         uses: actions/checkout@v3
         with:
           ref: "${{ env.VERSION }}"
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         if: "${{ inputs.test_image_url == '' }}"
         with:
           name: ${{ env.ARTIFACT_ID }}
@@ -161,6 +161,8 @@ jobs:
       - name: Prepare test
         run: |
           set -x
+
+          PHPVER="$(jq -r .php_version ./etc/ncp.cfg)"
           mv "output/${ARTIFACT_FILE?}" ncp.img
           sudo apt-get update
           sudo apt-get install -y systemd-container
@@ -172,29 +174,46 @@ jobs:
           mount_raspbian "ncp.img"
           sudo cat raspbian_root/etc/machine-id
           sudo systemd-id128 new | sudo tee ./raspbian_root/etc/machine-id
-          sudo wget -nv https://github.com/multiarch/qemu-user-static/releases/latest/download/qemu-aarch64-static -O raspbian_root/usr/bin/qemu-aarch64-static
-          sudo wget -nv https://github.com/multiarch/qemu-user-static/releases/latest/download/qemu-arm-static -O raspbian_root/usr/bin/qemu-arm-static
-          sudo chmod +x raspbian_root/usr/bin/qemu-{arm,aarch64}-static
+          # sudo wget -nv https://github.com/multiarch/qemu-user-static/releases/latest/download/qemu-aarch64-static -O raspbian_root/usr/bin/qemu-aarch64-static
+          # sudo wget -nv https://github.com/multiarch/qemu-user-static/releases/latest/download/qemu-arm-static -O raspbian_root/usr/bin/qemu-arm-static
+          # sudo chmod +x raspbian_root/usr/bin/qemu-{arm,aarch64}-static
           echo 'Mutex posixsem' | sudo tee -a raspbian_root/etc/apache2/mods-available/ssl.conf
           echo 'ignore-warnings ARM64-COW-BUG' | sudo tee -a raspbian_root/etc/redis/redis.conf
           sudo mkdir -p raspbian_root/etc/systemd/system/redis-server.service.d
           echo '[Service]' | sudo tee raspbian_root/etc/systemd/system/redis-server.service.d/ncp-ci.conf
           echo 'PrivateUsers=false' | sudo tee -a raspbian_root/etc/systemd/system/redis-server.service.d/ncp-ci.conf
 
-          sudo mkdir -p raspbian_root/etc/systemd/system/php8.3-fpm.service.d
-          echo '[Service]' | sudo tee raspbian_root/etc/systemd/system/php8.3-fpm.service.d/ncp-ci.conf
-          echo 'ExecStartPre=mkdir -p /var/run/php' | sudo tee -a raspbian_root/etc/systemd/system/php8.3-fpm.service.d/ncp-ci.conf
+          sudo mkdir -p raspbian_root/etc/systemd/system/php${PHPVER}-fpm.service.d
+          echo '[Service]' | sudo tee raspbian_root/etc/systemd/system/php${PHPVER}-fpm.service.d/ncp-ci.conf
+          echo 'ExecStartPre=mkdir -p /var/run/php' | sudo tee raspbian_root/etc/systemd/system/php${PHPVER}-fpm.service.d/ncp-ci.conf
+
+          # Disable ImportCredential and LoadCredential directives to workaround https://gitlab.com/qemu-project/qemu/-/work_items/1962
+          # see https://github.com/systemd/systemd/issues/31219#issuecomment-2846006948
+          for i in raspbian_root/usr/lib/systemd/system/*.service
+          do
+            [[ -f $i ]] || continue
+          	grep -q '^ImportCredential=' "$i" && {
+          	  sudo mkdir -p "${i/usr\/lib/etc}.d"
+          	  echo -e '[Service]\nImportCredential=' | sudo tee "${i/usr\/lib/etc}.d/unset-ImportCredential.conf"
+            }
+            grep -q '^LoadCredenital=' "$i" && {
+          	  sudo mkdir -p "${i/usr\/lib/etc}.d"
+          	  echo -e '[Service]\nLoadCredential=' | sudo tee "${i/usr\/lib/etc}.d/unset-LoadCredential.conf"
+            }
+          done
       - name: Test image
         id: test
         run: |
 
+          PHPVER="$(jq -r .php_version ./etc/ncp.cfg)"
+
           log_err() {
             rc="${1?}"
             msg="${2?}"
             echo -e "${LOG_DIAG} $msg" >&2
             return $rc
           }
-          sudo systemd-nspawn --boot -D ./raspbian_root/ -M ncp --hostname=nextcloudpi |& awk "{ print \"${LOG_GUEST} \" \$0 }" &
+          sudo systemd-nspawn --boot -D ./raspbian_root/ -M ncp --hostname=nextcloudpi --network-veth |& awk "{ print \"${LOG_GUEST} \" \$0 }" &
           sleep 60
 
           CONTAINER_CMD=(sudo systemd-run --machine=ncp -P --wait)
@@ -215,7 +234,7 @@ jobs:
             echo -e "${LOG_CICD} Could not reach container. Aborting..."
             "${CONTAINER_CMD[@]}" systemctl status --no-pager redis-server || :;
             "${CONTAINER_CMD[@]}" systemctl status --no-pager mariadb || :;
-            "${CONTAINER_CMD[@]}" systemctl status --no-pager php8.3-fpm || :;
+            "${CONTAINER_CMD[@]}" systemctl status --no-pager php${PHPVER}-fpm :;
             exit 1
           }
 
@@ -283,7 +302,8 @@ jobs:
           for attempt in {1..5}
           do
             echo -e "${LOG_CICD} == System Tests (attempt $attempt/5) =="
-            USE_SUDO=yes ./.venv/bin/python tests/system_tests.py --non-interactive |& awk "{ print \"${LOG_TEST} \" \$0 }"
+            # TODO: Reenable update test
+            USE_SUDO=yes ./.venv/bin/python tests/system_tests.py --skip-update-test --non-interactive |& awk "{ print \"${LOG_TEST} \" \$0 }"
             [[ ${PIPESTATUS[0]} -eq 0 ]] || {
               echo -e "${LOG_CICD} System test failed!"
               sleep 12

diff --git a/bin/ncp-restore b/bin/ncp-restore
@@ -153,6 +153,7 @@ sed -i "s|'datadirectory' =>.*|'datadirectory' => '${DATADIR}',|" "${NCDIR}"/con
 
 # Just in case we moved the opcache dir
 install_template "php/opcache.ini.sh" "/etc/php/${PHPVER}/mods-available/opcache.ini"
+systemctl reload "php${PHPVER}-fpm"
 
 # tmp upload dir
 mkdir -p "$DATADIR/tmp"

diff --git a/bin/ncp-update-nc.d/update-nc.sh b/bin/ncp-update-nc.d/update-nc.sh
@@ -258,6 +258,12 @@ elif ! is_more_recent_than "29.0.0" "${NCVER}" && is_more_recent_than "8.3.0" "$
 then
   /usr/local/bin/ncp-update-nc.d/upgrade-php-bookworm-8.3.sh
 
+  # Reload library.sh to reset PHPVER
+  source /usr/local/etc/library.sh
+elif ! is_more_recent_than "33.0.0" "${NCVER}" && is_more_recent_than "8.5.0" "${PHPVER}.0" && [[ "$DEBIAN_VERSION" -ge 13 ]]
+then
+  /usr/local/bin/ncp-update-nc.d/upgrade-php-trixie-8.5.sh
+
   # Reload library.sh to reset PHPVER
   source /usr/local/etc/library.sh
 fi