Merge pull request 'Repin upstream source to jellyfin-ha-src main' (#15) from benvin/repin-ha-fixes into main

Reviewed-on: #15

Dockerfile.runtime

@@ -27,7 +27,7 @@ RUN apt-get update \
 # Versions are the newest each plugin publishes whose targetAbi <= the pinned
 # Jellyfin server version (12.0.0):
 #   LDAP Authentication 24.0.0.0  targetAbi 12.0.0.0
-#   SSO Authentication  4.0.0.4   targetAbi 10.11.0.0 (newest release; loads on 12.0)
+#   SSO Authentication  5.0.0.0   targetAbi 12.0.0.0
 # sha256 pins make each fetch reproducible.
 FROM --platform=linux/amd64 debian:bookworm-slim AS plugins
 
@@ -37,10 +37,12 @@ RUN apt-get update \
 
 ARG LDAP_URL=http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/jellyfin/files/plugin/ldap-authentication/ldap-authentication_24.0.0.0.zip
 ARG LDAP_SHA256=3be1f9d6a6ce9ea375e556dd30136d178a8dbe35cbe866d30d3451dc3ff7e804
-# LDAP is served through artifactapi remote. SSO is served through the artifactapi
-# github proxy, which the CI build network can reach (github is not directly reachable).
-ARG SSO_URL=http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/9p4/jellyfin-plugin-sso/releases/download/v4.0.0.4/sso-authentication_4.0.0.4.zip
-ARG SSO_SHA256=c09f16ba31059a434ddd7f811e4f9608d4b4c4514cc80a5bf1ca33bee61e1107
+# Both are served through artifactapi remotes over http: this stage's base image
+# trusts only public CAs and artifactapi presents an internal-CA certificate, so
+# https here fails to verify. The sha256 pins below supply the integrity guarantee.
+# SSO is the in-house unkin fork (valkey-backed OAuth state, shared across replicas).
+ARG SSO_URL=http://artifactapi.k8s.syd1.au.unkin.net/api/v2/remotes/jellyfin-plugins/files/unkin/jellyfin-plugin-sso/5.0.0.0/sso-authentication_5.0.0.0.zip
+ARG SSO_SHA256=7e5f09cc4c81dce35edca650d74ed0680f425ca65c6221bb75456de9b8557e14
 
 WORKDIR /plugins
 RUN set -eu; \
@@ -50,8 +52,8 @@ RUN set -eu; \
     unzip -oq ldap.zip -d "LDAP Authentication_24.0.0.0"; \
     curl -fsSL "$SSO_URL" -o sso.zip; \
     echo "$SSO_SHA256  sso.zip" | sha256sum -c -; \
-    mkdir -p "SSO Authentication_4.0.0.4"; \
-    unzip -oq sso.zip -d "SSO Authentication_4.0.0.4"; \
+    mkdir -p "SSO Authentication_5.0.0.0"; \
+    unzip -oq sso.zip -d "SSO Authentication_5.0.0.0"; \
     rm -f ldap.zip sso.zip
 
 # ── Runtime stage ─────────────────────────────────────────────────────────────

UPSTREAM_REF

@@ -1 +1 @@
-ec581b5e5f156edb862d01f4bd07d9ba51903ed6
+6691b785c30715ec4561b00b7bd0fd112478d3e3