codeling · Nov 6, 2026 · Nov 6, 2026 · Nov 6, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -32,6 +32,8 @@ jobs:
         run: php tests/lint/check-joomla-checksums.php
       - name: Language files
         run: php tests/lint/check-language.php bfstop.xml PLG_SYSTEM_BFSTOP
+      - name: Plugin, package and CHANGELOG have the same version
+        run: php tests/lint/check-versions.php
       - name: Composer manifest is valid
         run: composer validate --strict
       - name: Vendored GeoIP reader is the version locked in composer.lock
@@ -73,29 +75,26 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.read.outputs.matrix }}
+      upgrade: ${{ steps.read.outputs.upgrade }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - id: read
         run: |
           echo "matrix=$(jq -c '{include: .include}' tests/ci/matrix.json)" >> "$GITHUB_OUTPUT"
+          # the update from the previous release: the Joomla 5 entries with
+          # MySQL/MariaDB (1.5 ran on neither Joomla 6 nor PostgreSQL)
+          echo "upgrade=$(jq -c '{include: [.include[] | select((.joomla | startswith("5.")) and (.db | startswith("postgres") | not))]}' tests/ci/matrix.json)" >> "$GITHUB_OUTPUT"
 
-  integration:
-    name: Joomla ${{ matrix.joomla }}, ${{ matrix.db }}, PHP ${{ matrix.php }}
-    needs: matrix
+  # what users install: the package with plugin and component, built once by
+  # package/build.sh; the jobs below install exactly this, and it is kept as
+  # an artifact of the run (a snapshot to try out)
+  package:
+    name: Package
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.matrix.outputs.matrix) }}
-    env:
-      JOOMLA_VERSION: ${{ matrix.joomla }}
-      DB_HOST: 127.0.0.1
-      DB_NAME: joomla
-      DB_PASS: bfstop-test
+    outputs:
+      com-ref: ${{ steps.com.outputs.ref }}
+      version: ${{ steps.build.outputs.version }}
     steps:
-      - name: Set paths
-        run: |
-          echo "JOOMLA_ROOT=$RUNNER_TEMP/joomla" >> "$GITHUB_ENV"
-          echo "COM_BFSTOP_ROOT=$RUNNER_TEMP/com_bfstop" >> "$GITHUB_ENV"
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # use the com_bfstop branch of the same name if there is one and it
@@ -123,8 +122,53 @@ jobs:
           repository: codeling/com_bfstop
           ref: ${{ steps.com.outputs.ref }}
           path: com_bfstop
+      - name: Move com_bfstop checkout out of the plugin's
+        run: mv com_bfstop "$RUNNER_TEMP/com_bfstop"
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
+        with:
+          php-version: '8.4'
+          coverage: none
+      - name: Build plugin, component and package
+        id: build
+        run: |
+          package/build.sh "$RUNNER_TEMP/com_bfstop" build
+          echo "version=$(php tests/lint/check-versions.php --print-version)" >> "$GITHUB_OUTPUT"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: bfstop-${{ steps.build.outputs.version }}
+          path: build/
+          if-no-files-found: error
+
+  integration:
+    name: Joomla ${{ matrix.joomla }}, ${{ matrix.db }}, PHP ${{ matrix.php }}
+    needs: [matrix, package]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.matrix.outputs.matrix) }}
+    env:
+      JOOMLA_VERSION: ${{ matrix.joomla }}
+      DB_HOST: 127.0.0.1
+      DB_NAME: joomla
+      DB_PASS: bfstop-test
+    steps:
+      - name: Set paths
+        run: |
+          echo "JOOMLA_ROOT=$RUNNER_TEMP/joomla" >> "$GITHUB_ENV"
+          echo "COM_BFSTOP_ROOT=$RUNNER_TEMP/com_bfstop" >> "$GITHUB_ENV"
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # the component's classes are loaded from its checkout by the tests
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: codeling/com_bfstop
+          ref: ${{ needs.package.outputs.com-ref }}
+          path: com_bfstop
       - name: Move com_bfstop checkout out of the plugin's
         run: mv com_bfstop "$COM_BFSTOP_ROOT"
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: bfstop-${{ needs.package.outputs.version }}
+          path: ${{ runner.temp }}/build
 
       - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
@@ -138,7 +182,9 @@ jobs:
           DB_IMAGE: ${{ matrix.db }}
         run: tests/ci/start-database.sh
 
-      - name: Install Joomla and bfstop
+      - name: Install Joomla and the bfstop package
+        env:
+          BFSTOP_PACKAGE: ${{ runner.temp }}/build/pkg_bfstop-${{ needs.package.outputs.version }}.zip
         run: tests/ci/install-joomla.sh
 
       - name: Tests
@@ -147,3 +193,52 @@ jobs:
       - name: Plugin log
         if: failure()
         run: cat "$JOOMLA_ROOT"/administrator/logs/*.php || true
+
+  # a site with the previous release (tests/ci/previous-release.sha256) and
+  # its data, updated with the package: tests/ci/upgrade-test.sh
+  upgrade:
+    name: Update from the previous release (Joomla ${{ matrix.joomla }}, ${{ matrix.db }})
+    needs: [matrix, package]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.matrix.outputs.upgrade) }}
+    env:
+      JOOMLA_VERSION: ${{ matrix.joomla }}
+      DB_HOST: 127.0.0.1
+      DB_NAME: joomla
+      DB_PASS: bfstop-test
+    steps:
+      - name: Set paths
+        run: |
+          echo "JOOMLA_ROOT=$RUNNER_TEMP/joomla" >> "$GITHUB_ENV"
+          echo "COM_BFSTOP_ROOT=$RUNNER_TEMP/com_bfstop" >> "$GITHUB_ENV"
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: codeling/com_bfstop
+          ref: ${{ needs.package.outputs.com-ref }}
+          path: com_bfstop
+      - name: Move com_bfstop checkout out of the plugin's
+        run: mv com_bfstop "$COM_BFSTOP_ROOT"
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: bfstop-${{ needs.package.outputs.version }}
+          path: ${{ runner.temp }}/build
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
+        with:
+          php-version: ${{ matrix.php }}
+          extensions: mysqli, pdo_mysql, zip, mbstring, intl, gd
+          tools: phpunit:11
+          coverage: none
+      - name: Start database (${{ matrix.db }})
+        env:
+          DB_IMAGE: ${{ matrix.db }}
+        run: tests/ci/start-database.sh
+      - name: Update from the previous release
+        env:
+          BFSTOP_PACKAGE: ${{ runner.temp }}/build/pkg_bfstop-${{ needs.package.outputs.version }}.zip
+        run: tests/ci/upgrade-test.sh
+      - name: Plugin log
+        if: failure()
+        run: cat "$JOOMLA_ROOT"/administrator/logs/*.php || true
diff --git a/.gitignore b/.gitignore
@@ -1,2 +1,3 @@
 /vendor/
 *.zip
+/build/
diff --git a/CHANGELOG b/CHANGELOG
@@ -1,4 +1,4 @@
-2.0.0 (2026-08-24)
+2.0.0 (unreleased)
   - Migrate to Joomla 5/6: PSR-4 namespaced classes (Codeling\Plugin\System\Bfstop),
     service provider, SubscriberInterface event handling
   - Drop Joomla 3/4 compatibility (requires Joomla 5 or 6 and PHP 8.1); the

diff --git a/README b/README
@@ -9,6 +9,9 @@ https://github.com/codeling/bfstop/wiki
 
 For information on what changed in recent versions, see the CHANGELOG file
 
+The package users install (plugin and component together) is built from this
+repository and com_bfstop by package/build.sh, see package/README.md.
+
 If you find any issues, please report them at
 https://github.com/codeling/bfstop/issues
 

diff --git a/deploy.sh b/deploy.sh
@@ -15,10 +15,11 @@ langfiles="language"
 docs="CHANGELOG LICENSE.txt README"
 plgtype="system"
 langs="de-DE en-GB"
-version=2.0.0
+version="$(sed -n 's:.*<version>\(.*\)</version>.*:\1:p' "$(dirname "$0")/$extname.xml" | head -n 1)"
 
 if [ "$1" == "zip" ]
 then
+	rm -f $extname-$version.zip
 	zip -r $extname-$version.zip $srcfiles $docs $langfiles
 	exit
 fi

diff --git a/package/README.md b/package/README.md
@@ -0,0 +1,35 @@
+# The BFStop package
+
+What users install: one Joomla! package (`pkg_bfstop-<version>.zip`) with the
+plugin (this repository) and the component
+([codeling/com_bfstop](https://github.com/codeling/com_bfstop)) in it. It used
+to have a repository of its own, codeling/pkg_bfstop, with the extension zips
+committed into it by hand.
+
+- `pkg_bfstop.xml`: the package manifest.
+- `script.php`: the package's installer script; refuses Joomla! < 5.0 and
+  PHP < 8.1 before anything is installed (sites on Joomla! 4 stay with 1.5).
+- `update.xml`: the update server's collection file
+  (`https://bfstop.bfroehler.info/update.xml`, which installed sites ask).
+- `build.sh`: builds the zips.
+
+## Building
+
+    package/build.sh <com_bfstop checkout> [<output directory>]
+
+zips the plugin and the component with their own `deploy.sh`, from copies of
+the checkouts, and puts them and the package into `build/` (or the given
+directory), with a `SHA256SUMS-<version>` file. Nothing is committed: CI builds
+the package for every push and pull request and keeps it as an artifact of the
+run ("bfstop-<version>"), installs it in all its Joomla! sites and updates a
+site of the previous release with it (see `tests/README.md`).
+
+## Versions
+
+Plugin, component and package are released together, with one version number.
+It is written in `bfstop.xml` of both repositories, in `pkg_bfstop.xml` and
+`update.xml`, and in the first entry of `CHANGELOG`, which says `(unreleased)`
+until the release, then the date. `tests/lint/check-versions.php` checks that
+they agree (CI runs it, and `build.sh` refuses to build otherwise);
+`--release=<tag>` additionally checks them against the tag and requires the
+CHANGELOG date. The `deploy.sh` scripts take the version from their manifest.
diff --git a/package/build.sh b/package/build.sh
@@ -0,0 +1,53 @@
+#!/bin/bash
+#
+# Builds the release zips of BFStop: the plugin (this repository), the
+# component (a checkout of codeling/com_bfstop) and the package containing
+# both, which is what users install. The checkouts are not changed; the zips
+# go to the output directory (default: build/ in this repository):
+#
+#   bfstop-<version>.zip, com_bfstop-<version>.zip, pkg_bfstop-<version>.zip
+#
+# All three must have the same version (see tests/lint/check-versions.php),
+# so a package can't contain the extensions of another release.
+#
+# Usage: package/build.sh <com_bfstop checkout> [<output directory>]
+set -euo pipefail
+
+plugin_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+component_root="$(cd "${1:?usage: package/build.sh <com_bfstop checkout> [<output directory>]}" && pwd)"
+out="${2:-$plugin_root/build}"
+mkdir -p "$out"
+out="$(cd "$out" && pwd)"
+
+COM_BFSTOP_ROOT="$component_root" php "$plugin_root/tests/lint/check-versions.php"
+version="$(php "$plugin_root/tests/lint/check-versions.php" --print-version)"
+
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+
+# each extension is zipped by its own deploy.sh, in a copy of its checkout
+# (deploy.sh writes the zip next to its sources)
+build_extension() {
+	local src="$1" zip="$2"
+	mkdir -p "$work/src"
+	rm -rf "$work/src/ext"
+	cp -a "$src" "$work/src/ext"
+	rm -f "$work/src/ext"/*.zip
+	(cd "$work/src/ext" && ./deploy.sh zip > /dev/null)
+	mv "$work/src/ext/$zip" "$out/$zip"
+	php "$plugin_root/tests/lint/check-zip.php" "$out/$zip" bfstop.xml > /dev/null
+}
+build_extension "$plugin_root" "bfstop-$version.zip"
+build_extension "$component_root" "com_bfstop-$version.zip"
+
+mkdir -p "$work/pkg/packages"
+cp "$plugin_root/package/pkg_bfstop.xml" "$plugin_root/package/script.php" "$work/pkg/"
+cp "$out/bfstop-$version.zip" "$work/pkg/packages/plg_sys_bfstop.zip"
+cp "$out/com_bfstop-$version.zip" "$work/pkg/packages/com_bfstop.zip"
+rm -f "$out/pkg_bfstop-$version.zip"
+(cd "$work/pkg" && zip -qr "$out/pkg_bfstop-$version.zip" pkg_bfstop.xml script.php packages)
+php "$plugin_root/tests/lint/check-zip.php" "$out/pkg_bfstop-$version.zip" pkg_bfstop.xml > /dev/null
+
+(cd "$out" && sha256sum "bfstop-$version.zip" "com_bfstop-$version.zip" "pkg_bfstop-$version.zip" > "SHA256SUMS-$version")
+echo "Built in $out:"
+cat "$out/SHA256SUMS-$version"
diff --git a/package/pkg_bfstop.xml b/package/pkg_bfstop.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<extension type="package" version="2.5" method="upgrade">
+	<name>Brute Force Stop Package</name>
+	<author>Bernhard Froehler</author>
+	<creationDate>May 2013</creationDate>
+	<copyright>Copyright (C) by Bernhard Froehler</copyright>
+	<license>GNU/GPLv3 http://www.gnu.org/licenses/gpl-3.0.html</license>
+	<packagename>bfstop</packagename>
+	<version>2.0.0</version>
+	<url>https://github.com/codeling/bfstop</url>
+	<packager>Bernhard Froehler</packager>
+	<packagerurl>https://github.com/codeling/bfstop</packagerurl>
+	<description>Brute Force Stop Package successfully installed!&lt;br&gt;&lt;br&gt;&lt;div&gt;This package contains all extensions constituting the Brute Force Stop (bfstop) functionality. It provides means to avert Brute-Force-Attacks on your Joomla-Installation.&lt;/div&gt;&lt;br&gt;&lt;div&gt;For a list of all currently blocked IP addresses (and the chance to unblock them), go to "Components" - "Brute Force Stop Administration"&lt;br&gt;&lt;br&gt;If you have any questions or problems, please visit the &lt;a href='https://github.com/codeling/bfstop'&gt;project site on github&lt;/a&gt;.&lt;br&gt;In case you want to uninstall Brute Force Stop, please use the Package to uninstall all extensions at once!&lt;br&gt;Brute Force Stop is published under the &lt;a target='_blank' title='GNU General Public License' href='http://www.gnu.org/copyleft/gpl.html'&gt;GNU General Public License&lt;/a&gt;.&lt;/div&gt;</description>
+	<scriptfile>script.php</scriptfile>
+	<files folder="packages">
+		<file type="component" id="com_bfstop">com_bfstop.zip</file>
+		<file type="plugin" id="bfstop" group="system">plg_sys_bfstop.zip</file>
+	</files>
+	<updateservers>
+		<server type="collection" name="BFStop Package Update Server">https://bfstop.bfroehler.info/update.xml</server>
+	</updateservers>
+</extension>
diff --git a/package/script.php b/package/script.php
@@ -0,0 +1,23 @@
+<?php
+/*
+ * @package BFStop Package (pkg_bfstop) for Joomla!
+ * @author Bernhard Froehler
+ * @copyright (C) Bernhard Froehler
+ * @license GNU/GPLv3 http://www.gnu.org/licenses/gpl-3.0.html
+**/
+defined('_JEXEC') or die;
+
+use Joomla\CMS\Installer\InstallerScript;
+
+/**
+ * Runs before the plugin and the component are installed: InstallerScript's
+ * preflight() refuses Joomla and PHP versions BFStop 2 doesn't run on (a site
+ * on Joomla 4 has to stay with BFStop 1.5), before anything is changed.
+ * Plugin and component check the same themselves when they are installed
+ * on their own.
+ */
+class pkg_bfstopInstallerScript extends InstallerScript
+{
+	protected $minimumJoomla = '5.0.0';
+	protected $minimumPhp = '8.1.0';
+}
diff --git a/package/update.xml b/package/update.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<extensionset name="Brute Force Stop Package" description="Brute Force Stop Package">
+    <extension name="Brute Force Stop Package" element="pkg_bfstop" type="package" version="2.0.0" detailsurl="https://bfstop.bfroehler.info/update-pkg.xml" />
+</extensionset>