From b43f776d547f0ac28a7c7a29b650a367dfc07d7a Mon Sep 17 00:00:00 2001
From: Ketan Patel <k2patel@gmail.com>
Date: Sat, 3 Oct 2026 00:23:13 -0400
Subject: [PATCH] Leave one-time Docker Hub tag removal to the maintainer

---
 .gitea/workflows/build-push.yml |  9 +------
 build/retire-distroless-tag.py  | 43 ---------------------------------
 2 files changed, 1 insertion(+), 51 deletions(-)
 delete mode 100644 build/retire-distroless-tag.py

diff --git a/.gitea/workflows/build-push.yml b/.gitea/workflows/build-push.yml
index f33de8e..a2676c0 100644
--- a/.gitea/workflows/build-push.yml
+++ b/.gitea/workflows/build-push.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Install Docker CLI
         run: |
           apt-get update
-          apt-get install -y --no-install-recommends docker.io python3
+          apt-get install -y --no-install-recommends docker.io
           rm -rf /var/lib/apt/lists/*
 
       - name: Log in to Docker Hub
@@ -52,10 +52,3 @@ jobs:
           labels: |
             org.opencontainers.image.source=https://git.k2patel.in/k2patel/docker-rtorrent
             org.opencontainers.image.revision=${{ github.sha }}
-
-      - name: Retire the separate distroless tag
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-          DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
-          DOCKER_REPOSITORY: k2patel/rtorrent
-        run: python3 build/retire-distroless-tag.py
diff --git a/build/retire-distroless-tag.py b/build/retire-distroless-tag.py
deleted file mode 100644
index fbb1226..0000000
--- a/build/retire-distroless-tag.py
+++ /dev/null
@@ -1,43 +0,0 @@
-"""Remove only the retired distroless tag, after a successful latest publication."""
-import json
-import os
-from urllib.error import HTTPError
-from urllib.request import Request, urlopen
-
-repo = os.environ['DOCKER_REPOSITORY']
-if repo not in {'k2patel/rtorrent', 'k2patel/floodui'}:
-    raise SystemExit('Unexpected repository')
-base = 'https://hub.docker.com/v2/repositories/' + repo + '/tags/'
-
-def request(url, method='GET', data=None, token=None):
-    headers = {'Content-Type': 'application/json'}
-    if token:
-        headers['Authorization'] = 'Bearer ' + token
-    req = Request(url, method=method, headers=headers,
-                  data=json.dumps(data).encode() if data is not None else None)
-    with urlopen(req, timeout=30) as response:
-        body = response.read()
-        return json.loads(body) if body else None
-
-try:
-    latest = request(base + 'latest/')
-    try:
-        old = request(base + 'distroless/')
-    except HTTPError as error:
-        if error.code == 404:
-            print(repo + ': only latest remains; no legacy tag to retire')
-            raise SystemExit(0)
-        raise
-    if not latest.get('digest'):
-        raise SystemExit('Refusing cleanup without a published latest digest')
-    auth = request('https://hub.docker.com/v2/users/login', method='POST', data={
-        'username': os.environ['DOCKER_USERNAME'], 'password': os.environ['DOCKER_TOKEN']})
-    token = auth['token']
-    request(base + 'distroless/', method='DELETE', token=token)
-    # Verify the latest image remained unchanged.
-    if request(base + 'latest/')['digest'] != latest['digest']:
-        raise SystemExit('latest changed during tag retirement; inspect the registry')
-    print(repo + ': retired distroless tag; latest retained at ' + latest['digest'])
-except HTTPError as error:
-    # Never print an authentication response or token.
-    raise SystemExit(f'Docker Hub tag retirement failed: HTTP {error.code}. Token needs delete permission.')