[carlalexander]

Vendor-source replacement — ready for Carl's review

Remediates CVE-2026-109618 / CVE-2026-109619 using complete vendor-maintained sources, not a Ymir patch set. Commit d90b7fd replaces the rejected 206aa1b architecture on the same branch.

No merge, release/tag, image/layer publishing, platform catalog update, or production rollout is authorized.

Implementation

• PHP 7.4/8.0/8.1: immutable, checksum-verified complete PHP-team snapshots; native source generation with build-only Bison/re2c. Preserve the real 7.4.34-dev banner.
• PHP 7.2/7.3: pinned, authenticated Sury source packages, prepared by native dpkg-source with all 159/139 vendor patches, unchanged. Debian is build-only source preparation; compilation and final runtime remain AL2023.
• Remove runtime/patches/ entirely. No selected prerequisites, vendor C/header/script edits, fake tooling, or OS/ABI migration.
• Restore Lambda session/include/PEAR paths through ordinary configuration and build layout. Customer project INI overrides remain effective. The vendor's unchanged phpize uses its pathname fallback against native AL2023 helper files; future non-path Debian-tool dependencies require reevaluation, not stubs.
• Pin and checksum the upstream PEAR bootstrap before placement/execution; normal vendor installation remains unchanged.
• Retain bounded upload, multipart-limit, upload-progress, warm-worker isolation, FPM/CLI OOM regressions; add native default-session persistence. Failed/empty INI reads fail verification.
• PR CI builds and verifies all 9 PHP × 2 architecture images without publishing; forks fail explicitly rather than reporting skipped-green verification.

Source identities, provenance limitations and compatibility details: runtime/sources/README.md.

Verification

• All five final arm64 images built and passed runtime/test-image.sh, including modules, extension files, TLS, startup, size and all seven legacy regression groups (105–111MB).
• Source provenance/integrity checks and missing-download, incorrect-checksum, truncated-series negative controls. All three PEAR checksum-negative controls prevent installer placement; offline installation proofs also pass.
• Scoped CS-Fixer/Rector fixes/checks, PHPStan, PHP 7.2 fixture syntax, Bash syntax, warning-level ShellCheck and whitespace checks. Local unit suite: 400 tests / 1,264 assertions.
• Fresh independent whole-PR review and focused rereview. Material finding: newly activated floating PEAR bootstrap; fixed, negatively tested, and all three affected full images rebuilt/retested. No outstanding material findings. Unrelated user changes preserved.
• All 38 checks green on d90b7fd: 18-image matrix, PR quality/unit matrix, push quality/unit matrix. Every image built and verified; all publication steps were skipped. One isolated PHP 8.4 x86_64 rerun cleared a stale pending check after its original verification passed; no code changes. Historical green checks on 206aa1b are not substituted.

Compatibility and release boundary

Vendor mitigations immediately terminate PHP on OOM (exit 1, bypassing shutdown callbacks/destructors), disable session upload-progress tracking and change multipart handling. Do not add automatic application retries that could repeat side effects. These remain EOL versions; focused regressions are not comprehensive exploit/CVE coverage or a support guarantee.

No full amd64 image was built locally; both architectures and all supported PHP selectors are CI gates. Exported ZIP artifacts, live Lambda cold/warm invocations, release permissions/catalog parity and customer rollout require later, explicit authorization. Existing deployments are not patched retroactively; zip deployments need redeployment, and container deployments need base-image rebuild/redeployment, including pinned digests. Preserve recovery artifacts, but rollback to unpatched runtimes restores exposure.

Refs YMIR-127.