Skip to content

fix: consume vendor-maintained legacy PHP security backports #56

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
carlalexander wants to merge 2 commits into from
Closed

fix: consume vendor-maintained legacy PHP security backports #56

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
206aa1b
fix: backport October security fixes to legacy PHP runtimes
carlalexander Oct 22, 2026
d90b7fd
fix: build legacy runtimes from complete vendor sources
carlalexander Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 33 additions & 13 deletions .github/workflows/build-publish-dev-images.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
name: Build and publish development images
name: Build and verify development images

on:
push:
Expand All @@ -11,6 +11,14 @@ on:
- 'src/**'
- 'templates/**'
- '.github/workflows/build-publish-dev-images.yml'
pull_request:
paths:
- 'composer.json'
- 'composer.lock'
- 'runtime/**'
- 'src/**'
- 'templates/**'
- '.github/workflows/build-publish-dev-images.yml'

permissions:
id-token: write
Expand All @@ -21,7 +29,7 @@ env:

jobs:
publish:
name: Build and publish PHP ${{ matrix.php }} (${{ matrix.arch }})
name: Build and verify PHP ${{ matrix.php }} (${{ matrix.arch }})
runs-on: ubuntu-latest
strategy:
fail-fast: false
Expand All @@ -30,6 +38,12 @@ jobs:
arch: [x86_64, arm64]

steps:
- name: Require a trusted branch for image verification
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
run: |
echo "::error::Image verification requires a trusted branch in this repository; fork pull requests are not verified."
exit 1

- name: Set up QEMU to run ARM images
uses: docker/setup-qemu-action@v4

Expand All @@ -40,6 +54,7 @@ jobs:
uses: actions/checkout@v5

- name: Login to Docker Hub
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
uses: docker/login-action@v4
with:
username: ${{ secrets.DOCKER_USERNAME }}
Expand All @@ -48,17 +63,19 @@ jobs:
- name: Determine Repository and Platform
id: meta
run: |
VERSION_CLEAN=$(echo ${{ matrix.php }} | sed 's/\.//g')
if [ "${{ matrix.arch }}" = "x86_64" ]; then
echo "repo=ymirapp/php-runtime-dev" >> $GITHUB_OUTPUT
echo "platform=linux/amd64" >> $GITHUB_OUTPUT
else
echo "repo=ymirapp/arm-php-runtime-dev" >> $GITHUB_OUTPUT
echo "platform=linux/arm64" >> $GITHUB_OUTPUT
fi
echo "tag=php-$VERSION_CLEAN" >> $GITHUB_OUTPUT
echo "compat_tag=php-${{ matrix.php }}" >> $GITHUB_OUTPUT
echo "dir=php-$VERSION_CLEAN" >> $GITHUB_OUTPUT
VERSION_CLEAN=$(echo '${{ matrix.php }}' | sed 's/\.//g')
{
if [ "${{ matrix.arch }}" = "x86_64" ]; then
echo "repo=ymirapp/php-runtime-dev"
echo "platform=linux/amd64"
else
echo "repo=ymirapp/arm-php-runtime-dev"
echo "platform=linux/arm64"
fi
echo "tag=php-$VERSION_CLEAN"
echo "compat_tag=php-${{ matrix.php }}"
echo "dir=php-$VERSION_CLEAN"
} >> "$GITHUB_OUTPUT"

- name: Build and Load Image
uses: depot/build-push-action@v1
Expand All @@ -68,6 +85,7 @@ jobs:
file: runtime/${{ steps.meta.outputs.dir }}/Dockerfile
platforms: ${{ steps.meta.outputs.platform }}
load: true
push: false
tags: |
${{ steps.meta.outputs.repo }}:${{ steps.meta.outputs.tag }}
${{ steps.meta.outputs.repo }}:${{ steps.meta.outputs.compat_tag }}
Expand All @@ -79,6 +97,7 @@ jobs:
run: ./runtime/test-image.sh ${{ steps.meta.outputs.repo }}:${{ steps.meta.outputs.tag }} ${{ steps.meta.outputs.platform }}

- name: Build and Push Image
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
uses: depot/build-push-action@v1
with:
project: ${{ secrets.DEPOT_PROJECT_ID }}
Expand All @@ -94,6 +113,7 @@ jobs:
DOCKER_PLATFORM=${{ steps.meta.outputs.platform }}

- name: Verify Tag Aliases
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
run: |
CANONICAL_IMAGE="${{ steps.meta.outputs.repo }}:${{ steps.meta.outputs.tag }}"
COMPAT_IMAGE="${{ steps.meta.outputs.repo }}:${{ steps.meta.outputs.compat_tag }}"
Expand Down
21 changes: 19 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,23 @@ on:
push:
paths:
- '.github/workflows/ci.yml'
- 'runtime/**'
- 'src/**'
- 'tests/**'
- 'composer.json'
- 'composer.lock'
pull_request:
paths:
- '.github/workflows/ci.yml'
- '.github/workflows/build-publish-dev-images.yml'
- 'runtime/**'
- 'src/**'
- 'tests/**'
- 'composer.json'
- 'composer.lock'

permissions:
contents: read

jobs:
code-quality:
Expand All @@ -23,11 +36,15 @@ jobs:
- name: Install dependencies
run: composer install --no-ansi --no-interaction --no-scripts --no-security-blocking --no-suggest --prefer-dist
- name: Run PHP CS Fixer
run: composer php-cs-fixer
run: |
composer php-cs-fixer
composer php-cs-fixer -- --path-mode=override runtime/security
- name: Run PHPStan
run: composer phpstan
- name: Run Rector
run: composer rector
run: |
composer rector
composer rector -- process runtime/security
php-tests:
name: Run tests on ${{ matrix.php-versions }}
runs-on: ubuntu-latest
Expand Down
34 changes: 29 additions & 5 deletions runtime/php-72/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,24 @@
ARG CPU_ARCHITECTURE
ARG DOCKER_PLATFORM

# Sury PHP 7.2 source package
# Vendor-maintained security backports. dpkg-source applies the complete vendor patch series.
# Sury's pool does not guarantee retention; if a pinned file disappears, review a pinned vendor replacement and never loosen the digest guards.
FROM --platform=${DOCKER_PLATFORM} debian:trixie-slim@sha256:62bd423aeee912639ca8ee681c2b762cb3e25137e0a92b20be455898a9f034ad as php-source
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl dpkg-dev xz-utils
COPY <<EOF /tmp/sury/SHA256SUMS
a06c4b5deeeed7ac81be430c95b74a9f456d21e19ca8d1aae8a2f319d4b1dcfe php7.2_7.2.34-66+0~20261021.122+debian13~1.gbpe0bcd4.dsc
409e11bc6a2c18707dfc44bc61c820ddfd81e17481470f3405ee7822d8379903 php7.2_7.2.34.orig.tar.xz
4a5a49d808a4d0cd4d32709fbf471519e8c04d81fbc8f237baae073a87454ee9 php7.2_7.2.34-66+0~20261021.122+debian13~1.gbpe0bcd4.debian.tar.xz
EOF
WORKDIR /tmp/sury
RUN set -e; for file in $(awk '{print $2}' SHA256SUMS); do \
curl --location --silent --show-error --fail -o "$file" "https://packages.sury.org/php/pool/main/p/php7.2/$(echo "$file" | sed 's/+/%2B/g')"; \
done; \
sha256sum --check --strict SHA256SUMS && \
dpkg-source --require-strong-checksums -x php7.2_7.2.34-66+0~20261021.122+debian13~1.gbpe0bcd4.dsc /tmp/php && \
awk 'NF && $1 !~ /^#/ {print $1}' /tmp/php/debian/patches/series | cmp - /tmp/php/.pc/applied-patches

FROM --platform=${DOCKER_PLATFORM} public.ecr.aws/lambda/provided:al2023-${CPU_ARCHITECTURE} as build-environment

ENV BUILD_DIR="/tmp/build" INSTALL_DIR="/opt/ymir"
Expand Down Expand Up @@ -39,11 +57,11 @@ RUN ./config --prefix=${INSTALL_DIR}/openssl11 --openssldir=${INSTALL_DIR}/opens
&& cp ${INSTALL_DIR}/openssl11/lib/libssl.so.1.1 ${INSTALL_DIR}/lib/ && cp ${INSTALL_DIR}/openssl11/lib/libcrypto.so.1.1 ${INSTALL_DIR}/lib/

# PHP 7.2.34
ENV VERSION_PHP=7.2.34
RUN mkdir -p ${BUILD_DIR}/php
COPY --from=php-source /tmp/php ${BUILD_DIR}/php
WORKDIR ${BUILD_DIR}/php
RUN curl --location --silent --show-error --fail https://www.php.net/distributions/php-${VERSION_PHP}.tar.gz | tar xzC . --strip-components=1
RUN ./buildconf --force && \
# Vendor build preparation from debian/rules and build/build2.mk.
RUN mv ext/ext_skel ext/ext_skel.in && \
make -f build/build.mk generated_lists && make -B -f build/build2.mk aclocal.m4 && ./buildconf --force && \
export PKG_CONFIG_PATH="${INSTALL_DIR}/openssl11/lib/pkgconfig:$PKG_CONFIG_PATH" && \
CFLAGS="-fstack-protector-strong -fpic -fpie -Os -I${INSTALL_DIR}/include -I${INSTALL_DIR}/openssl11/include -I/usr/include -ffunction-sections -fdata-sections" \
CPPFLAGS="-fstack-protector-strong -fpic -fpie -Os -I${INSTALL_DIR}/include -I${INSTALL_DIR}/openssl11/include -I/usr/include -ffunction-sections -fdata-sections" \
Expand All @@ -55,9 +73,14 @@ RUN ./buildconf --force && \
--enable-exif --enable-ftp --with-gettext --enable-mbstring --enable-opcache=shared --with-pdo-pgsql=shared --with-pgsql=shared --with-pdo-mysql=shared,mysqlnd --with-mysqli --enable-pcntl \
--enable-zip --enable-bcmath --enable-intl=shared --enable-soap --with-xsl --with-pear
RUN make -j $(nproc)
RUN make install PEAR_INSTALLER_URL='https://github.com/pear/pearweb_phars/raw/master/install-pear-nozlib.phar'
RUN make install PEAR_INSTALLDIR=${INSTALL_DIR}/lib/php PEAR_INSTALLER_URL='https://github.com/pear/pearweb_phars/raw/master/install-pear-nozlib.phar'
RUN cp php.ini-production ${INSTALL_DIR}/etc/php/php.ini

# Vendor phpize copies Debian's shtool, libtool aux and aclocal paths. Its dpkg probe only picks the aux
# directory name and falls back to libtool/config here; reevaluate any other dpkg use rather than stubbing it.
RUN cp ${BUILD_DIR}/php/build/shtool /usr/bin/shtool && mkdir -p ${INSTALL_DIR}/share /usr/share/libtool && \
ln -s /usr/share/aclocal ${INSTALL_DIR}/share/aclocal && ln -s /usr/share/libtool/build-aux /usr/share/libtool/config

# PECL
RUN set -xe; cd ${BUILD_DIR}; \
for ext in apcu igbinary zstd; do \
Expand Down Expand Up @@ -98,6 +121,7 @@ RUN ${INSTALL_DIR}/bin/php /tmp/copy-dependencies.php /tmp/layer/ymir/bin /tmp/l
PHP_EXT_DIR=$(${INSTALL_DIR}/bin/php-config --extension-dir) && ${INSTALL_DIR}/bin/php /tmp/copy-dependencies.php /tmp/layer/lib/php/extensions/$(basename ${PHP_EXT_DIR}) /tmp/layer/lib
RUN find /tmp/layer/ymir/bin -type f -exec strip --strip-all {} + || true && find /tmp/layer/lib -type f -name "*.so*" -exec strip --strip-unneeded {} + || true && find /tmp/layer/lib -type f -name "*.a" -delete && find /tmp/layer/lib -type f -name "*.la" -delete
COPY runtime/shared/php.ini /tmp/layer/ymir/etc/php/php.ini
COPY runtime/shared/sury-defaults.ini /tmp/layer/ymir/etc/php/conf.d/sury-defaults.ini
COPY runtime/shared/99-openssl-ca-legacy.ini /tmp/layer/ymir/etc/php/conf.d/99-openssl-ca-legacy.ini
COPY runtime/shared/php-fpm.conf /tmp/layer/ymir/etc/php-fpm.d/php-fpm.conf
RUN sed -i '/extension=msgpack.so/d' /tmp/layer/ymir/etc/php/php.ini && \
Expand Down
34 changes: 29 additions & 5 deletions runtime/php-73/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,25 @@
ARG CPU_ARCHITECTURE
ARG DOCKER_PLATFORM

# Sury PHP 7.3 source package
# Vendor-maintained security backports. dpkg-source applies the complete vendor patch series.
# Sury's pool does not guarantee retention; if a pinned file disappears, review a pinned vendor replacement and never loosen the digest guards.
FROM --platform=${DOCKER_PLATFORM} debian:trixie-slim@sha256:62bd423aeee912639ca8ee681c2b762cb3e25137e0a92b20be455898a9f034ad as php-source
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl dpkg-dev xz-utils
COPY <<EOF /tmp/sury/SHA256SUMS
c22d4541d5264ec53918b7d9b70b74121cdfeef1c6974b9fe4e9ad552b310575 php7.3_7.3.33-35+0~20261021.144+debian13~1.gbpecf76f.dsc
166eaccde933381da9516a2b70ad0f447d7cec4b603d07b9a916032b215b90cc php7.3_7.3.33.orig.tar.xz
3d15cc09b4c35343ad15fd80b681f126a8efec8efde757e21c04fd54a56ba8d4 php7.3_7.3.33.orig.tar.xz.asc
0c65625f2cbd18749891f7a0bba653c7eabe5864155036cac9407508560eb983 php7.3_7.3.33-35+0~20261021.144+debian13~1.gbpecf76f.debian.tar.xz
EOF
WORKDIR /tmp/sury
RUN set -e; for file in $(awk '{print $2}' SHA256SUMS); do \
curl --location --silent --show-error --fail -o "$file" "https://packages.sury.org/php/pool/main/p/php7.3/$(echo "$file" | sed 's/+/%2B/g')"; \
done; \
sha256sum --check --strict SHA256SUMS && \
dpkg-source --require-strong-checksums -x php7.3_7.3.33-35+0~20261021.144+debian13~1.gbpecf76f.dsc /tmp/php && \
awk 'NF && $1 !~ /^#/ {print $1}' /tmp/php/debian/patches/series | cmp - /tmp/php/.pc/applied-patches

FROM --platform=${DOCKER_PLATFORM} public.ecr.aws/lambda/provided:al2023-${CPU_ARCHITECTURE} as build-environment

ENV BUILD_DIR="/tmp/build" INSTALL_DIR="/opt/ymir"
Expand Down Expand Up @@ -39,11 +58,10 @@ RUN ./config --prefix=${INSTALL_DIR}/openssl11 --openssldir=${INSTALL_DIR}/opens
&& cp ${INSTALL_DIR}/openssl11/lib/libssl.so.1.1 ${INSTALL_DIR}/lib/ && cp ${INSTALL_DIR}/openssl11/lib/libcrypto.so.1.1 ${INSTALL_DIR}/lib/

# PHP 7.3.33
ENV VERSION_PHP=7.3.33
RUN mkdir -p ${BUILD_DIR}/php
COPY --from=php-source /tmp/php ${BUILD_DIR}/php
WORKDIR ${BUILD_DIR}/php
RUN curl --location --silent --show-error --fail https://www.php.net/distributions/php-${VERSION_PHP}.tar.gz | tar xzC . --strip-components=1
RUN ./buildconf --force && \
# Vendor build preparation from debian/rules and build/build2.mk.
RUN make -f build/build.mk generated_lists && make -B -f build/build2.mk aclocal.m4 && ./buildconf --force && \
export PKG_CONFIG_PATH="${INSTALL_DIR}/openssl11/lib/pkgconfig:$PKG_CONFIG_PATH" && \
CFLAGS="-fstack-protector-strong -fpic -fpie -Os -I${INSTALL_DIR}/include -I${INSTALL_DIR}/openssl11/include -I/usr/include -ffunction-sections -fdata-sections" \
CPPFLAGS="-fstack-protector-strong -fpic -fpie -Os -I${INSTALL_DIR}/include -I${INSTALL_DIR}/openssl11/include -I/usr/include -ffunction-sections -fdata-sections" \
Expand All @@ -55,9 +73,14 @@ RUN ./buildconf --force && \
--enable-exif --enable-ftp --with-gettext --enable-mbstring --enable-opcache=shared --with-pdo-pgsql=shared --with-pgsql=shared --with-pdo-mysql=shared,mysqlnd --with-mysqli --enable-pcntl \
--enable-zip --enable-bcmath --enable-intl=shared --enable-soap --with-xsl --with-pear
RUN make -j $(nproc)
RUN make install PEAR_INSTALLER_URL='https://github.com/pear/pearweb_phars/raw/master/install-pear-nozlib.phar'
RUN make install PEAR_INSTALLDIR=${INSTALL_DIR}/lib/php PEAR_INSTALLER_URL='https://github.com/pear/pearweb_phars/raw/master/install-pear-nozlib.phar'
RUN cp php.ini-production ${INSTALL_DIR}/etc/php/php.ini

# Vendor phpize copies Debian's shtool, libtool aux and aclocal paths. Its dpkg probe only picks the aux
# directory name and falls back to libtool/config here; reevaluate any other dpkg use rather than stubbing it.
RUN cp ${BUILD_DIR}/php/build/shtool /usr/bin/shtool && mkdir -p ${INSTALL_DIR}/share /usr/share/libtool && \
ln -s /usr/share/aclocal ${INSTALL_DIR}/share/aclocal && ln -s /usr/share/libtool/build-aux /usr/share/libtool/config

# PECL
RUN set -xe; cd ${BUILD_DIR}; \
for ext in apcu igbinary zstd; do \
Expand Down Expand Up @@ -98,6 +121,7 @@ RUN ${INSTALL_DIR}/bin/php /tmp/copy-dependencies.php /tmp/layer/ymir/bin /tmp/l
PHP_EXT_DIR=$(${INSTALL_DIR}/bin/php-config --extension-dir) && ${INSTALL_DIR}/bin/php /tmp/copy-dependencies.php /tmp/layer/lib/php/extensions/$(basename ${PHP_EXT_DIR}) /tmp/layer/lib
RUN find /tmp/layer/ymir/bin -type f -exec strip --strip-all {} + || true && find /tmp/layer/lib -type f -name "*.so*" -exec strip --strip-unneeded {} + || true && find /tmp/layer/lib -type f -name "*.a" -delete && find /tmp/layer/lib -type f -name "*.la" -delete
COPY runtime/shared/php.ini /tmp/layer/ymir/etc/php/php.ini
COPY runtime/shared/sury-defaults.ini /tmp/layer/ymir/etc/php/conf.d/sury-defaults.ini
COPY runtime/shared/99-openssl-ca-legacy.ini /tmp/layer/ymir/etc/php/conf.d/99-openssl-ca-legacy.ini
COPY runtime/shared/php-fpm.conf /tmp/layer/ymir/etc/php-fpm.d/php-fpm.conf
RUN sed -i '/extension=msgpack.so/d' /tmp/layer/ymir/etc/php/php.ini
Expand Down
20 changes: 15 additions & 5 deletions runtime/php-74/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ ENV PKG_CONFIG_PATH="${INSTALL_DIR}/lib64/pkgconfig:${INSTALL_DIR}/lib/pkgconfig
MAKEFLAGS='-j4'

RUN dnf makecache && dnf install -y make gcc gcc-c++ autoconf automake libtool git \
libcurl-devel zlib-devel readline-devel gettext-devel libicu-devel libxslt-devel libzip-devel libpq-devel oniguruma-devel openssl-devel libsodium-devel libffi-devel libpng-devel libjpeg-devel freetype-devel libwebp-devel libzstd-devel lz4-devel tar xz file \
libcurl-devel zlib-devel readline-devel gettext-devel libicu-devel libxslt-devel libzip-devel libpq-devel oniguruma-devel openssl-devel libsodium-devel libffi-devel libpng-devel libjpeg-devel freetype-devel libwebp-devel libzstd-devel lz4-devel tar xz file bison re2c \
perl-FindBin perl-IPC-Cmd

RUN mkdir -p ${BUILD_DIR} ${INSTALL_DIR}/bin ${INSTALL_DIR}/etc/php ${INSTALL_DIR}/etc/php/conf.d ${INSTALL_DIR}/lib ${INSTALL_DIR}/lib64 ${INSTALL_DIR}/sbin
Expand All @@ -37,11 +37,15 @@ WORKDIR ${BUILD_DIR}/openssl11
RUN ./config --prefix=${INSTALL_DIR}/openssl11 --openssldir=${INSTALL_DIR}/openssl11/ssl shared zlib && make -j $(nproc) && make install_sw \
&& cp ${INSTALL_DIR}/openssl11/lib/libssl.so.1.1 ${INSTALL_DIR}/lib/ && cp ${INSTALL_DIR}/openssl11/lib/libcrypto.so.1.1 ${INSTALL_DIR}/lib/

# PHP 7.4.33
ENV VERSION_PHP=7.4.33
# PHP 7.4 official PHP-7.4-CVE-2026-109618-109619 security branch (builds as 7.4.34-dev)
# The checksum pins GitHub's archive bytes; on mismatch, investigate and reapprove rather than update it.
ENV PHP_SOURCE_COMMIT=712e60f9edfd03f0960fc4fc3c2c375f42b90aa2 \
PHP_SOURCE_SHA256=c85c8cae6cd97c8688eb0bb2385d2341b74606153d19c3c8688183c3bc760d47
RUN mkdir -p ${BUILD_DIR}/php
WORKDIR ${BUILD_DIR}/php
RUN curl --location --silent --show-error --fail https://www.php.net/distributions/php-${VERSION_PHP}.tar.gz | tar xzC . --strip-components=1
RUN curl --location --silent --show-error --fail -o /tmp/php-src.tar.gz https://github.com/php/php-src/archive/${PHP_SOURCE_COMMIT}.tar.gz \
&& echo "${PHP_SOURCE_SHA256} /tmp/php-src.tar.gz" | sha256sum --check --strict \
&& tar xzf /tmp/php-src.tar.gz -C . --strip-components=1 && rm /tmp/php-src.tar.gz
RUN ./buildconf --force && \
export PKG_CONFIG_PATH="${INSTALL_DIR}/openssl11/lib/pkgconfig:$PKG_CONFIG_PATH" && \
CFLAGS="-fstack-protector-strong -fpic -fpie -Os -I${INSTALL_DIR}/include -I${INSTALL_DIR}/openssl11/include -I/usr/include -ffunction-sections -fdata-sections" \
Expand All @@ -54,7 +58,13 @@ RUN ./buildconf --force && \
--enable-exif --enable-ftp --with-gettext --enable-mbstring --enable-opcache=shared --with-pdo-pgsql=shared --with-pgsql=shared --with-pdo-mysql=shared,mysqlnd --with-mysqli --enable-pcntl \
--with-zip --enable-bcmath --enable-intl=shared --enable-soap --with-xsl --with-pear
RUN make -j $(nproc)
RUN make install PEAR_INSTALLER_URL='https://github.com/pear/pearweb_phars/raw/master/install-pear-nozlib.phar'
# Git snapshots lack the release-bundled PEAR installer; place a pinned vendor copy where make install expects it.
ENV PEAR_INSTALLER_URL=https://raw.githubusercontent.com/pear/pearweb_phars/72aa5f771f56aaf826641b21159453f993e44450/install-pear-nozlib.phar \
PEAR_INSTALLER_SHA256=a71349da29f1a6e3f0792695b167e582375a93c70c0e9d35e7c4675697c5f039
RUN curl --location --silent --show-error --fail -o /tmp/install-pear-nozlib.phar ${PEAR_INSTALLER_URL} \
&& echo "${PEAR_INSTALLER_SHA256} /tmp/install-pear-nozlib.phar" | sha256sum --check --strict \
&& mv /tmp/install-pear-nozlib.phar pear/install-pear-nozlib.phar
RUN make install PEAR_INSTALLER_URL="${PEAR_INSTALLER_URL}"
RUN cp php.ini-production ${INSTALL_DIR}/etc/php/php.ini

# PECL
Expand Down
Loading
Loading