From 8a21d40f2463b0ad0c236ceed640b0876563c2c2 Mon Sep 17 00:00:00 2001 From: le0m Date: Sat, 24 Oct 2026 21:08:22 +0200 Subject: [PATCH] feat: apply more backported patches from the Debian PHP team --- README.md | 54 +- compat/Dockerfile | 16 + compat/Dockerfile.5.6 | 272 ---- compat/Dockerfile.5.6-apache | 337 ----- compat/Dockerfile.5.6-fpm | 312 ----- compat/Makefile | 3 +- compat/README.md | 8 +- eol/5.6/apache/Dockerfile | 14 +- eol/5.6/cli/Dockerfile | 14 +- eol/5.6/fpm/Dockerfile | 14 +- eol/7.0/apache/Dockerfile | 14 +- eol/7.0/cli/Dockerfile | 14 +- eol/7.0/fpm/Dockerfile | 14 +- eol/7.1/alpine/Dockerfile | 14 +- eol/7.1/apache/Dockerfile | 14 +- eol/7.1/cli/Dockerfile | 14 +- eol/7.1/fpm-alpine/Dockerfile | 14 +- eol/7.1/fpm/Dockerfile | 14 +- eol/7.2/alpine/Dockerfile | 14 +- eol/7.2/apache/Dockerfile | 14 +- eol/7.2/cli/Dockerfile | 14 +- eol/7.2/fpm-alpine/Dockerfile | 14 +- eol/7.2/fpm/Dockerfile | 14 +- eol/7.3/alpine/Dockerfile | 14 +- eol/7.3/apache/Dockerfile | 14 +- eol/7.3/cli/Dockerfile | 14 +- eol/7.3/fpm-alpine/Dockerfile | 14 +- eol/7.3/fpm/Dockerfile | 14 +- eol/7.4/alpine/Dockerfile | 14 +- eol/7.4/apache/Dockerfile | 14 +- eol/7.4/cli/Dockerfile | 14 +- eol/7.4/fpm-alpine/Dockerfile | 14 +- eol/7.4/fpm/Dockerfile | 14 +- eol/8.0/alpine/Dockerfile | 14 +- eol/8.0/apache/Dockerfile | 14 +- eol/8.0/cli/Dockerfile | 14 +- eol/8.0/fpm-alpine/Dockerfile | 14 +- eol/8.0/fpm/Dockerfile | 14 +- eol/8.1/alpine/Dockerfile | 14 +- eol/8.1/apache/Dockerfile | 14 +- eol/8.1/cli/Dockerfile | 14 +- eol/8.1/fpm-alpine/Dockerfile | 14 +- eol/8.1/fpm/Dockerfile | 14 +- eol/README.md | 45 +- ...1-Avoid-state-corruption-via-bailout.patch | 529 -------- eol/patches/5.6/series | 2 - .../7.0/0211-backport-ZSTR_MAX_LEN.patch | 25 - ...0-Avoid-state-corruption-via-bailout.patch | 701 ---------- eol/patches/7.0/series | 3 - .../7.1/0167-backport-ZSTR_MAX_LEN.patch | 24 - ...6-Avoid-state-corruption-via-bailout.patch | 698 ---------- eol/patches/7.1/series | 3 - .../7.2/0135-backport-ZSTR_MAX_LEN.patch | 23 - ...9-Avoid-state-corruption-via-bailout.patch | 893 ------------- eol/patches/7.2/series | 3 - .../7.3/0107-backport-ZSTR_MAX_LEN.patch | 22 - ...9-Avoid-state-corruption-via-bailout.patch | 912 ------------- eol/patches/7.3/series | 3 - ...1-Avoid-state-corruption-via-bailout.patch | 976 -------------- eol/patches/7.4/series | 2 - ...1-Avoid-state-corruption-via-bailout.patch | 944 ------------- eol/patches/8.0/series | 2 - ...1-Avoid-state-corruption-via-bailout.patch | 1179 ----------------- eol/patches/8.1/series | 2 - eol/patches/docker-php-source-patch | 27 +- eol/patches/series.5.6 | 272 ++++ eol/patches/series.7.0 | 241 ++++ eol/patches/series.7.1 | 197 +++ eol/patches/series.7.2 | 167 +++ eol/patches/series.7.3 | 147 ++ eol/patches/series.7.4 | 172 +++ eol/patches/series.8.0 | 145 ++ eol/patches/series.8.1 | 91 ++ 73 files changed, 1888 insertions(+), 8068 deletions(-) create mode 100644 compat/Dockerfile delete mode 100644 compat/Dockerfile.5.6 delete mode 100644 compat/Dockerfile.5.6-apache delete mode 100644 compat/Dockerfile.5.6-fpm delete mode 100644 eol/patches/5.6/0261-Avoid-state-corruption-via-bailout.patch delete mode 100644 eol/patches/5.6/series delete mode 100644 eol/patches/7.0/0211-backport-ZSTR_MAX_LEN.patch delete mode 100644 eol/patches/7.0/0230-Avoid-state-corruption-via-bailout.patch delete mode 100644 eol/patches/7.0/series delete mode 100644 eol/patches/7.1/0167-backport-ZSTR_MAX_LEN.patch delete mode 100644 eol/patches/7.1/0186-Avoid-state-corruption-via-bailout.patch delete mode 100644 eol/patches/7.1/series delete mode 100644 eol/patches/7.2/0135-backport-ZSTR_MAX_LEN.patch delete mode 100644 eol/patches/7.2/0159-Avoid-state-corruption-via-bailout.patch delete mode 100644 eol/patches/7.2/series delete mode 100644 eol/patches/7.3/0107-backport-ZSTR_MAX_LEN.patch delete mode 100644 eol/patches/7.3/0139-Avoid-state-corruption-via-bailout.patch delete mode 100644 eol/patches/7.3/series delete mode 100644 eol/patches/7.4/0001-Avoid-state-corruption-via-bailout.patch delete mode 100644 eol/patches/7.4/series delete mode 100644 eol/patches/8.0/0001-Avoid-state-corruption-via-bailout.patch delete mode 100644 eol/patches/8.0/series delete mode 100644 eol/patches/8.1/0001-Avoid-state-corruption-via-bailout.patch delete mode 100644 eol/patches/8.1/series create mode 100644 eol/patches/series.5.6 create mode 100644 eol/patches/series.7.0 create mode 100644 eol/patches/series.7.1 create mode 100644 eol/patches/series.7.2 create mode 100644 eol/patches/series.7.3 create mode 100644 eol/patches/series.7.4 create mode 100644 eol/patches/series.8.0 create mode 100644 eol/patches/series.8.1 diff --git a/README.md b/README.md index 188a166..e54af67 100644 --- a/README.md +++ b/README.md @@ -14,53 +14,29 @@ For development environments, you might want to choose an [image with XDebug ins If you use Open Telemetry in your project, you may be interested in an [image with the OTel PHP extension](https://hub.docker.com/r/chialab/php-otel/). -If you are really desperate and need PHP 5.6 with support for MySQL 8.x, check the [php-compat](https://hub.docker.com/r/chialab/php-compat/) image. +If you need PHP 5.6 to connect to a MySQL 8.x server that keeps `caching_sha2_password` as its default authentication plugin, check the [php-compat](https://hub.docker.com/r/chialab/php-compat/) image. ## Available tags -- `latest` -- `5.6` -- `5.6-apache` -- `5.6-fpm` -- `7.0` -- `7.0-apache` -- `7.0-fpm` -- `7.1` -- `7.1-apache` -- `7.1-fpm` -- `7.2` -- `7.2-apache` -- `7.2-fpm` -- `7.3` -- `7.3-apache` -- `7.3-fpm` -- `7.4` -- `7.4-apache` -- `7.4-fpm` -- `8.0` -- `8.0-apache` -- `8.0-fpm` -- `8.1` -- `8.1-apache` -- `8.1-fpm` -- `8.2` -- `8.2-apache` -- `8.2-fpm` -- `8.3` -- `8.3-apache` -- `8.3-fpm` -- `8.4` -- `8.4-apache` -- `8.4-fpm` -- `8.5` -- `8.5-apache` -- `8.5-fpm` +- `latest`, `alpine` +- `8.5`, `8.5-apache`, `8.5-fpm`, `8.5-alpine`, `8.5-fpm-alpine` +- `8.4`, `8.4-apache`, `8.4-fpm`, `8.4-alpine`, `8.4-fpm-alpine` +- `8.3`, `8.3-apache`, `8.3-fpm`, `8.3-alpine`, `8.3-fpm-alpine` +- `8.2`, `8.2-apache`, `8.2-fpm`, `8.2-alpine`, `8.2-fpm-alpine` +- `8.1`, `8.1-apache`, `8.1-fpm`, `8.1-alpine`, `8.1-fpm-alpine` +- `8.0`, `8.0-apache`, `8.0-fpm`, `8.0-alpine`, `8.0-fpm-alpine` +- `7.4`, `7.4-apache`, `7.4-fpm`, `7.4-alpine`, `7.4-fpm-alpine` +- `7.3`, `7.3-apache`, `7.3-fpm`, `7.3-alpine`, `7.3-fpm-alpine` +- `7.2`, `7.2-apache`, `7.2-fpm`, `7.2-alpine`, `7.2-fpm-alpine` +- `7.1`, `7.1-apache`, `7.1-fpm`, `7.1-alpine`, `7.1-fpm-alpine` +- `7.0`, `7.0-apache`, `7.0-fpm` +- `5.6`, `5.6-apache`, `5.6-fpm` As you might have guessed, all tags are built on top of the corresponding tag of the official image. Not all tags are supported in order to easen maintenance. ### Security backports for EOL versions The official images of unsupported PHP versions (5.6 to 8.1) no longer receive security fixes. For those versions we rebuild PHP from the official images' Dockerfiles (see [`eol/`](eol/)), on the same OS release, with security patches applied to the PHP sources. The image layout doesn't change, so `docker-php-ext-*` and `install-php-extensions` keep working. -The `PHP_PATCHES` environment variable and the `it.chialab.php.patches` label list what has been applied. `PHP_VERSION` and `php -v` still report the upstream version, so vulnerability scanners may keep flagging fixed issues. +The patches are the security and bug-fix backports maintained for [deb.sury.org](https://deb.sury.org), taken from the Debian PHP team's [packaging repository](https://salsa.debian.org/php-team/php). Debian packaging changes, changed defaults and deb.sury.org's version-check telemetry are left out. The `PHP_PATCHES` environment variable and the `it.chialab.php.patches` label name the deb.sury.org build the patches come from (e.g. `deb.sury.org-7.4.33-31`). `PHP_VERSION` and `php -v` still report the upstream version, so vulnerability scanners may keep flagging fixed issues. ## Installed extensions The following modules and extensions have been enabled, diff --git a/compat/Dockerfile b/compat/Dockerfile new file mode 100644 index 0000000..451d77e --- /dev/null +++ b/compat/Dockerfile @@ -0,0 +1,16 @@ +ARG BASE_IMAGE=chialab/php:5.6 +FROM ${BASE_IMAGE} +LABEL maintainer="dev@chialab.io" + +# Rebuild the MySQL extensions against MariaDB's libmysqlclient instead of mysqlnd: it can connect +# to MySQL 8+ servers whose default authentication plugin (caching_sha2_password) mysqlnd 5.6 +# doesn't know, as long as the account itself uses mysql_native_password. +RUN set -eux; \ + apt-get update; \ + apt-get install -y --no-install-recommends libmariadbclient-dev-compat; \ + rm -rf /var/lib/apt/lists/*; \ + rm -f "$PHP_INI_DIR"/conf.d/docker-php-ext-mysql.ini "$PHP_INI_DIR"/conf.d/docker-php-ext-mysqli.ini "$PHP_INI_DIR"/conf.d/docker-php-ext-pdo_mysql.ini; \ + docker-php-ext-configure mysql --with-mysql=/usr; \ + docker-php-ext-configure mysqli --with-mysqli=/usr/bin/mysql_config; \ + docker-php-ext-configure pdo_mysql --with-pdo-mysql=/usr; \ + docker-php-ext-install mysql mysqli pdo_mysql diff --git a/compat/Dockerfile.5.6 b/compat/Dockerfile.5.6 deleted file mode 100644 index b00390b..0000000 --- a/compat/Dockerfile.5.6 +++ /dev/null @@ -1,272 +0,0 @@ -# -# This is taken from the official PHP image's Dockerfile (https://github.com/docker-library/php/tree/783878384a8f3953ed571e5a34ba0fe546726c85) -# and slightly fixed to work in this day and age. -# - -FROM debian:stretch-slim - -LABEL maintainer="dev@chialab.io" - -# Fix Debian 9 (Stretch) source list, because it has been moved to archive, and update packages. -RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \ - -e 's/security.debian.org/archive.debian.org/g' \ - -e '/stretch-updates/d' /etc/apt/sources.list \ - && apt-get update && apt-get upgrade -y - -# prevent Debian's PHP packages from being installed -# https://github.com/docker-library/php/pull/542 -RUN set -eux; \ - { \ - echo 'Package: php*'; \ - echo 'Pin: release *'; \ - echo 'Pin-Priority: -1'; \ - } > /etc/apt/preferences.d/no-debian-php - -# dependencies required for running "phpize" -# (see persistent deps below) -ENV PHPIZE_DEPS \ - autoconf \ - dpkg-dev \ - file \ - g++ \ - gcc \ - libc-dev \ - make \ - pkg-config \ - re2c - -# persistent / runtime deps -RUN apt-get update && apt-get install -y \ - $PHPIZE_DEPS \ - ca-certificates \ - curl \ - xz-utils \ - --no-install-recommends && rm -r /var/lib/apt/lists/* - -ENV PHP_INI_DIR /usr/local/etc/php -RUN mkdir -p $PHP_INI_DIR/conf.d - -#### -#### - -# Apply stack smash protection to functions using local buffers and alloca() -# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) -# Enable optimization (-O2) -# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) -# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated) -# https://github.com/docker-library/php/issues/272 -ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2" -ENV PHP_CPPFLAGS="$PHP_CFLAGS" -ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie" - -ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3 - -ENV PHP_VERSION 5.6.40 -ENV PHP_URL="https://www.php.net/distributions/php-5.6.40.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-5.6.40.tar.xz.asc" -ENV PHP_SHA256="1369a51eee3995d7fbd1c5342e5cc917760e276d561595b6052b21ace2656d1c" PHP_MD5="" - -RUN set -xe; \ - \ - fetchDeps=' \ - wget \ - '; \ - if ! command -v gpg > /dev/null; then \ - fetchDeps="$fetchDeps \ - dirmngr \ - gnupg \ - "; \ - fi; \ - apt-get update; \ - apt-get install -y --no-install-recommends $fetchDeps; \ - rm -rf /var/lib/apt/lists/*; \ - \ - mkdir -p /usr/src; \ - cd /usr/src; \ - \ - wget -O php.tar.xz "$PHP_URL"; \ - \ - if [ -n "$PHP_SHA256" ]; then \ - echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ - fi; \ - if [ -n "$PHP_MD5" ]; then \ - echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \ - fi; \ - \ - if [ -n "$PHP_ASC_URL" ]; then \ - wget -O php.tar.xz.asc "$PHP_ASC_URL"; \ - export GNUPGHOME="$(mktemp -d)"; \ - for key in $GPG_KEYS; do \ - gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ - done; \ - gpg --batch --verify php.tar.xz.asc php.tar.xz; \ - command -v gpgconf > /dev/null && gpgconf --kill all; \ - rm -rf "$GNUPGHOME"; \ - fi; \ - \ - apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps - -COPY --from=php:5.6 /usr/local/bin/docker-php-source /usr/local/bin/ - -# Security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \ - --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches - -RUN set -eux; \ - \ - savedAptMark="$(apt-mark showmanual)"; \ - apt-get update; \ - apt-get install -y --no-install-recommends \ - libcurl4-openssl-dev \ - libedit-dev \ - libsqlite3-dev \ - libssl1.0-dev \ - libxml2-dev \ - zlib1g-dev \ - libmariadb2 libmariadbclient-dev-compat \ - ${PHP_EXTRA_BUILD_DEPS:-} \ - ; \ - rm -rf /var/lib/apt/lists/*; \ - \ - export \ - CFLAGS="$PHP_CFLAGS" \ - CPPFLAGS="$PHP_CPPFLAGS" \ - LDFLAGS="$PHP_LDFLAGS" \ - ; \ - docker-php-source extract; \ - cd /usr/src/php; \ - gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ - debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \ -# https://bugs.php.net/bug.php?id=74125 - if [ ! -d /usr/include/curl ]; then \ - ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \ - fi; \ - ./configure \ - --build="$gnuArch" \ - --with-config-file-path="$PHP_INI_DIR" \ - --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ - \ -# make sure invalid --configure-flags are fatal errors intead of just warnings - --enable-option-checking=fatal \ - \ -# https://github.com/docker-library/php/issues/439 - --with-mhash \ - \ -# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236) - --enable-ftp \ -# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) - --enable-mbstring \ -# Use MariaDB's libmysqlclient library instead of mysqlnd to be able to communicate with MySQL 8+, which uses new locales of the utf8mb4 family that are unknown to old mysqlnd - --disable-mysqlnd \ - --with-mysql="/usr" \ - --with-mysqli="/usr/bin/mysql_config" \ - --with-pdo-mysql="/usr" \ - \ - --with-curl \ - --with-libedit \ - --with-openssl \ - --with-zlib \ - \ -# bundled pcre does not support JIT on s390x -# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT - $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \ - --with-libdir="lib/$debMultiarch" \ - \ - ${PHP_EXTRA_CONFIGURE_ARGS:-} \ - ; \ - make -j "$(nproc)"; \ - make install; \ - find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \ - make clean; \ - \ -# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) - cp -v php.ini-* "$PHP_INI_DIR/"; \ - \ - cd /; \ - docker-php-source delete; \ - \ -# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies - apt-mark auto '.*' > /dev/null; \ - [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \ - find /usr/local -type f -executable -exec ldd '{}' ';' \ - | awk '/=>/ { print $(NF-1) }' \ - | sort -u \ - | xargs -r dpkg-query --search \ - | cut -d: -f1 \ - | sort -u \ - | xargs -r apt-mark manual \ - ; \ - apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \ - \ - php --version; \ - \ -# https://github.com/docker-library/php/issues/443 - pecl update-channels; \ - rm -rf /tmp/pear ~/.pearrc - -COPY --from=php:5.6 /usr/local/bin/docker-php-ext-* /usr/local/bin/docker-php-entrypoint /usr/local/bin/ - -ENTRYPOINT ["docker-php-entrypoint"] -#### -CMD ["php", "-a"] -#### - -# Download script to install PHP extensions and dependencies -ADD https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/ - -RUN chmod +x /usr/local/bin/install-php-extensions - -# PEAR < 1.10.18 can't read pecl.php.net responses anymore. -RUN pear upgrade --force https://pear.php.net/get/PEAR-1.10.18.tgz - -# retry: PECL sometimes replies "No releases available" on CI runners. -RUN retry() { for i in 1 2 3; do "$@" && return; sleep 10; done; return 1; }; \ - DEBIAN_FRONTEND=noninteractive apt-get update -q \ - && DEBIAN_FRONTEND=noninteractive apt-get install -qq -y \ - curl \ - git \ - zip unzip \ -# iconv, mbstring and pdo_sqlite are omitted as they are already installed - && PHP_EXTENSIONS=" \ - amqp \ - bcmath \ - bz2 \ - calendar \ - event \ - exif \ - gd \ - gettext \ - imagick \ - intl \ - ldap \ - mcrypt \ - memcached \ - mysql \ - mysqli \ - opcache \ - pdo_mysql \ - pdo_pgsql \ - pgsql \ - redis \ - soap \ - sockets \ - xsl \ - zip \ - " \ - && retry install-php-extensions $PHP_EXTENSIONS - -# Install Composer. -ENV PATH=$PATH:/root/composer/vendor/bin \ - COMPOSER_ALLOW_SUPERUSER=1 \ - COMPOSER_HOME=/root/composer -RUN cd /opt \ - # Download installer and check for its integrity. - && curl -sSL https://getcomposer.org/installer > composer-setup.php \ - && curl -sSL https://composer.github.io/installer.sha384sum > composer-setup.sha384sum \ - && sha384sum --check composer-setup.sha384sum \ - # Install Composer 2. - && php composer-setup.php --install-dir=/usr/local/bin --filename=composer --2 \ - # Remove installer files. - && rm /opt/composer-setup.php /opt/composer-setup.sha384sum diff --git a/compat/Dockerfile.5.6-apache b/compat/Dockerfile.5.6-apache deleted file mode 100644 index 5aaa4d6..0000000 --- a/compat/Dockerfile.5.6-apache +++ /dev/null @@ -1,337 +0,0 @@ -# -# This is taken from the official PHP image's Dockerfile (https://github.com/docker-library/php/tree/783878384a8f3953ed571e5a34ba0fe546726c85) -# and slightly fixed to work in this day and age. -# - -FROM debian:stretch-slim - -LABEL maintainer="dev@chialab.io" - -# Fix Debian 9 (Stretch) source list, because it has been moved to archive, and update packages. -RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \ - -e 's/security.debian.org/archive.debian.org/g' \ - -e '/stretch-updates/d' /etc/apt/sources.list \ - && apt-get update && apt-get upgrade -y - -# prevent Debian's PHP packages from being installed -# https://github.com/docker-library/php/pull/542 -RUN set -eux; \ - { \ - echo 'Package: php*'; \ - echo 'Pin: release *'; \ - echo 'Pin-Priority: -1'; \ - } > /etc/apt/preferences.d/no-debian-php - -# dependencies required for running "phpize" -# (see persistent deps below) -ENV PHPIZE_DEPS \ - autoconf \ - dpkg-dev \ - file \ - g++ \ - gcc \ - libc-dev \ - make \ - pkg-config \ - re2c - -# persistent / runtime deps -RUN apt-get update && apt-get install -y \ - $PHPIZE_DEPS \ - ca-certificates \ - curl \ - xz-utils \ - --no-install-recommends && rm -r /var/lib/apt/lists/* - -ENV PHP_INI_DIR /usr/local/etc/php -RUN mkdir -p $PHP_INI_DIR/conf.d - -#### -RUN apt-get update \ - && apt-get install -y --no-install-recommends \ - apache2 \ - && rm -rf /var/lib/apt/lists/* - -ENV APACHE_CONFDIR /etc/apache2 -ENV APACHE_ENVVARS $APACHE_CONFDIR/envvars - -RUN set -eux; \ - \ -# generically convert lines like -# export APACHE_RUN_USER=www-data -# into -# : ${APACHE_RUN_USER:=www-data} -# export APACHE_RUN_USER -# so that they can be overridden at runtime ("-e APACHE_RUN_USER=...") - sed -ri 's/^export ([^=]+)=(.*)$/: ${\1:=\2}\nexport \1/' "$APACHE_ENVVARS"; \ - \ -# setup directories and permissions - . "$APACHE_ENVVARS"; \ - for dir in \ - "$APACHE_LOCK_DIR" \ - "$APACHE_RUN_DIR" \ - "$APACHE_LOG_DIR" \ - /var/www/html \ - ; do \ - rm -rvf "$dir"; \ - mkdir -p "$dir"; \ - chown "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$dir"; \ -# allow running as an arbitrary user (https://github.com/docker-library/php/issues/743) - chmod 777 "$dir"; \ - done; \ - \ -# logs should go to stdout / stderr - ln -sfT /dev/stderr "$APACHE_LOG_DIR/error.log"; \ - ln -sfT /dev/stdout "$APACHE_LOG_DIR/access.log"; \ - ln -sfT /dev/stdout "$APACHE_LOG_DIR/other_vhosts_access.log"; \ - chown -R --no-dereference "$APACHE_RUN_USER:$APACHE_RUN_GROUP" "$APACHE_LOG_DIR" - -# Apache + PHP requires preforking Apache for best results -RUN a2dismod mpm_event && a2enmod mpm_prefork - -# PHP files should be handled by PHP, and should be preferred over any other file type -RUN { \ - echo ''; \ - echo '\tSetHandler application/x-httpd-php'; \ - echo ''; \ - echo; \ - echo 'DirectoryIndex disabled'; \ - echo 'DirectoryIndex index.php index.html'; \ - echo; \ - echo ''; \ - echo '\tOptions -Indexes'; \ - echo '\tAllowOverride All'; \ - echo ''; \ - } | tee "$APACHE_CONFDIR/conf-available/docker-php.conf" \ - && a2enconf docker-php - -ENV PHP_EXTRA_BUILD_DEPS apache2-dev -ENV PHP_EXTRA_CONFIGURE_ARGS --with-apxs2 --disable-cgi -#### - -# Apply stack smash protection to functions using local buffers and alloca() -# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) -# Enable optimization (-O2) -# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) -# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated) -# https://github.com/docker-library/php/issues/272 -ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2" -ENV PHP_CPPFLAGS="$PHP_CFLAGS" -ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie" - -ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3 - -ENV PHP_VERSION 5.6.40 -ENV PHP_URL="https://www.php.net/distributions/php-5.6.40.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-5.6.40.tar.xz.asc" -ENV PHP_SHA256="1369a51eee3995d7fbd1c5342e5cc917760e276d561595b6052b21ace2656d1c" PHP_MD5="" - -RUN set -xe; \ - \ - fetchDeps=' \ - wget \ - '; \ - if ! command -v gpg > /dev/null; then \ - fetchDeps="$fetchDeps \ - dirmngr \ - gnupg \ - "; \ - fi; \ - apt-get update; \ - apt-get install -y --no-install-recommends $fetchDeps; \ - rm -rf /var/lib/apt/lists/*; \ - \ - mkdir -p /usr/src; \ - cd /usr/src; \ - \ - wget -O php.tar.xz "$PHP_URL"; \ - \ - if [ -n "$PHP_SHA256" ]; then \ - echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ - fi; \ - if [ -n "$PHP_MD5" ]; then \ - echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \ - fi; \ - \ - if [ -n "$PHP_ASC_URL" ]; then \ - wget -O php.tar.xz.asc "$PHP_ASC_URL"; \ - export GNUPGHOME="$(mktemp -d)"; \ - for key in $GPG_KEYS; do \ - gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ - done; \ - gpg --batch --verify php.tar.xz.asc php.tar.xz; \ - command -v gpgconf > /dev/null && gpgconf --kill all; \ - rm -rf "$GNUPGHOME"; \ - fi; \ - \ - apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps - -COPY --from=php:5.6-apache /usr/local/bin/docker-php-source /usr/local/bin/ - -# Security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \ - --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches - -RUN set -eux; \ - \ - savedAptMark="$(apt-mark showmanual)"; \ - apt-get update; \ - apt-get install -y --no-install-recommends \ - libcurl4-openssl-dev \ - libedit-dev \ - libsqlite3-dev \ - libssl1.0-dev \ - libxml2-dev \ - zlib1g-dev \ - libmariadb2 libmariadbclient-dev-compat \ - ${PHP_EXTRA_BUILD_DEPS:-} \ - ; \ - rm -rf /var/lib/apt/lists/*; \ - \ - export \ - CFLAGS="$PHP_CFLAGS" \ - CPPFLAGS="$PHP_CPPFLAGS" \ - LDFLAGS="$PHP_LDFLAGS" \ - ; \ - docker-php-source extract; \ - cd /usr/src/php; \ - gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ - debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \ -# https://bugs.php.net/bug.php?id=74125 - if [ ! -d /usr/include/curl ]; then \ - ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \ - fi; \ - ./configure \ - --build="$gnuArch" \ - --with-config-file-path="$PHP_INI_DIR" \ - --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ - \ -# make sure invalid --configure-flags are fatal errors intead of just warnings - --enable-option-checking=fatal \ - \ -# https://github.com/docker-library/php/issues/439 - --with-mhash \ - \ -# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236) - --enable-ftp \ -# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) - --enable-mbstring \ -# Use MariaDB's libmysqlclient library instead of mysqlnd to be able to communicate with MySQL 8+, which uses new locales of the utf8mb4 family that are unknown to old mysqlnd - --disable-mysqlnd \ - --with-mysql="/usr" \ - --with-mysqli="/usr/bin/mysql_config" \ - --with-pdo-mysql="/usr" \ - \ - --with-curl \ - --with-libedit \ - --with-openssl \ - --with-zlib \ - \ -# bundled pcre does not support JIT on s390x -# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT - $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \ - --with-libdir="lib/$debMultiarch" \ - \ - ${PHP_EXTRA_CONFIGURE_ARGS:-} \ - ; \ - make -j "$(nproc)"; \ - make install; \ - find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \ - make clean; \ - \ -# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) - cp -v php.ini-* "$PHP_INI_DIR/"; \ - \ - cd /; \ - docker-php-source delete; \ - \ -# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies - apt-mark auto '.*' > /dev/null; \ - [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \ - find /usr/local -type f -executable -exec ldd '{}' ';' \ - | awk '/=>/ { print $(NF-1) }' \ - | sort -u \ - | xargs -r dpkg-query --search \ - | cut -d: -f1 \ - | sort -u \ - | xargs -r apt-mark manual \ - ; \ - apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \ - \ - php --version; \ - \ -# https://github.com/docker-library/php/issues/443 - pecl update-channels; \ - rm -rf /tmp/pear ~/.pearrc - -COPY --from=php:5.6-apache /usr/local/bin/docker-php-ext-* /usr/local/bin/docker-php-entrypoint /usr/local/bin/ - -ENTRYPOINT ["docker-php-entrypoint"] -#### -COPY --from=php:5.6-apache /usr/local/bin/apache2-foreground /usr/local/bin/ -WORKDIR /var/www/html - -EXPOSE 80 -CMD ["apache2-foreground"] -#### - -# Download script to install PHP extensions and dependencies -ADD https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/ - -RUN chmod +x /usr/local/bin/install-php-extensions - -# PEAR < 1.10.18 can't read pecl.php.net responses anymore. -RUN pear upgrade --force https://pear.php.net/get/PEAR-1.10.18.tgz - -# retry: PECL sometimes replies "No releases available" on CI runners. -RUN retry() { for i in 1 2 3; do "$@" && return; sleep 10; done; return 1; }; \ - DEBIAN_FRONTEND=noninteractive apt-get update -q \ - && DEBIAN_FRONTEND=noninteractive apt-get install -qq -y \ - curl \ - git \ - zip unzip \ -# iconv, mbstring and pdo_sqlite are omitted as they are already installed - && PHP_EXTENSIONS=" \ - amqp \ - bcmath \ - bz2 \ - calendar \ - event \ - exif \ - gd \ - gettext \ - imagick \ - intl \ - ldap \ - mcrypt \ - memcached \ - mysql \ - mysqli \ - opcache \ - pdo_mysql \ - pdo_pgsql \ - pgsql \ - redis \ - soap \ - sockets \ - xsl \ - zip \ - " \ - && retry install-php-extensions $PHP_EXTENSIONS \ - && if command -v a2enmod; then a2enmod rewrite; fi - -# Install Composer. -ENV PATH=$PATH:/root/composer/vendor/bin \ - COMPOSER_ALLOW_SUPERUSER=1 \ - COMPOSER_HOME=/root/composer -RUN cd /opt \ - # Download installer and check for its integrity. - && curl -sSL https://getcomposer.org/installer > composer-setup.php \ - && curl -sSL https://composer.github.io/installer.sha384sum > composer-setup.sha384sum \ - && sha384sum --check composer-setup.sha384sum \ - # Install Composer 2. - && php composer-setup.php --install-dir=/usr/local/bin --filename=composer --2 \ - # Remove installer files. - && rm /opt/composer-setup.php /opt/composer-setup.sha384sum diff --git a/compat/Dockerfile.5.6-fpm b/compat/Dockerfile.5.6-fpm deleted file mode 100644 index dbc6e41..0000000 --- a/compat/Dockerfile.5.6-fpm +++ /dev/null @@ -1,312 +0,0 @@ -# -# This is taken from the official PHP image's Dockerfile (https://github.com/docker-library/php/tree/783878384a8f3953ed571e5a34ba0fe546726c85) -# and slightly fixed to work in this day and age. -# - -FROM debian:stretch-slim - -LABEL maintainer="dev@chialab.io" - -# Fix Debian 9 (Stretch) source list, because it has been moved to archive, and update packages. -RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \ - -e 's/security.debian.org/archive.debian.org/g' \ - -e '/stretch-updates/d' /etc/apt/sources.list \ - && apt-get update && apt-get upgrade -y - -# prevent Debian's PHP packages from being installed -# https://github.com/docker-library/php/pull/542 -RUN set -eux; \ - { \ - echo 'Package: php*'; \ - echo 'Pin: release *'; \ - echo 'Pin-Priority: -1'; \ - } > /etc/apt/preferences.d/no-debian-php - -# dependencies required for running "phpize" -# (see persistent deps below) -ENV PHPIZE_DEPS \ - autoconf \ - dpkg-dev \ - file \ - g++ \ - gcc \ - libc-dev \ - make \ - pkg-config \ - re2c - -# persistent / runtime deps -RUN apt-get update && apt-get install -y \ - $PHPIZE_DEPS \ - ca-certificates \ - curl \ - xz-utils \ - --no-install-recommends && rm -r /var/lib/apt/lists/* - -ENV PHP_INI_DIR /usr/local/etc/php -RUN mkdir -p $PHP_INI_DIR/conf.d - -#### -ENV PHP_EXTRA_CONFIGURE_ARGS --enable-fpm --with-fpm-user=www-data --with-fpm-group=www-data --disable-cgi -#### - -# Apply stack smash protection to functions using local buffers and alloca() -# Make PHP's main executable position-independent (improves ASLR security mechanism, and has no performance impact on x86_64) -# Enable optimization (-O2) -# Enable linker optimization (this sorts the hash buckets to improve cache locality, and is non-default) -# Adds GNU HASH segments to generated executables (this is used if present, and is much faster than sysv hash; in this configuration, sysv hash is also generated) -# https://github.com/docker-library/php/issues/272 -ENV PHP_CFLAGS="-fstack-protector-strong -fpic -fpie -O2" -ENV PHP_CPPFLAGS="$PHP_CFLAGS" -ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie" - -ENV GPG_KEYS 0BD78B5F97500D450838F95DFE857D9A90D90EC1 6E4F6AB321FDC07F2C332E3AC2BF0BC433CFC8B3 - -ENV PHP_VERSION 5.6.40 -ENV PHP_URL="https://www.php.net/distributions/php-5.6.40.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-5.6.40.tar.xz.asc" -ENV PHP_SHA256="1369a51eee3995d7fbd1c5342e5cc917760e276d561595b6052b21ace2656d1c" PHP_MD5="" - -RUN set -xe; \ - \ - fetchDeps=' \ - wget \ - '; \ - if ! command -v gpg > /dev/null; then \ - fetchDeps="$fetchDeps \ - dirmngr \ - gnupg \ - "; \ - fi; \ - apt-get update; \ - apt-get install -y --no-install-recommends $fetchDeps; \ - rm -rf /var/lib/apt/lists/*; \ - \ - mkdir -p /usr/src; \ - cd /usr/src; \ - \ - wget -O php.tar.xz "$PHP_URL"; \ - \ - if [ -n "$PHP_SHA256" ]; then \ - echo "$PHP_SHA256 *php.tar.xz" | sha256sum -c -; \ - fi; \ - if [ -n "$PHP_MD5" ]; then \ - echo "$PHP_MD5 *php.tar.xz" | md5sum -c -; \ - fi; \ - \ - if [ -n "$PHP_ASC_URL" ]; then \ - wget -O php.tar.xz.asc "$PHP_ASC_URL"; \ - export GNUPGHOME="$(mktemp -d)"; \ - for key in $GPG_KEYS; do \ - gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \ - done; \ - gpg --batch --verify php.tar.xz.asc php.tar.xz; \ - command -v gpgconf > /dev/null && gpgconf --kill all; \ - rm -rf "$GNUPGHOME"; \ - fi; \ - \ - apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false $fetchDeps - -COPY --from=php:5.6-fpm /usr/local/bin/docker-php-source /usr/local/bin/ - -# Security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \ - --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches - -RUN set -eux; \ - \ - savedAptMark="$(apt-mark showmanual)"; \ - apt-get update; \ - apt-get install -y --no-install-recommends \ - libcurl4-openssl-dev \ - libedit-dev \ - libsqlite3-dev \ - libssl1.0-dev \ - libxml2-dev \ - zlib1g-dev \ - libmariadb2 libmariadbclient-dev-compat \ - ${PHP_EXTRA_BUILD_DEPS:-} \ - ; \ - rm -rf /var/lib/apt/lists/*; \ - \ - export \ - CFLAGS="$PHP_CFLAGS" \ - CPPFLAGS="$PHP_CPPFLAGS" \ - LDFLAGS="$PHP_LDFLAGS" \ - ; \ - docker-php-source extract; \ - cd /usr/src/php; \ - gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ - debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \ -# https://bugs.php.net/bug.php?id=74125 - if [ ! -d /usr/include/curl ]; then \ - ln -sT "/usr/include/$debMultiarch/curl" /usr/local/include/curl; \ - fi; \ - ./configure \ - --build="$gnuArch" \ - --with-config-file-path="$PHP_INI_DIR" \ - --with-config-file-scan-dir="$PHP_INI_DIR/conf.d" \ - \ -# make sure invalid --configure-flags are fatal errors intead of just warnings - --enable-option-checking=fatal \ - \ -# https://github.com/docker-library/php/issues/439 - --with-mhash \ - \ -# --enable-ftp is included here because ftp_ssl_connect() needs ftp to be compiled statically (see https://github.com/docker-library/php/issues/236) - --enable-ftp \ -# --enable-mbstring is included here because otherwise there's no way to get pecl to use it properly (see https://github.com/docker-library/php/issues/195) - --enable-mbstring \ -# Use MariaDB's libmysqlclient library instead of mysqlnd to be able to communicate with MySQL 8+, which uses new locales of the utf8mb4 family that are unknown to old mysqlnd - --disable-mysqlnd \ - --with-mysql="/usr" \ - --with-mysqli="/usr/bin/mysql_config" \ - --with-pdo-mysql="/usr" \ - \ - --with-curl \ - --with-libedit \ - --with-openssl \ - --with-zlib \ - \ -# bundled pcre does not support JIT on s390x -# https://manpages.debian.org/stretch/libpcre3-dev/pcrejit.3.en.html#AVAILABILITY_OF_JIT_SUPPORT - $(test "$gnuArch" = 's390x-linux-gnu' && echo '--without-pcre-jit') \ - --with-libdir="lib/$debMultiarch" \ - \ - ${PHP_EXTRA_CONFIGURE_ARGS:-} \ - ; \ - make -j "$(nproc)"; \ - make install; \ - find /usr/local/bin /usr/local/sbin -type f -executable -exec strip --strip-all '{}' + || true; \ - make clean; \ - \ -# https://github.com/docker-library/php/issues/692 (copy default example "php.ini" files somewhere easily discoverable) - cp -v php.ini-* "$PHP_INI_DIR/"; \ - \ - cd /; \ - docker-php-source delete; \ - \ -# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies - apt-mark auto '.*' > /dev/null; \ - [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \ - find /usr/local -type f -executable -exec ldd '{}' ';' \ - | awk '/=>/ { print $(NF-1) }' \ - | sort -u \ - | xargs -r dpkg-query --search \ - | cut -d: -f1 \ - | sort -u \ - | xargs -r apt-mark manual \ - ; \ - apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \ - \ - php --version; \ - \ -# https://github.com/docker-library/php/issues/443 - pecl update-channels; \ - rm -rf /tmp/pear ~/.pearrc - -COPY --from=php:5.6-fpm /usr/local/bin/docker-php-ext-* /usr/local/bin/docker-php-entrypoint /usr/local/bin/ - -ENTRYPOINT ["docker-php-entrypoint"] -#### -WORKDIR /var/www/html - -RUN set -ex \ - && cd /usr/local/etc \ - && if [ -d php-fpm.d ]; then \ - # for some reason, upstream's php-fpm.conf.default has "include=NONE/etc/php-fpm.d/*.conf" - sed 's!=NONE/!=!g' php-fpm.conf.default | tee php-fpm.conf > /dev/null; \ - cp php-fpm.d/www.conf.default php-fpm.d/www.conf; \ - else \ - # PHP 5.x doesn't use "include=" by default, so we'll create our own simple config that mimics PHP 7+ for consistency - mkdir php-fpm.d; \ - cp php-fpm.conf.default php-fpm.d/www.conf; \ - { \ - echo '[global]'; \ - echo 'include=etc/php-fpm.d/*.conf'; \ - } | tee php-fpm.conf; \ - fi \ - && { \ - echo '[global]'; \ - echo 'error_log = /proc/self/fd/2'; \ - echo; \ - echo '[www]'; \ - echo '; if we send this to /proc/self/fd/1, it never appears'; \ - echo 'access.log = /proc/self/fd/2'; \ - echo; \ - echo 'clear_env = no'; \ - echo; \ - echo '; Ensure worker stdout and stderr are sent to the main error log.'; \ - echo 'catch_workers_output = yes'; \ - } | tee php-fpm.d/docker.conf \ - && { \ - echo '[global]'; \ - echo 'daemonize = no'; \ - echo; \ - echo '[www]'; \ - echo 'listen = 9000'; \ - } | tee php-fpm.d/zz-docker.conf - -EXPOSE 9000 -CMD ["php-fpm"] -#### - -# Download script to install PHP extensions and dependencies -ADD https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/ - -RUN chmod +x /usr/local/bin/install-php-extensions - -# PEAR < 1.10.18 can't read pecl.php.net responses anymore. -RUN pear upgrade --force https://pear.php.net/get/PEAR-1.10.18.tgz - -# retry: PECL sometimes replies "No releases available" on CI runners. -RUN retry() { for i in 1 2 3; do "$@" && return; sleep 10; done; return 1; }; \ - DEBIAN_FRONTEND=noninteractive apt-get update -q \ - && DEBIAN_FRONTEND=noninteractive apt-get install -qq -y \ - curl \ - git \ - zip unzip \ -# iconv, mbstring and pdo_sqlite are omitted as they are already installed - && PHP_EXTENSIONS=" \ - amqp \ - bcmath \ - bz2 \ - calendar \ - event \ - exif \ - gd \ - gettext \ - imagick \ - intl \ - ldap \ - mcrypt \ - memcached \ - mysql \ - mysqli \ - opcache \ - pdo_mysql \ - pdo_pgsql \ - pgsql \ - redis \ - soap \ - sockets \ - xsl \ - zip \ - " \ - && retry install-php-extensions $PHP_EXTENSIONS - -# Install Composer. -ENV PATH=$PATH:/root/composer/vendor/bin \ - COMPOSER_ALLOW_SUPERUSER=1 \ - COMPOSER_HOME=/root/composer -RUN cd /opt \ - # Download installer and check for its integrity. - && curl -sSL https://getcomposer.org/installer > composer-setup.php \ - && curl -sSL https://composer.github.io/installer.sha384sum > composer-setup.sha384sum \ - && sha384sum --check composer-setup.sha384sum \ - # Install Composer 2. - && php composer-setup.php --install-dir=/usr/local/bin --filename=composer --2 \ - # Remove installer files. - && rm /opt/composer-setup.php /opt/composer-setup.sha384sum diff --git a/compat/Makefile b/compat/Makefile index 283ca91..64ea852 100644 --- a/compat/Makefile +++ b/compat/Makefile @@ -2,6 +2,7 @@ SHELL := /bin/bash ALL: build .PHONY: build test push +PARENT_IMAGE := chialab/php IMAGE := chialab/php-compat VERSION ?= latest PHP_VERSION = $(firstword $(subst -, ,$(VERSION))) @@ -43,7 +44,7 @@ endif build: @echo " =====> Building $(REGISTRY)$(IMAGE):$(VERSION)..." - docker image build --quiet --build-context patches=../eol/patches -f Dockerfile.$(VERSION) -t $(REGISTRY)$(IMAGE):$(VERSION) . + docker image build --quiet --build-arg 'BASE_IMAGE=$(PARENT_IMAGE):$(VERSION)' -t $(REGISTRY)$(IMAGE):$(VERSION) . test: @echo -e "=====> Testing loaded extensions... \c" diff --git a/compat/README.md b/compat/README.md index a3ee651..7a1346b 100644 --- a/compat/README.md +++ b/compat/README.md @@ -22,9 +22,11 @@ Compatibility docker images. ### PHP 5.6 -Built from the latest official PHP 5.6 Dockerfiles ([this](https://github.com/docker-library/php/tree/783878384a8f3953ed571e5a34ba0fe546726c85) commit), -with PHP compiled to use MariaDB's `libmysqlclient` connector. This fixes connections with MySQL 8.0+, which uses a default -collation not recognized by the official image's `mysqlnd` connector (`utf8mb4`). +Built on top of [`chialab/php:5.6`](../README.md) (same tag), with the `mysql`, `mysqli` and `pdo_mysql` extensions rebuilt +against MariaDB's `libmysqlclient` connector instead of `mysqlnd`. Unlike `mysqlnd` 5.6, it can connect to MySQL 8.0+ servers +whose default authentication plugin is `caching_sha2_password`, as long as the account uses `mysql_native_password`. Accounts +using `caching_sha2_password` aren't supported, and the `mysqlnd`-only APIs (such as `mysqli_stmt::get_result()`) aren't +available. ## Available tags - `5.6` diff --git a/eol/5.6/apache/Dockerfile b/eol/5.6/apache/Dockerfile index b107e36..296e542 100644 --- a/eol/5.6/apache/Dockerfile +++ b/eol/5.6/apache/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/37a17e9a4ea67d5422411675b8564860dcf4cc22/php-37a17e9a4ea67d5422411675b8564860dcf4cc22.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:stretch-slim # chialab: Debian stretch has been moved to archive.debian.org. @@ -176,11 +181,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/fab4 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-5.6.40-105" +LABEL it.chialab.php.patches="deb.sury.org-5.6.40-105" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.5.6,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/5.6/cli/Dockerfile b/eol/5.6/cli/Dockerfile index 7bd3dcc..5388080 100644 --- a/eol/5.6/cli/Dockerfile +++ b/eol/5.6/cli/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/37a17e9a4ea67d5422411675b8564860dcf4cc22/php-37a17e9a4ea67d5422411675b8564860dcf4cc22.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:stretch-slim # chialab: Debian stretch has been moved to archive.debian.org. @@ -116,11 +121,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/fab4 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-5.6.40-105" +LABEL it.chialab.php.patches="deb.sury.org-5.6.40-105" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.5.6,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/5.6/fpm/Dockerfile b/eol/5.6/fpm/Dockerfile index b98bb1f..892c217 100644 --- a/eol/5.6/fpm/Dockerfile +++ b/eol/5.6/fpm/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/37a17e9a4ea67d5422411675b8564860dcf4cc22/php-37a17e9a4ea67d5422411675b8564860dcf4cc22.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:stretch-slim # chialab: Debian stretch has been moved to archive.debian.org. @@ -117,11 +122,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/fab4 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=5.6,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-5.6.40-105" +LABEL it.chialab.php.patches="deb.sury.org-5.6.40-105" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.5.6,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/7.0/apache/Dockerfile b/eol/7.0/apache/Dockerfile index 931bbe5..90d9126 100644 --- a/eol/7.0/apache/Dockerfile +++ b/eol/7.0/apache/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/9521952fd4f62fc7a1ddafa42588c07b93736e04/php-9521952fd4f62fc7a1ddafa42588c07b93736e04.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:stretch-slim # chialab: Debian stretch has been moved to archive.debian.org. @@ -170,11 +175,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/0e5c ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.0,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.0.33-93" +LABEL it.chialab.php.patches="deb.sury.org-7.0.33-93" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.0,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/7.0/cli/Dockerfile b/eol/7.0/cli/Dockerfile index b74e0cb..0e0b6b6 100644 --- a/eol/7.0/cli/Dockerfile +++ b/eol/7.0/cli/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/9521952fd4f62fc7a1ddafa42588c07b93736e04/php-9521952fd4f62fc7a1ddafa42588c07b93736e04.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:stretch-slim # chialab: Debian stretch has been moved to archive.debian.org. @@ -110,11 +115,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/0e5c ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.0,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.0.33-93" +LABEL it.chialab.php.patches="deb.sury.org-7.0.33-93" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.0,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/7.0/fpm/Dockerfile b/eol/7.0/fpm/Dockerfile index 0a0e407..d239372 100644 --- a/eol/7.0/fpm/Dockerfile +++ b/eol/7.0/fpm/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/9521952fd4f62fc7a1ddafa42588c07b93736e04/php-9521952fd4f62fc7a1ddafa42588c07b93736e04.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:stretch-slim # chialab: Debian stretch has been moved to archive.debian.org. @@ -111,11 +116,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/0e5c ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.0,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.0.33-93" +LABEL it.chialab.php.patches="deb.sury.org-7.0.33-93" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.0,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/7.1/alpine/Dockerfile b/eol/7.1/alpine/Dockerfile index 378e77f..1aca917 100644 --- a/eol/7.1/alpine/Dockerfile +++ b/eol/7.1/alpine/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/a88ccf5051d416b9f47faf85df9b7b875e111a71/php-a88ccf5051d416b9f47faf85df9b7b875e111a71.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM alpine:3.10 # dependencies required for running "phpize" @@ -102,11 +107,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/2bf3 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.1,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.1.33-81" +LABEL it.chialab.php.patches="deb.sury.org-7.1.33-81" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.1,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ apk add --no-cache --virtual .build-deps \ diff --git a/eol/7.1/apache/Dockerfile b/eol/7.1/apache/Dockerfile index 78a7141..e80aff2 100644 --- a/eol/7.1/apache/Dockerfile +++ b/eol/7.1/apache/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/a88ccf5051d416b9f47faf85df9b7b875e111a71/php-a88ccf5051d416b9f47faf85df9b7b875e111a71.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:buster-slim # chialab: Debian buster has been moved to archive.debian.org. @@ -174,11 +179,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/2bf3 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.1,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.1.33-81" +LABEL it.chialab.php.patches="deb.sury.org-7.1.33-81" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.1,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/7.1/cli/Dockerfile b/eol/7.1/cli/Dockerfile index c001cbc..d4cc094 100644 --- a/eol/7.1/cli/Dockerfile +++ b/eol/7.1/cli/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/a88ccf5051d416b9f47faf85df9b7b875e111a71/php-a88ccf5051d416b9f47faf85df9b7b875e111a71.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:buster-slim # chialab: Debian buster has been moved to archive.debian.org. @@ -114,11 +119,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/2bf3 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.1,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.1.33-81" +LABEL it.chialab.php.patches="deb.sury.org-7.1.33-81" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.1,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/7.1/fpm-alpine/Dockerfile b/eol/7.1/fpm-alpine/Dockerfile index 6136cb6..0e49528 100644 --- a/eol/7.1/fpm-alpine/Dockerfile +++ b/eol/7.1/fpm-alpine/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/a88ccf5051d416b9f47faf85df9b7b875e111a71/php-a88ccf5051d416b9f47faf85df9b7b875e111a71.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM alpine:3.10 # dependencies required for running "phpize" @@ -103,11 +108,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/2bf3 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.1,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.1.33-81" +LABEL it.chialab.php.patches="deb.sury.org-7.1.33-81" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.1,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ apk add --no-cache --virtual .build-deps \ diff --git a/eol/7.1/fpm/Dockerfile b/eol/7.1/fpm/Dockerfile index fff3856..f6f53b2 100644 --- a/eol/7.1/fpm/Dockerfile +++ b/eol/7.1/fpm/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/a88ccf5051d416b9f47faf85df9b7b875e111a71/php-a88ccf5051d416b9f47faf85df9b7b875e111a71.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:buster-slim # chialab: Debian buster has been moved to archive.debian.org. @@ -115,11 +120,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/2bf3 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.1,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.1.33-81" +LABEL it.chialab.php.patches="deb.sury.org-7.1.33-81" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.1,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/7.2/alpine/Dockerfile b/eol/7.2/alpine/Dockerfile index b5f12b2..851d088 100644 --- a/eol/7.2/alpine/Dockerfile +++ b/eol/7.2/alpine/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e0bcd488d9f8da024d9e1a254113539a846cac6d/php-e0bcd488d9f8da024d9e1a254113539a846cac6d.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM alpine:3.12 # dependencies required for running "phpize" @@ -94,11 +99,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/20eb ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.2,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.2.34-66" +LABEL it.chialab.php.patches="deb.sury.org-7.2.34-66" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.2,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ apk add --no-cache --virtual .build-deps \ diff --git a/eol/7.2/apache/Dockerfile b/eol/7.2/apache/Dockerfile index 9c2f668..6125644 100644 --- a/eol/7.2/apache/Dockerfile +++ b/eol/7.2/apache/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e0bcd488d9f8da024d9e1a254113539a846cac6d/php-e0bcd488d9f8da024d9e1a254113539a846cac6d.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:buster-slim # chialab: Debian buster has been moved to archive.debian.org. @@ -167,11 +172,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/20eb ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.2,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.2.34-66" +LABEL it.chialab.php.patches="deb.sury.org-7.2.34-66" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.2,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/7.2/cli/Dockerfile b/eol/7.2/cli/Dockerfile index 2fdeffd..728bf73 100644 --- a/eol/7.2/cli/Dockerfile +++ b/eol/7.2/cli/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e0bcd488d9f8da024d9e1a254113539a846cac6d/php-e0bcd488d9f8da024d9e1a254113539a846cac6d.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:buster-slim # chialab: Debian buster has been moved to archive.debian.org. @@ -106,11 +111,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/20eb ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.2,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.2.34-66" +LABEL it.chialab.php.patches="deb.sury.org-7.2.34-66" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.2,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/7.2/fpm-alpine/Dockerfile b/eol/7.2/fpm-alpine/Dockerfile index 617dc5c..f68d780 100644 --- a/eol/7.2/fpm-alpine/Dockerfile +++ b/eol/7.2/fpm-alpine/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e0bcd488d9f8da024d9e1a254113539a846cac6d/php-e0bcd488d9f8da024d9e1a254113539a846cac6d.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM alpine:3.12 # dependencies required for running "phpize" @@ -96,11 +101,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/20eb ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.2,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.2.34-66" +LABEL it.chialab.php.patches="deb.sury.org-7.2.34-66" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.2,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ apk add --no-cache --virtual .build-deps \ diff --git a/eol/7.2/fpm/Dockerfile b/eol/7.2/fpm/Dockerfile index 4877f54..4a88221 100644 --- a/eol/7.2/fpm/Dockerfile +++ b/eol/7.2/fpm/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e0bcd488d9f8da024d9e1a254113539a846cac6d/php-e0bcd488d9f8da024d9e1a254113539a846cac6d.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:buster-slim # chialab: Debian buster has been moved to archive.debian.org. @@ -108,11 +113,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/20eb ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.2,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.2.34-66" +LABEL it.chialab.php.patches="deb.sury.org-7.2.34-66" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.2,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/7.3/alpine/Dockerfile b/eol/7.3/alpine/Dockerfile index a803329..4386422 100644 --- a/eol/7.3/alpine/Dockerfile +++ b/eol/7.3/alpine/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/ecf76f6726bee03657a2c608240685732312fe54/php-ecf76f6726bee03657a2c608240685732312fe54.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM alpine:3.15 # dependencies required for running "phpize" @@ -92,11 +97,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/35d0 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.3,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.3.33-35" +LABEL it.chialab.php.patches="deb.sury.org-7.3.33-35" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.3,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ apk add --no-cache --virtual .build-deps \ diff --git a/eol/7.3/apache/Dockerfile b/eol/7.3/apache/Dockerfile index 566f961..0f85619 100644 --- a/eol/7.3/apache/Dockerfile +++ b/eol/7.3/apache/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/ecf76f6726bee03657a2c608240685732312fe54/php-ecf76f6726bee03657a2c608240685732312fe54.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:bullseye-slim # chialab: Debian bullseye has been moved to archive.debian.org. @@ -163,11 +168,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/35d0 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.3,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.3.33-35" +LABEL it.chialab.php.patches="deb.sury.org-7.3.33-35" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.3,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/7.3/cli/Dockerfile b/eol/7.3/cli/Dockerfile index 28b3d4a..b6b687a 100644 --- a/eol/7.3/cli/Dockerfile +++ b/eol/7.3/cli/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/ecf76f6726bee03657a2c608240685732312fe54/php-ecf76f6726bee03657a2c608240685732312fe54.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:bullseye-slim # chialab: Debian bullseye has been moved to archive.debian.org. @@ -105,11 +110,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/35d0 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.3,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.3.33-35" +LABEL it.chialab.php.patches="deb.sury.org-7.3.33-35" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.3,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/7.3/fpm-alpine/Dockerfile b/eol/7.3/fpm-alpine/Dockerfile index c78baf0..82889a6 100644 --- a/eol/7.3/fpm-alpine/Dockerfile +++ b/eol/7.3/fpm-alpine/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/ecf76f6726bee03657a2c608240685732312fe54/php-ecf76f6726bee03657a2c608240685732312fe54.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM alpine:3.15 # dependencies required for running "phpize" @@ -92,11 +97,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/35d0 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.3,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.3.33-35" +LABEL it.chialab.php.patches="deb.sury.org-7.3.33-35" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.3,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ apk add --no-cache --virtual .build-deps \ diff --git a/eol/7.3/fpm/Dockerfile b/eol/7.3/fpm/Dockerfile index a4f84f7..407f5ca 100644 --- a/eol/7.3/fpm/Dockerfile +++ b/eol/7.3/fpm/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/ecf76f6726bee03657a2c608240685732312fe54/php-ecf76f6726bee03657a2c608240685732312fe54.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:bullseye-slim # chialab: Debian bullseye has been moved to archive.debian.org. @@ -105,11 +110,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/35d0 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.3,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.3.33-35" +LABEL it.chialab.php.patches="deb.sury.org-7.3.33-35" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.3,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/7.4/alpine/Dockerfile b/eol/7.4/alpine/Dockerfile index 2399dee..a0e68d0 100644 --- a/eol/7.4/alpine/Dockerfile +++ b/eol/7.4/alpine/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e9c428802984a79e6e2e1f505404322e6fe7ba8d/php-e9c428802984a79e6e2e1f505404322e6fe7ba8d.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM alpine:3.16 # dependencies required for running "phpize" @@ -92,11 +97,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/1361 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.4,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.4.33-31" +LABEL it.chialab.php.patches="deb.sury.org-7.4.33-31" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.4,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ apk add --no-cache --virtual .build-deps \ diff --git a/eol/7.4/apache/Dockerfile b/eol/7.4/apache/Dockerfile index 541317c..a456538 100644 --- a/eol/7.4/apache/Dockerfile +++ b/eol/7.4/apache/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e9c428802984a79e6e2e1f505404322e6fe7ba8d/php-e9c428802984a79e6e2e1f505404322e6fe7ba8d.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:bullseye-slim # chialab: Debian bullseye has been moved to archive.debian.org. @@ -163,11 +168,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/1361 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.4,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.4.33-31" +LABEL it.chialab.php.patches="deb.sury.org-7.4.33-31" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.4,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/7.4/cli/Dockerfile b/eol/7.4/cli/Dockerfile index 39203d2..7d4fcd6 100644 --- a/eol/7.4/cli/Dockerfile +++ b/eol/7.4/cli/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e9c428802984a79e6e2e1f505404322e6fe7ba8d/php-e9c428802984a79e6e2e1f505404322e6fe7ba8d.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:bullseye-slim # chialab: Debian bullseye has been moved to archive.debian.org. @@ -105,11 +110,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/1361 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.4,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.4.33-31" +LABEL it.chialab.php.patches="deb.sury.org-7.4.33-31" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.4,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/7.4/fpm-alpine/Dockerfile b/eol/7.4/fpm-alpine/Dockerfile index 5967b9b..f859d10 100644 --- a/eol/7.4/fpm-alpine/Dockerfile +++ b/eol/7.4/fpm-alpine/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e9c428802984a79e6e2e1f505404322e6fe7ba8d/php-e9c428802984a79e6e2e1f505404322e6fe7ba8d.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM alpine:3.16 # dependencies required for running "phpize" @@ -92,11 +97,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/1361 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.4,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.4.33-31" +LABEL it.chialab.php.patches="deb.sury.org-7.4.33-31" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.4,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ apk add --no-cache --virtual .build-deps \ diff --git a/eol/7.4/fpm/Dockerfile b/eol/7.4/fpm/Dockerfile index c571e72..2732d5f 100644 --- a/eol/7.4/fpm/Dockerfile +++ b/eol/7.4/fpm/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/e9c428802984a79e6e2e1f505404322e6fe7ba8d/php-e9c428802984a79e6e2e1f505404322e6fe7ba8d.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:bullseye-slim # chialab: Debian bullseye has been moved to archive.debian.org. @@ -105,11 +110,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/1361 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=7.4,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-7.4.33-31" +LABEL it.chialab.php.patches="deb.sury.org-7.4.33-31" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.7.4,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/8.0/alpine/Dockerfile b/eol/8.0/alpine/Dockerfile index af571d8..d36375a 100644 --- a/eol/8.0/alpine/Dockerfile +++ b/eol/8.0/alpine/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/abebea27da1d5cf90a0e83ab81ea3e708886aebb/php-abebea27da1d5cf90a0e83ab81ea3e708886aebb.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM alpine:3.16 # dependencies required for running "phpize" @@ -92,11 +97,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/df46 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=8.0,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-8.0.30-25" +LABEL it.chialab.php.patches="deb.sury.org-8.0.30-25" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.8.0,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ apk add --no-cache --virtual .build-deps \ diff --git a/eol/8.0/apache/Dockerfile b/eol/8.0/apache/Dockerfile index f7d1924..1a7d9ab 100644 --- a/eol/8.0/apache/Dockerfile +++ b/eol/8.0/apache/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/abebea27da1d5cf90a0e83ab81ea3e708886aebb/php-abebea27da1d5cf90a0e83ab81ea3e708886aebb.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:bullseye-slim # chialab: Debian bullseye has been moved to archive.debian.org. @@ -163,11 +168,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/df46 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=8.0,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-8.0.30-25" +LABEL it.chialab.php.patches="deb.sury.org-8.0.30-25" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.8.0,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/8.0/cli/Dockerfile b/eol/8.0/cli/Dockerfile index 4f722e4..54baaa8 100644 --- a/eol/8.0/cli/Dockerfile +++ b/eol/8.0/cli/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/abebea27da1d5cf90a0e83ab81ea3e708886aebb/php-abebea27da1d5cf90a0e83ab81ea3e708886aebb.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:bullseye-slim # chialab: Debian bullseye has been moved to archive.debian.org. @@ -105,11 +110,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/df46 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=8.0,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-8.0.30-25" +LABEL it.chialab.php.patches="deb.sury.org-8.0.30-25" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.8.0,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/8.0/fpm-alpine/Dockerfile b/eol/8.0/fpm-alpine/Dockerfile index f09419f..37c6c85 100644 --- a/eol/8.0/fpm-alpine/Dockerfile +++ b/eol/8.0/fpm-alpine/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/abebea27da1d5cf90a0e83ab81ea3e708886aebb/php-abebea27da1d5cf90a0e83ab81ea3e708886aebb.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM alpine:3.16 # dependencies required for running "phpize" @@ -92,11 +97,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/df46 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=8.0,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-8.0.30-25" +LABEL it.chialab.php.patches="deb.sury.org-8.0.30-25" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.8.0,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ apk add --no-cache --virtual .build-deps \ diff --git a/eol/8.0/fpm/Dockerfile b/eol/8.0/fpm/Dockerfile index 0d6a00b..6dea32b 100644 --- a/eol/8.0/fpm/Dockerfile +++ b/eol/8.0/fpm/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/abebea27da1d5cf90a0e83ab81ea3e708886aebb/php-abebea27da1d5cf90a0e83ab81ea3e708886aebb.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:bullseye-slim # chialab: Debian bullseye has been moved to archive.debian.org. @@ -105,11 +110,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/df46 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=8.0,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-8.0.30-25" +LABEL it.chialab.php.patches="deb.sury.org-8.0.30-25" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.8.0,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/8.1/alpine/Dockerfile b/eol/8.1/alpine/Dockerfile index 9e874aa..fafd9a4 100644 --- a/eol/8.1/alpine/Dockerfile +++ b/eol/8.1/alpine/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/4e430ad99622d9fabcee27d6dba438c81de716eb/php-4e430ad99622d9fabcee27d6dba438c81de716eb.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM alpine:3.21 # dependencies required for running "phpize" @@ -89,11 +94,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/5c03 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=8.1,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-8.1.34-9" +LABEL it.chialab.php.patches="deb.sury.org-8.1.34-9" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.8.1,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ apk add --no-cache --virtual .build-deps \ diff --git a/eol/8.1/apache/Dockerfile b/eol/8.1/apache/Dockerfile index 8b5ce11..a7026cd 100644 --- a/eol/8.1/apache/Dockerfile +++ b/eol/8.1/apache/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/4e430ad99622d9fabcee27d6dba438c81de716eb/php-4e430ad99622d9fabcee27d6dba438c81de716eb.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:trixie-slim # prevent Debian's PHP packages from being installed @@ -158,11 +163,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/5c03 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=8.1,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-8.1.34-9" +LABEL it.chialab.php.patches="deb.sury.org-8.1.34-9" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.8.1,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/8.1/cli/Dockerfile b/eol/8.1/cli/Dockerfile index 1d9aa48..ab8d67f 100644 --- a/eol/8.1/cli/Dockerfile +++ b/eol/8.1/cli/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/4e430ad99622d9fabcee27d6dba438c81de716eb/php-4e430ad99622d9fabcee27d6dba438c81de716eb.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:trixie-slim # prevent Debian's PHP packages from being installed @@ -98,11 +103,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/5c03 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=8.1,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-8.1.34-9" +LABEL it.chialab.php.patches="deb.sury.org-8.1.34-9" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.8.1,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/8.1/fpm-alpine/Dockerfile b/eol/8.1/fpm-alpine/Dockerfile index e6c8d6e..47b1e2e 100644 --- a/eol/8.1/fpm-alpine/Dockerfile +++ b/eol/8.1/fpm-alpine/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/4e430ad99622d9fabcee27d6dba438c81de716eb/php-4e430ad99622d9fabcee27d6dba438c81de716eb.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM alpine:3.21 # dependencies required for running "phpize" @@ -89,11 +94,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/5c03 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=8.1,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-8.1.34-9" +LABEL it.chialab.php.patches="deb.sury.org-8.1.34-9" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.8.1,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ apk add --no-cache --virtual .build-deps \ diff --git a/eol/8.1/fpm/Dockerfile b/eol/8.1/fpm/Dockerfile index 74ea69e..70eb09e 100644 --- a/eol/8.1/fpm/Dockerfile +++ b/eol/8.1/fpm/Dockerfile @@ -4,6 +4,11 @@ # with the changes marked "chialab:". # +# chialab: deb.sury.org's patches for this version, from the Salsa commit of the build named in PHP_PATCHES. +FROM scratch AS deb-patches +ARG DEB_PATCHES=https://salsa.debian.org/php-team/php/-/archive/4e430ad99622d9fabcee27d6dba438c81de716eb/php-4e430ad99622d9fabcee27d6dba438c81de716eb.tar.gz?path=debian/patches +ADD --unpack=true $DEB_PATCHES / + FROM debian:trixie-slim # prevent Debian's PHP packages from being installed @@ -98,11 +103,12 @@ ARG DOCKER_PHP_SCRIPTS=https://raw.githubusercontent.com/docker-library/php/5c03 ADD --chmod=755 $DOCKER_PHP_SCRIPTS/docker-php-source /usr/local/bin/ # chialab: security backports for this EOL version (see eol/patches). -ENV PHP_PATCHES="CVE-2026-109618 CVE-2026-109619" -LABEL it.chialab.php.patches="CVE-2026-109618 CVE-2026-109619" -RUN --mount=type=bind,from=patches,source=8.1,target=/usr/src/php-patches \ +ENV PHP_PATCHES="deb.sury.org-8.1.34-9" +LABEL it.chialab.php.patches="deb.sury.org-8.1.34-9" +RUN --mount=type=bind,from=deb-patches,target=/usr/src/deb-patches \ + --mount=type=bind,from=patches,source=series.8.1,target=/usr/src/php-series \ --mount=type=bind,from=patches,source=docker-php-source-patch,target=/usr/local/bin/docker-php-source-patch \ - docker-php-source-patch /usr/src/php-patches + docker-php-source-patch /usr/src/php-series /usr/src/deb-patches RUN set -eux; \ \ diff --git a/eol/README.md b/eol/README.md index 966f6ba..e5b4415 100644 --- a/eol/README.md +++ b/eol/README.md @@ -6,16 +6,23 @@ applied to the sources, and use the result as the base image instead of `php://Dockerfile`: the official Dockerfiles, one per tag suffix (`cli`, `apache`, `fpm`, `alpine`, `fpm-alpine`). -- `patches/`: `docker-php-source-patch` and one `/series` of patches per version, passed to - the build as the `patches` named context. +- `patches/`: `docker-php-source-patch` and one `series.` per version, passed to the build + as the `patches` named context. + +The patches are deb.sury.org's, from the Debian PHP team's +[repository on Salsa](https://salsa.debian.org/php-team/php). Each Dockerfile downloads +`debian/patches` from the Salsa commit in its `DEB_PATCHES` into a `deb-patches` stage. Each +`series.` is an allow-list over that `series`: it names every patch in the same order, with +the ones left out commented as `# : `. `docker-php-source-patch` fails the build if +the two lists differ, so a new deb.sury.org revision can't add a patch nobody has reviewed. The build picks a directory up on its own: if `eol//` exists, the Makefile and `build-images.yml` build it as the base image. No workflow lists EOL versions. ## Adding a version -Add it once there is a security patch to apply: `make test` fails an EOL image whose -`PHP_PATCHES` is empty. Until then, keep building on the official image. +Add it once deb.sury.org publishes patches for it: `make test` fails an EOL image whose `PHP_PATCHES` +is empty. Until then, keep building on the official image. 1. **Find the source.** Take the last [docker-library/php](https://github.com/docker-library/php) commit that still has the `/` directory. For each flavor, pick the variant the plain @@ -30,12 +37,32 @@ Add it once there is a security patch to apply: `make test` fails an EOL image w first `COPY`, and replace the `COPY docker-php-*` and `COPY apache2-foreground` lines with `ADD --chmod=755 $DOCKER_PHP_SCRIPTS/