For when a PHP security release is out and the LiteSpeed apt repo lags
(2026-10-21: php2shell CVE-2026-109618/-109619 fixed in 8.2.35/8.3.36/
8.4.27/8.5.12, LiteSpeed still on 8.2.34/8.3.35/8.4.26/8.5.11).
Dockerfile.lsphp / Dockerfile.litespeed gain an `lsphp-src` stage that is
idle unless PHP_SRC_VERSION is set; normal builds are unchanged (measured:
module list, file manifest, ldd, ini and dpkg identical to the published
images).
When set (lsphp-src-build.sh):
- tarball sha256 (php.net releases JSON) + OpenPGP signature against the
committed php.net keyring, signer pinned per branch
- configure flags replayed from the packaged lsphp's own Configure Command
- LiteSpeed's php-litespeed-8.3 SAPI (what the packages actually compile,
measured) instead of php-src's sapi/litespeed; sha256-pinned and checked
against the packaged binary's LSAPI_* names
- packaged compiled-in ini defaults reproduced (session.save_path on 8.2/
8.3) and gated (`php -n` diff)
- ABI gate (lsphp-abi-gate.sh, pahole) before reusing LiteSpeed's packaged
PECL .so files; regression-tested in Shell-Checks
lsphp-src-overlay.sh swaps only php-src-owned files (decided by dpkg) and
fails the build unless extensions, versions, effective ini and feature
lines match the packaged lsphp under both CLI and litespeed SAPIs.
CI: lsphp-source-emergency.yaml (workflow_dispatch only). build-push.yaml
refuses to overwrite a newer php.net image with an older packaged one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two judgement calls arising from the pipefail/SIGPIPE fix, reasoned through
and written up rather than decided silently:
1. Boot posture when 'lsphp -i' genuinely fails. Recommendation is fail-open
plus a machine-detectable degraded marker and one probe retry, NOT
fail-closed: a transient fork() failure during this fleet's backup windows
produces the identical empty-LSPHP_INFO signature, so fail-closed would
refuse to boot healthy sites under host pressure. Includes the caution
that degraded must not map onto Docker 'unhealthy', or a watchdog would
restart-loop a serving site over something restarts cannot fix.
Corrects a premise the fix rested on: the two entrypoints were NOT already
consistent — entrypoint-litespeed.sh fails open silently, with no warning.
2. Whether the new static check should gate releases. Recommendation is to
hard-gate, but only after back-testing the job against trunk and recent
tags to bound false positives.
Recommendations only; no implementation.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
shadowdaoandClaude Opus 5.5