feat(images): upgrade lsphp from the LiteSpeed repo at build time; label PHP version #24

2026-10-21T13:08:04Z

jknapp commented

2026-10-21 13:08:04 +00:00

Why

A critical PHP security release (two RCEs, CVSS 9.2) lands 2026-10-21 14:00 UTC. cac-litespeed and cac-lsphp start FROM litespeedtech/openlitespeed:1.8.4-lsphpNN, which LiteSpeed last built in 2025-12 (lsphp85 8.5.0, lsphp84 8.4.15). Our images only got newer lsphp as a side effect of installing lsphpNN-ldap. This makes the upgrade explicit, complete and verified, so a CI rebuild ships the patch as soon as LiteSpeed publishes the .deb.

What

scripts/lsphp-apt-upgrade.sh: apt-get update --error-on=any, OS upgrade, then upgrades every installed lsphpNN* package. Fails the build if the LiteSpeed repo is unreachable, lsphp is left upgradable, or the result differs from what CI resolved from the repo index.
CI resolves the current lsphp version from rpms.litespeedtech.com/debian per matrix entry and passes EXPECT_* + a per-run CACHE_BUST (no layer cache today; this keeps it that way).
Images carry org.whp.php-version / org.whp.lsphp-package-version labels; cac/cac-fpm (remi) print php -v in the build log and take CACHE_BUST.

Tested on .148 (2026-10-21)

image	PHP old → new	modules	OLS	hardened run	stop
cac-lsphp php85	8.5.11 → 8.5.11	identical (68)	1.8.4	LSAPI :9000 open, PHP as uid 1003	0.1s exit 0
cac-lsphp php84	8.4.26 → 8.4.26	identical (66)	1.8.4	LSAPI :9000 open, PHP as uid 1003	0.1s exit 0
cac-litespeed php85	8.5.11 → 8.5.11	identical (67)	1.8.4	serves PHP as uid 1003	3.3s exit 0

Build time ~70-110s per image. Not tested: php81-83 lsphp/litespeed, a CI run.

🤖 Generated with Claude Code

## Why A critical PHP security release (two RCEs, CVSS 9.2) lands 2026-10-21 14:00 UTC. cac-litespeed and cac-lsphp start FROM `litespeedtech/openlitespeed:1.8.4-lsphpNN`, which LiteSpeed last built in 2025-12 (lsphp85 8.5.0, lsphp84 8.4.15). Our images only got newer lsphp as a side effect of installing `lsphpNN-ldap`. This makes the upgrade explicit, complete and verified, so a CI rebuild ships the patch as soon as LiteSpeed publishes the .deb. ## What - `scripts/lsphp-apt-upgrade.sh`: `apt-get update --error-on=any`, OS upgrade, then upgrades **every** installed `lsphpNN*` package. Fails the build if the LiteSpeed repo is unreachable, lsphp is left upgradable, or the result differs from what CI resolved from the repo index. - CI resolves the current lsphp version from `rpms.litespeedtech.com/debian` per matrix entry and passes `EXPECT_*` + a per-run `CACHE_BUST` (no layer cache today; this keeps it that way). - Images carry `org.whp.php-version` / `org.whp.lsphp-package-version` labels; cac/cac-fpm (remi) print `php -v` in the build log and take `CACHE_BUST`. ## Tested on .148 (2026-10-21) | image | PHP old → new | modules | OLS | hardened run | stop | |---|---|---|---|---|---| | cac-lsphp php85 | 8.5.11 → 8.5.11 | identical (68) | 1.8.4 | LSAPI :9000 open, PHP as uid 1003 | 0.1s exit 0 | | cac-lsphp php84 | 8.4.26 → 8.4.26 | identical (66) | 1.8.4 | LSAPI :9000 open, PHP as uid 1003 | 0.1s exit 0 | | cac-litespeed php85 | 8.5.11 → 8.5.11 | identical (67) | 1.8.4 | serves PHP as uid 1003 | 3.3s exit 0 | Build time ~70-110s per image. Not tested: php81-83 lsphp/litespeed, a CI run. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jknapp added 1 commit 2026-10-21 13:08:04 +00:00

feat(images): upgrade lsphp from the LiteSpeed repo at build time; label PHP version 71ca114529

cac-litespeed and cac-lsphp start FROM litespeedtech/openlitespeed:1.8.4-lsphpNN,
which ships lsphp85 8.5.0 / lsphp84 8.4.15 (built 2025-12). lsphp only moved
forward as a side effect of installing lsphpNN-ldap. lsphp-apt-upgrade.sh now
sweeps every installed lsphpNN* package (and OS packages) to the repo's current
release on every build and fails the build if the repo is unreachable or the
result doesn't match what CI resolved from the repo index. CI passes a per-run
CACHE_BUST so the upgrade layer is never a cache hit, and images carry
org.whp.php-version / org.whp.lsphp-package-version labels.

Tested on .148 (2026-10-21): cac-lsphp php85/php84 and cac-litespeed php85 built
from this branch report the same PHP (8.5.11 / 8.4.26), identical module lists
and OLS 1.8.4 as the current registry images; with the hardening flags each
serves/runs PHP as the customer uid, restarts, and stops cleanly (exit 0).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

jknapp merged commit 642b97707d into trunk

2026-10-21 13:08:15 +00:00

jknapp referenced this pull request

2026-10-21 14:07:06 +00:00

fix(lsphp-apt-upgrade): no early-exit readers under pipefail #25

jknapp referenced this pull request

2026-10-21 16:47:54 +00:00

feat(lsphp): emergency lsphp build from php.net source (same support as packaged) #30

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cloud-hosting-platform/cloud-apache-container#24