fix(images): install Remi packages from the origin, not the lagging mirrors #28

2026-10-21T15:02:39Z

jknapp commented

2026-10-21 15:02:39 +00:00

Remi mirrors lagged the 2026-10-21 PHP security release (still 8.2.34 when 8.2.35 was out), so cac/cac-fpm builds shipped vulnerable PHP. Use the origin baseurl; packages stay GPG-checked. Verified on 192.168.1.193: clean almalinux/10-base install gets PHP 8.2.35.

🤖 Generated with Claude Code

Remi mirrors lagged the 2026-10-21 PHP security release (still 8.2.34 when 8.2.35 was out), so cac/cac-fpm builds shipped vulnerable PHP. Use the origin baseurl; packages stay GPG-checked. Verified on 192.168.1.193: clean almalinux/10-base install gets PHP 8.2.35. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jknapp added 1 commit 2026-10-21 15:02:39 +00:00

fix(images): install Remi packages from the origin, not the lagging mirrors c49f456336

During the php2shell release the Remi mirrors still served 8.2.34 hours after
8.2.35 was published, so cac/cac-fpm builds shipped vulnerable PHP. Enable the
repo files' baseurl (rpms.remirepo.net) and comment the mirrorlist. Verified on
the build server: a clean almalinux/10-base install now gets PHP 8.2.35.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

jknapp merged commit e8e3bfd490 into trunk

2026-10-21 15:02:41 +00:00

jknapp referenced this pull request

2026-10-21 15:29:35 +00:00

fix(images): Remi origin over HTTPS first; fail builds older than php.net #29

jknapp referenced this issue from a commit

2026-10-21 15:29:36 +00:00

fix(images): Remi origin over HTTPS first; fail builds older than php.net

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cloud-hosting-platform/cloud-apache-container#28