From c49f45633680679fa449ae43893b62ed2299dcc0 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Wed, 21 Oct 2026 08:02:38 -0700 Subject: [PATCH] fix(images): install Remi packages from the origin, not the lagging mirrors During the php2shell release the Remi mirrors still served 8.2.34 hours after 8.2.35 was published, so cac/cac-fpm builds shipped vulnerable PHP. Enable the repo files' baseurl (rpms.remirepo.net) and comment the mirrorlist. Verified on the build server: a clean almalinux/10-base install now gets PHP 8.2.35. Co-Authored-By: Claude Opus 5.5 --- Dockerfile | 4 ++++ Dockerfile.fpm | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/Dockerfile b/Dockerfile index 386d044..ea01e70 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,6 +9,10 @@ ARG CACHE_BUST= RUN dnf install -y \ https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm \ https://rpms.remirepo.net/enterprise/remi-release-10.rpm && \ + # Use Remi's origin, not the mirrorlist: during the 2026-10-21 PHP security + # release the mirrors lagged hours behind (still 8.2.34 when 8.2.35 was out), + # so builds shipped unpatched PHP. Packages stay GPG-checked (gpgcheck=1). + sed -i -e 's/^#baseurl=/baseurl=/' -e 's/^mirrorlist=/#mirrorlist=/' /etc/yum.repos.d/remi*.repo && \ dnf update -y && \ dnf install -y httpd mod_ssl openssl wget procps cronie iproute postgresql-devel microdnf less git \ nano rsync unzip zip mariadb bind-utils jq patch nc tree dos2unix && \ diff --git a/Dockerfile.fpm b/Dockerfile.fpm index 96a2e27..0c16f90 100644 --- a/Dockerfile.fpm +++ b/Dockerfile.fpm @@ -9,6 +9,10 @@ ARG CACHE_BUST= RUN dnf install -y \ https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm \ https://rpms.remirepo.net/enterprise/remi-release-10.rpm && \ + # Use Remi's origin, not the mirrorlist: during the 2026-10-21 PHP security + # release the mirrors lagged hours behind (still 8.2.34 when 8.2.35 was out), + # so builds shipped unpatched PHP. Packages stay GPG-checked (gpgcheck=1). + sed -i -e 's/^#baseurl=/baseurl=/' -e 's/^mirrorlist=/#mirrorlist=/' /etc/yum.repos.d/remi*.repo && \ dnf update -y && \ dnf install -y openssl wget procps cronie iproute postgresql-devel microdnf less git \ nano rsync unzip zip mariadb bind-utils jq patch nc tree dos2unix fcgi && \ -- 2.52.0