fix(images): Remi origin over HTTPS first; fail builds older than php.net #29

2026-10-21T15:29:34Z

jknapp commented

2026-10-21 15:29:34 +00:00

Follow-up to #28 (security review): HTTPS-first Remi origin (http fallback only because the origin HTTPS is timing out today), plus a build gate: CI resolves php.net current release per branch over HTTPS and the Dockerfile fails if the installed PHP is older. A replayed http index therefore cannot ship old PHP; packages remain GPG-checked.

Tested on 192.168.1.193: baseurl rewrite installs PHP 8.5.12; gate passes at 8.5.12, fails at 8.5.99.

🤖 Generated with Claude Code

Follow-up to #28 (security review): HTTPS-first Remi origin (http fallback only because the origin HTTPS is timing out today), plus a build gate: CI resolves php.net current release per branch over HTTPS and the Dockerfile fails if the installed PHP is older. A replayed http index therefore cannot ship old PHP; packages remain GPG-checked. Tested on 192.168.1.193: baseurl rewrite installs PHP 8.5.12; gate passes at 8.5.12, fails at 8.5.99. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jknapp added 1 commit 2026-10-21 15:29:36 +00:00

fix(images): Remi origin over HTTPS first; fail builds older than php.net af7fd193e5

Security review of #28: plain-http repo metadata could be replayed to keep a
build on old (validly signed) vulnerable PHP. The origin is now tried over
HTTPS first, with http only as a fallback (its HTTPS timed out/reset under the
2026-10-21 release load). CI resolves php.net's current release per branch
(over HTTPS) and the build fails if the installed PHP is older, so neither a
lagging mirror nor replayed metadata can ship a vulnerable PHP.

Tested on 192.168.1.193 (almalinux/10-base): rewritten baseurl installs PHP
8.5.12; the gate passes at 8.5.12 and fails at 8.5.99.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

jknapp merged commit be1540f559 into trunk

2026-10-21 15:29:44 +00:00

jknapp referenced this pull request

2026-10-21 16:47:54 +00:00

feat(lsphp): emergency lsphp build from php.net source (same support as packaged) #30

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cloud-hosting-platform/cloud-apache-container#29