shadowdaoandClaude Opus 5.5
83c2ee9c2a
For when a PHP security release is out and the LiteSpeed apt repo lags (2026-10-21: php2shell CVE-2026-109618/-109619 fixed in 8.2.35/8.3.36/ 8.4.27/8.5.12, LiteSpeed still on 8.2.34/8.3.35/8.4.26/8.5.11). Dockerfile.lsphp / Dockerfile.litespeed gain an `lsphp-src` stage that is idle unless PHP_SRC_VERSION is set; normal builds are unchanged (measured: module list, file manifest, ldd, ini and dpkg identical to the published images). When set (lsphp-src-build.sh): - tarball sha256 (php.net releases JSON) + OpenPGP signature against the committed php.net keyring, signer pinned per branch - configure flags replayed from the packaged lsphp's own Configure Command - LiteSpeed's php-litespeed-8.3 SAPI (what the packages actually compile, measured) instead of php-src's sapi/litespeed; sha256-pinned and checked against the packaged binary's LSAPI_* names - packaged compiled-in ini defaults reproduced (session.save_path on 8.2/ 8.3) and gated (`php -n` diff) - ABI gate (lsphp-abi-gate.sh, pahole) before reusing LiteSpeed's packaged PECL .so files; regression-tested in Shell-Checks lsphp-src-overlay.sh swaps only php-src-owned files (decided by dpkg) and fails the build unless extensions, versions, effective ini and feature lines match the packaged lsphp under both CLI and litespeed SAPIs. CI: lsphp-source-emergency.yaml (workflow_dispatch only). build-push.yaml refuses to overwrite a newer php.net image with an older packaged one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
23 lines
1.4 KiB
Plaintext
23 lines
1.4 KiB
Plaintext
# PHP release-manager signing keys, per branch: <branch> <PRIMARY fingerprint> <who>
|
|
# Transcribed from https://www.php.net/gpg-keys.php (2026-10-21). The key material
|
|
# is php-keyring.asc in this directory, the official keyring from
|
|
# https://www.php.net/distributions/php-keyring.gpg (saved unmodified; it is ASCII-armoured despite its .gpg name).
|
|
# lsphp-src-build.sh accepts a tarball only if gpgv validates its .asc against
|
|
# php-keyring.asc AND the signing key's PRIMARY fingerprint is listed here for
|
|
# the tarball's branch. A new release manager = a reviewed commit to both files.
|
|
8.1 528995BFEDFBA7191D46839EF9BA0ADA31CBD89E Joe Watkins
|
|
8.1 39B641343D8C104B2B146DC3F9C39DC0B9698544 Ben Ramsey
|
|
8.1 F1F692238FBC1666E5A5CCD4199F9DFEF6FFBAFD Patrick Allaert
|
|
8.2 1198C0117593497A5EC5C199286AF1F9897469DC Pierrick Charron
|
|
8.2 39B641343D8C104B2B146DC3F9C39DC0B9698544 Ben Ramsey
|
|
8.2 E60913E4DF209907D8E30D96659A97C9CF2A795A Sergey Panteleev
|
|
8.3 1198C0117593497A5EC5C199286AF1F9897469DC Pierrick Charron
|
|
8.3 AFD8691FDAEDF03BDF6E460563F15A9B715376CA Eric A Mann
|
|
8.3 C28D937575603EB4ABB725861C0779DC5C0A9DE4 Jakub Zelenka
|
|
8.4 AFD8691FDAEDF03BDF6E460563F15A9B715376CA Eric A Mann
|
|
8.4 9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6 Calvin Buckley
|
|
8.4 0616E93D95AF471243E26761770426E17EBBB3DD Saki Takamachi
|
|
8.5 1198C0117593497A5EC5C199286AF1F9897469DC Pierrick Charron
|
|
8.5 49D9AF6BC72A80D6691719C8AA23F5BE9C7097D4 Volker Dusch
|
|
8.5 D95C03BC702BE9515344AE3374E44BC9067701A5 Daniel Scherzer
|