shadowdaoandClaude Opus 5.5
16c8bcc46e
For when a PHP security release is out and the LiteSpeed apt repo lags (2026-10-21: php2shell CVE-2026-109618/-109619 fixed in 8.2.35/8.3.36/ 8.4.27/8.5.12, LiteSpeed still on 8.2.34/8.3.35/8.4.26/8.5.11). Dockerfile.lsphp / Dockerfile.litespeed gain an `lsphp-src` stage that is idle unless PHP_SRC_VERSION is set; normal builds are unchanged (measured: module list, file manifest, ldd, ini and dpkg identical to the published images). When set (lsphp-src-build.sh): - tarball sha256 (php.net releases JSON) + OpenPGP signature against the committed php.net keyring, signer pinned per branch - configure flags replayed from the packaged lsphp's own Configure Command - LiteSpeed's php-litespeed-8.3 SAPI (what the packages actually compile, measured) instead of php-src's sapi/litespeed; sha256-pinned and checked against the packaged binary's LSAPI_* names - packaged compiled-in ini defaults reproduced (session.save_path on 8.2/ 8.3) and gated (`php -n` diff) - ABI gate (lsphp-abi-gate.sh, pahole) before reusing LiteSpeed's packaged PECL .so files; regression-tested in Shell-Checks lsphp-src-overlay.sh swaps only php-src-owned files (decided by dpkg) and fails the build unless extensions, versions, effective ini and feature lines match the packaged lsphp under both CLI and litespeed SAPIs. CI: lsphp-source-emergency.yaml (workflow_dispatch only). build-push.yaml refuses to overwrite a newer php.net image with an older packaged one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
14 lines
937 B
Plaintext
14 lines
937 B
Plaintext
# LiteSpeed's own LSAPI SAPI source, which the LiteSpeed lsphp packages compile
|
|
# INSTEAD of php-src's bundled sapi/litespeed (measured 2026-10-21 on packaged
|
|
# lsphp81..85: the binaries carry LSAPI_MAX_CMD_SCRIPT_PATH_LEN, report
|
|
# "Copyright (c) 1997-2016" and phpversion('litespeed') = '' — all three are
|
|
# php-litespeed-8.3, none is php-src 8.5.12's sapi/litespeed).
|
|
# LiteSpeed publishes no signature for it; this sha256 was taken on 2026-10-21
|
|
# (Last-Modified: Sun, 07 Sep 2025 20:35:32 GMT) and lsphp-src-build.sh refuses
|
|
# any other file. lsphp-src-build.sh additionally checks that the resulting
|
|
# binary has the same LSAPI_* feature/env-name set as the packaged lsphp, so a
|
|
# LiteSpeed SAPI upgrade we have not pinned yet fails the build instead of
|
|
# shipping an older SAPI.
|
|
# <url> <sha256>
|
|
https://www.litespeedtech.com/packages/lsapi/php-litespeed-8.3.tgz cd616b82cc853e5e3187fccd060228b9cd1a2009ce72d8da5950eef950ac29b1
|