shadowdaoandClaude Opus 5.5
83c2ee9c2a
For when a PHP security release is out and the LiteSpeed apt repo lags (2026-10-21: php2shell CVE-2026-109618/-109619 fixed in 8.2.35/8.3.36/ 8.4.27/8.5.12, LiteSpeed still on 8.2.34/8.3.35/8.4.26/8.5.11). Dockerfile.lsphp / Dockerfile.litespeed gain an `lsphp-src` stage that is idle unless PHP_SRC_VERSION is set; normal builds are unchanged (measured: module list, file manifest, ldd, ini and dpkg identical to the published images). When set (lsphp-src-build.sh): - tarball sha256 (php.net releases JSON) + OpenPGP signature against the committed php.net keyring, signer pinned per branch - configure flags replayed from the packaged lsphp's own Configure Command - LiteSpeed's php-litespeed-8.3 SAPI (what the packages actually compile, measured) instead of php-src's sapi/litespeed; sha256-pinned and checked against the packaged binary's LSAPI_* names - packaged compiled-in ini defaults reproduced (session.save_path on 8.2/ 8.3) and gated (`php -n` diff) - ABI gate (lsphp-abi-gate.sh, pahole) before reusing LiteSpeed's packaged PECL .so files; regression-tested in Shell-Checks lsphp-src-overlay.sh swaps only php-src-owned files (decided by dpkg) and fails the build unless extensions, versions, effective ini and feature lines match the packaged lsphp under both CLI and litespeed SAPIs. CI: lsphp-source-emergency.yaml (workflow_dispatch only). build-push.yaml refuses to overwrite a newer php.net image with an older packaged one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
48 lines
2.9 KiB
PHP
48 lines
2.9 KiB
PHP
<?php
|
|
// lsphp-src-probe.php — prints the runtime "support surface" of the PHP that
|
|
// runs it, one fact per line, for lsphp-src-overlay.sh to diff before/after the
|
|
// php.net overlay. Run under BOTH SAPIs: `bin/php probe.php` and
|
|
// `bin/lsphp probe.php` (lsphp executes a script argument under the litespeed
|
|
// SAPI — measured; it is only `-m`/`-r` it does not understand).
|
|
// Line kinds: SAPI <name> | VERSION <v> | EXT <name> <version> | ZEXT <name> <version>
|
|
// INI <name> <value> | FEAT <key> <value>
|
|
// The overlay script relies on the stable "<KIND> <key> <rest>" shape; keep it.
|
|
echo 'SAPI ', PHP_SAPI, "\n";
|
|
echo 'VERSION ', PHP_VERSION, "\n";
|
|
echo 'FEAT ZTS ', PHP_ZTS, "\n";
|
|
echo 'FEAT DEBUG ', PHP_DEBUG, "\n";
|
|
echo 'FEAT INT_SIZE ', PHP_INT_SIZE, "\n";
|
|
foreach (get_loaded_extensions() as $e) {
|
|
echo 'EXT ', str_replace(' ', '_', $e), ' ', phpversion($e), "\n";
|
|
}
|
|
foreach (get_loaded_extensions(true) as $e) {
|
|
echo 'ZEXT ', str_replace(' ', '_', $e), ' ', phpversion($e), "\n";
|
|
}
|
|
foreach (ini_get_all(null, false) as $k => $v) {
|
|
echo 'INI ', $k, ' ', var_export($v, true), "\n";
|
|
}
|
|
if (function_exists('gd_info')) {
|
|
foreach (gd_info() as $k => $v) {
|
|
echo 'FEAT gd:', str_replace(' ', '_', $k), ' ', var_export($v, true), "\n";
|
|
}
|
|
}
|
|
if (function_exists('curl_version')) {
|
|
$c = curl_version();
|
|
echo 'FEAT curl:version ', $c['version'], "\n";
|
|
echo 'FEAT curl:ssl ', $c['ssl_version'], "\n";
|
|
echo 'FEAT curl:protocols ', implode(',', $c['protocols']), "\n";
|
|
}
|
|
echo 'FEAT openssl ', defined('OPENSSL_VERSION_TEXT') ? OPENSSL_VERSION_TEXT : 'none', "\n";
|
|
if (defined('INTL_ICU_VERSION')) echo 'FEAT icu ', INTL_ICU_VERSION, "\n";
|
|
if (class_exists('Imagick')) echo 'FEAT imagick:formats ', count(Imagick::queryFormats()), "\n";
|
|
if (function_exists('sodium_crypto_aead_aes256gcm_is_available')) echo 'FEAT sodium:aes256gcm ', var_export(sodium_crypto_aead_aes256gcm_is_available(), true), "\n";
|
|
echo 'FEAT password_algos ', implode(',', password_algos()), "\n";
|
|
echo 'FEAT hash_algos ', count(hash_algos()), "\n";
|
|
echo 'FEAT stream_wrappers ', implode(',', stream_get_wrappers()), "\n";
|
|
echo 'FEAT stream_filters ', implode(',', stream_get_filters()), "\n";
|
|
if (function_exists('mb_list_encodings')) echo 'FEAT mb_encodings ', count(mb_list_encodings()), "\n";
|
|
if (function_exists('opcache_get_status')) echo 'FEAT opcache:loaded 1', "\n";
|
|
if (class_exists('Redis')) echo 'FEAT redis:serializers ', implode(',', array_filter(['IGBINARY', 'MSGPACK', 'JSON'], fn($s) => defined("Redis::SERIALIZER_$s"))), "\n";
|
|
if (class_exists('Redis')) echo 'FEAT redis:compression ', implode(',', array_filter(['LZF', 'ZSTD', 'LZ4'], fn($s) => defined("Redis::COMPRESSION_$s"))), "\n";
|
|
if (class_exists('Memcached')) echo 'FEAT memcached:igbinary ', var_export(Memcached::HAVE_IGBINARY, true), ' msgpack ', var_export(Memcached::HAVE_MSGPACK, true), ' sasl ', var_export(Memcached::HAVE_SASL, true), "\n";
|