Repository navigation
feat: ship patched PHP images without the official php images - #40
Merged
Merged
Conversation
- Add build-base.yml. It builds the docker-library php:<minor>-fpm-alpine image with a PHP version that the official images do not have yet. - Build amd64 and arm64 on native runners, push by digest, then merge into <org>/php-base:<minor>-fpm-alpine and <org>/php-base:<version>-fpm-alpine. - Keep the sha256 check and the GPG check of the .asc file. - Add ARG BASE_IMAGE to php/Dockerfile for the builder and final stages.
- Build each arch on a native runner (amd64 on ubuntu-latest, arm64 on ubuntu-24.04-arm). Push by digest, then merge the manifest list. - Remove QEMU from the PHP and OLS builds. Run the structure test on both arches. - Add workflow_dispatch inputs: php_versions, base_image, tag_suffix, openlitespeed. - Pass the PHP image to the builder image, so a test tag builds on a test tag. - Set cancel-in-progress to false. A push to main must not cancel a release run. - Retry each install-php-extensions call 5 times, 30 seconds apart.
- Add -n to the jq version check in deploy.yml. Without it, jq waits for input and every version is rejected. - Set pipefail in build-base.yml, so a bad version or sha256 stops the run. - Run the base dry run on the PR only when the test-base-image label is added. Before, each push to the PR started a new 15-minute base build.
- PHP advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) names session upload progress as a confirmed exploit path. - PHP advises to keep it disabled after the patch when the feature is unused. - PHP image: conf.d/zz-security.ini, and an FPM php_admin_flag so a site .user.ini cannot enable it again. - OLS image: mods-available/zz-security.ini. - Structure tests check the effective value and the FPM pool file.
- The final stage copies only /usr/local/etc/php from the builder stage. - /usr/local/etc/php-fpm.d/zz-security.conf was lost, and the structure test failed.
itsrafsanjani
force-pushed
the
fix/cve-php-base-pipeline
branch
from
October 21, 2026 14:29
334021f to
44e917e
Compare
itsrafsanjani
marked this pull request as ready for review
October 21, 2026 14:57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
php:*-fpm-alpineimages come some hours after php.net. We must not wait for them.pecl.php.netreturned 504 and "No releases available". All PHP jobs of run 39570023231 failed.What changes
build-base.yml:<minor>/alpine3.24/fpmfrom onedocker-library/phpmaster commit.PHP_VERSION,PHP_URL,PHP_ASC_URLandPHP_SHA256. Stops if a line does not match..ascfile.PHP_VERSIONin the image. Pushes by digest.<org>/php-base:<prefix><minor>-fpm-alpineand<org>/php-base:<prefix><version>-fpm-alpine.php_versionandphp_sha256(lists, same order),tag_prefix,alpine.php/Dockerfile: newARG BASE_IMAGE(defaultphp:${PHP_VERSION}-fpm-alpine) for the builder and final stages. Thecli-alpinestages do not change.php/retry.sh: retries eachinstall-php-extensionscall 5 times, 30 s apart, then fails.deploy.yml:workflow_dispatchinputs:php_versions,base_image,tag_suffix,openlitespeed.build-builderruns aftermerge-phpand uses the PHP image with the same tag suffix.cancel-in-progress: false. A push tomainmust not cancel a release run.builder/Dockerfile: newARG PHP_IMAGE, so a test tag builds on a test tag.Dry run (8.2.34, test tags only)
Risks
mainor the 1st/15th cron rebuildsmeghsh/php:<minor>from the official images. Before the official images have the patch, this reverts the fix. Merge this PR with[skip ci]in the commit subject.build-base.ymlalso runs on a PR when thetest-base-imagelabel is added. It builds 8.2.34 withtest-tags only..asc, the base build fails at the GPG step. This is intentional.