Php: PHP 7.1.32

[GrahamCampbell]

Will support for PHP 7.1.32 be landing soon?

[phy25]

Please see 406fcd31e62d633f62ac0d7bc5fc29aa1b3929fc, and https://github.com/docker-library/faq#an-images-source-changed-in-git-now-what

[GrahamCampbell]

Ah. ;)

[GrahamCampbell]

The time to getting the image available on the registry and a PHP tag on GitHub is very large. PHP 7.1.32 was tagged on 28th August 7AM GMT. It's now 3rd September, and the image is only just available. For PHP 7.3, the tag was on 27th August, and again, just available. That's 7 days to get the security fixes.

[tianon]

It was a major holiday weekend in the US 😉 (and I'm technically still on PTO even today)

(To quote some our good friends in the Node.js community when they did something similar, "the expected downstream effect.")

I also wasn't aware these were security updates -- weren't the last set as well? Were they announced as such on php.net?

[GrahamCampbell]

Yeh, it says security release on the pho.net homepage.

[tianon]

Ahh, now I recall better what's up here; php.net doesn't have an RSS feed for news, and the -announce mailing list isn't exactly actively used (August 1st being the most recent post I see online).

Is there some other way for us to subscribe to security notifications for the PHP project I'm not aware of?

[GrahamCampbell]

I'm not sure. @nikic will know.

[tianon]

(now that I'm at a computer) it does appear to have RSS/Atom now (with different content :smile:), although something that's focused on security updates would be nice -- perhaps another field in https://qa.php.net 's API?

[deguif]

Hi @tianon I think there is a problem with the push on docker hub (https://doi-janky.infosiftr.net/job/put-shared/job/heavy/):

+ perl/put-multiarch.sh library/php
Skipping php:7 (sha256:8cd5f3508dbbe9490e158930b212424fbf93b3e8ac77827748deb538c05da916)
Skipping php:7-alpine (sha256:2dd2f2a5aab4c9b5f1039508643b3126e635b6c41383f05fdac3801bdfe863d4)
Skipping php:7-alpine3.10 (sha256:2dd2f2a5aab4c9b5f1039508643b3126e635b6c41383f05fdac3801bdfe863d4)
Skipping php:7-alpine3.9 (sha256:7de8627eaf1b192766c4da5271d8089c153e8496d7b8f8080869d1777d8cc5e6)
Skipping php:7-apache (sha256:3314ed226566124b5a863b31c05b6f098f2dacad8ad52c40d53f08dc1ddce014)
Skipping php:7-apache-buster (sha256:3314ed226566124b5a863b31c05b6f098f2dacad8ad52c40d53f08dc1ddce014)
Skipping php:7-apache-stretch (sha256:24c18683b4dadba2b8b74c2acaccb0fec5f78a3e9cd7aaec798513ab2e6b8690)
Skipping php:7-buster (sha256:8cd5f3508dbbe9490e158930b212424fbf93b3e8ac77827748deb538c05da916)
Skipping php:7-cli (sha256:8cd5f3508dbbe9490e158930b212424fbf93b3e8ac77827748deb538c05da916)
Skipping php:7-cli-alpine (sha256:2dd2f2a5aab4c9b5f1039508643b3126e635b6c41383f05fdac3801bdfe863d4)
Skipping php:7-cli-alpine3.10 (sha256:2dd2f2a5aab4c9b5f1039508643b3126e635b6c41383f05fdac3801bdfe863d4)
Skipping php:7-cli-alpine3.9 (sha256:7de8627eaf1b192766c4da5271d8089c153e8496d7b8f8080869d1777d8cc5e6)
Skipping php:7-cli-buster (sha256:8cd5f3508dbbe9490e158930b212424fbf93b3e8ac77827748deb538c05da916)
Skipping php:7-cli-stretch (sha256:12b9489ca1921bf6a602039f56782b7f348bd2882781f9dc79b0b77dc5595a3f)
Skipping php:7-fpm (sha256:9bcbe5d5d5f914d8f0e22eb2f4a35bf4bbe294dc054601ede7324a2a08aea569)
Skipping php:7-fpm-alpine (sha256:27f59d5dd6c22a2ff8b394bd42737962fa99ca0a195fa7de34927350a67dca4a)
Skipping php:7-fpm-alpine3.10 (sha256:27f59d5dd6c22a2ff8b394bd42737962fa99ca0a195fa7de34927350a67dca4a)
Skipping php:7-fpm-alpine3.9 (sha256:879ef6d0da2480117d6e6a973c2aa6d61be6480d799c5d20d016cb59f0f5bdef)
Skipping php:7-fpm-buster (sha256:9bcbe5d5d5f914d8f0e22eb2f4a35bf4bbe294dc054601ede7324a2a08aea569)
Skipping php:7-fpm-stretch (sha256:07ca0ad1e083f6e31028cb9b4fe208a49b3688589865172d4fbed36da9660d42)
Skipping php:7-stretch (sha256:12b9489ca1921bf6a602039f56782b7f348bd2882781f9dc79b0b77dc5595a3f)
Skipping php:7-zts (sha256:fb88769f18caf5cff069459db689af3c4f1d0de45175c62f94609d513285b4dd)
Skipping php:7-zts-alpine (sha256:fd3e4be4711ec6e8c73c1b71e9d14ba3e175046750c78f594c8677ac33dbea03)
Skipping php:7-zts-alpine3.10 (sha256:fd3e4be4711ec6e8c73c1b71e9d14ba3e175046750c78f594c8677ac33dbea03)
Skipping php:7-zts-alpine3.9 (sha256:10bc5626293c0f6ab3d778fa82068e199555e7958e089bee57dc98c22e5e5e75)
Skipping php:7-zts-buster (sha256:fb88769f18caf5cff069459db689af3c4f1d0de45175c62f94609d513285b4dd)
Skipping php:7-zts-stretch (sha256:9f12ca84e9b4ee5d87bd5dddd283ac3706ebe1b4a4fe637a5ce7c61ef5da55e6)
Skipping php:7.1 (sha256:0d4b3bacbbf2403cbf56a98a7c25f9870f8638ec8f2fa0cbccb7484d2bbba7a9)
Skipping php:7.1-alpine (sha256:3c60c72da4448625369dab059973819c1c33020dea7e71d05d7c5f1792c542f1)
Skipping php:7.1-alpine3.10 (sha256:3c60c72da4448625369dab059973819c1c33020dea7e71d05d7c5f1792c542f1)
ERROR: unexpected response code HEADing blob 'php:7.1-alpine3.9@sha256:01ff3d9753e7cf69bb0f3f759c29130dcdc9164fbd0f97c70570bfdd13684a9d': 403 at /usr/local/lib/perl5/site_perl/5.28.2/Bashbrew/RegistryUserAgent.pm line 159.

Related also to https://github.com/docker-library/php/issues/883

[tianon]

Yeah, thanks for the prod, the infrastructure for updating manifest lists was struggling; I've manually pushed all the tags of php now and made a few adjustments that will hopefully lessen the chance of that in the future (but there is likely more tuning required).

[GrahamCampbell]

Will 7.4.0-RC1 be coming soon too?

[tianon]

As soon as qa.php.net is updated to list it,
https://doi-janky.infosiftr.net/job/update.sh/job/php/ will pick it up.

[GrahamCampbell]

Right. I expect that will happen tomorrow morning, UK time.

[deguif]

Thanks again @tianon
Nice to have the badge directly in the readme now ;)

[GrahamCampbell]

Whoops, I missread the NEWS file. It will be Sep 5th, not 4th. :P

[tianon]

7.4.0RC1 is up with https://github.com/docker-library/official-images/pull/6587 :+1:

[GrahamCampbell]

👍

[GrahamCampbell]

PHP 7.4.0RC2 was released yesterday.

[tianon]

Yep, and if you look at the automated update.sh job, you'll see that it's consistently failing to build: (https://doi-janky.infosiftr.net/job/update.sh/job/php/)

+ make install
Installing PHP SAPI module:       apache2handler
/usr/share/apache2/build/instdso.sh SH_LIBTOOL='/usr/share/apr-1.0/build/libtool' libphp7.la /usr/lib/apache2/modules
/usr/share/apr-1.0/build/libtool --mode=install install libphp7.la /usr/lib/apache2/modules/
libtool: install: install .libs/libphp7.so /usr/lib/apache2/modules/libphp7.so
libtool: install: install .libs/libphp7.lai /usr/lib/apache2/modules/libphp7.la
libtool: install: install .libs/libphp7.a /usr/lib/apache2/modules/libphp7.a
install: cannot stat '.libs/libphp7.a': No such file or directory
apxs:Error: Command failed with rc=65536
.
make: *** [Makefile:149: install-sapi] Error 1

(So someone needs to do the update locally, and dig into the failure to figure out what's changed and how we fix it or whether we need to file an issue upstream instead.)

[nikic]

@dstogov May this be related to PIC changes?

[tianon]

I think https://github.com/php/php-src/commit/db094b4b2e5ef0f0c30f412ce3a2516e31e17da7#diff-67e997bcfdac55191033d57a16d1408a is the likely candidate.

[dstogov]

Yes, this is related. I'll try to fix this today/tomorrow.

[dstogov]

Should be fixed by f633c347574c0d814050b4bf2493e0cac6a5988c

@petk
It seems, we use an old libtool 1.5.26 from 2008, while the last version 2.4.6 from 2014.
Some useful options are not available and/or don't work properly.
It may make sense to try updating libtool in master.

[tianon]

Nice, thanks @dstogov! I have verified the fix via (successfully!) building a Dockerfile off the following diff:

diff --git a/7.4-rc/buster/cli/Dockerfile b/7.4-rc/buster/cli/Dockerfile
index 16cb169..75eec0d 100644
--- a/7.4-rc/buster/cli/Dockerfile
+++ b/7.4-rc/buster/cli/Dockerfile
@@ -63,9 +63,9 @@ ENV PHP_LDFLAGS="-Wl,-O1 -Wl,--hash-style=both -pie"

 ENV GPG_KEYS 42670A7FE4D0441C8E4632349E4FDC074A4EF02D 5A52880781F755608BF815FC910DEB46F53EA312

-ENV PHP_VERSION 7.4.0RC1
-ENV PHP_URL="https://downloads.php.net/~derick/php-7.4.0RC1.tar.xz" PHP_ASC_URL="https://downloads.php.net/~derick/php-7.4.0RC1.tar.xz.asc"
-ENV PHP_SHA256="9e3d158ad070968ad9d9e796a7acf88c3cfe0e0382e991e6dee05a18049d4a62" PHP_MD5=""
+ENV PHP_VERSION 7.4.0RC2
+ENV PHP_URL="https://downloads.php.net/~derick/php-7.4.0RC2.tar.xz" PHP_ASC_URL="https://downloads.php.net/~derick/php-7.4.0RC2.tar.xz.asc"
+ENV PHP_SHA256="90483cc337f713d958018d9188b26852949470ca700cc0b7c80877d3363512c3" PHP_MD5=""

 RUN set -eux; \
        \
@@ -128,6 +128,7 @@ RUN set -eux; \
        ; \
        docker-php-source extract; \
        cd /usr/src/php; \
+       wget -qO- 'https://github.com/php/php-src/commit/f633c347574c0d814050b4bf2493e0cac6a5988c.patch' | patch -p1; \
        gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
        debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
 # https://bugs.php.net/bug.php?id=74125

Do you think getting a build of 7.4.0RC2 out is important enough that we should apply this patch locally, or should we just wait for the release of RC3 instead? (I guess in other words, what's the expected timeline for RC3?)

[dstogov]

RC3 is going to be available only in two weeks
https://wiki.php.net/todo/php74

[GrahamCampbell]

I still think it's worth getting RC2. There are a bunch of bugs fixed since RC1. In particular, there's one affecting the laravel/laravel default app not being able to start up on RC1.

NB The release schedule has always been 2 weeks between each alpha, beta, and RC release (and 1 month between each stable release).