From 43ce9a2b4f9c0878d38d9b064b2c5fc47f04cf7b Mon Sep 17 00:00:00 2001 From: Remi Collet Date: Wed, 11 May 2022 10:48:41 +0200 Subject: dup 8.1 --- .gitignore | 9 + 10-opcache.ini | 153 ++ 20-ffi.ini | 13 + 20-oci8.ini | 53 + Makefile | 6 + clog | 3 + failed.txt | 20 + macros.php | 16 + opcache-default.blacklist | 11 + php-7.0.0-odbctimer.patch | 45 + php-7.0.7-curl.patch | 15 + php-7.2.0-includedir.patch | 11 + php-7.2.0-oci8conf.patch | 35 + php-7.4.0-datetests.patch | 98 + php-7.4.0-httpd.patch | 27 + php-7.4.0-ldap_r.patch | 19 + php-7.4.0-libdb.patch | 92 + php-7.4.0-phpize.patch | 35 + php-8.0.0-embed.patch | 25 + php-8.0.0-phpinfo.patch | 118 + php-8.0.10-openssl3.patch | 4761 ++++++++++++++++++++++++++++++++++++++++ php-8.0.10-phar-sha.patch | 515 +++++ php-8.0.10-snmp-sha.patch | 143 ++ php-8.0.10-systzdata-v21.patch | 718 ++++++ php-8.0.13-crypt.patch | 45 + php-8.0.19-parser.patch | 16 + php-8.0.6-deprecated.patch | 400 ++++ php-8.0.7-argon2.patch | 15 + php-fpm-www.conf | 438 ++++ php-fpm.conf | 137 ++ php-fpm.logrotate | 9 + php-fpm.service | 18 + php-fpm.sysconfig | 14 + php-fpm.wants | 3 + php-keyring.gpg | 415 ++++ php.conf | 52 + php.conf2 | 14 + php.ini | 1666 ++++++++++++++ php.modconf | 14 + php.spec | 3841 ++++++++++++++++++++++++++++++++ 40 files changed, 14038 insertions(+) create mode 100644 .gitignore create mode 100644 10-opcache.ini create mode 100644 20-ffi.ini create mode 100644 20-oci8.ini create mode 100644 Makefile create mode 100644 clog create mode 100644 failed.txt create mode 100644 macros.php create mode 100644 opcache-default.blacklist create mode 100644 php-7.0.0-odbctimer.patch create mode 100644 php-7.0.7-curl.patch create mode 100644 php-7.2.0-includedir.patch create mode 100644 php-7.2.0-oci8conf.patch create mode 100644 php-7.4.0-datetests.patch create mode 100644 php-7.4.0-httpd.patch create mode 100644 php-7.4.0-ldap_r.patch create mode 100644 php-7.4.0-libdb.patch create mode 100644 php-7.4.0-phpize.patch create mode 100644 php-8.0.0-embed.patch create mode 100644 php-8.0.0-phpinfo.patch create mode 100644 php-8.0.10-openssl3.patch create mode 100644 php-8.0.10-phar-sha.patch create mode 100644 php-8.0.10-snmp-sha.patch create mode 100644 php-8.0.10-systzdata-v21.patch create mode 100644 php-8.0.13-crypt.patch create mode 100644 php-8.0.19-parser.patch create mode 100644 php-8.0.6-deprecated.patch create mode 100644 php-8.0.7-argon2.patch create mode 100644 php-fpm-www.conf create mode 100644 php-fpm.conf create mode 100644 php-fpm.logrotate create mode 100644 php-fpm.service create mode 100644 php-fpm.sysconfig create mode 100644 php-fpm.wants create mode 100644 php-keyring.gpg create mode 100644 php.conf create mode 100644 php.conf2 create mode 100644 php.ini create mode 100644 php.modconf create mode 100644 php.spec diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..01f0400 --- /dev/null +++ b/.gitignore @@ -0,0 +1,9 @@ +clog +package-*.xml +*.tgz +*.tar.bz2 +*.tar.gz +*.tar.xz +*.tar.xz.asc +*.src.rpm +*/*rpm diff --git a/10-opcache.ini b/10-opcache.ini new file mode 100644 index 0000000..a5be172 --- /dev/null +++ b/10-opcache.ini @@ -0,0 +1,153 @@ +; Enable Zend OPcache extension module +zend_extension=opcache + +; Determines if Zend OPCache is enabled +opcache.enable=1 + +; Determines if Zend OPCache is enabled for the CLI version of PHP +opcache.enable_cli=1 + +; The OPcache shared memory storage size. +;opcache.memory_consumption=128 + +; The amount of memory for interned strings in Mbytes. +;opcache.interned_strings_buffer=8 + +; The maximum number of keys (scripts) in the OPcache hash table. +; Only numbers between 200 and 1000000 are allowed. +;opcache.max_accelerated_files=10000 + +; The maximum percentage of "wasted" memory until a restart is scheduled. +;opcache.max_wasted_percentage=5 + +; When this directive is enabled, the OPcache appends the current working +; directory to the script key, thus eliminating possible collisions between +; files with the same name (basename). Disabling the directive improves +; performance, but may break existing applications. +;opcache.use_cwd=1 + +; When disabled, you must reset the OPcache manually or restart the +; webserver for changes to the filesystem to take effect. +;opcache.validate_timestamps=1 + +; How often (in seconds) to check file timestamps for changes to the shared +; memory storage allocation. ("1" means validate once per second, but only +; once per request. "0" means always validate) +;opcache.revalidate_freq=2 + +; Enables or disables file search in include_path optimization +;opcache.revalidate_path=0 + +; If disabled, all PHPDoc comments are dropped from the code to reduce the +; size of the optimized code. +;opcache.save_comments=1 + +; If enabled, compilation warnings (including notices and deprecations) will +; be recorded and replayed each time a file is included. Otherwise, compilation +; warnings will only be emitted when the file is first cached. +;opcache.record_warnings=0 + +; Allow file existence override (file_exists, etc.) performance feature. +;opcache.enable_file_override=0 + +; A bitmask, where each bit enables or disables the appropriate OPcache +; passes +;opcache.optimization_level=0x7FFFBFFF + +; This hack should only be enabled to work around "Cannot redeclare class" +; errors. +;opcache.dups_fix=0 + +; The location of the OPcache blacklist file (wildcards allowed). +; Each OPcache blacklist file is a text file that holds the names of files +; that should not be accelerated. +opcache.blacklist_filename=/etc/php.d/opcache*.blacklist + +; Allows exclusion of large files from being cached. By default all files +; are cached. +;opcache.max_file_size=0 + +; Check the cache checksum each N requests. +; The default value of "0" means that the checks are disabled. +;opcache.consistency_checks=0 + +; How long to wait (in seconds) for a scheduled restart to begin if the cache +; is not being accessed. +;opcache.force_restart_timeout=180 + +; OPcache error_log file name. Empty string assumes "stderr". +;opcache.error_log= + +; All OPcache errors go to the Web server log. +; By default, only fatal errors (level 0) or errors (level 1) are logged. +; You can also enable warnings (level 2), info messages (level 3) or +; debug messages (level 4). +;opcache.log_verbosity_level=1 + +; Preferred Shared Memory back-end. Leave empty and let the system decide. +;opcache.preferred_memory_model= + +; Protect the shared memory from unexpected writing during script execution. +; Useful for internal debugging only. +;opcache.protect_memory=0 + +; Allows calling OPcache API functions only from PHP scripts which path is +; started from specified string. The default "" means no restriction +;opcache.restrict_api= + +; Enables and sets the second level cache directory. +; It should improve performance when SHM memory is full, at server restart or +; SHM reset. The default "" disables file based caching. +; RPM note : file cache directory must be owned by process owner +; for mod_php, see /etc/httpd/conf.d/php.conf +; for php-fpm, see /etc/php-fpm.d/*conf +;opcache.file_cache= + +; Enables or disables opcode caching in shared memory. +;opcache.file_cache_only=0 + +; Enables or disables checksum validation when script loaded from file cache. +;opcache.file_cache_consistency_checks=1 + +; Implies opcache.file_cache_only=1 for a certain process that failed to +; reattach to the shared memory (for Windows only). Explicitly enabled file +; cache is required. +;opcache.file_cache_fallback=1 + +; Enables or disables copying of PHP code (text segment) into HUGE PAGES. +; This should improve performance, but requires appropriate OS configuration. +opcache.huge_code_pages=0 + +; Validate cached file permissions. +; Leads OPcache to check file readability on each access to cached file. +; This directive should be enabled in shared hosting environment, when few +; users (PHP-FPM pools) reuse the common OPcache shared memory. +;opcache.validate_permission=0 + +; Prevent name collisions in chroot'ed environment. +; This directive prevents file name collisions in different "chroot" +; environments. It should be enabled for sites that may serve requests in +; different "chroot" environments. +;opcache.validate_root=0 + +; If specified, it produces opcode dumps for debugging different stages of +; optimizations. +;opcache.opt_debug_level=0 + +; Specifies a PHP script that is going to be compiled and executed at server +; start-up. +; http://php.net/opcache.preload +;opcache.preload= + +; Preloading code as root is not allowed for security reasons. This directive +; facilitates to let the preloading to be run as another user. +; http://php.net/opcache.preload_user +;opcache.preload_user= + +; Prevents caching files that are less than this number of seconds old. It +; protects from caching of incompletely updated files. In case all file updates +; on your site are atomic, you may increase performance by setting it to "0". +;opcache.file_update_protection=2 + +; Absolute path used to store shared lockfiles (for *nix only). +;opcache.lockfile_path=/tmp diff --git a/20-ffi.ini b/20-ffi.ini new file mode 100644 index 0000000..0bce40d --- /dev/null +++ b/20-ffi.ini @@ -0,0 +1,13 @@ +; Enable ffi extension module +extension=ffi + +; FFI API restriction. Possibe values: +; "preload" - enabled in CLI scripts and preloaded files (default) +; "false" - always disabled +; "true" - always enabled +;ffi.enable=preload + +; List of headers files to preload, wildcard patterns allowed. +; /usr/share/php/preload used by for RPM packages +; /usr/local/share/php/preload may be used for local files +ffi.preload=/usr/share/php/preload/*.h:/usr/local/share/php/preload/*.h diff --git a/20-oci8.ini b/20-oci8.ini new file mode 100644 index 0000000..46e0668 --- /dev/null +++ b/20-oci8.ini @@ -0,0 +1,53 @@ +; Enable oci8 extension module +extension=oci8 + +; Connection: Enables privileged connections using external +; credentials (OCI_SYSOPER, OCI_SYSDBA) +; http://php.net/oci8.privileged-connect +;oci8.privileged_connect = Off + +; Connection: The maximum number of persistent OCI8 connections per +; process. Using -1 means no limit. +; http://php.net/oci8.max-persistent +;oci8.max_persistent = -1 + +; Connection: The maximum number of seconds a process is allowed to +; maintain an idle persistent connection. Using -1 means idle +; persistent connections will be maintained forever. +; http://php.net/oci8.persistent-timeout +;oci8.persistent_timeout = -1 + +; Connection: The number of seconds that must pass before issuing a +; ping during oci_pconnect() to check the connection validity. When +; set to 0, each oci_pconnect() will cause a ping. Using -1 disables +; pings completely. +; http://php.net/oci8.ping-interval +;oci8.ping_interval = 60 + +; Connection: Set this to a user chosen connection class to be used +; for all pooled server requests with Oracle 11g Database Resident +; Connection Pooling (DRCP). To use DRCP, this value should be set to +; the same string for all web servers running the same application, +; the database pool must be configured, and the connection string must +; specify to use a pooled server. +;oci8.connection_class = + +; High Availability: Using On lets PHP receive Fast Application +; Notification (FAN) events generated when a database node fails. The +; database must also be configured to post FAN events. +;oci8.events = Off + +; Tuning: This option enables statement caching, and specifies how +; many statements to cache. Using 0 disables statement caching. +; http://php.net/oci8.statement-cache-size +;oci8.statement_cache_size = 20 + +; Tuning: Enables statement prefetching and sets the default number of +; rows that will be fetched automatically after statement execution. +; http://php.net/oci8.default-prefetch +;oci8.default_prefetch = 100 + +; Compatibility. Using On means oci_close() will not close +; oci_connect() and oci_new_connect() connections. +; http://php.net/oci8.old-oci-close-semantics +;oci8.old_oci_close_semantics = Off diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..a5696eb --- /dev/null +++ b/Makefile @@ -0,0 +1,6 @@ +SRCDIR := $(shell pwd) +NAME := $(shell basename $(SRCDIR)) +include ../../common/Makefile + +srpm: + rpmbuild $(RPMDEFINES) $(SRCDEFINES) --define 'scl php80' -bs $(NAME).spec diff --git a/clog b/clog new file mode 100644 index 0000000..9f3046c --- /dev/null +++ b/clog @@ -0,0 +1,3 @@ +Update to 8.0.19 - http://www.php.net/releases/8_0_19.php + +use oracle client library version 21.6 diff --git a/failed.txt b/failed.txt new file mode 100644 index 0000000..1495908 --- /dev/null +++ b/failed.txt @@ -0,0 +1,20 @@ +===== 8.0.19 (2022-05-12) + +$ grep -ar 'Tests failed' /var/lib/mock/*/build.log + +/var/lib/mock/scl80el7x/build.log:Tests failed : 0 +/var/lib/mock/scl80el8x/build.log:Tests failed : 0 +/var/lib/mock/scl80el9x/build.log:Tests failed : 0 +/var/lib/mock/scl80fc34x/build.log:Tests failed : 0 +/var/lib/mock/scl80fc35x/build.log:Tests failed : 0 +/var/lib/mock/scl80fc36x/build.log:Tests failed : 0 + + + + +(1) proc_open give erratic test results :( +(2) test issue (fixed upstream) +(3) known issue +(4) related to tzdata +(5) need investigation +(6) // issue diff --git a/macros.php b/macros.php new file mode 100644 index 0000000..3943a74 --- /dev/null +++ b/macros.php @@ -0,0 +1,16 @@ +# +# Interface versions exposed by PHP: +# +%@SCL@php_core_api @PHP_APIVER@ +%@SCL@php_zend_api @PHP_ZENDVER@ +%@SCL@php_pdo_api @PHP_PDOVER@ +%@SCL@php_version @PHP_VERSION@ + +%@SCL@php_extdir @LIBDIR@/php/modules + +%@SCL@php_inidir @ETCDIR@/php.d + +%@SCL@php_incldir @INCDIR@/php + +%@SCL@__php @BINDIR@/php + diff --git a/opcache-default.blacklist b/opcache-default.blacklist new file mode 100644 index 0000000..0cc2e18 --- /dev/null +++ b/opcache-default.blacklist @@ -0,0 +1,11 @@ +; The blacklist file is a text file that holds the names of files +; that should not be accelerated. The file format is to add each filename +; to a new line. The filename may be a full path or just a file prefix +; (i.e., /var/www/x blacklists all the files and directories in /var/www +; that start with 'x'). Line starting with a ; are ignored (comments). +; Files are usually triggered by one of the following three reasons: +; 1) Directories that contain auto generated code, like Smarty or ZFW cache. +; 2) Code that does not work well when accelerated, due to some delayed +; compile time evaluation. +; 3) Code that triggers an OPcache bug. + diff --git a/php-7.0.0-odbctimer.patch b/php-7.0.0-odbctimer.patch new file mode 100644 index 0000000..18bcf0f --- /dev/null +++ b/php-7.0.0-odbctimer.patch @@ -0,0 +1,45 @@ +diff -up php-7.0.0RC1/ext/odbc/php_odbc.c.odbctimer php-7.0.0RC1/ext/odbc/php_odbc.c +--- php-7.0.0RC1/ext/odbc/php_odbc.c.odbctimer 2015-08-18 23:39:26.000000000 +0200 ++++ php-7.0.0RC1/ext/odbc/php_odbc.c 2015-08-22 07:44:51.170196466 +0200 +@@ -434,7 +434,8 @@ static void _free_odbc_result(zend_resou + efree(res->values); + res->values = NULL; + } +- if (res->stmt) { ++ /* If aborted via timer expiration, don't try to call any unixODBC function */ ++ if (res->stmt && !(PG(connection_status) & PHP_CONNECTION_TIMEOUT)) { + #if defined(HAVE_SOLID) || defined(HAVE_SOLID_30) || defined(HAVE_SOLID_35) + SQLTransact(res->conn_ptr->henv, res->conn_ptr->hdbc, + (SQLUSMALLINT) SQL_COMMIT); +@@ -484,9 +485,12 @@ static void _close_odbc_conn(zend_resour + } + } ZEND_HASH_FOREACH_END(); + +- safe_odbc_disconnect(conn->hdbc); +- SQLFreeConnect(conn->hdbc); +- SQLFreeEnv(conn->henv); ++ /* If aborted via timer expiration, don't try to call any unixODBC function */ ++ if (!(PG(connection_status) & PHP_CONNECTION_TIMEOUT)) { ++ safe_odbc_disconnect(conn->hdbc); ++ SQLFreeConnect(conn->hdbc); ++ SQLFreeEnv(conn->henv); ++ } + efree(conn); + ODBCG(num_links)--; + } +@@ -509,9 +513,12 @@ static void _close_odbc_pconn(zend_resou + } + } ZEND_HASH_FOREACH_END(); + +- safe_odbc_disconnect(conn->hdbc); +- SQLFreeConnect(conn->hdbc); +- SQLFreeEnv(conn->henv); ++ /* If aborted via timer expiration, don't try to call any unixODBC function */ ++ if (!(PG(connection_status) & PHP_CONNECTION_TIMEOUT)) { ++ safe_odbc_disconnect(conn->hdbc); ++ SQLFreeConnect(conn->hdbc); ++ SQLFreeEnv(conn->henv); ++ } + free(conn); + + ODBCG(num_links)--; diff --git a/php-7.0.7-curl.patch b/php-7.0.7-curl.patch new file mode 100644 index 0000000..218db98 --- /dev/null +++ b/php-7.0.7-curl.patch @@ -0,0 +1,15 @@ +diff -up php-7.0.7RC1/ext/curl/interface.c.curltls php-7.0.7RC1/ext/curl/interface.c +--- php-7.0.7RC1/ext/curl/interface.c.curltls 2016-05-10 17:28:33.000000000 +0200 ++++ php-7.0.7RC1/ext/curl/interface.c 2016-05-12 07:43:00.900419946 +0200 +@@ -1257,7 +1257,11 @@ PHP_MINIT_FUNCTION(curl) + + #if LIBCURL_VERSION_NUM >= 0x072200 /* Available since 7.34.0 */ + REGISTER_CURL_CONSTANT(CURLOPT_LOGIN_OPTIONS); ++#endif + ++#if LIBCURL_VERSION_NUM >= 0x071300 /* Available since 7.19.0 (in upstream curl 7.34) ++ backported in RHEL-7 curl-7.29.0-16.el7 rhbz#1012136 ++ backported in RHEL-6 curl-7.19.7-43.el6 rhbz#1036789 */ + REGISTER_CURL_CONSTANT(CURL_SSLVERSION_TLSv1_0); + REGISTER_CURL_CONSTANT(CURL_SSLVERSION_TLSv1_1); + REGISTER_CURL_CONSTANT(CURL_SSLVERSION_TLSv1_2); diff --git a/php-7.2.0-includedir.patch b/php-7.2.0-includedir.patch new file mode 100644 index 0000000..7a42cd6 --- /dev/null +++ b/php-7.2.0-includedir.patch @@ -0,0 +1,11 @@ +--- php-7.2.0/configure.ac.includedir ++++ php-7.2.0/configure.ac +@@ -1230,7 +1230,7 @@ + EXPANDED_DATADIR=$datadir + EXPANDED_PHP_CONFIG_FILE_PATH=`eval echo "$PHP_CONFIG_FILE_PATH"` + EXPANDED_PHP_CONFIG_FILE_SCAN_DIR=`eval echo "$PHP_CONFIG_FILE_SCAN_DIR"` +-INCLUDE_PATH=.:$EXPANDED_PEAR_INSTALLDIR ++INCLUDE_PATH=.:$EXPANDED_PEAR_INSTALLDIR:${EXPANDED_DATADIR}/php:/usr/share/pear:/usr/share/php + + exec_prefix=$old_exec_prefix + libdir=$old_libdir diff --git a/php-7.2.0-oci8conf.patch b/php-7.2.0-oci8conf.patch new file mode 100644 index 0000000..0ad16a1 --- /dev/null +++ b/php-7.2.0-oci8conf.patch @@ -0,0 +1,35 @@ +diff -up ./ext/ldap/php_ldap.h.remi-oci8 ./ext/ldap/php_ldap.h +--- ./ext/ldap/php_ldap.h.remi-oci8 2017-06-20 15:45:35.000000000 +0200 ++++ ./ext/ldap/php_ldap.h 2017-06-20 16:55:01.640203868 +0200 +@@ -27,7 +27,7 @@ + #include + #endif + +-#include ++#include "/usr/include/ldap.h" + + extern zend_module_entry ldap_module_entry; + #define ldap_module_ptr &ldap_module_entry +diff -up ./ext/oci8/config.m4.remi-oci8 ./ext/oci8/config.m4 +--- ./ext/oci8/config.m4.remi-oci8 2017-06-20 15:45:39.000000000 +0200 ++++ ./ext/oci8/config.m4 2017-06-20 16:55:01.640203868 +0200 +@@ -372,6 +372,7 @@ if test "$PHP_OCI8" != "no"; then + + dnl Header directory for Instant Client SDK RPM install + OCISDKRPMINC=`echo "$PHP_OCI8_INSTANT_CLIENT" | $PHP_OCI8_SED -e 's!^/usr/lib/oracle/\(.*\)/client\('${PHP_OCI8_IC_LIBDIR_SUFFIX}'\)*/lib[/]*$!/usr/include/oracle/\1/client\2!'` ++ OCISDKRPMINC=`echo "$PHP_OCI8_INSTANT_CLIENT" | $PHP_OCI8_SED -e 's!^/usr/\(lib64\|lib\)/oracle/\(.*\)/\(client64\|client\)/lib[/]*$!/usr/include/oracle/\2/\3!'` + + dnl Header directory for Instant Client SDK zip file install + OCISDKZIPINC=$PHP_OCI8_INSTANT_CLIENT/sdk/include +diff -up ./ext/pdo_oci/config.m4.remi-oci8 ./ext/pdo_oci/config.m4 +--- ./ext/pdo_oci/config.m4.remi-oci8 2017-06-20 16:55:01.640203868 +0200 ++++ ./ext/pdo_oci/config.m4 2017-06-20 17:16:03.053538358 +0200 +@@ -93,7 +93,7 @@ if test "$PHP_PDO_OCI" != "no"; then + + AC_MSG_CHECKING([for oci.h]) + dnl Header directory for Instant Client SDK RPM install +- OCISDKRPMINC=`echo "$PDO_OCI_LIB_DIR" | $PHP_PDO_OCI_SED -e 's!^\(.*\)/lib/oracle/\(.*\)/\('${PDO_OCI_CLIENT_DIR}'\)/lib[/]*$!\1/include/oracle/\2/\3!'` ++ OCISDKRPMINC=`echo "$PDO_OCI_LIB_DIR" | $PHP_PDO_OCI_SED -e 's!^\(.*\)/\(lib64\|lib\)/oracle/\(.*\)/\('${PDO_OCI_CLIENT_DIR}'\)/lib[/]*$!\1/include/oracle/\3/\4!'` + + dnl Header directory for manual installation + OCISDKMANINC=`echo "$PDO_OCI_LIB_DIR" | $PHP_PDO_OCI_SED -e 's!^\(.*\)/lib[/]*$!\1/include!'` diff --git a/php-7.4.0-datetests.patch b/php-7.4.0-datetests.patch new file mode 100644 index 0000000..8c437e5 --- /dev/null +++ b/php-7.4.0-datetests.patch @@ -0,0 +1,98 @@ +diff -up ./ext/date/tests/bug33414-2.phpt.datetests ./ext/date/tests/bug33414-2.phpt +--- ./ext/date/tests/bug33414-2.phpt.datetests 2020-04-09 14:06:11.000000000 +0200 ++++ ./ext/date/tests/bug33414-2.phpt 2020-04-09 14:40:00.809433489 +0200 +@@ -74,10 +74,10 @@ $strtotime_tstamp = strtotime("next Frid + print "result=".date("l Y-m-d H:i:s T I", $strtotime_tstamp)."\n"; + print "wanted=Friday 00:00:00\n\n"; + ?> +---EXPECT-- ++--EXPECTF-- + TZ=Pacific/Rarotonga - wrong day. +-tStamp=Thursday 1970-01-01 17:17:17 -1030 0 +-result=Tuesday 1970-01-06 00:00:00 -1030 0 ++tStamp=Thursday 1970-01-01 17:17:17 %s ++result=Tuesday 1970-01-06 00:00:00 %s + wanted=Tuesday 00:00:00 + + TZ=Atlantic/South_Georgia - wrong day. +@@ -91,13 +91,13 @@ result=Monday 2005-04-04 00:00:00 EDT 1 + wanted=Monday 00:00:00 + + TZ=Pacific/Enderbury - wrong day, off by 2 days. +-tStamp=Thursday 1970-01-01 17:17:17 -12 0 +-result=Monday 1970-01-05 00:00:00 -12 0 ++tStamp=Thursday 1970-01-01 17:17:17 %s ++result=Monday 1970-01-05 00:00:00 %s + wanted=Monday 00:00:00 + + TZ=Pacific/Kiritimati - wrong day, off by 2 days. +-tStamp=Thursday 1970-01-01 17:17:17 -1040 0 +-result=Monday 1970-01-05 00:00:00 -1040 0 ++tStamp=Thursday 1970-01-01 17:17:17 %s ++result=Monday 1970-01-05 00:00:00 %s + wanted=Monday 00:00:00 + + TZ=America/Managua - wrong day. +@@ -106,13 +106,13 @@ result=Tuesday 2005-04-12 00:00:00 CDT 1 + wanted=Tuesday 00:00:00 + + TZ=Pacific/Pitcairn - wrong day. +-tStamp=Thursday 1970-01-01 17:17:17 -0830 0 +-result=Wednesday 1970-01-07 00:00:00 -0830 0 ++tStamp=Thursday 1970-01-01 17:17:17 %s ++result=Wednesday 1970-01-07 00:00:00 %s + wanted=Wednesday 00:00:00 + + TZ=Pacific/Fakaofo - wrong day. +-tStamp=Thursday 1970-01-01 17:17:17 -11 0 +-result=Saturday 1970-01-03 00:00:00 -11 0 ++tStamp=Thursday 1970-01-01 17:17:17 %s ++result=Saturday 1970-01-03 00:00:00 %s + wanted=Saturday 00:00:00 + + TZ=Pacific/Johnston - wrong day. +diff -up ./ext/date/tests/bug66985.phpt.datetests ./ext/date/tests/bug66985.phpt +--- ./ext/date/tests/bug66985.phpt.datetests 2020-04-09 14:06:11.000000000 +0200 ++++ ./ext/date/tests/bug66985.phpt 2020-04-09 14:40:37.099288185 +0200 +@@ -3,7 +3,7 @@ Bug #66985 (Some timezones are no longer + --FILE-- + 3 +- [timezone] => Factory +-) +-DateTimeZone Object +-( + [timezone_type] => 3 + [timezone] => GB-Eire + ) +diff -up ./ext/date/tests/strtotime3-64bit.phpt.datetests ./ext/date/tests/strtotime3-64bit.phpt +--- ./ext/date/tests/strtotime3-64bit.phpt.datetests 2020-04-09 14:06:11.000000000 +0200 ++++ ./ext/date/tests/strtotime3-64bit.phpt 2020-04-09 14:40:00.809433489 +0200 +@@ -44,7 +44,7 @@ foreach ($strs as $str) { + } + + ?> +---EXPECT-- ++--EXPECTF-- + bool(false) + bool(false) + string(31) "Thu, 15 Jun 2006 00:00:00 +0100" +@@ -53,7 +53,7 @@ bool(false) + string(31) "Fri, 16 Jun 2006 23:49:12 +0100" + bool(false) + string(31) "Fri, 16 Jun 2006 02:22:00 +0100" +-string(31) "Sun, 16 Jun 0222 02:22:00 -0036" ++string(31) "Sun, 16 Jun 0222 02:22:00 %s" + string(31) "Fri, 16 Jun 2006 02:22:33 +0100" + bool(false) + string(31) "Tue, 02 Mar 2004 00:00:00 +0000" diff --git a/php-7.4.0-httpd.patch b/php-7.4.0-httpd.patch new file mode 100644 index 0000000..34f7c8a --- /dev/null +++ b/php-7.4.0-httpd.patch @@ -0,0 +1,27 @@ +Disable MPM detection + +mod_php is build twice +- as NTS without option +- as ZTS using --enable-maintainer-zts + +diff --git a/sapi/apache2handler/config.m4 b/sapi/apache2handler/config.m4 +--- a/sapi/apache2handler/config.m4 ++++ b/sapi/apache2handler/config.m4 +@@ -105,17 +105,6 @@ if test "$PHP_APXS2" != "no"; then + ;; + esac + +- if test "$APACHE_VERSION" -lt 2004001; then +- APXS_MPM=`$APXS -q MPM_NAME` +- if test "$APXS_MPM" != "prefork" && test "$APXS_MPM" != "peruser" && test "$APXS_MPM" != "itk"; then +- PHP_BUILD_THREAD_SAFE +- fi +- else +- APACHE_THREADED_MPM=`$APXS_HTTPD -V 2>/dev/null | grep 'threaded:.*yes'` +- if test -n "$APACHE_THREADED_MPM"; then +- PHP_BUILD_THREAD_SAFE +- fi +- fi + AC_MSG_RESULT(yes) + PHP_SUBST(APXS) + else diff --git a/php-7.4.0-ldap_r.patch b/php-7.4.0-ldap_r.patch new file mode 100644 index 0000000..13566b4 --- /dev/null +++ b/php-7.4.0-ldap_r.patch @@ -0,0 +1,19 @@ + +Use -lldap_r by default. + +diff -up php-7.4.0RC2/ext/ldap/config.m4.ldap_r php-7.4.0RC2/ext/ldap/config.m4 +--- php-7.4.0RC2/ext/ldap/config.m4.ldap_r 2019-09-17 10:21:24.769200812 +0200 ++++ php-7.4.0RC2/ext/ldap/config.m4 2019-09-17 10:21:30.658181771 +0200 +@@ -68,7 +68,11 @@ if test "$PHP_LDAP" != "no"; then + dnl -pc removal is a hack for clang + MACHINE_INCLUDES=$($CC -dumpmachine | $SED 's/-pc//') + +- if test -f $LDAP_LIBDIR/liblber.a || test -f $LDAP_LIBDIR/liblber.$SHLIB_SUFFIX_NAME || test -f $LDAP_LIBDIR/$MACHINE_INCLUDES/liblber.a || test -f $LDAP_LIBDIR/$MACHINE_INCLUDES/liblber.$SHLIB_SUFFIX_NAME; then ++ if test -f $LDAP_LIBDIR/libldap_r.$SHLIB_SUFFIX_NAME; then ++ PHP_ADD_LIBRARY_WITH_PATH(lber, $LDAP_LIBDIR, LDAP_SHARED_LIBADD) ++ PHP_ADD_LIBRARY_WITH_PATH(ldap_r, $LDAP_LIBDIR, LDAP_SHARED_LIBADD) ++ ++ elif test -f $LDAP_LIBDIR/liblber.a || test -f $LDAP_LIBDIR/liblber.$SHLIB_SUFFIX_NAME || test -f $LDAP_LIBDIR/$MACHINE_INCLUDES/liblber.a || test -f $LDAP_LIBDIR/$MACHINE_INCLUDES/liblber.$SHLIB_SUFFIX_NAME; then + PHP_ADD_LIBRARY_WITH_PATH(lber, $LDAP_LIBDIR, LDAP_SHARED_LIBADD) + PHP_ADD_LIBRARY_WITH_PATH(ldap, $LDAP_LIBDIR, LDAP_SHARED_LIBADD) + diff --git a/php-7.4.0-libdb.patch b/php-7.4.0-libdb.patch new file mode 100644 index 0000000..d7c6289 --- /dev/null +++ b/php-7.4.0-libdb.patch @@ -0,0 +1,92 @@ +diff -up ./ext/dba/config.m4.libdb ./ext/dba/config.m4 +--- ./ext/dba/config.m4.libdb 2020-04-09 14:06:11.000000000 +0200 ++++ ./ext/dba/config.m4 2020-04-09 14:35:08.208605065 +0200 +@@ -375,61 +375,13 @@ if test "$PHP_DB4" != "no"; then + dbdp4="/usr/local/BerkeleyDB.4." + dbdp5="/usr/local/BerkeleyDB.5." + for i in $PHP_DB4 ${dbdp5}1 ${dbdp5}0 ${dbdp4}8 ${dbdp4}7 ${dbdp4}6 ${dbdp4}5 ${dbdp4}4 ${dbdp4}3 ${dbdp4}2 ${dbdp4}1 ${dbdp}0 /usr/local /usr; do +- if test -f "$i/db5/db.h"; then +- THIS_PREFIX=$i +- THIS_INCLUDE=$i/db5/db.h +- break +- elif test -f "$i/db4/db.h"; then +- THIS_PREFIX=$i +- THIS_INCLUDE=$i/db4/db.h +- break +- elif test -f "$i/include/db5.3/db.h"; then +- THIS_PREFIX=$i +- THIS_INCLUDE=$i/include/db5.3/db.h +- break +- elif test -f "$i/include/db5.1/db.h"; then +- THIS_PREFIX=$i +- THIS_INCLUDE=$i/include/db5.1/db.h +- break +- elif test -f "$i/include/db5.0/db.h"; then +- THIS_PREFIX=$i +- THIS_INCLUDE=$i/include/db5.0/db.h +- break +- elif test -f "$i/include/db4.8/db.h"; then +- THIS_PREFIX=$i +- THIS_INCLUDE=$i/include/db4.8/db.h +- break +- elif test -f "$i/include/db4.7/db.h"; then +- THIS_PREFIX=$i +- THIS_INCLUDE=$i/include/db4.7/db.h +- break +- elif test -f "$i/include/db4.6/db.h"; then +- THIS_PREFIX=$i +- THIS_INCLUDE=$i/include/db4.6/db.h +- break +- elif test -f "$i/include/db4.5/db.h"; then +- THIS_PREFIX=$i +- THIS_INCLUDE=$i/include/db4.5/db.h +- break +- elif test -f "$i/include/db4/db.h"; then +- THIS_PREFIX=$i +- THIS_INCLUDE=$i/include/db4/db.h +- break +- elif test -f "$i/include/db/db4.h"; then +- THIS_PREFIX=$i +- THIS_INCLUDE=$i/include/db/db4.h +- break +- elif test -f "$i/include/db4.h"; then +- THIS_PREFIX=$i +- THIS_INCLUDE=$i/include/db4.h +- break +- elif test -f "$i/include/db.h"; then ++ if test -f "$i/include/db.h"; then + THIS_PREFIX=$i + THIS_INCLUDE=$i/include/db.h + break + fi + done +- PHP_DBA_DB_CHECK(4, db-5.3 db-5.1 db-5.0 db-4.8 db-4.7 db-4.6 db-4.5 db-4.4 db-4.3 db-4.2 db-4.1 db-4.0 db-4 db4 db, [(void)db_create((DB**)0, (DB_ENV*)0, 0)]) ++ PHP_DBA_DB_CHECK(4, db, [(void)db_create((DB**)0, (DB_ENV*)0, 0)]) + fi + PHP_DBA_STD_RESULT(db4,Berkeley DB4) + +diff -up ./ext/dba/dba.c.libdb ./ext/dba/dba.c +--- ./ext/dba/dba.c.libdb 2020-04-09 14:06:11.000000000 +0200 ++++ ./ext/dba/dba.c 2020-04-09 14:36:30.593275190 +0200 +@@ -50,6 +50,10 @@ + #include "php_lmdb.h" + #include "dba_arginfo.h" + ++#ifdef DB4_INCLUDE_FILE ++#include DB4_INCLUDE_FILE ++#endif ++ + PHP_MINIT_FUNCTION(dba); + PHP_MSHUTDOWN_FUNCTION(dba); + PHP_MINFO_FUNCTION(dba); +@@ -459,6 +463,10 @@ PHP_MINFO_FUNCTION(dba) + + php_info_print_table_start(); + php_info_print_table_row(2, "DBA support", "enabled"); ++#ifdef DB_VERSION_STRING ++ php_info_print_table_row(2, "libdb header version", DB_VERSION_STRING); ++ php_info_print_table_row(2, "libdb library version", db_version(NULL, NULL, NULL)); ++#endif + if (handlers.s) { + smart_str_0(&handlers); + php_info_print_table_row(2, "Supported handlers", ZSTR_VAL(handlers.s)); diff --git a/php-7.4.0-phpize.patch b/php-7.4.0-phpize.patch new file mode 100644 index 0000000..fb99f3e --- /dev/null +++ b/php-7.4.0-phpize.patch @@ -0,0 +1,35 @@ +diff -up ./scripts/phpize.in.headers ./scripts/phpize.in +--- ./scripts/phpize.in.headers 2019-07-23 10:05:11.000000000 +0200 ++++ ./scripts/phpize.in 2019-07-23 10:18:13.648098089 +0200 +@@ -165,6 +165,15 @@ phpize_autotools() + $PHP_AUTOHEADER || exit 1 + } + ++phpize_check_headers() ++{ ++ if test ! -f $includedir/main/php.h; then ++ echo "Can't find PHP headers in $includedir" ++ echo "The php-devel package is required for use of this command." ++ exit 1 ++ fi ++} ++ + # Main script + + case "$1" in +@@ -183,12 +192,15 @@ case "$1" in + + # Version + --version|-v) ++ phpize_check_headers + phpize_print_api_numbers + exit 0 + ;; + + # Default + *) ++ phpize_check_headers ++ + phpize_check_configm4 0 + + phpize_check_build_files diff --git a/php-8.0.0-embed.patch b/php-8.0.0-embed.patch new file mode 100644 index 0000000..27533ea --- /dev/null +++ b/php-8.0.0-embed.patch @@ -0,0 +1,25 @@ +diff -up ./sapi/embed/config.m4.embed ./sapi/embed/config.m4 +--- ./sapi/embed/config.m4.embed 2020-07-07 13:51:05.879764972 +0200 ++++ ./sapi/embed/config.m4 2020-07-07 13:52:50.128412148 +0200 +@@ -12,7 +12,8 @@ if test "$PHP_EMBED" != "no"; then + yes|shared) + LIBPHP_CFLAGS="-shared" + PHP_EMBED_TYPE=shared +- INSTALL_IT="\$(mkinstalldirs) \$(INSTALL_ROOT)\$(prefix)/lib; \$(INSTALL) -m 0755 $SAPI_SHARED \$(INSTALL_ROOT)\$(prefix)/lib" ++ EXTRA_LDFLAGS="$EXTRA_LDFLAGS -release \$(PHP_MAJOR_VERSION).\$(PHP_MINOR_VERSION)" ++ INSTALL_IT="\$(mkinstalldirs) \$(INSTALL_ROOT)\$(libdir); \$(LIBTOOL) --mode=install \$(INSTALL) -m 0755 \$(OVERALL_TARGET) \$(INSTALL_ROOT)\$(libdir)" + ;; + static) + LIBPHP_CFLAGS="-static" +diff -up ./scripts/php-config.in.embed ./scripts/php-config.in +--- ./scripts/php-config.in.embed 2020-07-07 12:54:42.000000000 +0200 ++++ ./scripts/php-config.in 2020-07-07 13:51:05.880764968 +0200 +@@ -18,7 +18,7 @@ exe_extension="@EXEEXT@" + php_cli_binary=NONE + php_cgi_binary=NONE + configure_options="@CONFIGURE_OPTIONS@" +-php_sapis="@PHP_INSTALLED_SAPIS@" ++php_sapis="apache2handler litespeed fpm phpdbg @PHP_INSTALLED_SAPIS@" + ini_dir="@EXPANDED_PHP_CONFIG_FILE_SCAN_DIR@" + ini_path="@EXPANDED_PHP_CONFIG_FILE_PATH@" + diff --git a/php-8.0.0-phpinfo.patch b/php-8.0.0-phpinfo.patch new file mode 100644 index 0000000..391d996 --- /dev/null +++ b/php-8.0.0-phpinfo.patch @@ -0,0 +1,118 @@ + +Drop "Configure Command" from phpinfo as it doesn't +provide any useful information. +The available extensions are not related to this command. + +Replace full GCC name by gcc in php -v output + + +Also apply + +From 9bf43c45908433d382f0499d529849172d0d8206 Mon Sep 17 00:00:00 2001 +From: Remi Collet +Date: Mon, 28 Dec 2020 08:33:09 +0100 +Subject: [PATCH] rename COMPILER and ARCHITECTURE macro (too generic) + +--- + configure.ac | 4 ++-- + ext/standard/info.c | 8 ++++---- + sapi/cli/php_cli.c | 8 ++++---- + win32/build/confutils.js | 10 +++++----- + 4 files changed, 15 insertions(+), 15 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 9d9c8b155b07..143dc061346b 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -1289,10 +1289,10 @@ if test -n "${PHP_BUILD_PROVIDER}"; then + AC_DEFINE_UNQUOTED(PHP_BUILD_PROVIDER,"$PHP_BUILD_PROVIDER",[build provider]) + fi + if test -n "${PHP_BUILD_COMPILER}"; then +- AC_DEFINE_UNQUOTED(COMPILER,"$PHP_BUILD_COMPILER",[used compiler for build]) ++ AC_DEFINE_UNQUOTED(PHP_BUILD_COMPILER,"$PHP_BUILD_COMPILER",[used compiler for build]) + fi + if test -n "${PHP_BUILD_ARCH}"; then +- AC_DEFINE_UNQUOTED(ARCHITECTURE,"$PHP_BUILD_ARCH",[build architecture]) ++ AC_DEFINE_UNQUOTED(PHP_BUILD_ARCH,"$PHP_BUILD_ARCH",[build architecture]) + fi + + PHP_SUBST_OLD(PHP_INSTALLED_SAPIS) +diff --git a/ext/standard/info.c b/ext/standard/info.c +index 153cb6cde014..8ceef31d9fe4 100644 +--- a/ext/standard/info.c ++++ b/ext/standard/info.c +@@ -798,11 +798,11 @@ PHPAPI ZEND_COLD void php_print_info(int flag) + #ifdef PHP_BUILD_PROVIDER + php_info_print_table_row(2, "Build Provider", PHP_BUILD_PROVIDER); + #endif +-#ifdef COMPILER +- php_info_print_table_row(2, "Compiler", COMPILER); ++#ifdef PHP_BUILD_COMPILER ++ php_info_print_table_row(2, "Compiler", PHP_BUILD_COMPILER); + #endif +-#ifdef ARCHITECTURE +- php_info_print_table_row(2, "Architecture", ARCHITECTURE); ++#ifdef PHP_BUILD_ARCH ++ php_info_print_table_row(2, "Architecture", PHP_BUILD_ARCH); + #endif + #ifdef CONFIGURE_COMMAND + php_info_print_table_row(2, "Configure Command", CONFIGURE_COMMAND ); +diff --git a/sapi/cli/php_cli.c b/sapi/cli/php_cli.c +index 5092fb0ffd68..9d296acec631 100644 +--- a/sapi/cli/php_cli.c ++++ b/sapi/cli/php_cli.c +@@ -640,12 +640,12 @@ static int do_cli(int argc, char **argv) /* {{{ */ + #else + "NTS " + #endif +-#ifdef COMPILER +- COMPILER ++#ifdef PHP_BUILD_COMPILER ++ PHP_BUILD_COMPILER + " " + #endif +-#ifdef ARCHITECTURE +- ARCHITECTURE ++#ifdef PHP_BUILD_ARCH ++ PHP_BUILD_ARCH + " " + #endif + #if ZEND_DEBUG + +diff -up ./ext/standard/info.c.phpinfo ./ext/standard/info.c +--- ./ext/standard/info.c.phpinfo 2020-07-21 10:49:31.000000000 +0200 ++++ ./ext/standard/info.c 2020-07-21 11:41:56.295633523 +0200 +@@ -804,9 +804,6 @@ PHPAPI ZEND_COLD void php_print_info(int + #ifdef PHP_BUILD_ARCH + php_info_print_table_row(2, "Architecture", PHP_BUILD_ARCH); + #endif +-#ifdef CONFIGURE_COMMAND +- php_info_print_table_row(2, "Configure Command", CONFIGURE_COMMAND ); +-#endif + + if (sapi_module.pretty_name) { + php_info_print_table_row(2, "Server API", sapi_module.pretty_name ); +diff -up ./ext/standard/tests/general_functions/phpinfo.phpt.phpinfo ./ext/standard/tests/general_functions/phpinfo.phpt +--- ./ext/standard/tests/general_functions/phpinfo.phpt.phpinfo 2020-07-21 10:49:31.000000000 +0200 ++++ ./ext/standard/tests/general_functions/phpinfo.phpt 2020-07-21 11:41:56.296633522 +0200 +@@ -17,7 +17,6 @@ PHP Version => %s + + System => %s + Build Date => %s%a +-Configure Command => %s + Server API => Command Line Interface + Virtual Directory Support => %s + Configuration File (php.ini) Path => %s +diff -up ./sapi/cli/php_cli.c.phpinfo ./sapi/cli/php_cli.c +--- ./sapi/cli/php_cli.c.phpinfo 2020-07-21 11:43:38.812475300 +0200 ++++ ./sapi/cli/php_cli.c 2020-07-21 11:43:45.783464540 +0200 +@@ -641,8 +641,7 @@ static int do_cli(int argc, char **argv) + "NTS " + #endif + #ifdef PHP_BUILD_COMPILER +- PHP_BUILD_COMPILER +- " " ++ "gcc " + #endif + #ifdef PHP_BUILD_ARCH + PHP_BUILD_ARCH diff --git a/php-8.0.10-openssl3.patch b/php-8.0.10-openssl3.patch new file mode 100644 index 0000000..6070150 --- /dev/null +++ b/php-8.0.10-openssl3.patch @@ -0,0 +1,4761 @@ +From 3d13d14f318267b27f99025b37a2061c835e0727 Mon Sep 17 00:00:00 2001 +From: Remi Collet +Date: Sun, 8 Aug 2021 17:38:30 +0200 +Subject: [PATCH 01/39] minimal fix for openssl 3.0 (#7002) + +(cherry picked from commit a0972deb0f441fc7991001cb51efc994b70a3b51) +--- + ext/openssl/openssl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index 19e7a0d79e..015cd89aa6 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -1221,7 +1221,9 @@ PHP_MINIT_FUNCTION(openssl) + REGISTER_LONG_CONSTANT("OPENSSL_CMS_NOSIGS", CMS_NOSIGS, CONST_CS|CONST_PERSISTENT); + + REGISTER_LONG_CONSTANT("OPENSSL_PKCS1_PADDING", RSA_PKCS1_PADDING, CONST_CS|CONST_PERSISTENT); ++#ifdef RSA_SSLV23_PADDING + REGISTER_LONG_CONSTANT("OPENSSL_SSLV23_PADDING", RSA_SSLV23_PADDING, CONST_CS|CONST_PERSISTENT); ++#endif + REGISTER_LONG_CONSTANT("OPENSSL_NO_PADDING", RSA_NO_PADDING, CONST_CS|CONST_PERSISTENT); + REGISTER_LONG_CONSTANT("OPENSSL_PKCS1_OAEP_PADDING", RSA_PKCS1_OAEP_PADDING, CONST_CS|CONST_PERSISTENT); + +-- +2.31.1 + +From fc0dbc36e4563a5146aa5345e8520f6601ec7030 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Wed, 4 Aug 2021 09:41:39 +0200 +Subject: [PATCH 02/39] Optimize openssl memory leak test + +Just do one call and check whether memory usage changes. Looping +this 100000 times is extremely slow with debug builds of openssl. + +(cherry picked from commit 6249172ae37f958f0a3ef92cb55d5bf7affa8214) +--- + ext/openssl/tests/bug79145.phpt | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/ext/openssl/tests/bug79145.phpt b/ext/openssl/tests/bug79145.phpt +index 4f3dc9e766..c9c7df2953 100644 +--- a/ext/openssl/tests/bug79145.phpt ++++ b/ext/openssl/tests/bug79145.phpt +@@ -3,7 +3,6 @@ Bug #79145 (openssl memory leak) + --SKIPIF-- + + --FILE-- + + --EXPECT-- + bool(true) +-- +2.31.1 + +From da4fbfb99a6dfc9dbaaa04a4bc8068a7e9bfa46c Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Wed, 4 Aug 2021 09:46:07 +0200 +Subject: [PATCH 03/39] Reduce security level in some OpenSSL tests + +This allows tests using older protocols and algorithms to work +under OpenSSL 3. + +Also account for minor changes in error reporting. + +(cherry picked from commit 3ea57cf83834e07aae6953201015e39b4a2ac6dd) +--- + ext/openssl/tests/session_meta_capture.phpt | 4 ++-- + ext/openssl/tests/stream_crypto_flags_001.phpt | 4 ++-- + ext/openssl/tests/stream_crypto_flags_002.phpt | 4 ++-- + ext/openssl/tests/stream_crypto_flags_003.phpt | 4 ++-- + ext/openssl/tests/stream_crypto_flags_004.phpt | 4 ++-- + ext/openssl/tests/stream_security_level.phpt | 4 ++-- + ext/openssl/tests/tls_min_v1.0_max_v1.1_wrapper.phpt | 4 ++-- + ext/openssl/tests/tls_wrapper.phpt | 4 ++-- + ext/openssl/tests/tls_wrapper_with_tls_v1.3.phpt | 4 ++-- + ext/openssl/tests/tlsv1.0_wrapper.phpt | 4 ++-- + ext/openssl/tests/tlsv1.1_wrapper.phpt | 4 ++-- + 11 files changed, 22 insertions(+), 22 deletions(-) + +diff --git a/ext/openssl/tests/session_meta_capture.phpt b/ext/openssl/tests/session_meta_capture.phpt +index 58b48e9c59..8a0f403a15 100644 +--- a/ext/openssl/tests/session_meta_capture.phpt ++++ b/ext/openssl/tests/session_meta_capture.phpt +@@ -15,7 +15,7 @@ $serverCode = <<<'CODE' + $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; + $serverCtx = stream_context_create(['ssl' => [ + 'local_cert' => '%s', +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); +@@ -36,7 +36,7 @@ $clientCode = <<<'CODE' + 'verify_peer' => true, + 'cafile' => '%s', + 'peer_name' => '%s', +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + phpt_wait(); +diff --git a/ext/openssl/tests/stream_crypto_flags_001.phpt b/ext/openssl/tests/stream_crypto_flags_001.phpt +index acd97110ff..a86e0f8a6c 100644 +--- a/ext/openssl/tests/stream_crypto_flags_001.phpt ++++ b/ext/openssl/tests/stream_crypto_flags_001.phpt +@@ -15,7 +15,7 @@ $serverCode = <<<'CODE' + $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; + $serverCtx = stream_context_create(['ssl' => [ + 'local_cert' => '%s', +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); +@@ -35,7 +35,7 @@ $clientCode = <<<'CODE' + 'verify_peer' => true, + 'cafile' => '%s', + 'peer_name' => '%s', +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + phpt_wait(); +diff --git a/ext/openssl/tests/stream_crypto_flags_002.phpt b/ext/openssl/tests/stream_crypto_flags_002.phpt +index 15b1ec2cfc..2870bdc814 100644 +--- a/ext/openssl/tests/stream_crypto_flags_002.phpt ++++ b/ext/openssl/tests/stream_crypto_flags_002.phpt +@@ -15,7 +15,7 @@ $serverCode = <<<'CODE' + $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; + $serverCtx = stream_context_create(['ssl' => [ + 'local_cert' => '%s', +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); +@@ -36,7 +36,7 @@ $clientCode = <<<'CODE' + 'verify_peer' => true, + 'cafile' => '%s', + 'peer_name' => '%s', +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + phpt_wait(); +diff --git a/ext/openssl/tests/stream_crypto_flags_003.phpt b/ext/openssl/tests/stream_crypto_flags_003.phpt +index 35f83f22dd..da1f1ae228 100644 +--- a/ext/openssl/tests/stream_crypto_flags_003.phpt ++++ b/ext/openssl/tests/stream_crypto_flags_003.phpt +@@ -19,7 +19,7 @@ $serverCode = <<<'CODE' + + // Only accept TLSv1.0 and TLSv1.2 connections + 'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_0_SERVER | STREAM_CRYPTO_METHOD_TLSv1_2_SERVER, +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); +@@ -40,7 +40,7 @@ $clientCode = <<<'CODE' + 'verify_peer' => true, + 'cafile' => '%s', + 'peer_name' => '%s', +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + phpt_wait(); +diff --git a/ext/openssl/tests/stream_crypto_flags_004.phpt b/ext/openssl/tests/stream_crypto_flags_004.phpt +index d9bfcfea3f..b7626b8ea7 100644 +--- a/ext/openssl/tests/stream_crypto_flags_004.phpt ++++ b/ext/openssl/tests/stream_crypto_flags_004.phpt +@@ -16,7 +16,7 @@ $serverCode = <<<'CODE' + $serverCtx = stream_context_create(['ssl' => [ + 'local_cert' => '%s', + 'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_0_SERVER, +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); +@@ -37,7 +37,7 @@ $clientCode = <<<'CODE' + 'verify_peer' => true, + 'cafile' => '%s', + 'peer_name' => '%s', +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + phpt_wait(); +diff --git a/ext/openssl/tests/stream_security_level.phpt b/ext/openssl/tests/stream_security_level.phpt +index 44ba4c6d57..b8a8796de3 100644 +--- a/ext/openssl/tests/stream_security_level.phpt ++++ b/ext/openssl/tests/stream_security_level.phpt +@@ -24,7 +24,7 @@ $serverCode = <<<'CODE' + 'local_cert' => '%s', + // Make sure the server side starts up successfully if the default security level is + // higher. We want to test the error at the client side. +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); +@@ -66,7 +66,7 @@ ServerClientTestCase::getInstance()->run($clientCode, $serverCode); + ?> + --EXPECTF-- + Warning: stream_socket_client(): SSL operation failed with code 1. OpenSSL Error messages: +-error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed in %s : eval()'d code on line %d ++error:%s:SSL routines:%S:certificate verify failed in %s : eval()'d code on line %d + + Warning: stream_socket_client(): Failed to enable crypto in %s : eval()'d code on line %d + +diff --git a/ext/openssl/tests/tls_min_v1.0_max_v1.1_wrapper.phpt b/ext/openssl/tests/tls_min_v1.0_max_v1.1_wrapper.phpt +index ac31192da4..73dd812291 100644 +--- a/ext/openssl/tests/tls_min_v1.0_max_v1.1_wrapper.phpt ++++ b/ext/openssl/tests/tls_min_v1.0_max_v1.1_wrapper.phpt +@@ -15,7 +15,7 @@ $serverCode = <<<'CODE' + 'local_cert' => '%s', + 'min_proto_version' => STREAM_CRYPTO_PROTO_TLSv1_0, + 'max_proto_version' => STREAM_CRYPTO_PROTO_TLSv1_1, +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + $server = stream_socket_server('tls://127.0.0.1:64321', $errno, $errstr, $flags, $ctx); +@@ -32,7 +32,7 @@ $clientCode = <<<'CODE' + $ctx = stream_context_create(['ssl' => [ + 'verify_peer' => false, + 'verify_peer_name' => false, +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + phpt_wait(); +diff --git a/ext/openssl/tests/tls_wrapper.phpt b/ext/openssl/tests/tls_wrapper.phpt +index d79e978c10..3488f6f7f0 100644 +--- a/ext/openssl/tests/tls_wrapper.phpt ++++ b/ext/openssl/tests/tls_wrapper.phpt +@@ -14,7 +14,7 @@ $serverCode = <<<'CODE' + $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN; + $ctx = stream_context_create(['ssl' => [ + 'local_cert' => '%s', +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + $server = stream_socket_server('tls://127.0.0.1:64321', $errno, $errstr, $flags, $ctx); +@@ -31,7 +31,7 @@ $clientCode = <<<'CODE' + $ctx = stream_context_create(['ssl' => [ + 'verify_peer' => false, + 'verify_peer_name' => false, +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + phpt_wait(); +diff --git a/ext/openssl/tests/tls_wrapper_with_tls_v1.3.phpt b/ext/openssl/tests/tls_wrapper_with_tls_v1.3.phpt +index b419179b3f..c8a0245601 100644 +--- a/ext/openssl/tests/tls_wrapper_with_tls_v1.3.phpt ++++ b/ext/openssl/tests/tls_wrapper_with_tls_v1.3.phpt +@@ -14,7 +14,7 @@ $serverCode = <<<'CODE' + $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN; + $ctx = stream_context_create(['ssl' => [ + 'local_cert' => '%s', +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + $server = stream_socket_server('tls://127.0.0.1:64321', $errno, $errstr, $flags, $ctx); +@@ -31,7 +31,7 @@ $clientCode = <<<'CODE' + $ctx = stream_context_create(['ssl' => [ + 'verify_peer' => false, + 'verify_peer_name' => false, +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + phpt_wait(); +diff --git a/ext/openssl/tests/tlsv1.0_wrapper.phpt b/ext/openssl/tests/tlsv1.0_wrapper.phpt +index adbe7b6308..fc802662ac 100644 +--- a/ext/openssl/tests/tlsv1.0_wrapper.phpt ++++ b/ext/openssl/tests/tlsv1.0_wrapper.phpt +@@ -13,7 +13,7 @@ $serverCode = <<<'CODE' + $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN; + $ctx = stream_context_create(['ssl' => [ + 'local_cert' => '%s', +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + $server = stream_socket_server('tlsv1.0://127.0.0.1:64321', $errno, $errstr, $flags, $ctx); +@@ -30,7 +30,7 @@ $clientCode = <<<'CODE' + $ctx = stream_context_create(['ssl' => [ + 'verify_peer' => false, + 'verify_peer_name' => false, +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + phpt_wait(); +diff --git a/ext/openssl/tests/tlsv1.1_wrapper.phpt b/ext/openssl/tests/tlsv1.1_wrapper.phpt +index c1aaa04919..84a137b5f4 100644 +--- a/ext/openssl/tests/tlsv1.1_wrapper.phpt ++++ b/ext/openssl/tests/tlsv1.1_wrapper.phpt +@@ -13,7 +13,7 @@ $serverCode = <<<'CODE' + $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN; + $ctx = stream_context_create(['ssl' => [ + 'local_cert' => '%s', +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + $server = stream_socket_server('tlsv1.1://127.0.0.1:64321', $errno, $errstr, $flags, $ctx); +@@ -30,7 +30,7 @@ $clientCode = <<<'CODE' + $ctx = stream_context_create(['ssl' => [ + 'verify_peer' => false, + 'verify_peer_name' => false, +- 'security_level' => 1, ++ 'security_level' => 0, + ]]); + + phpt_wait(); +-- +2.31.1 + +From fe770720985c5f31a79528528be0aa8e0e56a389 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Wed, 4 Aug 2021 09:57:40 +0200 +Subject: [PATCH 04/39] Adjust some tests for whitespace differences in OpenSSL + 3 + +A trailing newline is no longer present in OpenSSL 3. + +(cherry picked from commit 0a530d7650c6f9cb7c1b55755c8bf5961052039c) +--- + ext/openssl/tests/bug28382.phpt | 17 +++++++---------- + ext/openssl/tests/cve2013_4073.phpt | 5 ++--- + ext/openssl/tests/openssl_x509_parse_basic.phpt | 10 ++++------ + 3 files changed, 13 insertions(+), 19 deletions(-) + +diff --git a/ext/openssl/tests/bug28382.phpt b/ext/openssl/tests/bug28382.phpt +index 3d8cb528ba..00765ba838 100644 +--- a/ext/openssl/tests/bug28382.phpt ++++ b/ext/openssl/tests/bug28382.phpt +@@ -9,11 +9,10 @@ if (!extension_loaded("openssl")) die("skip"); + $cert = file_get_contents(__DIR__ . "/bug28382cert.txt"); + $ext = openssl_x509_parse($cert); + var_dump($ext['extensions']); +-/* openssl 1.0 prepends the string "Full Name:" to the crlDistributionPoints array key. +- For now, as this is the one difference only between 0.9.x and 1.x, it's handled with +- placeholders to not to duplicate the test. When more diffs come, a duplication would +- be probably a better solution. +-*/ ++/* ++ * The reason for %A at the end of crlDistributionPoints and authorityKeyIdentifier is that ++ * OpenSSL 3.0 removes new lines which were present in previous versions. ++ */ + ?> + --EXPECTF-- + array(11) { +@@ -24,8 +23,7 @@ array(11) { + ["nsCertType"]=> + string(30) "SSL Client, SSL Server, S/MIME" + ["crlDistributionPoints"]=> +- string(%d) "%AURI:http://mobile.blue-software.ro:90/ca/crl.shtml +-" ++ string(%d) "%AURI:http://mobile.blue-software.ro:90/ca/crl.shtml%A" + ["nsCaPolicyUrl"]=> + string(38) "http://mobile.blue-software.ro:90/pub/" + ["subjectAltName"]=> +@@ -33,9 +31,8 @@ array(11) { + ["subjectKeyIdentifier"]=> + string(59) "B0:A7:FF:F9:41:15:DE:23:39:BD:DD:31:0F:97:A0:B2:A2:74:E0:FC" + ["authorityKeyIdentifier"]=> +- string(115) "DirName:/C=RO/ST=Romania/L=Craiova/O=Sergiu/OU=Sergiu SRL/CN=Sergiu CA/emailAddress=n_sergiu@hotmail.com +-serial:00 +-" ++ string(%d) "DirName:/C=RO/ST=Romania/L=Craiova/O=Sergiu/OU=Sergiu SRL/CN=Sergiu CA/emailAddress=n_sergiu@hotmail.com ++serial:00%A" + ["keyUsage"]=> + string(71) "Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment" + ["nsBaseUrl"]=> +diff --git a/ext/openssl/tests/cve2013_4073.phpt b/ext/openssl/tests/cve2013_4073.phpt +index c88021b0ae..5cd05ab040 100644 +--- a/ext/openssl/tests/cve2013_4073.phpt ++++ b/ext/openssl/tests/cve2013_4073.phpt +@@ -9,11 +9,10 @@ $info = openssl_x509_parse($cert); + var_export($info['extensions']); + + ?> +---EXPECT-- ++--EXPECTF-- + array ( + 'basicConstraints' => 'CA:FALSE', + 'subjectKeyIdentifier' => '88:5A:55:C0:52:FF:61:CD:52:A3:35:0F:EA:5A:9C:24:38:22:F7:5C', + 'keyUsage' => 'Digital Signature, Non Repudiation, Key Encipherment', +- 'subjectAltName' => 'DNS:altnull.python.org' . "\0" . 'example.com, email:null@python.org' . "\0" . 'user@example.org, URI:http://null.python.org' . "\0" . 'http://example.org, IP Address:192.0.2.1, IP Address:2001:DB8:0:0:0:0:0:1 +-', ++ 'subjectAltName' => 'DNS:altnull.python.org' . "\0" . 'example.com, email:null@python.org' . "\0" . 'user@example.org, URI:http://null.python.org' . "\0" . 'http://example.org, IP Address:192.0.2.1, IP Address:2001:DB8:0:0:0:0:0:1%A', + ) +diff --git a/ext/openssl/tests/openssl_x509_parse_basic.phpt b/ext/openssl/tests/openssl_x509_parse_basic.phpt +index b80c1f71f1..38915157f3 100644 +--- a/ext/openssl/tests/openssl_x509_parse_basic.phpt ++++ b/ext/openssl/tests/openssl_x509_parse_basic.phpt +@@ -153,10 +153,9 @@ array(16) { + ["subjectKeyIdentifier"]=> + string(59) "DB:7E:40:72:BD:5C:35:85:EC:29:29:81:12:E8:62:68:6A:B7:3F:7D" + ["authorityKeyIdentifier"]=> +- string(202) "keyid:DB:7E:40:72:BD:5C:35:85:EC:29:29:81:12:E8:62:68:6A:B7:3F:7D ++ string(%d) "keyid:DB:7E:40:72:BD:5C:35:85:EC:29:29:81:12:E8:62:68:6A:B7:3F:7D + DirName:/C=BR/ST=Rio Grande do Sul/L=Porto Alegre/CN=Henrique do N. Angelo/emailAddress=hnangelo@php.net +-serial:AE:C5:56:CC:72:37:50:A2 +-" ++serial:AE:C5:56:CC:72:37:50:A2%A" + ["basicConstraints"]=> + string(7) "CA:TRUE" + } +@@ -301,10 +300,9 @@ array(16) { + ["subjectKeyIdentifier"]=> + string(59) "DB:7E:40:72:BD:5C:35:85:EC:29:29:81:12:E8:62:68:6A:B7:3F:7D" + ["authorityKeyIdentifier"]=> +- string(202) "keyid:DB:7E:40:72:BD:5C:35:85:EC:29:29:81:12:E8:62:68:6A:B7:3F:7D ++ string(%d) "keyid:DB:7E:40:72:BD:5C:35:85:EC:29:29:81:12:E8:62:68:6A:B7:3F:7D + DirName:/C=BR/ST=Rio Grande do Sul/L=Porto Alegre/CN=Henrique do N. Angelo/emailAddress=hnangelo@php.net +-serial:AE:C5:56:CC:72:37:50:A2 +-" ++serial:AE:C5:56:CC:72:37:50:A2%A" + ["basicConstraints"]=> + string(7) "CA:TRUE" + } +-- +2.31.1 + +From 676a47080bed2730b892e4ea43b93deb4acea335 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Wed, 4 Aug 2021 11:55:47 +0200 +Subject: [PATCH 05/39] Use different cipher in openssl_seal() test + +RC4 is insecure and not supported in newer versions. + +(cherry picked from commit 046b36bcf8c062375c9f5e2a763d6144c2a484b4) +--- + ext/openssl/tests/openssl_seal_basic.phpt | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/ext/openssl/tests/openssl_seal_basic.phpt b/ext/openssl/tests/openssl_seal_basic.phpt +index 16efb05a66..e23045c992 100644 +--- a/ext/openssl/tests/openssl_seal_basic.phpt ++++ b/ext/openssl/tests/openssl_seal_basic.phpt +@@ -9,7 +9,7 @@ $a = 1; + $b = array(1); + $c = array(1); + $d = array(1); +-$method = "RC4"; ++$method = "AES-128-ECB"; + + var_dump(openssl_seal($a, $b, $c, $d, $method)); + +@@ -41,8 +41,8 @@ var_dump(openssl_seal($data, $sealed, $ekeys, array($wrong), $method)); + Warning: openssl_seal(): Not a public key (1th member of pubkeys) in %s on line %d + bool(false) + openssl_seal(): Argument #4 ($public_key) cannot be empty +-int(19) +-int(19) ++int(32) ++int(32) + + Warning: openssl_seal(): Not a public key (2th member of pubkeys) in %s on line %d + bool(false) +-- +2.31.1 + +From 389b4605281975d4ecac92cb3751d18d2e3fd60a Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Wed, 4 Aug 2021 11:58:46 +0200 +Subject: [PATCH 06/39] Don't test legacy algorithms in SPKI tests + +MD4 and RMD160 may not be available on newer OpenSSL versions. + +(cherry picked from commit 9695936341c49ea0efec5bdf24acbcdf59e2a7f8) +--- + ext/openssl/tests/openssl_spki_export_basic.phpt | 4 ---- + .../tests/openssl_spki_export_challenge_basic.phpt | 14 -------------- + ext/openssl/tests/openssl_spki_new_basic.phpt | 8 -------- + ext/openssl/tests/openssl_spki_verify_basic.phpt | 7 ------- + 4 files changed, 33 deletions(-) + +diff --git a/ext/openssl/tests/openssl_spki_export_basic.phpt b/ext/openssl/tests/openssl_spki_export_basic.phpt +index 4085d2d5d8..c03954390b 100644 +--- a/ext/openssl/tests/openssl_spki_export_basic.phpt ++++ b/ext/openssl/tests/openssl_spki_export_basic.phpt +@@ -19,14 +19,12 @@ foreach ($key_sizes as $key_size) { + + /* array of available hashings to test */ + $algo = array( +- OPENSSL_ALGO_MD4, + OPENSSL_ALGO_MD5, + OPENSSL_ALGO_SHA1, + OPENSSL_ALGO_SHA224, + OPENSSL_ALGO_SHA256, + OPENSSL_ALGO_SHA384, + OPENSSL_ALGO_SHA512, +- OPENSSL_ALGO_RMD160 + ); + + /* loop over key sizes for test */ +@@ -56,5 +54,3 @@ function _uuid() { + \-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\- + \-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\- + \-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\- +-\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\- +-\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\- +diff --git a/ext/openssl/tests/openssl_spki_export_challenge_basic.phpt b/ext/openssl/tests/openssl_spki_export_challenge_basic.phpt +index f44e60ec62..06308bf10c 100644 +--- a/ext/openssl/tests/openssl_spki_export_challenge_basic.phpt ++++ b/ext/openssl/tests/openssl_spki_export_challenge_basic.phpt +@@ -21,14 +21,12 @@ foreach ($key_sizes as $key_size) { + + /* array of available hashings to test */ + $algo = array( +- OPENSSL_ALGO_MD4, + OPENSSL_ALGO_MD5, + OPENSSL_ALGO_SHA1, + OPENSSL_ALGO_SHA224, + OPENSSL_ALGO_SHA256, + OPENSSL_ALGO_SHA384, + OPENSSL_ALGO_SHA512, +- OPENSSL_ALGO_RMD160 + ); + + /* loop over key sizes for test */ +@@ -89,15 +87,3 @@ string\(36\) \"[0-9a-f]{8}\-([0-9a-f]{4}\-){3}[0-9a-f]{12}\" + bool\(false\) + string\(36\) \"[0-9a-f]{8}\-([0-9a-f]{4}\-){3}[0-9a-f]{12}\" + bool\(false\) +-string\(36\) \"[0-9a-f]{8}\-([0-9a-f]{4}\-){3}[0-9a-f]{12}\" +-bool\(false\) +-string\(36\) \"[0-9a-f]{8}\-([0-9a-f]{4}\-){3}[0-9a-f]{12}\" +-bool\(false\) +-string\(36\) \"[0-9a-f]{8}\-([0-9a-f]{4}\-){3}[0-9a-f]{12}\" +-bool\(false\) +-string\(36\) \"[0-9a-f]{8}\-([0-9a-f]{4}\-){3}[0-9a-f]{12}\" +-bool\(false\) +-string\(36\) \"[0-9a-f]{8}\-([0-9a-f]{4}\-){3}[0-9a-f]{12}\" +-bool\(false\) +-string\(36\) \"[0-9a-f]{8}\-([0-9a-f]{4}\-){3}[0-9a-f]{12}\" +-bool\(false\) +diff --git a/ext/openssl/tests/openssl_spki_new_basic.phpt b/ext/openssl/tests/openssl_spki_new_basic.phpt +index cb54747fe0..8378bd1ac6 100644 +--- a/ext/openssl/tests/openssl_spki_new_basic.phpt ++++ b/ext/openssl/tests/openssl_spki_new_basic.phpt +@@ -18,14 +18,12 @@ foreach ($key_sizes as $key_size) { + + /* array of available hashings to test */ + $algo = array( +- OPENSSL_ALGO_MD4, + OPENSSL_ALGO_MD5, + OPENSSL_ALGO_SHA1, + OPENSSL_ALGO_SHA224, + OPENSSL_ALGO_SHA256, + OPENSSL_ALGO_SHA384, + OPENSSL_ALGO_SHA512, +- OPENSSL_ALGO_RMD160 + ); + + /* loop over key sizes for test */ +@@ -53,21 +51,15 @@ string(478) "%s" + string(478) "%s" + string(478) "%s" + string(478) "%s" +-string(478) "%s" +-string(474) "%s" +-string(830) "%s" + string(830) "%s" + string(830) "%s" + string(830) "%s" + string(830) "%s" + string(830) "%s" + string(830) "%s" +-string(826) "%s" +-string(1510) "%s" + string(1510) "%s" + string(1510) "%s" + string(1510) "%s" + string(1510) "%s" + string(1510) "%s" + string(1510) "%s" +-string(1506) "%s" +diff --git a/ext/openssl/tests/openssl_spki_verify_basic.phpt b/ext/openssl/tests/openssl_spki_verify_basic.phpt +index c760d0cb83..35badcda37 100644 +--- a/ext/openssl/tests/openssl_spki_verify_basic.phpt ++++ b/ext/openssl/tests/openssl_spki_verify_basic.phpt +@@ -25,7 +25,6 @@ $algo = array( + OPENSSL_ALGO_SHA256, + OPENSSL_ALGO_SHA384, + OPENSSL_ALGO_SHA512, +- OPENSSL_ALGO_RMD160 + ); + + /* loop over key sizes for test */ +@@ -80,9 +79,3 @@ bool(true) + bool(false) + bool(true) + bool(false) +-bool(true) +-bool(false) +-bool(true) +-bool(false) +-bool(true) +-bool(false) +-- +2.31.1 + +From 054aeebb623e6d4a055a4bab60a864f8c7f65675 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Wed, 4 Aug 2021 12:48:02 +0200 +Subject: [PATCH 07/39] Only report provided ciphers in + openssl_get_cipher_methods() + +With OpenSSL 3 ciphers may be registered, but not provided. Make +sure that openssl_get_cipher_methods() only returns provided +ciphers, so that "in_array openssl_get_cipher_methods" style +checks continue working as expected. + +(cherry picked from commit a80ae97d3176aded77ee422772608a026380fc1a) +--- + ext/openssl/openssl.c | 34 +++++++++++++++++++++++++++++++++- + ext/openssl/php_openssl.h | 4 +++- + 2 files changed, 36 insertions(+), 2 deletions(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index 015cd89aa6..4ffa2185fb 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -6798,6 +6798,31 @@ PHP_FUNCTION(openssl_get_md_methods) + } + /* }}} */ + ++#if PHP_OPENSSL_API_VERSION >= 0x30000 ++static void php_openssl_add_cipher_name(const char *name, void *arg) ++{ ++ size_t len = strlen(name); ++ zend_string *str = zend_string_alloc(len, 0); ++ zend_str_tolower_copy(ZSTR_VAL(str), name, len); ++ add_next_index_str((zval*)arg, str); ++} ++ ++static void php_openssl_add_cipher_or_alias(EVP_CIPHER *cipher, void *arg) ++{ ++ EVP_CIPHER_names_do_all(cipher, php_openssl_add_cipher_name, arg); ++} ++ ++static void php_openssl_add_cipher(EVP_CIPHER *cipher, void *arg) ++{ ++ php_openssl_add_cipher_name(EVP_CIPHER_get0_name(cipher), arg); ++} ++ ++static int php_openssl_compare_func(Bucket *a, Bucket *b) ++{ ++ return string_compare_function(&a->val, &b->val); ++} ++#endif ++ + /* {{{ Return array of available cipher algorithms */ + PHP_FUNCTION(openssl_get_cipher_methods) + { +@@ -6807,9 +6832,16 @@ PHP_FUNCTION(openssl_get_cipher_methods) + RETURN_THROWS(); + } + array_init(return_value); ++#if PHP_OPENSSL_API_VERSION >= 0x30000 ++ EVP_CIPHER_do_all_provided(NULL, ++ aliases ? php_openssl_add_cipher_or_alias : php_openssl_add_cipher, ++ return_value); ++ zend_hash_sort(Z_ARRVAL_P(return_value), php_openssl_compare_func, 1); ++#else + OBJ_NAME_do_all_sorted(OBJ_NAME_TYPE_CIPHER_METH, +- aliases ? php_openssl_add_method_or_alias: php_openssl_add_method, ++ aliases ? php_openssl_add_method_or_alias : php_openssl_add_method, + return_value); ++#endif + } + /* }}} */ + +diff --git a/ext/openssl/php_openssl.h b/ext/openssl/php_openssl.h +index c674ead34b..16bad9e6b0 100644 +--- a/ext/openssl/php_openssl.h ++++ b/ext/openssl/php_openssl.h +@@ -39,8 +39,10 @@ extern zend_module_entry openssl_module_entry; + #define PHP_OPENSSL_API_VERSION 0x10001 + #elif OPENSSL_VERSION_NUMBER < 0x10100000L + #define PHP_OPENSSL_API_VERSION 0x10002 +-#else ++#elif OPENSSL_VERSION_NUMBER < 0x30000000L + #define PHP_OPENSSL_API_VERSION 0x10100 ++#else ++#define PHP_OPENSSL_API_VERSION 0x30000 + #endif + #endif + +-- +2.31.1 + +From 62fbe1839d980583156b0d22c49753c4666e73e8 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Wed, 4 Aug 2021 12:05:02 +0200 +Subject: [PATCH 08/39] Avoid RC4 use in another test + +(cherry picked from commit 503146aa87e48f075f47a093ed7868e323814a66) +--- + ext/openssl/tests/openssl_open_basic.phpt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ext/openssl/tests/openssl_open_basic.phpt b/ext/openssl/tests/openssl_open_basic.phpt +index 5e551c507f..271a878cdf 100644 +--- a/ext/openssl/tests/openssl_open_basic.phpt ++++ b/ext/openssl/tests/openssl_open_basic.phpt +@@ -8,7 +8,7 @@ $data = "openssl_open() test"; + $pub_key = "file://" . __DIR__ . "/public.key"; + $priv_key = "file://" . __DIR__ . "/private_rsa_1024.key"; + $wrong = "wrong"; +-$method = "RC4"; ++$method = "AES-128-ECB"; + + openssl_seal($data, $sealed, $ekeys, array($pub_key, $pub_key, $pub_key), $method); + openssl_open($sealed, $output, $ekeys[0], $priv_key, $method); +-- +2.31.1 + +From 95e6b2c67de6a63d059b678d14f291487f563163 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Wed, 4 Aug 2021 15:47:14 +0200 +Subject: [PATCH 09/39] Use EVP_PKEY API for + openssl_public_encrypt/private_decrypt + +Use the high level API instead of the deprecated low level API. + +(cherry picked from commit 0233afae2762a7e7be49935ebbb981783c471d13) +--- + ext/openssl/openssl.c | 117 +++++++----------- + .../tests/openssl_error_string_basic.phpt | 2 +- + 2 files changed, 45 insertions(+), 74 deletions(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index 4ffa2185fb..64840da451 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -6230,11 +6230,6 @@ PHP_FUNCTION(openssl_private_encrypt) + PHP_FUNCTION(openssl_private_decrypt) + { + zval *key, *crypted; +- EVP_PKEY *pkey; +- int cryptedlen; +- zend_string *cryptedbuf = NULL; +- unsigned char *crypttemp; +- int successful = 0; + zend_long padding = RSA_PKCS1_PADDING; + char * data; + size_t data_len; +@@ -6243,11 +6238,7 @@ PHP_FUNCTION(openssl_private_decrypt) + RETURN_THROWS(); + } + +- PHP_OPENSSL_CHECK_SIZE_T_TO_INT(data_len, data, 1); +- +- RETVAL_FALSE; +- +- pkey = php_openssl_pkey_from_zval(key, 0, "", 0); ++ EVP_PKEY *pkey = php_openssl_pkey_from_zval(key, 0, "", 0); + if (pkey == NULL) { + if (!EG(exception)) { + php_error_docref(NULL, E_WARNING, "key parameter is not a valid private key"); +@@ -6255,42 +6246,33 @@ PHP_FUNCTION(openssl_private_decrypt) + RETURN_FALSE; + } + +- cryptedlen = EVP_PKEY_size(pkey); +- crypttemp = emalloc(cryptedlen + 1); +- +- switch (EVP_PKEY_id(pkey)) { +- case EVP_PKEY_RSA: +- case EVP_PKEY_RSA2: +- cryptedlen = RSA_private_decrypt((int)data_len, +- (unsigned char *)data, +- crypttemp, +- EVP_PKEY_get0_RSA(pkey), +- (int)padding); +- if (cryptedlen != -1) { +- cryptedbuf = zend_string_alloc(cryptedlen, 0); +- memcpy(ZSTR_VAL(cryptedbuf), crypttemp, cryptedlen); +- successful = 1; +- } +- break; +- default: +- php_error_docref(NULL, E_WARNING, "key type not supported in this PHP build!"); ++ size_t out_len = 0; ++ EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(pkey, NULL); ++ if (!ctx || EVP_PKEY_decrypt_init(ctx) <= 0 || ++ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || ++ EVP_PKEY_decrypt(ctx, NULL, &out_len, (unsigned char *) data, data_len) <= 0) { ++ php_openssl_store_errors(); ++ RETVAL_FALSE; ++ goto cleanup; + } + +- efree(crypttemp); +- +- if (successful) { +- ZSTR_VAL(cryptedbuf)[cryptedlen] = '\0'; +- ZEND_TRY_ASSIGN_REF_NEW_STR(crypted, cryptedbuf); +- cryptedbuf = NULL; +- RETVAL_TRUE; +- } else { ++ zend_string *out = zend_string_alloc(out_len, 0); ++ if (EVP_PKEY_decrypt(ctx, (unsigned char *) ZSTR_VAL(out), &out_len, ++ (unsigned char *) data, data_len) <= 0) { ++ zend_string_release(out); + php_openssl_store_errors(); ++ RETVAL_FALSE; ++ goto cleanup; + } + ++ out = zend_string_truncate(out, out_len, 0); ++ ZSTR_VAL(out)[out_len] = '\0'; ++ ZEND_TRY_ASSIGN_REF_NEW_STR(crypted, out); ++ RETVAL_TRUE; ++ ++cleanup: ++ EVP_PKEY_CTX_free(ctx); + EVP_PKEY_free(pkey); +- if (cryptedbuf) { +- zend_string_release_ex(cryptedbuf, 0); +- } + } + /* }}} */ + +@@ -6298,10 +6280,6 @@ PHP_FUNCTION(openssl_private_decrypt) + PHP_FUNCTION(openssl_public_encrypt) + { + zval *key, *crypted; +- EVP_PKEY *pkey; +- int cryptedlen; +- zend_string *cryptedbuf; +- int successful = 0; + zend_long padding = RSA_PKCS1_PADDING; + char * data; + size_t data_len; +@@ -6310,11 +6288,7 @@ PHP_FUNCTION(openssl_public_encrypt) + RETURN_THROWS(); + } + +- PHP_OPENSSL_CHECK_SIZE_T_TO_INT(data_len, data, 1); +- +- RETVAL_FALSE; +- +- pkey = php_openssl_pkey_from_zval(key, 1, NULL, 0); ++ EVP_PKEY *pkey = php_openssl_pkey_from_zval(key, 1, NULL, 0); + if (pkey == NULL) { + if (!EG(exception)) { + php_error_docref(NULL, E_WARNING, "key parameter is not a valid public key"); +@@ -6322,35 +6296,32 @@ PHP_FUNCTION(openssl_public_encrypt) + RETURN_FALSE; + } + +- cryptedlen = EVP_PKEY_size(pkey); +- cryptedbuf = zend_string_alloc(cryptedlen, 0); +- +- switch (EVP_PKEY_id(pkey)) { +- case EVP_PKEY_RSA: +- case EVP_PKEY_RSA2: +- successful = (RSA_public_encrypt((int)data_len, +- (unsigned char *)data, +- (unsigned char *)ZSTR_VAL(cryptedbuf), +- EVP_PKEY_get0_RSA(pkey), +- (int)padding) == cryptedlen); +- break; +- default: +- php_error_docref(NULL, E_WARNING, "key type not supported in this PHP build!"); +- ++ size_t out_len = 0; ++ EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(pkey, NULL); ++ if (!ctx || EVP_PKEY_encrypt_init(ctx) <= 0 || ++ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || ++ EVP_PKEY_encrypt(ctx, NULL, &out_len, (unsigned char *) data, data_len) <= 0) { ++ php_openssl_store_errors(); ++ RETVAL_FALSE; ++ goto cleanup; + } + +- if (successful) { +- ZSTR_VAL(cryptedbuf)[cryptedlen] = '\0'; +- ZEND_TRY_ASSIGN_REF_NEW_STR(crypted, cryptedbuf); +- cryptedbuf = NULL; +- RETVAL_TRUE; +- } else { ++ zend_string *out = zend_string_alloc(out_len, 0); ++ if (EVP_PKEY_encrypt(ctx, (unsigned char *) ZSTR_VAL(out), &out_len, ++ (unsigned char *) data, data_len) <= 0) { ++ zend_string_release(out); + php_openssl_store_errors(); ++ RETVAL_FALSE; ++ goto cleanup; + } ++ ++ ZSTR_VAL(out)[out_len] = '\0'; ++ ZEND_TRY_ASSIGN_REF_NEW_STR(crypted, out); ++ RETVAL_TRUE; ++ ++cleanup: ++ EVP_PKEY_CTX_free(ctx); + EVP_PKEY_free(pkey); +- if (cryptedbuf) { +- zend_string_release_ex(cryptedbuf, 0); +- } + } + /* }}} */ + +diff --git a/ext/openssl/tests/openssl_error_string_basic.phpt b/ext/openssl/tests/openssl_error_string_basic.phpt +index b55b7ced44..eb76dfbf77 100644 +--- a/ext/openssl/tests/openssl_error_string_basic.phpt ++++ b/ext/openssl/tests/openssl_error_string_basic.phpt +@@ -119,7 +119,7 @@ expect_openssl_errors('openssl_private_decrypt', ['04065072']); + // public encrypt and decrypt with failed padding check and padding + @openssl_public_encrypt("data", $crypted, $public_key_file, 1000); + @openssl_public_decrypt("data", $crypted, $public_key_file); +-expect_openssl_errors('openssl_private_(en|de)crypt padding', [$err_pem_no_start_line, '04068076', '04067072']); ++expect_openssl_errors('openssl_private_(en|de)crypt padding', [$err_pem_no_start_line, '0408F090', '04067072']); + + // X509 + echo "X509 errors\n"; +-- +2.31.1 + +From b29b719e4741cde6d1e441e0340f038976cb461b Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Wed, 4 Aug 2021 16:56:32 +0200 +Subject: [PATCH 10/39] Use EVP_PKEY APIs for + openssl_private_encrypt/public_decrypt + +Use high level APIs instead of deprecated low level APIs. + +(cherry picked from commit 384ad6e22412756d7a2fa7a4c35579f041784e59) +--- + ext/openssl/openssl.c | 119 +++++++----------- + .../tests/openssl_error_string_basic.phpt | 2 +- + 2 files changed, 45 insertions(+), 76 deletions(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index 64840da451..4e9b949b5f 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -6170,10 +6170,6 @@ clean_exit: + PHP_FUNCTION(openssl_private_encrypt) + { + zval *key, *crypted; +- EVP_PKEY *pkey; +- int cryptedlen; +- zend_string *cryptedbuf = NULL; +- int successful = 0; + char * data; + size_t data_len; + zend_long padding = RSA_PKCS1_PADDING; +@@ -6182,12 +6178,7 @@ PHP_FUNCTION(openssl_private_encrypt) + RETURN_THROWS(); + } + +- PHP_OPENSSL_CHECK_SIZE_T_TO_INT(data_len, data, 1); +- +- RETVAL_FALSE; +- +- pkey = php_openssl_pkey_from_zval(key, 0, "", 0); +- ++ EVP_PKEY *pkey = php_openssl_pkey_from_zval(key, 0, "", 0); + if (pkey == NULL) { + if (!EG(exception)) { + php_error_docref(NULL, E_WARNING, "key param is not a valid private key"); +@@ -6195,33 +6186,31 @@ PHP_FUNCTION(openssl_private_encrypt) + RETURN_FALSE; + } + +- cryptedlen = EVP_PKEY_size(pkey); +- cryptedbuf = zend_string_alloc(cryptedlen, 0); +- +- switch (EVP_PKEY_id(pkey)) { +- case EVP_PKEY_RSA: +- case EVP_PKEY_RSA2: +- successful = (RSA_private_encrypt((int)data_len, +- (unsigned char *)data, +- (unsigned char *)ZSTR_VAL(cryptedbuf), +- EVP_PKEY_get0_RSA(pkey), +- (int)padding) == cryptedlen); +- break; +- default: +- php_error_docref(NULL, E_WARNING, "key type not supported in this PHP build!"); ++ size_t out_len = 0; ++ EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(pkey, NULL); ++ if (!ctx || EVP_PKEY_sign_init(ctx) <= 0 || ++ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || ++ EVP_PKEY_sign(ctx, NULL, &out_len, (unsigned char *) data, data_len) <= 0) { ++ php_openssl_store_errors(); ++ RETVAL_FALSE; ++ goto cleanup; + } + +- if (successful) { +- ZSTR_VAL(cryptedbuf)[cryptedlen] = '\0'; +- ZEND_TRY_ASSIGN_REF_NEW_STR(crypted, cryptedbuf); +- cryptedbuf = NULL; +- RETVAL_TRUE; +- } else { ++ zend_string *out = zend_string_alloc(out_len, 0); ++ if (EVP_PKEY_sign(ctx, (unsigned char *) ZSTR_VAL(out), &out_len, ++ (unsigned char *) data, data_len) <= 0) { ++ zend_string_release(out); + php_openssl_store_errors(); ++ RETVAL_FALSE; ++ goto cleanup; + } +- if (cryptedbuf) { +- zend_string_release_ex(cryptedbuf, 0); +- } ++ ++ ZSTR_VAL(out)[out_len] = '\0'; ++ ZEND_TRY_ASSIGN_REF_NEW_STR(crypted, out); ++ RETVAL_TRUE; ++ ++cleanup: ++ EVP_PKEY_CTX_free(ctx); + EVP_PKEY_free(pkey); + } + /* }}} */ +@@ -6329,11 +6318,6 @@ cleanup: + PHP_FUNCTION(openssl_public_decrypt) + { + zval *key, *crypted; +- EVP_PKEY *pkey; +- int cryptedlen; +- zend_string *cryptedbuf = NULL; +- unsigned char *crypttemp; +- int successful = 0; + zend_long padding = RSA_PKCS1_PADDING; + char * data; + size_t data_len; +@@ -6342,11 +6326,7 @@ PHP_FUNCTION(openssl_public_decrypt) + RETURN_THROWS(); + } + +- PHP_OPENSSL_CHECK_SIZE_T_TO_INT(data_len, data, 1); +- +- RETVAL_FALSE; +- +- pkey = php_openssl_pkey_from_zval(key, 1, NULL, 0); ++ EVP_PKEY *pkey = php_openssl_pkey_from_zval(key, 1, NULL, 0); + if (pkey == NULL) { + if (!EG(exception)) { + php_error_docref(NULL, E_WARNING, "key parameter is not a valid public key"); +@@ -6354,43 +6334,32 @@ PHP_FUNCTION(openssl_public_decrypt) + RETURN_FALSE; + } + +- cryptedlen = EVP_PKEY_size(pkey); +- crypttemp = emalloc(cryptedlen + 1); +- +- switch (EVP_PKEY_id(pkey)) { +- case EVP_PKEY_RSA: +- case EVP_PKEY_RSA2: +- cryptedlen = RSA_public_decrypt((int)data_len, +- (unsigned char *)data, +- crypttemp, +- EVP_PKEY_get0_RSA(pkey), +- (int)padding); +- if (cryptedlen != -1) { +- cryptedbuf = zend_string_alloc(cryptedlen, 0); +- memcpy(ZSTR_VAL(cryptedbuf), crypttemp, cryptedlen); +- successful = 1; +- } +- break; +- +- default: +- php_error_docref(NULL, E_WARNING, "key type not supported in this PHP build!"); +- ++ size_t out_len = 0; ++ EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(pkey, NULL); ++ if (!ctx || EVP_PKEY_verify_recover_init(ctx) <= 0 || ++ EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0 || ++ EVP_PKEY_verify_recover(ctx, NULL, &out_len, (unsigned char *) data, data_len) <= 0) { ++ php_openssl_store_errors(); ++ RETVAL_FALSE; ++ goto cleanup; + } + +- efree(crypttemp); +- +- if (successful) { +- ZSTR_VAL(cryptedbuf)[cryptedlen] = '\0'; +- ZEND_TRY_ASSIGN_REF_NEW_STR(crypted, cryptedbuf); +- cryptedbuf = NULL; +- RETVAL_TRUE; +- } else { ++ zend_string *out = zend_string_alloc(out_len, 0); ++ if (EVP_PKEY_verify_recover(ctx, (unsigned char *) ZSTR_VAL(out), &out_len, ++ (unsigned char *) data, data_len) <= 0) { ++ zend_string_release(out); + php_openssl_store_errors(); ++ RETVAL_FALSE; ++ goto cleanup; + } + +- if (cryptedbuf) { +- zend_string_release_ex(cryptedbuf, 0); +- } ++ out = zend_string_truncate(out, out_len, 0); ++ ZSTR_VAL(out)[out_len] = '\0'; ++ ZEND_TRY_ASSIGN_REF_NEW_STR(crypted, out); ++ RETVAL_TRUE; ++ ++cleanup: ++ EVP_PKEY_CTX_free(ctx); + EVP_PKEY_free(pkey); + } + /* }}} */ +diff --git a/ext/openssl/tests/openssl_error_string_basic.phpt b/ext/openssl/tests/openssl_error_string_basic.phpt +index eb76dfbf77..f3eb82067b 100644 +--- a/ext/openssl/tests/openssl_error_string_basic.phpt ++++ b/ext/openssl/tests/openssl_error_string_basic.phpt +@@ -112,7 +112,7 @@ expect_openssl_errors('openssl_pkey_export', ['06065064', '0906A065']); + expect_openssl_errors('openssl_pkey_get_public', [$err_pem_no_start_line]); + // private encrypt with unknown padding + @openssl_private_encrypt("data", $crypted, $private_key_file, 1000); +-expect_openssl_errors('openssl_private_encrypt', ['04066076']); ++expect_openssl_errors('openssl_private_encrypt', ['0408F090']); + // private decrypt with failed padding check + @openssl_private_decrypt("data", $crypted, $private_key_file); + expect_openssl_errors('openssl_private_decrypt', ['04065072']); +-- +2.31.1 + +From bfdbdfb6bf128c157adfba402b89b0f82be993ab Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Thu, 5 Aug 2021 10:29:50 +0200 +Subject: [PATCH 11/39] Use EVP_PKEY APIs for key generation + +Use high level API instead of deprecated low level API. + +(cherry picked from commit 13313d9b1b9fa014fe6f92c496477e28f4f11772) +--- + ext/openssl/openssl.c | 210 +++++++++++++++----------------- + ext/openssl/tests/bug80747.phpt | 4 +- + 2 files changed, 101 insertions(+), 113 deletions(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index 4e9b949b5f..d260670ff9 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -3656,140 +3656,130 @@ static EVP_PKEY *php_openssl_pkey_from_zval(zval *val, int public_key, char *pas + return key; + } + ++static int php_openssl_get_evp_pkey_type(int key_type) { ++ switch (key_type) { ++ case OPENSSL_KEYTYPE_RSA: ++ return EVP_PKEY_RSA; ++#if !defined(NO_DSA) ++ case OPENSSL_KEYTYPE_DSA: ++ return EVP_PKEY_DSA; ++#endif ++#if !defined(NO_DH) ++ case OPENSSL_KEYTYPE_DH: ++ return EVP_PKEY_DH; ++#endif ++#ifdef HAVE_EVP_PKEY_EC ++ case OPENSSL_KEYTYPE_EC: ++ return EVP_PKEY_EC; ++#endif ++ default: ++ return -1; ++ } ++} ++ + /* {{{ php_openssl_generate_private_key */ + static EVP_PKEY * php_openssl_generate_private_key(struct php_x509_request * req) + { +- char * randfile = NULL; +- int egdsocket, seeded; +- EVP_PKEY * return_val = NULL; +- + if (req->priv_key_bits < MIN_KEY_LENGTH) { + php_error_docref(NULL, E_WARNING, "Private key length must be at least %d bits, configured to %d", + MIN_KEY_LENGTH, req->priv_key_bits); + return NULL; + } + +- randfile = php_openssl_conf_get_string(req->req_config, req->section_name, "RANDFILE"); ++ int type = php_openssl_get_evp_pkey_type(req->priv_key_type); ++ if (type < 0) { ++ php_error_docref(NULL, E_WARNING, "Unsupported private key type"); ++ return NULL; ++ } ++ ++ int egdsocket, seeded; ++ char *randfile = php_openssl_conf_get_string(req->req_config, req->section_name, "RANDFILE"); + php_openssl_load_rand_file(randfile, &egdsocket, &seeded); ++ PHP_OPENSSL_RAND_ADD_TIME(); + +- if ((req->priv_key = EVP_PKEY_new()) != NULL) { +- switch(req->priv_key_type) { +- case OPENSSL_KEYTYPE_RSA: +- { +- RSA* rsaparam; +-#if OPENSSL_VERSION_NUMBER < 0x10002000L +- /* OpenSSL 1.0.2 deprecates RSA_generate_key */ +- PHP_OPENSSL_RAND_ADD_TIME(); +- rsaparam = (RSA*)RSA_generate_key(req->priv_key_bits, RSA_F4, NULL, NULL); +-#else +- { +- BIGNUM *bne = (BIGNUM *)BN_new(); +- if (BN_set_word(bne, RSA_F4) != 1) { +- BN_free(bne); +- php_error_docref(NULL, E_WARNING, "Failed setting exponent"); +- return NULL; +- } +- rsaparam = RSA_new(); +- PHP_OPENSSL_RAND_ADD_TIME(); +- if (rsaparam == NULL || !RSA_generate_key_ex(rsaparam, req->priv_key_bits, bne, NULL)) { +- php_openssl_store_errors(); +- RSA_free(rsaparam); +- rsaparam = NULL; +- } +- BN_free(bne); +- } +-#endif +- if (rsaparam && EVP_PKEY_assign_RSA(req->priv_key, rsaparam)) { +- return_val = req->priv_key; +- } else { +- php_openssl_store_errors(); +- } +- } +- break; ++ EVP_PKEY *key = NULL; ++ EVP_PKEY *params = NULL; ++ EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_id(type, NULL); ++ if (!ctx) { ++ php_openssl_store_errors(); ++ goto cleanup; ++ } ++ ++ if (type != EVP_PKEY_RSA) { ++ if (EVP_PKEY_paramgen_init(ctx) <= 0) { ++ php_openssl_store_errors(); ++ goto cleanup; ++ } ++ ++ switch (type) { + #if !defined(NO_DSA) +- case OPENSSL_KEYTYPE_DSA: +- PHP_OPENSSL_RAND_ADD_TIME(); +- { +- DSA *dsaparam = DSA_new(); +- if (dsaparam && DSA_generate_parameters_ex(dsaparam, req->priv_key_bits, NULL, 0, NULL, NULL, NULL)) { +- DSA_set_method(dsaparam, DSA_get_default_method()); +- if (DSA_generate_key(dsaparam)) { +- if (EVP_PKEY_assign_DSA(req->priv_key, dsaparam)) { +- return_val = req->priv_key; +- } else { +- php_openssl_store_errors(); +- } +- } else { +- php_openssl_store_errors(); +- DSA_free(dsaparam); +- } +- } else { +- php_openssl_store_errors(); +- } +- } +- break; ++ case EVP_PKEY_DSA: ++ if (EVP_PKEY_CTX_set_dsa_paramgen_bits(ctx, req->priv_key_bits) <= 0) { ++ php_openssl_store_errors(); ++ goto cleanup; ++ } ++ break; + #endif + #if !defined(NO_DH) +- case OPENSSL_KEYTYPE_DH: +- PHP_OPENSSL_RAND_ADD_TIME(); +- { +- int codes = 0; +- DH *dhparam = DH_new(); +- if (dhparam && DH_generate_parameters_ex(dhparam, req->priv_key_bits, 2, NULL)) { +- DH_set_method(dhparam, DH_get_default_method()); +- if (DH_check(dhparam, &codes) && codes == 0 && DH_generate_key(dhparam)) { +- if (EVP_PKEY_assign_DH(req->priv_key, dhparam)) { +- return_val = req->priv_key; +- } else { +- php_openssl_store_errors(); +- } +- } else { +- php_openssl_store_errors(); +- DH_free(dhparam); +- } +- } else { +- php_openssl_store_errors(); +- } +- } +- break; ++ case EVP_PKEY_DH: ++ if (EVP_PKEY_CTX_set_dh_paramgen_prime_len(ctx, req->priv_key_bits) <= 0) { ++ php_openssl_store_errors(); ++ goto cleanup; ++ } ++ break; + #endif + #ifdef HAVE_EVP_PKEY_EC +- case OPENSSL_KEYTYPE_EC: +- { +- EC_KEY *eckey; +- if (req->curve_name == NID_undef) { +- php_error_docref(NULL, E_WARNING, "Missing configuration value: \"curve_name\" not set"); +- return NULL; +- } +- eckey = EC_KEY_new_by_curve_name(req->curve_name); +- if (eckey) { +- EC_KEY_set_asn1_flag(eckey, OPENSSL_EC_NAMED_CURVE); +- if (EC_KEY_generate_key(eckey) && +- EVP_PKEY_assign_EC_KEY(req->priv_key, eckey)) { +- return_val = req->priv_key; +- } else { +- EC_KEY_free(eckey); +- } +- } +- } +- break; ++ case EVP_PKEY_EC: ++ if (req->curve_name == NID_undef) { ++ php_error_docref(NULL, E_WARNING, "Missing configuration value: \"curve_name\" not set"); ++ goto cleanup; ++ } ++ ++ if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, req->curve_name) <= 0 || ++ EVP_PKEY_CTX_set_ec_param_enc(ctx, OPENSSL_EC_NAMED_CURVE) <= 0) { ++ php_openssl_store_errors(); ++ goto cleanup; ++ } ++ break; + #endif +- default: +- php_error_docref(NULL, E_WARNING, "Unsupported private key type"); ++ EMPTY_SWITCH_DEFAULT_CASE() + } +- } else { ++ ++ if (EVP_PKEY_paramgen(ctx, ¶ms) <= 0) { ++ php_openssl_store_errors(); ++ goto cleanup; ++ } ++ ++ EVP_PKEY_CTX_free(ctx); ++ ctx = EVP_PKEY_CTX_new(params, NULL); ++ if (!ctx) { ++ php_openssl_store_errors(); ++ goto cleanup; ++ } ++ } ++ ++ if (EVP_PKEY_keygen_init(ctx) <= 0) { + php_openssl_store_errors(); ++ goto cleanup; + } + +- php_openssl_write_rand_file(randfile, egdsocket, seeded); ++ if (type == EVP_PKEY_RSA && EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, req->priv_key_bits) <= 0) { ++ php_openssl_store_errors(); ++ goto cleanup; ++ } + +- if (return_val == NULL) { +- EVP_PKEY_free(req->priv_key); +- req->priv_key = NULL; +- return NULL; ++ if (EVP_PKEY_keygen(ctx, &key) <= 0) { ++ php_openssl_store_errors(); ++ goto cleanup; + } + +- return return_val; ++ req->priv_key = key; ++ ++cleanup: ++ php_openssl_write_rand_file(randfile, egdsocket, seeded); ++ EVP_PKEY_free(params); ++ EVP_PKEY_CTX_free(ctx); ++ return key; + } + /* }}} */ + +diff --git a/ext/openssl/tests/bug80747.phpt b/ext/openssl/tests/bug80747.phpt +index 327c916688..12ae0ff0e1 100644 +--- a/ext/openssl/tests/bug80747.phpt ++++ b/ext/openssl/tests/bug80747.phpt +@@ -14,9 +14,7 @@ $conf = array( + 'private_key_bits' => 511, + ); + var_dump(openssl_pkey_new($conf)); +-while ($e = openssl_error_string()) { +- echo $e, "\n"; +-} ++echo openssl_error_string(), "\n"; + + ?> + --EXPECTF-- +-- +2.31.1 + +From 8dfe551ef85a874df63d0bb50b2d065c3370fd7e Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Thu, 5 Aug 2021 11:50:11 +0200 +Subject: [PATCH 12/39] Relax error check + +The precise error is version-dependent, just check that there +is some kind of error reported. + +(cherry picked from commit cd8bf0b6bd23e03bdc8d069df53a2d976809a916) +--- + ext/openssl/tests/bug80747.phpt | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/ext/openssl/tests/bug80747.phpt b/ext/openssl/tests/bug80747.phpt +index 12ae0ff0e1..3f319b4b24 100644 +--- a/ext/openssl/tests/bug80747.phpt ++++ b/ext/openssl/tests/bug80747.phpt +@@ -14,9 +14,9 @@ $conf = array( + 'private_key_bits' => 511, + ); + var_dump(openssl_pkey_new($conf)); +-echo openssl_error_string(), "\n"; ++var_dump(openssl_error_string() !== false); + + ?> +---EXPECTF-- ++--EXPECT-- + bool(false) +-error:%s:key size too small ++bool(true) +-- +2.31.1 + +From 44859f59f3ff3d7cf24ae146e9b0da348e6befcd Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Thu, 5 Aug 2021 12:59:13 +0200 +Subject: [PATCH 13/39] Store whether pkey object contains private key + +Rather than querying whether the EVP_PKEY contains private key +information, determine this at time of construction and store it +in the PHP object. + +OpenSSL doesn't provide an API for this purpose, and seems +somewhat reluctant to add one, see +https://github.com/openssl/openssl/issues/9467. + +To avoid using deprecated low-level APIs to determine whether +something is a private key ourselves, remember it at the point +of construction. + +(cherry picked from commit f878bbd96b34ac11fed66c895891570ef10b0dcb) +--- + ext/openssl/openssl.c | 155 +++++++++--------------------------------- + 1 file changed, 31 insertions(+), 124 deletions(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index d260670ff9..1fca64df15 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -201,6 +201,7 @@ static void php_openssl_request_free_obj(zend_object *object) + + typedef struct _php_openssl_pkey_object { + EVP_PKEY *pkey; ++ bool is_private; + zend_object std; + } php_openssl_pkey_object; + +@@ -224,6 +225,13 @@ static zend_object *php_openssl_pkey_create_object(zend_class_entry *class_type) + return &intern->std; + } + ++static void php_openssl_pkey_object_init(zval *zv, EVP_PKEY *pkey, bool is_private) { ++ object_init_ex(zv, php_openssl_pkey_ce); ++ php_openssl_pkey_object *obj = Z_OPENSSL_PKEY_P(zv); ++ obj->pkey = pkey; ++ obj->is_private = is_private; ++} ++ + static zend_function *php_openssl_pkey_get_constructor(zend_object *object) { + zend_throw_error(NULL, "Cannot directly construct OpenSSLAsymmetricKey, use openssl_pkey_new() instead"); + return NULL; +@@ -517,7 +525,6 @@ static X509 *php_openssl_x509_from_zval(zval *val, bool *free_cert); + static X509_REQ *php_openssl_csr_from_param(zend_object *csr_obj, zend_string *csr_str); + static EVP_PKEY *php_openssl_pkey_from_zval(zval *val, int public_key, char *passphrase, size_t passphrase_len); + +-static int php_openssl_is_private_key(EVP_PKEY* pkey); + static X509_STORE * php_openssl_setup_verify(zval * calist); + static STACK_OF(X509) * php_openssl_load_all_certs_from_file(char *certfile); + static EVP_PKEY * php_openssl_generate_private_key(struct php_x509_request * req); +@@ -3362,11 +3369,8 @@ PHP_FUNCTION(openssl_csr_new) + if (we_made_the_key) { + /* and an object for the private key */ + zval zkey_object; +- php_openssl_pkey_object *key_object; +- object_init_ex(&zkey_object, php_openssl_pkey_ce); +- key_object = Z_OPENSSL_PKEY_P(&zkey_object); +- key_object->pkey = req.priv_key; +- ++ php_openssl_pkey_object_init( ++ &zkey_object, req.priv_key, /* is_private */ true); + ZEND_TRY_ASSIGN_REF_TMP(out_pkey, &zkey_object); + req.priv_key = NULL; /* make sure the cleanup code doesn't zap it! */ + } +@@ -3424,7 +3428,6 @@ PHP_FUNCTION(openssl_csr_get_public_key) + zend_string *csr_str; + zend_bool use_shortnames = 1; + +- php_openssl_pkey_object *key_object; + EVP_PKEY *tpubkey; + + ZEND_PARSE_PARAMETERS_START(1, 2) +@@ -3467,9 +3470,7 @@ PHP_FUNCTION(openssl_csr_get_public_key) + RETURN_FALSE; + } + +- object_init_ex(return_value, php_openssl_pkey_ce); +- key_object = Z_OPENSSL_PKEY_P(return_value); +- key_object->pkey = tpubkey; ++ php_openssl_pkey_object_init(return_value, tpubkey, /* is_private */ false); + } + /* }}} */ + +@@ -3545,10 +3546,9 @@ static EVP_PKEY *php_openssl_pkey_from_zval(zval *val, int public_key, char *pas + } + + if (Z_TYPE_P(val) == IS_OBJECT && Z_OBJCE_P(val) == php_openssl_pkey_ce) { +- int is_priv; +- +- key = php_openssl_pkey_from_obj(Z_OBJ_P(val))->pkey; +- is_priv = php_openssl_is_private_key(key); ++ php_openssl_pkey_object *obj = php_openssl_pkey_from_obj(Z_OBJ_P(val)); ++ key = obj->pkey; ++ bool is_priv = obj->is_private; + + /* check whether it is actually a private key if requested */ + if (!public_key && !is_priv) { +@@ -3783,85 +3783,6 @@ cleanup: + } + /* }}} */ + +-/* {{{ php_openssl_is_private_key +- Check whether the supplied key is a private key by checking if the secret prime factors are set */ +-static int php_openssl_is_private_key(EVP_PKEY* pkey) +-{ +- assert(pkey != NULL); +- +- switch (EVP_PKEY_id(pkey)) { +- case EVP_PKEY_RSA: +- case EVP_PKEY_RSA2: +- { +- RSA *rsa = EVP_PKEY_get0_RSA(pkey); +- if (rsa != NULL) { +- const BIGNUM *p, *q; +- +- RSA_get0_factors(rsa, &p, &q); +- if (p == NULL || q == NULL) { +- return 0; +- } +- } +- } +- break; +- case EVP_PKEY_DSA: +- case EVP_PKEY_DSA1: +- case EVP_PKEY_DSA2: +- case EVP_PKEY_DSA3: +- case EVP_PKEY_DSA4: +- { +- DSA *dsa = EVP_PKEY_get0_DSA(pkey); +- if (dsa != NULL) { +- const BIGNUM *p, *q, *g, *pub_key, *priv_key; +- +- DSA_get0_pqg(dsa, &p, &q, &g); +- if (p == NULL || q == NULL) { +- return 0; +- } +- +- DSA_get0_key(dsa, &pub_key, &priv_key); +- if (priv_key == NULL) { +- return 0; +- } +- } +- } +- break; +- case EVP_PKEY_DH: +- { +- DH *dh = EVP_PKEY_get0_DH(pkey); +- if (dh != NULL) { +- const BIGNUM *p, *q, *g, *pub_key, *priv_key; +- +- DH_get0_pqg(dh, &p, &q, &g); +- if (p == NULL) { +- return 0; +- } +- +- DH_get0_key(dh, &pub_key, &priv_key); +- if (priv_key == NULL) { +- return 0; +- } +- } +- } +- break; +-#ifdef HAVE_EVP_PKEY_EC +- case EVP_PKEY_EC: +- { +- EC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey); +- if (ec != NULL && NULL == EC_KEY_get0_private_key(ec)) { +- return 0; +- } +- } +- break; +-#endif +- default: +- php_error_docref(NULL, E_WARNING, "Key type not supported in this PHP build!"); +- break; +- } +- return 1; +-} +-/* }}} */ +- + #define OPENSSL_GET_BN(_array, _bn, _name) do { \ + if (_bn != NULL) { \ + int len = BN_num_bytes(_bn); \ +@@ -3920,7 +3841,7 @@ static zend_bool php_openssl_pkey_init_and_assign_rsa(EVP_PKEY *pkey, RSA *rsa, + } + + /* {{{ php_openssl_pkey_init_dsa */ +-static zend_bool php_openssl_pkey_init_dsa(DSA *dsa, zval *data) ++static zend_bool php_openssl_pkey_init_dsa(DSA *dsa, zval *data, bool *is_private) + { + BIGNUM *p, *q, *g, *priv_key, *pub_key; + const BIGNUM *priv_key_const, *pub_key_const; +@@ -3934,6 +3855,7 @@ static zend_bool php_openssl_pkey_init_dsa(DSA *dsa, zval *data) + + OPENSSL_PKEY_SET_BN(data, pub_key); + OPENSSL_PKEY_SET_BN(data, priv_key); ++ *is_private = priv_key != NULL; + if (pub_key) { + return DSA_set0_key(dsa, pub_key, priv_key); + } +@@ -3998,7 +3920,7 @@ static BIGNUM *php_openssl_dh_pub_from_priv(BIGNUM *priv_key, BIGNUM *g, BIGNUM + /* }}} */ + + /* {{{ php_openssl_pkey_init_dh */ +-static zend_bool php_openssl_pkey_init_dh(DH *dh, zval *data) ++static zend_bool php_openssl_pkey_init_dh(DH *dh, zval *data, bool *is_private) + { + BIGNUM *p, *q, *g, *priv_key, *pub_key; + +@@ -4011,6 +3933,7 @@ static zend_bool php_openssl_pkey_init_dh(DH *dh, zval *data) + + OPENSSL_PKEY_SET_BN(data, priv_key); + OPENSSL_PKEY_SET_BN(data, pub_key); ++ *is_private = priv_key != NULL; + if (pub_key) { + return DH_set0_key(dh, pub_key, priv_key); + } +@@ -4039,7 +3962,6 @@ PHP_FUNCTION(openssl_pkey_new) + struct php_x509_request req; + zval * args = NULL; + zval *data; +- php_openssl_pkey_object *key_object; + + if (zend_parse_parameters(ZEND_NUM_ARGS(), "|a!", &args) == FAILURE) { + RETURN_THROWS(); +@@ -4056,9 +3978,7 @@ PHP_FUNCTION(openssl_pkey_new) + RSA *rsa = RSA_new(); + if (rsa) { + if (php_openssl_pkey_init_and_assign_rsa(pkey, rsa, data)) { +- object_init_ex(return_value, php_openssl_pkey_ce); +- key_object = Z_OPENSSL_PKEY_P(return_value); +- key_object->pkey = pkey; ++ php_openssl_pkey_object_init(return_value, pkey, /* is_private */ true); + return; + } + RSA_free(rsa); +@@ -4076,11 +3996,10 @@ PHP_FUNCTION(openssl_pkey_new) + if (pkey) { + DSA *dsa = DSA_new(); + if (dsa) { +- if (php_openssl_pkey_init_dsa(dsa, data)) { ++ bool is_private; ++ if (php_openssl_pkey_init_dsa(dsa, data, &is_private)) { + if (EVP_PKEY_assign_DSA(pkey, dsa)) { +- object_init_ex(return_value, php_openssl_pkey_ce); +- key_object = Z_OPENSSL_PKEY_P(return_value); +- key_object->pkey = pkey; ++ php_openssl_pkey_object_init(return_value, pkey, is_private); + return; + } else { + php_openssl_store_errors(); +@@ -4101,13 +4020,10 @@ PHP_FUNCTION(openssl_pkey_new) + if (pkey) { + DH *dh = DH_new(); + if (dh) { +- if (php_openssl_pkey_init_dh(dh, data)) { ++ bool is_private; ++ if (php_openssl_pkey_init_dh(dh, data, &is_private)) { + if (EVP_PKEY_assign_DH(pkey, dh)) { +- php_openssl_pkey_object *key_object; +- +- object_init_ex(return_value, php_openssl_pkey_ce); +- key_object = Z_OPENSSL_PKEY_P(return_value); +- key_object->pkey = pkey; ++ php_openssl_pkey_object_init(return_value, pkey, is_private); + return; + } else { + php_openssl_store_errors(); +@@ -4133,6 +4049,7 @@ PHP_FUNCTION(openssl_pkey_new) + if (pkey) { + eckey = EC_KEY_new(); + if (eckey) { ++ bool is_private = false; + EC_GROUP *group = NULL; + zval *bn; + zval *x; +@@ -4164,6 +4081,7 @@ PHP_FUNCTION(openssl_pkey_new) + // The public key 'pnt' can be calculated from 'd' or is defined by 'x' and 'y' + if ((bn = zend_hash_str_find(Z_ARRVAL_P(data), "d", sizeof("d") - 1)) != NULL && + Z_TYPE_P(bn) == IS_STRING) { ++ is_private = true; + d = BN_bin2bn((unsigned char*) Z_STRVAL_P(bn), Z_STRLEN_P(bn), NULL); + if (!EC_KEY_set_private_key(eckey, d)) { + php_openssl_store_errors(); +@@ -4211,10 +4129,7 @@ PHP_FUNCTION(openssl_pkey_new) + } + if (EC_KEY_check_key(eckey) && EVP_PKEY_assign_EC_KEY(pkey, eckey)) { + EC_GROUP_free(group); +- +- object_init_ex(return_value, php_openssl_pkey_ce); +- key_object = Z_OPENSSL_PKEY_P(return_value); +- key_object->pkey = pkey; ++ php_openssl_pkey_object_init(return_value, pkey, is_private); + return; + } else { + php_openssl_store_errors(); +@@ -4249,9 +4164,7 @@ clean_exit: + if (PHP_SSL_REQ_PARSE(&req, args) == SUCCESS) { + if (php_openssl_generate_private_key(&req)) { + /* pass back a key resource */ +- object_init_ex(return_value, php_openssl_pkey_ce); +- key_object = Z_OPENSSL_PKEY_P(return_value); +- key_object->pkey = req.priv_key; ++ php_openssl_pkey_object_init(return_value, req.priv_key, /* is_private */ true); + /* make sure the cleanup code doesn't zap it! */ + req.priv_key = NULL; + } +@@ -4424,7 +4337,6 @@ PHP_FUNCTION(openssl_pkey_get_public) + { + zval *cert; + EVP_PKEY *pkey; +- php_openssl_pkey_object *key_object; + + if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &cert) == FAILURE) { + RETURN_THROWS(); +@@ -4434,9 +4346,7 @@ PHP_FUNCTION(openssl_pkey_get_public) + RETURN_FALSE; + } + +- object_init_ex(return_value, php_openssl_pkey_ce); +- key_object = Z_OPENSSL_PKEY_P(return_value); +- key_object->pkey = pkey; ++ php_openssl_pkey_object_init(return_value, pkey, /* is_private */ false); + } + /* }}} */ + +@@ -4458,7 +4368,6 @@ PHP_FUNCTION(openssl_pkey_get_private) + EVP_PKEY *pkey; + char * passphrase = ""; + size_t passphrase_len = sizeof("")-1; +- php_openssl_pkey_object *key_object; + + if (zend_parse_parameters(ZEND_NUM_ARGS(), "z|s!", &cert, &passphrase, &passphrase_len) == FAILURE) { + RETURN_THROWS(); +@@ -4473,9 +4382,7 @@ PHP_FUNCTION(openssl_pkey_get_private) + RETURN_FALSE; + } + +- object_init_ex(return_value, php_openssl_pkey_ce); +- key_object = Z_OPENSSL_PKEY_P(return_value); +- key_object->pkey = pkey; ++ php_openssl_pkey_object_init(return_value, pkey, /* is_private */ true); + } + + /* }}} */ +-- +2.31.1 + +From c58ef46342a52c8b81ee6f727257a2b471b6d9c3 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Thu, 5 Aug 2021 14:59:16 +0200 +Subject: [PATCH 14/39] Add test for openssl_dh_compute_key() + +This function was not tested at all :( + +(cherry picked from commit 7168f71e00676172e7fcf710adfc07eccd6714e6) +--- + ext/openssl/tests/openssl_dh_compute_key.phpt | 29 +++++++++++++++++++ + 1 file changed, 29 insertions(+) + create mode 100644 ext/openssl/tests/openssl_dh_compute_key.phpt + +diff --git a/ext/openssl/tests/openssl_dh_compute_key.phpt b/ext/openssl/tests/openssl_dh_compute_key.phpt +new file mode 100644 +index 0000000000..8730f4b57d +--- /dev/null ++++ b/ext/openssl/tests/openssl_dh_compute_key.phpt +@@ -0,0 +1,29 @@ ++--TEST-- ++openssl_dh_compute_key() ++--FILE-- ++ ++--EXPECT-- ++b0049944fa5d36f364dd02e675dde50f8c2d67481c5cf0fe2f248d383eec1d38c23d5ed2644fbef2676bcd6ce148361ca82619c8f93e10506cb89d0a1bdaa0f0bc6f68cef0f7cb6d97d43e8dda3c7a5c5a98ebd2342a605ce530fd46a0602d28d4afc48e92088d0bc42194ca8682a85317f812d81b86cd284eed405df2f76aae84ccd560856e8a3d0ce4f591394bca02eb8a1984ebb41bb19714fb8b579bcafd36a9051d51d075f66229893289d8a0c918bfd222f17803cc532d2cf93bb2a567953323ca409beb3237faae9c6fdfc671594324953badd07dd4770ee09fd19f90045654c5709e92aa614b83594c2f62a8bc3c7e786e54bc1259a0a737c70dd4cc +-- +2.31.1 + +From fbb478f86081d4d879d1ed644c37842e0d9b1192 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Thu, 5 Aug 2021 14:52:56 +0200 +Subject: [PATCH 15/39] Extract php_openssl_pkey_derive() function + +To allow sharing it with the openssl_dh_compute_key() implementation. + +(cherry picked from commit c6542b2a1e431e7fa980bd97c696c8c48fb58dc3) +--- + ext/openssl/openssl.c | 77 +++++++++++++++++++++++-------------------- + 1 file changed, 41 insertions(+), 36 deletions(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index 1fca64df15..bf3f70d355 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -4560,6 +4560,34 @@ PHP_FUNCTION(openssl_pkey_get_details) + } + /* }}} */ + ++static zend_string *php_openssl_pkey_derive(EVP_PKEY *key, EVP_PKEY *peer_key, size_t key_size) { ++ EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(key, NULL); ++ if (!ctx) { ++ return NULL; ++ } ++ ++ if (EVP_PKEY_derive_init(ctx) <= 0 || ++ EVP_PKEY_derive_set_peer(ctx, peer_key) <= 0 || ++ (key_size == 0 && EVP_PKEY_derive(ctx, NULL, &key_size) <= 0)) { ++ php_openssl_store_errors(); ++ EVP_PKEY_CTX_free(ctx); ++ return NULL; ++ } ++ ++ zend_string *result = zend_string_alloc(key_size, 0); ++ if (EVP_PKEY_derive(ctx, (unsigned char *)ZSTR_VAL(result), &key_size) <= 0) { ++ php_openssl_store_errors(); ++ zend_string_release_ex(result, 0); ++ EVP_PKEY_CTX_free(ctx); ++ return NULL; ++ } ++ ++ ZSTR_LEN(result) = key_size; ++ ZSTR_VAL(result)[key_size] = 0; ++ EVP_PKEY_CTX_free(ctx); ++ return result; ++} ++ + /* {{{ Computes shared secret for public value of remote DH key and local DH key */ + PHP_FUNCTION(openssl_dh_compute_key) + { +@@ -4567,7 +4595,6 @@ PHP_FUNCTION(openssl_dh_compute_key) + char *pub_str; + size_t pub_len; + DH *dh; +- EVP_PKEY *pkey; + BIGNUM *pub; + zend_string *data; + int len; +@@ -4578,11 +4605,12 @@ PHP_FUNCTION(openssl_dh_compute_key) + + PHP_OPENSSL_CHECK_SIZE_T_TO_INT(pub_len, pub_key, 1); + +- pkey = Z_OPENSSL_PKEY_P(key)->pkey; ++ EVP_PKEY *pkey = Z_OPENSSL_PKEY_P(key)->pkey; + + if (EVP_PKEY_base_id(pkey) != EVP_PKEY_DH) { + RETURN_FALSE; + } ++ + dh = EVP_PKEY_get0_DH(pkey); + if (dh == NULL) { + RETURN_FALSE; +@@ -4612,59 +4640,36 @@ PHP_FUNCTION(openssl_pkey_derive) + { + zval *priv_key; + zval *peer_pub_key; +- EVP_PKEY *pkey = NULL; +- EVP_PKEY *peer_key = NULL; +- EVP_PKEY_CTX *ctx = NULL; +- size_t key_size; + zend_long key_len = 0; +- zend_string *result; + + if (zend_parse_parameters(ZEND_NUM_ARGS(), "zz|l", &peer_pub_key, &priv_key, &key_len) == FAILURE) { + RETURN_THROWS(); + } + +- RETVAL_FALSE; + if (key_len < 0) { + zend_argument_value_error(3, "must be greater than or equal to 0"); + RETURN_THROWS(); + } + +- key_size = key_len; +- pkey = php_openssl_pkey_from_zval(priv_key, 0, "", 0); ++ EVP_PKEY *pkey = php_openssl_pkey_from_zval(priv_key, 0, "", 0); + if (!pkey) { +- goto cleanup; ++ RETURN_FALSE; + } + +- peer_key = php_openssl_pkey_from_zval(peer_pub_key, 1, NULL, 0); ++ EVP_PKEY *peer_key = php_openssl_pkey_from_zval(peer_pub_key, 1, NULL, 0); + if (!peer_key) { +- goto cleanup; +- } +- +- ctx = EVP_PKEY_CTX_new(pkey, NULL); +- if (!ctx) { +- goto cleanup; +- } +- +- if (EVP_PKEY_derive_init(ctx) > 0 +- && EVP_PKEY_derive_set_peer(ctx, peer_key) > 0 +- && (key_size > 0 || EVP_PKEY_derive(ctx, NULL, &key_size) > 0) +- && (result = zend_string_alloc(key_size, 0)) != NULL) { +- if (EVP_PKEY_derive(ctx, (unsigned char*)ZSTR_VAL(result), &key_size) > 0) { +- ZSTR_LEN(result) = key_size; +- ZSTR_VAL(result)[key_size] = 0; +- RETVAL_NEW_STR(result); +- } else { +- php_openssl_store_errors(); +- zend_string_release_ex(result, 0); +- RETVAL_FALSE; +- } ++ EVP_PKEY_free(pkey); ++ RETURN_FALSE; + } + +-cleanup: ++ zend_string *result = php_openssl_pkey_derive(pkey, peer_key, key_len); + EVP_PKEY_free(pkey); + EVP_PKEY_free(peer_key); +- if (ctx) { +- EVP_PKEY_CTX_free(ctx); ++ ++ if (result) { ++ RETURN_NEW_STR(result); ++ } else { ++ RETURN_FALSE; + } + } + /* }}} */ +-- +2.31.1 + +From f8f202ae92bf2c92cec4ad8d6bf2f57236ccd976 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Thu, 5 Aug 2021 15:58:20 +0200 +Subject: [PATCH 16/39] Avoid DH_compute_key() with OpenSSL 3 + +Instead construct a proper EVP_PKEY for the public key and +perform a derive operation. + +Unfortunately we can't use a common code path here, because +EVP_PKEY_set1_encoded_public_key() formerly known as +EVP_PKEY_set1_tls_encodedpoint() does not appear to work with +DH keys prior to OpenSSL 3. + +(cherry picked from commit cb48260fdd7e8a5a636e68917eca484530af5c94) +--- + ext/openssl/openssl.c | 64 +++++++++++++++++++++++++++---------------- + 1 file changed, 40 insertions(+), 24 deletions(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index bf3f70d355..91d2589aad 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -4588,16 +4588,48 @@ static zend_string *php_openssl_pkey_derive(EVP_PKEY *key, EVP_PKEY *peer_key, s + return result; + } + ++static zend_string *php_openssl_dh_compute_key(EVP_PKEY *pkey, char *pub_str, size_t pub_len) { ++#if PHP_OPENSSL_API_VERSION >= 0x30000 ++ EVP_PKEY *peer_key = EVP_PKEY_new(); ++ if (!peer_key || EVP_PKEY_copy_parameters(peer_key, pkey) <= 0 || ++ EVP_PKEY_set1_encoded_public_key(peer_key, (unsigned char *) pub_str, pub_len) <= 0) { ++ php_openssl_store_errors(); ++ EVP_PKEY_free(peer_key); ++ return NULL; ++ } ++ ++ zend_string *result = php_openssl_pkey_derive(pkey, peer_key, 0); ++ EVP_PKEY_free(peer_key); ++ return result; ++#else ++ DH *dh = EVP_PKEY_get0_DH(pkey); ++ if (dh == NULL) { ++ return NULL; ++ } ++ ++ BIGNUM *pub = BN_bin2bn((unsigned char*)pub_str, (int)pub_len, NULL); ++ zend_string *data = zend_string_alloc(DH_size(dh), 0); ++ int len = DH_compute_key((unsigned char*)ZSTR_VAL(data), pub, dh); ++ BN_free(pub); ++ ++ if (len < 0) { ++ php_openssl_store_errors(); ++ zend_string_release_ex(data, 0); ++ return NULL; ++ } ++ ++ ZSTR_LEN(data) = len; ++ ZSTR_VAL(data)[len] = 0; ++ return data; ++#endif ++} ++ + /* {{{ Computes shared secret for public value of remote DH key and local DH key */ + PHP_FUNCTION(openssl_dh_compute_key) + { + zval *key; + char *pub_str; + size_t pub_len; +- DH *dh; +- BIGNUM *pub; +- zend_string *data; +- int len; + + if (zend_parse_parameters(ZEND_NUM_ARGS(), "sO", &pub_str, &pub_len, &key, php_openssl_pkey_ce) == FAILURE) { + RETURN_THROWS(); +@@ -4606,32 +4638,16 @@ PHP_FUNCTION(openssl_dh_compute_key) + PHP_OPENSSL_CHECK_SIZE_T_TO_INT(pub_len, pub_key, 1); + + EVP_PKEY *pkey = Z_OPENSSL_PKEY_P(key)->pkey; +- + if (EVP_PKEY_base_id(pkey) != EVP_PKEY_DH) { + RETURN_FALSE; + } + +- dh = EVP_PKEY_get0_DH(pkey); +- if (dh == NULL) { +- RETURN_FALSE; +- } +- +- pub = BN_bin2bn((unsigned char*)pub_str, (int)pub_len, NULL); +- +- data = zend_string_alloc(DH_size(dh), 0); +- len = DH_compute_key((unsigned char*)ZSTR_VAL(data), pub, dh); +- +- if (len >= 0) { +- ZSTR_LEN(data) = len; +- ZSTR_VAL(data)[len] = 0; +- RETVAL_NEW_STR(data); ++ zend_string *result = php_openssl_dh_compute_key(pkey, pub_str, pub_len); ++ if (result) { ++ RETURN_NEW_STR(result); + } else { +- php_openssl_store_errors(); +- zend_string_release_ex(data, 0); +- RETVAL_FALSE; ++ RETURN_FALSE; + } +- +- BN_free(pub); + } + /* }}} */ + +-- +2.31.1 + +From fbb13f6bf183f1d2d95fe2aa48edce300aad5fd7 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Wed, 4 Aug 2021 14:54:59 +0200 +Subject: [PATCH 17/39] Use different algorithm in pkcs7 tests + +The default of OPENSSL_CIPHER_RC2_40 is no longer (non-legacy) +supported in OpenSSL 3, specify a newer cipher instead. + +We should probably either change the default (if acceptable) or +make the parameter required. + +(cherry picked from commit 563b3e3472d7c5e3502fb49ef023b6e18ed0f22a) +--- + .../tests/openssl_pkcs7_decrypt_basic.phpt | 3 ++- + .../tests/openssl_pkcs7_encrypt_basic.phpt | 23 ++++++++++--------- + 2 files changed, 14 insertions(+), 12 deletions(-) + +diff --git a/ext/openssl/tests/openssl_pkcs7_decrypt_basic.phpt b/ext/openssl/tests/openssl_pkcs7_decrypt_basic.phpt +index eb0698da9f..0d4da7a251 100644 +--- a/ext/openssl/tests/openssl_pkcs7_decrypt_basic.phpt ++++ b/ext/openssl/tests/openssl_pkcs7_decrypt_basic.phpt +@@ -19,8 +19,9 @@ $single_cert = "file://" . __DIR__ . "/cert.crt"; + $headers = array("test@test", "testing openssl_pkcs7_encrypt()"); + $wrong = "wrong"; + $empty = ""; ++$cipher = OPENSSL_CIPHER_AES_128_CBC; + +-openssl_pkcs7_encrypt($infile, $encrypted, $single_cert, $headers); ++openssl_pkcs7_encrypt($infile, $encrypted, $single_cert, $headers, 0, $cipher); + var_dump(openssl_pkcs7_decrypt($encrypted, $outfile, $single_cert, $privkey)); + var_dump(openssl_pkcs7_decrypt($encrypted, $outfile, openssl_x509_read($single_cert), $privkey)); + var_dump(openssl_pkcs7_decrypt($encrypted, $outfile, $single_cert, $wrong)); +diff --git a/ext/openssl/tests/openssl_pkcs7_encrypt_basic.phpt b/ext/openssl/tests/openssl_pkcs7_encrypt_basic.phpt +index ef9b25e70b..7a600bc292 100644 +--- a/ext/openssl/tests/openssl_pkcs7_encrypt_basic.phpt ++++ b/ext/openssl/tests/openssl_pkcs7_encrypt_basic.phpt +@@ -20,19 +20,20 @@ $headers = array("test@test", "testing openssl_pkcs7_encrypt()"); + $empty_headers = array(); + $wrong = "wrong"; + $empty = ""; ++$cipher = OPENSSL_CIPHER_AES_128_CBC; + +-var_dump(openssl_pkcs7_encrypt($infile, $outfile, $single_cert, $headers)); +-var_dump(openssl_pkcs7_encrypt($infile, $outfile, openssl_x509_read($single_cert), $headers)); ++var_dump(openssl_pkcs7_encrypt($infile, $outfile, $single_cert, $headers, 0, $cipher)); ++var_dump(openssl_pkcs7_encrypt($infile, $outfile, openssl_x509_read($single_cert), $headers, 0, $cipher)); + var_dump(openssl_pkcs7_decrypt($outfile, $outfile2, $single_cert, $privkey)); +-var_dump(openssl_pkcs7_encrypt($infile, $outfile, $single_cert, $assoc_headers)); +-var_dump(openssl_pkcs7_encrypt($infile, $outfile, $single_cert, $empty_headers)); +-var_dump(openssl_pkcs7_encrypt($wrong, $outfile, $single_cert, $headers)); +-var_dump(openssl_pkcs7_encrypt($empty, $outfile, $single_cert, $headers)); +-var_dump(openssl_pkcs7_encrypt($infile, $empty, $single_cert, $headers)); +-var_dump(openssl_pkcs7_encrypt($infile, $outfile, $wrong, $headers)); +-var_dump(openssl_pkcs7_encrypt($infile, $outfile, $empty, $headers)); +-var_dump(openssl_pkcs7_encrypt($infile, $outfile, $multi_certs, $headers)); +-var_dump(openssl_pkcs7_encrypt($infile, $outfile, array_map('openssl_x509_read', $multi_certs) , $headers)); ++var_dump(openssl_pkcs7_encrypt($infile, $outfile, $single_cert, $assoc_headers, 0, $cipher)); ++var_dump(openssl_pkcs7_encrypt($infile, $outfile, $single_cert, $empty_headers, 0, $cipher)); ++var_dump(openssl_pkcs7_encrypt($wrong, $outfile, $single_cert, $headers, 0, $cipher)); ++var_dump(openssl_pkcs7_encrypt($empty, $outfile, $single_cert, $headers, 0, $cipher)); ++var_dump(openssl_pkcs7_encrypt($infile, $empty, $single_cert, $headers, 0, $cipher)); ++var_dump(openssl_pkcs7_encrypt($infile, $outfile, $wrong, $headers, 0, $cipher)); ++var_dump(openssl_pkcs7_encrypt($infile, $outfile, $empty, $headers, 0, $cipher)); ++var_dump(openssl_pkcs7_encrypt($infile, $outfile, $multi_certs, $headers, 0, $cipher)); ++var_dump(openssl_pkcs7_encrypt($infile, $outfile, array_map('openssl_x509_read', $multi_certs), $headers, 0, $cipher)); + + if (file_exists($outfile)) { + echo "true\n"; +-- +2.31.1 + +From e6d9c6b6cfcc255124bb42b409c29db854ff828d Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Thu, 5 Aug 2021 16:30:55 +0200 +Subject: [PATCH 18/39] Use different algorithm in cms tests + +Same as with pkcs7, switch these tests to use an algorithm that +OpenSSL 3 supports out of the box. + +Once again, we should consider changing the default or making it +required. + +(cherry picked from commit ec4d926a80fe93c80d2b52f0178bc627097d9288) +--- + ext/openssl/tests/openssl_cms_decrypt_basic.phpt | 3 ++- + ext/openssl/tests/openssl_cms_encrypt_der.phpt | 3 ++- + ext/openssl/tests/openssl_cms_encrypt_pem.phpt | 3 ++- + 3 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/ext/openssl/tests/openssl_cms_decrypt_basic.phpt b/ext/openssl/tests/openssl_cms_decrypt_basic.phpt +index 86c70f4fde..709194ec05 100644 +--- a/ext/openssl/tests/openssl_cms_decrypt_basic.phpt ++++ b/ext/openssl/tests/openssl_cms_decrypt_basic.phpt +@@ -15,8 +15,9 @@ $single_cert = "file://" . __DIR__ . "/cert.crt"; + $headers = array("test@test", "testing openssl_cms_encrypt()"); + $wrong = "wrong"; + $empty = ""; ++$cipher = OPENSSL_CIPHER_AES_128_CBC; + +-openssl_cms_encrypt($infile, $encrypted, $single_cert, $headers); ++openssl_cms_encrypt($infile, $encrypted, $single_cert, $headers, cipher_algo: $cipher); + + var_dump(openssl_cms_decrypt($encrypted, $outfile, $single_cert, $privkey)); + print("\nDecrypted text:\n"); +diff --git a/ext/openssl/tests/openssl_cms_encrypt_der.phpt b/ext/openssl/tests/openssl_cms_encrypt_der.phpt +index e7aa8f4dad..06bfcabeb4 100644 +--- a/ext/openssl/tests/openssl_cms_encrypt_der.phpt ++++ b/ext/openssl/tests/openssl_cms_encrypt_der.phpt +@@ -14,8 +14,9 @@ $decryptfile = $tname . ".out"; + $single_cert = "file://" . __DIR__ . "/cert.crt"; + $privkey = "file://" . __DIR__ . "/private_rsa_1024.key"; + $headers = array("test@test", "testing openssl_cms_encrypt()"); ++$cipher = OPENSSL_CIPHER_AES_128_CBC; + +-var_dump(openssl_cms_encrypt($infile, $cryptfile, $single_cert, $headers, OPENSSL_CMS_BINARY, OPENSSL_ENCODING_DER)); ++var_dump(openssl_cms_encrypt($infile, $cryptfile, $single_cert, $headers, OPENSSL_CMS_BINARY, OPENSSL_ENCODING_DER, $cipher)); + if (openssl_cms_decrypt($cryptfile, $decryptfile, $single_cert, $privkey, OPENSSL_ENCODING_DER) == false) { + print "DER decrypt error\n"; + print "recipient:\n"; +diff --git a/ext/openssl/tests/openssl_cms_encrypt_pem.phpt b/ext/openssl/tests/openssl_cms_encrypt_pem.phpt +index 929f3f2e02..4030862391 100644 +--- a/ext/openssl/tests/openssl_cms_encrypt_pem.phpt ++++ b/ext/openssl/tests/openssl_cms_encrypt_pem.phpt +@@ -14,8 +14,9 @@ $decryptfile = $tname . ".pemout"; + $single_cert = "file://" . __DIR__ . "/cert.crt"; + $privkey = "file://" . __DIR__ . "/private_rsa_1024.key"; + $headers = array("test@test", "testing openssl_cms_encrypt()"); ++$cipher = OPENSSL_CIPHER_AES_128_CBC; + +-var_dump(openssl_cms_encrypt($infile, $cryptfile, $single_cert, $headers, OPENSSL_CMS_BINARY, OPENSSL_ENCODING_PEM)); ++var_dump(openssl_cms_encrypt($infile, $cryptfile, $single_cert, $headers, OPENSSL_CMS_BINARY, OPENSSL_ENCODING_PEM, $cipher)); + if (openssl_cms_decrypt($cryptfile, $decryptfile, $single_cert, $privkey, OPENSSL_ENCODING_PEM) == false) { + print "PEM decrypt error\n"; + print "recipient:\n"; +-- +2.31.1 + +From 31e60d155d01253ab42f490fecd0f2a5e537bc47 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Thu, 5 Aug 2021 17:07:44 +0200 +Subject: [PATCH 19/39] Use larger key size for DSA/DH tests + +OpenSSL 3 validates allowed sizes strictly, pick minimum sizes +that are supported. + +(cherry picked from commit 1cf4fb739f7a4fa8404a4c0958f13d04eae519d4) +--- + ext/openssl/tests/bug73711.cnf | 3 --- + ext/openssl/tests/bug73711.phpt | 11 ++++++++--- + 2 files changed, 8 insertions(+), 6 deletions(-) + delete mode 100644 ext/openssl/tests/bug73711.cnf + +diff --git a/ext/openssl/tests/bug73711.cnf b/ext/openssl/tests/bug73711.cnf +deleted file mode 100644 +index 0d27d910d4..0000000000 +--- a/ext/openssl/tests/bug73711.cnf ++++ /dev/null +@@ -1,3 +0,0 @@ +-[ req ] +-default_bits = 384 +- +diff --git a/ext/openssl/tests/bug73711.phpt b/ext/openssl/tests/bug73711.phpt +index 0b3f91b8fe..4e4bba8aa8 100644 +--- a/ext/openssl/tests/bug73711.phpt ++++ b/ext/openssl/tests/bug73711.phpt +@@ -6,9 +6,14 @@ if (!extension_loaded("openssl")) die("skip openssl not loaded"); + ?> + --FILE-- + OPENSSL_KEYTYPE_DSA, 'config' => $cnf])); +-var_dump(openssl_pkey_new(["private_key_type" => OPENSSL_KEYTYPE_DH, 'config' => $cnf])); ++var_dump(openssl_pkey_new([ ++ "private_key_type" => OPENSSL_KEYTYPE_DSA, ++ "private_key_bits" => 1024, ++])); ++var_dump(openssl_pkey_new([ ++ "private_key_type" => OPENSSL_KEYTYPE_DH, ++ "private_key_bits" => 512, ++])); + echo "DONE"; + ?> + --EXPECTF-- +-- +2.31.1 + +From b93f08093684d24a80857fec7ede1c41f440cff5 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Wed, 4 Aug 2021 13:54:26 +0200 +Subject: [PATCH 20/39] Skip some tests if cipher not available + +(cherry picked from commit d23a8b33abc3cd7e516563877a3f698b7a94ac10) +--- + ext/openssl/tests/bug71917.phpt | 1 + + ext/openssl/tests/bug72362.phpt | 1 + + ext/openssl/tests/openssl_decrypt_basic.phpt | 15 ++++++++++----- + 3 files changed, 12 insertions(+), 5 deletions(-) + +diff --git a/ext/openssl/tests/bug71917.phpt b/ext/openssl/tests/bug71917.phpt +index a68cf0162c..0cc518c4ef 100644 +--- a/ext/openssl/tests/bug71917.phpt ++++ b/ext/openssl/tests/bug71917.phpt +@@ -3,6 +3,7 @@ Bug #71917: openssl_open() returns junk on envelope < 16 bytes + --SKIPIF-- + + --FILE-- + + --FILE-- + +Date: Thu, 5 Aug 2021 16:29:43 +0200 +Subject: [PATCH 21/39] Use different cipher in one more CMS test + +Followup to ec4d926a80fe93c80d2b52f0178bc627097d9288 -- I failed +to squash in this commit. + +(cherry picked from commit a2c201351b32b1a7c44f6c6692c2a9fca9179e17) +--- + .../tests/openssl_cms_encrypt_basic.phpt | 23 ++++++++++--------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/ext/openssl/tests/openssl_cms_encrypt_basic.phpt b/ext/openssl/tests/openssl_cms_encrypt_basic.phpt +index f1a0c6af8b..ee706ebfba 100644 +--- a/ext/openssl/tests/openssl_cms_encrypt_basic.phpt ++++ b/ext/openssl/tests/openssl_cms_encrypt_basic.phpt +@@ -18,20 +18,21 @@ $headers = array("test@test", "testing openssl_cms_encrypt()"); + $empty_headers = array(); + $wrong = "wrong"; + $empty = ""; ++$cipher = OPENSSL_CIPHER_AES_128_CBC; + +-var_dump(openssl_cms_encrypt($infile, $outfile, $single_cert, $headers)); +-var_dump(openssl_cms_encrypt($infile, $outfile, openssl_x509_read($single_cert), $headers)); ++var_dump(openssl_cms_encrypt($infile, $outfile, $single_cert, $headers, cipher_algo: $cipher)); ++var_dump(openssl_cms_encrypt($infile, $outfile, openssl_x509_read($single_cert), $headers, cipher_algo: $cipher)); + var_dump(openssl_cms_decrypt($outfile, $outfile2, $single_cert, $privkey)); + readfile($outfile2); +-var_dump(openssl_cms_encrypt($infile, $outfile, $single_cert, $assoc_headers)); +-var_dump(openssl_cms_encrypt($infile, $outfile, $single_cert, $empty_headers)); +-var_dump(openssl_cms_encrypt($wrong, $outfile, $single_cert, $headers)); +-var_dump(openssl_cms_encrypt($empty, $outfile, $single_cert, $headers)); +-var_dump(openssl_cms_encrypt($infile, $empty, $single_cert, $headers)); +-var_dump(openssl_cms_encrypt($infile, $outfile, $wrong, $headers)); +-var_dump(openssl_cms_encrypt($infile, $outfile, $empty, $headers)); +-var_dump(openssl_cms_encrypt($infile, $outfile, $multi_certs, $headers)); +-var_dump(openssl_cms_encrypt($infile, $outfile, array_map('openssl_x509_read', $multi_certs) , $headers)); ++var_dump(openssl_cms_encrypt($infile, $outfile, $single_cert, $assoc_headers, cipher_algo: $cipher)); ++var_dump(openssl_cms_encrypt($infile, $outfile, $single_cert, $empty_headers, cipher_algo: $cipher)); ++var_dump(openssl_cms_encrypt($wrong, $outfile, $single_cert, $headers, cipher_algo: $cipher)); ++var_dump(openssl_cms_encrypt($empty, $outfile, $single_cert, $headers, cipher_algo: $cipher)); ++var_dump(openssl_cms_encrypt($infile, $empty, $single_cert, $headers, cipher_algo: $cipher)); ++var_dump(openssl_cms_encrypt($infile, $outfile, $wrong, $headers, cipher_algo: $cipher)); ++var_dump(openssl_cms_encrypt($infile, $outfile, $empty, $headers, cipher_algo: $cipher)); ++var_dump(openssl_cms_encrypt($infile, $outfile, $multi_certs, $headers, cipher_algo: $cipher)); ++var_dump(openssl_cms_encrypt($infile, $outfile, array_map('openssl_x509_read', $multi_certs), $headers, cipher_algo: $cipher)); + + if (file_exists($outfile)) { + echo "true\n"; +-- +2.31.1 + +From c42a69def274fb77cbcb3db4189841e3f582803a Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Fri, 6 Aug 2021 10:35:49 +0200 +Subject: [PATCH 22/39] Generate pkcs12_read test inputs on the fly + +The old p12_with_extra_certs.p12 file uses an unsupported something. + +(cherry picked from commit 5843ba518cfb9ac6ae6d6a69629239cbf77d4cfb) +--- + ext/openssl/tests/bug74022_2.phpt | 10 ++-- + .../tests/openssl_pkcs12_read_basic.phpt | 46 ++++++++++-------- + ext/openssl/tests/p12_with_extra_certs.p12 | Bin 3205 -> 0 bytes + 3 files changed, 31 insertions(+), 25 deletions(-) + delete mode 100644 ext/openssl/tests/p12_with_extra_certs.p12 + +diff --git a/ext/openssl/tests/bug74022_2.phpt b/ext/openssl/tests/bug74022_2.phpt +index 5df37fb3c9..9c38387157 100644 +--- a/ext/openssl/tests/bug74022_2.phpt ++++ b/ext/openssl/tests/bug74022_2.phpt +@@ -12,11 +12,13 @@ function test($p12_contents, $password) { + var_dump(count($cert_data['extracerts'])); + } + +-$p12_base64 = 'MIIW+QIBAzCCFr8GCSqGSIb3DQEHAaCCFrAEghasMIIWqDCCEV8GCSqGSIb3DQEHBqCCEVAwghFMAgEAMIIRRQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQYwDgQIQOfCxIAgGIICAggAgIIRGFTkvHpJjCtFjukXYVlhyOIqKiS8Zvg84dX244hhI0S51Uyn/tlXM2GD/3hDNVxcVKwP/fKN21lEkoXoK4h2/5BY3qCdZa3Ef3vk44b/+FGCUAqvsOo1ZjD2P/sBGhLu3aFnQ6ktUXlKV4cnqhlF62AqY4e5efQzmJXn+gI8cSNI5c+qQ0RQgGoRY4nJfvMSZG0/DAkirjGikU/2TZd8LwLkxVUBYbF5/T0fNtA3o99+4tF+8ZRv6ArYjplRdwcBbMbzGhn3ytCq6cmVid9iLjwHJFmvAPXKbmu0Lh5eRRznX9gBWlzGd08Q/ch0MW2ehZTu1A2VrNWl+FKWSk8l0MlSoTPJFutFiejRvMr6VzbQItyJ/mtrNa9b1Hicgoj9HaBB6arx4wKORlbSOxFNOWdTCUhFdqthK5o7b9i/owyVgyY0s7BFEZChc0zGpRq7BLrynY79b+pHKzpil9isuisp1++piHZx9Y/bpC7OP5FlYF9+3TJL0EpEFQD8FqEoqcMFRxIDWGpCQiLGcmL14OH1JKSgOJEAgogsIF/KQhvWeKcUSJlai+0sskl8mOrCt2EJwuRvzmemuzebYN3JMOiBXKONYR0yU8AeAyNTgSBimWhACtikUyfpgZXlIeXyFMvj9fmd0I/zqjaW4upqrCudCOj/CWx7+e+8udfJxI7agWwrZMf1BEkOhRFOHOIuV+IEbaoMP6vVrGlhK71oN+gnoes5ivohpFDJWSZ3+1fMh56vfNynuM2wLJO7FTROPla+4ug33V/2ubGpoIyXn2lTSbuXaYDfsXMa1inakOMW9Q+PHGdIjZrwQU/u9Q2H0IlwFd4uQojZo15SRf4xh5FOuUrrfGRAnp1mWHALTBqd2VnkgqtBl8rXZXqA+CiEhEDhTAQmvf+wCKd3FklrhV+p65YcfRK9OJv5aFQM1/+WbJozF4/Wi5j4rtIDPrgMMEflOyoZIxGxDOaklyAvaasRU2TT8E2LIEvGKOzlrhIZqWyRESjgXdh6l0UBMaVAidIZ0JLf+8fqSZ0Zia5iAaJpm82MQr/PVXC4lqqxDlHhefwM3OKfZVkfAw0a2eePM5YkIxAgMpAstBt32UIixlj/5l4MwqzP8Reb4MsV6Fph2e14vsV1diLBaJI3hrU5UBVEDWV0GSbwdhZLtdubSaBHcv5v9aZ1cdFKL6d2rHksW9ooNnh/ljPxmVlfHbb8sPYDXmLmBNJdNV1gQouhKKrt0ov1J9+sqE53D9+9dfRwf/myYlnyNgqU4vNMrZI2flyugkYoUxIC8stVF46zfL5QkSg3GqdLQC4gpeJ0WdTSyOBaOgUvqGdSARb5bXm1VXF5IxVg1B4v+puNIHS9yuphXUJvw6xWWPjbQAllDrPjMqAbxmF465vFyQP0qEvMjRD+SaFIgW4KjMqfteKo4MgqKTRF4UP9r0HkwRErOznxWDfSxzXYztY6U72NdifN9IIFiBikKQqZvfvaN+1jukehSRpGQHQB5OxeeKThJZJGiUC5Fgvl7lPb6Djx8Rfba/FJvVsR2KFS64sArtUKmC6LcJxEY9WcsiJTHek817zvYej7FD1NxuttNp+ue9ArOoIhOEf08HIOu3d2yjeRlN5CJ/jIdKYlZW6m6Ap1M+OUHhJTF73K6lKKD9Diwa3s6FoqOwtZF4uYwHnCG218BMY8GgEVD73x5KjDOP02Y6EakZNp/9QIqQT4WkMWXMaqAPADtoh8X1FJLlnvs2Ko+hLlPxuPaIA4KvSuuocnWx/6HJbdqHUS/Se+JJo0Igt4Svax1R2kvoIPuQmPmHJ6l7CeZZiNbe+baFSx+V6g/6AgHUsUOSqGvUIEns1uIE9CQ8w0G3yLVonjERJLrdj+em3Pt7fxrxoOI4nwjplX0wJk0rkQREiS8ULQDHueptUcxJxMKpugAc4CL+BsHohkhm4kpOEmviKDwzxytQhDp2Fj2PRO9kqyNrNfzNGCN5709blEIVYTtonELI2vR5Ap+O2pH+AlqrnHWgeOYAKAyWT13xCNRsGNdv2sCDDiHqxq01IBzYhPvoWzECOmGbJRRSGOVzYCJJpVjl0NNKv9ucmftSQRjm6xgLIqv1xrehDYuJ/IMsYQ5QwXBGxy7nkeRg+onWzA0ZnEWgzLs3T/Pj7z/TPQWiN03MH24RvQXTWBqp9iBwXpsCZVgUIM/VLCQJn0/V5gfRy9Ne0rk2/tHMnzGHvll5Spoy6WkxSfQ8c8CjTilaoPWV6fOcNB2Z6ZuTqX0fbnxcEAu2fOK7e6ryGipEgaxrdiopDTlgPEFMdGUETbUh0ACrv/gNsS+m5MtNisWnhxFEiXrsWoWIgW/6TgRJGo+l52bh/xxC0bwHbYuHK62sxDVeXpBOnA4VE+WckWsC0CKYJvv4vfTbLI46fyd3lnlcSuHYM4SdbND7THNeK+KB5GyuUFLgAhhtZv8ceEo63IOlBUUy1NlWnr0cbidxvVnOugFLExCV5QGr+xbrssIibQxs8AfOBK8Cxh83IlzJVe7dX1mZVG1c6AM6SKSC6F0LBOeNEvcLlz4PBMIciubCE6ecdXCzJYFbj9ERDlnrZMKrnATRMsgCPaWdyYgQwkDuCj5uqf4aiKLzA61918hLY3MB7mSyJcCkXDYKr11Br0YSAdu8uG6IjpiUQS2PFz8E8XHBmO/uobhEuCPR2LnUv+xFN8zoPQlA5ueRz1yBF8L+CsvDGp/N3KF26ETWlvmnEdt7foE+o/J7aG6xO/CNB+/+yGbVPZRVAntZec9nbqlQ55qECnWtQNnShW7+3RSGamWeTtE2DyRSfd/62JkPNEY25jbBUIkMNtKolA5dbYa+u50S3lvakMmvQvzcSC3PONajKHgk4mBn3qf9X2uM5RDL83M7489r6JPcxTnNK27rQoxplkxLiN8HuB+AB5hp82WoyvLydR4hoBnJPIYKMcmEfIR+SgLoCyNIQLjzk5Iyk1ZwdwsjyNPXi1/HHZq8+NhoTCupjGfWgXghoz89MTYAjpMvOlES2rgFuCdphSc8Nd1uQtZx4CLMOU0gut0PI81ePBBI0iG74PWMEcp5HlHHY/hPTaRkBFLYkq9CWmJc1PfjiCWf3pwRmT7dUnmcptynexIMOZt2Nd76jc+g7k5MmEK+Qdz7/c1un4sVLquxdY6nUY/znLz+2zC/OTSsF39+rak3p8TXR0kBNsHl8UTioi4CGhCMsWsQy9me25TDHzbtIvBPVp9xXufsOe2wqPLjq3iNEGXTsagx3sLvl7BJ6WW/YMC7sUpjx1Ai3zkqViW0jQB+BzMZjfYM/8Yj31EEE+WssxY+NfitBgZzeMGGjNOAKp7XN0glwhuo1G2/APyU/Zopx3gMYj5OExgkZ7kvK++7+NlPmE+8AEuZ/uf30TtKwvRXOSvAMqqm26kb/WQPCj1xFQ0AEDl0Sbyfgk1E51Cd/ujL0t32FNkSoE8pe3IaTnwAnW7NHTZ/RByh2nsr0ThfFg4pFFuSD4dzU8r2J/4YJG3B06eyyTRLoyLBQwzwIgzGBAU8USdD8CXlA8SkfBbF39500ZRNcMIt6wdQa1CHAUHDLPw9JF9Q0FwCspgkjc9+lTRZMtumN5ChgypSkUB1dzLV2hqeQzDngVjcco/CoxM0Svm8gGrM9qobCTGzGF8/wZljv1yRiqu6HGFYWDAQ/p+wWx6ScstxEAB+5R5GrOedgd4zPXi2NMvyeN+ACFRBSPkhXIXpLZADvBi/WQMYbHia1wL8WUrSGQuB4P46cWGyseaxl//6GQ9IoGbK3XuLIPeE+BpPLB0H9LSLY+5f3qOEkKzCCW0z+68ZMlanlsThLKhqk8yrmJhV4788Tr7BC3eGbAie1urrrfUR613Jsp5peLSJuWQHdWCE/fdKgoSsRJ+DYkPoyS1YNz4BF4yz1Oem9Mti7gvgTQNX6g6PCu0rN8B6HIgY9TvWy5OCoZjJKasb+OgTMld7TJDnyK5/JcvDKHNVwcpK74lxcVX7IRorP/eh4IQ1+P/Gh06A62RHp2dEh/fNuKeCiRM2vGH0gdIN/Ca6MX8MqazgJq2EONyWiqRoGPqqZpAVTa8l5kgGvxQE/CQ4x0uAxwresRRTUZ+fJEanAhTWYgI5mRoEkG88UZjyCWmCnpNMQRYHoq7iY0So5qUdkHvpUA48cNMyztPEEHsUyWC36ZCyNsQN26FoJrG9TqXedBrhcki0sPOWugvKtGsdTT354wJTDe5OCo0AH3eFo/auuuAk/DF7yu614UCmKtXHYJ61GpIkjBu9WrPAIJhndMqfGMD/yU4UMEPHyojqHvU0BSgv1k76vI3K2lqERkaNYFfzRNj+e7k+NNos8w7XCzilWBL2ePB3pG5xfivcH4tYFm0FbnIkSz52VIy+PTiK7QQuBPDRTcn1k41+9vxQxRWpsqM/NP+4gqGozNyANXLQ64Y+QXSnWrD+xMjL/kVFwUBJ2HaAIJHjZ7ZqLRzXVOUbQ9pivJiBkXvLptSo72Iw4zsbRd1x8WNEaihx1MBAj+s+4MNdC5MBkQMlSB0PTJzs9xlz0gN+Oz0lohH6JO7ngPJUYbo2AIWEYZN+9kn/RyHblQTElrJeLf1jGNi4anBfzbsIXQuVm/nsrE5MH23X66+rJzUk8Fc5JAIDGBslkDPg3UNnElcE3cYbcB/ZzjFtgz8ducWKQmI+Yqv4p7BVXji/rHPim8vL6P5xZc95tbIonp5bQH+PPSmcfDk3rrf5mS58dJvWh/UpwcfdVvUAsWLJEV1lUBg1qecVbCsa6Oy7tJ2ZK7e3KdtZrmXiYpSAnSzRNJotr4g4H99brG6IwUx3qk5BE4x3C8MpSb+1NcKnM9nhqwAGRb9sfVXG38eNltm7hDnsolQcFQmHkDSM4arUVRqmsG8O16bThtlFWbYYN355aGQxrO2pICnt0ZOAI5CA3Rl8FprhFZgVy4pcpMVwy2zCNaYGJoGYsxDm/lEWJbTGcVm6YkyaZvdkXM1uAVegLZOCKnlW9H7b1uU3NvUw4Qx3DhI5xMD9jZhlXIsYfa9s5NQjTeIX8fFbx1fdENpHjVRxs82DO26uLEaJpoL/Ywn1xfs1uV0VQb2NGPvUJKysjMRoX0Zfa0hsSBhw/ZSlyX1xfQY8ShusVswf3zEnwI1LTgtr0CvBNwnuaSDv/IoypEfCOuMrJEGJuTPDbGGyS4VeRf0He5Dk9RskehgrJcwhlw+hXajR6SluODcsEGfL+eOUjAOO9agWaqM2CfV52/vJNhA5KMEJwHuQAU1SHr4+xaW4EKWPlxB6Sjjz/IuL+toLBetBA3ZhEfokac6rQplUIiOICd3Ghwi1rpUZPL5YuP0murhpBGTdzMzGSMhSZ74LeAcoRKEG4rKKIS3fRS65QMlaLC6uOT8givHdXsk+4zLBF0BnYAe4bq8RDcpt9TJRczL6+NaxYxa36R+DRin4U1SwaUdIvEKaEDBdVLnzKkpAim5cww1MYkGZmFcVg8u8fSnoz5TeorZy00dQCMCC+SyMb58TTA08UrCOSq07+ILregexlx+Cxpbgpabo858lkJLDpPJmq8YQmog2gaMstJbpyV3M4wf1GL4ylPurPWUuyX58H8oRyX/FH79cpsbyeNoghwfvRVw8/tOUyF1DbA8Lw0HauIHTQwMTOvREPCPmlMvldIUJxHqIpqcsXESIWT/+YaHBiKGueGqPOdkFPtXSyf4t1Ka56M/9ftvdR/oFtr/iApE0Hyosz84INF/Rq9HYd8jrVb3IcQw637U2s4sE+I95+c+VaYxcDq29Jd2jD3uZfn6vbxb7Zz//Z8G4PGBNDns+D/jDoAMIIFQQYJKoZIhvcNAQcBoIIFMgSCBS4wggUqMIIFJgYLKoZIhvcNAQwKAQKgggTuMIIE6jAcBgoqhkiG9w0BDAEDMA4ECDpR8wgSXD4AAgIIAASCBMijRdwb0L38qXtBGebx6l35L3eR8/NPfJTyDKqYQOiIhNfYp/f+Ml9g3NlCB+ba03BZBCFSo1a9csjMZ1fDgS5AoNE683hbPdNj6D5JYQtvOpX/D5rawmI0iuDTIc6GOpN5PS0ds9OLnlS6pagq3U7QycuiPR0jVq72qzQUDxnqXU0XO+IwQXFP5UhKrPJe/cbUotznQPGH5g88ydM9YelIvIVImXLlXeVLY8CtzRQPSduX1zckVUMktrpSvqJUhVuN4ikhh+4ga1LvtaziOibk6HNekSlN13sqSQ7GeWGToB1AOmN8i1LZmWRnrPG61dT3uPg0R/5rPq6hrNQvAnx7Mpq7Uz1OuzDzGoaBtX+/CVIpeYLAYm7hdKouT84hk7qsT9ls1Dwb5P1C8HjBWas0KufoyxoHL61A+xGIcHkbOeVNy20AFUf7Xhb+kPlSdOhP3Ik1F2iUXa0pFxqTNcsmTDRzAReciYxVJ0lOTbqX7O6/a+U/sT109GqVGZJcpyk1FCUSk3HWbjSKOhxjpvxqfSKexr9ZOTmih7rBNYSY6sRUYgtpQyWNo8iWilwSP3FCBCbRIJrzJ5O6wn0JDTHONqxS9zENz/MvX8oHEZk+mkpxZA4YCodP10zQjzKHsXI1lRWrUARzpDfqGck1BBXXLrLNDL3w+00ipkTdEgtdhNFtHZ7A0Fda62ys5JTKt/oWSi0FPhjXdGnxf+8rBkB/jlKx99Ue6R4S+ve7Eqyl98TelFvX5C6wa63+/kw4/8L5aSlhrAUyYrykmnZ9nb61YY4HTmwpSJP0tHmr3LHxPVx15vp3KIyrYQVvbap+FvfcLjMoU6ckLQDZpQSJdFo86MdNedrKbwmVN7pV/M2b3DjPp5ixLCSXJgK3RaATIxQL88IDv4+ySL0Z2t6jUopZ40liyDnHGDl9zajeQ1WaW4yHS65aVlzYHSFvCGr8F/4Lydk5ax5HHqna6LbFeuQ4kUcUaGfiIagtFW+ueyfOckqLnwYisjG5fQmheONPHb7jg/qHQoKasD4TvmwrvUcG20c5J57oZ80C94zySYpdHTaETXHEOwz7NBPP1hplC1IaAfbhwZ48Z0kWWqddfELUC5miapzthvzpycOzL6zWmTLjyTXPZrbkqYfVrD26bsD/YOo54BThGcBdEfu2chT2eNF0rRZwF5U9TACfzMFYxUIVRq4rWAaerppkK5JNBT/la2QxUElh9HPn+0GGL1BYYEPCihciwWy2BwJs1IgjhU4ARTlukuxK+WLPTflwvlOX5G1P5D57up8kxtDncR5IIuZJgWWSFLGOkGeHXmjynLMqS1OCzIId3dj0c3EYBnku82eItAQd5fk7/rs0Lg0S1XeVSrgPphTgviGXzTWSh28S3VZJ2G7k4dr1P/sJQounjbcDrFyYaFxYXEqyO9L6vFShO5z7/vD5h9uLPddE4vC6PKJxZoWopWncLcLljuYKG0k+y4MV9U0/cESYJWzBbcZZpULdesinhxMg1wNPu5FeeFCsZpdhN2FadIuu/Kcsk6xNeDDIwwYXb3hVY0ARRAo//LyLv3zDB0LWz1LH3qJQeZ53DbgZ4VXQ6uK0yTgSsH4Lwaj5oFBPp4NJ3hdGa7trpJbeUMIxJTAjBgkqhkiG9w0BCRUxFgQUh6FIxf4sbyJnvvC+6J1NHGaa9w0wMTAhMAkGBSsOAwIaBQAEFFkCkI701QHxh2zcZkzDy8bn7qKwBAjafnZaU5r0FgICCAA='; ++$cert = file_get_contents(__DIR__ . "/public.crt"); ++$priv = file_get_contents(__DIR__ . "/private.crt"); ++$extracert = file_get_contents(__DIR__ . "/cert.crt"); ++$pass = "qwerty"; ++openssl_pkcs12_export($cert, $p12, $priv, $pass, array('extracerts' => [$extracert, $extracert])); + +-$p12 = base64_decode($p12_base64); +- +-test($p12, 'qwerty'); ++test($p12, $pass); + ?> + --EXPECT-- + int(2) +diff --git a/ext/openssl/tests/openssl_pkcs12_read_basic.phpt b/ext/openssl/tests/openssl_pkcs12_read_basic.phpt +index b81b4d9dac..8cb2b41fd7 100644 +--- a/ext/openssl/tests/openssl_pkcs12_read_basic.phpt ++++ b/ext/openssl/tests/openssl_pkcs12_read_basic.phpt +@@ -4,10 +4,12 @@ openssl_pkcs12_read() tests + + --FILE-- + $extracert)); + + var_dump(openssl_pkcs12_read("", $certs, "")); + var_dump(openssl_pkcs12_read($p12, $certs, "")); +@@ -73,24 +75,26 @@ MK80GEnRQIkB7uZVk+r0HusK + ["extracerts"]=> + array(1) { + [0]=> +- string(1111) "-----BEGIN CERTIFICATE----- +-MIIDBjCCAe4CCQDaL5/+UVeXuTANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJB +-VTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0 +-cyBQdHkgTHRkMB4XDTE1MDYxMDEyNDAwNVoXDTE2MDYwOTEyNDAwNVowRTELMAkG +-A1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0 +-IFdpZGdpdHMgUHR5IEx0ZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB +-AL/IF7bW0vpEg5A054SDqTi5pkSeie6nyIT77qCAVI5PMlhNjxuqDIlLpCWonvKb +-LMRtp7t24BsQBRgQgps8mtfRr0gV1qq9HMfDj2bZdGcTShZN/M/BFATwxaNRTHl9 +-ey8zxGcLd4aFFBlVhXHYdBXg/PG/oxJMAFuMwa+KxSP6Mqp1FlOZtvUUieQcToMf +-Mh8Lbr4g/yHFj5lgWIJ2fmJjHJZ4wf9QBeGUrVqqxzSDEL9f0PGy+grqSHoIzLr3 +-+uhvhoI85nCyZs9+lrELuQKqbiZ8Q6Vmj6JGt3miNBFVTbBpP9GK8sVuVQwgqd8p +-C3e8hHqv7vwF+s0zjiZ+rCcCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAdpTtiyDJ +-0wLB18iunXCMUJpjc/HVYEp5P9vl2E/bcZfGns/8KxNHoe9mgJycr3mwjCjMjVx2 +-L/9q/8XoT02aBncwAx4oZ2H0qfjZppaUSnSc1Uv+dsldDC2mZvJgwXN7jtQmU5P3 +-cspFHuJoYK8AqYJqlO6E4L9uRF7dLEliUnrBpF4BxziwskTquRX+zgD+fmk0L5O8 +-qqvm8btWCxfng+qD7UHFWbUQ2IegZ3VrBWJ2XsxOvokMM4HoHVb0BZgq8Dvu0XJ9 +-EriEQkcydtrRKtlcWHLKcJuNUnkw2qfj+F8mmdaZib8Apa1UCkt0ZlpyYO3V2ejY +-WIjafwJYrv6f5g== ++ string(1249) "-----BEGIN CERTIFICATE----- ++MIIDbDCCAtWgAwIBAgIJAK7FVsxyN1CiMA0GCSqGSIb3DQEBBQUAMIGBMQswCQYD ++VQQGEwJCUjEaMBgGA1UECBMRUmlvIEdyYW5kZSBkbyBTdWwxFTATBgNVBAcTDFBv ++cnRvIEFsZWdyZTEeMBwGA1UEAxMVSGVucmlxdWUgZG8gTi4gQW5nZWxvMR8wHQYJ ++KoZIhvcNAQkBFhBobmFuZ2Vsb0BwaHAubmV0MB4XDTA4MDYzMDEwMjg0M1oXDTA4 ++MDczMDEwMjg0M1owgYExCzAJBgNVBAYTAkJSMRowGAYDVQQIExFSaW8gR3JhbmRl ++IGRvIFN1bDEVMBMGA1UEBxMMUG9ydG8gQWxlZ3JlMR4wHAYDVQQDExVIZW5yaXF1 ++ZSBkbyBOLiBBbmdlbG8xHzAdBgkqhkiG9w0BCQEWEGhuYW5nZWxvQHBocC5uZXQw ++gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMteno+QK1ulX4/WDAVBYfoTPRTz ++e4SZLwgael4jwWTytj+8c5nNllrFELD6WjJzfjaoIMhCF4w4I2bkWR6/PTqrvnv+ ++iiiItHfKvJgYqIobUhkiKmWa2wL3mgqvNRIqTrTC4jWZuCkxQ/ksqL9O/F6zk+aR ++S1d+KbPaqCR5Rw+lAgMBAAGjgekwgeYwHQYDVR0OBBYEFNt+QHK9XDWF7CkpgRLo ++Ymhqtz99MIG2BgNVHSMEga4wgauAFNt+QHK9XDWF7CkpgRLoYmhqtz99oYGHpIGE ++MIGBMQswCQYDVQQGEwJCUjEaMBgGA1UECBMRUmlvIEdyYW5kZSBkbyBTdWwxFTAT ++BgNVBAcTDFBvcnRvIEFsZWdyZTEeMBwGA1UEAxMVSGVucmlxdWUgZG8gTi4gQW5n ++ZWxvMR8wHQYJKoZIhvcNAQkBFhBobmFuZ2Vsb0BwaHAubmV0ggkArsVWzHI3UKIw ++DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQCP1GUnStC0TBqngr3Kx+zS ++UW8KutKO0ORc5R8aV/x9LlaJrzPyQJgiPpu5hXogLSKRIHxQS3X2+Y0VvIpW72LW ++PVKPhYlNtO3oKnfoJGKin0eEhXRZMjfEW/kznY+ZZmNifV2r8s+KhNAqI4PbClvn ++4vh8xF/9+eVEj+hM+0OflA== + -----END CERTIFICATE----- + " + } + +-- +2.31.1 + +From 8e99695bb1f630edee4ddb44ae78e99190b5efb3 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Fri, 6 Aug 2021 11:15:18 +0200 +Subject: [PATCH 23/39] Do not special case export of EC keys + +All other private keys are exported in PKCS#8 format, while EC +keys use traditional format. Switch them to use PKCS#8 format as +well. + +As the OpenSSL docs say: + +> PEM_write_bio_PrivateKey_traditional() writes out a private key +> in the "traditional" format with a simple private key marker and +> should only be used for compatibility with legacy programs. + +(cherry picked from commit f2d3e75933fa155a5281c824263780dbc660ecb1) +--- + ext/openssl/openssl.c | 36 ++++--------------- + .../tests/openssl_pkey_export_basic.phpt | 6 +++- + 2 files changed, 11 insertions(+), 31 deletions(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index 91d2589aad..b360b0506e 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -4225,21 +4225,9 @@ PHP_FUNCTION(openssl_pkey_export_to_file) + cipher = NULL; + } + +- switch (EVP_PKEY_base_id(key)) { +-#ifdef HAVE_EVP_PKEY_EC +- case EVP_PKEY_EC: +- pem_write = PEM_write_bio_ECPrivateKey( +- bio_out, EVP_PKEY_get0_EC_KEY(key), cipher, +- (unsigned char *)passphrase, (int)passphrase_len, NULL, NULL); +- break; +-#endif +- default: +- pem_write = PEM_write_bio_PrivateKey( +- bio_out, key, cipher, +- (unsigned char *)passphrase, (int)passphrase_len, NULL, NULL); +- break; +- } +- ++ pem_write = PEM_write_bio_PrivateKey( ++ bio_out, key, cipher, ++ (unsigned char *)passphrase, (int)passphrase_len, NULL, NULL); + if (pem_write) { + /* Success! + * If returning the output as a string, do so now */ +@@ -4297,21 +4285,9 @@ PHP_FUNCTION(openssl_pkey_export) + cipher = NULL; + } + +- switch (EVP_PKEY_base_id(key)) { +-#ifdef HAVE_EVP_PKEY_EC +- case EVP_PKEY_EC: +- pem_write = PEM_write_bio_ECPrivateKey( +- bio_out, EVP_PKEY_get0_EC_KEY(key), cipher, +- (unsigned char *)passphrase, (int)passphrase_len, NULL, NULL); +- break; +-#endif +- default: +- pem_write = PEM_write_bio_PrivateKey( +- bio_out, key, cipher, +- (unsigned char *)passphrase, (int)passphrase_len, NULL, NULL); +- break; +- } +- ++ pem_write = PEM_write_bio_PrivateKey( ++ bio_out, key, cipher, ++ (unsigned char *)passphrase, (int)passphrase_len, NULL, NULL); + if (pem_write) { + /* Success! + * If returning the output as a string, do so now */ +diff --git a/ext/openssl/tests/openssl_pkey_export_basic.phpt b/ext/openssl/tests/openssl_pkey_export_basic.phpt +index 678b7e7299..5cd68d18b8 100644 +--- a/ext/openssl/tests/openssl_pkey_export_basic.phpt ++++ b/ext/openssl/tests/openssl_pkey_export_basic.phpt +@@ -47,7 +47,11 @@ var_dump($key instanceof OpenSSLAsymmetricKey); + object(OpenSSLAsymmetricKey)#%d (0) { + } + bool(true) +------BEGIN EC PRIVATE KEY-----%a-----END EC PRIVATE KEY----- ++-----BEGIN PRIVATE KEY----- ++MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgs+Sqh7IzteDBiS5K ++PfTvuWuyt9YkrkuoyiW/6bag6NmhRANCAAQ+riFshYe8HnWt1avx6OuNajipU1ZW ++6BgW0+D/EtDDSYeQg9ngO8qyo5M6cyh7ORtKZVUy7DP1+W+eocaZC+a6 ++-----END PRIVATE KEY----- + bool(true) + bool(true) + object(OpenSSLAsymmetricKey)#%d (0) { +-- +2.31.1 + +From 87bec9d2942be4a87cccb0d28cb3e134d692c312 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Fri, 6 Aug 2021 16:51:05 +0200 +Subject: [PATCH 24/39] Switch manual DH key generation to param API + +Instead of using the deprecated low-level interface. + +This should also avoid issues with fetching parameters from +legacy keys, cf. https://github.com/openssl/openssl/issues/16247. + +(cherry picked from commit a7740a0bf00704372353ea4360c3e6b58102a6f7) +--- + ext/openssl/openssl.c | 136 ++++++++++++++++++++++++++++++++++-------- + 1 file changed, 112 insertions(+), 24 deletions(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index b360b0506e..06e5adecda 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -56,6 +56,10 @@ + #include + #include + #include ++#if PHP_OPENSSL_API_VERSION >= 0x30000 ++#include ++#include ++#endif + + /* Common */ + #include +@@ -3919,8 +3923,8 @@ static BIGNUM *php_openssl_dh_pub_from_priv(BIGNUM *priv_key, BIGNUM *g, BIGNUM + } + /* }}} */ + +-/* {{{ php_openssl_pkey_init_dh */ +-static zend_bool php_openssl_pkey_init_dh(DH *dh, zval *data, bool *is_private) ++#if PHP_OPENSSL_API_VERSION < 0x30000 ++static zend_bool php_openssl_pkey_init_legacy_dh(DH *dh, zval *data, bool *is_private) + { + BIGNUM *p, *q, *g, *priv_key, *pub_key; + +@@ -3952,9 +3956,108 @@ static zend_bool php_openssl_pkey_init_dh(DH *dh, zval *data, bool *is_private) + return 0; + } + /* all good */ ++ *is_private = true; + return 1; + } +-/* }}} */ ++#endif ++ ++static EVP_PKEY *php_openssl_pkey_init_dh(zval *data, bool *is_private) ++{ ++#if PHP_OPENSSL_API_VERSION >= 0x30000 ++ BIGNUM *p = NULL, *q = NULL, *g = NULL, *priv_key = NULL, *pub_key = NULL; ++ EVP_PKEY *param_key = NULL, *pkey = NULL; ++ EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_DH, NULL); ++ OSSL_PARAM *params = NULL; ++ OSSL_PARAM_BLD *bld = OSSL_PARAM_BLD_new(); ++ ++ OPENSSL_PKEY_SET_BN(data, p); ++ OPENSSL_PKEY_SET_BN(data, q); ++ OPENSSL_PKEY_SET_BN(data, g); ++ OPENSSL_PKEY_SET_BN(data, priv_key); ++ OPENSSL_PKEY_SET_BN(data, pub_key); ++ ++ if (!ctx || !bld || !p || !g) { ++ goto cleanup; ++ } ++ ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p); ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g); ++ if (q) { ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q); ++ } ++ if (priv_key) { ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, priv_key); ++ if (!pub_key) { ++ pub_key = php_openssl_dh_pub_from_priv(priv_key, g, p); ++ if (!pub_key) { ++ goto cleanup; ++ } ++ } ++ } ++ if (pub_key) { ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY, pub_key); ++ } ++ ++ params = OSSL_PARAM_BLD_to_param(bld); ++ if (!params) { ++ goto cleanup; ++ } ++ ++ if (EVP_PKEY_fromdata_init(ctx) <= 0 || ++ EVP_PKEY_fromdata(ctx, ¶m_key, EVP_PKEY_KEYPAIR, params) <= 0) { ++ goto cleanup; ++ } ++ ++ if (pub_key || priv_key) { ++ *is_private = priv_key != NULL; ++ EVP_PKEY_up_ref(param_key); ++ pkey = param_key; ++ } else { ++ *is_private = true; ++ PHP_OPENSSL_RAND_ADD_TIME(); ++ EVP_PKEY_CTX_free(ctx); ++ ctx = EVP_PKEY_CTX_new(param_key, NULL); ++ if (EVP_PKEY_keygen_init(ctx) <= 0 || EVP_PKEY_keygen(ctx, &pkey) <= 0) { ++ goto cleanup; ++ } ++ } ++ ++cleanup: ++ php_openssl_store_errors(); ++ EVP_PKEY_free(param_key); ++ EVP_PKEY_CTX_free(ctx); ++ OSSL_PARAM_free(params); ++ OSSL_PARAM_BLD_free(bld); ++ BN_free(p); ++ BN_free(q); ++ BN_free(g); ++ BN_free(priv_key); ++ BN_free(pub_key); ++ return pkey; ++#else ++ EVP_PKEY *pkey = EVP_PKEY_new(); ++ if (!pkey) { ++ php_openssl_store_errors(); ++ return NULL; ++ } ++ ++ DH *dh = DH_new(); ++ if (!dh) { ++ EVP_PKEY_free(pkey); ++ return NULL; ++ } ++ ++ if (!php_openssl_pkey_init_legacy_dh(dh, data, is_private) ++ || !EVP_PKEY_assign_DH(pkey, dh)) { ++ php_openssl_store_errors(); ++ EVP_PKEY_free(pkey); ++ DH_free(dh); ++ return NULL; ++ } ++ ++ return pkey; ++#endif ++} + + /* {{{ Generates a new private key */ + PHP_FUNCTION(openssl_pkey_new) +@@ -4016,28 +4119,13 @@ PHP_FUNCTION(openssl_pkey_new) + RETURN_FALSE; + } else if ((data = zend_hash_str_find(Z_ARRVAL_P(args), "dh", sizeof("dh") - 1)) != NULL && + Z_TYPE_P(data) == IS_ARRAY) { +- pkey = EVP_PKEY_new(); +- if (pkey) { +- DH *dh = DH_new(); +- if (dh) { +- bool is_private; +- if (php_openssl_pkey_init_dh(dh, data, &is_private)) { +- if (EVP_PKEY_assign_DH(pkey, dh)) { +- php_openssl_pkey_object_init(return_value, pkey, is_private); +- return; +- } else { +- php_openssl_store_errors(); +- } +- } +- DH_free(dh); +- } else { +- php_openssl_store_errors(); +- } +- EVP_PKEY_free(pkey); +- } else { +- php_openssl_store_errors(); ++ bool is_private; ++ pkey = php_openssl_pkey_init_dh(data, &is_private); ++ if (!pkey) { ++ RETURN_FALSE; + } +- RETURN_FALSE; ++ php_openssl_pkey_object_init(return_value, pkey, is_private); ++ return; + #ifdef HAVE_EVP_PKEY_EC + } else if ((data = zend_hash_str_find(Z_ARRVAL_P(args), "ec", sizeof("ec") - 1)) != NULL && + Z_TYPE_P(data) == IS_ARRAY) { +-- +2.31.1 + +From 0b1f12e24360dad5c6feba319af7e12e2cf72fc1 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Fri, 6 Aug 2021 17:14:58 +0200 +Subject: [PATCH 25/39] Switch manual DSA key generation to param API + +This is very similar to the DH case, with the primary difference +that priv_key is ignored if pub_key is not given, rather than +generating pub_key from priv_key. Would be nice if these worked +the same (in which case we should probably also unify the keygen +for FFC algorithms, as it's very similar). + +(cherry picked from commit 2bf316fdfc0cfc4b6a5e27c9a13274d01b4b298f) +--- + ext/openssl/openssl.c | 126 ++++++++++++++++++++++++++++++++++-------- + 1 file changed, 102 insertions(+), 24 deletions(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index 06e5adecda..84a4083807 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -3844,8 +3844,8 @@ static zend_bool php_openssl_pkey_init_and_assign_rsa(EVP_PKEY *pkey, RSA *rsa, + return 1; + } + +-/* {{{ php_openssl_pkey_init_dsa */ +-static zend_bool php_openssl_pkey_init_dsa(DSA *dsa, zval *data, bool *is_private) ++#if PHP_OPENSSL_API_VERSION < 0x30000 ++static zend_bool php_openssl_pkey_init_legacy_dsa(DSA *dsa, zval *data, bool *is_private) + { + BIGNUM *p, *q, *g, *priv_key, *pub_key; + const BIGNUM *priv_key_const, *pub_key_const; +@@ -3878,9 +3878,102 @@ static zend_bool php_openssl_pkey_init_dsa(DSA *dsa, zval *data, bool *is_privat + return 0; + } + /* all good */ ++ *is_private = true; + return 1; + } +-/* }}} */ ++#endif ++ ++static EVP_PKEY *php_openssl_pkey_init_dsa(zval *data, bool *is_private) ++{ ++#if PHP_OPENSSL_API_VERSION >= 0x30000 ++ BIGNUM *p = NULL, *q = NULL, *g = NULL, *priv_key = NULL, *pub_key = NULL; ++ EVP_PKEY *param_key = NULL, *pkey = NULL; ++ EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_DSA, NULL); ++ OSSL_PARAM *params = NULL; ++ OSSL_PARAM_BLD *bld = OSSL_PARAM_BLD_new(); ++ ++ OPENSSL_PKEY_SET_BN(data, p); ++ OPENSSL_PKEY_SET_BN(data, q); ++ OPENSSL_PKEY_SET_BN(data, g); ++ OPENSSL_PKEY_SET_BN(data, priv_key); ++ OPENSSL_PKEY_SET_BN(data, pub_key); ++ ++ if (!ctx || !bld || !p || !q || !g) { ++ goto cleanup; ++ } ++ ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p); ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q); ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g); ++ // TODO: We silently ignore priv_key if pub_key is not given, unlike in the DH case. ++ if (pub_key) { ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PUB_KEY, pub_key); ++ if (priv_key) { ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, priv_key); ++ } ++ } ++ ++ params = OSSL_PARAM_BLD_to_param(bld); ++ if (!params) { ++ goto cleanup; ++ } ++ ++ if (EVP_PKEY_fromdata_init(ctx) <= 0 || ++ EVP_PKEY_fromdata(ctx, ¶m_key, EVP_PKEY_KEYPAIR, params) <= 0) { ++ goto cleanup; ++ } ++ ++ if (pub_key) { ++ *is_private = priv_key != NULL; ++ EVP_PKEY_up_ref(param_key); ++ pkey = param_key; ++ } else { ++ *is_private = true; ++ PHP_OPENSSL_RAND_ADD_TIME(); ++ EVP_PKEY_CTX_free(ctx); ++ ctx = EVP_PKEY_CTX_new(param_key, NULL); ++ if (EVP_PKEY_keygen_init(ctx) <= 0 || EVP_PKEY_keygen(ctx, &pkey) <= 0) { ++ goto cleanup; ++ } ++ } ++ ++cleanup: ++ php_openssl_store_errors(); ++ EVP_PKEY_free(param_key); ++ EVP_PKEY_CTX_free(ctx); ++ OSSL_PARAM_free(params); ++ OSSL_PARAM_BLD_free(bld); ++ BN_free(p); ++ BN_free(q); ++ BN_free(g); ++ BN_free(priv_key); ++ BN_free(pub_key); ++ return pkey; ++#else ++ EVP_PKEY *pkey = EVP_PKEY_new(); ++ if (!pkey) { ++ php_openssl_store_errors(); ++ return NULL; ++ } ++ ++ DSA *dsa = DSA_new(); ++ if (!dsa) { ++ php_openssl_store_errors(); ++ EVP_PKEY_free(pkey); ++ return NULL; ++ } ++ ++ if (!php_openssl_pkey_init_legacy_dsa(dsa, data, is_private) ++ || !EVP_PKEY_assign_DSA(pkey, dsa)) { ++ php_openssl_store_errors(); ++ EVP_PKEY_free(pkey); ++ DSA_free(dsa); ++ return NULL; ++ } ++ ++ return pkey; ++#endif ++} + + /* {{{ php_openssl_dh_pub_from_priv */ + static BIGNUM *php_openssl_dh_pub_from_priv(BIGNUM *priv_key, BIGNUM *g, BIGNUM *p) +@@ -4095,28 +4188,13 @@ PHP_FUNCTION(openssl_pkey_new) + RETURN_FALSE; + } else if ((data = zend_hash_str_find(Z_ARRVAL_P(args), "dsa", sizeof("dsa") - 1)) != NULL && + Z_TYPE_P(data) == IS_ARRAY) { +- pkey = EVP_PKEY_new(); +- if (pkey) { +- DSA *dsa = DSA_new(); +- if (dsa) { +- bool is_private; +- if (php_openssl_pkey_init_dsa(dsa, data, &is_private)) { +- if (EVP_PKEY_assign_DSA(pkey, dsa)) { +- php_openssl_pkey_object_init(return_value, pkey, is_private); +- return; +- } else { +- php_openssl_store_errors(); +- } +- } +- DSA_free(dsa); +- } else { +- php_openssl_store_errors(); +- } +- EVP_PKEY_free(pkey); +- } else { +- php_openssl_store_errors(); ++ bool is_private; ++ pkey = php_openssl_pkey_init_dsa(data, &is_private); ++ if (!pkey) { ++ RETURN_FALSE; + } +- RETURN_FALSE; ++ php_openssl_pkey_object_init(return_value, pkey, is_private); ++ return; + } else if ((data = zend_hash_str_find(Z_ARRVAL_P(args), "dh", sizeof("dh") - 1)) != NULL && + Z_TYPE_P(data) == IS_ARRAY) { + bool is_private; +-- +2.31.1 + +From d20cf6a278be5561debcd5ce0cc34a6046eac669 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Sun, 8 Aug 2021 17:39:06 +0200 +Subject: [PATCH 26/39] Use OpenSSL NCONF APIs (#7337) + +(cherry picked from commit 94bc5fce261a4a56a545bdfb25d5c2452a07de08) +--- + ext/openssl/openssl.c | 66 +++++++++++++++++++++++-------------------- + 1 file changed, 36 insertions(+), 30 deletions(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index 84a4083807..1dda83f71e 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -500,8 +500,8 @@ int php_openssl_get_ssl_stream_data_index() + static char default_ssl_conf_filename[MAXPATHLEN]; + + struct php_x509_request { /* {{{ */ +- LHASH_OF(CONF_VALUE) * global_config; /* Global SSL config */ +- LHASH_OF(CONF_VALUE) * req_config; /* SSL config for this request */ ++ CONF *global_config; /* Global SSL config */ ++ CONF *req_config; /* SSL config for this request */ + const EVP_MD * md_alg; + const EVP_MD * digest; + char * section_name, +@@ -712,13 +712,13 @@ static time_t php_openssl_asn1_time_to_time_t(ASN1_UTCTIME * timestr) /* {{{ */ + } + /* }}} */ + +-static inline int php_openssl_config_check_syntax(const char * section_label, const char * config_filename, const char * section, LHASH_OF(CONF_VALUE) * config) /* {{{ */ ++static inline int php_openssl_config_check_syntax(const char * section_label, const char * config_filename, const char * section, CONF *config) /* {{{ */ + { + X509V3_CTX ctx; + + X509V3_set_ctx_test(&ctx); +- X509V3_set_conf_lhash(&ctx, config); +- if (!X509V3_EXT_add_conf(config, &ctx, (char *)section, NULL)) { ++ X509V3_set_nconf(&ctx, config); ++ if (!X509V3_EXT_add_nconf(config, &ctx, (char *)section, NULL)) { + php_openssl_store_errors(); + php_error_docref(NULL, E_WARNING, "Error loading %s section %s of %s", + section_label, +@@ -730,17 +730,24 @@ static inline int php_openssl_config_check_syntax(const char * section_label, co + } + /* }}} */ + +-static char *php_openssl_conf_get_string( +- LHASH_OF(CONF_VALUE) *conf, const char *group, const char *name) { +- char *str = CONF_get_string(conf, group, name); +- if (str == NULL) { +- /* OpenSSL reports an error if a configuration value is not found. +- * However, we don't want to generate errors for optional configuration. */ +- ERR_clear_error(); +- } ++static char *php_openssl_conf_get_string(CONF *conf, const char *group, const char *name) { ++ /* OpenSSL reports an error if a configuration value is not found. ++ * However, we don't want to generate errors for optional configuration. */ ++ ERR_set_mark(); ++ char *str = NCONF_get_string(conf, group, name); ++ ERR_pop_to_mark(); + return str; + } + ++static long php_openssl_conf_get_number(CONF *conf, const char *group, const char *name) { ++ /* Same here, ignore errors. */ ++ long res = 0; ++ ERR_set_mark(); ++ NCONF_get_number(conf, group, name, &res); ++ ERR_pop_to_mark(); ++ return res; ++} ++ + static int php_openssl_add_oid_section(struct php_x509_request * req) /* {{{ */ + { + char * str; +@@ -752,7 +759,7 @@ static int php_openssl_add_oid_section(struct php_x509_request * req) /* {{{ */ + if (str == NULL) { + return SUCCESS; + } +- sktmp = CONF_get_section(req->req_config, str); ++ sktmp = NCONF_get_section(req->req_config, str); + if (sktmp == NULL) { + php_openssl_store_errors(); + php_error_docref(NULL, E_WARNING, "Problem loading oid section %s", str); +@@ -823,13 +830,13 @@ static int php_openssl_parse_config(struct php_x509_request * req, zval * option + + SET_OPTIONAL_STRING_ARG("config", req->config_filename, default_ssl_conf_filename); + SET_OPTIONAL_STRING_ARG("config_section_name", req->section_name, "req"); +- req->global_config = CONF_load(NULL, default_ssl_conf_filename, NULL); +- if (req->global_config == NULL) { ++ req->global_config = NCONF_new(NULL); ++ if (!NCONF_load(req->global_config, default_ssl_conf_filename, NULL)) { + php_openssl_store_errors(); + } +- req->req_config = CONF_load(NULL, req->config_filename, NULL); +- if (req->req_config == NULL) { +- php_openssl_store_errors(); ++ ++ req->req_config = NCONF_new(NULL); ++ if (!NCONF_load(req->req_config, req->config_filename, NULL)) { + return FAILURE; + } + +@@ -853,8 +860,7 @@ static int php_openssl_parse_config(struct php_x509_request * req, zval * option + SET_OPTIONAL_STRING_ARG("req_extensions", req->request_extensions_section, + php_openssl_conf_get_string(req->req_config, req->section_name, "req_extensions")); + SET_OPTIONAL_LONG_ARG("private_key_bits", req->priv_key_bits, +- CONF_get_number(req->req_config, req->section_name, "default_bits")); +- ++ php_openssl_conf_get_number(req->req_config, req->section_name, "default_bits")); + SET_OPTIONAL_LONG_ARG("private_key_type", req->priv_key_type, OPENSSL_KEYTYPE_DEFAULT); + + if (optional_args && (item = zend_hash_str_find(Z_ARRVAL_P(optional_args), "encrypt_key", sizeof("encrypt_key")-1)) != NULL) { +@@ -934,11 +940,11 @@ static void php_openssl_dispose_config(struct php_x509_request * req) /* {{{ */ + req->priv_key = NULL; + } + if (req->global_config) { +- CONF_free(req->global_config); ++ NCONF_free(req->global_config); + req->global_config = NULL; + } + if (req->req_config) { +- CONF_free(req->req_config); ++ NCONF_free(req->req_config); + req->req_config = NULL; + } + } +@@ -2844,12 +2850,12 @@ static int php_openssl_make_REQ(struct php_x509_request * req, X509_REQ * csr, z + STACK_OF(CONF_VALUE) * dn_sk, *attr_sk = NULL; + char * str, *dn_sect, *attr_sect; + +- dn_sect = CONF_get_string(req->req_config, req->section_name, "distinguished_name"); ++ dn_sect = NCONF_get_string(req->req_config, req->section_name, "distinguished_name"); + if (dn_sect == NULL) { + php_openssl_store_errors(); + return FAILURE; + } +- dn_sk = CONF_get_section(req->req_config, dn_sect); ++ dn_sk = NCONF_get_section(req->req_config, dn_sect); + if (dn_sk == NULL) { + php_openssl_store_errors(); + return FAILURE; +@@ -2858,7 +2864,7 @@ static int php_openssl_make_REQ(struct php_x509_request * req, X509_REQ * csr, z + if (attr_sect == NULL) { + attr_sk = NULL; + } else { +- attr_sk = CONF_get_section(req->req_config, attr_sect); ++ attr_sk = NCONF_get_section(req->req_config, attr_sect); + if (attr_sk == NULL) { + php_openssl_store_errors(); + return FAILURE; +@@ -3275,8 +3281,8 @@ PHP_FUNCTION(openssl_csr_sign) + X509V3_CTX ctx; + + X509V3_set_ctx(&ctx, cert, new_cert, csr, NULL, 0); +- X509V3_set_conf_lhash(&ctx, req.req_config); +- if (!X509V3_EXT_add_conf(req.req_config, &ctx, req.extensions_section, new_cert)) { ++ X509V3_set_nconf(&ctx, req.req_config); ++ if (!X509V3_EXT_add_nconf(req.req_config, &ctx, req.extensions_section, new_cert)) { + php_openssl_store_errors(); + goto cleanup; + } +@@ -3349,10 +3355,10 @@ PHP_FUNCTION(openssl_csr_new) + X509V3_CTX ext_ctx; + + X509V3_set_ctx(&ext_ctx, NULL, NULL, csr, NULL, 0); +- X509V3_set_conf_lhash(&ext_ctx, req.req_config); ++ X509V3_set_nconf(&ext_ctx, req.req_config); + + /* Add extensions */ +- if (req.request_extensions_section && !X509V3_EXT_REQ_add_conf(req.req_config, ++ if (req.request_extensions_section && !X509V3_EXT_REQ_add_nconf(req.req_config, + &ext_ctx, req.request_extensions_section, csr)) + { + php_openssl_store_errors(); +-- +2.31.1 + +From 575c8ddf73c4a343139be225596c5101497e3186 Mon Sep 17 00:00:00 2001 +From: Jakub Zelenka +Date: Sun, 8 Aug 2021 20:54:46 +0100 +Subject: [PATCH 27/39] Make CertificateGenerator not dependent on external + config in OpenSSL 3.0 + +(cherry picked from commit c90c9c7545427d9d35cbac45c4ec896f54619744) +--- + ext/openssl/tests/CertificateGenerator.inc | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/ext/openssl/tests/CertificateGenerator.inc b/ext/openssl/tests/CertificateGenerator.inc +index 1dc378e706..4783353a47 100644 +--- a/ext/openssl/tests/CertificateGenerator.inc ++++ b/ext/openssl/tests/CertificateGenerator.inc +@@ -65,7 +65,10 @@ class CertificateGenerator + ), + null, + $this->caKey, +- 2 ++ 2, ++ [ ++ 'config' => self::CONFIG, ++ ] + ); + } + +@@ -101,6 +104,7 @@ class CertificateGenerator + [ req ] + distinguished_name = req_distinguished_name + default_md = sha256 ++default_bits = 1024 + + [ req_distinguished_name ] + +@@ -124,8 +128,9 @@ CONFIG; + ]; + + $this->lastKey = self::generateKey($keyLength); ++ $csr = openssl_csr_new($dn, $this->lastKey, $config); + $this->lastCert = openssl_csr_sign( +- openssl_csr_new($dn, $this->lastKey, $config), ++ $csr, + $this->ca, + $this->caKey, + /* days */ 2, +@@ -139,7 +144,7 @@ CONFIG; + openssl_x509_export($this->lastCert, $certText); + + $keyText = ''; +- openssl_pkey_export($this->lastKey, $keyText); ++ openssl_pkey_export($this->lastKey, $keyText, null, $config); + + file_put_contents($file, $certText . PHP_EOL . $keyText); + } finally { +-- +2.31.1 + +From 4da1bade85b14bd1f0aa9cf9f463931de54de2ef Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Mon, 9 Aug 2021 10:26:12 +0200 +Subject: [PATCH 28/39] Extract EC key initialization + +(cherry picked from commit 14d7c7e9aee5ab55a92ddc626b7b81c130ea7618) +--- + ext/openssl/openssl.c | 239 ++++++++++++++++++++++-------------------- + 1 file changed, 126 insertions(+), 113 deletions(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index 1dda83f71e..a595101cf6 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -4158,6 +4158,126 @@ cleanup: + #endif + } + ++#ifdef HAVE_EVP_PKEY_EC ++static bool php_openssl_pkey_init_legacy_ec(EC_KEY *eckey, zval *data, bool *is_private) { ++ EC_GROUP *group = NULL; ++ EC_POINT *pnt = NULL; ++ BIGNUM *d = NULL; ++ zval *bn; ++ zval *x; ++ zval *y; ++ ++ if ((bn = zend_hash_str_find(Z_ARRVAL_P(data), "curve_name", sizeof("curve_name") - 1)) != NULL && ++ Z_TYPE_P(bn) == IS_STRING) { ++ int nid = OBJ_sn2nid(Z_STRVAL_P(bn)); ++ if (nid != NID_undef) { ++ group = EC_GROUP_new_by_curve_name(nid); ++ if (!group) { ++ php_openssl_store_errors(); ++ goto clean_exit; ++ } ++ EC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE); ++ EC_GROUP_set_point_conversion_form(group, POINT_CONVERSION_UNCOMPRESSED); ++ if (!EC_KEY_set_group(eckey, group)) { ++ php_openssl_store_errors(); ++ goto clean_exit; ++ } ++ } ++ } ++ ++ if (group == NULL) { ++ php_error_docref(NULL, E_WARNING, "Unknown curve name"); ++ goto clean_exit; ++ } ++ ++ // The public key 'pnt' can be calculated from 'd' or is defined by 'x' and 'y' ++ *is_private = false; ++ if ((bn = zend_hash_str_find(Z_ARRVAL_P(data), "d", sizeof("d") - 1)) != NULL && ++ Z_TYPE_P(bn) == IS_STRING) { ++ *is_private = true; ++ d = BN_bin2bn((unsigned char*) Z_STRVAL_P(bn), Z_STRLEN_P(bn), NULL); ++ if (!EC_KEY_set_private_key(eckey, d)) { ++ php_openssl_store_errors(); ++ goto clean_exit; ++ } ++ // Calculate the public key by multiplying the Point Q with the public key ++ // P = d * Q ++ pnt = EC_POINT_new(group); ++ if (!pnt || !EC_POINT_mul(group, pnt, d, NULL, NULL, NULL)) { ++ php_openssl_store_errors(); ++ goto clean_exit; ++ } ++ ++ BN_free(d); ++ } else if ((x = zend_hash_str_find(Z_ARRVAL_P(data), "x", sizeof("x") - 1)) != NULL && ++ Z_TYPE_P(x) == IS_STRING && ++ (y = zend_hash_str_find(Z_ARRVAL_P(data), "y", sizeof("y") - 1)) != NULL && ++ Z_TYPE_P(y) == IS_STRING) { ++ pnt = EC_POINT_new(group); ++ if (pnt == NULL) { ++ php_openssl_store_errors(); ++ goto clean_exit; ++ } ++ if (!EC_POINT_set_affine_coordinates_GFp( ++ group, pnt, BN_bin2bn((unsigned char*) Z_STRVAL_P(x), Z_STRLEN_P(x), NULL), ++ BN_bin2bn((unsigned char*) Z_STRVAL_P(y), Z_STRLEN_P(y), NULL), NULL)) { ++ php_openssl_store_errors(); ++ goto clean_exit; ++ } ++ } ++ ++ if (pnt != NULL) { ++ if (!EC_KEY_set_public_key(eckey, pnt)) { ++ php_openssl_store_errors(); ++ goto clean_exit; ++ } ++ EC_POINT_free(pnt); ++ pnt = NULL; ++ } ++ ++ if (!EC_KEY_check_key(eckey)) { ++ PHP_OPENSSL_RAND_ADD_TIME(); ++ EC_KEY_generate_key(eckey); ++ php_openssl_store_errors(); ++ } ++ if (EC_KEY_check_key(eckey)) { ++ return true; ++ } else { ++ php_openssl_store_errors(); ++ } ++ ++clean_exit: ++ BN_free(d); ++ EC_POINT_free(pnt); ++ EC_GROUP_free(group); ++ return false; ++} ++ ++static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) { ++ EVP_PKEY *pkey = EVP_PKEY_new(); ++ if (!pkey) { ++ php_openssl_store_errors(); ++ return NULL; ++ } ++ ++ EC_KEY *ec = EC_KEY_new(); ++ if (!ec) { ++ EVP_PKEY_free(pkey); ++ return NULL; ++ } ++ ++ if (!php_openssl_pkey_init_legacy_ec(ec, data, is_private) ++ || !EVP_PKEY_assign_EC_KEY(pkey, ec)) { ++ php_openssl_store_errors(); ++ EVP_PKEY_free(pkey); ++ EC_KEY_free(ec); ++ return NULL; ++ } ++ ++ return pkey; ++} ++#endif ++ + /* {{{ Generates a new private key */ + PHP_FUNCTION(openssl_pkey_new) + { +@@ -4213,120 +4333,13 @@ PHP_FUNCTION(openssl_pkey_new) + #ifdef HAVE_EVP_PKEY_EC + } else if ((data = zend_hash_str_find(Z_ARRVAL_P(args), "ec", sizeof("ec") - 1)) != NULL && + Z_TYPE_P(data) == IS_ARRAY) { +- EC_KEY *eckey = NULL; +- EC_GROUP *group = NULL; +- EC_POINT *pnt = NULL; +- BIGNUM *d = NULL; +- pkey = EVP_PKEY_new(); +- if (pkey) { +- eckey = EC_KEY_new(); +- if (eckey) { +- bool is_private = false; +- EC_GROUP *group = NULL; +- zval *bn; +- zval *x; +- zval *y; +- +- if ((bn = zend_hash_str_find(Z_ARRVAL_P(data), "curve_name", sizeof("curve_name") - 1)) != NULL && +- Z_TYPE_P(bn) == IS_STRING) { +- int nid = OBJ_sn2nid(Z_STRVAL_P(bn)); +- if (nid != NID_undef) { +- group = EC_GROUP_new_by_curve_name(nid); +- if (!group) { +- php_openssl_store_errors(); +- goto clean_exit; +- } +- EC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE); +- EC_GROUP_set_point_conversion_form(group, POINT_CONVERSION_UNCOMPRESSED); +- if (!EC_KEY_set_group(eckey, group)) { +- php_openssl_store_errors(); +- goto clean_exit; +- } +- } +- } +- +- if (group == NULL) { +- php_error_docref(NULL, E_WARNING, "Unknown curve name"); +- goto clean_exit; +- } +- +- // The public key 'pnt' can be calculated from 'd' or is defined by 'x' and 'y' +- if ((bn = zend_hash_str_find(Z_ARRVAL_P(data), "d", sizeof("d") - 1)) != NULL && +- Z_TYPE_P(bn) == IS_STRING) { +- is_private = true; +- d = BN_bin2bn((unsigned char*) Z_STRVAL_P(bn), Z_STRLEN_P(bn), NULL); +- if (!EC_KEY_set_private_key(eckey, d)) { +- php_openssl_store_errors(); +- goto clean_exit; +- } +- // Calculate the public key by multiplying the Point Q with the public key +- // P = d * Q +- pnt = EC_POINT_new(group); +- if (!pnt || !EC_POINT_mul(group, pnt, d, NULL, NULL, NULL)) { +- php_openssl_store_errors(); +- goto clean_exit; +- } +- +- BN_free(d); +- } else if ((x = zend_hash_str_find(Z_ARRVAL_P(data), "x", sizeof("x") - 1)) != NULL && +- Z_TYPE_P(x) == IS_STRING && +- (y = zend_hash_str_find(Z_ARRVAL_P(data), "y", sizeof("y") - 1)) != NULL && +- Z_TYPE_P(y) == IS_STRING) { +- pnt = EC_POINT_new(group); +- if (pnt == NULL) { +- php_openssl_store_errors(); +- goto clean_exit; +- } +- if (!EC_POINT_set_affine_coordinates_GFp( +- group, pnt, BN_bin2bn((unsigned char*) Z_STRVAL_P(x), Z_STRLEN_P(x), NULL), +- BN_bin2bn((unsigned char*) Z_STRVAL_P(y), Z_STRLEN_P(y), NULL), NULL)) { +- php_openssl_store_errors(); +- goto clean_exit; +- } +- } +- +- if (pnt != NULL) { +- if (!EC_KEY_set_public_key(eckey, pnt)) { +- php_openssl_store_errors(); +- goto clean_exit; +- } +- EC_POINT_free(pnt); +- pnt = NULL; +- } +- +- if (!EC_KEY_check_key(eckey)) { +- PHP_OPENSSL_RAND_ADD_TIME(); +- EC_KEY_generate_key(eckey); +- php_openssl_store_errors(); +- } +- if (EC_KEY_check_key(eckey) && EVP_PKEY_assign_EC_KEY(pkey, eckey)) { +- EC_GROUP_free(group); +- php_openssl_pkey_object_init(return_value, pkey, is_private); +- return; +- } else { +- php_openssl_store_errors(); +- } +- } else { +- php_openssl_store_errors(); +- } +- } else { +- php_openssl_store_errors(); +- } +-clean_exit: +- if (d != NULL) { +- BN_free(d); +- } +- if (pnt != NULL) { +- EC_POINT_free(pnt); +- } +- if (group != NULL) { +- EC_GROUP_free(group); +- } +- if (eckey != NULL) { +- EC_KEY_free(eckey); ++ bool is_private; ++ pkey = php_openssl_pkey_init_ec(data, &is_private); ++ if (!pkey) { ++ RETURN_FALSE; + } +- EVP_PKEY_free(pkey); +- RETURN_FALSE; ++ php_openssl_pkey_object_init(return_value, pkey, is_private); ++ return; + #endif + } + } +-- +2.31.1 + +From 0b12c49898ef390ce53e33490a842fd384de6902 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Mon, 9 Aug 2021 12:01:35 +0200 +Subject: [PATCH 29/39] Test calculation of EC public key from private key + +(cherry picked from commit 246698671f941b2034518ab04f35009b2da77bb1) +--- + ext/openssl/tests/ecc.phpt | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/ext/openssl/tests/ecc.phpt b/ext/openssl/tests/ecc.phpt +index 0a71393ae3..0b05410c2c 100644 +--- a/ext/openssl/tests/ecc.phpt ++++ b/ext/openssl/tests/ecc.phpt +@@ -33,6 +33,16 @@ $d2 = openssl_pkey_get_details($key2); + // Compare array + var_dump($d1 === $d2); + ++// Check that the public key info is computed from the private key if it is missing. ++$d1_priv = $d1; ++unset($d1_priv["ec"]["x"]); ++unset($d1_priv["ec"]["y"]); ++ ++$key3 = openssl_pkey_new($d1_priv); ++var_dump($key3); ++$d3 = openssl_pkey_get_details($key3); ++var_dump($d1 === $d3); ++ + $dn = array( + "countryName" => "BR", + "stateOrProvinceName" => "Rio Grande do Sul", +@@ -93,6 +103,9 @@ bool(true) + object(OpenSSLAsymmetricKey)#%d (0) { + } + bool(true) ++object(OpenSSLAsymmetricKey)#%d (0) { ++} ++bool(true) + Testing openssl_csr_new with key generation + NULL + object(OpenSSLAsymmetricKey)#%d (0) { +-- +2.31.1 + +From 6b6b7c28dc81e106f6a1ef96d1f4bc43901764cf Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Mon, 9 Aug 2021 11:12:20 +0200 +Subject: [PATCH 30/39] Use param API for creating EC keys + +Rather than the deprecated low level APIs. + +(cherry picked from commit f9e701cde813fad4e1f647e63750c0b9bdeadb4e) +--- + ext/openssl/openssl.c | 96 +++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 96 insertions(+) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index a595101cf6..df057caa8b 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -4159,6 +4159,7 @@ cleanup: + } + + #ifdef HAVE_EVP_PKEY_EC ++#if PHP_OPENSSL_API_VERSION < 0x30000 + static bool php_openssl_pkey_init_legacy_ec(EC_KEY *eckey, zval *data, bool *is_private) { + EC_GROUP *group = NULL; + EC_POINT *pnt = NULL; +@@ -4236,6 +4237,7 @@ static bool php_openssl_pkey_init_legacy_ec(EC_KEY *eckey, zval *data, bool *is_ + } + + if (!EC_KEY_check_key(eckey)) { ++ *is_private = true; + PHP_OPENSSL_RAND_ADD_TIME(); + EC_KEY_generate_key(eckey); + php_openssl_store_errors(); +@@ -4252,8 +4254,101 @@ clean_exit: + EC_GROUP_free(group); + return false; + } ++#endif + + static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) { ++#if PHP_OPENSSL_API_VERSION >= 0x30000 ++ BIGNUM *d = NULL, *x = NULL, *y = NULL; ++ EC_GROUP *group = NULL; ++ EC_POINT *pnt = NULL; ++ char *pnt_oct = NULL; ++ EVP_PKEY *param_key = NULL, *pkey = NULL; ++ EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL); ++ OSSL_PARAM *params = NULL; ++ OSSL_PARAM_BLD *bld = OSSL_PARAM_BLD_new(); ++ zval *curve_name_zv = zend_hash_str_find(Z_ARRVAL_P(data), "curve_name", sizeof("curve_name") - 1); ++ ++ OPENSSL_PKEY_SET_BN(data, d); ++ OPENSSL_PKEY_SET_BN(data, x); ++ OPENSSL_PKEY_SET_BN(data, y); ++ ++ if (!ctx || !bld || !curve_name_zv || Z_TYPE_P(curve_name_zv) != IS_STRING) { ++ goto cleanup; ++ } ++ ++ int nid = OBJ_sn2nid(Z_STRVAL_P(curve_name_zv)); ++ group = EC_GROUP_new_by_curve_name(nid); ++ if (!group) { ++ php_error_docref(NULL, E_WARNING, "Unknown curve name"); ++ goto cleanup; ++ } ++ ++ OSSL_PARAM_BLD_push_utf8_string( ++ bld, OSSL_PKEY_PARAM_GROUP_NAME, Z_STRVAL_P(curve_name_zv), Z_STRLEN_P(curve_name_zv)); ++ ++ if (d) { ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_PRIV_KEY, d); ++ ++ pnt = EC_POINT_new(group); ++ if (!pnt || !EC_POINT_mul(group, pnt, d, NULL, NULL, NULL)) { ++ goto cleanup; ++ } ++ } else if (x && y) { ++ /* OpenSSL does not allow setting EC_PUB_X/EC_PUB_Y, so convert to encoded format. */ ++ pnt = EC_POINT_new(group); ++ if (!pnt || !EC_POINT_set_affine_coordinates(group, pnt, x, y, NULL)) { ++ goto cleanup; ++ } ++ } ++ ++ if (pnt) { ++ size_t pnt_oct_len = ++ EC_POINT_point2buf(group, pnt, POINT_CONVERSION_COMPRESSED, &pnt_oct, NULL); ++ if (!pnt_oct_len) { ++ goto cleanup; ++ } ++ ++ OSSL_PARAM_BLD_push_octet_string(bld, OSSL_PKEY_PARAM_PUB_KEY, pnt_oct, pnt_oct_len); ++ } ++ ++ params = OSSL_PARAM_BLD_to_param(bld); ++ if (!params) { ++ goto cleanup; ++ } ++ ++ if (EVP_PKEY_fromdata_init(ctx) <= 0 || ++ EVP_PKEY_fromdata(ctx, ¶m_key, EVP_PKEY_KEYPAIR, params) <= 0) { ++ goto cleanup; ++ } ++ ++ EVP_PKEY_CTX_free(ctx); ++ ctx = EVP_PKEY_CTX_new(param_key, NULL); ++ if (EVP_PKEY_check(ctx)) { ++ *is_private = d != NULL; ++ EVP_PKEY_up_ref(param_key); ++ pkey = param_key; ++ } else { ++ *is_private = true; ++ PHP_OPENSSL_RAND_ADD_TIME(); ++ if (EVP_PKEY_keygen_init(ctx) <= 0 || EVP_PKEY_keygen(ctx, &pkey) <= 0) { ++ goto cleanup; ++ } ++ } ++ ++cleanup: ++ php_openssl_store_errors(); ++ EVP_PKEY_free(param_key); ++ EVP_PKEY_CTX_free(ctx); ++ OSSL_PARAM_free(params); ++ OSSL_PARAM_BLD_free(bld); ++ EC_POINT_free(pnt); ++ EC_GROUP_free(group); ++ OPENSSL_free(pnt_oct); ++ BN_free(d); ++ BN_free(x); ++ BN_free(y); ++ return pkey; ++#else + EVP_PKEY *pkey = EVP_PKEY_new(); + if (!pkey) { + php_openssl_store_errors(); +@@ -4275,6 +4370,7 @@ static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) { + } + + return pkey; ++#endif + } + #endif + +-- +2.31.1 + +From ab4d43be04953eb75b37d532ac5fe42f0464f1be Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Mon, 9 Aug 2021 14:19:33 +0200 +Subject: [PATCH 31/39] Extract public key portion via PEM roundtrip + +The workaround with cloning the X509_REQ no longer works in +OpenSSL 3. Instead extract the public key portion by round +tripping through PEM. + +(cherry picked from commit 26a51e8d7a6026f6bd69813d044785d154a296a3) +--- + ext/openssl/openssl.c | 43 +++++++++++++++++++------------------------ + 1 file changed, 19 insertions(+), 24 deletions(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index df057caa8b..e86e99c73f 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -3430,49 +3430,44 @@ PHP_FUNCTION(openssl_csr_get_subject) + } + /* }}} */ + ++static EVP_PKEY *php_openssl_extract_public_key(EVP_PKEY *priv_key) ++{ ++ /* Extract public key portion by round-tripping through PEM. */ ++ BIO *bio = BIO_new(BIO_s_mem()); ++ if (!bio || !PEM_write_bio_PUBKEY(bio, priv_key)) { ++ BIO_free(bio); ++ return NULL; ++ } ++ ++ EVP_PKEY *pub_key = PEM_read_bio_PUBKEY(bio, NULL, NULL, NULL); ++ BIO_free(bio); ++ return pub_key; ++} ++ + /* {{{ Returns the subject of a CERT or FALSE on error */ + PHP_FUNCTION(openssl_csr_get_public_key) + { +- X509_REQ *orig_csr, *csr; + zend_object *csr_obj; + zend_string *csr_str; + zend_bool use_shortnames = 1; + +- EVP_PKEY *tpubkey; +- + ZEND_PARSE_PARAMETERS_START(1, 2) + Z_PARAM_OBJ_OF_CLASS_OR_STR(csr_obj, php_openssl_request_ce, csr_str) + Z_PARAM_OPTIONAL + Z_PARAM_BOOL(use_shortnames) + ZEND_PARSE_PARAMETERS_END(); + +- orig_csr = php_openssl_csr_from_param(csr_obj, csr_str); +- if (orig_csr == NULL) { ++ X509_REQ *csr = php_openssl_csr_from_param(csr_obj, csr_str); ++ if (csr == NULL) { + RETURN_FALSE; + } + +-#if PHP_OPENSSL_API_VERSION >= 0x10100 +- /* Due to changes in OpenSSL 1.1 related to locking when decoding CSR, +- * the pub key is not changed after assigning. It means if we pass +- * a private key, it will be returned including the private part. +- * If we duplicate it, then we get just the public part which is +- * the same behavior as for OpenSSL 1.0 */ +- csr = X509_REQ_dup(orig_csr); +-#else +- csr = orig_csr; +-#endif +- + /* Retrieve the public key from the CSR */ +- tpubkey = X509_REQ_get_pubkey(csr); +- +- if (csr != orig_csr) { +- /* We need to free the duplicated CSR */ +- X509_REQ_free(csr); +- } ++ EVP_PKEY *tpubkey = php_openssl_extract_public_key(X509_REQ_get_pubkey(csr)); + + if (csr_str) { +- /* We also need to free the original CSR if it was freshly created */ +- X509_REQ_free(orig_csr); ++ /* We need to free the original CSR if it was freshly created */ ++ X509_REQ_free(csr); + } + + if (tpubkey == NULL) { +-- +2.31.1 + +From 7939ffbdcc8d3358306653d7343f2b70204824f9 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Fri, 6 Aug 2021 12:08:07 +0200 +Subject: [PATCH 32/39] Use param API for openssl_pkey_get_details() + +Now that the DSA/DH/EC keys are not created using the legacy API, +we can fetch the details using the param API as well, and not +run into buggy priv_key handling. + +(cherry picked from commit 6db2c2dbe7a02055e2798e503ccde4b151b7cabf) +--- + ext/openssl/openssl.c | 123 ++++++++++++++++++++++++++++++++++++------ + 1 file changed, 106 insertions(+), 17 deletions(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index e86e99c73f..40f05da9f2 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -3788,17 +3788,17 @@ cleanup: + } + /* }}} */ + +-#define OPENSSL_GET_BN(_array, _bn, _name) do { \ +- if (_bn != NULL) { \ +- int len = BN_num_bytes(_bn); \ +- zend_string *str = zend_string_alloc(len, 0); \ +- BN_bn2bin(_bn, (unsigned char*)ZSTR_VAL(str)); \ +- ZSTR_VAL(str)[len] = 0; \ +- add_assoc_str(&_array, #_name, str); \ +- } \ +- } while (0); ++static void php_openssl_add_bn_to_array(zval *ary, const BIGNUM *bn, const char *name) { ++ if (bn != NULL) { ++ int len = BN_num_bytes(bn); ++ zend_string *str = zend_string_alloc(len, 0); ++ BN_bn2bin(bn, (unsigned char *)ZSTR_VAL(str)); ++ ZSTR_VAL(str)[len] = 0; ++ add_assoc_str(ary, name, str); ++ } ++} + +-#define OPENSSL_PKEY_GET_BN(_type, _name) OPENSSL_GET_BN(_type, _name, _name) ++#define OPENSSL_PKEY_GET_BN(_type, _name) php_openssl_add_bn_to_array(&_type, _name, #_name) + + #define OPENSSL_PKEY_SET_BN(_data, _name) do { \ + zval *bn; \ +@@ -4639,12 +4639,34 @@ PHP_FUNCTION(openssl_pkey_get_private) + + /* }}} */ + ++#if PHP_OPENSSL_API_VERSION >= 0x30000 ++static void php_openssl_copy_bn_param( ++ zval *ary, EVP_PKEY *pkey, const char *param, const char *name) { ++ BIGNUM *bn = NULL; ++ if (EVP_PKEY_get_bn_param(pkey, param, &bn) > 0) { ++ php_openssl_add_bn_to_array(ary, bn, name); ++ BN_free(bn); ++ } ++} ++ ++static zend_string *php_openssl_get_utf8_param( ++ EVP_PKEY *pkey, const char *param, const char *name) { ++ char buf[64]; ++ size_t len; ++ if (EVP_PKEY_get_utf8_string_param(pkey, param, buf, sizeof(buf), &len) > 0) { ++ zend_string *str = zend_string_alloc(len, 0); ++ memcpy(ZSTR_VAL(str), buf, len); ++ ZSTR_VAL(str)[len] = '\0'; ++ return str; ++ } ++ return NULL; ++} ++#endif ++ + /* {{{ returns an array with the key details (bits, pkey, type)*/ + PHP_FUNCTION(openssl_pkey_get_details) + { + zval *key; +- EVP_PKEY *pkey; +- BIO *out; + unsigned int pbio_len; + char *pbio; + zend_long ktype; +@@ -4653,9 +4675,9 @@ PHP_FUNCTION(openssl_pkey_get_details) + RETURN_THROWS(); + } + +- pkey = Z_OPENSSL_PKEY_P(key)->pkey; ++ EVP_PKEY *pkey = Z_OPENSSL_PKEY_P(key)->pkey; + +- out = BIO_new(BIO_s_mem()); ++ BIO *out = BIO_new(BIO_s_mem()); + if (!PEM_write_bio_PUBKEY(out, pkey)) { + BIO_free(out); + php_openssl_store_errors(); +@@ -4669,6 +4691,72 @@ PHP_FUNCTION(openssl_pkey_get_details) + /*TODO: Use the real values once the openssl constants are used + * See the enum at the top of this file + */ ++#if PHP_OPENSSL_API_VERSION >= 0x30000 ++ zval ary; ++ switch (EVP_PKEY_base_id(pkey)) { ++ case EVP_PKEY_RSA: ++ ktype = OPENSSL_KEYTYPE_RSA; ++ array_init(&ary); ++ add_assoc_zval(return_value, "rsa", &ary); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_RSA_N, "n"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_RSA_E, "e"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_RSA_D, "d"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_RSA_FACTOR1, "p"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_RSA_FACTOR2, "q"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_RSA_EXPONENT1, "dmp1"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_RSA_EXPONENT2, "dmq1"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_RSA_COEFFICIENT1, "iqmp"); ++ break; ++ case EVP_PKEY_DSA: ++ ktype = OPENSSL_KEYTYPE_DSA; ++ array_init(&ary); ++ add_assoc_zval(return_value, "dsa", &ary); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_FFC_P, "p"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_FFC_Q, "q"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_FFC_G, "g"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_PRIV_KEY, "priv_key"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_PUB_KEY, "pub_key"); ++ break; ++ case EVP_PKEY_DH: ++ ktype = OPENSSL_KEYTYPE_DH; ++ array_init(&ary); ++ add_assoc_zval(return_value, "dh", &ary); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_FFC_P, "p"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_FFC_G, "g"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_PRIV_KEY, "priv_key"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_PUB_KEY, "pub_key"); ++ break; ++ case EVP_PKEY_EC: { ++ ktype = OPENSSL_KEYTYPE_EC; ++ array_init(&ary); ++ add_assoc_zval(return_value, "ec", &ary); ++ ++ zend_string *curve_name = php_openssl_get_utf8_param( ++ pkey, OSSL_PKEY_PARAM_GROUP_NAME, "curve_name"); ++ if (curve_name) { ++ add_assoc_str(&ary, "curve_name", curve_name); ++ ++ int nid = OBJ_sn2nid(ZSTR_VAL(curve_name)); ++ if (nid != NID_undef) { ++ ASN1_OBJECT *obj = OBJ_nid2obj(nid); ++ if (obj) { ++ // OpenSSL recommends a buffer length of 80. ++ char oir_buf[80]; ++ int oir_len = OBJ_obj2txt(oir_buf, sizeof(oir_buf), obj, 1); ++ add_assoc_stringl(&ary, "curve_oid", oir_buf, oir_len); ++ ASN1_OBJECT_free(obj); ++ } ++ } ++ } ++ ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_EC_PUB_X, "x"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_EC_PUB_Y, "y"); ++ php_openssl_copy_bn_param(&ary, pkey, OSSL_PKEY_PARAM_PRIV_KEY, "d"); ++ break; ++ } ++ EMPTY_SWITCH_DEFAULT_CASE(); ++ } ++#else + switch (EVP_PKEY_base_id(pkey)) { + case EVP_PKEY_RSA: + case EVP_PKEY_RSA2: +@@ -4785,14 +4873,14 @@ PHP_FUNCTION(openssl_pkey_get_details) + pub = EC_KEY_get0_public_key(ec_key); + + if (EC_POINT_get_affine_coordinates_GFp(ec_group, pub, x, y, NULL)) { +- OPENSSL_GET_BN(ec, x, x); +- OPENSSL_GET_BN(ec, y, y); ++ php_openssl_add_bn_to_array(&ec, x, "x"); ++ php_openssl_add_bn_to_array(&ec, y, "y"); + } else { + php_openssl_store_errors(); + } + + if ((d = EC_KEY_get0_private_key(EVP_PKEY_get0_EC_KEY(pkey))) != NULL) { +- OPENSSL_GET_BN(ec, d, d); ++ php_openssl_add_bn_to_array(&ec, d, "d"); + } + + add_assoc_zval(return_value, "ec", &ec); +@@ -4806,6 +4894,7 @@ PHP_FUNCTION(openssl_pkey_get_details) + ktype = -1; + break; + } ++#endif + add_assoc_long(return_value, "type", ktype); + + BIO_free(out); +-- +2.31.1 + +From 35012d2b29254b806e5f376817d22f6c3bab136d Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Mon, 9 Aug 2021 14:34:12 +0200 +Subject: [PATCH 33/39] Add missing unsigned qualifier + +This previously got lost in the deprecation warning noise. + +(cherry picked from commit ff2a39e6fcbd9a3bd7f411168b19711a4be9a2a4) +--- + ext/openssl/openssl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index 40f05da9f2..856d7fc4af 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -4256,7 +4256,7 @@ static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) { + BIGNUM *d = NULL, *x = NULL, *y = NULL; + EC_GROUP *group = NULL; + EC_POINT *pnt = NULL; +- char *pnt_oct = NULL; ++ unsigned char *pnt_oct = NULL; + EVP_PKEY *param_key = NULL, *pkey = NULL; + EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL); + OSSL_PARAM *params = NULL; +-- +2.31.1 + +From c34296faadc0a9e15e4ca960d573cdf3aabd8742 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Mon, 9 Aug 2021 14:47:43 +0200 +Subject: [PATCH 34/39] Use param API to create RSA key + +Instead of deprecated low-level API. + +A caveat here is that when using the high-level API, OpenSSL 3 +requires that if the prime factors are set, the CRT parameters +are also set. See https://github.com/openssl/openssl/issues/16271. + +As such, add CRT parameters to the manual construction test. + +This fixes the last deprecation warnings in openssl.c, but there +are more elsewhere. + +(cherry picked from commit 3724b49aa953fadc365c27e64fba2266d7f6d16b) +--- + ext/openssl/openssl.c | 121 +++++++++++++++--- + ext/openssl/tests/openssl_pkey_new_basic.phpt | 16 +++ + 2 files changed, 116 insertions(+), 21 deletions(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index 856d7fc4af..9e31f76998 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -3812,8 +3812,8 @@ static void php_openssl_add_bn_to_array(zval *ary, const BIGNUM *bn, const char + } \ + } while (0); + +-/* {{{ php_openssl_pkey_init_rsa */ +-static zend_bool php_openssl_pkey_init_and_assign_rsa(EVP_PKEY *pkey, RSA *rsa, zval *data) ++#if PHP_OPENSSL_API_VERSION < 0x30000 ++static zend_bool php_openssl_pkey_init_legacy_rsa(RSA *rsa, zval *data) + { + BIGNUM *n, *e, *d, *p, *q, *dmp1, *dmq1, *iqmp; + +@@ -3837,12 +3837,102 @@ static zend_bool php_openssl_pkey_init_and_assign_rsa(EVP_PKEY *pkey, RSA *rsa, + return 0; + } + +- if (!EVP_PKEY_assign_RSA(pkey, rsa)) { ++ return 1; ++} ++#endif ++ ++static EVP_PKEY *php_openssl_pkey_init_rsa(zval *data) ++{ ++#if PHP_OPENSSL_API_VERSION >= 0x30000 ++ BIGNUM *n = NULL, *e = NULL, *d = NULL, *p = NULL, *q = NULL; ++ BIGNUM *dmp1 = NULL, *dmq1 = NULL, *iqmp = NULL; ++ EVP_PKEY *pkey = NULL; ++ EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL); ++ OSSL_PARAM *params = NULL; ++ OSSL_PARAM_BLD *bld = OSSL_PARAM_BLD_new(); ++ ++ OPENSSL_PKEY_SET_BN(data, n); ++ OPENSSL_PKEY_SET_BN(data, e); ++ OPENSSL_PKEY_SET_BN(data, d); ++ OPENSSL_PKEY_SET_BN(data, p); ++ OPENSSL_PKEY_SET_BN(data, q); ++ OPENSSL_PKEY_SET_BN(data, dmp1); ++ OPENSSL_PKEY_SET_BN(data, dmq1); ++ OPENSSL_PKEY_SET_BN(data, iqmp); ++ ++ if (!ctx || !bld || !n || !d) { ++ goto cleanup; ++ } ++ ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_N, n); ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_D, d); ++ if (e) { ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_E, e); ++ } ++ if (p) { ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_FACTOR1, p); ++ } ++ if (q) { ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_FACTOR2, q); ++ } ++ if (dmp1) { ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_EXPONENT1, dmp1); ++ } ++ if (dmq1) { ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_EXPONENT2, dmq1); ++ } ++ if (iqmp) { ++ OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_RSA_COEFFICIENT1, iqmp); ++ } ++ ++ params = OSSL_PARAM_BLD_to_param(bld); ++ if (!params) { ++ goto cleanup; ++ } ++ ++ if (EVP_PKEY_fromdata_init(ctx) <= 0 || ++ EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEYPAIR, params) <= 0) { ++ goto cleanup; ++ } ++ ++cleanup: ++ php_openssl_store_errors(); ++ EVP_PKEY_CTX_free(ctx); ++ OSSL_PARAM_free(params); ++ OSSL_PARAM_BLD_free(bld); ++ BN_free(n); ++ BN_free(e); ++ BN_free(d); ++ BN_free(p); ++ BN_free(q); ++ BN_free(dmp1); ++ BN_free(dmq1); ++ BN_free(iqmp); ++ return pkey; ++#else ++ EVP_PKEY *pkey = EVP_PKEY_new(); ++ if (!pkey) { + php_openssl_store_errors(); +- return 0; ++ return NULL; + } + +- return 1; ++ RSA *rsa = RSA_new(); ++ if (!rsa) { ++ php_openssl_store_errors(); ++ EVP_PKEY_free(pkey); ++ return NULL; ++ } ++ ++ if (!php_openssl_pkey_init_legacy_rsa(rsa, data) ++ || !EVP_PKEY_assign_RSA(pkey, rsa)) { ++ php_openssl_store_errors(); ++ EVP_PKEY_free(pkey); ++ RSA_free(rsa); ++ return NULL; ++ } ++ ++ return pkey; ++#endif + } + + #if PHP_OPENSSL_API_VERSION < 0x30000 +@@ -4386,23 +4476,12 @@ PHP_FUNCTION(openssl_pkey_new) + + if ((data = zend_hash_str_find(Z_ARRVAL_P(args), "rsa", sizeof("rsa")-1)) != NULL && + Z_TYPE_P(data) == IS_ARRAY) { +- pkey = EVP_PKEY_new(); +- if (pkey) { +- RSA *rsa = RSA_new(); +- if (rsa) { +- if (php_openssl_pkey_init_and_assign_rsa(pkey, rsa, data)) { +- php_openssl_pkey_object_init(return_value, pkey, /* is_private */ true); +- return; +- } +- RSA_free(rsa); +- } else { +- php_openssl_store_errors(); +- } +- EVP_PKEY_free(pkey); +- } else { +- php_openssl_store_errors(); ++ pkey = php_openssl_pkey_init_rsa(data); ++ if (!pkey) { ++ RETURN_FALSE; + } +- RETURN_FALSE; ++ php_openssl_pkey_object_init(return_value, pkey, /* is_private */ true); ++ return; + } else if ((data = zend_hash_str_find(Z_ARRVAL_P(args), "dsa", sizeof("dsa") - 1)) != NULL && + Z_TYPE_P(data) == IS_ARRAY) { + bool is_private; +diff --git a/ext/openssl/tests/openssl_pkey_new_basic.phpt b/ext/openssl/tests/openssl_pkey_new_basic.phpt +index b2c37f6a87..08c9660f22 100644 +--- a/ext/openssl/tests/openssl_pkey_new_basic.phpt ++++ b/ext/openssl/tests/openssl_pkey_new_basic.phpt +@@ -26,6 +26,11 @@ $phex = "EECFAE81B1B9B3C908810B10A1B5600199EB9F44AEF4FDA493B81A9E3D84F632" . + $qhex = "C97FB1F027F453F6341233EAAAD1D9353F6C42D08866B1D05A0F2035028B9D86" . + "9840B41666B42E92EA0DA3B43204B5CFCE3352524D0416A5A441E700AF461503"; + ++$dphex = "11"; ++$dqhex = "11"; ++$qinvhex = "b06c4fdabb6301198d265bdbae9423b380f271f73453885093077fcd39e2119f" . ++ "c98632154f5883b167a967bf402b4e9e2e0f9656e698ea3666edfb25798039f7"; ++ + $rsa= openssl_pkey_new(array( + 'rsa' => array( + 'n' => hex2bin($nhex), +@@ -33,6 +38,9 @@ $rsa= openssl_pkey_new(array( + 'd' => hex2bin($dhex), + 'p' => hex2bin($phex), + 'q' => hex2bin($qhex), ++ 'dmp1' => hex2bin($dphex), ++ 'dmq1' => hex2bin($dqhex), ++ 'iqmp' => hex2bin($qinvhex), + ) + )); + $details = openssl_pkey_get_details($rsa); +@@ -42,6 +50,10 @@ openssl_pkey_test_cmp($ehex, $rsa_details['e']); + openssl_pkey_test_cmp($dhex, $rsa_details['d']); + openssl_pkey_test_cmp($phex, $rsa_details['p']); + openssl_pkey_test_cmp($qhex, $rsa_details['q']); ++openssl_pkey_test_cmp($dphex, $rsa_details['dmp1']); ++openssl_pkey_test_cmp($dqhex, $rsa_details['dmq1']); ++openssl_pkey_test_cmp($qinvhex, $rsa_details['iqmp']); ++echo "\n"; + + // DSA + $phex = '00f8000ae45b2dacb47dd977d58b719d097bdf07cb2c17660ad898518c08' . +@@ -95,6 +107,10 @@ int(0) + int(0) + int(0) + int(0) ++int(0) ++int(0) ++int(0) ++ + int(0) + int(0) + int(0) +-- +2.31.1 + +From b32adee0fe39c9d0fb981fc7cfe1892c225ba1c3 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Tue, 10 Aug 2021 11:50:18 +0200 +Subject: [PATCH 35/39] Fork openssl_error_string() test for OpenSSL + +The used error code differ signficantly, so use a separate test +file. + +openssl_encrypt() no longer throws an error for invalid key length, +which looks like an upstream bug. + +(cherry picked from commit e5f53e1ca13bfe8abd0f6037c98b59d2dac5744f) +--- + .../tests/openssl_error_string_basic.phpt | 7 +- + .../openssl_error_string_basic_openssl3.phpt | 183 ++++++++++++++++++ + 2 files changed, 188 insertions(+), 2 deletions(-) + create mode 100644 ext/openssl/tests/openssl_error_string_basic_openssl3.phpt + +diff --git a/ext/openssl/tests/openssl_error_string_basic.phpt b/ext/openssl/tests/openssl_error_string_basic.phpt +index f3eb82067b..aee84b3fab 100644 +--- a/ext/openssl/tests/openssl_error_string_basic.phpt ++++ b/ext/openssl/tests/openssl_error_string_basic.phpt +@@ -1,7 +1,10 @@ + --TEST-- +-openssl_error_string() tests ++openssl_error_string() tests (OpenSSL < 3.0) + --SKIPIF-- +- ++= 0x30000000) die('skip For OpenSSL < 3.0'); ++?> + --FILE-- + = 3.0) ++--EXTENSIONS-- ++openssl ++--SKIPIF-- ++= 3.0'); ++?> ++--FILE-- ++ 0) { ++ $error_code = $m[1]; ++ if (isset($expected_errors[$error_code])) { ++ $expected_errors[$error_code] = true; ++ } ++ $all_errors[$error_code] = $error_string; ++ } else { ++ $all_errors[] = $error_string; ++ } ++ } ++ ++ $fail = false; ++ foreach ($expected_errors as $error_code => $error_code_found) { ++ if (!$error_code_found) { ++ $fail = true; ++ echo "$name: no error code $error_code\n"; ++ } ++ } ++ ++ if (!$fail) { ++ echo "$name: ok\n"; ++ } else { ++ echo "$name: uncaught errors\n"; ++ foreach ($all_errors as $code => $str) { ++ if (!isset($expected_errors[$code]) || !$expected_errors[$code]) { ++ echo "\t", $code, ": ", $str, "\n"; ++ } ++ } ++ } ++} ++ ++// helper for debugging errors ++function dump_openssl_errors($name) { ++ echo "\n$name\n"; ++ while (($error_string = openssl_error_string()) !== false) { ++ var_dump($error_string); ++ } ++} ++ ++// common output file ++$output_file = __DIR__ . "/openssl_error_string_basic_output.tmp"; ++// invalid file for read is something that does not exist in current directory ++$invalid_file_for_read = __DIR__ . "/invalid_file_for_read_operation.txt"; ++// invalid file for is the test dir as writing file to existing dir should always fail ++$invalid_file_for_write = __DIR__; ++// crt file ++$crt_file = "file://" . __DIR__ . "/cert.crt"; ++// csr file ++$csr_file = "file://" . __DIR__ . "/cert.csr"; ++// public key file ++$public_key_file = "file://" .__DIR__ . "/public.key"; ++// private key file ++$private_key_file = "file://" .__DIR__ . "/private_rsa_1024.key"; ++// private key file with password (password is 'php') ++$private_key_file_with_pass = "file://" .__DIR__ . "/private_rsa_2048_pass_php.key"; ++ ++// ENCRYPTION ++$data = "test"; ++$method = "AES-128-ECB"; ++$enc_key = str_repeat('x', 40); ++// error because password is longer then key length and ++// EVP_CIPHER_CTX_set_key_length fails for AES ++if (0) { ++// TODO: This no longer errors! ++openssl_encrypt($data, $method, $enc_key); ++$enc_error = openssl_error_string(); ++var_dump($enc_error); ++// make sure that error is cleared now ++var_dump(openssl_error_string()); ++// internally OpenSSL ERR won't save more than 15 (16 - 1) errors so lets test it ++for ($i = 0; $i < 20; $i++) { ++ openssl_encrypt($data, $method, $enc_key); ++} ++$error_queue_size = 0; ++while (($enc_error_new = openssl_error_string()) !== false) { ++ if ($enc_error_new !== $enc_error) { ++ echo "The new encoding error doesn't match the expected one\n"; ++ } ++ ++$error_queue_size; ++} ++var_dump($error_queue_size); ++echo "\n"; ++} ++ ++$err_pem_no_start_line = '0480006C'; ++ ++// PKEY ++echo "PKEY errors\n"; ++// file for pkey (file:///) fails when opennig (BIO_new_file) ++@openssl_pkey_export_to_file("file://" . $invalid_file_for_read, $output_file); ++expect_openssl_errors('openssl_pkey_export_to_file opening', ['10000080']); ++// file or private pkey is not correct PEM - failing PEM_read_bio_PrivateKey ++@openssl_pkey_export_to_file($csr_file, $output_file); ++expect_openssl_errors('openssl_pkey_export_to_file pem', ['1E08010C']); ++// file to export cannot be written ++@openssl_pkey_export_to_file($private_key_file, $invalid_file_for_write); ++expect_openssl_errors('openssl_pkey_export_to_file write', ['10080002']); ++// successful export ++@openssl_pkey_export($private_key_file_with_pass, $out, 'wrong pwd'); ++expect_openssl_errors('openssl_pkey_export', ['1C800064', '04800065']); ++// invalid x509 for getting public key ++@openssl_pkey_get_public($private_key_file); ++expect_openssl_errors('openssl_pkey_get_public', [$err_pem_no_start_line]); ++// private encrypt with unknown padding ++@openssl_private_encrypt("data", $crypted, $private_key_file, 1000); ++expect_openssl_errors('openssl_private_encrypt', ['1C8000A5']); ++// private decrypt with failed padding check ++@openssl_private_decrypt("data", $crypted, $private_key_file); ++expect_openssl_errors('openssl_private_decrypt', ['0200009F', '02000072']); ++// public encrypt and decrypt with failed padding check and padding ++@openssl_public_encrypt("data", $crypted, $public_key_file, 1000); ++@openssl_public_decrypt("data", $crypted, $public_key_file); ++expect_openssl_errors('openssl_private_(en|de)crypt padding', [$err_pem_no_start_line, '02000076', '0200008A', '02000072', '1C880004']); ++ ++// X509 ++echo "X509 errors\n"; ++// file for x509 (file:///) fails when opennig (BIO_new_file) ++@openssl_x509_export_to_file("file://" . $invalid_file_for_read, $output_file); ++expect_openssl_errors('openssl_x509_export_to_file open', ['10000080']); ++// file or str cert is not correct PEM - failing PEM_read_bio_X509 or PEM_ASN1_read_bio ++@openssl_x509_export_to_file($csr_file, $output_file); ++expect_openssl_errors('openssl_x509_export_to_file pem', [$err_pem_no_start_line]); ++// file to export cannot be written ++@openssl_x509_export_to_file($crt_file, $invalid_file_for_write); ++expect_openssl_errors('openssl_x509_export_to_file write', ['10080002']); ++// checking purpose fails because there is no such purpose 1000 ++@openssl_x509_checkpurpose($crt_file, 1000); ++expect_openssl_errors('openssl_x509_checkpurpose purpose', ['05800079']); ++ ++// CSR ++echo "CSR errors\n"; ++// file for csr (file:///) fails when opennig (BIO_new_file) ++@openssl_csr_get_subject("file://" . $invalid_file_for_read); ++expect_openssl_errors('openssl_csr_get_subject open', ['10000080']); ++// file or str csr is not correct PEM - failing PEM_read_bio_X509_REQ ++@openssl_csr_get_subject($crt_file); ++expect_openssl_errors('openssl_csr_get_subjec pem', [$err_pem_no_start_line]); ++ ++// other possible causes that are difficult to catch: ++// - ASN1_STRING_to_UTF8 fails in add_assoc_name_entry ++// - invalid php_x509_request field (NULL) would cause error with CONF_get_string ++ ++?> ++--CLEAN-- ++ ++--EXPECT-- ++PKEY errors ++openssl_pkey_export_to_file opening: ok ++openssl_pkey_export_to_file pem: ok ++openssl_pkey_export_to_file write: ok ++openssl_pkey_export: ok ++openssl_pkey_get_public: ok ++openssl_private_encrypt: ok ++openssl_private_decrypt: ok ++openssl_private_(en|de)crypt padding: ok ++X509 errors ++openssl_x509_export_to_file open: ok ++openssl_x509_export_to_file pem: ok ++openssl_x509_export_to_file write: ok ++openssl_x509_checkpurpose purpose: ok ++CSR errors ++openssl_csr_get_subject open: ok ++openssl_csr_get_subjec pem: ok +-- +2.31.1 + +From f99d70f7d8d660c2ded4f8f1700771c227987021 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Tue, 10 Aug 2021 12:17:17 +0200 +Subject: [PATCH 36/39] Switch dh_param handling to EVP_PKEY API + +(cherry picked from commit ef787bae242fdd2e72625bbce6ab4ca466b1ef59) +--- + ext/openssl/xp_ssl.c | 26 +++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +diff --git a/ext/openssl/xp_ssl.c b/ext/openssl/xp_ssl.c +index 206543ca82..b61234943e 100644 +--- a/ext/openssl/xp_ssl.c ++++ b/ext/openssl/xp_ssl.c +@@ -1197,11 +1197,7 @@ static RSA *php_openssl_tmp_rsa_cb(SSL *s, int is_export, int keylength) + + static int php_openssl_set_server_dh_param(php_stream * stream, SSL_CTX *ctx) /* {{{ */ + { +- DH *dh; +- BIO* bio; +- zval *zdhpath; +- +- zdhpath = php_stream_context_get_option(PHP_STREAM_CONTEXT(stream), "ssl", "dh_param"); ++ zval *zdhpath = php_stream_context_get_option(PHP_STREAM_CONTEXT(stream), "ssl", "dh_param"); + if (zdhpath == NULL) { + #if 0 + /* Coming in OpenSSL 1.1 ... eventually we'll want to enable this +@@ -1216,14 +1212,29 @@ static int php_openssl_set_server_dh_param(php_stream * stream, SSL_CTX *ctx) /* + return FAILURE; + } + +- bio = BIO_new_file(Z_STRVAL_P(zdhpath), PHP_OPENSSL_BIO_MODE_R(PKCS7_BINARY)); ++ BIO *bio = BIO_new_file(Z_STRVAL_P(zdhpath), PHP_OPENSSL_BIO_MODE_R(PKCS7_BINARY)); + + if (bio == NULL) { + php_error_docref(NULL, E_WARNING, "Invalid dh_param"); + return FAILURE; + } + +- dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); ++#if PHP_OPENSSL_API_VERSION >= 0x30000 ++ EVP_PKEY *pkey = PEM_read_bio_Parameters(bio, NULL); ++ BIO_free(bio); ++ ++ if (pkey == NULL) { ++ php_error_docref(NULL, E_WARNING, "Failed reading DH params"); ++ return FAILURE; ++ } ++ ++ if (SSL_CTX_set0_tmp_dh_pkey(ctx, pkey) < 0) { ++ php_error_docref(NULL, E_WARNING, "Failed assigning DH params"); ++ EVP_PKEY_free(pkey); ++ return FAILURE; ++ } ++#else ++ DH *dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); + BIO_free(bio); + + if (dh == NULL) { +@@ -1238,6 +1249,7 @@ static int php_openssl_set_server_dh_param(php_stream * stream, SSL_CTX *ctx) /* + } + + DH_free(dh); ++#endif + + return SUCCESS; + } +-- +2.31.1 + +From b3deb9b38d4a52b4582f40d4d32240353db26653 Mon Sep 17 00:00:00 2001 +From: Nikita Popov +Date: Wed, 11 Aug 2021 10:11:12 +0200 +Subject: [PATCH 37/39] Fix openssl memory leaks + +Some leaks that snuck in during refactorings. + +(cherry picked from commit 7d2a2c7dc0447c81316d14f3a43a4b6a8ce0b982) +--- + ext/openssl/openssl.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index 9e31f76998..d8102bd4bc 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -3463,7 +3463,9 @@ PHP_FUNCTION(openssl_csr_get_public_key) + } + + /* Retrieve the public key from the CSR */ +- EVP_PKEY *tpubkey = php_openssl_extract_public_key(X509_REQ_get_pubkey(csr)); ++ EVP_PKEY *orig_key = X509_REQ_get_pubkey(csr); ++ EVP_PKEY *tpubkey = php_openssl_extract_public_key(orig_key); ++ EVP_PKEY_free(orig_key); + + if (csr_str) { + /* We need to free the original CSR if it was freshly created */ +@@ -4328,6 +4330,7 @@ static bool php_openssl_pkey_init_legacy_ec(EC_KEY *eckey, zval *data, bool *is_ + php_openssl_store_errors(); + } + if (EC_KEY_check_key(eckey)) { ++ EC_GROUP_free(group); + return true; + } else { + php_openssl_store_errors(); +-- +2.31.1 + +From 02f08ac888b0c5f43468eaf76b59b29a7c2d7c74 Mon Sep 17 00:00:00 2001 +From: Remi Collet +Date: Fri, 10 Sep 2021 11:28:20 +0200 +Subject: [PATCH 38/39] fix [-Wmaybe-uninitialized] build warnings + +(cherry picked from commit 6ee96f095ad947ffc820437b2e9e6449000e18a2) +--- + ext/openssl/openssl.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c +index d8102bd4bc..40e6e7ba97 100644 +--- a/ext/openssl/openssl.c ++++ b/ext/openssl/openssl.c +@@ -3991,6 +3991,8 @@ static EVP_PKEY *php_openssl_pkey_init_dsa(zval *data, bool *is_private) + OPENSSL_PKEY_SET_BN(data, priv_key); + OPENSSL_PKEY_SET_BN(data, pub_key); + ++ *is_private = false; ++ + if (!ctx || !bld || !p || !q || !g) { + goto cleanup; + } +@@ -4162,6 +4164,8 @@ static EVP_PKEY *php_openssl_pkey_init_dh(zval *data, bool *is_private) + OPENSSL_PKEY_SET_BN(data, priv_key); + OPENSSL_PKEY_SET_BN(data, pub_key); + ++ *is_private = false; ++ + if (!ctx || !bld || !p || !g) { + goto cleanup; + } +@@ -4255,6 +4259,8 @@ static bool php_openssl_pkey_init_legacy_ec(EC_KEY *eckey, zval *data, bool *is_ + zval *x; + zval *y; + ++ *is_private = false; ++ + if ((bn = zend_hash_str_find(Z_ARRVAL_P(data), "curve_name", sizeof("curve_name") - 1)) != NULL && + Z_TYPE_P(bn) == IS_STRING) { + int nid = OBJ_sn2nid(Z_STRVAL_P(bn)); +@@ -4279,7 +4285,6 @@ static bool php_openssl_pkey_init_legacy_ec(EC_KEY *eckey, zval *data, bool *is_ + } + + // The public key 'pnt' can be calculated from 'd' or is defined by 'x' and 'y' +- *is_private = false; + if ((bn = zend_hash_str_find(Z_ARRVAL_P(data), "d", sizeof("d") - 1)) != NULL && + Z_TYPE_P(bn) == IS_STRING) { + *is_private = true; +@@ -4360,6 +4365,8 @@ static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) { + OPENSSL_PKEY_SET_BN(data, x); + OPENSSL_PKEY_SET_BN(data, y); + ++ *is_private = false; ++ + if (!ctx || !bld || !curve_name_zv || Z_TYPE_P(curve_name_zv) != IS_STRING) { + goto cleanup; + } +-- +2.31.1 + +From b881c41d32928781cb48013692da04fc84ca9107 Mon Sep 17 00:00:00 2001 +From: Jakub Zelenka +Date: Sun, 12 Sep 2021 20:30:02 +0100 +Subject: [PATCH 39/39] Make OpenSSL tests less dependent on system config + +It fixes dependencies on system config if running tests with OpenSSL 3.0 + +(cherry picked from commit 43f0141d74c1db6e792f3b625ea7f4ae57ff338f) +--- + ext/openssl/tests/bug52093.phpt | 6 +++--- + ext/openssl/tests/bug72165.phpt | 5 +++-- + ext/openssl/tests/bug73711.phpt | 3 +++ + ext/openssl/tests/ecc.phpt | 3 +++ + .../tests/openssl_error_string_basic_openssl3.phpt | 9 +++++---- + 5 files changed, 17 insertions(+), 9 deletions(-) + +diff --git a/ext/openssl/tests/bug52093.phpt b/ext/openssl/tests/bug52093.phpt +index 63eaceb5ac..162945f914 100644 +--- a/ext/openssl/tests/bug52093.phpt ++++ b/ext/openssl/tests/bug52093.phpt +@@ -14,10 +14,10 @@ $dn = array( + "commonName" => "Henrique do N. Angelo", + "emailAddress" => "hnangelo@php.net" + ); +- ++$options = ['config' => __DIR__ . DIRECTORY_SEPARATOR . 'openssl.cnf']; + $privkey = openssl_pkey_new(); +-$csr = openssl_csr_new($dn, $privkey); +-$cert = openssl_csr_sign($csr, null, $privkey, 365, [], PHP_INT_MAX); ++$csr = openssl_csr_new($dn, $privkey, $options); ++$cert = openssl_csr_sign($csr, null, $privkey, 365, $options, PHP_INT_MAX); + var_dump(openssl_x509_parse($cert)['serialNumber']); + ?> + --EXPECT-- +diff --git a/ext/openssl/tests/bug72165.phpt b/ext/openssl/tests/bug72165.phpt +index 50e8b54100..fb78881fc3 100644 +--- a/ext/openssl/tests/bug72165.phpt ++++ b/ext/openssl/tests/bug72165.phpt +@@ -6,8 +6,9 @@ if (!extension_loaded("openssl")) die("skip"); + ?> + --FILE-- + "hello", 1 => "world"); +-$var2 = openssl_csr_new(array(0),$var0,null,array(0)); ++$var0 = [0 => "hello", 1 => "world"]; ++$options = ['config' => __DIR__ . DIRECTORY_SEPARATOR . 'openssl.cnf']; ++$var2 = openssl_csr_new([0], $var0, $options, [0]); + ?> + --EXPECTF-- + Warning: openssl_csr_new(): dn: numeric fild names are not supported in %sbug72165.php on line %d +diff --git a/ext/openssl/tests/bug73711.phpt b/ext/openssl/tests/bug73711.phpt +index 4e4bba8aa8..8ca0101d1a 100644 +--- a/ext/openssl/tests/bug73711.phpt ++++ b/ext/openssl/tests/bug73711.phpt +@@ -6,13 +6,16 @@ if (!extension_loaded("openssl")) die("skip openssl not loaded"); + ?> + --FILE-- + OPENSSL_KEYTYPE_DSA, + "private_key_bits" => 1024, ++ 'config' => $config, + ])); + var_dump(openssl_pkey_new([ + "private_key_type" => OPENSSL_KEYTYPE_DH, + "private_key_bits" => 512, ++ 'config' => $config, + ])); + echo "DONE"; + ?> +diff --git a/ext/openssl/tests/ecc.phpt b/ext/openssl/tests/ecc.phpt +index 0b05410c2c..1d97b1450a 100644 +--- a/ext/openssl/tests/ecc.phpt ++++ b/ext/openssl/tests/ecc.phpt +@@ -4,9 +4,11 @@ openssl_*() with OPENSSL_KEYTYPE_EC + + --FILE-- + "secp384r1", + "private_key_type" => OPENSSL_KEYTYPE_EC, ++ "config" => $config, + ); + echo "Testing openssl_pkey_new\n"; + $key1 = openssl_pkey_new($args); +@@ -15,6 +17,7 @@ var_dump($key1); + $argsFailed = array( + "curve_name" => "invalid_cuve_name", + "private_key_type" => OPENSSL_KEYTYPE_EC, ++ "config" => $config, + ); + + $keyFailed = openssl_pkey_new($argsFailed); +diff --git a/ext/openssl/tests/openssl_error_string_basic_openssl3.phpt b/ext/openssl/tests/openssl_error_string_basic_openssl3.phpt +index b119346fe1..d435a53e30 100644 +--- a/ext/openssl/tests/openssl_error_string_basic_openssl3.phpt ++++ b/ext/openssl/tests/openssl_error_string_basic_openssl3.phpt +@@ -100,18 +100,19 @@ echo "\n"; + $err_pem_no_start_line = '0480006C'; + + // PKEY ++$options = ['config' => __DIR__ . DIRECTORY_SEPARATOR . 'openssl.cnf']; + echo "PKEY errors\n"; + // file for pkey (file:///) fails when opennig (BIO_new_file) +-@openssl_pkey_export_to_file("file://" . $invalid_file_for_read, $output_file); ++@openssl_pkey_export_to_file("file://" . $invalid_file_for_read, $output_file, null, $options); + expect_openssl_errors('openssl_pkey_export_to_file opening', ['10000080']); + // file or private pkey is not correct PEM - failing PEM_read_bio_PrivateKey +-@openssl_pkey_export_to_file($csr_file, $output_file); ++@openssl_pkey_export_to_file($csr_file, $output_file, null, $options); + expect_openssl_errors('openssl_pkey_export_to_file pem', ['1E08010C']); + // file to export cannot be written +-@openssl_pkey_export_to_file($private_key_file, $invalid_file_for_write); ++@openssl_pkey_export_to_file($private_key_file, $invalid_file_for_write, null, $options); + expect_openssl_errors('openssl_pkey_export_to_file write', ['10080002']); + // successful export +-@openssl_pkey_export($private_key_file_with_pass, $out, 'wrong pwd'); ++@openssl_pkey_export($private_key_file_with_pass, $out, 'wrong pwd', $options); + expect_openssl_errors('openssl_pkey_export', ['1C800064', '04800065']); + // invalid x509 for getting public key + @openssl_pkey_get_public($private_key_file); +-- +2.31.1 + diff --git a/php-8.0.10-phar-sha.patch b/php-8.0.10-phar-sha.patch new file mode 100644 index 0000000..7d6fa2c --- /dev/null +++ b/php-8.0.10-phar-sha.patch @@ -0,0 +1,515 @@ +Backported for 8.0 from + + +From 8bb0c74e24359a11216824117ac3adf3d5ef7b71 Mon Sep 17 00:00:00 2001 +From: Remi Collet +Date: Thu, 5 Aug 2021 11:10:15 +0200 +Subject: [PATCH] switch phar to use sha256 signature by default + +--- + ext/phar/phar/pharcommand.inc | 2 +- + ext/phar/tests/create_new_and_modify.phpt | 4 ++-- + ext/phar/tests/create_new_phar_c.phpt | 4 ++-- + ext/phar/tests/phar_setsignaturealgo2.phpt | 2 +- + ext/phar/tests/tar/phar_setsignaturealgo2.phpt | 2 +- + ext/phar/tests/zip/phar_setsignaturealgo2.phpt | 2 +- + ext/phar/util.c | 6 +++--- + ext/phar/zip.c | 2 +- + 8 files changed, 12 insertions(+), 12 deletions(-) + +diff --git a/ext/phar/phar/pharcommand.inc b/ext/phar/phar/pharcommand.inc +index a31290eee75fe..5f698b4bec26b 100644 +--- a/ext/phar/phar/pharcommand.inc ++++ b/ext/phar/phar/pharcommand.inc +@@ -92,7 +92,7 @@ class PharCommand extends CLICommand + 'typ' => 'select', + 'val' => NULL, + 'inf' => ' Selects the hash algorithm.', +- 'select' => array('md5' => 'MD5','sha1' => 'SHA1') ++ 'select' => array('md5' => 'MD5','sha1' => 'SHA1', 'sha256' => 'SHA256', 'sha512' => 'SHA512', 'openssl' => 'OPENSSL') + ), + 'i' => array( + 'typ' => 'regex', +diff --git a/ext/phar/tests/create_new_and_modify.phpt b/ext/phar/tests/create_new_and_modify.phpt +index 02e36c6cea2fe..32defcae8a639 100644 +--- a/ext/phar/tests/create_new_and_modify.phpt ++++ b/ext/phar/tests/create_new_and_modify.phpt +@@ -49,8 +49,8 @@ include $pname . '/b.php'; + + --EXPECTF-- + brand new! +-string(40) "%s" +-string(40) "%s" ++string(%d) "%s" ++string(%d) "%s" + bool(true) + modified! + another! +diff --git a/ext/phar/tests/create_new_phar_c.phpt b/ext/phar/tests/create_new_phar_c.phpt +index 566d3c4d5f8ad..bf6d740fd1d10 100644 +--- a/ext/phar/tests/create_new_phar_c.phpt ++++ b/ext/phar/tests/create_new_phar_c.phpt +@@ -20,7 +20,7 @@ var_dump($phar->getSignature()); + --EXPECTF-- + array(2) { + ["hash"]=> +- string(40) "%s" ++ string(64) "%s" + ["hash_type"]=> +- string(5) "SHA-1" ++ string(7) "SHA-256" + } +diff --git a/ext/phar/tests/phar_setsignaturealgo2.phpt b/ext/phar/tests/phar_setsignaturealgo2.phpt +index 293d3196713d8..4f31836fbbbcc 100644 +--- a/ext/phar/tests/phar_setsignaturealgo2.phpt ++++ b/ext/phar/tests/phar_setsignaturealgo2.phpt +@@ -52,7 +52,7 @@ array(2) { + ["hash"]=> + string(%d) "%s" + ["hash_type"]=> +- string(5) "SHA-1" ++ string(7) "SHA-256" + } + array(2) { + ["hash"]=> +diff --git a/ext/phar/tests/tar/phar_setsignaturealgo2.phpt b/ext/phar/tests/tar/phar_setsignaturealgo2.phpt +index 9923ac5c88476..cc10a241d739b 100644 +--- a/ext/phar/tests/tar/phar_setsignaturealgo2.phpt ++++ b/ext/phar/tests/tar/phar_setsignaturealgo2.phpt +@@ -51,7 +51,7 @@ array(2) { + ["hash"]=> + string(%d) "%s" + ["hash_type"]=> +- string(5) "SHA-1" ++ string(7) "SHA-256" + } + array(2) { + ["hash"]=> +diff --git a/ext/phar/tests/zip/phar_setsignaturealgo2.phpt b/ext/phar/tests/zip/phar_setsignaturealgo2.phpt +index 8de77479d7825..60fec578ee894 100644 +--- a/ext/phar/tests/zip/phar_setsignaturealgo2.phpt ++++ b/ext/phar/tests/zip/phar_setsignaturealgo2.phpt +@@ -78,7 +78,7 @@ array(2) { + ["hash"]=> + string(%d) "%s" + ["hash_type"]=> +- string(5) "SHA-1" ++ string(7) "SHA-256" + } + array(2) { + ["hash"]=> +diff --git a/ext/phar/util.c b/ext/phar/util.c +index 314acfe81a788..8d2db03b69601 100644 +--- a/ext/phar/util.c ++++ b/ext/phar/util.c +@@ -1798,6 +1798,8 @@ int phar_create_signature(phar_archive_d + *signature_length = 64; + break; + } ++ default: ++ phar->sig_flags = PHAR_SIG_SHA256; + case PHAR_SIG_SHA256: { + unsigned char digest[32]; + PHP_SHA256_CTX context; +@@ -1894,8 +1896,6 @@ int phar_create_signature(phar_archive_d + *signature_length = siglen; + } + break; +- default: +- phar->sig_flags = PHAR_SIG_SHA1; + case PHAR_SIG_SHA1: { + unsigned char digest[20]; + PHP_SHA1_CTX context; +diff --git a/ext/phar/zip.c b/ext/phar/zip.c +index 31d4bd2998215..c5e38cabf7b87 100644 +--- a/ext/phar/zip.c ++++ b/ext/phar/zip.c +@@ -1423,7 +1423,7 @@ int phar_zip_flush(phar_archive_data *phar, char *user_stub, zend_long len, int + + memcpy(eocd.signature, "PK\5\6", 4); + if (!phar->is_data && !phar->sig_flags) { +- phar->sig_flags = PHAR_SIG_SHA1; ++ phar->sig_flags = PHAR_SIG_SHA256; + } + if (phar->sig_flags) { + PHAR_SET_16(eocd.counthere, zend_hash_num_elements(&phar->manifest) + 1); + +From c51af22fef988c1b2f92b7b9e3a9d745f7084815 Mon Sep 17 00:00:00 2001 +From: Remi Collet +Date: Thu, 5 Aug 2021 16:49:48 +0200 +Subject: [PATCH] implement openssl_256 and openssl_512 for phar singatures + +--- + ext/openssl/openssl.c | 1 + + ext/phar/phar.1.in | 10 +++- + ext/phar/phar.c | 8 +++- + ext/phar/phar/pharcommand.inc | 14 +++++- + ext/phar/phar_internal.h | 2 + + ext/phar/phar_object.c | 24 ++++++++-- + ext/phar/tests/files/openssl256.phar | Bin 0 -> 7129 bytes + ext/phar/tests/files/openssl256.phar.pubkey | 6 +++ + ext/phar/tests/files/openssl512.phar | Bin 0 -> 7129 bytes + ext/phar/tests/files/openssl512.phar.pubkey | 6 +++ + .../phar_get_supported_signatures_002a.phpt | 6 ++- + .../tests/tar/phar_setsignaturealgo2.phpt | 16 +++++++ + ext/phar/tests/test_signaturealgos.phpt | 8 ++++ + ext/phar/util.c | 45 ++++++++++++++---- + 14 files changed, 128 insertions(+), 18 deletions(-) + create mode 100644 ext/phar/tests/files/openssl256.phar + create mode 100644 ext/phar/tests/files/openssl256.phar.pubkey + create mode 100644 ext/phar/tests/files/openssl512.phar + create mode 100644 ext/phar/tests/files/openssl512.phar.pubkey + +diff --git a/ext/phar/phar.1.in b/ext/phar/phar.1.in +index 77912b241dfd5..323e77b0e2a3b 100644 +--- a/ext/phar/phar.1.in ++++ b/ext/phar/phar.1.in +@@ -475,7 +475,15 @@ SHA512 + .TP + .PD + .B openssl +-OpenSSL ++OpenSSL using SHA-1 ++.TP ++.PD ++.B openssl_sha256 ++OpenSSL using SHA-256 ++.TP ++.PD ++.B openssl_sha512 ++OpenSSL using SHA-512 + + .SH SEE ALSO + For a more or less complete description of PHAR look here: +diff --git a/ext/phar/phar.c b/ext/phar/phar.c +index 77f21cef9da53..bc08e4edde05d 100644 +--- a/ext/phar/phar.c ++++ b/ext/phar/phar.c +@@ -869,6 +869,8 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, size_t fname_len, ch + PHAR_GET_32(sig_ptr, sig_flags); + + switch(sig_flags) { ++ case PHAR_SIG_OPENSSL_SHA512: ++ case PHAR_SIG_OPENSSL_SHA256: + case PHAR_SIG_OPENSSL: { + uint32_t signature_len; + char *sig; +@@ -903,7 +905,7 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, size_t fname_len, ch + return FAILURE; + } + +- if (FAILURE == phar_verify_signature(fp, end_of_phar, PHAR_SIG_OPENSSL, sig, signature_len, fname, &signature, &sig_len, error)) { ++ if (FAILURE == phar_verify_signature(fp, end_of_phar, sig_flags, sig, signature_len, fname, &signature, &sig_len, error)) { + efree(savebuf); + efree(sig); + php_stream_close(fp); +@@ -3162,7 +3164,9 @@ int phar_flush(phar_archive_data *phar, char *user_stub, zend_long len, int conv + + php_stream_write(newfile, digest, digest_len); + efree(digest); +- if (phar->sig_flags == PHAR_SIG_OPENSSL) { ++ if (phar->sig_flags == PHAR_SIG_OPENSSL || ++ phar->sig_flags == PHAR_SIG_OPENSSL_SHA256 || ++ phar->sig_flags == PHAR_SIG_OPENSSL_SHA512) { + phar_set_32(sig_buf, digest_len); + php_stream_write(newfile, sig_buf, 4); + } +diff --git a/ext/phar/phar/pharcommand.inc b/ext/phar/phar/pharcommand.inc +index 5f698b4bec26b..1b1eeca59c560 100644 +--- a/ext/phar/phar/pharcommand.inc ++++ b/ext/phar/phar/pharcommand.inc +@@ -92,7 +92,7 @@ class PharCommand extends CLICommand + 'typ' => 'select', + 'val' => NULL, + 'inf' => ' Selects the hash algorithm.', +- 'select' => array('md5' => 'MD5','sha1' => 'SHA1', 'sha256' => 'SHA256', 'sha512' => 'SHA512', 'openssl' => 'OPENSSL') ++ 'select' => ['md5' => 'MD5','sha1' => 'SHA1', 'sha256' => 'SHA256', 'sha512' => 'SHA512', 'openssl' => 'OPENSSL', 'openssl_sha256' => 'OPENSSL_SHA256', 'openssl_sha512' => 'OPENSSL_SHA512'] + ), + 'i' => array( + 'typ' => 'regex', +@@ -156,6 +156,8 @@ class PharCommand extends CLICommand + $hash_avail = Phar::getSupportedSignatures(); + $hash_optional = array('SHA-256' => 'SHA256', + 'SHA-512' => 'SHA512', ++ 'OpenSSL_sha256' => 'OpenSSL_SHA256', ++ 'OpenSSL_sha512' => 'OpenSSL_SHA512', + 'OpenSSL' => 'OpenSSL'); + if (!in_array('OpenSSL', $hash_avail)) { + unset($phar_args['y']); +@@ -429,6 +431,16 @@ class PharCommand extends CLICommand + self::error("Cannot use OpenSSL signing without key.\n"); + } + return Phar::OPENSSL; ++ case 'openssl_sha256': ++ if (!$privkey) { ++ self::error("Cannot use OpenSSL signing without key.\n"); ++ } ++ return Phar::OPENSSL_SHA256; ++ case 'openssl_sha512': ++ if (!$privkey) { ++ self::error("Cannot use OpenSSL signing without key.\n"); ++ } ++ return Phar::OPENSSL_SHA512; + } + } + // }}} +diff --git a/ext/phar/phar_internal.h b/ext/phar/phar_internal.h +index a9f81e2ab994a..30b408a8c4462 100644 +--- a/ext/phar/phar_internal.h ++++ b/ext/phar/phar_internal.h +@@ -88,6 +88,8 @@ + #define PHAR_SIG_SHA256 0x0003 + #define PHAR_SIG_SHA512 0x0004 + #define PHAR_SIG_OPENSSL 0x0010 ++#define PHAR_SIG_OPENSSL_SHA256 0x0011 ++#define PHAR_SIG_OPENSSL_SHA512 0x0012 + + /* flags byte for each file adheres to these bitmasks. + All unused values are reserved */ +diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c +index 9c1e5f2fa1eef..c05970e657f18 100644 +--- a/ext/phar/phar_object.c ++++ b/ext/phar/phar_object.c +@@ -1246,9 +1246,13 @@ PHP_METHOD(Phar, getSupportedSignatures) + add_next_index_stringl(return_value, "SHA-512", 7); + #ifdef PHAR_HAVE_OPENSSL + add_next_index_stringl(return_value, "OpenSSL", 7); ++ add_next_index_stringl(return_value, "OpenSSL_SHA256", 14); ++ add_next_index_stringl(return_value, "OpenSSL_SHA512", 14); + #else + if (zend_hash_str_exists(&module_registry, "openssl", sizeof("openssl")-1)) { + add_next_index_stringl(return_value, "OpenSSL", 7); ++ add_next_index_stringl(return_value, "OpenSSL_SHA256", 14); ++ add_next_index_stringl(return_value, "OpenSSL_SHA512", 14); + } + #endif + } +@@ -3028,6 +3032,8 @@ PHP_METHOD(Phar, setSignatureAlgorithm) + case PHAR_SIG_MD5: + case PHAR_SIG_SHA1: + case PHAR_SIG_OPENSSL: ++ case PHAR_SIG_OPENSSL_SHA256: ++ case PHAR_SIG_OPENSSL_SHA512: + if (phar_obj->archive->is_persistent && FAILURE == phar_copy_on_write(&(phar_obj->archive))) { + zend_throw_exception_ex(phar_ce_PharException, 0, "phar \"%s\" is persistent, unable to copy on write", phar_obj->archive->fname); + RETURN_THROWS(); +@@ -3066,19 +3072,25 @@ PHP_METHOD(Phar, getSignature) + add_assoc_stringl(return_value, "hash", phar_obj->archive->signature, phar_obj->archive->sig_len); + switch(phar_obj->archive->sig_flags) { + case PHAR_SIG_MD5: +- add_assoc_stringl(return_value, "hash_type", "MD5", 3); ++ add_assoc_string(return_value, "hash_type", "MD5"); + break; + case PHAR_SIG_SHA1: +- add_assoc_stringl(return_value, "hash_type", "SHA-1", 5); ++ add_assoc_string(return_value, "hash_type", "SHA-1"); + break; + case PHAR_SIG_SHA256: +- add_assoc_stringl(return_value, "hash_type", "SHA-256", 7); ++ add_assoc_string(return_value, "hash_type", "SHA-256"); + break; + case PHAR_SIG_SHA512: +- add_assoc_stringl(return_value, "hash_type", "SHA-512", 7); ++ add_assoc_string(return_value, "hash_type", "SHA-512"); + break; + case PHAR_SIG_OPENSSL: +- add_assoc_stringl(return_value, "hash_type", "OpenSSL", 7); ++ add_assoc_string(return_value, "hash_type", "OpenSSL"); ++ break; ++ case PHAR_SIG_OPENSSL_SHA256: ++ add_assoc_string(return_value, "hash_type", "OpenSSL_SHA256"); ++ break; ++ case PHAR_SIG_OPENSSL_SHA512: ++ add_assoc_string(return_value, "hash_type", "OpenSSL_SHA512"); + break; + default: + unknown = strpprintf(0, "Unknown (%u)", phar_obj->archive->sig_flags); +@@ -5103,6 +5115,8 @@ void phar_object_init(void) /* {{{ */ + REGISTER_PHAR_CLASS_CONST_LONG(phar_ce_archive, "PHPS", PHAR_MIME_PHPS) + REGISTER_PHAR_CLASS_CONST_LONG(phar_ce_archive, "MD5", PHAR_SIG_MD5) + REGISTER_PHAR_CLASS_CONST_LONG(phar_ce_archive, "OPENSSL", PHAR_SIG_OPENSSL) ++ REGISTER_PHAR_CLASS_CONST_LONG(phar_ce_archive, "OPENSSL_SHA256", PHAR_SIG_OPENSSL_SHA256) ++ REGISTER_PHAR_CLASS_CONST_LONG(phar_ce_archive, "OPENSSL_SHA512", PHAR_SIG_OPENSSL_SHA512) + REGISTER_PHAR_CLASS_CONST_LONG(phar_ce_archive, "SHA1", PHAR_SIG_SHA1) + REGISTER_PHAR_CLASS_CONST_LONG(phar_ce_archive, "SHA256", PHAR_SIG_SHA256) + REGISTER_PHAR_CLASS_CONST_LONG(phar_ce_archive, "SHA512", PHAR_SIG_SHA512) +diff --git a/ext/phar/tests/phar_get_supported_signatures_002a.phpt b/ext/phar/tests/phar_get_supported_signatures_002a.phpt +index 06d811f2c35c2..639143b3d2c90 100644 +--- a/ext/phar/tests/phar_get_supported_signatures_002a.phpt ++++ b/ext/phar/tests/phar_get_supported_signatures_002a.phpt +@@ -14,7 +14,7 @@ phar.readonly=0 + var_dump(Phar::getSupportedSignatures()); + ?> + --EXPECT-- +-array(5) { ++array(7) { + [0]=> + string(3) "MD5" + [1]=> +@@ -25,4 +25,8 @@ array(5) { + string(7) "SHA-512" + [4]=> + string(7) "OpenSSL" ++ [5]=> ++ string(14) "OpenSSL_SHA256" ++ [6]=> ++ string(14) "OpenSSL_SHA512" + } +diff --git a/ext/phar/tests/tar/phar_setsignaturealgo2.phpt b/ext/phar/tests/tar/phar_setsignaturealgo2.phpt +index cc10a241d739b..c2eb5d77a5bf0 100644 +--- a/ext/phar/tests/tar/phar_setsignaturealgo2.phpt ++++ b/ext/phar/tests/tar/phar_setsignaturealgo2.phpt +@@ -38,6 +38,10 @@ $pkey = ''; + openssl_pkey_export($private, $pkey, NULL, $config_arg); + $p->setSignatureAlgorithm(Phar::OPENSSL, $pkey); + var_dump($p->getSignature()); ++$p->setSignatureAlgorithm(Phar::OPENSSL_SHA512, $pkey); ++var_dump($p->getSignature()); ++$p->setSignatureAlgorithm(Phar::OPENSSL_SHA256, $pkey); ++var_dump($p->getSignature()); + } catch (Exception $e) { + echo $e->getMessage(); + } +@@ -83,3 +87,15 @@ array(2) { + ["hash_type"]=> + string(7) "OpenSSL" + } ++array(2) { ++ ["hash"]=> ++ string(%d) "%s" ++ ["hash_type"]=> ++ string(14) "OpenSSL_SHA512" ++} ++array(2) { ++ ["hash"]=> ++ string(%d) "%s" ++ ["hash_type"]=> ++ string(14) "OpenSSL_SHA256" ++} +diff --git a/ext/phar/util.c b/ext/phar/util.c +index 8d2db03b69601..515830bf2c70a 100644 +--- a/ext/phar/util.c ++++ b/ext/phar/util.c +@@ -34,7 +34,7 @@ + #include + #include + #else +-static int phar_call_openssl_signverify(int is_sign, php_stream *fp, zend_off_t end, char *key, size_t key_len, char **signature, size_t *signature_len); ++static int phar_call_openssl_signverify(int is_sign, php_stream *fp, zend_off_t end, char *key, size_t key_len, char **signature, size_t *signature_len, php_uint32 sig_type); + #endif + + /* for links to relative location, prepend cwd of the entry */ +@@ -1381,11 +1381,11 @@ static int phar_hex_str(const char *digest, size_t digest_len, char **signature) + /* }}} */ + + #ifndef PHAR_HAVE_OPENSSL +-static int phar_call_openssl_signverify(int is_sign, php_stream *fp, zend_off_t end, char *key, size_t key_len, char **signature, size_t *signature_len) /* {{{ */ ++static int phar_call_openssl_signverify(int is_sign, php_stream *fp, zend_off_t end, char *key, size_t key_len, char **signature, size_t *signature_len, php_uint32 sig_type) /* {{{ */ + { + zend_fcall_info fci; + zend_fcall_info_cache fcc; +- zval retval, zp[3], openssl; ++ zval retval, zp[4], openssl; + zend_string *str; + + ZVAL_STRINGL(&openssl, is_sign ? "openssl_sign" : "openssl_verify", is_sign ? sizeof("openssl_sign")-1 : sizeof("openssl_verify")-1); +@@ -1402,6 +1402,14 @@ static int phar_call_openssl_signverify(int is_sign, php_stream *fp, zend_off_t + } else { + ZVAL_EMPTY_STRING(&zp[0]); + } ++ if (sig_type == PHAR_SIG_OPENSSL_SHA512) { ++ ZVAL_LONG(&zp[3], 9); /* value from openssl.c #define OPENSSL_ALGO_SHA512 9 */ ++ } else if (sig_type == PHAR_SIG_OPENSSL_SHA256) { ++ ZVAL_LONG(&zp[3], 7); /* value from openssl.c #define OPENSSL_ALGO_SHA256 7 */ ++ } else { ++ /* don't rely on default value which may change in the future */ ++ ZVAL_LONG(&zp[3], 1); /* value from openssl.c #define OPENSSL_ALGO_SHA1 1 */ ++ } + + if ((size_t)end != Z_STRLEN(zp[0])) { + zval_ptr_dtor_str(&zp[0]); +@@ -1419,7 +1427,7 @@ static int phar_call_openssl_signverify(int is_sign, php_stream *fp, zend_off_t + return FAILURE; + } + +- fci.param_count = 3; ++ fci.param_count = 4; + fci.params = zp; + Z_ADDREF(zp[0]); + if (is_sign) { +@@ -1482,12 +1490,22 @@ int phar_verify_signature(php_stream *fp, size_t end_of_phar, uint32_t sig_type, + php_stream_rewind(fp); + + switch (sig_type) { ++ case PHAR_SIG_OPENSSL_SHA512: ++ case PHAR_SIG_OPENSSL_SHA256: + case PHAR_SIG_OPENSSL: { + #ifdef PHAR_HAVE_OPENSSL + BIO *in; + EVP_PKEY *key; +- EVP_MD *mdtype = (EVP_MD *) EVP_sha1(); ++ const EVP_MD *mdtype; + EVP_MD_CTX *md_ctx; ++ ++ if (sig_type == PHAR_SIG_OPENSSL_SHA512) { ++ mdtype = EVP_sha512(); ++ } else if (sig_type == PHAR_SIG_OPENSSL_SHA256) { ++ mdtype = EVP_sha256(); ++ } else { ++ mdtype = EVP_sha1(); ++ } + #else + size_t tempsig; + #endif +@@ -1521,7 +1539,7 @@ int phar_verify_signature(php_stream *fp, size_t end_of_phar, uint32_t sig_type, + #ifndef PHAR_HAVE_OPENSSL + tempsig = sig_len; + +- if (FAILURE == phar_call_openssl_signverify(0, fp, end_of_phar, pubkey ? ZSTR_VAL(pubkey) : NULL, pubkey ? ZSTR_LEN(pubkey) : 0, &sig, &tempsig)) { ++ if (FAILURE == phar_call_openssl_signverify(0, fp, end_of_phar, pubkey ? ZSTR_VAL(pubkey) : NULL, pubkey ? ZSTR_LEN(pubkey) : 0, &sig, &tempsig, sig_type)) { + if (pubkey) { + zend_string_release_ex(pubkey, 0); + } +@@ -1815,6 +1833,8 @@ int phar_create_signature(phar_archive_data *phar, php_stream *fp, char **signat + *signature_length = 32; + break; + } ++ case PHAR_SIG_OPENSSL_SHA512: ++ case PHAR_SIG_OPENSSL_SHA256: + case PHAR_SIG_OPENSSL: { + unsigned char *sigbuf; + #ifdef PHAR_HAVE_OPENSSL +@@ -1822,6 +1842,15 @@ int phar_create_signature(phar_archive_data *phar, php_stream *fp, char **signat + BIO *in; + EVP_PKEY *key; + EVP_MD_CTX *md_ctx; ++ const EVP_MD *mdtype; ++ ++ if (phar->sig_flags == PHAR_SIG_OPENSSL_SHA512) { ++ mdtype = EVP_sha512(); ++ } else if (phar->sig_flags == PHAR_SIG_OPENSSL_SHA256) { ++ mdtype = EVP_sha256(); ++ } else { ++ mdtype = EVP_sha1(); ++ } + + in = BIO_new_mem_buf(PHAR_G(openssl_privatekey), PHAR_G(openssl_privatekey_len)); + +@@ -1847,7 +1876,7 @@ int phar_create_signature(phar_archive_data *phar, php_stream *fp, char **signat + siglen = EVP_PKEY_size(key); + sigbuf = emalloc(siglen + 1); + +- if (!EVP_SignInit(md_ctx, EVP_sha1())) { ++ if (!EVP_SignInit(md_ctx, mdtype)) { + EVP_PKEY_free(key); + efree(sigbuf); + if (error) { +@@ -1885,7 +1914,7 @@ int phar_create_signature(phar_archive_data *phar, php_stream *fp, char **signat + siglen = 0; + php_stream_seek(fp, 0, SEEK_END); + +- if (FAILURE == phar_call_openssl_signverify(1, fp, php_stream_tell(fp), PHAR_G(openssl_privatekey), PHAR_G(openssl_privatekey_len), (char **)&sigbuf, &siglen)) { ++ if (FAILURE == phar_call_openssl_signverify(1, fp, php_stream_tell(fp), PHAR_G(openssl_privatekey), PHAR_G(openssl_privatekey_len), (char **)&sigbuf, &siglen, phar->sig_flags)) { + if (error) { + spprintf(error, 0, "unable to write phar \"%s\" with requested openssl signature", phar->fname); + } diff --git a/php-8.0.10-snmp-sha.patch b/php-8.0.10-snmp-sha.patch new file mode 100644 index 0000000..3ef67ea --- /dev/null +++ b/php-8.0.10-snmp-sha.patch @@ -0,0 +1,143 @@ +Backported for 8.0 from + + +From 718e91343fddb8817a004f96f111c424843bf746 Mon Sep 17 00:00:00 2001 +From: Remi Collet +Date: Wed, 11 Aug 2021 13:02:18 +0200 +Subject: [PATCH] add SHA256 and SHA512 for security protocol + +--- + ext/snmp/config.m4 | 18 +++++++++- + ext/snmp/snmp.c | 33 ++++++++++++++++++- + .../tests/snmp-object-setSecurity_error.phpt | 2 +- + ext/snmp/tests/snmp3-error.phpt | 2 +- + 4 files changed, 51 insertions(+), 4 deletions(-) + +diff --git a/ext/snmp/config.m4 b/ext/snmp/config.m4 +index 1475ddfe2b7f0..f285a572de9cb 100644 +--- a/ext/snmp/config.m4 ++++ b/ext/snmp/config.m4 +@@ -30,7 +30,7 @@ if test "$PHP_SNMP" != "no"; then + AC_MSG_ERROR([Could not find the required paths. Please check your net-snmp installation.]) + fi + else +- AC_MSG_ERROR([Net-SNMP version 5.3 or greater reqired (detected $snmp_full_version).]) ++ AC_MSG_ERROR([Net-SNMP version 5.3 or greater required (detected $snmp_full_version).]) + fi + else + AC_MSG_ERROR([Could not find net-snmp-config binary. Please check your net-snmp installation.]) +@@ -54,6 +54,22 @@ if test "$PHP_SNMP" != "no"; then + $SNMP_SHARED_LIBADD + ]) + ++ dnl Check whether usmHMAC192SHA256AuthProtocol exists. ++ PHP_CHECK_LIBRARY($SNMP_LIBNAME, usmHMAC192SHA256AuthProtocol, ++ [ ++ AC_DEFINE(HAVE_SNMP_SHA256, 1, [ ]) ++ ], [], [ ++ $SNMP_SHARED_LIBADD ++ ]) ++ ++ dnl Check whether usmHMAC384SHA512AuthProtocol exists. ++ PHP_CHECK_LIBRARY($SNMP_LIBNAME, usmHMAC384SHA512AuthProtocol, ++ [ ++ AC_DEFINE(HAVE_SNMP_SHA512, 1, [ ]) ++ ], [], [ ++ $SNMP_SHARED_LIBADD ++ ]) ++ + PHP_NEW_EXTENSION(snmp, snmp.c, $ext_shared) + PHP_SUBST(SNMP_SHARED_LIBADD) + fi +diff --git a/ext/snmp/snmp.c b/ext/snmp/snmp.c +index 69d6549405b17..f0917501751f5 100644 +--- a/ext/snmp/snmp.c ++++ b/ext/snmp/snmp.c +@@ -29,6 +29,7 @@ + #include "php_snmp.h" + + #include "zend_exceptions.h" ++#include "zend_smart_string.h" + #include "ext/spl/spl_exceptions.h" + #include "snmp_arginfo.h" + +@@ -938,16 +939,48 @@ static int netsnmp_session_set_auth_prot + if (!strcasecmp(prot, "MD5")) { + s->securityAuthProto = usmHMACMD5AuthProtocol; + s->securityAuthProtoLen = USM_AUTH_PROTO_MD5_LEN; +- } else ++ return true; ++ } + #endif ++ + if (!strcasecmp(prot, "SHA")) { + s->securityAuthProto = usmHMACSHA1AuthProtocol; + s->securityAuthProtoLen = USM_AUTH_PROTO_SHA_LEN; +- } else { +- zend_value_error("Authentication protocol must be either \"MD5\" or \"SHA\""); +- return (-1); ++ return true; + } +- return (0); ++ ++#ifdef HAVE_SNMP_SHA256 ++ if (!strcasecmp(prot, "SHA256")) { ++ s->securityAuthProto = usmHMAC192SHA256AuthProtocol; ++ s->securityAuthProtoLen = sizeof(usmHMAC192SHA256AuthProtocol) / sizeof(oid); ++ return true; ++ } ++#endif ++ ++#ifdef HAVE_SNMP_SHA512 ++ if (!strcasecmp(prot, "SHA512")) { ++ s->securityAuthProto = usmHMAC384SHA512AuthProtocol; ++ s->securityAuthProtoLen = sizeof(usmHMAC384SHA512AuthProtocol) / sizeof(oid); ++ return true; ++ } ++#endif ++ ++ smart_string err = {0}; ++ ++ smart_string_appends(&err, "Authentication protocol must be \"SHA\""); ++#ifdef HAVE_SNMP_SHA256 ++ smart_string_appends(&err, " or \"SHA256\""); ++#endif ++#ifdef HAVE_SNMP_SHA512 ++ smart_string_appends(&err, " or \"SHA512\""); ++#endif ++#ifndef DISABLE_MD5 ++ smart_string_appends(&err, " or \"MD5\""); ++#endif ++ smart_string_0(&err); ++ zend_value_error("%s", err.c); ++ smart_string_free(&err); ++ return false; + } + /* }}} */ + +diff --git a/ext/snmp/tests/snmp-object-setSecurity_error.phpt b/ext/snmp/tests/snmp-object-setSecurity_error.phpt +index f8de846492a75..cf4f928837773 100644 +--- a/ext/snmp/tests/snmp-object-setSecurity_error.phpt ++++ b/ext/snmp/tests/snmp-object-setSecurity_error.phpt +@@ -59,7 +59,7 @@ var_dump($session->close()); + --EXPECTF-- + Security level must be one of "noAuthNoPriv", "authNoPriv", or "authPriv" + Security level must be one of "noAuthNoPriv", "authNoPriv", or "authPriv" +-Authentication protocol must be either "MD5" or "SHA" ++Authentication protocol must be %s + + Warning: SNMP::setSecurity(): Error generating a key for authentication pass phrase '': Generic error (The supplied password length is too short.) in %s on line %d + bool(false) +diff --git a/ext/snmp/tests/snmp3-error.phpt b/ext/snmp/tests/snmp3-error.phpt +index 849e363b45058..389800dad6b28 100644 +--- a/ext/snmp/tests/snmp3-error.phpt ++++ b/ext/snmp/tests/snmp3-error.phpt +@@ -58,7 +58,7 @@ try { + Checking error handling + Security level must be one of "noAuthNoPriv", "authNoPriv", or "authPriv" + Security level must be one of "noAuthNoPriv", "authNoPriv", or "authPriv" +-Authentication protocol must be either "MD5" or "SHA" ++Authentication protocol must be %s + + Warning: snmp3_get(): Error generating a key for authentication pass phrase '': Generic error (The supplied password length is too short.) in %s on line %d + bool(false) diff --git a/php-8.0.10-systzdata-v21.patch b/php-8.0.10-systzdata-v21.patch new file mode 100644 index 0000000..779f538 --- /dev/null +++ b/php-8.0.10-systzdata-v21.patch @@ -0,0 +1,718 @@ +# License: MIT +# http://opensource.org/licenses/MIT + +Add support for use of the system timezone database, rather +than embedding a copy. Discussed upstream but was not desired. + +History: +r21: retrieve tzdata version from /usr/share/zoneinfo/tzdata.zi +r20: adapt for timelib 2020.03 (in 8.0.10RC1) +r19: adapt for timelib 2020.02 (in 8.0.0beta2) +r18: adapt for autotool change in 7.3.3RC1 +r17: adapt for timelib 2018.01 (in 7.3.2RC1) +r16: adapt for timelib 2017.06 (in 7.2.3RC1) +r15: adapt for timelib 2017.05beta7 (in 7.2.0RC1) +r14: improve check for valid tz file +r13: adapt for upstream changes to use PHP allocator +r12: adapt for upstream changes for new zic +r11: use canonical names to avoid more case sensitivity issues + round lat/long from zone.tab towards zero per builtin db +r10: make timezone case insensitive +r9: fix another compile error without --with-system-tzdata configured (Michael Heimpold) +r8: fix compile error without --with-system-tzdata configured +r7: improve check for valid timezone id to exclude directories +r6: fix fd leak in r5, fix country code/BC flag use in + timezone_identifiers_list() using system db, + fix use of PECL timezonedb to override system db, +r5: reverts addition of "System/Localtime" fake tzname. + updated for 5.3.0, parses zone.tab to pick up mapping between + timezone name, country code and long/lat coords +r4: added "System/Localtime" tzname which uses /etc/localtime +r3: fix a crash if /usr/share/zoneinfo doesn't exist (Raphael Geissert) +r2: add filesystem trawl to set up name alias index +r1: initial revision + +diff --git a/ext/date/config0.m4 b/ext/date/config0.m4 +index 20e4164aaa..a61243646d 100644 +--- a/ext/date/config0.m4 ++++ b/ext/date/config0.m4 +@@ -4,6 +4,19 @@ AC_CHECK_HEADERS([io.h]) + dnl Check for strtoll, atoll + AC_CHECK_FUNCS(strtoll atoll) + ++PHP_ARG_WITH(system-tzdata, for use of system timezone data, ++[ --with-system-tzdata[=DIR] to specify use of system timezone data], ++no, no) ++ ++if test "$PHP_SYSTEM_TZDATA" != "no"; then ++ AC_DEFINE(HAVE_SYSTEM_TZDATA, 1, [Define if system timezone data is used]) ++ ++ if test "$PHP_SYSTEM_TZDATA" != "yes"; then ++ AC_DEFINE_UNQUOTED(HAVE_SYSTEM_TZDATA_PREFIX, "$PHP_SYSTEM_TZDATA", ++ [Define for location of system timezone data]) ++ fi ++fi ++ + PHP_DATE_CFLAGS="-I@ext_builddir@/lib -DZEND_ENABLE_STATIC_TSRMLS_CACHE=1 -DHAVE_TIMELIB_CONFIG_H=1" + timelib_sources="lib/astro.c lib/dow.c lib/parse_date.c lib/parse_tz.c + lib/timelib.c lib/tm2unixtime.c lib/unixtime2tm.c lib/parse_iso_intervals.c lib/interval.c" +diff --git a/ext/date/lib/parse_tz.c b/ext/date/lib/parse_tz.c +index e9bd0f136d..c04ff01adc 100644 +--- a/ext/date/lib/parse_tz.c ++++ b/ext/date/lib/parse_tz.c +@@ -26,8 +26,21 @@ + #include "timelib.h" + #include "timelib_private.h" + ++#ifdef HAVE_SYSTEM_TZDATA ++#include ++#include ++#include ++#include ++#include ++ ++#include "php_scandir.h" ++ ++#else + #define TIMELIB_SUPPORTS_V2DATA + #include "timezonedb.h" ++#endif ++ ++#include + + #if (defined(__APPLE__) || defined(__APPLE_CC__)) && (defined(__BIG_ENDIAN__) || defined(__LITTLE_ENDIAN__)) + # if defined(__LITTLE_ENDIAN__) +@@ -94,6 +107,11 @@ static int read_php_preamble(const unsigned char **tzf, timelib_tzinfo *tz) + { + uint32_t version; + ++ if (memcmp(*tzf, "TZif", 4) == 0) { ++ *tzf += 20; ++ return 0; ++ } ++ + /* read ID */ + version = (*tzf)[3] - '0'; + *tzf += 4; +@@ -435,7 +453,467 @@ void timelib_dump_tzinfo(timelib_tzinfo *tz) + } + } + +-static int seek_to_tz_position(const unsigned char **tzf, const char *timezone, const timelib_tzdb *tzdb) ++#ifdef HAVE_SYSTEM_TZDATA ++ ++#ifdef HAVE_SYSTEM_TZDATA_PREFIX ++#define ZONEINFO_PREFIX HAVE_SYSTEM_TZDATA_PREFIX ++#else ++#define ZONEINFO_PREFIX "/usr/share/zoneinfo" ++#endif ++ ++/* System timezone database pointer. */ ++static const timelib_tzdb *timezonedb_system; ++ ++/* Hash table entry for the cache of the zone.tab mapping table. */ ++struct location_info { ++ char code[2]; ++ double latitude, longitude; ++ char name[64]; ++ char *comment; ++ struct location_info *next; ++}; ++ ++/* Cache of zone.tab. */ ++static struct location_info **system_location_table; ++ ++/* Size of the zone.tab hash table; a random-ish prime big enough to ++ * prevent too many collisions. */ ++#define LOCINFO_HASH_SIZE (1021) ++ ++/* Compute a case insensitive hash of str */ ++static uint32_t tz_hash(const char *str) ++{ ++ const unsigned char *p = (const unsigned char *)str; ++ uint32_t hash = 5381; ++ int c; ++ ++ while ((c = tolower(*p++)) != '\0') { ++ hash = (hash << 5) ^ hash ^ c; ++ } ++ ++ return hash % LOCINFO_HASH_SIZE; ++} ++ ++/* Parse an ISO-6709 date as used in zone.tab. Returns end of the ++ * parsed string on success, or NULL on parse error. On success, ++ * writes the parsed number to *result. */ ++static char *parse_iso6709(char *p, double *result) ++{ ++ double v, sign; ++ char *pend; ++ size_t len; ++ ++ if (*p == '+') ++ sign = 1.0; ++ else if (*p == '-') ++ sign = -1.0; ++ else ++ return NULL; ++ ++ p++; ++ for (pend = p; *pend >= '0' && *pend <= '9'; pend++) ++ ;; ++ ++ /* Annoying encoding used by zone.tab has no decimal point, so use ++ * the length to determine the format: ++ * ++ * 4 = DDMM ++ * 5 = DDDMM ++ * 6 = DDMMSS ++ * 7 = DDDMMSS ++ */ ++ len = pend - p; ++ if (len < 4 || len > 7) { ++ return NULL; ++ } ++ ++ /* p => [D]DD */ ++ v = (p[0] - '0') * 10.0 + (p[1] - '0'); ++ p += 2; ++ if (len == 5 || len == 7) ++ v = v * 10.0 + (*p++ - '0'); ++ /* p => MM[SS] */ ++ v += (10.0 * (p[0] - '0') ++ + p[1] - '0') / 60.0; ++ p += 2; ++ /* p => [SS] */ ++ if (len > 5) { ++ v += (10.0 * (p[0] - '0') ++ + p[1] - '0') / 3600.0; ++ p += 2; ++ } ++ ++ /* Round to five decimal place, not because it's a good idea, ++ * but, because the builtin data uses rounded data, so, match ++ * that. */ ++ *result = trunc(v * sign * 100000.0) / 100000.0; ++ ++ return p; ++} ++ ++/* This function parses the zone.tab file to build up the mapping of ++ * timezone to country code and geographic location, and returns a ++ * hash table. The hash table is indexed by the function: ++ * ++ * tz_hash(timezone-name) ++ */ ++static struct location_info **create_location_table(void) ++{ ++ struct location_info **li, *i; ++ char zone_tab[PATH_MAX]; ++ char line[512]; ++ FILE *fp; ++ ++ strncpy(zone_tab, ZONEINFO_PREFIX "/zone.tab", sizeof zone_tab); ++ ++ fp = fopen(zone_tab, "r"); ++ if (!fp) { ++ return NULL; ++ } ++ ++ li = calloc(LOCINFO_HASH_SIZE, sizeof *li); ++ ++ while (fgets(line, sizeof line, fp)) { ++ char *p = line, *code, *name, *comment; ++ uint32_t hash; ++ double latitude, longitude; ++ ++ while (isspace(*p)) ++ p++; ++ ++ if (*p == '#' || *p == '\0' || *p == '\n') ++ continue; ++ ++ if (!isalpha(p[0]) || !isalpha(p[1]) || p[2] != '\t') ++ continue; ++ ++ /* code => AA */ ++ code = p; ++ p[2] = 0; ++ p += 3; ++ ++ /* coords => [+-][D]DDMM[SS][+-][D]DDMM[SS] */ ++ p = parse_iso6709(p, &latitude); ++ if (!p) { ++ continue; ++ } ++ p = parse_iso6709(p, &longitude); ++ if (!p) { ++ continue; ++ } ++ ++ if (!p || *p != '\t') { ++ continue; ++ } ++ ++ /* name = string */ ++ name = ++p; ++ while (*p != '\t' && *p && *p != '\n') ++ p++; ++ ++ *p++ = '\0'; ++ ++ /* comment = string */ ++ comment = p; ++ while (*p != '\t' && *p && *p != '\n') ++ p++; ++ ++ if (*p == '\n' || *p == '\t') ++ *p = '\0'; ++ ++ hash = tz_hash(name); ++ i = malloc(sizeof *i); ++ memcpy(i->code, code, 2); ++ strncpy(i->name, name, sizeof i->name); ++ i->comment = strdup(comment); ++ i->longitude = longitude; ++ i->latitude = latitude; ++ i->next = li[hash]; ++ li[hash] = i; ++ /* printf("%s [%u, %f, %f]\n", name, hash, latitude, longitude); */ ++ } ++ ++ fclose(fp); ++ ++ return li; ++} ++ ++/* Return location info from hash table, using given timezone name. ++ * Returns NULL if the name could not be found. */ ++const struct location_info *find_zone_info(struct location_info **li, ++ const char *name) ++{ ++ uint32_t hash = tz_hash(name); ++ const struct location_info *l; ++ ++ if (!li) { ++ return NULL; ++ } ++ ++ for (l = li[hash]; l; l = l->next) { ++ if (timelib_strcasecmp(l->name, name) == 0) ++ return l; ++ } ++ ++ return NULL; ++} ++ ++/* Filter out some non-tzdata files and the posix/right databases, if ++ * present. */ ++static int index_filter(const struct dirent *ent) ++{ ++ return strcmp(ent->d_name, ".") != 0 ++ && strcmp(ent->d_name, "..") != 0 ++ && strcmp(ent->d_name, "posix") != 0 ++ && strcmp(ent->d_name, "posixrules") != 0 ++ && strcmp(ent->d_name, "right") != 0 ++ && strstr(ent->d_name, ".list") == NULL ++ && strstr(ent->d_name, ".tab") == NULL; ++} ++ ++static int sysdbcmp(const void *first, const void *second) ++{ ++ const timelib_tzdb_index_entry *alpha = first, *beta = second; ++ ++ return timelib_strcasecmp(alpha->id, beta->id); ++} ++ ++ ++/* Retrieve tzdata version. */ ++static void retrieve_zone_version(timelib_tzdb *db) ++{ ++ static char buf[30]; ++ char path[PATH_MAX]; ++ FILE *fp; ++ ++ strncpy(path, ZONEINFO_PREFIX "/tzdata.zi", sizeof(path)); ++ ++ fp = fopen(path, "r"); ++ if (fp) { ++ if (fgets(buf, sizeof(buf), fp)) { ++ if (!memcmp(buf, "# version ", 10) && ++ isdigit(buf[10]) && ++ isdigit(buf[11]) && ++ isdigit(buf[12]) && ++ isdigit(buf[13]) && ++ islower(buf[14])) { ++ if (buf[14] >= 't') { /* 2022t = 2022.20 */ ++ buf[17] = 0; ++ buf[16] = buf[14] - 't' + '0'; ++ buf[15] = '2'; ++ } else if (buf[14] >= 'j') { /* 2022j = 2022.10 */ ++ buf[17] = 0; ++ buf[16] = buf[14] - 'j' + '0'; ++ buf[15] = '1'; ++ } else { /* 2022a = 2022.1 */ ++ buf[16] = 0; ++ buf[15] = buf[14] - 'a' + '1'; ++ } ++ buf[14] = '.'; ++ db->version = buf+10; ++ } ++ } ++ fclose(fp); ++ } ++} ++ ++/* Create the zone identifier index by trawling the filesystem. */ ++static void create_zone_index(timelib_tzdb *db) ++{ ++ size_t dirstack_size, dirstack_top; ++ size_t index_size, index_next; ++ timelib_tzdb_index_entry *db_index; ++ char **dirstack; ++ ++ /* LIFO stack to hold directory entries to scan; each slot is a ++ * directory name relative to the zoneinfo prefix. */ ++ dirstack_size = 32; ++ dirstack = malloc(dirstack_size * sizeof *dirstack); ++ dirstack_top = 1; ++ dirstack[0] = strdup(""); ++ ++ /* Index array. */ ++ index_size = 64; ++ db_index = malloc(index_size * sizeof *db_index); ++ index_next = 0; ++ ++ do { ++ struct dirent **ents; ++ char name[PATH_MAX], *top; ++ int count; ++ ++ /* Pop the top stack entry, and iterate through its contents. */ ++ top = dirstack[--dirstack_top]; ++ snprintf(name, sizeof name, ZONEINFO_PREFIX "/%s", top); ++ ++ count = php_scandir(name, &ents, index_filter, php_alphasort); ++ ++ while (count > 0) { ++ struct stat st; ++ const char *leaf = ents[count - 1]->d_name; ++ ++ snprintf(name, sizeof name, ZONEINFO_PREFIX "/%s/%s", ++ top, leaf); ++ ++ if (strlen(name) && stat(name, &st) == 0) { ++ /* Name, relative to the zoneinfo prefix. */ ++ const char *root = top; ++ ++ if (root[0] == '/') root++; ++ ++ snprintf(name, sizeof name, "%s%s%s", root, ++ *root ? "/": "", leaf); ++ ++ if (S_ISDIR(st.st_mode)) { ++ if (dirstack_top == dirstack_size) { ++ dirstack_size *= 2; ++ dirstack = realloc(dirstack, ++ dirstack_size * sizeof *dirstack); ++ } ++ dirstack[dirstack_top++] = strdup(name); ++ } ++ else { ++ if (index_next == index_size) { ++ index_size *= 2; ++ db_index = realloc(db_index, ++ index_size * sizeof *db_index); ++ } ++ ++ db_index[index_next++].id = strdup(name); ++ } ++ } ++ ++ free(ents[--count]); ++ } ++ ++ if (count != -1) free(ents); ++ free(top); ++ } while (dirstack_top); ++ ++ qsort(db_index, index_next, sizeof *db_index, sysdbcmp); ++ ++ db->index = db_index; ++ db->index_size = index_next; ++ ++ free(dirstack); ++} ++ ++#define FAKE_HEADER "1234\0??\1??" ++#define FAKE_UTC_POS (7 - 4) ++ ++/* Create a fake data segment for database 'sysdb'. */ ++static void fake_data_segment(timelib_tzdb *sysdb, ++ struct location_info **info) ++{ ++ size_t n; ++ char *data, *p; ++ ++ data = malloc(3 * sysdb->index_size + 7); ++ ++ p = mempcpy(data, FAKE_HEADER, sizeof(FAKE_HEADER) - 1); ++ ++ for (n = 0; n < sysdb->index_size; n++) { ++ const struct location_info *li; ++ timelib_tzdb_index_entry *ent; ++ ++ ent = (timelib_tzdb_index_entry *)&sysdb->index[n]; ++ ++ /* Lookup the timezone name in the hash table. */ ++ if (strcmp(ent->id, "UTC") == 0) { ++ ent->pos = FAKE_UTC_POS; ++ continue; ++ } ++ ++ li = find_zone_info(info, ent->id); ++ if (li) { ++ /* If found, append the BC byte and the ++ * country code; set the position for this ++ * section of timezone data. */ ++ ent->pos = (p - data) - 4; ++ *p++ = '\1'; ++ *p++ = li->code[0]; ++ *p++ = li->code[1]; ++ } ++ else { ++ /* If not found, the timezone data can ++ * point at the header. */ ++ ent->pos = 0; ++ } ++ } ++ ++ sysdb->data = (unsigned char *)data; ++} ++ ++/* Returns true if the passed-in stat structure describes a ++ * probably-valid timezone file. */ ++static int is_valid_tzfile(const struct stat *st, int fd) ++{ ++ if (fd) { ++ char buf[20]; ++ if (read(fd, buf, 20)!=20) { ++ return 0; ++ } ++ lseek(fd, SEEK_SET, 0); ++ if (memcmp(buf, "TZif", 4)) { ++ return 0; ++ } ++ } ++ return S_ISREG(st->st_mode) && st->st_size > 20; ++} ++ ++/* To allow timezone names to be used case-insensitively, find the ++ * canonical name for this timezone, if possible. */ ++static const char *canonical_tzname(const char *timezone) ++{ ++ if (timezonedb_system) { ++ timelib_tzdb_index_entry *ent, lookup; ++ ++ lookup.id = (char *)timezone; ++ ++ ent = bsearch(&lookup, timezonedb_system->index, ++ timezonedb_system->index_size, sizeof lookup, ++ sysdbcmp); ++ if (ent) { ++ return ent->id; ++ } ++ } ++ ++ return timezone; ++} ++ ++/* Return the mmap()ed tzfile if found, else NULL. On success, the ++ * length of the mapped data is placed in *length. */ ++static char *map_tzfile(const char *timezone, size_t *length) ++{ ++ char fname[PATH_MAX]; ++ struct stat st; ++ char *p; ++ int fd; ++ ++ if (timezone[0] == '\0' || strstr(timezone, "..") != NULL) { ++ return NULL; ++ } ++ ++ snprintf(fname, sizeof fname, ZONEINFO_PREFIX "/%s", canonical_tzname(timezone)); ++ ++ fd = open(fname, O_RDONLY); ++ if (fd == -1) { ++ return NULL; ++ } else if (fstat(fd, &st) != 0 || !is_valid_tzfile(&st, fd)) { ++ close(fd); ++ return NULL; ++ } ++ ++ *length = st.st_size; ++ p = mmap(NULL, st.st_size, PROT_READ, MAP_SHARED, fd, 0); ++ close(fd); ++ ++ return p != MAP_FAILED ? p : NULL; ++} ++ ++#endif ++ ++static int inmem_seek_to_tz_position(const unsigned char **tzf, const char *timezone, const timelib_tzdb *tzdb) + { + int left = 0, right = tzdb->index_size - 1; + +@@ -461,9 +939,49 @@ static int seek_to_tz_position(const unsigned char **tzf, const char *timezone, + return 0; + } + ++static int seek_to_tz_position(const unsigned char **tzf, const char *timezone, ++ char **map, size_t *maplen, ++ const timelib_tzdb *tzdb) ++{ ++#ifdef HAVE_SYSTEM_TZDATA ++ if (tzdb == timezonedb_system) { ++ char *orig; ++ ++ orig = map_tzfile(timezone, maplen); ++ if (orig == NULL) { ++ return 0; ++ } ++ ++ (*tzf) = (unsigned char *)orig; ++ *map = orig; ++ return 1; ++ } ++ else ++#endif ++ { ++ return inmem_seek_to_tz_position(tzf, timezone, tzdb); ++ } ++} ++ + const timelib_tzdb *timelib_builtin_db(void) + { ++#ifdef HAVE_SYSTEM_TZDATA ++ if (timezonedb_system == NULL) { ++ timelib_tzdb *tmp = malloc(sizeof *tmp); ++ ++ tmp->version = "0.system"; ++ tmp->data = NULL; ++ create_zone_index(tmp); ++ retrieve_zone_version(tmp); ++ system_location_table = create_location_table(); ++ fake_data_segment(tmp, system_location_table); ++ timezonedb_system = tmp; ++ } ++ ++ return timezonedb_system; ++#else + return &timezonedb_builtin; ++#endif + } + + const timelib_tzdb_index_entry *timelib_timezone_identifiers_list(const timelib_tzdb *tzdb, int *count) +@@ -475,7 +993,30 @@ const timelib_tzdb_index_entry *timelib_timezone_identifiers_list(const timelib_ + int timelib_timezone_id_is_valid(const char *timezone, const timelib_tzdb *tzdb) + { + const unsigned char *tzf; +- return (seek_to_tz_position(&tzf, timezone, tzdb)); ++ ++#ifdef HAVE_SYSTEM_TZDATA ++ if (tzdb == timezonedb_system) { ++ char fname[PATH_MAX]; ++ struct stat st; ++ ++ if (timezone[0] == '\0' || strstr(timezone, "..") != NULL) { ++ return 0; ++ } ++ ++ if (system_location_table) { ++ if (find_zone_info(system_location_table, timezone) != NULL) { ++ /* found in cache */ ++ return 1; ++ } ++ } ++ ++ snprintf(fname, sizeof fname, ZONEINFO_PREFIX "/%s", canonical_tzname(timezone)); ++ ++ return stat(fname, &st) == 0 && is_valid_tzfile(&st, 0); ++ } ++#endif ++ ++ return (inmem_seek_to_tz_position(&tzf, timezone, tzdb)); + } + + static int skip_64bit_preamble(const unsigned char **tzf, timelib_tzinfo *tz) +@@ -517,6 +1058,8 @@ static timelib_tzinfo* timelib_tzinfo_ctor(const char *name) + timelib_tzinfo *timelib_parse_tzfile(const char *timezone, const timelib_tzdb *tzdb, int *error_code) + { + const unsigned char *tzf; ++ char *memmap = NULL; ++ size_t maplen; + timelib_tzinfo *tmp; + int version; + int transitions_result, types_result; +@@ -524,7 +1067,7 @@ timelib_tzinfo *timelib_parse_tzfile(const char *timezone, const timelib_tzdb *t + + *error_code = TIMELIB_ERROR_NO_ERROR; + +- if (seek_to_tz_position(&tzf, timezone, tzdb)) { ++ if (seek_to_tz_position(&tzf, timezone, &memmap, &maplen, tzdb)) { + tmp = timelib_tzinfo_ctor(timezone); + + version = read_preamble(&tzf, tmp, &type); +@@ -563,11 +1106,36 @@ timelib_tzinfo *timelib_parse_tzfile(const char *timezone, const timelib_tzdb *t + } + skip_posix_string(&tzf, tmp); + ++#ifdef HAVE_SYSTEM_TZDATA ++ if (memmap) { ++ const struct location_info *li; ++ ++ /* TZif-style - grok the location info from the system database, ++ * if possible. */ ++ ++ if ((li = find_zone_info(system_location_table, timezone)) != NULL) { ++ tmp->location.comments = timelib_strdup(li->comment); ++ strncpy(tmp->location.country_code, li->code, 2); ++ tmp->location.longitude = li->longitude; ++ tmp->location.latitude = li->latitude; ++ tmp->bc = 1; ++ } ++ else { ++ set_default_location_and_comments(&tzf, tmp); ++ } ++ ++ /* Now done with the mmap segment - discard it. */ ++ munmap(memmap, maplen); ++ } else { ++#endif + if (type == TIMELIB_TZINFO_PHP) { + read_location(&tzf, tmp); + } else { + set_default_location_and_comments(&tzf, tmp); + } ++#ifdef HAVE_SYSTEM_TZDATA ++ } ++#endif + } else { + *error_code = TIMELIB_ERROR_NO_SUCH_TIMEZONE; + tmp = NULL; +diff --git a/ext/date/php_date.c b/ext/date/php_date.c +index 2d5cffb963..389f09f313 100644 +--- a/ext/date/php_date.c ++++ b/ext/date/php_date.c +@@ -457,7 +457,11 @@ PHP_MINFO_FUNCTION(date) + php_info_print_table_row(2, "date/time support", "enabled"); + php_info_print_table_row(2, "timelib version", TIMELIB_ASCII_VERSION); + php_info_print_table_row(2, "\"Olson\" Timezone Database Version", tzdb->version); ++#ifdef HAVE_SYSTEM_TZDATA ++ php_info_print_table_row(2, "Timezone Database", "system"); ++#else + php_info_print_table_row(2, "Timezone Database", php_date_global_timezone_db_enabled ? "external" : "internal"); ++#endif + php_info_print_table_row(2, "Default timezone", guess_timezone(tzdb)); + php_info_print_table_end(); + diff --git a/php-8.0.13-crypt.patch b/php-8.0.13-crypt.patch new file mode 100644 index 0000000..31a8c8a --- /dev/null +++ b/php-8.0.13-crypt.patch @@ -0,0 +1,45 @@ +From fc4e31467c352032ee709ac55d3c67bc22abcd8d Mon Sep 17 00:00:00 2001 +From: Remi Collet +Date: Fri, 15 Oct 2021 17:11:12 +0200 +Subject: [PATCH] add --with-external-libcrypt build option display an error + message if some algo not available in external libcrypt + +--- + ext/standard/config.m4 | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/ext/standard/config.m4 b/ext/standard/config.m4 +index 58b9c5e658a4..3ec18be4d7df 100644 +--- a/ext/standard/config.m4 ++++ b/ext/standard/config.m4 +@@ -267,14 +267,25 @@ int main() { + ])]) + + ++PHP_ARG_WITH([external-libcrypt], ++ [for external libcrypt or libxcrypt], ++ [AS_HELP_STRING([--with-external-libcrypt], ++ [Use external libcrypt or libxcrypt])], ++ [no], ++ [no]) ++ + dnl + dnl If one of them is missing, use our own implementation, portable code is then possible + dnl +-dnl TODO This is currently always enabled +-if test "$ac_cv_crypt_blowfish" = "no" || test "$ac_cv_crypt_des" = "no" || test "$ac_cv_crypt_ext_des" = "no" || test "$ac_cv_crypt_md5" = "no" || test "$ac_cv_crypt_sha512" = "no" || test "$ac_cv_crypt_sha256" = "no" || test "$ac_cv_func_crypt_r" != "yes" || true; then +- AC_DEFINE_UNQUOTED(PHP_USE_PHP_CRYPT_R, 1, [Whether PHP has to use its own crypt_r for blowfish, des, ext des and md5]) +- +- PHP_ADD_SOURCES(PHP_EXT_DIR(standard), crypt_freesec.c crypt_blowfish.c crypt_sha512.c crypt_sha256.c php_crypt_r.c) ++dnl This is currently enabled by default ++if test "$ac_cv_crypt_blowfish" = "no" || test "$ac_cv_crypt_des" = "no" || test "$ac_cv_crypt_ext_des" = "no" || test "$ac_cv_crypt_md5" = "no" || test "$ac_cv_crypt_sha512" = "no" || test "$ac_cv_crypt_sha256" = "no" || test "$ac_cv_func_crypt_r" != "yes" || test "$PHP_EXTERNAL_LIBCRYPT" = "no"; then ++ if test "$PHP_EXTERNAL_LIBCRYPT" = "no"; then ++ AC_DEFINE_UNQUOTED(PHP_USE_PHP_CRYPT_R, 1, [Whether PHP has to use its own crypt_r for blowfish, des, ext des and md5]) ++ ++ PHP_ADD_SOURCES(PHP_EXT_DIR(standard), crypt_freesec.c crypt_blowfish.c crypt_sha512.c crypt_sha256.c php_crypt_r.c) ++ else ++ AC_MSG_ERROR([Cannot use external libcrypt as some algo are missing]) ++ fi + else + AC_DEFINE_UNQUOTED(PHP_USE_PHP_CRYPT_R, 0, [Whether PHP has to use its own crypt_r for blowfish, des and ext des]) + fi diff --git a/php-8.0.19-parser.patch b/php-8.0.19-parser.patch new file mode 100644 index 0000000..8a28e4d --- /dev/null +++ b/php-8.0.19-parser.patch @@ -0,0 +1,16 @@ +diff -up ./build/gen_stub.php.syslib ./build/gen_stub.php +--- ./build/gen_stub.php.syslib 2020-06-25 08:11:51.782046813 +0200 ++++ ./build/gen_stub.php 2020-06-25 08:13:11.188860368 +0200 +@@ -1075,6 +1075,12 @@ function initPhpParser() { + } + + $isInitialized = true; ++ ++ if (file_exists('/usr/share/php/PhpParser4/autoload.php')) { ++ require_once '/usr/share/php/PhpParser4/autoload.php'; ++ return; ++ } ++ + $version = "4.13.0"; + $phpParserDir = __DIR__ . "/PHP-Parser-$version"; + if (!is_dir($phpParserDir)) { diff --git a/php-8.0.6-deprecated.patch b/php-8.0.6-deprecated.patch new file mode 100644 index 0000000..1e6b93b --- /dev/null +++ b/php-8.0.6-deprecated.patch @@ -0,0 +1,400 @@ +From 4dc8b3c0efaae25b08c8f59b068f17c97c59d0ae Mon Sep 17 00:00:00 2001 +From: Remi Collet +Date: Wed, 5 May 2021 15:41:00 +0200 +Subject: [PATCH] get rid of inet_aton and inet_ntoa use inet_ntop iand + inet_pton where available standardize buffer size + +--- + ext/sockets/sockaddr_conv.c | 4 ++++ + ext/sockets/sockets.c | 48 +++++++++++++++++++++++++------------ + ext/standard/dns.c | 16 ++++++++++++- + main/network.c | 20 ++++++++++++++-- + 4 files changed, 70 insertions(+), 18 deletions(-) + +diff --git a/ext/sockets/sockaddr_conv.c b/ext/sockets/sockaddr_conv.c +index 57996612d2d7e..65c8418fb3a6f 100644 +--- a/ext/sockets/sockaddr_conv.c ++++ b/ext/sockets/sockaddr_conv.c +@@ -87,7 +87,11 @@ int php_set_inet_addr(struct sockaddr_in *sin, char *string, php_socket *php_soc + struct in_addr tmp; + struct hostent *host_entry; + ++#ifdef HAVE_INET_PTON ++ if (inet_pton(AF_INET, string, &tmp)) { ++#else + if (inet_aton(string, &tmp)) { ++#endif + sin->sin_addr.s_addr = tmp.s_addr; + } else { + if (strlen(string) > MAXFQDNLEN || ! (host_entry = php_network_gethostbyname(string))) { +diff --git a/ext/sockets/sockets.c b/ext/sockets/sockets.c +index 16ad3e8013a4c..85c938d1b97b1 100644 +--- a/ext/sockets/sockets.c ++++ b/ext/sockets/sockets.c +@@ -220,8 +220,10 @@ zend_module_entry sockets_module_entry = { + ZEND_GET_MODULE(sockets) + #endif + ++#ifndef HAVE_INET_NTOP + /* inet_ntop should be used instead of inet_ntoa */ + int inet_ntoa_lock = 0; ++#endif + + static int php_open_listen_sock(php_socket *sock, int port, int backlog) /* {{{ */ + { +@@ -1082,10 +1084,12 @@ PHP_FUNCTION(socket_getsockname) + struct sockaddr_in *sin; + #if HAVE_IPV6 + struct sockaddr_in6 *sin6; +- char addr6[INET6_ADDRSTRLEN+1]; ++#endif ++#ifdef HAVE_INET_NTOP ++ char addrbuf[INET6_ADDRSTRLEN]; + #endif + struct sockaddr_un *s_un; +- char *addr_string; ++ const char *addr_string; + socklen_t salen = sizeof(php_sockaddr_storage); + + if (zend_parse_parameters(ZEND_NUM_ARGS(), "Oz|z", &arg1, socket_ce, &addr, &port) == FAILURE) { +@@ -1106,8 +1110,8 @@ PHP_FUNCTION(socket_getsockname) + #if HAVE_IPV6 + case AF_INET6: + sin6 = (struct sockaddr_in6 *) sa; +- inet_ntop(AF_INET6, &sin6->sin6_addr, addr6, INET6_ADDRSTRLEN); +- ZEND_TRY_ASSIGN_REF_STRING(addr, addr6); ++ inet_ntop(AF_INET6, &sin6->sin6_addr, addrbuf, sizeof(addrbuf)); ++ ZEND_TRY_ASSIGN_REF_STRING(addr, addrbuf); + + if (port != NULL) { + ZEND_TRY_ASSIGN_REF_LONG(port, htons(sin6->sin6_port)); +@@ -1117,11 +1121,14 @@ PHP_FUNCTION(socket_getsockname) + #endif + case AF_INET: + sin = (struct sockaddr_in *) sa; ++#ifdef HAVE_INET_NTOP ++ addr_string = inet_ntop(AF_INET, &sin->sin_addr, addrbuf, sizeof(addrbuf)); ++#else + while (inet_ntoa_lock == 1); + inet_ntoa_lock = 1; + addr_string = inet_ntoa(sin->sin_addr); + inet_ntoa_lock = 0; +- ++#endif + ZEND_TRY_ASSIGN_REF_STRING(addr, addr_string); + + if (port != NULL) { +@@ -1154,10 +1161,12 @@ PHP_FUNCTION(socket_getpeername) + struct sockaddr_in *sin; + #if HAVE_IPV6 + struct sockaddr_in6 *sin6; +- char addr6[INET6_ADDRSTRLEN+1]; ++#endif ++#ifdef HAVE_INET_NTOP ++ char addrbuf[INET6_ADDRSTRLEN]; + #endif + struct sockaddr_un *s_un; +- char *addr_string; ++ const char *addr_string; + socklen_t salen = sizeof(php_sockaddr_storage); + + if (zend_parse_parameters(ZEND_NUM_ARGS(), "Oz|z", &arg1, socket_ce, &arg2, &arg3) == FAILURE) { +@@ -1178,9 +1187,9 @@ PHP_FUNCTION(socket_getpeername) + #if HAVE_IPV6 + case AF_INET6: + sin6 = (struct sockaddr_in6 *) sa; +- inet_ntop(AF_INET6, &sin6->sin6_addr, addr6, INET6_ADDRSTRLEN); ++ inet_ntop(AF_INET6, &sin6->sin6_addr, addrbuf, sizeof(addrbuf)); + +- ZEND_TRY_ASSIGN_REF_STRING(arg2, addr6); ++ ZEND_TRY_ASSIGN_REF_STRING(arg2, addrbuf); + + if (arg3 != NULL) { + ZEND_TRY_ASSIGN_REF_LONG(arg3, htons(sin6->sin6_port)); +@@ -1191,11 +1200,14 @@ PHP_FUNCTION(socket_getpeername) + #endif + case AF_INET: + sin = (struct sockaddr_in *) sa; ++#ifdef HAVE_INET_NTOP ++ addr_string = inet_ntop(AF_INET, &sin->sin_addr, addrbuf, sizeof(addrbuf)); ++#else + while (inet_ntoa_lock == 1); + inet_ntoa_lock = 1; + addr_string = inet_ntoa(sin->sin_addr); + inet_ntoa_lock = 0; +- ++#endif + ZEND_TRY_ASSIGN_REF_STRING(arg2, addr_string); + + if (arg3 != NULL) { +@@ -1527,12 +1539,14 @@ PHP_FUNCTION(socket_recvfrom) + struct sockaddr_in sin; + #if HAVE_IPV6 + struct sockaddr_in6 sin6; +- char addr6[INET6_ADDRSTRLEN]; ++#endif ++#ifdef HAVE_INET_NTOP ++ char addrbuf[INET6_ADDRSTRLEN]; + #endif + socklen_t slen; + int retval; + zend_long arg3, arg4; +- char *address; ++ const char *address; + zend_string *recv_buf; + + if (zend_parse_parameters(ZEND_NUM_ARGS(), "Ozllz|z", &arg1, socket_ce, &arg2, &arg3, &arg4, &arg5, &arg6) == FAILURE) { +@@ -1590,7 +1604,11 @@ PHP_FUNCTION(socket_recvfrom) + ZSTR_LEN(recv_buf) = retval; + ZSTR_VAL(recv_buf)[ZSTR_LEN(recv_buf)] = '\0'; + ++#ifdef HAVE_INET_NTOP ++ address = inet_ntop(AF_INET, &sin.sin_addr, addrbuf, sizeof(addrbuf)); ++#else + address = inet_ntoa(sin.sin_addr); ++#endif + + ZEND_TRY_ASSIGN_REF_NEW_STR(arg2, recv_buf); + ZEND_TRY_ASSIGN_REF_STRING(arg5, address ? address : "0.0.0.0"); +@@ -1617,11 +1635,11 @@ PHP_FUNCTION(socket_recvfrom) + ZSTR_LEN(recv_buf) = retval; + ZSTR_VAL(recv_buf)[ZSTR_LEN(recv_buf)] = '\0'; + +- memset(addr6, 0, INET6_ADDRSTRLEN); +- inet_ntop(AF_INET6, &sin6.sin6_addr, addr6, INET6_ADDRSTRLEN); ++ memset(addrbuf, 0, INET6_ADDRSTRLEN); ++ inet_ntop(AF_INET6, &sin6.sin6_addr, addrbuf, sizeof(addrbuf)); + + ZEND_TRY_ASSIGN_REF_NEW_STR(arg2, recv_buf); +- ZEND_TRY_ASSIGN_REF_STRING(arg5, addr6[0] ? addr6 : "::"); ++ ZEND_TRY_ASSIGN_REF_STRING(arg5, addrbuf[0] ? addrbuf : "::"); + ZEND_TRY_ASSIGN_REF_LONG(arg6, ntohs(sin6.sin6_port)); + break; + #endif +diff --git a/ext/standard/dns.c b/ext/standard/dns.c +index 41b98424edb60..6efdbbe894b46 100644 +--- a/ext/standard/dns.c ++++ b/ext/standard/dns.c +@@ -228,6 +228,9 @@ PHP_FUNCTION(gethostbynamel) + struct hostent *hp; + struct in_addr in; + int i; ++#ifdef HAVE_INET_NTOP ++ char addr4[INET_ADDRSTRLEN]; ++#endif + + ZEND_PARSE_PARAMETERS_START(1, 1) + Z_PARAM_PATH(hostname, hostname_len) +@@ -255,7 +258,11 @@ PHP_FUNCTION(gethostbynamel) + } + + in = *h_addr_entry; ++#ifdef HAVE_INET_NTOP ++ add_next_index_string(return_value, inet_ntop(AF_INET, &in, addr4, INET_ADDRSTRLEN)); ++#else + add_next_index_string(return_value, inet_ntoa(in)); ++#endif + } + } + /* }}} */ +@@ -266,7 +273,10 @@ static zend_string *php_gethostbyname(char *name) + struct hostent *hp; + struct in_addr *h_addr_0; /* Don't call this h_addr, it's a macro! */ + struct in_addr in; +- char *address; ++#ifdef HAVE_INET_NTOP ++ char addr4[INET_ADDRSTRLEN]; ++#endif ++ const char *address; + + hp = php_network_gethostbyname(name); + if (!hp) { +@@ -281,7 +291,11 @@ static zend_string *php_gethostbyname(char *name) + + memcpy(&in.s_addr, h_addr_0, sizeof(in.s_addr)); + ++#ifdef HAVE_INET_NTOP ++ address = inet_ntop(AF_INET, &in, addr4, INET_ADDRSTRLEN); ++#else + address = inet_ntoa(in); ++#endif + return zend_string_init(address, strlen(address), 0); + } + /* }}} */ +diff --git a/main/network.c b/main/network.c +index 2c504952b2dd1..7f2f714ec42df 100644 +--- a/main/network.c ++++ b/main/network.c +@@ -236,8 +236,12 @@ PHPAPI int php_network_getaddresses(const char *host, int socktype, struct socka + } while ((sai = sai->ai_next) != NULL); + + freeaddrinfo(res); ++#else ++#ifdef HAVE_INET_PTON ++ if (!inet_pton(AF_INET, host, &in)) { + #else + if (!inet_aton(host, &in)) { ++#endif + if(strlen(host) > MAXFQDNLEN) { + host_info = NULL; + errno = E2BIG; +@@ -555,7 +559,11 @@ PHPAPI int php_network_parse_network_address_with_port(const char *addr, zend_lo + goto out; + } + #endif ++#ifdef HAVE_INET_PTON ++ if (inet_pton(AF_INET, tmp, &in4->sin_addr) > 0) { ++#else + if (inet_aton(tmp, &in4->sin_addr) > 0) { ++#endif + in4->sin_port = htons(port); + in4->sin_family = AF_INET; + *sl = sizeof(struct sockaddr_in); +@@ -617,15 +625,19 @@ PHPAPI void php_network_populate_name_from_sockaddr( + } + + if (textaddr) { +-#if HAVE_IPV6 && HAVE_INET_NTOP ++#ifdef HAVE_INET_NTOP + char abuf[256]; + #endif +- char *buf = NULL; ++ const char *buf = NULL; + + switch (sa->sa_family) { + case AF_INET: + /* generally not thread safe, but it *is* thread safe under win32 */ ++#ifdef HAVE_INET_NTOP ++ buf = inet_ntop(AF_INET, &((struct sockaddr_in*)sa)->sin_addr, (char *)&abuf, sizeof(abuf)); ++#else + buf = inet_ntoa(((struct sockaddr_in*)sa)->sin_addr); ++#endif + if (buf) { + *textaddr = strpprintf(0, "%s:%d", + buf, ntohs(((struct sockaddr_in*)sa)->sin_port)); +@@ -862,7 +874,11 @@ php_socket_t php_network_connect_socket_to_host(const char *host, unsigned short + + in4->sin_family = sa->sa_family; + in4->sin_port = htons(bindport); ++#ifdef HAVE_INET_PTON ++ if (!inet_pton(AF_INET, bindto, &in4->sin_addr)) { ++#else + if (!inet_aton(bindto, &in4->sin_addr)) { ++#endif + php_error_docref(NULL, E_WARNING, "Invalid IP Address: %s", bindto); + goto skip_bind; + } +From e5b6f43ec7813392d83ea586b7902e0396a1f792 Mon Sep 17 00:00:00 2001 +From: Remi Collet +Date: Thu, 6 May 2021 14:21:29 +0200 +Subject: [PATCH] get rid of inet_addr usage + +--- + main/fastcgi.c | 4 ++++ + sapi/litespeed/lsapilib.c | 4 ++++ + 2 files changed, 8 insertions(+) + +diff --git a/main/fastcgi.c b/main/fastcgi.c +index 071f69d3a7f0..c936d42405de 100644 +--- a/main/fastcgi.c ++++ b/main/fastcgi.c +@@ -688,8 +688,12 @@ int fcgi_listen(const char *path, int backlog) + if (!*host || !strncmp(host, "*", sizeof("*")-1)) { + sa.sa_inet.sin_addr.s_addr = htonl(INADDR_ANY); + } else { ++#ifdef HAVE_INET_PTON ++ if (!inet_pton(AF_INET, host, &sa.sa_inet.sin_addr)) { ++#else + sa.sa_inet.sin_addr.s_addr = inet_addr(host); + if (sa.sa_inet.sin_addr.s_addr == INADDR_NONE) { ++#endif + struct hostent *hep; + + if(strlen(host) > MAXFQDNLEN) { +diff --git a/sapi/litespeed/lsapilib.c b/sapi/litespeed/lsapilib.c +index a72b5dc1b988..305f3326a682 100644 +--- a/sapi/litespeed/lsapilib.c ++++ b/sapi/litespeed/lsapilib.c +@@ -2672,8 +2672,12 @@ int LSAPI_ParseSockAddr( const char * pBind, struct sockaddr * pAddr ) + ((struct sockaddr_in *)pAddr)->sin_addr.s_addr = htonl( INADDR_LOOPBACK ); + else + { ++#ifdef HAVE_INET_PTON ++ if (!inet_pton(AF_INET, p, &((struct sockaddr_in *)pAddr)->sin_addr)) ++#else + ((struct sockaddr_in *)pAddr)->sin_addr.s_addr = inet_addr( p ); + if ( ((struct sockaddr_in *)pAddr)->sin_addr.s_addr == INADDR_BROADCAST) ++#endif + { + doAddrInfo = 1; + } +From 99d67d121acd4c324738509679d23acaf759d065 Mon Sep 17 00:00:00 2001 +From: Remi Collet +Date: Thu, 6 May 2021 16:35:48 +0200 +Subject: [PATCH] use getnameinfo instead of gethostbyaddr + +--- + ext/standard/dns.c | 34 ++++++++++++++++++++++------------ + 1 file changed, 22 insertions(+), 12 deletions(-) + +diff --git a/ext/standard/dns.c b/ext/standard/dns.c +index edd9a4549f5c..540c777faaba 100644 +--- a/ext/standard/dns.c ++++ b/ext/standard/dns.c +@@ -169,20 +169,30 @@ PHP_FUNCTION(gethostbyaddr) + static zend_string *php_gethostbyaddr(char *ip) + { + #if HAVE_IPV6 && HAVE_INET_PTON +- struct in6_addr addr6; +-#endif +- struct in_addr addr; +- struct hostent *hp; ++ struct sockaddr_in sa4; ++ struct sockaddr_in6 sa6; ++ char out[NI_MAXHOST]; + +-#if HAVE_IPV6 && HAVE_INET_PTON +- if (inet_pton(AF_INET6, ip, &addr6)) { +- hp = gethostbyaddr((char *) &addr6, sizeof(addr6), AF_INET6); +- } else if (inet_pton(AF_INET, ip, &addr)) { +- hp = gethostbyaddr((char *) &addr, sizeof(addr), AF_INET); +- } else { +- return NULL; ++ if (inet_pton(AF_INET6, ip, &sa6.sin6_addr)) { ++ sa6.sin6_family = AF_INET6; ++ ++ if (getnameinfo((struct sockaddr *)&sa6, sizeof(sa6), out, sizeof(out), NULL, 0, NI_NAMEREQD) < 0) { ++ return zend_string_init(ip, strlen(ip), 0); ++ } ++ return zend_string_init(out, strlen(out), 0); ++ } else if (inet_pton(AF_INET, ip, &sa4.sin_addr)) { ++ sa4.sin_family = AF_INET; ++ ++ if (getnameinfo((struct sockaddr *)&sa4, sizeof(sa4), out, sizeof(out), NULL, 0, NI_NAMEREQD) < 0) { ++ return zend_string_init(ip, strlen(ip), 0); ++ } ++ return zend_string_init(out, strlen(out), 0); + } ++ return NULL; /* not a valid IP */ + #else ++ struct in_addr addr; ++ struct hostent *hp; ++ + addr.s_addr = inet_addr(ip); + + if (addr.s_addr == -1) { +@@ -190,13 +200,13 @@ static zend_string *php_gethostbyaddr(char *ip) + } + + hp = gethostbyaddr((char *) &addr, sizeof(addr), AF_INET); +-#endif + + if (!hp || hp->h_name == NULL || hp->h_name[0] == '\0') { + return zend_string_init(ip, strlen(ip), 0); + } + + return zend_string_init(hp->h_name, strlen(hp->h_name), 0); ++#endif + } + /* }}} */ + diff --git a/php-8.0.7-argon2.patch b/php-8.0.7-argon2.patch new file mode 100644 index 0000000..88018de --- /dev/null +++ b/php-8.0.7-argon2.patch @@ -0,0 +1,15 @@ +diff --git a/ext/sodium/sodium_pwhash.c b/ext/sodium/sodium_pwhash.c +index e58a9514cc..86cc06cd91 100644 +--- a/ext/sodium/sodium_pwhash.c ++++ b/ext/sodium/sodium_pwhash.c +@@ -62,10 +62,6 @@ static inline int get_options(zend_array *options, size_t *memlimit, size_t *ops + return FAILURE; + } + } +- if ((opt = zend_hash_str_find(options, "threads", strlen("threads"))) && (zval_get_long(opt) != 1)) { +- zend_value_error("A thread value other than 1 is not supported by this implementation"); +- return FAILURE; +- } + return SUCCESS; + } + diff --git a/php-fpm-www.conf b/php-fpm-www.conf new file mode 100644 index 0000000..c001475 --- /dev/null +++ b/php-fpm-www.conf @@ -0,0 +1,438 @@ +; Start a new pool named 'www'. +; the variable $pool can be used in any directive and will be replaced by the +; pool name ('www' here) +[www] + +; Per pool prefix +; It only applies on the following directives: +; - 'access.log' +; - 'slowlog' +; - 'listen' (unixsocket) +; - 'chroot' +; - 'chdir' +; - 'php_values' +; - 'php_admin_values' +; When not set, the global prefix (or @php_fpm_prefix@) applies instead. +; Note: This directive can also be relative to the global prefix. +; Default Value: none +;prefix = /path/to/pools/$pool + +; Unix user/group of processes +; Note: The user is mandatory. If the group is not set, the default user's group +; will be used. +; RPM: apache user chosen to provide access to the same directories as httpd +user = apache +; RPM: Keep a group allowed to write in log dir. +group = apache + +; The address on which to accept FastCGI requests. +; Valid syntaxes are: +; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific IPv4 address on +; a specific port; +; '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on +; a specific port; +; 'port' - to listen on a TCP socket to all addresses +; (IPv6 and IPv4-mapped) on a specific port; +; '/path/to/unix/socket' - to listen on a unix socket. +; Note: This value is mandatory. +listen = 127.0.0.1:9000 + +; Set listen(2) backlog. +; Default Value: 511 +;listen.backlog = 511 + +; Set permissions for unix socket, if one is used. In Linux, read/write +; permissions must be set in order to allow connections from a web server. +; Default Values: user and group are set as the running user +; mode is set to 0660 +;listen.owner = nobody +;listen.group = nobody +;listen.mode = 0660 + +; When POSIX Access Control Lists are supported you can set them using +; these options, value is a comma separated list of user/group names. +; When set, listen.owner and listen.group are ignored +;listen.acl_users = apache +;listen.acl_groups = + +; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect. +; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original +; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address +; must be separated by a comma. If this value is left blank, connections will be +; accepted from any ip address. +; Default Value: any +listen.allowed_clients = 127.0.0.1 + +; Specify the nice(2) priority to apply to the pool processes (only if set) +; The value can vary from -19 (highest priority) to 20 (lower priority) +; Note: - It will only work if the FPM master process is launched as root +; - The pool processes will inherit the master process priority +; unless it specified otherwise +; Default Value: no set +; process.priority = -19 + +; Set the process dumpable flag (PR_SET_DUMPABLE prctl) even if the process user +; or group is different than the master process user. It allows to create process +; core dump and ptrace the process for the pool user. +; Default Value: no +; process.dumpable = yes + +; Choose how the process manager will control the number of child processes. +; Possible Values: +; static - a fixed number (pm.max_children) of child processes; +; dynamic - the number of child processes are set dynamically based on the +; following directives. With this process management, there will be +; always at least 1 children. +; pm.max_children - the maximum number of children that can +; be alive at the same time. +; pm.start_servers - the number of children created on startup. +; pm.min_spare_servers - the minimum number of children in 'idle' +; state (waiting to process). If the number +; of 'idle' processes is less than this +; number then some children will be created. +; pm.max_spare_servers - the maximum number of children in 'idle' +; state (waiting to process). If the number +; of 'idle' processes is greater than this +; number then some children will be killed. +; ondemand - no children are created at startup. Children will be forked when +; new requests will connect. The following parameter are used: +; pm.max_children - the maximum number of children that +; can be alive at the same time. +; pm.process_idle_timeout - The number of seconds after which +; an idle process will be killed. +; Note: This value is mandatory. +pm = dynamic + +; The number of child processes to be created when pm is set to 'static' and the +; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'. +; This value sets the limit on the number of simultaneous requests that will be +; served. Equivalent to the ApacheMaxClients directive with mpm_prefork. +; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP +; CGI. The below defaults are based on a server without much resources. Don't +; forget to tweak pm.* to fit your needs. +; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand' +; Note: This value is mandatory. +pm.max_children = 50 + +; The number of child processes created on startup. +; Note: Used only when pm is set to 'dynamic' +; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2 +pm.start_servers = 5 + +; The desired minimum number of idle server processes. +; Note: Used only when pm is set to 'dynamic' +; Note: Mandatory when pm is set to 'dynamic' +pm.min_spare_servers = 5 + +; The desired maximum number of idle server processes. +; Note: Used only when pm is set to 'dynamic' +; Note: Mandatory when pm is set to 'dynamic' +pm.max_spare_servers = 35 + +; The number of seconds after which an idle process will be killed. +; Note: Used only when pm is set to 'ondemand' +; Default Value: 10s +;pm.process_idle_timeout = 10s; + +; The number of requests each child process should execute before respawning. +; This can be useful to work around memory leaks in 3rd party libraries. For +; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS. +; Default Value: 0 +;pm.max_requests = 500 + +; The URI to view the FPM status page. If this value is not set, no URI will be +; recognized as a status page. It shows the following information: +; pool - the name of the pool; +; process manager - static, dynamic or ondemand; +; start time - the date and time FPM has started; +; start since - number of seconds since FPM has started; +; accepted conn - the number of request accepted by the pool; +; listen queue - the number of request in the queue of pending +; connections (see backlog in listen(2)); +; max listen queue - the maximum number of requests in the queue +; of pending connections since FPM has started; +; listen queue len - the size of the socket queue of pending connections; +; idle processes - the number of idle processes; +; active processes - the number of active processes; +; total processes - the number of idle + active processes; +; max active processes - the maximum number of active processes since FPM +; has started; +; max children reached - number of times, the process limit has been reached, +; when pm tries to start more children (works only for +; pm 'dynamic' and 'ondemand'); +; Value are updated in real time. +; Example output: +; pool: www +; process manager: static +; start time: 01/Jul/2011:17:53:49 +0200 +; start since: 62636 +; accepted conn: 190460 +; listen queue: 0 +; max listen queue: 1 +; listen queue len: 42 +; idle processes: 4 +; active processes: 11 +; total processes: 15 +; max active processes: 12 +; max children reached: 0 +; +; By default the status page output is formatted as text/plain. Passing either +; 'html', 'xml' or 'json' in the query string will return the corresponding +; output syntax. Example: +; http://www.foo.bar/status +; http://www.foo.bar/status?json +; http://www.foo.bar/status?html +; http://www.foo.bar/status?xml +; +; By default the status page only outputs short status. Passing 'full' in the +; query string will also return status for each pool process. +; Example: +; http://www.foo.bar/status?full +; http://www.foo.bar/status?json&full +; http://www.foo.bar/status?html&full +; http://www.foo.bar/status?xml&full +; The Full status returns for each process: +; pid - the PID of the process; +; state - the state of the process (Idle, Running, ...); +; start time - the date and time the process has started; +; start since - the number of seconds since the process has started; +; requests - the number of requests the process has served; +; request duration - the duration in µs of the requests; +; request method - the request method (GET, POST, ...); +; request URI - the request URI with the query string; +; content length - the content length of the request (only with POST); +; user - the user (PHP_AUTH_USER) (or '-' if not set); +; script - the main script called (or '-' if not set); +; last request cpu - the %cpu the last request consumed +; it's always 0 if the process is not in Idle state +; because CPU calculation is done when the request +; processing has terminated; +; last request memory - the max amount of memory the last request consumed +; it's always 0 if the process is not in Idle state +; because memory calculation is done when the request +; processing has terminated; +; If the process is in Idle state, then informations are related to the +; last request the process has served. Otherwise informations are related to +; the current request being served. +; Example output: +; ************************ +; pid: 31330 +; state: Running +; start time: 01/Jul/2011:17:53:49 +0200 +; start since: 63087 +; requests: 12808 +; request duration: 1250261 +; request method: GET +; request URI: /test_mem.php?N=10000 +; content length: 0 +; user: - +; script: /home/fat/web/docs/php/test_mem.php +; last request cpu: 0.00 +; last request memory: 0 +; +; Note: There is a real-time FPM status monitoring sample web page available +; It's available in: @EXPANDED_DATADIR@/fpm/status.html +; +; Note: The value must start with a leading slash (/). The value can be +; anything, but it may not be a good idea to use the .php extension or it +; may conflict with a real PHP file. +; Default Value: not set +;pm.status_path = /status + +; The ping URI to call the monitoring page of FPM. If this value is not set, no +; URI will be recognized as a ping page. This could be used to test from outside +; that FPM is alive and responding, or to +; - create a graph of FPM availability (rrd or such); +; - remove a server from a group if it is not responding (load balancing); +; - trigger alerts for the operating team (24/7). +; Note: The value must start with a leading slash (/). The value can be +; anything, but it may not be a good idea to use the .php extension or it +; may conflict with a real PHP file. +; Default Value: not set +;ping.path = /ping + +; This directive may be used to customize the response of a ping request. The +; response is formatted as text/plain with a 200 response code. +; Default Value: pong +;ping.response = pong + +; The access log file +; Default: not set +;access.log = log/$pool.access.log + +; The access log format. +; The following syntax is allowed +; %%: the '%' character +; %C: %CPU used by the request +; it can accept the following format: +; - %{user}C for user CPU only +; - %{system}C for system CPU only +; - %{total}C for user + system CPU (default) +; %d: time taken to serve the request +; it can accept the following format: +; - %{seconds}d (default) +; - %{milliseconds}d +; - %{mili}d +; - %{microseconds}d +; - %{micro}d +; %e: an environment variable (same as $_ENV or $_SERVER) +; it must be associated with embraces to specify the name of the env +; variable. Some examples: +; - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e +; - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e +; %f: script filename +; %l: content-length of the request (for POST request only) +; %m: request method +; %M: peak of memory allocated by PHP +; it can accept the following format: +; - %{bytes}M (default) +; - %{kilobytes}M +; - %{kilo}M +; - %{megabytes}M +; - %{mega}M +; %n: pool name +; %o: output header +; it must be associated with embraces to specify the name of the header: +; - %{Content-Type}o +; - %{X-Powered-By}o +; - %{Transfert-Encoding}o +; - .... +; %p: PID of the child that serviced the request +; %P: PID of the parent of the child that serviced the request +; %q: the query string +; %Q: the '?' character if query string exists +; %r: the request URI (without the query string, see %q and %Q) +; %R: remote IP address +; %s: status (response code) +; %t: server time the request was received +; it can accept a strftime(3) format: +; %d/%b/%Y:%H:%M:%S %z (default) +; The strftime(3) format must be encapsuled in a %{}t tag +; e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t +; %T: time the log has been written (the request has finished) +; it can accept a strftime(3) format: +; %d/%b/%Y:%H:%M:%S %z (default) +; The strftime(3) format must be encapsuled in a %{}t tag +; e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t +; %u: remote user +; +; Default: "%R - %u %t \"%m %r\" %s" +;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%" + +; The log file for slow requests +; Default Value: not set +; Note: slowlog is mandatory if request_slowlog_timeout is set +slowlog = /var/log/php-fpm/www-slow.log + +; The timeout for serving a single request after which a PHP backtrace will be +; dumped to the 'slowlog' file. A value of '0s' means 'off'. +; Available units: s(econds)(default), m(inutes), h(ours), or d(ays) +; Default Value: 0 +;request_slowlog_timeout = 0 + +; Depth of slow log stack trace. +; Default Value: 20 +;request_slowlog_trace_depth = 20 + +; The timeout for serving a single request after which the worker process will +; be killed. This option should be used when the 'max_execution_time' ini option +; does not stop script execution for some reason. A value of '0' means 'off'. +; Available units: s(econds)(default), m(inutes), h(ours), or d(ays) +; Default Value: 0 +;request_terminate_timeout = 0 + +; Set open file descriptor rlimit. +; Default Value: system defined value +;rlimit_files = 1024 + +; Set max core size rlimit. +; Possible Values: 'unlimited' or an integer greater or equal to 0 +; Default Value: system defined value +;rlimit_core = 0 + +; Chroot to this directory at the start. This value must be defined as an +; absolute path. When this value is not set, chroot is not used. +; Note: you can prefix with '$prefix' to chroot to the pool prefix or one +; of its subdirectories. If the pool prefix is not set, the global prefix +; will be used instead. +; Note: chrooting is a great security feature and should be used whenever +; possible. However, all PHP paths will be relative to the chroot +; (error_log, sessions.save_path, ...). +; Default Value: not set +;chroot = + +; Chdir to this directory at the start. +; Note: relative path can be used. +; Default Value: current directory or / when chroot +;chdir = /var/www + +; Redirect worker stdout and stderr into main error log. If not set, stdout and +; stderr will be redirected to /dev/null according to FastCGI specs. +; Note: on highloaded environment, this can cause some delay in the page +; process time (several ms). +; Default Value: no +;catch_workers_output = yes + +; Clear environment in FPM workers +; Prevents arbitrary environment variables from reaching FPM worker processes +; by clearing the environment in workers before env vars specified in this +; pool configuration are added. +; Setting to "no" will make all environment variables available to PHP code +; via getenv(), $_ENV and $_SERVER. +; Default Value: yes +;clear_env = no + +; Limits the extensions of the main script FPM will allow to parse. This can +; prevent configuration mistakes on the web server side. You should only limit +; FPM to .php extensions to prevent malicious users to use other extensions to +; execute php code. +; Note: set an empty value to allow all extensions. +; Default Value: .php +;security.limit_extensions = .php .php3 .php4 .php5 .php7 + +; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from +; the current environment. +; Default Value: clean env +;env[HOSTNAME] = $HOSTNAME +;env[PATH] = /usr/local/bin:/usr/bin:/bin +;env[TMP] = /tmp +;env[TMPDIR] = /tmp +;env[TEMP] = /tmp + +; Additional php.ini defines, specific to this pool of workers. These settings +; overwrite the values previously defined in the php.ini. The directives are the +; same as the PHP SAPI: +; php_value/php_flag - you can set classic ini defines which can +; be overwritten from PHP call 'ini_set'. +; php_admin_value/php_admin_flag - these directives won't be overwritten by +; PHP call 'ini_set' +; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no. + +; Defining 'extension' will load the corresponding shared extension from +; extension_dir. Defining 'disable_functions' or 'disable_classes' will not +; overwrite previously defined php.ini values, but will append the new value +; instead. + +; Note: path INI options can be relative and will be expanded with the prefix +; (pool, global or @prefix@) + +; Default Value: nothing is defined by default except the values in php.ini and +; specified at startup with the -d argument +;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com +;php_flag[display_errors] = off +php_admin_value[error_log] = /var/log/php-fpm/www-error.log +php_admin_flag[log_errors] = on +;php_admin_value[memory_limit] = 128M + +; Set the following data paths to directories owned by the FPM process user. +; +; Do not change the ownership of existing system directories, if the process +; user does not have write permission, create dedicated directories for this +; purpose. +; +; See warning about choosing the location of these directories on your system +; at http://php.net/session.save-path +php_value[session.save_handler] = files +php_value[session.save_path] = /var/lib/php/session +php_value[soap.wsdl_cache_dir] = /var/lib/php/wsdlcache +;php_value[opcache.file_cache] = /var/lib/php/opcache diff --git a/php-fpm.conf b/php-fpm.conf new file mode 100644 index 0000000..53a07b6 --- /dev/null +++ b/php-fpm.conf @@ -0,0 +1,137 @@ +;;;;;;;;;;;;;;;;;;;;; +; FPM Configuration ; +;;;;;;;;;;;;;;;;;;;;; + +; All relative paths in this configuration file are relative to PHP's install +; prefix. + +; Include one or more files. If glob(3) exists, it is used to include a bunch of +; files from a glob(3) pattern. This directive can be used everywhere in the +; file. +include=/etc/php-fpm.d/*.conf + +;;;;;;;;;;;;;;;;;; +; Global Options ; +;;;;;;;;;;;;;;;;;; + +[global] +; Pid file +; Default Value: none +pid = /run/php-fpm/php-fpm.pid + +; Error log file +; If it's set to "syslog", log is sent to syslogd instead of being written +; in a local file. +; Default Value: /var/log/php-fpm.log +error_log = /var/log/php-fpm/error.log + +; syslog_facility is used to specify what type of program is logging the +; message. This lets syslogd specify that messages from different facilities +; will be handled differently. +; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON) +; Default Value: daemon +;syslog.facility = daemon + +; syslog_ident is prepended to every message. If you have multiple FPM +; instances running on the same server, you can change the default value +; which must suit common needs. +; Default Value: php-fpm +;syslog.ident = php-fpm + +; Log level +; Possible Values: alert, error, warning, notice, debug +; Default Value: notice +;log_level = notice + +; Log limit on number of characters in the single line (log entry). If the +; line is over the limit, it is wrapped on multiple lines. The limit is for +; all logged characters including message prefix and suffix if present. However +; the new line character does not count into it as it is present only when +; logging to a file descriptor. It means the new line character is not present +; when logging to syslog. +; Default Value: 1024 +;log_limit = 4096 + +; Log buffering specifies if the log line is buffered which means that the +; line is written in a single write operation. If the value is false, then the +; data is written directly into the file descriptor. It is an experimental +; option that can potentionaly improve logging performance and memory usage +; for some heavy logging scenarios. This option is ignored if logging to syslog +; as it has to be always buffered. +; Default value: yes +;log_buffering = no + +; If this number of child processes exit with SIGSEGV or SIGBUS within the time +; interval set by emergency_restart_interval then FPM will restart. A value +; of '0' means 'Off'. +; Default Value: 0 +;emergency_restart_threshold = 0 + +; Interval of time used by emergency_restart_interval to determine when +; a graceful restart will be initiated. This can be useful to work around +; accidental corruptions in an accelerator's shared memory. +; Available Units: s(econds), m(inutes), h(ours), or d(ays) +; Default Unit: seconds +; Default Value: 0 +;emergency_restart_interval = 0 + +; Time limit for child processes to wait for a reaction on signals from master. +; Available units: s(econds), m(inutes), h(ours), or d(ays) +; Default Unit: seconds +; Default Value: 0 +;process_control_timeout = 0 + +; The maximum number of processes FPM will fork. This has been designed to control +; the global number of processes when using dynamic PM within a lot of pools. +; Use it with caution. +; Note: A value of 0 indicates no limit +; Default Value: 0 +;process.max = 128 + +; Specify the nice(2) priority to apply to the master process (only if set) +; The value can vary from -19 (highest priority) to 20 (lowest priority) +; Note: - It will only work if the FPM master process is launched as root +; - The pool process will inherit the master process priority +; unless specified otherwise +; Default Value: no set +;process.priority = -19 + +; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging. +; Default Value: yes +daemonize = yes + +; Set open file descriptor rlimit for the master process. +; Default Value: system defined value +;rlimit_files = 1024 + +; Set max core size rlimit for the master process. +; Possible Values: 'unlimited' or an integer greater or equal to 0 +; Default Value: system defined value +;rlimit_core = 0 + +; Specify the event mechanism FPM will use. The following is available: +; - select (any POSIX os) +; - poll (any POSIX os) +; - epoll (linux >= 2.5.44) +; Default Value: not set (auto detection) +;events.mechanism = epoll + +; When FPM is built with systemd integration, specify the interval, +; in seconds, between health report notification to systemd. +; Set to 0 to disable. +; Available Units: s(econds), m(inutes), h(ours) +; Default Unit: seconds +; Default value: 10 +;systemd_interval = 10 + +;;;;;;;;;;;;;;;;;;;; +; Pool Definitions ; +;;;;;;;;;;;;;;;;;;;; + +; Multiple pools of child processes may be started with different listening +; ports and different management options. The name of the pool will be +; used in logs and stats. There is no limitation on the number of pools which +; FPM can handle. Your system will tell you anyway :) + +; See /etc/php-fpm.d/*.conf + diff --git a/php-fpm.logrotate b/php-fpm.logrotate new file mode 100644 index 0000000..25f9feb --- /dev/null +++ b/php-fpm.logrotate @@ -0,0 +1,9 @@ +/var/log/php-fpm/*log { + missingok + notifempty + sharedscripts + delaycompress + postrotate + /bin/kill -SIGUSR1 `cat /run/php-fpm/php-fpm.pid 2>/dev/null` 2>/dev/null || true + endscript +} diff --git a/php-fpm.service b/php-fpm.service new file mode 100644 index 0000000..687dfc0 --- /dev/null +++ b/php-fpm.service @@ -0,0 +1,18 @@ +# It's not recommended to modify this file in-place, because it +# will be overwritten during upgrades. If you want to customize, +# the best way is to use the "systemctl edit" command. + +[Unit] +Description=The PHP FastCGI Process Manager +After=syslog.target network.target + +[Service] +Type=notify +EnvironmentFile=/etc/sysconfig/php-fpm +ExecStart=/usr/sbin/php-fpm --nodaemonize +ExecReload=/bin/kill -USR2 $MAINPID +PrivateTmp=true + +[Install] +WantedBy=multi-user.target + diff --git a/php-fpm.sysconfig b/php-fpm.sysconfig new file mode 100644 index 0000000..4099ed6 --- /dev/null +++ b/php-fpm.sysconfig @@ -0,0 +1,14 @@ +# Additional environment file for php-fpm + +# This file is deprecated when systemd is used and +# will be removed in the future + +# With systemd >= 204 you can simply drop a file with the +# suffix .conf in /etc/systemd/system/php-fpm.service.d, with +# [Service] +# Environment=FOO=bar + +# See systemd documentation. +# man systemd.unit +# man systemd.exec + diff --git a/php-fpm.wants b/php-fpm.wants new file mode 100644 index 0000000..5c7c8e4 --- /dev/null +++ b/php-fpm.wants @@ -0,0 +1,3 @@ +[Unit] +Wants=php-fpm.service + diff --git a/php-keyring.gpg b/php-keyring.gpg new file mode 100644 index 0000000..870d816 --- /dev/null +++ b/php-keyring.gpg @@ -0,0 +1,415 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBFjxRtoBEADkS6+Q7afwYDPFnqJXuyF2ZIvXysDBrpr/xbre4jVeiC/HIELa +QedOJqO1V+BgnTRkfhor+Yq3mZ1un+6zJIiFcm5Kp7sPZjh15JF96PsA4e2Eh5eC +eJzjXHj1nAKXfn5+CgpYEyL30r1/ACkmo9TKIiUxIDZRkZvxjY4UKeo+EoJo0Viu +tV8mvSTgxaz9gzPhZ5OJR8zECT8j3T8d+tBD8wWxxmGZ0veOu/MBew1C/BDr8RqT +CXDywUbyNuSsdb3a5aLuIuLekSJVSCcFwPIje1WrX4FyC42+elOp0SXpjWzdb08N +XX4DEY8zVyVXI1ScSpTbslffcFkY60NJhjpP7t856L9vTLRfHIM9BIdSYH/ar5mE +Q0vyJbiNfkx5tIMnEmnIYbmnjjmcPZDKZ4PyQEUEWF3DqNOOAWhk9HUMFEkANkd1 +vEcNNQxgD2eOJM6egfUv9KtuAEcRX2iDu3gIyE+55x92VVoEJDu5M+Q6PYGUIMh7 +nz2gS3lnlpG2vquQpqDS9UogsZ8L4NsukdP2ixRFnD9qaTOemqRYwIptOX6wvrtR +7PmWOnnRZ5OcpK5/qyK9iCLY7bbHDViBoV0uLEHNPTDHjrALJrqS+dH1glYid/82 +OvKE3KREjRpMOW83nNfQcqkMi9fhH8WUkz6OD6JemvB/s/CwBS2w3+9LAQARAQAB +tB5TYXJhIEdvbGVtb24gPHBvbGxpdGFAcGhwLm5ldD6JAj4EEwECACgCGwMGCwkI +BwMCBhUIAgkKCwQWAgMBAh4BAheABQJY/TOeBQkNNFUtAAoJENvbOXRw0SFy1xYP +/jQeNv4WUPK3M0Hl3EvEnOeODxePysU0khvgnw/mRtQu7BOwRdbB0HWv8Kx0HXL7 +XI4l2myHRZbd9PrBlG4YFYjZqWmqQ9WGlLBxDpSJNeROpTgKjhxA2hOl1xH2Et5k +bRcZzpJJ9zuD3rqkq80S3u/UAB/QzYfJWKnQBTXi/3psZNAVTRp3/4sEn1kCfEnl +NUYPih/NqdXE0frlKeITOAmatD2cjYcJlc/ETLil8Sq1nIgiE/++KZalbcXcRSHV +ZSd/L+fNlMDIh6k9pjcE562oiyyMHKed/pAX7o1BqlKqSwxjQoNskpICVFkyMv+P +7cIPyOxJa8kaGyyHND+8i1GzvwcPhLYeOWDwmiXBs4Ea8Z7KWxhi19zlxMrEfAcf +FIomcRoxfzcnSY3FVJYIoEySK/IBiivqeunyeDA2JG1vLSZIV5hNicUihp4hnhX4 +Z1gElN+C68P49SZseFzxvzwMq5RIUbWVwIh2+Wj51/UrULgoM4qNkgejDLYFyTxb +LfXq+Tk91UXdpepBHvE9KFVqh4MbIlyx9TAzOizqLdZlnPRwLb3rWBLsv7XbCTeY +tp4jVU8Q35hnvGFy+GsSROJv04mJW+whyz+zxOEMPiVbVA5um3ZbSj5oou87M9Li +JtrUOqNfyyqddLC8L5LgwwlYKqP+W6Q4LMf/Whoj3FFCuQINBFjxRtoBEACk8wfJ +qP03Hz6PX8br3jEUllSngdD/28K2C4RVOOr71u4FJRcEMR98SbPnCNIUt4KdedO1 +DJpYac1XvIaVBbLxEcBjRMWNhBgZbxoQzPjFTWHQ/UwHZPiiwQkL55fN1ejBEacD +V8B1JwqjcBbii6zItLUV/gxGH7Jce/f7KBM7vWlaP+xHpmd+iPK1swK5wNQzDL83 +b7NPyj58fqlmh54Fr+jcpuUjynaYfjtJsgwc4CScdai7FclctLMg8Y8DW7/bkqf1 +BQy9Dik82IWSN4wgVM1eWSGx+PzPlshGH/C8B53U353NcRhjFp3zX31wQhsJrA7J +p+10S3HbXGrr3aVGMMq3dqSBGp38iKJUmJ3zyVvby5Mk4+8FFmMk3gVuQE52pW4E +OlSVQNQC8yzYsgaG/4N0M8DRpbfPhT5wiD/Qcb7MUXTE96dzs/KcyPJju/aq4cJ6 +DgpbJmM6OZwnx5HYwa58RgOwAVBbsxYOa6oS+Fj02eaiUETwfPHtqF9juCcM5D0m +cLZRT1I4zK60qPb6ZDzuFguXg8hm/djjh2YlDFCNKqCZHktCISTWX5u1cyF5j+UL +3fsKcAAcyiHZV9UH8tr6v0i0P19Uje2ZHk9utJggYSSM0uyqGhmiyd8su2FqitBl +tvTo00Kc8sv4AcDmCng8SVO0og1wiJZdiHJI7QARAQABiQIfBBgBAgAJBQJY8Uba +AhsMAAoJENvbOXRw0SFydu4QALeYG2PPMEOQtMV6jOVT51U0Yo0yl94RJoQCOCCT +/JkUyIDczHmtcVABrpitX3tFl4vacJM3uKWKbzbM7qO2+Hd0u6rxO+o8WUGRMZp5 +IgcbagDOHs0vorVN2Yo0Tl8RoqW91MCvlRFA+8snmKjWfTYj8jxbhIUEtVrIU+5L +DEgDP+T6PvpaVeXfLYItieCsZgib3qPz5mM49jDH84XG5F19kx0QtVGJs7n8FrcA +GcQl/iMrm7dRrRuh9394ongIum0uld287Zlg9q12iJiir3w04Npy43G12RXq9TD9 +aRfbMhQ+HB5Dnvf42mfCfGvalSE0rg9mh1KeaiQUXxCzCf1D6a3H50rh1IDn363W +n41/Hr0j4ntVjvEJxs9nUb8qod2HMOPLOFqwxck7ueGaeDN/GZ5zjPdIppYwE3Lb +CM1ZFLkV+QhFef4zXwml1/AnGGFULgGYorwGCchizhU1wbZVcoUF74MtprnAsuPd +Fxlw+4yCcFEeYVpMDQg/ZfZ28T1GruGHqLJqIVpOum48Ec+fjnHAZAH9dOs/qhBu +CLE+5xUoVyP2lwt0MaHs5SLmxRKhcV6IWRJKTlZ9YdDXbVv5LisL/qDOTjRj7vOg +CPRhklyA0JjFeyTDpSeAWXFZnab0nYBPWkxtdxxRruEeQPAYP1vl0O6ABMxRAI6o +6zIImQINBFklYukBEAC9tCSjnoNs3ucOA9RPfKcuK87JD9jdet2UUsw4DHd/Hwmr +t3T7WKoH1GwRp+ue5+vzXqdFRZ4gG+7tgvUsOtNb5rh22bTBsUIeGsvm/omJntXC +FQhYcfjtk04p3qtgJ5PGjZahCRYg4aQ2tGp2Mb8auFuFPsHtOHLWQCL7vQShsN9m +EkEzAQZnn9QYL+IvTQVSKsRy8XcHYZVk2uT2xQY2LvkAucWF0TrjU2LJ2IFdepc0 ++jz1xasBR0afT9YccHpQH5w8yOW+9o/n7BiMHfgT0sBMdKCfKVoQrQe0CsFnqc/+ +V4NsnHkyUrbfKiIFm+NOupIMpL6/A+Iky5YpjIIUHPuVL6VAY6wm463WI8FPk+Nt +Gekm9jqISxirkYWsIEoZtCrycC8N0iUbGq8eLYdC9ewU5dagCdLGwnDvYjOvzH15 +6LTiE/Svrq2q0kBDAa7CTGRlT+2sgD89ol73QtAVUJst99lVHMmIL1cV4HUpvOlT +JHRdsN6VhlPrw6ue+2vmYsF86bYni6vMH6KJnmiWa1wijYO0wiSphtTXAa0HE/HT +V+hSb9bCRbyipwdqkEeaj8sKcx9+XyNxVOlUfo8pQZnLRTd61Fvj+sSTSEbo95a5 +gi0WDnyNtiafKEvLxal7VyatbAcCEcLDYAVHffNLg4fm4H35HN0YQpUt+SuVwQAR +AQABtBpSZW1pIENvbGxldCA8cmVtaUBwaHAubmV0PokCPgQTAQIAKAUCWSVi6QIb +AwUJDShogAYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQ3J/40+5a8n9OJQ/9 +HtuZ4BMPMDFGVPUZ9DP0d74DF/QcT0V101TrdIZ92R4up56Dv40djjQZc2W9BmpP +VFr/v6qdjapdPH5vvmatnQDz/nIOfo1iwPWGzvmKnbDBQ4qJX7Jd6PdD/YorcD+0 +tOQNKLIGE9ZFQnS80iz9iaTGzvQKEQKEMugQSf3kG3NBEGqKQBsTTrBQOUJ3g8w6 +id2/qJtrDRbL9TuCU77Dpx9HUAnjj/Ixlvd4RQDa/BCYzGYJlCyTsaVW3qc7DIh/ +pRadqtswghSETtl6SSo9yHtoYOGTxXO6UikLEE8miOlaOPQrC9hCD+LSGc5QhNLB +EKes0l79w9kw9qZ9Xfh4pw/hf1N4O3kPHyUg0q9QaX1XKtigjTUcpdf2Kq8LtlB6 +0p40eZE2dV3T11X+rcn33pFSXMeTJeaNKHXoeGcva/gyZVtvi8iJhqtw9QOUkxRD +vGB+FEUId3Z1yAu7ZAz6qiUCgxK/VJ6/kBb+YYR8K4FHLmNOd5KoiTerKQu423uu +MYlYfBHpVZ9YuEJQnTEpizFEeOgaixx5RDLnoPsd/x59VS9eaaKotTPbW/rEp7Sv +bKj0dR5WMfGyd/OJrcWVZy8/Kh5Mc/4KOHD+JGAp0bE113TkEEoTZ8gNHFdLdv52 +V9eXUkeT5IxyThZBkUy6palDM8A5vaf6Eet8xOLy9XG5Ag0EWSVi6QEQAKujAODv +sdbt5n1dO29Nj5htbmt6M2A7eOjt7yUj4UMtBaGOA08O0DVA8MJkvepMq9AJBXHZ +Mi9Dycw3rxBHQDqHJJMwghu3RoQw1y5Wym7LiLhoWSU/wK0BrKOULBwh+kS6udKA +4oWrV/gr0JGmfdL8dZjBF10kHCfCcjcjWtmIp2GRaoOKTlHCviNmRxzyqba7zE0Z +c2maQ/4w98BI83GqD1bT8gF/5qwSI1hecBwt9oS7EbZ1ZiE8SSE8Gr6OR3p5UNHb +zqxUWy8W4r3qulCLc6g1LPXP1V59cMxX9jQJ7lSdv0k8C6Lb6t9Wm8G63hNYgRCA +mNW5EnqieTrx45K9vqoqfQK6Apfy0UoOquiuK7QClT3wBd7kmyKsCfV0bwRA/fV/ +sC1Rniu8PV7CRk9ryudUXycKq33pSkrOfZjFIQhCqdJkVc2MPbAuj2pOMutKwGKR +q/Mt3O8nEfGqWaJPa36C6dhlPqjEGTIEk5P493DzM7fj5VVIWyUrI8Vm9FslSvzI +LcONHMtKtRs2cRYA085NKDXGN7i5Am7L7ZONfqVs3V493ICwmALzeSULNLiMtX+E +SQfdWCS3Hosnjbc6INDg9BRhFt5MEWJ/qchM3g4NQuukqtOYsiEUw8bCzepwJxXp +lvNYu0yQDxvP+0RzjMozruVz3VoHeyf6rSWvABEBAAGJAiUEGAECAA8FAlklYukC +GwwFCQ0oaIAACgkQ3J/40+5a8n/8gg//a75gXQ4csiDUTsUndb94EXqraffmMcT5 +oCzfcP+Mecbuv3G8oQZeLRchsW2i4QecnvPwrXAJcF8kJuN/KZLyeh21PWBy55wo +/2nbwOvQockXpK5yVeuc3DmdTaxDnW9u3QpSwbvkEyoCpeHH6rZ1wjqn8Qi1k7nj +C4qgXpRrLQdRsS5ULXpf3IM+vaxbQ5avVnNRu5zMA6M/0reL0RSjgMfnk+3AwLCt +uMiy1aStCe8V7Y60/oauk+IZA1VJlSz2n3675YD7TkTZKkYIYZHTBw3ZPVJo08jd +RUXtGJjpOyyWVjP7GMKvZuQVWqcFyc8QHHaIPDLkdi7B9YFPWqfwJPBfUXcdzjAX +I7N4XsSEeMm8S8SC4FKCidioP/A+bamKcONHUuZ+AztvLh24ZTkqzA/sRRYpbMGU +QzpcDbastuXG66s3e9pJa0R14011A4bofy6Ureh9q6TQNOkNegUUdjbGSd1bfNId +QXRH0+LBV1oaY//v+aBjswy4hJ5oXmQj5jQKFitRCP9jzueyDdMJZ0j0Hhh4ItCz +FV5zIKtWiy7pRp1DXq9LjoyWeeLfKu+HrEGjMwyTGJiMjcL7oCHeiV/a+fY92wpU +rY1/mRVLqKqDIA6/iEL2DVf21U7rXY26xxvf4QFImZaYLwKQYLe8TOOjDA/I9bR1 +JJmh54yw10CZAg0EYIdBNgEQALohT1pcSlW4sk0DNfAvur1W3U+TEkevuQnKdSD/ +chKs50nLYRuiVrsZsR28tnr2j41uwvm+Y6ZPYAPSkQZ8yAT0pYnXbaIR83iGtZOH +P6wdxV39Mpf0T3yD4dOmgka1hynqNjEbRhE/t2fXNKf0JrBUmkyyhLYbQlkH+raU +gQug9EsyOJxEMER9qZM+Le/JiK5/i+8JxhjPcAQxiKu3l/usGtU6zcVUGjMSqs3Z +89Fa8WBOeGxDwwSKrn8MyyfEWrbCCF4Ao8gBeFmIkWgoeyumIAA0SYZkFjaltbTm +sFjVmYmmLXIKtKTnzZx0+jYJr42s0Q8n2ymgSKcC0Cmn+iuKslhuMpWJaqaHuZhj +K/80BArAYETW6ne1IZWPSsobd/2x4u9iwCkd/SWERA3/KnML6lgOVJfNbFxDxuJ+ +LFvpe6VoSAHlc4fC6+lMroeg011kzjgWX4H94Bdp5svpWHQ/UQ3/YMGvgUY1vy+V +d28bGzuslsnz5o2Zh40h2Dmpti5s2w7Z9TvLD2RMM1N6PrdCXVrQx3bB9nN7x1nL +osn+0v/8gfck93SO9PXLQtUgqhhWsh+/TrOiVWmWqLvbN95zWSnDRVHp1P8vKEGX +I26aokxEd1mVfilQKnHv2k6ieMc1M26GM48uXNqLSihYG2WgNl80agVFU00m/+Ea +9Uz7ABEBAAG0G0JlbiBSYW1zZXkgPHJhbXNleUBwaHAubmV0PokCVAQTAQgAPhYh +BDm2QTQ9jBBLKxRtw/nDncC5aYVEBQJgh0E2AhsDBQkGvxrvBQsJCAcCBhUKCQgL +AgQWAgMBAh4BAheAAAoJEPnDncC5aYVEzJYQAI72cCn9qEq/tRB9n9t02CPgFtLJ +VFBIJIfWeCRLQsv2vmqWGa9ehqsPT3jd0yTqNsV2hRTkzvNnrbIQUtHbRAm2pNz4 +74ClcIHuqbdk7gwfyEHw2vWpEtiVTHbJA1aqQypBrCjdfJt0s65wg4HSpodSelJO +A0shWBhBhSgU4kUvxJKPTcF1UM5iAjmm8OVIQLUeZDLFMJV6FAHmOG0JmvGMhPp1 +Hd3YdNgyyhlF1Jrqx/MK+eRBXbXSAMRSmBuUcV5p16bkt1CQ/vU5Nwi3B2HFpsva +5j6/9NZr4V5q8i2De4CyIpXj31fsKjfgs3k2ShIDUh6rvxyhkCHq1jqc5vYSltnF +9bIEht/Mn383LUoL+vBejY/UIRKShTt6eK6lcnAxa/ujb4nNvoP+UGHCsTRcNK+t +oujDxSYF1nI0zHGKCmNRmEyjW6Kp4eNspoNkm8dAwGaEvgvVNM5Jo5zAI/i4jBO1 +4lG7qTVhH1rVUFOUDKM+HMD6AdiOSp2dXXmY5Xa4OMJ8qWbPEUQP/qzFdceQL/Yj +mzTQOaorhAdB/2ULPiB0XhSJpuz3HSe0Juz8sBVCpabAQHk8++ydOfWRb7hR1oxS +6qJi2TIlT5vOR6X8v4kccxmvoQQbnSdVUTHSgbp/ifVFITek8Rbe9aNRnu4i+NOk +KgA3swgzlkJcKfDGuQINBGCHQTYBEADY0/Oat2b8EDcNSKPJNdyrQlDQ+N2fyTbq +1XPThTe5f3nRT1jepYqfsi/i4/6rza2AMvyxPO7AQSsHYlBYHxccqCH2Q90jCTu7 +iUJyU65Kx3aZC3U7VE4+jl81W5/b5qqjvZNRxLgDZDnvO7hBFh7b+jj7x1ABsHdw +q+zXjmg2mJCBsD4ba5jQaPr+nirvhr/Y744mGpaVWRlg7d/LhL73GRy546DgCVej +gd56vMsi2HBy2BKtjxIr2nd2yJn12+A5yenuagOVpye8F5Dy7ULFJ6iYe1/NpoVn +yipv3m0hE4C0x1vIw8tiXR85cb0aGuYgjOgEyLCE9INmMQ0ZZd1JqZwK2IyWiy0n +DNVJXqkzc3YjYZcrYiBb8dV7kvAf0E+UniIYTYtBU2rOWBM3aTT47Jh6ftss/tQ4 +e0HLeHZpvpWwJtkPHb1jGD/08icZH4XyVxIlEMhziuAZdBDTr7v7xSmqPrw49afW +iXfROV01j94tFdvF48wDOIb3qIBBbsNddqMvHPTShq2wMHlnylVFM/0CJn/yxezB +cuQfRVWeHg7lbzSt0HD29fBz7MlxoOSesmJCN+swoSy4nZ1nhWNHEaRh32Vn2H2q +4ya0rZFEHk2fS6WWBMTh7cjinmklQVxAhB99d+EYCZ4SHu74Ats4LvAsdJwe5I9b +lOIrYecwNwARAQABiQI8BBgBCAAmFiEEObZBND2MEEsrFG3D+cOdwLlphUQFAmCH +QTYCGwwFCQa/Gu8ACgkQ+cOdwLlphUQt+Q/+PWBVFPl05+TbJBF+1yyFXeH3VFjd +zwwKX+z5FgFcuO/ux4Tyef9nVUboiI9zCwEliczljyho+++Utzb2yG7sPwwsls9L +eOA3eb4y9pTsjqEfu7jGIbtIIUGqPtet7x4m5Og38qyXnAFUaJz6JJiFqbhekeNk +SPK/mIfySxkeHBCiyIuvWiAQYFzBYN6DsOKEjjW0HzayKoofKE6fTomaKvUNLs5e +gyvpuJQA+jtF/UFMWHXwE1UF+CsYCmBRR8uVffYzKt1PAJV3HKhRgcrvUudxoMNs +Ifl8VFlQeC6S0L3ZK/yyYW2hFyjpLEYwrIbSDRXzZyekhC12d5MRVpo+xqMhoZGY +iSkFHDfvedjh7htEvjLEDPtolbzZTbdrCFTNnKbTkVAV7z6Sx2AaBX6tCPXycqRe +I1nB1HqGFLOW9zT4a7FaDAy0o8glTx8ERPjbIBy9R1hIIB5ewyAAP1feG5Xfuj6q +Vm7IlELvft1kGvB0gm9k3X+hnbwIVzzgvGuMvl5+NumrD8VcoJ7UvjsFDRsvpHIJ +7zL2rEp4XZ8QwvqOSuYfbxWSTJoW5psyyHurBC4ZF67YFDLB0PiK/CyB4VxYHe79 +GU5ykN+r8SR1eavNndhUFo94I3QQ+999x0DvOhS54Uj4kKidZuZ70yDeh7761wO8 +wqWvQdQZUVULCQWZAg0EYGWinQEQAMQJ6RQqrrZgYJ6SIfzJPsC3zFd00C/UxLQo +aaiAQHEPnEQgjnAPqkvspSE7MpmyAohbUzXVnDO+ycxznIkLz0yYjs/m1qVB6hTM +w/PlD10ELoA6m3om/2E1vQQI78U3w3evBgVlGLzBIXWKLX7ZsBSm4xoPmD9mmisM +sM0xhqQzVuGm0I81gvKkIlWHPB+TqUWBpvDwmIdCRuGis7810OBKaMmTQ/rdhg1T +YZInZPfjeuW+oZ8Lqs4w3cfmyuDbbKQN8b1Qd2d9lJwkudI6KhIyH7uU0F1GeHIg +i9hZJZZcnlDiqtcHZ5YYEUHEzD6rPAL0LoUFpS6dP4DFch8R4oBpW8XTjg2BzfwZ +RCv1IuIgd6HhEUcuWj5QGMi6huCF/2WVDEoGs/K32Kyh+1Jg4OOOpuLP0/YqvsRO +AMbdY80xppR2yMMtpTJPhs5aCykZ8ffHKEsh4VGvi+xFIwuOGElqXoALFPas8N+D +5jXnJQR1/2zekei9YiM6jDXps0SIChBL6vG05cua6X5K+71YHHlDoUubb+tjiIHy +FYtzEe1PPMiLl6XtAdqllLqUQvy+McHgdqNOIU+FxbWDWjDtZ5hlDdZ+sIlz3esG +wl/zQQMdRdTsjcNuElOdl2pMmLlA8CvhJM+IkHVsIHponLtBqN0Ibrw+Sh1kX0sE +cjkfrDSJABEBAAG0KFBhdHJpY2sgQWxsYWVydCA8cGF0cmlja2FsbGFlcnRAcGhw +Lm5ldD6JAmUEEwEIADgWIQTx9pIjj7wWZuWlzNQZn53+9v+6/QUCYGWinQIbAwUL +CQgHAgYVCgkICwIEFgIDAQIeAQIXgAAhCRAZn53+9v+6/RYhBPH2kiOPvBZm5aXM +1Bmfnf72/7r9wugQAJuMXAsnTk2m4Esda1R66IaOx3hms49hTtoJ3XTkOP0z/Y89 +66mJ0Zp/tjhof74jRwN+Eo9R0Vc4WpuXdL6ZaOm6alc4hYsT+13bO1hNEXFP70OF +3sithHac8wShdeutBdXGW/DcR8m7CXOsNWdQAlbYnCb3gt2zTp4DTrxmYVP4YptB +sQBQtaTqHlO0K0UGoHEkqk5PbbOeuUvvBAyeSEvislOxeSCQakBXFVROKojd90Qb +i6XFlNvZWzPgBHsrVRKuopgiNqfNAKz/n5ruhZcI4SKdni7zmv9CLiBO8P/qqzta +9Wv52z669MgPRMfODJr7Q9pG6AZCAm99oKCUStX/adKGBnfu0mx/v0bIyK7YSWp/ +8l4ioiulBs04xeZ1S9T6nMEGry8k2qlErcGI59DAR08aOAbKs/42W70Eoxepx8pw +S8KSyCfTCuF78bDdxXv3uutYb+A1AiHspu+esjJscgcXNRPYruQFBDUQ0aUzVrns +bePX6i1ZXYkPUTSRs6Hu9K8sJQ+mr5dTEae28szDxfN9mPqlNGbsKc21CsXwOJhU +IgU6a32gtZ7xq4g/A9DYHY1jSPhKi2q5JMbckQ2qzrl17zXhVISEcPTebQ0Qcu3Y +S24+k/mAqIGCrlSnFtLOf6MPTtL8JpeW9fiuys2spb/pHhqmlCevbda8CUtLuQIN +BGBlop0BEADLZJnHlI7dfEQ+thWKLLdLpd0MZBOugCqWjYdUfL89OY60W2C3Lrzg +fewjiNLxBzwvqmgEYyQURtlV7o04LJVtyO1B2b7ZQYQoC6gu+KV5z+8w1EOs6G+M +INda/QydjQk8ymChggGdHtWtGzTZ5K1js+e8wJgkF00n9YCxkkz+jJCK1L7w73vt +YvS0qYea1UVxmGG+cBsfQ9GbweRl6TvSjlmLtl7m6h1cpGDQrnyyp/yrfONLby1t +Q32lMhfH09XAPHpJWCfhv9dovgHHtb4Kroaj82UAZz2Je2Rn7SJiACLvezWEFTZM +WClntlHqHIVtmasntzhzzgK6E1IH67DgWR3m82noLpmbYlHAOLmNBsOYRGdfOQG2 +8L25P3HrWV9APikwdPHg4/0tKLgNzhB6yO6dj5Hs/YRsJD0Jn9X+cCNasP5VTLOF +sZD4J1i8jT8brlf/f367qOte3aFAPQq7OFYPvpFY/c0J0D6eb3FHCxfejVQL4YV4 +bg3HOUGynUeBGwHgyQJw/LY0LdCejokylQZr7Dj8H4l3b6x85UhJSKRoIin+c8aX +iI7/2CJbFDAIv3sovyMsAhS+GyntxIpYmoAl0jrqRCr6CWCaFl1Tjh3xrJ+pRCSk +TVq9OASHUqAb532B3Tt+DJzwrlf4qtQDFz7o7lPGXMnxYLW/KEa7QQARAQABiQJN +BBgBCAAgFiEE8faSI4+8FmblpczUGZ+d/vb/uv0FAmBlop0CGwwAIQkQGZ+d/vb/ +uv0WIQTx9pIjj7wWZuWlzNQZn53+9v+6/ccvD/0RXb7doLc6YilekZcEqtvvCrgo +/ZDbda1tjRbpQGyLy9J9whIdD7G7lSoGILSd8U18gCL7PZq96tGq75CDy89u0vI+ +IQ1WemRlfrBZb5qkSOGO2Yr/VYVxxjZbtYiM44aJyrehhA3MCvwzyP27iclH7N0X +sXgJOF1p3AVEfuXHhAVSbR3tkLPe7osXKyDUgUCuvJIPLSglCqPHsm95Xch8PpUX +JRemPpFnsPIlqDKu/vfIrDMZtnEFBog/afjA6sqmC8X2BTKF6Tiv8KKy0divkwsm +dAq+We0vkkIMq1PMc2UkDLv8DujpF4TXMvBXO3AWoKPDNt6L7zMUdymto5TIIA9W +sIbn+aGTfbfSflJlhlzJ53nyzl/x9ukFabwp7jjF6Vyh7KYMQE6ob16JWTo+AZY3 +mvKoUXw6jwGonaBjNkuR9Em/IyjXDx0tiKKaNPdVh8Tg8pcGNt3ssroEKWqLrUjW +lrso/+QPeH2Gl5+NjQYSIcQOcYo/MGuiikA9GJu088+IgJ8bmTiFgMuq/ZLAuQ6g +kpZBQXAN2hVIkV6H5IJwp8lbyf8GG0qBCk9Va03+PZjhZLu/fb9EzVmhyX95cENY +NUE7QXQplsJZqchsBbjgQE38DWiZKT7uyRhZUCUD3h9ZIsYo63NrQNoA+xkz9tub ++4cXQV6iJi/GqeBTcpkCDQRc/6jxARAA6399os7LWW0t8VwhEmjSj+1L14Ryh81Q +PEM15P1DrUXagxeLu7FGmecm7r3/0CA3m6szhpIv9qZ8ifk1KZPYkKQUeFxJvfrt +RfcfDew1Ynp4ansl4+jARv06GdOwkG7EiyVktSPyf0hGqLayeQhmqDl2cxPJuPO8 +JOSDISgk33rU94/QBWA2RRLSJtB3MZupY9Z6RvYMswyRbcYKWQlqZ09iZ4IDqeeO +pl/YuIWECl/99bpEEoqFD9tNlpaY+mDy2ihT6RWe+4uefbSWfFEjxpGd+x1ccCKK +qViYggEl0bw+S60RaS+5xEOG9wnuRrVRnVe9EbTYw2+xMdDsBaFl0qvLPY/66Bfe +D+iZpA/dN2BrsOLLWk7CJ9yCgoHxL185GMLbQNy687bCeVUGDIBF56OKzGBA7bJi +W6Z+XVkVX16li908TBnLy6DItYIqYFmSgGCAYviAmsq1v/dVOddpdAzDW4RfH5Fr +BNopYM92FswF8NtDN+VstwWAUQA2IDX3fYwPimIV+xG8ebgVALy7nWkAdsFGPoZk +UJa+x5Ln8WUOF37kMbNthd/uBelyeDZ2MU6/Eb+z54GOWijnw2l7bnlTysatJ88l +0dezmN0OQ8Yn3SaDjMKNVs+kifqVlAhSip3/eIA4/3P3Bp/RWtakzN9nV/fUVWgc +6hu6FzM6ozcAEQEAAbQlRGVyaWNrIFJldGhhbnMgPGdwZ0BkZXJpY2tyZXRoYW5z +Lm5sPokCVAQTAQoAPhYhBFpSiAeB91Vgi/gV/JEN60b1PqMSBQJc/6l5AhsDBQkS +zAMABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEJEN60b1PqMSNQUP/2me0vxA +BXrqn9uUr/09Cz+HWio7W3b901alD1amIKS4W8cKs1vNe5qHEQKH5Nd/LlYKuyKu +agKWKrfLG7dguNAEVCya3zUqFiT71yh7BD8SvvUUTqgpTet4fHW8sr+rIYgvrXUV +Prb4U5DvzVfMOBBO1QBFM1ZS6J7A8EeVmmyysYc36CPoYb/CB6yMe7G1pnE9tqoo +A4hiHwfrb3t9TeSzKIbKTcuHtGgaxIosp/e3/eFZUi0zPVAQKLBA1rnUHejVb9cA +RZQSIFpLBbUaGGBJSjNualoQOWPnHCuTy9yF6++B4ToLWLB5r9nQu70cdod21tLt +p2BMpryKikpN6OIq5Kpj62uAGDu5b/lhhbQV5tp5gxabhIyfoCnLC6JMHwVsppIG +1XsDtcM4IaFl3bl5Ol0+G0vuNru21e9ydGMHR153hPl5fszWCkWQhHXw728+vIZX +4KI3uLbpJLDHWY8QGrwGpqPMcqObcepkskejpKZX2JtycoiOlntuMWfLLmL7S+Om +YnFkOy8G0TctD45wLlfWtJDzRr2p7TDYcQ3oHf0OQMHAQ4qUJXLYyxlPja4PWiMV +x5I9hLtXfJ4krKK/FJQDccFegBR8vhQVoQ0WFot/Vzo1qu488f0w0tAJDf16+w8W +FhYnIbwfndGMgfu/nkAZ/NAkD/bAul9NGKBctCVEZXJpY2sgUmV0aGFucyAoUEhQ +KSA8ZGVyaWNrQHBocC5uZXQ+iQJUBBMBCgA+FiEEWlKIB4H3VWCL+BX8kQ3rRvU+ +oxIFAlz/qWkCGwMFCRLMAwAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQkQ3r +RvU+oxJxzhAAx8TGL+IaTYEzEICUk2wBTISoSMuoF5eZU4x3ZviA6yWG1OLn98uL +eCGjGCMFp1/OFGZfCe/QAVj7/eBZzPnvVj7JkUrPt4EpU0XOpVan9cVh9Yzds62H +Q19WRJOnMYO7xzZcempmUsZ5oAGivRsJ42UhvHi409T/ZpRdyOtiWXmdBXIRK9G3 +OuLBhchvFIhAbjfYbFD+gVzdGThU6xHXAfnLoFuyzYIpXzgrDYdmfkskLmTd4meK +oFVwcBnPWXxUJz1HNxPCI/dY8DUmWjqnb4qBU+JnLq16UmvEG2TdxpKivcoJH5la +IVnAEa2A3answ7WU5yF7n5b9PH9xFsPJpcUc7+rc2F3D6eY8WY+tSSzyKxuRYF7h +FeRifwSSjOMDp50kgUR2f/5gGRD8rDSKTtGq9pVDXtIPt2xEnY/SH6O8Mmusmk8/ +bS61t6HPjEZBGOO9LrYbVBcHCZAHRzWuFTIadyh+q330fXlCYHaHAZiN55TEDocj +1XxlhiLcyRGwDtMnc2IOjJUjyxAXwFwVqVOGCFtop33tj4TCKmMD+NSeLWmCmDLj +81t4r9+O2A2A8AhEMBCC7m9N6DlDdGMeOyzdDTUTp9cdbnLRc2qJNk8Q3C4/FI82 +SoJtOE0buvA9Jfz5GEU+V/ZEuMj+YYRCz6t3iFISCjxWlUTIH5Gw5A20KERlcmlj +ayBSZXRoYW5zIDxkZXJpY2tAZGVyaWNrcmV0aGFucy5ubD6JAlQEEwEKAD4WIQRa +UogHgfdVYIv4FfyRDetG9T6jEgUCXP+o8QIbAwUJEswDAAULCQgHAgYVCgkICwIE +FgIDAQIeAQIXgAAKCRCRDetG9T6jEo2yD/9PNspNKjiGq0u7CBxY4XrFXYNzGVUJ +UQxnCZk5o+K1zpU5VCV8XjXBrehwSe/17hAakl+5j+qFt/prORPHdXPyKyI+SM/O +muc+1AjOU3OPApwrpX0AsYMdDi5BtpXiJ8RGBNEsKJN+hCikpNkUXVlbluvcytCX +/je4TbnJdRFFSJCdP1YXAzrVbXCVFWgTU5g5SwPEpDxs9Qzvgg35PG/U5QiFSTCN +CokT1Hdf+S2a+h5nxSnqm2Vn80NyNBy9y4kBBCkU18NzR96cWxiccshR8qS+7Tg1 +EIBFFnheZkR2MQukfxCHliX40pGipyHE5Kf8huYgNRiHsfdYIfzYQx8lfvwRNq38 +QrMihIfcBZfl6z096J6Aj6XiA5VqcKDdD0gVw77KCkRyzBtGt6kSqStF9JYE9RjB +b375qPsvCVhW/alpScnRtJzVytDT9xeqe5F0V6/GhNvnlgBo3I2p+33gDb5TQOFw +oidV46lXlAYo0sAbXJPw9ZZrHE661HQ9T5CLtJ+cadITX3638Sc6XcsdbD+upU2V +1piQ9gUvgCNdYGjcYMXTfe4l7x+6pthE0lb7u+q/nyzTozez0xoCWygMJlETQXKn +s6EnhMi3phAuUnhso3fWAvwtOgHW9QaL+rx5npad3wGyRo9xqTmrE/El8FgALXY2 +XfggH/zQhIwNIbQxRGVyaWNrIFJldGhhbnMgKEdpdEh1YikgPGdpdGh1YkBkZXJp +Y2tyZXRoYW5zLm5sPokCVAQTAQoAPhYhBFpSiAeB91Vgi/gV/JEN60b1PqMSBQJc +/6lWAhsDBQkSzAMABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEJEN60b1PqMS +jWUQALGWNAhYnuTTAIoKtwPsDab6kJV3TcBaiD5ezXXYX1WFEKMuLenYkCIzRuWO +FkZR8Rr8iJj7viCPWV5bniicsKNq4Af8YIXq8Qnam30gSkHo+jGpzZYnDdFDajYa +x7wVKMxUmPsC6RhfEk0JAFXhoqrFOrsuUw+bBC4LOvFzdufmS8klJq4krpYf1kp5 +CW6/DL38YRrmhq5djyiuA8iJPtylxcR+tXSmyGtgltCiHS4EdOOyG0hOsfkHPqIK +d5Tb7J+pMGimCp/9YV1NINbFpWIG3pF6sopMLU5YHh0Wq7SgfDVmkuPxUaEChTVz +S9y6k3DwhW7ZRpcSx9hDRwaHFw/eTuSdNH/7CpXKr0o/+zuvq+gpAHbPH1GfikoN +B87lSdfUdM95QTveQjS+6IFbQR/5pCEAraZ97EP02A2o45nn2bV/gOvZRqqPuJZQ +8rJ0ryqfxRWj/cRKrtt+k/n0dKQXJt/0g5s+IVgIHHoe5htzsXyjvxfpSL+vut8Y +ftr8lyCzGqFUZaX5zpsgwpy4FMf93ttPYiQuG/pVD4dSxc347xL03rB+0F6YIv6S +DKuA9Yy9bj2xRuJb5WmAlb67qwE7urGvgAkMXs3deVMWJ1oH5KB1t15mOU3Gund/ +q3WO21GQj7leALl4cV+oDXI+3z1idIMEWQWaoY2pT7PnUw5ruQINBFz/qPEBEACw +WHa7KtEtx2KKghel9yLwLx44LRnuKWLjGNrHqjIy6RSWBcOKVUnewtlzr8ugAAE3 +qMXtGd3vCLpEtqDJ4RghBrV9YVLArr9ba4clmSgr1iDKZE4xjR71rkwEcrQA9Iqa +faOQmTzj/MJoErYONat57CfArQs+Sd4SYJyLTZ+6HdSZVyM5tDooookToZaq/FHQ +1gKtQVuIkM7229JaVo+4xQn8N+nQCsKvbl/9ATxXoxzsf2UxDsOOW+Mi9qAmSDdD +pGIsWkFmvZnRPPnLXRkQiCcq703Zt/A5ake4JPLV3ZVvvzhvA37Qz8YE8Pud+jTL +bvZ6eKh/X3XYkUGjtbDUPfY61HTbiLKcDYmEbtD9bPa9gePhNPXVcpVKd+r9UQJA ++Oskt5zbNnOx1JCNIHKJ8s2ll62G4BcS76BnPSzCtGuDnW01xPj8Q5qEHwBcpKvW +j4sRx6DSxhieeMm3FZ2ScCarz2vNY3smDJSc2lOWYlFgQwwzqAsxqA7Lb5VmYuSR +KKEWB8XnQ2rcoAaUuCm8qU/zfa/yn97eZa9VKMMX9X7tcMAuYRD0fEmS9zjeX64h +/+tZdQnUq2Jtthz4qInNs/lSSYhCTC5H9FZ9hFe5X7LiYnTws5o6TXejtXxItaYF +/4Ltdsq/bT5gI/PNqP++iTQFjLDUUoG5S3U8/631+QARAQABiQI8BBgBCgAmFiEE +WlKIB4H3VWCL+BX8kQ3rRvU+oxIFAlz/qPECGwwFCRLMAwAACgkQkQ3rRvU+oxIW +mg/8CHGV74oqKrNf0ruUaHWfm1Lk++/CAp6uSZeMOkJST/4Nl5f2O3aPA7XVk4da +vvHA3IrS053LM7xUUb0FnarKMlKg//3f6Jtvavege6zfG3qj/s6fS/8EgoZkS3sy +wGHYzy299sgZKx7eF/pkVj/olgDQ/MpkM5scpDhY1rHjvhcR8sLM8O5DkOfyTaEi +RuphMRF9G21pu3kIPf4C/4tMN0TmNBzd+9L6n4iQooVsxzAohjlIQl6DjnGM5U7I +o3ufQqCuGOhJNdMPbuaH/ZtLxhnru1kZiHToPoGRDAW8YdjBnYIljW73RKPgMpkI +iL56DXSsb87qKBLZ3aBkjZO2NxT3GUPbCAYQ/b5JQ0Oeu2wbfYDZ8lr+rATED/9Z +6mrmPPgmVg+EmXpX3byBlfLvWuknZQgEFyZEiQUNWsPX1ML+VXUS9VkHYngZ6PDS +PREP+rN/XwsNaCKg76Dx3Vcxq+0Nj9c6qEPoiC4eQGa7iSc7ylHsYlQ9qLrwSBXm +OoGSnFkpToyEi33SA2FqZqLIvG1+z7sqiTiWbTdjZ8GShAwZDDnsbNUxue9YiYFN +UwEkJhcxkApawGhNtWkbDtTrvRRAHZ58CMDMRvpaKfGcpF+RlyRumTlEChpi+vNX +3Uyor2raD12YolIUGbjVdj3vYRkwdvoQ3cZJpZZLHyT9nDWZAg0EWxcHQgEQAJrY +yC/KKIzplzkKtuc6jCpUT2LMovFvUHp+OdCMN+K1SgveBhxsHgK10fx9Ki1Uvo2W +jhUAw1reQk/g06wiusJW0bZ2W5rKQKUPJH2JLEJcVdJAVdq2vGTdsVNkvia8O0XX +zN0tGb2juyjX1HPXUJ5jRBsiPrppeK6+NEizQmj4WYBF6wfsEalJdQ8g7nSR4p9s +HdotI+6ug6hxStcjK/wwFLRqpYwZQLDbRJVVMDAXIVLmmg8CP4VarIsF+PEv9ioC +EaT2yynFVYShmbU2XmUJSlatXaHhS3/C6IkKtOWZdU2Z2Yg0OyAUssikXYDV8bNO +dlSq+0gz+xwmglKGYwMxs1S+CtSnSwbuwmLvN2VMRWDCN4CLYRezmkNW03U2OXRx +rME6qlk82VNcLjpJnc1AVWBF/Wi4K+sG32e+uoTa7vZD4p5YmfgMRwe3sa6KCNgb +ufin5idIttHB/ZOZdyIMvxMqEBkjgCOHArLDFLMeMe364uBt7c2MLCPH6+v584Rd +rOz+Yl8AvKg3+izX6lwXE2VrC/6fkXlW7Z0+gES8YmNd++si5JOjDGqQhJ6h/r9u +ZVGLYk1LpgExgHxGhG1WXISIrGBd0kqFdkHYAIgTZ929grdv4tFpz4+rSBxTBlwd +PCKselkX3b0S5hSqAGsyFL/UT+l7h5vlLvTJe6W5ABEBAAG0IUNocmlzdG9waCBN +LiBCZWNrZXIgPGNtYkBwaHAubmV0PokCVAQTAQgAPhYhBMuvafFzoP6ktTf0cNZs +lZMRi8y2BQJbFwdCAhsDBQkHhM4ABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJ +ENZslZMRi8y2o4MP/14vXeLNCNNtnhpbknRUVXrORcKZsDTyTHLx4BJvae9DsB0G +lzGI4xlkWFXRW9o1/3xG/sHpg1hQ2o5qAKPN8IAJBRm+O/cbyYxX5Jowy1l+vipt +93ZS9h+L2nEWk+hBT6hnf23u5po5JKPCEWgAqZxCnFivP5/STND9CZ5fXlTMXGYR +mehI/uGQ1k8qXMLVCG75mMxIbtXVnl0NIoq/mnT8kNWs2y17EKrbhX6tKVdOzsQI +SZ1CN0+SJeYrfCjvlVnCFQS/wG3OfmfsXIMtXR02sLffhai54jIM/DndaGrsNxay +GqScMVMnhkU8Tk1M92fwph3JaMlT7mik+fndWkQZtKAuu9j7CNmFhd19UKPbx+Fp +LIEccYyn0jh0Rngc8Js3ZhIAjaCNpSjJTIuWcNwRdks0hHSuvsK32C+YpakF1G7O +WWFSSy/p7VGXNR6R/sZgn7oC0qd954BGyaMhxmM7fezhcFYCSNG5D+jG2Ri5KtcF +Jcuw4tKXDxT1wg0pmk0tLH+ZNPw307Wdzrjqpz5TrYzLTiycxbl+uo4btKe742rl +uSXVaqx5bVpx6o1i42lGevCjq/n6oBbM78n8gTc4vPrdPjRYONviTplNipLol47h +rPG2yakoe0PqYKFLm7CzHbL64a3ZCK9K/XWth8OUJbDUGWRHnVZ5tpxQqYR2uQIN +BFsXB0IBEADDWz0jKxhy7ARP8K38vBwajJGTbwiuyiUNm/ShCWhmu/JgECQoKJa7 +gd/DpzZgjkA/7fTFGrF//AH8CK2kX/9TDnkLsjsT0Wlm66MOtMyz4HYkTjJHHFqQ +UgyoVhU2xFAp2snVgZLdV7ySoz++t3t9lSu8fUUzqdf07ufX+A4HXzgI6/2A+xzv +bvkWY/j18XE2ME13xiBXitdZGqVLLD02i/OaaQHYi1PEalfLnWtMBPu5oQd+2VTt +6bYsEOPjCOYfXXw7UTvGtOXOHE5wt0mZB28yBv8oZjsNpa36FHW90O+8KGBmrz5X +5c0MuilAnrfGdFaU1cnSFeGyEGdfsG2FzwPL9vfIVX14f92JzcppfwlOjm/vzONj +OE2/GbAOaCG9ppP37yfGmsSftLu4MpBsqSkKB/QlGncwP9tww+swe17DWMKmtm6C +0uSb3dbTb/QNdzWEEz5ZYAU4Aq8Y1Sc8QRlqSgRLmBsvffX4vQsg70r0khp3Ari/ +tcBAkWnnkkOg1xPB0/DGEhOzEIChjImtLghIkYXeVWJcfcR4fPrEcs37V8PR0WWK +s4gNEKy7nBelcB4EfPjEXEYjiAXCzzF5CaoY4uob5RXtvOp20Xv6+thPKFAhuDdP +XLxOGLYJ5/uhk7lElEhTaQ7PqxRsCcWDtf4OZEhOl1ag2G3TEXx/8QARAQABiQI8 +BBgBCAAmFiEEy69p8XOg/qS1N/Rw1myVkxGLzLYFAlsXB0ICGwwFCQeEzgAACgkQ +1myVkxGLzLZwBw/+Osh1vCAHiFUakQ2VPXzHe1wYbZPLbN+8as8O/pF/U6DzwO4Q +KUxjwbMrIFs2t0OucldFgJUjNHxQmKSdeq4x+NNhcZegobY8CIEdsWsXle4jZukq +DP+83xbH0z6AWZI3GuRvNCVg3KN4RRIFCOmBkdfmiGMXZq0tQgFWYFZ+o3R7FPt0 +eZ1Vm34TiG5zRcyZfWqWZtmow9yPYCcV0Xfb7H85H3f3M5xter9LXxbf0XXdPnlW +wZw7iuNgMjgtjUbWiidE/KRVCxEUGzARw7kV12EYESA13z1PYFY5n2evaXw0jCkD +JKtBJ/2HjkL7ruNDkKOtR/1/8D6b/yuKHZQXmLnJ3791yOtNnH064lALDeyZWorb +lSTyblBZmCsw2LKq0OyXEzPkY6KwPWI0oXOc2OSjcYTEIaXMOYACubQ1AeSol9cQ +U7zrIsCRoDN6hI6ENSVsukt8BTRuInHxFIwrmsd00RMsEdtRjfnmvvpLB4YeW7aI +CojEQ4S9Rec5HhbjbS7LcNGVBjgwh5EuA0qQWtjd8cOi3SHlKu9p7vgTaiwuhaH3 +km6Ntuy4xUSuuDA7/WHKxWOaR2JTZQ+QfUUH+JAfM/QUYK7lJAH7v4DaCraEFJND +O2qA/HKCscuFvMFXKZyf3Il33omfBV7l3UGvEWXFx8MMb8YEapUHwyy5+aOZAy4E +T2apoBEIAIVKpwaY26eSNBC7df7JedOYV4SS8zgldlM4F1HxoR680aaYUR/K+NoO +NaL2FzCngT+Vi0L4/tWxWMzU5Jf16rSML+UYvRnJFd6T6Y3LSfkfU1K5Ol/1jXws +yqFzgb5FT4tw2Jn0rQMm44680s/Fbs4dmC7FvfB0o9c1VraPJF8kAqba5okkxPWZ +OYVP1rRDxIqv6ZSusmS4bQfajpLOsq3xbCiKe3V6HrvNWwlom1AVyGcRmeVrAhyo +/bILicsZHcyS5ujDGgQFgJl63XxodVVFu+kbZC2hvwu7nGuwZuZfKZOQdN2m+R9w +kUANrwzM4v3TM7FfBsZ9shk6WHkSfyMBAJeV+fHZ5AvcFJb/pcA1rnV1taISnV3U +ECSkYq1m+WTRB/4z1YCL71pcx7fE/mSvG2CdE1R/ZY3pl3LYzEvVFEkIVvK0uGXS +uicLj0GwZhUayF0QfzGEFuIg4kq5Vn8NOX1sSbs/1zsILuInJUKSFQCGi4frHNlA +0tH5FT5B5tjNfKlV+X31CTsR0yav9YBkIcu69qfKp6kLkQGxrdWcB9B6ZI2gF4YE +pZYuI6w+O9Lvb7LXPhFQwB9cefiX+wUy3zO3v/vgCYk/Bmq5XjWniY87XZXj7E/J +zpGwHzix+yTZBWK9TzDwCS8ZB5iNejPsjBqj3n59a15XNnfopFC9RyQ/ykaMeUNe +cfEnQcjUj+Q4FlKPBHBR/R13vfLp6s+FsuT6B/410jcf0oYkHMbn+tXJYrBR5D13 +m53iNMlGRAa8A/mmDvq8Rr12iBul7hbln7QF9uIlKdCZBZIeJl12P+3fem1u6njg +KTplOB2WYVgwsXWFHjs8hlMMoRES4pgZyL++ryydm8Qk/1gLD9O2Idwx2swpxj/4 +unyVA7QYcs8H2CVWGcLR1vqXVemDUIwjz9GjMExyKPfQSABOCAL/LbNuKoAWhL0U +32dc9t7imFK2oAETJ5n6de523s9RhONWByuqjxsdkKKwGhtYLs6crJTPFXHNR64+ +Qh+Zm7OQtozDYxxB2/DCw29DQPNos/fRzVeyb/sQhglw5anOVUnlCt2YTT8FtDJT +dGFuaXNsYXYgTWFseXNoZXYgKFBIUCBrZXkpIDxzbWFseXNoZXZAZ21haWwuY29t +Poh6BBMRCAAiBQJPZqq0AhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAv +eVa8XaBLXZczAP0e5EiiVLAgrvu7wRjjrXLa7qxtffqfn+6j8sNC7GiLewD/Qy+m +e/M6G/0i5+++xkSPcTuLeH6IPnrjxgzB9MUKKP60K1N0YW5pc2xhdiBNYWx5c2hl +diAoUEhQIGtleSkgPHN0YXNAcGhwLm5ldD6IegQTEQgAIgUCT2apoAIbAwYLCQgH +AwIGFQgCCQoLBBYCAwECHgECF4AACgkQL3lWvF2gS12F2wD/WpBvlFluHo+UhV4c +IUULd8y/LnrAnUoLSSeGmHJl1wYA/1tAWFYZvHKUWfvGadsnZulr7Rh/NFbBuCZ4 +hKhki1DVtDVTdGFuaXNsYXYgTWFseXNoZXYgKFBIUCBrZXkpIDxzbWFseXNoZXZA +c3VnYXJjcm0uY29tPoh6BBMRCAAiBQJPZqqdAhsDBgsJCAcDAgYVCAIJCgsEFgID +AQIeAQIXgAAKCRAveVa8XaBLXWuhAP9L9/cztiAKFozxIC3v2IA+8uJ6mVQGBiC4 +4mMdzXpADQD8CbSaMqY2rdbk/S4D+8H6WIIRwwt1xmI4iw0jjh4ePk+5Ag0ET2ap +oBAIAN9k8ymNmSQZmPcFj/sCmguribCrNuH4KktfA2fbS0U29Jd9vxF15e9URvtJ +zH5b2pimJq6faJcmAJUfx+ClmlHznq6VPWrq4Ib74Je5sS+Kn94mRmX3f/ziHTgp +AnCyA6sCHQ6bc549Gfw+v777Qs1LQQvy5f9gd5M4Y6eeZOphN7JIFUV2i/oviZ6l +11+N6SJwpCqEvuZmH/G6rb0mKNPS401fy/i8NZAO7l2UBx1364HeBxcwP8+CKcPX +XOn7rC2tYKb/7IGqm8PBdBfk8ZSfC9tF+XsDLcybCaheJ5xkyDR3BNJzt7SWEHgc +ZEdl0EwkHisdRUZ3Oq6Mr9y06+sAAwUH/RS1vvpB7qwIyUfFUCZ4T99ujs+LTlu1 +n/HTWvrt0d9oxI/SuIIonszQ5b6MBe2737P8FWdiKxbrtZZ/GXZxLm1kOCIeAkBF +dZQ47vb6xJwc/wpCZOXXPXqDIpvBjdKbIGTByk4vfmeFRY0vL3ezI+hjqxlROKSv +Ztli6QcNDfdcE+zh7oxtYp+xr2ppWaeU4XeTlSoKGO618doRrhDtU/jAEimmEcGL +0wjXqgkjPME9saXa6h52PCJnpB5BmdK45VhnFTZ3eVEDw+u18U3VVKWkSb9VwC+2 +J4dRhYc3TA675yndKWvlclU2NOMmGXbxKWKcwwTniYoAZ/Yt2v91HBeIYQQYEQgA +CQUCT2apoAIbDAAKCRAveVa8XaBLXboRAP9VV3cWCMsqCUKVFA/N19Tzju2oMrjM +mNuZG/m8svCgTQD7ButCzuNUZTc2tLQAiXm9SZ7CmnYErNKR6nLbedaZ6PCZAg0E +Xrb0LgEQAOX87ju0d9lqnpjc/B8j3/jB79MPAkuoE/yMzPcAfyzl7ytYcgjBclqj +U1YWR3hWdJKI0Qx59+Ss1anIJuOvTo0Saanj0YJSlDCFPUO5C7wuEqh4+EgacAiy +23LUtunKVJ9MQ7t+TtKeRijI84KK58RcM4ukHHwbCb9ww1mEUjTlcJBJ/n70iNoT +GKGCZ18IpyFvK8atSf1jt67k9hS2wS7VJNqw3Orm6xJDqGi3fMFtWg9ErxrtNkIM +YmrO+ofRsilUcpUrEDyv2Q/FNviOVE9BXzVVJ7zxOCwjMNJ4ao6Ezk0NOZU36qv0 +Bg8B3IWN6axWMwUQvfh0SAzZUGxfzuraG86Rj1z21PJwJxQATIRhERfm118EAVxw +P/xz0Nwrr044Hx0Wi8mX6qi0B5d1rf08VAUoJ/Bhr7Lfbpjbi0z4mvwZh+ydRrow +Doff+g0IAamzRVmcFVFyOdLM2iM9z10Ds6dPvi6QVvTMZfrE3l1MIpFb+YuOeU5A +QFbl0so2HaWP1TMb/0pQjhXh9WwSOfwjG1QyEibs4CxSMbJ2TwPYLNo9QQZnBdPM +PBUfa0Jkahw+NnztHjENsHbsr/ic1Zvi7HuaUTCKzm1oGeiIqIBXtH8WrQsQlAWi +JdEvu2YkKAyjxUOD9reL4a8NbGve1MeNC1T4onX5OqJ/dCsnnd19ABEBAAG0OEdh +YnJpZWwgQ2FydXNvIChSZWxlYXNlIE1hbmFnZXIpIDxjYXJ1c29nYWJyaWVsQHBo +cC5uZXQ+iQJUBBMBCAA+FiEEv93ShkKCT4EY73eQm2elwSIpEY8FAl629C4CGwMF +CQeEzgAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQm2elwSIpEY93YRAAorek +8NdIxkegDBXSrVVR0wA3FsT7tMT25cVDHpV0NnGVoRYRQW65rjW7zPAKHe/oXk6M +OuVbCg9Gr9znJa/KlQHsi0Hsv+6+w6rLpXw8aQfikfFgLIVOELY6/MoVcao2vEXv +Q0gDPo3JKVA+W7lMrY+sLUyJcww9yI1181qBJRlAp5wwyKPiqNExHKlxRklMSR6v +gJHocL7hSWcGPpSmKMqq5oZkwB73mhEktXAI6yEuAeOKEx7XarBfWeN4BCo9BHgp +nslR5pjgzWjKbHK5k+XBS0ApKi4dDuzuDcodqhIhqUhrFj04LGznYfnLa7IVuupI +NVY+HX/OBd9+a7qEH+hF7IOGFwfjv5xOCfbdzDzp3v4G6mluzTmDxByNta/T30hF +tWmKsqY5FP7ip1eN6//DvhZlQVcpbs8WEeivo8BRvbMBy6tW/hFMhWxEPrA+i9Qq +CRt0l5f29smtnJyCcZPi3AvtZI8qK+fgFgEinbz+NnOXY62JLJl/+GucSoWnx9rg +OJb2ZEDcTFuN8JCo4YxPAvACSPib4CF03nnFhAuyP/qnPcDKwFGhLUT++3FIilEA +CZ/dSGEylGQqTSYDl/gyxCpHslnZt6f2T8ZMd4fuqyrNvWT6sTARjwX3VCCwHNPn +M7ik9DWsgZM3gIFrtBwkfd9zeL2tgxgC25WWkJS5Ag0EXrb0LgEQAN1a0LLbJ+fK +NIFqwxsjNM5X5YdyPQMkkM0mMZzLgZMz3yCSUFw/ZbfD6ZqRfpxugek39M2l8BRA +8eWo0TiFAq2HdD9yXBfqiWc1DFL0ZkVgJtSM8czE4IX1EON7BRwin0BkOChn+PE0 +JWKdvrjyo6bZ995YFyNkA3GlUxSyoAhaivPFfrSoKBUSXSiZBk9KzdrS5k76ZlhE +73Vej1S5XCz+Ssqj6X683iDqTWlkXaUJ8EAnwv+b81zPmnjfxnAWYxa/Hi+vGWxD +gDhP4El+XJSLjcEB5JWt0a1UkSKXigz7LkYib1s091mIkTPsNmtsh5c2opGMoWJd +wbZvyqgM3VqrlCIkLdGiThqvhh85kKkvgg1Bicg0d00vmWlzJ4MFhkbt0pTLY7hp ++e+PF3gWey9inmqbiz52Xag8PQav7opOi1fb95Wvi/BkMZ6v5nmjxzQEe+HaF4Uj +ZG1fFwVp3Hss2V2DvT2QAzz/JV1Aj0aNFo37VAVebKqkdrxNCRQQg4p630kwEImR +wJTYY8tVNUlVQPbdVwkYJvdhXjsVXApPoxBhU20S5qevxMiI/2FhEHHgm5PmokSa +XiDgII7Gm4sUgoAreslvOmydpQeGKSOU5gZ1MQtvfBvdcQQfV1klnCTtYQMV/6lN +UXEx9LlXzaQ3/Ah0LC0XSV+8B9zz/A0FABEBAAGJAjwEGAEIACYWIQS/3dKGQoJP +gRjvd5CbZ6XBIikRjwUCXrb0LgIbDAUJB4TOAAAKCRCbZ6XBIikRj1+vD/9KA9Ev +HdPNyDk8jU/dUvPYKqLcQTKA0cBpDcv9+N0bfVFijBtw8Hpyg+23Q0XxJuwpgL7N +72HLxCJzrpfIyucc5j99+Wrh1wrbqdynkKJ9hM24lMhj2ZHaP42oN6At4unLFGh8 +0a+YkJFjTxh9jORvtjXpQjzq+j+8isQ5i71yT9WTzesJBhtrLMVQrgOND5E6AS/I +uUEjOHt3INuG2HFJp0jRtdlBT9ZLB+zoTJIIMARUqZGZTgF+rehVIsTXed7fdWid +MK9GKN9SU+cBWZ3vcb37lDph8bCmRb/aGlby5hBUy6KwrSXF/V6VsyqWiccXzt99 +Dq0BfuSE+VCKYjHToyw4j9gnlrZdH2NMwyUgicKbc8GLbxGS6tzYrSy2MD+BILQD ++cnpGgAyD2kbcEm6ghGWLTTi11cotcr0uXCLiPZwWG28ychx9HxXvvNUNArvDSmP +26uZqo/WZFYukaaFLltQocI5PEAkx2K4N+xb0y5Ht/8M+XNO/t/pAR+yHWNUpZUg +bZ0dujm5hPdVA9U51cyHMCucOl0sN0+oO26re7e0ZTnImjF6HBzgN5LhDmccoT4r +pOFJqrW77hOMhvIUkg5n4Sd63wbB88BKsPXF6mRUEPcHuvwLr5jAE8QSW6sLhphA +bh57GXdFtudEaKvQbGW9yalYwuj7Yip5XJGttg== +=XZOV +-----END PGP PUBLIC KEY BLOCK----- diff --git a/php.conf b/php.conf new file mode 100644 index 0000000..0639c0a --- /dev/null +++ b/php.conf @@ -0,0 +1,52 @@ +# +# The following lines prevent .user.ini files from being viewed by Web clients. +# + + + Require all denied + + + Order allow,deny + Deny from all + Satisfy All + + + +# +# Allow php to handle Multiviews +# +AddType text/html .php + +# +# Add index.php to the list of files that will be served as directory +# indexes. +# +DirectoryIndex index.php + +# mod_php options + + # + # Cause the PHP interpreter to handle files with a .php extension. + # + + SetHandler application/x-httpd-php + + + # + # Uncomment the following lines to allow PHP to pretty-print .phps + # files as PHP source code: + # + # + # SetHandler application/x-httpd-php-source + # + + # + # Apache specific PHP configuration options + # those can be override in each configured vhost + # + php_value session.save_handler "files" + php_value session.save_path "/var/lib/php/session" + php_value soap.wsdl_cache_dir "/var/lib/php/wsdlcache" + + #php_value opcache.file_cache "/var/lib/php/opcache" + diff --git a/php.conf2 b/php.conf2 new file mode 100644 index 0000000..cdd7640 --- /dev/null +++ b/php.conf2 @@ -0,0 +1,14 @@ + +# Redirect to local php-fpm if mod_php (5, 7 or 8) is not available + + + + # Enable http authorization headers + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 + + + SetHandler "proxy:fcgi://127.0.0.1:9000" + + + + diff --git a/php.ini b/php.ini new file mode 100644 index 0000000..dae0741 --- /dev/null +++ b/php.ini @@ -0,0 +1,1666 @@ +[PHP] + +;;;;;;;;;;;;;;;;;;; +; About php.ini ; +;;;;;;;;;;;;;;;;;;; +; PHP's initialization file, generally called php.ini, is responsible for +; configuring many of the aspects of PHP's behavior. + +; PHP attempts to find and load this configuration from a number of locations. +; The following is a summary of its search order: +; 1. SAPI module specific location. +; 2. The PHPRC environment variable. (As of PHP 5.2.0) +; 3. A number of predefined registry keys on Windows (As of PHP 5.2.0) +; 4. Current working directory (except CLI) +; 5. The web server's directory (for SAPI modules), or directory of PHP +; (otherwise in Windows) +; 6. The directory from the --with-config-file-path compile time option, or the +; Windows directory (usually C:\windows) +; See the PHP docs for more specific information. +; http://php.net/configuration.file + +; The syntax of the file is extremely simple. Whitespace and lines +; beginning with a semicolon are silently ignored (as you probably guessed). +; Section headers (e.g. [Foo]) are also silently ignored, even though +; they might mean something in the future. + +; Directives following the section heading [PATH=/www/mysite] only +; apply to PHP files in the /www/mysite directory. Directives +; following the section heading [HOST=www.example.com] only apply to +; PHP files served from www.example.com. Directives set in these +; special sections cannot be overridden by user-defined INI files or +; at runtime. Currently, [PATH=] and [HOST=] sections only work under +; CGI/FastCGI. +; http://php.net/ini.sections + +; Directives are specified using the following syntax: +; directive = value +; Directive names are *case sensitive* - foo=bar is different from FOO=bar. +; Directives are variables used to configure PHP or PHP extensions. +; There is no name validation. If PHP can't find an expected +; directive because it is not set or is mistyped, a default value will be used. + +; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one +; of the INI constants (On, Off, True, False, Yes, No and None) or an expression +; (e.g. E_ALL & ~E_NOTICE), a quoted string ("bar"), or a reference to a +; previously set variable or directive (e.g. ${foo}) + +; Expressions in the INI file are limited to bitwise operators and parentheses: +; | bitwise OR +; ^ bitwise XOR +; & bitwise AND +; ~ bitwise NOT +; ! boolean NOT + +; Boolean flags can be turned on using the values 1, On, True or Yes. +; They can be turned off using the values 0, Off, False or No. + +; An empty string can be denoted by simply not writing anything after the equal +; sign, or by using the None keyword: + +; foo = ; sets foo to an empty string +; foo = None ; sets foo to an empty string +; foo = "None" ; sets foo to the string 'None' + +; If you use constants in your value, and these constants belong to a +; dynamically loaded extension (either a PHP extension or a Zend extension), +; you may only use these constants *after* the line that loads the extension. + +;;;;;;;;;;;;;;;;;;; +; About this file ; +;;;;;;;;;;;;;;;;;;; +; PHP comes packaged with two INI files. One that is recommended to be used +; in production environments and one that is recommended to be used in +; development environments. + +; php.ini-production contains settings which hold security, performance and +; best practices at its core. But please be aware, these settings may break +; compatibility with older or less security conscience applications. We +; recommending using the production ini in production and testing environments. + +; php.ini-development is very similar to its production variant, except it is +; much more verbose when it comes to errors. We recommend using the +; development version only in development environments, as errors shown to +; application users can inadvertently leak otherwise secure information. + +; This is the php.ini-production INI file. + +;;;;;;;;;;;;;;;;;;; +; Quick Reference ; +;;;;;;;;;;;;;;;;;;; + +; The following are all the settings which are different in either the production +; or development versions of the INIs with respect to PHP's default behavior. +; Please see the actual settings later in the document for more details as to why +; we recommend these changes in PHP's behavior. + +; display_errors +; Default Value: On +; Development Value: On +; Production Value: Off + +; display_startup_errors +; Default Value: On +; Development Value: On +; Production Value: Off + +; error_reporting +; Default Value: E_ALL +; Development Value: E_ALL +; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT + +; log_errors +; Default Value: Off +; Development Value: On +; Production Value: On + +; max_input_time +; Default Value: -1 (Unlimited) +; Development Value: 60 (60 seconds) +; Production Value: 60 (60 seconds) + +; output_buffering +; Default Value: Off +; Development Value: 4096 +; Production Value: 4096 + +; register_argc_argv +; Default Value: On +; Development Value: Off +; Production Value: Off + +; request_order +; Default Value: None +; Development Value: "GP" +; Production Value: "GP" + +; session.gc_divisor +; Default Value: 100 +; Development Value: 1000 +; Production Value: 1000 + +; session.sid_bits_per_character +; Default Value: 4 +; Development Value: 5 +; Production Value: 5 + +; short_open_tag +; Default Value: On +; Development Value: Off +; Production Value: Off + +; variables_order +; Default Value: "EGPCS" +; Development Value: "GPCS" +; Production Value: "GPCS" + +; zend.exception_ignore_args +; Default Value: Off +; Development Value: Off +; Production Value: On + +; zend.exception_string_param_max_len +; Default Value: 15 +; Development Value: 15 +; Production Value: 0 + +;;;;;;;;;;;;;;;;;;;; +; php.ini Options ; +;;;;;;;;;;;;;;;;;;;; +; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" +;user_ini.filename = ".user.ini" + +; To disable this feature set this option to an empty value +;user_ini.filename = + +; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) +;user_ini.cache_ttl = 300 + +;;;;;;;;;;;;;;;;;;;; +; Language Options ; +;;;;;;;;;;;;;;;;;;;; + +; Enable the PHP scripting language engine under Apache. +; http://php.net/engine +engine = On + +; This directive determines whether or not PHP will recognize code between +; tags as PHP source which should be processed as such. It is +; generally recommended that should be used and that this feature +; should be disabled, as enabling it may result in issues when generating XML +; documents, however this remains supported for backward compatibility reasons. +; Note that this directive does not control the would work. +; http://php.net/syntax-highlighting +;highlight.string = #DD0000 +;highlight.comment = #FF9900 +;highlight.keyword = #007700 +;highlight.default = #0000BB +;highlight.html = #000000 + +; If enabled, the request will be allowed to complete even if the user aborts +; the request. Consider enabling it if executing long requests, which may end up +; being interrupted by the user or a browser timing out. PHP's default behavior +; is to disable this feature. +; http://php.net/ignore-user-abort +;ignore_user_abort = On + +; Determines the size of the realpath cache to be used by PHP. This value should +; be increased on systems where PHP opens many files to reflect the quantity of +; the file operations performed. +; Note: if open_basedir is set, the cache is disabled +; http://php.net/realpath-cache-size +;realpath_cache_size = 4096k + +; Duration of time, in seconds for which to cache realpath information for a given +; file or directory. For systems with rarely changing files, consider increasing this +; value. +; http://php.net/realpath-cache-ttl +;realpath_cache_ttl = 120 + +; Enables or disables the circular reference collector. +; http://php.net/zend.enable-gc +zend.enable_gc = On + +; If enabled, scripts may be written in encodings that are incompatible with +; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such +; encodings. To use this feature, mbstring extension must be enabled. +;zend.multibyte = Off + +; Allows to set the default encoding for the scripts. This value will be used +; unless "declare(encoding=...)" directive appears at the top of the script. +; Only affects if zend.multibyte is set. +;zend.script_encoding = + +; Allows to include or exclude arguments from stack traces generated for exceptions. +; In production, it is recommended to turn this setting on to prohibit the output +; of sensitive information in stack traces +; Default Value: Off +; Development Value: Off +; Production Value: On +zend.exception_ignore_args = On + +; Allows setting the maximum string length in an argument of a stringified stack trace +; to a value between 0 and 1000000. +; This has no effect when zend.exception_ignore_args is enabled. +; Default Value: 15 +; Development Value: 15 +; Production Value: 0 +; In production, it is recommended to set this to 0 to reduce the output +; of sensitive information in stack traces. +zend.exception_string_param_max_len = 0 + +;;;;;;;;;;;;;;;;; +; Miscellaneous ; +;;;;;;;;;;;;;;;;; + +; Decides whether PHP may expose the fact that it is installed on the server +; (e.g. by adding its signature to the Web server header). It is no security +; threat in any way, but it makes it possible to determine whether you use PHP +; on your server or not. +; http://php.net/expose-php +expose_php = On + +;;;;;;;;;;;;;;;;;;; +; Resource Limits ; +;;;;;;;;;;;;;;;;;;; + +; Maximum execution time of each script, in seconds +; http://php.net/max-execution-time +; Note: This directive is hardcoded to 0 for the CLI SAPI +max_execution_time = 30 + +; Maximum amount of time each script may spend parsing request data. It's a good +; idea to limit this time on productions servers in order to eliminate unexpectedly +; long running scripts. +; Note: This directive is hardcoded to -1 for the CLI SAPI +; Default Value: -1 (Unlimited) +; Development Value: 60 (60 seconds) +; Production Value: 60 (60 seconds) +; http://php.net/max-input-time +max_input_time = 60 + +; Maximum input variable nesting level +; http://php.net/max-input-nesting-level +;max_input_nesting_level = 64 + +; How many GET/POST/COOKIE input variables may be accepted +;max_input_vars = 1000 + +; Maximum amount of memory a script may consume +; http://php.net/memory-limit +memory_limit = 128M + +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; +; Error handling and logging ; +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; + +; This directive informs PHP of which errors, warnings and notices you would like +; it to take action for. The recommended way of setting values for this +; directive is through the use of the error level constants and bitwise +; operators. The error level constants are below here for convenience as well as +; some common settings and their meanings. +; By default, PHP is set to take action on all errors, notices and warnings EXCEPT +; those related to E_NOTICE and E_STRICT, which together cover best practices and +; recommended coding standards in PHP. For performance reasons, this is the +; recommend error reporting setting. Your production server shouldn't be wasting +; resources complaining about best practices and coding standards. That's what +; development servers and development settings are for. +; Note: The php.ini-development file has this setting as E_ALL. This +; means it pretty much reports everything which is exactly what you want during +; development and early testing. +; +; Error Level Constants: +; E_ALL - All errors and warnings (includes E_STRICT as of PHP 5.4.0) +; E_ERROR - fatal run-time errors +; E_RECOVERABLE_ERROR - almost fatal run-time errors +; E_WARNING - run-time warnings (non-fatal errors) +; E_PARSE - compile-time parse errors +; E_NOTICE - run-time notices (these are warnings which often result +; from a bug in your code, but it's possible that it was +; intentional (e.g., using an uninitialized variable and +; relying on the fact it is automatically initialized to an +; empty string) +; E_STRICT - run-time notices, enable to have PHP suggest changes +; to your code which will ensure the best interoperability +; and forward compatibility of your code +; E_CORE_ERROR - fatal errors that occur during PHP's initial startup +; E_CORE_WARNING - warnings (non-fatal errors) that occur during PHP's +; initial startup +; E_COMPILE_ERROR - fatal compile-time errors +; E_COMPILE_WARNING - compile-time warnings (non-fatal errors) +; E_USER_ERROR - user-generated error message +; E_USER_WARNING - user-generated warning message +; E_USER_NOTICE - user-generated notice message +; E_DEPRECATED - warn about code that will not work in future versions +; of PHP +; E_USER_DEPRECATED - user-generated deprecation warnings +; +; Common Values: +; E_ALL (Show all errors, warnings and notices including coding standards.) +; E_ALL & ~E_NOTICE (Show all errors, except for notices) +; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) +; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) +; Default Value: E_ALL +; Development Value: E_ALL +; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT +; http://php.net/error-reporting +error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT + +; This directive controls whether or not and where PHP will output errors, +; notices and warnings too. Error output is very useful during development, but +; it could be very dangerous in production environments. Depending on the code +; which is triggering the error, sensitive information could potentially leak +; out of your application such as database usernames and passwords or worse. +; For production environments, we recommend logging errors rather than +; sending them to STDOUT. +; Possible Values: +; Off = Do not display any errors +; stderr = Display errors to STDERR (affects only CGI/CLI binaries!) +; On or stdout = Display errors to STDOUT +; Default Value: On +; Development Value: On +; Production Value: Off +; http://php.net/display-errors +display_errors = Off + +; The display of errors which occur during PHP's startup sequence are handled +; separately from display_errors. We strongly recommend you set this to 'off' +; for production servers to avoid leaking configuration details. +; Default Value: On +; Development Value: On +; Production Value: Off +; http://php.net/display-startup-errors +display_startup_errors = Off + +; Besides displaying errors, PHP can also log errors to locations such as a +; server-specific log, STDERR, or a location specified by the error_log +; directive found below. While errors should not be displayed on productions +; servers they should still be monitored and logging is a great way to do that. +; Default Value: Off +; Development Value: On +; Production Value: On +; http://php.net/log-errors +log_errors = On + +; Set maximum length of log_errors. In error_log information about the source is +; added. The default is 1024 and 0 allows to not apply any maximum length at all. +; http://php.net/log-errors-max-len +log_errors_max_len = 1024 + +; Do not log repeated messages. Repeated errors must occur in same file on same +; line unless ignore_repeated_source is set true. +; http://php.net/ignore-repeated-errors +ignore_repeated_errors = Off + +; Ignore source of message when ignoring repeated messages. When this setting +; is On you will not log errors with repeated messages from different files or +; source lines. +; http://php.net/ignore-repeated-source +ignore_repeated_source = Off + +; If this parameter is set to Off, then memory leaks will not be shown (on +; stdout or in the log). This is only effective in a debug compile, and if +; error reporting includes E_WARNING in the allowed list +; http://php.net/report-memleaks +report_memleaks = On + +; This setting is off by default. +;report_zend_debug = 0 + +; Turn off normal error reporting and emit XML-RPC error XML +; http://php.net/xmlrpc-errors +;xmlrpc_errors = 0 + +; An XML-RPC faultCode +;xmlrpc_error_number = 0 + +; When PHP displays or logs an error, it has the capability of formatting the +; error message as HTML for easier reading. This directive controls whether +; the error message is formatted as HTML or not. +; Note: This directive is hardcoded to Off for the CLI SAPI +; http://php.net/html-errors +;html_errors = On + +; If html_errors is set to On *and* docref_root is not empty, then PHP +; produces clickable error messages that direct to a page describing the error +; or function causing the error in detail. +; You can download a copy of the PHP manual from http://php.net/docs +; and change docref_root to the base URL of your local copy including the +; leading '/'. You must also specify the file extension being used including +; the dot. PHP's default behavior is to leave these settings empty, in which +; case no links to documentation are generated. +; Note: Never use this feature for production boxes. +; http://php.net/docref-root +; Examples +;docref_root = "/phpmanual/" + +; http://php.net/docref-ext +;docref_ext = .html + +; String to output before an error message. PHP's default behavior is to leave +; this setting blank. +; http://php.net/error-prepend-string +; Example: +;error_prepend_string = "" + +; String to output after an error message. PHP's default behavior is to leave +; this setting blank. +; http://php.net/error-append-string +; Example: +;error_append_string = "" + +; Log errors to specified file. PHP's default behavior is to leave this value +; empty. +; http://php.net/error-log +; Example: +;error_log = php_errors.log +; Log errors to syslog (Event Log on Windows). +;error_log = syslog + +; The syslog ident is a string which is prepended to every message logged +; to syslog. Only used when error_log is set to syslog. +;syslog.ident = php + +; The syslog facility is used to specify what type of program is logging +; the message. Only used when error_log is set to syslog. +;syslog.facility = user + +; Set this to disable filtering control characters (the default). +; Some loggers only accept NVT-ASCII, others accept anything that's not +; control characters. If your logger accepts everything, then no filtering +; is needed at all. +; Allowed values are: +; ascii (all printable ASCII characters and NL) +; no-ctrl (all characters except control characters) +; all (all characters) +; raw (like "all", but messages are not split at newlines) +; http://php.net/syslog.filter +;syslog.filter = ascii + +;windows.show_crt_warning +; Default value: 0 +; Development value: 0 +; Production value: 0 + +;;;;;;;;;;;;;;;;; +; Data Handling ; +;;;;;;;;;;;;;;;;; + +; The separator used in PHP generated URLs to separate arguments. +; PHP's default setting is "&". +; http://php.net/arg-separator.output +; Example: +;arg_separator.output = "&" + +; List of separator(s) used by PHP to parse input URLs into variables. +; PHP's default setting is "&". +; NOTE: Every character in this directive is considered as separator! +; http://php.net/arg-separator.input +; Example: +;arg_separator.input = ";&" + +; This directive determines which super global arrays are registered when PHP +; starts up. G,P,C,E & S are abbreviations for the following respective super +; globals: GET, POST, COOKIE, ENV and SERVER. There is a performance penalty +; paid for the registration of these arrays and because ENV is not as commonly +; used as the others, ENV is not recommended on productions servers. You +; can still get access to the environment variables through getenv() should you +; need to. +; Default Value: "EGPCS" +; Development Value: "GPCS" +; Production Value: "GPCS"; +; http://php.net/variables-order +variables_order = "GPCS" + +; This directive determines which super global data (G,P & C) should be +; registered into the super global array REQUEST. If so, it also determines +; the order in which that data is registered. The values for this directive +; are specified in the same manner as the variables_order directive, +; EXCEPT one. Leaving this value empty will cause PHP to use the value set +; in the variables_order directive. It does not mean it will leave the super +; globals array REQUEST empty. +; Default Value: None +; Development Value: "GP" +; Production Value: "GP" +; http://php.net/request-order +request_order = "GP" + +; This directive determines whether PHP registers $argv & $argc each time it +; runs. $argv contains an array of all the arguments passed to PHP when a script +; is invoked. $argc contains an integer representing the number of arguments +; that were passed when the script was invoked. These arrays are extremely +; useful when running scripts from the command line. When this directive is +; enabled, registering these variables consumes CPU cycles and memory each time +; a script is executed. For performance reasons, this feature should be disabled +; on production servers. +; Note: This directive is hardcoded to On for the CLI SAPI +; Default Value: On +; Development Value: Off +; Production Value: Off +; http://php.net/register-argc-argv +register_argc_argv = Off + +; When enabled, the ENV, REQUEST and SERVER variables are created when they're +; first used (Just In Time) instead of when the script starts. If these +; variables are not used within a script, having this directive on will result +; in a performance gain. The PHP directive register_argc_argv must be disabled +; for this directive to have any effect. +; http://php.net/auto-globals-jit +auto_globals_jit = On + +; Whether PHP will read the POST data. +; This option is enabled by default. +; Most likely, you won't want to disable this option globally. It causes $_POST +; and $_FILES to always be empty; the only way you will be able to read the +; POST data will be through the php://input stream wrapper. This can be useful +; to proxy requests or to process the POST data in a memory efficient fashion. +; http://php.net/enable-post-data-reading +;enable_post_data_reading = Off + +; Maximum size of POST data that PHP will accept. +; Its value may be 0 to disable the limit. It is ignored if POST data reading +; is disabled through enable_post_data_reading. +; http://php.net/post-max-size +post_max_size = 8M + +; Automatically add files before PHP document. +; http://php.net/auto-prepend-file +auto_prepend_file = + +; Automatically add files after PHP document. +; http://php.net/auto-append-file +auto_append_file = + +; By default, PHP will output a media type using the Content-Type header. To +; disable this, simply set it to be empty. +; +; PHP's built-in default media type is set to text/html. +; http://php.net/default-mimetype +default_mimetype = "text/html" + +; PHP's default character set is set to UTF-8. +; http://php.net/default-charset +default_charset = "UTF-8" + +; PHP internal character encoding is set to empty. +; If empty, default_charset is used. +; http://php.net/internal-encoding +;internal_encoding = + +; PHP input character encoding is set to empty. +; If empty, default_charset is used. +; http://php.net/input-encoding +;input_encoding = + +; PHP output character encoding is set to empty. +; If empty, default_charset is used. +; See also output_buffer. +; http://php.net/output-encoding +;output_encoding = + +;;;;;;;;;;;;;;;;;;;;;;;;; +; Paths and Directories ; +;;;;;;;;;;;;;;;;;;;;;;;;; + +; UNIX: "/path1:/path2" +;include_path = ".:/php/includes" +; +; Windows: "\path1;\path2" +;include_path = ".;c:\php\includes" +; +; PHP's default setting for include_path is ".;/path/to/php/pear" +; http://php.net/include-path + +; The root of the PHP pages, used only if nonempty. +; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root +; if you are running php as a CGI under any web server (other than IIS) +; see documentation for security issues. The alternate is to use the +; cgi.force_redirect configuration below +; http://php.net/doc-root +doc_root = + +; The directory under which PHP opens the script using /~username used only +; if nonempty. +; http://php.net/user-dir +user_dir = + +; Directory in which the loadable extensions (modules) reside. +; http://php.net/extension-dir +;extension_dir = "./" +; On windows: +;extension_dir = "ext" + +; Directory where the temporary files should be placed. +; Defaults to the system default (see sys_get_temp_dir) +;sys_temp_dir = "/tmp" + +; Whether or not to enable the dl() function. The dl() function does NOT work +; properly in multithreaded servers, such as IIS or Zeus, and is automatically +; disabled on them. +; http://php.net/enable-dl +enable_dl = Off + +; cgi.force_redirect is necessary to provide security running PHP as a CGI under +; most web servers. Left undefined, PHP turns this on by default. You can +; turn it off here AT YOUR OWN RISK +; **You CAN safely turn this off for IIS, in fact, you MUST.** +; http://php.net/cgi.force-redirect +;cgi.force_redirect = 1 + +; if cgi.nph is enabled it will force cgi to always sent Status: 200 with +; every request. PHP's default behavior is to disable this feature. +;cgi.nph = 1 + +; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape +; (iPlanet) web servers, you MAY need to set an environment variable name that PHP +; will look for to know it is OK to continue execution. Setting this variable MAY +; cause security issues, KNOW WHAT YOU ARE DOING FIRST. +; http://php.net/cgi.redirect-status-env +;cgi.redirect_status_env = + +; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's +; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok +; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting +; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting +; of zero causes PHP to behave as before. Default is 1. You should fix your scripts +; to use SCRIPT_FILENAME rather than PATH_TRANSLATED. +; http://php.net/cgi.fix-pathinfo +;cgi.fix_pathinfo=1 + +; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside +; of the web tree and people will not be able to circumvent .htaccess security. +;cgi.discard_path=1 + +; FastCGI under IIS supports the ability to impersonate +; security tokens of the calling client. This allows IIS to define the +; security context that the request runs under. mod_fastcgi under Apache +; does not currently support this feature (03/17/2002) +; Set to 1 if running under IIS. Default is zero. +; http://php.net/fastcgi.impersonate +;fastcgi.impersonate = 1 + +; Disable logging through FastCGI connection. PHP's default behavior is to enable +; this feature. +;fastcgi.logging = 0 + +; cgi.rfc2616_headers configuration option tells PHP what type of headers to +; use when sending HTTP response code. If set to 0, PHP sends Status: header that +; is supported by Apache. When this option is set to 1, PHP will send +; RFC2616 compliant header. +; Default is zero. +; http://php.net/cgi.rfc2616-headers +;cgi.rfc2616_headers = 0 + +; cgi.check_shebang_line controls whether CGI PHP checks for line starting with #! +; (shebang) at the top of the running script. This line might be needed if the +; script support running both as stand-alone script and via PHP CGI<. PHP in CGI +; mode skips this line and ignores its content if this directive is turned on. +; http://php.net/cgi.check-shebang-line +;cgi.check_shebang_line=1 + +;;;;;;;;;;;;;;;; +; File Uploads ; +;;;;;;;;;;;;;;;; + +; Whether to allow HTTP file uploads. +; http://php.net/file-uploads +file_uploads = On + +; Temporary directory for HTTP uploaded files (will use system default if not +; specified). +; http://php.net/upload-tmp-dir +;upload_tmp_dir = + +; Maximum allowed size for uploaded files. +; http://php.net/upload-max-filesize +upload_max_filesize = 2M + +; Maximum number of files that can be uploaded via a single request +max_file_uploads = 20 + +;;;;;;;;;;;;;;;;;; +; Fopen wrappers ; +;;;;;;;;;;;;;;;;;; + +; Whether to allow the treatment of URLs (like http:// or ftp://) as files. +; http://php.net/allow-url-fopen +allow_url_fopen = On + +; Whether to allow include/require to open URLs (like http:// or ftp://) as files. +; http://php.net/allow-url-include +allow_url_include = Off + +; Define the anonymous ftp password (your email address). PHP's default setting +; for this is empty. +; http://php.net/from +;from="john@doe.com" + +; Define the User-Agent string. PHP's default setting for this is empty. +; http://php.net/user-agent +;user_agent="PHP" + +; Default timeout for socket based streams (seconds) +; http://php.net/default-socket-timeout +default_socket_timeout = 60 + +; If your scripts have to deal with files from Macintosh systems, +; or you are running on a Mac and need to deal with files from +; unix or win32 systems, setting this flag will cause PHP to +; automatically detect the EOL character in those files so that +; fgets() and file() will work regardless of the source of the file. +; http://php.net/auto-detect-line-endings +;auto_detect_line_endings = Off + +;;;;;;;;;;;;;;;;;;;;;; +; Dynamic Extensions ; +;;;;;;;;;;;;;;;;;;;;;; + +; If you wish to have an extension loaded automatically, use the following +; syntax: +; +; extension=modulename +; +; For example: +; +; extension=mysqli +; +; When the extension library to load is not located in the default extension +; directory, You may specify an absolute path to the library file: +; +; extension=/path/to/extension/mysqli.so +; +; Note : The syntax used in previous PHP versions ('extension=.so' and +; 'extension='php_.dll') is supported for legacy reasons and may be +; deprecated in a future PHP major version. So, when it is possible, please +; move to the new ('extension=) syntax. + +;;;; +; Note: packaged extension modules are now loaded via the .ini files +; found in the directory /etc/php.d; these are loaded by default. +;;;; + +;;;;;;;;;;;;;;;;;;; +; Module Settings ; +;;;;;;;;;;;;;;;;;;; + +[CLI Server] +; Whether the CLI web server uses ANSI color coding in its terminal output. +cli_server.color = On + +[Date] +; Defines the default timezone used by the date functions +; http://php.net/date.timezone +;date.timezone = + +; http://php.net/date.default-latitude +;date.default_latitude = 31.7667 + +; http://php.net/date.default-longitude +;date.default_longitude = 35.2333 + +; http://php.net/date.sunrise-zenith +;date.sunrise_zenith = 90.833333 + +; http://php.net/date.sunset-zenith +;date.sunset_zenith = 90.833333 + +[filter] +; http://php.net/filter.default +;filter.default = unsafe_raw + +; http://php.net/filter.default-flags +;filter.default_flags = + +[iconv] +; Use of this INI entry is deprecated, use global input_encoding instead. +; If empty, default_charset or input_encoding or iconv.input_encoding is used. +; The precedence is: default_charset < input_encoding < iconv.input_encoding +;iconv.input_encoding = + +; Use of this INI entry is deprecated, use global internal_encoding instead. +; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. +; The precedence is: default_charset < internal_encoding < iconv.internal_encoding +;iconv.internal_encoding = + +; Use of this INI entry is deprecated, use global output_encoding instead. +; If empty, default_charset or output_encoding or iconv.output_encoding is used. +; The precedence is: default_charset < output_encoding < iconv.output_encoding +; To use an output encoding conversion, iconv's output handler must be set +; otherwise output encoding conversion cannot be performed. +;iconv.output_encoding = + +[imap] +; rsh/ssh logins are disabled by default. Use this INI entry if you want to +; enable them. Note that the IMAP library does not filter mailbox names before +; passing them to rsh/ssh command, thus passing untrusted data to this function +; with rsh/ssh enabled is insecure. +;imap.enable_insecure_rsh=0 + +[intl] +;intl.default_locale = +; This directive allows you to produce PHP errors when some error +; happens within intl functions. The value is the level of the error produced. +; Default is 0, which does not produce any errors. +;intl.error_level = E_WARNING +;intl.use_exceptions = 0 + +[sqlite3] +; Directory pointing to SQLite3 extensions +; http://php.net/sqlite3.extension-dir +;sqlite3.extension_dir = + +; SQLite defensive mode flag (only available from SQLite 3.26+) +; When the defensive flag is enabled, language features that allow ordinary +; SQL to deliberately corrupt the database file are disabled. This forbids +; writing directly to the schema, shadow tables (eg. FTS data tables), or +; the sqlite_dbpage virtual table. +; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html +; (for older SQLite versions, this flag has no use) +;sqlite3.defensive = 1 + +[Pcre] +; PCRE library backtracking limit. +; http://php.net/pcre.backtrack-limit +;pcre.backtrack_limit=100000 + +; PCRE library recursion limit. +; Please note that if you set this value to a high number you may consume all +; the available process stack and eventually crash PHP (due to reaching the +; stack size limit imposed by the Operating System). +; http://php.net/pcre.recursion-limit +;pcre.recursion_limit=100000 + +; Enables or disables JIT compilation of patterns. This requires the PCRE +; library to be compiled with JIT support. +pcre.jit=0 + +[Pdo] +; Whether to pool ODBC connections. Can be one of "strict", "relaxed" or "off" +; http://php.net/pdo-odbc.connection-pooling +;pdo_odbc.connection_pooling=strict + +[Pdo_mysql] +; Default socket name for local MySQL connects. If empty, uses the built-in +; MySQL defaults. +pdo_mysql.default_socket= + +[Phar] +; http://php.net/phar.readonly +;phar.readonly = On + +; http://php.net/phar.require-hash +;phar.require_hash = On + +;phar.cache_list = + +[mail function] +; For Unix only. You may supply arguments as well (default: "sendmail -t -i"). +; http://php.net/sendmail-path +sendmail_path = /usr/sbin/sendmail -t -i + +; Force the addition of the specified parameters to be passed as extra parameters +; to the sendmail binary. These parameters will always replace the value of +; the 5th parameter to mail(). +;mail.force_extra_parameters = + +; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename +mail.add_x_header = Off + +; The path to a log file that will log all mail() calls. Log entries include +; the full path of the script, line number, To address and headers. +;mail.log = +; Log mail to syslog (Event Log on Windows). +;mail.log = syslog + +[ODBC] +; http://php.net/odbc.default-db +;odbc.default_db = Not yet implemented + +; http://php.net/odbc.default-user +;odbc.default_user = Not yet implemented + +; http://php.net/odbc.default-pw +;odbc.default_pw = Not yet implemented + +; Controls the ODBC cursor model. +; Default: SQL_CURSOR_STATIC (default). +;odbc.default_cursortype + +; Allow or prevent persistent links. +; http://php.net/odbc.allow-persistent +odbc.allow_persistent = On + +; Check that a connection is still valid before reuse. +; http://php.net/odbc.check-persistent +odbc.check_persistent = On + +; Maximum number of persistent links. -1 means no limit. +; http://php.net/odbc.max-persistent +odbc.max_persistent = -1 + +; Maximum number of links (persistent + non-persistent). -1 means no limit. +; http://php.net/odbc.max-links +odbc.max_links = -1 + +; Handling of LONG fields. Returns number of bytes to variables. 0 means +; passthru. +; http://php.net/odbc.defaultlrl +odbc.defaultlrl = 4096 + +; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char. +; See the documentation on odbc_binmode and odbc_longreadlen for an explanation +; of odbc.defaultlrl and odbc.defaultbinmode +; http://php.net/odbc.defaultbinmode +odbc.defaultbinmode = 1 + +[MySQLi] + +; Maximum number of persistent links. -1 means no limit. +; http://php.net/mysqli.max-persistent +mysqli.max_persistent = -1 + +; Allow accessing, from PHP's perspective, local files with LOAD DATA statements +; http://php.net/mysqli.allow_local_infile +;mysqli.allow_local_infile = On + +; Allow or prevent persistent links. +; http://php.net/mysqli.allow-persistent +mysqli.allow_persistent = On + +; Maximum number of links. -1 means no limit. +; http://php.net/mysqli.max-links +mysqli.max_links = -1 + +; Default port number for mysqli_connect(). If unset, mysqli_connect() will use +; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the +; compile-time value defined MYSQL_PORT (in that order). Win32 will only look +; at MYSQL_PORT. +; http://php.net/mysqli.default-port +mysqli.default_port = 3306 + +; Default socket name for local MySQL connects. If empty, uses the built-in +; MySQL defaults. +; http://php.net/mysqli.default-socket +mysqli.default_socket = + +; Default host for mysqli_connect() (doesn't apply in safe mode). +; http://php.net/mysqli.default-host +mysqli.default_host = + +; Default user for mysqli_connect() (doesn't apply in safe mode). +; http://php.net/mysqli.default-user +mysqli.default_user = + +; Default password for mysqli_connect() (doesn't apply in safe mode). +; Note that this is generally a *bad* idea to store passwords in this file. +; *Any* user with PHP access can run 'echo get_cfg_var("mysqli.default_pw") +; and reveal this password! And of course, any users with read access to this +; file will be able to reveal the password as well. +; http://php.net/mysqli.default-pw +mysqli.default_pw = + +; Allow or prevent reconnect +mysqli.reconnect = Off + +[mysqlnd] +; Enable / Disable collection of general statistics by mysqlnd which can be +; used to tune and monitor MySQL operations. +mysqlnd.collect_statistics = On + +; Enable / Disable collection of memory usage statistics by mysqlnd which can be +; used to tune and monitor MySQL operations. +mysqlnd.collect_memory_statistics = Off + +; Records communication from all extensions using mysqlnd to the specified log +; file. +; http://php.net/mysqlnd.debug +;mysqlnd.debug = + +; Defines which queries will be logged. +;mysqlnd.log_mask = 0 + +; Default size of the mysqlnd memory pool, which is used by result sets. +;mysqlnd.mempool_default_size = 16000 + +; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. +;mysqlnd.net_cmd_buffer_size = 2048 + +; Size of a pre-allocated buffer used for reading data sent by the server in +; bytes. +;mysqlnd.net_read_buffer_size = 32768 + +; Timeout for network requests in seconds. +;mysqlnd.net_read_timeout = 31536000 + +; SHA-256 Authentication Plugin related. File with the MySQL server public RSA +; key. +;mysqlnd.sha256_server_public_key = + +[OCI8] +; see /etc/php.d/20-oci8.ini + +[PostgreSQL] +; Allow or prevent persistent links. +; http://php.net/pgsql.allow-persistent +pgsql.allow_persistent = On + +; Detect broken persistent links always with pg_pconnect(). +; Auto reset feature requires a little overheads. +; http://php.net/pgsql.auto-reset-persistent +pgsql.auto_reset_persistent = Off + +; Maximum number of persistent links. -1 means no limit. +; http://php.net/pgsql.max-persistent +pgsql.max_persistent = -1 + +; Maximum number of links (persistent+non persistent). -1 means no limit. +; http://php.net/pgsql.max-links +pgsql.max_links = -1 + +; Ignore PostgreSQL backends Notice message or not. +; Notice message logging require a little overheads. +; http://php.net/pgsql.ignore-notice +pgsql.ignore_notice = 0 + +; Log PostgreSQL backends Notice message or not. +; Unless pgsql.ignore_notice=0, module cannot log notice message. +; http://php.net/pgsql.log-notice +pgsql.log_notice = 0 + +[bcmath] +; Number of decimal digits for all bcmath functions. +; http://php.net/bcmath.scale +bcmath.scale = 0 + +[browscap] +; http://php.net/browscap +;browscap = extra/browscap.ini + +[Session] +; Handler used to store/retrieve data. +; http://php.net/session.save-handler +session.save_handler = files + +; Argument passed to save_handler. In the case of files, this is the path +; where data files are stored. Note: Windows users have to change this +; variable in order to use PHP's session functions. +; +; The path can be defined as: +; +; session.save_path = "N;/path" +; +; where N is an integer. Instead of storing all the session files in +; /path, what this will do is use subdirectories N-levels deep, and +; store the session data in those directories. This is useful if +; your OS has problems with many files in one directory, and is +; a more efficient layout for servers that handle many sessions. +; +; NOTE 1: PHP will not create this directory structure automatically. +; You can use the script in the ext/session dir for that purpose. +; NOTE 2: See the section on garbage collection below if you choose to +; use subdirectories for session storage +; +; The file storage module creates files using mode 600 by default. +; You can change that by using +; +; session.save_path = "N;MODE;/path" +; +; where MODE is the octal representation of the mode. Note that this +; does not overwrite the process's umask. +; http://php.net/session.save-path + +; RPM note : session directory must be owned by process owner +; for mod_php, see /etc/httpd/conf.d/php.conf +; for php-fpm, see /etc/php-fpm.d/*conf +;session.save_path = "/tmp" + +; Whether to use strict session mode. +; Strict session mode does not accept an uninitialized session ID, and +; regenerates the session ID if the browser sends an uninitialized session ID. +; Strict mode protects applications from session fixation via a session adoption +; vulnerability. It is disabled by default for maximum compatibility, but +; enabling it is encouraged. +; https://wiki.php.net/rfc/strict_sessions +session.use_strict_mode = 0 + +; Whether to use cookies. +; http://php.net/session.use-cookies +session.use_cookies = 1 + +; http://php.net/session.cookie-secure +;session.cookie_secure = + +; This option forces PHP to fetch and use a cookie for storing and maintaining +; the session id. We encourage this operation as it's very helpful in combating +; session hijacking when not specifying and managing your own session id. It is +; not the be-all and end-all of session hijacking defense, but it's a good start. +; http://php.net/session.use-only-cookies +session.use_only_cookies = 1 + +; Name of the session (used as cookie name). +; http://php.net/session.name +session.name = PHPSESSID + +; Initialize session on request startup. +; http://php.net/session.auto-start +session.auto_start = 0 + +; Lifetime in seconds of cookie or, if 0, until browser is restarted. +; http://php.net/session.cookie-lifetime +session.cookie_lifetime = 0 + +; The path for which the cookie is valid. +; http://php.net/session.cookie-path +session.cookie_path = / + +; The domain for which the cookie is valid. +; http://php.net/session.cookie-domain +session.cookie_domain = + +; Whether or not to add the httpOnly flag to the cookie, which makes it +; inaccessible to browser scripting languages such as JavaScript. +; http://php.net/session.cookie-httponly +session.cookie_httponly = + +; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) +; Current valid values are "Strict", "Lax" or "None". When using "None", +; make sure to include the quotes, as `none` is interpreted like `false` in ini files. +; https://tools.ietf.org/html/draft-west-first-party-cookies-07 +session.cookie_samesite = + +; Handler used to serialize data. php is the standard serializer of PHP. +; http://php.net/session.serialize-handler +session.serialize_handler = php + +; Defines the probability that the 'garbage collection' process is started on every +; session initialization. The probability is calculated by using gc_probability/gc_divisor, +; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. +; Default Value: 1 +; Development Value: 1 +; Production Value: 1 +; http://php.net/session.gc-probability +session.gc_probability = 1 + +; Defines the probability that the 'garbage collection' process is started on every +; session initialization. The probability is calculated by using gc_probability/gc_divisor, +; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. +; For high volume production servers, using a value of 1000 is a more efficient approach. +; Default Value: 100 +; Development Value: 1000 +; Production Value: 1000 +; http://php.net/session.gc-divisor +session.gc_divisor = 1000 + +; After this number of seconds, stored data will be seen as 'garbage' and +; cleaned up by the garbage collection process. +; http://php.net/session.gc-maxlifetime +session.gc_maxlifetime = 1440 + +; NOTE: If you are using the subdirectory option for storing session files +; (see session.save_path above), then garbage collection does *not* +; happen automatically. You will need to do your own garbage +; collection through a shell script, cron entry, or some other method. +; For example, the following script is the equivalent of setting +; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): +; find /path/to/sessions -cmin +24 -type f | xargs rm + +; Check HTTP Referer to invalidate externally stored URLs containing ids. +; HTTP_REFERER has to contain this substring for the session to be +; considered as valid. +; http://php.net/session.referer-check +session.referer_check = + +; Set to {nocache,private,public,} to determine HTTP caching aspects +; or leave this empty to avoid sending anti-caching headers. +; http://php.net/session.cache-limiter +session.cache_limiter = nocache + +; Document expires after n minutes. +; http://php.net/session.cache-expire +session.cache_expire = 180 + +; trans sid support is disabled by default. +; Use of trans sid may risk your users' security. +; Use this option with caution. +; - User may send URL contains active session ID +; to other person via. email/irc/etc. +; - URL that contains active session ID may be stored +; in publicly accessible computer. +; - User may access your site with the same session ID +; always using URL stored in browser's history or bookmarks. +; http://php.net/session.use-trans-sid +session.use_trans_sid = 0 + +; Set session ID character length. This value could be between 22 to 256. +; Shorter length than default is supported only for compatibility reason. +; Users should use 32 or more chars. +; http://php.net/session.sid-length +; Default Value: 32 +; Development Value: 26 +; Production Value: 26 +session.sid_length = 26 + +; The URL rewriter will look for URLs in a defined set of HTML tags. +;
is special; if you include them here, the rewriter will +; add a hidden field with the info which is otherwise appended +; to URLs. tag's action attribute URL will not be modified +; unless it is specified. +; Note that all valid entries require a "=", even if no value follows. +; Default Value: "a=href,area=href,frame=src,form=" +; Development Value: "a=href,area=href,frame=src,form=" +; Production Value: "a=href,area=href,frame=src,form=" +; http://php.net/url-rewriter.tags +session.trans_sid_tags = "a=href,area=href,frame=src,form=" + +; URL rewriter does not rewrite absolute URLs by default. +; To enable rewrites for absolute paths, target hosts must be specified +; at RUNTIME. i.e. use ini_set() +; tags is special. PHP will check action attribute's URL regardless +; of session.trans_sid_tags setting. +; If no host is defined, HTTP_HOST will be used for allowed host. +; Example value: php.net,www.php.net,wiki.php.net +; Use "," for multiple hosts. No spaces are allowed. +; Default Value: "" +; Development Value: "" +; Production Value: "" +;session.trans_sid_hosts="" + +; Define how many bits are stored in each character when converting +; the binary hash data to something readable. +; Possible values: +; 4 (4 bits: 0-9, a-f) +; 5 (5 bits: 0-9, a-v) +; 6 (6 bits: 0-9, a-z, A-Z, "-", ",") +; Default Value: 4 +; Development Value: 5 +; Production Value: 5 +; http://php.net/session.hash-bits-per-character +session.sid_bits_per_character = 5 + +; Enable upload progress tracking in $_SESSION +; Default Value: On +; Development Value: On +; Production Value: On +; http://php.net/session.upload-progress.enabled +;session.upload_progress.enabled = On + +; Cleanup the progress information as soon as all POST data has been read +; (i.e. upload completed). +; Default Value: On +; Development Value: On +; Production Value: On +; http://php.net/session.upload-progress.cleanup +;session.upload_progress.cleanup = On + +; A prefix used for the upload progress key in $_SESSION +; Default Value: "upload_progress_" +; Development Value: "upload_progress_" +; Production Value: "upload_progress_" +; http://php.net/session.upload-progress.prefix +;session.upload_progress.prefix = "upload_progress_" + +; The index name (concatenated with the prefix) in $_SESSION +; containing the upload progress information +; Default Value: "PHP_SESSION_UPLOAD_PROGRESS" +; Development Value: "PHP_SESSION_UPLOAD_PROGRESS" +; Production Value: "PHP_SESSION_UPLOAD_PROGRESS" +; http://php.net/session.upload-progress.name +;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" + +; How frequently the upload progress should be updated. +; Given either in percentages (per-file), or in bytes +; Default Value: "1%" +; Development Value: "1%" +; Production Value: "1%" +; http://php.net/session.upload-progress.freq +;session.upload_progress.freq = "1%" + +; The minimum delay between updates, in seconds +; Default Value: 1 +; Development Value: 1 +; Production Value: 1 +; http://php.net/session.upload-progress.min-freq +;session.upload_progress.min_freq = "1" + +; Only write session data when session data is changed. Enabled by default. +; http://php.net/session.lazy-write +;session.lazy_write = On + +[Assertion] +; Switch whether to compile assertions at all (to have no overhead at run-time) +; -1: Do not compile at all +; 0: Jump over assertion at run-time +; 1: Execute assertions +; Changing from or to a negative value is only possible in php.ini! (For turning assertions on and off at run-time, see assert.active, when zend.assertions = 1) +; Default Value: 1 +; Development Value: 1 +; Production Value: -1 +; http://php.net/zend.assertions +zend.assertions = -1 + +; Assert(expr); active by default. +; http://php.net/assert.active +;assert.active = On + +; Throw an AssertionError on failed assertions +; http://php.net/assert.exception +;assert.exception = On + +; Issue a PHP warning for each failed assertion. (Overridden by assert.exception if active) +; http://php.net/assert.warning +;assert.warning = On + +; Don't bail out by default. +; http://php.net/assert.bail +;assert.bail = Off + +; User-function to be called if an assertion fails. +; http://php.net/assert.callback +;assert.callback = 0 + +[mbstring] +; language for internal character representation. +; This affects mb_send_mail() and mbstring.detect_order. +; http://php.net/mbstring.language +;mbstring.language = Japanese + +; Use of this INI entry is deprecated, use global internal_encoding instead. +; internal/script encoding. +; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) +; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. +; The precedence is: default_charset < internal_encoding < iconv.internal_encoding +;mbstring.internal_encoding = + +; Use of this INI entry is deprecated, use global input_encoding instead. +; http input encoding. +; mbstring.encoding_translation = On is needed to use this setting. +; If empty, default_charset or input_encoding or mbstring.input is used. +; The precedence is: default_charset < input_encoding < mbstring.http_input +; http://php.net/mbstring.http-input +;mbstring.http_input = + +; Use of this INI entry is deprecated, use global output_encoding instead. +; http output encoding. +; mb_output_handler must be registered as output buffer to function. +; If empty, default_charset or output_encoding or mbstring.http_output is used. +; The precedence is: default_charset < output_encoding < mbstring.http_output +; To use an output encoding conversion, mbstring's output handler must be set +; otherwise output encoding conversion cannot be performed. +; http://php.net/mbstring.http-output +;mbstring.http_output = + +; enable automatic encoding translation according to +; mbstring.internal_encoding setting. Input chars are +; converted to internal encoding by setting this to On. +; Note: Do _not_ use automatic encoding translation for +; portable libs/applications. +; http://php.net/mbstring.encoding-translation +;mbstring.encoding_translation = Off + +; automatic encoding detection order. +; "auto" detect order is changed according to mbstring.language +; http://php.net/mbstring.detect-order +;mbstring.detect_order = auto + +; substitute_character used when character cannot be converted +; one from another +; http://php.net/mbstring.substitute-character +;mbstring.substitute_character = none + +; Enable strict encoding detection. +;mbstring.strict_detection = Off + +; This directive specifies the regex pattern of content types for which mb_output_handler() +; is activated. +; Default: mbstring.http_output_conv_mimetype=^(text/|application/xhtml\+xml) +;mbstring.http_output_conv_mimetype= + +; This directive specifies maximum stack depth for mbstring regular expressions. It is similar +; to the pcre.recursion_limit for PCRE. +;mbstring.regex_stack_limit=100000 + +; This directive specifies maximum retry count for mbstring regular expressions. It is similar +; to the pcre.backtrack_limit for PCRE. +;mbstring.regex_retry_limit=1000000 + +[gd] +; Tell the jpeg decode to ignore warnings and try to create +; a gd image. The warning will then be displayed as notices +; disabled by default +; http://php.net/gd.jpeg-ignore-warning +;gd.jpeg_ignore_warning = 1 + +[exif] +; Exif UNICODE user comments are handled as UCS-2BE/UCS-2LE and JIS as JIS. +; With mbstring support this will automatically be converted into the encoding +; given by corresponding encode setting. When empty mbstring.internal_encoding +; is used. For the decode settings you can distinguish between motorola and +; intel byte order. A decode setting cannot be empty. +; http://php.net/exif.encode-unicode +;exif.encode_unicode = ISO-8859-15 + +; http://php.net/exif.decode-unicode-motorola +;exif.decode_unicode_motorola = UCS-2BE + +; http://php.net/exif.decode-unicode-intel +;exif.decode_unicode_intel = UCS-2LE + +; http://php.net/exif.encode-jis +;exif.encode_jis = + +; http://php.net/exif.decode-jis-motorola +;exif.decode_jis_motorola = JIS + +; http://php.net/exif.decode-jis-intel +;exif.decode_jis_intel = JIS + +[Tidy] +; The path to a default tidy configuration file to use when using tidy +; http://php.net/tidy.default-config +;tidy.default_config = /usr/local/lib/php/default.tcfg + +; Should tidy clean and repair output automatically? +; WARNING: Do not use this option if you are generating non-html content +; such as dynamic images +; http://php.net/tidy.clean-output +tidy.clean_output = Off + +[soap] +; Enables or disables WSDL caching feature. +; http://php.net/soap.wsdl-cache-enabled +soap.wsdl_cache_enabled=1 + +; Sets the directory name where SOAP extension will put cache files. +; http://php.net/soap.wsdl-cache-dir + +; RPM note : cache directory must be owned by process owner +; for mod_php, see /etc/httpd/conf.d/php.conf +; for php-fpm, see /etc/php-fpm.d/*conf +soap.wsdl_cache_dir="/tmp" + +; (time to live) Sets the number of second while cached file will be used +; instead of original one. +; http://php.net/soap.wsdl-cache-ttl +soap.wsdl_cache_ttl=86400 + +; Sets the size of the cache limit. (Max. number of WSDL files to cache) +soap.wsdl_cache_limit = 5 + +[sysvshm] +; A default size of the shared memory segment +;sysvshm.init_mem = 10000 + +[ldap] +; Sets the maximum number of open links or -1 for unlimited. +ldap.max_links = -1 + +[dba] +;dba.default_handler= + +[opcache] +; see /etc/php.d/10-opcache.ini + +[curl] +; A default value for the CURLOPT_CAINFO option. This is required to be an +; absolute path. +;curl.cainfo = + +[openssl] +; The location of a Certificate Authority (CA) file on the local filesystem +; to use when verifying the identity of SSL/TLS peers. Most users should +; not specify a value for this directive as PHP will attempt to use the +; OS-managed cert stores in its absence. If specified, this value may still +; be overridden on a per-stream basis via the "cafile" SSL stream context +; option. +;openssl.cafile= + +; If openssl.cafile is not specified or if the CA file is not found, the +; directory pointed to by openssl.capath is searched for a suitable +; certificate. This value must be a correctly hashed certificate directory. +; Most users should not specify a value for this directive as PHP will +; attempt to use the OS-managed cert stores in its absence. If specified, +; this value may still be overridden on a per-stream basis via the "capath" +; SSL stream context option. +;openssl.capath= + +[ffi] +; see /etc/php.d/20-ffi.ini diff --git a/php.modconf b/php.modconf new file mode 100644 index 0000000..6f678e6 --- /dev/null +++ b/php.modconf @@ -0,0 +1,14 @@ +# +# PHP is an HTML-embedded scripting language which attempts to make it +# easy for developers to write dynamically generated webpages. +# + +# Cannot load both php5, php7 and php modules + + + + LoadModule php_module modules/libphp.so + + + + diff --git a/php.spec b/php.spec new file mode 100644 index 0000000..ea067a9 --- /dev/null +++ b/php.spec @@ -0,0 +1,3841 @@ +# remirepo spec file for php80-php +# with SCL and backport stuff, adapted from +# +# Fedora spec file for php +# +# License: MIT +# http://opensource.org/licenses/MIT +# +# Please preserve changelog entries +# +%if 0%{?scl:1} +%scl_package php +%else +%global pkg_name %{name} +%global _root_sysconfdir %{_sysconfdir} +%global _root_bindir %{_bindir} +%global _root_sbindir %{_sbindir} +%global _root_includedir %{_includedir} +%global _root_libdir %{_libdir} +%global _root_prefix %{_prefix} +%global _root_initddir %{_initddir} +%global _root_datadir %{_datadir} +%endif + +# API/ABI check +%global apiver 20200930 +%global zendver 20200930 +%global pdover 20170320 +# Extension version +%global oci8ver 3.0.1 + +# Adds -z now to the linker flags +%global _hardened_build 1 + +# version used for php embedded library soname +%global embed_version 8.0 + +# Ugly hack. Harcoded values to avoid relocation. +%global _httpd_mmn %(cat %{_root_includedir}/httpd/.mmn 2>/dev/null || echo 0) +%global _httpd_confdir %{_root_sysconfdir}/httpd/conf.d +%global _httpd_moddir %{_libdir}/httpd/modules +%global _root_httpd_moddir %{_root_libdir}/httpd/modules +# httpd 2.4 values +%global _httpd_apxs %{_root_bindir}/apxs +%global _httpd_modconfdir %{_root_sysconfdir}/httpd/conf.modules.d +%global _httpd_contentdir /usr/share/httpd + +%global macrosdir %(d=%{_rpmconfigdir}/macros.d; [ -d $d ] || d=%{_root_sysconfdir}/rpm; echo $d) + +%global mysql_sock %(mysql_config --socket 2>/dev/null || echo /var/lib/mysql/mysql.sock) + +%global oraclever 21.6 +%global oraclelib 21.1 + +# Build for LiteSpeed Web Server (LSAPI), you can disable using --without tests +%bcond_without lsws + +# Regression tests take a long time, you can skip 'em with this +%bcond_without tests + + +# Use the arch-specific mysql_config binary to avoid mismatch with the +# arch detection heuristic used by bindir/mysql_config. +%global mysql_config %{_root_libdir}/mysql/mysql_config + +# Optional extensions; to enable: pass "--with xxx" etc to rpmbuild/mock. +%bcond_with oci8 +%bcond_with zip +# Optional extensions; to disable: pass "--without xxx" etc to rpmbuild/mock. +%bcond_without imap +%bcond_without firebird +%bcond_without freetds +%bcond_without tidy +%bcond_without sqlite3 +%bcond_without enchant + +%if 0%{?fedora} >= 27 || 0%{?rhel} >= 8 +# switch to bundled library using --without libpcre +%bcond_without libpcre +%else +# switch to system library using --with libpcre +%bcond_with libpcre +%endif + +# Using qdbm from "remi" for now, see https://bugzilla.redhat.com/2017308 +%if 0%{?fedora} >= 33 || 0%{?rhel} >= 8 +%bcond_without qdbm +%else +%bcond_with qdbm +%endif + +%if 0%{?fedora} >= 33 || 0%{?rhel} >= 8 +# switch to bundled library using --without libxcrypt +%bcond_without libxcrypt +%else +# switch to system library using --with libxcrypt +%bcond_with libxcrypt +%endif + +%bcond_without dtrace + +# build with system libgd (gd-last in remi repo) +%bcond_without libgd + +# httpd 2.4.10 with httpd-filesystem and sethandler support +%if 0%{?fedora} >= 21 || 0%{?rhel} >= 8 +%global with_httpd2410 1 +%else +%global with_httpd2410 0 +%endif + +%global gh_commit 18f2ef094af2b1ad961408fbaf222b9448df2750 +%global gh_short %(c=%{gh_commit}; echo ${c:0:7}) +#global gh_date 20200615 +%global gh_owner php +%global gh_project php-src +%global upver 8.0.19 +#global rcver RC1 + +Summary: PHP scripting language for creating dynamic web sites +Name: %{?scl_prefix}php +Version: %{upver}%{?rcver:~%{rcver}}%{?gh_date:.%{gh_date}} +Release: 1%{?dist} +# All files licensed under PHP version 3.01, except +# Zend is licensed under Zend +# TSRM is licensed under BSD +# main/snprintf.c, main/spprintf.c and main/rfc1867.c are ASL 1.0 +# ext/date/lib is MIT +# Zend/zend_sort is NCSA +License: PHP and Zend and BSD and MIT and ASL 1.0 and NCSA +URL: http://www.php.net/ + +%if 0%{?gh_date} +Source0: https://github.com/%{gh_owner}/%{gh_project}/archive/%{gh_commit}/%{gh_project}-%{upver}-%{gh_short}.tar.gz +%else +Source0: http://www.php.net/distributions/php-%{upver}%{?rcver}.tar.xz +# See https://secure.php.net/gpg-keys.php +Source20: https://www.php.net/distributions/php-keyring.gpg +Source21: https://www.php.net/distributions/php-%{upver}%{?rcver}.tar.xz.asc +%endif +Source1: php.conf +Source2: php.ini +Source3: macros.php +Source4: php-fpm.conf +Source5: php-fpm-www.conf +Source6: php-fpm.service +Source7: php-fpm.logrotate +Source8: php-fpm.sysconfig +Source9: php.modconf +Source10: php.conf2 +Source12: php-fpm.wants +# Configuration files for some extensions +Source50: 10-opcache.ini +Source51: opcache-default.blacklist +Source52: 20-oci8.ini +Source53: 20-ffi.ini + +# Build fixes +Patch1: php-7.4.0-httpd.patch +Patch5: php-7.2.0-includedir.patch +Patch6: php-8.0.0-embed.patch +Patch8: php-7.4.0-libdb.patch +# get rid of deprecated functions from 8.1 +Patch9: php-8.0.6-deprecated.patch +# RHEL backports +Patch10: php-7.0.7-curl.patch + +# Functional changes +# Use system nikic/php-parser +Patch41: php-8.0.19-parser.patch +# use system tzdata +Patch42: php-8.0.10-systzdata-v21.patch +# See http://bugs.php.net/53436 +Patch43: php-7.4.0-phpize.patch +# Use -lldap_r for OpenLDAP +Patch45: php-7.4.0-ldap_r.patch +# Ignore unsupported "threads" option on password_hash +Patch46: php-8.0.7-argon2.patch +# drop "Configure command" from phpinfo output +# and only use gcc (instead of full version) +Patch47: php-8.0.0-phpinfo.patch +# add sha256 / sha512 security protocol, from 8.1 +Patch48: php-8.0.10-snmp-sha.patch +# switch phar to use sha256 signature by default, from 8.1 +# implement openssl_256 and openssl_512 for phar signatures, from 8.1 +Patch49: php-8.0.10-phar-sha.patch +# compatibility with OpenSSL 3.0, from 8.1 +Patch50: php-8.0.10-openssl3.patch +# use system libxcrypt, from 8.1 +Patch51: php-8.0.13-crypt.patch + +# RC Patch +Patch91: php-7.2.0-oci8conf.patch + +# Upstream fixes (100+) + +# Security fixes (200+) + +# Fixes for tests (300+) +# Factory is droped from system tzdata +Patch300: php-7.4.0-datetests.patch + +# WIP + +BuildRequires: gnupg2 +BuildRequires: bzip2-devel +BuildRequires: pkgconfig(libcurl) >= 7.29.0 +BuildRequires: libdb-devel +BuildRequires: httpd-devel >= 2.0.46-1 +BuildRequires: pam-devel +%if %{with_httpd2410} +# to ensure we are using httpd with filesystem feature (see #1081453) +BuildRequires: httpd-filesystem +%endif +BuildRequires: %{?dtsprefix}libstdc++-devel +# no pkgconfig to avoid compat-openssl10 +BuildRequires: openssl-devel >= 1.0.1 +BuildRequires: pkgconfig(sqlite3) >= 3.7.4 +BuildRequires: pkgconfig(zlib) >= 1.2.0.4 +BuildRequires: smtpdaemon +BuildRequires: pkgconfig(libedit) +%if %{with libpcre} +BuildRequires: pkgconfig(libpcre2-8) >= 10.30 +%else +Provides: bundled(pcre2) = 10.32 +%endif +%if %{with libxcrypt} +BuildRequires: pkgconfig(libxcrypt) +%endif +BuildRequires: bzip2 +BuildRequires: perl +BuildRequires: autoconf +BuildRequires: automake +BuildRequires: make +BuildRequires: %{?dtsprefix}gcc +BuildRequires: %{?dtsprefix}gcc-c++ +BuildRequires: libtool +BuildRequires: libtool-ltdl-devel +%if %{with dtrace} +BuildRequires: %{?dtsprefix}systemtap-sdt-devel +%endif +%if 0%{?gh_date} +BuildRequires: bison +BuildRequires: re2c +%endif +# used for tests +BuildRequires: /bin/ps + +Requires: httpd-mmn = %{_httpd_mmn} +Provides: %{?scl_prefix}mod_php = %{version}-%{release} +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +# To ensure correct /var/lib/php/session ownership: +%if %{with_httpd2410} +Requires(pre): httpd-filesystem +%else +Requires(pre): httpd +%endif + +%if 0%{?fedora} >= 27 || 0%{?rhel} >= 8 +# For backwards-compatibility, pull the "php" command +Recommends: %{?scl_prefix}php-cli%{?_isa} = %{version}-%{release} +# httpd have threaded MPM by default +Recommends: %{?scl_prefix}php-fpm%{?_isa} = %{version}-%{release} +# as "php" is now mostly a meta-package, commonly used extensions +Recommends: %{?scl_prefix}php-mbstring%{?_isa} = %{version}-%{release} +Recommends: %{?scl_prefix}php-opcache%{?_isa} = %{version}-%{release} +Recommends: %{?scl_prefix}php-pdo%{?_isa} = %{version}-%{release} +Recommends: %{?scl_prefix}php-sodium%{?_isa} = %{version}-%{release} +Recommends: %{?scl_prefix}php-xml%{?_isa} = %{version}-%{release} +%else +# For backwards-compatibility, require php-cli for the time being: +Requires: %{?scl_prefix}php-cli%{?_isa} = %{version}-%{release} +# For ARGON2 password +Requires: %{?scl_prefix}php-sodium%{?_isa} = %{version}-%{release} +%endif + + +# Don't provides extensions, or shared libraries (embedded) +%{?filter_from_requires: %filter_from_requires /libphp.*so/d} +%{?filter_provides_in: %filter_provides_in %{_libdir}/.*\.so$} +%{?filter_setup} + + +%description +PHP is an HTML-embedded scripting language. PHP attempts to make it +easy for developers to write dynamically generated web pages. PHP also +offers built-in database integration for several commercial and +non-commercial database management systems, so writing a +database-enabled webpage with PHP is fairly simple. The most common +use of PHP coding is probably as a replacement for CGI scripts. + +This package contains the module (often referred to as mod_php) +which adds support for the PHP language to system Apache HTTP Server. + + +%package cli +Summary: Command-line interface for PHP +# sapi/cli/ps_title.c is PostgreSQL +License: PHP and Zend and BSD and MIT and ASL 1.0 and NCSA and PostgreSQL +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +Provides: %{?scl_prefix}php-cgi = %{version}-%{release}, %{?scl_prefix}php-cgi%{?_isa} = %{version}-%{release} +Provides: %{?scl_prefix}php-pcntl, %{?scl_prefix}php-pcntl%{?_isa} +Provides: %{?scl_prefix}php-readline, %{?scl_prefix}php-readline%{?_isa} + +%description cli +The %{?scl_prefix}php-cli package contains the command-line interface +executing PHP scripts, %{_bindir}/php, and the CGI interface. + + +%package dbg +Summary: The interactive PHP debugger +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} + +%description dbg +The %{?scl_prefix}php-dbg package contains the interactive PHP debugger. + + +%package fpm +Summary: PHP FastCGI Process Manager +BuildRequires: libacl-devel +BuildRequires: pkgconfig(libsystemd) >= 209 +Requires(pre): %{_root_sbindir}/useradd +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +%{?systemd_requires} +# This is actually needed for the %%triggerun script but Requires(triggerun) +# is not valid. We can use %%post because this particular %%triggerun script +# should fire just after this package is installed. +Requires(post): systemd-sysv +%if %{with_httpd2410} +# To ensure correct /var/lib/php/session ownership: +Requires(pre): httpd-filesystem +# For php.conf in /etc/httpd/conf.d +# and version 2.4.10 for proxy support in SetHandler +Requires: httpd-filesystem >= 2.4.10 +%endif + +%description fpm +PHP-FPM (FastCGI Process Manager) is an alternative PHP FastCGI +implementation with some additional features useful for sites of +any size, especially busier sites. + +%if %{with lsws} +%package litespeed +Summary: LiteSpeed Web Server PHP support +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} + +%description litespeed +The %{?scl_prefix}php-litespeed package provides the %{_bindir}/lsphp command +used by the LiteSpeed Web Server (LSAPI enabled PHP). +%endif + + +%package embedded +Summary: PHP library for embedding in applications +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +# doing a real -devel package for just the .so symlink is a bit overkill +Provides: %{?scl_prefix}php-embedded-devel = %{version}-%{release} +Provides: %{?scl_prefix}php-embedded-devel%{?_isa} = %{version}-%{release} + +%description embedded +The %{?scl_prefix}php-embedded package contains a library which can be embedded +into applications to provide PHP scripting language support. + + +%package common +Summary: Common files for PHP +# All files licensed under PHP version 3.01, except +# fileinfo is licensed under PHP version 3.0 +# regex, libmagic are licensed under BSD +License: PHP and BSD +# ABI/API check - Arch specific +Provides: %{?scl_prefix}php(api) = %{apiver}-%{__isa_bits} +Provides: %{?scl_prefix}php(zend-abi) = %{zendver}-%{__isa_bits} +Provides: %{?scl_prefix}php(language) = %{version} +Provides: %{?scl_prefix}php(language)%{?_isa} = %{version} +# Provides for all builtin/shared modules: +Provides: %{?scl_prefix}php-bz2, %{?scl_prefix}php-bz2%{?_isa} +Provides: %{?scl_prefix}php-calendar, %{?scl_prefix}php-calendar%{?_isa} +Provides: %{?scl_prefix}php-core = %{version}, %{?scl_prefix}php-core%{?_isa} = %{version} +Provides: %{?scl_prefix}php-ctype, %{?scl_prefix}php-ctype%{?_isa} +Provides: %{?scl_prefix}php-curl, %{?scl_prefix}php-curl%{?_isa} +Provides: %{?scl_prefix}php-date, %{?scl_prefix}php-date%{?_isa} +Provides: bundled(timelib) +Provides: %{?scl_prefix}php-exif, %{?scl_prefix}php-exif%{?_isa} +Provides: %{?scl_prefix}php-fileinfo, %{?scl_prefix}php-fileinfo%{?_isa} +Provides: bundled(libmagic) = 5.29 +Provides: %{?scl_prefix}php-filter, %{?scl_prefix}php-filter%{?_isa} +Provides: %{?scl_prefix}php-ftp, %{?scl_prefix}php-ftp%{?_isa} +Provides: %{?scl_prefix}php-gettext, %{?scl_prefix}php-gettext%{?_isa} +Provides: %{?scl_prefix}php-hash, %{?scl_prefix}php-hash%{?_isa} +Provides: %{?scl_prefix}php-mhash = %{version}, %{?scl_prefix}php-mhash%{?_isa} = %{version} +Provides: %{?scl_prefix}php-iconv, %{?scl_prefix}php-iconv%{?_isa} +Obsoletes: %{?scl_prefix}php-json < 8.0.0 +Provides: %{?scl_prefix}php-json = %{upver}, %{?scl_prefix}php-json%{?_isa} = %{upver} +Provides: %{?scl_prefix}php-libxml, %{?scl_prefix}php-libxml%{?_isa} +Provides: %{?scl_prefix}php-openssl, %{?scl_prefix}php-openssl%{?_isa} +Provides: %{?scl_prefix}php-phar, %{?scl_prefix}php-phar%{?_isa} +Provides: %{?scl_prefix}php-pcre, %{?scl_prefix}php-pcre%{?_isa} +Provides: %{?scl_prefix}php-reflection, %{?scl_prefix}php-reflection%{?_isa} +Provides: %{?scl_prefix}php-session, %{?scl_prefix}php-session%{?_isa} +Provides: %{?scl_prefix}php-sockets, %{?scl_prefix}php-sockets%{?_isa} +Provides: %{?scl_prefix}php-spl, %{?scl_prefix}php-spl%{?_isa} +Provides: %{?scl_prefix}php-standard = %{version}, %{?scl_prefix}php-standard%{?_isa} = %{version} +Provides: %{?scl_prefix}php-tokenizer, %{?scl_prefix}php-tokenizer%{?_isa} +Provides: %{?scl_prefix}php-zlib, %{?scl_prefix}php-zlib%{?_isa} +%{?scl:Requires: %{scl}-runtime} + +%description common +The %{?scl_prefix}php-common package contains files used by both +the %{?scl_prefix}php package and the %{?scl_prefix}php-cli package. + +%package devel +Summary: Files needed for building PHP extensions +Requires: %{?scl_prefix}php-cli%{?_isa} = %{version}-%{release} +# always needed to build extension +Requires: autoconf +Requires: automake +Requires: make +Requires: gcc +Requires: gcc-c++ +Requires: libtool +# see "php-config --libs" +Requires: krb5-devel%{?_isa} +Requires: libxml2-devel%{?_isa} +Requires: openssl-devel%{?_isa} >= 1.0.1 +%if %{with libpcre} +Requires: pcre2-devel%{?_isa} >= 10.30 +%endif +Requires: zlib-devel%{?_isa} +%if 0%{?fedora} || 0%{?rhel} >= 8 +Recommends: php-nikic-php-parser4 >= 4.13.0 +%endif + +%description devel +The %{?scl_prefix}php-devel package contains the files needed for building PHP +extensions. If you need to compile your own PHP extensions, you will +need to install this package. + +%package opcache +Summary: The Zend OPcache +License: PHP +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +Provides: %{?scl_prefix}php-pecl-zendopcache = %{version} +Provides: %{?scl_prefix}php-pecl-zendopcache%{?_isa} = %{version} +Provides: %{?scl_prefix}php-pecl(opcache) = %{version} +Provides: %{?scl_prefix}php-pecl(opcache)%{?_isa} = %{version} + +%description opcache +The Zend OPcache provides faster PHP execution through opcode caching and +optimization. It improves PHP performance by storing precompiled script +bytecode in the shared memory. This eliminates the stages of reading code from +the disk and compiling it on future access. In addition, it applies a few +bytecode optimization patterns that make code execution faster. + +%if %{with imap} +%package imap +Summary: A module for PHP applications that use IMAP +# All files licensed under PHP version 3.01 +License: PHP +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +BuildRequires: pkgconfig(krb5) +BuildRequires: pkgconfig(krb5-gssapi) +BuildRequires: openssl-devel >= 1.0.1 +BuildRequires: libc-client-devel + +%description imap +The %{?scl_prefix}php-imap module will add IMAP (Internet Message Access Protocol) +support to PHP. IMAP is a protocol for retrieving and uploading e-mail +messages on mail servers. PHP is an HTML-embedded scripting language. +%endif + +%package ldap +Summary: A module for PHP applications that use LDAP +# All files licensed under PHP version 3.01 +License: PHP +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +BuildRequires: pkgconfig(libsasl2) +BuildRequires: openldap-devel +BuildRequires: openssl-devel >= 1.0.1 + +%description ldap +The %{?scl_prefix}php-ldap package adds Lightweight Directory Access Protocol (LDAP) +support to PHP. LDAP is a set of protocols for accessing directory +services over the Internet. PHP is an HTML-embedded scripting +language. + +%package pdo +Summary: A database access abstraction module for PHP applications +# All files licensed under PHP version 3.01 +License: PHP +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +# ABI/API check - Arch specific +Provides: %{?scl_prefix}php-pdo-abi = %{pdover}-%{__isa_bits} +Provides: %{?scl_prefix}php(pdo-abi) = %{pdover}-%{__isa_bits} +%if %{with sqlite3} +Provides: %{?scl_prefix}php-sqlite3, %{?scl_prefix}php-sqlite3%{?_isa} +%endif +Provides: %{?scl_prefix}php-pdo_sqlite, %{?scl_prefix}php-pdo_sqlite%{?_isa} + +%description pdo +The %{?scl_prefix}php-pdo package contains a dynamic shared object that will add +a database access abstraction layer to PHP. This module provides +a common interface for accessing MySQL, PostgreSQL or other +databases. + +%package mysqlnd +Summary: A module for PHP applications that use MySQL databases +# All files licensed under PHP version 3.01 +License: PHP +Requires: %{?scl_prefix}php-pdo%{?_isa} = %{version}-%{release} +Provides: %{?scl_prefix}php_database +Provides: %{?scl_prefix}php-mysqli = %{version}-%{release} +Provides: %{?scl_prefix}php-mysqli%{?_isa} = %{version}-%{release} +Provides: %{?scl_prefix}php-pdo_mysql, %{?scl_prefix}php-pdo_mysql%{?_isa} + +%description mysqlnd +The %{?scl_prefix}php-mysqlnd package contains a dynamic shared object that will add +MySQL database support to PHP. MySQL is an object-relational database +management system. PHP is an HTML-embeddable scripting language. If +you need MySQL support for PHP applications, you will need to install +this package and the php package. + +This package use the MySQL Native Driver + +%package pgsql +Summary: A PostgreSQL database module for PHP +# All files licensed under PHP version 3.01 +License: PHP +Requires: %{?scl_prefix}php-pdo%{?_isa} = %{version}-%{release} +Provides: %{?scl_prefix}php_database +Provides: %{?scl_prefix}php-pdo_pgsql, %{?scl_prefix}php-pdo_pgsql%{?_isa} +BuildRequires: krb5-devel +BuildRequires: openssl-devel >= 1.0.1 +BuildRequires: postgresql-devel + +%description pgsql +The %{?scl_prefix}php-pgsql package add PostgreSQL database support to PHP. +PostgreSQL is an object-relational database management +system that supports almost all SQL constructs. PHP is an +HTML-embedded scripting language. If you need back-end support for +PostgreSQL, you should install this package in addition to the main +php package. + +%package process +Summary: Modules for PHP script using system process interfaces +# All files licensed under PHP version 3.01 +License: PHP +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +Provides: %{?scl_prefix}php-posix, %{?scl_prefix}php-posix%{?_isa} +Provides: %{?scl_prefix}php-shmop, %{?scl_prefix}php-shmop%{?_isa} +Provides: %{?scl_prefix}php-sysvsem, %{?scl_prefix}php-sysvsem%{?_isa} +Provides: %{?scl_prefix}php-sysvshm, %{?scl_prefix}php-sysvshm%{?_isa} +Provides: %{?scl_prefix}php-sysvmsg, %{?scl_prefix}php-sysvmsg%{?_isa} + +%description process +The %{?scl_prefix}php-process package contains dynamic shared objects which add +support to PHP using system interfaces for inter-process +communication. + +%package odbc +Summary: A module for PHP applications that use ODBC databases +# All files licensed under PHP version 3.01, except +# pdo_odbc is licensed under PHP version 3.0 +License: PHP +Requires: %{?scl_prefix}php-pdo%{?_isa} = %{version}-%{release} +Provides: %{?scl_prefix}php_database +Provides: %{?scl_prefix}php-pdo_odbc, %{?scl_prefix}php-pdo_odbc%{?_isa} +# EL-7 version don't have pkgconfig +BuildRequires: unixODBC-devel + +%description odbc +The %{?scl_prefix}php-odbc package contains a dynamic shared object that will add +database support through ODBC to PHP. ODBC is an open specification +which provides a consistent API for developers to use for accessing +data sources (which are often, but not always, databases). PHP is an +HTML-embeddable scripting language. If you need ODBC support for PHP +applications, you will need to install this package and the php +package. + +%package soap +Summary: A module for PHP applications that use the SOAP protocol +# All files licensed under PHP version 3.01 +License: PHP +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +BuildRequires: pkgconfig(libxml-2.0) + +%description soap +The %{?scl_prefix}php-soap package contains a dynamic shared object that will add +support to PHP for using the SOAP web services protocol. + +%if %{with firebird} +%package pdo-firebird +Summary: PDO driver for Interbase/Firebird databases +# All files licensed under PHP version 3.01 +License: PHP +BuildRequires: firebird-devel +Requires: %{?scl_prefix}php-pdo%{?_isa} = %{version}-%{release} +Provides: %{?scl_prefix}php_database +Provides: %{?scl_prefix}php-pdo_firebird, %{?scl_prefix}php-pdo_firebird%{?_isa} + +%description pdo-firebird +The %{?scl_prefix}php-pdo-firebird package contains the PDO driver for +Interbase/Firebird databases. + + +InterBase is the name of the closed-source variant of this RDBMS that was +developed by Borland/Inprise. + +Firebird is a commercially independent project of C and C++ programmers, +technical advisors and supporters developing and enhancing a multi-platform +relational database management system based on the source code released by +Inprise Corp (now known as Borland Software Corp) under the InterBase Public +License. +%endif + +%if %{with oci8} +%package oci8 +Summary: A module for PHP applications that use OCI8 databases +# All files licensed under PHP version 3.01 +License: PHP +BuildRequires: oracle-instantclient-devel >= %{oraclever} +Requires: %{?scl_prefix}php-pdo%{?_isa} = %{version}-%{release} +Provides: %{?scl_prefix}php_database +Provides: %{?scl_prefix}php-pdo_oci +Provides: %{?scl_prefix}php-pdo_oci%{?_isa} +Obsoletes: %{?scl_prefix}php-pecl-oci8 <= %{oci8ver} +Conflicts: %{?scl_prefix}php-pecl-oci8 > %{oci8ver} +Provides: %{?scl_prefix}php-pecl(oci8) = %{oci8ver} +Provides: %{?scl_prefix}php-pecl(oci8)%{?_isa} = %{oci8ver} +# Should requires libclntsh.so.18.3, but it's not provided by Oracle RPM. +AutoReq: 0 + +%description oci8 +The %{?scl_prefix}php-oci8 packages provides the OCI8 extension version %{oci8ver} +and the PDO driver to access Oracle Database. + +The extension is linked with Oracle client libraries %{oraclever} +(Oracle Instant Client). For details, see Oracle's note +"Oracle Client / Server Interoperability Support" (ID 207303.1). + +You must install libclntsh.so.%{oraclelib} to use this package, provided +in the database installation, or in the free Oracle Instant Client +available from Oracle. + +Notice: +- %{?scl_prefix}php-oci8 provides oci8 and pdo_oci extensions from php sources. +- %{?scl_prefix}php-pecl-oci8 only provides oci8 extension. + +Documentation is at http://php.net/oci8 and http://php.net/pdo_oci +%endif + +%package snmp +Summary: A module for PHP applications that query SNMP-managed devices +# All files licensed under PHP version 3.01 +License: PHP +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release}, net-snmp +BuildRequires: net-snmp-devel + +%description snmp +The %{?scl_prefix}php-snmp package contains a dynamic shared object that will add +support for querying SNMP devices to PHP. PHP is an HTML-embeddable +scripting language. If you need SNMP support for PHP applications, you +will need to install this package and the php package. + +%package xml +Summary: A module for PHP applications which use XML +# All files licensed under PHP version 3.01 +License: PHP +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +Provides: %{?scl_prefix}php-dom, %{?scl_prefix}php-dom%{?_isa} +Provides: %{?scl_prefix}php-domxml, %{?scl_prefix}php-domxml%{?_isa} +Provides: %{?scl_prefix}php-simplexml, %{?scl_prefix}php-simplexml%{?_isa} +Provides: %{?scl_prefix}php-xmlreader, %{?scl_prefix}php-xmlreader%{?_isa} +Provides: %{?scl_prefix}php-xmlwriter, %{?scl_prefix}php-xmlwriter%{?_isa} +Provides: %{?scl_prefix}php-xsl, %{?scl_prefix}php-xsl%{?_isa} +BuildRequires: pkgconfig(libxslt) >= 1.1 +BuildRequires: pkgconfig(libexslt) +BuildRequires: pkgconfig(libxml-2.0) >= 2.7.6 + +%description xml +The %{?scl_prefix}php-xml package contains dynamic shared objects which add support +to PHP for manipulating XML documents using the DOM tree, +and performing XSL transformations on XML documents. + +%package mbstring +Summary: A module for PHP applications which need multi-byte string handling +# All files licensed under PHP version 3.01, except +# libmbfl is licensed under LGPLv2 +# onigurama is licensed under BSD +# ucgendat is licensed under OpenLDAP +License: PHP and LGPLv2 and BSD and OpenLDAP +%if 0%{?rhel} +BuildRequires: oniguruma5php-devel +%else +BuildRequires: oniguruma-devel +%endif +Provides: bundled(libmbfl) = 1.3.2 +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} + +%description mbstring +The %{?scl_prefix}php-mbstring package contains a dynamic shared object that will add +support for multi-byte string handling to PHP. + +%package gd +Summary: A module for PHP applications for using the gd graphics library +# All files licensed under PHP version 3.01 +%if %{with libgd} +License: PHP +%else +# bundled libgd is licensed under BSD +License: PHP and BSD +%endif +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +%if %{with libgd} +BuildRequires: pkgconfig(gdlib) >= 2.3.3 +%else +# Required to build the bundled GD library +BuildRequires: pkgconfig(zlib) +BuildRequires: pkgconfig(libjpeg) +BuildRequires: pkgconfig(libpng) +BuildRequires: pkgconfig(freetype2) +BuildRequires: pkgconfig(xpm) +BuildRequires: pkgconfig(libwebp) +Provides: bundled(gd) = 2.0.35 +%endif + +%description gd +The %{?scl_prefix}php-gd package contains a dynamic shared object that will add +support for using the gd graphics library to PHP. + +%package bcmath +Summary: A module for PHP applications for using the bcmath library +# All files licensed under PHP version 3.01, except +# libbcmath is licensed under LGPLv2+ +License: PHP and LGPLv2+ +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +Provides: bundled(libbcmath) + +%description bcmath +The %{?scl_prefix}php-bcmath package contains a dynamic shared object that will add +support for using the bcmath library to PHP. + +%package gmp +Summary: A module for PHP applications for using the GNU MP library +# All files licensed under PHP version 3.01 +License: PHP +BuildRequires: gmp-devel +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} + +%description gmp +These functions allow you to work with arbitrary-length integers +using the GNU MP library. + +%package dba +Summary: A database abstraction layer module for PHP applications +# All files licensed under PHP version 3.01 +License: PHP +BuildRequires: libdb-devel +BuildRequires: tokyocabinet-devel +BuildRequires: lmdb-devel +%if %{with qdbm} +BuildRequires: qdbm-devel +%endif +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} + +%description dba +The %{?scl_prefix}php-dba package contains a dynamic shared object that will add +support for using the DBA database abstraction layer to PHP. + +%if %{with tidy} +%package tidy +Summary: Standard PHP module provides tidy library support +# All files licensed under PHP version 3.01 +License: PHP +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +BuildRequires: libtidy-devel + +%description tidy +The %{?scl_prefix}php-tidy package contains a dynamic shared object that will add +support for using the tidy library to PHP. +%endif + +%if %{with freetds} +%package pdo-dblib +Summary: PDO driver for Microsoft SQL Server and Sybase databases +# All files licensed under PHP version 3.01 +License: PHP +Requires: %{?scl_prefix}php-pdo%{?_isa} = %{version}-%{release} +BuildRequires: freetds-devel +Provides: %{?scl_prefix}php-pdo_dblib, %{?scl_prefix}php-pdo_dblib%{?_isa} + +%description pdo-dblib +The %{?scl_prefix}php-pdo-dblib package contains a dynamic shared object +that implements the PHP Data Objects (PDO) interface to enable access from +PHP to Microsoft SQL Server and Sybase databases through the FreeTDS library. +%endif + +%package pspell +Summary: A module for PHP applications for using pspell interfaces +# All files licensed under PHP version 3.01 +License: PHP +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +BuildRequires: aspell-devel >= 0.50.0 + +%description pspell +The %{?scl_prefix}php-pspell package contains a dynamic shared object that will add +support for using the pspell library to PHP. + +%package intl +Summary: Internationalization extension for PHP applications +# All files licensed under PHP version 3.01 +License: PHP +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +BuildRequires: pkgconfig(icu-i18n) >= 69 +BuildRequires: pkgconfig(icu-io) >= 69 +BuildRequires: pkgconfig(icu-uc) >= 69 + +%description intl +The %{?scl_prefix}php-intl package contains a dynamic shared object that will add +support for using the ICU library to PHP. + +%if %{with enchant} +%package enchant +Summary: Enchant spelling extension for PHP applications +# All files licensed under PHP version 3.0 +License: PHP +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +BuildRequires: pkgconfig(enchant-2) + +%description enchant +The %{?scl_prefix}php-enchant package contains a dynamic shared object that will add +support for using the enchant library to PHP. +%endif + +%if %{with zip} +%package zip +Summary: ZIP archive management extension for PHP +# All files licensed under PHP version 3.0.1 +License: PHP +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +BuildRequires: pkgconfig(libzip) >= 0.11 + +%description zip +The %{?scl_prefix}php-zip package provides an extension that will add +support for ZIP archive management to PHP. +%endif + + +%package sodium +Summary: Wrapper for the Sodium cryptographic library +# All files licensed under PHP version 3.0.1 +License: PHP +# Minimal is 1.0.8, 1.0.14 is needed for argon2 password +BuildRequires: pkgconfig(libsodium) >= 1.0.14 + +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} +Obsoletes: %{?scl_prefix}php-pecl-libsodium2 < 3 +Provides: %{?scl_prefix}php-pecl(libsodium) = %{version} +Provides: %{?scl_prefix}php-pecl(libsodium)%{?_isa} = %{version} + +%description sodium +The %{?scl_prefix}php-sodium package provides a simple, +low-level PHP extension for the libsodium cryptographic library. + + +%package ffi +Summary: Foreign Function Interface +# All files licensed under PHP version 3.0.1 +License: PHP +BuildRequires: pkgconfig(libffi) + +Requires: %{?scl_prefix}php-common%{?_isa} = %{version}-%{release} + +%description ffi +FFI is one of the features that made Python and LuaJIT very useful for fast +prototyping. It allows calling C functions and using C data types from pure +scripting language and therefore develop “system code” more productively. + +For PHP, FFI opens a way to write PHP extensions and bindings to C libraries +in pure PHP. + + +%prep +: Building %{name}-%{version}-%{release} +%if %{with lsws} +: With Litespeed SAPI +%endif +%if %{with oci8} +: With Oracle extensions +%endif +%if %{with enchant} +: With Enchant extensions +%endif +%if %{with imap} +: With Imap extensions +%endif +%if %{with firebird} +: With pdo_firebird extension +%endif +%if %{with freetds} +: With pdo_dblib extension +%endif +%if %{with sqlite3} +: With Sqlite3 extension +%endif +%if %{with tidy} +: With Tidy extension +%endif +%if %{with zip} +: With Zip extension +%endif +%if %{with tests} +: Run Test suite +%endif +%if %{with libgd} +: Use System libgd +%else +: Use Bundled libgd +%endif +%if %{with libpcre} +: Use System libpcre +%else +: Use Bundled libpcre +%endif +%if %{with dtrace} +: Enable Dtrace build +%endif + +%if 0%{?gh_date} +: no gpg check for git snapshot +%else +%{?gpgverify:%{gpgverify} --keyring='%{SOURCE20}' --signature='%{SOURCE21}' --data='%{SOURCE0}'} +%endif + +%if 0%{?gh_date} +%setup -q -n %{gh_project}-%{gh_commit} +%else +%setup -q -n php-%{upver}%{?rcver} +%endif + +%patch1 -p1 -b .mpmcheck +%patch5 -p1 -b .includedir +%patch6 -p1 -b .embed +%patch8 -p1 -b .libdb +%patch9 -p1 -b .deprecated +%if 0%{?rhel} +%patch10 -p1 -b .curltls +%endif + +%patch41 -p1 -b .syslib +%if 0%{?fedora} >= 30 || 0%{?rhel} >= 6 +%patch42 -p1 -b .systzdata +%endif +%patch43 -p1 -b .headers +sed -e 's/php-devel/%{?scl_prefix}php-devel/' -i scripts/phpize.in +%if 0%{?fedora} >= 18 || 0%{?rhel} >= 7 +%patch45 -p1 -b .ldap_r +%endif +%patch46 -p1 -b .argon2 +%patch47 -p1 -b .phpinfo +%patch48 -p1 -b .sha +%patch49 -p1 -b .pharsha +%if 0%{?fedora} >= 36 || 0%{?rhel} >= 9 +%patch50 -p1 -b .openssl3 +rm ext/openssl/tests/p12_with_extra_certs.p12 +%endif +%patch51 -p1 -b .libxcrypt + +%patch91 -p1 -b .remi-oci8 + +# upstream patches + +# security patches + +# Fixes for tests +%patch300 -p1 -b .datetests + +# WIP patch + +# Prevent %%doc confusion over LICENSE files +cp Zend/LICENSE ZEND_LICENSE +cp TSRM/LICENSE TSRM_LICENSE +cp sapi/fpm/LICENSE fpm_LICENSE +cp ext/mbstring/libmbfl/LICENSE libmbfl_LICENSE +cp ext/fileinfo/libmagic/LICENSE libmagic_LICENSE +cp ext/bcmath/libbcmath/LICENSE libbcmath_LICENSE +cp ext/date/lib/LICENSE.rst timelib_LICENSE + +# Multiple builds for multiple SAPIs +mkdir \ + build-fpm \ + build-apache \ + build-embedded \ + build-cgi + +# ----- Manage known as failed test ------- +# affected by systzdata patch +rm ext/date/tests/timezone_location_get.phpt +%if 0%{?fedora} < 28 +# need tzdata 2018i +rm ext/date/tests/bug33414-1.phpt +rm ext/date/tests/bug33415-2.phpt +rm ext/date/tests/date_modify-1.phpt +%endif +# too fast builder +rm ext/date/tests/bug73837.phpt +# fails sometime +rm ext/sockets/tests/mcast_ipv?_recv.phpt +# Should be skipped but fails sometime +rm ext/standard/tests/file/file_get_contents_error001.phpt +# cause stack exhausion +rm Zend/tests/bug54268.phpt +rm Zend/tests/bug68412.phpt +# slow and erratic result +rm sapi/cli/tests/upload_2G.phpt +# tar issue +rm ext/zlib/tests/004-mb.phpt + +# Safety check for API version change. +pver=$(sed -n '/#define PHP_VERSION /{s/.* "//;s/".*$//;p}' main/php_version.h) +if test "x${pver}" != "x%{upver}%{?rcver}%{!?rcver:%{?gh_date:-dev}}"; then + : Error: Upstream PHP version is now ${upver}, expecting %{upver}%{?rcver}%{!?rcver:%{?gh_date:-dev}}. + : Update the version/rcver macros and rebuild. + exit 1 +fi + +vapi=`sed -n '/#define PHP_API_VERSION/{s/.* //;p}' main/php.h` +if test "x${vapi}" != "x%{apiver}"; then + : Error: Upstream API version is now ${vapi}, expecting %{apiver}. + : Update the apiver macro and rebuild. + exit 1 +fi + +vzend=`sed -n '/#define ZEND_MODULE_API_NO/{s/^[^0-9]*//;p;}' Zend/zend_modules.h` +if test "x${vzend}" != "x%{zendver}"; then + : Error: Upstream Zend ABI version is now ${vzend}, expecting %{zendver}. + : Update the zendver macro and rebuild. + exit 1 +fi + +# Safety check for PDO ABI version change +vpdo=`sed -n '/#define PDO_DRIVER_API/{s/.*[ ]//;p}' ext/pdo/php_pdo_driver.h` +if test "x${vpdo}" != "x%{pdover}"; then + : Error: Upstream PDO ABI version is now ${vpdo}, expecting %{pdover}. + : Update the pdover macro and rebuild. + exit 1 +fi + +# Check for some extension version +ver=$(sed -n '/#define PHP_OCI8_VERSION /{s/.* "//;s/".*$//;p}' ext/oci8/php_oci8.h) +if test "$ver" != "%{oci8ver}"; then + : Error: Upstream OCI8 version is now ${ver}, expecting %{oci8ver}. + : Update the oci8ver macro and rebuild. + exit 1 +fi + +# https://bugs.php.net/63362 - Not needed but installed headers. +# Drop some Windows specific headers to avoid installation, +# before build to ensure they are really not needed. +rm -f TSRM/tsrm_win32.h \ + TSRM/tsrm_config.w32.h \ + Zend/zend_config.w32.h \ + ext/mysqlnd/config-win.h \ + ext/standard/winver.h \ + main/win32_internal_function_disabled.h \ + main/win95nt.h + +# Fix some bogus permissions +find . -name \*.[ch] -exec chmod 644 {} \; +chmod 644 README.* + +# Create the macros.php files +sed -e "s/@PHP_APIVER@/%{apiver}-%{__isa_bits}/" \ + -e "s/@PHP_ZENDVER@/%{zendver}-%{__isa_bits}/" \ + -e "s/@PHP_PDOVER@/%{pdover}-%{__isa_bits}/" \ + -e "s/@PHP_VERSION@/%{upver}/" \ + -e "s:@LIBDIR@:%{_libdir}:" \ + -e "s:@ETCDIR@:%{_sysconfdir}:" \ + -e "s:@INCDIR@:%{_includedir}:" \ + -e "s:@BINDIR@:%{_bindir}:" \ + -e "s:@SCL@:%{?scl:%{scl}_}:" \ + %{SOURCE3} | tee macros.php +%if 0%{?fedora} >= 24 || 0%{?rhel} >= 8 +echo '%%%{?scl:%{scl}_}pecl_xmldir %{_localstatedir}/lib/php/peclxml' | tee -a macros.php +%endif + +# Some extensions have their own configuration file +cp %{SOURCE50} %{SOURCE51} %{SOURCE52} %{SOURCE53} . + +sed -e 's:%{_root_sysconfdir}:%{_sysconfdir}:' \ + -i 10-opcache.ini +sed -e 's:%{_root_datadir}:%{_datadir}:' \ + -i 20-ffi.ini + +%if 0%{!?scl:1} +: SCL macro not defined +exit 1 +%endif + + +%build +# This package fails to build with LTO due to undefined symbols. LTO +# was disabled in OpenSuSE as well, but with no real explanation why +# beyond the undefined symbols. It really shold be investigated further. +# Disable LTO +%define _lto_cflags %{nil} + +%{?dtsenable} + +# Set build date from https://reproducible-builds.org/specs/source-date-epoch/ +export SOURCE_DATE_EPOCH=$(date +%s -r NEWS) +export PHP_UNAME=$(uname) +export PHP_BUILD_SYSTEM=$(cat /etc/redhat-release | sed -e 's/ Beta//') +%if 0%{?vendor:1} +export PHP_BUILD_PROVIDER="%{vendor}" +%endif +export PHP_BUILD_COMPILER="$(gcc --version | head -n1)" +export PHP_BUILD_ARCH="%{_arch}" + +# Force use of system libtool: +libtoolize --force --copy +cat $(aclocal --print-ac-dir)/{libtool,ltoptions,ltsugar,ltversion,lt~obsolete}.m4 >build/libtool.m4 + +%if 0%{?gh_date} +# Bison files +scripts/dev/genfiles +%endif + +# Regenerate configure scripts (patches change config.m4's) +touch configure.ac +./buildconf --force + +CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing -Wno-pointer-sign" +export CFLAGS + +# Install extension modules in %{_libdir}/php/modules. +EXTENSION_DIR=%{_libdir}/php/modules; export EXTENSION_DIR + +# Set PEAR_INSTALLDIR to ensure that the hard-coded include_path +# includes the PEAR directory even though pear is packaged +# separately. +PEAR_INSTALLDIR=%{_datadir}/pear; export PEAR_INSTALLDIR + +# Shell function to configure and build a PHP tree. +build() { +# Old/recent bison version seems to produce a broken parser; +# upstream uses GNU Bison 2.3. Workaround: +mkdir Zend && cp ../Zend/zend_{language,ini}_{parser,scanner}.[ch] Zend + +# Always static: +# date, filter, libxml, reflection, spl: not supported +# hash: for PHAR_SIG_SHA256 and PHAR_SIG_SHA512 +# session: dep on hash, used by soap +# pcre: used by filter, zip +# pcntl, readline: only used by CLI sapi +# openssl: for PHAR_SIG_OPENSSL +# zlib: used by image + +ln -sf ../configure +%configure \ + --enable-rtld-now \ + --cache-file=../config.cache \ + --with-libdir=%{_lib} \ + --with-config-file-path=%{_sysconfdir} \ + --with-config-file-scan-dir=%{_sysconfdir}/php.d \ + --disable-debug \ + --with-pic \ + --disable-rpath \ + --without-pear \ + --with-exec-dir=%{_bindir} \ + --without-gdbm \ + --with-openssl \ + --with-system-ciphers \ +%if %{with libpcre} + --with-external-pcre \ +%endif +%if %{with libxcrypt} + --with-external-libcrypt \ +%endif + --with-zlib \ + --with-layout=GNU \ + --with-kerberos \ + --with-libxml \ +%if 0%{?fedora} >= 28 || 0%{?rhel} >= 6 + --with-system-tzdata \ +%endif + --with-mhash \ + --without-password-argon2 \ +%if %{with dtrace} + --enable-dtrace \ +%endif + $* +if test $? != 0; then + tail -500 config.log + : configure failed + exit 1 +fi + +make %{?_smp_mflags} +} + +# Build /usr/bin/php-cgi with the CGI SAPI, and most the shared extensions +pushd build-cgi + +build --libdir=%{_libdir}/php \ + --enable-pcntl \ + --enable-opcache \ + --enable-opcache-file \ + --enable-phpdbg \ +%if %{with imap} + --with-imap=shared --with-imap-ssl \ +%endif + --enable-mbstring=shared \ + --enable-mbregex \ + --enable-gd=shared \ +%if %{with libgd} + --with-external-gd \ +%else + --with-webp \ + --with-jpeg \ + --with-xpm \ + --with-freetype \ +%endif + --with-gmp=shared \ + --enable-calendar=shared \ + --enable-bcmath=shared \ + --with-bz2=shared \ + --enable-ctype=shared \ + --enable-dba=shared --with-db4=%{_root_prefix} \ + --with-tcadb=%{_root_prefix} \ + --with-lmdb=%{_root_prefix} \ +%if %{with qdbm} + --with-qdbm=%{_root_prefix} \ +%endif + --enable-exif=shared \ + --enable-ftp=shared \ + --with-gettext=shared \ + --with-iconv=shared \ + --enable-sockets=shared \ + --enable-tokenizer=shared \ + --with-ldap=shared --with-ldap-sasl \ + --enable-mysqlnd=shared \ + --with-mysqli=shared,mysqlnd \ + --with-mysql-sock=%{mysql_sock} \ +%if %{with oci8} + --with-oci8=shared,instantclient,%{_root_libdir}/oracle/%{oraclever}/client64/lib,%{oraclever} \ + --with-pdo-oci=shared,instantclient,%{_root_libdir}/oracle/%{oraclever}/client64/lib,%{oraclever} \ +%endif +%if %{with firebird} + --with-pdo-firebird=shared \ +%endif + --enable-dom=shared \ + --with-pgsql=shared \ + --enable-simplexml=shared \ + --enable-xml=shared \ + --with-snmp=shared,%{_root_prefix} \ + --enable-soap=shared \ + --with-xsl=shared,%{_root_prefix} \ + --enable-xmlreader=shared --enable-xmlwriter=shared \ + --with-curl=shared \ + --enable-pdo=shared \ + --with-pdo-odbc=shared,unixODBC,%{_root_prefix} \ + --with-pdo-mysql=shared,mysqlnd \ + --with-pdo-pgsql=shared,%{_root_prefix} \ + --with-pdo-sqlite=shared \ +%if %{with sqlite3} + --with-sqlite3=shared \ +%else + --without-sqlite3 \ +%endif +%if %{with zip} + --with-zip=shared \ +%endif + --without-readline \ + --with-libedit \ + --with-pspell=shared \ + --enable-phar=shared \ +%if %{with tidy} + --with-tidy=shared,%{_root_prefix} \ +%endif +%if %{with freetds} + --with-pdo-dblib=shared,%{_root_prefix} \ +%endif + --enable-sysvmsg=shared --enable-sysvshm=shared --enable-sysvsem=shared \ + --enable-shmop=shared \ + --enable-posix=shared \ + --with-unixODBC=shared,%{_root_prefix} \ + --enable-intl=shared \ +%if %{with enchant} + --with-enchant=shared \ +%endif + --enable-fileinfo=shared \ + --with-ffi=shared \ + --with-sodium=shared +popd + +without_shared="--disable-gd \ + --disable-dom --disable-dba --without-unixODBC \ + --disable-opcache \ + --disable-phpdbg \ + --without-ffi \ + --disable-xmlreader --disable-xmlwriter \ + --without-sodium \ + --without-sqlite3 --disable-phar --disable-fileinfo \ + --without-pspell \ + --without-curl --disable-posix --disable-xml \ + --disable-simplexml --disable-exif --without-gettext \ + --without-iconv --disable-ftp --without-bz2 --disable-ctype \ + --disable-shmop --disable-sockets --disable-tokenizer \ + --disable-sysvmsg --disable-sysvshm --disable-sysvsem" + +# Build Apache module, and the CLI SAPI, /usr/bin/php +pushd build-apache +build --with-apxs2=%{_httpd_apxs} \ + --libdir=%{_libdir}/php \ +%if %{with lsws} + --enable-litespeed \ +%endif + --without-mysqli \ + --disable-pdo \ + ${without_shared} +popd + +# Build php-fpm +pushd build-fpm +build --enable-fpm \ + --with-fpm-systemd \ + --with-fpm-acl \ + --libdir=%{_libdir}/php \ + --without-mysqli \ + --disable-pdo \ + ${without_shared} +popd + +# Build for inclusion as embedded script language into applications, +# /usr/lib[64]/libphp.so +pushd build-embedded +build --enable-embed \ + --without-mysqli \ + --disable-pdo \ + ${without_shared} +popd + + +%check +%if %{with tests} +cd build-fpm + +# Run tests, using the CLI SAPI +export NO_INTERACTION=1 REPORT_EXIT_STATUS=1 MALLOC_CHECK_=2 +export SKIP_ONLINE_TESTS=1 +export SKIP_IO_CAPTURE_TESTS=1 +unset TZ LANG LC_ALL +if ! make test TESTS=-j4; then + set +x + for f in $(find .. -name \*.diff -type f -print); do + if ! grep -q XFAIL "${f/.diff/.phpt}" + then + echo "TEST FAILURE: $f --" + head -n 100 "$f" + echo -e "\n-- $f result ends." + fi + done + set -x + #exit 1 +fi +unset NO_INTERACTION REPORT_EXIT_STATUS MALLOC_CHECK_ +%endif + + +%install +%{?dtsenable} + +# Install the version for embedded script language in applications + php_embed.h +make -C build-embedded install-sapi install-headers \ + INSTALL_ROOT=$RPM_BUILD_ROOT + +# Install the php-fpm binary +make -C build-fpm install-fpm \ + INSTALL_ROOT=$RPM_BUILD_ROOT + +# Install everything from the CGI SAPI build +make -C build-cgi install \ + INSTALL_ROOT=$RPM_BUILD_ROOT + +# Use php-config from embed SAPI to reduce used libs +install -m 755 build-embedded/scripts/php-config $RPM_BUILD_ROOT%{_bindir}/php-config + +# Install the default configuration file +install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/ +install -m 644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/php.ini +sed -e 's:%{_root_sysconfdir}:%{_sysconfdir}:' \ + -i $RPM_BUILD_ROOT%{_sysconfdir}/php.ini + +# For third-party packaging: +install -m 755 -d $RPM_BUILD_ROOT%{_datadir}/php/preload + +# install the DSO +install -m 755 -d $RPM_BUILD_ROOT%{_httpd_moddir} +install -m 755 build-apache/libs/libphp.so $RPM_BUILD_ROOT%{_httpd_moddir} + +# Apache config fragment +%if %{?scl:1}0 +sed -e 's/libphp/lib%{scl}/' %{SOURCE9} >modconf +install -m 755 -d $RPM_BUILD_ROOT%{_root_httpd_moddir} +ln -s %{_httpd_moddir}/libphp.so $RPM_BUILD_ROOT%{_root_httpd_moddir}/lib%{scl}.so +%else +cp %{SOURCE9} modconf +%endif + +# Dual config file with httpd >= 2.4 (RHEL >= 7) +install -D -m 644 modconf $RPM_BUILD_ROOT%{_httpd_modconfdir}/20-%{name}.conf +install -D -m 644 %{SOURCE1} $RPM_BUILD_ROOT%{_httpd_confdir}/%{name}.conf +%if %{with_httpd2410} +cat %{SOURCE10} >>$RPM_BUILD_ROOT%{_httpd_confdir}/%{name}.conf +%endif + +sed -e 's:/var/lib:%{_localstatedir}/lib:' \ + -i $RPM_BUILD_ROOT%{_httpd_confdir}/%{name}.conf + +install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/php.d +install -m 755 -d $RPM_BUILD_ROOT%{_localstatedir}/lib/php +install -m 700 -d $RPM_BUILD_ROOT%{_localstatedir}/lib/php/session +install -m 700 -d $RPM_BUILD_ROOT%{_localstatedir}/lib/php/wsdlcache +install -m 700 -d $RPM_BUILD_ROOT%{_localstatedir}/lib/php/opcache +%if 0%{?fedora} >= 24 || 0%{?rhel} >= 8 +install -m 755 -d $RPM_BUILD_ROOT%{_localstatedir}/lib/php/peclxml +install -m 755 -d $RPM_BUILD_ROOT%{_docdir}/pecl +install -m 755 -d $RPM_BUILD_ROOT%{_datadir}/tests/pecl +%endif + +%if %{with lsws} +install -m 755 build-apache/sapi/litespeed/php $RPM_BUILD_ROOT%{_bindir}/lsphp +%endif + +# PHP-FPM stuff +# Log +install -m 755 -d $RPM_BUILD_ROOT%{_localstatedir}/log/php-fpm +install -m 755 -d $RPM_BUILD_ROOT%{_localstatedir}/run/php-fpm +# Config +install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/php-fpm.d +install -m 644 %{SOURCE4} $RPM_BUILD_ROOT%{_sysconfdir}/php-fpm.conf +sed -e 's:/run:%{_localstatedir}/run:' \ + -e 's:/var/log:%{_localstatedir}/log:' \ + -e 's:/etc:%{_sysconfdir}:' \ + -i $RPM_BUILD_ROOT%{_sysconfdir}/php-fpm.conf +install -m 644 %{SOURCE5} $RPM_BUILD_ROOT%{_sysconfdir}/php-fpm.d/www.conf +sed -e 's:/var/lib:%{_localstatedir}/lib:' \ + -e 's:/var/log:%{_localstatedir}/log:' \ + -i $RPM_BUILD_ROOT%{_sysconfdir}/php-fpm.d/www.conf +mv $RPM_BUILD_ROOT%{_sysconfdir}/php-fpm.conf.default . +mv $RPM_BUILD_ROOT%{_sysconfdir}/php-fpm.d/www.conf.default . +# tmpfiles.d +# install -m 755 -d $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d +# install -m 644 php-fpm.tmpfiles $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d/php-fpm.conf +# install systemd unit files and scripts for handling server startup +install -Dm 644 %{SOURCE6} $RPM_BUILD_ROOT%{_unitdir}/%{?scl_prefix}php-fpm.service +%if 0%{?fedora} >= 27 || 0%{?rhel} >= 8 +install -Dm 644 %{SOURCE12} $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d/%{?scl_prefix}php-fpm.conf +install -Dm 644 %{SOURCE12} $RPM_BUILD_ROOT%{_unitdir}/nginx.service.d/%{?scl_prefix}php-fpm.conf +sed -e 's/php-fpm/%{?scl_prefix}php-fpm/' -i $RPM_BUILD_ROOT%{_unitdir}/*.service.d/%{?scl_prefix}php-fpm.conf +%endif +sed -e 's:/run:%{_localstatedir}/run:' \ + -e 's:/etc/sysconfig:%{_sysconfdir}/sysconfig:' \ + -e 's:php-fpm.service:%{?scl_prefix}php-fpm.service:' \ + -e 's:/usr/sbin:%{_sbindir}:' \ + -i $RPM_BUILD_ROOT%{_unitdir}/%{?scl_prefix}php-fpm.service +# this folder requires systemd >= 204 +install -m 755 -d $RPM_BUILD_ROOT%{_root_sysconfdir}/systemd/system/%{?scl_prefix}php-fpm.service.d + +%if %{with_httpd2410} +# Switch to UDS +# FPM +sed -e 's@127.0.0.1:9000@%{_localstatedir}/run/php-fpm/www.sock@' \ + -e 's@^;listen.acl_users@listen.acl_users@' \ + -i $RPM_BUILD_ROOT%{_sysconfdir}/php-fpm.d/www.conf +# Apache +sed -e 's@proxy:fcgi://127.0.0.1:9000@proxy:unix:%{_localstatedir}/run/php-fpm/www.sock|fcgi://localhost@' \ + -i $RPM_BUILD_ROOT%{_httpd_confdir}/%{name}.conf +%endif + +# LogRotate +install -m 755 -d $RPM_BUILD_ROOT%{_root_sysconfdir}/logrotate.d +install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_root_sysconfdir}/logrotate.d/%{?scl_prefix}php-fpm +sed -e 's:/run:%{_localstatedir}/run:' \ + -e 's:/var/log:%{_localstatedir}/log:' \ + -i $RPM_BUILD_ROOT%{_root_sysconfdir}/logrotate.d/%{?scl_prefix}php-fpm + +# Environment file +%if 0%{?fedora} >= 26 || 0%{?rhel} >= 8 +sed -e '/EnvironmentFile/d' -i $RPM_BUILD_ROOT%{_unitdir}/%{?scl_prefix}php-fpm.service +%else +install -m 755 -d $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig +install -m 644 %{SOURCE8} $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/php-fpm +sed -e 's:php-fpm.service:%{?scl_prefix}php-fpm.service:' \ + -i $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/php-fpm +%endif + +# make the cli commands available in standard root for SCL build +%if 0%{?scl:1} +install -m 755 -d $RPM_BUILD_ROOT%{_root_bindir} +ln -s %{_bindir}/php $RPM_BUILD_ROOT%{_root_bindir}/%{scl} +ln -s %{_bindir}/php-cgi $RPM_BUILD_ROOT%{_root_bindir}/%{scl}-cgi +ln -s %{_bindir}/phar.phar $RPM_BUILD_ROOT%{_root_bindir}/%{scl_prefix}phar +ln -s %{_bindir}/phpdbg $RPM_BUILD_ROOT%{_root_bindir}/%{scl_prefix}phpdbg +%if %{with lsws} +ln -s %{_bindir}/lsphp $RPM_BUILD_ROOT%{_root_bindir}/ls%{scl} +%endif +%endif + +TESTCMD="$RPM_BUILD_ROOT%{_bindir}/php --no-php-ini" +# Ensure all provided extensions are really there +for mod in core date filter hash json libxml openssl pcntl pcre readline reflection session spl standard zlib +do + $TESTCMD --modules | grep -i "$mod\$" +done + +TESTCMD="$TESTCMD --define extension_dir=$RPM_BUILD_ROOT%{_libdir}/php/modules" + +# Generate files lists and stub .ini files for each subpackage +for mod in pgsql odbc ldap snmp \ + mysqlnd mysqli \ +%if %{with imap} + imap \ +%endif + mbstring gd dom xsl soap bcmath dba \ + simplexml bz2 calendar ctype exif ftp gettext gmp iconv \ + sockets tokenizer opcache \ + pdo \ +%if %{with sqlite3} + sqlite3 \ +%endif +%if %{with enchant} + enchant \ +%endif + ffi \ + phar fileinfo intl \ +%if %{with tidy} + tidy \ +%endif +%if %{with zip} + zip \ +%endif + sodium \ + pspell curl xml \ + posix shmop sysvshm sysvsem sysvmsg \ + pdo_mysql pdo_pgsql pdo_odbc pdo_sqlite \ +%if %{with oci8} + oci8 pdo_oci \ +%endif +%if %{with firebird} + pdo_firebird \ +%endif +%if %{with freetds} + pdo_dblib \ +%endif + xmlreader xmlwriter +do + # for extension load order + case $mod in + opcache) + # Zend extensions + TESTCMD="$TESTCMD --define zend_extension=$mod" + ini=10-${mod}.ini;; + pdo_*|mysqli|xmlreader) + # Extensions with dependencies on 20-* + TESTCMD="$TESTCMD --define extension=$mod" + ini=30-${mod}.ini;; + *) + TESTCMD="$TESTCMD --define extension=$mod" + # Extensions with no dependency + ini=20-${mod}.ini;; + esac + + $TESTCMD --modules | grep -i "$mod\$" + + # some extensions have their own config file + if [ -f ${ini} ]; then + cp -p ${ini} $RPM_BUILD_ROOT%{_sysconfdir}/php.d/${ini} + else + cat > $RPM_BUILD_ROOT%{_sysconfdir}/php.d/${ini} < files.${mod} <> files.xml + +# mysqlnd +cat files.mysqli \ + files.pdo_mysql \ + >> files.mysqlnd + +# Split out the PDO modules +cat files.pdo_pgsql >> files.pgsql +cat files.pdo_odbc >> files.odbc +%if %{with oci8} +cat files.pdo_oci >> files.oci8 +%endif + +# sysv* and posix in packaged in php-process +cat files.shmop files.sysv* files.posix > files.process + +# Package sqlite3 and pdo_sqlite with pdo; isolating the sqlite dependency +# isn't useful at this time since rpm itself requires sqlite. +cat files.pdo_sqlite >> files.pdo +%if %{with sqlite3} +cat files.sqlite3 >> files.pdo +%endif + +# Package curl, phar and fileinfo in -common. +cat files.curl files.phar files.fileinfo \ + files.exif files.gettext files.iconv files.calendar \ + files.ftp files.bz2 files.ctype files.sockets \ + files.tokenizer > files.common + +# The default Zend OPcache blacklist file +install -m 644 opcache-default.blacklist $RPM_BUILD_ROOT%{_sysconfdir}/php.d/opcache-default.blacklist + +# Install the macros file: +install -m 644 -D macros.php \ + $RPM_BUILD_ROOT%{macrosdir}/macros.%{name} + +# Remove unpackaged files +rm -rf $RPM_BUILD_ROOT%{_libdir}/php/modules/*.a \ + $RPM_BUILD_ROOT%{_bindir}/{phptar} \ + $RPM_BUILD_ROOT%{_datadir}/pear \ + $RPM_BUILD_ROOT%{_libdir}/libphp.a \ + $RPM_BUILD_ROOT%{_libdir}/libphp.la + +# Remove irrelevant docs +rm -f README.{Zeus,QNX,CVS-RULES} + + +%if ! %{with_httpd2410} +%pre fpm +# Add the "apache" user (to avoid pulling httpd in our dep) +getent group apache >/dev/null || \ + groupadd -g 48 -r apache +getent passwd apache >/dev/null || \ + useradd -r -u 48 -g apache -s /sbin/nologin \ + -d %{_httpd_contentdir} -c "Apache" apache +exit 0 +%endif + +%post fpm +%systemd_post %{?scl:%{scl}-}php-fpm.service + +%preun fpm +%systemd_preun %{?scl:%{scl}-}php-fpm.service + +%if 0%{?fedora} < 27 && 0%{?rhel} < 8 +%postun fpm +%systemd_postun_with_restart %{?scl:%{scl}-}php-fpm.service +%endif + +%if 0%{?fedora} >= 27 || 0%{?rhel} >= 8 +# Raised by new pool installation or new extension installation +%transfiletriggerin fpm -- %{_sysconfdir}/php-fpm.d %{_sysconfdir}/php.d +systemctl try-restart %{?scl:%{scl}-}php-fpm.service >/dev/null 2>&1 || : +%endif + +# Handle upgrading from SysV initscript to native systemd unit. +# We can tell if a SysV version of php-fpm was previously installed by +# checking to see if the initscript is present. +%triggerun fpm -- %{?scl_prefix}php-fpm +if [ -f /etc/rc.d/init.d/%{?scl_prefix}php-fpm ]; then + # Save the current service runlevel info + # User must manually run systemd-sysv-convert --apply php-fpm + # to migrate them to systemd targets + /usr/bin/systemd-sysv-convert --save %{?scl_prefix}php-fpm >/dev/null 2>&1 || : + + # Run these because the SysV package being removed won't do them + /sbin/chkconfig --del %{?scl_prefix}php-fpm >/dev/null 2>&1 || : + /bin/systemctl try-restart %{?scl_prefix}php-fpm.service >/dev/null 2>&1 || : +fi + + +%if 0%{?fedora} < 28 && 0%{?rhel} < 8 +%post embedded -p /sbin/ldconfig +%postun embedded -p /sbin/ldconfig +%endif + + +%{!?_licensedir:%global license %%doc} + +%files +%{_httpd_moddir}/libphp.so +%if 0%{?scl:1} +%dir %{_libdir}/httpd +%dir %{_libdir}/httpd/modules +%{_root_httpd_moddir}/lib%{scl}.so +%endif +%attr(0770,root,apache) %dir %{_localstatedir}/lib/php/session +%attr(0770,root,apache) %dir %{_localstatedir}/lib/php/wsdlcache +%attr(0770,root,apache) %dir %{_localstatedir}/lib/php/opcache +%config(noreplace) %{_httpd_confdir}/%{name}.conf +%config(noreplace) %{_httpd_modconfdir}/20-%{name}.conf + +%files common -f files.common +%doc EXTENSIONS NEWS UPGRADING* README.REDIST.BINS *md docs +%license LICENSE TSRM_LICENSE ZEND_LICENSE +%license libmagic_LICENSE +%license timelib_LICENSE +%doc php.ini-* +%config(noreplace) %{_sysconfdir}/php.ini +%dir %{_sysconfdir}/php.d +%dir %{_libdir}/php +%dir %{_libdir}/php/modules +%dir %{_localstatedir}/lib/php +%dir %{_datadir}/php +%if 0%{?fedora} >= 24 || 0%{?rhel} >= 8 +%dir %{_localstatedir}/lib/php/peclxml +%dir %{_docdir}/pecl +%dir %{_datadir}/tests +%dir %{_datadir}/tests/pecl +%endif + +%files cli +%{_bindir}/php +%{_bindir}/php-cgi +%{_bindir}/phar.phar +%{_bindir}/phar +# provides phpize here (not in -devel) for pecl command +%{_bindir}/phpize +%{_mandir}/man1/php.1* +%{_mandir}/man1/php-cgi.1* +%{_mandir}/man1/phar.1* +%{_mandir}/man1/phar.phar.1* +%{_mandir}/man1/phpize.1* +%if 0%{?scl:1} +%{_root_bindir}/%{scl} +%{_root_bindir}/%{scl}-cgi +%{_root_bindir}/%{scl_prefix}phar +%endif + +%files dbg +%{_bindir}/phpdbg +%{_mandir}/man1/phpdbg.1* +%doc sapi/phpdbg/CREDITS +%if 0%{?scl:1} +%{_root_bindir}/%{scl_prefix}phpdbg +%endif + +%files fpm +%doc php-fpm.conf.default www.conf.default +%license fpm_LICENSE +%attr(0770,root,apache) %dir %{_localstatedir}/lib/php/session +%attr(0770,root,apache) %dir %{_localstatedir}/lib/php/wsdlcache +%attr(0770,root,apache) %dir %{_localstatedir}/lib/php/opcache +%if %{with_httpd2410} +%config(noreplace) %{_httpd_confdir}/%{name}.conf +%endif +%config(noreplace) %{_sysconfdir}/php-fpm.conf +%config(noreplace) %{_sysconfdir}/php-fpm.d/www.conf +%config(noreplace) %{_root_sysconfdir}/logrotate.d/%{?scl_prefix}php-fpm +%if 0%{?fedora} < 26 && 0%{?rhel} < 8 +%config(noreplace) %{_sysconfdir}/sysconfig/php-fpm +%endif +# {_prefix}/lib/tmpfiles.d/php-fpm.conf +%{_unitdir}/%{?scl_prefix}php-fpm.service +%dir %{_root_sysconfdir}/systemd/system/%{?scl_prefix}php-fpm.service.d +%if 0%{?fedora} >= 27 || 0%{?rhel} >= 8 +%{_unitdir}/httpd.service.d/%{?scl_prefix}php-fpm.conf +%{_unitdir}/nginx.service.d/%{?scl_prefix}php-fpm.conf +%endif +%{_sbindir}/php-fpm +%dir %{_sysconfdir}/php-fpm.d +# log owned by apache for log +%attr(770,apache,root) %dir %{_localstatedir}/log/php-fpm +%dir %{_localstatedir}/run/php-fpm +%{_mandir}/man8/php-fpm.8* +%dir %{_datadir}/fpm +%{_datadir}/fpm/status.html + +%if %{with lsws} +%files litespeed +%{_bindir}/lsphp +%if 0%{?scl:1} +%{_root_bindir}/ls%{scl} +%endif +%endif + +%files embedded +%{_libdir}/libphp.so +%{_libdir}/libphp-%{embed_version}.so + +%files devel +%{_bindir}/php-config +%{_includedir}/php +%{_libdir}/php/build +%{_mandir}/man1/php-config.1* +%{macrosdir}/macros.%{name} + +%files pgsql -f files.pgsql +%files odbc -f files.odbc +%if %{with imap} +%files imap -f files.imap +%endif +%files ldap -f files.ldap +%files snmp -f files.snmp +%files xml -f files.xml +%files mbstring -f files.mbstring +%license libmbfl_LICENSE +%files gd -f files.gd +%files soap -f files.soap +%files bcmath -f files.bcmath +%license libbcmath_LICENSE +%files gmp -f files.gmp +%files dba -f files.dba +%files pdo -f files.pdo +%if %{with tidy} +%files tidy -f files.tidy +%endif +%if %{with freetds} +%files pdo-dblib -f files.pdo_dblib +%endif +%files pspell -f files.pspell +%files intl -f files.intl +%files process -f files.process +%if %{with firebird} +%files pdo-firebird -f files.pdo_firebird +%endif +%if %{with enchant} +%files enchant -f files.enchant +%endif +%files mysqlnd -f files.mysqlnd +%files opcache -f files.opcache +%config(noreplace) %{_sysconfdir}/php.d/opcache-default.blacklist +%if %{with oci8} +%files oci8 -f files.oci8 +%endif +%if %{with zip} +%files zip -f files.zip +%endif +%files sodium -f files.sodium +%files ffi -f files.ffi +%dir %{_datadir}/php/preload + + +%changelog +* Tue May 10 2022 Remi Collet - 8.0.19-1 +- Update to 8.0.19 - http://www.php.net/releases/8_0_19.php +- use oracle client library version 21.6 + +* Tue Apr 26 2022 Remi Collet - 8.0.19~RC1-1 +- update to 8.0.19RC1 + +* Wed Apr 13 2022 Remi Collet - 8.0.18-1 +- Update to 8.0.18 - http://www.php.net/releases/8_0_18.php + +* Thu Mar 31 2022 Remi Collet - 8.0.18~RC1-1 +- update to 8.0.18RC1 + +* Tue Mar 15 2022 Remi Collet - 8.0.17-1 +- Update to 8.0.17 - http://www.php.net/releases/8_0_17.php + +* Wed Mar 2 2022 Remi Collet - 8.0.17~RC1-1 +- update to 8.0.17RC1 + +* Tue Feb 22 2022 Remi Collet - 8.0.16-2 +- retrieve tzdata version +- use oracle client library version 21.5 + +* Wed Feb 16 2022 Remi Collet - 8.0.16-1 +- Update to 8.0.16 - http://www.php.net/releases/8_0_16.php + +* Thu Feb 3 2022 Remi Collet - 8.0.16~RC1-1 +- update to 8.0.16RC1 + +* Tue Jan 18 2022 Remi Collet - 8.0.15-1 +- Update to 8.0.15 - http://www.php.net/releases/8_0_15.php + +* Wed Jan 5 2022 Remi Collet - 8.0.15~RC1-1 +- update to 8.0.15RC1 + +* Thu Dec 16 2021 Remi Collet - 8.0.14-1 +- Update to 8.0.14 - http://www.php.net/releases/8_0_14.php + +* Thu Dec 2 2021 Remi Collet - 8.0.14~RC1-2 +- ensure we use libgd >= 2.3 + +* Thu Dec 2 2021 Remi Collet - 8.0.14~RC1-1 +- update to 8.0.14RC1 +- use oracle client library version 21.4 + +* Wed Nov 17 2021 Remi Collet - 8.0.13-1 +- Update to 8.0.13 - http://www.php.net/releases/8_0_13.php + +* Wed Nov 3 2021 Remi Collet - 8.0.13~RC1-1 +- update to 8.0.13RC1 + +* Tue Oct 26 2021 Remi Collet - 8.0.12-3 +- dba: enable qdbm backend + +* Tue Oct 26 2021 Remi Collet - 8.0.12-2 +- add patch for OpenSSL 3.0 on F36 and EL9 + +* Tue Oct 19 2021 Remi Collet - 8.0.12-1 +- Update to 8.0.12 - http://www.php.net/releases/8_0_12.php + +* Mon Oct 18 2021 Remi Collet - 8.0.12~RC1-2 +- build using system libxcrypt (Fedora) + +* Wed Oct 6 2021 Remi Collet - 8.0.12~RC1-1 +- update to 8.0.12RC1 +- use libicu version 69 + +* Wed Sep 22 2021 Remi Collet - 8.0.11-1 +- Update to 8.0.11 - http://www.php.net/releases/8_0_11.php + +* Tue Sep 7 2021 Remi Collet - 8.0.11~RC1-1 +- update to 8.0.11RC1 +- use oracle client library version 21.3 + +* Tue Aug 24 2021 Remi Collet - 8.0.10-1 +- Update to 8.0.10 - http://www.php.net/releases/8_0_10.php + +* Wed Aug 11 2021 Remi Collet - 8.0.10~RC1-2 +- phar: switch to sha256 signature by default, backported from 8.1 +- phar: implement openssl_256 and openssl_512 for signatures, backported from 8.1 +- snmp: add sha256 / sha512 security protocol, backported from 8.1 + +* Tue Aug 10 2021 Remi Collet - 8.0.10~RC1-1 +- update to 8.0.10RC1 +- adapt systzdata patch for timelib 2020.03 (v20) + +* Tue Aug 3 2021 Remi Collet - 8.0.9-2 +- add upstream patch for https://bugs.php.net/81325 segfault in simplexml + +* Thu Jul 29 2021 Remi Collet - 8.0.9-1 +- Update to 8.0.9 - http://www.php.net/releases/8_0_9.php + +* Tue Jul 13 2021 Remi Collet - 8.0.9~RC1-1 +- update to 8.0.9RC1 + +* Tue Jun 29 2021 Remi Collet - 8.0.8-1 +- Update to 8.0.8 - http://www.php.net/releases/8_0_8.php + +* Tue Jun 15 2021 Remi Collet - 8.0.8~RC1-1 +- update to 8.0.8RC1 +- ignore unsupported "threads" option on password_hash + +* Wed Jun 2 2021 Remi Collet - 8.0.7-1 +- Update to 8.0.7 - http://www.php.net/releases/8_0_7.php + +* Thu May 20 2021 Remi Collet - 8.0.7~RC1-1 +- update to 8.0.7RC1 + +* Sat May 8 2021 Remi Collet - 8.0.6-2 +- get rid of inet_ntoa, inet_aton, inet_addr and gethostbyaddr calls + +* Wed May 5 2021 Remi Collet - 8.0.6-1 +- Update to 8.0.6 - http://www.php.net/releases/8_0_6.php + +* Tue Apr 27 2021 Remi Collet - 8.0.5-1 +- Update to 8.0.5 - http://www.php.net/releases/8_0_5.php + +* Tue Apr 13 2021 Remi Collet - 8.0.5~RC1-1 +- update to 8.0.5RC1 + +* Tue Mar 16 2021 Remi Collet - 8.0.4~RC1-1 +- update to 8.0.4RC1 +- use oracle client library version 21.1 + +* Wed Mar 3 2021 Remi Collet - 8.0.3-1 +- Update to 8.0.3 - http://www.php.net/releases/8_0_3.php + +* Thu Feb 18 2021 Remi Collet - 8.0.3~RC1-1 +- update to 8.0.3RC1 + +* Tue Feb 2 2021 Remi Collet - 8.0.2-1 +- Update to 8.0.2 - http://www.php.net/releases/8_0_2.php + +* Thu Jan 28 2021 Remi Collet - 8.0.2~RC1-2 +- add upstream patch for https://bugs.php.net/80682 + fix opcache doesn't honour pcre.jit option + +* Tue Jan 19 2021 Remi Collet - 8.0.2~RC1-1 +- update to 8.0.2RC1 +- oci8 version is now 3.0.1 + +* Tue Jan 5 2021 Remi Collet - 8.0.1-1 +- Update to 8.0.1 - http://www.php.net/releases/8_0_1.php + +* Tue Jan 5 2021 Remi Collet - 8.0.1~RC1-2 +- test build for new upstream patch (from 8.1) + +* Tue Dec 15 2020 Remi Collet - 8.0.1~RC1-1 +- update to 8.0.1RC1 + +* Tue Dec 8 2020 Remi Collet - 8.0.0-2 +- fix service dependency name +- add dependency on make for devel + +* Wed Nov 25 2020 Remi Collet - 8.0.0-1 +- update to 8.0.0 GA + +* Wed Nov 18 2020 Remi Collet - 8.0.0~rc5-38 +- update to 8.0.0RC5 +- use oracle client library version 19.9 + +* Tue Nov 10 2020 Remi Collet - 8.0.0~rc4-37 +- update to 8.0.0RC4 + +* Tue Oct 27 2020 Remi Collet - 8.0.0~rc3-36 +- update to 8.0.0RC3 + +* Wed Oct 14 2020 Remi Collet - 8.0.0~rc2-35 +- update to 8.0.0RC2 + +* Wed Sep 30 2020 Remi Collet - 8.0.0~rc1-34 +- update to 8.0.0rc1 +- bump ABI/API versions + +* Thu Sep 17 2020 Remi Collet - 8.0.0~beta4-33 +- use %%bcond_without for dtrace, libgd, firebird, lsws, libpcre, imap + tidy, freetds, sqlite3, enchant so can be disabled during rebuild +- use %%bcond_with for libgd, libpcre, oci8, and zip + so can be enabled during rebuild + +* Wed Sep 16 2020 Remi Collet - 8.0.0~beta4-32 +- update to 8.0.0beta4 + +* Wed Sep 2 2020 Remi Collet - 8.0.0~beta3-31 +- update to 8.0.0beta3 +- adapt systzdata patch (v19) + +* Wed Aug 26 2020 Remi Collet - 8.0.0~beta2-30 +- build with upstream fix for zend_call_method + +* Wed Aug 19 2020 Remi Collet - 8.0.0~beta2-29 +- update to 8.0.0beta2 + +* Thu Aug 13 2020 Remi Collet - 8.0.0~beta1-28 +- use oracle client library version 19.8 + +* Wed Aug 5 2020 Remi Collet - 8.0.0~beta1-27 +- update to 8.0.0beta1 +- bump ABI/API versions + +* Tue Jul 21 2020 Remi Collet - 8.0.0~alpha3-26 +- update to 8.0.0alpha3 +- oci8 version is now 3.0.0 + +* Fri Jul 10 2020 Remi Collet - 8.0.0~alpha2-25 +- rebuild using ICU 65 + +* Thu Jul 9 2020 Remi Collet - 8.0.0~alpha2-24 +- rebuild 1 upstream patch + +* Tue Jul 7 2020 Remi Collet - 8.0.0~alpha2-23 +- update to 8.0.0alpha2 +- display build system and provider in phpinfo + +* Thu Jun 25 2020 Remi Collet - 8.0.0~alpha1-22 +- add upstream patch to use hash in gen_stub.php + +* Wed Jun 24 2020 Remi Collet - 8.0.0~alpha1-21 +- use system nikic/php-parser if available to generate + C headers from PHP stub +- switch from "runselftest" option to bcond_without tests + +* Wed Jun 24 2020 Remi Collet - 8.0.0~alpha1-20 +- update to 8.0.0alpha1 + +* Mon Jun 15 2020 Remi Collet - 8.0.0~DEV.20200615-19 +- new snapshot + +* Tue Jun 9 2020 Remi Collet - 8.0.0~DEV.20200609-18 +- new snapshot +- rebuild using oniguruma5php + +* Mon Jun 8 2020 Remi Collet - 8.0.0~DEV.20200608-17 +- new snapshot +- drop patch to fix PHP_UNAME + +* Tue Jun 2 2020 Remi Collet - 8.0.0~DEV.20200602-16 +- new snapshot +- drop xmlrpc extension + +* Wed May 27 2020 Remi Collet - 8.0.0~DEV.20200527-15 +- new snapshot +- json is now build statically + +* Wed May 27 2020 Remi Collet - 8.0.0~DEV.20200526-14 +- new snapshot +- build phpdbg only once + +* Tue May 26 2020 Remi Collet - 8.0.0~DEV.20200526-13 +- new snapshot + +* Wed May 20 2020 Remi Collet - 8.0.0~DEV.20200519-12 +- use php-config from embed SAPI to reduce used libs + +* Tue May 19 2020 Remi Collet - 8.0.0~DEV.20200519-11 +- new snapshot + +* Wed May 13 2020 Remi Collet - 8.0.0~DEV.20200513-10 +- new snapshot + +* Wed May 13 2020 Remi Collet - 8.0.0~DEV.20200513-9 +- new snapshot + +* Mon May 4 2020 Remi Collet - 8.0.0~DEV.20200504-8 +- new snapshot +- enchant: use libenchant-2 instead of libenchant + +* Tue Apr 28 2020 Remi Collet - 8.0.0~DEV.20200428-7 +- new snapshot +- test build for https://github.com/php/php-src/pull/5480 + +* Mon Apr 27 2020 Remi Collet - 8.0.0~DEV.20200427-6 +- new snapshot +- fix tag=disable-static + +* Mon Apr 27 2020 Remi Collet - 8.0.0~DEV.20200427-5 +- new snapshot +- revert changes to use non PIC object files + +* Wed Apr 22 2020 Remi Collet - 8.0.0~DEV.20200422-4 +- new snapshot + +* Wed Apr 15 2020 Remi Collet - 8.0.0~DEV.20200415-3 +- new snapshot + +* Fri Apr 10 2020 Remi Collet - 8.0.0~DEV.20200409-2 +- new snapshot +- refresh php.ini from upstream +- rename 15-php80-php.conf to 20-php70-php.conf to ensure load order + +* Thu Apr 9 2020 Remi Collet - 8.0.0~DEV.20200409-1 +- update to 8.0.0-dev + +* Tue Mar 31 2020 Remi Collet - 7.4.5~RC1-1 +- update to 7.4.5RC1 + +* Tue Mar 17 2020 Remi Collet - 7.4.4-1 +- Update to 7.4.4 - http://www.php.net/releases/7_4_4.php +- use oracle client library version 19.6 (18.5 on EL-6) + +* Tue Mar 3 2020 Remi Collet - 7.4.4~RC1-1 +- update to 7.4.4RC1 + +* Tue Feb 18 2020 Remi Collet - 7.4.3-1 +- Update to 7.4.3 - http://www.php.net/releases/7_4_3.php + +* Tue Feb 4 2020 Remi Collet - 7.4.3~RC1-1 +- update to 7.4.3RC1 + +* Tue Jan 28 2020 Remi Collet - 7.4.2-2 +- make sodium mandatory on EL-7, to avoid user confusion + https://github.com/remicollet/remirepo/issues/137 + +* Tue Jan 21 2020 Remi Collet - 7.4.2-1 +- Update to 7.4.2 - http://www.php.net/releases/7_4_2.php + +* Tue Jan 7 2020 Remi Collet - 7.4.2~RC1-1 +- update to 7.4.2RC1 + +* Wed Dec 18 2019 Remi Collet - 7.4.1-1 +- Update to 7.4.1 - http://www.php.net/releases/7_4_1.php + +* Wed Dec 11 2019 Remi Collet - 7.4.1~RC1-1 +- update to 7.4.1RC1 +- use oracle client library version 19.5 + +* Wed Nov 27 2019 Remi Collet - 7.4.0-1 +- update to 7.4.0 GA + +* Mon Nov 11 2019 Remi Collet - 7.4.0~rc6-34 +- update to 7.4.0RC6 + +* Tue Oct 29 2019 Remi Collet - 7.4.0~rc5-33 +- update to 7.4.0RC5 +- set opcache.enable_cli in provided default configuration + +* Fri Oct 25 2019 Remi Collet - 7.4.0~rc4-32 +- add /usr/share/php/preload as default ffi.preload configuration + +* Thu Oct 24 2019 Remi Collet - 7.4.0~rc4-31 +- allow wildcards in ffi.preload + +* Wed Oct 23 2019 Remi Collet - 7.4.0~rc4-30 +- fix preload, add more upstream patches for #78713 #78716 + +* Mon Oct 21 2019 Remi Collet - 7.4.0~rc4-29 +- fix preload, add upstream patch for #78512 + +* Tue Oct 15 2019 Remi Collet - 7.4.0~rc4-28 +- update to 7.4.0RC4 + +* Fri Oct 11 2019 Remi Collet - 7.4.0~rc3-27 +- test build with more upstream patches + +* Thu Oct 10 2019 Remi Collet - 7.4.0~rc3-26 +- fix librt issue on F31 using upstream patch + +* Mon Oct 7 2019 Remi Collet - 7.4.0~rc3-25 +- ensure all shared extensions can be loaded + +* Fri Oct 4 2019 Remi Collet - 7.4.0~rc3-24 +- fix broken intl extension on EL-7 + +* Tue Oct 1 2019 Remi Collet - 7.4.0~rc3-23 +- update to 7.4.0RC3 + +* Fri Sep 20 2019 Remi Collet - 7.4.0~rc2-22 +- fix broken gmp extension https://bugs.php.net/78574 + +* Tue Sep 17 2019 Remi Collet - 7.4.0~rc2-21 +- update to 7.4.0RC2 (new tag) + +* Tue Sep 17 2019 Remi Collet - 7.4.0~rc2-19 +- update to 7.4.0RC2 +- add tarball signature check +- reduce to 4 concurrent test workers + +* Tue Sep 3 2019 Remi Collet - 7.4.0~rc1-18 +- update to 7.4.0RC1 +- bump API number to 20190902 + +* Tue Aug 20 2019 Remi Collet - 7.4.0~beta4-17 +- update to 7.4.0beta4 + +* Tue Aug 6 2019 Remi Collet - 7.4.0~beta2-16 +- update to 7.4.0beta2 + +* Wed Jul 24 2019 Remi Collet - 7.4.0~beta1-15 +- update to 7.4.0beta1 (new tag) + +* Tue Jul 23 2019 Remi Collet - 7.4.0~beta1-14 +- update to 7.4.0beta1 +- main package now recommends commonly used extensions and SAPI + (json, mbstring, opcache, pdo, xml) +- fix gd build options and dependencies +- refresh provided configuration from upstream production values + +* Fri Jul 12 2019 Remi Collet - 7.4.0~alpha3-13 +- drop recode extension, moved to php-pecl-recode +- add upstream patch for argon2 password + +* Tue Jul 9 2019 Remi Collet - 7.4.0~alpha3-12 +- update to 7.4.0alpha3 +- drop argon2 dependency using libsodium implementation + +* Tue Jun 25 2019 Remi Collet - 7.4.0~alpha2-11 +- update to 7.4.0alpha2 + +* Mon Jun 17 2019 Remi Collet - 7.4.0~alpha1-10 +- use oracle client library version 19.3 + +* Wed Jun 12 2019 Remi Collet - 7.4.0~alpha1-9 +- add 3 upstream patches + +* Wed Jun 12 2019 Remi Collet - 7.4.0~alpha1-8 +- update to 7.4.0alpha1 + +* Wed Jun 12 2019 Remi Collet - 7.4.0~DEV.20190612-7 +- new snapshot +- use pkgconfig dependencies for libxslt, libexslt, libsasl2, libargon2 + +* Wed Jun 5 2019 Remi Collet - 7.4.0~DEV.20190605-6 +- new snapshot + +* Wed May 29 2019 Remi Collet - 7.4.0~DEV.20190529-5 +- new snapshot +- bump ABI version +- add patch for old unixODBC from + https://github.com/php/php-src/pull/4203 + +* Tue May 28 2019 Remi Collet - 7.4.0~DEV.20190528-4 +- new snapshot + +* Wed May 22 2019 Remi Collet - 7.4.0~DEV.20190522-3 +- new snapshot with configuration updated from upstream + +* Tue May 21 2019 Remi Collet - 7.4.0~DEV.20190521-2 +- new snapshot for enchant and sodium fix + +* Tue May 21 2019 Remi Collet - 7.4.0~DEV.20190521-1 +- new snapshot for sqlite3 fix + +* Mon May 20 2019 Remi Collet - 7.4.0~DEV.20190520-1 +- update to 7.4.0-dev +- drop interbase extension and sub-package +- move pdo_firebird extension in pdo-firebird sub-package +- drop wddx extension +- add ffi extension in new ffi sub-package +- use pkgconfig dependencies for ext using PHP_CHECK_MODULE + +* Wed May 15 2019 Remi Collet - 7.3.6~RC1-2 +- update to 7.3.6RC1 (new tag) + +* Tue May 14 2019 Remi Collet - 7.3.6~RC1-1 +- update to 7.3.6RC1 + +* Wed May 1 2019 Remi Collet - 7.3.5-2 +- test build for https://bugs.php.net/77653 + patch from https://github.com/php/php-src/pull/4007 + +* Wed May 1 2019 Remi Collet - 7.3.5-1 +- Update to 7.3.5 - http://www.php.net/releases/7_3_5.php + +* Tue Apr 16 2019 Remi Collet - 7.3.5~RC1-1 +- update to 7.3.5RC1 + +* Fri Apr 5 2019 Remi Collet - 7.3.4-3 +- build with system oniguruma5 + +* Wed Apr 3 2019 Remi Collet - 7.3.4-2 +- test build for https://bugs.php.net/77653 + patch from https://github.com/php/php-src/pull/4007 + +* Tue Apr 2 2019 Remi Collet - 7.3.4-1 +- Update to 7.3.4 - http://www.php.net/releases/7_3_4.php + +* Thu Mar 21 2019 Remi Collet - 7.3.4~RC1-2 +- update to 7.3.4RC1 new tag +- add upstream patches for failed tests + +* Tue Mar 19 2019 Remi Collet - 7.3.4~RC1-1 +- update to 7.3.4RC1 + +* Tue Mar 5 2019 Remi Collet - 7.3.3-1 +- Update to 7.3.3 - http://www.php.net/releases/7_3_3.php +- add upstream patch for OpenSSL 1.1.1b + +* Fri Feb 22 2019 Remi Collet - 7.3.3~RC1-2 +- php-devel: drop dependency on libicu-devel + +* Tue Feb 19 2019 Remi Collet - 7.3.3~RC1-1 +- update to 7.3.3RC1 +- adapt systzdata patch (v18) + +* Mon Feb 18 2019 Remi Collet - 7.3.2-3 +- pdo_oci: backport PDOStatement::getColumnMeta from 7.4 + +* Thu Feb 7 2019 Remi Collet - 7.3.2-2 +- rebuild using libicu62 + +* Tue Feb 5 2019 Remi Collet - 7.3.2-1 +- Update to 7.3.2 - http://www.php.net/releases/7_3_2.php + +* Tue Jan 22 2019 Remi Collet - 7.3.2~RC1-1 +- update to 7.3.2RC1 +- update system tzdata patch for timelib 2018.01 + +* Thu Jan 17 2019 Remi Collet 7.3.1-3 +- cleanup for EL-8 + +* Wed Jan 16 2019 Remi Collet - 7.3.1-2 +- test build for https://bugs.php.net/77430 + +* Tue Jan 8 2019 Remi Collet - 7.3.1-1 +- Update to 7.3.1 - http://www.php.net/releases/7_3_1.php + +* Tue Dec 18 2018 Remi Collet - 7.3.1~RC1-1 +- update to 7.3.1RC1 +- oci8 version is now 2.2.0 + +* Tue Dec 4 2018 Remi Collet - 7.3.0-1 +- update to 7.3.0 GA +- update FPM configuration from upstream + +* Tue Nov 20 2018 Remi Collet - 7.3.0~rc6-1 +- update to 7.3.0RC6 + +* Tue Nov 6 2018 Remi Collet - 7.3.0~rc5-1 +- update to 7.3.0RC5 + +* Mon Nov 5 2018 Remi Collet - 7.3.0~rc4-2 +- test build for https://github.com/php/php-src/pull/3652 + +* Tue Oct 23 2018 Remi Collet - 7.3.0~rc4-1 +- update to 7.3.0RC4 + +* Tue Oct 9 2018 Remi Collet - 7.3.0~rc3-1 +- update to 7.3.0RC3 + +* Tue Sep 25 2018 Remi Collet - 7.3.0~rc2-1 +- update to 7.3.0RC2 +- use oracle client library version 18.3 + +* Tue Sep 11 2018 Remi Collet - 7.3.0~rc1-1 +- update to 7.3.0RC1 +- with oniguruma 6.9.0 + +* Mon Sep 3 2018 Remi Collet - 7.3.0~beta3-3 +- add upstream patch for openssl failing test + +* Tue Aug 28 2018 Remi Collet - 7.3.0~beta3-2 +- add upstream patch for F29 + +* Tue Aug 28 2018 Remi Collet - 7.3.0~beta3-1 +- update to 7.3.0beta3 + +* Thu Aug 16 2018 Remi Collet - 7.3.0~beta2-1 +- update to 7.3.0beta2 +- bump API numbers + +* Tue Jul 17 2018 Remi Collet - 7.3.0~alpha4-1 +- update to 7.3.0alpha4 + +* Tue Jul 3 2018 Remi Collet - 7.3.0~alpha3-1 +- update to 7.3.0alpha3 + +* Thu Jun 21 2018 Remi Collet - 7.3.0~alpha2-2 +- update to 7.3.0alpha2 new sources + +* Tue Jun 19 2018 Remi Collet - 7.3.0~alpha2-1 +- update to 7.3.0alpha2 +- bump php(zend-abi) and php(api) to 20180606 +- revert 5dd1ef90caec3021e6ce55c8554e695edf641eaf + +* Thu Jun 7 2018 Remi Collet - 7.3.0~alpha1-1 +- update to 7.3.0alpha1 +- switch from pcre to pcre2 + +* Wed Jun 6 2018 Remi Collet - 7.2.7~RC1-1 +- update to 7.2.7RC1 + +* Wed May 23 2018 Remi Collet - 7.2.6-1 +- Update to 7.2.6 - http://www.php.net/releases/7_2_6.php + +* Mon May 14 2018 Remi Collet - 7.2.6~RC1-2 +- rebuild against EL 7.5 + +* Sun May 13 2018 Remi Collet - 7.2.6~RC1-1 +- update to 7.2.6RC1 + +* Tue Apr 24 2018 Remi Collet - 7.2.5-1 +- Update to 7.2.5 - http://www.php.net/releases/7_2_5.php + +* Wed Apr 11 2018 Remi Collet - 7.2.5~RC1-1 +- update to 7.2.5RC1 + +* Tue Apr 3 2018 Remi Collet - 7.2.4-2 +- add upstream patch for oniguruma 6.8.1, FTBFS #1562583 + +* Tue Mar 27 2018 Remi Collet - 7.2.4-1 +- Update to 7.2.4 - http://www.php.net/releases/7_2_4.php +- FPM: update default pool configuration for process.dumpable + +* Thu Mar 15 2018 Remi Collet - 7.2.4~RC1-2 +- add file trigger to restart the php-fpm service + when new pool or new extension installed (F27+) + +* Tue Mar 13 2018 Remi Collet - 7.2.4~RC1-1 +- update to 7.2.4RC1 + +* Fri Mar 2 2018 Remi Collet - 7.2.3-2 +- devel: drop dependency on devtoolset + +* Wed Feb 28 2018 Remi Collet - 7.2.3-1 +- Update to 7.2.3 - http://www.php.net/releases/7_2_3.php +- FPM: revert pid file removal +- improve devel dependencies + +* Wed Feb 14 2018 Remi Collet - 7.2.3~RC1-3 +- rebuild for new tag and drop patch merged upstream +- drop ldconfig scriptlets on F28 + +* Wed Feb 14 2018 Remi Collet - 7.2.3~RC1-2 +- update to 7.2.3RC1 +- adapt systzdata, fixheader and ldap_r patches +- apply upstream patch for date ext + +* Tue Jan 30 2018 Remi Collet - 7.2.2-1 +- Update to 7.2.2 - http://www.php.net/releases/7_2_2.php + +* Tue Jan 16 2018 Remi Collet - 7.2.2~RC1-1 +- update to 7.2.2RC1 +- define SOURCE_DATE_EPOCH for reproducible build + +* Wed Jan 3 2018 Remi Collet - 7.2.1-1 +- Update to 7.2.1 - http://www.php.net/releases/7_2_1.php + +* Fri Dec 29 2017 Remi Collet - 7.2.1~RC1-2 +- add upstream patch for https://bugs.php.net/75579 + +* Wed Dec 13 2017 Remi Collet - 7.2.1~RC1-1 +- update to 7.2.1RC1 + +* Tue Nov 28 2017 Remi Collet - 7.2.0-1 +- update to 7.2.0 GA + +* Tue Nov 7 2017 Remi Collet - 7.2.0-0.31.RC6 +- update to 7.2.0RC6 + +* Tue Oct 24 2017 Remi Collet - 7.2.0-0.30.RC5 +- update to 7.2.0RC5 + +* Wed Oct 18 2017 Remi Collet - 7.2.0-0.29.RC4 +- enable argon2 password hash + +* Tue Oct 10 2017 Remi Collet - 7.2.0-0.28.RC4 +- update to 7.2.0RC4 +- oci8 version is now 2.1.8 + +* Thu Sep 28 2017 Remi Collet - 7.2.0-0.27.RC3 +- dont obsolete php72-php-pecl-libsodium + +* Tue Sep 26 2017 Remi Collet - 7.2.0-0.26.RC3 +- update to 7.2.0RC3 + +* Mon Sep 25 2017 Remi Collet - 7.2.0-0.25.RC3 +- RC3 test build +- F27: php now requires php-fpm and start it with httpd / nginx + +* Thu Sep 14 2017 Remi Collet - 7.2.0-0.24.RC2 +- update builder from RHEL 7.3 to RHEL 7.4 + +* Wed Sep 13 2017 Remi Collet - 7.2.0-0.23.RC2 +- update to 7.2.0RC2 + +* Thu Aug 31 2017 Remi Collet - 7.2.0-0.22.RC1 +- add patch for EL-6, fix undefined symbol: sqlite3_errstr + +* Tue Aug 29 2017 Remi Collet - 7.2.0-0.21.RC1 +- update to 7.2.0RC1 + +* Mon Aug 28 2017 Remi Collet - 7.2.0-0.19.20170827.c22cda5 +- test build from git snapshot +- refresh configuration files, sync with upstream, drop .so suffix + +* Sun Aug 27 2017 Remi Collet - 7.2.0-0.18.20170828.cc57774 +- test build from git snapshot + +* Tue Aug 22 2017 Remi Collet - 7.2.0-0.17.20170822.3fff74a +- test build from git snapshot +- adapt tzdata patch for timelib 2017.05beta7 +- disable httpd MPM check + +* Tue Aug 15 2017 Remi Collet - 7.2.0-0.16.beta3 +- update to 7.2.0beta3 + +* Tue Aug 1 2017 Remi Collet - 7.2.0-0.15.beta2 +- add patch for EL-6, fix undefined symbol: sqlite3_errstr +- revert use of sqlite3_close_v2 on EL-6 + +* Tue Aug 1 2017 Remi Collet - 7.2.0-0.14.beta2 +- update to 7.2.0beta2 +- oci8 version is now 2.1.7 + +* Tue Jul 18 2017 Remi Collet - 7.2.0-0.13.beta1 +- update to 7.2.0beta1 +- oci8 version is now 2.1.6 +- bump apiver and zendver to 20170718 + +* Tue Jul 11 2017 Remi Collet - 7.2.0-0.12.20170611.249f75e +- test build +- add sodium extension in new sub-package + +* Tue Jul 4 2017 Remi Collet - 7.2.0-0.11.alpha3 +- update to 7.2.0alpha3 + +* Tue Jun 20 2017 Remi Collet - 7.2.0-0.9.alpha2 +- update to 7.2.0alpha2 +- oci8 version is now 2.1.5 +- use oracle instant client version 12.2 + +* Tue Jun 6 2017 Remi Collet - 7.2.0-0.8.alpha1 +- update to 7.2.0alpha1 + +* Fri Jun 2 2017 Remi Collet - 7.2.0-0.7.20170602.a86c87d +- new snapshot +- use system oniguruma (F26) + +* Mon May 29 2017 Remi Collet - 7.2.0-0.6.20170529.37a16a3 +- new snapshot + +* Mon May 29 2017 Remi Collet - 7.2.0-0.5.alpha0 +- test build for release process test, 7.2.0alpha0 +- dba: add --with-lmdb build option + +* Tue May 16 2017 Remi Collet - 7.2.0-0.4.20170516.0722a01 +- new snapshot + +* Sat May 6 2017 Remi Collet - 7.2.0-0.3.20170504.5af997e +- new snapshot, May the 4th be with you +- enable PHP execution of .phar files, see #1117140 + +* Tue Apr 25 2017 Remi Collet - 7.2.0-0.2.20170424.eb68c0d +- refresh + +* Wed Apr 12 2017 Remi Collet - 7.2.0-0.1.20170412.efeab78 +- update to 7.2.0-dev +- drop mcrypt subpackage (removed upstream) + +* Tue Apr 11 2017 Remi Collet - 7.1.4-1 +- Update to 7.1.4 - http://www.php.net/releases/7_1_4.php + +* Tue Mar 28 2017 Remi Collet - 7.1.4-0.1.RC1 +- Update to 7.1.4RC1 + +* Tue Mar 14 2017 Remi Collet - 7.1.3-1 +- Update to 7.1.3 - http://www.php.net/releases/7_1_3.php + +* Fri Mar 10 2017 Remi Collet - 7.1.3-0.2.RC1 +- fix interbase build on F26 + +* Tue Feb 28 2017 Remi Collet - 7.1.3-0.1.RC1 +- Update to 7.1.3RC1 + +* Wed Feb 15 2017 Remi Collet - 7.1.2-1 +- Update to 7.1.2 - http://www.php.net/releases/7_1_2.php + +* Thu Feb 2 2017 Remi Collet - 7.1.2-0.2.RC1 +- Update to 7.1.2RC1 (new sources) + +* Wed Feb 1 2017 Remi Collet 7.1.2-0.1.RC1 +- Update to 7.1.2RC1 + +* Wed Jan 18 2017 Remi Collet 7.1.1-3 +- EL-7: add patch for https://bugs.php.net/73956 +- switch back to gcc 6.2 + +* Wed Jan 18 2017 Remi Collet 7.1.1-2 +- EL-7: rebuild using gcc 4.8 instead of 6.2 + because of https://bugzilla.redhat.com/1414348 + +* Wed Jan 18 2017 Remi Collet 7.1.1-1 +- Update to 7.1.1 - http://www.php.net/releases/7_1_1.php + +* Thu Jan 5 2017 Remi Collet 7.1.1-0.1.RC1 +- Update to 7.1.1RC1 + +* Mon Dec 26 2016 Remi Collet 7.1.0-2 +- test optimized build using GCC 6.2 + +* Thu Dec 1 2016 Remi Collet 7.1.0-1 +- Update to 7.1.0 - http://www.php.net/releases/7_1_0.php +- use bundled pcre library 8.38 on EL-7 +- disable pcre.jit everywhere as it raise AVC #1398474 +- sync provided configuration with upstream production defaults + +* Wed Nov 9 2016 Remi Collet 7.1.0-0.13.RC6 +- Update to 7.1.0RC6 + +* Wed Oct 26 2016 Remi Collet 7.1.0-0.12.RC5 +- Update to 7.1.0RC5 + +* Mon Oct 17 2016 Remi Collet 7.1.0-0.11.RC4 +- Update to 7.1.0RC4 +- update tzdata patch to v14, improve check for valid tz file +- oci8 version is now 2.1.3 + +* Wed Oct 5 2016 Remi Collet 7.1.0-0.10.RC3 +- rebuild + +* Thu Sep 29 2016 Remi Collet 7.1.0-0.9.RC3 +- Update to 7.1.0RC3 + +* Wed Sep 14 2016 Remi Collet 7.1.0-0.8.RC2 +- Update to 7.1.0RC2 +- API version is now 20160303 + +* Thu Sep 1 2016 Remi Collet 7.1.0-0.8.RC1 +- Update to 7.1.0RC1 +- oci8 version is now 2.1.2 + +* Wed Aug 3 2016 Remi Collet 7.1.0-0.7.beta2 +- Update to 7.1.0beta2 + +* Thu Jul 21 2016 Remi Collet 7.1.0-0.6.beta1 +- Update to 7.1.0beta1 + +* Wed Jul 6 2016 Remi Collet 7.1.0-0.5.alpha3 +- Update to 7.1.0alpha3 + +* Thu Jun 30 2016 Remi Collet 7.1.0-0.4.alpha2 +- own tests/doc directories for pecl packages (f24) + +* Wed Jun 22 2016 Remi Collet 7.1.0-0.3.alpha2 +- Update to 7.1.0alpha2 (rebuild) + +* Wed Jun 22 2016 Remi Collet 7.1.0-0.2.alpha2 +- Update to 7.1.0alpha2 + +* Wed Jun 8 2016 Remi Collet 7.1.0-0.1.alpha1 +- Update to 7.1.0alpha1 + +* Wed May 25 2016 Remi Collet 7.0.7-1 +- Update to 7.0.7 - http://www.php.net/releases/7_0_7.php + +* Thu May 12 2016 Remi Collet 7.0.7-0.1.RC1 +- Update to 7.0.7RC1 +- oci8 version is now 2.1.1 + +* Thu Apr 28 2016 Remi Collet 7.0.6-3 +- Update to 7.0.6 - http://www.php.net/releases/7_0_6.php +- rebuild for new sources + +* Wed Apr 27 2016 Remi Collet 7.0.6-2 +- Update to 7.0.6 + http://www.php.net/releases/7_0_6.php + +* Tue Apr 12 2016 Remi Collet 7.0.6-0.2.RC1 +- Update to 7.0.6RC1 + +* Fri Apr 8 2016 Remi Collet 7.0.5-2 +- Fixed bug #71914 (Reference is lost in "switch") + +* Wed Mar 30 2016 Remi Collet 7.0.5-1 +- Update to 7.0.5 + http://www.php.net/releases/7_0_5.php + +* Wed Mar 16 2016 Remi Collet 7.0.5-0.1.RC1 +- Update to 7.0.5RC1 + +* Sun Mar 6 2016 Remi Collet 7.0.4-2 +- adapt for F24: define %%pecl_xmldir and own it + +* Wed Mar 2 2016 Remi Collet 7.0.4-1 +- Update to 7.0.4 + http://www.php.net/releases/7_0_4.php +- pcre: disables JIT compilation of patterns with system pcre < 8.38 + +* Thu Feb 18 2016 Remi Collet 7.0.4-0.1.RC1 +- Update to 7.0.4RC1 + +* Wed Feb 3 2016 Remi Collet 7.0.3-1 +- Update to 7.0.3 + http://www.php.net/releases/7_0_3.php + +* Fri Jan 29 2016 Remi Collet 7.0.3-0.3.20160129gitdd3d10c +- test build + +* Fri Jan 29 2016 Remi Collet 7.0.3-0.2.RC1 +- FPM: test build for https://bugs.php.net/62172 + +* Wed Jan 20 2016 Remi Collet 7.0.3-0.1.RC1 +- Update to 7.0.3RC1 + +* Wed Jan 6 2016 Remi Collet 7.0.2-1 +- Update to 7.0.2 + http://www.php.net/releases/7_0_2.php + +* Sun Dec 27 2015 Remi Collet 7.0.2-0.1.RC1 +- Update to 7.0.2RC1 +- opcache: build with --disable-huge-code-pages on EL-6 + +* Wed Dec 16 2015 Remi Collet 7.0.1-1 +- Update to 7.0.1 + http://www.php.net/releases/7_0_1.php +- curl: add CURL_SSLVERSION_TLSv1_x constant (EL) +- fpm: switch to UDS on Fedora >= 21 + +* Wed Dec 9 2015 Remi Collet 7.0.1-0.1.RC1 +- Update to 7.0.1RC1 +- drop --disable-huge-code-pages build option on EL-6, + but keep it disabled in default configuration + +* Thu Dec 3 2015 Remi Collet 7.0.0-2 +- build with --disable-huge-code-pages on EL-6 + +* Tue Dec 1 2015 Remi Collet 7.0.0-1 +- Update to 7.0.0 + http://www.php.net/releases/7_0_0.php + +* Mon Nov 30 2015 Remi Collet 7.0.0-0.26.RC8 +- set opcache.huge_code_pages=0 on EL-6 + see https://bugs.php.net/70973 and https://bugs.php.net/70977 + +* Wed Nov 25 2015 Remi Collet 7.0.0-0.25.RC8 +- Update to 7.0.0RC8 +- set opcache.huge_code_pages=1 on x86_64 + +* Thu Nov 12 2015 Remi Collet 7.0.0-0.24.RC7 +- Update to 7.0.0RC7 (retagged) + +* Wed Nov 11 2015 Remi Collet 7.0.0-0.23.RC7 +- Update to 7.0.0RC7 + +* Wed Oct 28 2015 Remi Collet 7.0.0-0.22.RC6 +- Update to 7.0.0RC6 + +* Mon Oct 19 2015 Remi Collet 7.0.0-0.21.RC5 +- php-config: reports all built sapis + +* Wed Oct 14 2015 Remi Collet 7.0.0-0.20.RC5 +- rebuild as retagged + +* Tue Oct 13 2015 Remi Collet 7.0.0-0.19.RC5 +- Update to 7.0.0RC5 +- update php-fpm.d/www.conf comments +- API and Zend API are now set to 20151012 + +* Wed Sep 30 2015 Remi Collet 7.0.0-0.18.RC4 +- Update to 7.0.0RC4 +- php-fpm: set http authorization headers + +* Fri Sep 18 2015 Remi Collet 7.0.0-0.17.RC3 +- F23 rebuild with rh_layout + +* Wed Sep 16 2015 Remi Collet 7.0.0-0.16.RC3 +- Update to 7.0.0RC3 +- disable zip extension (provided in php-pecl-zip) + +* Fri Sep 4 2015 Remi Collet 7.0.0-0.15.RC2 +- Update to 7.0.0RC2 +- enable oci8 and pdo_oci extensions +- sync php.ini with upstream php.ini-production + +* Sat Aug 22 2015 Remi Collet 7.0.0-0.14.RC1 +- Update to 7.0.0RC1 + +* Wed Aug 5 2015 Remi Collet 7.0.0-0.13.beta3 +- Update to 7.0.0beta3 + +* Wed Jul 22 2015 Remi Collet 7.0.0-0.12.beta2 +- Update to 7.0.0beta2 +- switch from libvpx to libwebp (only for bundled libgd, not used) + +* Wed Jul 8 2015 Remi Collet 7.0.0-0.11.beta1 +- Update to 7.0.0beta1 +- use upstream tarball instead of git snapshot + +* Wed Jun 24 2015 Remi Collet 7.0.0-0.10.alpha2 +- Update to 7.0.0alpha2 +- use new layout (/etc/opt, /var/opt) + +* Wed Jun 17 2015 Remi Collet 7.0.0-0.9.20150617git3697f02 +- new snapshot + +* Thu Jun 11 2015 Remi Collet 7.0.0-0.9.20150611git8cfe282 +- new snapshot +- the phar link is now correctly created + +* Tue Jun 9 2015 Remi Collet 7.0.0-0.8.alpha1 +- Update to 7.0.0alpha1 + +* Tue Jun 2 2015 Remi Collet 7.0.0-0.7.20150602git8a089e7 +- new snapshot + +* Fri May 29 2015 Remi Collet 7.0.0-0.7.20150525git6f46fa3 +- new snapshot +- t1lib support have been removed + +* Mon May 25 2015 Remi Collet 7.0.0-0.6.20150525git404360f +- new snapshot + +* Mon May 18 2015 Remi Collet 7.0.0-0.6.20150518gitcee8857 +- new snapshot + +* Sat May 16 2015 Remi Collet 7.0.0-0.6.20150515gitc9f27ee +- new snapshot + +* Tue Apr 28 2015 Remi Collet 7.0.0-0.6.20150507gitdd0b602 +- add experimental file based opcode cache (disabled by default) + +* Tue Apr 28 2015 Remi Collet 7.0.0-0.5.20150428git94f0b94 +- new snapshot + +* Mon Apr 27 2015 Remi Collet 7.0.0-0.5.20150427git1a4d3e4 +- new snapshot +- adapt system tzdata patch for upstream change for new zic + +* Sat Apr 18 2015 Remi Collet 7.0.0-0.5.20150418git1f0a624 +- new snapshot + +* Thu Apr 16 2015 Remi Collet 7.0.0-0.5.20150416gitc77d97f +- new snapshot + +* Fri Apr 3 2015 Remi Collet 7.0.0-0.5.20150403gitadcf0c6 +- new snapshot + +* Tue Mar 31 2015 Remi Collet 7.0.0-0.4.20150331git463ca30 +- rename 10-php70-php.conf to 15-php70-php.conf to + ensure load order (after 10-rh-php56-php.conf) + +* Wed Mar 25 2015 Remi Collet 7.0.0-0.3.20150325git2fe6acd +- rebuild + +* Wed Mar 25 2015 Remi Collet 7.0.0-0.2.20150325git23336d7 +- fix mod_php configuration +- disable static json +- sync php.ini with upstream php.ini-production + +* Wed Mar 25 2015 Remi Collet 7.0.0-0.1.20150325git23336d7 +- update for php 7.0.0 +- ereg, mssql, mysql and sybase_ct extensions are removed +- add pdo-dblib subpackage (instead of php-mssql) +- disable oci8 extension, not yet adapted for 7.0 +- add php-zip subpackage +- add php-json subpackage + +* Thu Mar 19 2015 Remi Collet 5.6.7-1 +- Update to 5.6.7 + http://www.php.net/releases/5_6_7.php + +* Sun Mar 8 2015 Remi Collet 5.6.7-0.1.RC1 +- update to 5.6.7RC1 + +* Thu Feb 19 2015 Remi Collet 5.6.6-1 +- Update to 5.6.6 + http://www.php.net/releases/5_6_6.php + +* Wed Jan 21 2015 Remi Collet 5.6.5-1 +- Update to 5.6.5 + http://www.php.net/releases/5_6_5.php + +* Tue Jan 20 2015 Remi Collet 5.6.5-0.2.RC1 +- fix php-fpm.service.d location + +* Fri Jan 9 2015 Remi Collet 5.6.5-0.1.RC1 +- update to 5.6.5RC1 +- add base system path in default include path +- FPM: enable ACL for Unix Domain Socket + +* Wed Dec 17 2014 Remi Collet 5.6.4-2 +- Update to 5.6.4 + http://www.php.net/releases/5_6_4.php +- add sybase_ct extension (in mssql sub-package) +- xmlrpc requires xml + +* Wed Dec 10 2014 Remi Collet 5.6.4-1 +- Update to 5.6.4 + http://www.php.net/releases/5_6_4.php + +* Thu Nov 27 2014 Remi Collet 5.6.4-0.1.RC1 +- update to 5.6.4RC1 + +* Wed Nov 26 2014 Remi Collet 5.6.3-3 +- add embedded sub package +- filter all libraries to avoid provides + +* Sun Nov 16 2014 Remi Collet 5.6.3-2 +- FPM: add upstream patch for https://bugs.php.net/68421 + access.format=R doesn't log ipv6 address +- FPM: add upstream patch for https://bugs.php.net/68420 + listen=9000 listens to ipv6 localhost instead of all addresses +- FPM: add upstream patch for https://bugs.php.net/68423 + will no longer load all pools + +* Thu Nov 13 2014 Remi Collet 5.6.3-1 +- Update to PHP 5.6.3 + http://php.net/releases/5_6_3.php + +* Sun Nov 2 2014 Remi Collet 5.6.3-0.1.RC1 +- update to 5.6.3RC1 +- new version of systzdata patch, fix case sensitivity +- ignore Factory in date tests +- disable opcache.fast_shutdown in default config +- add php56-cgi command in base system + +* Thu Oct 16 2014 Remi Collet 5.6.2-1 +- Update to PHP 5.6.2 + http://php.net/releases/5_6_2.php + +* Fri Oct 3 2014 Remi Collet 5.6.1-1 +- Update to PHP 5.6.1 + http://php.net/releases/5_6_1.php +- use default system cipher list by Fedora policy + http://fedoraproject.org/wiki/Changes/CryptoPolicy +- add system php library to default include_path + +* Fri Aug 29 2014 Remi Collet 5.6.0-1.1 +- enable libvpx on EL 6 (with libvpx 1.3.0) +- add php56-phpdbg command in base system + +* Thu Aug 28 2014 Remi Collet 5.6.0-1 +- PHP 5.6.0 is GA +- add lsphp56 command in base system + +* Sun Aug 24 2014 Remi Collet - 5.6.0-0.1.RC4 +- initial spec for PHP 5.6 as Software Collection +- adapted from php 5.6 spec file from remi repository +- adapted from php 5.5 spec file from rhscl 1.1 + +* Tue May 13 2014 Remi Collet - 5.5.6-10 +- fileinfo: fix out-of-bounds memory access CVE-2014-2270 +- fileinfo: fix extensive backtracking CVE-2013-7345 + +* Fri Mar 21 2014 Remi Collet - 5.5.6-9 +- gd: fix NULL deref in imagecrop CVE-2013-7327 +- gd: drop vpx support, fix huge memory consumption #1075201 + +* Fri Feb 21 2014 Remi Collet - 5.5.6-8 +- fix patch name +- fix memory leak introduce in patch for CVE-2014-1943 +- fix heap-based buffer over-read in DateInterval CVE-2013-6712 + +* Wed Feb 19 2014 Remi Collet - 5.5.6-7 +- fix infinite recursion in fileinfo CVE-2014-1943 + +* Fri Feb 14 2014 Remi Collet - 5.5.6-6 +- fix heap overflow vulnerability in imagecrop CVE-2013-7226 + +* Tue Feb 4 2014 Remi Collet - 5.5.6-5 +- allow multiple paths in ini_scan_dir #1058161 + +* Fri Dec 6 2013 Remi Collet - 5.5.6-4 +- add security fix for CVE-2013-6420 + +* Tue Nov 19 2013 Remi Collet 5.5.6-2 +- rebuild with test enabled +- add dependency on php-pecl-jsonc + +* Tue Nov 19 2013 Remi Collet 5.5.6-0 +- update to PHP 5.5.6 +- buildstrap build + +* Thu Oct 17 2013 Remi Collet 5.5.5-1 +- update to PHP 5.5.5 +- mod_php only for httpd24 + +* Thu Sep 19 2013 Remi Collet 5.5.4-1 +- update to PHP 5.5.4 +- improve security, use specific soap.wsdl_cache_dir + use /var/lib/php/wsdlcache for mod_php and php-fpm +- sync short_tag comments in php.ini with upstream +- relocate RPM macro + +* Wed Aug 21 2013 Remi Collet 5.5.3-1 +- update to PHP 5.5.3 +- improve system libzip patch +- fix typo and add missing entries in php.ini + +* Fri Aug 2 2013 Remi Collet 5.5.1-1 +- update to PHP 5.5.1 for php55 SCL + +* Mon Jul 29 2013 Remi Collet 5.4.16-6 +- rebuild for new httpd-mmn value + +* Mon Jul 29 2013 Remi Collet 5.4.16-5 +- remove ZTS conditional stuf for ligibility +- add mod_php for apache 2.4 (from httpd24 collection) + +* Thu Jul 18 2013 Remi Collet 5.4.16-4 +- improve mod_php, pgsql and ldap description +- add missing man pages (phar, php-cgi) +- add provides php(pdo-abi) for consistency with php(api) and php(zend-abi) +- use %%__isa_bits instead of %%__isa in ABI suffix #985350 + +* Fri Jul 12 2013 Remi Collet - 5.4.16-3 +- add security fix for CVE-2013-4113 +- add missing ASL 1.0 license + +* Fri Jun 7 2013 Remi Collet 5.4.16-2 +- run tests during build + +* Fri Jun 7 2013 Remi Collet 5.4.16-1 +- rebase to 5.4.16 +- fix hang in FindTishriMolad(), #965144 +- patch for upstream Bug #64915 error_log ignored when daemonize=0 +- patch for upstream Bug #64949 Buffer overflow in _pdo_pgsql_error, #969103 +- patch for upstream bug #64960 Segfault in gc_zval_possible_root + +* Thu May 23 2013 Remi Collet 5.4.14-3 +- remove wrappers in /usr/bin (#966407) + +* Thu Apr 25 2013 Remi Collet 5.4.14-2 +- rebuild for libjpeg (instead of libjpeg_turbo) +- fix unowned dir %%{_datadir}/fpm and %%{_libdir}/httpd (#956221) + +* Thu Apr 11 2013 Remi Collet 5.4.14-1 +- update to 5.4.14 +- clean old deprecated options + +* Wed Mar 13 2013 Remi Collet 5.4.13-1 +- update to 5.4.13 +- security fixes for CVE-2013-1635 and CVE-2013-1643 +- make php-mysql package optional (and disabled) +- make ZTS build optional (and disabled) +- always try to load mod_php (apache warning is usefull) +- Hardened build (links with -z now option) +- Remove %%config from /etc/rpm/macros.php + +* Wed Jan 16 2013 Remi Collet 5.4.11-1 +- update to 5.4.11 +- fix php.conf to allow MultiViews managed by php scripts + +* Wed Dec 19 2012 Remi Collet 5.4.10-1 +- update to 5.4.10 +- remove patches merged upstream +- drop "Configure Command" from phpinfo output +- prevent php_config.h changes across (otherwise identical) + rebuilds + + +* Thu Nov 22 2012 Remi Collet 5.4.9-1 +- update to 5.4.9 + +* Mon Nov 19 2012 Remi Collet 5.4.8-7 +- fix php.conf + +* Mon Nov 19 2012 Remi Collet 5.4.8-6 +- filter private shared in _httpd_modir +- improve system libzip patch to use pkg-config +- use _httpd_contentdir macro and fix php.gif path +- switch back to upstream generated scanner/parser +- use system pcre only when recent enough + +* Fri Nov 16 2012 Remi Collet 5.4.8-5 +- improves php.conf, no need to be relocated + +* Fri Nov 9 2012 Remi Collet 5.4.8-6 +- clarify Licenses +- missing provides xmlreader and xmlwriter +- change php embedded library soname version to 5.4 + +* Mon Nov 5 2012 Remi Collet 5.4.8-4 +- fix mysql_sock macro definition + +* Thu Oct 25 2012 Remi Collet 5.4.8-4 +- fix standard build (non scl) + +* Thu Oct 25 2012 Remi Collet 5.4.8-3 +- fix installed headers + +* Tue Oct 23 2012 Joe Orton - 5.4.8-2 +- use libldap_r for ldap extension + +* Tue Oct 23 2012 Remi Collet 5.4.8-3 +- add missing scl_prefix in some provides/requires + +* Tue Oct 23 2012 Remi Collet 5.4.8-2.1 +- make php-enchant optionnal, not available on RHEL-5 +- make php-recode optionnal, not available on RHEL-5 +- disable t1lib on RHEL-5 + +* Tue Oct 23 2012 Remi Collet 5.4.8-2 +- enable tidy on RHEL-6 only +- re-enable unit tests + +* Tue Oct 23 2012 Remi Collet 5.4.8-1.2 +- minor macro fixes for RHEL-5 build +- update autotools workaround for RHEL-5 +- use readline when libedit not available (RHEL-5) + +* Mon Oct 22 2012 Remi Collet 5.4.8-1 +- update to 5.4.8 +- define both session.save_handler and session.save_path +- fix possible segfault in libxml (#828526) +- use SKIP_ONLINE_TEST during make test +- php-devel requires pcre-devel and php-cli (instead of php) +- provides php-phar +- update systzdata patch to v10, timezone are case insensitive + +* Mon Oct 15 2012 Remi Collet 5.4.7-4 +- php-fpm: create apache user if needed +- php-cli: provides cli command in standard root (scl) + +* Fri Oct 12 2012 Remi Collet 5.4.7-3 +- add configtest option to init script +- test configuration before service reload +- fix php-fpm service relocation +- fix php-fpm config relocation +- drop embdded subpackage for scl + +* Wed Oct 3 2012 Remi Collet 5.4.7-2 +- missing requires on scl-runtime +- relocate /var/lib/session +- fix php-devel requires +- rename, but don't relocate macros.php + +* Tue Oct 2 2012 Remi Collet 5.4.7-1 +- initial spec rewrite for scl build + +* Mon Oct 1 2012 Remi Collet 5.4.7-10 +- fix typo in systemd macro + +* Mon Oct 1 2012 Remi Collet 5.4.7-9 +- php-fpm: enable PrivateTmp +- php-fpm: new systemd macros (#850268) +- php-fpm: add upstream patch for startup issue (#846858) + +* Fri Sep 28 2012 Remi Collet 5.4.7-8 +- systemd integration, https://bugs.php.net/63085 +- no odbc call during timeout, https://bugs.php.net/63171 +- check sqlite3_column_table_name, https://bugs.php.net/63149 + +* Mon Sep 24 2012 Remi Collet 5.4.7-7 +- most failed tests explained (i386, x86_64) + +* Wed Sep 19 2012 Remi Collet 5.4.7-6 +- fix for http://bugs.php.net/63126 (#783967) + +* Wed Sep 19 2012 Remi Collet 5.4.7-5 +- patch to ensure we use latest libdb (not libdb4) + +* Wed Sep 19 2012 Remi Collet 5.4.7-4 +- really fix rhel tests (use libzip and libdb) + +* Tue Sep 18 2012 Remi Collet 5.4.7-3 +- fix test to enable zip extension on RHEL-7 + +* Mon Sep 17 2012 Remi Collet 5.4.7-2 +- remove session.save_path from php.ini + move it to apache and php-fpm configuration files + +* Fri Sep 14 2012 Remi Collet 5.4.7-1 +- update to 5.4.7 + http://www.php.net/releases/5_4_7.php +- php-fpm: don't daemonize + +* Mon Aug 20 2012 Remi Collet 5.4.6-2 +- enable php-fpm on secondary arch (#849490) + +* Fri Aug 17 2012 Remi Collet 5.4.6-1 +- update to 5.4.6 +- update to v9 of systzdata patch +- backport fix for new libxml + +* Fri Jul 20 2012 Remi Collet 5.4.5-1 +- update to 5.4.5 + +* Mon Jul 02 2012 Remi Collet 5.4.4-4 +- also provide php(language)%%{_isa} +- define %%{php_version} + +* Mon Jul 02 2012 Remi Collet 5.4.4-3 +- drop BR for libevent (#835671) +- provide php(language) to allow version check + +* Thu Jun 21 2012 Remi Collet 5.4.4-2 +- add missing provides (core, ereg, filter, standard) + +* Thu Jun 14 2012 Remi Collet 5.4.4-1 +- update to 5.4.4 (CVE-2012-2143, CVE-2012-2386) +- use /usr/lib/tmpfiles.d instead of /etc/tmpfiles.d +- use /run/php-fpm instead of /var/run/php-fpm + +* Wed May 09 2012 Remi Collet 5.4.3-1 +- update to 5.4.3 (CVE-2012-2311, CVE-2012-2329) + +* Thu May 03 2012 Remi Collet 5.4.2-1 +- update to 5.4.2 (CVE-2012-1823) + +* Fri Apr 27 2012 Remi Collet 5.4.1-1 +- update to 5.4.1 + +* Wed Apr 25 2012 Joe Orton - 5.4.0-6 +- rebuild for new icu +- switch (conditionally) to libdb-devel + +* Sat Mar 31 2012 Remi Collet 5.4.0-5 +- fix Loadmodule with MPM event (use ZTS if not MPM worker) +- split conf.d/php.conf + conf.modules.d/10-php.conf with httpd 2.4 + +* Thu Mar 29 2012 Joe Orton - 5.4.0-4 +- rebuild for missing automatic provides (#807889) + +* Mon Mar 26 2012 Joe Orton - 5.4.0-3 +- really use _httpd_mmn + +* Mon Mar 26 2012 Joe Orton - 5.4.0-2 +- rebuild against httpd 2.4 +- use _httpd_mmn, _httpd_apxs macros + +* Fri Mar 02 2012 Remi Collet 5.4.0-1 +- update to PHP 5.4.0 finale + +* Sat Feb 18 2012 Remi Collet 5.4.0-0.4.RC8 +- update to PHP 5.4.0RC8 + +* Sat Feb 04 2012 Remi Collet 5.4.0-0.3.RC7 +- update to PHP 5.4.0RC7 +- provides env file for php-fpm (#784770) +- add patch to use system libzip (thanks to spot) +- don't provide INSTALL file + +* Wed Jan 25 2012 Remi Collet 5.4.0-0.2.RC6 +- all binaries in /usr/bin with zts prefix + +* Wed Jan 18 2012 Remi Collet 5.4.0-0.1.RC6 +- update to PHP 5.4.0RC6 + https://fedoraproject.org/wiki/Features/Php54 + +* Sun Jan 08 2012 Remi Collet 5.3.8-4.4 +- fix systemd unit + +* Mon Dec 12 2011 Remi Collet 5.3.8-4.3 +- switch to systemd + +* Tue Dec 06 2011 Adam Jackson - 5.3.8-4.2 +- Rebuild for new libpng + +* Wed Oct 26 2011 Marcela Mašláňová - 5.3.8-3.2 +- rebuild with new gmp without compat lib + +* Wed Oct 12 2011 Peter Schiffer - 5.3.8-3.1 +- rebuild with new gmp + +* Wed Sep 28 2011 Remi Collet 5.3.8-3 +- revert is_a() to php <= 5.3.6 behavior (from upstream) + with new option (allow_string) for new behavior + +* Tue Sep 13 2011 Remi Collet 5.3.8-2 +- add mysqlnd sub-package +- drop patch4, use --libdir to use /usr/lib*/php/build +- add patch to redirect mysql.sock (in mysqlnd) + +* Tue Aug 23 2011 Remi Collet 5.3.8-1 +- update to 5.3.8 + http://www.php.net/ChangeLog-5.php#5.3.8 + +* Thu Aug 18 2011 Remi Collet 5.3.7-1 +- update to 5.3.7 + http://www.php.net/ChangeLog-5.php#5.3.7 +- merge php-zts into php (#698084) + +* Tue Jul 12 2011 Joe Orton - 5.3.6-4 +- rebuild for net-snmp SONAME bump + +* Mon Apr 4 2011 Remi Collet 5.3.6-3 +- enable mhash extension (emulated by hash extension) + +* Wed Mar 23 2011 Remi Collet 5.3.6-2 +- rebuild for new MySQL client library + +* Thu Mar 17 2011 Remi Collet 5.3.6-1 +- update to 5.3.6 + http://www.php.net/ChangeLog-5.php#5.3.6 +- fix php-pdo arch specific requires + +* Tue Mar 15 2011 Joe Orton - 5.3.5-6 +- disable zip extension per "No Bundled Libraries" policy (#551513) + +* Mon Mar 07 2011 Caolán McNamara 5.3.5-5 +- rebuild for icu 4.6 + +* Mon Feb 28 2011 Remi Collet 5.3.5-4 +- fix systemd-units requires + +* Thu Feb 24 2011 Remi Collet 5.3.5-3 +- add tmpfiles.d configuration for php-fpm +- add Arch specific requires/provides + +* Wed Feb 09 2011 Fedora Release Engineering - 5.3.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Fri Jan 07 2011 Remi Collet 5.3.5-1 +- update to 5.3.5 + http://www.php.net/ChangeLog-5.php#5.3.5 +- clean duplicate configure options + +* Tue Dec 28 2010 Remi Collet 5.3.4-2 +- rebuild against MySQL 5.5.8 +- remove all RPM_SOURCE_DIR + +* Sun Dec 12 2010 Remi Collet 5.3.4-1.1 +- security patch from upstream for #660517 + +* Sat Dec 11 2010 Remi Collet 5.3.4-1 +- update to 5.3.4 + http://www.php.net/ChangeLog-5.php#5.3.4 +- move phpize to php-cli (see #657812) + +* Wed Dec 1 2010 Remi Collet 5.3.3-5 +- ghost /var/run/php-fpm (see #656660) +- add filter_setup to not provides extensions as .so + +* Mon Nov 1 2010 Joe Orton - 5.3.3-4 +- use mysql_config in libdir directly to avoid biarch build failures + +* Fri Oct 29 2010 Joe Orton - 5.3.3-3 +- rebuild for new net-snmp + +* Sun Oct 10 2010 Remi Collet 5.3.3-2 +- add php-fpm sub-package + +* Thu Jul 22 2010 Remi Collet 5.3.3-1 +- PHP 5.3.3 released + +* Fri Apr 30 2010 Remi Collet 5.3.2-3 +- garbage collector upstream patches (#580236) + +* Fri Apr 02 2010 Caolán McNamara 5.3.2-2 +- rebuild for icu 4.4 + +* Sat Mar 06 2010 Remi Collet 5.3.2-1 +- PHP 5.3.2 Released! +- remove mime_magic option (now provided by fileinfo, by emu) +- add patch for http://bugs.php.net/50578 +- remove patch for libedit (upstream) +- add runselftest option to allow build without test suite + +* Fri Nov 27 2009 Joe Orton - 5.3.1-3 +- update to v7 of systzdata patch + +* Wed Nov 25 2009 Joe Orton - 5.3.1-2 +- fix build with autoconf 2.6x + +* Fri Nov 20 2009 Remi Collet 5.3.1-1 +- update to 5.3.1 +- remove openssl patch (merged upstream) +- add provides for php-pecl-json +- add prod/devel php.ini in doc + +* Tue Nov 17 2009 Tom "spot" Callaway - 5.3.0-7 +- use libedit instead of readline to resolve licensing issues + +* Tue Aug 25 2009 Tomas Mraz - 5.3.0-6 +- rebuilt with new openssl + +* Sun Jul 26 2009 Fedora Release Engineering - 5.3.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Thu Jul 16 2009 Joe Orton 5.3.0-4 +- rediff systzdata patch + +* Thu Jul 16 2009 Joe Orton 5.3.0-3 +- update to v6 of systzdata patch; various fixes + +* Tue Jul 14 2009 Joe Orton 5.3.0-2 +- update to v5 of systzdata patch; parses zone.tab and extracts + timezone->{country-code,long/lat,comment} mapping table + +* Sun Jul 12 2009 Remi Collet 5.3.0-1 +- update to 5.3.0 +- remove ncurses, dbase, mhash extensions +- add enchant, sqlite3, intl, phar, fileinfo extensions +- raise sqlite version to 3.6.0 (for sqlite3, build with --enable-load-extension) +- sync with upstream "production" php.ini + +* Sun Jun 21 2009 Remi Collet 5.2.10-1 +- update to 5.2.10 +- add interbase sub-package + +* Sat Feb 28 2009 Remi Collet - 5.2.9-1 +- update to 5.2.9 + +* Thu Feb 26 2009 Fedora Release Engineering - 5.2.8-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Thu Feb 5 2009 Joe Orton 5.2.8-9 +- add recode support, -recode subpackage (#106755) +- add -zts subpackage with ZTS-enabled build of httpd SAPI +- adjust php.conf to use -zts SAPI build for worker MPM + +* Wed Feb 4 2009 Joe Orton 5.2.8-8 +- fix patch fuzz, renumber patches + +* Wed Feb 4 2009 Joe Orton 5.2.8-7 +- drop obsolete configure args +- drop -odbc patch (#483690) + +* Mon Jan 26 2009 Joe Orton 5.2.8-5 +- split out sysvshm, sysvsem, sysvmsg, posix into php-process + +* Sun Jan 25 2009 Joe Orton 5.2.8-4 +- move wddx to php-xml, build curl shared in -common +- remove BR for expat-devel, bogus configure option + +* Fri Jan 23 2009 Joe Orton 5.2.8-3 +- rebuild for new MySQL + +* Sat Dec 13 2008 Remi Collet 5.2.8-2 +- libtool 2 workaround for phpize (#476004) +- add missing php_embed.h (#457777) + +* Tue Dec 09 2008 Remi Collet 5.2.8-1 +- update to 5.2.8 + +* Sat Dec 06 2008 Remi Collet 5.2.7-1.1 +- libtool 2 workaround + +* Fri Dec 05 2008 Remi Collet 5.2.7-1 +- update to 5.2.7 +- enable pdo_dblib driver in php-mssql + +* Mon Nov 24 2008 Joe Orton 5.2.6-7 +- tweak Summary, thanks to Richard Hughes + +* Tue Nov 4 2008 Joe Orton 5.2.6-6 +- move gd_README to php-gd +- update to r4 of systzdata patch; introduces a default timezone + name of "System/Localtime", which uses /etc/localtime (#469532) + +* Sat Sep 13 2008 Remi Collet 5.2.6-5 +- enable XPM support in php-gd +- Fix BR for php-gd + +* Sun Jul 20 2008 Remi Collet 5.2.6-4 +- enable T1lib support in php-gd + +* Mon Jul 14 2008 Joe Orton 5.2.6-3 +- update to 5.2.6 +- sync default php.ini with upstream +- drop extension_dir from default php.ini, rely on hard-coded + default, to make php-common multilib-safe (#455091) +- update to r3 of systzdata patch + +* Thu Apr 24 2008 Joe Orton 5.2.5-7 +- split pspell extension out into php-spell (#443857) + +* Tue Feb 19 2008 Fedora Release Engineering - 5.2.5-6 +- Autorebuild for GCC 4.3 + +* Fri Jan 11 2008 Joe Orton 5.2.5-5 +- ext/date: use system timezone database + +* Fri Dec 28 2007 Joe Orton 5.2.5-4 +- rebuild for libc-client bump + +* Wed Dec 05 2007 Release Engineering - 5.2.5-3 +- Rebuild for openssl bump + +* Wed Dec 5 2007 Joe Orton 5.2.5-2 +- update to 5.2.5 + +* Mon Oct 15 2007 Joe Orton 5.2.4-3 +- correct pcre BR version (#333021) +- restore metaphone fix (#205714) +- add READMEs to php-cli + +* Sun Sep 16 2007 Joe Orton 5.2.4-2 +- update to 5.2.4 + +* Sun Sep 2 2007 Joe Orton 5.2.3-9 +- rebuild for fixed APR + +* Tue Aug 28 2007 Joe Orton 5.2.3-8 +- add ldconfig post/postun for -embedded (Hans de Goede) + +* Fri Aug 10 2007 Hans de Goede 5.2.3-7 +- add php-embedded sub-package + +* Fri Aug 10 2007 Joe Orton 5.2.3-6 +- fix build with new glibc +- fix License + +* Mon Jul 16 2007 Joe Orton 5.2.3-5 +- define php_extdir in macros.php + +* Mon Jul 2 2007 Joe Orton 5.2.3-4 +- obsolete php-dbase + +* Tue Jun 19 2007 Joe Orton 5.2.3-3 +- add mcrypt, mhash, tidy, mssql subpackages (Dmitry Butskoy) +- enable dbase extension and package in -common + +* Fri Jun 8 2007 Joe Orton 5.2.3-2 +- update to 5.2.3 (thanks to Jeff Sheltren) + +* Wed May 9 2007 Joe Orton 5.2.2-4 +- fix php-pdo *_arg_force_ref global symbol abuse (#216125) + +* Tue May 8 2007 Joe Orton 5.2.2-3 +- rebuild against uw-imap-devel + +* Fri May 4 2007 Joe Orton 5.2.2-2 +- update to 5.2.2 +- synch changes from upstream recommended php.ini + +* Thu Mar 29 2007 Joe Orton 5.2.1-5 +- enable SASL support in LDAP extension (#205772) + +* Wed Mar 21 2007 Joe Orton 5.2.1-4 +- drop mime_magic extension (deprecated by php-pecl-Fileinfo) + +* Mon Feb 19 2007 Joe Orton 5.2.1-3 +- fix regression in str_{i,}replace (from upstream) + +* Thu Feb 15 2007 Joe Orton 5.2.1-2 +- update to 5.2.1 +- add Requires(pre) for httpd +- trim %%changelog to versions >= 5.0.0 + +* Thu Feb 8 2007 Joe Orton 5.2.0-10 +- bump default memory_limit to 32M (#220821) +- mark config files noreplace again (#174251) +- drop trailing dots from Summary fields +- use standard BuildRoot +- drop libtool15 patch (#226294) + +* Tue Jan 30 2007 Joe Orton 5.2.0-9 +- add php(api), php(zend-abi) provides (#221302) +- package /usr/share/php and append to default include_path (#225434) + +* Tue Dec 5 2006 Joe Orton 5.2.0-8 +- fix filter.h installation path +- fix php-zend-abi version (Remi Collet, #212804) + +* Tue Nov 28 2006 Joe Orton 5.2.0-7 +- rebuild again + +* Tue Nov 28 2006 Joe Orton 5.2.0-6 +- rebuild for net-snmp soname bump + +* Mon Nov 27 2006 Joe Orton 5.2.0-5 +- build json and zip shared, in -common (Remi Collet, #215966) +- obsolete php-json and php-pecl-zip +- build readline extension into /usr/bin/php* (#210585) +- change module subpackages to require php-common not php (#177821) + +* Wed Nov 15 2006 Joe Orton 5.2.0-4 +- provide php-zend-abi (#212804) +- add /etc/rpm/macros.php exporting interface versions +- synch with upstream recommended php.ini + +* Wed Nov 15 2006 Joe Orton 5.2.0-3 +- update to 5.2.0 (#213837) +- php-xml provides php-domxml (#215656) +- fix php-pdo-abi provide (#214281) + +* Tue Oct 31 2006 Joseph Orton 5.1.6-4 +- rebuild for curl soname bump +- add build fix for curl 7.16 API + +* Wed Oct 4 2006 Joe Orton 5.1.6-3 +- from upstream: add safety checks against integer overflow in _ecalloc + +* Tue Aug 29 2006 Joe Orton 5.1.6-2 +- update to 5.1.6 (security fixes) +- bump default memory_limit to 16M (#196802) + +* Wed Jul 12 2006 Jesse Keating - 5.1.4-8.1 +- rebuild + +* Fri Jun 9 2006 Joe Orton 5.1.4-8 +- Provide php-posix (#194583) +- only provide php-pcntl from -cli subpackage +- add missing defattr's (thanks to Matthias Saou) + +* Fri Jun 9 2006 Joe Orton 5.1.4-7 +- move Obsoletes for php-openssl to -common (#194501) +- Provide: php-cgi from -cli subpackage + +* Fri Jun 2 2006 Joe Orton 5.1.4-6 +- split out php-cli, php-common subpackages (#177821) +- add php-pdo-abi version export (#193202) + +* Wed May 24 2006 Radek Vokal 5.1.4-5.1 +- rebuilt for new libnetsnmp + +* Thu May 18 2006 Joe Orton 5.1.4-5 +- provide mod_php (#187891) +- provide php-cli (#192196) +- use correct LDAP fix (#181518) +- define _GNU_SOURCE in php_config.h and leave it defined +- drop (circular) dependency on php-pear + +* Mon May 8 2006 Joe Orton 5.1.4-3 +- update to 5.1.4 + +* Wed May 3 2006 Joe Orton 5.1.3-3 +- update to 5.1.3 + +* Tue Feb 28 2006 Joe Orton 5.1.2-5 +- provide php-api (#183227) +- add provides for all builtin modules (Tim Jackson, #173804) +- own %%{_libdir}/php/pear for PEAR packages (per #176733) +- add obsoletes to allow upgrade from FE4 PDO packages (#181863) + +* Fri Feb 10 2006 Jesse Keating - 5.1.2-4.3 +- bump again for double-long bug on ppc(64) + +* Tue Feb 07 2006 Jesse Keating - 5.1.2-4.1 +- rebuilt for new gcc4.1 snapshot and glibc changes + +* Tue Jan 31 2006 Joe Orton 5.1.2-4 +- rebuild for new libc-client soname + +* Mon Jan 16 2006 Joe Orton 5.1.2-3 +- only build xmlreader and xmlwriter shared (#177810) + +* Fri Jan 13 2006 Joe Orton 5.1.2-2 +- update to 5.1.2 + +* Thu Jan 5 2006 Joe Orton 5.1.1-8 +- rebuild again + +* Mon Jan 2 2006 Joe Orton 5.1.1-7 +- rebuild for new net-snmp + +* Mon Dec 12 2005 Joe Orton 5.1.1-6 +- enable short_open_tag in default php.ini again (#175381) + +* Fri Dec 09 2005 Jesse Keating +- rebuilt + +* Thu Dec 8 2005 Joe Orton 5.1.1-5 +- require net-snmp for php-snmp (#174800) + +* Sun Dec 4 2005 Joe Orton 5.1.1-4 +- add /usr/share/pear back to hard-coded include_path (#174885) + +* Fri Dec 2 2005 Joe Orton 5.1.1-3 +- rebuild for httpd 2.2 + +* Mon Nov 28 2005 Joe Orton 5.1.1-2 +- update to 5.1.1 +- remove pear subpackage +- enable pdo extensions (php-pdo subpackage) +- remove non-standard conditional module builds +- enable xmlreader extension + +* Thu Nov 10 2005 Tomas Mraz 5.0.5-6 +- rebuilt against new openssl + +* Mon Nov 7 2005 Joe Orton 5.0.5-5 +- pear: update to XML_RPC 1.4.4, XML_Parser 1.2.7, Mail 1.1.9 (#172528) + +* Tue Nov 1 2005 Joe Orton 5.0.5-4 +- rebuild for new libnetsnmp + +* Wed Sep 14 2005 Joe Orton 5.0.5-3 +- update to 5.0.5 +- add fix for upstream #34435 +- devel: require autoconf, automake (#159283) +- pear: update to HTTP-1.3.6, Mail-1.1.8, Net_SMTP-1.2.7, XML_RPC-1.4.1 +- fix imagettftext et al (upstream, #161001) + +* Thu Jun 16 2005 Joe Orton 5.0.4-11 +- ldap: restore ldap_start_tls() function + +* Fri May 6 2005 Joe Orton 5.0.4-10 +- disable RPATHs in shared extensions (#156974) + +* Tue May 3 2005 Joe Orton 5.0.4-9 +- build simplexml_import_dom even with shared dom (#156434) +- prevent truncation of copied files to ~2Mb (#155916) +- install /usr/bin/php from CLI build alongside CGI +- enable sysvmsg extension (#142988) + +* Mon Apr 25 2005 Joe Orton 5.0.4-8 +- prevent build of builtin dba as well as shared extension + +* Wed Apr 13 2005 Joe Orton 5.0.4-7 +- split out dba and bcmath extensions into subpackages +- BuildRequire gcc-c++ to avoid AC_PROG_CXX{,CPP} failure (#155221) +- pear: update to DB-1.7.6 +- enable FastCGI support in /usr/bin/php-cgi (#149596) + +* Wed Apr 13 2005 Joe Orton 5.0.4-6 +- build /usr/bin/php with the CLI SAPI, and add /usr/bin/php-cgi, + built with the CGI SAPI (thanks to Edward Rudd, #137704) +- add php(1) man page for CLI +- fix more test cases to use -n when invoking php + +* Wed Apr 13 2005 Joe Orton 5.0.4-5 +- rebuild for new libpq soname + +* Tue Apr 12 2005 Joe Orton 5.0.4-4 +- bundle from PEAR: HTTP, Mail, XML_Parser, Net_Socket, Net_SMTP +- snmp: disable MSHUTDOWN function to prevent error_log noise (#153988) +- mysqli: add fix for crash on x86_64 (Georg Richter, upstream #32282) + +* Mon Apr 11 2005 Joe Orton 5.0.4-3 +- build shared objects as PIC (#154195) + +* Mon Apr 4 2005 Joe Orton 5.0.4-2 +- fix PEAR installation and bundle PEAR DB-1.7.5 package + +* Fri Apr 1 2005 Joe Orton 5.0.4-1 +- update to 5.0.4 (#153068) +- add .phps AddType to php.conf (#152973) +- better gcc4 fix for libxmlrpc + +* Wed Mar 30 2005 Joe Orton 5.0.3-5 +- BuildRequire mysql-devel >= 4.1 +- don't mark php.ini as noreplace to make upgrades work (#152171) +- fix subpackage descriptions (#152628) +- fix memset(,,0) in Zend (thanks to Dave Jones) +- fix various compiler warnings in Zend + +* Thu Mar 24 2005 Joe Orton 5.0.3-4 +- package mysqli extension in php-mysql +- really enable pcntl (#142903) +- don't build with --enable-safe-mode (#148969) +- use "Instant Client" libraries for oci8 module (Kai Bolay, #149873) + +* Fri Feb 18 2005 Joe Orton 5.0.3-3 +- fix build with GCC 4 + +* Wed Feb 9 2005 Joe Orton 5.0.3-2 +- install the ext/gd headers (#145891) +- enable pcntl extension in /usr/bin/php (#142903) +- add libmbfl array arithmetic fix (dcb314@hotmail.com, #143795) +- add BuildRequire for recent pcre-devel (#147448) + +* Wed Jan 12 2005 Joe Orton 5.0.3-1 +- update to 5.0.3 (thanks to Robert Scheck et al, #143101) +- enable xsl extension (#142174) +- package both the xsl and dom extensions in php-xml +- enable soap extension, shared (php-soap package) (#142901) +- add patches from upstream 5.0 branch: + * Zend_strtod.c compile fixes + * correct php_sprintf return value usage + +* Mon Nov 22 2004 Joe Orton 5.0.2-8 +- update for db4-4.3 (Robert Scheck, #140167) +- build against mysql-devel +- run tests in %%check + +* Wed Nov 10 2004 Joe Orton 5.0.2-7 +- truncate changelog at 4.3.1-1 +- merge from 4.3.x package: + - enable mime_magic extension and Require: file (#130276) + +* Mon Nov 8 2004 Joe Orton 5.0.2-6 +- fix dom/sqlite enable/without confusion + +* Mon Nov 8 2004 Joe Orton 5.0.2-5 +- fix phpize installation for lib64 platforms +- add fix for segfault in variable parsing introduced in 5.0.2 + +* Mon Nov 8 2004 Joe Orton 5.0.2-4 +- update to 5.0.2 (#127980) +- build against mysqlclient10-devel +- use new RTLD_DEEPBIND to load extension modules +- drop explicit requirement for elfutils-devel +- use AddHandler in default conf.d/php.conf (#135664) +- "fix" round() fudging for recent gcc on x86 +- disable sqlite pending audit of warnings and subpackage split + +* Fri Sep 17 2004 Joe Orton 5.0.1-4 +- don't build dom extension into 2.0 SAPI + +* Fri Sep 17 2004 Joe Orton 5.0.1-3 +- ExclusiveArch: x86 ppc x86_64 for the moment + +* Fri Sep 17 2004 Joe Orton 5.0.1-2 +- fix default extension_dir and conf.d/php.conf + +* Thu Sep 9 2004 Joe Orton 5.0.1-1 +- update to 5.0.1 +- only build shared modules once +- put dom extension in php-dom subpackage again +- move extension modules into %%{_libdir}/php/modules +- don't use --with-regex=system, it's ignored for the apache* SAPIs + +* Wed Aug 11 2004 Tom Callaway +- Merge in some spec file changes from Jeff Stern (jastern@uci.edu) + +* Mon Aug 09 2004 Tom Callaway +- bump to 5.0.0 +- add patch to prevent clobbering struct re_registers from regex.h +- remove domxml references, replaced with dom now built-in +- fix php.ini to refer to php5 not php4 -- cgit