Skip to content

Commit 0f33561

Browse files
zhengkunwang223zhengkunwang223
committed
fix(php): repair PECL downloads across runtime images
Upgrade pinned PEAR and legacy Archive_Tar, fix PHP 5.6 CA lookup, and use signed Bullseye archives. Add the legacy PHP 7 release workflow and repeatable PECL checks.
1 parent 193a789 commit 0f33561

12 files changed

Lines changed: 224 additions & 11 deletions

File tree

‎.github/workflows/php7-legacy-release.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Build PHP 7 Legacy Images
2+
run-name: Build PHP 7 Legacy Images 7.0.33, 7.1.33, 7.2.34
3+
4+
on:
5+
workflow_dispatch:
6+
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
docker:
12+
name: Build PHP Image ${{ matrix.phpVersion }}
13+
runs-on: ubuntu-latest
14+
strategy:
15+
fail-fast: false
16+
max-parallel: 1
17+
matrix:
18+
phpVersion: ["7.0.33", "7.1.33", "7.2.34"]
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@v5
22+
23+
- name: Set up QEMU
24+
uses: docker/setup-qemu-action@v3
25+
26+
- name: Set up Docker Buildx
27+
uses: docker/setup-buildx-action@v3
28+
29+
- name: Login to Docker Hub
30+
uses: docker/login-action@v3
31+
with:
32+
username: ${{ secrets.DOCKERHUB_USERNAME }}
33+
password: ${{ secrets.DOCKERHUB_PASSWORD }}
34+
35+
- name: Build PHP-FPM image and push
36+
uses: docker/build-push-action@v6
37+
with:
38+
context: php/${{ matrix.phpVersion }}
39+
file: php/${{ matrix.phpVersion }}/Dockerfile
40+
platforms: linux/amd64,linux/arm64/v8,linux/arm/v7
41+
push: true
42+
tags: 1panel/php:${{ matrix.phpVersion }}-fpm
43+
cache-from: type=gha,scope=php-legacy-${{ matrix.phpVersion }}
44+
cache-to: type=gha,mode=max,scope=php-legacy-${{ matrix.phpVersion }}

‎README.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,27 @@ Current images in this repository:
3030

3131
`Build PHP 8 Security Images` builds PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 from pinned upstream Dockerfiles, without waiting for official base image tags. See [source provenance and build instructions](php/8/upstream/README.md).
3232

33+
## PHP extension downloads
34+
35+
The PHP 5.6, PHP 7 and PHP 8 images install checksum-pinned PEAR 1.10.18 after compiling PHP. The separate 5.6/7.0–7.2 contexts first upgrade checksum-pinned Archive_Tar 1.4.14 to satisfy its dependency. PHP 5.6 uses the system CA bundle through `SSL_CERT_FILE`, with certificate verification enabled. This includes the upstream [HTTP chunked response fix](https://github.com/pear/pear-core/pull/152), which prevents PECL metadata from failing with `does not have REST info xml available`. The bootstrap uses curl and a local, offline upgrade because the older PEAR downloader cannot fetch the update reliably.
36+
37+
Run `bash tests/check-php-pecl.sh IMAGE` against a built image to download, compile and load APCu in a disposable container and verify a cache write/read. It selects APCu 4.0.11 for PHP 5.6 and needs network access. Run `python3 tests/check-php-pecl-source.py` for offline checks of all seven build contexts and the release wiring.
38+
39+
## Rebuilding PHP images
40+
41+
Commit and push the fixes, then select that branch in Actions. Existing images and running containers do not receive Dockerfile changes automatically.
42+
43+
| Action | Inputs | Published `1panel/php` tags |
44+
| --- | --- | --- |
45+
| Build PHP 5 Image | `php56Version=5.6.40` | `5.6.40-fpm` (amd64) |
46+
| Build PHP 7 Legacy Images | No inputs; builds all three versions | `7.0.33-fpm`, `7.1.33-fpm`, `7.2.34-fpm` |
47+
| Build PHP 7 Image | `php74Version=7.4.33`, `php74ImageVersion=7.4.34`, `buildPhp73=true`, `php73Version=7.3.33` | `7.4.34-fpm`, `7.3.33-fpm` |
48+
| Build PHP 8 Image | Run twice: `phpVersion=8.0.30`, then `8.1.34` | `8.0.31-fpm`, `8.1.35-fpm` |
49+
50+
The legacy PHP 7 Action uses the existing Dockerfiles and preserves the previous workflow's amd64/arm64/arm/v7 platform list; local PECL installation checks cover amd64 only. The alternative `php/5.6` context remains available through CNB. Both 5.6 contexts include the PECL fix.
51+
52+
For PHP 8.2+, rebuild only images whose PEAR is older than 1.10.17. `Build PHP 8 Security Images` rebuilds the fixed batch `8.2.35`, `8.3.36`, `8.4.27`, `8.5.12`. After publication, pull the updated base image and rebuild the 1Panel runtime.
53+
3354
## PHP EOL source backports
3455

3556
PHP 7.4.33, 8.0.30 and 8.1.34 builds apply the official minimal source backports for CVE-2026-109618 / CVE-2026-109619 and rebuild PHP. These branches remain EOL; older patch levels in these series now fail explicitly. `1panel/php:7.4.34-fpm`, `8.0.31-fpm` and `8.1.35-fpm` are 1Panel maintenance image tags based on official PHP 7.4.33, 8.0.30 and 8.1.34 respectively; their internal PHP versions remain unchanged. See [implementation, compatibility changes and validation](php/EOL-BACKPORT.md).

‎README_zh.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,27 @@
3030

3131
`Build PHP 8 Security Images` 从固定上游提交的 Dockerfile 构建 PHP 8.2.35、8.3.36、8.4.27 和 8.5.12，不依赖尚未发布的官方基础镜像标签。详见[源码来源和构建说明](php/8/upstream/README.md)。
3232

33+
## PHP 扩展下载
34+
35+
PHP 5.6、PHP 7 和 PHP 8 镜像在编译 PHP 后安装固定版本、校验 SHA256 的 PEAR 1.10.18。独立的 5.6/7.0–7.2 构建目录先离线升级固定版本并校验 SHA256 的 Archive_Tar 1.4.14，以满足其依赖。PHP 5.6 通过 `SSL_CERT_FILE` 使用系统 CA 证书包，保留证书校验。其中包含上游的 [HTTP 分块响应修复](https://github.com/pear/pear-core/pull/152)，避免 PECL 元数据解析报 `does not have REST info xml available`。通过 curl 下载后离线升级，避免旧版 PEAR 下载器无法下载自身更新。
36+
37+
构建镜像后运行 `bash tests/check-php-pecl.sh IMAGE`，在临时容器中下载、编译、加载 APCu 并检查缓存读写。PHP 5.6 自动选择 APCu 4.0.11，此检查需要联网。运行 `python3 tests/check-php-pecl-source.py` 可离线检查全部七个构建目录及发布入口。
38+
39+
## 重新发布 PHP 镜像
40+
41+
先提交并推送修复，在 Actions 中选择包含修复的分支。已发布镜像和运行中的容器不会自动获得 Dockerfile 修改。
42+
43+
| Action | 参数 | 发布的 `1panel/php` 标签 |
44+
| --- | --- | --- |
45+
| Build PHP 5 Image | `php56Version=5.6.40` | `5.6.40-fpm`（amd64） |
46+
| Build PHP 7 Legacy Images | 无参数，一次构建三个版本 | `7.0.33-fpm`、`7.1.33-fpm`、`7.2.34-fpm` |
47+
| Build PHP 7 Image | `php74Version=7.4.33`、`php74ImageVersion=7.4.34`、`buildPhp73=true`、`php73Version=7.3.33` | `7.4.34-fpm`、`7.3.33-fpm` |
48+
| Build PHP 8 Image | 分别运行两次：`phpVersion=8.0.30`、`8.1.34` | `8.0.31-fpm`、`8.1.35-fpm` |
49+
50+
旧 PHP 7 Action 使用已有 Dockerfile，保留此前工作流的 amd64/arm64/arm/v7 平台列表；本地 PECL 安装验证仅覆盖 amd64。备用 `php/5.6` 构建目录仍可通过 CNB 选择，两个 5.6 目录均包含 PECL 修复。
51+
52+
PHP 8.2+ 仅在镜像内 PEAR 低于 1.10.17 时需要为本问题重打。`Build PHP 8 Security Images` 会重建固定的 `8.2.35`、`8.3.36`、`8.4.27`、`8.5.12` 四个版本。发布后重新拉取基础镜像，再重建 1Panel 运行环境。
53+
3354
## PHP EOL 源码回补
3455

3556
PHP 7.4.33、8.0.30 和 8.1.34 构建会应用官方针对 CVE-2026-109618 / CVE-2026-109619 的最小源码回补并重新编译 PHP。这些分支仍为 EOL，同系列更早的补丁版本现在会明确失败。`1panel/php:7.4.34-fpm`、`8.0.31-fpm` 和 `8.1.35-fpm` 为 1Panel 维护版镜像标签，分别基于官方 PHP 7.4.33、8.0.30、8.1.34 加上述回补，内部 PHP 版本保持原值。详见[实现、兼容性变化和验证说明](php/EOL-BACKPORT.md)。

‎php/5.6.40/Dockerfile‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,11 @@
55
#
66
FROM debian:bullseye-slim
77

8-
RUN sed -i 's|http://deb.debian.org|http://mirrors.tuna.tsinghua.edu.cn|g' /etc/apt/sources.list && \
9-
sed -i 's|http://security.debian.org|http://mirrors.tuna.tsinghua.edu.cn|g' /etc/apt/sources.list && \
10-
apt-get update
8+
# Signed archives work before ca-certificates is installed in the slim base.
9+
RUN printf '%s\n' \
10+
'deb [check-valid-until=no] http://archive.debian.org/debian bullseye main' \
11+
'deb [check-valid-until=no] http://archive.debian.org/debian-security bullseye-security main' \
12+
> /etc/apt/sources.list
1113

1214
# prevent Debian's PHP packages from being installed
1315
# https://github.com/docker-library/php/pull/542
@@ -92,6 +94,7 @@ COPY ./data/install-php-extensions /usr/local/bin/
9294
ENV OPENSSL_PREFIX=/usr/local/openssl
9395
ENV CURL_PREFIX=/usr/local/curl
9496
ENV LD_LIBRARY_PATH=/usr/local/openssl/lib:$LD_LIBRARY_PATH
97+
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
9598

9699
RUN cd /tmp && \
97100
tar -xzf openssl-1.0.2u.tar.gz && \
@@ -190,8 +193,15 @@ RUN set -eux; \
190193
php --version; \
191194
\
192195
# https://github.com/docker-library/php/issues/443
193-
pecl update-channels; \
194-
rm -rf /tmp/pear ~/.pearrc
196+
# Bootstrap a fixed downloader before requesting any PECL metadata.
197+
curl -fsSL --retry 3 https://pear.php.net/get/Archive_Tar-1.4.14.tgz -o /tmp/Archive_Tar.tgz; \
198+
echo '4af263e4fdfcb400f888f84cccf8d05d1be2eb78128349431405b2ffb0c0c9f4 /tmp/Archive_Tar.tgz' | sha256sum -c -; \
199+
pear upgrade --offline --loose /tmp/Archive_Tar.tgz; \
200+
curl -fsSL --retry 3 https://pear.php.net/get/PEAR-1.10.18.tgz -o /tmp/PEAR.tgz; \
201+
echo '276db000b4e0a9388c7f5168522174bae4144c8c411a71d480b82ec25ee3bc8b /tmp/PEAR.tgz' | sha256sum -c -; \
202+
pear upgrade --offline --loose /tmp/PEAR.tgz; \
203+
pecl channel-update https://pecl.php.net/channel.xml; \
204+
rm -rf /tmp/Archive_Tar.tgz /tmp/PEAR.tgz /tmp/pear ~/.pearrc
195205

196206
RUN set -ex \
197207
&& cd /usr/local/etc \

‎php/5.6/Dockerfile‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,18 @@ RUN apt-get -qq update -o Acquire::AllowInsecureRepositories=true -o Acquire::Al
1616
apt-get clean && \
1717
rm -rf /var/lib/apt/lists/*
1818

19+
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
20+
21+
# PEAR before 1.10.17 cannot decode PECL's chunked HTTP responses.
22+
RUN curl -fsSL --retry 3 https://pear.php.net/get/Archive_Tar-1.4.14.tgz -o /tmp/Archive_Tar.tgz && \
23+
echo '4af263e4fdfcb400f888f84cccf8d05d1be2eb78128349431405b2ffb0c0c9f4 /tmp/Archive_Tar.tgz' | sha256sum -c - && \
24+
pear upgrade --offline --loose /tmp/Archive_Tar.tgz && \
25+
curl -fsSL --retry 3 https://pear.php.net/get/PEAR-1.10.18.tgz -o /tmp/PEAR.tgz && \
26+
echo '276db000b4e0a9388c7f5168522174bae4144c8c411a71d480b82ec25ee3bc8b /tmp/PEAR.tgz' | sha256sum -c - && \
27+
pear upgrade --offline --loose /tmp/PEAR.tgz && \
28+
pecl channel-update https://pecl.php.net/channel.xml && \
29+
rm -rf /tmp/Archive_Tar.tgz /tmp/PEAR.tgz /tmp/pear
30+
1931
RUN chmod uga+x /usr/local/bin/install-php-extensions && \
2032
chmod +x /usr/bin/composer
2133

‎php/7.0.33/Dockerfile‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,12 @@ FROM php:7.0.33-fpm AS php-source
88

99
FROM debian:bullseye-slim
1010

11+
# Signed archives work before ca-certificates is installed in the slim base.
12+
RUN printf '%s\n' \
13+
'deb [check-valid-until=no] http://archive.debian.org/debian bullseye main' \
14+
'deb [check-valid-until=no] http://archive.debian.org/debian-security bullseye-security main' \
15+
> /etc/apt/sources.list
16+
1117
# prevent Debian's PHP packages from being installed
1218
# https://github.com/docker-library/php/pull/542
1319
RUN set -eux; \
@@ -158,8 +164,15 @@ RUN set -eux; \
158164
php --version; \
159165
\
160166
# https://github.com/docker-library/php/issues/443
161-
pecl update-channels; \
162-
rm -rf /tmp/pear ~/.pearrc
167+
# Bootstrap a fixed downloader before requesting any PECL metadata.
168+
curl -fsSL --retry 3 https://pear.php.net/get/Archive_Tar-1.4.14.tgz -o /tmp/Archive_Tar.tgz; \
169+
echo '4af263e4fdfcb400f888f84cccf8d05d1be2eb78128349431405b2ffb0c0c9f4 /tmp/Archive_Tar.tgz' | sha256sum -c -; \
170+
pear upgrade --offline --loose /tmp/Archive_Tar.tgz; \
171+
curl -fsSL --retry 3 https://pear.php.net/get/PEAR-1.10.18.tgz -o /tmp/PEAR.tgz; \
172+
echo '276db000b4e0a9388c7f5168522174bae4144c8c411a71d480b82ec25ee3bc8b /tmp/PEAR.tgz' | sha256sum -c -; \
173+
pear upgrade --offline --loose /tmp/PEAR.tgz; \
174+
pecl channel-update https://pecl.php.net/channel.xml; \
175+
rm -rf /tmp/Archive_Tar.tgz /tmp/PEAR.tgz /tmp/pear ~/.pearrc
163176

164177
#COPY docker-php-ext-* docker-php-entrypoint /usr/local/bin/
165178

‎php/7.1.33/Dockerfile‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,12 @@ FROM php:7.1.33-fpm AS php-source
77

88
FROM debian:bullseye-slim
99

10+
# Signed archives work before ca-certificates is installed in the slim base.
11+
RUN printf '%s\n' \
12+
'deb [check-valid-until=no] http://archive.debian.org/debian bullseye main' \
13+
'deb [check-valid-until=no] http://archive.debian.org/debian-security bullseye-security main' \
14+
> /etc/apt/sources.list
15+
1016
# prevent Debian's PHP packages from being installed
1117
# https://github.com/docker-library/php/pull/542
1218
RUN set -eux; \
@@ -163,8 +169,15 @@ RUN set -eux; \
163169
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
164170
\
165171
# update pecl channel definitions https://github.com/docker-library/php/issues/443
166-
pecl update-channels; \
167-
rm -rf /tmp/pear ~/.pearrc; \
172+
# Bootstrap a fixed downloader before requesting any PECL metadata.
173+
curl -fsSL --retry 3 https://pear.php.net/get/Archive_Tar-1.4.14.tgz -o /tmp/Archive_Tar.tgz; \
174+
echo '4af263e4fdfcb400f888f84cccf8d05d1be2eb78128349431405b2ffb0c0c9f4 /tmp/Archive_Tar.tgz' | sha256sum -c -; \
175+
pear upgrade --offline --loose /tmp/Archive_Tar.tgz; \
176+
curl -fsSL --retry 3 https://pear.php.net/get/PEAR-1.10.18.tgz -o /tmp/PEAR.tgz; \
177+
echo '276db000b4e0a9388c7f5168522174bae4144c8c411a71d480b82ec25ee3bc8b /tmp/PEAR.tgz' | sha256sum -c -; \
178+
pear upgrade --offline --loose /tmp/PEAR.tgz; \
179+
pecl channel-update https://pecl.php.net/channel.xml; \
180+
rm -rf /tmp/Archive_Tar.tgz /tmp/PEAR.tgz /tmp/pear ~/.pearrc; \
168181
# smoke test
169182
php --version
170183

‎php/7.2.34/Dockerfile‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,12 @@ FROM php:7.2.34-fpm AS php-source
77

88
FROM debian:bullseye-slim
99

10+
# Signed archives work before ca-certificates is installed in the slim base.
11+
RUN printf '%s\n' \
12+
'deb [check-valid-until=no] http://archive.debian.org/debian bullseye main' \
13+
'deb [check-valid-until=no] http://archive.debian.org/debian-security bullseye-security main' \
14+
> /etc/apt/sources.list
15+
1016
# prevent Debian's PHP packages from being installed
1117
# https://github.com/docker-library/php/pull/542
1218
RUN set -eux; \
@@ -170,8 +176,15 @@ RUN set -eux; \
170176
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
171177
\
172178
# update pecl channel definitions https://github.com/docker-library/php/issues/443
173-
pecl update-channels; \
174-
rm -rf /tmp/pear ~/.pearrc; \
179+
# Bootstrap a fixed downloader before requesting any PECL metadata.
180+
curl -fsSL --retry 3 https://pear.php.net/get/Archive_Tar-1.4.14.tgz -o /tmp/Archive_Tar.tgz; \
181+
echo '4af263e4fdfcb400f888f84cccf8d05d1be2eb78128349431405b2ffb0c0c9f4 /tmp/Archive_Tar.tgz' | sha256sum -c -; \
182+
pear upgrade --offline --loose /tmp/Archive_Tar.tgz; \
183+
curl -fsSL --retry 3 https://pear.php.net/get/PEAR-1.10.18.tgz -o /tmp/PEAR.tgz; \
184+
echo '276db000b4e0a9388c7f5168522174bae4144c8c411a71d480b82ec25ee3bc8b /tmp/PEAR.tgz' | sha256sum -c -; \
185+
pear upgrade --offline --loose /tmp/PEAR.tgz; \
186+
pecl channel-update https://pecl.php.net/channel.xml; \
187+
rm -rf /tmp/Archive_Tar.tgz /tmp/PEAR.tgz /tmp/pear ~/.pearrc; \
175188
# smoke test
176189
php --version
177190

‎php/7/Dockerfile‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,13 @@ COPY ./data/prepare-apt /usr/local/bin/
1111
# Rebuild only the exact EOL baselines; all other series return immediately.
1212
RUN sh /usr/local/bin/rebuild-php-eol
1313

14+
# PEAR before 1.10.17 cannot decode PECL's chunked HTTP responses.
15+
RUN curl -fsSL --retry 3 https://pear.php.net/get/PEAR-1.10.18.tgz -o /tmp/PEAR.tgz && \
16+
echo '276db000b4e0a9388c7f5168522174bae4144c8c411a71d480b82ec25ee3bc8b /tmp/PEAR.tgz' | sha256sum -c - && \
17+
pear upgrade --offline --loose /tmp/PEAR.tgz && \
18+
pecl channel-update https://pecl.php.net/channel.xml && \
19+
rm -rf /tmp/PEAR.tgz /tmp/pear
20+
1421
RUN chmod uga+x /usr/local/bin/prepare-apt && \
1522
prepare-apt && \
1623
apt-get update && \

‎php/8/Dockerfile‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,13 @@ COPY ./data/prepare-apt /usr/local/bin/
1010
# Rebuild only the exact EOL baselines; all other series return immediately.
1111
RUN sh /usr/local/bin/rebuild-php-eol
1212

13+
# PEAR before 1.10.17 cannot decode PECL's chunked HTTP responses.
14+
RUN curl -fsSL --retry 3 https://pear.php.net/get/PEAR-1.10.18.tgz -o /tmp/PEAR.tgz && \
15+
echo '276db000b4e0a9388c7f5168522174bae4144c8c411a71d480b82ec25ee3bc8b /tmp/PEAR.tgz' | sha256sum -c - && \
16+
pear upgrade --offline --loose /tmp/PEAR.tgz && \
17+
pecl channel-update https://pecl.php.net/channel.xml && \
18+
rm -rf /tmp/PEAR.tgz /tmp/pear
19+
1320
RUN apt-get update && \
1421
apt-get install -y --no-install-recommends supervisor && \
1522
mkdir -p /var/log/supervisor /etc/supervisor/conf.d && \

0 commit comments

Comments
 (0)