Skip to content

Commit 305e2ef

Browse files
abnegateabnegate
committed
(fix): pin extension sources by commit and checksum
Extensions were built from `git clone --branch <tag>` and `pecl install <package>-<version>`, both of which resolve through a mutable pointer — an upstream tag can be deleted and recreated on a different commit, and the build would silently compile it into an image that runs as the base for every Appwrite service. Each git extension now carries a PHP_*_COMMIT alongside its version and is fetched by that SHA directly (`git init` + `git fetch --depth 1 <url> <sha>`), so the tag is never consulted; protobuf carries a PHP_PROTOBUF_CHECKSUM and its PECL tarball is verified with sha256sum before install. Submodules stay transitively pinned through the parent commit's gitlinks. The version is kept beside each reference so the release it was resolved from stays readable, and so tests.yaml has something to assert against. Everything moves to its latest compatible release in the same pass, since a stale pin is now genuinely frozen: base image digest, brotli 0.18.3 -> 0.20.0, lz4 0.6.0 -> 0.7.0, mongodb 2.2.1 -> 2.3.3, protobuf 5.34.0 -> 5.35.1, scrypt 2.0.1 -> 2.0.2, swoole 6.2.0 -> 6.2.2, xdebug 3.5.1 -> 3.5.3, zstd 0.15.2 -> 0.17.0.
1 parent e4b9834 commit 305e2ef

2 files changed

Lines changed: 82 additions & 38 deletions

File tree

‎Dockerfile‎

Lines changed: 81 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,38 @@
11
# Pin php:8.5-alpine by multi-arch index digest. Bump with:
22
# docker buildx imagetools inspect php:8.5-alpine | head -2
3-
ARG BASE_IMAGE="php:8.5-alpine@sha256:3cfccf28acfbb58ae991324612a3b0e2062a572026bb4dca030020e5295d1633"
3+
ARG BASE_IMAGE="php:8.5-alpine@sha256:0554eb53778b5316f6b9a3447c9dfa3cf2141c0c02ff816c42cdc9aa240a34aa"
44

55
FROM $BASE_IMAGE AS compile
66

7+
# Every source is fetched by immutable reference — a commit SHA for git, a
8+
# tarball checksum for PECL — because a tag can be repointed at any time. The
9+
# version beside each reference is the release it was resolved from; the
10+
# weekly updater rewrites both together.
711
ENV \
8-
PHP_BROTLI_VERSION="0.18.3" \
12+
PHP_BROTLI_VERSION="0.20.0" \
13+
PHP_BROTLI_COMMIT="45faa7966ddcec080d04d72ea4b85e3629857f64" \
914
PHP_IMAGICK_VERSION="3.8.1" \
10-
PHP_LZ4_VERSION="0.6.0" \
15+
PHP_IMAGICK_COMMIT="70087bab33eab913e99ac77d64d04d1a2fd0b7b0" \
16+
PHP_LZ4_VERSION="0.7.0" \
17+
PHP_LZ4_COMMIT="b871fbf4d0c5c2b0cad22dd74721a340cb2e4ffa" \
1118
PHP_MAXMINDDB_VERSION="v1.13.1" \
12-
PHP_MONGODB_VERSION="2.2.1" \
13-
PHP_PROTOBUF_VERSION="5.34.0" \
19+
PHP_MAXMINDDB_COMMIT="2194f58d0f024ce923e685cdf92af3daf9951908" \
20+
PHP_MONGODB_VERSION="2.3.3" \
21+
PHP_MONGODB_COMMIT="06be1f01bb4c44f524be743dcd0a9bed26ae55f6" \
22+
PHP_PROTOBUF_VERSION="5.35.1" \
23+
PHP_PROTOBUF_CHECKSUM="7ab8cd62e8b78ff9f48462ff9e3e30fd8c2d8bb5ab760d51049b38fa0b8c559e" \
1424
PHP_REDIS_VERSION="6.3.0" \
15-
PHP_SCRYPT_VERSION="2.0.1" \
25+
PHP_REDIS_COMMIT="df4fab2de7fc327c54c94a13af2b9542e4fbd720" \
26+
PHP_SCRYPT_VERSION="2.0.2" \
27+
PHP_SCRYPT_COMMIT="5a14bc766423dac3f868792fa8c41f85f47263ec" \
1628
PHP_SNAPPY_VERSION="0.2.3" \
17-
PHP_SWOOLE_VERSION="v6.2.0" \
29+
PHP_SNAPPY_COMMIT="d31b77d63955dbbf1a302ca13c4795292f91d140" \
30+
PHP_SWOOLE_VERSION="v6.2.2" \
31+
PHP_SWOOLE_COMMIT="8e8c49915ca5f9dcb9ee654f9e336a9c88dd375e" \
1832
PHP_YAML_VERSION="2.3.0" \
19-
PHP_ZSTD_VERSION="0.15.2"
33+
PHP_YAML_COMMIT="c1f0d8ba5ef3884846261bbdb91c2ab0b07db44c" \
34+
PHP_ZSTD_VERSION="0.17.0" \
35+
PHP_ZSTD_COMMIT="1774622c25aa3c20315b5f2a5769def976f5ac8c"
2036

2137
RUN \
2238
apk update && \
@@ -26,6 +42,7 @@ RUN \
2642
automake \
2743
brotli-dev \
2844
c-ares-dev \
45+
curl \
2946
curl-dev \
3047
g++ \
3148
gcc \
@@ -55,8 +72,10 @@ RUN \
5572

5673
FROM compile AS redis
5774
RUN \
58-
git clone --depth 1 --branch $PHP_REDIS_VERSION https://github.com/phpredis/phpredis.git && \
59-
cd phpredis && \
75+
git init redis && \
76+
cd redis && \
77+
git fetch --depth 1 https://github.com/phpredis/phpredis.git $PHP_REDIS_COMMIT && \
78+
git checkout FETCH_HEAD && \
6079
phpize && \
6180
./configure && \
6281
make -j"$(nproc)" && make install && \
@@ -65,8 +84,10 @@ RUN \
6584

6685
FROM compile AS imagick
6786
RUN \
68-
git clone --depth 1 --branch $PHP_IMAGICK_VERSION https://github.com/imagick/imagick && \
87+
git init imagick && \
6988
cd imagick && \
89+
git fetch --depth 1 https://github.com/imagick/imagick $PHP_IMAGICK_COMMIT && \
90+
git checkout FETCH_HEAD && \
7091
phpize && \
7192
./configure && \
7293
make -j"$(nproc)" && make install && \
@@ -75,8 +96,10 @@ RUN \
7596

7697
FROM compile AS yaml
7798
RUN \
78-
git clone --depth 1 --branch $PHP_YAML_VERSION https://github.com/php/pecl-file_formats-yaml && \
79-
cd pecl-file_formats-yaml && \
99+
git init yaml && \
100+
cd yaml && \
101+
git fetch --depth 1 https://github.com/php/pecl-file_formats-yaml $PHP_YAML_COMMIT && \
102+
git checkout FETCH_HEAD && \
80103
phpize && \
81104
./configure && \
82105
make -j"$(nproc)" && make install && \
@@ -85,8 +108,10 @@ RUN \
85108

86109
FROM compile AS maxmind
87110
RUN \
88-
git clone --depth 1 --branch $PHP_MAXMINDDB_VERSION https://github.com/maxmind/MaxMind-DB-Reader-php.git && \
89-
cd MaxMind-DB-Reader-php && \
111+
git init maxminddb && \
112+
cd maxminddb && \
113+
git fetch --depth 1 https://github.com/maxmind/MaxMind-DB-Reader-php.git $PHP_MAXMINDDB_COMMIT && \
114+
git checkout FETCH_HEAD && \
90115
cd ext && \
91116
phpize && \
92117
./configure && \
@@ -96,8 +121,10 @@ RUN \
96121

97122
FROM compile AS mongodb
98123
RUN \
99-
git clone --depth 1 --branch $PHP_MONGODB_VERSION https://github.com/mongodb/mongo-php-driver.git && \
100-
cd mongo-php-driver && \
124+
git init mongodb && \
125+
cd mongodb && \
126+
git fetch --depth 1 https://github.com/mongodb/mongo-php-driver.git $PHP_MONGODB_COMMIT && \
127+
git checkout FETCH_HEAD && \
101128
git submodule update --init && \
102129
phpize && \
103130
./configure && \
@@ -107,9 +134,11 @@ RUN \
107134

108135
FROM compile AS zstd
109136
RUN \
110-
git clone --recursive https://github.com/kjdev/php-ext-zstd.git && \
111-
cd php-ext-zstd && \
112-
git reset --hard $PHP_ZSTD_VERSION && \
137+
git init zstd && \
138+
cd zstd && \
139+
git fetch --depth 1 https://github.com/kjdev/php-ext-zstd.git $PHP_ZSTD_COMMIT && \
140+
git checkout FETCH_HEAD && \
141+
git submodule update --init --recursive && \
113142
phpize && \
114143
./configure --with-libzstd && \
115144
make -j"$(nproc)" && make install && \
@@ -118,9 +147,10 @@ RUN \
118147

119148
FROM compile AS brotli
120149
RUN \
121-
git clone https://github.com/kjdev/php-ext-brotli.git && \
122-
cd php-ext-brotli && \
123-
git reset --hard $PHP_BROTLI_VERSION && \
150+
git init brotli && \
151+
cd brotli && \
152+
git fetch --depth 1 https://github.com/kjdev/php-ext-brotli.git $PHP_BROTLI_COMMIT && \
153+
git checkout FETCH_HEAD && \
124154
phpize && \
125155
./configure --with-libbrotli && \
126156
make -j"$(nproc)" && make install && \
@@ -129,9 +159,11 @@ RUN \
129159

130160
FROM compile AS lz4
131161
RUN \
132-
git clone --recursive https://github.com/kjdev/php-ext-lz4.git && \
133-
cd php-ext-lz4 && \
134-
git reset --hard $PHP_LZ4_VERSION && \
162+
git init lz4 && \
163+
cd lz4 && \
164+
git fetch --depth 1 https://github.com/kjdev/php-ext-lz4.git $PHP_LZ4_COMMIT && \
165+
git checkout FETCH_HEAD && \
166+
git submodule update --init --recursive && \
135167
phpize && \
136168
./configure --with-lz4-includedir=/usr && \
137169
make -j"$(nproc)" && make install && \
@@ -140,9 +172,11 @@ RUN \
140172

141173
FROM compile AS snappy
142174
RUN \
143-
git clone --recursive https://github.com/kjdev/php-ext-snappy.git && \
144-
cd php-ext-snappy && \
145-
git reset --hard $PHP_SNAPPY_VERSION && \
175+
git init snappy && \
176+
cd snappy && \
177+
git fetch --depth 1 https://github.com/kjdev/php-ext-snappy.git $PHP_SNAPPY_COMMIT && \
178+
git checkout FETCH_HEAD && \
179+
git submodule update --init --recursive && \
146180
phpize && \
147181
./configure && \
148182
make -j"$(nproc)" && make install && \
@@ -151,17 +185,21 @@ RUN \
151185

152186
FROM compile AS scrypt
153187
RUN \
154-
git clone https://github.com/DomBlack/php-scrypt.git && \
155-
cd php-scrypt && \
156-
git reset --hard $PHP_SCRYPT_VERSION && \
188+
git init scrypt && \
189+
cd scrypt && \
190+
git fetch --depth 1 https://github.com/DomBlack/php-scrypt.git $PHP_SCRYPT_COMMIT && \
191+
git checkout FETCH_HEAD && \
157192
phpize && \
158193
./configure --enable-scrypt && \
159194
make -j"$(nproc)" && make install && \
160195
cp $(php-config --extension-dir)/scrypt.so /artifacts/ && \
161196
strip /artifacts/scrypt.so
162197

163198
FROM compile AS protobuf
164-
RUN MAKEFLAGS="-j$(nproc)" pecl install protobuf-${PHP_PROTOBUF_VERSION} && \
199+
RUN curl -fsSL -o protobuf.tgz \
200+
https://pecl.php.net/get/protobuf-${PHP_PROTOBUF_VERSION}.tgz && \
201+
echo "${PHP_PROTOBUF_CHECKSUM} protobuf.tgz" | sha256sum -c - && \
202+
MAKEFLAGS="-j$(nproc)" pecl install protobuf.tgz && \
165203
cp $(php-config --extension-dir)/protobuf.so /artifacts/ && \
166204
strip /artifacts/protobuf.so
167205

@@ -190,8 +228,10 @@ RUN docker-php-ext-configure gd \
190228
# handlers, which makes opcache's JIT refuse to enable in downstream images.
191229
FROM compile AS swoole
192230
RUN \
193-
git clone --depth 1 --branch $PHP_SWOOLE_VERSION https://github.com/swoole/swoole-src.git && \
194-
cd swoole-src && \
231+
git init swoole && \
232+
cd swoole && \
233+
git fetch --depth 1 https://github.com/swoole/swoole-src.git $PHP_SWOOLE_COMMIT && \
234+
git checkout FETCH_HEAD && \
195235
phpize && \
196236
./configure \
197237
--enable-brotli \
@@ -300,11 +340,15 @@ CMD [ "tail", "-f", "/dev/null" ]
300340
# XDebug variant — build with: docker build --target xdebug -t appwrite/base:XYZ-xdebug .
301341
FROM compile AS xdebug-build
302342

303-
ENV PHP_XDEBUG_VERSION="3.5.1"
343+
ENV \
344+
PHP_XDEBUG_VERSION="3.5.3" \
345+
PHP_XDEBUG_COMMIT="127bbcb980400752221cfaa54bdc1420e6ef3c12"
304346

305347
RUN \
306-
git clone --depth 1 --branch $PHP_XDEBUG_VERSION https://github.com/xdebug/xdebug && \
348+
git init xdebug && \
307349
cd xdebug && \
350+
git fetch --depth 1 https://github.com/xdebug/xdebug $PHP_XDEBUG_COMMIT && \
351+
git checkout FETCH_HEAD && \
308352
phpize && \
309353
./configure && \
310354
make -j"$(nproc)" && make install && \

‎tests.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ commandTests:
114114
command: "php"
115115
args: ["--re", "swoole"]
116116
expectedOutput:
117-
- ".*version 6.2.0.*"
117+
- ".*version 6.2.2.*"
118118
- name: 'ZIP'
119119
command: "zip"
120120
args: ["-v"]

0 commit comments

Comments
 (0)