Repository navigation
Build standalone CLI binaries with patched PHP 8.4 #65
Description
Problem
The current customer-installable standalone CLI binaries bundle PHP 8.4.23. The public 2.3.0 Linux x86_64 binary identifies its embedded runtime as micro SAPI for PHP8.4.23, and the exact release workflow pins PHP_VERSION: '8.4.23' for Linux/macOS and PHP_VERSION_WINDOWS: '8.4.23' for Windows. Current protected main still carries both pins.
PHP's October 2026 critical advisories fix CVE-2026-109618 and CVE-2026-109619 at PHP 8.4.27:
Reachability and urgency
This version match is real, but it is not evidence that CLI 2.3.0 is remotely exploitable or compromised. The confirmed upstream exploit chains rely on web-request startup/shutdown or multiple requests handled by a persistent web worker. The standalone dw binaries execute one CLI/micro-SAPI invocation and expose no inbound HTTP listener. dw server:start-dev launches the project's external php artisan serve; it does not turn the embedded runtime into a web SAPI. The portable PHAR also uses the operator's external PHP rather than the bundled runtime.
An application-specific OOM path from untrusted input cannot be categorically excluded, and there is no reason for the next standalone binaries to keep shipping a known-vulnerable PHP core after a supported fixed release exists. Treat this as existing-surface release hardening, not an incident, emergency 2.3.0 rewrite, unrelated development gate, or operator action.
Acceptance
- Raise both standalone build pins to PHP 8.4.27 or a newer supported 8.4 patch release; keep Linux, macOS, and Windows aligned unless a documented platform constraint requires otherwise.
- Preserve the pinned static-php-cli toolchain and checksum controls. Confirm the existing cache identity changes with the PHP version so no 8.4.23 micro runtime can be reused.
- Add a fail-closed build assertion that the produced micro runtime is at or above the selected fixed floor before it is combined with the PHAR, on every platform.
- Qualify all four standalone targets, the portable PHAR, installer/checksum behavior, release handoff, and provenance without weakening the existing release boundary.
- Publish through the normal protected release process at the owning release checkpoint. Verify the public binaries report the patched embedded runtime and retain exact-source checksums/attestations.
Do not mutate the existing 2.3.0 tag or assets. The current release remains usable under the bounded CLI-only reachability described above; this issue owns the corrected next standalone release.
Delivered
Published and verified in 2.3.1, exact source 03ec028a97c7ed5771735635526563be1e684c0d. Complete acceptance receipt covers all four cold/warm micro guards, packaged native/PHAR/launcher qualification, protected release/handoff, public checksums and installers, and cryptographic exact-source attestations for all ten assets. Existing 2.3.0 tag/assets were compared before and after and remain unchanged. No remaining work under this issue.
Activity
rmcdaniel commentedon Oct 27, 2026
Maintainer handoff accepted: Cloud owns the supported PHP pin correction and fail-closed produced-runtime checks through all four protected standalone targets, portable PHAR/installer/checksum/provenance qualification, normal publication and installed public-binary acceptance. No source or release change has been made yet. Preserve the existing 2.3.0 tag/assets and release boundary.
rmcdaniel commentedon Oct 27, 2026
Delivered and verified in CLI 2.3.1, October 27, 2026.
03ec028a97c7ed5771735635526563be1e684c0d, passed the full PHP 8.2–8.5 matrix, PHAR smoke/reproducibility, central policy, boundary, CodeQL and Sonar checks. The new workflow regression also rejects the previous workflow without the runtime guard.PHP runtime: 8.4.27 (micro)and all required extensions pass. Both pinned-version and default-channel public installs reportready, CLI 2.3.1 and that patched runtime. The public PHAR reports the exact version/source and lists commands correctly under external PHP 8.3.36.refs/tags/2.3.1, release workflow and hosted-runner requirement matched. The current repository API association was checked separately for every asset. No TLS, signature or identity check was disabled.4b85e83afab358f65526bc78837eca855fae1858resolves to that exact qualified commit. The existing maintainer tag-creation exception was recorded; no qualification settings or history were changed. Pre/post comparison confirms the existing 2.3.0 tag and every old asset ID, digest, size and timestamp are unchanged.The four native platforms executed their checks on their respective hosted runners. Independent post-publication execution here covered Linux and the portable PHAR; the other downloaded binaries are bound to the qualified builds by their exact checksums and verified provenance.
dw-linux-x86_6492b7108a2f54573e9ef14c10e59fc58e3268e8b5c62cc8d998a6ec9dab25e290dw-linux-aarch642172d53261d40b8098bbde8dcbc7e8e804c930b46e6298d24e93a7199b885bdddw-macos-aarch644d2a0280b04daa00f9a8c40b66ab622bbf19f76d2a7ce38463897e700843e98ddw-windows-x86_64.exe984737e772dc38aa35d45f26604a04795360f552033b86ed058a3052f4437d94dw.phar30a95433cd06d3bd79aa17d750ad89e06ccf2d037ff883241533906b6069a2ecAll acceptance criteria are complete.
rmcdaniel commentedon Oct 27, 2026
Security accepts closure. The earlier independent publication review verified the exact protected run/tag binding, all ten public assets, the nine checksum entries, and the complete attestation subject/digest set. Cloud final receipt 6438766219 closes the one remaining evidence gap with fresh-TUF/offline cryptographic verification for every subject, including repository/owner identity, exact source and signer commit, tag, workflow, hosted runner, transparency timestamp, and current API association. The public Linux runtime and both installer paths prove PHP 8.4.27/micro; all four packaged targets passed their native hosted guards, and 2.3.0 remains unchanged. No Security hold or operator action remains.