Merge ~athos-ribeiro/ubuntu/+source/php8.1:merge-lp1978364-kinetic into ubuntu/+source/php8.1:debian/sid

[Athos Ribeiro]

Merge for php8.1 8.1.5, as per LP: #1978364.

This also includes the patch needed to fix LP: #1975626.

Do note that php 8.1.7 was already released upstream and the package will soon be pushed to Debian unstable.

PPA: https://launchpad.net/~athos-ribeiro/+archive/ubuntu/lp1978364-merge-php-kinetic/+packages

Local dep8 test suite run result summary:

autopkgtest [01:22:43]: @@@@@@@@@@@@@@@@@@@@ summary
cli PASS
cgi PASS
mod-php PASS
fpm PASS

[Bryce Harrington (bryce)]

LGTM, +1

It looks like it builds fine in the PPA. I attempted to build locally in an LXC container but it hit a CPU spin in one of the test cases and eventually tripped the OOM killer:

    ...
    PASS gmp_setbit() basic tests [ext/gmp/tests/gmp_setbit.phpt]
    TEST 6423/15617 [ext/gmp/tests/gmp_setbit_long.php1]
    Error: websocket: close 1006 (abnormal closure): unexpected EOF

When my system came back, top was showing CPU usage up over 600! OOM killer did its job:

    [3615086.331225] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=lxc.payload.triage-kinetic,mems_allowed=0,global_oom,task_memcg=/user.slice/user-1000.slice/session-c2.scope,task=steamwebhelper,pid=859039,uid=1000
    [3615086.331260] Out of memory: Killed process 859039 (steamwebhelper) total-vm:612740kB, anon-rss:60872kB, file-rss:0kB, shmem-rss:12956kB, UID:1000 pgtables:816kB oom_score_adj:200
    [3615086.334708] oom_reaper: reaped process 859039 (steamwebhelper), now anon-rss:0kB, file-rss:0kB, shmem-rss:12952kB

I've built php many times and haven't seen a behavior like this. So I wouldn't rule it out as a fluke, esp. since the PPA seems to have built fine. But can you do a local build and autopkgtest run in an LXC container and see if anything similar happens for you? If it does, maybe file a bug report and/or disable the test.

I also triggered autopkgtests to run on launchpad and those look fine at least:

Results from https://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-athos-ribeiro-lp1978364-merge-php-kinetic/?format=plain:
  php8.1 @ amd64:
    13.06.22 22:28:46 Log 🗒️ ✅ Triggers: ['php8.1/8.1.5-1ubuntu1~ppa1']
      cli PASS ✅
      cgi PASS ✅
      mod-php PASS ✅
      fpm PASS ✅
  php8.1 @ armhf:
    13.06.22 22:38:08 Log 🗒️ ✅ Triggers: ['php8.1/8.1.5-1ubuntu1~ppa1']
      cli PASS ✅
      cgi PASS ✅
      mod-php PASS ✅
      fpm PASS ✅
  php8.1 @ ppc64el:
    13.06.22 22:31:21 Log 🗒️ ✅ Triggers: ['php8.1/8.1.5-1ubuntu1~ppa1']
      cli PASS ✅
      cgi PASS ✅
      mod-php PASS ✅
      fpm PASS ✅
  php8.1 @ s390x:
    13.06.22 22:30:09 Log 🗒️ ✅ Triggers: ['php8.1/8.1.5-1ubuntu1~ppa1']
      cli PASS ✅
      cgi PASS ✅
      mod-php PASS ✅
      fpm PASS ✅
Running:
    time pkg release arch ppa trigger
    0:24:32 php8.1 kinetic arm64 athos-ribeiro/lp1978364-merge-php-kinetic php8.1/8.1.5-1ubuntu1~ppa1
Waiting:

The merge its...

review: Approve

[Athos Ribeiro (athos-ribeiro)]

Thanks Bryce!

My local builds (and tests) are fine... I just uploaded this. Let's see how migration goes.

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: athos-ribeiro, bryce
Uploaders: athos-ribeiro, bryce
MP auto-approved

review: Approve

diff --git a/debian/changelog b/debian/changelog
index d5273e1..6686b2c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,25 @@
+php8.1 (8.1.5-1ubuntu1) kinetic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1978364). Remaining changes:
+    - Force upgrade from earlier mod-php's to version 8.1 (LP #1890263):
+      + d/control: add transitional packages and Breaks/Replaces.
+      + d/rules: exclude transitional packages in dh_install.
+    - d/rules: Don't fill up build log with pedantic warnings.
+    - d/p/0046-Update-gcc-func-attr-macro.patch: fix detection of unknown gcc
+      function attributes. (LP #1882279)
+    - d/rules: document garbage collection in ini files. (LP #1772915)
+  * Dropped changes:
+    - SECURITY UPDATE: use-after-free in php_filter_float()
+      + debian/patches/CVE-2021-21708.patch: fix int handling in
+        ext/filter/logical_filters.c, ext/filter/tests/bug81708.phpt.
+      + CVE-2021-21708
+      [ Fixed in 8.1.3-1 ]
+  * New changes:
+    - d/p/0047-Fix-ssl3-unexpected-eof.patch: fix OpenSSL3 related
+      unexpected EOF failure. (LP: #1975626)
+
+ -- Athos Ribeiro <[e-mail]>  Sat, 11 Jun 2022 00:08:45 -0300
+
 php8.1 (8.1.5-1) unstable; urgency=medium
 
   * New upstream version 8.1.5
@@ -18,6 +40,44 @@ php8.1 (8.1.3-1) unstable; urgency=medium
 
  -- Ondřej Surý <[e-mail]>  Mon, 21 Feb 2022 15:47:42 +0100
 
+php8.1 (8.1.2-1ubuntu4) kinetic; urgency=medium
+
+  * d/p/0046-Update-gcc-func-attr-macro.patch: fix detection of unknown gcc
+    function attributes. (LP: #1882279)
+  * d/rules: document garbage collection in ini files. (LP: #1772915)
+
+ -- Athos Ribeiro <[e-mail]>  Mon, 02 May 2022 19:54:49 -0300
+
+php8.1 (8.1.2-1ubuntu3) kinetic; urgency=medium
+
+  * No-change rebuild against libicu71
+
+ -- Steve Langasek <[e-mail]>  Sat, 30 Apr 2022 02:06:04 +0000
+
+php8.1 (8.1.2-1ubuntu2) jammy; urgency=medium
+
+  * d/control: Add transitional packages and Breaks/Replaces to force
+    upgrade from earlier mod-php's to version 8.1.
+    (LP: #1890263)
+  * d/rules: Don't fill up build log with pedantic warnings.
+
+ -- Bryce Harrington <[e-mail]>  Thu, 07 Apr 2022 17:46:26 +0000
+
+php8.1 (8.1.2-1ubuntu1) jammy; urgency=medium
+
+  * SECURITY UPDATE: use-after-free in php_filter_float()
+    - debian/patches/CVE-2021-21708.patch: fix int handling in
+      ext/filter/logical_filters.c, ext/filter/tests/bug81708.phpt.
+    - CVE-2021-21708
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 04 Mar 2022 13:13:46 -0500
+
+php8.1 (8.1.2-1build1) jammy; urgency=medium
+
+  * No-change rebuild for icu soname change.
+
+ -- Matthias Klose <[e-mail]>  Wed, 09 Feb 2022 09:18:22 +0100
+
 php8.1 (8.1.2-1) unstable; urgency=medium
 
   * New upstream version 8.1.2
diff --git a/debian/control b/debian/control
index e7e70f9..1c8b195 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: php8.1
 Section: php
 Priority: optional
-Maintainer: Debian PHP Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian PHP Maintainers <[e-mail]>
 Uploaders: Ondřej Surý <[e-mail]>,
            Lior Kaplan <[e-mail]>
 Build-Depends: apache2-dev (>= 2.4),
@@ -93,6 +94,8 @@ Depends: libmagic1,
 Provides: libapache2-mod-php,
           php8.1-json,
           ${php:Provides}
+Replaces: libapache2-mod-php7.4 (>> 8.1.2-1~),
+         libapache2-mod-php8.0 (>> 8.1.2-1~)
 Recommends: apache2
 Suggests: php-pear
 Description: server-side, HTML-embedded scripting language (Apache 2 module)
@@ -106,6 +109,30 @@ Description: server-side, HTML-embedded scripting language (Apache 2 module)
  open source general-purpose scripting language that is especially suited
  for web development and can be embedded into HTML.
 
+Package: libapache2-mod-php7.4
+Section: httpd
+Architecture: any
+Replaces: libapache2-mod-php7.4 (<< 7.4.3-5~)
+Breaks: libapache2-mod-php7.4 (<< 7.4.3-5~)
+Depends: libapache2-mod-php,
+         ${misc:Depends},
+         ${shlibs:Depends}
+Description: Transitional package
+ This is a transitional dummy package to libapache2-mod-php8.1.  It can
+ be safely removed and libapache2-mod-php installed instead.
+
+Package: libapache2-mod-php8.0
+Section: httpd
+Architecture: any
+Replaces: libapache2-mod-php8.0 (<< 8.0.8-2~)
+Breaks: libapache2-mod-php8.0 (<< 8.0.8-2~)
+Depends: libapache2-mod-php,
+         ${misc:Depends},
+         ${shlibs:Depends}
+Description: Transitional package
+ This is a transitional dummy package to libapache2-mod-php8.1.  It can
+ be safely removed and libapache2-mod-php installed instead.
+
 Package: libphp8.1-embed
 Architecture: any
 Depends: libmagic1,
diff --git a/debian/control.in b/debian/control.in
index 11a4d60..60be50d 100644
--- a/debian/control.in
+++ b/debian/control.in
@@ -1,7 +1,8 @@
 Source: php@PHP_VERSION@
 Section: php
 Priority: optional
-Maintainer: Debian PHP Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian PHP Maintainers <[e-mail]>
 Uploaders: Ondřej Surý <[e-mail]>,
            Lior Kaplan <[e-mail]>
 Build-Depends: apache2-dev (>= 2.4),
@@ -93,6 +94,8 @@ Depends: libmagic1,
 Provides: libapache2-mod-php,
           php@PHP_VERSION@-json,
           ${php:Provides}
+Replaces: libapache2-mod-php7.4 (>> 8.1.2-1~),
+         libapache2-mod-php8.0 (>> 8.1.2-1~)
 Recommends: apache2
 Suggests: php-pear
 Description: server-side, HTML-embedded scripting language (Apache 2 module)
@@ -106,6 +109,30 @@ Description: server-side, HTML-embedded scripting language (Apache 2 module)
  open source general-purpose scripting language that is especially suited
  for web development and can be embedded into HTML.
 
+Package: libapache2-mod-php7.4
+Section: httpd
+Architecture: any
+Replaces: libapache2-mod-php7.4 (<< 7.4.3-5~)
+Breaks: libapache2-mod-php7.4 (<< 7.4.3-5~)
+Depends: libapache2-mod-php,
+         ${misc:Depends},
+         ${shlibs:Depends}
+Description: Transitional package
+ This is a transitional dummy package to libapache2-mod-php8.1.  It can
+ be safely removed and libapache2-mod-php installed instead.
+
+Package: libapache2-mod-php8.0
+Section: httpd
+Architecture: any
+Replaces: libapache2-mod-php8.0 (<< 8.0.8-2~)
+Breaks: libapache2-mod-php8.0 (<< 8.0.8-2~)
+Depends: libapache2-mod-php,
+         ${misc:Depends},
+         ${shlibs:Depends}
+Description: Transitional package
+ This is a transitional dummy package to libapache2-mod-php8.1.  It can
+ be safely removed and libapache2-mod-php installed instead.
+
 Package: libphp@PHP_VERSION@-embed
 Architecture: any
 Depends: libmagic1,
diff --git a/debian/patches/0046-Update-gcc-func-attr-macro.patch b/debian/patches/0046-Update-gcc-func-attr-macro.patch
new file mode 100644
index 0000000..cb8ea57
--- /dev/null
+++ b/debian/patches/0046-Update-gcc-func-attr-macro.patch
@@ -0,0 +1,29 @@
+From df0894ad1a8195df67a52108b931e07d708cec9a Mon Sep 17 00:00:00 2001
+From: Ming Chen <[e-mail]>
+Date: Mon, 2 Mar 2020 09:40:36 +0800
+Subject: ax_gcc_func_attribute: Revise the detection of unknown attributes
+
+GCC outputs a warning when Wstrict-prototypes is on, in such case the
+attribute detection always fails even if the attribute is actually
+supported. This change checks for the "-Wattributes" warning in
+conftest.err instead of the existence of the file.
+
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/php8.1/+bug/1882279
+Forwarded: https://github.com/php/php-src/pull/8483
+Origin: http://git.savannah.gnu.org/gitweb/?p=autoconf-archive.git;a=commitdiff;h=df0894ad1a8195df67a52108b931e07d708cec9a
+Last-Update: 2022-05-02
+---
+ build/ax_gcc_func_attribute.m4 | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/build/ax_gcc_func_attribute.m4
++++ b/build/ax_gcc_func_attribute.m4
+@@ -227,7 +227,7 @@
+             dnl GCC doesn't exit with an error if an unknown attribute is
+             dnl provided but only outputs a warning, so accept the attribute
+             dnl only if no warning were issued.
+-            [AS_IF([test -s conftest.err],
++            [AS_IF([grep -- -Wattributes conftest.err],
+                 [AS_VAR_SET([ac_var], [no])],
+                 [AS_VAR_SET([ac_var], [yes])])],
+             [AS_VAR_SET([ac_var], [no])])
diff --git a/debian/patches/0047-Fix-ssl3-unexpected-eof.patch b/debian/patches/0047-Fix-ssl3-unexpected-eof.patch
new file mode 100644
index 0000000..257ee76
--- /dev/null
+++ b/debian/patches/0047-Fix-ssl3-unexpected-eof.patch
@@ -0,0 +1,76 @@
+From 74f75db0c3665677ec006cd379fd561feacffdc6 Mon Sep 17 00:00:00 2001
+From: Jakub Zelenka <[e-mail]>
+Date: Sun, 15 May 2022 13:49:17 +0100
+Subject: Fix bug #79589: ssl3_read_n:unexpected eof while reading
+
+The unexpected EOF failure was introduced in OpenSSL 3.0 to prevent
+truncation attack. However there are many non complaint servers and
+it is causing break for many users including potential majority
+of those where the truncation attack is not applicable. For that reason
+we try to keep behavior consitent with older OpenSSL versions which is
+also the path chosen by some other languages and web servers.
+
+Closes GH-8369
+
+Bug: https://github.com/php/php-src/issues/8369
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/php8.1/+bug/1975626
+Last-Update: 2022-06-11
+Origin: upstream, https://github.com/php/php-src/commit/74f75db0c3665677ec006cd379fd561feacffdc6
+---
+ NEWS                            |  4 ++++
+ ext/openssl/tests/bug79589.phpt | 21 +++++++++++++++++++++
+ ext/openssl/xp_ssl.c            |  5 +++++
+ 3 files changed, 30 insertions(+)
+ create mode 100644 ext/openssl/tests/bug79589.phpt
+
+--- a/NEWS
++++ b/NEWS
+@@ -37,6 +37,10 @@
+ - Sockets:
+   . Fixed Solaris builds. (David Carlier)
+ 
++- OpenSSL:
++  . Fixed bug #79589 (error:14095126:SSL routines:ssl3_read_n:unexpected eof
++    while reading). (Jakub Zelenka)
++
+ - SPL:
+   . Fixed bug GH-8121 (SplFileObject - seek and key with csv file inconsistent).
+     (cmb)
+--- /dev/null
++++ b/ext/openssl/tests/bug79589.phpt
+@@ -0,0 +1,21 @@
++--TEST--
++Bug #65538: TLS unexpected EOF failure
++--EXTENSIONS--
++openssl
++--SKIPIF--
++<?php
++if (getenv("SKIP_ONLINE_TESTS")) die("skip online test");
++?>
++--FILE--
++<?php
++
++$release = file_get_contents(
++    'https://chromedriver.storage.googleapis.com/LATEST_RELEASE',
++    false,
++    stream_context_create(['ssl' => ['verify_peer'=> false]])
++);
++echo gettype($release);
++
++?>
++--EXPECT--
++string
+--- a/ext/openssl/xp_ssl.c
++++ b/ext/openssl/xp_ssl.c
+@@ -1648,6 +1648,11 @@
+ 
+ 	ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
+ 
++#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF
++	/* Only for OpenSSL 3+ to keep OpenSSL 1.1.1 behavior */
++	ssl_ctx_options |= SSL_OP_IGNORE_UNEXPECTED_EOF;
++#endif
++
+ 	if (!GET_VER_OPT("disable_compression") || zend_is_true(val)) {
+ 		ssl_ctx_options |= SSL_OP_NO_COMPRESSION;
+ 	}
diff --git a/debian/patches/series b/debian/patches/series
index 51a1c37..5e997e9 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -43,3 +43,5 @@
 0043-Lower-the-OpenSSL-requirement-to-1.0.1.patch
 0044-Fail-the-build-when-the-dtrace-call-fails.patch
 0045-Override-result-of-AC_PROG_LN_S-to-fix-FTBFS-on-ppc6.patch
+0046-Update-gcc-func-attr-macro.patch
+0047-Fix-ssl3-unexpected-eof.patch
diff --git a/debian/rules b/debian/rules
index e2bcac1..c81f742 100755
--- a/debian/rules
+++ b/debian/rules
@@ -138,7 +138,7 @@ ifeq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
 else
   DEB_CFLAGS_MAINT_APPEND += -O0
 endif
-DEB_CFLAGS_MAINT_APPEND += -Wall -pedantic -fsigned-char -fno-strict-aliasing 
+DEB_CFLAGS_MAINT_APPEND += -Wall -fsigned-char -fno-strict-aliasing
 DEB_CFLAGS_MAINT_APPEND += $(shell getconf LFS_CFLAGS)
 
 # OpenSSL 3.0 support
@@ -260,6 +260,16 @@ BUILTIN_EXTENSION_CHECK=$$e=get_loaded_extensions(); natcasesort($$e); \
 			foreach($$e as $$i) { $$s .= " $$i"; } \
 			echo("php:Extensions=" . wordwrap($$s . ".\n", 75, "\$${Newline}"));
 
+# Document garbage collection procedure
+define GC_PROBABILITY_DOC
+; Debian Default Value: 1\n;\
+This is disabled in the Debian packages due to the strict permissions\n;\
+on /var/lib/php. Instead, GC is performed through /etc/cron.d/php,\n;\
+which uses the session.gc_maxlifetime setting. Please, check\n;\
+/usr/share/doc/$(PHP_COMMON)/README.Debian.gz for further reference.
+endef
+export GC_PROBABILITY_DOC
+
 include $(CURDIR)/debian/rules.d/*.mk
 
 #extensions
@@ -502,7 +512,7 @@ override_dh_install-arch: remove-files-stamp prepare-fpm-pools
 	install -d -m 755 debian/tmp/usr/lib/cgi-bin/
 	ln debian/tmp/usr/bin/php-cgi$(PHP_NAME_VERSION) debian/tmp/usr/lib/cgi-bin/php$(PHP_NAME_VERSION)
 
-	dh_install --fail-missing
+	dh_install --fail-missing --exclude=libapache2-mod-php7.4 --exclude=libapache2-mod-php8.0
 
 # Install a helper script for checking PHP FPM configuration
 	mkdir -p debian/$(PHP_FPM)/usr/lib/php/
@@ -512,6 +522,7 @@ override_dh_install-arch: remove-files-stamp prepare-fpm-pools
 	mkdir -p debian/$(PHP_COMMON)/usr/lib/php/$(PHP_NAME_VERSION)/
 	cat php.ini-production | tr "\t" " " | \
 	$(SED) -e'/session.gc_probability =/ s/1/0/g;' \
+	    -e"/session.gc_probability =/i $${GC_PROBABILITY_DOC}" \
 	    -e'/disable_functions =/ s/$$/ $(PCNTL_FUNCTIONS)/g;' \
 	    -e'/expose_php =/ s/On/Off/g;' \
 	  > debian/$(PHP_COMMON)/usr/lib/php/$(PHP_NAME_VERSION)/php.ini-production
@@ -519,10 +530,12 @@ override_dh_install-arch: remove-files-stamp prepare-fpm-pools
 	cat php.ini-production | tr "\t" " " | \
 	$(SED) -e'/memory_limit =/ s/128M/-1/g;' \
 	    -e'/session.gc_probability =/ s/1/0/g' \
+	    -e"/session.gc_probability =/i $${GC_PROBABILITY_DOC}" \
 	  > debian/$(PHP_COMMON)/usr/lib/php/$(PHP_NAME_VERSION)/php.ini-production.cli
 
 	cat php.ini-development | tr "\t" " " | \
 	$(SED) -e'/session.gc_probability =/ s/1/0/g;' \
+	    -e"/session.gc_probability =/i $${GC_PROBABILITY_DOC}" \
 	    -e'/disable_functions =/ s/$$/ $(PCNTL_FUNCTIONS)/g;' \
 	  > debian/$(PHP_COMMON)/usr/lib/php/$(PHP_NAME_VERSION)/php.ini-development