Repository navigation
Rebuild standalone binaries with a maintained OpenSSL line #67
Description
Finding
The current published CLI 2.3.1 standalone binaries do not have one consistent, maintained OpenSSL boundary.
Read-only inspection of the exact public assets on 2026-10-30 found:
- every downloaded asset matches its public
SHA256SUMSentry; dw-linux-x86_64anddw-linux-aarch64are stripped, statically linked executables and both containOpenSSL 3.6.2pluslibcurl/8.23.0;dw-macos-aarch64contains the sameOpenSSL 3.6.2andlibcurl/8.23.0identities;dw-windows-x86_64.execontainsOpenSSL 3.6.5; the release source deliberately omits ext-curl on Windows and uses Symfony streams over OpenSSL;- the exact release workflow pins PHP 8.4.27 and static-php-cli 2.8.5 at revision
4318ef8fa32a02460ec1554746674a7bc42b49fa; the existing runtime guards prove PHP and extensions but do not assert the embedded OpenSSL/libcurl versions; - a current Composer 2.10.3 audit of the exact
2.3.1lock reports zero advisories and zero abandoned packages.
OpenSSL 3.6.3, 3.6.4, and 3.6.5 are security patch releases after the embedded 3.6.2. The later fixes include high-severity CVE-2026-45447 and CVE-2026-84782 plus moderate and low findings. No CLI path was identified for the high-severity PKCS#7 or DTLS-specific defects, and no exploitation or customer impact was observed. The CLI does make outbound TLS connections, so the static TLS dependency remains a real runtime component rather than unused build inventory.
OpenSSL lists 3.6.5 as the final current 3.6 patch and the 3.6 line as supported only through 2026-11-01. OpenSSL 3.5 is the current LTS line through 2030. Primary references:
- https://openssl-library.org/news/openssl-3.6-notes/
- https://openssl-library.org/news/vulnerabilities-3.6/
- https://openssl-library.org/source/
The generic Trivy filesystem scan reported zero language-specific inputs because it cannot inventory the embedded static PHP runtime. That zero is a scanner coverage limit, not a clean dependency result.
This is existing released-surface maintenance. It does not require an emergency rollback, does not block unrelated Server/Rust/SDK work, and requires no operator action, but the next CLI standalone release should not preserve this dependency state.
Required correction
- Rebuild every standalone target with a supported OpenSSL line containing all applicable fixes, preferably OpenSSL 3.5 LTS at 3.5.9 or later. Do not publish another standalone release on OpenSSL 3.6 after its support end.
- Keep Linux, Linux arm64, macOS, and Windows aligned on the selected supported policy unless a documented platform constraint requires a different supported version.
- Preserve PHP 8.4.27 or a newer supported PHP patch, libcurl 8.23.0 or later where ext-curl is shipped, the pinned static-php-cli/toolchain checks, cache-identity binding, checksums, provenance, and immutable old assets.
- Make the cache identity include the selected OpenSSL dependency policy so an older phpmicro cache cannot silently satisfy the new build.
- Extend the produced-runtime evidence and release tests to fail closed on the exact embedded OpenSSL version and support floor on all four targets; retain the existing PHP and extension guards.
- Publish through the normal protected release path. Verify every public binary, checksum, attestation, installer path, runtime version, OpenSSL identity, and normal outbound HTTPS behavior before closing.
- Add a compact static-dependency inventory or SBOM sufficient for future advisory monitoring; do not treat a generic scanner zero as proof that embedded libraries are absent.
Preserve 2.3.1 unchanged for rollback and provenance verification; do not retag or replace its assets.
Current delivery
CLI 2.3.2 is published from a0bfe5967a6296de735eddca3a3ffbbfe3ed6817 through the normal successful release producer. #68 implements the supported dependency policy; #69 exercises actual native HTTPS before artifact handoff/publication.
All four native cold builds and trusted warm-cache release builds pass their runtime and HTTPS checks. All 14 public assets were downloaded; all 13 checksum entries and all four published runtime inventories pass. Each standalone target reports PHP 8.4.27 and OpenSSL 3.5.9 for loaded library and headers. Unix targets report libcurl 8.23.0 using that same OpenSSL backend; Windows retains streams.
All 14 exact-source/tag/workflow/hosted cryptographic attestation checks pass. Independent fresh no-PHP Linux installation, command discovery and normal public HTTPS upgrade metadata pass with current/target 2.3.2. Final acceptance receipt. Existing 2.3.1 remains unchanged.
Activity
rmcdaniel commentedon Oct 30, 2026
Implementation-narrowing evidence: the exact 2.3.1 release uses static-php-cli 2.8.5, published April 18, at pinned revision
4318ef8f, and invokesspc download ... --prefer-pre-built. That SPC revision marks OpenSSL asprovide-pre-built; its documented behavior is to prefer those precompiled library inputs. The resulting October cold-cache build and release binaries still contain OpenSSL 3.6.2 even though 3.6.5 had been available since September 29.The current phpmicro cache identity hashes the SPC version/revision, PHP version, extension list, runner/toolchain identities, prerequisite script, and release workflow, but not the resolved OpenSSL version/source digest. Merely expiring or rebuilding the cache with the same preference is therefore not a sufficient fail-closed correction.
A robust implementation should select an exact supported OpenSSL source or verified prebuilt input, verify its official digest before build use, record the version+digest in retained evidence, and include that identity in the phpmicro cache key/manifest. Static-php-cli documents that
config/source.jsoncontrols source resolution and may be overridden; an exact committed source policy is preferable to its dynamic latest-release selection for reproducible release builds. Keep 3.5.9+ LTS as the default target unless qualification proves a different supported line is required. This comment is implementation guidance, not a second gate or a source assignment.rmcdaniel commentedon Oct 30, 2026
Implementation path is available without abandoning SPC's prebuilt cache for every library:
4318ef8,download --custom-urlis processed before--prefer-pre-built. Supplying an exactopenssl:URL therefore forces only OpenSSL to source while the other eligible libraries can remain prebuilt.603f5602e2eef00d77fbd429d34dcd5822bb301757a1bc9cdb24c670f1eb859aforopenssl-3.5.9.tar.gz.spc download, resolve theopensslfilename fromdownloads/.lock.json, require the exact expected basename, and compare its SHA-256 with the pinned official value before any build. Do this on Linux, macOS and Windows.This avoids the short-lived 3.6 line and makes the actual library source/digest part of both build authority and cache provenance. Primary references: OpenSSL downloads/lifecycle and SPC DownloadCommand at the pinned revision.
rmcdaniel commentedon Oct 31, 2026
Source correction merged through #68 as
008eae24cc7cea8fba4e2df8b62bab5cf67e1724. All 16 reviewed-head checks pass, including PHP 8.2–8.5, reproducible PHAR, CodeQL and Sonar. The nine initial analyzer findings were corrected in code; current analysis reports zero new/accepted issues and zero hotspots, without changing gates or rules.The source policy pins OpenSSL 3.5.9 LTS at official SHA-256
603f5602e2eef00d77fbd429d34dcd5822bb301757a1bc9cdb24c670f1eb859a. A real, checksum-verified SPC 2.8.5 invocation with prebuilt preference fetched OpenSSL from that custom source URL, and the new guard accepted the actual archive and download lock. The produced-runtime guard checks the loaded OpenSSL library separately from headers, plus the Unix libcurl version/backend and Windows streams boundary. Per-target dependency inventories enter the normal required-asset/checksum/attestation path.Local validation: 38 Node release contracts pass, full PHP 921 tests / 17,396 assertions (11 existing deprecations, one skip), affected release contracts 15/384, parsed workflow YAML and actual library-probe output. The local probe validates extraction; it is not native micro-runtime qualification.
The normal main-branch four-target cache warmer is running. No 2.3.2 tag or release is published. Next: qualify native cold/warm runtimes, then publish the ordinary patch and verify public assets, inventories, checksums, attestations, installers and outbound HTTPS. Keep #67 open through that installed acceptance; 2.3.1 stays immutable.
rmcdaniel commentedon Oct 31, 2026
Delivered CLI 2.3.2 from
a0bfe5967a6296de735eddca3a3ffbbfe3ed6817; normal release producer passed and publication completed at 08:02:11 UTC on October 31..dependencies.jsoninventories match that runtime policy. Cryptographic verification passes for all 14 assets including SHA256SUMS, requiring repositorydurable-workflow/cli, signer.github/workflows/release.yml, exact source digesta0bfe5967a6296de735eddca3a3ffbbfe3ed6817,refs/tags/2.3.2, and GitHub-hosted runners.readywith installed/active version 2.3.2, lists commands, and completes normalupgrade --dry-run --output=jsonthrough public HTTPS withstatus: noop, current/target 2.3.2. An initial custom-directory test also confirmed the documentednot-on-pathdiagnostic; adding that directory to PATH producesready.OpenSSL lists the 3.5 LTS support line through April 8, 2030. This release provides a compact static runtime dependency inventory; generic language-scanner absence is not used as TLS evidence. Existing 2.3.1 tags/assets remain unchanged. No protocol or SDK change is needed.
Acceptance completed 2026-10-31 08:20 UTC. Task-owned worktree, ignored caches, disposable consumer image, bulk downloads/tools and both verified merged remote heads have been removed. No task containers remain. Hosted producer logs and public checksummed/attested inventories remain the evidence.