Security - PHP RCEs - when will packages be available?

R

richardtoohey2

Hi,

Can see the new versions hit ports very quickly, but no sign of anything in packages yet (quarterly).

The Forums message made it sound like they (forums) waiting on the pkg repo, then that changed to building from own repo.

Is there any information on when PHP binary packages will be available in quarterly/latest?

I've taken machines offline so I'd like to know roughly when I can upgrade them and bring them back online.

Thank you.
 
Its really a pitty that the build of php packages could not be prioritized in some way. All other distris have it done already.
Not everybody wants to switch to the ports on short hand, especially if the setup was pure pkg based.
 
Yes, the disparity between the updated PHP ports appearing in the ports tree (which was about 15 minutes before PHP.org itself said there would be an update) and them being available in packaged form is really something to think about for those running the pipeline.

I'm sure everybody is working their butts off, but something running 70% of websites worldwide (or so I heard) should be available in packaged form much much faster,  specifically on FreeBSD (the stable, secure server OS), even more so when there is a big push to switch to the packaged base system, which ceases to be optional one major version from now.
 
DutchDaemon said:
Yes, the disparity between the updated PHP ports appearing in the ports tree (which was about 15 minutes before PHP.org itself said there would be an update) and them being available in packaged form is really something to think about for those running the pipeline.

I'm sure everybody is working their butts off, but something running 70% of websites worldwide (or so I heard) should be available in packaged form much much faster,  specifically on FreeBSD (the stable, secure server OS), even more so when there is a big push to switch to the packaged base system, which ceases to be optional one major version from now.
Click to expand...

Right now it is an essential skill to mix individual, single ports into a pkg tree.
 
marzl said:
who has contact to "the one" who is in charge/control doing this build? Any chances to speed that up a tiny bit?
Click to expand...
There isn't any alternative mechanism in play right now other than a full build.

You could just copy custom made new php packages to the pkg mirror, but then consistency between those packages and all the other ones is uncertain. Because the git version of the ports tree is different and php would not be the only change.

I think you would have to do some git surgery. Take a ports tree of the revision that built the last full pkg collection. Merge just the php fixes from head, nothing else. Then build php and copy it over to the mirrors that have that version of the pkg collection.
 
That's something poudriere is very good at. You can just grep the php ports out of your build file, turn it into a new build file, and feed only those ports to poudriere. When those are built, you switch back to your old build file. Everything stays healthy. Meanwhile, you have your updated PHP packages in a matter of minutes.

This is not something I do routinely, by the way, but if there's something I need now and I can see that Rust has an update as well. Yeah, Rust can build later..
 
You must log in or register to reply here.
Back
Top