Security - PHP RCEs - when will packages be available?

R

richardtoohey2

Hi,

Can see the new versions hit ports very quickly, but no sign of anything in packages yet (quarterly).

The Forums message made it sound like they (forums) waiting on the pkg repo, then that changed to building from own repo.

Is there any information on when PHP binary packages will be available in quarterly/latest?

I've taken machines offline so I'd like to know roughly when I can upgrade them and bring them back online.

Thank you.
 
Its really a pitty that the build of php packages could not be prioritized in some way. All other distris have it done already.
Not everybody wants to switch to the ports on short hand, especially if the setup was pure pkg based.
 
Yes, the disparity between the updated PHP ports appearing in the ports tree (which was about 15 minutes before PHP.org itself said there would be an update) and them being available in packaged form is really something to think about for those running the pipeline.

I'm sure everybody is working their butts off, but something running 70% of websites worldwide (or so I heard) should be available in packaged form much much faster,  specifically on FreeBSD (the stable, secure server OS), even more so when there is a big push to switch to the packaged base system, which ceases to be optional one major version from now.
 
DutchDaemon said:
Yes, the disparity between the updated PHP ports appearing in the ports tree (which was about 15 minutes before PHP.org itself said there would be an update) and them being available in packaged form is really something to think about for those running the pipeline.

I'm sure everybody is working their butts off, but something running 70% of websites worldwide (or so I heard) should be available in packaged form much much faster,  specifically on FreeBSD (the stable, secure server OS), even more so when there is a big push to switch to the packaged base system, which ceases to be optional one major version from now.
Click to expand...

Right now it is an essential skill to mix individual, single ports into a pkg tree.
 
marzl said:
who has contact to "the one" who is in charge/control doing this build? Any chances to speed that up a tiny bit?
Click to expand...
There isn't any alternative mechanism in play right now other than a full build.

You could just copy custom made new php packages to the pkg mirror, but then consistency between those packages and all the other ones is uncertain. Because the git version of the ports tree is different and php would not be the only change.

I think you would have to do some git surgery. Take a ports tree of the revision that built the last full pkg collection. Merge just the php fixes from head, nothing else. Then build php and copy it over to the mirrors that have that version of the pkg collection.
 
That's something poudriere is very good at. You can just grep the php ports out of your build file, turn it into a new build file, and feed only those ports to poudriere. When those are built, you switch back to your old build file. Everything stays healthy. Meanwhile, you have your updated PHP packages in a matter of minutes.

This is not something I do routinely, by the way, but if there's something I need now and I can see that Rust has an update as well. Yeah, Rust can build later..
 
where do you see things are moving ? This is really bad, for such a great, critical and _secure_ OS , to have critical software missing 12h after the fix was published
 
Hi,

I have various servers FreeBSD 15.1 updated, but


# pkg upgrade

Not show updates for PHP, my systems have 8.5.11

Early in the morning I closed web ports (80, 443 TCP with PF)

Any news about the update release?

P.D.:
In my OpenBSD the PHP is ready released and installed.
 
Prime your pkg repo by going from quarterly to latest.
What version are you on:
pkg -vv | grep url

Are you on quarterly? Switch to Latest

Other random advise while you wait for binaries:
  • Compile you own! For Core services, you can compile from ports.
  • Wait! Less used services, you can disable and wait for the package.
  • Compile once make you own pkg! pkg create
 
yes
Rudy said:
Core services, you can compile from ports. Less used services, you can disable and wait for package. Or, if all your hardware is the 'same' you can create you own package:
pkg create


Prime your pkg repo by going from quarterly to latest.
What version are you on:
pkg -vv | grep url

Are you on quarterly? Switch to Latest
Click to expand...

yes, on latest 14.5..

Repositories:
FreeBSD: {
url : "pkg+https://pkg.freebsd.org/FreeBSD:14:amd64/latest",
enabled : yes,
priority : 0,
mirror_type : "SRV",
signature_type : "FINGERPRINTS",
fingerprints : "/usr/share/keys/pkg"
}
FreeBSD-kmods: {
url : "pkg+https://pkg.freebsd.org/FreeBSD:14:amd64/kmods_quarterly_4",
enabled : yes,
priority : 0,
mirror_type : "SRV",
signature_type : "FINGERPRINTS",
fingerprints : "/usr/share/keys/pkg"
}
 
You must log in or register to reply here.
Back
Top